candor-ts 0.39.2 → 0.39.3

package/README.md

@@ -167,7 +167,8 @@ content-hash gate is its first increment).
 
 ## Trust contract (spec §4)
 
-Anything candor-ts can't resolve is `Unknown`, never silently pure: a function-valued parameter or
+Anything candor-ts can't resolve is designed to read `Unknown`, never silently pure — known open gaps
+are listed in candor-spec's SOUNDNESS.md (e.g. R780, R803, R804): a function-valued parameter or
 field being called, an `any`-typed callee, resolution landing on a type rather than a body.
 
 An **uncurated dependency** can opt out of `Unknown`/silent-pure by **declaring its effects** in its
@@ -184,7 +185,7 @@ literal is never a claim of absence.
 ## Cross-engine consistency — machine-checked
 
 candor-ts is one of the **four code engines** (with the reference engine candor-java, the Rust
-engines, and candor-swift) held together by the spec's **16-part conformance suite**: the shared
+engines, and candor-swift) held together by the spec's **cross-engine conformance suite**: the shared
 effect-set oracle, the §6.2 policy-grammar battery (including `allow Db`), the §3.1 query-shape
 and match-ladder checks, the gate exit-code contracts, and the newer parts up through the
 pure-vs-Unknown ruling (PART 16) — the engines must answer identically, on every push to the spec.
@@ -219,7 +220,7 @@ read the Rust source".
 
 ## Status
 
-0.30.0, speaking candor-spec 0.39: the analysis core, the gate (`--policy` / `--gate-json` /
+Speaking candor-spec 0.39 (the package version is in `package.json`): the analysis core, the gate (`--policy` / `--gate-json` /
 `.candor/config`), the full §3.1 query surface (including `containment`, `blindspots`, the
 `--include-unknown` dispatch frontier, and ⟨0.24⟩ `gate --report` — the gate applied to an EXISTING
 report, byte-equivalent to `scan --policy`'s verdict), the MCP server, the LSP server, and the watch loop are

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.39.2",
+  "version": "0.39.3",
   "mcpName": "io.github.tombaldwin/candor",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.39)",
   "type": "module",

package/scan.mjs

@@ -3201,6 +3201,79 @@ if (R416_HITS) process.on("exit", () => {
   if (total) process.stderr.write(`R416PROBE total=${total}`
     + rows.map(([k, n]) => ` ${k}=${n}`).join("") + "\n");
 });
+// SOUNDNESS R800 — WHICH POSITIONS ARE PATHS IS A FACT ABOUT THE SIGNATURE, SO ASK THE SIGNATURE.
+// `FS_TWO_PATH_MEMBERS` above is a hand-kept list of node's names, and it was the only place the engine
+// learned that a call has a SECOND path. `fs-extra` is κ whole-module `Fs` — the engine chose to model
+// it — and none of its twelve two-path verbs (`copy`/`copySync`, `move`/`moveSync`, `ensureLink`/
+// `ensureSymlink`, `createLink`/`createSymlink` and their Sync twins) is on the list, so a literal source
+// made the call `complete` and `allow Fs in <fn> <src-literal>` certified a copy to a caller-supplied
+// destination. EXECUTED: the copy moved the payload, `moveSync` removed the source, the links were real.
+//
+// The checker already knows: in @types/node AND @types/fs-extra every two-path operation declares its
+// first two parameters with a PATH type (`PathLike`, `string | URL`, or plain `string`), and no other
+// `Fs` operation does — a data/options/mode/uid second parameter is a union with Buffer/encoding/object
+// members, a number, or `any`. MEASURED by enumerating every callable export of `fs` and `fs-extra`
+// (230) and applying this predicate: it reproduces `FS_TWO_PATH_MEMBERS` EXACTLY on node (10 of 10, 0
+// extra) and adds exactly the twelve fs-extra verbs above, nothing else. The list is KEPT as a floor
+// (an unresolved or `any`-typed call still gets node's names), and the two are OR-ed, so this can only
+// make a call need MORE captured positions — fail-closed if the predicate ever over-reaches — and never
+// fewer. It also closes R801's first arm independently of the token fix below: `promisify(fs.copyFile)`
+// resolves to `copyFile.__promisify__(src: PathLike, dst: PathLike)`, which this reads by TYPE.
+const isPathParamType = (t) => {
+  if (!t) return false;
+  const parts = (t.isUnion?.() ? t.types : [t])
+    .filter((x) => !(x.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Null)));
+  if (parts.length === 0) return false;
+  if (t.aliasSymbol?.name === "PathLike") return true;
+  let sawString = false;
+  for (const x of parts) {
+    if (x.flags & ts.TypeFlags.String) { sawString = true; continue; }
+    const n = x.symbol?.name ?? x.aliasSymbol?.name;
+    if (n === "URL" || n === "Buffer" || n === "PathLike") continue;
+    return false;
+  }
+  return sawString;
+};
+// `CANDOR_R801_HITS=1` — the R416 reach counter, same discipline (prints ONLY when non-zero): `tok:<verb>`
+// counts a `__promisify__` token recovered to its verb, `two:<member>` a call the signature made two-path
+// that `FS_TWO_PATH_MEMBERS` did not name. A byte-identical A/B means nothing until these are non-zero.
+const R801_HITS = process.env.CANDOR_R801_HITS ? new Map() : null;
+const r801Hit = (k) => { if (R801_HITS) R801_HITS.set(k, (R801_HITS.get(k) ?? 0) + 1); };
+if (R801_HITS) process.on("exit", () => {
+  const rows = [...R801_HITS].sort();
+  const total = rows.reduce((a, [, n]) => a + n, 0);
+  if (total) process.stderr.write(`R801PROBE total=${total}` + rows.map(([k, n]) => ` ${k}=${n}`).join("") + "\n");
+});
+function signatureHasTwoPaths(node) {
+  let sig;
+  try { sig = checker.getResolvedSignature(node); } catch { return false; }
+  const ps = sig?.getParameters?.() ?? [];
+  if (ps.length < 2) return false;
+  const ty = (p) => checker.getTypeOfSymbolAtLocation(p, node);
+  return isPathParamType(ty(ps[0])) && isPathParamType(ty(ps[1]));
+}
+// SOUNDNESS R801 — THE MEMBER TOKEN IS THE VERB, NOT THE NAME TYPESCRIPT'S DECLARATION MERGING CHOSE.
+// @types/node declares a promisified overload as `namespace copyFile { function __promisify__(…) }`
+// (72 of them: fs, dns, child_process, crypto, zlib), and `fs-extra`'s `copyFile`/`writeFile`/`write`/…
+// re-exports are typed `typeof fs.copyFile.__promisify__ & …`. A call through either spelling resolves
+// to a declaration NAMED `__promisify__`, so the module stayed right while EVERY member-keyed table
+// missed: `FS_TWO_PATH_MEMBERS` (silent — R800's `fse.copyFile`), `NET_ESTABLISHING` (a masking bypass —
+// `promisify(dns.resolve)(host)` beside a benign fetch certified the resolver's host), `FS_USE_VERBS` (a
+// FALSE FAILURE — `fse.write(fd, …)` hedged a fully-captured surface), and κ's own member regexes
+// (`promisify(crypto.generateKeyPair)` matched no `generateKey…` rule and the crypto floor reviews every
+// other member pure — SILENT Rand). No table was wrong; the token was. So the fix is at the ONE place the
+// token is minted, which every table reads, rather than a fifth copy of `__promisify__` in four lists.
+// The verb is recoverable one node up: the namespace the declaration sits in.
+function declMemberToken(decl, name) {
+  if (name !== "__promisify__") return name;
+  for (let p = decl?.parent; p; p = p.parent) {
+    if (ts.isModuleBlock(p) || ts.isVariableDeclarationList(p) || ts.isVariableStatement(p)
+        || ts.isVariableDeclaration(p) || ts.isTypeLiteralNode(p) || ts.isFunctionTypeNode(p)) continue;
+    if (ts.isModuleDeclaration(p) && ts.isIdentifier(p.name)) { r801Hit(`tok:${p.name.text}`); return p.name.text; }
+    break;
+  }
+  return name;
+}
 function fsPathLiteral(node, member) {
   const args = node.arguments ?? [];
   const at = (i) => {
@@ -3212,7 +3285,9 @@ function fsPathLiteral(node, member) {
     return c;
   };
   const a0 = at(0);
-  const needsTwo = FS_TWO_PATH_MEMBERS.has(member);
+  const listed = FS_TWO_PATH_MEMBERS.has(member);
+  const needsTwo = listed || signatureHasTwoPaths(node);
+  if (needsTwo && !listed) r801Hit(`two:${member}`);
   const a1 = needsTwo ? at(1) : null;
   const complete = a0 !== null && (!needsTwo || a1 !== null);
   // EVERY literal path position, not just the first. Publishing position 0 and calling a
@@ -3509,6 +3584,22 @@ const isPublishableForeignIface = (d) => {
   // hash in, and publishing under it would be the second spelling §4 forbids.
   return !!m && !m.startsWith("<") && !m.startsWith("/") && m !== pkgName && m !== rootOwnerPkg;
 };
+// ⟨SOUNDNESS R521⟩ THE ONE PLACE THE BOUNDARY HAND-OFF'S REACH IS COUNTED, and it counts the
+// REGISTRATION rather than the branch entry — R574/R583's lesson, which cost this family three probes
+// that fired one line before the work they were cited for could be rejected. `walk` is called
+// unconditionally; the probe fires only when the implementor really was newly recorded under `ifaceDecl`,
+// so a super already reached by the direct heritage path (the `seen`/`*ClimbSeen` guards) counts zero.
+// `CANDOR_R521_REACH=1` makes each such registration announce itself so `bin/corpus-ab.py --mark` can
+// COUNT them instead of anyone inferring reach from an unchanged row — a byte-identical A/B over a corpus
+// that never reaches the branch is the most flattering number available and the least informative.
+const handoffCount = (d) => (interfaceImpls.get(d)?.length ?? 0) + (foreignInterfaceImpls.get(d)?.length ?? 0);
+function probeHandoff(kind, ifaceDecl, walk) {
+  if (!process.env.CANDOR_R521_REACH) { walk(ifaceDecl); return; }
+  const before = handoffCount(ifaceDecl);
+  walk(ifaceDecl);
+  if (handoffCount(ifaceDecl) > before)
+    console.error(`R521-REACH ${kind} ${declModule(ifaceDecl) ?? "?"}#${ifaceDecl.name?.text ?? "?"}`);
+}
 // ⟨CARDINAL SIN FIX, caller-path scope⟩ ifaceQual ("mod.Iface") -> Set<callerQual> that GENUINELY
 // dispatched through that interface's own signature and had it resolved by CHA below — populated AT THE
 // RESOLUTION SITE (pass 2's interface-CHA arm), not reconstructed afterward from the flat callgraph.
@@ -3948,7 +4039,22 @@ for (const sf of sources) {
         registerImpl(iface);
         for (const eh of iface.heritageClauses ?? []) {
           if (eh.token !== ts.SyntaxKind.ExtendsKeyword) continue;
-          for (const st of eh.types) for (const sdecl of localInterfaceDecls(st.expression)) climb(sdecl);
+          for (const st of eh.types) {
+            for (const sdecl of localInterfaceDecls(st.expression)) climb(sdecl);
+            // ⟨SOUNDNESS R521⟩ …AND THE HAND-OFF ACROSS THE BOUNDARY, WHICH NEITHER CLIMBER MADE. Each
+            // climber filtered its supers to its OWN side — this one to `projectFiles`, `fClimb` below to
+            // `isPublishableForeignIface` — so `interface LocalSub extends dep.MethodShaped` fell BETWEEN
+            // them: `class Impl implements LocalSub` registered under `LocalSub` only, nothing was ever
+            // registered under `depiface#MethodShaped.run`, and a local dispatch on the FOREIGN type
+            // (`function callFor(m: MethodShaped) { m.run() }`) had no key for ⟨0.39⟩ obligation 3's local
+            // join to answer on. MEASURED at HEAD on a one-variable pair: with `impl` annotated `LocalSub`,
+            // `src.index.callFor` and `src.index.entry` both read `inferred: []` and `deny Fs
+            // src.index.entry` exited 0 over a body that provably writes the file; annotating the SAME
+            // object `MethodShaped` (the direct spelling, one token) charged `['Fs']` and exited 1.
+            // A super is reached by whichever walker OWNS its declaration, not by whichever one started —
+            // the two `seen` sets are separate, so the mutual recursion terminates on the first revisit.
+            for (const sdecl of foreignInterfaceDecls(st.expression)) probeHandoff("nominal", sdecl, fClimb);
+          }
         }
       };
       // ⟨0.39⟩ obligation 2: the same relation for an abstraction this package does NOT own. `class
@@ -3971,6 +4077,21 @@ for (const sf of sources) {
         if (!arr.includes(node)) arr.push(node);
         for (const eh of iface.heritageClauses ?? []) {
           if (eh.token !== ts.SyntaxKind.ExtendsKeyword) continue;
+          // ⟨SOUNDNESS R521⟩ AND THE MIRROR DIRECTION IS DELIBERATELY *NOT* HERE — §9 says state the
+          // boundary and justify it, not that every widening is free. A foreign interface whose super is
+          // declared in THIS project would register only under the foreign key, so the symmetric hand-off
+          // (`localInterfaceDecls(st.expression)` -> `climb`) looks like the same one-line fix. It was
+          // written, MEASURED over the 28-repo pinned TS roster, and REMOVED, because its only reach on
+          // real code is a shape it answers WRONGLY: rollup's `src/rollup/types.d.ts` carries
+          // `declare module 'estree' { interface BaseClass { … } }`, so `BaseClass` has TWO declarations
+          // of ONE dependency-owned interface and the local one is a project file. Registering an
+          // implementor under it mints `rollup#BaseClass.<m>` — our package's key for an abstraction
+          // `estree` owns, the "invented second spelling" `isPublishableForeignIface`'s own comment
+          // refuses at length, and a key no consumer can ever form. It also buys nothing: the FOREIGN
+          // declaration of that same merged interface is registered by the existing filter, so the
+          // owner-keyed answer is already present. The residual it leaves is a `node_modules` package
+          // importing a project interface, which nothing in the roster does — recorded as a latent gap
+          // rather than closed by a widening whose one measured instance was mis-keyed.
           for (const st of eh.types) for (const sdecl of foreignInterfaceDecls(st.expression)) fClimb(sdecl);
         }
       };
@@ -4521,9 +4642,18 @@ function registerStructuralImpl(ifaceDecl, implNode, seen = new Set()) {
     for (const st of eh.types) {
       let sym; try { sym = checker.getSymbolAtLocation(st.expression); } catch { sym = undefined; }
       const tgt = sym && sym.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(sym) : sym;
-      for (const d of tgt?.declarations ?? [])
-        if (ts.isInterfaceDeclaration(d) && projectFiles.has(path.resolve(d.getSourceFile().fileName)))
-          registerStructuralImpl(d, implNode, seen);
+      for (const d of tgt?.declarations ?? []) {
+        if (!ts.isInterfaceDeclaration(d)) continue;
+        if (projectFiles.has(path.resolve(d.getSourceFile().fileName))) registerStructuralImpl(d, implNode, seen);
+        // ⟨SOUNDNESS R521⟩ …and the FOREIGN super of a LOCAL interface, the structural spelling of the
+        // hand-off the nominal climber above now makes. `const impl: LocalSub = { run(){ …fs… } }` where
+        // `interface LocalSub extends dep.MethodShaped` registered under `LocalSub` and NOWHERE ELSE, so
+        // nothing was published or joined under `depiface#MethodShaped.run`. The `seen` set is SHARED
+        // across the hand-off (passed through, not re-created), so a diamond reached from both sides visits
+        // each declaration once and the mutual recursion terminates.
+        else if (isPublishableForeignIface(d))
+          probeHandoff("structural", d, (x) => registerForeignStructuralImpl(x, implNode, seen));
+      }
     }
   }
 }
@@ -4544,6 +4674,10 @@ function registerForeignStructuralImpl(ifaceDecl, implNode, seen = new Set()) {
     for (const st of eh.types) {
       let sym; try { sym = checker.getSymbolAtLocation(st.expression); } catch { sym = undefined; }
       const tgt = sym && sym.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(sym) : sym;
+      // ⟨SOUNDNESS R521⟩ NO mirror hand-off to `registerStructuralImpl` here, for the reason the nominal
+      // climber's own comment gives in full: measured over the pinned TS roster, the only shape that
+      // reaches it is a project-file MODULE AUGMENTATION of a dependency's interface, where the key it
+      // would mint names the wrong owner and the foreign declaration already answers.
       for (const d of tgt?.declarations ?? [])
         if (isPublishableForeignIface(d)) registerForeignStructuralImpl(d, implNode, seen);
     }
@@ -5480,12 +5614,16 @@ function moduleUnit(sf) {
 // `C.constructor` unit, so a static-init effect was MISLABELED as the instance ctor (and carried no
 // unitKind). Mint it as its own unit, lazily, mirroring `moduleUnit`. (An anonymous class expression's
 // static block keys under `<anonymous>`; there is at most one static-init unit per class name.)
-function staticBlockUnit(node) {
+// The qual alone, WITHOUT minting — R782/R785's wiring pass asks "does this block's unit exist?" and must
+// not create an empty one to find out. One derivation for both, so the two cannot spell it differently.
+function staticBlockQual(node) {
   const cls = node.parent;
-  const sf = node.getSourceFile();
-  const mod = moduleOf(sf);
   const cname = (ts.isClassDeclaration(cls) || ts.isClassExpression(cls)) && cls.name ? cls.name.text : "<anonymous>";
-  const qual = `${mod}.${cname}.<static-init>`;
+  return `${moduleOf(node.getSourceFile())}.${cname}.<static-init>`;
+}
+function staticBlockUnit(node) {
+  const sf = node.getSourceFile();
+  const qual = staticBlockQual(node);
   let rec = fns.get(qual);
   if (!rec) {
     rec = { local: "<static-init>", direct: new Set(), fsKinds: new Set(), edges: new Set(), hosts: new Set(), tables: new Set(),
@@ -5776,23 +5914,260 @@ function recordDispatch(rec, decl, pkg) {
 // Bounded by the SAME `CHA_FANOUT_LIMIT` the in-scan dispatch site and the union emitter apply, and
 // hedged on the SAME completeness condition: an implementor whose member resolves to no unit leaves the
 // candidate set incomplete, and edging the rest while staying silent about it would drop its effects.
-function joinLocalImpls(rec, d) {
-  if (!rec || !d) return;
+// ⟨SOUNDNESS R574⟩ THE RECEIVER'S VALUE IS THE PACKAGE'S OWN PRODUCT — returns the producing
+// expression, or null. `const g = makeClient(); g.fetchIt(u)` where `makeClient` is declared by `pkg`
+// and takes NO ARGUMENT: the package was handed nothing it could hand back, so the value it returned
+// is its own, and a LOCAL `class MyClient implements Gettable` is not a candidate at this site.
+//
+// IT IS A DENYLIST AND IT FAILS TOWARDS OVER-CHARGE. Only the provenance it can PROVE is excluded —
+// a `const` with a single declaration whose initializer is a zero-argument call or `new` resolving
+// into the same package. A parameter, a field, a `let`, a property access on a package object, or a
+// factory that RECEIVED an argument all fall through and keep the full CHA join. Widening it to an
+// allowlist of "receivers that look local" is the inversion this family has been burned by
+// ([[candor-denylist-over-allowlist]]); a missing exclusion here costs precision, a wrong one costs
+// silence.
+//
+// THE RESIDUAL, NAMED RATHER THAN ASSERTED AWAY: a zero-argument factory that returns an implementor
+// the caller registered EARLIER through a global registry (`register(new MyClient()); makeClient()`)
+// is genuinely a local implementor and is excluded here. That is not a new hole — it is exactly the
+// answer `d46c098` gave for the same shape, since the whole join sat behind `!eff` — and the
+// `dispatchesOn` key R560 added is published either way, so a consumer joining that key against its
+// own implementors still recovers it. This is an ASSUMPTION about zero-argument factories, not a
+// proof, and it is worded as one.
+function packageProducedReceiver(recvExpr, pkg) {
+  if (!recvExpr || !pkg) return null;
+  const unwrap = (x) => {
+    while (x && (ts.isAwaitExpression(x) || ts.isParenthesizedExpression(x) || ts.isNonNullExpression(x)
+                 || ts.isAsExpression(x))) x = x.expression;
+    return x;
+  };
+  let e = unwrap(recvExpr);
+  // ONE hop through a `const` binding. `const` and a SINGLE declaration deliberately: a `let`/`var`
+  // can be reassigned anywhere in the scope, and two declarations mean two answers — both are the
+  // open-slot shape ⟨R103⟩ already treats as an incomplete candidate set, so neither is provable here.
+  if (e && ts.isIdentifier(e)) {
+    const decls = checker.getSymbolAtLocation(e)?.declarations ?? [];
+    if (decls.length !== 1) return null;
+    const d = decls[0];
+    if (!ts.isVariableDeclaration(d) || !d.initializer) return null;
+    if (!(d.parent && ts.isVariableDeclarationList(d.parent) && (d.parent.flags & ts.NodeFlags.Const))) return null;
+    e = unwrap(d.initializer);
+  }
+  if (!e || !(ts.isCallExpression(e) || ts.isNewExpression(e))) return null;
+  if ((e.arguments?.length ?? 0) !== 0) return null;  // it was handed nothing, so it returned nothing of ours
+  const pd = checker.getResolvedSignature(e)?.declaration;
+  if (!pd) return null;
+  const pm = declModule(pd);
+  return (pm === pkg || (pm.startsWith("@types/") ? pm.slice("@types/".length) : pm) === pkg) ? e : null;
+}
+// ⟨SOUNDNESS R574⟩ RETURNS WHAT IT DID, so a reach probe can count JOINS rather than branch entries.
+// `null` = this key named no visible implementor and nothing was contributed; otherwise the outcome
+// kind (`edge` / `ambiguous` / `hedge`). Every caller may ignore it; the value exists because
+// `R560-REACH` was published as "182 hits across 12 entries — the over-charge control WITH real reach"
+// while firing on BRANCH ENTRY, one line before `recordDispatch` could reject the declaration. A file
+// containing only `fs.writeFileSync` + `cp.execSync` emitted two such hits that changed no row. A reach
+// probe cited as evidence must count the thing it is cited for.
+// ⟨SOUNDNESS R583⟩ THE ONE PLACE A JOIN'S REACH IS COUNTED. §9 — the boundary is not drawn around
+// R574's trigger: `R560-REACH` fired on BRANCH ENTRY, and a grep of the MECHANISM rather than of the
+// row found `R524-REACH` and `R558-REACH` doing the same thing. Demonstrated on one file importing a
+// foreign index-signature interface and a foreign named member with NO local implementor of either:
+// both probes emit a hit, both rows come back EMPTY, and no join occurred. Neither published figure
+// was wrong — R524's 6 hits matched its 6 changed rows and R558's was 0 — so this is a LATENT
+// instrument defect, recorded as one rather than upgraded. Three probes answering one question from
+// three hand-placed call sites is the drift §G forbids; there is now one.
+const probeJoinReach = (mark, outcome, detail) => {
+  if (outcome && process.env[`CANDOR_${mark.split("-")[0]}_REACH`]) console.error(`${mark} ${outcome} ${detail}`);
+};
+// `hedgeOnly` ⟨SOUNDNESS R574⟩: this key HAS visible implementors and the receiver provably is not one
+// of them, so take SPEC ⟨0.35⟩'s option (b) — `Unknown` with a `dispatch:` why — instead of option (a),
+// charging their effects. The clause makes the two equally sound and says so ("Both are sound; they
+// differ only in precision"). It is reached only when `targets.length > 0`, so it is exactly
+// co-extensive with the charge it replaces: where there is no implementor there is nothing to hedge.
+function joinLocalImpls(rec, d, hedgeOnly) {
+  if (!rec || !d) return null;
   const { targets, allResolved, decls } = localImplTargets(d.key);
-  if (!targets.length) return;
+  if (!targets.length) return null;
   // The name means two things here, so no implementor set can be attributed to this key — §4 ⟨0.24⟩'s
   // `ambiguous:`, not `dispatch:`: the owner type is nameable, but WHICH declaration it names is not.
   if (decls.size > 1) {
     rec.direct.add("Unknown");
     rec.why.add(`ambiguous:${d.pkg}.${d.ifaceName}.${d.member}`);
-    return;
+    return "ambiguous";
   }
-  if (targets.length > CHA_FANOUT_LIMIT || !allResolved) {
+  if (hedgeOnly || targets.length > CHA_FANOUT_LIMIT || !allResolved) {
     rec.direct.add("Unknown");
     rec.why.add(dispatchWhy(`${d.pkg}.${d.ifaceName}`, d.member));
-    return;
+    return hedgeOnly ? "hedge-foreign-receiver" : "hedge";
   }
   for (const t of targets) rec.edges.add(t);
+  return "edge";
+}
+// ⟨SOUNDNESS R524, shape (i)⟩ The interface whose INDEX SIGNATURE a resolved declaration dispatches
+// THROUGH, or null. `interface Handlers { [k: string]: (n: number) => number }` is not a member
+// signature, so `dispatchedInterfaceMember` returns null for it — correctly, because an index signature
+// names no member and therefore mints no key any producer's `interfaceUnion` could ever publish under
+// (the emitter's own loop requires `member.name`). That is the right answer for the WIRE and the wrong
+// one for obligation 3's LOCAL half, which does not need a publishable key: the implementor is in THIS
+// scan and the member name is sitting at the call site. ⟨0.35⟩ (SPEC.md:4655) binds the caller's
+// `inferred` to a visible structural implementor's effects or `Unknown` "where a synthesised or
+// structural implementor is VISIBLE to the engine's own resolution", with no restriction to LOCALLY
+// declared abstractions — so moving `Handlers` into `node_modules` may not change the answer.
+// The checker resolves `h.roll(n)` to the index signature's FUNCTION TYPE, not to the signature, so
+// both spellings are accepted here for the same reason `memberSigOf` accepts both spellings of a member.
+function indexSignatureIface(decl) {
+  const sig = !decl ? null
+    : ts.isIndexSignatureDeclaration(decl) ? decl
+    : (decl.parent && ts.isIndexSignatureDeclaration(decl.parent) ? decl.parent : null);
+  if (!sig || !sig.parent || !ts.isInterfaceDeclaration(sig.parent) || !sig.parent.name) return null;
+  return sig.parent;
+}
+// The property name a CALL SITE accesses on its receiver — `h.roll(n)` and `h["roll"](n)` both name
+// `roll`. It has to come from the site because the resolved declaration has no name to give: that is
+// what an index signature IS. A computed, non-literal key (`h[k](n)`) names nothing and resolves
+// nothing — it is left exactly where it was rather than guessed at.
+function accessedMemberName(expr) {
+  if (!expr) return null;
+  if (ts.isPropertyAccessExpression(expr)) return expr.name?.text ?? null;
+  if (ts.isElementAccessExpression(expr) && expr.argumentExpression
+      && (ts.isStringLiteralLike(expr.argumentExpression) || ts.isNumericLiteral(expr.argumentExpression)))
+    return expr.argumentExpression.text;
+  return null;
+}
+// ⟨SOUNDNESS R587⟩ The DECLARATION a value-reference slot names — an identifier, a property access, or
+// an ELEMENT ACCESS with a literal key. It exists because `checker.getSymbolAtLocation` returns
+// undefined for an element access (MEASURED on all four arms of the R587 fixture — `d["roll"]` and
+// `i["roll"]` alike), so `realDecl(getSymbolAtLocation(a))` silently answered nothing and every caller
+// of the element-access spelling fell out of `functions[]` entirely. The call path already learned
+// this once — the dynamic-slot arm looks the member up on the RECEIVER's type for exactly the same
+// reason, and its comment records that its own first draft asserted the opposite and was false. This
+// is the reference-position sibling of that lookup, in ONE place for the two sites that need it.
+//
+// A DECLARED member resolves through `getPropertyOfType`; an INDEX SIGNATURE has no property symbol at
+// all and resolves through `getIndexInfosOfType`, which is the node `indexSignatureIface` already
+// accepts. A genuinely dynamic key yields no name and therefore no declaration — nothing is guessed.
+function refSlotDecl(expr) {
+  if (!expr) return undefined;
+  if (!ts.isElementAccessExpression(expr)) return realDecl(checker.getSymbolAtLocation(expr));
+  const key = accessedMemberName(expr);
+  if (!key) return undefined;
+  let rt; try { rt = checker.getTypeAtLocation(expr.expression); } catch { return undefined; }
+  if (!rt) return undefined;
+  const prop = checker.getPropertyOfType(rt, key);
+  if (prop) return realDecl(prop);
+  return (checker.getIndexInfosOfType?.(rt) ?? []).map((i) => i.declaration).find(Boolean);
+}
+// Obligation 3's LOCAL half for the index-signature spelling. Deliberately NOT `recordDispatch`: it
+// records nothing on the wire, because `dispatchesOn` is a key a CONSUMER is expected to be able to
+// join against a published union, and no union is ever published for an index signature. A value there
+// that nothing can answer is the noise `recordDispatch`'s own comment refuses, and noise in a soundness
+// field is how a real value stops being read. The JOIN is the whole of the fix.
+//
+// PURELY ADDITIVE: `joinLocalImpls` either edges to units this scan minted or hedges `Unknown`, and the
+// `invisible`/ledger disclosure downstream of this call site still runs either way. Nothing that was
+// disclosed before stops being disclosed.
+// ⟨SOUNDNESS R574⟩ Returns its outcome for the same reason `joinLocalImpls` does — `null` when nothing
+// was contributed — so a reach probe counts joins rather than branch entries.
+function joinIndexSignatureImpls(rec, decl, pkg, memberName, hedgeOnly) {
+  if (!rec || !decl || !pkg) return null;  // NOT gated on `memberName`: null is the COMPUTED-key case below
+  if (declIsNodeTypes(decl)) return null;  // the platform type surface — same exclusion as `recordDispatch`
+  const iface = indexSignatureIface(decl);
+  if (!iface) return null;
+  const ifaceName = iface.name.text;
+  // A COMPUTED key — `h[name](n)`, the idiomatic dispatch-table spelling and the one an index signature
+  // exists for — names no single member, so EVERY member a visible implementor supplies is genuinely
+  // reachable from it. Joining each is the same answer `joinLocalImpls` gives for a named one, applied
+  // to the whole reachable set; it is not a widening of the named case, and it charges nothing no
+  // visible implementor performs. The audit boundary is deliberately drawn past R524's own fixture,
+  // which uses a literal member: a rule that fired only on `h.roll(n)` would miss the spelling the
+  // construct is FOR. Bounded by the same `CHA_FANOUT_LIMIT` as every other CHA site here — a table
+  // too wide to enumerate is an open hierarchy and takes the disclosed Unknown, not silence.
+  const names = memberName ? [memberName] : indexSigMemberNames(pkg, ifaceName);
+  if (!names.length) return null;
+  if (names.length > CHA_FANOUT_LIMIT) {
+    rec.direct.add("Unknown");
+    rec.why.add(dispatchWhy(`${pkg}.${ifaceName}`, memberName ?? undefined));
+    return "hedge";
+  }
+  let out = null;
+  for (const m of names)
+    out = joinLocalImpls(rec, { key: dispatchKey(pkg, ifaceName, m), pkg, ifaceName, member: m }, hedgeOnly) ?? out;
+  probeJoinReach("R524-REACH", out, `${pkg}#${ifaceName}.${memberName ?? "<computed>"}`);
+  return out;
+}
+// ⟨SOUNDNESS R558⟩ AN INTERFACE MEMBER NAMED AS A FIRST-CLASS VALUE IS A DISPATCH, and it invokes
+// exactly what the CALL spelling invokes. `[n].map(d.roll)` and `d.roll(n)` reach the same body through
+// the same abstraction; only the first desugars AWAY from the CallExpression arm, where every
+// obligation-3 join in this file lives. MEASURED at HEAD (`d46c098`) before this fix, one file, five
+// arms, the only variable being what the reference NAMES: `refPlain` (a plain function ref) `['Fs']`,
+// `refClass` (a CLASS member ref) `['Fs']`, `callDeclared` (the SAME interface member, CALLED) `['Fs']`
+// — and `refDeclared` / `refIndexed` ABSENT FROM `functions[]` ENTIRELY, which SPEC §2 rule 3 makes an
+// affirmative purity claim. `pure refDeclared` and `pure refIndexed` exited 0 over a body that writes
+// to disk; `pure refClass` / `pure refPlain` exited 1 over the identical body.
+//
+// A NEW ADDITIVE PREDICATE, NOT A WIDENING OF THE HOF-REF ARM'S OPACITY INDEX. That index answers "is
+// this holder caller-controlled" — a different question with a different right answer, and widening it
+// to admit a resolved signature would hand every resolved dependency function the opaque-callback
+// `Unknown`. This one asks only "does this reference name an abstract member some VISIBLE implementor
+// answers", and routes a yes through the SAME `recordDispatch` / `joinLocalImpls` /
+// `joinIndexSignatureImpls` the call site uses — never a second implementation of the join, which is
+// how the two would drift (§G). candor-rust fixed its half of this class — R549 mechanism B,
+// `xs.front().map(Buf::chunk)` — the same way in `186e854`, with a new predicate rather than a widened
+// index; the severities differed (rust lost only the KEY, ts lost the whole ROW) and the shape did not.
+//
+// `argIsCallable` is required, not decorative: `recordDispatch` accepts a PropertySignature, and a
+// non-function property named as a value (`xs.map(cfg.label)`) is DATA, not a dispatch — charging it
+// would fabricate its implementors' effects onto a caller that invokes nothing.
+//
+// ⟨SOUNDNESS R587⟩ THIS PREDICATE IS NOW THE WHOLE OF THE DESUGARED ANSWER, at three call sites rather
+// than one — the HOF-ref arm R558 built it for, the REFLECTIVE-INVOKE funnel (`fn.call`/`fn.apply`/
+// `Reflect.apply`), and the ELEMENT-ACCESS reference spelling. It answers "does this reference name an
+// abstract member some VISIBLE implementor answers", and that question does not change with the
+// syntax that reaches it. `hedgeOnly` is ⟨0.35⟩ option (b), threaded through from the caller rather
+// than re-decided here: only the reflective funnel passes it, and only on the CallExpression arm's own
+// ⟨R574⟩ condition (κ answered AND `packageProducedReceiver`). The HOF-ref site passes nothing and is
+// byte-identical to R558's. `mark` names WHICH site reached the join so the two changes can be priced
+// apart in one A/B run; it still goes through the single ⟨R583⟩ `probeJoinReach`, so it counts the
+// join's returned OUTCOME and not entry to a branch — the property that invalidated R560's published
+// reach figure. Three marks through one probe is what R583 left; this is a fourth name, not a fourth
+// probe.
+function chargeMemberRefDispatch(rec, refExpr, d2, hedgeOnly, mark = "R558-REACH") {
+  if (!rec || !d2 || !argIsCallable(refExpr)) return false;
+  const m = declModule(d2);
+  // ONLY `<local>` TAKES THIS PACKAGE'S NAME. Every other `<…>` pseudo-module is the platform type
+  // surface and is REFUSED, not renamed — `declIsNodeTypes` (the exclusion `recordDispatch` applies)
+  // tests `@types/node` and NOT the TypeScript ES lib, so the `!mod.startsWith("<")` guard at the
+  // CallExpression site is what has always kept the lib out, and a helper that derives its own key has
+  // to restate it. MEASURED, and this is why the corpus A/B is not optional: keying `<es-lib>` as
+  // `pkgName` published `typeorm#ArrayConstructor.isArray` on **530 typeorm rows** and 2 nest rows from
+  // `xs.some(Array.isArray)` — a key naming an interface typeorm does not own, that no producer could
+  // ever answer, which is precisely the wire noise `recordDispatch`'s own comment refuses and precisely
+  // candor-rust's R549 malformed-key class reproduced in a second engine. Nothing else in that A/B
+  // moved: it was 532 rows of `dispatchesOn` and zero of anything else.
+  const pkg = m === "<local>" ? pkgName
+    : !m || m.startsWith("<") ? null
+    : m.startsWith("@types/") ? m.slice("@types/".length) : m;
+  if (!pkg) return false;
+  // REACH PROBE, env-gated, same convention as `CANDOR_R519_REACH`/`CANDOR_R524_REACH` above: a
+  // byte-identical A/B over a corpus that cannot reach the changed branch is the most flattering
+  // number available and the least informative, and this family has mistaken one for evidence four
+  // times. `bin/corpus-ab.py --mark R558-REACH` COUNTS these instead of anyone inferring reach.
+  // ⟨SOUNDNESS R583⟩ counted on the JOIN'S OUTCOME, through the one shared probe, rather than on entry
+  // to the branch — see `probeJoinReach`. As written it fired whenever `recordDispatch` minted a key,
+  // which happens for every foreign interface member whether or not any implementor is visible.
+  const probe = (kind, outcome) =>
+    probeJoinReach(mark, outcome, `${kind} ${pkg} ${refExpr.getText().replace(/\s+/g, "").slice(0, 60)}`);
+  // the DECLARED-member spelling — the reference resolves to the interface's own signature.
+  const rd = recordDispatch(rec, d2, pkg);
+  if (rd) { probe("declared", joinLocalImpls(rec, rd, hedgeOnly)); return true; }
+  // the INDEX-SIGNATURE spelling — `i.roll` resolves to the `[k: string]: …` signature, which names no
+  // member, so the name comes from the REFERENCE site exactly as R524 shape (i) takes it from the call
+  // site. Measured, not assumed: `checker.getSymbolAtLocation(i.roll)` returns the `__index` symbol and
+  // its declaration IS the IndexSignature, which is the node `indexSignatureIface` already accepts.
+  if (indexSignatureIface(d2)) {
+    probe("indexsig", joinIndexSignatureImpls(rec, d2, pkg, accessedMemberName(refExpr), hedgeOnly));
+    return true;
+  }
+  return false;
 }
 // Apply ONE chained-dependency entry to the calling unit. There is exactly one of these because there used
 // to be two, drifted: the CallExpression arm and the desugared-declaration arm each spelled the copy out,
@@ -5812,15 +6187,20 @@ function joinLocalImpls(rec, d) {
 // copying them here would copy whatever happened to be known and silently under-report. An edge flows
 // through the SAME least fixpoint every other call does.
 let localImplTargetsByKey = null;
-function localImplTargets(key) {
+// ⟨SOUNDNESS R524, shape (i)⟩ `<pkg>#<Iface>` -> every member name a VISIBLE implementor of that
+// index-signature interface supplies. Built in the same pass and off the same evidence as the target
+// index above, because a COMPUTED key (`h[k]()`) names no single member and every one of them is then
+// genuinely reachable. Separate map rather than a widening of the one above: these are NAMES, not
+// targets, and the ambiguity/fan-out guards that decide a target set must not be answered from here.
+let indexSigNamesByIface = null;
+function ensureLocalImplIndex() {
   if (!localImplTargetsByKey) {
     localImplTargetsByKey = new Map();
+    indexSigNamesByIface = new Map();
     const add = (ownerPkg, ifaceDecl, implClasses) => {
       const ifaceName = ifaceDecl.name?.text;
       if (!ifaceName) return;
-      for (const member of ifaceDecl.members ?? []) {
-        const m = member.name?.getText?.();
-        if (!m) continue;
+      const push = (m) => {
         const k = dispatchKey(ownerPkg, ifaceName, m);
         if (!localImplTargetsByKey.has(k))
           localImplTargetsByKey.set(k, { targets: [], allResolved: true, decls: new Set() });
@@ -5846,7 +6226,33 @@ function localImplTargets(key) {
           if (!t) { cell.allResolved = false; continue; }
           if (!cell.targets.includes(t)) cell.targets.push(t);
         }
+      };
+      for (const member of ifaceDecl.members ?? []) {
+        const m = member.name?.getText?.();
+        if (m) push(m);
       }
+      // ⟨SOUNDNESS R524, shape (i)⟩ AN INDEX SIGNATURE DECLARES NO MEMBER, so the loop above indexes
+      // nothing for `interface Handlers { [k: string]: (n: number) => number }` and obligation 3's join
+      // had no key to answer on — which is the whole of R524's ts half. The member names such an
+      // interface can be dispatched on are not on the DECLARATION at all; they are whatever its
+      // implementors actually supply, so they are enumerated from the implementors. `push` is reused
+      // verbatim rather than copied: it re-scans every implementor for that name and marks
+      // `allResolved` false for any that cannot answer it, so an implementor set that disagrees about
+      // which keys exist hedges instead of resolving — the same fail-closed condition the declared-member
+      // arm already applies, reached the same way. A name no implementor supplies forms no key and is
+      // untouched (`localImplTargets` returns its empty cell, `joinLocalImpls` returns early), which is
+      // what keeps a foreign abstraction with NO visible implementor exactly where PART 92 c5/c10 pin it.
+      if ((ifaceDecl.members ?? []).some((m) => ts.isIndexSignatureDeclaration(m) && m.type && ts.isFunctionTypeNode(m.type)))
+        for (const cls of implClasses)
+          for (const x of cls.members ?? cls.properties ?? []) {
+            const m = (ts.isMethodDeclaration(x) || ts.isPropertyDeclaration(x) || ts.isPropertyAssignment(x))
+              && x.name?.getText?.();
+            if (!m) continue;
+            push(m);
+            const ik = `${ownerPkg}#${ifaceName}`;
+            if (!indexSigNamesByIface.has(ik)) indexSigNamesByIface.set(ik, new Set());
+            indexSigNamesByIface.get(ik).add(m);
+          }
     };
     for (const [ifaceDecl, impls] of interfaceImpls) add(pkgName, ifaceDecl, impls);
     for (const [ifaceDecl, impls] of foreignInterfaceImpls) {
@@ -5854,8 +6260,16 @@ function localImplTargets(key) {
       if (ownerPkg && !ownerPkg.startsWith("<") && !ownerPkg.startsWith("/")) add(ownerPkg, ifaceDecl, impls);
     }
   }
+}
+function localImplTargets(key) {
+  ensureLocalImplIndex();
   return localImplTargetsByKey.get(key) ?? { targets: [], allResolved: true, decls: new Set() };
 }
+// ⟨SOUNDNESS R524, shape (i)⟩ Every member name a visible implementor of `pkg#Iface` supplies.
+function indexSigMemberNames(pkg, ifaceName) {
+  ensureLocalImplIndex();
+  return [...(indexSigNamesByIface.get(`${pkg}#${ifaceName}`) ?? [])];
+}
 function applyDepHit(rec, hit) {
   // ⟨0.39⟩ The dispatched members travel with the hit — transitively, so a consumer of THIS report
   // learns of a dispatch two packages down — and each one is joined against what this scan can see.
@@ -6090,11 +6504,17 @@ const memberOwnerQual = (member) => {
 // here: the ledger's question is "did κ cover THIS call", and re-deriving the member from `decl` would
 // be a second spelling of it that could drift from the first (§G — where two paths compute one fact,
 // make them disagree; better still, do not have two).
-function disclosureTail(rec, decl, pkg, file, member) {
+// ⟨SOUNDNESS R697⟩ `kappaAnswered` — κ HAS a rule for this call, so the caller is reaching the funnel for
+// the arms κ's rule does not speak to. Only the LEDGER arm is κ's question ("did κ cover this call"), and
+// it is suppressed; the manifest, the unanswerable-KEY arm and the dynamic-re-export arm ask questions a
+// package-level κ rule cannot answer, and they run. Passed rather than re-derived from `kappaKnows(pkg,
+// member)` because κ was asked with `kMod`, which is NOT always `mod` (a construction asks about the
+// class's own module), and a second spelling of one fact is §G.
+function disclosureTail(rec, decl, pkg, file, member, kappaAnswered) {
   const declared = packageManifestEffects(file);
   if (declared !== null) { for (const e of declared) rec.direct.add(e); return; } // [] = declared pure
   const abstraction = unanswerableKey(decl);
-  if (!kappaKnows(pkg, member) && !depCoveredPkgs.has(pkg) && crossesPackageBoundary(file)) {
+  if (!kappaAnswered && !kappaKnows(pkg, member) && !depCoveredPkgs.has(pkg) && crossesPackageBoundary(file)) {
     unlistedSeen.set(pkg, (unlistedSeen.get(pkg) ?? 0) + 1);
     rec.blind.add(pkg);
     // ⟨0.21⟩ A package chained ONLY by a SELF-DECLARED-INCOMPLETE report reaches this arm because its
@@ -7268,6 +7688,32 @@ function visitCalls(node) {
             // (would flood the overwhelming-majority `arr.forEach(x => …)` shape). It is not an id/property-
             // access anyway, so it skips the ref arm below; guarded explicitly for clarity.
             if (ts.isArrowFunction(a) || ts.isFunctionExpression(a)) return;
+            // ⟨SOUNDNESS R587⟩ THE ELEMENT-ACCESS SPELLING OF THE SAME REFERENCE. `[n].map(i["roll"])`
+            // and `[n].map(i.roll)` name the same member of the same interface and invoke the same
+            // body; only the second was admitted here, so the first got no edge, no Unknown and no
+            // disclosure and its caller was ABSENT from `functions[]` — SPEC §2 rule 3's affirmative
+            // purity claim, over a body ground-truthed by `node` to write a file. Measured at `6a639e6`
+            // in all four cells: `fElemRef`/`lElemRef`/`fdElemRef`/`ldElemRef` all ABSENT while
+            // `fRef`/`lRef` read `['Fs']`. `accessedMemberName` — written by R524 and already reading
+            // `h["roll"]` — is the proof the SPELLING was anticipated and only the GATE was not.
+            //
+            // ADMITTED FOR THE DISPATCH JOIN ONLY, and that boundary is a decision (§9 in the other
+            // direction). Letting an element access fall through to the arm's opaque-callback branch
+            // would hand a NEW `Unknown` to every `xs.map(fns[0])` whose holder resolves to nothing —
+            // an ecosystem-wide hedge widening, which is what ⟨0.39⟩ priced and declined at 2.60% of
+            // functions, and it is not what this row is about. So the join runs and the arm returns.
+            //
+            // THE SCOPE CLAIM, AND WHAT BACKS IT. For a NON-element access nothing below changes at
+            // all; for an element access the arm previously returned here doing nothing, so this can
+            // only ADD. That much is structural — but "adds only what it should" is not, and it is
+            // the half an assertion would hide (§K), so it is pinned by fixtures that would go red
+            // were it false: CONTROL 2 (a PURE implementor gains nothing), CONTROL 3 (no visible
+            // implementor gains neither an effect nor a hedge) and CONTROL 5 (a COMPUTED key resolves
+            // nothing), each on both element-access spellings and both declaration sites.
+            if (ts.isElementAccessExpression(a) && accessedMemberName(a)) {
+              chargeMemberRefDispatch(rec, a, refSlotDecl(a), false, "R587-REACH");
+              return;
+            }
             if (!ts.isIdentifier(a) && !ts.isPropertyAccessExpression(a)) return;
             const d2 = realDecl(checker.getSymbolAtLocation(a));
             const t = (d2 && nodeName.get(d2)) || resolveFnRefUnit(a); // pin direct fn OR a local alias chain
@@ -7298,6 +7744,13 @@ function visitCalls(node) {
             //  (3) CALLABILITY — `argIsCallable` (has a call signature, or `any`/`unknown`/unconstrained
             //      generic that COULD hold a function).
             if (!hofInvokesArg(calleeName, argIdx, node)) return;
+            // ⟨SOUNDNESS R558⟩ …and BEFORE the by-reference dependency charge below, without returning:
+            // a FOREIGN interface member named as a value needs BOTH the visible-implementor join and
+            // the `invisible`/ledger disclosure `chargeExternalDecl` already gives it, and the two
+            // answer different halves of the same call. For a LOCAL one this is the whole answer, and
+            // the opaque-callback branch further down declines it anyway (a MethodSignature is neither a
+            // project value holder nor `!d2`), so no existing verdict is displaced — only absence is.
+            chargeMemberRefDispatch(rec, a, d2);
             // The BY-REFERENCE dependency charge belongs BELOW guard (1), not above it. It was placed
             // first and returned early, so it ran at EVERY argument position: `xs.reduce(dep.merge,
             // dep.makeSeed)` and `promise.then(dep.onOk, dep.onErr)` charged the non-callback argument's
@@ -7338,8 +7791,15 @@ function visitCalls(node) {
           if ((m === "call" || m === "apply") && recvText !== "Reflect") invokedRef = recv;
           else if (recvText === "Reflect" && (m === "apply" || m === "construct"))
             invokedRef = (node.arguments ?? [])[0] ?? null;
-          if (invokedRef && (ts.isIdentifier(invokedRef) || ts.isPropertyAccessExpression(invokedRef))) {
-            const d2 = realDecl(checker.getSymbolAtLocation(invokedRef));
+          // ⟨SOUNDNESS R587⟩ …and the ELEMENT-ACCESS spelling of the invoked reference, on the same
+          // grounds as the HOF-ref arm above: `i["roll"].call(null, n)` invokes exactly what
+          // `i.roll.call(null, n)` invokes. Measured ABSENT at `6a639e6` in every cell
+          // (`fElemCall`/`lElemCall`/`fdElemCall`). Restricted to a LITERAL key by
+          // `accessedMemberName` — a computed `i[k].call(…)` names nothing and is left where it was
+          // rather than guessed at, which is the same line R524 drew.
+          if (invokedRef && (ts.isIdentifier(invokedRef) || ts.isPropertyAccessExpression(invokedRef)
+                             || (ts.isElementAccessExpression(invokedRef) && accessedMemberName(invokedRef)))) {
+            const d2 = refSlotDecl(invokedRef);
             // Resolve the receiver/arg0 to its function unit, FOLLOWING local-variable aliases
             // (`const m = effectful; m.call(…)`) — the direct-identifier form already landed on a minted
             // unit, but an aliased local var resolves to its VARIABLE decl (not a unit), which dropped the
@@ -7355,11 +7815,45 @@ function visitCalls(node) {
               // over-disclosure); an EFFECTFUL one (`fs.writeFileSync` → Fs, `dns.resolve` → Net) gets its effect.
               const kMod = d2 && declModule(d2);
               const kMember = d2?.name?.getText?.()
-                ?? (ts.isPropertyAccessExpression(invokedRef) ? invokedRef.name.text : ts.isIdentifier(invokedRef) ? invokedRef.text : null);
+                ?? (ts.isIdentifier(invokedRef) ? invokedRef.text : accessedMemberName(invokedRef));
               // SELF-NAME GUARD (see `isOwnPackageDecl`): the reflectively-invoked reference may be OUR
               // OWN package's own function, reached through its own `dist/*.d.ts` — never let κ answer
               // for it, same reasoning as the (CLASSIFY) arm.
               const kEff = kMod && kMember && !isOwnPackageDecl(d2) ? kappa(kMod, kMember) : null;
+              // ⟨SOUNDNESS R587⟩ THE DISPATCH JOIN, AT THE FUNNEL THAT HAD NEITHER HALF OF IT. This is
+              // the site R573 was filed on and it was silent in EIGHT spellings, not the two the row
+              // named. `chargeExternalDecl` below runs `joinLocalImpls(recordDispatch(…))` — obligation
+              // 3's DECLARED half — and never `joinIndexSignatureImpls`, so a foreign index signature
+              // reached `[]`; and `declIsLocal` keeps a LOCAL declaration out of that funnel entirely,
+              // so both local spellings (index-signature AND declared-member) reached nothing at all
+              // and their callers were ABSENT. Measured at `6a639e6`, one file, `tsc` clean, every body
+              // ground-truthed by `node` to write a file:
+              //
+              //     fCall/fApply/fReflect  []      lCall/lApply/lReflect   ABSENT
+              //     ldCall/ldApply         ABSENT  ← the LOCAL DECLARED half, which R573 does not name
+              //     fdCall/fdApply ['Fs']  fPlain/fdPlain/ldPlain ['Fs']   ← the controls
+              //
+              // and the local half is STRICTLY WORSE than its own baseline: `li.roll(n)` discloses
+              // `Unknown` (`deny Unknown` exit 1) and the identical body through `.call` is silent.
+              //
+              // §G — THE SAME PREDICATE THE HOF-REF ARM CALLS, not a third join. Adding
+              // `joinIndexSignatureImpls` to `chargeExternalDecl` (the remedy the review named) would
+              // close three of these eight: that function receives no call-site expression, so it
+              // cannot supply the member name an index signature has no declaration to give, and it is
+              // unreachable for every LOCAL arm. The question "does this reference name an abstract
+              // member some visible implementor answers" is one question and now has one implementation.
+              //
+              // ⟨R574⟩ IS CARRIED ACROSS RATHER THAN RE-DECIDED. Where κ answered AND the receiver is
+              // demonstrably the package's own product (`const g = makeClient(); g.fetchIt.call(…)`),
+              // this hedges — `Unknown` + `dispatch:` — exactly as the CallExpression arm does, on the
+              // same `packageProducedReceiver` test with the same `eff ?` gate. Without it this fix
+              // would reintroduce R574's fabricated concrete effect at a NEW site, which is how that
+              // class spread the first time.
+              const ownProduct = kEff && (ts.isPropertyAccessExpression(invokedRef) || ts.isElementAccessExpression(invokedRef))
+                ? packageProducedReceiver(invokedRef.expression,
+                    kMod?.startsWith("@types/") ? kMod.slice("@types/".length) : kMod)
+                : null;
+              chargeMemberRefDispatch(rec, invokedRef, d2, !!ownProduct, "R587-REACH");
               if (kEff) {
                 rec.direct.add(kEff);
                 if (kEff === "Unknown") rec.why.add(`reflect:${kMod.replace(/^node:/, "")}.${kMember}`);
@@ -7912,7 +8406,7 @@ function visitCalls(node) {
             : (isConnectingCtor(declaredCtorClassName(decl)) ? declaredCtorClassName(decl) : ctorClassName);
           const member = isConnectingCtor(ctorRuleName) ? ctorRuleName
             : isConstruction ? "new"
-            : (decl.name ? decl.name.getText() : bindingName(decl));
+            : declMemberToken(decl, decl.name ? decl.name.getText() : bindingName(decl)); // R801
           // ⟨0.32⟩ THE MODULE κ IS READ AGAINST — `mod` for everything except a construction whose
           // constructor came from somewhere else, which is re-keyed onto the CLASS's own module.
           //
@@ -8145,13 +8639,130 @@ function visitCalls(node) {
           // one hop short and the consumer's row ABSENT — a purity claim. Recorded BEFORE the chained
           // lookup below and independently of whether it hits: whether this run happened to be chained
           // says nothing about what a consumer of THIS report will be able to see.
-          if (!eff && !mod.startsWith("<"))
-            joinLocalImpls(rec, recordDispatch(rec, decl,
-              mod.startsWith("@types/") ? mod.slice("@types/".length) : mod));
-          // CANDOR_DEPS: an unclassified call into a package with a loaded sibling report inherits
-          // that function's recorded transitive effects (+ literal surfaces) by `hash`.
+          //
+          // ⟨SOUNDNESS R560⟩ NOT GATED ON `!eff`, AND THAT GUARD WAS THE WHOLE OF THE CARDINAL SIN.
+          // A κ WHOLE-MODULE rule answers for the package, and it fired on a call whose only link to the
+          // package is its TYPE — so the join that would have found the caller's OWN implementor never
+          // ran. MEASURED at `d46c098`, one file, one variable (where the interface is declared):
+          // `ev.save(n)` with `ev: DefaultEventsMap` (socket.io) and a LOCAL implementor that writes a
+          // file read `inferred:['Net']` — `deny Fs` EXIT 0 over the write, `deny Net` EXIT 1 over
+          // nothing dialling — while the local-interface twin `viaLocal` read `['Fs']` and gated
+          // correctly. `emitNoop`, an EMPTY body typed the same way, also read `['Net']`.
+          // §9 — THE BOUNDARY IS NOT DRAWN AROUND R560's TRIGGER: the row is written on the
+          // index-signature spelling, and the DECLARED-member spelling of a foreign interface
+          // (`TypedEventBroadcaster.emit`, a real socket.io interface with a named member) was measured
+          // to lose the same effect the same way. Both spellings are joined here, so both are closed.
+          // The engine already KNEW the answer in both — it published the union entry
+          // `TypedEventBroadcaster.emit -> ['Fs']` in the same report whose caller row said `['Net']`.
+          // Running the join unconditionally is PURELY ADDITIVE: `joinLocalImpls` only edges to units
+          // this scan minted or hedges `Unknown`, so κ's own charge is never removed by it. The
+          // FABRICATION half of R560 — κ's `Net` on a call that enters no package code — is NOT fixed
+          // here and is NOT the same defect: removing it is a NARROWING of a sound over-approximation
+          // and belongs to a ruling, not a patch. See the CHANGELOG entry for the measurement.
+          if (!mod.startsWith("<")) {
+            const dpkg = mod.startsWith("@types/") ? mod.slice("@types/".length) : mod;
+            // REACH PROBE for the ⟨R560⟩ half, env-gated, same convention as ⟨R519⟩/⟨R524⟩'s.
+            // ⟨SOUNDNESS R574⟩ IT FIRED ON BRANCH ENTRY AND IS NOW FIRED ON THE JOIN'S OUTCOME. As
+            // published it sat HERE, above `recordDispatch`, so a file containing only
+            // `fs.writeFileSync` + `cp.execSync` emitted two hits — both rejected by `recordDispatch`
+            // one line later, both incapable of changing a row. The number it produced, "182 hits
+            // across 12 entries — the over-charge control WITH real reach", therefore could not
+            // distinguish 182 genuine joins from 182 node-core no-ops, and it was cited as if it
+            // could. A probe placed before the filter it is evidence FOR measures the filter's input.
+            // It now counts only outcomes that CONTRIBUTED to `rec` — an edge, an `ambiguous:` or a
+            // `dispatch:` hedge — and prints WHICH, so the next reader can bucket without re-running.
+            // ⟨SOUNDNESS R574⟩ …AND WHERE THE RECEIVER IS THE PACKAGE'S OWN PRODUCT, HEDGE INSTEAD OF
+            // CHARGING. Removing the `!eff` guard was right and is not reverted — but it also ran the
+            // CHA join on every foreign call κ had already answered, and a local implementor of the
+            // package's interface is then charged to a call that cannot reach it. MEASURED at
+            // `d534b62`, one file, `tsc` clean, `analyzed=6`, the only variable being the receiver's
+            // PROVENANCE: `viaLib()` — `const g = makeClient(); g.fetchIt(u)`, the receiver genuinely
+            // got's own object — read `['Net']` at `d46c098` and `['Exec','Net']` after, the `Exec`
+            // coming from a local `class MyClient implements Gettable` the call never reaches.
+            //
+            // THE BOUNDARY IS `eff` AND THAT IS A DECISION, NOT AN OVERSIGHT (§9). It is confined to
+            // the branch R560 ADDED, so nothing that existed before R560 can move: the `!eff` path is
+            // byte-identical. The asymmetry has a reason rather than a convenience — where κ answered,
+            // the package's OWN implementor is already charged by κ's rule, so declining a candidate
+            // the receiver provably is not loses nothing about the receiver; where κ did not answer,
+            // the CHA candidates are the only thing the engine knows about the call and declining them
+            // is SILENCE, which is the trade this family refuses. **MEASURED, so the asymmetry is
+            // priced and not assumed: at `d46c098` the identical consumer against a NON-κ package
+            // already read `['Exec']` on `viaLib` through this same join.** The over-charge is
+            // therefore the shipped ⟨0.35⟩/⟨0.39⟩ CHA over-approximation and R560 widened its SCOPE,
+            // not its KIND — which is why the answer here is ⟨0.35⟩'s other sanctioned branch and not
+            // a deletion.
+            //
+            // IT HEDGES, IT DOES NOT DELETE. `['Net','Unknown']` + `dispatch:got.Gettable.fetchIt`,
+            // not `['Net']`: narrowing past a fabrication into silence converts an over-report into
+            // the cardinal sin, and no row may lose an effect without gaining the disclosure that
+            // replaces it. `recordDispatch` still runs, so the wire key R560 added is still published
+            // and a consumer joining it against its own implementors recovers what this scan declined
+            // to assert.
+            const ownProduct = eff ? packageProducedReceiver(
+              (ts.isPropertyAccessExpression(node.expression) || ts.isElementAccessExpression(node.expression))
+                ? node.expression.expression : null, dpkg) : null;
+            const rdOut = joinLocalImpls(rec, recordDispatch(rec, decl, dpkg), !!ownProduct);
+            // ⟨SOUNDNESS R524, shape (i)⟩ …and the INDEX-SIGNATURE spelling of the same dispatch, which
+            // `recordDispatch` returns null for because there is no member name on the declaration to
+            // form a key from. A CallExpression is the only site that has the receiver access in hand,
+            // and a member name is exactly what the site supplies and the declaration cannot. The
+            // DESUGARED arm — `[n].map(h.roll)`, silent through an interface member in BOTH the local
+            // and the foreign arm — was a wider hole with its own mechanism; it is ⟨R558⟩ and is now
+            // closed at the HOF-ref site by `chargeMemberRefDispatch`, through these same two joins.
+            const isOut = joinIndexSignatureImpls(rec, decl, dpkg, accessedMemberName(node.expression), !!ownProduct);
+            // ⟨SOUNDNESS R583⟩ through the one shared probe, so the three reach marks in this file
+            // cannot drift again. `eff &&` because the branch R560 ADDED is the κ-answered one.
+            probeJoinReach("R560-REACH", eff && (rdOut ?? isOut), `${dpkg}.${member || "<computed>"} eff=${eff}`);
+          }
+          // CANDOR_DEPS: a call into a package with a loaded sibling report inherits that function's
+          // recorded transitive effects (+ literal surfaces) by `hash`.
+          //
+          // ⟨SOUNDNESS R696⟩ NOT GATED ON `!eff`, AND THAT GUARD WAS THE WHOLE OF THE CARDINAL SIN —
+          // the ts sibling of candor-java R685, where `crossDepJoin` was gated on `effect == null` so a
+          // member the classifier had a rule for never had the dependency's OWN published row read at
+          // all. Here it was κ: a κ rule for the package — a WHOLE-MODULE one in every measured case
+          // (`axios|got|node-fetch|undici|ws|socket.io|nodemailer`→Net, `winston|pino|bunyan|npmlog`→Log,
+          // `pg|mysql2|mongodb|…`→Db, `execa|cross-spawn|shelljs`→Exec, `fs-extra|glob|chokidar|…`→Fs) —
+          // made `eff` truthy for EVERY member of the package, so the chained entry under that exact
+          // hash was skipped and κ's one effect was published as the whole answer.
+          //
+          // MEASURED ON REAL CODE, one variable held apart: the corpus's real `got` 14.4.1 scanned into a
+          // report (`got#Request.flush -> ['Clock','Net','Unknown']`, `unresolved: true`, four reason
+          // classes), chained against a consumer doing `r.flush()`. Under the package's real name the
+          // consumer row read `['Net']` with `unresolved: false` and no reasons — `deny Clock src.m.go`
+          // and `deny Unknown src.m.go` BOTH exit 0. With the SAME report content renamed `gotx` so κ has
+          // no rule, the same consumer read `['Clock','Net','Unknown']`, `unresolved: true`, and both
+          // gates exit 1. The consumer was reading MORE CERTAINTY than the report it was handed, which is
+          // the one thing §2's chained join exists to prevent.
+          //
+          // And the one-tree control, which is what makes it a contradiction rather than a preference:
+          // eight shapes (plain method, dep-declared interface reached through the interface, `import
+          // type`, abstract member, callback property, generic constrained to a dep interface, index
+          // signature, bare function export) all read `['Exec']` with the dependency's body IN the scan
+          // and `['Log']` once split behind a chained report named `winston`. Same source, two answers,
+          // `deny Exec` exit 1 → exit 0, and `deny Exec Unknown` green too — no policy form caught it.
+          //
+          // PURELY ADDITIVE, which is why this is a patch and not a ruling: `applyDepHit` only ever calls
+          // `rec.*.add`, so κ's own charge is never removed and no row can lose an effect — the union the
+          // family's cross-dep rule asks for. `crossDeps.size > 0` still means an UNCHAINED scan is
+          // byte-identical; the newly reached set is exactly (chained ∧ κ answered ∧ the report carries
+          // the key). Distinct from the R574 hazard one branch up: THAT join guesses a LOCAL implementor
+          // of a foreign abstraction, where the receiver's provenance decides whether the candidate is
+          // reachable at all. This one reads the DEPENDENCY's own row for the very member the checker
+          // resolved, so a receiver the PACKAGE produced is exactly what the row is about.
+          // MEASURED rather than argued, because that is a safety assertion and this file's own §K rule
+          // says those are the lines to attack: with a dep declaring `Sink`, implementing it as an Exec
+          // `DepSink` returned from `makeSink()`, and the CONSUMER declaring its own Fs `LocalSink` for
+          // the same interface, `const s = makeSink(); s.write(x)` gains the dependency's `Exec` beside
+          // κ's `Log` and does NOT gain the consumer's `Fs`. Pinned in test.mjs §11h.
+          // THE BOUNDARY, stated rather than overclaimed: this join can still over-charge to the extent
+          // the DEPENDENCY's own ⟨0.39⟩ obligation-2 union entry over-approximates (a union naming an
+          // implementor from a third package that this receiver provably is not). That is inherited from
+          // the producer's row and is the same over-approximation the pre-R696 `!eff` path already
+          // accepted on every κ-silent package; the error direction is over-charge, never silence.
           let inheritedFromDep = false;
-          if (!eff && crossDeps.size > 0 && !mod.startsWith("<")) {
+          if (crossDeps.size > 0 && !mod.startsWith("<")) {
             const nameDecl = memberSigOf(decl); // a function-typed property names its member one level up
             let localTail = nameDecl.name ? nameDecl.name.getText() : null;
             const owner3 = nameDecl.parent && nameDecl.parent.name ? nameDecl.parent.name.getText() : null;
@@ -8173,7 +8784,23 @@ function visitCalls(node) {
             // fallback exactly the typed-consumer shape the chain targets never joined.
             const hit = localTail && (crossDeps.get(`${depMod}#${localTail}`)
               ?? (nameDecl.name ? crossDeps.get(`${depMod}#${nameDecl.name.getText()}`) : undefined));
-            if (hit) { inheritedFromDep = true; applyDepHit(rec, hit); }
+            if (hit) {
+              inheritedFromDep = true;
+              // ⟨SOUNDNESS R696⟩ REACH PROBE for the branch this row ADDED — the κ-answered one — and it
+              // counts the JOIN'S OUTCOME, not branch entry (R574/R583: a probe placed before the filter
+              // it is evidence for measures the filter's input). `eff &&` because the pre-R696 `!eff` path
+              // is byte-identical and cannot be what a reader is pricing. Env-gated, same convention as
+              // ⟨R519⟩/⟨R524⟩/⟨R560⟩'s: CANDOR_R696_REACH=1.
+              const before = eff ? `${rec.direct.size}/${rec.blind.size}/${rec.why.size}/${rec.incomplete.size}`
+                                 + `/${rec.hosts.size}/${rec.cmds.size}/${rec.paths.size}/${rec.tables.size}/${rec.dispatch.size}` : null;
+              applyDepHit(rec, hit);
+              if (eff) {
+                const after = `${rec.direct.size}/${rec.blind.size}/${rec.why.size}/${rec.incomplete.size}`
+                            + `/${rec.hosts.size}/${rec.cmds.size}/${rec.paths.size}/${rec.tables.size}/${rec.dispatch.size}`;
+                probeJoinReach("R696-REACH", after === before ? null : "contributed",
+                               `${depMod}#${localTail} eff=${eff} ${before}->${after}`);
+              }
+            }
           }
           // unmatched external = (OPAQUE): contributes nothing — the curated-κ caveat C1. The
           // κ-coverage LEDGER makes the caveat per-scan evidence instead of a doc footnote: count
@@ -8181,7 +8808,22 @@ function visitCalls(node) {
           // report covers (the argon2 lesson — the blind spot landed on exactly the call a
           // security review cared about). Builtins are excluded: κ's builtin coverage is the
           // bounded frontier, and an unlisted builtin (path, util) is known-pure, not blind.
-          if (!eff && !inheritedFromDep && !mod.startsWith("<")) {
+          //
+          // ⟨SOUNDNESS R697⟩ AND THIS ARM'S `!eff` WAS THE SECOND HALF OF THE SAME PREEMPTION. The
+          // unanswerable-KEY disclosure lives down this funnel, and κ's answer suppressed it: a call
+          // through a member of a CHAINED package whose report is silent under that key got
+          // `Unknown[dispatch:<pkg>.<Owner>.<member>]` when κ had no rule and NOTHING when it did.
+          // MEASURED, same report content both arms, only the package NAME differing so that κ matches:
+          // an `abstract act()` of a chained dep read `['Unknown'] why=['dispatch:depkit.Base.act']` and
+          // `deny Exec Unknown src.m.go` exit 1; named `winston` the row read `['Log']` and the same
+          // policy exit 0 — over a real `execSync`. Same for a dep-declared interface the dep does not
+          // implement (`Unknown[dispatch:depkit.Runner.run]` vs nothing). κ's rule says what the PACKAGE
+          // does; it never says WHICH IMPLEMENTATION runs behind an abstraction member, which is the only
+          // question this arm asks — so it is not κ's to answer and not κ's to silence.
+          // The LEDGER arm inside the funnel IS κ's question and stays suppressed (`kappaAnswered`).
+          // `!inheritedFromDep` is KEPT: where the chained report carried the key it answered, and R696
+          // above has already joined it.
+          if (!inheritedFromDep && !mod.startsWith("<")) {
             // The REAL package name first: a typed consumer of an untyped package resolves into
             // @types/<pkg>, and κ's tables/review lists hold the real name (/code-review: lodash
             // via @types/lodash was falsely disclosed — kappaKnows saw the unstripped name).
@@ -8192,7 +8834,7 @@ function visitCalls(node) {
             // already ran its own chained-dep lookup above (`inheritedFromDep`, with its constructor/
             // owner-prefix spelling), so it hands the tail an already-external, already-unmatched `decl`
             // rather than re-deriving the join.
-            disclosureTail(rec, decl, pkg, file, member);
+            disclosureTail(rec, decl, pkg, file, member, !!eff);
           }
         }
       }
@@ -8992,7 +9634,7 @@ function visitCalls(node) {
         // call gets (never silent-pure). A pure builtin tag (String.raw, from the TS lib, not node_modules) adds
         // nothing — no fabrication.
         const mod = declModule(decl);
-        const member = decl.name ? decl.name.getText() : "";
+        const member = declMemberToken(decl, decl.name ? decl.name.getText() : ""); // R801 — same token
         // SELF-NAME GUARD (see `isOwnPackageDecl`): an external-looking tag may be OUR OWN package's
         // own function, reached through its own `dist/*.d.ts` — never let κ answer for it. `mod` stays
         // whatever `declModule` computed, so the ledger below (already keyed on
@@ -9122,6 +9764,94 @@ function mintCallTargetUnit(fn) {
 }
 for (const sf of sources) visitCalls(sf);
 
+// ---- pass 2a′: CLASS-DEFINITION-TIME WORK IS WIRED FROM THE UNIT THAT EVALUATES THE CLASS ----------------
+// SOUNDNESS R782 + R785. A JS class definition is EAGER and INLINE: `@Deco class Y {}` calls `Deco` —
+// and a `static { … }` block runs — at the moment the enclosing body reaches that statement, once per
+// evaluation. So the unit that EVALUATES the class performs that work: `<module>` for a top-level class,
+// `mk` for `function mk() { @Deco class Y {} return Y }`, `A.m` for a class declared inside a method.
+// ⟨0.14⟩ (SPEC §2, the initializer unit) already rules module top-level code in scope. Before this pass
+// every piece of it was a ROOT: `Deco` was reported as its own unit (correctly) and NOTHING edged to it,
+// `X.<static-init>` and `<decorator-arg>@N` were minted and never reached. MEASURED (EXECUTED — the
+// compiled module writes its witness on import, `mk` writes on every call): `deny Fs src.m.<module>`,
+// `deny Fs src.m.mk`, `deny Fs src.m.caller` and the README's own layer gate `deny Fs src.domain` over an
+// `infra` decorator applied to a `domain` class ALL exited 0, while the identical effect as a plain
+// statement exited 1. `staticBlockUnit` copied java's `<clinit>` shape, which is right on the JVM (class
+// init is lazy and JVM-triggered) and wrong here.
+//
+// THIS IS AN EDGE PASS, NOT A CHANGE TO `enclosing`, and that is the point of both constraints R782 names:
+//  (1) The evaluating unit is `enclosing(cls.parent)` — the climb starts OUTSIDE the whole decorated class.
+//      One node up from a METHOD decorator is the ClassDeclaration, which `nodeName` maps to
+//      `X.constructor`; continuing the climb from the Decorator would FABRICATE the decorator's effects
+//      onto the constructor and every `new X()` — exactly what `174f3cb`'s Decorator guard removed. The
+//      guard in `enclosing` is untouched, so no call inside a decorator moves; this pass only ADDS edges.
+//  (2) Only to a LOCAL, BODIED unit. An external decorator (`@Injectable()`, `@Entity()`) is R64 shape 3 —
+//      wiring it would put the κ ledger's `Unknown`/`invisible` on `<module>` in every framework file, a
+//      priced disclosure question filed elsewhere — and a body-less local declaration is the same: no body
+//      this scan can see. A `<decorator-arg>@N` / `<static-init>` / anonymous `<decorator>@N` unit is by
+//      construction local and bodied (it exists only because something in it was attributed there).
+// Targets, per decorator: the decorator's own APPLICATION (the value it evaluates to is CALLED with the
+// target — the resolved signature of the Decorator node itself), the factory CALL when the expression is
+// one (`@F("u")` calls `F`; the closure it returns is attributed to `F` lexically), and that call's
+// argument unit. Per class: every `static {}` block's unit. Classes are processed INNERMOST FIRST, so a
+// class defined inside an outer class's static block wires into that block's unit before the outer class
+// wires the block — no second sweep needed. `<module>` is minted only when there is something to edge.
+// `CANDOR_R782_HITS=1` counts each edge added (`deco`/`arg`/`static`), printed only when non-zero.
+{
+  const R782_HITS = process.env.CANDOR_R782_HITS ? new Map() : null;
+  const hit = (k) => { if (R782_HITS) R782_HITS.set(k, (R782_HITS.get(k) ?? 0) + 1); };
+  if (R782_HITS) process.on("exit", () => {
+    const rows = [...R782_HITS].sort();
+    const total = rows.reduce((a, [, n]) => a + n, 0);
+    if (total) process.stderr.write(`R782PROBE total=${total}` + rows.map(([k, n]) => ` ${k}=${n}`).join("") + "\n");
+  });
+  const hasBody = (d) => !!d && !!d.body
+    && (ts.isFunctionDeclaration(d) || ts.isMethodDeclaration(d) || ts.isArrowFunction(d)
+        || ts.isFunctionExpression(d) || ts.isGetAccessorDeclaration(d) || ts.isSetAccessorDeclaration(d));
+  const localBodiedUnit = (callLike) => {
+    let d;
+    try { d = checker.getResolvedSignature(callLike)?.declaration; } catch { d = undefined; }
+    if (!d || !declIsLocal(d) || !hasBody(d)) return undefined;
+    return callTargetUnit(d);
+  };
+  const decoratedClass = (dec) => {
+    for (let p = dec.parent; p; p = p.parent)
+      if (ts.isClassDeclaration(p) || ts.isClassExpression(p)) return p;
+    return undefined;
+  };
+  const classes = [];
+  for (const sf of sources) (function findClasses(n) {
+    if (ts.isClassDeclaration(n) || ts.isClassExpression(n)) classes.push(n);
+    ts.forEachChild(n, findClasses);
+  })(sf);
+  // Document order is outer-before-inner; reversed, every nested class precedes its container.
+  for (const cls of classes.reverse()) {
+    const targets = [];
+    const add = (q, k) => { if (q && fns.has(q)) targets.push([q, k]); };
+    const decorators = [];
+    (function findDecorators(n) {
+      if (n !== cls && (ts.isClassDeclaration(n) || ts.isClassExpression(n))) return; // its own pass
+      if (ts.isDecorator(n) && decoratedClass(n) === cls) decorators.push(n);
+      ts.forEachChild(n, findDecorators);
+    })(cls);
+    for (const dec of decorators) {
+      add(localBodiedUnit(dec), "deco");                         // the application
+      let e = dec.expression;
+      while (ts.isParenthesizedExpression(e)) e = e.expression;
+      if (ts.isCallExpression(e)) {
+        add(localBodiedUnit(e), "deco");                         // the factory call
+        add(`${moduleOf(e.getSourceFile())}.${DECORATOR_ARG_LOCAL}${e.getStart()}`, "arg");
+      }
+    }
+    for (const m of cls.members ?? [])
+      if (ts.isClassStaticBlockDeclaration(m)) add(staticBlockQual(m), "static");
+    if (!targets.length) continue;
+    const from = enclosing(cls.parent);
+    const rec = from && fns.get(from);
+    if (!rec) continue;
+    for (const [q, k] of targets) if (q !== from && !rec.edges.has(q)) { rec.edges.add(q); hit(k); }
+  }
+}
+
 // ---- pass 2b: callback-flow resolution (the callback_named move) ----------------------------------
 // A fn invoking its parameter i resolves to the named target(s) actually passed. Three shapes:
 //  - NO visible call site (the fn may be exported; outside callers can pass anything) — honest Unknown
@@ -11064,21 +11794,40 @@ if (wantJson) {
   // `REPORT_STREAM_WRITTEN` OnceLock at the analog site (crates/candor-scan/src/scan.rs).
   reportStreamWritten = true;
 } else {
-  writeAtomic(`${outPrefix}.json`, JSON.stringify(envelope, null, 1));
-  writeAtomic(`${outPrefix}.callgraph.json`, JSON.stringify(cg, null, 1));
-  // ⟨verify⟩ ALL-FUNCTION SPAN index — the [start, end] line SPAN of EVERY analyzed fn, pure ones INCLUDED
-  // (the §2 report carries a start loc for effectful fns only). The dynamic honesty oracle (candor-ts-verify)
-  // maps a runtime effect site to its enclosing fn; it needs SPANS, not just starts, for two reasons: (1) a
-  // pure fn omitted from §2 has no anchor, so its effect would fold onto the nearest preceding effectful fn
-  // and its cardinal-sin escape would vanish (a silent MISS); (2) a start-only "nearest declaration below"
-  // rule misattributes a site that sits AFTER a nested fn but INSIDE the effectful outer fn to that nested
-  // (often pure) fn — manufacturing a FALSE violation (found corpus-testing a real app: an fs.readFileSync in
-  // a big `run()` bucketed onto a pure test-callback arrow declared earlier). With spans the oracle picks the
-  // INNERMOST fn whose [start,end] CONTAINS the site — correct in both cases. Format `{fn: {loc, end}}`;
-  // additive (no §2/callgraph consumer reads it); the oracle fails CLOSED (discloses) without it.
-  const locs = {};
-  for (const [name, rec] of fns) if (rec.loc) locs[name] = { loc: rec.loc, end: rec.endLine ?? null };
-  writeAtomic(`${outPrefix}.locs.json`, JSON.stringify(locs, null, 1));
+  // ⟨SOUNDNESS R522⟩ THIS WRITE CAN FAIL FOR ORDINARY REASONS — a read-only filesystem, an unwritable
+  // directory, a prefix with no parent at all — and until now none of them were caught. `writeAtomic`
+  // -> `writeSinkAtomic` -> `fs.writeFileSync` threw straight out of `main`, past every refusal plumbing
+  // in this file, as an UNCAUGHT exception: a raw Node stack trace on stderr and exit 1. SPEC §3.3.1
+  // makes a broken sink an exit-2 usage error like any other unwritable `--out`/`--gate-json`; a stack
+  // trace is neither a verdict nor a refusal, and a CI consumer parsing this run's exit code reads exit
+  // 1 as "the policy failed", not "the tool couldn't write its own report". Measured:
+  // `candor-ts . /also-bogus` (the legacy positional out-prefix, armed at parse time) died here with
+  // `EROFS: read-only file system, open '/also-bogus.json.<pid>.tmp'` and no exit-2 refusal at all.
+  //
+  // `refuseEarly` is safe to call this late: `armedGateSink`/`refusalPrefix` were latched during argv
+  // parsing, and `writeRefusalMarker` already fails OPEN on its own unwritable sink (see above) — so a
+  // `--gate-json`/marker write that fails for the SAME reason this one just did does not mask the cause.
+  try {
+    writeAtomic(`${outPrefix}.json`, JSON.stringify(envelope, null, 1));
+    writeAtomic(`${outPrefix}.callgraph.json`, JSON.stringify(cg, null, 1));
+    // ⟨verify⟩ ALL-FUNCTION SPAN index — the [start, end] line SPAN of EVERY analyzed fn, pure ones INCLUDED
+    // (the §2 report carries a start loc for effectful fns only). The dynamic honesty oracle (candor-ts-verify)
+    // maps a runtime effect site to its enclosing fn; it needs SPANS, not just starts, for two reasons: (1) a
+    // pure fn omitted from §2 has no anchor, so its effect would fold onto the nearest preceding effectful fn
+    // and its cardinal-sin escape would vanish (a silent MISS); (2) a start-only "nearest declaration below"
+    // rule misattributes a site that sits AFTER a nested fn but INSIDE the effectful outer fn to that nested
+    // (often pure) fn — manufacturing a FALSE violation (found corpus-testing a real app: an fs.readFileSync in
+    // a big `run()` bucketed onto a pure test-callback arrow declared earlier). With spans the oracle picks the
+    // INNERMOST fn whose [start,end] CONTAINS the site — correct in both cases. Format `{fn: {loc, end}}`;
+    // additive (no §2/callgraph consumer reads it); the oracle fails CLOSED (discloses) without it.
+    const locs = {};
+    for (const [name, rec] of fns) if (rec.loc) locs[name] = { loc: rec.loc, end: rec.endLine ?? null };
+    writeAtomic(`${outPrefix}.locs.json`, JSON.stringify(locs, null, 1));
+  } catch (e) {
+    console.error(`candor-ts: could not write the report to ${outPrefix} (${e.message}) — refusing (exit 2)`);
+    refuseEarly(`could not write the report to ${outPrefix}: ${e.message}`);
+    process.exit(2);
+  }
 }
 // Type-hierarchy sidecar (SPEC §4 / 0.7): each project class/interface (qualified `mod.Name`, matching
 // the `mod.Class.member` fn quals) -> its qualified direct supertypes/interfaces. Compact (O(types)),