candor-ts 0.35.0 → 0.36.1

package/scan.mjs

@@ -48,7 +48,7 @@ const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 // literal stamped into the envelope's `spec` field, so the doc lines and the report can never drift.
 // Reused, never re-littered.
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(ENGINE_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.35";
+const SPEC_VERSION = "0.36";
 
 // A TREE TOO DEEP TO WALK IS "COULD NOT EVALUATE" (exit 2), NEVER "FOUND A VIOLATION" (exit 1).
 //
@@ -207,6 +207,14 @@ const CONFIG_KEYS_IMPLEMENTED = new Set(["policy", "baseline", "deps", "unknown-
 // It carries its own `prefix` because §3.3.1's direct-file locator accepts any `.json` name whatever its
 // dot-segments: a consumer handed one file cannot recover the prefix from the filename.
 let refusalPrefix = null, refusalTarget = null;
+// The flags the parse loop accepts WITHOUT a value. A target may legitimately follow one of these
+// (`candor-ts --json .`), so they are not stopping points; the value-taking flags are skipped by the
+// arm above, and anything else dash-shaped is what that loop calls an unknown flag. `-h`/`-V`/
+// `--help`/`--version` are print-and-exit modes consumed before this walk and are listed for symmetry.
+const KNOWN_VALUELESS_FLAGS = new Set([
+  "--agents", "--json", "--allow-js", "--workspace", "--deps", "--dep-inits",
+  "--peek-excluded", "-h", "-V", "--help", "--version",
+]);
 const noteRefusalPrefix = (pfx) => { if (refusalPrefix === null) refusalPrefix = pfx; };
 const noteRefusalTarget = (t)   => { if (refusalTarget === null) refusalTarget = t; };
 const writeRefusalMarker = (why) => {
@@ -239,6 +247,7 @@ const clearRefusalMarker = () => {
 //      deleting the question.
 const preScan = (av) => {
   let gate = null, policy = null, target = null, out = null, refused = false;
+  let stopped = false, markerTarget = null;
   for (let i = 0; i < av.length; i++) {
     const a = av[i], v = av[i + 1];
     if (a === "--gate-json" || a === "--policy" || a === "--out") {
@@ -264,11 +273,23 @@ const preScan = (av) => {
       i++;
       continue;
     }
+    // ⟨0.32⟩ A TOKEN THE PARSE LOOP WOULD REFUSE STOPS THE MARKER TARGET, BUT NOT THE GUARD TARGET.
+    // The two consumers of this walk want opposite things and used to share one variable. `target`
+    // feeds the input GUARDS, where the comment above is right that over-collecting can only protect a
+    // file more. `markerTarget` feeds the ⟨0.32⟩ refusal MARKER's prefix, where over-collecting is a
+    // WRITE: measured, `candor-ts --scope src` resolved `src` — the rejected flag's operand — and the
+    // marker was written to `src/.candor/`, creating that directory in the operator's tree. The parse
+    // loop never reaches that token; it refuses at `--scope`. candor-rust had the same defect on a
+    // different argv (SOUNDNESS R232); candor-swift writes nothing here and is the shape to match.
+    if (a.startsWith("-") && !KNOWN_VALUELESS_FLAGS.has(a)) stopped = true;
     // The scan TARGET, needed to discover the `.candor/config` whose `policy` key may name an input
     // this sink must not overwrite.
-    if (!a.startsWith("-") && target === null) { target = a; noteRefusalTarget(a); }
+    if (!a.startsWith("-") && target === null) {
+      target = a;
+      if (!stopped && !refused) { markerTarget = a; noteRefusalTarget(a); }
+    }
   }
-  return { gate, policy, target, out };
+  return { gate, policy, target, out, markerTarget };
 };
 
 // SPEC §3.3.1 ⟨0.28⟩ — every `--gate-json` this argv names. `preScan` keeps only the last, which is what
@@ -514,7 +535,7 @@ const preGateSink = preScan(argv).gate;
 // The raw target is used rather than the resolved root: they coincide for a directory target, and being
 // slightly wrong about WHERE costs a marker nobody reads, while being late costs the marker entirely.
 {
-  const preT = preScan(argv).target;
+  const preT = preScan(argv).markerTarget;
   if (preT) { noteRefusalTarget(preT); noteRefusalPrefix(path.join(preT, ".candor", "report")); }
 }
 // ⟨0.28⟩ SPEC §3.3.1 (4) — THE SAME RULE ONE HOP UPSTREAM, FOR THE REPORT STREAM. `--json` is the
@@ -2408,9 +2429,22 @@ const reassignedIn = (sf) => {
 // identity is the binding the type literal belongs to: ConstructSignature -> TypeLiteral -> Variable-
 // Declaration. Returns "" for a `class`-declared constructor (whose parent is a ClassDeclaration) and for
 // anything else, so a caller can treat "" as "this mechanism cannot answer".
+//
+// R136 — …AND THE INTERFACE SPELLING, which is the second half of the same question. The lib files use
+// BOTH shapes for a constructible global: `declare var WebSocket: { new (…): WebSocket }` (an anonymous
+// type literal) and `declare var Date: DateConstructor; interface DateConstructor { new (): Date }` (a
+// NAMED interface). Only the first was walked, so every declaration-keyed branch saw `""` for the second
+// and a `Date` reached through an inherited constructor could not be named. Both parents are the binding
+// the construct signature belongs to; which one the lib author chose is not a fact about the program.
+// Still returns "" for a `class`-declared constructor (parent is a ClassDeclaration) and for anything
+// else. Callers use the answer ONLY to ADD a name to a denylist they already hold, never to remove one,
+// so widening the walk can over-charge and can never silence.
 function declaredCtorClassName(decl) {
-  const tl = decl && decl.parent;
-  const vd = tl && ts.isTypeLiteralNode(tl) ? tl.parent : null;
+  const owner = decl && decl.parent;
+  if (owner && ts.isInterfaceDeclaration(owner)) {
+    return owner.name && ts.isIdentifier(owner.name) ? owner.name.text : "";
+  }
+  const vd = owner && ts.isTypeLiteralNode(owner) ? owner.parent : null;
   return vd && ts.isVariableDeclaration(vd) && vd.name && ts.isIdentifier(vd.name) ? vd.name.text : "";
 }
 // R130 — `super(...)`. It is a CallExpression, not a NewExpression, so `ts.isNewExpression` is false and
@@ -3176,7 +3210,7 @@ const classOverrides = new Map();// base-method MemberDeclaration node -> overri
 const classDescendants = new Map();// base ClassDeclaration -> transitive LOCAL subclass ClassDeclarations (coercion-CHA)
 // `Object.defineProperty(target, key, { get/set })` runtime accessors (the silent-pure defineProperty
 // hole): the TS checker types `target.key` as a plain DATA property (defineProperty is a runtime
-// construct), so `accessorAt` finds no get-accessor and the forcing site `target.key` reads
+// construct), so `accessorsAt` finds no get-accessor and the forcing site `target.key` reads
 // silent-pure. We index, keyed by the TARGET's symbol → key string → { get, set } descriptor function
 // node, every such accessor seen in the project. The forcing-site arm consults this when the type-level
 // accessor resolution comes up empty (precise edge when target+key resolve; else honest Unknown).
@@ -4275,73 +4309,322 @@ for (const sf of sources) {
 // when the accessor's declaration lives in a project file (a UNIT we minted; edge to it). A resolved
 // accessor we CAN'T see (external/typed-only declaration) returns local:false so the caller follows
 // the existing Unknown/curated-κ posture — never silent-pure for a resolved-but-unseen accessor.
-// A property SYMBOL → its accessor declaration of the wanted kind (or null). `local` is true when that
-// declaration lives in a project file (a unit we minted; edge to it). Shared by every property-read
-// shape: dot access, element access, and object destructuring.
-function accessorFromSym(sym, kind /* "get" | "set" */) {
-  if (!sym) return null;
+// A property SYMBOL → EVERY accessor declaration of the wanted kind (a possibly-empty list). `local` is
+// true when that declaration lives in a project file (a unit we minted; edge to it). Shared by every
+// property-read shape: dot access, element access, and object destructuring.
+//
+// EVERY DECLARATION, NOT THE FIRST — this was a `.find`, and on a UNION-TYPED RECEIVER that is a silent
+// under-report chosen by declaration order. TypeScript synthesizes ONE property symbol for `x.token`
+// where `x: Aa | Bb`, carrying BOTH classes' accessor declarations, and their order is the checker's,
+// not the source's. `.find` therefore picked an arbitrary arm and, when it picked the pure one, the
+// effectful arm vanished. EXECUTED, node 22.12.0, counting real `fs.appendFileSync` calls by reading the
+// log file back:
+//
+//     export class Aa { set token(v: string) { /* pure */ } }
+//     export class Bb { set token(v: string) { fs.appendFileSync("/tmp/x", v); } }
+//     export function u1(x: Aa | Bb) { x.token = "v"; }
+//
+//     u1(new Bb())  ->  1 real write        pre-fix: `c.u1` ABSENT from functions[], `deny Fs` exit 0
+//                                           post-fix: `c.u1` ["Fs"], `deny Fs` exit 1
+//
+// and it was order-dependent in a way no reader could predict: the SAME program with the two classes
+// swapped in the file reported `Fs` (the checker happened to list the effectful arm first). A union
+// receiver is a disjunction — ANY arm may be the runtime value — so the sound answer is the UNION of
+// the arms' accessors, which is also what `classBodiedGetter`'s `every` already assumes one line up.
+// The direction this fails in is over-charge (an arm that cannot occur at this site), never silence.
+// SOUNDNESS R259 — A UNION RECEIVER IS A DISJUNCTION, AND `getProperties()` ANSWERS THE INTERSECTION.
+// R245 fixed the union question at `accessorsFromSym` — ONE synthesised symbol carrying several
+// declarations — and its own commit message states the rule this level does not implement: *"a union
+// receiver is a disjunction — ANY arm may be the runtime value — so the sound answer is the UNION of the
+// arms' accessors."* Every whole-object arm gets its property LIST from `type.getProperties()`, which on
+// a union returns only the properties present in EVERY constituent, so an accessor declared on ONE arm is
+// never handed to the (now-correct) helper at all. Proven against the TS API directly: for `x: Aa | Bb`
+// where only `Aa` declares `token`, `getProperties()` is `[other]` and `getProperty("token")` is null.
+//
+// EXECUTED, node 22.12.0, 1 real accessor invocation per cell, over 46 cells of a generated matrix —
+// six union shapes crossed with every arm that typechecks, caller ABSENT from `functions[]` in all 46:
+//
+//     Aa|undefined  assign-src, JSON.stringify, structuredClone, spread, rest        5 of 5 arms silent
+//     Aa|null       the same five                                                    5 of 5
+//     Aa|string     + Object.assign target, Object.entries, Object.values            6 of 6
+//     Aa|Bb         + Reflect.get, Reflect.set                                      10 of 10
+//     Aa|{lit}      the same ten                                                    10 of 10
+//     (f ? a : b)   the same ten — a union formed AT THE SITE                       10 of 10
+//
+// and on the caller ALL EIGHT policy forms exit 0 — blanket `deny Fs`, `deny Unknown`, `deny Fs Unknown`,
+// `pure <caller>`, `deny Fs <caller>`, and the three reason-scoped ones — with the scoped rules BINDING.
+// Blanket `deny Fs` is red elsewhere in the module only when the object's PRODUCER is in scope; when the
+// object arrives as a parameter, nothing anywhere goes red. NARROWED forms are correct today and stay
+// correct — `x ?? fb` and `if (!x) return` both disclose, because TS narrows before the site, so the hole
+// needs the union to SURVIVE into the operation (12 arms each, 0 silent, carried as controls).
+//
+// The direction this fails in is OVER-CHARGE — an arm that cannot be the runtime value at this site —
+// never silence, which is the same trade `accessorsFromSym`'s `every` already makes one level down.
+/** Every property symbol ANY arm of `type` declares — the disjunction, not `getProperties()`'s intersection. */
+function propertiesAcrossArms(type) {
+  if (!type?.getProperties) return [];
+  if (!type.isUnion?.()) return type.getProperties();
+  const seen = new Set();
+  for (const arm of type.types) for (const p of (arm.getProperties?.() ?? [])) seen.add(p);
+  return [...seen];
+}
+/** Every arm's symbol for `name` — a LIST, because two arms can declare the same name with different
+ *  accessor bodies and picking one is the order-dependence R245 was filed to kill. */
+function propertySymbolsAcrossArms(type, name) {
+  if (!type?.getProperty) return [];
+  const seen = new Set();
+  const direct = type.getProperty(name);
+  if (direct) seen.add(direct);
+  if (type.isUnion?.()) for (const arm of type.types) { const p = arm.getProperty?.(name); if (p) seen.add(p); }
+  return [...seen];
+}
+function accessorsFromSym(sym, kind /* "get" | "set" */) {
+  if (!sym) return [];
   const want = kind === "get" ? ts.isGetAccessorDeclaration : ts.isSetAccessorDeclaration;
   // A symbol is an accessor only if its declarations include an accessor of the wanted kind.
-  const decl = (sym.declarations ?? []).find((d) => want(d));
-  if (!decl) return null;
-  return { decl, local: projectFiles.has(path.resolve(decl.getSourceFile().fileName)) };
-}
-function accessorAt(propNode, kind /* "get" | "set" */) {
-  let sym;
+  return (sym.declarations ?? []).filter((d) => want(d))
+    .map((decl) => ({ decl, local: projectFiles.has(path.resolve(decl.getSourceFile().fileName)) }));
+}
+// SOUNDNESS R240(a) — THE KEY'S TYPE PINS THE PROPERTY SET, AND ASKING IT IS NOT A GUESS.
+// `accessorsAt` used to resolve only a syntactic string literal, under a comment that said a dynamic
+// key "can't be pinned to one property … resolving it would guess". That is true of `k: string` and
+// FALSE of `k: "token" | "other"`, whose TYPE names exactly two properties — the same shape as R232/R233,
+// where a safety comment was true for the case in front of its author and false one spelling over.
+//
+// Returns the FINITE set of property names the key can hold, or `null` when there is no finite set.
+// `null` is a real answer ("we cannot say which property this is"), distinct from an empty set.
+//
+// THIS IS NOT AN OVER-APPROXIMATION: every name returned is a value the key is DECLARED to be able to
+// take, so charging all of them charges exactly what the program says can run. It fails toward `null`
+// (today's silence) on anything it cannot enumerate, which is the denylist direction — a name is
+// admitted only when a literal type PROVES it, never guessed from the receiver's property list.
+//
+// FIVE SPELLINGS, all measured on executed fixtures (see the test block and the CHANGELOG):
+//   "token" | "other"   a literal union                       -> {token, other}
+//   const k = "token"   a single literal type                 -> {token}
+//   EK / EK.Token       a string enum, whole or one member    -> {token, other} / {token}   (EnumLiteral
+//                                                                carries StringLiteral, so `.value` is
+//                                                                the runtime key)
+//   keyof Session       an Index type the checker has already normalised to a literal union
+//   K extends keyof T   a TYPE PARAMETER — pinned through its CONSTRAINT, which is that same union
+//
+// The CAP is a rail, not a semantic: a template-literal type can expand to tens of thousands of names,
+// and past the cap this returns `null` — the pre-fix answer, so the cap can only lose precision, never
+// soundness.
+const KEY_NAME_CAP = 512;
+function keyLiteralNames(t, depth = 0, seen = new Set()) {
+  if (!t || depth > 4 || seen.has(t)) return null;
+  seen.add(t);
+  if (t.isUnion?.()) {
+    const out = new Set();
+    for (const c of t.types) {
+      const s = keyLiteralNames(c, depth + 1, seen);
+      if (!s) return null;                        // ONE unpinnable arm makes the whole key unpinnable
+      for (const x of s) out.add(x);
+      if (out.size > KEY_NAME_CAP) return null;
+    }
+    return out;
+  }
+  // A string/number literal type IS the property name. `EK.Token` is `EnumLiteral | StringLiteral`, so a
+  // string enum member lands here and `.value` is the runtime key the enum member compiles to.
+  if (t.isStringLiteral?.()) return new Set([t.value]);
+  if (t.isNumberLiteral?.()) return new Set([String(t.value)]);
+  // `K extends keyof Session` — the type parameter itself names nothing; its CONSTRAINT does.
+  const c = checker.getBaseConstraintOfType?.(t);
+  if (c && c !== t) return keyLiteralNames(c, depth + 1, seen);
+  return null;                                    // `string`, `symbol`, `keyof T` for generic T, …
+}
+function accessorsAt(propNode, kind /* "get" | "set" */) {
   if (ts.isElementAccessExpression(propNode)) {
-    // `c["prop"]` carries no `.name`; resolve the LITERAL key as a property on the receiver's type.
-    // A dynamic key (`c[k]`) can't be pinned to one property — leave it unresolved (the existing
-    // dynamic-access posture stands; resolving it would guess, never fabricate here).
+    // `c["prop"]` carries no `.name`; resolve the key to the property NAMES it can hold and look each
+    // one up on the receiver's type. Returns `null` — distinct from `[]` — when the key is NOT pinned
+    // to a finite name set, so the caller can tell "pinned, and none of them is an accessor" (nothing
+    // to charge) from "we do not know which property this is" (a disclosure question).
     const arg = propNode.argumentExpression;
-    sym = arg && ts.isStringLiteralLike(arg)
-      ? checker.getTypeAtLocation(propNode.expression)?.getProperty?.(arg.text)
-      : null;
-  } else {
-    sym = checker.getSymbolAtLocation(propNode.name ?? propNode);
-  }
-  return accessorFromSym(sym, kind);
+    const texts = arg && ts.isStringLiteralLike(arg) ? new Set([arg.text])
+                : arg ? keyLiteralNames(checker.getTypeAtLocation(arg)) : null;
+    if (!texts) return null;
+    const recvType = checker.getTypeAtLocation(propNode.expression);
+    const out = [];
+    // R259 — every ARM's symbol for the name, not just the union's own (which is null unless the
+    // property is common to all of them).
+    for (const t of texts) for (const sym of propertySymbolsAcrossArms(recvType, t))
+      out.push(...accessorsFromSym(sym, kind));
+    return out;
+  }
+  return accessorsFromSym(checker.getSymbolAtLocation(propNode.name ?? propNode), kind);
 }
 // A `Object.defineProperty` descriptor accessor for the forcing site `recv.key` (read → get, assign →
-// set), consulted ONLY when the type-level `accessorAt` came up empty (the checker types target.key as
+// set), consulted ONLY when the type-level `accessorsAt` came up empty (the checker types target.key as
 // a data prop, so defineProperty accessors are invisible to it). Resolve the receiver expression to its
 // binding symbol and the key to a static string; look both up in `definePropAccessors`. Returns the
 // descriptor function NODE (a minted unit) when found, or null. NO fabrication: a data (`value:`)
 // descriptor was never indexed, an absent target/key returns null.
 function definePropForceTarget(propNode, kind /* "get" | "set" */) {
-  if (definePropAccessors.size === 0) return null;
-  let recvExpr, keyText;
+  if (definePropAccessors.size === 0) return [];
+  // R240(a) — the key set, not one key: the SAME literal-type pinning the type-level arm now does. A
+  // descriptor installed under `"hot"` and reached as `target[k]` with `k: "hot" | "cold"` was silent
+  // here for exactly the reason it was silent there (executed: 1 real setter invocation, row ABSENT).
+  let recvExpr, keyTexts;
   if (ts.isElementAccessExpression(propNode)) {
     recvExpr = propNode.expression;
     const arg = propNode.argumentExpression;
-    keyText = arg && ts.isStringLiteralLike(arg) ? arg.text : null;
+    keyTexts = arg && ts.isStringLiteralLike(arg) ? new Set([arg.text])
+             : arg ? keyLiteralNames(checker.getTypeAtLocation(arg)) : null;
   } else if (ts.isPropertyAccessExpression(propNode)) {
     recvExpr = propNode.expression;
-    keyText = propNode.name?.getText?.();
-  } else return null;
-  if (keyText == null) return null;
+    const n = propNode.name?.getText?.();
+    keyTexts = n == null ? null : new Set([n]);
+  } else return [];
+  if (keyTexts == null) return [];
   // Resolve the receiver to the SAME symbol the defineProperty target identifier resolved to. Follow an
   // import alias so a cross-module `import { config }` access joins the defining module's index entry.
   const rsym0 = checker.getSymbolAtLocation(recvExpr);
-  if (!rsym0) return null;
+  if (!rsym0) return [];
   const rsym = rsym0.flags & ts.SymbolFlags.Alias ? (() => { try { return checker.getAliasedSymbol(rsym0); } catch { return rsym0; } })() : rsym0;
   const byKey = definePropAccessors.get(rsym) ?? definePropAccessors.get(rsym0);
-  const entry = byKey?.get(keyText);
-  return entry?.[kind] ?? null;
+  if (!byKey) return [];
+  const out = [];
+  for (const k of keyTexts) { const n = byKey.get(k)?.[kind]; if (n) out.push(n); }
+  return out;
 }
 // Record a resolved accessor HIT (read or write) as an edge from `owner`: into the accessor UNIT when
 // it's a local declaration we minted; otherwise Unknown (a resolved-but-unseen accessor body — never
 // silent-pure, SPEC §4). `label` tags the §-why disclosure.
-function recordAccessorHit(owner, hit, label) {
+// SOUNDNESS R282 — AND THE OVERRIDES, WHICH THIS NEVER ASKED FOR. The edge above lands on the
+// declaration RESOLUTION picked — for a base-typed receiver that is the BASE's accessor — and nothing
+// here consulted `classOverrides`, so a subclass override's effects never reached the caller. The
+// method path one arm over (`allOverrides` at the CallExpression site) does exactly this, off the SAME
+// index, which already keys accessor declarations: `classOverrides`'s own indexing loop matches
+// `isGetAccessorDeclaration`/`isSetAccessorDeclaration` explicitly. The index knew; the consumer never
+// asked. §F1 question 3 — separate implementations of one question, and this is the one that drifted.
+//
+// THE ROW THAT FILED THIS NAMED `abstract get` — A DECLARATION WITH NO BODY — AND THAT IS THE TRIGGER,
+// NOT THE CLASS. A CONCRETE base accessor WITH a body fails identically, and that is the shape real code
+// has. EXECUTED, node 22.12.0, counting real `fs.appendFileSync` calls, receiver typed as the base:
+//
+//     abstract class T { abstract get val(): string; }                     1 real write, `leak` ABSENT
+//     class T { get val() { return "b"; } }  + override get val()          1 real write, `leak` ABSENT
+//     class T { m() { return "b"; } }        + override m()                1 real write, `leak` ['Fs']  ← the control
+//
+// In a tree containing nothing else, `pure src.only.leak` and `deny Fs src.only.leak` both exit 0 with
+// the scope BINDING, `deny Unknown` exits 0, and blanket `deny Fs` exits 1 only INCIDENTALLY — via the
+// independently-reported `src.only.TImpl.get val` unit, never via the caller, which was not judged at all.
+//
+// Bounded exactly as the method path is, and the bounds are the point rather than trivia: the fan-out is
+// scoped to the RECEIVER's static-type subtree when the receiver pins a local class (a sibling
+// subclass's override is type-impossible on this path, and charging it would be fabrication-adjacent);
+// past `CHA_FANOUT_LIMIT`, or with any override not minted as a unit, it DISCLOSES rather than silently
+// dropping what it could not enumerate. A base accessor no subclass overrides has no index entry, so
+// today's answer is preserved byte-for-byte there.
+function accessorOverrideFanOut(rec, decl, recvExpr) {
+  const allOverrides = classOverrides.get(decl);
+  if (!allOverrides || allOverrides.length === 0) return;
+  let overrides = allOverrides;
+  if (recvExpr) {
+    const rt = checker.getTypeAtLocation(recvExpr);
+    const rootClass = (rt?.symbol?.declarations ?? []).find((d) =>
+      ts.isClassDeclaration(d) && projectFiles.has(path.resolve(d.getSourceFile().fileName)));
+    // SOUNDNESS-PRESERVING FALLBACK, the method path's verbatim: a receiver we cannot pin to a LOCAL
+    // class (a union, an interface, `any`, an external type) keeps the FULL override set.
+    if (rootClass) overrides = allOverrides.filter((om) =>
+      ts.isClassDeclaration(om.parent) && classInSubtree(om.parent, rootClass));
+  }
+  if (overrides.length === 0) return;
+  const ownerQual = (d) => (d.parent?.name
+    ? `${moduleOf(d.parent.getSourceFile())}.${namespacePrefixOf(d.parent)}${d.parent.name.getText()}`
+    : null);
+  if (overrides.length > CHA_FANOUT_LIMIT) {
+    rec.direct.add("Unknown");                       // override family too wide to enumerate soundly
+    rec.why.add(dispatchWhy(ownerQual(decl), decl.name?.getText?.()));
+    return;
+  }
+  let allResolved = true;
+  const targets = [];
+  for (const om of overrides) { const ot = nodeName.get(om); if (ot) targets.push(ot); else allResolved = false; }
+  for (const ot of targets) rec.edges.add(ot);       // (EDGE) into each override — effects propagate
+  if (!allResolved) {
+    rec.direct.add("Unknown");                       // an override we could not name is not a pure one
+    rec.why.add(dispatchWhy(ownerQual(decl), decl.name?.getText?.()));
+  }
+}
+function recordAccessorHit(owner, hit, label, recvExpr = null) {
   const rec = fns.get(owner);
   const t = nodeName.get(hit.decl);
   if (hit.local && t) {
     rec.edges.add(t); // (EDGE) into the accessor unit — effects propagate
+    accessorOverrideFanOut(rec, hit.decl, recvExpr);  // R282 — …and into every override it may bind to
   } else {
     rec.direct.add("Unknown");
     rec.why.add(`reflect:accessor:${label}`); // a defineProperty runtime accessor (descriptor get/set unseen) — metaprogramming, canonical `reflect:`
   }
 }
 
+// SOUNDNESS R247 — ONE AUTHORITY for "could a runtime key of this TYPE ever name this property?".
+// Extracted from R240(b)'s unpinnable-key branch, which is where the question was first answered and
+// where the corpus proved it has to be asked BOTH ways: a STRING key cannot name a symbol-keyed
+// accessor (axios 1.7.2's six `AxiosHeaders` rows, armed only by `get [Symbol.toStringTag]()`), and a
+// SYMBOL key cannot name a string-keyed one (mongoose 8's 18 rows, armed by bson's `get id()`).
+// R247's convergence needs the identical test on the `Reflect.set(t, k, v)` side, and a second private
+// copy is how the two spellings drift apart again — which is the entire subject of the row.
+//
+// A DENYLIST OF THE PROVEN-UNREACHABLE, not an allowlist: it excludes only when EVERY declaration of
+// the property has a computed name whose expression is symbol-TYPED, and it lifts entirely when the
+// key's own type could hold the other kind (`PropertyKey`, `symbol`, `any`, `unknown`) or when there is
+// no key expression to read at all (`keyT == null` → every property stays reachable).
+//
+// SOUNDNESS R283 — A TYPE PARAMETER IS NOT A SPELLING, AND THE COMMENT ABOVE IS TRUE OF FOUR SPELLINGS
+// AND FALSE OF EVERY GENERIC ONE. "It lifts entirely when the key's own type could hold the other kind
+// (`PropertyKey`, `symbol`, `any`, `unknown`)" was written by the commit that needed it, and it reads as
+// a considered ruling — §K exactly. A TYPE PARAMETER's own flags are `TypeParameter` and nothing else:
+// neither symbol-ish nor wild, so both tests read FALSE and the key was treated as provably not a symbol,
+// although `K extends PropertyKey` binds to one at the call site. The key's vocabulary is in its
+// CONSTRAINT, and `getBaseConstraintOfType` is where the checker keeps it — the same call `keyLiteralNames`
+// already makes twenty lines up for exactly this reason (§G: ask the authority, it already knows).
+//
+// MEASURED through the TS API on the fixture, at 9a0cfd9:
+//     k: K where K extends PropertyKey   flags 524288 (TypeParameter)   keyMayBeSymbol FALSE
+//                                        getBaseConstraintOfType -> PropertyKey, whose arms answer TRUE
+//
+// AND THE PART THAT DECIDES HOW MUCH THIS MATTERS: the blindness was NOT uniform, because one arm passed
+// BY ACCIDENT. `Reflect.set(t, k, v)`'s lib.d.ts `propertyKey: PropertyKey` is NON-generic, so the
+// checker hands this helper `PropertyKey` and the guard answered right for the wrong reason; `Reflect.get`
+// is generic (`P extends PropertyKey`), so `k` keeps type `K` and the guard answered wrong. A guard that
+// passes because of an overload's shape is one TypeScript release from flipping, and it is why the
+// axis here is the CONSTRAINT and not the four spellings. EXECUTED, 1 real getter invocation per cell,
+// over a class whose only accessor is `get [SYM]()`:
+//
+//     K extends keyof Src    Reflect.get SILENT  Reflect.set SILENT  s[k] SILENT  s[k]=v SILENT
+//     K extends symbol       Reflect.get SILENT  Reflect.set SILENT
+//     K extends PropertyKey  Reflect.get SILENT  Reflect.set discloses  ← the accidental pass
+//     PropertyKey / symbol / keyof Src / any (non-generic)   all four arms disclose
+//     string / "tok" / "tok"|"other"   correctly silent — 0 executed, no legal key reaches the accessor
+//
+// UNCONSTRAINED `<K>` fails OPEN (both kinds possible), which is the disclose direction: a bare type
+// parameter can be instantiated with anything, so nothing is proven and nothing may be excluded.
+function keyCouldNameAccessor(propSym, keyT) {
+  const SYMBOLISH = ts.TypeFlags.ESSymbolLike, WILD = ts.TypeFlags.Any | ts.TypeFlags.Unknown;
+  // A key type flattened to the arms whose FLAGS actually answer the question: a union spreads to its
+  // constituents, a type parameter to its constraint's, and an UNCONSTRAINED one to `null` — "no
+  // vocabulary is proven here", which both tests below read as possible.
+  const arms = (t, depth = 0) => {
+    if (!t) return [];
+    if (t.isUnion?.()) return t.types.flatMap((x) => arms(x, depth));
+    if ((t.flags & ts.TypeFlags.TypeParameter) && depth < 4) {
+      const c = checker.getBaseConstraintOfType?.(t);
+      return c && c !== t ? arms(c, depth + 1) : [null];
+    }
+    return [t];
+  };
+  const keyArms = keyT ? arms(keyT) : [];
+  const keyMayBeSymbol = !keyT || keyArms.some((t) => t === null || (t.flags & (SYMBOLISH | WILD)));
+  const keyMayBeString = !keyT || keyArms.some((t) => t === null || !(t.flags & SYMBOLISH));
+  const ds = propSym?.declarations ?? [];
+  const symbolNamed = ds.length > 0 && ds.every((d) => d.name && ts.isComputedPropertyName(d.name)
+    && !!(checker.getTypeAtLocation(d.name.expression)?.flags & SYMBOLISH));
+  return symbolNamed ? keyMayBeSymbol : keyMayBeString;
+}
+
 // Object PROPERTY-ENUMERATION (`{...obj}`, `const {...rest} = obj`, `Object.assign(t, obj)`): copying an
 // object's own enumerable props INVOKES each source getter — the whole-object analog of `obj.prop`,
 // invisible to the property-access arm (no PropertyAccess node per key). Edge `owner` to every LOCAL
@@ -4430,10 +4713,9 @@ function classBodiedGetter(sym) {
 function enumerateGetters(owner, type, srcExpr) {
   if (!owner) return;
   if (type && type.getProperties) {
-    for (const p of type.getProperties()) {
+    for (const p of propertiesAcrossArms(type)) {   // R259 — the disjunction, not the intersection
       if (classBodiedGetter(p)) continue; // prototype + non-enumerable → not copied by a spread
-      const hit = accessorFromSym(p, "get");
-      if (hit) recordAccessorHit(owner, hit, p.getName());
+      for (const hit of accessorsFromSym(p, "get")) recordAccessorHit(owner, hit, p.getName(), srcExpr);
     }
   }
   // The structural arm: `const o: SomeClass = { get k(){…} }` — the BINDING's initializer is an object
@@ -4466,6 +4748,149 @@ function enumerateGetters(owner, type, srcExpr) {
   }
 }
 
+// R116 — THE MIRROR OF `enumerateGetters`, AND THE ARM THAT DID NOT EXIST. `Object.assign(t, s)` is
+// specified as `t[k] = s[k]` for every own enumerable key of every source, so it invokes the TARGET's
+// SETTERS exactly as `t.k = v` does. `enumerateGetters` above handles the SOURCE side; nothing handled
+// this one, so a setter that writes a file was reported as nothing at all:
+//
+//     export class Sink { set token(x: number) { fs.writeFileSync("/tmp/leak", String(x)); } }
+//     export function viaAssign() { const s = new Sink(); Object.assign(s, { token: 1 }); }
+//       -> `viaAssign` ABSENT from `functions[]`, `deny Fs` exit 0, in a tree containing NOTHING else
+//     export function viaNamedWrite() { const s = new Sink(); s.token = 2; }   -> ["Fs"], correctly
+//
+// One spelling of a question the engine already answers right, which is what makes it a defect rather
+// than a coverage gap. GROUND TRUTH EXECUTED on node 22.12.0, counting setter invocations: 1 for every
+// `Object.assign` spelling (literal source, two sources, a parameter source, a spread source, a
+// computed key) and 1 for `Reflect.set`; 0 for `{...s, token: 1}` (a spread builds a FRESH object, so
+// no setter runs) and 0 for `Object.defineProperties(s, { token: { value: 3 } })` (a `value:` descriptor
+// installs an own property and bypasses the setter). Those two zeroes are the controls.
+//
+// THE KEY SET IS A DENYLIST OF THE PROVEN, NOT AN ALLOWLIST OF THE GUESSED — the family rule, and the
+// direction this fails in is over-charge. Every setter the target declares is charged UNLESS the copied
+// key set can be PROVEN and excludes it. It is provable in exactly one shape: a fresh object literal at
+// the call site with no spread and no computed key, whose keys are its own text. It is NOT provable from
+// a source's declared TYPE, because TypeScript is structural and the runtime object may carry more keys
+// than the annotation admits:
+//     function f(s: { a: number }) { Object.assign(target, s); }   f({ a: 1, token: 2 });   // token IS copied
+// so a type-keyed answer would be an allowlist of guessed-safe keys, which is how a silent under-report
+// gets introduced while killing an over-charge.
+//
+// NO FABRICATION WHERE THERE IS NOTHING TO CHARGE: a target that declares no `set` accessor takes this
+// function through zero iterations, so the overwhelmingly common `Object.assign(cfg, opts)` over plain
+// data objects is untouched — measured on the corpus, not assumed.
+//
+// `keys === null` means "the copied key set is not provable"; a Set means it is, exactly.
+const provenCopiedKeys = (sources) => {
+  const keys = new Set();
+  for (let s of sources) {
+    while (s && (ts.isParenthesizedExpression(s) || ts.isAsExpression(s)
+                 || ts.isSatisfiesExpression(s) || ts.isNonNullExpression(s))) s = s.expression;
+    if (!s || !ts.isObjectLiteralExpression(s)) return null;   // parameter / call return / variable
+    for (const pr of s.properties) {
+      if (ts.isSpreadAssignment(pr)) return null;              // `{...o}` copies an unknown key set
+      const n = pr.name;
+      if (!n) return null;
+      if (ts.isIdentifier(n) || ts.isStringLiteralLike(n) || ts.isNumericLiteral(n)) keys.add(n.text);
+      else return null;                                        // computed key `{[k]: v}`
+    }
+  }
+  return keys;
+};
+//
+// SOUNDNESS R247 — WHERE THE KEY SET IS UNPROVABLE, DISCLOSE `Unknown`; DO NOT CHARGE EVERY SETTER.
+// The paragraph above ("every setter the target declares is charged unless the copied key set can be
+// PROVEN and excludes it") described what this branch did until R247, and it made ONE ECMAScript
+// operation answer two ways: `Reflect.set(s, k, v)` with a runtime key charged `['Fs']` here, while
+// `s[k] = v` — the same property write, the same unpinnable key — disclosed `['Unknown']` under
+// R240(b) a few hundred lines down. A scoped `deny Fs` caught one and not the other.
+//
+// The two directions are not symmetric and that is what decides it: charging every setter is
+// FABRICATION (it claims an effect that a run may not perform), disclosing `Unknown` is honest about
+// exactly what is not known. The family's posture is to under-report rather than fabricate, and R240(b)
+// had already spent that posture on the other spelling.
+//
+// GROUND TRUTH EXECUTED, node 22.12.0, counting real `fs.writeFileSync` calls on a class declaring TWO
+// setters (`token`, `other`) and one data property (`plain`):
+//     Reflect.set(s, k, v)      k="token" 1   k="other" 1   k="plain" 0      ← at most ONE, never both
+//     Object.assign(s, src)     src={plain}  0   {plain,token} 1   {plain,token,other} 2
+//     Reflect.set(s,"token",v)  1   Object.assign(s,{token:1}) 1   Object.assign(s,{plain:1}) 0
+// So the invoked set is an UNKNOWN SUBSET of the declared setters in both cases — including the empty
+// subset, which is the input the old charge fabricated on.
+//
+// THE PROVABLE BRANCH IS UNTOUCHED: a fresh object literal at the call site, or a string-literal
+// `Reflect.set` key, still resolves to the named setters and still propagates their effects through an
+// EDGE. Only `keys === null` changed. WITHDRAWAL PRICED FIRST, over 14,149 rows (1,623 TS-source +
+// 12,526 npm): 316 sites reach this branch and 0 rows lose an effect — every effect it charged is
+// either pure or already carried by another path.
+//
+// TWO REASON TAGS, deliberately not one. `Reflect.set` is the SAME mechanism as `s[k] = v` — one
+// runtime-chosen key, at most one setter — so it emits R240(b)'s own `reflect:accessor:dynamic-key`,
+// and that identity IS the convergence this row asked for. `Object.assign` is a different mechanism
+// with a different bound (an unprovable copied key SET; 0..n setters, measured 2 above), so it emits
+// `reflect:accessor:dynamic-keyset`. Both sit in the `reflect` class, so `deny Unknown[reflect]`
+// selects both and no policy has to know the difference.
+//
+// `keyType` is the type of the runtime key where there IS one (`Reflect.set`'s second argument), so the
+// two-way symbol/string denylist can rule out a provably-unreachable accessor exactly as R240(b) does.
+// `Object.assign` passes null — it copies own enumerable STRING **and SYMBOL** keys, so no accessor on
+// the target is provably out of reach and the guard must lift entirely.
+//
+// SOUNDNESS R251 — AND THE SAME FUNCTION ANSWERS THE **GET** SIDE, WHICH HAD NO ARM AT ALL.
+// `Reflect.get(t, k)` performs the ordinary [[Get]] — it runs whatever getter the property lookup finds
+// — and nothing in this file handled it, in ANY spelling. Not the unprovable-key case R240/R247 are
+// about: it was silent for the plain string-literal key too, so the whole builtin was missing.
+//
+//     class Src { get token() { return fs.readFileSync("/etc/hosts", "utf8"); } }
+//     export function go() { const s = new Src(); return Reflect.get(s, "token"); }
+//       -> `go` ABSENT from `functions[]`; in a tree containing NOTHING else, `deny Fs src.only.go`
+//          exit 0 AND `pure src.only.go` exit 0, both scopes binding (no unmatched-scope warning).
+//
+// This is `kind`-parameterised rather than copied, which is §G: R247 already merged the two spellings of
+// the SET question into one body after they drifted, and a private `enumerateTargetGetters` would be the
+// same mistake in the other direction. Only the accessor kind differs — the key-set logic, the
+// unprovable-key disclosure, the symbol/string denylist and the no-fabrication exit are identical.
+//
+// GROUND TRUTH EXECUTED, node 22.12.0, counting real getter invocations:
+//     Reflect.get(o,"token")  literal 1  class 1     ← BOTH, and the class arm is why there is no
+//     Reflect.get(o,k) k="token"      1        1        `classBodiedGetter` exclusion below
+//     Reflect.get(o,"other")          0        0     ← the provable-exclusion control
+//     Reflect.has / ownKeys / deleteProperty / defineProperty / getOwnPropertyDescriptor / getPrototypeOf
+//                                     0        0     ← the whole rest of `Reflect.*`, swept, all zero
+// (`Reflect.apply`/`Reflect.construct` DO invoke user code — 1 each — and are already handled by the
+// reflective-invoke arm near `invokedRef`, not here.)
+function enumerateTargetAccessors(owner, targetExpr, keys, kind /* "get" | "set" */, unprovable = {}) {
+  if (!owner || !targetExpr) return;
+  const t = checker.getTypeAtLocation(targetExpr);
+  if (!t || !t.getProperties) return;
+  // `!keys`, not `keys === null`: a Set is always truthy, so this is exactly "the key set is not
+  // provable" — and it keeps the tolerance the old `keys && !keys.has(…)` line had for a caller that
+  // passes nothing. `keys.has` below is now unguarded, so a future third call site omitting the
+  // argument would throw rather than take this branch.
+  if (!keys) {
+    for (const p of propertiesAcrossArms(t)) {      // R259 — the disjunction, not the intersection
+      if (!accessorsFromSym(p, kind).length) continue;
+      if (!keyCouldNameAccessor(p, unprovable.keyType ?? null)) continue;
+      const rec = fns.get(owner);
+      rec.direct.add("Unknown");
+      rec.why.add(`reflect:accessor:${unprovable.why ?? "dynamic-key"}`);
+      return;   // one disclosure per site — WHICH accessor runs is the thing not known
+    }
+    return;     // a target declaring no reachable accessor discloses nothing (0 real invocations)
+  }
+  for (const p of propertiesAcrossArms(t)) {        // R259 — the disjunction, not the intersection
+    // NO `classBodiedGetter`-style exclusion here, and the asymmetry is the point rather than an
+    // oversight: R115 excluded a class-bodied GETTER because a prototype accessor is non-enumerable and
+    // therefore never COPIED. A prototype SETTER is the opposite — it is found by the assignment's
+    // property lookup and IS invoked. Executed above: the `Sink` setter lives on `Sink.prototype` and
+    // runs once. Excluding it here would be R115's reasoning applied to the direction it does not hold.
+    // R251 — and the same holds for the GET side reached this way: `Reflect.get` is a property LOOKUP,
+    // not a copy, so it finds a prototype getter too (executed: class 1). The exclusion belongs to
+    // `enumerateGetters`, whose callers really are copies, and to nothing here.
+    if (!keys.has(p.getName())) continue;                      // proven not touched by this operation
+    for (const hit of accessorsFromSym(p, kind)) recordAccessorHit(owner, hit, p.getName(), targetExpr);
+  }
+}
+
 // The synthesized `<module>` unit for a source file's TOP-LEVEL executable statements (spec §2
 // unitKind "initializer" — java's `<clinit>` twin). Top-level `await fetch(…)`, a bare
 // `readFileSync(…)`, an IIFE, `export const r = await fetch(…)` execute at MODULE-LOAD time and
@@ -4845,6 +5270,133 @@ const dispatchWhy = (qualifiedOwner, member) =>
   qualifiedOwner && member ? `dispatch:${qualifiedOwner}.${member}`
                            : `callback:${qualifiedOwner ?? member ?? "unresolved call"}`;
 
+// SOUNDNESS R284 — THE OWNER A MEMBER HAS AND NOBODY WENT LOOKING FOR, plus the one site that formed an
+// owner it could not qualify. `dispatchWhy` above decides §4's class from whether an owner STRING could
+// be formed, so every producer that fails to form one silently demotes a member dispatch to `callback:`
+// and moves its §6.2 class from `dispatch` to `indirect` — narrowing every `deny E Unknown[dispatch]`
+// gate in the field, which SPEC §4 ⟨0.24⟩ names and rejects in terms.
+//
+// The producing arm read `sigDecl.parent?.name`, which an `InterfaceDeclaration` has and a `TypeLiteral`
+// NEVER does. MEASURED, one program, at 9a0cfd9 — a pure spelling difference in TypeScript:
+//
+//     interface Shape { m(): void }   x.m()   ->  dispatch:src.a.Shape.m        [dispatch] RED
+//     type Shape = { m(): void };     x.m()   ->  callback:m                    [dispatch] —, [indirect] RED
+//
+// AND THE BOUNDARY OF THE ROW THAT FILED IT WAS DRAWN AROUND ITS OWN TRIGGER — one arm, the one in hand.
+// Grepping the MECHANISM ("a site that forms a dispatch:/callback: owner") rather than the name found
+// two more, both measured on executing fixtures:
+//
+//   · the >12-override family arm emits an UNQUALIFIED `dispatch:Shape.m` where every other site emits
+//     `mod.Owner.member`. The consumer's `^dispatch:(.+)\.([^.]+)$` then yields owner `Shape`, which
+//     matches no `declaringType` qual, so the dispatch frontier can never resolve it. The comment at the
+//     producing arm asserts "the other emission sites produced none" of the 1,234 malformed strings — a
+//     §K sentence: true of the corpus it was measured on, false of the code. A 14-subclass fixture
+//     produces one on demand.
+//   · `reflect:accessor:` took its owner from the same `parent?.name`, with `?? "?"` as the fallback, so
+//     a type-alias-declared accessor discloses `reflect:accessor:?.val` where the interface spelling
+//     discloses `reflect:accessor:Shape.val`. The class does not move (both are `reflect`), but `?` is
+//     not an owner anything can scope to.
+//
+// WHAT THIS DOES **NOT** CLAIM: a fully anonymous inline literal (`function f(x: { m(): void })`) still
+// has no owner to name and stays `callback:`, because SPEC §4 reserves `dispatch:` for an owner type AND
+// member that are BOTH known. That residual is stated, not closed — it is the open list, and a nested
+// literal names the alias that declares the shape it sits in rather than inventing a path.
+const NAMED_TYPE_OWNER = (d) => ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)
+  || ts.isClassExpression(d) || ts.isTypeAliasDeclaration(d) || ts.isEnumDeclaration(d);
+// SOUNDNESS R355 — THE WALK MUST STOP AT A VALUE BOUNDARY, or it names a type that does not declare
+// the member. R284 added this ancestor walk so a member of an anonymous type LITERAL could still name
+// the alias that declares it; it climbs every parent until it finds a named declaration, and nothing
+// stopped it leaving the type position. Four shapes measured wrong on real code:
+//
+//   literal in a method BODY      eslint 9.x `SourceCode.traverse` -> dispatch:….SourceCode.enterNode
+//                                 (`enterNode` is a method of a literal declared inside the method;
+//                                  SourceCode declares no such member)
+//   literal in a class FIELD      zx `ProcessPromise.bus` -> dispatch:….ProcessPromise.unpipe, which
+//                                 names a REAL but DIFFERENT method of that class
+//   TYPE-PARAMETER constraint     `class A<T extends {m(): void}>` -> dispatch:….A.m — the class named
+//                                 as owner of its own constraint's member
+//   inline PROPERTY type          `cb!: { m(): void }` -> dispatch:….Holder.m
+//
+// SPEC §4 makes the dotted `dispatch:<owner-type>.<member>` detail NORMATIVE, so a phantom owner is a
+// wrong normative field, and `callers --include-unknown` builds frontier edges from it. It is
+// over-approximate rather than silent — never a cardinal sin — but 0.35.0 ships these rows as
+// `callback:`, so publishing the phantom and fixing it later would flip `deny Unknown[dispatch]` twice
+// on identical bytes.
+//
+// A DENYLIST OF VALUE-POSITION BOUNDARIES, not an allowlist of permitted ancestors: a node kind nobody
+// foresaw keeps climbing and over-fires visibly, rather than silently demoting a real owner to
+// `callback:`. Say which direction it fails in — this one fails loud.
+// SOUNDNESS R367 — RETIRED, AND KEPT ONLY AS THE RECORD OF WHY. This denylist was the syntactic proxy
+// for "has the walk left the type position", and it was wrong in BOTH directions: too narrow at R355
+// (it missed the interface/type-alias property spelling, which R359 then added), and once wide enough
+// to catch that, too broad — `ts.isTypeReferenceNode` demoted `type RO = Readonly<{ m(): void }>`,
+// which genuinely has `m`, turning a firing `deny Unknown[dispatch]` green on a real owner (R363).
+// Three commits chasing one question with the wrong instrument.
+//
+// `ownerDeclaresMember` now asks the checker directly and answers all six shapes correctly, including
+// the four this list was written for. The list is no longer consulted; it is left here, unused, for
+// one release so the next reader meets the reasoning rather than the deletion. THE GENERAL POINT is
+// in `candor-handlist-vein`: an engine WITH a type checker should not hand-maintain what the checker
+// derives — that instrument belongs to candor-rust and candor-swift, which have no checker.
+// (the list itself is deleted — `npm test`'s lint is right that a retired binding is dead code;
+//  the shapes it covered are in SOUNDNESS R355/R359/R363/R367, which is where they belong.)
+/** The nearest ancestor declaration that NAMES the type this member belongs to, or null. */
+const namedTypeAncestor = (node) => {
+  for (let n = node?.parent, guard = 0; n && guard++ < 32; n = n.parent) {
+    if (ts.isSourceFile(n)) return null;
+    if (NAMED_TYPE_OWNER(n) && n.name) return n;
+  }
+  return null;
+};
+/** `<module>.<namespace prefix><Name>` — the spelling `mod.Class.member` quals use, so the dispatch
+ *  frontier can resolve it against the hierarchy sidecar. A bare name cannot be resolved by anything. */
+const qualifiedTypeName = (d) => (d?.name
+  ? `${moduleOf(d.getSourceFile())}.${namespacePrefixOf(d)}${d.name.getText()}` : null);
+/** SOUNDNESS R367 — ASK THE CHECKER WHETHER THE CANDIDATE OWNER ACTUALLY HAS THE MEMBER.
+ *
+ *  R284 walked up to the nearest named declaration and named it. R355 and R359 then tried to fix the
+ *  cases where that walk leaves the type position by enumerating NODE KINDS to stop at — a hand-
+ *  maintained syntactic list, which is the instrument the two engines WITHOUT a type checker are
+ *  forced to use. candor-ts has a checker. Enumerating positions here was answering a semantic
+ *  question with a syntactic proxy, and the proxy was wrong in both directions: it missed
+ *  `interface I { cb: { m(): void } }` (R359) and, once widened enough to catch that, it demoted
+ *  `type RO = Readonly<{ m(): void }>`, which genuinely HAS `m` — turning a firing
+ *  `deny Unknown[dispatch]` green on a real owner (R363).
+ *
+ *  The question is not "what syntax is this literal sitting in". It is "does the type this
+ *  declaration declares have a property by this name". That is one checker call and it is exact:
+ *      type Named  = { m(): void }              -> has m   -> owner kept
+ *      type RO     = Readonly<{ m(): void }>    -> has m   -> owner kept   (the mapped type maps it)
+ *      type Id<T>=T; type IdLit = Id<{m()}>     -> has m   -> owner kept
+ *      type ListOf = Array<{ m(): void }>       -> no m    -> no owner
+ *      interface I { cb: { m(): void } }        -> no m    -> no owner
+ *      class C { go(){ const a={m(){}}; a.m() }}-> no m    -> no owner
+ *
+ *  FAILS LOUD BY CONSTRUCTION. Any uncertainty — no symbol, no declared type, the checker throwing —
+ *  answers "yes, keep the owner", so an unanswerable case over-approximates visibly rather than
+ *  silently demoting a real owner to `callback:`. That is the direction R363 recorded as the one
+ *  nothing warns about. */
+const ownerDeclaresMember = (ownerDecl, memberName) => {
+  if (!ownerDecl || !memberName) return true;
+  try {
+    const sym = ownerDecl.name && checker.getSymbolAtLocation(ownerDecl.name);
+    if (!sym) return true;
+    const t = checker.getDeclaredTypeOfSymbol(sym);
+    if (!t) return true;
+    return !!checker.getPropertyOfType(t, memberName);
+  } catch { return true; }
+};
+
+/** The owner qual for a member whose immediate parent may be an ANONYMOUS type literal. Falls back to
+ *  the nearest NAMED type declaration, VERIFIED to have the member; null when there genuinely is not
+ *  one, or when the one found does not declare it. */
+const memberOwnerQual = (member) => {
+  if (member?.parent?.name) return qualifiedTypeName(member.parent);
+  const anc = namedTypeAncestor(member);
+  const name = member?.name?.getText?.();
+  return ownerDeclaresMember(anc, name) ? qualifiedTypeName(anc) : null;
+};
+
 // ⟨THE FUNNEL⟩ Every site that reaches a resolved EXTERNAL declaration whose own κ lookup found nothing
 // answers the SAME question — chained sibling report, §5.1 manifest, κ-coverage ledger, or the
 // unanswerable-key disclosure — and it used to answer it up to four times over, independently, in the
@@ -5554,6 +6106,49 @@ const identIsEnvMayAlias = (id) => {
   return !!sym && envMayAliasSymbols.has(sym);
 };
 
+// R113 — WEB STORAGE, IDENTIFIED FROM THE RECEIVER'S TYPE rather than from the member's declaration.
+// R109 charged `localStorage.setItem(k, v)` by keying on the resolved MEMBER — `decl.parent.name ===
+// "Storage"` in the es-lib arm. That reading can only see a member the interface DECLARES. `Storage` also
+// carries an INDEX SIGNATURE (`[name: string]: any` — in lib.dom AND in @types/node's
+// `web-globals/storage.d.ts`, identically), so `localStorage.x = secret` resolves to no declaration at
+// all, no accessor exists for the property arm to find, and the write was reported as NOTHING in BOTH
+// lib configurations.
+//
+// GROUND TRUTH IS EXECUTED, node 22.12.0 with `--experimental-webstorage --localstorage-file=./ls.db`:
+// process 1 runs `localStorage.x = "SECRET"; localStorage["tok"] = "SECRET"`, process 2 reads both back.
+// The index-signature write PERSISTS ACROSS PROCESSES, byte-identically to the `setItem` call that IS
+// charged. `debug` publishes `localStorage.debug = 'worker:*'` as its documented browser API and
+// `util-deprecate/browser.js` does `global.localStorage[name]`, so this is the spelling real code uses.
+//
+// R109's OWN COMMENT DISMISSED THIS ROW — "the `localStorage.x = v` INDEX-SIGNATURE spelling is untouched
+// and still pure — pure under @types/node too, so it is not part of this split." Every literal word was
+// true. The conclusion was not: both arms agreeing is not a safety property, it is the R111 failure mode.
+// Attack K, in the comment that made the previous fix look complete.
+//
+// KEYED ON THE RECEIVER'S TYPE SYMBOL, which is the identity the call arm already uses — one step
+// earlier in the same chain, so it reaches the members the interface never named. It also gets the alias
+// and parameter spellings for free: `const ls = localStorage; ls.x = v`, `window.localStorage.x = v`,
+// `sessionStorage.x = v` and `function f(s: Storage) { s.x = v }` all have a `Storage`-typed receiver and
+// no new branch. FABRICATION GUARD: the type symbol must have a declaration in `typescript/lib/lib.*.d.ts`
+// or under `@types/node/`, so a project's own `interface Storage` / `class Storage` is never charged
+// (measured, not argued — the shadow control in test.mjs).
+//
+// `some`, not `every`: this INCLUDES rather than excludes, so the conservative direction is to charge on
+// any host declaration. Under @types/node the symbol legitimately carries two declarations (the
+// module-local `interface Storage` and the `declare global { interface Storage extends _Storage {} }`
+// merge), and `every` would have to be right about both.
+const webStorageDeclFile = (d) => {
+  const f = path.resolve(d.getSourceFile().fileName).replace(/\\/g, "/");
+  return /typescript\/lib\/lib\..*\.d\.ts$/.test(f) || declIsNodeTypes(d);
+};
+const isWebStorageExpr = (expr) => {
+  if (!expr) return false;
+  let t; try { t = checker.getTypeAtLocation(expr); } catch { return false; }
+  const sym = t && (t.symbol ?? t.aliasSymbol);
+  if (!sym || sym.name !== "Storage") return false;
+  return (sym.declarations ?? []).some(webStorageDeclFile);
+};
+
 // ---- whole-object process.env access via builtins/spread ------------------------------------------------
 // `process.env.KEY` is caught above, but the WHOLE env object handed to a builtin that enumerates or mutates it
 // is the same Env effect and read silent-pure: `Object.assign(process.env, o)` / `Object.defineProperty(...)` /
@@ -5574,16 +6169,104 @@ const ENV_TOUCHING_BUILTIN = new Set([
 const ENV_TOUCHING_GLOBAL = new Set(["structuredClone"]);
 const identIsGlobal = (id) => // an identifier that is the ambient global (no project-local declaration shadows it)
   !(checker.getSymbolAtLocation(id)?.declarations ?? []).some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)));
+// THE `globalThis.` QUALIFIER, WHICH DEFEATED FIVE TEXT-KEYED ARMS AT ONCE (SOUNDNESS row id pending —
+// filed by the coordinator, not invented here). Every arm below
+// recognises a whole-object builtin by the callee's TEXT (`Object.assign`, `Reflect.set`, `Object.keys`),
+// and `globalThis.Object.assign(...)` is the same function under a different spelling. MEASURED, one
+// file, `tsc --noEmit` clean, each pair differing ONLY in the qualifier:
+//
+//     Object.assign(sink, {token:1})            ["Fs"]      globalThis.Object.assign(…)     ABSENT
+//     Reflect.set(sink, "token", 1)             ["Fs"]      globalThis.Reflect.set(…)       ABSENT
+//     Object.assign({}, literalWithGetter)      ["Unknown"] globalThis.Object.assign(…)     ABSENT
+//     Object.keys(process.env)                  ["Env"]     globalThis.Object.keys(env)     ABSENT
+//     Object.keys(localStorage)                 ["Unknown"] globalThis.Object.keys(ls)      ABSENT
+//
+// Ground truth EXECUTED on node 22.12.0: `globalThis.Object.assign`, `globalThis.Reflect.set` and the
+// bare spellings each invoke the accessor exactly once; `globalThis.Object.keys(process.env)` reads the
+// whole environment. Five arms, one spelling, and the `Env` one is a whole-environment read reported as
+// nothing. This is R95's `globalThis.fetch` class, one builtin family over.
+//
+// RETURNS THE CANONICAL `Owner.member` TEXT for a call whose callee is a member of an ambient global
+// builtin, reached BARE or through a proven-global `globalThis`/`global`/`window`/`self` root (parens,
+// `as` casts and `!` unwrapped, as `identIsGlobalProcess` already does for the process object). Returns
+// null for anything else, so a project's own `Object` — bare or hung off a project-shadowed root — is
+// never matched. It can only make an existing text test recognise MORE spellings of the same function;
+// it cannot make one stop matching.
+const GLOBAL_ROOTS = new Set(["globalThis", "global", "window", "self"]);
+const globalBuiltinCallee = (callee) => {
+  if (!callee || !ts.isPropertyAccessExpression(callee)) return null;
+  const member = callee.name?.text;
+  if (!member) return null;
+  let owner = callee.expression;
+  while (owner && (ts.isParenthesizedExpression(owner) || ts.isAsExpression(owner)
+                   || ts.isNonNullExpression(owner))) owner = owner.expression;
+  if (ts.isIdentifier(owner)) return identIsGlobal(owner) ? `${owner.text}.${member}` : null;
+  if (!ts.isPropertyAccessExpression(owner) || !owner.name?.text) return null;
+  let root = owner.expression;
+  while (root && (ts.isParenthesizedExpression(root) || ts.isAsExpression(root)
+                  || ts.isNonNullExpression(root))) root = root.expression;
+  if (!ts.isIdentifier(root) || !GLOBAL_ROOTS.has(root.text) || !identIsGlobal(root)) return null;
+  return `${owner.name.text}.${member}`;
+};
+// SOUNDNESS R281 — THE SAME QUESTION FOR A **BARE** GLOBAL, AND THE TABLE THE QUALIFIER FIX DID NOT REACH.
+// `globalBuiltinCallee` above canonicalises a MEMBER of a global object (`globalThis.Object.assign` ->
+// `Object.assign`). `structuredClone` is not a member of anything — it is a bare global — so it lives in
+// its own table (`ENV_TOUCHING_GLOBAL`) whose two consumers both tested `ts.isIdentifier(callee)`, and a
+// qualified spelling is a PropertyAccess. `f58dc0f` fixed FIVE member-keyed arms by routing them through
+// the helper above and left this one; `9a0cfd9` (R252) then added a NEW consumer of the same table with
+// the same identifier test, so it was born with the hole its sibling commit had just closed.
+//
+// MEASURED at 9a0cfd9, three isolated trees each containing exactly one function, `tsc --noEmit` clean:
+//
+//     structuredClone(process.env)              functions[] = [["src.only.leak",["Env"]]]   deny Env -> 1
+//     globalThis.structuredClone(process.env)   functions[] = []                            deny Env -> 0
+//     window.structuredClone(process.env)       functions[] = []                            deny Env -> 0
+//     self.structuredClone(process.env)         functions[] = []                            deny Env -> 0
+//
+// and `deny Unknown`, `deny Env Unknown`, `pure src.only.leak` and `deny Env src.only.leak` ALL exit 0 on
+// the three qualified spellings, with the scoped rule BINDING (a bogus name prints `matched NO function`;
+// these do not). No incidental catch anywhere — a whole-environment read reported as nothing at all.
+// EXECUTED on node 22.12.0 with `window`/`self` bound to `globalThis` as a browser/worker binds them:
+// each spelling really clones all 66 variables, a planted `CANDOR_SECRET` among them.
+//
+// `window.`/`self.` were asserted "identical BY CONSTRUCTION" in the row that filed this; they are not
+// asserted here, they are the two rows above, run.
+//
+// Returns the BARE global name a callee resolves to, or null. Shadow-guarded by the same `identIsGlobal`
+// the member helper uses, on the identifier that actually decides: the bare callee itself, or the
+// `globalThis`/`global`/`window`/`self` root. It can only make an existing text test recognise MORE
+// spellings of the same function; a project's own `structuredClone`, bare or hung off a shadowed root,
+// still matches nothing.
+const globalBareCallee = (callee) => {
+  if (!callee) return null;
+  if (ts.isIdentifier(callee)) return identIsGlobal(callee) ? callee.text : null;
+  if (!ts.isPropertyAccessExpression(callee) || !callee.name?.text) return null;
+  let root = callee.expression;
+  while (root && (ts.isParenthesizedExpression(root) || ts.isAsExpression(root)
+                  || ts.isNonNullExpression(root))) root = root.expression;
+  // ONLY a global ROOT, never an arbitrary owner: `Object.assign` must not read as the bare global
+  // `assign`, and `globalThis.Object.assign` must not read as the bare global `Object` — both are the
+  // member helper's business, and answering them here would be the second copy §G exists to prevent.
+  return ts.isIdentifier(root) && GLOBAL_ROOTS.has(root.text) && identIsGlobal(root) ? callee.name.text : null;
+};
 // True when `node` is a call to a global builtin that reads/writes every key of an object argument (so any
 // env-object argument makes the enclosing fn Env): `Object.*`/`Reflect.*`/`JSON.stringify` (member) or
 // `structuredClone` (bare). Guarded against a project-local shadow of the callee.
 const envTouchingBuiltinCall = (node) => {
   if (!ts.isCallExpression(node)) return false;
   const c = node.expression;
-  if (ts.isPropertyAccessExpression(c) && ts.isIdentifier(c.expression))
-    return ENV_TOUCHING_BUILTIN.has(`${c.expression.text}.${c.name.text}`) && identIsGlobal(c.expression);
-  if (ts.isIdentifier(c)) return ENV_TOUCHING_GLOBAL.has(c.text) && identIsGlobal(c);
-  return false;
+  // THE `globalThis.` QUALIFIER (SOUNDNESS row id pending — filed by the coordinator) — through
+  // `globalBuiltinCallee`, so `globalThis.Object.keys(process.env)` is the same call
+  // as `Object.keys(process.env)`. The old test required `c.expression` to be an IDENTIFIER, so the
+  // qualified spelling produced `"undefined.keys"` and read false: a whole-environment read reported as
+  // nothing. The shadow guard moves INTO the helper (it still checks `identIsGlobal` on the root), so
+  // this is not a widening of what counts as global, only of how it may be spelled.
+  if (ts.isPropertyAccessExpression(c) && ENV_TOUCHING_BUILTIN.has(globalBuiltinCallee(c) ?? "")) return true;
+  // R281 — the bare-global table, through `globalBareCallee`, so `globalThis.structuredClone(process.env)`
+  // is the same call as `structuredClone(process.env)`. The old test required an IDENTIFIER callee, so
+  // every qualified spelling read false: a whole-environment read reported as nothing. NOT a widening of
+  // what counts as global — the helper still asks `identIsGlobal` — only of how it may be spelled.
+  return ENV_TOUCHING_GLOBAL.has(globalBareCallee(c) ?? "");
 };
 
 /** ⟨R95⟩ Does this CALL reach the host's `fetch`, whatever the callee is spelled as?
@@ -6083,7 +6766,9 @@ function visitCalls(node) {
                   }
                 } else {
                   rec.direct.add("Unknown"); // override family too wide to enumerate soundly
-                  rec.why.add(dispatchWhy(decl.parent?.name?.getText?.(), decl.name?.getText?.())); // class-override dispatch (overridable member, unresolved/too-wide family) — canonical `dispatch:OWNER.member`, frontier-relevant
+                  // R284 — QUALIFIED, like its <=12 sibling four lines up and like every other emission
+                  // site. This one alone emitted a bare `dispatch:Shape.m`, which no frontier resolves.
+                  rec.why.add(dispatchWhy(memberOwnerQual(decl), decl.name?.getText?.())); // class-override dispatch (overridable member, unresolved/too-wide family) — canonical `dispatch:OWNER.member`, frontier-relevant
                 }
               }
             }
@@ -6181,13 +6866,23 @@ function visitCalls(node) {
                 // QUALIFIED owner (module.Type), matching the `mod.Class.member` fn quals so the
                 // dispatch-frontier (callers --include-unknown) can resolve overrides against the
                 // hierarchy sidecar. Bare `decl.parent.name` would not match a reacher's declaringType.
-                const tn = sigDecl.parent?.name
-                  ? `${moduleOf(sigDecl.parent.getSourceFile())}.${namespacePrefixOf(sigDecl.parent)}${sigDecl.parent.name.getText()}`
-                  : null;
+                // R284 — `memberOwnerQual`, not `parent?.name`: a MethodSignature in a `type X = {...}`
+                // has an owner (`X`) that only the ancestor walk can see, and demoting it to `callback:`
+                // moved its §6.2 class out of `dispatch`. Same helper as the class-override arm, so the
+                // two cannot answer this differently again.
+                const tn = memberOwnerQual(sigDecl);
                 // A CALL SIGNATURE has no member to name (`interface UnaryFunction { (x: T): R }`,
-                // `type PatchFn = (a, b) => void`), and a member of an ANONYMOUS type literal has no
-                // owner to name. Both are function-VALUE invocations, not member dispatch — see
-                // `dispatchWhy`. This is where all 1,234 malformed strings measured on a 15-repo corpus
+                // `type PatchFn = (a, b) => void`) — a function-VALUE invocation, not member dispatch.
+                //
+                // THE SECOND HALF OF THIS SENTENCE WAS FALSE FROM R284 UNTIL R359, and R355's commit
+                // message claimed to have corrected it while changing nothing here. It read "…and a
+                // member of an ANONYMOUS type literal has no owner to name". R284 gave such a member an
+                // owner deliberately — the named declaration that DECLARES the literal — which is right
+                // for `type Named = { m(): void }` and wrong the moment the walk leaves the type
+                // position. The rule now is: a literal in TYPE position takes the name of the
+                // declaration that declares it; a literal in VALUE position, or nested behind a
+                // property signature or a type argument, has no owner and stays `callback:`. See
+                // `VALUE_POSITION_BOUNDARY` and `dispatchWhy`. This is where all 1,234 malformed strings measured on a 15-repo corpus
                 // came from; the other emission sites produced none.
                 rec.why.add(dispatchWhy(tn, sigDecl.name?.getText?.())); // resolution landed on a type, not a body — canonical `dispatch:OWNER.member` (frontier-relevant)
               }
@@ -6233,8 +6928,19 @@ function visitCalls(node) {
               || (parent === "Console" && CLOCK_READING_CONSOLE_MEMBERS.test(name)))
             rec.direct.add("Clock");
           if (parent === "Math" && name === "random") rec.direct.add("Rand");
+          // R136 — …AND THROUGH A SUBCLASS. `checker.getTypeAtLocation(node.expression)` names the
+          // CALL-SITE expression's type, so `class MyDate extends Date {}` + `new MyDate()` reads
+          // "MyDate" and the clock read vanished — silently, with no `Unknown` and no `invisible`.
+          // The authority is the same one the connecting-ctor arm below now uses: the DECLARATION the
+          // constructor resolved to, which for an inherited implicit constructor is the BASE's construct
+          // signature, here `interface DateConstructor`. ADDITIVE (an `||`): a construction that named
+          // itself before still fires, so this can only add a Clock, never remove one. Ground truth
+          // EXECUTED on node 22.12.0 — `new MyDate()` and a two-level `class Deep extends MyDate {}`
+          // both return the current time; `new MyDate(0)` returns the epoch and is correctly NOT charged,
+          // because the zero-argument test is unchanged.
           if (ts.isNewExpression(node) && (node.arguments ?? []).length === 0
-              && checker.getTypeAtLocation(node.expression)?.symbol?.name === "DateConstructor")
+              && (checker.getTypeAtLocation(node.expression)?.symbol?.name === "DateConstructor"
+                  || declaredCtorClassName(decl) === "DateConstructor"))
             rec.direct.add("Clock");
           // Browser/runtime NETWORK globals declared in lib.dom — no importable module for the κ table to
           // key on, so they read SILENT-PURE. `XMLHttpRequest.send`/`.open` issue the HTTP request; the
@@ -6379,8 +7085,26 @@ function visitCalls(node) {
             // …through an alias too: `const W = WebSocket; new W(url)` reads a ctor named "W".
             // Same defect as the call path, one node type over — hence the SHARED unwrap.
             const unCtor = unaliasGlobal(node.expression);
-            const ctorName = unCtor.node.getText();
+            const ctorSiteName = unCtor.node.getText();
             if (unCtor.truncated) { const o = enclosing(node); if (o) fns.get(o).direct.add("Unknown"); }
+            // R136 — …AND THROUGH A SUBCLASS, which neither the call-site name nor the alias unwrap can
+            // see. `class Y3 extends WebSocket {}` declares no constructor, so `new Y3(u)` resolves to
+            // the BASE's construct signature and the identifier at the call site is "Y3" — no rule
+            // matches and a construction that opens a real socket reported NOTHING: absent from
+            // `functions[]`, no `invisible`, no `Unknown`, and `deny Net` went exit 1 -> exit 0. This is
+            // R130's own `declaredCtorClassName` walk, which landed on the κ arm's `ctorRuleName` and on
+            // the `super(…)` branch six lines up but NOT here, so the fix was invisible to any test that
+            // exercised the lib.dom path: under `types: ["node"]` the identical source read `['Net']`.
+            // Same discipline as `ctorRuleName`: consulted ONLY when the call-site name is not already a
+            // connecting ctor, and its answer used ONLY when it IS one — so it can add a name to the
+            // connecting set and can never take one away. `class Y1 extends Headers {}` (declared name
+            // "Headers", no rule) stays absent, measured. Ground truth EXECUTED on node 22.12.0: the
+            // implicit-constructor subclass fires one real upgrade handshake against an
+            // `http.createServer` listener, and so does a two-level `class ZZ extends Y3 {}`.
+            const ctorName = CONNECTING_WEB_CTORS.test(ctorSiteName)
+              ? ctorSiteName
+              : (CONNECTING_WEB_CTORS.test(declaredCtorClassName(decl))
+                 ? declaredCtorClassName(decl) : ctorSiteName);
             // R130 — the SHARED constant, not a literal pair repeated here. The identical two names are
             // now κ rules for `undici-types` (the package `@types/node` re-exports these globals from),
             // and this arm and that table answering the same question from two hand-kept lists is the
@@ -6857,6 +7581,54 @@ function visitCalls(node) {
       markEnv();
     }
   }
+  // R113 — WEB STORAGE, THE WHOLE INTERFACE, through the same six shapes the `process.env` block above
+  // enumerates. That block is the AUTHORITY for "a host object touched as a whole", not a template to
+  // paraphrase (§G): the question — which spellings reach a foreign key/value store — has one answer, and
+  // writing a second, shorter list is how the next spelling gets missed. The shapes are dot/bracket access
+  // (literal OR runtime key), destructuring, the `in` test, spread, a key-enumerating builtin, and for-in.
+  //
+  // `Unknown`, not `Fs`: the backing store is not modelled (a browser's is not a filesystem; node's
+  // `--localstorage-file` one is). That is R109's answer verbatim, and the point is that the two lib
+  // configurations converge on it. The reason names the interface actually resolved, so it gates as
+  // `Unknown[native]` exactly like the `setItem` call.
+  //
+  // THE WHOLE INTERFACE, NOT A VERB LIST — the denylist direction, R109's argument transferring verbatim.
+  // Reads persist across sessions and origins just as writes do, `length`/`key(i)` expose the stored key
+  // set, and an unlisted member would be silently pure. Over-charging a `Storage` receiver is a precision
+  // cost bounded to code that already touches web storage; under-charging one is the cardinal sin.
+  {
+    const markStore = (label) => {
+      const owner = enclosing(node);
+      if (!owner) return;
+      const r = fns.get(owner);
+      r.direct.add("Unknown");
+      r.why.add(`native:Storage.${label}`);
+    };
+    const memberLabel = (n) => (ts.isPropertyAccessExpression(n) ? (n.name?.getText?.() ?? "?")
+      : (n.argumentExpression && ts.isStringLiteralLike(n.argumentExpression)
+         ? n.argumentExpression.text : "[computed]"));
+    if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))
+        && isWebStorageExpr(node.expression)) {
+      markStore(memberLabel(node));
+    }
+    else if (ts.isVariableDeclaration(node) && node.name && ts.isObjectBindingPattern(node.name)
+             && node.initializer && isWebStorageExpr(node.initializer)) {
+      markStore("<destructure>");
+    }
+    else if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.InKeyword
+             && isWebStorageExpr(node.right)) {
+      markStore("<in>");
+    }
+    else if ((ts.isSpreadAssignment(node) || ts.isSpreadElement(node)) && isWebStorageExpr(node.expression)) {
+      markStore("<spread>");
+    }
+    else if (envTouchingBuiltinCall(node) && node.arguments.some((a) => isWebStorageExpr(a))) {
+      markStore("<enumerate>");
+    }
+    else if (ts.isForInStatement(node) && isWebStorageExpr(node.expression)) {
+      markStore("<for-in>");
+    }
+  }
   // Runtime GLOBALS reached as CALLS with no import for the κ resolver to classify: `process.hrtime()`/
   // `.hrtime.bigint()` is a monotonic clock read (Clock); `process.send(...)` is the child↔parent IPC
   // channel (Ipc); the global `fetch(...)` is the standard modern HTTP client (Net). Matched on the
@@ -7118,11 +7890,114 @@ function visitCalls(node) {
     }
     // Object.assign(target, ...sources) copies each SOURCE's own enumerable props → invokes their
     // getters (the object-spread twin). Enumerate the sources' local getters.
-    if (callee.getText().replace(/\s+/g, "") === "Object.assign") {
+    //
+    // R116 — …AND THE TARGET'S SETTERS, which the copy invokes for every key it writes. See
+    // `enumerateTargetSetters`: the source arm and the target arm are the two halves of one operation
+    // and only one of them existed.
+    // THE `globalThis.` QUALIFIER (SOUNDNESS row id pending — filed by the coordinator) — the SAME
+    // text, recognised through the qualifier too. `globalBuiltinCallee`
+    // is the one authority for that question (`envTouchingBuiltinCall` reads it as well); a second
+    // private copy is how the next spelling gets missed.
+    const ct116 = globalBuiltinCallee(callee) ?? callee.getText().replace(/\s+/g, "");
+    if (ct116 === "Object.assign") {
       const owner = enclosing(node);
-      for (const src of (node.arguments ?? []).slice(1)) {
+      const sources = (node.arguments ?? []).slice(1);
+      for (const src of sources) {
         enumerateGetters(owner, checker.getTypeAtLocation(src), src);
       }
+      // SHADOW-GUARDED, like the `Reflect.set` arm below. The getter line above is NOT — it matches
+      // `Object.assign` by TEXT, so a project's own `const Object = { assign(){} }` reaches it. That is
+      // pre-existing and is REPORTED rather than silently widened here (it is a fabrication-direction
+      // question of its own), but the charge this fix ADDS does not inherit the hole.
+      if (globalBuiltinCallee(callee) === "Object.assign")
+        enumerateTargetAccessors(owner, (node.arguments ?? [])[0], provenCopiedKeys(sources), "set",
+                                 { why: "dynamic-keyset", keyType: null });   // R247 — copies string AND symbol keys
+    }
+    // SOUNDNESS R252 — THE OTHER BUILTINS THAT READ EVERY OWN ENUMERABLE **VALUE**, AND THE COMMENT
+    // THAT RULED THEM OUT ON THE WRONG HALF OF THE QUESTION.
+    //
+    // `Object.entries`/`Object.values`/`JSON.stringify`/`structuredClone` each read every own enumerable
+    // property's VALUE, so each invokes an own enumerable getter exactly as a spread or an
+    // `Object.assign` SOURCE does. They are the same operation as the line above; nothing routed them
+    // through it. Executed: caller ABSENT from `functions[]` in all four, `deny Fs` and `pure` scoped to
+    // the caller both exit 0 over a tree containing nothing but the literal and the call.
+    //
+    // WHY IT SURVIVED, and it is the constraint on the fix rather than trivia. R115's comment states
+    // "`JSON.stringify(c)` and `Object.entries(c)` STAYING PURE IS CORRECT … (executed: 0 invocations on
+    // a class instance)". That is TRUE — a class accessor is installed on the prototype and is
+    // non-enumerable, so these never visit it — and it is FALSE for an object LITERAL, whose getter is an
+    // OWN enumerable property. The sentence measured the case in front of it and then read as a general
+    // ruling. §K, in a comment written by the commit that needed it.
+    //
+    // SO THE CLASS-INSTANCE ANSWER MUST NOT MOVE — it is correct, and it is this fix's over-charge
+    // control. That is why this routes through `enumerateGetters` rather than growing a private loop:
+    // `classBodiedGetter` is exactly R115's exclusion, so the correct half is preserved BY CONSTRUCTION
+    // instead of by a second implementation that has to remember to agree (§G).
+    //
+    // GROUND TRUTH EXECUTED, node 22.12.0, counting real getter invocations — object LITERAL vs CLASS
+    // instance. The zeroes are as load-bearing as the ones: they are the rest of the sweep, and they are
+    // why this list is four names and not "every whole-object builtin".
+    //     Object.entries 1/0   Object.values 1/0   JSON.stringify 1/0   structuredClone 1/0
+    //     Object.keys 0/0      Object.getOwnPropertyNames 0/0      Object.getOwnPropertyDescriptors 0/0
+    //     Object.freeze 0/0    Object.seal 0/0     for..in 0/0     console.log 0/0   String(o) 0/0
+    //     `${o}` 0/0           util.inspect(o) 0/0                 assert.deepStrictEqual 0/0
+    // `Object.keys` and `getOwnPropertyNames` read NAMES, never values; a descriptor read returns the
+    // accessor function itself without calling it; `console.log`/`util.inspect` print `[Getter]`.
+    // (`Object.assign` and spread are the line above; `{...o}`/rest are the object-literal arm.)
+    //
+    // RESIDUALS, stated as the open list they are: `console.log("%j", o)` and
+    // `util.inspect(o, {getters: true})` DO invoke (executed 1) and are option/format-string dependent;
+    // and every one of these reads NESTED objects too — `JSON.stringify({ a: lit })` and
+    // `structuredClone([lit])` invoke the getter one level down (executed 1), which no arm here reaches
+    // because `enumerateGetters` asks the ARGUMENT's own property list.
+    // R281 — `structuredClone` asks `globalBareCallee`, the SAME authority the Env arm asks, so the two
+    // consumers of `ENV_TOUCHING_GLOBAL` cannot drift the way they just did. The identifier-only test
+    // this replaces was copied here by R252 from the Env arm six commits after `f58dc0f` had fixed the
+    // identical hole one table over.
+    if (["Object.entries", "Object.values", "JSON.stringify"].includes(globalBuiltinCallee(callee))
+        || globalBareCallee(callee) === "structuredClone") {
+      const arg = (node.arguments ?? [])[0];
+      if (arg) enumerateGetters(enclosing(node), checker.getTypeAtLocation(arg), arg);
+    }
+    // R116 §9 — WIDENED PAST THE ROW'S OWN TRIGGER, by grepping the MECHANISM ("a builtin that writes a
+    // property into a caller-supplied target") rather than the one call the row named. `Reflect.set(t, k,
+    // v)` is specified to run the setter the property lookup finds, and it was silent for the same reason
+    // — EXECUTED, 1 setter invocation for both the literal-key and the runtime-key spelling, and both
+    // ABSENT from `functions[]` before this. A literal key names exactly one property; a runtime key can
+    // name any, so it falls to the unprovable branch and charges every setter the target declares.
+    // (`Object.defineProperty`/`defineProperties` are deliberately NOT here: a descriptor INSTALLS a
+    // property and bypasses the setter — executed, 0 invocations — and the engine already indexes those
+    // through `definePropAccessors`. `Object.create`/`structuredClone`/spread all build fresh objects.)
+    //
+    // SHADOW-GUARDED with `identIsGlobal`, which the `Object.assign` line above still is not — a
+    // project's own `const Object = …` would match its text test. Left as it is rather than widened
+    // silently: it is a separate (fabrication-direction) question, it is REPORTED rather than folded in
+    // here, and this new arm does not inherit the hole.
+    //
+    // SOUNDNESS R251 — `Reflect.get(t, k)` IS THE SAME ARM, AND IT DID NOT EXIST. Found the way R116's
+    // own `Reflect.set` sibling was: by grepping the MECHANISM rather than the name. The two are one
+    // table entry apart in `ENV_TOUCHING_BUILTIN` above, and only one of them had an accessor arm.
+    // EXECUTED: 1 getter invocation for the literal-key spelling AND for the runtime-key one, on an
+    // object literal AND on a class instance; the caller was ABSENT from `functions[]` in all four.
+    //
+    // ONE key-set expression for both directions, deliberately, because two spellings of one question
+    // is what R247 was filed to close and a second copy here would reopen it (§G / F1-3). Today it is a
+    // string-literal test: a literal key names exactly one property, anything else falls to the
+    // unprovable branch and DISCLOSES. It is knowingly weaker than `accessorsAt`, which pins a key
+    // whose TYPE names a finite set (R240(a): `const k = "token"`, a literal union, a string enum) — so
+    // `s[k] = v` resolves a pinned key while `Reflect.set(s, k, v)` discloses `Unknown` for it. That
+    // residual fails in the DISCLOSE direction, not the silent one, so it is a precision gap and is
+    // REPORTED as its own row rather than folded into this fix's pricing.
+    const reflectKeySet = (k) => (k && ts.isStringLiteralLike(k) ? new Set([k.text]) : null);
+    for (const [name, kind] of [["Reflect.set", "set"], ["Reflect.get", "get"]]) {
+      if (globalBuiltinCallee(callee) !== name) continue;
+      const k = (node.arguments ?? [])[1];
+      // R247 — an unprovable key here answers with R240(b)'s OWN tag, because `Reflect.set(t, k, v)` and
+      // `t[k] = v` are one operation: one runtime key, at most one setter (executed above). R251 —
+      // `Reflect.get(t, k)` and `t[k]` are that same one operation on the read side, so it takes the
+      // same tag; a `deny Unknown[reflect]` written for one already selects the other.
+      enumerateTargetAccessors(enclosing(node), (node.arguments ?? [])[0], reflectKeySet(k), kind,
+                               { why: "dynamic-key", keyType: k ? checker.getTypeAtLocation(k) : null });
     }
   }
   // GET/SET ACCESSOR access (the silent-pure-accessor fix): a property read that resolves to a
@@ -7142,25 +8017,33 @@ function visitCalls(node) {
     const compoundAssign = isBinAssign && !simpleAssign
       && p.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && p.operatorToken.kind <= ts.SyntaxKind.LastAssignment;
     const recordKind = (kind) => {
-      const hit = accessorAt(node, kind);
-      if (hit) {
+      const hits = accessorsAt(node, kind);
+      if (hits && hits.length) {
         const owner = enclosing(node);
         if (!owner) return;
-        const an = hit.decl.parent?.name?.getText?.() ?? "?";
         const pn = node.name?.getText?.() ?? node.argumentExpression?.getText?.() ?? "?";
-        recordAccessorHit(owner, hit, `${an}.${pn}`);
+        // R284 — `?` is not an owner. A type-alias-declared accessor's parent is a TypeLiteral with no
+        // name; the alias that declares it does have one. BARE here, matching this label's existing
+        // spelling (`reflect:` detail is best-effort per §4, and requalifying it would move strings
+        // nothing asked to move) — the fallback only fires where the old code printed `?`.
+        for (const hit of hits) {
+          const aOwner = hit.decl.parent?.name?.getText?.() ?? namedTypeAncestor(hit.decl)?.name?.getText?.() ?? "?";
+          recordAccessorHit(owner, hit, `${aOwner}.${pn}`, node.expression);
+        }
         return;
       }
       // No type-level accessor — try the `Object.defineProperty` runtime-accessor index. The checker
       // types target.key as a data prop, so an effectful defineProperty getter/setter is invisible to
-      // accessorAt; consult definePropForceTarget so the forcing site edges to the descriptor unit
+      // accessorsAt; consult definePropForceTarget so the forcing site edges to the descriptor unit
       // (precise) instead of reading silent-pure (the cardinal sin). A descriptor we minted is always
       // local, so this is an EDGE; never Unknown for a resolved-and-seen descriptor.
-      const dpNode = definePropForceTarget(node, kind);
-      if (dpNode) {
+      const dpNodes = definePropForceTarget(node, kind);
+      if (dpNodes.length) {
         const owner = enclosing(node);
-        const t = owner && nodeName.get(dpNode);
-        if (t) fns.get(owner).edges.add(t);
+        if (owner) for (const dpNode of dpNodes) {
+          const t = nodeName.get(dpNode);
+          if (t) fns.get(owner).edges.add(t);
+        }
         return;
       }
       // A computed-key descriptor accessor on this receiver's target means `recv.<anything>` MIGHT
@@ -7176,6 +8059,61 @@ function visitCalls(node) {
         if (kinds && kinds.has(kind)) {
           const owner = enclosing(node);
           if (owner) { fns.get(owner).direct.add("Unknown"); fns.get(owner).why.add(`reflect:defineProperty:dynamic-key`); } // dynamic-key descriptor install — metaprogramming, canonical `reflect:`
+          return;
+        }
+      }
+      // SOUNDNESS R240(b) — AN UNPINNABLE KEY ON A RECEIVER THAT DECLARES ACCESSORS.
+      // `hits === null` means the key names no finite property set (`k: string`), so R240(a)'s resolver
+      // had nothing to enumerate. Charging every declared accessor would be a guess about WHICH one runs;
+      // saying nothing certifies the caller pure, which is the cardinal sin. Disclose `Unknown` — the
+      // posture this same function already takes eleven lines up for a computed-key `defineProperty`
+      // descriptor, and the one §4 prescribes for an unresolvable target.
+      //
+      // GATED ON THE RECEIVER'S OWN DECLARATIONS, so it is not a blanket hedge on every `obj[k] = v`: a
+      // receiver type that declares NO accessor of this kind cannot invoke one, and stays ABSENT
+      // (executed: 0 real writes). Measured over 17 corpus entries — 5,535 unpinnable element accesses,
+      // of which 14 sit on a receiver declaring an accessor of the wanted kind.
+      if (hits === null) {
+        const rt = checker.getTypeAtLocation(node.expression);
+        // A SYMBOL-NAMED accessor (`get [Symbol.toStringTag]() {…}`) cannot be reached by a STRING key,
+        // and arming the disclosure on one is a fabrication, not a hedge. FOUND BY AUDITING THE CORPUS
+        // ROWS RATHER THAN THE COUNT: the first cut of this branch fired on all six flagged
+        // `AxiosHeaders` methods in axios 1.7.2 — every one because `AxiosHeaders` declares
+        // `get [Symbol.toStringTag]()`, which `self[key]` with `key: string` can never name. The
+        // exclusion is a DENYLIST of the PROVEN-unreachable: it fires only when EVERY declaration of
+        // the property has a computed name whose expression is symbol-TYPED, and it lifts entirely if
+        // the key's own type could hold a symbol (`PropertyKey`, `symbol`, `any`).
+        // BOTH DIRECTIONS, because the first cut had only one and the corpus caught it twice. A string
+        // key cannot name a symbol property, AND a symbol key cannot name a string one — the mirror was
+        // missing and produced the whole of this branch's measured price: mongoose 8's 18 rows traced to
+        // ONE direct source, `types/objectid.js:39` `ObjectId.prototype[objectIdSymbol] = true` with
+        // `objectIdSymbol: unique symbol`, armed by bson's STRING-named `get id()`. Same audit-boundary
+        // error one line over from the fix for it.
+        // R247 — the two-way symbol/string test now lives in `keyCouldNameAccessor`, ONE authority shared
+        // with `enumerateTargetSetters`'s `Reflect.set` arm. The behaviour here is unchanged (pinned by
+        // the four symbol rows below); what changed is that the other spelling now asks the same code.
+        const keyT = ts.isElementAccessExpression(node) && node.argumentExpression
+          ? checker.getTypeAtLocation(node.argumentExpression) : null;
+        for (const prop of (rt?.getProperties?.() ?? [])) {
+          if (!accessorsFromSym(prop, kind).length) continue;
+          if (!keyCouldNameAccessor(prop, keyT)) continue;
+          const owner = enclosing(node);
+          if (owner) { fns.get(owner).direct.add("Unknown"); fns.get(owner).why.add(`reflect:accessor:dynamic-key`); } // runtime-chosen property name — metaprogramming, canonical `reflect:`
+          return;
+        }
+        // …and the same question for a `defineProperty` DESCRIPTOR: the descriptor was installed under a
+        // LITERAL key (so `definePropDynamicKey` above does not fire) but is being reached through an
+        // unpinnable one, which is the mirror of that case and was silent for the mirror reason.
+        if (definePropAccessors.size > 0) {
+          const r0 = checker.getSymbolAtLocation(node.expression);
+          const r1 = r0 && (r0.flags & ts.SymbolFlags.Alias)
+            ? (() => { try { return checker.getAliasedSymbol(r0); } catch { return r0; } })() : r0;
+          const byKey = (r1 && definePropAccessors.get(r1)) || (r0 && definePropAccessors.get(r0));
+          if (byKey) for (const e of byKey.values()) if (e?.[kind]) {
+            const owner = enclosing(node);
+            if (owner) { fns.get(owner).direct.add("Unknown"); fns.get(owner).why.add(`reflect:accessor:dynamic-key`); }
+            break;
+          }
         }
       }
     };
@@ -7200,8 +8138,9 @@ function visitCalls(node) {
         const keyName = ts.isIdentifier(key) ? key.text
           : ts.isStringLiteralLike(key) ? key.text : null;
         if (keyName === null) continue; // computed key (`{[k]: v}`) — unresolvable to one property
-        const hit = accessorFromSym(recvType?.getProperty?.(keyName), "get");
-        if (hit) recordAccessorHit(owner, hit, keyName);
+        for (const sym of propertySymbolsAcrossArms(recvType, keyName))   // R259
+        for (const hit of accessorsFromSym(sym, "get"))
+          recordAccessorHit(owner, hit, keyName);
       }
     }
   }
@@ -8731,6 +9670,37 @@ let peekAttempted = false;
 // per CLASS, so the answer is too: a class is peeked only when no file of that class went unread.
 const peekUnread = new Set();
 let peekUnattributed = false;
+// ⟨0.19⟩/⟨0.24⟩ SPEC §6.2 — THE POLICY'S REASON-CLASS VOCABULARY (`.candor/config` `unknown-alias`),
+// parsed ONCE here and read by BOTH the peek below and the §6.2 gate far below. It used to be parsed only
+// at the gate, and the peek passed a bare `{}` in its place.
+//
+// R154: `{}` is not an EMPTY alias map, it is an object with no `.has`. `parsePolicy`'s alias arm reads
+// `else if (aliases && aliases.has(cn))` — truthy, then TypeError — so the FIRST `Unknown[<token>]` whose
+// token is not `*`, `dynamic` or a built-in REASON_CLASS threw straight into the peek's catch, leaving
+// `peekPolicy` null. The peek was then never ATTEMPTED, which is strictly worse than a peek that ran and
+// found nothing: `outOfScope` and `scannedUnder` go ABSENT rather than `[]`, `excluded[].peeked` reads
+// false, and ⟨0.30⟩'s fail-closed INCOMPLETE verdict never arms. MEASURED on published 0.35.0 over one
+// excluded file performing `Fs`: `deny Fs` alone exits 2 naming the function; adding `deny Unknown[corp]`
+// beside it exits 0 `policy ✓` with no disclosure of any kind. An unrelated rule turned a red verdict
+// green — while the gate honoured that same rule correctly, so two paths disagreed about one policy.
+//
+// THE TRIGGER IS A TOKEN THE MAP IS NEEDED FOR, not an alias being defined. `Unknown[nosuchalias]` disarms
+// the peek identically; there the gate's own §6.2 refusal happens to hold the exit at 2, which is why only
+// the defined-alias spelling surfaces as a silent under-report. `Unknown[reflect]` (a built-in class)
+// never reaches the alias arm and was always fine — that pair is what isolates the arm.
+//
+// ANCHORED AT THE POLICY FILE, the same anchor the gate uses (SPEC §3.1 `99eb4e9`) — vocabulary travels
+// with the policy that uses it, and two anchors would expand one rule two ways. Memoized rather than
+// eager, so `parseUnknownAliases`'s own stderr warnings are still printed exactly once.
+let policyAliasMap = null, policyAliasErrs = null;
+const policyAliases = () => {
+  if (policyAliasMap === null) {
+    policyAliasErrs = [];
+    policyAliasMap = parseUnknownAliases(discoverConfigText(policyVocabularyAnchor(policyPath, target)),
+                                         policyAliasErrs);
+  }
+  return policyAliasMap;
+};
 if (policyPath) {
   // ⟨0.33⟩ NO LONGER GATED ON `excludedFiles.length`. A tree with a policy and NOTHING excluded used to
   // skip this whole block, so `outOfScopeFindings`/`scannedUnderRules` stayed `null` and both
@@ -8747,17 +9717,40 @@ if (policyPath) {
   // run must not fail the gate" catch — findings silently empty, gate green. The catch is right; a bug
   // hiding behind it is not, which is why the trigger below is now a POSITIVE test on the rules.
   let peekPolicy = null;
-  try {
-    const pol = parsePolicy(fs.readFileSync(policyPath, "utf8"), {});
+  // R154 — THE CATCH COVERS THE READ ONLY. It used to wrap the parse too, and its own comment named only
+  // the read ("an unreadable policy"), which is exactly how the TypeError above sat behind it for a whole
+  // rung: the ⟨0.30⟩ note above already records a ReferenceError hiding in this same catch, and answered it
+  // by tightening the TRIGGER — which does nothing for a throw one line earlier. The ARGUMENT for
+  // narrowing, stated as the assumption it is: the gate below calls the SAME `parsePolicy` on the SAME
+  // bytes with the SAME map and no `try` at all, so on every input that reaches both, a throw here is one
+  // that would kill the run at the gate anyway — catching it only moved where it died and made one of the
+  // two places a silent green. That holds while both reach the parse, which is every run bar a policy file
+  // that becomes unreadable between these two lines.
+  //
+  // ONE MEASURED BEHAVIOUR CHANGE, and it moves the right way. `policyAliases()` runs here now, and
+  // `discoverConfigText` refuses an existing-but-unreadable `.candor/config` with `process.exit(2)`. Where
+  // the policy is filed in a tree of its OWN whose config is unreadable — the only case the target-anchored
+  // reads at :1151/:1314 do not already catch — the refusal now lands BEFORE the envelope is written
+  // instead of after. MEASURED both arms: exit 2 either way, report WRITTEN at 0.35.0 and NONE here, which
+  // is the §3.1 posture (a refusal produces no report), not a regression from it.
+  let peekText = null;
+  try { peekText = fs.readFileSync(policyPath, "utf8"); }
+  catch { /* an unreadable policy is the gate's business to refuse (exit 2), not the peek's */ }
+  if (peekText !== null) {
+    const pol = parsePolicy(peekText, policyAliases());
     // ⟨0.29⟩ A REFUSED POLICY LEAVES THE KEY ABSENT (SPEC §2). The peek is a producer reading the policy,
     // so §3.1 binds it exactly as it binds the gate: over a policy no route will honour, `outOfScope: []`
     // claims a look taken against rules that never stood, and the `denied` set it would look for is the
     // parser's SALVAGE of an unhonourable file — the rewriting `fatalPolicyErrors` exists to refuse.
     // candor-java already withheld here; this engine, candor-rust and candor-swift did not.
-    if (!fatalPolicyErrors(pol.errors).length) {
+    // R154: the ALIAS-DEFINITION errors count under that same rule, and the gate already folds them into
+    // its own refusal (`parseErrs` below). `unknown-alias corp = reflect,nativ` keeps `corp` in the map, so
+    // `pol.errors` alone is EMPTY and the peek would have published `outOfScope`/`scannedUnder` against a
+    // policy the gate is about to refuse at exit 2 — a look taken under rules that never stood.
+    if (!fatalPolicyErrors([...policyAliasErrs, ...pol.errors]).length) {
       peekPolicy = pol;
     }
-  } catch { /* an unreadable policy is the gate's business to refuse, not the peek's */ }
+  }
   // ⟨0.30⟩ THE TRIGGER IS "ARE THERE DENY RULES", not "is the flattened effect-name set non-empty". The
   // old test read the name set, and `pure` is a deny rule with an EMPTY effect list meaning "every effect
   // except Unknown" — so under the STRICTEST policy the set was empty, the peek never ran, and the tree
@@ -9545,8 +10538,12 @@ if (policyPath !== null) {
     // with the policy filed outside the scan target the two expanded the SAME rule differently and §3.1's
     // byte-equality MUST was breakable by a file that is neither the report nor the policy. `net-partner`
     // (above, at the target) is deliberately NOT moved: it describes the thing being scanned.
-    const parseErrs = [];
-    const unknownAliases = parseUnknownAliases(discoverConfigText(policyVocabularyAnchor(policyPath, target)), parseErrs);
+    // R154 — THE SAME MAP THE PEEK USED, not a second parse of the same file. The peek passed `{}` and this
+    // route passed the real vocabulary, so one `Unknown[<alias>]` line meant two different things to two
+    // paths reading one policy: the gate honoured it, the peek threw on it. `policyAliases()` is memoized
+    // above, so the alias parser's own stderr warnings are still printed exactly once per run.
+    const unknownAliases = policyAliases();
+    const parseErrs = [...policyAliasErrs];
     const gatePolicy = parsePolicy(text, unknownAliases);
     parseErrs.push(...gatePolicy.errors);
     // ⟨0.28⟩ SPEC §6.2 — the LINES THE PARSE DROPPED, for the verdict document below. Non-fatal by