candor-ts 0.36.2 → 0.38.0

package/AGENTS.md

@@ -23,7 +23,7 @@ the TypeScript-specific production + query surface.
 > **Already installed? Report the version and ask before upgrading — before you scan.** If this
 > project already has candor (a `.candor/` report directory, or `candor-ts` reachable via `npx`/a
 > global install), do this *first*: run `npx -y candor-ts --version` (offline) and **tell the user
-> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.36)."*
+> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.38)."*
 > On a build too old for the flag, read `candor.version` / `candor.spec` from an existing
 > `.candor/report*.json`, or `npm ls -g candor-ts`.
 >

package/README.md

@@ -201,7 +201,7 @@ pure-vs-Unknown ruling (PART 16) — the engines must answer identically, on eve
 | A call resolving to a *type* (function-typed field/param) → `Unknown`, never silent-pure | SPEC §4 |
 | Unmatched external calls contribute nothing (curated-classifier caveat) | SEMANTICS §8 C1 |
 | The literal surfaces `hosts`/`cmds`/`paths`/`tables`, literal-read only | SPEC §2 |
-| `{ candor: { version, toolchain, spec: "0.36" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
+| `{ candor: { version, toolchain, spec: "0.38" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
 | Call-graph sidecar with **every** analyzed function a key | SPEC §2.2 |
 | The gate: AS-EFF-006 / 008 / 009, loud on an unreadable policy | SPEC §6.2 |
 
@@ -219,7 +219,7 @@ read the Rust source".
 
 ## Status
 
-0.30.0, speaking candor-spec 0.36: the analysis core, the gate (`--policy` / `--gate-json` /
+0.30.0, speaking candor-spec 0.38: the analysis core, the gate (`--policy` / `--gate-json` /
 `.candor/config`), the full §3.1 query surface (including `containment`, `blindspots`, the
 `--include-unknown` dispatch frontier, and ⟨0.24⟩ `gate --report` — the gate applied to an EXISTING
 report, byte-equivalent to `scan --policy`'s verdict), the MCP server, the LSP server, and the watch loop are
@@ -268,7 +268,13 @@ did not already choose to install.
 
 Discovery is passive: the manifest is [`server.json`](server.json), published to the official
 [MCP Registry](https://registry.modelcontextprotocol.io) so clients and directories can find candor
-without being handed a script. The registry verifies namespace ownership through the marker below.
+without being handed a script.
+
+The registry verifies namespace ownership from the **`mcpName` field in `package.json`** — that is the
+npm mechanism. (A `mcp-name:` README marker is the *crates.io* convention and does nothing here; the
+first cut of this used it, and the registry refused the publish with
+`missing required 'mcpName' field`. The line below is kept only because it is how a human greps for the
+namespace.)
 
 mcp-name: io.github.tombaldwin/candor
 

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "candor-ts",
-  "version": "0.36.2",
-  "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.36)",
+  "version": "0.38.0",
+  "mcpName": "io.github.tombaldwin/candor",
+  "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.38)",
   "type": "module",
   "dependencies": {
     "@types/node": "^25.9.2",

package/query-core.mjs

@@ -10,6 +10,7 @@
  */
 import fs from "node:fs";
 import nodePath from "node:path";
+import { RESERVED_SIDECAR_SEGMENTS } from "./scan-core.mjs";
 import { reasonClass, REASON_CLASSES, DYNAMIC_CLASSES, resolveReasonClasses, reasonClassesMatch,
          classFilterExcludes, netClassResolver, reportNetClasses, unanswerableScoped,
          effectiveInferred, reportUnits } from "./policy.mjs";
@@ -44,7 +45,14 @@ function siblings(prefix, predicate) {
 // exists to prevent. CAUGHT BY PART 56 the moment ⟨0.32⟩ landed in this engine: a refusal "left a report",
 // because discovery counted the marker the refusal had just written. Adding a file kind beside the
 // reports means teaching discovery about it in the same change.
-export const isReport = (f) => !f.endsWith(".callgraph.json") && !f.endsWith(".hierarchy.json") && !f.endsWith(".locs.json") && !f.includes(".encountered-") && !f.endsWith(".calibrated.json") && !f.endsWith(".gate.json") && !f.endsWith(".refused.json");
+// DERIVED from SPEC §2.2's reserved set, not restated. This was seven chained `endsWith` calls and it
+// was MISSING `layerreach` — so `<prefix>.<crate>.<kind>.layerreach.json`, which candor-rust really
+// writes, came back `true` from a predicate whose whole job is "is this a report". Measured: a
+// `map --json` over a good rust report flipped to the INCOMPLETE shape with two malformed-report
+// diagnostics. `encountered-*` stays a separate `.includes()` because it is a prefix FAMILY, not a
+// fixed trailing segment.
+export const isReport = (f) =>
+  !RESERVED_SIDECAR_SEGMENTS.some((seg) => f.endsWith(`.${seg}.json`)) && !f.includes(".encountered-");
 
 // A report exists at the prefix if there's an exact `<prefix>.json` (candor-ts) OR a sibling
 // `<prefix>.<crate>.scan.json` (the candor-scan/Rust multi-report form) — the loaders read both, so a
@@ -153,7 +161,11 @@ const reportFilesAt = (prefix) => (fs.existsSync(`${prefix}.json`) ? [`${prefix}
 // beside-the-report layout — the exact spelling `--gate-json` exists for, pinned by the control test —
 // and `encountered-*` because it is engine-local scan bookkeeping no query reads. Existing files only:
 // the guard protects data, and a sidecar not on disk has none to lose.
-const PAIRED_SIDECAR_SEGMENTS = ["calibrated", "callgraph", "hierarchy", "layerreach", "locs"];
+// A DELIBERATE SUBSET of the reserved set, with both exclusions NAMED rather than achieved by omission
+// — a copy that is shorter than its source cannot be read as intentional. Derived, so an eighth
+// reserved segment arrives here automatically.
+const PAIRED_SIDECAR_EXCLUDED = new Set(["gate", "refused"]);
+const PAIRED_SIDECAR_SEGMENTS = RESERVED_SIDECAR_SEGMENTS.filter((s) => !PAIRED_SIDECAR_EXCLUDED.has(s));
 export function gateReportInputFiles(prefix) {
   if (!prefix) return [];
   const out = [];

package/query.mjs

@@ -717,7 +717,7 @@ function renderPathHuman(fns, cg, fnQ, eff, hedge = false) {
 // package.json; SPEC_VERSION is the spec contract this build speaks. Reused, never re-littered.
 const QUERY_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(QUERY_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.36";
+const SPEC_VERSION = "0.38";
 
 // ---- the §3.3.1 canonical query grammar (⟨0.10⟩, additive over 0.9) --------------------------------
 // One shape for every verb: `<verb> <verb-args…> [--report <locator>] [--policy <file>] [--json]

package/scan-core.mjs

@@ -191,6 +191,104 @@ export const CLOCK_READING_CONSOLE_MEMBERS = /^(time|timeEnd|timeLog)$/;
 export const CONNECTING_WEB_CTORS = /^(WebSocket|EventSource)$/;
 export const WEB_WIRE_MEMBERS = /^(send|close)$/;
 
+/** THE CALL-CLASSIFICATION NAME SETS — module scope, and exported for the R111 reason above.
+ *
+ * All four lived ~740 lines INSIDE scan.mjs's `visitCalls`, re-allocated on every classified call and,
+ * more to the point, unimportable: no test could identity-check one, so every assertion about them had
+ * to be a hand-copied spelling asserted through a scan — which is exactly how R109 and R110 drifted.
+ * They close over nothing. The PREDICATES that read them do (`isConnectingCtor` and `netEstablishing`
+ * close over `ctorRuleName`/`mod`), and those stay in scan.mjs; these are pure literal sets.
+ *
+ * They are deliberately NOT merged with scan.mjs's `NET_USE_VERBS`, which spells some of the same names
+ * while answering a DIFFERENT question — "is this call's argument 0 a PAYLOAD rather than a locator?" —
+ * and fails in the opposite direction. Two questions, two sets.
+ */
+
+// The net cluster's documented public CONNECTING constructors. `new X()` normally synthesizes the member
+// token "new" so a κ rule can exempt inert construction from a module-wide effect (`new http.Agent()`),
+// BUT a connecting constructor is NOT inert: `new http.ClientRequest(url)` performs the network I/O on
+// construction (it is what `http.request()` returns and dispatches), so the blanket `new`-exemption would
+// convert a real Net source into pure — a cardinal-sin under-report. For such a ctor scan.mjs synthesizes
+// the CLASS name instead of "new", so the net-cluster rule's `/^(?!new$)/` matcher keeps the effect.
+// http2 connects via `connect()` (a function, not a ctor) so it needs no entry here. Inert ctors
+// (Agent/Server/Socket/TLSSocket/Http2Server*/message shells) still synthesize "new" and stay pure.
+// `CONNECTING_WEB_CTORS` above is the es-lib arm of the same question and is read beside this set.
+export const CONNECTING_CTORS = new Set(["ClientRequest"]);
+
+// SPEC §2.2's RESERVED TRAILING SEGMENTS — the family-wide set, and the ONE owner of it in this engine.
+//
+// §2.2 exists, in its own words, "because the engines were already drifting on it": three of the four
+// excluded these by name and one discriminated by segment count, and the by-name lists DISAGREED. A
+// consumer with the shorter list claims another engine's sidecar as a report.
+//
+// This engine had THREE spellings and they disagreed: `isReport`'s chained `endsWith` calls in
+// query-core.mjs (six segments, MISSING `layerreach`), and two five-name arrays in query-core.mjs and
+// scan.mjs. MEASURED 2026-09-13, and the missing one was live: candor-rust writes
+// `<prefix>.<crate>.<kind>.layerreach.json`, `isReport` called it a REPORT, and a `map --json` over a
+// perfectly good rust report flipped from `{"(root)": …}` to `{"incomplete": …, "modules": …}` with two
+// "malformed report" diagnostics — fail-closed and disclosed, so not a cardinal sin, but it breaks the
+// cross-engine premise this loader states in its own comment ("an agent queries a report from any
+// language identically").
+//
+// `encountered-*` is NOT here: it is a FAMILY matched by prefix, not a fixed trailing segment, and the
+// engine-local scan bookkeeping no query reads. It stays an explicit `.includes()` at the one predicate
+// that needs it, rather than being smuggled into a list of exact segments.
+export const RESERVED_SIDECAR_SEGMENTS =
+  ["callgraph", "hierarchy", "calibrated", "layerreach", "locs", "gate", "refused"];
+
+// Host-ESTABLISHING Net call names (the masking-fix allowlist): a Net call by one of these whose
+// host is not a captured literal leaves the host invisible. Excludes use-verbs (write/end/send on
+// a connected socket). `post/put/patch/delete/head/options` cover the axios/got/undici tier whose
+// URL is the call arg (sweep [18]); `dgram.send(buf,port,host)` is added module-aware by
+// scan.mjs's `netEstablishing` (UDP has no connect, so send carries the destination — sweep [12]).
+// SOUNDNESS R410 — THE RESOLVER FAMILY WAS MISSING, and its absence is a GATE BYPASS, not a
+// missed disclosure. `dns.resolve` classifies Net (see the κ table below), so a resolver call
+// carries the effect while contributing NO host; with this list not naming it, nothing marked
+// the surface incomplete and a benign sibling `fetch("https://api.stripe.com")` certified a
+// caller-controlled DNS target — `allow Net api.stripe.com` exit 0, measured, with the
+// sibling-free control correctly caught by AS-EFF-008. Written as the WHOLE family rather than
+// the spelling in hand (R346): every node `dns` resolver, the `dns/promises` twins (same names)
+// and the `Resolver` class methods, which share these member names. test.mjs pins that family by
+// IDENTITY against this export — the assertion R410 shipped without, because the set was unreachable.
+//
+// NOTE THE SHAPE PROBLEM THIS DOES NOT FIX. This set is an INCLUSION list, so forgetting a
+// member UNDER-reports — the opposite of `FS_USE_VERBS`/`EXEC_USE_VERBS` below, where
+// forgetting over-charges and is safe. That asymmetry is the defect class itself: java's Net
+// is sound precisely because it uses the general rule (any Net call contributing no visible
+// host leaves the surface incomplete) rather than a list. The durable repair is to INVERT this
+// into a use-verb denylist beside the other two; that is a wider change with its own
+// over-charge bill to price, so it is filed rather than smuggled in here.
+
+export const NET_ESTABLISHING = new Set(["request", "get", "post", "put", "patch", "delete", "head",
+  "options", "connect", "createConnection", "fetch",
+  "lookup", "lookupService", "reverse", "resolve", "resolve4", "resolve6", "resolveAny",
+  "resolveCname", "resolveCaa", "resolveMx", "resolveNaptr", "resolveNs", "resolvePtr",
+  "resolveSoa", "resolveSrv", "resolveTlsa", "resolveTxt"]);
+
+// Fs/Exec USE-verbs whose LOCATOR was fixed earlier, not an arg of THIS call — so a missing literal
+// here is the legitimate split-construct/use shape, never the masking signal (the establishing-
+// allowlist discipline, generalized from Net to all 4 effects; sweep [11]). Fs: the fd/FileHandle
+// ops (fd came from open()); the path-taking fs.* fns are establishing. Exec: ChildProcess methods
+// (the command was fixed at spawn); the spawn fns are establishing.
+// The node `fs` verbs whose FIRST argument is a DESCRIPTOR, not a path — the fd came from a
+// prior `open()` whose path this analysis already saw, so their invisible destination is not a
+// gap and marking them `incomplete` charges every buffered write in a real tree.
+//
+// ⟨0.29⟩ `readv`/`writev` (+Sync) were MISSING, and the ⟨0.29⟩ positional-literal fix is what
+// made it visible: before it, `writev(fd, "/tmp/lit")` had its literal found ANYWHERE in the
+// call and published as a path — a fabrication — so the set was never consulted for these four.
+// Killing the fabrication moved them into the other wrong bucket. Found by generating a case
+// per node `fs` export rather than reasoning about the list (24 fd verbs in node, 20 here).
+//
+// Forgetting a member here OVER-charges (safe); adding a path-taking verb by mistake
+// UNDER-reports. An allowlist is the right shape for exactly that reason — the inverse of
+// the denylist rule that governs the classifier surface.
+export const FS_USE_VERBS = new Set(["write", "writeSync", "read", "readSync", "close", "closeSync",
+  "fsync", "fsyncSync", "fdatasync", "fdatasyncSync", "ftruncate", "ftruncateSync", "fchmod",
+  "fchmodSync", "fchown", "fchownSync", "futimes", "futimesSync", "fstat", "fstatSync",
+  "readv", "readvSync", "writev", "writevSync"]);
+export const EXEC_USE_VERBS = new Set(["kill", "send", "disconnect", "ref", "unref"]);
+
 // ---- κ — the curated classifier (CLASSIFIER §2: the dispatch/execution boundary, not builders) ----
 // Node builtins + a curated npm tier (the same under-report-and-say-so posture as the crate table:
 // an unlisted package contributes nothing — never a guess).

package/scan.mjs

@@ -37,7 +37,8 @@ import { isTestPath, kappa, kappaKnows, nodeCoreUnreviewed, fsKind, commandHeadE
          tablesInSql, modelHostEffects, isModelHost, isModelSdkPackage, netClassesOf,
          partnerFor, CLOCK_READING_PERFORMANCE_MEMBERS, CLOCK_READING_PROCESS_MEMBERS,
          CLOCK_READING_CONSOLE_MEMBERS, CONNECTING_WEB_CTORS,
-         WEB_WIRE_MEMBERS } from "./scan-core.mjs";
+         WEB_WIRE_MEMBERS, CONNECTING_CTORS, NET_ESTABLISHING, FS_USE_VERBS,
+         EXEC_USE_VERBS, RESERVED_SIDECAR_SEGMENTS } from "./scan-core.mjs";
 import { emitSurface } from "./surface.mjs";
 
 const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
@@ -48,7 +49,7 @@ const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 // literal stamped into the envelope's `spec` field, so the doc lines and the report can never drift.
 // Reused, never re-littered.
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(ENGINE_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.36";
+const SPEC_VERSION = "0.38";
 
 // A TREE TOO DEEP TO WALK IS "COULD NOT EVALUATE" (exit 2), NEVER "FOUND A VIOLATION" (exit 1).
 //
@@ -691,7 +692,14 @@ const outArmedSidecars = [];
 // destroying it from the report sink is precisely the cross-sink harm §3.3.1 measures, failing OPEN in
 // the way `armGateJsonFailClosed` refuses to. `encountered-*` is a prefix family rather than a segment
 // and belongs to no report's pair. Exclusion by argument, not by a shorter list.
-const REPORT_SIDECAR_SEGMENTS = ["callgraph", "hierarchy", "locs", "calibrated", "layerreach"];
+// …and `refused` is the THIRD exclusion, which this list dropped by OMISSION while the paragraph above
+// argued the other two. The ⟨0.32⟩ refusal MARKER has its own lifecycle — a run that completes its
+// write phase removes it, and the rung guarantees a LOST marker fails OPEN while a STALE one fails
+// CLOSED. Sweeping it from the report sink makes "lost" the common case, inverting exactly that. Named
+// now, so all three exclusions are arguments rather than a shorter list, which is what the paragraph
+// above already claimed of this line.
+const REPORT_SIDECAR_EXCLUDED = new Set(["gate", "refused"]);
+const REPORT_SIDECAR_SEGMENTS = RESERVED_SIDECAR_SEGMENTS.filter((s) => !REPORT_SIDECAR_EXCLUDED.has(s));
 const removeArmedReportSidecars = (report, prefix, inputs) => {
   const stem = report.replace(/\.json$/i, "");
   for (const seg of REPORT_SIDECAR_SEGMENTS) {
@@ -2925,9 +2933,62 @@ const FS_TWO_PATH_MEMBERS = new Set([
   "copyFile", "copyFileSync", "cp", "cpSync", "rename", "renameSync",
   "link", "linkSync", "symlink", "symlinkSync",
 ]);
+// SOUNDNESS R416 — A LOCATOR THAT IS DETERMINED IS DETERMINED HOWEVER IT REACHES THE CALL. This
+// function read ONLY a syntactic string literal sitting in the path position, so a path bound one line
+// above was lost entirely. MEASURED on shipped 0.36.2:
+//     export function f() { const p = "/tmp/benign"; fs.writeFileSync(p, ""); }
+//        ->  paths: null, incomplete: ["Fs"]   =>  `allow Fs /tmp/benign` REFUSES a fully determined write
+//     export function g() { fs.writeFileSync("/tmp/benign", ""); }
+//        ->  paths: ["/tmp/benign"]            =>  certified, correctly
+// rust credits a plain local and a const; java and swift credit it; ts was the worst of the four
+// (conformance `gen_stat_locator.py`, arm `a4local`, which exists to pin exactly this).
+//
+// THIS FAILS CLOSED, so it is precision, not soundness — but it is SEQUENCING-CRITICAL. "Captured" has
+// to be a VALUE fact before any further rung marks a surface incomplete because "the locator was not
+// captured", or every such rung compounds the over-mask. Under-approximation stays permitted: what is
+// NOT resolved (a `let`, a parameter, a concatenation, a `path.join`) keeps today's behaviour and its
+// `incomplete` marker.
+//
+// THE RESOLVER IS `constStringValue`, unchanged and already trusted by the Net surface for the identical
+// question (`resolveConstUrlString` has read it since ⟨0.29⟩). Its bar is strict: EVERY value declaration
+// of the symbol must be an immutable `const` (or `readonly` field) whose initializer is a plain string
+// literal, and conflicting declarations resolve to null. Reusing it rather than writing a second path
+// resolver is the point — R288's fifteen-copies shape is what a private one would start.
+//
+// FAILURE DIRECTION, both ways, because this function feeds TWO consumers:
+//   · `lits` is PUBLISHED as `paths`. Resolving a value wrongly would FABRICATE a locator — the cardinal
+//     direction — which is why the resolver's bar is "every declaration is a const string literal" and
+//     not "some declaration looks like one".
+//   · `complete` SUPPRESSES the masking guard. Resolving more means marking `incomplete` less, so the
+//     same wrong resolution would also un-mask. One resolver, one bar, both consumers.
+// Siblings NOT touched here: `programHeadLiteral` (Exec) and the SQL slot (Db) have the same gap, each
+// with its own over-charge bill to price. Filed, not smuggled in.
+//
+// `CANDOR_R416_HITS=1` prints one stderr line naming the members whose const-bound path was resolved —
+// the R103 hit-counter pattern, kept for the same reason (an A/B that comes back byte-identical says
+// nothing until the corpus is shown to REACH the branch). It prints ONLY when the count is non-zero,
+// and that is not a detail: the first run of this probe emitted its summary line unconditionally, so
+// `corpus-ab.py --mark R416PROBE` counted 7 hits across 7 entries over a corpus whose real hit count
+// was 0 — a flattering reach figure manufactured by the instrument, which is AGENT-CORPUS-BRIEF §E1
+// happening to the very measurement written to prevent it.
+const R416_HITS = process.env.CANDOR_R416_HITS ? new Map() : null;
+const r416Hit = (k) => { if (R416_HITS) R416_HITS.set(k, (R416_HITS.get(k) ?? 0) + 1); };
+if (R416_HITS) process.on("exit", () => {
+  const rows = [...R416_HITS].sort();
+  const total = rows.reduce((a, [, n]) => a + n, 0);
+  if (total) process.stderr.write(`R416PROBE total=${total}`
+    + rows.map(([k, n]) => ` ${k}=${n}`).join("") + "\n");
+});
 function fsPathLiteral(node, member) {
   const args = node.arguments ?? [];
-  const at = (i) => (args[i] && ts.isStringLiteralLike(args[i]) ? args[i].text : null);
+  const at = (i) => {
+    const a = args[i];
+    if (!a) return null;
+    if (ts.isStringLiteralLike(a)) return a.text;
+    const c = constStringValue(a);          // R416 — a const-bound path is a captured path
+    if (c != null) r416Hit(member);
+    return c;
+  };
   const a0 = at(0);
   const needsTwo = FS_TWO_PATH_MEMBERS.has(member);
   const a1 = needsTwo ? at(1) : null;
@@ -7145,69 +7206,12 @@ function visitCalls(node) {
           // The member token κ matches: the resolved declaration's name, EXCEPT a `new X()` call,
           // whose declaration is a Constructor (empty name) — synthesize "new" so a rule can exempt
           // inert construction from its module-wide effect (the net cluster: `new http.Agent()` etc.).
-          // BUT a CONNECTING constructor is NOT inert: `new http.ClientRequest(url)` performs the
-          // network I/O on construction (it is what `http.request()` returns and dispatches), so the
-          // blanket `new`-exemption would convert a real Net source into pure (a cardinal-sin under-
-          // report). For such a ctor we synthesize the CLASS name instead of "new", so the net-cluster
-          // rule's `/^(?!new$)/` matcher keeps the effect. The set is the net cluster's documented
-          // public connecting ctors; http2 connects via `connect()` (a function, not a ctor) so it
-          // needs no entry here. Inert ctors (Agent/Server/Socket/TLSSocket/Http2Server*/message shells)
-          // still synthesize "new" and stay pure.
-          const CONNECTING_CTORS = new Set(["ClientRequest"]);
+          // A CONNECTING ctor is the exception to that exemption; the set, and why, is in scan-core.
           // R130 — `new WebSocket(url)` / `new EventSource(url)` are the same shape as `ClientRequest`:
           // the connection is opened BY the construction, so the blanket `new`-exemption would convert a
           // real Net source into pure. Read from the SHARED constant the es-lib arm reads, so the two
           // resolution paths cannot be widened separately.
           const isConnectingCtor = (n) => CONNECTING_CTORS.has(n) || CONNECTING_WEB_CTORS.test(n);
-          // Host-ESTABLISHING Net call names (the masking-fix allowlist): a Net call by one of these whose
-          // host is not a captured literal leaves the host invisible. Excludes use-verbs (write/end/send on
-          // a connected socket). `post/put/patch/delete/head/options` cover the axios/got/undici tier whose
-          // URL is the call arg (sweep [18]); `dgram.send(buf,port,host)` is added module-aware below (UDP
-          // has no connect, so send carries the destination — sweep [12]).
-          // SOUNDNESS R410 — THE RESOLVER FAMILY WAS MISSING, and its absence is a GATE BYPASS, not a
-          // missed disclosure. `dns.resolve` classifies Net (see the κ table below), so a resolver call
-          // carries the effect while contributing NO host; with this list not naming it, nothing marked
-          // the surface incomplete and a benign sibling `fetch("https://api.stripe.com")` certified a
-          // caller-controlled DNS target — `allow Net api.stripe.com` exit 0, measured, with the
-          // sibling-free control correctly caught by AS-EFF-008. Written as the WHOLE family rather than
-          // the spelling in hand (R346): every node `dns` resolver, the `dns/promises` twins (same names)
-          // and the `Resolver` class methods, which share these member names.
-          //
-          // NOTE THE SHAPE PROBLEM THIS DOES NOT FIX. This set is an INCLUSION list, so forgetting a
-          // member UNDER-reports — the opposite of `FS_USE_VERBS`/`EXEC_USE_VERBS` below, where
-          // forgetting over-charges and is safe. That asymmetry is the defect class itself: java's Net
-          // is sound precisely because it uses the general rule (any Net call contributing no visible
-          // host leaves the surface incomplete) rather than a list. The durable repair is to INVERT this
-          // into a use-verb denylist beside the other two; that is a wider change with its own
-          // over-charge bill to price, so it is filed rather than smuggled in here.
-          const NET_ESTABLISHING = new Set(["request", "get", "post", "put", "patch", "delete", "head",
-            "options", "connect", "createConnection", "fetch",
-            "lookup", "lookupService", "reverse", "resolve", "resolve4", "resolve6", "resolveAny",
-            "resolveCname", "resolveCaa", "resolveMx", "resolveNaptr", "resolveNs", "resolvePtr",
-            "resolveSoa", "resolveSrv", "resolveTxt"]);
-          // Fs/Exec USE-verbs whose LOCATOR was fixed earlier, not an arg of THIS call — so a missing literal
-          // here is the legitimate split-construct/use shape, never the masking signal (the establishing-
-          // allowlist discipline, generalized from Net to all 4 effects; sweep [11]). Fs: the fd/FileHandle
-          // ops (fd came from open()); the path-taking fs.* fns are establishing. Exec: ChildProcess methods
-          // (the command was fixed at spawn); the spawn fns are establishing.
-          // The node `fs` verbs whose FIRST argument is a DESCRIPTOR, not a path — the fd came from a
-          // prior `open()` whose path this analysis already saw, so their invisible destination is not a
-          // gap and marking them `incomplete` charges every buffered write in a real tree.
-          //
-          // ⟨0.29⟩ `readv`/`writev` (+Sync) were MISSING, and the ⟨0.29⟩ positional-literal fix is what
-          // made it visible: before it, `writev(fd, "/tmp/lit")` had its literal found ANYWHERE in the
-          // call and published as a path — a fabrication — so the set was never consulted for these four.
-          // Killing the fabrication moved them into the other wrong bucket. Found by generating a case
-          // per node `fs` export rather than reasoning about the list (24 fd verbs in node, 20 here).
-          //
-          // Forgetting a member here OVER-charges (safe); adding a path-taking verb by mistake
-          // UNDER-reports. An allowlist is the right shape for exactly that reason — the inverse of
-          // the denylist rule that governs the classifier surface.
-          const FS_USE_VERBS = new Set(["write", "writeSync", "read", "readSync", "close", "closeSync",
-            "fsync", "fsyncSync", "fdatasync", "fdatasyncSync", "ftruncate", "ftruncateSync", "fchmod",
-            "fchmodSync", "fchown", "fchownSync", "futimes", "futimesSync", "fstat", "fstatSync",
-            "readv", "readvSync", "writev", "writevSync"]);
-          const EXEC_USE_VERBS = new Set(["kill", "send", "disconnect", "ref", "unref"]);
           // `ctorRuleName` (below) rather than `ctorClassName`: a connecting ctor reached through a local
           // alias must still fail the surface closed on a runtime URL. Evaluated at call time, after it.
           const netEstablishing = (member) =>