candor-ts 0.39.0 → 0.39.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.39.0",
+  "version": "0.39.2",
   "mcpName": "io.github.tombaldwin/candor",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.39)",
   "type": "module",

package/scan.mjs

@@ -242,7 +242,29 @@ const noteRefusalTarget = (t)   => { if (refusalTarget === null) refusalTarget =
 const writeRefusalMarker = (why) => {
   if (!refusalPrefix) return;
   try {
-    fs.mkdirSync(path.dirname(refusalPrefix), { recursive: true });
+    // ⟨SOUNDNESS R520⟩ THE MARKER MAY CREATE ITS OWN `.candor`, AND NOT A TREE ABOVE IT.
+    //
+    // `recursive: true` made every refusal a `mkdir -p` of the prefix's WHOLE path, and that prefix is
+    // derived from the first bare token — so `candor-ts nonexistent-target /also-bogus` exited 2
+    // (correctly) and left `./nonexistent-target/.candor/report.refused.json` in the operator's cwd: a
+    // directory tree named after a TYPO. Found as litter in the candor umbrella's own checkout, by no
+    // gate. candor-java and candor-swift create nothing here, so this is two engines disagreeing with
+    // two and no clause has to move.
+    //
+    // The distinction the recursive form missed: ⟨0.28⟩'s fail-closed sink exists to REPLACE a previous
+    // run's document, so a later reader cannot mistake a stale report for a current one. A target that
+    // does not exist never held a report, so the write has nothing to fail closed OVER — it is pure
+    // side effect. Where the target DOES exist the marker still lands, `.candor` and all: CLI-1b's own
+    // control asserts that on a FRESH project, which is why this is not a blanket `existsSync` on the
+    // dirname — that spelling would mute the marker on exactly the case the rung is FOR.
+    //
+    // A bare non-recursive `mkdirSync` would encode the same rule (ENOENT into the catch below), but it
+    // would also throw EEXIST on the ordinary path, so both conditions are spelled out instead.
+    const markerDir = path.dirname(refusalPrefix);
+    if (!fs.existsSync(markerDir)) {
+      if (!fs.existsSync(path.dirname(markerDir))) return;   // nothing to fail closed OVER
+      fs.mkdirSync(markerDir);
+    }
     fs.writeFileSync(`${refusalPrefix}.refused.json`, JSON.stringify({
       candor: { spec: SPEC_VERSION }, refused: true,
       prefix: refusalPrefix, target: refusalTarget ?? ".", reason: String(why),
@@ -4582,11 +4604,38 @@ function contextualInterfaceDeclsFor(node, depth = 0) {
   }
   return direct;
 }
+// ⟨R64⟩'s unit local, spelled ONCE. `ownedByDecoratorArgument` below and `decoratorArgUnit` itself are
+// its only two readers; a second literal spelling is a second thing to keep in step. Declared above
+// `walkStructural` rather than beside `decoratorArgUnit`, because that walk RUNS at this point in module
+// evaluation and a `const` declared further down would be in its temporal dead zone.
+const DECORATOR_ARG_LOCAL = "<decorator-arg>@";
+/** ⟨SOUNDNESS R531, conformance PART 82⟩ Is this node's attribution owner ⟨R64⟩'s synthesized
+ *  decorator-ARGUMENT unit? Asks `enclosing` — the authority — rather than re-deriving "am I inside a
+ *  decorator argument" from the AST: two paths computing one fact is how this file has been bitten
+ *  before, and `enclosing`'s own R64 climb is subtler than any restatement of it (it distinguishes an
+ *  effect embedded in the argument DATA from an unresolvable decorator FACTORY, and `prev`-vs-`p`
+ *  decides which). `enclosing` may CREATE that unit as a side effect; it is dropped from `functions[]`
+ *  when nothing effectful lands in it, which PART 82's own `ctrllit`/`ctrlpure` arms assert. */
+function ownedByDecoratorArgument(node) {
+  const owner = fns.get(enclosing(node));
+  return !!owner && typeof owner.local === "string" && owner.local.startsWith(DECORATOR_ARG_LOCAL);
+}
 // Mint (or ALIAS to an existing unit) every member of a structural implementor `container`
 // (ObjectLiteralExpression's `.properties` or a ClassExpression's `.members` — both walked generically,
 // same shape as the nominal branch's own `cls.members`). Position-keyed, like `decoratorArgUnit` /
 // `staticBlockUnit` above — two structural implementors in one file must not collide.
-function mintStructuralMembers(container) {
+// ⟨SOUNDNESS R531⟩ `bodiesOnly` — mint the members whose BODY is written here, and take no position on
+// the members that merely REFERENCE a function declared elsewhere. The alias arm at the bottom of this
+// function sets `nodeName` to an EXISTING unit, which makes `enclosing()` stop at that property; that is
+// right when the literal is a structural IMPLEMENTOR (a dispatch on the abstraction has to land
+// somewhere) and wrong for a bare literal in any other position. MEASURED, and it is not hypothetical:
+// `({ count: c.count } = { count: 7 })` parses as an ObjectLiteralExpression in DESTRUCTURING-TARGET
+// position, its `count: c.count` alias resolves to the accessor unit `C.count`, and the setter
+// invocation the assignment performs was then attributed to the ACCESSOR instead of to the function
+// containing the assignment — test.mjs `[32]` went red on the first build of this fix, which is the
+// only reason the arm is split. Body-minting cannot do that: a unit minted from a body it owns moves
+// no effect that was not already inside it.
+function mintStructuralMembers(container, bodiesOnly = false) {
   const sf = container.getSourceFile();
   const mod = moduleOf(sf);
   const members = container.properties ?? container.members ?? [];
@@ -4612,6 +4661,7 @@ function mintStructuralMembers(container) {
     // result, a conditional, an opaque holder), is left UNRESOLVED — `nodeName.has(prop)` stays false, so
     // the dispatch site's `allResolved` gate reads this implementor as incomplete and forces Unknown: the
     // disjunction's (b) arm, never silence.
+    if (bodiesOnly) continue; // ⟨R531⟩ see the header — aliasing is an implementor's privilege, not a literal's
     const bound = unwrapBind(init);
     const ref = bound ? bound.ref : ((ts.isIdentifier(init) || ts.isPropertyAccessExpression(init)) ? init : null);
     if (ref) {
@@ -4621,6 +4671,25 @@ function mintStructuralMembers(container) {
     }
   }
 }
+/** ⟨SOUNDNESS R531⟩ THE MINTED UNIT IS KEYED ON THE PROPERTY, AND RESOLUTION ARRIVES AT THE
+ *  INITIALIZER. `mintStructuralMembers` sets `nodeName` on the PropertyAssignment/PropertyDeclaration,
+ *  but `realDecl` unwraps `a.roll` straight to the ArrowFunction that initialises it — so a plain
+ *  `nodeName.get(decl)` misses by exactly one node. Spelled ONCE, because ⟨R531b⟩'s pre-pass has to ask
+ *  the SAME question the call walk asks ("can this decl already be resolved to a unit?") and two
+ *  spellings of one fact is how this file has been bitten before (§G). MEASURED: the first build of
+ *  R531b asked only `nodeName.has(arrow)` and so minted a SECOND unit over a body R531 had already
+ *  minted — bson's `src.extended_json.serializeDocument` went from calling `<structural>@10049.Binary`
+ *  to calling `<callable>@10057`, one body through two units, which is exactly the double count
+ *  conformance PART 82 pins. Narrow by construction: only an arrow/fn-expression sitting DIRECTLY in a
+ *  property, and only a `nodeName` entry that already exists — no unit is invented here. */
+function callTargetUnit(decl) {
+  const direct = nodeName.get(decl);
+  if (direct) return direct;
+  if ((ts.isArrowFunction(decl) || ts.isFunctionExpression(decl)) && decl.parent
+      && (ts.isPropertyAssignment(decl.parent) || ts.isPropertyDeclaration(decl.parent)))
+    return nodeName.get(decl.parent);
+  return undefined;
+}
 function mintPositionalStructuralUnit(mod, sf, prop, name) {
   const qual = `${mod}.<structural>@${prop.getStart()}.${name}`;
   if (!fns.has(qual)) {
@@ -4632,6 +4701,50 @@ function mintPositionalStructuralUnit(mod, sf, prop, name) {
                     endLine: sf.getLineAndCharacterOfPosition(prop.getEnd()).line + 1 });
   }
   nodeName.set(prop, qual);
+  // ⟨SOUNDNESS R519⟩ CONTAINMENT. Minting is an ADDITION, never a MOVE.
+  //
+  // `enclosing()` returns the FIRST ancestor carrying a `nodeName`, so the line above — which exists to
+  // give the member an addressable unit a dispatch can land on — also silently STOPS the member's body
+  // being charged to the function that lexically contains it. Whenever no in-scan dispatch resolves to
+  // the minted unit, the effects then sit in a unit reachable from nothing and the enclosing function
+  // reads PURE: SPEC §2 rule 3's positive purity claim over code this engine read and understood.
+  //
+  // Nothing in a producer package need ever dispatch on a DEPENDENCY's abstraction — R512's own measured
+  // shape is a package that merely SUPPLIES an implementor — and the orphaning is not confined to that
+  // case: a union arm's type-literal member, an index-signature interface's member, and any member the
+  // matched interface does not declare are unreachable by name in ANY scan. MEASURED, v0.38.3 vs the
+  // released v0.39.0, one package, no chain, no unscanned dispatcher: ten spellings went `['Rand']` ->
+  // ABSENT with `deny Rand` exit 1 -> exit 0 (the R519 block in test.mjs, generated from one template).
+  //
+  // THE CONDITION IS UNCONDITIONAL, and that is a decision, not an omission. The obvious narrowing —
+  // "charge unless the member is provably dispatched in-scan" — is UNSOUND for this property: a
+  // dispatch elsewhere in the scan charges the DISPATCHING unit, never the enclosing one, so the
+  // containing function would still read pure over a body written inside it. MEASURED: a function that
+  // builds a class expression and calls its `size` two lines later still lost that `Rand` on v0.39.0.
+  // The exception would also remove charges v0.38.3 made, which is the one direction a fix for a silent
+  // under-report may not move in.
+  //
+  // FAILURE DIRECTION: OVER-charge. A function that builds an implementor it never runs is charged for
+  // what that implementor would do. That is the same over-approximation this engine already makes for
+  // EVERY closure it does not mint — an untyped `{ run(){ … } }` in the same position has always been
+  // charged to its enclosing function (asserted as `viaUntyped` in the R519 block) — so the fix removes
+  // an inconsistency rather than introducing an approximation.
+  //
+  // ALIASES ARE DELIBERATELY EXCLUDED: `mintStructuralMembers`'s `go: other.method` arm sets `nodeName`
+  // to an EXISTING unit and never reaches here. That body is not lexically contained, referencing a
+  // function is not calling it, and v0.38.3 charged nothing for it either — charging it would be a
+  // fabrication introduced in the name of closing an under-report.
+  const owner = enclosing(prop.parent);
+  if (owner && owner !== qual) {
+    fns.get(owner)?.edges.add(qual);
+    // REACH PROBE, env-gated and left in place deliberately. A byte-identical A/B over a corpus that
+    // cannot reach a changed branch is the most flattering number available and the least informative,
+    // and it has been mistaken for evidence four times in this family. `CANDOR_R519_REACH=1` makes this
+    // branch announce itself on stderr so `bin/corpus-ab.py --mark` can COUNT the hits rather than
+    // anyone inferring them afterwards by grep. Off by default: no output, one env read per minted
+    // member.
+    if (process.env.CANDOR_R519_REACH) console.error(`R519-REACH ${qual} <- ${owner}`);
+  }
 }
 for (const sf of sources) {
   (function walkStructural(node) {
@@ -4642,11 +4755,67 @@ for (const sf of sources) {
     // never structurally satisfy an interface with any member on its own.
     if (ts.isObjectLiteralExpression(node) && node.properties.length > 0) {
       const decls = contextualInterfaceDeclsFor(node);
-      if (decls.local.length || decls.foreign.length) {
-        for (const d of decls.local) registerStructuralImpl(d, node);
-        for (const d of decls.foreign) registerForeignStructuralImpl(d, node);
-        mintStructuralMembers(node);
-      }
+      for (const d of decls.local) registerStructuralImpl(d, node);
+      for (const d of decls.foreign) registerForeignStructuralImpl(d, node);
+      // ⟨SOUNDNESS R531⟩ MINT THE MEMBERS OF EVERY OBJECT LITERAL, not only of a contextually-typed one.
+      //
+      // Minting used to be gated on the literal matching some interface, because minting existed only to
+      // give a DISPATCH somewhere to land. But a minted unit is also the only thing a DIRECT call on the
+      // literal — `const u = { roll: (n) => Math.random() }; u.roll(n)` — can resolve to, and an untyped
+      // literal never reached here. The resolution then landed on the ARROW ITSELF, which the call site
+      // waves through as "already walked lexically" (see the `isArrowFunction` arm in the call walk): true
+      // of the arrow's LEXICAL owner, false of the CALLER. So the caller vanished from `functions[]`
+      // entirely — SPEC §2 rule 3's positive purity claim over a body this engine had read and charged
+      // one unit over.
+      //
+      // MEASURED at v0.38.3, v0.39.0, v0.39.1 and HEAD alike (so NOT an R519 regression): with
+      // `const a = { roll: (n: number) => Math.floor(Math.random() * n) }`, `function A1(n) { return
+      // a.roll(n) }` is ABSENT from `functions[]` and `deny Rand src.index.A1` exits 0 while
+      // `deny Rand src.index.A8` — the same body reached through a plain function — exits 1. Seven
+      // spellings: arrow and function-expression initializers, `as const`, a nested two-hop literal, an
+      // exported literal, a factory-returned literal, and the untyped-parameter caller.
+      //
+      // THE SPELLING ASYMMETRY IS THE TELL, and it is why this was invisible: `{ roll(n){…} }` — method
+      // SHORTHAND on the very same untyped literal — is a MethodDeclaration, not an arrow, so it misses
+      // that arm and discloses an honest `Unknown[callback:roll]`. One literal, two spellings, one loud
+      // and one silent.
+      //
+      // MINTING IS SAFE TO WIDEN ONLY BECAUSE ⟨R519⟩ MADE IT ADDITIVE. Before `mintPositionalStructuralUnit`
+      // gained its containment edge, extending minting to every literal would have MOVED the body of every
+      // `{ onClick: () => … }` out of its enclosing function — R519's own defect, multiplied. The
+      // containment edge is what makes this monotone-up: the enclosing unit keeps the charge, and the
+      // caller gains a unit to resolve to.
+      //
+      // FAILURE DIRECTION: PRECISION-POSITIVE, not over-charge. This resolves rather than hedges — the
+      // method-shorthand spelling goes `Unknown` -> the concrete effect, and a PURE member's caller stays
+      // ABSENT (asserted as the `P1`/pure twin in the R531 block). The rejected alternative was to disclose
+      // `Unknown` at the call site whenever the arrow is not lexically inside the caller; it closes the
+      // same silence and was MEASURED to charge `Unknown` to a caller of `{ twice: (n) => n * 2 }`, which
+      // is closing a silence by flooding the other channel — the trade ⟨0.39⟩'s cost model forbids.
+      //
+      // ONE POSITION IS EXCLUDED, AND CONFORMANCE PART 82 IS WHY. ⟨R64⟩ already mints a unit for a
+      // closure embedded directly in a DECORATOR'S ARGUMENT DATA — `@Factory({ init: () => { … } })` is
+      // the literal example in `decoratorArgUnit`'s own docstring — and that unit exists precisely
+      // because there is no declaration anywhere else for the body to land on. Minting the property as
+      // well splits one non-callable piece of syntax into TWO reported units, and ⟨R519⟩'s containment
+      // edge then feeds the effect back up, so `deny Fs` scores the same `readFileSync` twice:
+      // PART 82 `defect-shape2-argclosure-gate` went `notok count:1` -> `notok count:2`. Fails closed
+      // either way, so it is a double count and not a soundness regression — but a count the family has
+      // pinned four-way is a contract.
+      //
+      // THE BOUND IS "NOT A BINDING SITE", NOT "MAKE PART 82 PASS". A decorator argument is an anonymous
+      // expression: TypeScript gives no way to name that literal, so no call site anywhere can ever
+      // resolve `init`, and the unit R531 mints to be resolved AGAINST can never be reached. Skipping it
+      // costs nothing and returns this position to exactly its pre-R531 behaviour, which was never
+      // silent — the body is charged to `<decorator-arg>@N` and the gate fires.
+      //
+      // THE NEIGHBOURS WERE CHECKED RATHER THAN ASSUMED, because an audit drawn around its own trigger
+      // is this project's most expensive habit. The other synthetic attribution units are `moduleUnit`
+      // and `staticBlockUnit`, and BOTH are real binding sites: `static { const u = { roll: () => … };
+      // u.roll() }` resolves, and so does the module-scope form that R531 was filed for. They are NOT
+      // excluded, and the R531 block asserts both still charge their caller.
+      const bodiesOnly = !(decls.local.length || decls.foreign.length);
+      if (!(bodiesOnly && ownedByDecoratorArgument(node))) mintStructuralMembers(node, bodiesOnly);
     } else if (ts.isClassExpression(node)) {
       // Explicit `implements` on an anonymous/named class EXPRESSION — the nominal branch above only
       // ever visits `ts.isClassDeclaration`, so `held = new (class implements Task { go(){…} })()`
@@ -5340,7 +5509,7 @@ function staticBlockUnit(node) {
 function decoratorArgUnit(callNode) {
   const sf = callNode.getSourceFile();
   const mod = moduleOf(sf);
-  const local = `<decorator-arg>@${callNode.getStart()}`;
+  const local = `${DECORATOR_ARG_LOCAL}${callNode.getStart()}`;
   const qual = `${mod}.${local}`;
   let rec = fns.get(qual);
   if (!rec) {
@@ -7237,7 +7406,17 @@ function visitCalls(node) {
           }
         }
         if (mod === "<local>") {
-          const targetName = nodeName.get(decl);
+          // ⟨SOUNDNESS R531⟩ the property mint is keyed one node ABOVE the arrow resolution lands on;
+          // `callTargetUnit` is that lookup, spelled once and shared with ⟨R531b⟩'s pre-pass (see its
+          // docstring). Widening the mint without this line leaves the sin open — measured: the R531
+          // arms stayed ABSENT — so the two halves are one fix.
+          const mintedOnProp = nodeName.get(decl) ? undefined : callTargetUnit(decl);
+          // REACH PROBE, env-gated, same contract as ⟨R519⟩'s above: a byte-identical A/B over a corpus
+          // that cannot reach the changed branch is the most flattering number available and the least
+          // informative. `CANDOR_R531_REACH=1` makes THIS branch — the one that turns a silent caller
+          // into a charged one — announce itself so `bin/corpus-ab.py --mark` can count it.
+          if (mintedOnProp && process.env.CANDOR_R531_REACH) console.error(`R531-REACH ${owner} -> ${mintedOnProp}`);
+          const targetName = nodeName.get(decl) ?? mintedOnProp;
           if (targetName) {
             rec.edges.add(targetName); // (EDGE) — cross-FILE edges resolve the same way
             // Class-CHA fan-out: resolution landed on a base-class member that LOCAL subclasses
@@ -8834,6 +9013,113 @@ function visitCalls(node) {
   }
   ts.forEachChild(node, visitCalls);
 }
+/** ⟨SOUNDNESS R531b⟩ AN ARROW A CALL RESOLVES TO, THAT NO BINDING SITE EVER NAMED.
+ *
+ * ⟨R531⟩ closed the OBJECT-LITERAL-PROPERTY route by minting the property. This is the same silence one
+ * construct over, and it has no property to key on: `const c = (() => (n: number) => Math.random()*n)();
+ * function C(n){ return c(n) }` — the checker resolves `c(n)` to the ARROW returned by the IIFE, that
+ * arrow is nobody's initializer, so `nodeName` has no entry and the call walk's last `else if` waves it
+ * through on the grounds that "its body is visible and already walked lexically". That is true of the
+ * arrow's LEXICAL owner (here the module initializer) and FALSE of the caller, which then vanishes from
+ * `functions[]` entirely — SPEC §2 rule 3's positive purity claim over a body this engine read and
+ * charged one unit over. MEASURED byte-identical on published v0.38.3, v0.39.0, v0.39.1 and HEAD, so
+ * pre-existing, not an R519/R531 regression; `deny Rand src.lib.C1` exits 0 while the same body reached
+ * through a plain `const c4 = (n) => …` exits 1.
+ *
+ * THE BOUNDARY IS THE WAIVER'S OWN CLAIM, NOT A LIST OF SPELLINGS. The audit was deliberately not drawn
+ * around the IIFE that triggered it: a sweep of twenty-three spellings on the published engine found the
+ * identical silence in EIGHT — IIFE→arrow, factory→arrow, IIFE→function-expression, a ternary selecting
+ * between two arrows, `.bind()`, an array-literal element indexed at the call site, an arrow returned
+ * from a class method, and an arrow round-tripped through a generic identity `id<T>(x: T): T`. They are
+ * one defect, because the engine has one waiver, and the general property is "resolution landed on an
+ * arrow/function-expression node that no binding site minted". So the condition here is that property —
+ * every spelling that produces it is covered, including ones nobody has written down yet.
+ *
+ * WHEN THE WAIVER IS TRUE WE DO NOTHING. `enclosing(fn.parent)` is the unit the arrow's body is ALREADY
+ * charged to; when that is the caller's own unit, the caller really has the effects and there is no
+ * silence to close — a plain `(() => { … })()` IIFE inside a function is exactly this, and minting it
+ * would add a report row for no gain. Skipping is safe in the direction that matters: the skipped case is
+ * the one where the pre-fix engine was already correct.
+ *
+ * (a) MINT, NOT (b) DISCLOSE `Unknown` — and (b) was BUILT AND RUN for this route rather than inherited
+ * from R531's measurement of a different one. The decisive result is not the flood, it is that (b) does
+ * not close the gate: `Unknown` is not `Rand`, so `deny Rand C1` stays at EXIT 0 over a real
+ * `Math.random()` — measured on this file's own R531b fixture. The flood is real too, measured on the
+ * 53-entry npm corpus: (b) recovered ZERO concrete effects, charged `Unknown` to 63 previously-absent
+ * callers of which 24 resolve to targets this engine can SEE are pure (axios's `isStream`, `isThenable`,
+ * `toArray`, `isSpecCompliantForm`), and added a spurious reason to 202 existing rows. Minting RESOLVES
+ * instead: a pure target leaves the caller absent exactly as before (asserted by the R531b PRECISION
+ * arms), an effectful one charges the concrete effect and the scoped gate fires.
+ *
+ * MINTING IS ADDITIVE ONLY BECAUSE OF ⟨R519⟩'s CONTAINMENT EDGE, AND THAT STILL HOLDS FOR A NON-PROPERTY
+ * PARENT — it was CHECKED, not assumed, because if it did not hold this would be R519 re-created. R519's
+ * edge is `enclosing(prop.parent) -> minted`; the only thing it needs of the parent is that `enclosing`
+ * can answer for it, and `enclosing` answers for ANY node (it falls through to `moduleUnit` at the
+ * SourceFile). Here the owner is read BEFORE `nodeName.set`, so it is the pre-mint attribution owner by
+ * construction, and the edge gives that owner everything the mint would otherwise have moved out of it.
+ * Asserted directly in test.mjs's R531b block (`viaEnclosing`): the module initializer keeps its `Rand`
+ * after the mint.
+ *
+ * FAILURE DIRECTION: PRECISION-POSITIVE, and additive. No effect is removed from any unit, so no firing
+ * gate can go green; the report gains one row per arrow some call actually resolves to. It is NOT a
+ * blanket mint of every closure — an inline callback (`arr.map(x => …)`) is invoked by the CALLEE, never
+ * resolved by a call in this scan, so it is not a candidate and stays charged to its lexical owner.
+ * ⟨R64⟩'s decorator-argument position, which is what PART 82 pins, is likewise untouched: TypeScript
+ * gives no way to name a decorator argument's closure, so no call resolves to one, and the only closure
+ * there that IS called — an IIFE — takes the waiver-true skip above. PART 82's `count:1` is asserted
+ * unchanged.
+ *
+ * FIXPOINT, because the predicate reads `enclosing` and minting REFINES it. Minting arrow B can change
+ * the owner of a call that resolves to a sibling arrow A from "the shared lexical owner" to B — at which
+ * point A's waiver is no longer true and A must be minted too, or B under-reports A's effects. One pass
+ * in document order is not enough to see that, and the monotonicity (owners only ever get finer, the
+ * candidate set only shrinks) makes the loop terminate in the number of candidates. */
+function mintCallTargetUnit(fn) {
+  const sf = fn.getSourceFile();
+  const local = `<callable>@${fn.getStart()}`;
+  const qual = `${moduleOf(sf)}.${local}`;
+  const owner = enclosing(fn.parent); // BEFORE the nodeName.set below — the PRE-mint attribution owner
+  if (!fns.has(qual)) {
+    const { line, character } = sf.getLineAndCharacterOfPosition(fn.getStart());
+    fns.set(qual, { local, direct: new Set(), fsKinds: new Set(), edges: new Set(), hosts: new Set(),
+                    tables: new Set(), cmds: new Set(), paths: new Set(), blind: new Set(),
+                    incomplete: new Set(), dispatch: new Set(), why: new Set(), entry: false,
+                    loc: `${path.relative(rootDir, sf.fileName)}:${line + 1}:${character + 1}`,
+                    endLine: sf.getLineAndCharacterOfPosition(fn.getEnd()).line + 1 });
+  }
+  nodeName.set(fn, qual);
+  // ⟨R519⟩ CONTAINMENT — minting is an ADDITION, never a MOVE. Same edge, same reason, non-property parent.
+  if (owner && owner !== qual) fns.get(owner)?.edges.add(qual);
+  // REACH PROBE, env-gated, same contract as ⟨R519⟩'s and ⟨R531⟩'s. "CHANGED 0" and "the branch never
+  // ran" print identically; `bin/corpus-ab.py --mark` counts this rather than anyone inferring it later.
+  if (process.env.CANDOR_R531B_REACH) console.error(`R531B-REACH ${owner} -> ${qual}`);
+  return qual;
+}
+{
+  const cands = [];
+  for (const sf of sources) (function findAnonCallTargets(n) {
+    if (ts.isCallExpression(n) || ts.isTaggedTemplateExpression(n)) {
+      let d; try { d = checker.getResolvedSignature(n)?.declaration; } catch { d = undefined; }
+      if (d && (ts.isArrowFunction(d) || ts.isFunctionExpression(d)) && d.body
+          && projectFiles.has(path.resolve(d.getSourceFile().fileName)))
+        cands.push({ call: n, fn: d });
+    }
+    ts.forEachChild(n, findAnonCallTargets);
+  })(sf);
+  for (let round = 0; round <= cands.length; round++) {
+    const mint = [];
+    for (const c of cands) {
+      // ASK THE AUTHORITY: anything the call walk can already resolve — including ⟨R531⟩'s
+      // property mint, which is keyed one node ABOVE this arrow — must not be minted again.
+      if (callTargetUnit(c.fn)) continue;
+      if (enclosing(c.fn.parent) === enclosing(c.call)) continue; // the waiver is TRUE here — already walked into the caller
+      mint.push(c.fn);
+    }
+    if (!mint.length) break;
+    mint.sort((a, b) => a.getStart() - b.getStart()); // outer before inner: a nested mint must see its container's unit
+    for (const fn of mint) if (!callTargetUnit(fn)) mintCallTargetUnit(fn);
+  }
+}
 for (const sf of sources) visitCalls(sf);
 
 // ---- pass 2b: callback-flow resolution (the callback_named move) ----------------------------------