candor-ts 0.40.0 → 0.40.1

package/scan.mjs

@@ -40,6 +40,14 @@ import { isTestPath, kappa, kappaKnows, nodeCoreUnreviewed, fsKind, commandHeadE
          WEB_WIRE_MEMBERS, CONNECTING_CTORS, NET_ESTABLISHING, NET_ACCEPTING, NET_REQUEST_NAMED, FS_USE_VERBS,
          EXEC_USE_VERBS, RESERVED_SIDECAR_SEGMENTS } from "./scan-core.mjs";
 import { emitSurface } from "./surface.mjs";
+// ⟨R815⟩ reach marker for the class-definition-time attribution in `enclosing` (declared here, not beside it:
+// `enclosing` runs from module-level code above its own definition, so a later `const` is in its TDZ).
+const R815_REACH = process.env.CANDOR_R815_REACH ? (k) => console.error(`R815-REACH ${k}`) : null;
+// ⟨R934/R935⟩ reach marker: a charge that came from a PARAMETER or PROPERTY environment location.
+const R246_REACH = process.env.CANDOR_R246_REACH ? (k) => console.error(`R246-REACH ${k}`) : null;
+let projAccessorNames = null;
+const anyRecvSetResidue = [];   // ⟨R246/R1039⟩ { owner, name|null, kind } — see the post-fixpoint disclosure
+const ENVLOC_REACH = process.env.CANDOR_ENVLOC_REACH ? (k) => console.error(`ENVLOC-REACH ${k}`) : null;
 
 const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 
@@ -2655,7 +2663,16 @@ function declModule(decl) {
   let m = f.match(/@types\/node\/(.+?)\.d\.ts$/);
   if (m) return m[1];
   if (/typescript\/lib\/lib\..*\.d\.ts$/.test(f)) return "<es-lib>";
-  m = f.match(/node_modules\/(@[^/]+\/[^/]+|[^/]+)\//);
+  // ⟨SOUNDNESS R778⟩ The INNERMOST `node_modules/<pkg>/` owns the file, not the first. pnpm's real path is
+  // `node_modules/.pnpm/fs-extra@11.2.0/node_modules/fs-extra/…` and an npm nested install is
+  // `node_modules/outer/node_modules/inner/…`; the first-segment match keyed every foreign package of a pnpm
+  // tree as `.pnpm` and `inner` as `outer`. MEASURED with the installer the only variable (fx/r778-{npm,pnpm},
+  // EXECUTED to write the file): npm read `['Fs']` and `deny Fs` exit 1, pnpm read `[]` + `invisible:['.pnpm']`
+  // and exit 0 — a FALSE disclosure (`.pnpm` is not a package) hiding a κ-classified effect. For a flat npm
+  // layout the first and last segments are the same one, so no npm key moves. A file directly under a dot-store
+  // with no inner `node_modules/` (no package segment at all) asks the nearest `package.json` instead.
+  m = [...f.matchAll(/node_modules\/(@[^/]+\/[^/]+|[^/]+)\//g)].at(-1) ?? null;
+  if (m && m[1].startsWith(".")) m = (() => { const n = nearestPackageName(f); return n ? [null, n] : m; })();
   if (m) {
     // `@types/X` (DefinitelyTyped) provides types for the RUNTIME package X — map it to X so the curated κ
     // tier (keyed by the runtime name: pg/ws/…) fires. Without this a package typed via @types resolved to
@@ -3461,8 +3478,7 @@ function literalHeadHostUrl(expr) {
 //     (an assignment rooted at it, another call's argument, an alias, a return) refuses the capture.
 function determinedUrlObject(expr, call, depth = 0) {
   if (!expr || depth > 1) return null;
-  while (ts.isParenthesizedExpression(expr) || ts.isAsExpression(expr) || ts.isNonNullExpression(expr)
-         || ts.isSatisfiesExpression?.(expr)) expr = expr.expression;
+  expr = unwrapArgExpr(expr);   // R780: the one transparent-wrapper set
   if (ts.isNewExpression(expr) && ts.isIdentifier(expr.expression)
       && (expr.expression.text === "URL" || expr.expression.text === "Request")) {
     const decls = checker.getSymbolAtLocation(expr.expression)?.declarations ?? [];
@@ -3516,8 +3532,17 @@ function determinedUrlObject(expr, call, depth = 0) {
   visit(d.getSourceFile());
   return safe ? determinedUrlObject(d.initializer, call, depth + 1) : null;
 }
-// R947 — the invoked function's own ARGUMENTS on the reflective routes, or `null` when they are not
-// visible here (a spread, an `.apply` of a non-literal array). `null` is the safe answer: it captures nothing.
+// ⟨SOUNDNESS R780⟩ THE ONE TRANSPARENT-WRAPPER SET. Parentheses, `as`, `<T>x`, `!` and `satisfies` change no runtime
+// value, so every "is this expression THAT reference / THAT object?" question asks it through this one function.
+// There were seventeen hand-rolled loops answering it with FIVE different wrapper sets (parens only; +`as`;
+// +`!`; +`satisfies`; +`<T>`), and every gap was a spelling the engine went blind on: `(k.m as F).call(k)`,
+// `Reflect.apply(f as F, …)` and `(<any>globalThis).process.env.HOME` were ABSENT (EXECUTED, lane fixture
+// `fx/r780`), `(f as F).bind(t)` and `run((f))` were opaque. Two loops are deliberately NOT routed here:
+// `conversionSourceTracked` stops at `as` because an `as` IS the conversion it is asking about (R958 reads the
+// assertion separately), and `rootsAtStdStream` is a SUPPRESSOR (it frees `process.stdout.write` of a fabricated
+// Net) — widening a suppressor removes charges, which is not this fix's direction.
+// (Also R947: the invoked function's own ARGUMENTS on the reflective routes, or `null` when they are not
+// visible here — a spread, an `.apply` of a non-literal array. `null` is the safe answer: it captures nothing.)
 function unwrapArgExpr(e) {
   while (e && (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isTypeAssertionExpression?.(e)
                || ts.isNonNullExpression(e) || ts.isSatisfiesExpression?.(e))) e = e.expression;
@@ -3701,6 +3726,14 @@ function kappaOfRef(d2, ref) {
 function netEstablishingVerb(member, mod) {
   return NET_ESTABLISHING.has(member) || (/^(node:)?dgram$/.test(mod ?? "") && member === "send");
 }
+// ⟨R966⟩ see the (CLASSIFY) arm. A package whose `listen` is not a network accept: JSON-RPC connections start
+// reading a transport chosen (and, when it is a socket, charged) where the transport was built.
+const NON_NETWORK_LISTEN_PKGS = /^(vscode-jsonrpc|vscode-languageserver(-protocol)?|vscode-languageclient)(\/|$)/;
+function dependencyListenIsAccept(mod, decl) {
+  if (!mod || mod === "<local>" || mod === "<es-lib>" || mod.startsWith("/") || declIsNodeTypes(decl) || isOwnPackageDecl(decl))
+    return false;
+  return !NON_NETWORK_LISTEN_PKGS.test(mod);
+}
 function netAcceptingVerb(member, kMod) {
   return NET_ACCEPTING.has(member) || (/^(node:)?inspector(\/promises)?$/.test(kMod ?? "") && member === "open");
 }
@@ -4142,6 +4175,14 @@ const CHA_FANOUT_LIMIT = 12;
 // rather than inlined for the reason `CHA_FANOUT_LIMIT` was: two literals for one rule is how they drift.
 const TYPINGS_CENSUS_CAP = 128;
 const classOverrides = new Map();// base-method MemberDeclaration node -> overriding subclass member nodes (class-CHA)
+// ⟨SOUNDNESS R873⟩ An override that is not a class MEMBER: `this.m = () => …` assigned inside an instance body of
+// class `C` replaces `m` on every `C` instance. Registered in `classOverrides` like a member, keyed to the class
+// that performs the assignment here, because the node's `.parent` is an expression, not the class.
+const assignedOverrideClass = new Map(); // assigned override node -> the class-like node whose instances it overrides
+// The class an override node belongs to, for receiver-subtree scoping: a member's own class (declaration OR
+// expression — ⟨R956⟩), or the assigning class of a ⟨R873⟩ assigned override.
+const overrideOwner = (om) => assignedOverrideClass.get(om)
+  ?? ((om?.parent && (ts.isClassDeclaration(om.parent) || ts.isClassExpression(om.parent))) ? om.parent : null);
 const classDescendants = new Map();// base ClassDeclaration -> transitive LOCAL subclass ClassDeclarations (coercion-CHA)
 // R954 — the conformer registries (filled by the conversion pass after `walkStructural`).
 const classConformers = new Map();   // local ClassDeclaration -> conformer nodes (local class, literal, dep class)
@@ -4226,7 +4267,7 @@ function overrideClosure(seeds) {
   const out = [];
   for (const s of seeds) {
     for (const m of [s, ...overrideDescent(s)]) {
-      if (isOverridableMethod(m) && !out.includes(m)) out.push(m);
+      if ((isOverridableMethod(m) || assignedOverrideClass.has(m)) && !out.includes(m)) out.push(m);
       if (out.length > CHA_FANOUT_LIMIT + 1) return out;
     }
   }
@@ -4277,7 +4318,7 @@ function overrideDescent(decl) {
 function memberDispatchBodies(decl, rootClass) {
   const all = overrideDescent(decl);
   const scoped = (!rootClass || all.length === 0) ? all
-    : all.filter((om) => ts.isClassDeclaration(om.parent) && classInSubtree(om.parent, rootClass));
+    : all.filter((om) => classInSubtree(overrideOwner(om), rootClass));   // R873/R956: assigned and class-expression overrides
   // R954 — …and the CONFORMERS registered at the receiver's class (a value the checker showed
   // converted to it, or to a subclass of it), which run for this dispatch exactly as an override does. Scoped
   // the same way: registered at `Ct` and its ancestors, so a SUBTYPE receiver never sees them.
@@ -5153,7 +5194,9 @@ for (const { mod, name, ident } of exportAliasCandidates) {
   const baseClassOf = localBaseClassOf;
   for (const sf of sources) {
     (function scan(node) {
-      if (ts.isClassDeclaration(node)) {
+      // ⟨SOUNDNESS R956⟩ a CLASS EXPRESSION is a subclass like any other: `new (class extends BaseC { m(){…} })()`
+      // reaching a `BaseC`-typed `b.m()` was ABSENT at every gate (EXECUTED) because this index read declarations only.
+      if (ts.isClassDeclaration(node) || ts.isClassExpression(node)) {
         // Local-DESCENDANT index (the coercion-CHA universe, below). classOverrides is keyed by an
         // ANCESTOR MEMBER, so it only sees an override whose base ALSO declares the name. The coercion
         // protocol's members are the opposite shape: `class Sub extends Base { toString(){…} }` where
@@ -5190,6 +5233,7 @@ for (const { mod, name, ident } of exportAliasCandidates) {
               if (!classOverrides.has(ancestor)) classOverrides.set(ancestor, []);
               classOverrides.get(ancestor).push(m);
               foundLocal = true;
+              mintClassExprOverride(node, m, name);   // R956
               break;
             }
             base = baseClassOf(base);
@@ -5209,16 +5253,79 @@ for (const { mod, name, ident } of exportAliasCandidates) {
                 if (!foreignClassOverrides.has(fm)) foreignClassOverrides.set(fm, []);
                 const arr = foreignClassOverrides.get(fm);
                 if (!arr.includes(m)) arr.push(m);
+                mintClassExprOverride(node, m, name);   // R956
               }
             }
           }
         }
       }
+      if (ts.isClassDeclaration(node) || ts.isClassExpression(node)) registerAssignedOverrides(node);   // R873
       ts.forEachChild(node, scan);
     })(sf);
   }
 }
 
+// ⟨SOUNDNESS R956⟩ A class EXPRESSION's member has no unit (`localName` names class DECLARATION members only), so
+// its body folded into whatever evaluates the expression and no dispatch could land on it. An override needs an
+// addressable body: mint it the way a structural implementor's member is minted — keyed by `stableUnitTag`, with
+// ⟨R519⟩'s containment edge so the evaluating unit keeps every charge it had (an ADDITION, never a move). Only a
+// member that OVERRIDES is minted; a class expression's other members stay where they were.
+function mintClassExprOverride(cls, m, name) {
+  if (!ts.isClassExpression(cls) || nodeName.has(m)) return;
+  const bodied = (ts.isMethodDeclaration(m) && m.body)
+    || (ts.isPropertyDeclaration(m) && m.initializer && (ts.isArrowFunction(m.initializer) || ts.isFunctionExpression(m.initializer)));
+  if (!bodied) return;   // an unminted override reads unresolved at every reader — disclosed, never silent
+  const sf = m.getSourceFile();
+  mintPositionalStructuralUnit(moduleOf(sf), sf, m, name);
+  if (process.env.CANDOR_R873_REACH) console.error(`R873-REACH classexpr ${name}`);
+}
+// ⟨SOUNDNESS R873⟩ `this.m = <value>` inside an INSTANCE body of class `C` (its constructor, a method, an accessor,
+// an arrow property — not a nested `function`, which rebinds `this`) replaces `m` on that instance. Where `C` or a
+// local ancestor declares METHOD `m`, the assignment is an override of it: a `Base`-typed `b.m()` on a `C` runs the
+// assigned value. MEASURED: `class SubC extends BaseC { constructor(){ super(); this.m = () => write } }` with a
+// `BaseC`-typed `b.m()` was ABSENT at every gate (EXECUTED), the arrow charged to `SubC.constructor` only.
+//  · a function literal is minted (`mintCallTargetUnit`, containment edge kept: the assigning body still carries it)
+//    and registered — a resolution;
+//  · `this.m = this.m.bind(…)` / `this.m = this.m` re-installs the same method and registers nothing;
+//  · any other value (a wrapper's result, another method's `.bind`, a parameter) is registered UNRESOLVED, so every
+//    reader's `allResolved` gate discloses `dispatch:` rather than certifying the declared body alone.
+// A PROPERTY `m` is not this rule's: a written property slot is ⟨R103⟩'s, which already discloses.
+function registerAssignedOverrides(cls) {
+  const memberNamed = (c, name) => (c.members ?? []).find((x) => ts.isMethodDeclaration(x) && x.name?.getText?.() === name);
+  for (const mem of cls.members ?? []) {
+    if (ts.getCombinedModifierFlags(mem) & ts.ModifierFlags.Static) continue;
+    const body = (ts.isConstructorDeclaration(mem) || ts.isMethodDeclaration(mem) || ts.isGetAccessorDeclaration(mem)
+                  || ts.isSetAccessorDeclaration(mem)) ? mem.body
+      : (ts.isPropertyDeclaration(mem) && mem.initializer && ts.isArrowFunction(mem.initializer)) ? mem.initializer.body : null;
+    if (!body) continue;
+    (function walk(n) {
+      if (n !== body && (ts.isFunctionDeclaration(n) || ts.isFunctionExpression(n) || ts.isClassLike(n))) return;
+      if (ts.isBinaryExpression(n) && n.operatorToken.kind === ts.SyntaxKind.EqualsToken
+          && ts.isPropertyAccessExpression(n.left) && n.left.expression.kind === ts.SyntaxKind.ThisKeyword) {
+        const name = n.left.name.getText();
+        let anc = memberNamed(cls, name);
+        for (let b = localBaseClassOf(cls), g = 0; !anc && b && g++ < 64; b = localBaseClassOf(b)) anc = memberNamed(b, name);
+        if (anc) {
+          const rhs = unwrapArgExpr(n.right);
+          const bound = rhs && ts.isCallExpression(rhs) ? unwrapBind(rhs) : null;
+          const ref = bound ? bound.ref : rhs;
+          const same = ref && ts.isPropertyAccessExpression(ref) && ref.expression.kind === ts.SyntaxKind.ThisKeyword
+            && ref.name.getText() === name;
+          if (!same) {
+            const node = rhs && (ts.isArrowFunction(rhs) || ts.isFunctionExpression(rhs)) ? rhs : n;
+            if (node === rhs && !callTargetUnit(rhs)) mintCallTargetUnit(rhs);
+            if (!classOverrides.has(anc)) classOverrides.set(anc, []);
+            const arr = classOverrides.get(anc);
+            if (!arr.includes(node)) { arr.push(node); assignedOverrideClass.set(node, cls); }
+            if (process.env.CANDOR_R873_REACH) console.error(`R873-REACH assigned ${node === rhs ? "fn" : "opaque"} ${name}`);
+          }
+        }
+      }
+      ts.forEachChild(n, walk);
+    })(body);
+  }
+}
+
 // callback-flow bookkeeping (the Rust engine's callback_named move, ported): for every call that
 // edges to a LOCAL unit, record what each argument position received — a NAMED local unit (a
 // resolvable callback target), or an opaque value (an inline closure stays attributed to the
@@ -5233,7 +5340,8 @@ const callbackArgs = new Map();    // calleeName -> Map(argIndex -> Array<{calle
 // What each argument position of a call to LOCAL unit `targetName` received (callback flow, see `callbackArgs`).
 // Shared by the ordinary local arm and R955's callee-choice arm, so a callback passed through either is seen.
 function registerCallbackArgs(rec, targetName, args) {
-  args.forEach((a, i) => {
+  args.forEach((a0, i) => {
+    const a = unwrapArgExpr(a0);   // R780: `run((f))` / `run(f as F)` pass the same function as `run(f)`
     const slot = (callbackArgs.get(targetName) ?? callbackArgs.set(targetName, new Map()).get(targetName));
     const list = slot.get(i) ?? [];
     let target = null, opaque = false;
@@ -5372,8 +5480,7 @@ if (R103_HITS) process.on("exit", () => {
 });
 function openCallSlot(node) {
   if (!ts.isCallExpression(node)) return null;             // `new X()` constructs a class, not a slot
-  let callee = node.expression;
-  while (ts.isParenthesizedExpression(callee)) callee = callee.expression;
+  const callee = unwrapArgExpr(node.expression);   // R780
   // ELEMENT ACCESS IS THE SAME SLOT BY ANOTHER SPELLING, and it is here because the first draft of this
   // comment asserted the opposite — "an element access already reaches the dynamic-key/`callback:` arms"
   // — and that was FALSE when measured: `this["handler"]()` and `this[k]()` (k narrowed to the literal
@@ -5439,8 +5546,8 @@ function unwrapBind(node, depth = 0) {
   if (!node || depth > 8) return null;
   if (!ts.isCallExpression(node) || !ts.isPropertyAccessExpression(node.expression)) return null;
   if (node.expression.name.text !== "bind") return null;
-  let recv = node.expression.expression;
-  while (ts.isParenthesizedExpression(recv)) recv = recv.expression;
+  // R780: `(f as F).bind(t)` / `(f satisfies F).bind(t)` bind the same function — the ONE wrapper set, not parens only.
+  const recv = unwrapArgExpr(node.expression.expression);
   // chained `.bind().bind()` — recurse only when the receiver is ITSELF a `.bind` call, else it's an
   // arbitrary call (`getCallback().bind`) whose result we can't pin → unresolvable bind.
   if (ts.isCallExpression(recv)) {
@@ -6091,11 +6198,7 @@ function isConversionPosition(n) {
 }
 // R958 — the value under an assertion chain: parentheses, `as`, `<T>`, `!` and `satisfies` change no runtime value.
 let conversionViaAssertion = false;   // set while `convert` records a source read THROUGH an assertion
-function peelAssertions(e) {
-  while (e && (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isTypeAssertionExpression(e)
-               || ts.isNonNullExpression(e) || ts.isSatisfiesExpression?.(e))) e = e.expression;
-  return e;
-}
+const peelAssertions = (e) => unwrapArgExpr(e);   // R780: one wrapper set, not a third copy of it
 // R82 / PART 87: is the conversion's SOURCE type a fact about the VALUE, or only about a generic signature? A
 // call whose declared return type mentions one of its own type parameters (`wrap<T>(x: T): T`) hands back
 // whatever type the ARGUMENT had, and that signature proves assignability, never that the value IS the
@@ -6129,11 +6232,175 @@ function conversionSourceTracked(e, depth = 0) {
   }
   return true;
 }
+// ---- PARAMETER PROVENANCE: what every VISIBLE call site binds to a parameter (SOUNDNESS R934, R246) ----
+// A parameter's value is whatever its callers pass. For a function whose every reference is a CALL — not
+// handed out as a value, not `.call`/`.apply`/`.bind`-ed — the visible call sites ARE its bindings, and the
+// arguments there say what the parameter can hold. Two consumers ask this ONE index rather than each
+// walking calls: the environment-location model (a parameter every site hands `process.env`, R934) and
+// the `any`-receiver accessor arm (an `any`-typed parameter whose every site passes a typed value, R246).
+// `paramArgs` maps a parameter key (its symbol; a destructured parameter's NODE) to the argument expression
+// at each visible site (`null` where a spread hides the position; the default, or `null` for `undefined`,
+// where the site omits it). `paramFnEscaped(fnSym)` answers whether the function escapes, batched.
+const paramArgs = new Map();
+const paramOwnerOf = new Map();     // param key -> function symbol (for the escape question)
+const paramDeclOf = new Map();      // param key -> its ParameterDeclaration
+let paramFnEscaped;
+// A class some project class `extends` — its members are excluded (an override is invisible here).
+const extendedClassSyms = new Set();
+const classSymOf = (cls) => (cls?.name ? checker.getSymbolAtLocation(cls.name) : cls?.symbol) ?? null;
+{
+  const noteArg = (k, v) => { if (k) (paramArgs.get(k) ?? paramArgs.set(k, []).get(k)).push(v); };
+  const collectHeritage = (node) => {
+    if ((ts.isClassDeclaration(node) || ts.isClassExpression(node)) && node.heritageClauses) {
+      for (const h of node.heritageClauses) if (h.token === ts.SyntaxKind.ExtendsKeyword) {
+        for (const t of h.types) {
+          let s = checker.getSymbolAtLocation(t.expression);
+          if (s && (s.flags & ts.SymbolFlags.Alias)) { try { s = checker.getAliasedSymbol(s); } catch { /* keep */ } }
+          if (s) extendedClassSyms.add(s);
+        }
+      }
+    }
+    ts.forEachChild(node, collectHeritage);
+  };
+  for (const sf of sources) collectHeritage(sf);
+  const calls = [];
+  const collectCalls = (node) => {
+    if ((ts.isCallExpression(node) || ts.isNewExpression(node)) && (node.arguments?.length ?? 0) > 0) calls.push(node);
+    ts.forEachChild(node, collectCalls);
+  };
+  for (const sf of sources) collectCalls(sf);
+  // ⟨R934⟩ the functions whose parameters are eligible locations: a function declaration, a function or
+  // arrow bound to a `const`, a constructor, or a method of a class with no heritage that nothing extends.
+  // Every reference to it must be a CALL (or an export, a `typeof`, a member read that is not
+  // `.call`/`.apply`/`.bind`) — anything else hands it to code that binds its parameters unseen.
+  const fnEligible = new Map();     // declaration -> boolean
+  const fnSymOf = (decl) => {
+    if (ts.isFunctionDeclaration(decl) || ts.isMethodDeclaration(decl)) return decl.name ? checker.getSymbolAtLocation(decl.name) : null;
+    if ((ts.isArrowFunction(decl) || ts.isFunctionExpression(decl)) && ts.isVariableDeclaration(decl.parent)
+        && decl.parent.initializer === decl && ts.isIdentifier(decl.parent.name)
+        && (ts.getCombinedNodeFlags(decl.parent) & ts.NodeFlags.Const)) return checker.getSymbolAtLocation(decl.parent.name);
+    if (ts.isConstructorDeclaration(decl)) return classSymOf(decl.parent);
+    return null;
+  };
+  const declShapeOk = (decl) => {
+    if (!decl?.body || !projectFiles.has(path.resolve(decl.getSourceFile().fileName))) return false;
+    if (ts.isFunctionDeclaration(decl) || ts.isArrowFunction(decl) || ts.isFunctionExpression(decl)) return true;
+    if (ts.isConstructorDeclaration(decl)) return true;
+    if (ts.isMethodDeclaration(decl) && (ts.isClassDeclaration(decl.parent) || ts.isClassExpression(decl.parent)))
+      return !decl.parent.heritageClauses?.length && !extendedClassSyms.has(classSymOf(decl.parent));
+    return false;
+  };
+  const escapedFnSyms = new Set();
+  const escapeScannedSyms = new Set();
+  // One traversal per BATCH of function symbols not yet asked about; the answer is cached.
+  const scanEscapes = (cands0) => {
+    const cands = new Set([...cands0].filter((x) => x && !escapeScannedSyms.has(x)));
+    if (!cands.size) return;
+    for (const c of cands) escapeScannedSyms.add(c);
+    const names = new Set([...cands].map((s) => s.name));
+    const SAFE_MEMBER_BLOCK = new Set(["call", "apply", "bind"]);
+    const visit = (node) => {
+      if (ts.isIdentifier(node) && names.has(node.text)) {
+        let s = checker.getSymbolAtLocation(node);
+        if (s && (s.flags & ts.SymbolFlags.Alias)) { try { s = checker.getAliasedSymbol(s); } catch { /* keep */ } }
+        if (s && cands.has(s) && !escapedFnSyms.has(s)) {
+          // climb the transparent wrappers to the position the value lands in
+          let cur = node;
+          const p0 = node.parent;
+          let safe = false;
+          if (p0 && (ts.isPropertyAccessExpression(p0) || ts.isPropertyAssignment(p0) || ts.isMethodDeclaration(p0)
+              || ts.isFunctionDeclaration(p0) || ts.isClassDeclaration(p0) || ts.isClassExpression(p0)
+              || ts.isVariableDeclaration(p0) || ts.isPropertyDeclaration(p0)) && p0.name === node) {
+            // a declaration name, or `o.name` — a METHOD reference: safe only as the callee of a call
+            if (ts.isPropertyAccessExpression(p0)) {
+              const pp = p0.parent;
+              safe = !!pp && (ts.isCallExpression(pp) || ts.isNewExpression(pp)) && pp.expression === p0;
+            } else safe = true;
+          } else {
+            while (cur.parent && (ts.isParenthesizedExpression(cur.parent) || ts.isNonNullExpression(cur.parent))) cur = cur.parent;
+            const p = cur.parent;
+            if (!p) safe = true;
+            else if ((ts.isCallExpression(p) || ts.isNewExpression(p)) && p.expression === cur) safe = true;
+            else if (ts.isPropertyAccessExpression(p) && p.expression === cur) safe = !SAFE_MEMBER_BLOCK.has(p.name.text);
+            else if (ts.isExportSpecifier(p) || ts.isExportAssignment(p) || ts.isTypeQueryNode(p)
+                     || ts.isTypeOfExpression(p) || ts.isExpressionWithTypeArguments(p) || ts.isImportSpecifier(p)
+                     || ts.isImportClause(p) || ts.isNamespaceImport(p) || ts.isTypeReferenceNode(p)
+                     || ts.isQualifiedName(p)) safe = true;
+            else if (ts.isBinaryExpression(p) && p.right === cur && p.operatorToken.kind === ts.SyntaxKind.InstanceOfKeyword) safe = true;
+          }
+          if (!safe) escapedFnSyms.add(s);
+        }
+      }
+      ts.forEachChild(node, visit);
+    };
+    for (const sf of sources) visit(sf);
+  };
+  // Seed the parameter bindings: for every call whose resolved declaration is an eligible shape, bind each
+  // identifier parameter to its argument (or default / undefined). Only calls that hand over at least one
+  // argument are recorded here — a site that passes nothing binds `undefined` to every parameter, which
+  // is recorded by the per-declaration site count below.
+  const sitesByDecl = new Map();    // decl -> number of call sites seen
+  for (const call of calls) {
+    let decl;
+    try { decl = checker.getResolvedSignature(call)?.declaration; } catch { decl = null; }
+    if (!decl || !declShapeOk(decl)) continue;
+    if (!fnEligible.has(decl)) fnEligible.set(decl, !!fnSymOf(decl));
+    if (!fnEligible.get(decl)) continue;
+    sitesByDecl.set(decl, (sitesByDecl.get(decl) ?? 0) + 1);
+    const fsym = fnSymOf(decl);
+    let pos = 0, sawSpread = false;
+    const args = call.arguments ?? [];
+    const argAt = [];
+    for (const a of args) { if (ts.isSpreadElement(a)) { sawSpread = true; break; } argAt[pos++] = a; }
+    decl.parameters.forEach((p, i) => {
+      if (p.dotDotDotToken) return;
+      // a DESTRUCTURED parameter reads its keys when the frame is entered — keyed by the parameter node
+      const ps = ts.isIdentifier(p.name) ? checker.getSymbolAtLocation(p.name)
+        : ts.isObjectBindingPattern(p.name) ? p : null;
+      if (!ps) return;
+      paramOwnerOf.set(ps, fsym);
+      if (i < argAt.length && argAt[i]) noteArg(ps, argAt[i]);
+      else if (sawSpread) noteArg(ps, null);
+      else noteArg(ps, p.initializer ?? null);
+    });
+  }
+  // A call site that resolves to the declaration with NO arguments was not collected above; it binds
+  // every parameter to its default or `undefined`. Count them so a zero-argument site is not lost.
+  {
+    const visitZero = (node) => {
+      if ((ts.isCallExpression(node) || ts.isNewExpression(node)) && (node.arguments?.length ?? 0) === 0) {
+        let decl;
+        try { decl = checker.getResolvedSignature(node)?.declaration; } catch { decl = null; }
+        if (decl && sitesByDecl.has(decl)) for (const p of decl.parameters)
+          if (!p.dotDotDotToken && ts.isIdentifier(p.name)) noteArg(checker.getSymbolAtLocation(p.name), p.initializer ?? null);
+          else if (!p.dotDotDotToken && ts.isObjectBindingPattern(p.name)) noteArg(p, p.initializer ?? null);
+      }
+      ts.forEachChild(node, visitZero);
+    };
+    if (sitesByDecl.size) for (const sf of sources) visitZero(sf);
+  }
+  for (const k of paramArgs.keys()) { const d = ts.isParameter(k) ? k : k.valueDeclaration; if (d && ts.isParameter(d)) paramDeclOf.set(k, d); }
+  paramFnEscaped = (fsym) => { if (!fsym) return true; scanEscapes([fsym]); return escapedFnSyms.has(fsym); };
+  // Batch form: answer for many at once with ONE traversal.
+  paramFnEscaped.batch = (fsyms) => scanEscapes(fsyms);
+}
+
 const CONFORMER_REACH = process.env.CANDOR_CONFORMER_REACH ? (k, n) => console.error(`CONFORMER-REACH ${k} ${n}`) : null;
 for (const sf of sources) {
   const convert = (src, tt, at, kind) => {
     if (!tt || !conversionSourceTracked(src)) return;
     let st; try { st = checker.getTypeAtLocation(src); } catch { st = undefined; }
+    // ⟨SOUNDNESS R958, the `any`-PARAMETER half⟩ a source typed `any`/`unknown` names no conformer, so a value
+    // laundered through an `any` parameter reached a closed dispatch silently: `launder(x: any) { qDisp(x) }`
+    // called as `launder(new LocalW())` ran LocalW's `m` (EXECUTED) with `deny Fs` exit 0 on the caller. The
+    // parameter's visible arguments say what it holds — the SAME provenance index R246's accessor arm asks
+    // (`receiverValueTypes`) — so each argument type is recorded as a conversion source. Upcasts only, as
+    // ever (`recordConversion` keeps a target the type is assignable to). A dependency-sourced value and a
+    // lying downcast are untouched: they are R958's by-design residue.
+    if (anyishType(st)) for (const vt of receiverValueTypes(src)) {
+      try { recordConversion(vt, tt); } catch { /* best effort, as the main record below */ }
+      CONFORMER_REACH?.("any-param", `${path.relative(rootDir, sf.fileName)}:${at.getStart()}`);
+    }
     conversionViaAssertion = kind !== "conversion";
     try {
       if (!CONFORMER_REACH) { recordConversion(st, tt); return; }
@@ -6308,6 +6575,47 @@ function keyLiteralNames(t, depth = 0, seen = new Set()) {
   if (c && c !== t) return keyLiteralNames(c, depth + 1, seen);
   return null;                                    // `string`, `symbol`, `keyof T` for generic T, …
 }
+// SOUNDNESS R246 — THE RECEIVER'S VALUE, WHEN ITS STATIC TYPE SAYS NOTHING. Accessor lookup asks the
+// receiver's TYPE which properties it declares, and `any` declares none: `(s as any)[k] = v`,
+// `(s as any).token = v` and `function w(o: any) { o.token = v }` called as `w(new S())` all invoked S's
+// setter (EXECUTED, 6 of 6 writes observed) and were ABSENT with `deny Fs <fn>` exit 0 — the caller too.
+// The value is not unknowable; only its static type was thrown away. Two places say what it really is,
+// and both are facts rather than guesses:
+//   - an ASSERTION changes no runtime value (R958's look-through, the same `peelAssertions`): the operand
+//     under `as any` / `as unknown as T` / `<any>x` has the type the value really carries;
+//   - an `any`/`unknown` PARAMETER holds what its visible call sites pass (the shared PARAMETER PROVENANCE
+//     index, R934) — only for a function whose every reference is a call; an escaped one is unanswered.
+// Returns the EXTRA types beyond the checker's own (empty when the checker's type is informative and no
+// assertion intervenes), so a typed receiver's lookup is byte-identical to before. This RESOLVES — it adds
+// the accessor edges the value's type declares — and never hedges; a receiver neither rule answers is
+// exactly as it was (the residual is stated in SOUNDNESS R246, not hidden here).
+function anyishType(t) { return !!t && !!(t.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)); }   // hoisted: the conversion walk asks it first
+function receiverValueTypes(expr, depth = 0, seen = new Set()) {
+  if (!expr || depth > 6) return [];
+  let t; try { t = checker.getTypeAtLocation(expr); } catch { t = null; }
+  const inner = peelAssertions(expr);
+  if (inner && inner !== expr) {
+    const below = receiverValueTypes(inner, depth + 1, seen);
+    let ti; try { ti = checker.getTypeAtLocation(inner); } catch { ti = null; }
+    return [...(ti && !anyishType(ti) ? [ti] : []), ...below];
+  }
+  if (!anyishType(t) || !ts.isIdentifier(expr)) return [];
+  const sym = checker.getSymbolAtLocation(expr);
+  const d = sym?.valueDeclaration;
+  if (!sym || !d || !ts.isParameter(d) || seen.has(sym)) return [];
+  seen.add(sym);
+  const args = paramArgs.get(sym);
+  if (!args || paramFnEscaped(paramOwnerOf.get(sym))) return [];
+  const out = [];
+  for (const a of args) {
+    if (!a) continue;
+    let ta; try { ta = checker.getTypeAtLocation(a); } catch { ta = null; }
+    if (ta && !anyishType(ta)) out.push(ta);
+    out.push(...receiverValueTypes(a, depth + 1, seen));
+  }
+  return out;
+}
+const dedupeHits = (hits) => { const seen = new Set(); return hits.filter((h) => !seen.has(h.decl) && seen.add(h.decl)); };
 function accessorsAt(propNode, kind /* "get" | "set" */) {
   if (ts.isElementAccessExpression(propNode)) {
     // `c["prop"]` carries no `.name`; resolve the key to the property NAMES it can hold and look each
@@ -6324,9 +6632,19 @@ function accessorsAt(propNode, kind /* "get" | "set" */) {
     // property is common to all of them).
     for (const t of texts) for (const sym of propertySymbolsAcrossArms(recvType, t))
       out.push(...accessorsFromSym(sym, kind));
-    return out;
-  }
-  return accessorsFromSym(checker.getSymbolAtLocation(propNode.name ?? propNode), kind);
+    // R246 — and every type the receiver's VALUE can carry under an assertion or an `any` parameter.
+    for (const vt of receiverValueTypes(propNode.expression))
+      for (const t of texts) for (const sym of propertySymbolsAcrossArms(vt, t)) out.push(...accessorsFromSym(sym, kind));
+    return dedupeHits(out);
+  }
+  const direct = accessorsFromSym(checker.getSymbolAtLocation(propNode.name ?? propNode), kind);
+  if (direct.length || !ts.isPropertyAccessExpression(propNode)) return direct;
+  // R246 — `(s as any).token = v` / `o.token = v` with `o: any`: the checker resolves no symbol at all.
+  const out = [];
+  const name = propNode.name.text;
+  for (const vt of receiverValueTypes(propNode.expression))
+    for (const sym of propertySymbolsAcrossArms(vt, name)) out.push(...accessorsFromSym(sym, kind));
+  return dedupeHits(out);
 }
 // A `Object.defineProperty` descriptor accessor for the forcing site `recv.key` (read → get, assign →
 // set), consulted ONLY when the type-level `accessorsAt` came up empty (the checker types target.key as
@@ -6406,8 +6724,7 @@ function accessorOverrideFanOut(rec, decl, recvExpr) {
   // SOUNDNESS-PRESERVING FALLBACK, the method path's verbatim: a receiver we cannot pin to a LOCAL
   // class (a union, an interface, `any`, an external type) keeps the FULL override set.
   const rootClass = localReceiverClass(recvExpr);
-  const direct = rootClass ? allOverrides.filter((om) =>
-    ts.isClassDeclaration(om.parent) && classInSubtree(om.parent, rootClass)) : allOverrides;
+  const direct = rootClass ? allOverrides.filter((om) => classInSubtree(overrideOwner(om), rootClass)) : allOverrides;
   const overrides = memberDispatchBodies(decl, rootClass);
   if (direct.length <= CHA_FANOUT_LIMIT) probeR871("accessor", decl, overrides.length - direct.length);
   if (overrides.length === 0) return;
@@ -6658,8 +6975,10 @@ function classBodiedGetter(sym) {
 }
 function enumerateGetters(owner, type, srcExpr) {
   if (!owner) return;
-  if (type && type.getProperties) {
-    for (const p of propertiesAcrossArms(type)) {   // R259 — the disjunction, not the intersection
+  // R246 — the copied VALUE's types too, when its static type is `any`/`unknown` or asserted away.
+  const vprops = srcExpr ? receiverValueTypes(srcExpr).flatMap((vt) => propertiesAcrossArms(vt)) : [];
+  if ((type && type.getProperties) || vprops.length) {
+    for (const p of [...(type?.getProperties ? propertiesAcrossArms(type) : []), ...vprops]) {   // R259 — the disjunction, not the intersection
       if (classBodiedGetter(p)) continue; // prototype + non-enumerable → not copied by a spread
       for (const hit of accessorsFromSym(p, "get")) recordAccessorHit(owner, hit, p.getName(), srcExpr);
     }
@@ -6670,9 +6989,7 @@ function enumerateGetters(owner, type, srcExpr) {
   //
   // R120 — THREE UNWRAPS AND ONE ALIAS HOP, because the question is which OBJECT is being copied and
   // none of these four wrappers changes that answer. Each is a spelling measured absent at e5c60bc.
-  let se = srcExpr;
-  while (se && (ts.isParenthesizedExpression(se) || ts.isAsExpression(se)
-                || ts.isSatisfiesExpression(se) || ts.isNonNullExpression(se))) se = se.expression;
+  const se = unwrapArgExpr(srcExpr);   // R780
   if (!se || !ts.isIdentifier(se)) return;                                  // parameter / call return / member
   let sym0 = checker.getSymbolAtLocation(se);
   if (!sym0) return;
@@ -6682,9 +6999,7 @@ function enumerateGetters(owner, type, srcExpr) {
   if (sym0.flags & ts.SymbolFlags.Alias) { try { sym0 = checker.getAliasedSymbol(sym0) ?? sym0; } catch { /* unresolved import */ } }
   for (const d of sym0.declarations ?? []) {
     if (!ts.isVariableDeclaration(d) || !d.initializer) continue;
-    let init = d.initializer;
-    while (ts.isParenthesizedExpression(init) || ts.isAsExpression(init)
-           || ts.isSatisfiesExpression(init) || ts.isNonNullExpression(init)) init = init.expression;
+    const init = unwrapArgExpr(d.initializer);   // R780
     if (!ts.isObjectLiteralExpression(init)) continue;
     for (const pr of init.properties) {
       if (!ts.isGetAccessorDeclaration(pr)) continue;
@@ -6729,8 +7044,7 @@ function enumerateGetters(owner, type, srcExpr) {
 const provenCopiedKeys = (sources) => {
   const keys = new Set();
   for (let s of sources) {
-    while (s && (ts.isParenthesizedExpression(s) || ts.isAsExpression(s)
-                 || ts.isSatisfiesExpression(s) || ts.isNonNullExpression(s))) s = s.expression;
+    s = unwrapArgExpr(s);   // R780
     if (!s || !ts.isObjectLiteralExpression(s)) return null;   // parameter / call return / variable
     for (const pr of s.properties) {
       if (ts.isSpreadAssignment(pr)) return null;              // `{...o}` copies an unknown key set
@@ -6808,12 +7122,15 @@ function enumerateTargetAccessors(owner, targetExpr, keys, kind /* "get" | "set"
   if (!owner || !targetExpr) return;
   const t = checker.getTypeAtLocation(targetExpr);
   if (!t || !t.getProperties) return;
+  // R246 — every property the target's VALUE can carry: its static type's, and (under an assertion or an
+  // `any`/`unknown` parameter) the types the value really has. One list for both branches below.
+  const tprops = [...propertiesAcrossArms(t), ...receiverValueTypes(targetExpr).flatMap((vt) => propertiesAcrossArms(vt))];
   // `!keys`, not `keys === null`: a Set is always truthy, so this is exactly "the key set is not
   // provable" — and it keeps the tolerance the old `keys && !keys.has(…)` line had for a caller that
   // passes nothing. `keys.has` below is now unguarded, so a future third call site omitting the
   // argument would throw rather than take this branch.
   if (!keys) {
-    for (const p of propertiesAcrossArms(t)) {      // R259 — the disjunction, not the intersection
+    for (const p of tprops) {      // R259 — the disjunction, not the intersection
       if (!accessorsFromSym(p, kind).length) continue;
       if (!keyCouldNameAccessor(p, unprovable.keyType ?? null)) continue;
       const rec = fns.get(owner);
@@ -6823,7 +7140,9 @@ function enumerateTargetAccessors(owner, targetExpr, keys, kind /* "get" | "set"
     }
     return;     // a target declaring no reachable accessor discloses nothing (0 real invocations)
   }
-  for (const p of propertiesAcrossArms(t)) {        // R259 — the disjunction, not the intersection
+  const seenP = new Set();
+  for (const p of tprops) {        // R259 — the disjunction, not the intersection
+    if (seenP.has(p)) continue; seenP.add(p);
     // NO `classBodiedGetter`-style exclusion here, and the asymmetry is the point rather than an
     // oversight: R115 excluded a class-bodied GETTER because a prototype accessor is non-enumerable and
     // therefore never COPIED. A prototype SETTER is the opposite — it is found by the assignment's
@@ -6927,6 +7246,29 @@ function decoratorArgUnit(callNode) {
   }
   return qual;
 }
+// ⟨SOUNDNESS R815⟩ The `extends <expr>` unit of a class that has a constructor unit. The expression runs ONCE, at
+// class definition (so the evaluating unit edges here, pass 2a′) — and every construction then runs the
+// constructor of the class it produced through `super`, implicit or explicit, whose body this scan sees only as
+// the expression's own callees (`mixin()`'s class expression is attributed to `mixin`; a dependency's
+// `PartialType(X)` is the dependency's ledger/`invisible`). So the constructor edges here too. Attributing the
+// expression to the constructor ALONE (the old climb) left the definer silent; attributing it to the definer
+// ALONE drops the super reach — MEASURED: `new D3()` over `class D3 extends Partial(Plain)` from a dependency
+// that writes in its generated constructor (EXECUTED) went from `invisible:['mixdep']` to ABSENT, and nest's six
+// `extends PartialType(…)` DTO constructors lost their `@nestjs/mapped-types` disclosure the same way.
+function heritageUnit(cls, ctorQual) {
+  const qual = ctorQual.replace(/\.constructor$/, ".<heritage>");
+  if (!fns.has(qual)) {
+    const sf = cls.getSourceFile();
+    const h = (cls.heritageClauses ?? []).find((c) => c.token === ts.SyntaxKind.ExtendsKeyword) ?? cls;
+    fns.set(qual, { local: `${fns.get(ctorQual)?.local?.replace(/\.constructor$/, "") ?? "<anonymous>"}.<heritage>`,
+                    direct: new Set(), fsKinds: new Set(), edges: new Set(), hosts: new Set(), tables: new Set(),
+                    cmds: new Set(), paths: new Set(), blind: new Set(), incomplete: new Set(), dispatch: new Set(), why: new Set(),
+                    entry: false, unitKind: "initializer",
+                    loc: `${path.relative(rootDir, sf.fileName)}:${sf.getLineAndCharacterOfPosition(h.getStart()).line + 1}:1`,
+                    endLine: sf.getLineAndCharacterOfPosition(h.getEnd()).line + 1 });
+  }
+  return qual;
+}
 // nearest enclosing analyzed function (closures attribute to it — SEMANTICS §2)
 function enclosing(node) {
   let prev = null;
@@ -6966,6 +7308,36 @@ function enclosing(node) {
     if (ts.isDecorator(p)) return null;
     const n = nodeName.get(p);
     if (n) return n;
+    // ⟨SOUNDNESS R815⟩ THE REST OF THE CLASS-DEFINITION-TIME FAMILY R782/R785 started. Three more pieces of a class
+    // run when the class is EVALUATED, not when it is constructed or a member is called — and the climb
+    // attributed each to a unit that never runs it, leaving the evaluating unit silent (EXECUTED, lane fixture
+    // `fx/r815`: the enclosing function ABSENT, `deny Fs` exit 0; the effect fabricated onto `C.constructor` or the
+    // method):
+    //  · a `static x = …` INITIALISER runs at definition, exactly like a `static {}` block, so it lands on the
+    //    same `<static-init>` unit (which pass 2a′ wires from the evaluating unit). Climbing on reached the
+    //    ClassDeclaration, i.e. `C.constructor` — every `new C()` charged, the definer silent. An instance field
+    //    is NOT this (it runs per construction; the constructor is right), and a property that IS a unit
+    //    (`static h = () => …` minted as `C.h`) answered above before reaching here.
+    //  · an `extends <expr>` HERITAGE expression and
+    //  · a COMPUTED member name `[k()]` (class OR object-literal member)
+    //    are evaluated in the scope AROUND the class / literal, by whatever evaluates it — so the climb resumes
+    //    OUTSIDE the container. (The computed name hung under the member's own node, so the method `C3.[w("k")]`
+    //    was charged for its own name.)
+    if (prev && ts.isPropertyDeclaration(p) && p.initializer === prev
+        && (ts.getCombinedModifierFlags(p) & ts.ModifierFlags.Static)
+        && p.parent && (ts.isClassDeclaration(p.parent) || ts.isClassExpression(p.parent)))
+      { R815_REACH?.("static"); return staticBlockUnit(p); }
+    if (ts.isHeritageClause(p) && p.token === ts.SyntaxKind.ExtendsKeyword && p.parent
+        && (ts.isClassDeclaration(p.parent) || ts.isClassExpression(p.parent))) {
+      const ctor = nodeName.get(p.parent);
+      if (ctor) { R815_REACH?.("heritage"); return heritageUnit(p.parent, ctor); }
+      // a class with no constructor unit: the climb already resumes outside it, at the evaluating unit
+    }
+    if (ts.isComputedPropertyName(p) && p.parent?.parent) {
+      const container = p.parent.parent;
+      if (ts.isClassDeclaration(container) || ts.isClassExpression(container)) { R815_REACH?.("ckey"); return enclosing(container.parent); }
+      if (ts.isObjectLiteralExpression(container)) { R815_REACH?.("okey"); return enclosing(container); }
+    }
     // Reached the SourceFile with no named unit: a TOP-LEVEL executable statement. Attribute to the
     // file's synthesized `<module>` initializer unit (minted lazily here) rather than dropping it.
     if (ts.isSourceFile(p)) return moduleUnit(p);
@@ -7204,8 +7576,7 @@ function recordDispatch(rec, decl, pkg) {
 function packageProducedReceiver(recvExpr, pkg) {
   if (!recvExpr || !pkg) return null;
   const unwrap = (x) => {
-    while (x && (ts.isAwaitExpression(x) || ts.isParenthesizedExpression(x) || ts.isNonNullExpression(x)
-                 || ts.isAsExpression(x))) x = x.expression;
+    for (x = unwrapArgExpr(x); x && ts.isAwaitExpression(x);) x = unwrapArgExpr(x.expression);   // R780: + `await`
     return x;
   };
   let e = unwrap(recvExpr);
@@ -8357,6 +8728,89 @@ const HOF_INVOKERS = new Set([
   "then", "catch", "finally", "nextTick",
 ]);
 
+// ⟨SOUNDNESS R803⟩ THE LIST ABOVE IS NO LONGER THE GATE — IT IS THE POSITION MAP FOR THE CALLEES IT NAMES.
+//
+// `HOF_INVOKERS` decided, by callee NAME, whether a function reference handed to a non-local callee could be
+// invoked by it, and every callee it did not name dropped the reference: no edge, no `Unknown`, no row.
+// Measured on `fx/r803`, every cell EXECUTED by node to run its handler: `e.on`, `e.once`, `e.addListener`,
+// `process.once`, `http.createServer(h)`, `Array.from(xs, f)`, `new Promise(exec)`, lodash `_.each`/`_.times`,
+// a dependency `queue.add(f)` and `EventTarget.addEventListener` were all ABSENT, `deny Fs` exit 0 on each
+// caller. The comment that guarded it called the omission "an honest under-report (sound)" — true about
+// fabrication, false about silence; it also falsified `KAPPA_PURE`'s premise that lodash/rxjs side effects
+// "live in visible user callbacks", because this list is what decides whether those callbacks are visible.
+//
+// WHY NOT "ASK THE SIGNATURE" ALONE — measured by the ts vein analysis on the 28-entry roster: of 253 sites
+// where a callee's parameter is callable-typed and the argument is a local function reference, about half are
+// REMOVALS or STORES (`off`, `removeListener`, `removeEventListener`, `Map.set`, `Object.assign`), and 15 of the
+// 25 effect-bearing ones never invoke. A signature rule alone fabricates on those.
+//
+// So the rule is: an UNLISTED non-local callee invokes every argument position its resolved signature
+// POSITIVELY declares callable (`calleeParamIsCallable === true`), unless the callee is on the DENYLIST below.
+// The failure directions, stated because they are the reason for the shape (`candor-denylist-over-allowlist`):
+//   · a non-invoker MISSING from the denylist → an over-charge (its reference's effects charged to the
+//     caller). Visible, and the corpus A/B is the instrument that catches it.
+//   · an invoker the old list missed → now charged. Nothing an invoker can do lands it back in silence
+//     except being DENYLISTED, and the denylist only names declarations whose semantics are a removal or a
+//     store — the removal NAMES on any receiver, and reviewed ES-lib / node-core members by owner.
+//   · a callee whose parameter is `any`/`unknown`/unresolvable (`null`) is NOT admitted here. That is a
+//     residual, named rather than hidden: `console.log(f)`/`assert.equal(f, …)` take `any` and never invoke,
+//     and admitting `null` charges them — priced on the roster before deciding (see the commit message).
+// The listed names keep their own position map (`hofInvokesArg`/`hofArgIsNeverCallback`) unchanged.
+//
+// Removal by NAME on ANY receiver: a method named `removeListener` that invokes the listener it is removing
+// would be perverse, and these four are the registration API's inverse everywhere they appear (node events,
+// DOM `EventTarget`, eventemitter3, socket.io's emitter). Asked of the callee's spelling AND of the declaration
+// it resolved to, because `const processOff = process.off.bind(process); processOff(sig, h)` (vitest) and
+// got's `removeSessionSocketListener` are the same removal under a local name.
+//
+// Everything else is asked of the RESOLVED REVIEWED-LIBRARY declaration (ES lib, @types/node), never of a
+// name, so a DEPENDENCY's `add(fn)` (p-queue — a real roster silence) is not excused by sharing a name with
+// `Set.add`. The rule there is the GENERIC VALUE SLOT: a parameter whose declared type is a bare type
+// parameter (alone or beside non-callable members such as `PromiseLike<T>`) whose constraint has no call
+// signature. Such a callee is handed a value it knows nothing about and cannot call without a cast — `Map.set`'s
+// `V`, `Set.add`/`includes`/`indexOf`'s `T`, `Object.assign`/`defineProperties`/`freeze`'s `T`, a promise
+// executor's `resolve(value: T | PromiseLike<T>)`, `new Proxy(target: T)`, `new WeakRef(target: T)`. The
+// argument reads callable only because the CALL instantiated `T` with a function type. Restricted to the
+// reviewed library declarations on purpose: a dependency CAN cast and call (`(x as any)()`), so there the
+// generic slot is an assumption, and an assumption is not denylist evidence.
+// ⟨R241⟩ lib.dom interfaces whose every member touches a persistent browser store (see the es-lib call arm).
+const BROWSER_STORE_IFACES = new Set(["IDBFactory", "IDBDatabase", "IDBObjectStore", "IDBIndex", "IDBCursor",
+  "IDBCursorWithValue", "IDBTransaction", "CacheStorage", "Cache", "StorageManager", "FileSystemHandle",
+  "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemWritableFileStream", "FileSystemSyncAccessHandle", "CookieStore"]);
+const HOF_REMOVAL_NAMES = new Set(["off", "removeListener", "removeEventListener", "removeAllListeners"]);
+// NOT non-invokers — they invoke their first argument — but the reflective arm below answers them with the
+// invoked function's OWN arguments (R947's locator), and this arm, which cannot see those, would add a second
+// locator-less charge beside it (measured: `Reflect.apply(fs.readFileSync, undefined, ["/tmp/ok/b"])` lost its
+// `allow Fs /tmp/ok` certification). Owned elsewhere, so excluded here.
+const HOF_OWNED_ELSEWHERE = new Set(["Reflect.apply", "Reflect.construct"]);
+const hofOwnerMember = (decl) => {
+  if (!decl) return null;
+  const member = ts.isConstructSignatureDeclaration(decl) ? "new" : decl.name?.getText?.();
+  const holder = decl.parent && ts.isModuleBlock(decl.parent) ? decl.parent.parent : decl.parent;  // `namespace Reflect {…}`
+  const owner = holder?.name?.getText?.() ?? null;
+  return owner && member ? `${owner}.${member}` : null;
+};
+const declIsReviewedLib = (decl) => !!decl && (declModule(decl) === "<es-lib>" || declIsNodeTypes(decl));
+const hofCalleeNeverInvokes = (decl, name) => {
+  if ((name && HOF_REMOVAL_NAMES.has(name)) || HOF_REMOVAL_NAMES.has(decl?.name?.getText?.() ?? "")) return true;
+  return declIsReviewedLib(decl) && HOF_OWNED_ELSEWHERE.has(hofOwnerMember(decl) ?? "");
+};
+const calleeParamIsGenericSlot = (node, i) => {
+  const sd = checker.getResolvedSignature?.(node)?.declaration;
+  const ps = sd?.parameters;
+  if (!ps?.length || i >= ps.length || !ps[i].type || ps[i].dotDotDotToken) return false;
+  const t = checker.getTypeFromTypeNode(ps[i].type);
+  const isFreeTP = (u) => !!(u.flags & ts.TypeFlags.TypeParameter)
+    && !(checker.getBaseConstraintOfType(u)?.getCallSignatures?.().length > 0);
+  const parts = t.types ?? [t];
+  return parts.some(isFreeTP) && !parts.some((u) => !isFreeTP(u) && u.getCallSignatures?.().length > 0);
+};
+// ⟨R1031⟩ reviewed-library callees whose object-literal argument's callable members are INSTALLED, not
+// invoked: a property descriptor (`get`/`set`) or a descriptor map. Asked of the resolved declaration.
+const OBJ_ARG_INSTALLS = new Set(["ObjectConstructor.defineProperty", "ObjectConstructor.defineProperties",
+                                  "ObjectConstructor.create", "Reflect.defineProperty"]);
+const HOF_REACH = process.env.CANDOR_HOF_REACH ? (k, n) => console.error(`HOF-REACH ${k} ${n}`) : null;
+
 // ---- process.env recognition: the direct dot access (`process.env.KEY`) is the JVM System.getenv twin,
 // but the same environment READ is spelled several other ways that all read silent-pure without help:
 // bracket access (`process.env[k]`), a local const-alias (`const env = process.env; env.KEY`),
@@ -8387,14 +8841,25 @@ const declImportsNodeProcess = (decl) => {
 // downstream consult — the fix in one place, per brief §F1 item 3 ("make the two paths share one
 // authority", not patch the losing copy). Populated by the pre-pass immediately below.
 const processAliasSymbols = new Set();
-const identIsGlobalProcess = (id) => {
+const identIsGlobalProcess = (id0) => {
+  // ⟨SOUNDNESS R936⟩ through the ONE transparent-wrapper set (R780): `(process as any).argv`, `(<any>process).argv`
+  // and even `(process).argv` were ABSENT because the argv arm handed this the wrapped node and this matched an
+  // Identifier only — the env arm unwrapped first and the argv arm did not. Unwrapping HERE gives every caller
+  // the same answer instead of each remembering to.
+  const id = unwrapArgExpr(id0);
   if (!id) return false;
+  // ⟨SOUNDNESS R936⟩ `require("process")` / `require("node:process")` IS the process object — the module-binding
+  // spelling of the same global (CJS, `--allow-js` trees, and `createRequire`). `require("process").env.HOME` read
+  // nothing (EXECUTED). Keyed on a callee spelled `require` and the literal specifier; a project function that
+  // happens to be called `require` and returns something else is the only false match, and it over-charges.
+  if (ts.isCallExpression(id) && ts.isIdentifier(id.expression) && id.expression.text === "require"
+      && id.arguments.length === 1 && ts.isStringLiteralLike(id.arguments[0])
+      && (id.arguments[0].text === "process" || id.arguments[0].text === "node:process")) return true;
   // `globalThis.process` / `global.process` — the SAME process object reached off the global (isomorphic code:
   // `globalThis.process?.env`, often `(globalThis as any).process.env`). Unwrap parens/`as` casts around the
   // root; the `globalThis`/`global` root must be the ambient global, not a project shadow.
   if (ts.isPropertyAccessExpression(id) && id.name.text === "process") {
-    let root = id.expression;
-    while (ts.isParenthesizedExpression(root) || ts.isAsExpression(root) || ts.isNonNullExpression(root)) root = root.expression;
+    const root = unwrapArgExpr(id.expression);   // R780: `(<any>globalThis).process` is the same object
     if (ts.isIdentifier(root) && (root.text === "globalThis" || root.text === "global")) {
       const gd = checker.getSymbolAtLocation(root)?.declarations ?? [];
       return !gd.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)));
@@ -8423,9 +8888,7 @@ const identIsGlobalProcess = (id) => {
 {
   const isGlobalProcessInitializer = (expr) => {
     if (!expr) return false;
-    let e = expr;
-    while (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isNonNullExpression(e)) e = e.expression;
-    return identIsGlobalProcess(e); // handles `globalThis.process` / `global.process` / bare ambient `process`
+    return identIsGlobalProcess(unwrapArgExpr(expr));   // R780 // handles `globalThis.process` / `global.process` / bare ambient `process`
   };
   const collectProcessAliases = (node) => {
     if (ts.isVariableDeclaration(node) && node.name && ts.isIdentifier(node.name) && node.initializer) {
@@ -8434,8 +8897,7 @@ const identIsGlobalProcess = (id) => {
         if (sym) processAliasSymbols.add(sym);
       }
     } else if (ts.isVariableDeclaration(node) && node.name && ts.isObjectBindingPattern(node.name) && node.initializer) {
-      let root = node.initializer;
-      while (ts.isParenthesizedExpression(root) || ts.isAsExpression(root) || ts.isNonNullExpression(root)) root = root.expression;
+      const root = unwrapArgExpr(node.initializer);   // R780
       if (ts.isIdentifier(root) && (root.text === "globalThis" || root.text === "global")) {
         const gd = checker.getSymbolAtLocation(root)?.declarations ?? [];
         if (!gd.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)))) {
@@ -8476,11 +8938,7 @@ const identIsGlobalProcess = (id) => {
 // EXPRESSION — that is the model this adopts, with identity widened from a node to a value.
 //
 // TRANSPARENT: the wrappers that change only the static type, never the value.
-const unwrapEnvTransparent = (e) => {
-  while (e && (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isTypeAssertionExpression(e)
-               || ts.isNonNullExpression(e) || ts.isSatisfiesExpression(e))) e = e.expression;
-  return e;
-};
+const unwrapEnvTransparent = (e) => unwrapArgExpr(e);   // R780: one wrapper set, not a fourth copy of it
 // `process.env` / `process["env"]` / `globalThis.process?.env` / `(process as any).env` — the global
 // process object's `env` member. The `process` side keeps `identIsGlobalProcess`'s shadow guard, so a
 // project-local `process` (a parameter, a module `const`) matches nothing.
@@ -8536,16 +8994,86 @@ const envValueLeaves = (expr, out = []) => {
 //     READ was not even `Unknown` — it was absent).
 // A binding is a `VariableDeclaration` with an identifier name (no initializer = a binding with no env
 // leaf), a plain or logical (`??=`/`||=`/`&&=`) assignment to an identifier, or `{ env } = process` /
-// `{ env: e } = process` (wrappers unwrapped). A PARAMETER is never an alias — callers bind it — so
-// `e = process.env` as a default is charged where the default is evaluated (see the Env arm).
+// `{ env: e } = process` (wrappers unwrapped).
+//
+// ⟨R934/R935⟩ THE SAME QUESTION OVER EVERY STORAGE LOCATION WHOSE BINDINGS THIS PASS CAN ENUMERATE, not
+// over locals only. The identity above was asked of a VARIABLE; the environment object also travels
+// through a PARAMETER (R934: `function rd(e) { return e.K }` called as `rd(process.env)` — the read runs
+// in `rd`'s frame and `rd` was absent) and through a heap FIELD (R935: `const cfg = { env: process.env }`
+// at module level, read later as `cfg.env.K` by a function that never calls the module initializer —
+// absent; only `<module>` carried Env). Both are one defect: the alias model stopped at the first
+// location that was not a local, so the value was lost the moment it was stored anywhere else. The fix
+// is not a second analysis per location kind; it is the SAME binding table and the SAME two fixpoints
+// with two more kinds of location in them:
+//
+//   PARAMETER — its bindings are the arguments at every VISIBLE call site (positional, up to a spread;
+//     a site that omits it binds its default, else `undefined`). It joins MUST only — every visible site
+//     hands it the environment — and NEVER MAY. That asymmetry is pass 2b's ruling, transferred: a
+//     parameter fed the environment at one site and `{}` at another is the DIVERGENT shared-HOF shape,
+//     and charging the callee would pool the read onto the caller that passed `{}` (a fabrication). The
+//     caller that passes the environment is already charged by the Env arm (a call argument is not an
+//     inert consumer), so every gate above the callee still fires — the callee's own scoped gate is the
+//     only one that stays 0, exactly as it does for a divergent HOF. Only functions whose every reference
+//     is a CALL are eligible: a function that escapes as a value (a callback, `.call`, `.bind`, stored)
+//     has bindings this pass cannot see. Methods are eligible only on a class with no heritage that no
+//     project class extends — a dispatched call resolves to the base declaration, and an override's
+//     parameter would otherwise look fed by fewer sites than it is.
+//   PROPERTY — its bindings are the initializer of every VALUE-BEARING declaration (an object-literal
+//     property, a class field, a constructor parameter property — which is bound exactly as its
+//     parameter is) and the right side of every assignment to it. An absent initializer is not a binding:
+//     a field that is `undefined` until it is assigned the environment cannot make a reader read a
+//     DIFFERENT object's keys, and that is the only thing MUST has to rule out. MUST charges a reader Env;
+//     MAY (rebound to something else somewhere) discloses `Unknown[env-maybe-read]`, the local-alias
+//     posture, because unlike a parameter there is no caller in the reader's chain that carries it. A
+//     property declared by an interface or a type literal (`PropertySignature`) is NOT a location here:
+//     any conforming object can be its value, so its bindings are an open set — the residual is stated
+//     in SOUNDNESS, not hidden. A field of a class some project class extends is excluded for the
+//     override reason above.
+//
+// Writing the environment INTO a property stays charged where it happens (the Env arm's "store" rule);
+// this adds the READERS and removes nothing.
 const envAliasSymbols = new Set();
 const envMayAliasSymbols = new Set();
+// ⟨R935⟩ property locations, kept apart from the local sets so a property name never reaches the
+// identifier-keyed consumers (2c's `envSourceKind`, the alias-binding inert rule) by accident.
+const envPropMustSymbols = new Set();
+const envPropMaySymbols = new Set();
+// ⟨R935⟩ a property location's identity: its first declaration node (see `memberSymOf` for why not the symbol).
+const envLocKey = (sym) => sym?.declarations?.[0] ?? null;
 {
   const ENV_DESTRUCTURED = Symbol("env-destructured");
-  const bindings = new Map(); // symbol -> [value expr | null | ENV_DESTRUCTURED]
+  const bindings = new Map(); // symbol -> [value expr | null | ENV_DESTRUCTURED | { same: symbol }]
   const note = (sym, v) => { if (sym) (bindings.get(sym) ?? bindings.set(sym, []).get(sym)).push(v); };
   const LOGICAL_ASSIGN = new Set([ts.SyntaxKind.EqualsToken, ts.SyntaxKind.QuestionQuestionEqualsToken,
                                   ts.SyntaxKind.BarBarEqualsToken, ts.SyntaxKind.AmpersandAmpersandEqualsToken]);
+  const paramSyms = new Set();     // ⟨R934⟩ parameters with at least one recorded binding
+  const propSyms = new Set();      // ⟨R935⟩ eligible property locations with at least one binding
+  const propIneligible = new Set();
+  // The LOCATION KEY of a member reference: `o.p` / `o["p"]` → the property's first declaration node.
+  // Keyed by DECLARATION, not symbol: an object literal's type is WIDENED when it is bound, and the
+  // widened type carries fresh transient property symbols — `cfg.env` at a read site and `env:` in the
+  // literal are two symbol objects for one declaration (measured: the read never matched the binding).
+  const memberRawSym = (n) => (ts.isPropertyAccessExpression(n) ? checker.getSymbolAtLocation(n.name)
+    : (ts.isElementAccessExpression(n) && n.argumentExpression && ts.isStringLiteralLike(n.argumentExpression))
+      ? checker.getSymbolAtLocation(n.argumentExpression) : null) ?? null;
+  const memberSymOf = (n) => envLocKey(memberRawSym(n));
+  // Is this property symbol a location whose bindings we can enumerate? Every declaration must be
+  // value-bearing, in a project file, and not a member of an extended class.
+  const propEligible = (sym) => {
+    if (!sym || propIneligible.has(sym)) return false;
+    const decls = sym.declarations ?? [];
+    const ok = decls.length > 0 && decls.every((d) => {
+      if (!projectFiles.has(path.resolve(d.getSourceFile().fileName))) return false;
+      if (ts.isPropertyAssignment(d) || ts.isShorthandPropertyAssignment(d)) return ts.isObjectLiteralExpression(d.parent);
+      if (ts.isPropertyDeclaration(d)) return !d.modifiers?.some((m) => m.kind === ts.SyntaxKind.DeclareKeyword)
+        && !extendedClassSyms.has(classSymOf(d.parent));
+      if (ts.isParameter(d)) return ts.isConstructorDeclaration(d.parent) && !extendedClassSyms.has(classSymOf(d.parent.parent));
+      return false;
+    });
+    if (!ok) propIneligible.add(sym);
+    return ok;
+  };
+  const noteProp = (sym, v) => { if (propEligible(sym)) { const k = envLocKey(sym); propSyms.add(k); note(k, v); } };
   const collect = (node) => {
     if (ts.isVariableDeclaration(node) && node.name && ts.isIdentifier(node.name)) {
       note(checker.getSymbolAtLocation(node.name), node.initializer ?? null);
@@ -8558,28 +9086,97 @@ const envMayAliasSymbols = new Set();
       }
     } else if (ts.isBinaryExpression(node) && LOGICAL_ASSIGN.has(node.operatorToken.kind) && ts.isIdentifier(node.left)) {
       note(checker.getSymbolAtLocation(node.left), node.right);
+    } else if (ts.isBinaryExpression(node) && node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment
+               && node.operatorToken.kind <= ts.SyntaxKind.LastAssignment
+               && (ts.isPropertyAccessExpression(node.left) || ts.isElementAccessExpression(node.left))) {
+      // ⟨R935⟩ an assignment to a property location; a compound operator (`+=`) binds a non-environment.
+      const s = memberRawSym(node.left);
+      if (s) noteProp(s, LOGICAL_ASSIGN.has(node.operatorToken.kind) ? node.right : null);
+    } else if (ts.isPropertyAssignment(node) && ts.isObjectLiteralExpression(node.parent)) {
+      const s = checker.getSymbolAtLocation(node.name);
+      if (s && (s.flags & ts.SymbolFlags.Property)) noteProp(s, node.initializer);
+    } else if (ts.isShorthandPropertyAssignment(node) && ts.isObjectLiteralExpression(node.parent)) {
+      const s = checker.getSymbolAtLocation(node.name);
+      const v = checker.getShorthandAssignmentValueSymbol(node);
+      if (s && (s.flags & ts.SymbolFlags.Property)) noteProp(s, v ? { same: v } : null);
+    } else if (ts.isPropertyDeclaration(node) && node.initializer && node.name) {
+      noteProp(checker.getSymbolAtLocation(node.name), node.initializer);
+    } else if (ts.isParameter(node) && ts.isIdentifier(node.name) && ts.isConstructorDeclaration(node.parent)
+               && ts.getModifiers?.(node)?.some((m) => m.kind === ts.SyntaxKind.PublicKeyword
+                    || m.kind === ts.SyntaxKind.PrivateKeyword || m.kind === ts.SyntaxKind.ProtectedKeyword
+                    || m.kind === ts.SyntaxKind.ReadonlyKeyword)) {
+      // a constructor parameter property is bound exactly as its parameter is
+      const [ps, fs] = checker.getSymbolsOfParameterPropertyDeclaration(node, node.name.text);
+      if (ps && fs) noteProp(fs, { same: ps });
+    }
+    // ⟨R935⟩ WRITES THE TABLE ABOVE CANNOT NAME: a reflective write into the object (`Object.assign(o, …)`,
+    // `Object.defineProperty`, `Reflect.set`) or a computed-key store `o[k] = v` can rebind ANY of the
+    // object's properties. Every eligible property of the target's type gets a non-environment binding,
+    // so a location written that way can be MAY at best — a reader discloses `Unknown` rather than being
+    // charged `Env` over a value that was replaced off the books (executed: an `Object.assign` rebind read
+    // the replacement, and the first cut of this charged it `Env`).
+    const reflectTarget = ts.isCallExpression(node)
+      && /^(Object\.(assign|defineProperty|defineProperties)|Reflect\.(set|defineProperty))$/.test(
+           (ts.isPropertyAccessExpression(node.expression) ? node.expression.getText() : "").replace(/\s+/g, ""))
+      ? node.arguments[0]
+      : (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken
+         && ts.isElementAccessExpression(node.left) && node.left.argumentExpression
+         && !ts.isStringLiteralLike(node.left.argumentExpression) && !ts.isNumericLiteral(node.left.argumentExpression))
+        ? node.left.expression : null;
+    if (reflectTarget) {
+      let props = [];
+      try { props = checker.getTypeAtLocation(reflectTarget)?.getProperties?.() ?? []; } catch { props = []; }
+      for (const ps of props) if (propEligible(ps)) noteProp(ps, null);
     }
     ts.forEachChild(node, collect);
   };
   for (const sf of sources) collect(sf);
-  const leafIn = (leaf, set) => isProcessEnvExpr(leaf)
-    || (ts.isIdentifier(leaf) && set.has(checker.getSymbolAtLocation(leaf)));
-  const hasEnvLeaf = (v, set) => v === ENV_DESTRUCTURED || (!!v && typeof v === "object" && envValueLeaves(v).some((l) => leafIn(l, set)));
-  // MAY: least fixpoint of "some binding has a leaf that is process.env or already MAY".
+  // ⟨R934⟩ the parameter bindings come from the shared PARAMETER PROVENANCE index above.
+  for (const [ps, vals] of paramArgs) { paramSyms.add(ps); for (const v of vals) note(ps, v); }
+  const leafIn = (leaf, set, propSet) => isProcessEnvExpr(leaf)
+    || (ts.isIdentifier(leaf) && set.has(checker.getSymbolAtLocation(leaf)))
+    || (!!propSet && propSet.has(memberSymOf(leaf)));
+  const hasEnvLeaf = (v, set, propSet) => v === ENV_DESTRUCTURED
+    || (!!v && typeof v === "object" && "same" in v ? set.has(v.same) || propSet?.has(v.same) === true
+        : (!!v && typeof v === "object" && envValueLeaves(v).some((l) => leafIn(l, set, propSet))));
+
+
+  // MAY: least fixpoint of "some binding has a leaf that is process.env or already MAY" — LOCALS and
+  // PROPERTIES (a property's MAY reads a local's MAY and vice versa). Parameters never join MAY (above).
   for (let changed = true, n = 0; changed && n < 64; n++) {
     changed = false;
     for (const [sym, vals] of bindings) {
-      if (!envMayAliasSymbols.has(sym) && vals.some((v) => hasEnvLeaf(v, envMayAliasSymbols))) { envMayAliasSymbols.add(sym); changed = true; }
+      if (paramSyms.has(sym)) continue;
+      const isProp = propSyms.has(sym);
+      const set = isProp ? envPropMaySymbols : envMayAliasSymbols;
+      if (!set.has(sym) && vals.some((v) => hasEnvLeaf(v, envMayAliasSymbols, envPropMaySymbols))) { set.add(sym); changed = true; }
     }
   }
   // MUST: least fixpoint (from empty) of "every binding has a leaf that is process.env or already MUST" —
-  // least, so a cycle that never touches process.env directly stays MAY (the disclosing side).
-  for (let changed = true, n = 0; changed && n < 64; n++) {
-    changed = false;
+  // least, so a cycle that never touches process.env directly stays MAY (the disclosing side). Locals and
+  // properties start from their MAY sets; parameters are tried directly (MUST-only). A parameter whose
+  // function escapes is dropped before it can join.
+  const paramCands = [...paramSyms].filter((s) => bindings.get(s)?.some((v) => v !== null));
+  let batched = false;
+  const mustTry = () => {
+    let changed = false;
     for (const sym of envMayAliasSymbols) {
-      if (!envAliasSymbols.has(sym) && bindings.get(sym).every((v) => hasEnvLeaf(v, envAliasSymbols))) { envAliasSymbols.add(sym); changed = true; }
+      if (!envAliasSymbols.has(sym) && bindings.get(sym).every((v) => hasEnvLeaf(v, envAliasSymbols, envPropMustSymbols))) { envAliasSymbols.add(sym); changed = true; }
     }
-  }
+    for (const sym of envPropMaySymbols) {
+      if (!envPropMustSymbols.has(sym) && bindings.get(sym).every((v) => hasEnvLeaf(v, envAliasSymbols, envPropMustSymbols))) { envPropMustSymbols.add(sym); changed = true; }
+    }
+    for (const sym of paramCands) {
+      if (envAliasSymbols.has(sym)) continue;
+      if (!bindings.get(sym).every((v) => hasEnvLeaf(v, envAliasSymbols, envPropMustSymbols))) continue;
+      const fsym = paramOwnerOf.get(sym);
+      if (!batched) { batched = true; paramFnEscaped.batch(paramCands.map((p) => paramOwnerOf.get(p)).filter(Boolean)); }
+      if (paramFnEscaped(fsym)) continue;
+      envAliasSymbols.add(sym); changed = true;
+    }
+    return changed;
+  };
+  for (let n = 0; mustTry() && n < 64; n++) { /* to fixpoint */ }
 }
 // True when `id` is an identifier resolving to a confirmed process.env alias local.
 const identIsEnvAlias = (id) => {
@@ -8595,11 +9192,26 @@ const identIsEnvMayAlias = (id) => {
 };
 // The env kind of an expression's VALUE: "env" if some leaf is process.env or a MUST-alias, "may" if
 // some leaf is only a MAY-alias, else null. The one answer the Env arm, 2c and the shared helpers ask.
+// ⟨R935⟩ a member reference `o.p` / `o["p"]` whose property is an environment location.
+const envMemberSym = (n) => {
+  if (!(envPropMaySymbols.size > 0)) return null;
+  if (ts.isPropertyAccessExpression(n)) return envLocKey(checker.getSymbolAtLocation(n.name));
+  if (ts.isElementAccessExpression(n) && n.argumentExpression && ts.isStringLiteralLike(n.argumentExpression))
+    return envLocKey(checker.getSymbolAtLocation(n.argumentExpression));
+  return null;
+};
+const envPropKind = (n) => {
+  const s = envMemberSym(n);
+  if (!s || !envPropMaySymbols.has(s)) return null;
+  return envPropMustSymbols.has(s) ? "env" : "may";
+};
 const envValueKind = (expr) => {
   let kind = null;
   for (const l of envValueLeaves(expr)) {
     if (isProcessEnvExpr(l) || identIsEnvAlias(l)) return "env";
-    if (identIsEnvMayAlias(l)) kind = "may";
+    const pk = envPropKind(l);
+    if (pk === "env") return "env";
+    if (identIsEnvMayAlias(l) || pk === "may") kind = "may";
   }
   return kind;
 };
@@ -8612,8 +9224,21 @@ const envIsAssignOp = (k) => k >= ts.SyntaxKind.FirstAssignment && k <= ts.Synta
 let envAliasNames = null;
 const envRefKind = (node) => {
   if (isProcessEnvExpr(node)) return "env";
+  // ⟨R935⟩ a READ of an environment property location. Not an assignment target, a `delete` operand, a
+  // destructuring target or a `++`/`--` operand: those write the location, they do not read the object.
+  if (envPropMaySymbols.size > 0 && (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))) {
+    const pk = envPropKind(node);
+    if (!pk) return null;
+    const p = node.parent;
+    if (p && ts.isBinaryExpression(p) && p.left === node && envIsAssignOp(p.operatorToken.kind)) return null;
+    if (p && (ts.isDeleteExpression(p) || ((ts.isPrefixUnaryExpression(p) || ts.isPostfixUnaryExpression(p))
+        && (p.operator === ts.SyntaxKind.PlusPlusToken || p.operator === ts.SyntaxKind.MinusMinusToken)))) return null;
+    if (isDestructuringAssignTarget(node)) return null;
+    return pk;
+  }
   if (!ts.isIdentifier(node)) return null;
-  envAliasNames ??= new Set([...envMayAliasSymbols].map((s) => s.name));
+  // ⟨R934⟩ MUST-parameters are in `envAliasSymbols` but never in the MAY set, so the name filter reads both.
+  envAliasNames ??= new Set([...envMayAliasSymbols, ...envAliasSymbols].map((s) => s.name));
   if (!envAliasNames.has(node.text)) return null;
   const p = node.parent;
   if (!p) return null;
@@ -8628,8 +9253,9 @@ const envRefKind = (node) => {
       && (p.operator === ts.SyntaxKind.PlusPlusToken || p.operator === ts.SyntaxKind.MinusMinusToken)) return null;
   const sym = ts.isShorthandPropertyAssignment(p) && p.name === node
     ? checker.getShorthandAssignmentValueSymbol(p) : checker.getSymbolAtLocation(node);
-  if (!sym || !envMayAliasSymbols.has(sym)) return null;
-  return envAliasSymbols.has(sym) ? "env" : "may";
+  if (!sym) return null;
+  if (envAliasSymbols.has(sym)) return "env";
+  return envMayAliasSymbols.has(sym) ? "may" : null;
 };
 // ⟨R928/R804⟩ Does the CONSUMER of this env value provably touch no key? Climb through what passes the
 // value on unchanged (the transparent wrappers, both arms of `?:`, either side of `??`/`||`, the right of
@@ -8761,14 +9387,10 @@ const globalBuiltinCallee = (callee) => {
   if (!callee || !ts.isPropertyAccessExpression(callee)) return null;
   const member = callee.name?.text;
   if (!member) return null;
-  let owner = callee.expression;
-  while (owner && (ts.isParenthesizedExpression(owner) || ts.isAsExpression(owner)
-                   || ts.isNonNullExpression(owner))) owner = owner.expression;
+  const owner = unwrapArgExpr(callee.expression);   // R780
   if (ts.isIdentifier(owner)) return identIsGlobal(owner) ? `${owner.text}.${member}` : null;
   if (!ts.isPropertyAccessExpression(owner) || !owner.name?.text) return null;
-  let root = owner.expression;
-  while (root && (ts.isParenthesizedExpression(root) || ts.isAsExpression(root)
-                  || ts.isNonNullExpression(root))) root = root.expression;
+  const root = unwrapArgExpr(owner.expression);   // R780
   if (!ts.isIdentifier(root) || !GLOBAL_ROOTS.has(root.text) || !identIsGlobal(root)) return null;
   return `${owner.name.text}.${member}`;
 };
@@ -8805,9 +9427,7 @@ const globalBareCallee = (callee) => {
   if (!callee) return null;
   if (ts.isIdentifier(callee)) return identIsGlobal(callee) ? callee.text : null;
   if (!ts.isPropertyAccessExpression(callee) || !callee.name?.text) return null;
-  let root = callee.expression;
-  while (root && (ts.isParenthesizedExpression(root) || ts.isAsExpression(root)
-                  || ts.isNonNullExpression(root))) root = root.expression;
+  const root = unwrapArgExpr(callee.expression);   // R780
   // ONLY a global ROOT, never an arbitrary owner: `Object.assign` must not read as the bare global
   // `assign`, and `globalThis.Object.assign` must not read as the bare global `Object` — both are the
   // member helper's business, and answering them here would be the second copy §G exists to prevent.
@@ -9143,8 +9763,95 @@ function visitCalls(node) {
         // never a fabrication. (A LOCAL callee keeps its precise callback-flow below.)
         const calleeName = ts.isPropertyAccessExpression(node.expression) ? node.expression.name.text
           : ts.isIdentifier(node.expression) ? node.expression.text : null;
-        if (mod !== "<local>" && calleeName && HOF_INVOKERS.has(calleeName)) {
-          node.arguments?.forEach((a0, argIdx) => {
+        // ⟨SOUNDNESS R803⟩ a LISTED name keeps its position map; an UNLISTED non-local callee is admitted at the
+        // positions its signature POSITIVELY declares callable, unless denylisted. See `HOF_REMOVAL_NAMES`.
+        const hofListed = !!calleeName && HOF_INVOKERS.has(calleeName);
+        const hofName = calleeName ?? decl.name?.getText?.() ?? null;
+        const hofOpenAt = (!hofListed && mod !== "<local>" && node.arguments?.length
+                           && !hofCalleeNeverInvokes(decl, hofName))
+          ? (i) => calleeParamIsCallable(node, i) === true
+                   && !(declIsReviewedLib(decl) && calleeParamIsGenericSlot(node, i)) : null;
+        // ⟨SOUNDNESS R1031⟩ THE SAME RULE ONE LEVEL DOWN: a function reference handed inside an OBJECT
+        // LITERAL. rxjs `of(1).subscribe({ next: h })`, `{ complete: h }`, `{ error: h }`, `{ next }` and
+        // `{ next: o.m.bind(o) }` were ABSENT with `deny Fs <caller>` exit 0 while the bare `subscribe(h)`
+        // read `['Fs']` (EXECUTED: every handler that the observable fires wrote its file). R803 admits a
+        // POSITION its signature declares callable; the observer object's MEMBERS are positions too, and
+        // the signature declares them just as positively — `Partial<Observer<T>>`'s `next` is
+        // `((value: T) => void) | undefined`. So each property whose value is a reference, at a member the
+        // parameter's (non-callable) type arms declare callable, is handed to the SAME per-argument arm as
+        // a bare reference — one implementation of "a reference the callee may invoke", not a second copy.
+        // Inline arrows and methods in the literal were never dropped (they are structural units, charged
+        // lexically). Same admission as R803's open path: an unlisted non-local callee off the denylist; an
+        // `any`/`unknown`-typed parameter or member admits nothing (the R803 residual, unchanged).
+        const objArgRefs = (argIdx, lit, depth = 0) => {
+          if (depth > 2) return [];
+          // The parameter's DECLARED type, not the call's instantiation of it: `Object.assign(p, { unsubscribe })`
+          // instantiates `U` as `{ unsubscribe: () => void }`, which reads callable only because the CALL made it
+          // so — the signature declares nothing about invoking it (measured: trpc's `Unpromise.then` charged
+          // `callback:unsubscribe` until this read the declaration). A generic slot names no members, so it
+          // admits nothing; `Partial<Observer<T>>` declares `next` callable whatever `T` is.
+          let sd; try { sd = checker.getResolvedSignature?.(node)?.declaration; } catch { sd = null; }
+          const dps = sd?.parameters;
+          if (!dps?.length) return [];
+          const dp = dps[Math.min(argIdx, dps.length - 1)];
+          if (argIdx >= dps.length && !dp.dotDotDotToken) return [];
+          if (!dp.type) return [];
+          let pt; try { pt = checker.getTypeFromTypeNode(dp.type); } catch { pt = null; }
+          if (dp.dotDotDotToken && pt) pt = checker.getIndexTypeOfType?.(pt, ts.IndexKind.Number) ?? null;   // `...xs: T[]` → T
+          return objLitRefsFor(pt, lit, depth);
+        };
+        const callableT = (t) => !!t && (t.getCallSignatures?.().length > 0 || (t.types ?? []).some((u) => u.getCallSignatures?.().length > 0));
+        const objLitRefsFor = (pt, lit, depth) => {
+          if (!pt || (pt.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown))) return [];
+          const arms = (pt.types ?? [pt]).filter((u) => !(u.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Null | ts.TypeFlags.Any | ts.TypeFlags.Unknown))
+                                                   && !(u.getCallSignatures?.().length > 0));
+          const out = [];
+          for (const pr of lit.properties) {
+            const nm = pr.name && (ts.isIdentifier(pr.name) || ts.isStringLiteralLike(pr.name)) ? pr.name.text : null;
+            if (!nm) continue;
+            const memberTypes = arms.map((u) => { const ms = u.getProperty?.(nm); return ms ? checker.getTypeOfSymbolAtLocation(ms, lit) : null; }).filter(Boolean);
+            if (ts.isShorthandPropertyAssignment(pr)) {
+              if (memberTypes.some(callableT)) out.push({ shorthand: pr });
+              continue;
+            }
+            if (!ts.isPropertyAssignment(pr)) continue;           // a method / accessor is a structural unit already
+            const v = unwrapArgExpr(pr.initializer);
+            if (ts.isObjectLiteralExpression(v)) { for (const mt of memberTypes) out.push(...objLitRefsFor(mt, v, depth + 1)); continue; }
+            if (memberTypes.some(callableT)) out.push({ ref: pr.initializer });
+          }
+          return out;
+        };
+        if (mod !== "<local>" && (hofListed || hofOpenAt)) {
+          const hofArgArm = (a0, argIdx) => {
+            // ⟨R1031⟩ an object literal at an admitted callee: its referenced members are the arguments.
+            if (!hofListed) {
+              const lit = unwrapArgExpr(a0);
+              if (lit && ts.isObjectLiteralExpression(lit)) {
+                // A property DESCRIPTOR installs its `get`/`set` and invokes neither; the access sites are
+                // edged to the installed accessor by `definePropAccessors`. Charging the definer would be the
+                // over-charge R803's generic-slot denylist exists for, one level down.
+                if (declIsReviewedLib(decl) && OBJ_ARG_INSTALLS.has(hofOwnerMember(decl) ?? "")) return;
+                for (const r of objArgRefs(argIdx, lit)) {
+                  if (r.ref) { HOF_REACH?.("objref", `${hofName}`); hofArgArm(r.ref, -1 - argIdx); continue; }
+                  // `{ next }` — the shorthand's VALUE symbol, followed one alias hop to what it holds.
+                  const vs = checker.getShorthandAssignmentValueSymbol(r.shorthand);
+                  const vd = vs?.valueDeclaration;
+                  HOF_REACH?.("objref", `${hofName}`);
+                  if (vd && nodeName.get(vd)) rec.edges.add(nodeName.get(vd));
+                  else if (vd && ts.isVariableDeclaration(vd) && vd.initializer && !ts.isArrowFunction(vd.initializer)
+                           && !ts.isFunctionExpression(vd.initializer)) hofArgArm(vd.initializer, -1 - argIdx);
+                  else if (vd && ts.isVariableDeclaration(vd) && vd.initializer && nodeName.get(vd.initializer)) rec.edges.add(nodeName.get(vd.initializer));
+                  else if (!vd || ts.isParameter(vd) || ts.isVariableDeclaration(vd) || ts.isBindingElement(vd)) {
+                    rec.direct.add("Unknown"); rec.why.add(`callback:${r.shorthand.name.text.slice(0, 40)}`);
+                  }
+                }
+                return;
+              }
+            }
+            // ⟨R1031⟩ a member reference re-entering the arm carries a NEGATIVE index: it is admitted by its
+            // member's declared type above, and no position map or signature lookup applies to it.
+            const memberRef = argIdx < 0;
+            if (!memberRef && !hofListed && !hofOpenAt(argIdx)) return;
             // R947 — a TYPE-ONLY wrapper is the same reference: `xs.forEach(fs.unlinkSync as any)`
             // was dropped by the id/property-access gate below (no edge, no κ, no disclosure) while the bare
             // spelling was not. `as`/`!`/`satisfies`/parentheses change no runtime value.
@@ -9159,7 +9866,7 @@ function visitCalls(node) {
             // the same over-charge the by-reference arm below was fixed for and this arm was not.
             // …but it must be the NEGATIVE test, not `!hofInvokesArg`: an unresolved or loosely-typed
             // callee signature is not a licence to drop a bound callback. See `hofArgIsNeverCallback`.
-            if (hofArgIsNeverCallback(calleeName, argIdx, node)) return;
+            if (hofListed && hofArgIsNeverCallback(calleeName, argIdx, node)) return;
             const bound = unwrapBind(a);
             if (bound) {
               const bref = bound.ref;
@@ -9212,7 +9919,8 @@ function visitCalls(node) {
             if (!ts.isIdentifier(a) && !ts.isPropertyAccessExpression(a)) return;
             const d2 = realDecl(checker.getSymbolAtLocation(a));
             const t = (d2 && nodeName.get(d2)) || resolveFnRefUnit(a); // pin direct fn OR a local alias chain
-            if (t) { rec.edges.add(t); return; } // resolvable named/local callback — keep its analyzed effect
+            if (t) { if (!hofListed) HOF_REACH?.("edge", `${hofName}->${t}`);
+                     rec.edges.add(t); return; } // resolvable named/local callback — keep its analyzed effect
             // A DEPENDENCY function passed BY REFERENCE — `xs.forEach(depWrite)`, `setTimeout(dep.tick, 0)`.
             // The invoking HOF calls it, so its effects are reachable here, and the dependency's report
             // holds them under `<pkg>#depWrite`. Guard (2) below reasons that a ref resolving to a concrete
@@ -9238,7 +9946,7 @@ function visitCalls(node) {
             //      through the κ/invisible channel, so blanket-Unknown here would over-disclose them.
             //  (3) CALLABILITY — `argIsCallable` (has a call signature, or `any`/`unknown`/unconstrained
             //      generic that COULD hold a function).
-            if (!hofInvokesArg(calleeName, argIdx, node)) return;
+            if (hofListed && !hofInvokesArg(calleeName, argIdx, node)) return;
             // ⟨SOUNDNESS R558⟩ …and BEFORE the by-reference dependency charge below, without returning:
             // a FOREIGN interface member named as a value needs BOTH the visible-implementor join and
             // the `invisible`/ledger disclosure `chargeExternalDecl` already gives it, and the two
@@ -9253,6 +9961,7 @@ function visitCalls(node) {
             // dep VALUE with a call signature, passes. Guard (1) exists for exactly this shape and its own
             // comment names the case (`path.reduce(fn, obj)`); the new arm simply ran before it.
             if (d2 && !declIsLocal(d2) && argIsCallable(a)) {
+              if (!hofListed) HOF_REACH?.("dep", `${hofName}->${a.getText().slice(0, 40)}`);
               // R947 — A κ-CLASSIFIED BUILTIN PASSED BY REFERENCE. `chargeExternalDecl` is the
               // dependency funnel and never asks κ, and `disclosureTail` treats a κ-KNOWN member as covered, so
               // `xs.forEach(fs.unlinkSync)`, `setTimeout(fs.unlinkSync, 0, p)`, `.then(cp.execSync)` and
@@ -9275,11 +9984,24 @@ function visitCalls(node) {
             const holderIsProjectValue = d2 && (ts.isParameter(d2) || ts.isVariableDeclaration(d2) || ts.isBindingElement(d2))
               && projectFiles.has(path.resolve(d2.getSourceFile().fileName));
             if (!(holderIsProjectValue || !d2)) return;
+            // ⟨SOUNDNESS R803⟩ a newly admitted callee handed its OWN caller's parameter (`reg(e, h) { e.on("y", h) }`)
+            // is the callback flow's question, not an opaque value: the parameter is INVOKED, so pass 2b resolves it
+            // to what every visible call site passed (an edge — `deny Fs` on the caller of `reg` fires) and keeps the
+            // honest `callback:param#i` where a call site is opaque or none is visible. The listed names keep their
+            // older `callback:<name>` disclosure — unchanged here so this fix removes nothing it did not add.
+            if (!hofListed && d2 && ts.isParameter(d2) && d2.parent && nodeName.get(d2.parent) && argIsCallable(a)) {
+              const ownerUnit = nodeName.get(d2.parent);
+              HOF_REACH?.("param", `${hofName}->${a.getText().slice(0, 40)}`);
+              (paramInvokes.get(ownerUnit) ?? paramInvokes.set(ownerUnit, new Set()).get(ownerUnit)).add(d2.parent.parameters.indexOf(d2));
+              return;
+            }
             if (argIsCallable(a)) {
+              if (!hofListed) HOF_REACH?.("opaque", `${hofName}->${a.getText().slice(0, 40)}`);
               rec.direct.add("Unknown");
               rec.why.add(`callback:${a.getText().replace(/\s+/g, "").slice(0, 40)}`); // opaque callable invoked by a sync HOF — canonical `callback:`
             }
-          });
+          };
+          node.arguments?.forEach(hofArgArm);
         }
         // `fn.call(thisArg, …)` / `fn.apply(thisArg, args)` INVOKE the receiver function reference, and
         // `Reflect.apply(fn, …)` / `Reflect.construct(Ctor, …)` invoke their FIRST ARGUMENT. The resolved
@@ -9317,6 +10039,11 @@ function visitCalls(node) {
           if ((m === "call" || m === "apply") && recvText !== "Reflect") invokedRef = recv;
           else if (recvText === "Reflect" && (m === "apply" || m === "construct"))
             invokedRef = (node.arguments ?? [])[0] ?? null;
+          // ⟨SOUNDNESS R780⟩ `(k.m as F).call(k)`, `(f satisfies F).call(t)` and `Reflect.apply(f as F, …)` invoke what
+          // the bare spelling invokes. A single wrapped reference is not a CHOICE, so R955's leaves (which do unwrap)
+          // returned null and the id/property gate below saw a ParenthesizedExpression: no edge, no `Unknown`, the
+          // caller ABSENT (EXECUTED, `fx/r780`).
+          invokedRef = unwrapArgExpr(invokedRef);
           // ⟨SOUNDNESS R587⟩ …and the ELEMENT-ACCESS spelling of the invoked reference, on the same
           // grounds as the HOF-ref arm above: `i["roll"].call(null, n)` invokes exactly what
           // `i.roll.call(null, n)` invokes. Measured ABSENT at `6a639e6` in every cell
@@ -9430,8 +10157,7 @@ function visitCalls(node) {
               const recvExpr = (ts.isPropertyAccessExpression(node.expression)
                 || ts.isElementAccessExpression(node.expression)) ? node.expression.expression : null;
               const rootClass = localReceiverClass(recvExpr);
-              const direct = rootClass ? allOverrides.filter((om) =>
-                ts.isClassDeclaration(om.parent) && classInSubtree(om.parent, rootClass)) : allOverrides;
+              const direct = rootClass ? allOverrides.filter((om) => classInSubtree(overrideOwner(om), rootClass)) : allOverrides;
               const overrides = isSuperReceiver(recvExpr) ? [] : memberDispatchBodies(decl, rootClass);
               if (isSuperReceiver(recvExpr)) probeR871("super-call", decl, direct.length);
               else if (direct.length <= CHA_FANOUT_LIMIT) probeR871("class", decl, overrides.length - direct.length);
@@ -9760,6 +10486,22 @@ function visitCalls(node) {
             rec.direct.add("Unknown");
             rec.why.add(`native:Storage.${name}`);
           }
+          // SOUNDNESS R241 — THE REST OF THE BROWSER'S PERSISTENT STORES AND NAVIGATION, which the comment
+          // above named as "untouched and still pure" (the documented-limitation shape: writing it down is
+          // what stopped it being measured). IndexedDB, the Cache API and the Origin Private File System
+          // persist across sessions exactly as `Storage` does, and `location.assign`/`replace`/`reload`
+          // navigate (a request leaves the page). All six of the row's spellings read ABSENT under
+          // `lib: ["ES2022","DOM"]`, while `localStorage.setItem` on the same tree read `Unknown[native:…]`.
+          // Same answer as `Storage`, for the same reason: the WHOLE interface (the denylist direction — an
+          // unlisted member would be silent), `Unknown` because the backing store / navigation target is not
+          // modelled, keyed on the RESOLVED DECLARATION'S PARENT so a project's own `class Cache` resolves
+          // `<local>` and never reaches this arm. Reach on the (Node/server) roster is zero by construction;
+          // the price is paid only by code that already touches these hosts.
+          if (BROWSER_STORE_IFACES.has(parent)
+              || (parent === "Location" && (name === "assign" || name === "replace" || name === "reload"))) {
+            rec.direct.add("Unknown");
+            rec.why.add(`native:${parent}.${name}`);
+          }
           // `new EventSource(url)` / `new WebSocket(url)`: the constructor is declared on an anonymous
           // `declare var` object type (symbol `__type`, no usable parent name), but reaching the es-lib
           // branch already proves the ctor resolved to lib.dom (not a project class shadowing the name),
@@ -9997,6 +10739,22 @@ function visitCalls(node) {
               && (ts.isPropertyAccessExpression(node.expression) || ts.isElementAccessExpression(node.expression))
               && receiverIsProvenNonNetworkStream(node.expression.expression))
             { eff = null; effSuppressed = true; }
+          // ⟨SOUNDNESS R966⟩ A FRAMEWORK'S OWN `listen` IS AN ACCEPT. `NET_ACCEPTING` is asked only of a call κ
+          // classified `Net`, and κ classifies node's servers — so express `app.listen(p)` (declared in
+          // express-serve-static-core), koa `app.listen(p)` and fastify `f.listen({port})` reached neither the effect
+          // nor the accept mark: beside `net.connect(80, "ok.example")`, `allow Net in <fn> ok.example` exited 0
+          // over a server answering anyone (EXECUTED: a client got the handler's reply). An inclusion list decided a
+          // fail-closed question (R781's lesson), so this is the fail-closed reading: a DEPENDENCY member named
+          // `listen` that κ did not answer is a network accept — `Net`, and `netAccepting` marks it `incomplete`.
+          // The failure direction is an over-charge on a non-network `listen`; the one family known to be that is
+          // denylisted by package (a JSON-RPC `connection.listen()` starts reading a transport whose OWN
+          // construction decides whether it is a socket). Measured reach on the pinned roster: 1 unclassified
+          // dependency `listen` (nest's FastifyAdapter), 0 non-network. Not seen: hapi `server.start()`
+          // (`start` is p-queue's and repl's too), Bun.serve/Deno.serve (no types in any roster tree).
+          if (!eff && !effSuppressed && member === "listen" && dependencyListenIsAccept(mod, decl)) {
+            eff = "Net";
+            if (process.env.CANDOR_R966_REACH) console.error(`R966-REACH ${mod}.listen`);
+          }
           if (eff) {
             rec.direct.add(eff);
             // SPEC §2 `fs` — refine an Fs we just PROVED with the direction its verb implies. DIRECT only
@@ -10327,7 +11085,16 @@ function visitCalls(node) {
     // `const [,,x] = process.argv`, or handing it to a parser all reach the same process-startup state.
     // Marked on the expression itself so every idiom counts without enumerating them.
     if (isProcessArgvExpr(node)) markEnv();
+    // ⟨R934⟩ a DESTRUCTURED parameter that every visible call site hands the environment reads its keys
+    // as the frame is entered — the destructuring IS the read, in this function's frame.
+    if (ts.isParameter(node) && ts.isObjectBindingPattern(node.name) && envAliasSymbols.has(node)) { markEnv(); ENVLOC_REACH?.("param-pattern env"); }
     const kind = envRefKind(node);
+    if (kind && ENVLOC_REACH && !envConsumerInert(node)) {
+      const vd = ts.isIdentifier(node) ? checker.getSymbolAtLocation(node)?.valueDeclaration : null;
+      const where = `${path.relative(process.cwd(), node.getSourceFile().fileName)}:${node.getStart() >= 0 ? node.getSourceFile().getLineAndCharacterOfPosition(node.getStart()).line + 1 : 0}`;
+      if (vd && ts.isParameter(vd)) ENVLOC_REACH(`param ${kind} ${where}`);
+      else if (!ts.isIdentifier(node) && !isProcessEnvExpr(node)) ENVLOC_REACH(`prop ${kind} ${where}`);
+    }
     if (kind && !envConsumerInert(node)) {
       if (kind === "env") markEnv();
       else {
@@ -10368,6 +11135,24 @@ function visitCalls(node) {
         && isWebStorageExpr(node.expression)) {
       markStore(memberLabel(node));
     }
+    // SOUNDNESS R241 — the two PROPERTY spellings of the same host boundary, which no call arm sees: the
+    // cookie jar (`document.cookie`, read OR written — it is a persistent store, `Storage`'s posture) and a
+    // WRITE to any `Location` property (`location.href = u` navigates; so do `pathname`/`search`/`hash`).
+    // lib.dom declares both as DATA properties, so the accessor arm finds nothing either. Keyed on the
+    // resolved declaration living in the TypeScript lib and on its declaring interface, never on text.
+    if (ts.isPropertyAccessExpression(node)) {
+      const hsym = checker.getSymbolAtLocation(node.name);
+      const hdecl = (hsym?.declarations ?? []).find((d) => /typescript\/lib\/lib\..*\.d\.ts$/.test(path.resolve(d.getSourceFile().fileName).replace(/\\/g, "/")));
+      const iface = hdecl?.parent && ts.isInterfaceDeclaration(hdecl.parent) ? hdecl.parent.name.text : null;
+      const pn = node.name.text;
+      const hp = node.parent;
+      const written = (hp && ts.isBinaryExpression(hp) && hp.left === node && envIsAssignOp(hp.operatorToken.kind))
+        || isDestructuringAssignTarget(node);
+      if ((iface === "Document" && pn === "cookie") || (iface === "Location" && written)) {
+        const owner = enclosing(node);
+        if (owner) { const r = fns.get(owner); r.direct.add("Unknown"); r.why.add(`native:${iface}.${pn}`); }
+      }
+    }
     else if (ts.isVariableDeclaration(node) && node.name && ts.isObjectBindingPattern(node.name)
              && node.initializer && isWebStorageExpr(node.initializer)) {
       markStore("<destructure>");
@@ -10788,6 +11573,36 @@ function visitCalls(node) {
       && p.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && p.operatorToken.kind <= ts.SyntaxKind.LastAssignment;
     const recordKind = (kind) => {
       const hits = accessorsAt(node, kind);
+      // ⟨R246/R1039⟩ THE RESIDUE: a WRITE (R246) or READ (R1039) through a receiver whose static type is
+      // `any`/`unknown` and whose value neither the assertion look-through nor the parameter provenance could
+      // name. Recorded here; whether it is disclosed is decided after the fixpoint, when it is known which
+      // project accessors of that kind have effects.
+      if (!(hits && hits.length)) {
+        let rt1; try { rt1 = checker.getTypeAtLocation(node.expression); } catch { rt1 = null; }
+        if (anyishType(rt1) && !receiverValueTypes(node.expression).length) {
+          const owner1 = enclosing(node);
+          const nm1 = ts.isPropertyAccessExpression(node) ? node.name.text
+            : (node.argumentExpression && ts.isStringLiteralLike(node.argumentExpression) ? node.argumentExpression.text : null);
+          if (owner1) anyRecvSetResidue.push({ owner: owner1, name: nm1, kind });
+        }
+      }
+      if (R246_REACH) {
+        let rt0; try { rt0 = checker.getTypeAtLocation(node.expression); } catch { rt0 = null; }
+        if (anyishType(rt0) || peelAssertions(node.expression) !== node.expression) {
+          const vts = receiverValueTypes(node.expression);
+          const nm = ts.isPropertyAccessExpression(node) ? node.name.text
+            : (node.argumentExpression && ts.isStringLiteralLike(node.argumentExpression) ? node.argumentExpression.text : null);
+          if (hits && hits.length && vts.length) R246_REACH(`resolved ${kind}`);
+          else if (anyishType(rt0) && !vts.length) {
+            projAccessorNames ??= (() => { const m = { get: new Set(), set: new Set() };
+              const v = (n) => { if ((ts.isGetAccessorDeclaration(n) || ts.isSetAccessorDeclaration(n)) && n.name && !ts.isComputedPropertyName(n.name))
+                (ts.isGetAccessorDeclaration(n) ? m.get : m.set).add(n.name.getText()); ts.forEachChild(n, v); };
+              for (const sf of sources) v(sf); return m; })();
+            const could = nm == null ? projAccessorNames[kind].size > 0 : projAccessorNames[kind].has(nm);
+            R246_REACH(`residue ${kind} ${nm == null ? "dyn" : "named"} ${could ? "could-hit-project-accessor" : "no-project-accessor"}`);
+          }
+        }
+      }
       if (hits && hits.length) {
         const owner = enclosing(node);
         if (!owner) return;
@@ -10864,7 +11679,10 @@ function visitCalls(node) {
         // the four symbol rows below); what changed is that the other spelling now asks the same code.
         const keyT = ts.isElementAccessExpression(node) && node.argumentExpression
           ? checker.getTypeAtLocation(node.argumentExpression) : null;
-        for (const prop of (rt?.getProperties?.() ?? [])) {
+        // R246 — the VALUE's types too: `(s as any)[k] = v`, or `o[k] = v` with `o: any` fed an `S`.
+        const rprops = [...(rt?.getProperties?.() ?? [])];
+        for (const vt of receiverValueTypes(node.expression)) rprops.push(...(vt.getProperties?.() ?? []));
+        for (const prop of rprops) {
           if (!accessorsFromSym(prop, kind).length) continue;
           if (!keyCouldNameAccessor(prop, keyT)) continue;
           const owner = enclosing(node);
@@ -11282,15 +12100,24 @@ for (const sf of sources) visitCalls(sf);
     })(cls);
     for (const dec of decorators) {
       add(localBodiedUnit(dec), "deco");                         // the application
-      let e = dec.expression;
-      while (ts.isParenthesizedExpression(e)) e = e.expression;
+      const e = unwrapArgExpr(dec.expression);   // R780
       if (ts.isCallExpression(e)) {
         add(localBodiedUnit(e), "deco");                         // the factory call
         add(`${moduleOf(e.getSourceFile())}.${decoratorArgLocal(e)}`, "arg");   // ⟨R944⟩ the ONE spelling
       }
     }
     for (const m of cls.members ?? [])
-      if (ts.isClassStaticBlockDeclaration(m)) add(staticBlockQual(m), "static");
+      if (ts.isClassStaticBlockDeclaration(m)
+          || (ts.isPropertyDeclaration(m) && m.initializer && (ts.getCombinedModifierFlags(m) & ts.ModifierFlags.Static)))
+        add(staticBlockQual(m), "static");   // R815: a static field initialiser shares the block's unit
+    // R815: the `extends <expr>` unit — run by the definer (here) and reached by every construction (`super`).
+    const ctorQ = nodeName.get(cls);
+    const herQ = ctorQ && ctorQ.endsWith(".constructor") ? ctorQ.replace(/\.constructor$/, ".<heritage>") : null;
+    // Wired only when the expression attributed something: a bare `extends Base` mints the unit (a reference was
+    // attributed) and carries nothing, and an edge to an empty unit is a `calls` entry on every subclass for no answer.
+    const herR = herQ && fns.get(herQ);
+    if (herR && ["direct", "edges", "why", "blind", "hosts", "paths", "cmds", "incomplete", "dispatch", "tables"]
+                  .some((k) => herR[k]?.size)) { add(herQ, "heritage"); fns.get(ctorQ)?.edges.add(herQ); }
     if (!targets.length) continue;
     const from = enclosing(cls.parent);
     const rec = from && fns.get(from);
@@ -11797,6 +12624,52 @@ const inferred = new Map([...fns.keys()].map((k) => [k, new Set(fns.get(k).direc
         if (!queued.has(c)) { queued.add(c); queue.push(c); }
   }
 }
+// ⟨SOUNDNESS R246⟩ THE HEDGE FOR WHAT RESOLUTION CANNOT REACH. A write `o.name = v` / `o[k] = v` through a
+// receiver typed `any`/`unknown` whose value neither an assertion nor a visible call site names — an escaped
+// function's parameter, an exported one with no visible caller, an `any` field or return — can still land
+// on a project SETTER (EXECUTED: `[new Sx()].forEach(w)` with `w(o: any) { o.token = v }` ran Sx's setter, and
+// `w` was ABSENT, `deny Fs`/`deny Unknown` both exit 0). Which object it is cannot be known, so this
+// DISCLOSES rather than charges: `Unknown[reflect:accessor:any-receiver]` on the writer, and only when the
+// project declares a setter that could be the one — the SAME name (or any string-named setter for an
+// unpinnable key) — AND that setter's body has an effect. A setter-free or pure-setter project pays nothing.
+// Priced on the 28-entry roster (see the commit for the measured count — a handful of units, <0.1%).
+// SOUNDNESS R1039 — THE READ SIDE, SAME RULE: `o.name` / `o[k]` through such a receiver can run a project
+// GETTER (EXECUTED: an escaped `r(o: any) { return o.token }` handed a class whose `get token()` writes a
+// file — `r` ABSENT, `deny Unknown`/`deny Fs Unknown` exit 0 on v0.40.0). Same admission: a getter WITH A
+// BODY and an EFFECT that the read could name (the same name, or any string-named one for an unpinnable key).
+if (anyRecvSetResidue.length) {
+  const accUnits = { get: new Map(), set: new Map() };   // kind -> name -> [unit]
+  const visitS = (n) => {
+    // An accessor WITH A BODY: a body-less declaration (a project typings stub) is already its own `native:`
+    // disclosure, and arming every `any` write on it measured as pure noise (typeorm's bson `ObjectId.set id`).
+    if ((ts.isSetAccessorDeclaration(n) || ts.isGetAccessorDeclaration(n)) && n.body && n.name && !ts.isComputedPropertyName(n.name)) {
+      const u = nodeName.get(n);
+      const m = ts.isSetAccessorDeclaration(n) ? accUnits.set : accUnits.get;
+      if (u) { const k = n.name.getText(); (m.get(k) ?? m.set(k, []).get(k)).push(u); }
+    }
+    ts.forEachChild(n, visitS);
+  };
+  for (const sf of sources) visitS(sf);
+  const effectful = (u) => (inferred.get(u)?.size ?? 0) > 0;
+  const anyEffectful = { get: [...accUnits.get.values()].flat().some(effectful), set: [...accUnits.set.values()].flat().some(effectful) };
+  const hedged = new Set();
+  for (const { owner, name, kind } of anyRecvSetResidue) {
+    const hit = name == null ? anyEffectful[kind] : (accUnits[kind].get(name) ?? []).some(effectful);
+    if (!hit || !fns.has(owner)) continue;
+    const rec = fns.get(owner);
+    rec.direct.add("Unknown"); rec.why.add("reflect:accessor:any-receiver");
+    hedged.add(owner);
+  }
+  // propagate the added `Unknown` to every transitive caller (the fixpoint above has already run)
+  const queue = [...hedged];
+  const seenU = new Set(queue);
+  for (let head = 0; head < queue.length; head++) {
+    const u = queue[head];
+    inferred.get(u)?.add("Unknown");
+    for (const c of callersOf.get(u) ?? [])
+      if (!seenU.has(c) && !inferred.get(c)?.has("Unknown")) { seenU.add(c); queue.push(c); }
+  }
+}
 // `fsKinds` joins the propagated surfaces: kinds TRAVEL the call graph (a caller that transitively only
 // writes IS a writer), and the "?" poison travels with them so a caller of an undetermined-kind function
 // inherits the SUPPRESSION rather than a half-answer. Pinned by conformance PART 31.