candor_classify/

lib.rs

//! candor-classify — the curated effect classifier (crate+path -> effect), extracted to a STABLE
//! crate so both the nightly `rustc_private` lint AND a stable backend share ONE source of truth
//! (no drift). Pure string logic; no rustc internals. The effect vocabulary lives in candor-report.

use candor_report::EFFECTS;

/// The canonical CANDOR_POLICY DSL parser (SPEC §6.2), shared by the nightly gate and candor-query.
pub mod policy;
#[cfg(test)]
mod policy_props;

/// The SURPRISE heuristic (the cold-repo hook) — SHARED so candor-scan's scan-time note and
/// candor-query's `tour` verb can't drift. Generic over the effect element type.
pub mod surface;

/// The transitive least fixed point over a call graph — SHARED so the scanner's gate-side reason-class
/// accumulator and candor-query's `unverified --class` filter resolve over the SAME reach.
pub mod propagate;

/// ⟨0.24⟩ The §6.2 GATE over an already-accumulated signature — SHARED so `candor-scan --policy` and
/// `candor-query gate --report` (SPEC §3.1) are the same gate reached by two routes, not two gates.
pub mod gate;

/// Project-supplied rules, consulted only when the built-in `classify` returns None.
pub fn classify_extra(
    crate_name: &str,
    path: &str,
    extra: &[(&'static str, bool, String)],
) -> Option<&'static str> {
    for (eff, is_crate, prefix) in extra {
        let hit = if *is_crate { crate_name.starts_with(prefix.as_str()) } else { path.starts_with(prefix.as_str()) };
        if hit {
            return Some(eff);
        }
    }
    None
}

/// The exact third-party crates `classify` has effect rules for, and the crate-name
/// PREFIXES it recognizes. This is the single source of truth for "what candor knows":
/// it is emitted beside the JSON report (`<prefix>.calibrated.json`) so the Claude Code
/// receipt's coverage check reads candor's real coverage instead of a hand-copied list.
/// Keep in lockstep with `classify` below — the `db_crates_are_calibrated` and
/// `calibrated_crates_are_live` tests (in this crate's `tests` module) enforce both directions.
pub const CALIBRATED_CRATES: [&str; 82] = [
    // network (aws_config resolves credentials over the network on `.load()`;
    // git2 remote ops — fetch/push/connect — contact the network; async_net is smol's net layer;
    // pnet is raw L2/L3 packet capture)
    "reqwest", "isahc", "ureq", "curl", "aws_config", "git2", "tokio_tcp", "tokio_udp", "async_net",
    "async_nats", "lapin", "lettre", "tungstenite", "elasticsearch", "tonic", "rdkafka", "pnet",
    // directory traversal (ignore = gitignore-aware walker, powers ripgrep/fd; its walk executors are Fs)
    // + filesystem watching (notify = inotify/FSEvents/kqueue wrapper; powers watchexec/cargo-watch)
    "ignore", "notify",
    // database (see DB_CRATES in classify)
    "sqlx", "rusqlite", "postgres", "tokio_postgres", "diesel", "redis", "mongodb",
    "mysql", "mysql_async", "sea_orm", "deadpool_postgres",
    // filesystem (async_fs = smol; fs_err = std::fs wrapper; tempfile; glob) / entropy /
    // subprocess (async_process = smol; duct) / env (dotenvy/dotenv) / clock (time) / log / clipboard
    "memmap2", "fs_err", "async_fs", "tempfile", "glob",
    "rand", "getrandom", "fastrand",
    // entropy: the password-hashing tier (salt mints + bcrypt's internal salt) + the OsRng source
    "argon2", "bcrypt", "scrypt", "pbkdf2", "password_hash", "rand_core",
    "portable_pty", "async_process", "duct",
    "dotenvy", "dotenv",
    "chrono", "time", "tracing", "log", "arboard",
    // compiler diagnostic emission (a dylint lint's output) — see the Log rules in classify
    "rustc_lint", "rustc_errors",
    // raw syscalls via FFI — the syscall-name table that lights up the FFI-thin tier (nix is routed
    // through the same table by leaf name, so a consumer of nix is covered without nix's own source)
    "libc", "nix", "rustix",
    // coverage-differential additions (verb-keyed; see the per-crate rules near the end of classify):
    // sync TLS core + native-tls variants (Net); env/dir resolution + argv + LS_COLORS (Env);
    // sqlx-core execution terminals (Net/Db); directory walk + timestamp mutation + same-file (Fs);
    // process-spawn helpers (Exec); signal handler + interactive-tty prompts (Ipc); env_logger (Log);
    // jiff/backoff clock reads (Clock).
    "rustls", "native_tls_crate", "tokio_native_tls",
    "etcetera", "wild", "lscolors",
    "sqlx_core", "walkdir", "filetime", "clircle",
    "execute", "ctrlc", "clap", "jiff", "env_logger",
    "dialoguer", "console", "terminal_colorsaurus", "backoff", "grep_cli",
    // TUI: the terminal is a user dialogue channel (Ipc), exactly as dialoguer/console already rule.
    // crossterm does the tty I/O; ratatui renders to a Buffer and drives a backend that does.
    "crossterm", "ratatui",
    // tracing_subscriber: the fmt INIT terminals write program output (Log); the EnvFilter constructors
    // read RUST_LOG (Env). Everything else — layers, formatters, filter types — is a builder.
    "tracing_subscriber",
];

pub const CALIBRATED_PREFIXES: [&str; 3] = ["aws_sdk_", "aws_smithy", "cap_"];

/// Crates `classify` matches by PATH prefix rather than crate-name equality (their effectful modules
/// are recognised, e.g. `tokio::net::`/`async_std::fs::`/`mio::net::`), so they're absent from
/// `CALIBRATED_CRATES` (which the liveness test probes by crate name). The coverage check must still
/// treat them as *covered* — otherwise it would mislabel the most common async crates as blind spots.
pub const PATH_CALIBRATED_CRATES: [&str; 3] = ["tokio", "async_std", "mio"];

/// The FFI-thin syscall crates whose `CALIBRATED_CRATES` membership is INCOMPLETE BY DESIGN.
///
/// For every OTHER calibrated crate, "classify returned None" is a REVIEWED verdict — the table covers
/// the crate's effectful surface, so a miss means the call really is pure, and candor-scan's coverage
/// ledger exempts all of `CALIBRATED_CRATES` from blind-spot disclosure on exactly that theory (a
/// calibrated crate's silence is informative). That does not hold for `libc`/`nix`/`rustix`: the table
/// above DELIBERATELY skips their generic fd verbs (`read`/`write`/`close`/`lseek`/`dup`/`fcntl`/...)
/// because a fixed label would mis-categorise an ambiguous fd (file? socket? pipe?) as often as it
/// helps — an honest no-classify, not a purity finding. Real programs that touch these crates go
/// through those exact verbs constantly (`libc::read(fd, ..)` IS the effect, not a builder step), so the
/// blanket exemption converted "no rule here" into a confident, silent purity claim: `fn drain(fd: i32)
/// { libc::read(fd, buf, 64); }` reported zero effects AND zero disclosure (R59, SOUNDNESS.md) — worse
/// than an uncalibrated dependency, which at least discloses `invisible`.
///
/// Consumed ONLY by candor-scan's coverage-ledger filter (the same one-consumer site
/// `coverage_has_exactly_one_anchor_and_exactly_one_consumer` enforces), to carve these three OUT of the
/// `CALIBRATED_CRATES` exemption there — an unclassified call into them still joins the ledger and
/// disclosed `invisible`, exactly like a call into an uncalibrated dependency, while their CLASSIFIED
/// calls (`open`/`close`/`socket`/...) are untouched (they never reach the ledger at all — see
/// `blind_direct`'s `classified.is_none()` gate). Deliberately NOT removed from `CALIBRATED_CRATES`
/// itself: that list means "classify has SOME live rules here" (true — the FS/NET/EXEC/IPC/ENV/CLOCK/
/// RAND tables all fire for these three), and stays the honest `.calibrated.json` sidecar contract.
pub const CALIBRATED_BUT_PARTIAL_CRATES: [&str; 3] = ["libc", "nix", "rustix"];

/// SOUNDNESS R311 — the version each calibrated crate's rules were actually WRITTEN AGAINST.
///
/// `CALIBRATED_CRATES` converts "no rule matched" into "reviewed, and pure", with no disclosure. That
/// claim is evidence about SOURCE SOMEONE READ, and it was being granted on the crate NAME alone — so
/// an upstream release extended it, silently, to code that did not exist when the review happened.
/// Measured 2026-09-07: the sea_orm rule block says in terms that it was "verified against sea-orm
/// 1.1.20 source"; the calibrated fixture resolved 2.0.2, whose `DatabaseExecutor`,
/// `RestrictedConnection`, `RestrictedTransaction`, `RbacContext` and `RusqliteSharedConnection` carry
/// 43 public entry points that no rule can name and every one of which read PURE.
///
/// A crate resolving ABOVE its ceiling is downgraded to `CALIBRATED_BUT_PARTIAL_CRATES` behaviour:
/// matched calls keep their rules (they are still right), unmatched calls rejoin the ledger and
/// disclose `invisible` instead of reading as reviewed-pure. Fail-closed AT THE POINT THE CLAIM IS
/// MADE — the coverage gate can only ever notify us afterwards.
///
/// EXACT, not major-only, and the direction is deliberate: an exact ceiling fails NOISY (a minor bump
/// discloses until someone re-reviews and moves the line) while major-only fails SILENT — and the
/// minor direction is not hypothetical, since redis 1.6.0 -> 1.7.0 and mongodb 3.8.1 -> 3.9.0 both
/// produced real uncovered entry points in the same measurement. Per the family's denylist rule, start
/// strict and relax against measured disclosure volume, never the reverse.
///
/// A crate ABSENT from this table keeps its unconditional exemption: the ceiling is a denylist of
/// versions known to be beyond the review, not an allowlist of versions blessed by it. Adding a crate
/// here is what makes its claim honest, so the table is expected to grow toward `CALIBRATED_CRATES`.
// SOUNDNESS R328 — this table is MERGED, never rewritten. `bbd7615` replaced it wholesale with a
// freshly-computed dict and silently dropped NINE entries (dialoguer, dotenv, dotenvy, grep_cli, isahc,
// lettre, portable_pty, tempfile, postgres) while its own commit message claimed "four crates are
// deliberately absent, each with a stated reason in the code". Eight had no stated reason and every one
// of them cites a version in its own rules — they are exactly the crates the ceiling exists to protect,
// and the protection would have been gone the moment any of them published. Effect classes at stake:
// Net (isahc), SMTP (lettre), Exec (portable_pty), Fs (tempfile), Env (dotenv/dotenvy), Ipc (dialoguer).
//
// DELIBERATELY ABSENT, and this is the complete list:
//   postgres  — R313. Its recorded 0.7.10 was TOKIO-postgres's version, lifted by a regex from a comment
//               about a different crate; postgres ships 0.19.x. No verified baseline exists and inventing
//               one is the claim-without-review this table exists to stop.
//   async_fs, getrandom — their rules match on CRATE NAME alone, so no path can go stale.
//   rand_core — R320/R333 unresolved.
pub const CALIBRATED_CEILINGS: [(&str, &str); 70] = [
    ("arboard", "3.6.1"),
    ("argon2", "0.6.0"),
    ("async_nats", "0.35.1"),
    ("async_process", "2.5.0"),
    ("aws_config", "1.12.0"),
    ("backoff", "0.4.0"),
    ("bcrypt", "0.19.3"),
    ("chrono", "0.4.45"),
    ("clap", "4.6.6"),
    ("clircle", "0.6.1"),
    ("console", "0.15.11"),
    ("crossterm", "0.28.1"),
    ("ctrlc", "3.5.2"),
    ("curl", "0.4.50"),
    ("deadpool_postgres", "0.14.2"),
    ("dialoguer", "0.12.0"),
    ("diesel", "2.3.13"),
    ("dotenv", "0.15.0"),
    ("dotenvy", "0.15.7"),
    ("duct", "1.1.2"),
    ("elasticsearch", "8.19.0-alpha.1"),
    ("env_logger", "0.11.11"),
    ("etcetera", "0.11.0"),
    ("execute", "0.3.0"),
    ("fastrand", "2.5.0"),
    ("filetime", "0.2.29"),
    ("fs_err", "3.3.1"),
    ("git2", "0.20.4"),
    ("glob", "0.3.4"),
    ("grep_cli", "0.1.12"),
    ("ignore", "0.4.33"),
    ("isahc", "2.0.1"),
    ("jiff", "0.2.35"),
    ("lapin", "4.10.0"),
    ("lettre", "0.11.23"),
    ("log", "0.4.34"),
    ("lscolors", "0.21.0"),
    ("memmap2", "0.9.11"),
    ("mongodb", "3.8.1"),
    ("mysql", "28.0.0"),
    ("mysql_async", "0.37.0"),
    ("native_tls_crate", "0.2.18"),
    ("notify", "8.2.0"),
    ("password_hash", "0.6.1"),
    ("pbkdf2", "0.13.0"),
    ("pnet", "0.35.0"),
    ("portable_pty", "0.9.0"),
    ("rand", "0.10.2"),
    ("ratatui", "0.29.0"),
    ("rdkafka", "0.39.0"),
    ("redis", "1.6.0"),
    ("reqwest", "0.13.4"),
    ("rusqlite", "0.39"),
    ("rustls", "0.23.43"),
    ("scrypt", "0.12.0"),
    ("sea_orm", "1.1.20"),
    ("sqlx", "0.9.0"),
    ("sqlx_core", "0.9.0"),
    ("tempfile", "3.27.0"),
    ("terminal_colorsaurus", "1.0.3"),
    ("time", "0.3.55"),
    ("tokio_native_tls", "0.3.1"),
    ("tokio_postgres", "0.7.18"),
    ("tonic", "0.12.3"),
    ("tracing", "0.1.44"),
    ("tracing_subscriber", "0.3.23"),
    ("tungstenite", "0.30.0"),
    ("ureq", "2.12.1"),
    ("walkdir", "2.5.0"),
    ("wild", "2.2.1"),
];

/// `true` when `resolved` is a version this crate's rules were NOT written against — i.e. strictly
/// newer than its ceiling. Unknown crate, unparseable version, or an exact match: `false`, keep the
/// exemption. Comparison is numeric per dotted component so `1.10.0 > 1.9.0`; a pre-release or build
/// suffix on the resolved version is treated as ABOVE the release it decorates, which is the
/// charging direction.
/// Version-only comparison: is `a` strictly newer than `b`? Shared with `candor-scan`'s lockfile
/// parser so "which of two versions of one crate do we keep" is answered by the SAME comparator that
/// decides whether a version is beyond review — one authority, not two spellings that drift.
pub fn calibration_exceeded_raw(a: &str, b: &str) -> bool {
    let parts = |v: &str| -> Vec<u64> {
        v.split(['+', '-']).next().unwrap_or("")
            .split('.')
            .map(|p| p.parse::<u64>().unwrap_or(0))
            .collect()
    };
    let (x, y) = (parts(a), parts(b));
    for i in 0..x.len().max(y.len()) {
        let (p, q) = (x.get(i).copied().unwrap_or(0), y.get(i).copied().unwrap_or(0));
        if p != q {
            return p > q;
        }
    }
    a != b
}

pub fn calibration_exceeded(crate_name: &str, resolved: &str) -> bool {
    let Some((_, ceiling)) = CALIBRATED_CEILINGS.iter().find(|(c, _)| *c == crate_name) else {
        return false;
    };
    let parts = |v: &str| -> Vec<u64> {
        v.split(['+', '-']).next().unwrap_or("")
            .split('.')
            .map(|p| p.parse::<u64>().unwrap_or(0))
            .collect()
    };
    let (r, c) = (parts(resolved), parts(ceiling));
    if r.is_empty() {
        return false;
    }
    for i in 0..r.len().max(c.len()) {
        let (a, b) = (r.get(i).copied().unwrap_or(0), c.get(i).copied().unwrap_or(0));
        if a != b {
            return a > b;
        }
    }
    // Equal numerically: a pre-release/build suffix means it is not the reviewed artifact.
    resolved != *ceiling
}


/// Crates REVIEWED AND FOUND TO PERFORM NO EFFECT OF THEIR OWN — the κ ledger treats them as covered, so
/// their calls stop being disclosed blind spots.
///
/// SEPARATE FROM `CALIBRATED_CRATES` BY NECESSITY, not taste. That list means "classify has effect rules
/// here", and `calibrated_crates_are_live` fails any entry no rule matches — "a dead entry would silently
/// suppress a real coverage warning". A genuinely pure crate has no rule to be live, so it cannot go
/// there; without this list the only way to silence its noise would be to invent a rule, which is worse.
///
/// **THIS LIST MANUFACTURES PURITY CLAIMS, so an entry needs evidence and not a reputation.** A crate here
/// stops being disclosed and starts being believed. Each of these was checked against its source in the
/// local cargo registry for `std::{fs,net,process,env}` and stdio use, and every apparent hit was a DOC
/// COMMENT (serde_json's `/// [`File`]: std::fs::File`, serde_yml's `///  io::stdout()`):
///
///   serde_json 1.0.151, serde_yml 0.0.12, toml 1.1.3, regex 1.13.1, sha2 0.11.0
///
/// `color_eyre` was on the same filing and is NOT here — FETCHED AND CHECKED 2026-08-03, and it is not
/// pure. It reads `RUST_BACKTRACE` / `RUST_LIB_BACKTRACE` / `RUST_SPANTRACE` / `COLORBT_SHOW_HIDDEN`
/// (Env, `config.rs:939..1175`) and **opens source files to render code snippets** (Fs,
/// `config.rs:248`). It is also not CALIBRATED, deliberately: the `File::open` sits inside
/// `impl fmt::Display for SourceSection`, reached when a report is RENDERED rather than through any named
/// verb a caller invokes — so there is no path for a rule to match, and calibrating the crate would turn
/// that render path into an unmatched path, i.e. a PURITY CLAIM over the file read. Its calls therefore
/// stay disclosed as a blind spot. The noise is real; it is also honest, and that is the right trade.
///
/// THE SERIALIZER CAVEAT, worth stating because it is the one that looks wrong: `serde_json::from_reader`
/// and `to_writer` do move bytes — but through a handle the CALLER had to obtain, and obtaining it (a
/// `File::open`, a `TcpStream::connect`) is already classified on the caller. The crate performs no
/// syscall of its own, so charging it would double-count an effect the caller already carries.
pub const REVIEWED_PURE_CRATES: [&str; 5] = ["serde_json", "serde_yml", "toml", "regex", "sha2"];

/// The completeness gate's escape hatch (`eval/coverage-gate/`, `tests/coverage_gate.rs`): exact
/// (crate, consumer-facing path) pairs a human has read and found genuinely pure, despite `candor-scan`
/// self-scanning the crate's own vendored source finding a reachable Fs/Net/Db/Exec effect there. SEPARATE
/// from `REVIEWED_PURE_CRATES` — that list exempts a WHOLE crate from the coverage LEDGER's crate-level
/// disclosure; this one exempts a single ENTRY from the completeness GATE's per-function differential.
/// The gate's generator run (2026-08-27) found 669 self-scan-confirmed entries `classify()` already
/// recognizes (checked in as `covered.tsv`, asserted every push) and 251 it did not yet recognize under
/// any guessed spelling (checked in as `open.tsv`, a ratchet — NOT individually hand-verified, see that
/// file's header). An `open.tsv` row belongs here ONLY once read against the crate's real source and
/// confirmed to perform no effect (the SAME evidence bar `REVIEWED_PURE_CRATES` documents) — until then
/// it stays in the ratchet as an open question, not a silent assumption. The five below were the first
/// batch, from the 2026-08-27 coverage-gate triage:
///
///   - `curl::Multi::timeout` — this file's own `curl` rule (above) already documents WHY: `Easy::
///     timeout` is a pure `CURLOPT_TIMEOUT` setter sharing the `::timeout` leaf, and an under-report on
///     the rare event-loop kick beats mis-tagging every consumer that sets a timeout.
///   - `execute::command` / `execute::shell` — this file's own `execute` rule (above) already documents
///     WHY: both free functions only BUILD a `std::process::Command` (no `.spawn()`/`.output()`/
///     `.status()` call in either body) and return it to the caller, who spawns it themselves — the
///     caller's own `Command::spawn()` carries the effect. Self-scan's raw "Exec" signal comes from
///     `std::process::Command::new`'s coarse whole-type rule (constructing a `Command` is Exec by
///     default, narrowed only for crates like `async_process` that document their own pure-setter
///     surface), not from an actual subprocess launch in either function.
///   - `elasticsearch::Response::content_type` — a pure accessor reading a header off an ALREADY-received
///     response (`self.response.headers().get(..)`, http/response.rs:61) — no I/O of its own. Self-scan's
///     raw "Net" signal is the underlying HTTP client response type's coarse whole-type propagation, not
///     a second network round-trip.
///   - `rusqlite::Context::get_connection` — this file's own rusqlite rule (above) already documents WHY:
///     it hands back a `ConnectionRef` BORROWED from the ALREADY-established connection a running SQL
///     function executes within (`ffi::sqlite3_context_db_handle`, not a syscall) — the same "handle
///     accessor, not a syscall" shape as `TcpStream::local_addr`.
///
/// The next two (2026-08-28, the widened-CORE audit's `Ipc` batch — see `eval/coverage-gate/generate.py`
/// for why `Ipc` only entered the trigger set that day) are a DIFFERENT reason than the five above: not
/// "no effect", but genuinely UNREACHABLE — the item really does perform the effect self-scan found, but
/// no external consumer can ever name it, because the module it lives in is declared with no `pub` at
/// all and neither the module nor the item is re-exported anywhere in the crate root (checked against
/// real source, both ways):
///   - `dialoguer::Paging::render_prompt` — `dialoguer::paging` is a bare `mod paging;` (dialoguer
///     0.12.0, lib.rs:62: `use paging::Paging;`, not `pub use`), so `pub struct Paging` and its `pub fn
///     render_prompt` (which DOES call `Term::flush`, a real Ipc effect per this file's own `console`
///     rule) are internal machinery every `Select`/`MultiSelect`-style prompt uses to render its own
///     paginated view — the effect is already charged at THOSE public entry points' own `::interact*`
///     rule (above), not double-counted here.
///   - `mysql::Stream::connect_socket` — `mysql::io` is a bare `mod io;` (mysql 28.0.0, lib.rs:897, no
///     `pub use` of `io::*` or `Stream` anywhere), so `pub enum Stream` and its `pub fn connect_socket`
///     (a real Unix-domain-socket `connect()`, Ipc) are reachable only from within the crate's own
///     connection-establishment code — a real consumer can't name `mysql::Stream` at all, let alone call
///     a bare constructor on it.
pub const REVIEWED_PURE_ENTRIES: &[(&str, &str)] = &[
    ("curl", "curl::Multi::timeout"),
    ("execute", "execute::command"),
    ("execute", "execute::shell"),
    ("elasticsearch", "elasticsearch::Response::content_type"),
    ("rusqlite", "rusqlite::Context::get_connection"),
    ("dialoguer", "dialoguer::Paging::render_prompt"),
    ("mysql", "mysql::Stream::connect_socket"),
];

/// Representative path tails (each appended to a crate name) that the `calibrated_crates_are_live`
/// liveness test probes: at least one must match for every `CALIBRATED_CRATES` entry, else the entry is
/// dead. Exported as ONE source of truth because the nightly lint crate (`src/lib.rs`) runs the SAME
/// liveness test — when the two probe lists were duplicated they drifted, and a rule keyed on a
/// distinctive tail (pnet `::datalink::channel`, ignore `::WalkBuilder::build_parallel`, notify
/// `::RecommendedWatcher::new`) added to only one list silently broke the other crate's `cargo test`.
pub const CALIBRATION_PROBE_TAILS: &[&str] = &[
    "::X::send", "::X::execute", "::X::call", "::X::query", "::X::fetch_one", "::Remote::fetch",
    "::datalink::channel", "::WalkBuilder::build_parallel", "::RecommendedWatcher::new",
    "::X::connect", "::Utc::now", "::X::load", "::__private_api::log", "::tempfile", "::glob",
    "::X::run", "::dotenv", "::random", "::emit", "::X::emit_span_lint", "::X::anything",
    "::X::draw",
    "::SaltString::generate", "::hash", "::OsRng::fill_bytes",
    // verb-precise crates whose whole-crate rules were narrowed to the effectful surface (the pure
    // accessors/ctors/data-types now return None), so the liveness probe must name an EFFECTFUL path:
    "::Mmap::map", "::event", "::u32", "::Clipboard::get_text", "::spawn_command",
    // coverage-differential crates (each needs ≥1 effectful tail; existing tails already cover
    // native_tls_crate/tokio_native_tls/sqlx_core via ::X::connect, execute via ::X::execute, jiff via ::now):
    "::read_tls", "::home_dir", "::args", "::from_env", "::IntoIter::next", "::set_file_mtime",
    "::surely_conflicts_with", "::set_handler", "::get_matches", "::init", "::interact",
    "::write_line", "::background_color", "::retry", "::build",
];

/// Database client crates whose execution verbs are I/O (see the DB branch in `classify`).
/// Module-level so `db_crates_are_calibrated` can enforce `DB_CRATES ⊆ CALIBRATED_CRATES`.
pub const DB_CRATES: [&str; 11] = [
    "sqlx", "rusqlite", "postgres", "tokio_postgres", "diesel", "redis", "mongodb",
    "mysql", "mysql_async", "sea_orm", "deadpool_postgres",
];

/// Pure file-descriptor *ownership-transfer* leaves. These ADOPT an already-open descriptor
/// (`from_raw_fd`/`from_raw_socket`/`from_raw_handle`), EXTRACT/BORROW one
/// (`into_raw_fd`/`into_raw_socket`/`into_raw_handle`, `as_raw_fd`/`as_raw_socket`/`as_raw_handle`),
/// or UNWRAP an async wrapper back to its std type (`into_std`) — none of them issue a syscall or
/// perform I/O. calling a PURE function effectful is a FABRICATION — the precision failure (candor's cardinal sin is the opposite direction, the silent under-report) — and these collide with the
/// coarse std-type PREFIX rules (`std::net::TcpStream`/`std::fs::File`/`std::os::unix::net` → Net/Fs/Ipc)
/// even though the descriptor was opened ELSEWHERE. The portable_pty/async_process Exec rule already
/// exempts `from_raw_fd`; this generalises the same carve-out across the net/fs/ipc prefix rules.
/// (Found by a real-world sweep of tokio: `TcpStream::into_std`, `*::from_raw_fd`, `*::as_raw_fd` all
/// fabricated Net/Fs/Ipc.)
const PURE_FD_TRANSFER: &[&str] = &[
    "from_raw_fd", "from_raw_socket", "from_raw_handle",
    "into_raw_fd", "into_raw_socket", "into_raw_handle",
    "as_raw_fd", "as_raw_socket", "as_raw_handle",
    "into_std",
    // `SocketAddr::from_pathname` (std/async-std unix net) builds an address STRUCT from a path —
    // it opens no socket. The `std::os::unix::net` prefix rule below would otherwise fabricate Ipc
    // on it. (Found sweeping socket2: `SockAddr::as_unix` → `from_pathname` reported Ipc.)
    "from_pathname",
];

/// The std I/O **handle** types whose methods the scanner's receiver inference may route into
/// `classify` as `Type::method`.
///
/// WHY A LIST AND NOT "std". The std rules in `classify` are a MIXTURE: a few are type-precise with
/// reviewed pure-accessor carve-outs (`std::net::TcpStream` → Net minus `local_addr`/`peer_addr`/…;
/// `std::process::Command` → Exec minus `get_program`/`get_args`/…), but most are coarse MODULE
/// prefixes (`std::fs::` → Fs) written for free functions and constructors. Applied to arbitrary
/// method calls, a coarse prefix charges an effect for reading a struct field: `std::fs::Metadata`,
/// `DirEntry`, `Permissions` and `FileType` all sit under `std::fs::` and are pure DATA. So the
/// scanner used to skip EVERY std-rooted receiver — which shut the door on the pure data types and on
/// the real handles alike, and `fn run(cmd: &mut Command) { cmd.spawn(); }` certified PURE while it
/// spawned a process (a silent false all-clear; the `cc` crate's `command_helpers::spawn` was a live
/// instance). This list re-opens the door for the handles ONLY.
///
/// MEMBERSHIP RULE, and the reason it is safe to apply a whole-type rule to an inferred method call:
/// a type belongs here only when EVERY method on it is either the effect itself or an already-carved-
/// out pure read-back. That holds for an open descriptor's handle — a `File`/`TcpStream`/`Child` does
/// nothing but I/O on the thing it owns — and the `PURE_FD_TRANSFER` guard at the top of `classify`
/// exempts the `as_raw_fd`/`into_std` family for all of them before any prefix rule runs.
///
/// THE OPTION-BUILDERS, `OpenOptions` and `DirBuilder`, were absent for exactly this rule and now
/// satisfy it: each has a type-keyed carve-out in `classify` subtracting its pure setters, so only its
/// TERMINAL VERB (`open` / `create`) is Fs. The exclusion was written as "a narrow residual, not the
/// reported hole" and MEASURED otherwise — `fn load(o: &OpenOptions, p: &Path) { o.open(p) }` opened a
/// file and reported NOTHING, the same silent false all-clear as the `Command` parameter, while a
/// setter-only `OpenOptions::new().read(true)` reported `Fs` for opening nothing. The order the old
/// comment prescribed is the order taken: the verb-precise rules went in FIRST, and this list widened
/// onto them. `ReadDir` stays out — its `next` IS a syscall, but nothing distinguishes it from any
/// other iterator's `next`, so no verb-precise rule can be written and the honest miss stands.
///
/// `std::path::Path`/`PathBuf` are NOT here: they are pure data with an effectful STAT sub-surface —
/// the exact inverse shape — and they route through their own verb-precise carve-out in the scanner.
const STD_EFFECT_HANDLES: &[&str] = &[
    // Exec — the whole type is the subprocess boundary (`new` names a program, `arg`/`env` build the
    // invocation, `spawn`/`output`/`status` run it); the read-back getters are already carved out.
    "std::process::Command",
    "std::process::Child",
    // Net — an open socket. `connect`/`accept`/`read`/`write`/`shutdown`/`set_*` are socket syscalls;
    // `local_addr`/`peer_addr`/`nodelay`/`ttl`/`take_error` are carved out.
    "std::net::TcpStream",
    "std::net::TcpListener",
    "std::net::UdpSocket",
    // Ipc — a Unix-domain socket, the same shape as the TCP/UDP handles above.
    "std::os::unix::net::UnixStream",
    "std::os::unix::net::UnixListener",
    "std::os::unix::net::UnixDatagram",
    // Fs — an open file. Every method reads, writes, syncs, truncates or stats it; the descriptor
    // conversions are carved out by `PURE_FD_TRANSFER`.
    "std::fs::File",
    // Fs — the option-builders, whose PURE setters are subtracted by the type-keyed carve-outs in
    // `classify` so that only the terminal verb (`OpenOptions::open`, `DirBuilder::create`) routes to Fs.
    "std::fs::OpenOptions",
    "std::fs::DirBuilder",
];

/// Is `ty` a std I/O handle type whose methods may be routed into `classify` by the scanner's
/// receiver inference? See `STD_EFFECT_HANDLES` for the membership rule and the named exclusions.
pub fn is_std_effect_handle(ty: &str) -> bool {
    STD_EFFECT_HANDLES.contains(&ty)
}

/// Classify a resolved callee by the crate it belongs to and its full path.
pub fn classify(crate_name: &str, path: &str) -> Option<&'static str> {
    // Pure fd ownership-transfer/extraction leaves are never an effect, regardless of which std I/O
    // type they hang off — exempt them BEFORE the coarse prefix rules can fabricate Net/Fs/Ipc.
    if PURE_FD_TRANSFER.contains(&path.rsplit("::").next().unwrap_or(path)) {
        return None;
    }
    if crate_name.starts_with("aws_sdk_") || crate_name.starts_with("aws_smithy") {
        // Only request dispatch is network I/O; builder setters/accessors are pure.
        if path.ends_with("::send") || path.ends_with("::send_with") {
            return Some("Net");
        }
        return None;
    }
    // aws-config resolves credentials/region on `.load()` — it reaches the IMDS metadata
    // endpoint / STS over the network (and reads ~/.aws + env). Builders (`defaults()`,
    // `SdkConfig::builder()`, `BehaviorVersion::latest()`) are pure; the `load` is the I/O.
    // (Found hardening on a real app, ebman: `builder.load().await` was classified pure.)
    //
    // THE FIX: `load_from_env()` (lib.rs:170/188, both the `behavior-version-latest` and deprecated
    // forms) is `from_env().load().await` / `load_defaults(latest).await` one call down — the crate's OWN
    // "convenience wrapper" (its own doc comment's phrase) around the already-modelled `.load()` — but
    // `"load_from_env".ends_with("::load")` is false, so the wrapper read pure. Same vein as
    // `ignore::Walk::new`.
    if crate_name == "aws_config" {
        if path.ends_with("::load") || path.ends_with("::load_defaults") || path.ends_with("::load_from_env") {
            return Some("Net");
        }
        return None;
    }
    // git2 (libgit2 FFI): remote operations contact the network; everything else is local
    // to the .git directory. Match the remote verbs precisely — NOT bare `::clone`, which is
    // the `Clone`-trait dup of a `Remote` handle (pure), not `Repository::clone`. (Found
    // hardening on gitui: `remote.fetch`/`remote.push` were classified network-free — a git
    // client reporting it makes no network calls.)
    //
    // `Repository::clone`/`clone_recurse`/`clone_local`/`init` (via `RepoBuilder::clone`) IS the
    // thing the comment above named and then excluded anyway: the bare `::clone` denylist meant
    // to keep out `Remote::clone` (the derived trait dup) also swallowed `Repository::clone` —
    // libgit2's actual network clone, and arguably git2's single most common entry point. A
    // fabrication corpus round caught it: `git2::Repository::clone(url, path)` reported ZERO
    // effects and passed `deny Net` at exit 0. FQN-exact (like the `reqwest::get` disambiguation
    // a few lines up) so the fix doesn't just re-widen `::clone` and reintroduce the very
    // over-charge the comment was written to prevent: `Remote::clone` (and `Repository::clone`'s
    // own `Clone` derive, if it has one) must still read pure.
    if crate_name == "git2" {
        if path.ends_with("::fetch")
            || path.ends_with("::push")
            || path.ends_with("::download")
            || path.ends_with("::connect")
            || path.ends_with("::connect_auth")
            || path.ends_with("::ls")
            || path.ends_with("::upload")
            || path == "git2::Repository::clone"
            || path == "git2::Repository::clone_recurse"
            || path == "git2::build::RepoBuilder::clone"
            // A FOURTH+FIFTH true positive in the same gap the `Repository::clone` fix left open:
            // `Submodule::clone`/`Submodule::update` (submodule.rs:39,234) call `raw::git_submodule_clone`/
            // `git_submodule_update` DIRECTLY — the exact FFI leaves already in this file's own
            // FFI-tier NET table below, but only when a caller names the raw `ffi`/`raw::` leaf itself.
            // git2's documented, standard submodule-init idiom (`sub.clone(None)` /
            // `sub.update(true, None)`) never does that — it calls the safe wrapper, which carried no
            // rule of its own and read pure under `deny Net`. FQN-exact, matching the `Repository::clone`
            // fix's own discipline: a bare `::update`/`::clone` substring would sweep in git2's many pure
            // `update_*` setters (`CheckoutBuilder::update_only`, `DiffOptions::update_index`, …) and the
            // derive-`Clone` dup on every other git2 type.
            || path == "git2::Submodule::clone"
            || path == "git2::Submodule::update"
            // `Remote::list`/`RemoteConnection::list` (remote.rs:378,755) call `raw::git_remote_ls`
            // directly — the reference-advertisement fetch already in the FFI-tier NET table below,
            // reached the same way `Submodule::clone`/`update` were: the safe wrapper's OWN name
            // (`list`, not `ls`) never matched the `::ls` suffix this block already carried (which, on
            // git2 0.20, matches no real method at all — dead weight kept for whatever older API it once
            // fit). FQN-exact so a `list` on some other git2 type (none exist today, but the same
            // discipline as `Submodule::clone` above) can't be swept in by a bare suffix later.
            || path == "git2::Remote::list"
            || path == "git2::RemoteConnection::list"
        {
            return Some("Net");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27): every one of these is a public entry point whose body
        // calls a `raw::git_*` FFI leaf ALREADY in this file's own FS FFI-tier table below (config.rs/
        // index.rs/odb.rs/packbuilder.rs/reference.rs/repo.rs/treebuilder.rs, verified against git2
        // 0.20.4 source) — but that table is UNREACHABLE for a real consumer's call, because it only
        // fires when self-scan resolves the FFI leaf's OWN crate (`libgit2_sys`, via git2's internal
        // `use libgit2_sys as raw`), never for `crate_name == "git2"`, which returns from THIS block
        // first. A consumer never spells `raw::git_repository_open`; they call `git2::Repository::open`,
        // which fell through this entire branch to `None` — the exact `ignore::Walk::new` shape (a
        // lower-level rule the top-level entry point never reaches) but affecting git2's single most
        // common local operations (`Repository::open`/`init`), not an edge case. FQN-exact, not a
        // `::open`/`::write`/`::read` suffix — those verbs are common enough elsewhere (`Odb::reader`
        // isn't `::read`, `TreeBuilder`/`Index`/`PackBuilder::write` share the name with plenty of pure
        // builder setters on other types) that a bare suffix would either miss these or over-charge.
        if path == "git2::Config::add_file"
            || path == "git2::Config::open"
            || path == "git2::Config::open_default"
            || path == "git2::Index::add_all"
            || path == "git2::Index::add_path"
            || path == "git2::Index::read"
            || path == "git2::Index::write"
            || path == "git2::Index::write_tree"
            || path == "git2::Index::write_tree_to"
            || path == "git2::Odb::read"
            || path == "git2::Odb::reader"
            || path == "git2::Odb::write"
            || path == "git2::Odb::writer"
            || path == "git2::PackBuilder::write"
            || path == "git2::Reference::delete"
            || path == "git2::Reference::set_target"
            || path == "git2::Repository::blob_path"
            || path == "git2::Repository::checkout_head"
            || path == "git2::Repository::checkout_index"
            || path == "git2::Repository::checkout_tree"
            || path == "git2::Repository::commit"
            || path == "git2::Repository::discover"
            || path == "git2::Repository::discover_path"
            || path == "git2::Repository::init"
            || path == "git2::Repository::init_bare"
            || path == "git2::Repository::init_opts"
            || path == "git2::Repository::open"
            || path == "git2::Repository::open_bare"
            || path == "git2::Repository::open_ext"
            || path == "git2::Repository::open_from_env"
            || path == "git2::Repository::reference"
            || path == "git2::Repository::tag"
            || path == "git2::TreeBuilder::write"
        {
            return Some("Fs");
        }
        // `Cred::credential_helper` (cred.rs:121) calls `CredentialHelper::execute` (cred.rs:326),
        // which — on every code path — spawns a REAL `sh -c "<helper> get"` (or, if `sh` itself fails to
        // spawn, the helper binary directly) via `std::process::Command::spawn` to resolve
        // `credential.helper`-configured auth (cred.rs:370-390): a real subprocess launch a caller
        // authenticating against a private remote is one call away from (`Cred::credential_helper(cfg,
        // url, user)` is the crate's own documented way to honor `credential.helper`), not a lower-level
        // implementation detail. FQN-exact: `execute` alone is far too generic to key on blindly.
        if path == "git2::Cred::credential_helper" || path == "git2::CredentialHelper::execute" {
            return Some("Exec");
        }
        return None;
    }
    // libc — raw syscalls via FFI. The FFI-thin tier (nix, and the syscall layer beneath rusqlite/git2)
    // is invisible to a name classifier unless we model libc directly: a 35-crate calibration
    // (eval/calibration) showed nix reporting ZERO library effects because every wrapper bottoms out in
    // an unrecognised `libc::*` call. Classify by syscall name, but ONLY the UNAMBIGUOUS ones — the
    // socket family is Net, path/dir syscalls are Fs, spawn/exec/wait is Exec, SysV/pipe IPC is Ipc,
    // env/clock/entropy each their own. We deliberately SKIP the generic file-descriptor ops
    // (read/write/close/lseek/dup/fcntl/ioctl/poll/select/epoll*/mmap): they operate on ANY fd — file,
    // socket, or pipe — so a fixed label would mis-categorise as often as it helps. An honest
    // no-classify (under-report) beats emitting the WRONG effect. Pure conversions (htons/inet_pton/
    // gmtime) are also skipped.
    //
    // `nix` (the idiomatic SAFE libc wrapper, in ~every Rust systems/CLI crate) is routed through the
    // SAME table: its functions keep the syscall leaf name (`nix::fcntl::open`, `nix::sys::socket::connect`,
    // `nix::unistd::execvp`). Without this, a CONSUMER of nix analysed without nix's own source (the
    // stable scanner, single-crate) sees `nix::*` cross-crate and under-reports — serialport-rs opens its
    // device via `nix::fcntl::open` and reported ZERO Fs. The nightly lint reaches `libc::*` THROUGH nix's
    // body; this gives the scanner the same coverage directly. (Found sweeping serialport-rs.)
    // `rustix` is the same shape as nix but does RAW syscalls (no libc underneath), so its functions MUST
    // be classified directly. Its leaf names are the syscall names too (`rustix::time::clock_settime`,
    // `rustix::fs::mkfifoat`/`symlink`/`stat`, `rustix::net::connect`) — route it through the same table.
    // The rustix-specific `*at`/variant leaves it doesn't share with libc just under-report (the safe
    // direction). VALIDATED, not speculative: coreutils' `date` reads/sets the clock via
    // `rustix::time::clock_getres`/`clock_settime` and reported Clock=0; the file I/O that goes through
    // std::fs was already correct, which is why only the rustix-only effects (Clock/Ipc) were missing.
    if crate_name == "libc" || crate_name == "nix" || crate_name == "rustix" {
        let f = path.rsplit("::").next().unwrap_or(path);
        // path / directory / metadata syscalls (incl. *64 and *at variants) — `LIBC_FS`, hoisted to module
        // level so the AS-EFF-008 masking guard reads THE SAME TABLE (SOUNDNESS R806); see `masks_locator`.
        const FS: &[&str] = LIBC_FS;
        // socket family — these operate only on sockets, so Net is unambiguous (AF_UNIX domain isn't
        // visible at the call, so a Unix socket reads as Net rather than Ipc; acceptable over-general).
        const NET: &[&str] = LIBC_NET;
        // process creation / replacement / reaping
        const EXEC: &[&str] = LIBC_EXEC;
        // pipes / FIFOs / SysV + POSIX message queues, semaphores, shared memory; socketpair (AF_UNIX)
        const IPC: &[&str] = &[
            "pipe", "pipe2", "mkfifo", "mkfifoat", "socketpair", "msgget", "msgsnd", "msgrcv", "msgctl",
            "semget", "semop", "semtimedop", "semctl", "shmget", "shmat", "shmdt", "shmctl", "mq_open",
            "mq_send", "mq_receive", "mq_timedsend", "mq_timedreceive", "mq_close", "mq_unlink",
        ];
        const ENV: &[&str] = &["getenv", "secure_getenv", "setenv", "putenv", "unsetenv", "clearenv"];
        const CLOCK: &[&str] = &[
            "time", "gettimeofday", "clock_gettime", "clock_getres", "nanosleep", "clock_nanosleep",
            // SETTING the system clock is a clock effect too (was unclassified — found on coreutils `date`,
            // which sets it via `clock_settime`).
            "clock_settime", "settimeofday", "stime", "adjtime", "adjtimex", "clock_adjtime",
        ];
        const RAND: &[&str] = &["getrandom", "getentropy", "arc4random", "arc4random_buf", "arc4random_uniform"];
        if FS.contains(&f) {
            return Some("Fs");
        }
        if NET.contains(&f) {
            return Some("Net");
        }
        if EXEC.contains(&f) {
            return Some("Exec");
        }
        if IPC.contains(&f) {
            return Some("Ipc");
        }
        if ENV.contains(&f) {
            return Some("Env");
        }
        if CLOCK.contains(&f) {
            return Some("Clock");
        }
        if RAND.contains(&f) {
            return Some("Rand");
        }
        return None;
    }
    // C-library FFI bindings: libsqlite3 (under rusqlite) and libgit2 (under git2). Like the libc tier,
    // these crates are thin Rust over a C library, so their real I/O is invisible until the C entry
    // points are named. Match by the DISTINCTIVE C function name (`sqlite3_*` / `git_*`) via the call's
    // LEAF — independent of the binding crate's alias: rusqlite calls `ffi::sqlite3_step`, git2 calls
    // `raw::git_remote_fetch`, and the nightly lint resolves the same to `libsqlite3_sys`/`libgit2_sys`;
    // all spellings share the leaf. Only the I/O-performing entry points are listed — the in-memory
    // accessors (`sqlite3_bind_*`/`sqlite3_column_*`, `git_*_oid`/strarray/options builders) stay pure,
    // so a non-listed `sqlite3_`/`git_` leaf returns None (under-report, never a wrong effect). Calibrated
    // + validated against rusqlite 0.39 / git2 0.20 source (eval/calibration).
    {
        let leaf = path.rsplit("::").next().unwrap_or(path);
        if let Some(rest) = leaf.strip_prefix("sqlite3_") {
            let _ = rest;
            // SQLite C API operations that touch the database (open/exec/step/prepare/backup/blob/wal).
            //
            // SOUNDNESS R166 — MEMBERSHIP CRITERION, stated because the list was extended and the next
            // reader needs to know what "already audited" covers. A leaf belongs here when it either
            // (a) reads or writes DATABASE CONTENT (disk or the in-memory image), or (b) mutates the
            // registry of code the engine will later RUN — the extension/auto-extension registry, whose
            // effect is not local to the calling frame. The audit boundary was the WHOLE `sqlite3_*`
            // surface rusqlite 0.40.2 mentions (185 distinct symbols diffed against this list), not the
            // one name the row was filed for: `sqlite3_auto_extension` arrived with its `_cancel_`/
            // `_reset_` siblings and with four content-I/O leaves nobody had looked at.
            //
            // DELIBERATELY STILL ABSENT, so this is not read as "the surface is covered": the
            // CALLBACK-INSTALLING entry points (`sqlite3_create_function[_v2]`,
            // `sqlite3_create_window_function`, `sqlite3_create_collation_v2`, `sqlite3_create_module_v2`,
            // `sqlite3_*_hook`, `sqlite3_set_authorizer`, `sqlite3_progress_handler`, `sqlite3_trace_v2`).
            // Those register a UDF/hook on ONE connection for the life of that connection; they perform no
            // database I/O themselves, and the opaque-callback boundary is already disclosed by the
            // scanner's own `Unknown` at the call site that hands the function pointer across. The
            // auto-extension registry is the case that differs: it is PROCESS-GLOBAL and outlives every
            // connection, so its consequence cannot be attributed to a caller's own frame at all.
            // Unexamined and named as such: the libgit2 (`git_*`) table below got no equivalent sweep.
            const DB: &[&str] = &[
                "sqlite3_open", "sqlite3_open_v2", "sqlite3_open16", "sqlite3_close", "sqlite3_close_v2",
                "sqlite3_exec", "sqlite3_step", "sqlite3_prepare", "sqlite3_prepare_v2",
                "sqlite3_prepare_v3", "sqlite3_prepare16", "sqlite3_prepare16_v2", "sqlite3_prepare16_v3",
                "sqlite3_get_table", "sqlite3_backup_init", "sqlite3_backup_step", "sqlite3_backup_finish",
                "sqlite3_blob_open", "sqlite3_blob_read", "sqlite3_blob_write", "sqlite3_blob_reopen",
                "sqlite3_load_extension", "sqlite3_wal_checkpoint", "sqlite3_wal_checkpoint_v2",
                // (b) the PROCESS-GLOBAL extension registry — every one of these changes what a LATER
                // `sqlite3_open` on any connection will execute, and `sqlite3_load_extension` (already
                // above) is the same capability one call along.
                "sqlite3_auto_extension", "sqlite3_cancel_auto_extension", "sqlite3_reset_auto_extension",
                "sqlite3_enable_load_extension",
                // (a) further DATABASE-CONTENT I/O the original list missed: whole-image load/save,
                // a forced page-cache flush to disk, a direct VFS file operation, and arming the
                // automatic WAL checkpoint writes whose manual twin is already listed.
                "sqlite3_deserialize", "sqlite3_serialize", "sqlite3_db_cacheflush",
                "sqlite3_file_control", "sqlite3_wal_autocheckpoint",
            ];
            return DB.contains(&leaf).then_some("Db");
        }
        if leaf.starts_with("git_") {
            // libgit2: remote/transport operations contact the network … (incl. submodule clone/update,
            // which `git_clone`/fetch the subrepo over its remote — `allow_fetch` defaults on; an A/B on
            // git2 0.20 caught `Submodule::update`/`clone` reporting no `Net`).
            const NET: &[&str] = &[
                "git_clone", "git_remote_connect", "git_remote_connect_ext", "git_remote_fetch",
                "git_remote_download", "git_remote_upload", "git_remote_push", "git_remote_ls",
                "git_submodule_clone", "git_submodule_update",
            ];
            // … and repository/index/odb/checkout/ref/config operations touch the on-disk .git store.
            const FS: &[&str] = &[
                "git_repository_open", "git_repository_open_ext", "git_repository_open_bare",
                "git_repository_init", "git_repository_init_ext", "git_repository_discover",
                "git_checkout_tree", "git_checkout_head", "git_checkout_index", "git_index_read",
                "git_index_write", "git_index_write_tree", "git_index_write_tree_to",
                "git_index_add_bypath", "git_index_add_all", "git_odb_open", "git_odb_read",
                "git_odb_write", "git_odb_open_wstream", "git_odb_open_rstream",
                "git_blob_create_fromdisk", "git_blob_create_fromworkdir", "git_blob_create_from_disk",
                "git_blob_create_from_workdir", "git_blob_create_from_stream", "git_commit_create",
                "git_commit_create_v", "git_reference_create", "git_reference_set_target",
                "git_reference_delete", "git_config_open_default", "git_config_open_ondisk",
                "git_config_add_file_ondisk", "git_tag_create", "git_treebuilder_write",
                "git_packbuilder_write",
            ];
            if NET.contains(&leaf) {
                return Some("Net");
            }
            if FS.contains(&leaf) {
                return Some("Fs");
            }
            return None;
        }
        if leaf.starts_with("curl_") {
            // libcurl (under the `curl` crate, called `curl_sys::curl_*`). Only the entry points that
            // PERFORM network I/O: the blocking transfer (`curl_easy_perform`), raw socket send/recv,
            // the HTTP/2 keepalive PING (`upkeep`), and the multi-interface transfer pumps. The large
            // pure surface (setopt/init/cleanup/reset/getinfo/escape/multi_add_handle/fdset/info_read)
            // stays unclassified, as do `curl_multi_wait`/`poll` (readiness WAIT on sockets, no payload —
            // the loop's `perform` is the tagged boundary, per the I/O-boundary principle). An A/B on
            // curl 0.4 caught the whole crate reporting ZERO Net (`Easy::perform` read as pure).
            const NET: &[&str] = &[
                "curl_easy_perform", "curl_easy_send", "curl_easy_recv", "curl_easy_upkeep",
                "curl_multi_perform", "curl_multi_socket_action",
            ];
            return NET.contains(&leaf).then_some("Net");
        }
        if let Some(op) = leaf.strip_prefix("SSL_") {
            // OpenSSL (libssl, under the `openssl`/`native-tls` crates, called `ffi::SSL_*`). The TLS
            // handshake and record I/O run over the peer socket -> Net. Unlike libc read/write, an SSL_*
            // op is ~always over a network BIO (the rare memory-BIO/sans-IO case is the honest exception
            // we accept). The crypto surface (EVP_*/SHA*/AES*) and pure setup (SSL_CTX_new/SSL_set_fd) are
            // NOT here; `BIO_*` is skipped (a BIO may be memory or socket). Validated vs openssl 0.9 source.
            const SSL_NET: &[&str] = &[
                "connect", "accept", "do_handshake", "read", "read_ex", "write", "write_ex", "peek",
                "peek_ex", "shutdown",
            ];
            return SSL_NET.contains(&op).then_some("Net");
        }
    }
    // HTTP clients use the same builder pattern as the AWS SDK: only the dispatch is
    // I/O. (Found by the eval: ebman's reqwest calls to the Anthropic API + webhooks
    // were silently classified network-free because reqwest wasn't recognized.)
    if crate_name == "reqwest" || crate_name == "isahc" {
        // The dispatch (`::send`/`::execute`) is the I/O. PLUS the one-shot CONVENIENCE functions
        // `reqwest::get` / `reqwest::blocking::get` / `isahc::get`, which send immediately — they're
        // an EXACT match (not `Client::get`, the builder) to avoid false-positiving the builder path.
        // (Found running on `xh`: a one-shot `reqwest::get(url)` was classified network-free.)
        if path.ends_with("::send")
            || path.ends_with("::execute")
            || path == "reqwest::get"
            || path == "reqwest::blocking::get"
            || path == "isahc::get"
        {
            return Some("Net");
        }
        // THE URL-BEARING BUILDER METHODS: `Client::{get,post,put,delete,patch,head,request}(URL)`.
        // Real code almost never uses `reqwest::get(url)`; the DOMINANT idiom is the builder chain
        // `Client::new().post(url).send()` / `Client::builder().build()?.post(url).send()`. The `.send()`
        // already classifies `Net` — but the URL literal rides the `.post(url)` call, NOT `.send()`, so
        // without classifying the URL-naming step `Net` the endpoint is NEVER captured and the `Llm`
        // host refinement can't fire (ebman's `api.anthropic.com` call read as bare Net, undisclosed as
        // Llm — the dogfood silent under-report). Classifying these `Net` (idempotent with the eventual
        // `.send()`) makes the scanner capture the URL from their string arg. `request(method, url)`'s
        // url is its SECOND arg — the scanner's first-string-literal capture still gets it when the
        // method is a literal string, and misses it (honest under-report) when the method is an
        // expression. The pure builder surface (`::header`, `::json`, `::body`, `::query`, …) stays None.
        if path.ends_with("::get")
            || path.ends_with("::post")
            || path.ends_with("::put")
            || path.ends_with("::delete")
            || path.ends_with("::patch")
            || path.ends_with("::head")
            || path.ends_with("::request")
        {
            return Some("Net");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against isahc 2.0.1 — isahc-only, since
        // reqwest has no equivalent free-function async family:
        //
        // `get_async`/`head_async`/`post_async`/`put_async`/`delete_async`/`send_async` (lib.rs:357-500)
        // are the crate's async one-shot convenience functions — `HttpClient::shared().get_async(uri)`
        // etc., the exact async mirror of the already-covered `isahc::get`, dispatching immediately.
        // `HttpClient::new`/`HttpClientBuilder::build` (client.rs:629,444) are genuinely NOT lazy like
        // reqwest's `Client::new`: `build()` unconditionally calls `agent_builder.spawn()`
        // (agent/mod.rs:63), which spawns a background OS thread running `AgentContext::run` — curl's
        // multi-handle event loop that DOES perform the real socket reads/writes for every request later
        // sent through this client. Confirmed via self-scan on isahc's own source: `AgentBuilder::spawn`
        // reaches `Net` through that same call chain, not a guess.
        if crate_name == "isahc"
            && (path == "isahc::get_async"
                || path == "isahc::head_async"
                || path == "isahc::post_async"
                || path == "isahc::put_async"
                || path == "isahc::delete_async"
                || path == "isahc::send_async"
                || path.ends_with("HttpClient::new")
                || path.ends_with("HttpClientBuilder::build"))
        {
            return Some("Net");
        }
        // `reqwest::multipart::Part::file` (blocking/multipart.rs:223) opens the given path directly
        // (`std::fs::File::open`) to attach it as a form part — genuinely Fs, not Net (the eventual
        // upload is charged at `.send()`, already covered above).
        //
        // NOT modelled: `h3_client::pool::PoolClient::send_request` (async_impl/h3_client/pool.rs:207)
        // — `mod async_impl;` is PRIVATE in reqwest's lib.rs (only `self::async_impl::multipart` is
        // selectively re-exported), so `PoolClient` is unreachable from outside the crate; the real
        // HTTP/3 dispatch a consumer can actually reach is the already-covered `::send`/`::execute`.
        // Removed from open.tsv rather than guessed.
        // SOUNDNESS R337 — THE WRAPPER, not the wrapped. candor already charges
        // `native_tls_crate::Identity::from_pkcs8`/`from_pkcs12` `Fs` (the clause below), and the reason
        // it does is concrete rather than defensive: on the security-framework backend those create a
        // real `tempfile::TempDir` and write a keychain into it —
        // `native-tls-0.2.18/src/imp/security_framework.rs:93` (`identity.keychain`, `from_pkcs8`) and
        // `:167` (`tmp.keychain`, `from_pkcs12`). But candor classifies the call a CONSUMER writes, not
        // the dependency body behind it, so a consumer who reaches that code through its idiomatic
        // wrapper matched no rule at all — and in a CALIBRATED crate an unmatched path is a claim of
        // reviewed purity with no disclosure. A call taking only BYTES writes a file on macOS, and it
        // read pure.
        //
        // Swept for the CLASS rather than the two rows the coverage gate handed me: every caller of
        // `native_tls{,_crate}::Identity::from_pkcs8|from_pkcs12` in the local registry is reqwest
        // (0.11/0.12/0.13, all three spelling these the same way), lettre, and `tcp_stream` — which is
        // NOT calibrated, so its calls disclose rather than claim purity and it needs no rule.
        //
        // Suffix-matched, not exact-path, because all three reqwest majors carry the same names; and
        // narrow on purpose. The SIBLINGS are the fabrication control and they must stay pure:
        // `reqwest::tls::Identity::from_pem` is rustls-only, a `Cursor` over a buffer (tls.rs:373), and
        // lettre's `Certificate::from_der`/`from_pem` reach `native_tls::Certificate::*`, which imports
        // items with no keychain and no temp dir (security_framework.rs:206,212).
        // SOUNDNESS R342 — THE RESPONSE BODY IS READ FROM THE SOCKET, and `resp.text().await` is one of
        // the most-written lines in Rust networking. `send()` is charged; the methods that DRAIN what it
        // returned were not, so a helper that takes a `Response` and reads it — an extremely common
        // shape — was a positive purity claim on a CALIBRATED crate. Executed at reqwest 0.13.4:
        // `r.text()`, `r.json()` and `r.bytes()` all ABSENT while `c.get(..).send()` was `['Net']`.
        //
        // Verified in the source rather than assumed: `text` -> `text_with_charset` -> `bytes` ->
        // `do_bytes`, which is `BodyExt::collect(self.res.into_body()).await`
        // (`async_impl/response.rs:433`) — it drains the body off the wire. `chunk` and `bytes_stream`
        // are the streaming spellings of the same read; charging the stream CONSTRUCTOR follows this
        // file's own `Command::new` convention, where the effect is attributed at the point the caller
        // asks for it rather than at the poll nobody can see.
        //
        // Scoped by `Response::` and not by the bare verb: `::text` and `::json` are far too common a
        // leaf to match crate-wide. Found by the coverage gate the moment R185 taught the scanner to
        // see through `Option`/`Result` unwraps — the same "closing a silence makes consumers' gaps
        // visible" shape recorded on R302 and R337.
        if crate_name == "reqwest"
            && path.contains("Response::")
            && (path.ends_with("::text")
                || path.ends_with("::text_with_charset")
                || path.ends_with("::json")
                || path.ends_with("::bytes")
                || path.ends_with("::chunk")
                || path.ends_with("::bytes_stream"))
        {
            return Some("Net");
        }
        if crate_name == "reqwest"
            && (path.ends_with("::Identity::from_pkcs12_der")
                || path.ends_with("::Identity::from_pkcs8_pem"))
        {
            return Some("Fs");
        }
        if crate_name == "reqwest" && path.ends_with("::Part::file") {
            return Some("Fs");
        }
        return None;
    }
    if crate_name == "ureq" && path.ends_with("::call") {
        return Some("Net");
    }
    // THE COVERAGE-GATE SWEEP (2026-08-27), verified against ureq 2.12.1 (the version this ratchet's
    // rows were generated from — 3.x, also cached locally, rewrote this surface beyond recognition and
    // is a different question for a future pass). `::call` above is the no-body dispatch terminal;
    // these are its siblings:
    //
    // `Request::send`/`send_bytes`/`send_form`/`send_json`/`send_string` (request.rs:78-296) are the
    // WITH-BODY dispatch terminals — `do_call(Payload::..)`, the exact same terminal `call` reaches with
    // an empty payload. Missing them left every `agent.post(url).send_json(&body)` (the dominant idiom
    // for a JSON API call) silently pure.
    // `ureq::agent`/`request`/`request_url` (lib.rs:513,539,561) are real gaps in a stranger way: each
    // one's own body contains a REACHABLE (if `is_test(true)` was ever called — itself a `pub fn` a
    // consumer or another dependency could invoke) call to `testserver::test_agent()`, which binds a
    // real listening `TcpStream` (see `TestServer::new` below) — self-scan's whole-body reachability
    // treats that as real, and per this project's over-approximate-rather-than-miss discipline (a
    // toggleable global flag routing traffic through an internal listener is exactly the kind of path a
    // security-conscious caller wants disclosed, not silently pure), so does this rule. `agent()` is also
    // the crate's OWN base for `request`/`request_url` (`agent().request(..)`), and `request`/
    // `request_url` additionally carry the URL argument — matching the reqwest/isahc precedent above of
    // classifying the URL-bearing constructor `Net` too (idempotent with the eventual `.call()`/`.send()`)
    // so the destination is captured even if a caller never re-touches the returned `Request`.
    if crate_name == "ureq"
        && (path.ends_with("::send")
            || path.ends_with("::send_bytes")
            || path.ends_with("::send_form")
            || path.ends_with("::send_json")
            || path.ends_with("::send_string")
            || path == "ureq::agent"
            || path == "ureq::request"
            || path == "ureq::request_url"
            || path == "ureq::unversioned::transport::RustlsConnector::connect"
            || path == "ureq::tls::rustls::RustlsConnector::connect"
            || path == "ureq::RustlsConnector::connect")
    {
        return Some("Net");
    }
    // NOT modelled (both removed from open.tsv, not guessed):
    //   `ureq::Arc::connect` — the ratchet's generator strips generic arguments from an impl header, so
    //   `impl TlsConnector for Arc<rustls::ClientConfig>` (rtls.rs:88) produced the type name "Arc" — a
    //   bogus path (`ureq::Arc` names nothing; `Arc` is std's, not ureq's) that no consumer could ever
    //   write. The trait method itself is real (ureq's own internal TLS dispatch, invoked by `.call()`,
    //   already covered), but no FQN a real caller would spell resolves through this guess.
    //   `ureq::TestServer::new` — `TestServer` (testserver.rs:62) lives in `mod testserver;` (lib.rs:444),
    //   PRIVATE with no re-export, so `ureq::TestServer` is unreachable from outside the crate (the
    //   listener it binds is real, but only `agent()`'s internal `is_test` branch above can reach it).
    // The `curl` crate (libcurl's safe binding — cargo's own HTTP client): the dispatch verbs are
    // `perform` (Easy/Easy2/Transfer/Multi), raw-socket `send`/`recv`, the keepalive `upkeep`, and the
    // multi-interface `action` (socket_action). The big setopt-style builder surface stays pure.
    // `Multi::timeout` is deliberately NOT matched: `Easy::timeout` is a pure CURLOPT_TIMEOUT setter
    // sharing the leaf — an under-report on the rare event-loop kick beats mis-tagging every consumer
    // that sets a timeout. (Consumer-side companion to the curl_* FFI tier, same A/B finding.)
    if crate_name == "curl"
        && (path.ends_with("::perform")
            || path.ends_with("::send")
            || path.ends_with("::recv")
            || path.ends_with("::upkeep")
            || path.ends_with("::action"))
    {
        return Some("Net");
    }
    // The modern async-HTTP / TLS / QUIC / DNS stack — the LAYER reqwest/ureq/isahc build on, and that
    // crates use DIRECTLY. Found by the independent-method differential on `oha` (2026-06-17): candor
    // honestly DISCLOSED these as blind but never CLASSIFIED them, leaving real Net reaches uncovered.
    // Verb-keyed (the pure type/builder/codec surface stays None) and CRATE-GATED, so generic verbs
    // (request/connect/get/read/write/accept) never fabricate across unrelated crates. Same precision
    // discipline as the reqwest/curl rules above; complements the scan_builder_entry_effect entries.
    match crate_name {
        // hyper 1.x client connection I/O (the builder/Body/Request types stay pure).
        "hyper" if path.ends_with("::send_request") || path.ends_with("::handshake") => return Some("Net"),
        // hyper-util's pooled legacy Client + its TCP connectors.
        "hyper_util" if path.ends_with("::request") || path.ends_with("::connect") => return Some("Net"),
        // hickory (trust-dns) resolver — issues DNS queries over the network.
        "hickory_resolver"
            if path.ends_with("::lookup_ip") || path.ends_with("::lookup") || path.ends_with("_lookup")
                || path.ends_with("::resolve") => return Some("Net"),
        // HTTP/3 over QUIC.
        "h3" if path.ends_with("::send_request") || path.ends_with("::recv_data")
            || path.ends_with("::recv_response") || path.ends_with("::send_data") => return Some("Net"),
        // QUIC transport (UDP socket send/recv): connection setup, datagrams, AND the stream byte I/O
        // (`RecvStream::read*` / `SendStream::write*` / `finish`). Opening a stream is caught above, but a
        // fn that only HOLDS a stream and reads/writes it would otherwise read silent-pure (review: a Net
        // under-report). Crate-gated to quinn, where these verbs are unambiguously the socket I/O.
        "quinn" if path.ends_with("::connect") || path.ends_with("::accept") || path.ends_with("::open_bi")
            || path.ends_with("::open_uni") || path.ends_with("::accept_bi") || path.ends_with("::accept_uni")
            || path.ends_with("::send_datagram") || path.ends_with("::read_datagram")
            || path.ends_with("::read") || path.ends_with("::read_chunk") || path.ends_with("::read_chunks")
            || path.ends_with("::read_to_end") || path.ends_with("::write") || path.ends_with("::write_all")
            || path.ends_with("::write_chunk") || path.ends_with("::write_chunks")
            || path.ends_with("::finish") => return Some("Net"),
        // TLS-over-TCP stream adapters — the actual socket handshake/I/O (the config/cert types stay pure).
        "tokio_rustls" | "native_tls"
            if path.ends_with("::connect") || path.ends_with("::accept") || path.ends_with("::handshake") =>
            return Some("Net"),
        // AF_VSOCK host<->guest sockets — inter-process / VM comms.
        "tokio_vsock" if path.ends_with("::connect") || path.ends_with("::bind") || path.ends_with("::accept") =>
            return Some("Ipc"),
        // Loads the OS trust store from disk (cert files / keychain).
        "rustls_native_certs" if path.ends_with("::load_native_certs") => return Some("Fs"),
        // `rlimit` reads/mutates the process's kernel resource limits — the closest bucket is Env (host/
        // process config); no dedicated process-state bucket exists, so getrlimit (read) and setrlimit
        // (mutate) share it. NOTE: `num_cpus::get`/`get_physical` are deliberately NOT modeled — asking the
        // OS for the CPU count is a near-pure topology query, and std's equivalent `thread::
        // available_parallelism` classifies pure; modeling it as Env would spray Env over every thread-pool
        // constructor (review: a high-noise over-report) for no capability a reviewer cares about.
        "rlimit" if path.ends_with("::getrlimit") || path.ends_with("::setrlimit")
            || path.ends_with("::increase_nofile_limit") => return Some("Env"),
        // rustls — the SYNC TLS core (tokio_rustls/native_tls above are the async/system adapters). The
        // record-layer I/O is `read_tls`/`write_tls` (pull/push raw bytes through a held `io::Read`/`Write`)
        // and `complete_io` (loops them until the handshake/buffers drain). The config/cert/builder types
        // (`ClientConfig`/`ServerConfig`/`ConfigBuilder`) are PURE. `process_new_packets` is deliberately
        // EXCLUDED — it only decrypts ALREADY-buffered bytes (no socket touch; docs say call it AFTER
        // read_tls), so flagging it would over-report Net on the pure decrypt step.
        "rustls" if path.ends_with("::read_tls") || path.ends_with("::write_tls")
            || path.ends_with("::complete_io") => return Some("Net"),
        // native-tls under its alternate crate name + the tokio async wrapper (the `native_tls` arm above
        // is the common name). The TLS handshake over a TcpStream is Net; the builder/cert types are pure.
        "native_tls_crate" | "tokio_native_tls"
            if path.ends_with("::connect") || path.ends_with("::accept")
                || path.ends_with("::handshake") => return Some("Net"),
        _ => {}
    }
    // THE COVERAGE-GATE SWEEP (2026-08-27) — two crate-root CONSTRUCTORS the verb-keyed match above
    // never reached because neither ends in connect/accept/handshake, verified against their real
    // per-platform impl (native-tls 0.2.18, rustls 0.23.43):
    //
    // `native_tls_crate::TlsConnector::new` (lib.rs:481, the PUBLIC newtype wrapper around the private
    // per-platform `imp::TlsConnector`) reads the system trust store — on the openssl backend it loads
    // the probed cert file/dir from disk before any socket exists. `Identity::from_pkcs8` (lib.rs:178,
    // wrapping `imp::Identity::from_pkcs8`) on the security-framework (macOS) backend creates a real
    // temporary keychain file on disk to import the PKCS8 key into.
    // `rustls::KeyLogFile::new` (key_log_file.rs:88) reads `$SSLKEYLOGFILE` and, if set, opens (creating
    // if needed) that file in append mode — a real, if opt-in, disk write path independent of the sync
    // TLS record-layer I/O the `rustls` arm above already covers.
    // SOUNDNESS R331 — …and `TlsConnector::builder`, which is the SAME trust-store read reached by the
    // other spelling. `TlsConnector::new` is literally `TlsConnector::builder().build()`
    // (`native-tls-0.2.18/src/lib.rs:481`), and `TlsConnectorBuilder::build` (`:451`) is where
    // `imp::TlsConnector::new` — the openssl-backend cert-file/dir load — actually runs. The builder
    // spelling is the DOMINANT idiom the moment any option is set, and it is what `reqwest` itself
    // writes (`reqwest-0.12.28/src/async_impl/client.rs:529`).
    //
    // **KEYED ON `builder`, NOT ON `build`, AND THAT IS THE WHOLE FIX.** The first attempt added
    // `ends_with("TlsConnectorBuilder::build")` and moved nothing, so the row was closed with the
    // conclusion that the scanner "never types `TlsConnector::builder()`" and the repair had to be
    // receiver typing. **That conclusion was wrong.** `.build()` is a method on a foreign-returned
    // receiver and cannot be typed without a return index for a foreign crate — but `TlsConnector::
    // builder()` is a PATH call, recorded and classified exactly like `TlsConnector::new` beside it.
    // Charging the constructor rather than the terminal is also this file's own convention
    // (`Command::new`). Over-charge direction: a `builder()` whose `.build()` never happens, which is
    // not a shape anyone writes.
    //
    // WHY IT LOOKED LIKE NOTHING WAS RECORDED: under the calibration exemption a call that classifies
    // `None` is DROPPED from the report, so "no calls recorded" is what a correct scan of an exempt
    // crate looks like — not evidence that the receiver went untyped. Measured: under the PLAIN
    // `native_tls::` spelling (not calibrated) the same body is PRESENT with `invisible: ["native_tls"]`,
    // a disclosure; under `native_tls_crate` (the calibrated rename reqwest and tungstenite use) it is
    // ABSENT with nothing hidden. The rename is what turns a disclosure into a purity claim.
    if matches!(crate_name, "native_tls" | "native_tls_crate")
        && (path.ends_with("TlsConnector::new")
            || path.ends_with("TlsConnector::builder")
            || path.ends_with("Identity::from_pkcs8")
            || path.ends_with("Identity::from_pkcs12"))
    {
        return Some("Fs");
    }
    if crate_name == "rustls" && path.ends_with("KeyLogFile::new") {
        return Some("Fs");
    }
    // Message-queue clients fully encapsulate the socket (the underlying tokio::net lives
    // inside the crate, unseen), so a user's connect/publish/consume calls ARE the I/O
    // boundary — to a remote broker, hence Net. Match the broker round-trip verbs (snake_case
    // methods); the CamelCase option/property builders stay pure. (Found hardening on consumer
    // apps: lapin `basic_publish`/`queue_declare` and async-nats `publish`/`subscribe` were
    // classified pure — a message-queue client reporting no I/O.)
    if crate_name == "async_nats" {
        if path.ends_with("::connect")
            || path.contains("::publish")
            || path.ends_with("::subscribe")
            || path.ends_with("::queue_subscribe")
            || path.contains("::request")
            || path.ends_with("::flush")
        {
            return Some("Net");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against async-nats 0.35.1 (the version this
        // ratchet's rows were generated from — 0.50.0, also cached locally, removed/relocated this
        // exact surface, a separate question for a future pass):
        //
        // `connect_with_options` (lib.rs:891) is the crate's OWN real entry point `connect()` calls one
        // hop down — the actual handshake, missing because the verb list above matches the bare
        // `::connect` suffix, not the `_with_options` sibling.
        // `ConnectOptions::credentials_file`/`with_credentials_file` (options.rs:417,438) load a real
        // credentials file off disk via `auth_utils::load_creds` before authenticating — Fs, not Net
        // (the network round-trip these feed happens later, at `connect`).
        // `ServerAddr::socket_addrs` (lib.rs:1473) does `tokio::net::lookup_host` — a real DNS query.
        if path == "async_nats::connect_with_options" {
            return Some("Net");
        }
        if path == "async_nats::ConnectOptions::credentials_file"
            || path == "async_nats::ConnectOptions::with_credentials_file"
        {
            return Some("Fs");
        }
        if path == "async_nats::ServerAddr::socket_addrs" {
            return Some("Net");
        }
        return None;
    }
    if crate_name == "lapin" {
        if path.ends_with("::connect")
            || path.ends_with("::create_channel")
            || path.contains("::basic_")
            || path.contains("::queue_")
            || path.contains("::exchange_")
            || path.contains("::tx_")
            || path.ends_with("::confirm_select")
            || path.ends_with("::close")
        {
            return Some("Net");
        }
        return None;
    }
    // SMTP email — lettre's `Transport::send` is the network dispatch; Message building is
    // pure. (Found hardening on a lettre consumer: `mailer.send(&email)` classified pure.)
    //
    // THE COVERAGE-GATE SWEEP (2026-08-27), verified against lettre 0.11.23 source — the TLS-setup and
    // connection-establishment family this crate's own `send` rule never reached:
    //
    // `TlsParameters::new`/`new_rustls` (client/tls.rs:598,617) and `TlsParametersBuilder::build`/
    // `build_rustls` (tls.rs:325,446) — `build_rustls` calls `rustls_native_certs::load_native_certs()`
    // (a real OS-trust-store read) plus `tracing::debug!`; `build()` dispatches to it under the
    // (textually-visible, cfg-gated) `rustls` feature. `SmtpTransport`/`AsyncSmtpTransport::{from_url,
    // relay,starttls_relay}` (transport.rs:90,114,243; async_transport.rs:135,169,306) each construct a
    // `TlsParameters` directly (`relay`/`starttls_relay`) or via the crate's OWN `pub(crate)
    // from_connection_url` (`from_url`) — real TLS setup a consumer never spells `TlsParameters` to
    // reach. `FileTransport::read` (transport/file/mod.rs:216) calls `std::fs::read` directly.
    if crate_name == "lettre" {
        if path.ends_with("::send") || path.ends_with("::send_raw") {
            return Some("Net");
        }
        // SOUNDNESS R337 — lettre's half of the same wrapper gap. `Identity::from_pem(pem, key)`
        // (transport/smtp/client/tls.rs:749) is `native_tls::Identity::from_pkcs8(pem, key)`, which on
        // macOS writes a temporary keychain. The `::Identity::` in the suffix is load-bearing: the
        // `Certificate::from_pem` twenty lines above it (`:676`) is in-memory and must stay pure, and a
        // bare `::from_pem` would charge both.
        if path.ends_with("::Identity::from_pem") {
            return Some("Fs");
        }
        if path == "lettre::TlsParametersBuilder::build"
            || path == "lettre::transport::smtp::client::TlsParametersBuilder::build"
            || path == "lettre::TlsParametersBuilder::build_rustls"
            || path == "lettre::transport::smtp::client::TlsParametersBuilder::build_rustls"
            || path == "lettre::TlsParameters::new"
            || path == "lettre::transport::smtp::client::TlsParameters::new"
            || path == "lettre::TlsParameters::new_rustls"
            || path == "lettre::transport::smtp::client::TlsParameters::new_rustls"
            // SOUNDNESS R331 — the `_native` half of the same family, which this enumeration never had.
            // It surfaced the moment `TlsConnector::builder` started charging: the coverage gate's
            // oracle saw `Fs` on `TlsParameters::new_native` and `TlsParametersBuilder::build_native`
            // and `classify()` had no rule for either. `build_native` is `TlsConnector::builder()`
            // (`lettre-0.11.23/src/transport/smtp/client/tls.rs:338`) and `new_native` delegates
            // straight to it (`:610`); the already-listed `build`/`new` reach whichever backend is
            // enabled and were covered, so the list held every variant EXCEPT the one named after the
            // backend that does the disk read.
            //
            // `build_boring`/`new_boring` are deliberately NOT added. `build_boring` (`:384`) builds a
            // `boring::ssl::SslConnector`, and openssl's `SslConnector::builder` calls
            // `set_default_verify_paths()` — so it is PROBABLY `Fs` too, but `boring` is not a crate
            // this file has read, and the last three defects in this area came from charging a path
            // whose body nobody had opened. Left for a pass that reads it.
            || path == "lettre::TlsParameters::new_native"
            || path == "lettre::transport::smtp::client::TlsParameters::new_native"
            || path == "lettre::TlsParametersBuilder::build_native"
            || path == "lettre::transport::smtp::client::TlsParametersBuilder::build_native"
            || path == "lettre::SmtpTransport::from_url"
            || path == "lettre::SmtpTransport::relay"
            || path == "lettre::SmtpTransport::starttls_relay"
            || path == "lettre::AsyncSmtpTransport::from_url"
            || path == "lettre::AsyncSmtpTransport::relay"
            || path == "lettre::AsyncSmtpTransport::starttls_relay"
            || path == "lettre::FileTransport::read"
        {
            return Some("Fs");
        }
        // `AsyncStd1Executor::{connect,fs_read,fs_write}` (executor.rs:223,260,265, the sealed
        // `Executor` trait impl — `#[doc(hidden)]` in lettre's own source, so this is a narrower, less-
        // visited surface than the others above, but genuinely reachable: both the trait and the type
        // are `pub`, re-exported at the crate root) dial a real connection / read+write real files.
        // `AsyncSmtpConnection`/`AsyncNetworkStream::connect_asyncstd1` (client/async_connection.rs:121,
        // client/async_net.rs:207) dial a real `async-std` TCP connection — reachable only via the
        // module-qualified path (`transport::smtp::client::`), since neither type is re-exported at the
        // crate root (unlike `TlsParameters`'s sibling forms, which at least reach `client::` — the dual
        // spellings above, same shape as rusqlite's `Blob`/`Backup`).
        if path == "lettre::AsyncStd1Executor::connect"
            || path == "lettre::AsyncSmtpConnection::connect_asyncstd1"
            || path == "lettre::transport::smtp::client::AsyncSmtpConnection::connect_asyncstd1"
            || path == "lettre::AsyncNetworkStream::connect_asyncstd1"
            || path == "lettre::transport::smtp::client::AsyncNetworkStream::connect_asyncstd1"
        {
            return Some("Net");
        }
        if path == "lettre::AsyncStd1Executor::fs_read" || path == "lettre::AsyncStd1Executor::fs_write" {
            return Some("Fs");
        }
        // NOT included: `NetworkStream::{shutdown,set_read_timeout,set_write_timeout}` (client/net.rs)
        // LOOK like three more hits (self-scan flags them too, propagating from the coarse
        // `std::net::TcpStream` whole-handle rule) but `mod net;` (client/mod.rs:50) is PRIVATE and
        // `NetworkStream` is never re-exported (only imported crate-internally via a bare `use
        // self::net::NetworkStream;`, mod.rs:35) — no external consumer can ever name the type, so no
        // rule was added despite self-scan flagging it (the same `InnerConnection`/`RawStatement` shape
        // as the rusqlite fix elsewhere in this file).
        return None;
    }
    // WebSockets — tungstenite (the modern successor to the old `websocket` crate). connect
    // and the socket read/write/send are network; Message constructors are pure. (Found on a
    // tungstenite consumer: connect + send + read classified pure.)
    //
    // THE FIX: `connect` only names the URL-dialing client entry point. tungstenite ALSO ships the
    // stream-first client/server handshake free functions — `client`/`client_with_config` (client.rs:176,
    // 152: "use this if you need a nonblocking handshake ... or a custom stream") and
    // `accept`/`accept_with_config`/`accept_hdr`/`accept_hdr_with_config` (server.rs:23-63) — each of
    // which does `{Client,Server}Handshake::start(stream, ..).handshake()`, the REAL WS upgrade
    // handshake read/write over an already-open stream. These are the documented way to run tungstenite
    // over a caller-managed TCP/TLS/mio stream (exactly the shape most async runtimes use, since
    // tungstenite itself is sync/transport-agnostic) — missing from a verb list keyed only on the
    // dial-it-yourself `connect` spelling. Same vein as `git2::Submodule::clone`/`ignore::Walk::new`: an
    // established effect's SIBLING entry point absent from the allowlist.
    if crate_name == "tungstenite" {
        if path.ends_with("::connect")
            || path.ends_with("::connect_with_config")
            || path.ends_with("::client")
            || path.ends_with("::client_with_config")
            || path.ends_with("::client_tls")
            || path.ends_with("::client_tls_with_config")
            || path.ends_with("::accept")
            || path.ends_with("::accept_with_config")
            || path.ends_with("::accept_hdr")
            || path.ends_with("::accept_hdr_with_config")
            || path.ends_with("::read")
            || path.ends_with("::write")
            || path.ends_with("::send")
            || path.ends_with("::close")
            || path.ends_with("::flush")
            || path.ends_with("::read_message")
            || path.ends_with("::write_message")
        {
            return Some("Net");
        }
        return None;
    }
    // elasticsearch: request builders are pure; only the `.send()` dispatch is HTTP I/O
    // (same shape as reqwest / the AWS SDK). (Found on an elasticsearch consumer.)
    // SOUNDNESS R342 — …and the RESPONSE BODY, one wrapper up from reqwest's. `Response::json` is
    // `self.response.json::<B>().await` (`http/response.rs:102`) — reqwest's body drain, which this file
    // now charges — and `text`/`bytes`/`exception` are the same read. A consumer writing
    // `client.search(..).send().await?.json().await?` had the `send` charged and the read silent.
    //
    // This is EXACTLY the distinction this file's own exclusion list already draws for this type:
    // `Response::content_type` is documented there as a pure accessor reading a header off an
    // ALREADY-received response. `status_code`/`headers` are the same shape and stay pure; the body
    // methods are not accessors, they pull the remaining bytes off the wire. Both halves are asserted
    // in the test so the line between them cannot move by accident.
    if crate_name == "elasticsearch"
        && path.contains("Response::")
        && (path.ends_with("::json")
            || path.ends_with("::text")
            || path.ends_with("::bytes")
            || path.ends_with("::exception"))
    {
        return Some("Net");
    }
    if crate_name == "elasticsearch" && path.ends_with("::send") {
        return Some("Net");
    }
    // gRPC — tonic. The transport connect and the Grpc client RPC dispatch are network;
    // codecs and request/response wrappers are pure. (connect repro-confirmed on a consumer;
    // the unary/streaming RPC verbs are from the tonic::client::Grpc API.)
    //
    // THE COVERAGE-GATE FIX: the rule above only ever covered the CLIENT half. `Router::serve`/
    // `::serve_with_shutdown` (transport/server/mod.rs:783,811) are the SERVER's own most common entry
    // points — a tonic quickstart's last line — and both bind a real listening socket via
    // `TcpIncoming::new` (incoming.rs:197: `StdTcpListener::bind(addr)`), the crate's other bare-`pub`
    // constructor (`Server<L>::serve_with_shutdown` at mod.rs:530 is a DIFFERENT, `pub(crate)` method on
    // a different receiver — not reachable, and not this one). A `deny Net` on a gRPC SERVER app missed
    // its own listen call entirely.
    if crate_name == "tonic" {
        if path.ends_with("::connect")
            || path.ends_with("::unary")
            || path.ends_with("::server_streaming")
            || path.ends_with("::client_streaming")
            || path.ends_with("::streaming")
            || path.ends_with("::Router::serve")
            || path.ends_with("::Router::serve_with_shutdown")
            || path == "tonic::TcpIncoming::new"
            || path == "tonic::transport::server::TcpIncoming::new"
        {
            return Some("Net");
        }
        return None;
    }
    // Kafka — rdkafka (FFI to librdkafka). Producer send + consumer poll/recv/subscribe/
    // commit are network round-trips to the brokers. (API-calibrated + unit-tested; a real
    // repro needs librdkafka/cmake, deferred.)
    if crate_name == "rdkafka" {
        if path.ends_with("::send")
            || path.ends_with("::send_result")
            || path.ends_with("::recv")
            || path.ends_with("::poll")
            || path.ends_with("::subscribe")
            || path.ends_with("::commit")
            || path.ends_with("::commit_message")
            || path.ends_with("::commit_consumer_state")
            || path.ends_with("::store_offset")
            || path.ends_with("::seek")
            || path.ends_with("::fetch_metadata")
            || path.ends_with("::fetch_watermarks")
            || path.ends_with("::flush")
        {
            return Some("Net");
        }
        return None;
    }
    // cap-std: capability-oriented std. I/O goes *through* a held capability handle
    // (Dir/Pool/Clock/...), so these calls ARE the effect. Recognising them means a
    // cap-std project's real I/O is detected and matches the capability it declared
    // (via `declared_caps`/`capstd_cap`) — conformance against unforgeable capabilities.
    if crate_name.starts_with("cap_") {
        if path.contains("::net::Unix") || path.contains("::os::") {
            return Some("Ipc");
        }
        if path.contains("::net") {
            return Some("Net");
        }
        if path.contains("::time") {
            return Some("Clock");
        }
        if path.contains("::fs") || crate_name == "cap_tempfile" || crate_name == "cap_directories" {
            return Some("Fs");
        }
        return None;
    }
    // Local IPC (Unix-domain sockets) is I/O but not *network* — keep it distinct so
    // CANDOR_NO_AMBIENT and audits don't conflate it with internet access. async-std puts its
    // Unix sockets under `os::unix::net` (mirroring std); async-net (smol's net layer) under
    // `unix`.
    if path.starts_with("tokio::net::Unix")
        || path.starts_with("std::os::unix::net")
        || path.starts_with("async_std::os::unix::net")
        || path.starts_with("async_net::unix")
    {
        return Some("Ipc");
    }
    // Raw packet capture / raw sockets — libpnet (the dominant low-level networking crate; powers
    // bandwhich, sniffers, custom-protocol tools). `datalink::channel` opens an L2 socket and
    // `transport::transport_channel` an L3/L4 raw socket — both ARE network I/O. Packet construction
    // (pnet_packet / pnet_base, MacAddr, Ethernet frames…) is pure and stays unclassified. The actual
    // frame read/write happens via methods on the returned Sender/Receiver (trait-object dispatch the
    // syntactic backend can't resolve), so the channel-open call is the precise Net boundary. (Found
    // scanning bandwhich — a packet sniffer — which reported Net 0.)
    if crate_name == "pnet" || crate_name == "pnet_datalink" || crate_name == "pnet_transport" {
        if path.ends_with("::channel") || path.ends_with("::transport_channel") {
            return Some("Net");
        }
        return None;
    }
    // Directory traversal — `ignore` (BurntSushi's gitignore-aware walker; powers ripgrep, fd). The walk
    // EXECUTORS read the directory tree from disk = Fs. Type-precise on purpose: the configuration builders
    // (`OverrideBuilder::build`, `GitignoreBuilder::build`, the `WalkBuilder` setters) and `DirEntry`
    // accessors are PURE — only `WalkBuilder::build`/`build_parallel` (which kick off the walk) and
    // `WalkParallel::run` (which drives it) touch the filesystem. A bare `build` would wrongly flag the
    // config builders. (Found scanning fd — a file finder — which reported Fs 2: its own `fs::read_dir`
    // was caught, but the `ignore`-based traversal that IS fd was invisible cross-crate.)
    //
    // `Walk::new`/`Walk::from_iter` are the crate's own documented convenience constructors — literally
    // `WalkBuilder::new(path).build()` / `WalkBuilder::from_iter(paths).build()` in `ignore`'s own source
    // (walk.rs:1128-1146) — but a verb list keyed only on `WalkBuilder::build`/`build_parallel`/
    // `WalkParallel::run`/`add_ignore` never sees `Walk::new(root)` (the crate's own top-level doc example
    // and the SAME shape as the already-fixed `walkdir::WalkDir::new`/`git2::Repository::clone`: a
    // documented public entry point that reaches the modelled effect through a wrapper the allowlist
    // didn't name). `deny Fs` over `for e in Walk::new(root) { .. }` exited 0. Charged at the SAME
    // construction site as `WalkBuilder::build` — no receiver typing needed, it's a plain `Expr::Call` on
    // `ignore::Walk::new`/`ignore::Walk::from_iter`, crate-gated so an unrelated `Walk::new` (a different
    // crate, or a local type) cannot match this arm.
    if crate_name == "ignore" {
        if path == "ignore::WalkBuilder::build"
            || path == "ignore::WalkBuilder::build_parallel"
            || path.ends_with("::WalkParallel::run")
            // `add_ignore(path)` LOOKS like a config setter but reads that ignore file from disk at call
            // time (it returns the read error) — unlike the pure `add_custom_ignore_filename(name)` which
            // only stores a filename string. The lone Fs-touching builder method in the otherwise-pure setter
            // surface, so it was silently pure under the covered-crate floor.
            || path == "ignore::WalkBuilder::add_ignore"
            || path == "ignore::Walk::new"
            || path == "ignore::Walk::from_iter"
        {
            return Some("Fs");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against ignore 0.4.33 — the gitignore-matcher
        // construction family, a DIFFERENT public surface from the walk-builder family above:
        //
        // `Gitignore::new` (gitignore.rs:103) opens and reads the given file directly via
        // `GitignoreBuilder::add`. `Gitignore::global` (gitignore.rs:141) reads `$PWD` then delegates to
        // `GitignoreBuilder::new(cwd).build_global()`. `GitignoreBuilder::add` (gitignore.rs:405) is the
        // crate's own per-file loader — `File::open` + line-by-line read — the same shape `add_ignore`
        // above was fixed for, on the SIBLING type. `GitignoreBuilder::build_global`/
        // `gitconfig_excludes_path` (gitignore.rs:377,583) resolve git's global excludesfile: read
        // `GIT_CONFIG_GLOBAL`/`XDG_CONFIG_HOME`/`HOME` env vars, then open and parse whichever gitconfig
        // file they point at. `WalkBuilder::build_matchers` (walk.rs:675) is the incremental-walk
        // sibling of the already-covered `build_parallel` — same `self.build_ignore()` call, different
        // caller-facing verb. `IncrementalIgnore::matched`/`matched_with_errors` (incremental.rs:194,213)
        // are the newer per-directory incremental-walk API: each lazily loads that directory's ignore
        // files (and, when `max_filesize` is set, `stat`s the candidate file) as the walk descends.
        //
        // `Gitignore`/`GitignoreBuilder`/`gitconfig_excludes_path` live in `pub mod gitignore;`
        // (lib.rs:59) but — unlike `Walk`/`WalkBuilder` two lines up (`pub use crate::walk::{..}`,
        // lib.rs:52) — are NOT re-exported at the crate root, so the only real, compilable spelling is
        // the module-qualified one (proven by a consumer fixture: `ignore::Gitignore::new` does not
        // exist, `ignore::gitignore::Gitignore::new` does). `IncrementalIgnore` IS re-exported at the
        // root (`pub use crate::incremental::{..}`, lib.rs:51), so the bare form is correct there.
        if path == "ignore::gitignore::Gitignore::new"
            || path == "ignore::gitignore::Gitignore::global"
            || path == "ignore::gitignore::GitignoreBuilder::add"
            || path == "ignore::gitignore::GitignoreBuilder::build_global"
            || path == "ignore::gitignore::gitconfig_excludes_path"
            || path == "ignore::WalkBuilder::build_matchers"
            || path == "ignore::IncrementalIgnore::matched"
            || path == "ignore::IncrementalIgnore::matched_with_errors"
            || path == "ignore::DirEntry::metadata"
            || path == "ignore::walk::DirEntry::metadata"
            || path == "ignore::WalkParallel::visit"
            || path == "ignore::walk::WalkParallel::visit"
        {
            return Some("Fs");
        }
        return None;
    }
    // Filesystem watching — `notify` (the de-facto fs-watch crate: watchexec, cargo-watch, mdbook). A
    // watcher opens an OS notification handle (inotify / FSEvents / kqueue / ReadDirectoryChanges) and
    // registers paths — observing filesystem state changes = Fs. The lifecycle boundary: any
    // `*Watcher::new` constructor (RecommendedWatcher/PollWatcher/INotifyWatcher/FsEventWatcher/…), the
    // `recommended_watcher` convenience fn, and the `watch`/`unwatch` registration verbs. `Config`/`Event`/
    // `EventKind` data types stay pure. (Found scanning watchexec: its watcher-`create` read Fs 0.)
    if crate_name == "notify" {
        if path.ends_with("Watcher::new")
            || path.ends_with("::recommended_watcher")
            || path.ends_with("::watch")
            || path.ends_with("::unwatch")
            // `ReadDirectoryChangesWatcher::create` (windows.rs:475, `pub use windows::
            // ReadDirectoryChangesWatcher` at the crate root) is a SECOND, directly-callable
            // constructor distinct from the `Watcher::new` trait method above — it takes a raw
            // meta-event channel `Watcher::new`'s impl builds internally by calling THIS same
            // `create`, then spawns the real ReadDirectoryChangesW watch server thread.
            || path.ends_with("ReadDirectoryChangesWatcher::create")
        {
            return Some("Fs");
        }
        return None;
    }
    // std DNS resolution — `("host", 80).to_socket_addrs()` / `std::net::lookup_host("host")` perform a
    // real getaddrinfo query (Net), but the classify table covered only the socket I/O *types*, so they
    // floored silently (sweep [37]; the syntactic engine modelled DNS only at the libc layer).
    if path.ends_with("::to_socket_addrs")
        || path == "std::net::lookup_host"
        || path.ends_with("ToSocketAddrs::to_socket_addrs")
    {
        return Some("Net");
    }
    // Raw sockets. Match the I/O *types* only — `std::net` also holds pure data types
    // (SocketAddr, IpAddr, …) whose construction must NOT be flagged.
    if path.starts_with("std::net::TcpStream")
        || path.starts_with("std::net::TcpListener")
        || path.starts_with("std::net::UdpSocket")
        || path.starts_with("tokio::net::")
    {
        // …but the PURE accessors read back local/option state — no network I/O — so the whole-type Net
        // rule fabricated Net on them (sweep [24], the precision failure; mirrors the arboard/memmap2 accessor
        // carve-outs). local_addr/peer_addr return bound/connected addresses; nodelay/ttl/take_error read
        // socket options/state. Every genuine verb (connect/read/write/send/recv/accept) stays Net.
        if path.ends_with("::local_addr")
            || path.ends_with("::peer_addr")
            || path.ends_with("::nodelay")
            || path.ends_with("::ttl")
            || path.ends_with("::take_error")
        {
            return None;
        }
        return Some("Net");
    }
    // Legacy tokio 0.1 socket crates — `tokio_tcp`/`tokio_udp` are *entirely* networking
    // (no pure types to over-flag), so the whole crate is Net. (Found hardening on websocat,
    // which is still on tokio 0.1: its `tokio_tcp::TcpStream::connect` was classified
    // network-free — a network tool confidently reporting 0 Net.)
    if matches!(crate_name, "tokio_tcp" | "tokio_udp") {
        return Some("Net");
    }
    // The other async runtimes mirror tokio's module layout, and their `net` modules hold only
    // socket I/O types (the pure `SocketAddr`/`IpAddr` are re-exports that resolve to `std::net`,
    // so they're excluded by def-path). `mio` is the low-level non-blocking-socket layer under
    // tokio/others; `async_net` is smol's net crate. Closes the async-std/smol/mio gap the
    // tokio_tcp note flagged. (Calibrated by module structure — these crates ARE networking — not
    // a live repro; the TCP/UDP types are defined in-crate so the def-path prefix is exact.)
    if path.starts_with("async_std::net::")
        || path.starts_with("mio::net::")
        || crate_name == "async_net"
    {
        return Some("Net");
    }
    // Database clients. Like the AWS/HTTP builders, only the execution verbs are I/O;
    // query *construction* is pure. Best-effort across crates (tune via CANDOR_CONFIG).
    // Note: bare `::query` is deliberately omitted — it executes in postgres/rusqlite but
    // only *builds* in sqlx, so including it would false-positive sqlx's `query()` builder.
    if DB_CRATES.contains(&crate_name) {
        // Postgres / SQLite-family clients: `query`/`batch_execute`/`prepare`/etc. ARE the
        // execution (round-trips to the server). sqlx is the outlier where bare `query()`
        // only BUILDS — it keeps the narrow set below. (Found by running on a real
        // tokio-postgres app, pgman: candor had reported only 4 of ~20 DB call sites.)
        if matches!(crate_name, "postgres" | "tokio_postgres" | "deadpool_postgres" | "rusqlite") {
            // `PG_DB_VERBS`, hoisted to module level so the AS-EFF-008 masking guard reads the SAME
            // table (SOUNDNESS R806; see `masks_locator` and `PG_DB_VERBS_NO_SQL`).
            const PG: &[&str] = PG_DB_VERBS;
            if PG.iter().any(|v| path.ends_with(v)) {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27): `CancelToken::cancel_query` (tokio-postgres
            // cancel_token.rs:34) opens a BRAND NEW connection to the server to send a raw CancelRequest
            // packet — real socket I/O, but not a query round-trip on an existing connection like the PG
            // verb list above, so bucketed `Net` rather than `Db`.
            if matches!(crate_name, "tokio_postgres" | "postgres")
                && path.ends_with("CancelToken::cancel_query")
            {
                return Some("Net");
            }
            // rusqlite only: opening the database IS the connection establishment (`Connection::
            // open`/`open_in_memory`/`open_with_flags` — the embedded analog of `::connect`).
            //
            // THE FIX: rusqlite 0.32's `Connection` type has SIX `open*` constructors, not three —
            // `open_with_flags_and_vfs` and `open_in_memory_with_flags_and_vfs` call the real
            // `InnerConnection::open_with_flags` (the sqlite3_open_v2 FFI) directly (lib.rs:492,530), and
            // `open_in_memory_with_flags` (lib.rs:515) calls `Connection::open_with_flags(":memory:", ..)`
            // — but an exact-suffix allowlist keyed on the THREE simplest names never matches any of
            // them (`"open_in_memory_with_flags".ends_with("::open_with_flags")` is false: the suffix
            // check needs the string to END in that literal tail, and `_and_vfs`/`_with_flags` add
            // characters AFTER it). The same shape as `ignore::Walk::new`: a sibling spelling of an
            // already-modelled constructor missing from the allowlist, silently pure because rusqlite is
            // calibrated. Match on the `Connection::open` PREFIX rather than enumerating every suffix —
            // every current and future `Connection::open*` constructor opens a real handle. Scoped to the
            // `Connection::` segment specifically (not a bare leaf prefix) so an unrelated same-crate
            // `open`-prefixed method on a DIFFERENT type (e.g. the private `pragma::Sql::open_brace`,
            // which pushes one char to a string buffer — no I/O) cannot be swept in by accident.
            //
            // Same sighting, different constructor: `Connection::blob_open` and `Blob::reopen` call
            // `ffi::sqlite3_blob_open`/`sqlite3_blob_reopen` directly (blob/mod.rs:218,251) — genuinely
            // Db, and `sqlite3_blob_open`/`sqlite3_blob_reopen` are already in this file's own FFI-leaf DB
            // table above (matched only when a caller names the raw `ffi::` leaf directly) — but rusqlite's
            // own documented safe wrapper, the incremental-BLOB-I/O API every rusqlite blob consumer
            // actually calls, carried no rule of its own.
            if crate_name == "rusqlite"
                && (path.contains("::Connection::open")
                    || path.ends_with("::Connection::blob_open")
                    || path.ends_with("::Blob::reopen"))
            {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27): same shape again, and the SAME root cause as
            // `git2`'s — this `if crate_name == "rusqlite"` block returns unconditionally, so it never
            // reaches this file's own `sqlite3_*` FFI-leaf table below even though every one of these
            // calls a leaf ALREADY listed there (`sqlite3_backup_init`/`_step`, `sqlite3_blob_read`/
            // `_write`). Verified against rusqlite 0.32.1 source. `Backup::new`/`new_with_names` are the
            // crate's own online-backup constructors (backup.rs:187,200); `step`/`run_to_completion`
            // drive it; `Connection::backup`/`restore` (backup.rs:61,99) are the one-call convenience
            // wrappers around the same API and need their OWN rule since a consumer calling THEM never
            // names `Backup` at all. `Blob::{read,write}_at[_exact]`/`raw_read_at[_exact]`/
            // `write_all_at` (blob/pos_io.rs) are the incremental-BLOB positional-I/O methods, each
            // calling `ffi::sqlite3_blob_read`/`_write` directly. `Connection::from_handle`/
            // `_owned`/`extension_init2` and the free fn `init_auto_extension` (lib.rs:950,999,966;
            // auto_extension.rs:26) wrap a caller-supplied raw `*mut ffi::sqlite3` into a live
            // `Connection` — the loadable-extension entry points, same "produces a live connection"
            // effect as `Connection::open`, just over a handle the caller already has instead of one
            // this call opens itself (the `tokio_postgres::connect_raw`/`sea_orm::connect_proxy` shape).
            //
            // NOT included: `InnerConnection::*` and `RawStatement::step` LOOK like six more hits (self-
            // scan flags them too) but `mod inner_connection;`/`mod raw_statement;` (lib.rs:119,127) are
            // PRIVATE — despite `pub struct InnerConnection`/`RawStatement`, neither type has any public
            // path a real consumer could ever name or obtain a value of, so no rule was added for them
            // (a rule would be dead weight, never reachable). `Context::get_connection` (functions.rs)
            // is ALSO left out, deliberately: it returns a `ConnectionRef` accessor to an
            // ALREADY-established connection (`ffi::sqlite3_context_db_handle`, not an I/O verb) — the
            // same "handle accessor, not a syscall" shape as `TcpStream::local_addr`, not confirmed
            // enough to charge without risking the over-charge this file's history has repeatedly warned
            // against. THE COVERAGE-GATE SWEEP (2026-08-27) resolved this from "left in the ratchet"
            // to a formal call: `REVIEWED_PURE_ENTRIES` now carries `("rusqlite",
            // "rusqlite::Context::get_connection")` so the gate stops re-flagging it every refresh.
            //
            // TWO SPELLINGS EACH for `Backup`/`Blob`/`init_auto_extension`: none of the three is
            // re-exported at rusqlite's crate root (unlike `Connection`, declared directly in lib.rs), so
            // the ONLY real spelling a consumer can write is the module-qualified one
            // (`rusqlite::backup::Backup::new`, `rusqlite::blob::Blob::read_at`,
            // `rusqlite::auto_extension::init_auto_extension`) — but the coverage-gate ratchet recorded
            // the SHORT, technically-unreachable guess (`generate.py` always adds a bare
            // `{crate}::{Type}::{fn}` guess as a possible root-alias, without confirming a `pub use`
            // actually exists for it). Both are listed: the short form so this fix closes the exact row
            // the ratchet carries, the long form so it fires for what a real consumer's source (proven
            // against a compiling fixture) actually contains — dropping the long form would leave the
            // real gap open while the bookkeeping said closed.
            if crate_name == "rusqlite"
                && (path == "rusqlite::Backup::new"
                    || path == "rusqlite::backup::Backup::new"
                    || path == "rusqlite::Backup::new_with_names"
                    || path == "rusqlite::backup::Backup::new_with_names"
                    || path == "rusqlite::Backup::step"
                    || path == "rusqlite::backup::Backup::step"
                    || path == "rusqlite::Backup::run_to_completion"
                    || path == "rusqlite::backup::Backup::run_to_completion"
                    || path == "rusqlite::Connection::backup"
                    || path == "rusqlite::Connection::restore"
                    || path == "rusqlite::Blob::read_at"
                    || path == "rusqlite::blob::Blob::read_at"
                    || path == "rusqlite::Blob::read_at_exact"
                    || path == "rusqlite::blob::Blob::read_at_exact"
                    || path == "rusqlite::Blob::raw_read_at"
                    || path == "rusqlite::blob::Blob::raw_read_at"
                    || path == "rusqlite::Blob::raw_read_at_exact"
                    || path == "rusqlite::blob::Blob::raw_read_at_exact"
                    || path == "rusqlite::Blob::write_at"
                    || path == "rusqlite::blob::Blob::write_at"
                    || path == "rusqlite::Blob::write_all_at"
                    || path == "rusqlite::blob::Blob::write_all_at"
                    || path == "rusqlite::Connection::from_handle"
                    || path == "rusqlite::Connection::from_handle_owned"
                    || path == "rusqlite::Connection::extension_init2"
                    || path == "rusqlite::init_auto_extension"
                    || path == "rusqlite::auto_extension::init_auto_extension"
                    || path == "rusqlite::Statement::insert"
                    || path == "rusqlite::statement::Statement::insert"
                    || path == "rusqlite::Statement::raw_execute"
                    || path == "rusqlite::statement::Statement::raw_execute"
                    // SOUNDNESS R342 — `Rows::next` STEPS the statement: it is `self.advance()?`
                    // (`rusqlite-0.39.0/src/row.rs:40`), i.e. `sqlite3_step`, which is where a query's
                    // rows actually come from. Iterating a result set is the ordinary way to read from
                    // sqlite and it carried no `Db`. `advance` is listed beside it because it is `pub`
                    // and is the same call one level down.
                    || path == "rusqlite::Rows::next"
                    || path == "rusqlite::row::Rows::next"
                    || path == "rusqlite::Rows::advance"
                    || path == "rusqlite::row::Rows::advance")
            {
                return Some("Db");
            }
            return None;
        }
        // redis: the way redis is ACTUALLY used is the high-level `Commands`/`AsyncCommands`
        // traits (`con.get`/`set`/`hset`/`lpush`/…) — every method is a round-trip — plus
        // connection establishment. The shared VERBS below only catch the low-level
        // `cmd("GET").query(con)`, so without this a normal redis user's calls classify as
        // PURE. (Found hardening on redis-rs: a fn doing `con.get`/`set` reported no effects.)
        // SOUNDNESS R335 — the SENTINEL module, which the rules above reach only by accident. redis's
        // `sentinel` surface is how a client finds the current master in a failover deployment, and
        // every lookup TALKS TO THE SENTINEL SERVERS: `Sentinel::master_for` runs
        // `find_master_address` (a `SENTINEL masters` round-trip) and its own doc says "this will
        // connect to the master node to verify that it considers itself master"; `get_sentinel_client`
        // opens a client per address and issues `ROLE` until one answers. Measured on redis 1.6.0 —
        // which is this crate's REVIEWED CEILING, so the calibration exemption applied and every one of
        // them read as a positive purity claim, in both the receiver-typed and UFCS spellings.
        //
        // A DENYLIST, not the enumeration the surrounding rules use, and that is the point. The
        // enumerate-the-connecting-verbs shape is what goes stale: a release that ADDS a lookup verb
        // adds a SILENCE, the cardinal direction. Inverted, the whole module is `Db` except its
        // config surface, so a new verb is charged by default and only a new PURE verb costs a
        // fabrication. The exempt set is not guessed: every `pub fn` leaf in redis-1.6.0/src/sentinel.rs
        // is one of 33 names, and `build` / `new` / `set_*` are exactly the ones that touch no socket
        // (`Sentinel::build` parses URLs via `into_connection_info`; `SentinelClientBuilder::build`
        // assembles a config struct). The `contains("::Sentinel")` arm is not the loose match R321
        // punished: the module's ENTIRE public surface was enumerated before writing it, and no item
        // named `Sentinel*` exists anywhere else in the crate, nor any of these verb names.
        if crate_name == "redis"
            && (path.starts_with("redis::sentinel::") || path.contains("::Sentinel"))
        {
            let m = path.rsplit("::").next().unwrap_or(path);
            if m == "build" || m == "new" || m.starts_with("set_") {
                return None;
            }
            // §E1 HIT COUNTER (`CANDOR_ALIAS_DEBUG`) for `bin/corpus-ab.py --mark`.
            if std::env::var("CANDOR_ALIAS_DEBUG").is_ok() {
                eprintln!("R335SENTINEL {path}");
            }
            return Some("Db");
        }
        if crate_name == "redis"
            && (path.contains("Commands::")
                // THE COVERAGE-GATE SWEEP (2026-08-27), a pre-existing over-report found in passing:
                // `path.contains("::get_connection")` is a SUBSTRING match, so it also matched
                // `Client::get_connection_info` (client.rs:78) — a pure accessor returning an
                // already-stored `&ConnectionInfo`, no round-trip at all. Verified against redis 1.6.0.
                || (path.contains("::get_connection") && !path.ends_with("::get_connection_info"))
                || path.contains("::get_async_connection")
                || path.contains("::get_multiplexed_async_connection")
                // a live `ConnectionManager` round-trips (Db), but `ConnectionManagerConfig` is a pure
                // in-memory builder (set_number_of_retries/set_max_delay) — exclude it (adversarial review).
                // `ConnectionManager::clone` is an Arc refcount bump — no Db round-trip (sweep [27]).
                || (path.contains("ConnectionManager") && !path.contains("ConnectionManagerConfig")
                    && !path.ends_with("::clone"))
                || path.ends_with("::query")
                || path.ends_with("::query_async")
                || path.ends_with("::req_command")
                || path.ends_with("::req_packed_command")
                || path.ends_with("::req_packed_commands"))
        {
            return Some("Db");
        }
        // mongodb: a document-store API with none of the SQL verbs — the user calls
        // `coll.find_one`/`insert_one`/`aggregate`/… and `Client::with_uri_str`. Without
        // these a mongodb user's calls classify PURE. (Found hardening: a fn doing
        // `find_one`+`insert_one` reported no effects.) Handle accessors (name/namespace)
        // and option/doc builders don't match these verbs, so they stay pure.
        //
        // THE FIX: `Client::with_options(options)` IS `with_uri_str`'s own body one call down —
        // `with_uri_str` (client.rs:179) is literally `ClientOptions::parse(uri).await?;
        // Client::with_options(options)`, and `with_options` (client.rs:188) is where the topology/
        // monitoring actually spins up. A caller who already holds a `ClientOptions` (built
        // programmatically, or via `ClientOptions::parse` called separately) uses `with_options`
        // directly — mongodb's OWN alternate entry point for the identical effect, missing from an
        // allowlist keyed only on the URI-string spelling. Same shape as `ignore::Walk::new` and
        // diesel's `establish`: a sibling constructor of an already-modelled effect. Verified against
        // mongodb 3.8.1 source for both the async (`client.rs`) and sync (`sync/client.rs`) `Client`.
        if crate_name == "mongodb" {
            const MONGO: [&str; 28] = [
                "::with_uri_str", "::with_options", "::connect", "::find", "::find_one", "::insert_one",
                "::insert_many", "::update_one", "::update_many", "::delete_one",
                "::delete_many", "::replace_one", "::aggregate", "::count_documents",
                "::estimated_document_count", "::count", "::distinct", "::run_command",
                "::find_one_and_update", "::find_one_and_delete", "::find_one_and_replace",
                "::list_collections", "::list_collection_names", "::list_databases",
                "::list_database_names", "::create_collection", "::create_index", "::watch",
            ];
            if MONGO.iter().any(|v| path.ends_with(v)) {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27), verified against mongodb 3.8.1 — the client-side
            // field-level encryption (CSFLE) surface, entirely unrelated to the CRUD verb list above.
            //
            // `ClientEncryption::decrypt` (client/csfle/client_encryption.rs:195) is an ordinary `pub
            // async fn` that bottoms out in `CryptExecutor::run_ctx` (client/csfle/state_machine.rs:106),
            // a state-machine loop that — depending on state — runs a real `list_collections` query
            // against the key-vault database, executes a real command against `mongocryptd` (respawning
            // the child process if the connection drops), and fetches data keys from the key vault:
            // genuinely Net (and, via mongocryptd respawn, Exec), reached from a manual decrypt call, not
            // a guess. Suffix-matched because the real path runs through a re-export hop the ratchet's
            // crate-root-alias guess skips: `ClientEncryption` is defined inside `pub(crate) mod csfle;`
            // (client.rs:4) and reachable only via `pub use crate::client::csfle::client_encryption;` at
            // the crate root (lib.rs:74) — `mongodb::client_encryption::ClientEncryption`, not bare
            // `mongodb::ClientEncryption`. The name is specific enough within this crate that a suffix
            // match carries no fabrication risk (crate-gated, and `ClientEncryption` exists nowhere else
            // in mongodb's own source).
            if path.ends_with("ClientEncryption::decrypt") {
                return Some("Net");
            }
            // NOT modelled (removed from open.tsv, not guessed): `CreateDataKey::execute` /
            // `Encrypt::execute` — a DIFFERENT false-guess shape from every other row in this pass.
            // `CreateDataKey`/`Encrypt` (action/csfle/create_data_key.rs, action/csfle/encrypt.rs) are
            // the crate's real, publicly re-exported Action-builder types (`mongodb::action::csfle::
            // {CreateDataKey,Encrypt}`) — but the SAME effect self-scan found (the real `run_ctx` call)
            // lives in `impl Action for CreateDataKey<'a> { async fn execute(self) -> .. { .. } }`
            // (client/csfle/client_encryption/create_data_key.rs:14), which is the INPUT to the
            // `#[action_impl]` proc macro, not a real method: the `Action` trait (action.rs:104) declares
            // only `optional`, and its own doc comment says the crate's action types are "executed via
            // `await` (or `run` if using the sync client)" — the macro consumes this `execute` fn body
            // and re-emits it as `IntoFuture::into_future`, so no compiled `CreateDataKey`/`Encrypt`
            // value ever has a method literally named `execute` a consumer could call. Self-scan found a
            // real function performing a real effect; it is just never reachable under this spelling
            // (nor, by construction, under ANY spelling — a consumer's call site is `.await`, not a
            // `.execute()` method call, so candor-scan would need to resolve the `IntoFuture` desugaring
            // itself to see this at all, a different, deeper question than a classify() rule can answer).
            return None;
        }
        // mysql / mysql_async: the `query`/`exec` families + `get_conn`/`ping` execute
        // immediately — no build-then-execute split like sqlx, so matching `::query` is safe
        // here. Same DB-verb-dialect gap class as redis/mongodb; calibrated from the Queryable
        // API (unit-tested; a real-app repro is the remaining confirmation).
        //
        // THE FIX: `Conn::new(opts)` is each crate's OWN primary connection constructor — not a
        // pool helper like `get_conn`, but the raw handle. `mysql::Conn::new` (conn/mod.rs:342) calls
        // `conn.connect_stream()?; conn.connect()?` directly; `mysql_async::Conn::new` (conn/mod.rs:921)
        // returns a future that does the same handshake. Real connection establishment, same shape as
        // diesel's `establish`/rusqlite's `open*` — but `::new` never appeared in this verb list, so a
        // bare `Conn::new(opts)?` (the crate's OWN first doctest example) read pure. Scoped to the
        // `Conn::` segment specifically (`::new` alone is far too generic a suffix to key on blindly —
        // `Opts`/`Pool`/query-result types in the same two crates have their own pure `new`s).
        if matches!(crate_name, "mysql" | "mysql_async") {
            if path.ends_with("::Conn::new") {
                return Some("Db");
            }
            const MY: [&str; 16] = [
                "::query", "::query_first", "::query_iter", "::query_map", "::query_fold",
                "::query_drop", "::exec", "::exec_first", "::exec_iter", "::exec_map",
                "::exec_fold", "::exec_drop", "::exec_batch", "::prep", "::ping", "::get_conn",
            ];
            if MY.iter().any(|v| path.ends_with(v)) {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27), verified against mysql_async 0.37.0:
            // `Conn::from_url` (conn/mod.rs:1059) is `Conn::new(Opts::from_str(url)?)` one hop down —
            // the crate's OWN alternate entry point for the identical connect effect `Conn::new` above
            // already carries, same shape as `ignore::Walk::new`/diesel's `establish`.
            // `WhiteListFsHandler::handle` (local_infile_handler/builtin.rs:58, the `GlobalHandler` impl
            // for `LOAD DATA LOCAL INFILE`) opens a real file off the caller-supplied whitelist —
            // reachable at the crate root (`pub use self::local_infile_handler::{builtin::
            // WhiteListFsHandler, ..}`, lib.rs:500).
            if path == "mysql_async::Conn::from_url" {
                return Some("Db");
            }
            if path.ends_with("WhiteListFsHandler::handle") {
                return Some("Fs");
            }
            // NOT modelled (all three removed from open.tsv, not guessed): `mysql::MyTcpBuilder::connect`/
            // `Stream::connect_tcp`/`Stream::make_secure` (mysql, not mysql_async — io/tcp.rs, io/mod.rs,
            // io/tls/native_tls_io.rs). `mod io;` is PRIVATE in mysql's lib.rs with no re-export of
            // `MyTcpBuilder`/`Stream`, so none of the three is a path any external consumer can name —
            // the crate's real, externally-reachable connect effect is `Conn::new` above (already
            // covered), which calls into this private `io` module internally. Also NOT modelled:
            // `mysql_async::PathOrBuf::read` (opts/mod.rs) — `PathOrBuf` is declared in the same private
            // `mod opts;` whose OTHER types (`Opts`, `OptsBuilder`, …) ARE individually `pub use`-
            // re-exported at the crate root (lib.rs:493) but `PathOrBuf` specifically is not, so it too
            // is unreachable — the same private-module shape as tempfile's `imp::` functions above.
            return None;
        }
        // sea_orm: an ORM whose execution is split from building (like sqlx). The query
        // BUILDERS (`Entity::find`, `Entity::insert`) are pure; execution happens at `.all`/
        // `.one`/`.count`/`.stream` and `Insert/Update/Delete::exec`. The write path via an
        // ActiveModel (`model.insert(db)`) executes too — distinguished from the `EntityTrait`
        // builder by the trait in the path (`ActiveModelTrait::`). (Found hardening on a
        // sea_orm consumer app: `.all(db)` reads and `ActiveModel::insert` writes were pure.)
        if crate_name == "sea_orm" {
            // sea_orm RE-EXPORTS sea_query (`sea_orm::sea_query::…`), whose builder algebra collides with
            // the execution verbs: `Func::count(col)` builds a COUNT() expr, `Condition::all()` AND-groups
            // filters, `Expr::count(…)` — all PURE, none touch a db. The `::all`/`::count`/`::one` execution
            // rule fabricated Db on them (sweep [5]). sea_query is pure query construction end-to-end, so
            // exclude the whole re-exported namespace first.
            if path.contains("sea_query") {
                return None;
            }
            if path.ends_with("::all")
                || path.ends_with("::one")
                || path.ends_with("::count")
                || path.ends_with("::stream")
                || path.ends_with("::exec")
                || path.ends_with("::exec_with_returning")
                || path.ends_with("::exec_without_returning")
                || path.ends_with("::connect")
                // `Database::connect_proxy` (database/mod.rs:139, behind the `proxy` feature) is
                // `Database::connect`'s sibling for a caller-supplied `ProxyDatabaseTrait` backend —
                // same effect (produces a live `DatabaseConnection`), different verb, missing from an
                // allowlist keyed on the plain `connect` spelling.
                || path.ends_with("::connect_proxy")
                || path.ends_with("::execute")
                || path.ends_with("::execute_unprepared")
                || path.ends_with("::query_one")
                || path.ends_with("::query_all")
                || path.ends_with("::fetch_page")
                || path.ends_with("::num_items")
                || path.contains("ActiveModelTrait::")
            {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27): sea_orm's TRANSACTION and PAGINATION families,
            // verified against sea-orm 1.1.20 source — each of these was found effectful by self-scan
            // under no guessed spelling this allowlist already covered.
            //
            // `DatabaseConnection::transaction`/`transaction_with_config` (db_connection.rs:302,345, the
            // `TransactionTrait` impl) is the crate's documented callback-transaction API
            // (`db.transaction(|txn| ...)`) — every sqlx-backed match arm dispatches to the
            // `SqlxXxxPoolConnection::transaction` methods FQN-listed below, a real BEGIN. FQN-exact
            // (not a bare `::transaction` suffix) because `MockDatabaseConnection`/`ProxyDatabaseConnection`
            // (driver/mock.rs, driver/proxy.rs, both feature-gated) have their OWN `begin`/`commit`/
            // `rollback`/`ping`/`transaction` methods sharing every one of these verb names — a mock
            // backend performs no real I/O by construction, and a caller-supplied proxy is a callback
            // boundary, not a provable effect; a bare suffix would fabricate Db on both.
            if path == "sea_orm::DatabaseConnection::transaction"
                || path == "sea_orm::DatabaseConnection::transaction_with_config"
                // BONUS, found while proving the above reachable with a real consumer fixture (not in
                // the original coverage-gate ratchet — self-scan's own reachability pass didn't flag
                // these, apparently because it doesn't track an enum match arm's payload binding as a
                // typed receiver, but they dispatch through the identical match-on-`self` shape as
                // `transaction` two lines up): `DatabaseConnection::ping` (db_connection.rs:462) and the
                // `TransactionTrait::begin`/`begin_with_config` impl (db_connection.rs:246,268) — a fixture
                // proved `ping` silently read pure with no rule at all.
                || path == "sea_orm::DatabaseConnection::ping"
                || path == "sea_orm::DatabaseConnection::begin"
                || path == "sea_orm::DatabaseConnection::begin_with_config"
                // `DatabaseTransaction::commit`/`rollback` (transaction.rs:119,159) call
                // `<sqlx::X as sqlx::Database>::TransactionManager::commit`/`rollback` directly — real
                // COMMIT/ROLLBACK, not sea_orm's OWN `::begin`/`::run` (both `pub(crate)`, unreachable).
                || path == "sea_orm::DatabaseTransaction::commit"
                || path == "sea_orm::DatabaseTransaction::rollback"
                // The three sqlx-backed pool connections' OWN `begin`/`ping`/`transaction` (driver/
                // sqlx_{mysql,postgres,sqlite}.rs) — `begin`/`transaction` acquire a pool connection and
                // start a real transaction, `ping` round-trips `conn.ping()` to the server.
                || path == "sea_orm::SqlxMySqlPoolConnection::begin"
                || path == "sea_orm::SqlxMySqlPoolConnection::ping"
                || path == "sea_orm::SqlxMySqlPoolConnection::transaction"
                || path == "sea_orm::SqlxPostgresPoolConnection::begin"
                || path == "sea_orm::SqlxPostgresPoolConnection::ping"
                || path == "sea_orm::SqlxPostgresPoolConnection::transaction"
                || path == "sea_orm::SqlxSqlitePoolConnection::begin"
                || path == "sea_orm::SqlxSqlitePoolConnection::ping"
                || path == "sea_orm::SqlxSqlitePoolConnection::transaction"
                // `Paginator::fetch`/`fetch_and_next`/`into_stream`/`num_pages`/`num_items_and_pages`
                // (executor/paginator.rs) all transitively reach `fetch_page`/`num_items` — already-
                // covered verbs — but each is ALSO a documented entry point a real consumer calls
                // directly (`cake::Entity::find().paginate(db, 50).into_stream()`, the crate's own
                // pagination doc example) and needs its own rule for the same reason
                // `Connection::backup` needed one beside `Backup::new` in rusqlite.
                || path == "sea_orm::Paginator::fetch"
                || path == "sea_orm::Paginator::fetch_and_next"
                || path == "sea_orm::Paginator::into_stream"
                || path == "sea_orm::Paginator::num_pages"
                || path == "sea_orm::Paginator::num_items_and_pages"
                // `Insert`/`Inserter`/`TryInsert::exec_with_returning_keys`/`_many` (executor/insert.rs)
                // are sibling spellings of the already-covered `::exec_with_returning` (same shape as
                // rusqlite's `open_with_flags_and_vfs` beside `open_with_flags`): each calls through to
                // the same underlying `exec_with_returning_keys`/`_many` executor, a real INSERT.
                || path.ends_with("::exec_with_returning_keys")
                || path.ends_with("::exec_with_returning_many")
            {
                return Some("Db");
            }
            return None;
        }
        // (Reached by sqlx + diesel — the build-vs-execute-split crates.) `first` is diesel's
        // LIMIT-1 round trip and `load_iter` its 2.x streaming execution; `fetch_many` is sqlx's
        // multi-result stream. All crate-gated, so a std `Vec::first` never resolves here.
        //
        // `establish` is diesel's OWN name for `::connect` — `Connection::establish(url)`
        // (connection/mod.rs:243), implemented by opening the real backend handle in
        // `SqliteConnection`/`PgConnection`/`MysqlConnection::establish` (sqlite/connection/mod.rs:230,
        // pg/connection/mod.rs:176, mysql/connection/mod.rs:158 — each does the real file-open/socket-
        // connect). It is diesel's canonical, and by far most common, connection entry point — every
        // diesel quickstart opens with it — yet it shares no verb spelling with `::connect`, so it fell
        // through this allowlist to `None`, and because `diesel` IS a CALIBRATED_CRATES entry the miss
        // produced NO `coverage.uncovered` disclosure either (that ledger is crate-level: a calibrated
        // crate's unmatched path reads as reviewed-pure, not as a gap) — the same silent-purity shape as
        // `ignore::Walk::new` above, one call away from `establish_test_transaction`/`establish_inner`,
        // which are diesel's own private plumbing and stay unmatched (no `::` in the allowed suffix keeps
        // this exact-verb, not a substring match).
        const VERBS: [&str; 20] = [
            "::execute", "::query_row", "::query_map", "::query_one", "::fetch_one",
            "::fetch_all", "::fetch_optional", "::fetch", "::fetch_many", "::connect",
            "::acquire", "::begin", "::commit", "::rollback", "::load", "::load_iter",
            "::first", "::get_result", "::get_results", "::establish",
        ];
        if VERBS.iter().any(|v| path.ends_with(v)) {
            return Some("Db");
        }
        return None;
    }
    // std::path::Path / PathBuf STAT-family methods hit the filesystem (each is a stat/readlink/
    // readdir syscall) — unlike the rest of the std::path surface, which is pure string manipulation
    // (join/file_name/extension/parent/…). Verb-precise so the scanner's receiver inference can safely
    // route a `path.symlink_metadata()` method call here. (A blackout screen caught gix-dir — an entire
    // directory WALKER — reporting ZERO Fs because all its I/O is Path-method calls; same class as
    // fd's residual `Path::symlink_metadata` under-report.)
    if let Some(m) = path
        .strip_prefix("std::path::Path::")
        .or_else(|| path.strip_prefix("std::path::PathBuf::"))
    {
        const STAT: &[&str] = &[
            "metadata", "symlink_metadata", "canonicalize", "read_link", "read_dir", "exists",
            "try_exists", "is_file", "is_dir", "is_symlink",
        ];
        return STAT.contains(&m).then_some("Fs");
    }
    // OPTION-BUILDERS, the shape SPEC §1 ⟨0.32⟩ separates from an invocation object: "option-builders for
    // other effects (`OpenOptions`, request builders) stay pure because their resource arrives at the
    // terminal verb, which is charged at its own call site". An `OpenOptions` holds a handful of bools and
    // names no file; `DirBuilder` holds one bool and a mode. Both sit under the coarse `std::fs::` prefix
    // below, which charged Fs for `OpenOptions::new()` and for every `o.read(true)` — MEASURED: a
    // `let o = OpenOptions::new().read(true);` with no `open` ANYWHERE reported `Fs`.
    //
    // A DENYLIST, and keyed on the TYPE. Only the provably-pure setters/ctors are subtracted; anything
    // else under the type keeps its effect, so the terminal verb (`OpenOptions::open`, `DirBuilder::create`)
    // stays Fs and a std addition we have not read about fails in the safe direction. The type key is not
    // decoration: `create` is a pure flag SETTER on `OpenOptions` and the mkdir SYSCALL on `DirBuilder` —
    // one leaf, opposite answers. (candor-java keys the same carve-out by DESCRIPTOR, because its collision
    // is an overload — `command()` reads back, `command(List)` sets. Rust has no overloads, so the type IS
    // the discriminator; a bare-name denylist would silence `DirBuilder::create`.)
    if let Some(m) = path.strip_prefix("std::fs::OpenOptions::") {
        const PURE: &[&str] = &[
            // the builder itself + the std flag setters
            "new", "read", "write", "append", "truncate", "create", "create_new",
            // the platform extension setters (`OpenOptionsExt`, unix + windows)
            "mode", "custom_flags", "security_qos_flags", "access_mode", "share_mode", "attributes",
            // derives
            "clone", "default", "fmt", "eq", "ne", "hash",
        ];
        return (!PURE.contains(&m)).then_some("Fs");
    }
    if let Some(m) = path.strip_prefix("std::fs::DirBuilder::") {
        const PURE: &[&str] = &["new", "recursive", "mode", "clone", "default", "fmt"];
        return (!PURE.contains(&m)).then_some("Fs");
    }
    // THE PLATFORM `fs` MODULES — `std::os::{unix,windows,wasi}::fs`. Measured 2026-09-02, ground truth
    // EXECUTED (a `cargo run` that really created a symlink on disk and then stat'd it back):
    // `std::os::unix::fs::symlink`, `chown`, `lchown` and `chroot` all read PURE, so `deny Fs` over a
    // crate whose only filesystem write is a symlink exited 0. The `std::fs::` prefix below is the whole
    // filesystem rule and these modules are simply not under it — the platform-specific half of std's
    // filesystem API had no rule at all. (Found tracing why `tokio::fs::symlink` carries no `Fs` of its
    // own; its body is `asyncify(move || std::os::unix::fs::symlink(..))`.)
    //
    // A DENYLIST keyed on the TRAIT, exactly like `OpenOptions`/`DirBuilder` above and for the same
    // reason: subtract only the provably-pure surfaces, so a std addition nobody here has read about
    // fails in the SAFE direction. What is subtracted, and why each is pure:
    //   * `MetadataExt` / `DirEntryExt` / `FileTypeExt` — accessors over data ALREADY fetched by the
    //     `metadata()`/`read_dir()` call that is charged at its own site. `m.uid()` issues no syscall.
    //   * `PermissionsExt` — reads/sets bits on an in-memory `Permissions`; the syscall is
    //     `set_permissions`, charged under `std::fs::`.
    //   * `OpenOptionsExt` / `DirBuilderExt` — SPEC §1 ⟨0.32⟩ option-builders: the resource arrives at
    //     the terminal verb (`open`/`create`), which is charged at its own call site.
    // `FileExt` is deliberately NOT subtracted — `read_at`/`write_at`/`seek_read`/`seek_write` are the
    // positional-I/O syscalls and are exactly what this rule must keep.
    if let Some(rest) = path
        .strip_prefix("std::os::unix::fs::")
        .or_else(|| path.strip_prefix("std::os::windows::fs::"))
        .or_else(|| path.strip_prefix("std::os::wasi::fs::"))
    {
        const PURE_TRAITS: &[&str] = &[
            "MetadataExt::", "DirEntryExt::", "DirEntryExt2::", "FileTypeExt::",
            "PermissionsExt::", "OpenOptionsExt::", "DirBuilderExt::",
        ];
        return (!PURE_TRAITS.iter().any(|t| rest.starts_with(t))).then_some("Fs");
    }
    // THE PLATFORM `process` MODULES — `std::os::{unix,windows,wasi}::process`. SOUNDNESS R141, the
    // EXACT SIBLING of the `fs` rule above, and unruled for the same reason it was: R130 closed
    // `std::os::*::fs` and translated that question across ENGINES while never translating it across
    // SIBLING MODULES of the namespace it had just found unruled.
    //
    // Ground truth EXECUTED when the row was filed: a consumer printed `before`, then
    // `EXECED-THROUGH-LIB`, and never reached the following line — `CommandExt::exec` is `execvp` and
    // really does replace the process image. Re-measured at HEAD 2026-09-27 on a 5-function fixture:
    // `CommandExt::exec(c)`, `std::os::unix::process::CommandExt::exec(c)` and
    // `fn f<C: CommandExt>(c: &mut C) { c.exec() }` were all ABSENT from `functions[]` — no `Unknown`,
    // no `unresolved` — and `deny Exec`, `pure` and `deny Exec Unknown` all exited 0, while on the SAME
    // tree the RECEIVER spelling `c.exec()` exited 1 and the sibling-namespace UFCS control
    // `FileExt::read_at(f, b, 0)` exited 1. So this is the one-spelling-of-two shape of R130 itself:
    // `c.exec()` was only ever charged because the receiver types to `std::process::Command` and the
    // whole-type rule below answers; nothing answered for the trait-path spelling.
    //
    // A DENYLIST keyed on the TRAIT, exactly like the `fs` rule and for the same reason — subtract only
    // the provably-pure surfaces so a std addition nobody here has read about fails in the SAFE
    // direction. What is subtracted, and why each is pure:
    //   * `ExitStatusExt` / `ExitStatusError` / `ExitCodeExt` — accessors and constructors over an
    //     ALREADY-COLLECTED status (`signal()`, `core_dumped()`, `from_raw(n)`). The wait that produced
    //     it is charged at its own site under `std::process::Child`.
    //   * `parent_id` — `getppid()`, a read of this process's own identity, no spawn. Kept at PARITY
    //     with `std::process::id`, which carries no rule either; subtracting it here rather than
    //     leaving it to the Exec cliff is the one place this rule departs from "unrecognised keeps
    //     Exec", and it is named rather than folded in.
    // Everything else keeps Exec: `CommandExt::{exec, pre_exec, arg0, uid, gid, groups,
    // process_group}` and the windows `CommandExt::{creation_flags, raw_arg, …}` / `ChildExt`. That is
    // also what the receiver spelling already answers — `c.uid(0)` reports `['Exec']` at HEAD — so this
    // rule makes the two spellings agree rather than inventing a new verdict for either.
    if let Some(rest) = path
        .strip_prefix("std::os::unix::process::")
        .or_else(|| path.strip_prefix("std::os::windows::process::"))
        .or_else(|| path.strip_prefix("std::os::wasi::process::"))
    {
        const PURE: &[&str] =
            &["ExitStatusExt::", "ExitStatusError::", "ExitCodeExt::", "parent_id"];
        return (!PURE.iter().any(|t| rest.starts_with(t))).then_some("Exec");
    }
    // Filesystem. `tokio::fs`/`async_std::fs` are the async mirrors of `std::fs`; `async_fs` is
    // smol's fs crate; `fs_err` is a drop-in `std::fs` wrapper (its whole surface is fs I/O).
    if path.starts_with("std::fs::")
        || path.starts_with("tokio::fs::")
        || path.starts_with("async_std::fs::")
        || crate_name == "async_fs"
        || crate_name == "fs_err"
    {
        return Some("Fs");
    }
    // memmap2: only `MmapOptions::map*` (and the in-place `Mmap::flush`/`make_*` protection
    // changes / `remap`) actually issue the mmap/msync/mprotect/mremap syscall = Fs. The rest of the
    // crate is PURE: `MmapOptions::new`/setters BUILD the request, and once a region is mapped, reads
    // over it (`Mmap::len`/`is_empty`/`as_ptr`/`as_mut_ptr`/`deref` into the byte slice) are plain
    // memory access with no syscall. Whole-crate Fs fabricated Fs on those reads (a `m.len()` the
    // scanner's receiver inference routes to `memmap2::Mmap::len`). Match the syscall-issuing verbs;
    // everything else returns None (pure). `map*` covers `map`/`map_mut`/`map_exec`/`map_copy`/
    // `map_copy_read_only`/`map_raw`/`map_raw_read_only`/`map_anon`.
    if crate_name == "memmap2" {
        let m = path.rsplit("::").next().unwrap_or(path);
        if m.starts_with("map")
            || m == "flush"
            || m == "flush_async"
            || m == "flush_range"
            || m == "flush_async_range"
            || m == "remap"
            || m.starts_with("make_")
            || m == "advise"
            || m == "advise_range"
            || m == "lock"
            || m == "unlock"
        {
            return Some("Fs");
        }
        return None;
    }
    // tempfile: creating a temp file/dir touches the disk. Match the create/persist verbs (the
    // `Builder` setters — prefix/suffix/rand_bytes — stay pure). `persist`/`keep` rename/retain
    // the file on disk; `close` removes it.
    if crate_name == "tempfile"
        && (path.ends_with("::tempfile")
            || path.ends_with("::tempfile_in")
            || path.ends_with("::tempdir")
            || path.ends_with("::tempdir_in")
            || path.ends_with("NamedTempFile::new")
            || path.ends_with("NamedTempFile::new_in")
            || path.ends_with("TempDir::new")
            || path.ends_with("TempDir::new_in")
            || path.ends_with("::persist")
            || path.ends_with("::persist_noclobber")
            || path.ends_with("::keep"))
    {
        return Some("Fs");
    }
    // THE COVERAGE-GATE SWEEP (2026-08-27), verified against tempfile 3.27.0 source — the SIBLING
    // constructors/closers the create/persist verb list above never reached:
    //
    // `Builder::make`/`make_in` (lib.rs:716,739) are the crate's OWN documented escape hatch for a
    // caller-supplied factory (`Builder::new().make_in(dir, |path| UnixListener::bind(path))`) — real
    // disk creation via `util::create_helper`, same mechanism as `Builder::tempfile`/`tempfile_in`
    // two lines up, just a different entry verb.
    // `NamedTempFile::with_prefix`/`with_prefix_in`/`with_suffix`/`with_suffix_in` (file/mod.rs:630-677)
    // are one-call convenience wrappers documented as equivalent to `Builder::new().prefix(..).tempfile()`
    // — real creation, missing because the verb list matched `NamedTempFile::new`/`new_in` but not these.
    // `NamedTempFile::reopen` (file/mod.rs:951) calls the platform `imp::reopen`, a real `open`/`fstat`
    // pair (found the original file was replaced, or hands back a fresh handle to it).
    // `TempPath::close` (file/mod.rs:161) and `TempDir::close` (dir/mod.rs:470) `fs::remove_file`/
    // `remove_dir_all` the real path — `NamedTempFile::close` (file/mod.rs:727) is a thin `self.path.close()`
    // delegate to the same `TempPath::close`, so matching the `::close` suffix (crate-gated, and the ONLY
    // three `pub fn close` in this crate) catches it too without a separate rule.
    // `SpooledTempFile::set_len` (spooled.rs:134) calls `File::set_len` on the real disk file once the
    // in-memory buffer has spilled past `max_size` — the crate's own roll-over threshold, not a corner case.
    //
    // NOT included: `tempfile::create`/`create_named`/`reopen` (dir/imp/any.rs, file/imp/windows.rs,
    // file/imp/unix.rs) — despite being `pub fn`, `mod dir;`/`mod file;` are PRIVATE at the crate root
    // (lib.rs:202,204) with no re-export of the `imp` submodules, so no external consumer can ever name
    // these paths; the ratchet's generator guesses a crate-root alias for every candidate regardless of
    // whether one is real (the same "second, related shape" gap the previous pass's rusqlite/lettre
    // private-module findings already documented — restricted_types()/is_bare_pub check a type's or fn's
    // OWN visibility keyword, not its enclosing module chain). Removed from open.tsv rather than guessed.
    if crate_name == "tempfile"
        && (path == "tempfile::Builder::make"
            || path == "tempfile::Builder::make_in"
            || path == "tempfile::NamedTempFile::with_prefix"
            || path == "tempfile::NamedTempFile::with_prefix_in"
            || path == "tempfile::NamedTempFile::with_suffix"
            || path == "tempfile::NamedTempFile::with_suffix_in"
            || path == "tempfile::NamedTempFile::reopen"
            || path == "tempfile::SpooledTempFile::set_len"
            || path.ends_with("::close"))
    {
        return Some("Fs");
    }
    // glob: walks the filesystem to expand a pattern (the returned iterator reads directories).
    // `Pattern::matches` is pure string matching — match only the directory-walking entry points.
    if crate_name == "glob" && (path.ends_with("::glob") || path.ends_with("::glob_with")) {
        return Some("Fs");
    }
    // Password-hashing / KDF crates — the entropy tier (the TS engine's CTA lesson: an invisible
    // argon2 landed on exactly the call a security review cares about). In this engine's
    // verb-precise style the ENTROPY is the salt mint: `SaltString::generate(OsRng)` in the
    // password-hash API family, and bcrypt's `hash`/`hash_with_result` (salt minted internally).
    // Verification and explicit-salt hashing are deterministic recomputation — pure. `rand_core`
    // carries the OsRng source itself (otherwise the most common salt mint is invisible).
    if matches!(crate_name, "argon2" | "scrypt" | "pbkdf2" | "password_hash") {
        // SOUNDNESS R318 — `SaltString::generate` was this block's ONLY match target and the type was
        // DELETED upstream in password-hash 0.6.0 (0.5.0: 21 occurrences; 0.6.1: zero). Everything below
        // it fell through to `return None`, so all four crates asserted purity — including on
        // `argon2.hash_password(password)`, the one-argument DEFAULT TRAIT METHOD at
        // `password-hash-0.6.1/src/lib.rs:107` whose body is `let salt = try_generate_salt()?;`. That is
        // the most documented call shape in the family, minting OS entropy, reading pure, on crates whose
        // entire purpose is a security review.
        //
        // `ends_with`, NOT `contains`: `hash_password_with_salt` takes an explicit salt and is
        // deterministic recomputation — correctly PURE — and a `contains` match would fabricate `Rand`
        // on it. `hash_password_with_rng` DOES draw, from the caller's RNG, so it is charged.
        // The old `SaltString::generate` clause is kept: it is still the right answer for 0.5.x.
        if path.contains("SaltString::generate")
            || path.ends_with("::generate_salt")
            || path.ends_with("::try_generate_salt")
            // SOUNDNESS R330 — this suffix is a DEFAULT, refined by arity at the call site. `hash_password`
            // is one name with two signatures (see `password_hash_explicit_salt` below), and the path
            // cannot tell them apart. Charging here and NARROWING there is deliberate: a consumer that
            // never consults the refinement keeps the over-report, never the silence.
            || path.ends_with("::hash_password")
            || path.ends_with("::hash_password_with_rng")
        {
            return Some("Rand");
        }
        return None;
    }
    if crate_name == "bcrypt" {
        // SOUNDNESS R319 — this list was EXACTLY bcrypt's internal-salt surface at 0.15.1 and fell
        // behind by ADDITION, not by rename: 0.19.3 adds four more verbs that each document "the salt
        // is generated randomly using the OS randomness" and reach `getrandom::fill`. A stale-PATH
        // check could never have found this, because every old path still exists and still works —
        // a version ceiling catches additions, a path check only catches removals.
        // The explicit-salt family (`hash_with_salt`, `hash_with_salt_bytes`,
        // `non_truncating_hash_with_salt*`) stays PURE: the caller supplies the salt.
        if path.ends_with("::hash")
            || path.ends_with("::hash_with_result")
            || path.ends_with("::non_truncating_hash")
            || path.ends_with("::hash_bytes")
            || path.ends_with("::non_truncating_hash_bytes")
            || path.ends_with("::non_truncating_hash_with_result")
        {
            return Some("Rand");
        }
        return None;
    }
    if crate_name == "rand_core" {
        if path.contains("OsRng")
            || path.ends_with("::next_u32")
            || path.ends_with("::next_u64")
            || path.ends_with("::fill_bytes")
            // SOUNDNESS R333 — the FALLIBLE trait. rand_core 0.10 splits `RngCore` from `TryRngCore`,
            // and `SysRng` (the renamed `OsRng`) is fallible, so `try_next_u32` is the natural API on
            // it. `ends_with("::next_u32")` does NOT match `::try_next_u32`, so the modern spelling of
            // a real entropy draw read PURE. Third instance in one day, after R319 and R321, of the
            // same shape: an upstream rename is rarely just a rename — it arrives with an API SHAPE
            // change, and a suffix list written against the old shape stops covering the new one.
            || path.ends_with("::try_next_u32")
            || path.ends_with("::try_next_u64")
            || path.ends_with("::try_fill_bytes")
        {
            return Some("Rand");
        }
        return None;
    }
    // Randomness / entropy. `getrandom`/`fastrand` are effectful end-to-end. `rand` is NOT — it
    // mixes entropy/generation (effectful) with *pure* distribution constructors (`Uniform::new`,
    // `Normal::new`) and deterministic-seed constructors (`seed_from_u64`). Flagging the whole crate
    // over-reported those as `Rand`; match only the calls that actually consume randomness — the
    // entropy sources (`OsRng`, `thread_rng`/`rng`, `from_entropy`/`from_os_rng`) and the generation
    // verbs (`gen*`/`random*`/`fill*`/`sample*`/`next_u*`). A `Uniform::new` is now correctly pure.
    if crate_name == "getrandom" {
        return Some("Rand");
    }
    // fastrand: like `rand`, it mixes entropy-consuming generation (effectful) with PURE deterministic
    // pieces. `Rng::with_seed(42)` is a DETERMINISTIC seeded constructor (consumes no entropy — the same
    // seed gives the same stream), and `Rng::fork`/`Rng::clone` just split/copy existing state. Those are
    // PURE; whole-crate Rand fabricated Rand on them. The effect is the value-drawing methods (`u32`/
    // `usize`/`bool`/`f64`/`char`/`alphanumeric`/`choice`/`choose_multiple`/`shuffle`/`fill`/the range
    // forms) AND the entropy-seeded entry points: bare `Rng::new()` (seeds from the global entropy-backed
    // generator), `fastrand::seed`, and the top-level `fastrand::u32(..)` free functions (which draw from
    // the thread-local generator). `with_seed` is exempted explicitly; any other method on an `Rng`
    // (i.e. a value draw) is Rand.
    if crate_name == "fastrand" {
        let m = path.rsplit("::").next().unwrap_or(path);
        // Provably pure: deterministic seeded ctor + state split/copy.
        if m == "with_seed" || m == "fork" || m == "clone" {
            return None;
        }
        // Everything else fastrand exposes either draws a value or seeds from entropy → Rand. (The crate
        // has no pure data types beyond the `Rng` handle itself, so a non-draw stray would have to be a
        // method we don't recognise — keep the effect, the safe direction.)
        return Some("Rand");
    }
    if crate_name == "rand" {
        let rng_verb = path.ends_with("::gen")
            || path.ends_with("::gen_range")
            || path.ends_with("::gen_bool")
            || path.ends_with("::gen_ratio")
            || path.ends_with("::random")
            || path.ends_with("::random_range")
            || path.ends_with("::random_bool")
            || path.ends_with("::random_ratio")
            || path.ends_with("::random_iter") // rand 0.9 iterator generator
            || path.ends_with("::gen_iter")
            || path.ends_with("::fill")
            || path.ends_with("::fill_bytes")
            || path.ends_with("::try_fill")
            || path.ends_with("::try_fill_bytes")
            || path.ends_with("::sample")
            || path.ends_with("::sample_iter")
            || path.ends_with("::next_u32")
            || path.ends_with("::next_u64")
            // SOUNDNESS R333 — the FALLIBLE trait, in the `rand` block as well as `rand_core`'s. Two
            // verb lists answer one question ("is this a draw?") and only one had been widened, which
            // is why the first half of this fix moved nothing: correct code on a path the call does not
            // take. `TryRngCore`'s verbs are the natural API on the fallible `SysRng`.
            || path.ends_with("::try_next_u32")
            || path.ends_with("::try_next_u64")
            || path.ends_with("::thread_rng")
            || path.ends_with("::rng")
            || path.ends_with("::from_entropy")
            || path.ends_with("::from_os_rng");
        // `OsRng` is the OS entropy SOURCE, but `clone`/`fork`/`default` just copy or construct the
        // (zero-sized) handle and draw no entropy — pure, exactly like the `fastrand` arm's clone/fork
        // exemption above. The actual draws (`fill_bytes`/`next_u*`/…) are caught by `rng_verb`. Without
        // this exemption the blanket `contains("OsRng")` fabricated `Rand` on `OsRng::clone` (adversarial
        // review: OsRng is a unit struct, cloning consumes nothing).
        let m = path.rsplit("::").next().unwrap_or(path);
        let os_rng = path.contains("OsRng") && !matches!(m, "clone" | "fork" | "default");
        // SOUNDNESS R320 — …and the SAME clause for the type's CURRENT NAME. rand 0.10 renamed the OS
        // entropy source to `SysRng` and moved it to `getrandom`, re-exporting it as
        // `rand::rngs::SysRng` (`rand-0.10.2/src/rngs/mod.rs:119`). Measured, not assumed: candor
        // resolves the crate from the path the CONSUMER writes, so `rand::rngs::SysRng` arrives with
        // crate_name `rand` and lands here — NOT in getrandom's whole-crate exemption, which is what
        // R320 left open. The asymmetry that leaves was executed on a fixture: with `OsRng` as the
        // receiver an unrecognised verb charges `Rand` (the `contains` clause is the safety margin over
        // the verb list); with `SysRng` it read PURE. So the margin protected the DELETED spelling and
        // not its replacement, which is the wrong way round for a type whose only purpose is to draw
        // from the OS. Same construction exemption for the same reason — `SysRng` is a unit struct
        // (`getrandom-0.4.3/src/sys_rng.rs:34`), so copying the handle consumes nothing.
        let sys_rng = path.contains("SysRng") && !matches!(m, "clone" | "fork" | "default");
        // §E1 HIT COUNTER (`CANDOR_ALIAS_DEBUG`), for `bin/corpus-ab.py --mark`: a widened charge that
        // moves no rows is either inert or unreached, and those two print identically.
        if sys_rng && std::env::var("CANDOR_ALIAS_DEBUG").is_ok() {
            eprintln!("R320SYSRNG {path}");
        }
        if rng_verb || os_rng || sys_rng {
            return Some("Rand");
        }
        return None;
    }
    // Subprocess spawning. `tokio::process` is the async mirror of `std::process` — it exists
    // only to spawn/control subprocesses (`Command`/`Child`, no pure data types like std's
    // `Stdio`/`ExitStatus`/`exit`), so spawning through it is Exec just the same. Without this an
    // async app's `tokio::process::Command::new(..).spawn()` classified pure — a silent under-report
    // of subprocess execution, the dangerous direction (mirrors the tokio::fs/tokio::net coverage).
    if path.starts_with("std::process::Command")
        || path.starts_with("std::process::Child")
        || path.starts_with("tokio::process::Command")
        || path.starts_with("tokio::process::Child")
        || path.starts_with("async_std::process::Command")
        || path.starts_with("async_std::process::Child")
    {
        // PURE read-backs of the builder's stored fields / the cached pid — no spawn, no syscall — so the
        // whole-type Exec rule fabricated Exec on them (sweep [23]; mirrors the portable_pty getter carve-
        // out just below). get_program/get_args/get_envs/get_current_dir read the Command; Child::id reads
        // the cached pid. Every genuine verb (new/spawn/output/status/wait/kill) stays Exec.
        if path.ends_with("::get_program")
            || path.ends_with("::get_args")
            || path.ends_with("::get_envs")
            || path.ends_with("::get_current_dir")
            || path.ends_with("Child::id")
        {
            return None;
        }
        return Some("Exec");
    }
    // portable_pty / async_process are whole-crate Exec EXCEPT for the proven-pure surface they expose:
    // the `CommandBuilder` GETTERS (`get_argv`/`get_cwd`/`get_env`/`as_unix_command_line`…) read back
    // configuration, and the PURE DATA types (`PtySize::default`, `ExitStatus`/`Stdio`/`CommandBuilder`
    // construction/setters). The earlier `is_cmd_naming_method` fix stopped the head-refinement LEAK, but
    // the BASE Exec still fabricated on these accessors (a `cmd.get_cwd()` the scanner routes to
    // `portable_pty::CommandBuilder::get_cwd`). Subtract the read-back getters and the obvious pure
    // ctors/setters; the spawn/wait/exec surface (`spawn_command`/`openpty`/`wait`/`kill`/`exec`…) keeps
    // Exec. SUBTRACT only what is provably pure — when unrecognised, KEEP Exec (the safe direction).
    if crate_name == "async_process" || crate_name == "portable_pty" {
        let m = path.rsplit("::").next().unwrap_or(path);
        // THE COVERAGE-GATE SWEEP (2026-08-27): `CommandBuilder::get_shell` (cmdbuilder.rs:544, unix)
        // LOOKS like a config read-back getter — same `get_` naming as the pure getters below — but its
        // unix body calls `nix::unistd::access(shell, X_OK)`, a real filesystem-access syscall, before
        // falling back to a password-database lookup if `$SHELL` isn't set or isn't executable. Carved
        // out of the `get_` prefix exemption BEFORE it, not folded into it — the one getter this crate
        // exposes that is not actually pure. Verified against portable-pty 0.9.0.
        if m == "get_shell" {
            return Some("Fs");
        }
        // configuration read-back getters — pure (no spawn).
        if m.starts_with("get_") || m == "as_unix_command_line" {
            return None;
        }
        // pure data-type ctors/setters/derives that NAME no program and spawn nothing.
        if matches!(
            m,
            "default" | "new" | "piped" | "null" | "inherit" | "from_raw_fd"
                | "arg" | "args" | "arg0" | "env" | "envs" | "env_clear" | "env_remove"
                | "cwd" | "current_dir" | "rows" | "cols"
                | "clone" | "fmt" | "eq" | "ne" | "hash"
        ) {
            return None;
        }
        return Some("Exec");
    }
    // duct: a subprocess-orchestration crate. `cmd()`/`cmd!` only *build* an Expression; the
    // spawn/wait happens at `run`/`read`/`start`. Match the execution verbs, not the builder.
    if crate_name == "duct"
        && (path.ends_with("::run")
            || path.ends_with("::read")
            || path.ends_with("::start")
            || path.ends_with("::read_chars")
            // `Expression::reader` (lib.rs:357) calls the already-covered `.start()` internally to
            // launch the child and hands back a streaming `ReaderHandle` — a distinct public entry
            // point from `start` itself, so the suffix match above never reached it.
            || path.ends_with("Expression::reader"))
    {
        return Some("Exec");
    }
    if path.starts_with("std::env::") {
        return Some("Env");
    }
    // dotenvy / dotenv: load environment variables (reading a `.env` file and mutating the process
    // environment). Match the load/read entry points; `Error`/builder types stay pure.
    if matches!(crate_name, "dotenvy" | "dotenv")
        && (path.ends_with("::dotenv")
            || path.ends_with("::dotenv_override")
            || path.ends_with("::from_path")
            || path.ends_with("::from_path_override")
            || path.ends_with("::from_filename")
            || path.ends_with("::from_filename_override")
            || path.ends_with("::from_read")
            || path.ends_with("::from_read_override")
            || path.ends_with("::load")
            || path.ends_with("::var")
            || path.ends_with("::vars"))
    {
        return Some("Env");
    }
    // THE COVERAGE-GATE SWEEP (2026-08-27), verified against dotenv 0.15.0 and dotenvy 0.15.7
    // (byte-identical shape in both crates) — the ITERATOR-returning siblings of the load verbs above,
    // which return the parsed pairs instead of mutating the environment but still touch disk to get
    // them: `dotenv_iter`/`from_filename_iter` (lib.rs) resolve and open a `.env`-shaped file exactly
    // like `dotenv`/`from_filename` two lines up (same `Finder::new().find()` call); `from_path_iter`
    // opens the given path directly. Bucketed `Env` for consistency with the rest of this family rather
    // than `Fs` (self-scan's raw signal): the crate's OWN purpose is env-var loading, and splitting the
    // iterator variants into a different effect bucket from their non-iterator siblings would be an
    // arbitrary distinction a reviewer gains nothing from.
    //
    // NOT included: `Finder::find` / the free fn `find` (find.rs) — both are used only via a PRIVATE
    // `use crate::find::Finder;` (no `pub use`) inside a private `mod find;` (lib.rs), so neither
    // `dotenv(y)::Finder` nor `dotenv(y)::find` is a path any external consumer can compile a call to;
    // the ratchet's generator still guesses a crate-root alias for every candidate (the same private-
    // module shape as tempfile's `imp::` functions above). Removed from open.tsv rather than guessed.
    if matches!(crate_name, "dotenvy" | "dotenv")
        && (path.ends_with("::dotenv_iter")
            || path.ends_with("::from_filename_iter")
            || path.ends_with("::from_path_iter"))
    {
        return Some("Env");
    }
    // Wall-clock reads. Match the `now` accessor precisely (ends_with), not any path
    // containing the substring "now". The `time` crate (distinct from `std::time`/`chrono`)
    // reads the clock via `now_utc`/`now_local` (and the deprecated `Instant::now`).
    if (crate_name == "chrono" || path.starts_with("std::time::")) && path.ends_with("::now") {
        return Some("Clock");
    }
    if crate_name == "time"
        && (path.ends_with("::now_utc") || path.ends_with("::now_local") || path.ends_with("::now"))
    {
        return Some("Clock");
    }
    // `tracing`: same principle as the `log` facade below — the crate's TYPES are pure data, so match
    // the emit, not the whole crate. The actual program output is the macro-expanded
    // `Subscriber::event`/`event!`/`Span::*enter*` dispatch and the `Span::new*`/`Span::record`
    // recording path that drives the subscriber. The data-type accessors — `Level::as_str`,
    // `Span::is_disabled`/`metadata`/`id`, and constructing/reading `Level`/`LevelFilter`/`Span`/
    // `Event`/`Metadata`/`Field`/`FieldSet`/`Id` — are PURE (no output is produced), so whole-crate Log
    // fabricated Log on them. Match the emit verbs; everything else returns None.
    if crate_name == "tracing" {
        let m = path.rsplit("::").next().unwrap_or(path);
        // The user-facing emit MACROS (`tracing::info!`/`warn!`/…) — candor-scan is pre-expansion, so it
        // sees the raw macro path `tracing::info`, not the expanded `__tracing`/`Subscriber::event` the
        // deep (post-expansion) engine sees. Only the macro names; the pure DATA types (Level/Span/Event)
        // have other tails and stay None.
        if m == "trace" || m == "debug" || m == "info" || m == "warn" || m == "error"
            || m == "trace_span" || m == "debug_span" || m == "info_span" || m == "warn_span"
            || m == "error_span" || m == "span"
            || m == "event"
            || m == "new_span"
            || m == "record"
            || m == "record_follows_from"
            || m == "enter"
            || m == "exit"
            || m == "in_scope"
            || m == "entered"
            || path.contains("::__macro_support")
            || path.contains("::__tracing")
            || path.contains("Subscriber::event")
            || path.contains("Subscriber::new_span")
            || path.contains("Subscriber::enter")
            || path.contains("Subscriber::exit")
        {
            return Some("Log");
        }
        return None;
    }
    // The `log` facade: its macros route through `log::__private_api`; the crate's types
    // (`Level`, `LevelFilter`) are pure, so match the logging entry, not the whole crate.
    if crate_name == "log" {
        // Expanded macro form (deep engine) OR the raw user-facing macro names (candor-scan, pre-expansion).
        // `log::Level`/`LevelFilter`/`Record`/`Metadata` have other tails, so the type surface stays pure.
        let m = path.rsplit("::").next().unwrap_or(path);
        if path.contains("::__private_api")
            || m == "error" || m == "warn" || m == "info" || m == "debug" || m == "trace" || m == "log"
        {
            return Some("Log");
        }
    }
    // Compiler diagnostic emission — the ONE genuinely effectful operation in the otherwise-pure
    // rustc_* surface (a dylint lint's actual OUTPUT: it writes warnings/errors to the compiler's
    // diagnostic sink). Classified `Log` (same family as `tracing`/`log` — program output). Match the
    // emission verbs precisely; rustc_lint/rustc_errors are mostly pure types (Lint, LintId, the Diag
    // BUILDERS), and only the terminal `emit`/`emit_span_lint` actually produces output.
    if crate_name == "rustc_lint"
        && (path.ends_with("::emit_span_lint")
            || path.ends_with("::span_lint")
            || path.ends_with("::span_lint_hir"))
    {
        return Some("Log");
    }
    if crate_name == "rustc_errors"
        && (path.ends_with("::emit")
            || path.ends_with("::emit_diagnostic")
            || path.ends_with("::emit_now"))
    {
        return Some("Log");
    }
    // arboard: the effectful surface is the `Clipboard` handle's read/write verbs (each talks to the
    // OS clipboard / X11/Wayland/Win32/NSPasteboard server). The data types — chiefly `arboard::Error`
    // (whose `Display`/`to_string` formatting is pure) and the `ImageData`/`GetExtLinux`/`SetExtLinux`
    // option types — are PURE, so whole-crate Clipboard fabricated Clipboard on e.g. an error
    // `to_string()`. Match the handle verbs; everything else returns None. `Clipboard::new` opens the
    // connection to the clipboard server, so it's an effect too; `get`/`set` return the
    // builder-then-read `Get`/`Set` cursors whose `text`/`image`/`html` terminals do the I/O.
    //
    // THE ~79-CRATE R59-CLASS AUDIT (2026-08-28), verified against arboard 3.6.1: `file_list`
    // (lib.rs:205,251, `Get::file_list`/`Set::file_list`) is the SAME builder-then-terminal shape as
    // `text`/`image`/`html` two lines up — reading/writing the clipboard's file-path list — but was
    // missing, not because it's ambiguous (it's the only `file_list` in the crate) but because
    // `eval/coverage-gate/generate.py`'s own generator only triggers on a self-scan `inferred` set
    // containing Fs/Net/Db/Exec; Clipboard isn't in that trigger set, so a missing Clipboard verb is
    // structurally invisible to the completeness gate regardless of phrasing. `Clear::default`
    // (lib.rs:265) is `Clipboard::clear`'s own documented alternate entry point
    // (`clear() { self.clear_with().default() }`, lib.rs:156-158) — the SAME "sibling constructor"
    // shape as `ignore::Walk::new` beside `WalkBuilder::build`; `clear_with()` itself doesn't share
    // `clear`'s leaf, so neither the constructor nor its terminal was covered. `default` is otherwise
    // unused in this crate (no derived `Default` impls), so the bare leaf carries no fabrication risk
    // once crate-gated.
    if crate_name == "arboard" {
        let m = path.rsplit("::").next().unwrap_or(path);
        if m == "new"
            || m == "get"
            || m == "set"
            || m == "clear"
            || m == "get_text"
            || m == "set_text"
            || m == "set_html"
            || m == "get_image"
            || m == "set_image"
            || m == "text"
            || m == "image"
            || m == "html"
            || m == "file_list"
            || m == "default"
        {
            return Some("Clipboard");
        }
        return None;
    }
    // ── Coverage-differential additions (calibrated against each crate's real API; see the per-crate
    //    notes). All verb-keyed + crate-gated, with the pure builder/config/data surface returning None.

    // `etcetera` — XDG/known-folder base+app directory resolution. Each dir ACCESSOR reads the
    // environment at call time (`$HOME`/`$XDG_*` on Unix, `%APPDATA%`/`%LOCALAPPDATA%` on Windows), and
    // the `choose_*`/`home_dir` entry points read `$HOME`. The `AppStrategyArgs` data struct and the
    // strategy types themselves are PURE. (Found DISCLOSED-but-unmodeled in 3/4 differential projects.)
    if crate_name == "etcetera" {
        let m = path.rsplit("::").next().unwrap_or(path);
        if m == "home_dir"
            || m == "choose_base_strategy" || m == "choose_native_strategy" || m == "choose_app_strategy"
            || m == "config_dir" || m == "data_dir" || m == "cache_dir"
            || m == "state_dir" || m == "runtime_dir" || m == "data_local_dir"
        {
            return Some("Env");
        }
        return None;
    }
    // `sqlx-core` (crate `sqlx_core`) — the execution terminals under the sqlx core (the `sqlx` builder
    // table maps `sqlx::query*`; here it's the core `Executor`/`Connection`/`Pool` round-trips). Opening
    // the connection is the network boundary (Net); the query/transaction round-trips are Db. The
    // `*Options`/query-builder/row data types are PURE. Crate-gated so the generic verbs never spread.
    if crate_name == "sqlx_core" {
        if path.ends_with("::connect") || path.ends_with("::connect_with") {
            return Some("Net");
        }
        if path.ends_with("::fetch") || path.ends_with("::fetch_all") || path.ends_with("::fetch_one")
            || path.ends_with("::fetch_optional") || path.ends_with("::fetch_many")
            || path.ends_with("::execute") || path.ends_with("::execute_many")
            || path.ends_with("::prepare") || path.ends_with("::prepare_with")
            || path.ends_with("::acquire") || path.ends_with("::begin") || path.ends_with("::ping")
        {
            return Some("Db");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against sqlx-core 0.8.6/0.9.0 (identical
        // shape in both) — the free-function surface under `pub mod fs`/`pub mod net::tls`/
        // `pub mod migrate`, none of which end in the connect/fetch/execute verbs above:
        //
        // `fs::{read,read_to_string,create_dir_all,remove_file,remove_dir,remove_dir_all,read_dir}`
        // (fs.rs) are direct `std::fs::*` calls off-loaded to `spawn_blocking` — sqlx's OWN async
        // filesystem shim, used by the migrator to read `.sql` files and by SQLite to manage on-disk
        // databases. `net::tls::handshake` (net/tls/mod.rs:69) is the real TLS handshake dispatch
        // reqwest/ureq-style crates already model — sqlx has its OWN copy because it drives the
        // handshake over its own `Socket` trait rather than a `TcpStream` directly.
        // `migrate::resolve_blocking`/`resolve_blocking_with_config` (migrate/source.rs:151,156) are
        // `#[doc(hidden)]` but still `pub use`-exported at `sqlx_core::migrate` (mod.rs:16) — real,
        // callable, and reads the migrations directory off disk (`fs::read_dir` + per-file `canonicalize`).
        //
        // NOT included: `net::tls::tls_rustls::RustlsSocket::poll_{flush,read_ready,write_ready,
        // shutdown}` — `RustlsSocket` is declared inside `mod tls_rustls;` (net/tls/mod.rs), which is
        // PRIVATE with no re-export, so no external consumer can ever name it (the same private-module
        // shape as tempfile's `imp::` functions above). Removed from open.tsv rather than guessed.
        if path == "sqlx_core::fs::read"
            || path == "sqlx_core::fs::read_to_string"
            || path == "sqlx_core::fs::create_dir_all"
            || path == "sqlx_core::fs::remove_file"
            || path == "sqlx_core::fs::remove_dir"
            || path == "sqlx_core::fs::remove_dir_all"
            || path == "sqlx_core::fs::read_dir"
            || path.ends_with("::migrate::resolve_blocking")
            || path.ends_with("::migrate::resolve_blocking_with_config")
            || path == "sqlx_core::config::Config::try_from_path"
            || path == "sqlx_core::Config::try_from_path"
            || path == "sqlx_core::config::Config::try_from_path_or_default"
            || path == "sqlx_core::Config::try_from_path_or_default"
            || path == "sqlx_core::config::Config::try_from_crate_or_default"
            || path == "sqlx_core::Config::try_from_crate_or_default"
        {
            return Some("Fs");
        }
        if path.ends_with("::net::tls::handshake") {
            return Some("Net");
        }
        return None;
    }
    // `walkdir` — recursive directory traversal. Charged at `WalkDir::new` (construction), the SAME
    // point `ignore::WalkBuilder::build`/`glob::glob` are charged, and NOT at `IntoIter::next` (driving
    // the iterator) as this rule originally read. The disk read (`read_dir`+`stat`) is technically lazy
    // — nothing happens until the value is iterated — but `.next()` is reached ONLY through a receiver
    // typed as `walkdir::IntoIter`, and candor-scan's receiver-typing (`ctor_type`/`resolve_recv_type`)
    // hard-blocks the `.into_iter()` verb (a guard against fabricating onto a DIFFERENT std type, e.g.
    // `Vec::into_iter()` -> `std::vec::IntoIter`) with no per-crate exception for the SAME-crate case.
    // `WalkDir::into_iter()` returns `walkdir::IntoIter` (same crate as `WalkDir` itself, exactly the
    // shape the blocklist exists to protect, not the shape it should be blocking) — so every idiomatic
    // form (`for e in WalkDir::new(p)`, `.into_iter().count()`, `.into_iter().filter_map(..)`, an
    // untyped `let it = ...into_iter(); it.next()`) never reaches a typed `IntoIter::next` receiver and
    // read silent-pure under the OLD rule, with `deny Fs` exiting 0 over code that walks the filesystem.
    // Charging at `WalkDir::new` needs no receiver typing at all — it's a plain `Expr::Call`, robust to
    // however the iterator is later consumed. `max_depth`/`follow_links`/`sort_by`/`into_iter` (the
    // BUILDER chain, no I/O until pulled) and the cached `DirEntry::path`/`file_name`/`file_type`/`depth`
    // accessors (`file_type` makes NO syscall) stay PURE — matched by nothing here, so they fall through.
    // The `IntoIter::next`/`DirEntry::metadata` rule is KEPT, not dead: it still fires whenever the
    // concrete `walkdir::IntoIter` type reaches `.next()` by a route the blocklist doesn't gate — an
    // EXPLICIT type annotation (`let it: walkdir::IntoIter = ...`), a struct field declared with that
    // type, or a local fn's declared return type — real, if rarer, shapes than the inline-chain idiom.
    // (Companion to the already-modeled `ignore`.)
    if crate_name == "walkdir" {
        if path.ends_with("::WalkDir::new")
            || path.ends_with("::IntoIter::next")
            || path.ends_with("::DirEntry::metadata")
        {
            return Some("Fs");
        }
        return None;
    }
    // `filetime` — file-timestamp mutation. The `set_*` free fns issue utimes/utimensat/futimens (Fs).
    // `FileTime::now` reads the system clock (Clock). The `FileTime::from_*`/`zero` value constructors
    // (incl. `from_last_modification_time(&Metadata)` etc., which read an ALREADY-loaded `&Metadata`, not
    // the disk) and the `seconds`/`nanoseconds` accessors are PURE.
    if crate_name == "filetime" {
        if path.ends_with("::set_file_mtime") || path.ends_with("::set_file_atime")
            || path.ends_with("::set_file_times") || path.ends_with("::set_symlink_file_times")
            || path.ends_with("::set_file_handle_times")
        {
            return Some("Fs");
        }
        if path.ends_with("::FileTime::now") {
            return Some("Clock");
        }
        return None;
    }
    // `execute` — the `Execute` trait that extends `std::process::Command` with run helpers. The
    // `execute*` verbs SPAWN a child process (Exec). The `execute::command`/`shell` free fns and the
    // `command!`/`command_args!` macros only BUILD a Command (no spawn) and stay PURE.
    if crate_name == "execute" {
        if path.contains("::execute") {
            return Some("Exec");
        }
        return None;
    }
    // `ctrlc` — installs an OS signal handler (Unix SIGINT/SIGTERM/SIGHUP, Windows CTRL_C_EVENT) and
    // spawns its handler thread. Signals are an inter-process control channel, so the closest bucket is
    // Ipc (candor has no dedicated Signal effect; same judgment as routing SysV/pipe IPC to Ipc).
    if crate_name == "ctrlc" {
        if path.ends_with("::set_handler") || path.ends_with("::try_set_handler") {
            return Some("Ipc");
        }
        return None;
    }
    // `clap` — argument parsing. ONLY the terminals that read `std::env::args_os` at call time are an
    // effect (Env): `get_matches`/`get_matches_mut`/`try_get_matches` and the derive `parse`/`try_parse`.
    // clap is MOSTLY PURE: the ENTIRE builder surface (`Command::new`/`arg`/`about`/`Arg::new`) stays
    // None, and crucially the `*_from`/`*_parse_from` variants take an EXPLICIT iterator (they do NOT
    // read argv) so they stay pure too.
    //
    // THE ~79-CRATE R59-CLASS AUDIT (2026-08-28): this file used to leave `Arg::env` unmodeled, calling
    // bare `::env` "too generic to gate safely" — the same words used for libc's genuinely ambiguous fd
    // verbs. It isn't the same shape: `Arg::env(name)` calls `env::var_os(&name)` DIRECTLY at builder
    // time (verified against clap_builder 4.6.6, builder/arg.rs:2205-2213 — real, immediate, not
    // deferred to `get_matches()`), and — unlike a bare fd, which could be Fs/Net/Ipc — `clap_builder`
    // has exactly ONE `pub fn` ending `::env` in its entire source (`Arg::env`; the deprecated
    // `Arg::env_os` is a one-line delegate to it). This whole match arm is already crate-gated on
    // `crate_name == "clap"`, so no ambiguity survives to fabricate on: a fixture proved the untreated
    // gap silently vanishes the function ("functions": [] — the exact R59 shape, worse than an
    // uncalibrated dependency, since `clap` is fully `CALIBRATED_CRATES` and the miss reads as
    // reviewed-pure rather than disclosed). Classified, not carved into
    // `CALIBRATED_BUT_PARTIAL_CRATES`, because the effect IS unambiguous once actually checked.
    if crate_name == "clap" {
        if path.ends_with("::get_matches") || path.ends_with("::get_matches_mut")
            || path.ends_with("::try_get_matches")
            || path.ends_with("::parse") || path.ends_with("::try_parse")
            || path.ends_with("::env") || path.ends_with("::env_os")
        {
            return Some("Env");
        }
        return None;
    }
    // `jiff` — date/time. `Timestamp::now`/`Zoned::now`/`Zoned::now_with` read the wall clock (Clock).
    // `tz::TimeZone::system`/`get` and `tz::db().get` read the system tzdb files from disk
    // (`/etc/localtime`, `/usr/share/zoneinfo`; `system` is also `$TZ`-overridable — Fs is the dominant
    // op, modeled as Fs). The `Span`/`civil` date math and `Timestamp`/`Zoned` arithmetic are PURE.
    if crate_name == "jiff" {
        if path.ends_with("::now") || path.ends_with("::now_with") {
            return Some("Clock");
        }
        if path.ends_with("::TimeZone::system") || path.ends_with("::TimeZone::get")
            || path.ends_with("::TimeZoneDatabase::get")
            // `TimeZone::try_system` (tz/timezone.rs:391) is `TimeZone::system`'s fallible sibling —
            // same `crate::tz::system::get(crate::tz::db())` call, real localtime/zoneinfo disk read.
            || path.ends_with("::TimeZone::try_system")
        {
            return Some("Fs");
        }
        return None;
    }
    // `env_logger` — installs the global logger and emits to stderr; reads `RUST_LOG`/`RUST_LOG_STYLE`.
    // The init terminals are the effect (Log — program output, same family as `log`/`tracing`). The
    // `Builder::new`/`build` and the format/filter/target config setters are PURE.
    if crate_name == "env_logger" {
        if path.ends_with("::init") || path.ends_with("::try_init")
            || path.ends_with("::init_from_env") || path.ends_with("::try_init_from_env")
        {
            return Some("Log");
        }
        return None;
    }
    // `dialoguer` — interactive terminal prompts. The `interact*` verbs read stdin + write the tty (a
    // console dialogue with the user — Ipc, like the other local-channel effects). The
    // `with_prompt`/`default`/`items`/`validate_with` BUILDERS are PURE.
    if crate_name == "dialoguer" {
        if path.ends_with("::interact") || path.ends_with("::interact_on")
            || path.ends_with("::interact_text") || path.ends_with("::interact_text_on")
            || path.ends_with("::interact_opt") || path.ends_with("::interact_on_opt")
        {
            return Some("Ipc");
        }
        // `Editor::edit` (edit.rs:93) writes the caller's string to a real tempfile, spawns
        // `$VISUAL`/`$EDITOR` on it via `process::Command::spawn().wait()`, then reads the result back
        // — a real subprocess launch, not a terminal-dialogue read/write like the verbs above.
        if path.ends_with("Editor::edit") {
            return Some("Exec");
        }
        // WIDENED-CORE AUDIT (2026-08-28): `Editor::new`/`Editor::default` (edit.rs:54,44) call
        // `get_default_editor()` (edit.rs:31), which reads `env::var_os("VISUAL")` then `("EDITOR")`
        // IMMEDIATELY at construction — a real, independent Env read a consumer triggers just by
        // building an `Editor`, whether or not `.edit()` is ever called (the SAME "builder-time env
        // read, separate from the terminal verb" shape as `clap::Arg::env`, R59-class). Verified against
        // dialoguer 0.12.0: `get_default_editor` is the ONLY caller of either `env::var_os`, so there is
        // no ambiguity gating this to just these two constructors.
        if path.ends_with("Editor::new") || path.ends_with("Editor::default") {
            return Some("Env");
        }
        return None;
    }
    // `tracing_subscriber` — the subscriber that gives `tracing` somewhere to go. TWO effects, and the
    // filing said "Log/Fs": VERIFIED against 0.3.23, the Fs half is WRONG.
    //
    //   Log — `fmt/fmt_layer.rs:749` defaults `make_writer: io::stdout`, so the fmt INIT terminals install
    //         a subscriber that writes program output. Same family as `log`/`tracing`/`env_logger`.
    //   Env — `fmt/mod.rs:1219` reads `RUST_LOG` on the `init()` path, `fmt_layer.rs` reads `NO_COLOR`,
    //         and `filter/env/builder.rs:189,203` read `env::var(self.env_var_name())`.
    //
    // NOT Fs. The only `std::fs` in the crate is `impl MakeWriter for std::fs::File` — the crate ACCEPTING
    // a caller-supplied File, not opening one. The caller's `File::create` is classified on the caller, so
    // charging Fs here would double-count, exactly the `serde_json::from_reader` caveat one crate over.
    //
    // The builders (`fmt()`, `layer()`, `with_writer`, `with_target`, `EnvFilter::new`) are PURE: they
    // describe a subscriber. Only the INIT terminals install one, and only the from-env constructors read.
    if crate_name == "tracing_subscriber" {
        if path.ends_with("::init") || path.ends_with("::try_init") {
            return Some("Log");
        }
        if path.ends_with("::from_default_env") || path.ends_with("::try_from_default_env")
            || path.ends_with("::from_env") || path.ends_with("::from_env_lossy")
            || path.ends_with("::try_from_env")
        {
            return Some("Env");
        }
        return None;
    }
    // `crossterm` — the terminal driver. The tty is a USER DIALOGUE CHANNEL, so this is Ipc, matching the
    // ruling `dialoguer`/`console`/`terminal_colorsaurus` already carry rather than a new one.
    //
    // VERIFIED against crossterm-0.28.1 rather than assumed: `command.rs` `execute`/`queue` end in
    // `self.flush()?` on the writer (real code, not a doc example), `event::read`/`poll` read tty input,
    // and `terminal::{enable,disable}_raw_mode` + `size`/`window_size` talk to the device.
    //
    // `size`/`window_size`/`is_raw_mode_enabled` ARE classified, and that is deliberate: once a crate is
    // CALIBRATED every unmatched path becomes a PURITY CLAIM rather than a disclosed blind spot, so a tty
    // ioctl left to fall through would be claimed pure. The genuinely pure surface — the Command VALUE
    // types (`Print`, `MoveTo`, `SetForegroundColor`), the style/event data types — carries none of these
    // tails and stays pure correctly.
    if crate_name == "crossterm" {
        if path.ends_with("::execute") || path.ends_with("::queue")
            || path.ends_with("::event::read") || path.ends_with("::event::poll")
            || path.ends_with("::enable_raw_mode") || path.ends_with("::disable_raw_mode")
            || path.ends_with("::size") || path.ends_with("::window_size")
            || path.ends_with("::is_raw_mode_enabled")
        {
            return Some("Ipc");
        }
        // `terminal::supports_keyboard_enhancement` (terminal/sys/unix.rs:188, re-exported `pub use
        // sys::supports_keyboard_enhancement` in terminal.rs) drives the SAME channel as
        // `event::read`/`enable_raw_mode` above (it toggles raw mode, then reads/polls terminal events
        // to detect the kitty keyboard protocol) — bucketed `Ipc` for consistency with the rest of this
        // tty-dialogue family rather than the `Fs` self-scan's raw signal reports (that signal traces
        // through the crate's internal event source opening `/dev/tty` as a fallback fd, the same
        // primitive `tty_fd` below wraps — not a distinct effect from the terminal channel itself).
        //
        // NOT modelled: `tty_fd` (terminal/sys/file_descriptor.rs:124) — declared inside `pub(crate) mod
        // sys;` (terminal.rs:99), so despite being `pub fn` it is unreachable from outside the crate
        // (only used internally by the event source). Removed from open.tsv rather than guessed.
        if path.ends_with("::supports_keyboard_enhancement") {
            return Some("Ipc");
        }
        return None;
    }
    // `ratatui` — the TUI renderer, and the single loudest source of disclosed-blind calls measured in the
    // 2026-07-14 four-ecosystem sweep (3,345 across three real repos). The backlog filed it as
    // "mark reviewed-pure"; VERIFYING against ratatui-0.29.0 REFUTES that for part of the surface:
    // `terminal/terminal.rs` `draw`/`flush`/`clear`/`autoresize`/`hide_cursor`/`show_cursor` end in a
    // backend flush, and `backend/` writes to the terminal. Marking the whole crate pure would have
    // claimed purity over the one API that actually writes.
    //
    // So the split is where the sweep's noise actually is: the BULK of those 3,345 calls are widget,
    // layout, buffer, style and text constructors — genuinely pure, and now covered rather than disclosed.
    // The Terminal/backend verbs are Ipc, same channel as crossterm underneath them.
    if crate_name == "ratatui" {
        // CARVE-OUT FIRST: `widgets::canvas` is an IN-MEMORY grid. `Context::draw(&shape)` sets
        // `self.dirty` and paints into a `Painter` — no terminal, no writer, provably pure — but it ends
        // in `::draw` and the tails below would have charged it `Ipc`. MEASURED as a live fabrication on a
        // fixture (`plot(ctx) -> ['Ipc']`) before this line existed, and it is a HOT path: a TUI drawing
        // charts or maps calls it per shape per frame.
        //
        // A DENYLIST (carve out the proven-pure module) rather than an allowlist of `Terminal::`, per the
        // family rule: an allowlist silently under-reports whatever it forgot, and the write surface here
        // is Terminal AND the backends (`CrosstermBackend::flush`), so pinning to `Terminal::` would drop
        // a direct backend call. Reading the crate, canvas is the only module whose methods collide with
        // these tails.
        if path.contains("::canvas::") {
            return None;
        }
        if path.ends_with("::draw") || path.ends_with("::try_draw") || path.ends_with("::flush")
            || path.ends_with("::autoresize") || path.ends_with("::clear")
            || path.ends_with("::hide_cursor") || path.ends_with("::show_cursor")
            || path.ends_with("::insert_before")
            || path.ends_with("::set_cursor_position") || path.ends_with("::get_cursor_position")
        {
            return Some("Ipc");
        }
        return None;
    }
    // `console` — terminal handle + styling. The `Term` read/write verbs do tty I/O (Ipc, the user
    // dialogue channel; note there is NO `write_str` — `Term` impls `io::Write`). The free-fn terminal
    // detection (`colors_enabled`/`user_attended`) reads `CLICOLOR`/`CLICOLOR_FORCE` (Env). The `Style`
    // color/format methods and the text utils (`strip_ansi_codes`/`pad_str`/`measure_text_width`) are PURE.
    //
    // THE ~79-CRATE R59-CLASS AUDIT (2026-08-28): the note above ("no `write_str` — `Term` impls
    // `io::Write`") RECORDED the trait impl without covering it. `Term::write`/`Term::flush` (console
    // 0.15.11, term.rs:622-633) call `self.write_through(buf)` — the SAME primitive `write_line` already
    // charges Ipc for — and `Term::read` (term.rs:650-654) calls `io::stdin().read(buf)` directly. These
    // are a second, real entry point to the identical tty channel, missed because `read`/`write`/`flush`
    // are the names every I/O type shares — but crate-gated on `crate_name == "console"`, term.rs
    // defines exactly one of each (verified against the real source; no ambiguity survives the gate,
    // same shape as `clap::Arg::env`). Left unclassified, a fn calling only `term.write_all(..)` (no
    // `write_line`) read as reviewed-pure, since `console` is fully `CALIBRATED_CRATES`.
    if crate_name == "console" {
        if path.ends_with("::write_line") || path.ends_with("::read_line")
            || path.ends_with("::read_line_initial_text") || path.ends_with("::read_char")
            || path.ends_with("::read_key") || path.ends_with("::read_key_raw")
            || path.ends_with("::read_secure_line")
            || path.ends_with("Term::write") || path.ends_with("Term::flush")
            || path.ends_with("Term::read")
        {
            return Some("Ipc");
        }
        if path.ends_with("::colors_enabled") || path.ends_with("::colors_enabled_stderr")
            || path.ends_with("::user_attended") || path.ends_with("::user_attended_stderr")
        {
            return Some("Env");
        }
        return None;
    }
    // `terminal_colorsaurus` — queries the terminal's colours by writing OSC 10/11 escapes and reading the
    // reply (bidirectional tty dialogue — Ipc, consistent with dialoguer/console). Nothing else is I/O.
    if crate_name == "terminal_colorsaurus" {
        if path.ends_with("::background_color") || path.ends_with("::foreground_color")
            || path.ends_with("::color_palette")
            // SOUNDNESS R321 — FQN-exact, not a suffix. `1.0.3` added
            // `ColorPalette::theme_mode(&self)` (src/lib.rs:112), a PURE derived accessor
            // comparing `perceived_lightness()` on two already-fetched colours, alongside the
            // effectful free `theme_mode(options)` (src/lib.rs:157). A `::theme_mode` suffix
            // charges `Ipc` to both. Counterpart to R319: the same upstream mechanism — a
            // release ADDING a name — under-reports in one crate and fabricates in another,
            // depending only on whether the new name is effectful.
            || path == "terminal_colorsaurus::theme_mode"
        {
            return Some("Ipc");
        }
        return None;
    }
    // `backoff` — retry-with-backoff. `retry`/`retry_notify` consult the clock and `thread::sleep`
    // between attempts (Clock). The `ExponentialBackoff`/builder config is PURE. (The user closure's own
    // effects are out of scope here — we model only backoff's own Clock effect.)
    if crate_name == "backoff" {
        if path.ends_with("::retry") || path.ends_with("::retry_notify") {
            return Some("Clock");
        }
        return None;
    }
    // `lscolors` — LS_COLORS parsing. ONLY `from_env` reads the environment (Env). `from_string`/
    // `style_for_path`/`style_for*` and the `Style` type take explicit input and are PURE.
    if crate_name == "lscolors" {
        if path.ends_with("::from_env") {
            return Some("Env");
        }
        return None;
    }
    // `wild` — argv with glob expansion. `args`/`args_os` read `std::env::args(_os)` (Env). Nothing else.
    if crate_name == "wild" {
        if path.ends_with("::args") || path.ends_with("::args_os") {
            return Some("Env");
        }
        return None;
    }
    // `grep_cli` — only the firm effect is modeled: `CommandReaderBuilder::build` spawns a child process
    // (Exec). The `is_readable_stdin`/`is_tty_*` fd probes (isatty/fstat on the std descriptors) are
    // deliberately NOT modeled — candor doesn't classify `IsTerminal`/isatty as an effect anywhere, and
    // they read no data; flagging them would be an inconsistent over-report.
    if crate_name == "grep_cli" {
        if path.ends_with("::build") {
            return Some("Exec");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against grep-cli 0.1.12 — the sibling entry
        // points to `::build` above, none of which end in that suffix:
        //
        // `CommandReader::new` (process.rs:195) is `CommandReaderBuilder::new().build(cmd)` — the same
        // spawn, reached through the type's own one-call constructor instead of the builder.
        // `CommandReader::close` (process.rs:218) drops the child's stdout handle then calls
        // `self.child.wait()` — `std::process::Child::wait` is ALREADY classified `Exec` elsewhere in
        // this file (reaping/blocking on a spawned child is part of the subprocess lifecycle this
        // project tracks), and self-scan resolves `self.child`'s concrete `process::Child` type to
        // confirm it, not a guess.
        // `DecompressionMatcher::command` (decompress.rs:179) builds a REAL `Command::new(&decomp_cmd.bin)`
        // naming an actual decompressor binary (gzip/xz/bzip2/…) and returns it un-spawned — the same
        // "constructs a real argv, caller spawns it" shape `Cred::credential_helper` was classified for
        // in git2 (see the FQN-exact rule near this file's top).
        // `DecompressionReader::new` (decompress.rs:352) is `DecompressionReaderBuilder::new().build(path)`,
        // which calls the already-covered `CommandReaderBuilder::build` two hops down.
        // `patterns_from_path` (pattern.rs:82) opens and reads the given file directly (`std::fs::File::
        // open`) — unrelated to the Exec family above, genuinely Fs.
        // SOUNDNESS R342 — `DecompressionReader::close` was the sibling this enumeration missed. It is
        // `match self.rdr { Ok(ref mut rdr) => rdr.close(), Err(_) => Ok(()) }` (`decompress.rs:383`),
        // i.e. the already-listed `CommandReader::close` one level up, so it reaps the same child. Its
        // `CommandReader` counterpart was listed and it was not — measured on a consumer fixture:
        // `CommandReader::close` charged `Exec` and `DecompressionReader::close` read ABSENT.
        //
        // The `read` pair is listed for the same reason one hop over: reading a `DecompressionReader`
        // or a `CommandReader` pulls bytes from the child's stdout, which is the point of having
        // spawned it. FQN-exact rather than a `::read`/`::close` suffix, because both are far too
        // common a leaf to match crate-wide — the R321 lesson.
        //
        // Found because R185 taught the scanner to see through `match self.rdr { Ok(..) }`, which made
        // grep-cli's own self-scan nominate it. The rule is what a CONSUMER needs; the self-scan only
        // pointed at it.
        if path == "grep_cli::CommandReader::new"
            || path == "grep_cli::CommandReader::close"
            || path == "grep_cli::CommandReader::read"
            || path == "grep_cli::DecompressionMatcher::command"
            || path == "grep_cli::DecompressionReader::new"
            || path == "grep_cli::DecompressionReader::close"
            || path == "grep_cli::DecompressionReader::read"
            || path == "grep_cli::decompress::DecompressionReader::close"
            || path == "grep_cli::decompress::DecompressionReader::read"
            || path == "grep_cli::process::CommandReader::close"
            || path == "grep_cli::process::CommandReader::read"
        {
            return Some("Exec");
        }
        if path == "grep_cli::patterns_from_path" {
            return Some("Fs");
        }
        return None;
    }
    // `clircle` — detects whether two handles are the same file (cycle protection). `Identifier::try_from`
    // (File/Stdio) issues an `fstat`, and `surely_conflicts_with` does an `lseek` (`stream_position`) — both
    // Fs. The `PartialEq`/`Hash` comparisons read stored dev/ino and are PURE. (The named methods
    // `are_identical`/`same_file` do NOT exist in the crate — not modeled.)
    if crate_name == "clircle" {
        if path.ends_with("::try_from") || path.ends_with("::surely_conflicts_with") {
            return Some("Fs");
        }
        return None;
    }
    None
}

pub fn cap_from_name(name: &str) -> Option<&'static str> {
    EFFECTS.iter().copied().find(|e| *e == name)
}

/// Refine the `Exec` cliff (spec §4 ⟨0.5⟩): the effects a *literal, statically-known* subprocess
/// head implies, matched by basename (`/usr/bin/curl` → `curl`). The head's effects are ADDED to a
/// caller that already carries `Exec` (a subprocess is still spawned — `Exec` is never dropped); an
/// unrecognised or dynamically-built head returns `&[]` and keeps the bare cliff (never guess). A
/// **candor engine** reads `Fs`/`Env` only — spec §7 item 12 (the analyzer self-boundary) guarantees
/// that, so that case is spec-supplied, not curation. The rest is a small curated table under the
/// same under-report rule as the crate classifier. INVARIANT: every head here is an external tool
/// that does NOT run the analysed project's own code (so `make`/`npm`/`cargo` are deliberately
/// absent — they stay the cliff). The reference engines share this table so the `Exec` boundary —
/// the one boundary every engine hits — refines identically (the §4-consistency argument).
/// SPEC §2 `fs` — for a call ALREADY classified `Fs`, the read/write direction its path implies.
/// `["read"]`, `["write"]`, `["read","write"]`, or `[]` when the verb does not say.
///
/// THE EMPTY CASE IS THE DISCIPLINE. §2: *"when `Fs` is reached but its kind is unknown … the field MUST
/// be omitted rather than guessed. An empty or partial `fs` would be read as a positive claim ('reads but
/// never writes'), which is the §4 trust contract's forbidden direction."* So an unrecognised verb
/// contributes nothing and the field stays absent; absence means "kind undetermined", never "read-only".
///
/// A syntactic refinement of an effect already proved, NOT a soundness claim. Deliberately the same
/// vocabulary as candor-java's `fsKind`, candor-swift's and candor-ts's — the surface is spec'd four-way,
/// and four engines inventing four verb tables for one field is how a shared field stops meaning one thing.
pub fn fs_kind(path: &str) -> &'static [&'static str] {
    // the terminal segment is the verb (`std::fs::write`, `File::create`, `f.read_to_string`)
    let leaf = path.rsplit("::").next().unwrap_or(path);
    // `OpenOptions::open` is the one verb that does NOT carry its own direction — the direction was set
    // by the BUILDER chain (`.read(true)`/`.write(true)`), which this function cannot see. The READ list
    // below holds a bare `open` for `File::open`, unambiguously a read; letting an `OpenOptions` receiver
    // reach it publishes `fs: ["read"]` for a builder configured `write(true)`, and §2 reads that as the
    // positive claim "reads but never writes" — the forbidden direction. The paragraph under the READ
    // list has always SAID this; nothing implemented it, and it only became REACHABLE when
    // `OpenOptions::open` started classifying on its own — before, the `Fs` came from the
    // `OpenOptions::new` constructor, whose leaf claims nothing, so the field was simply absent.
    // MEASURED on this commit's own fix before this guard: `OpenOptions::new().read(true).open(p)` went
    // from `fs` ABSENT to `fs: ["read"]`, i.e. the fix minted a claim the engine cannot support. Keyed on
    // the TYPE segment, so it holds for the `fs_err`/`tokio::fs`/`async_std::fs` spellings too.
    if path.rsplit("::").nth(1) == Some("OpenOptions") {
        return &[];
    }
    // Reads the source AND writes the destination in one call.
    if matches!(leaf, "copy" | "rename" | "hard_link" | "soft_link" | "symlink") {
        return &["read", "write"];
    }
    const WRITE: &[&str] = &[
        "write", "write_all", "write_fmt", "write_vectored", "create", "create_new", "create_dir",
        "create_dir_all", "remove_file", "remove_dir", "remove_dir_all", "set_permissions",
        "set_len", "set_modified", "set_times", "append", "flush", "sync_all", "sync_data",
        "write_at", "truncate",
    ];
    const READ: &[&str] = &[
        "read", "read_to_string", "read_to_end", "read_exact", "read_dir", "read_link",
        "metadata", "symlink_metadata", "exists", "try_exists", "canonicalize", "open",
        "read_at", "file_type", "permissions", "modified", "accessed", "created", "len",
    ];
    if WRITE.contains(&leaf) { return &["write"]; }
    if READ.contains(&leaf) { return &["read"]; }
    // `OpenOptions` carries the direction in its BUILDER chain, not its terminal verb, so `.open()` on one
    // says nothing here and is deliberately left to the READ arm above only when it is `File::open`
    // (unambiguously a read). Anything else: no claim.
    if leaf.starts_with("write") || leaf.starts_with("append") { return &["write"]; }
    if leaf.starts_with("read") { return &["read"]; }
    &[]
}

pub fn classify_command_head(cmd: &str) -> &'static [&'static str] {
    // Only UNAMBIGUOUS single-effect tools belong here. A multi-modal head (`git status` is local,
    // `git push` is Net; `rsync` local-vs-remote) would FABRICATE the effect for its common case —
    // the under-report rule forbids it, so such heads keep the bare cliff.
    match cmd.rsplit(['/', '\\']).next().unwrap_or(cmd) {
        "curl" | "wget" | "http" | "ssh" | "scp" | "sftp" | "ftp" | "telnet" => &["Net"],
        "psql" | "mysql" | "sqlite3" | "mongosh" | "mongo" | "redis-cli" | "cqlsh" | "influx" => &["Db"],
        // candor engines — Fs/Env only, guaranteed by spec §7 item 12 (the analyzer self-boundary)
        "candor" | "candor-run.sh" | "candor-scan" | "candor-query" | "candor-java"
        | "candor-classify" | "candor-report" | "cargo-candor" => &["Env", "Fs"],
        _ => &[],
    }
}

/// Known machine-learning MODEL-provider hosts — the SPEC §1 ⟨0.13⟩ `Llm` host-literal refinement:
/// a statically-known `Net` request to one of these classifies `Llm` IN ADDITION to `Net` (Net is
/// never dropped — a model call IS network I/O, exactly as an `Exec`-refined subprocess keeps `Exec`),
/// just as a jdbc URL classifies `Db`. Matched by host, case-insensitive; a SUBDOMAIN of a listed host
/// counts. The reference engines share this table VERBATIM with candor-java's `Literals.MODEL_HOSTS`
/// (the analog of `classify_command_head`) so the `Net` boundary refines to `Llm` identically. An
/// UNKNOWN host stays bare `Net` — never guessed. Curated STARTER set; the §7 coverage ledger
/// discloses an uncovered provider like any other.
pub const MODEL_HOSTS: &[&str] = &[
    "api.openai.com",
    "api.anthropic.com",
    "generativelanguage.googleapis.com",
    "api.mistral.ai",
    "api.cohere.ai",
    "api.cohere.com",
    "api.groq.com",
    "api.together.xyz",
    "api.perplexity.ai",
    "openrouter.ai",
];

/// Whether an endpoint HOST literal is a known model provider (case-insensitive; a subdomain of a
/// `MODEL_HOSTS` entry counts). Strips a `:port` suffix first. Two special forms carry their own rule,
/// matching candor-java's `Literals.isModelHost` exactly: any host whose port is `11434` is a local
/// Ollama endpoint (a LOOPBACK host — `localhost`/`127.0.0.1`/`::1` — on port 11434); and an AWS Bedrock
/// runtime host (the model-inference service label `bedrock-runtime`/`bedrock-agent-runtime`).
pub fn is_model_host(host_literal: &str) -> bool {
    // Strip any `:port` (via the shared host_part) and lowercase for the name comparisons.
    let host = policy::host_part(host_literal).to_ascii_lowercase();
    // Ollama is a LOCAL endpoint: :11434 → Llm ONLY on a loopback host (max-review r3 parity fix — "any
    // host on :11434" fabricated Llm on unrelated internal services on that port).
    if let Some((_, port)) = host_literal.rsplit_once(':') {
        if port == "11434" {
            return matches!(host.as_str(), "localhost" | "127.0.0.1" | "::1");
        }
    }
    if MODEL_HOSTS.contains(&host.as_str()) {
        return true;
    }
    // A subdomain of a known model host counts (`eu.api.openai.com` → api.openai.com).
    if MODEL_HOSTS.iter().any(|m| host.ends_with(&format!(".{m}"))) {
        return true;
    }
    // AWS Bedrock runtime: the FIRST label is the model-inference service (`bedrock-runtime.<region>.
    // amazonaws.com`), NOT the substring "bedrock" (which caught `bedrock-backups.s3.amazonaws.com`, an
    // S3 bucket) and NOT the control-plane `bedrock.<region>.amazonaws.com`.
    host.ends_with(".amazonaws.com")
        && matches!(host.split('.').next(), Some("bedrock-runtime") | Some("bedrock-agent-runtime"))
}

/// ⟨0.20⟩ Curated telemetry / analytics / APM hosts — the `Net` destination-class `known-telemetry` set
/// (NET-DESTINATION-CLASS-DESIGN.md), shared VERBATIM with candor-java's `Literals.TELEMETRY_HOSTS` (like
/// `MODEL_HOSTS`). A benign observability endpoint. Matched by host, case-insensitive; a SUBDOMAIN of a
/// listed host counts. Tight, high-precision STARTER set — mis-including an exfil-capable host would
/// under-gate `deny Net[unknown-host]`.
pub const TELEMETRY_HOSTS: &[&str] = &[
    "sentry.io",
    "bugsnag.com",
    "rollbar.com",
    "segment.io",
    "segment.com",
    "mixpanel.com",
    "amplitude.com",
    "google-analytics.com",
    "analytics.google.com",
    "datadoghq.com",
    "datadoghq.eu",
    "newrelic.com",
    "nr-data.net",
    "honeycomb.io",
    "logtail.com",
    // ⟨0.20.1⟩ corpus-grown (a real-repo dogfood): more single-purpose analytics / session-replay / RUM
    // providers — vendor-specific product domains only (no general-purpose host), so no under-gate risk.
    "posthog.com",
    "plausible.io",
    "usefathom.com",
    "heapanalytics.com",
    "fullstory.com",
    "hotjar.com",
    "logrocket.com",
    "cloudflareinsights.com",
];

/// Whether an endpoint HOST literal is in `set` (case-insensitive; a subdomain of a listed host counts).
/// Strips a `:port` suffix first via `host_part`. The shared membership test for `TELEMETRY_HOSTS` and the
/// config-declared partner set (mirrors candor-java's `Literals.hostInSet`).
pub fn host_in_set(host_literal: &str, set: &[&str]) -> bool {
    let host = policy::host_part(host_literal).to_ascii_lowercase();
    set.contains(&host.as_str()) || set.iter().any(|e| host.ends_with(&format!(".{e}")))
}

/// Whether an endpoint HOST literal is a known telemetry/analytics/APM host (`TELEMETRY_HOSTS`).
pub fn is_telemetry_host(host_literal: &str) -> bool {
    host_in_set(host_literal, TELEMETRY_HOSTS)
}

/// ⟨0.20⟩ The `Net` DESTINATION CLASS of a host literal (NET-DESTINATION-CLASS-DESIGN.md): `known-telemetry`
/// (curated), `known-partner` (config `net-partner` OR a model host — a declared-ish external API), else
/// `unknown-host` — the HONEST default (candor makes no claim; the security gate bites this). A partner set
/// is per-project (config-declared). Never fabricated onto a safe class: an unresolved host is unknown-host.
/// Mirrors candor-java's `Literals.netDestClass`.
pub fn net_dest_class(host_literal: &str, partners: &std::collections::BTreeSet<String>) -> &'static str {
    if is_telemetry_host(host_literal) {
        return "known-telemetry";
    }
    if partner_for(host_literal, partners).is_some() || is_model_host(host_literal) {
        return "known-partner";
    }
    "unknown-host"
}

/// ⟨0.31⟩ WHICH declared partner a host matched, or `None` — the SAME match `net_dest_class` decides on,
/// extracted so the DISCLOSURE and the DECISION cannot use different rules.
///
/// That is not a stylistic preference. The reverted first attempt at the `net-partner` disclosure
/// re-implemented this match against a normaliser that KEEPS the port, so an observed
/// `partner.example:443` never equalled a declared `partner.example` and the disclosure came back
/// SILENTLY EMPTY on every real run — while the verdicts it was reporting on had flipped. A disclosure
/// normalised differently from the decision it reports can only be wrong, and one function with two
/// callers is what makes writing one impossible.
pub fn partner_for(
    host_literal: &str,
    partners: &std::collections::BTreeSet<String>,
) -> Option<String> {
    if partners.is_empty() {
        return None;
    }
    let host = policy::host_part(host_literal).to_ascii_lowercase();
    if partners.contains(&host) {
        return Some(host);
    }
    partners
        .iter()
        .find(|p| host.ends_with(&format!(".{p}")))
        .cloned()
}

/// ⟨0.20⟩ The closed `Net` destination-class vocabulary, for the `deny Net[<dest…>]` policy filter.
pub const NET_DEST_CLASSES: &[&str] = &["known-telemetry", "known-partner", "unknown-host"];

/// Curated Rust model-provider SDK crates — the SPEC §1 ⟨0.13⟩ `Llm` model-SDK surface, the Rust analog
/// of candor-java's `Rules.MODEL_SDK_PACKAGES`. A resolved call into one of these crates classifies
/// `Llm` + `Net` (the caller adds both — a model dispatch IS network I/O). NO method-name gating: these
/// are single-purpose provider clients, so ANY call into the crate is a model dispatch (matches the java
/// reference's judgment call). Curated STARTER list; the §7 coverage ledger discloses the rest.
pub const MODEL_SDK_CRATES: &[&str] = &[
    "async_openai",           // async-openai — the de-facto OpenAI client
    "anthropic_sdk",          // anthropic-sdk
    "anthropic",              // anthropic (community client crate)
    "aws_sdk_bedrockruntime", // AWS Bedrock runtime (invoke/converse) — the model surface of the aws-sdk family
    "ollama_rs",              // ollama-rs — local Ollama client
    "langchain_rust",         // langchain-rust — the LangChain invoke surfaces
    "mistralai",              // mistralai (Mistral client)
    "genai",                  // genai — a multi-provider model client
];

/// Whether a resolved call's CRATE is a curated model-provider SDK (`MODEL_SDK_CRATES`) → the SPEC §1
/// ⟨0.13⟩ `Llm` model-SDK classification (the caller adds both `Llm` and `Net`). Crate-level, no
/// method gating — a single-purpose client, matching candor-java's `isModelSdkOwner`.
pub fn is_model_sdk_crate(crate_name: &str) -> bool {
    MODEL_SDK_CRATES.contains(&crate_name)
}

/// The libc / nix / rustix PATH-and-directory syscall leaves `classify` charges `Fs` (incl. `*64` and
/// `*at` variants). Module-level, not local to `classify`, because it is ONE of the two answers to one
/// question: the AS-EFF-008 masking guard (`masks_locator`) reads this same table, so a leaf added here
/// is masked by default — see `LIBC_FS_NO_PATH` for the direction. SOUNDNESS R806.
pub const LIBC_FS: &[&str] = &[
            "open", "open64", "openat", "openat2", "creat", "creat64", "stat", "stat64", "lstat",
            "lstat64", "fstatat", "fstatat64", "newfstatat", "statx", "access", "faccessat",
            "faccessat2", "mkdir", "mkdirat", "rmdir", "unlink", "unlinkat", "rename", "renameat",
            "renameat2", "link", "linkat", "symlink", "symlinkat", "readlink", "readlinkat", "chmod",
            "fchmodat", "chown", "lchown", "fchownat", "truncate", "truncate64", "ftruncate",
            "ftruncate64", "opendir", "fdopendir", "readdir", "readdir64", "readdir_r", "closedir",
            "rewinddir", "seekdir", "telldir", "scandir", "mkstemp", "mkstemps", "mkostemp", "mkdtemp",
            "mknod", "mknodat", "chdir", "fchdir", "getcwd", "get_current_dir_name", "chroot",
            "pivot_root", "statfs", "statfs64", "fstatfs", "fstatfs64", "statvfs", "fstatvfs", "mount",
            "umount", "umount2", "fsync", "fdatasync", "sync", "syncfs", "sync_file_range", "fallocate",
            "posix_fallocate", "posix_fadvise", "sendfile", "sendfile64", "copy_file_range", "flock",
            "getdents", "getdents64", "utime", "utimes", "lutimes", "futimens", "utimensat", "futimesat",
            "realpath",
        ];

/// The libc / nix / rustix socket-family leaves `classify` charges `Net`. See `LIBC_NET_NO_DESTINATION`.
pub const LIBC_NET: &[&str] = &[
            "socket", "setsockopt", "getsockopt", "bind", "listen", "accept", "accept4", "connect",
            "shutdown", "send", "sendto", "sendmsg", "sendmmsg", "recv", "recvfrom", "recvmsg",
            "recvmmsg", "getpeername", "getsockname", "getaddrinfo", "freeaddrinfo", "getnameinfo",
        ];

/// The libc / nix / rustix process creation / replacement / reaping leaves `classify` charges `Exec`.
/// See `LIBC_EXEC_NO_PROGRAM`.
pub const LIBC_EXEC: &[&str] = &[
            "fork", "vfork", "clone", "clone3", "execl", "execlp", "execle", "execv", "execvp",
            "execvpe", "execve", "execveat", "fexecve", "posix_spawn", "posix_spawnp", "system",
            "popen", "pclose", "wait", "waitpid", "wait3", "wait4", "waitid",
        ];

/// The Postgres / SQLite-family client verbs `classify` charges `Db` for `postgres`, `tokio_postgres`,
/// `deadpool_postgres` and `rusqlite` — the round-trips themselves. Module-level because the masking
/// guard reads it too (`masks_locator`, SOUNDNESS R806): every verb here takes the SQL text at
/// argument 0 except the three in `PG_DB_VERBS_NO_SQL`, so a verb added here is masked by default.
pub const PG_DB_VERBS: &[&str] = &[
                "::query", "::query_one", "::query_opt", "::query_raw", "::execute",
                "::batch_execute", "::simple_query", "::prepare", "::prepare_typed",
                "::copy_in", "::copy_out", "::transaction", "::connect",
                // `Config::connect_raw` (tokio-postgres config.rs:739) does the SAME protocol handshake
                // as `Config::connect` over a caller-supplied stream (a Unix socket, a TLS-terminated
                // proxy) instead of dialing one itself — real Db/Net I/O, missing because the verb
                // doesn't end in the plain `connect` spelling.
                "::connect_raw",
                // rusqlite's dialect of the same verbs (a verb-probe found the CANONICAL rusqlite
                // consumer API classifying pure): `query_row` is the one-row read, `query_map`/
                // `query_and_then` the many-row reads, `execute_batch` is rusqlite's name for
                // batch_execute, `prepare_cached` round-trips like prepare. `query_typed` is
                // tokio_postgres 0.7.10+.
                "::query_row", "::query_map", "::query_and_then", "::execute_batch",
                "::prepare_cached", "::query_typed",
                "::prepare_typed_cached",
];

/// The members of `PG_DB_VERBS` that take NO SQL text, each checked against its signature:
/// `Client::transaction(&mut self)`, `connect(params, tls)` / `Config::connect_raw(stream, tls)` —
/// a connection string or a stream, never a query. A name wrongly listed here is a silent bypass;
/// a name missing from here is an over-mask that fails closed. SOUNDNESS R806.
pub const PG_DB_VERBS_NO_SQL: &[&str] = &["::transaction", "::connect", "::connect_raw"];

/// The members of `LIBC_FS` that take NO path — every one operates on a file DESCRIPTOR, a `DIR*`
/// stream, or nothing — so a missing literal there hides no locator. **CHECKED AGAINST EACH SIGNATURE,
/// because this is a denylist on a masking guard: a path-taking name wrongly listed here is the
/// benign-sibling-literal bypass (R399), while a no-path name missing from here only over-masks.**
/// Everything else in `LIBC_FS` names a path, at argument 0 or — for the `*at` family — argument 1.
pub const LIBC_FS_NO_PATH: &[&str] = &[
    "ftruncate", "ftruncate64", "fdopendir", "readdir", "readdir64", "readdir_r", "closedir",
    "rewinddir", "seekdir", "telldir", "fchdir", "getcwd", "get_current_dir_name", "fstatfs",
    "fstatfs64", "fstatvfs", "fsync", "fdatasync", "sync", "syncfs", "sync_file_range", "fallocate",
    "posix_fallocate", "posix_fadvise", "sendfile", "sendfile64", "copy_file_range", "flock",
    "getdents", "getdents64", "futimens",
];

/// The members of `LIBC_EXEC` that name NO program: process duplication (`fork`/`vfork`/`clone*`,
/// which run THIS image) and reaping (`wait*`, `pclose`). Every other member names what runs —
/// `system`/`popen` a shell command line, `exec*`/`posix_spawn*` a path or file name, `fexecve` an fd
/// whose program is invisible at the call. Same direction rule as `LIBC_FS_NO_PATH`.
pub const LIBC_EXEC_NO_PROGRAM: &[&str] = &[
    "fork", "vfork", "clone", "clone3", "wait", "waitpid", "wait3", "wait4", "waitid", "pclose",
];

/// The members of `LIBC_NET` that name NO destination: socket setup and options, the LOCAL side
/// (`bind`/`listen`/`accept*` — where the process listens, never a place it reaches; ⟨0.29⟩
/// `is_net_binding`), use-verbs on an already-connected or already-bound socket (`send`/`recv*`),
/// teardown and read-backs. The destination-naming remainder is `connect`, `sendto`, `sendmsg`,
/// `sendmmsg`, and the resolver pair `getaddrinfo`/`getnameinfo`.
pub const LIBC_NET_NO_DESTINATION: &[&str] = &[
    "socket", "setsockopt", "getsockopt", "bind", "listen", "accept", "accept4", "shutdown", "send",
    "recv", "recvfrom", "recvmsg", "recvmmsg", "getpeername", "getsockname", "freeaddrinfo",
];

/// Whether `crate_name` is one of the three crates `classify` routes through the libc syscall tables.
fn is_syscall_crate(crate_name: &str) -> bool {
    matches!(crate_name, "libc" | "nix" | "rustix")
}

/// Whether a subprocess-builder method only MODIFIES the command (`.arg`, `.env`, `.current_dir`)
/// rather than NAMING the program (`Command::new`, `duct::cmd`). A WHOLE-CRATE-Exec crate
/// (`portable_pty`, `duct`, `async_process`) classifies *every* method as `Exec`, so the
/// head-refinement must skip these: an arg or env-var-name literal that happened to match a head
/// (`.env("psql", …)`, `.arg("curl")`) would FABRICATE that effect — the §1 under-report rule. The
/// method is the call path's last segment.
pub fn is_cmd_builder_method(method: &str) -> bool {
    matches!(
        method,
        "arg" | "args" | "arg0" | "env" | "envs" | "env_clear" | "env_remove" | "current_dir"
            | "cwd" | "stdin" | "stdout" | "stderr" | "pre_exec" | "creation_flags" | "uid" | "gid"
            | "groups" | "process_group"
    )
}

/// Whether a subprocess method NAMES the program (so its first string literal IS the command head to
/// refine): `Command::new("curl")`, `duct::cmd("curl", …)`. The head-refinement must fire ONLY here —
/// an ALLOWLIST, not "any method except known modifiers". A whole-crate-Exec crate classifies EVERY
/// method as `Exec`, so a denylist leaked NON-naming methods that aren't modifiers — a getter like
/// `CommandBuilder::get_env("psql")` (reading back an env-var KEY, not a program) fed `"psql"` to the
/// head classifier and FABRICATED `Db` (review find). Only `new`/`cmd` name a program; everything else
/// (modifiers, getters `get_*`, custom builder methods) keeps the bare `Exec` cliff — under-refine
/// (safe) rather than fabricate. `std::process::Command` is verb-precise so getters never fire `Exec`
/// there anyway; the allowlist makes the whole-crate-Exec crates safe too.
pub fn is_cmd_naming_method(method: &str) -> bool {
    matches!(method, "new" | "cmd")
}

/// The masking guard (AS-EFF-008): a Net call whose method takes the HOST/URL as an argument is
/// "establishing" — a classified Net call here with no captured host literal leaves the endpoint
/// structurally INVISIBLE (a runtime-built host), so the surface is incomplete and the gate must fail
/// closed (else a benign sibling literal masks the runtime endpoint). An ALLOWLIST of connection-
/// establishing verbs — the SAFE direction: a USE-verb on an already-connected socket
/// (`stream.write`/`read`/`flush`, `socket.send`/`recv`) is NOT here, so a missing literal there (the
/// host was fixed at `connect`) never false-positives. **THAT LAST CLAIM WAS FALSE AND IS WITHDRAWN —
/// see R379 in the body: under-catching an establishing verb IS a broken gate whenever a benign sibling
/// literal sits in the same function, which is the exact scenario the first sentence names.** The list is
/// now an ALLOWLIST still — see the R379 body below: the denylist inversion was BUILT, A/B'd over
/// 1,545 crates and REFUSED (544 rows over-masked). An earlier draft of this line said "now a
/// DENYLIST", which was a leftover from the rejected cut and asserted the opposite of the code it
/// sits on — the comment-asserting-safety shape this register records. The arg is the method (path's
/// last segment).
pub fn is_net_establishing(method: &str) -> bool {
    // SOUNDNESS R379 — the DNS RESOLVER verbs were missing, and their absence was a GATE BYPASS.
    //
    // `classify` (see the `hickory_resolver` arm) already maps `::lookup_ip`, `::lookup` and any
    // `*_lookup` to `Net`, and asserts it. This list did not, so a `Net` call whose host is a runtime
    // value was never marked `incomplete` and a benign sibling literal certified it. Measured against
    // real hickory-resolver 0.26.2, on a fixture that builds clean:
    //
    //     pub async fn masked(r: &Resolver<TokioRuntimeProvider>, host: &str) {
    //         let _ = r.lookup_ip("good.example.com").await;   // the benign literal
    //         let _ = r.lookup_ip(host).await;                 // the runtime target
    //     }
    //
    // reported `hosts:['good.example.com'] incomplete:NONE`, and `allow Net good.example.com` exited
    // **0** over a DNS resolution of a caller-controlled hostname. `TcpStream::connect(host)` — one
    // verb over, same fixture — marked `incomplete:['Net']` and failed closed. The mechanism was
    // sound; only the enumeration was short.
    //
    // THE DOC ABOVE USED TO CLAIM under-catching here is "a missed mask (sound-with-disclosure), never
    // a broken gate". That is false and is withdrawn: it is a broken gate whenever a benign sibling
    // literal shares the function, which is the scenario the guard's own first sentence names.
    //
    // **AND IT STAYS AN ALLOWLIST, WHICH IS NOT THE FAMILY'S USUAL DIRECTION — the exception is
    // measured and it is the same one `is_cmd_naming_method` states two doc-blocks up.** Inverting to
    // a denylist of use-verbs was built and A/B'd over all 1,545 registry crates: **544 rows gained
    // `incomplete` and none lost it**, because a WHOLE-CRATE-Net crate classifies EVERY method as Net,
    // so a denylist masks essentially everything in one — `cap-std` 66 rows, `hickory-net` 44. The
    // triggers it added were conversions, accessors and combinators (`into` 24, `from_std` 20,
    // `as_socket` 15, `setsockopt` 32, `map_err` 7, `ok` 5, `try_clone` 4) — none of which hides a
    // host. Worse, it masked **`bind` (31)**, which this very file has `is_net_binding` to exclude
    // because a bind address is where the process LISTENS, never a destination it reaches. So here the
    // allowlist is the precise side and the denylist is the leaky one, exactly as recorded for Exec.
    //
    // The resolver family is written out rather than the one spelling in hand (R346): `_lookup`
    // catches `reverse_lookup`/`srv_lookup`/`mx_lookup`/`txt_lookup`/`ipv4_lookup`/`ipv6_lookup` and
    // the rest of the record-type verbs in one test, mirroring `classify`'s own `ends_with("_lookup")`.
    method.ends_with("_lookup")
        || matches!(
            method,
            "connect"
                | "connect_timeout"
                | "get"
                | "post"
                | "put"
                | "patch"
                | "delete"
                | "head"
                | "request"
                | "send_to"
                | "lookup_host"
                | "to_socket_addrs"
                // R379 — the DNS resolver verbs `classify` already calls Net.
                | "lookup"
                | "lookup_ip"
                | "resolve"
        )
}

/// ⟨0.29⟩ The Net verbs whose LOCATOR is at argument **1**, not 0 — the rust analogue of candor-ts's
/// `NET_URL_ARG1_MEMBERS`.
///
/// **A REGRESSION FOUND IN REVIEW, and the direction matters.** The positional-literal rung replaced
/// `first_str_lit` ("the first string literal ANYWHERE in the call") with `positional_str_lit(args, 0)`
/// as the UNIVERSAL default. That is right for `Fs`/`Db`/`Exec`, whose locator is always argument 0 —
/// but `is_net_establishing` already listed two verbs whose locator is not: `reqwest::Client::request`
/// takes `(Method, url)` and `UdpSocket::send_to` takes `(buf, addr)`. MEASURED after the swap:
/// `c.request(Method::GET, "https://api.example.com/v1")` published NO `hosts` at all and could not be
/// certified, while `c.get("https://api.example.com/v1")` certified normally.
///
/// ⟨0.29⟩ MEASURED FOR `request` ONLY. `send_to` is a METHOD on a receiver the STABLE syntactic backend
/// does not type, so `s.send_to(buf, "203.0.113.9:53")` is not classified at all there and its arg-1
/// literal is still uncaptured on the floor; the position is right and the deep engine can use it. Said
/// plainly because the first version of this fix's changelog listed both verbs as measured.
///
/// The direction is SAFE — an uncaptured locator fails closed, it never certifies something invisible —
/// which is exactly why it needed a review to find: the gate stayed sound and quietly stopped being
/// USABLE for a common shape. candor-ts avoided this by making its resolver verb-aware in the same rung;
/// this is that discipline arriving one engine late.
pub fn is_net_host_arg1(method: &str) -> bool {
    matches!(method, "request" | "send_to")
}

/// ⟨0.29⟩ / ⟨0.40⟩ A LOCAL BIND/LISTEN VERB — the address it names is where the process LISTENS, never a
/// destination it reaches (SPEC §2 ⟨0.40⟩ *A BIND OR LISTEN ADDRESS IS WHERE THE PROCESS LISTENS*, PART 96
/// `a_litbind`). Its literal never enters `hosts`.
///
/// **MEASURED, and it is a false all-clear rather than a naming quibble.** `UdpSocket::bind("0.0.0.0:0")`
/// put `0.0.0.0:0` into `hosts`, the DESTINATION surface `allow Net` gates on (§2), and — because a
/// literal had been captured — nothing marked the surface incomplete. So:
///
/// ```text
/// let s = UdpSocket::bind("0.0.0.0:0")?;   // local
/// s.send_to(b"secrets", dst);              // destination is a RUNTIME value
/// allow Net 0.0.0.0   ->   policy ✓, exit 0
/// ```
///
/// A local listen address certified a send to an endpoint nobody can see. That is the masking evasion
/// AS-EFF-008 exists to close, reached through a verb whose literal is not a destination at all.
///
/// **A BIND MARKS NOTHING** (⟨0.40⟩). This doc used to say *"A BIND CANNOT BE CERTIFIED, EVER, which is
/// why this marks the surface incomplete"*, and that has been false since `16fb46f` dropped the hedge:
/// neither rust engine marks a bind, and both only withhold its literal. ⟨0.40⟩ makes the withholding the
/// rule — an ephemeral client's own `send_to`/`connect` carries its locator under `is_net_establishing`,
/// so hedging the bind as well made every UDP client uncertifiable while adding nothing a gate could use;
/// and a bind with nothing beside it still fails `allow Net` closed on its EMPTY literal surface. The
/// half of the old sentence that WAS right — *a server that binds and accepts talks to whoever connects*
/// — belongs to the ACCEPT, not the bind, and lives in `is_net_accepting`, which is why `accept` and
/// `incoming` are no longer members here.
pub fn is_net_binding(method: &str) -> bool {
    matches!(method, "bind" | "listen" | "bind_to_device")
}

/// ⟨0.40⟩ A CALL THAT ACCEPTS CONNECTIONS — its peers are chosen by whoever connects, so no literal can name
/// them, and the unit's `Net` surface is INCOMPLETE (SPEC §2 ⟨0.40⟩ *A UNIT THAT ACCEPTS A CONNECTION …*,
/// AS-EFF-008, SEMANTICS §6 `masked_Net`; PART 96 `c_accept`). Both rust engines mark `incomplete` on a
/// `Net`-classified call this answers, WHETHER OR NOT a literal was captured (a server bootstrap's literal is
/// a LISTEN address, withheld like a bind's), and contribute no `hosts` entry for it.
///
/// **SOUNDNESS R817 — `accept`/`incoming` WERE MEMBERS OF `is_net_binding`, WHICH WITHHOLDS AND NEVER
/// MARKS**, so they were read exactly like a use-verb. `pub fn f(l: &TcpListener) { let _ =
/// TcpStream::connect("ok.example:80"); if let Ok((mut s, _)) = l.accept() { s.write_all(b"hi") } }`
/// reported `hosts: ["ok.example:80"]`, no `incomplete`, and `allow Net in f ok.example` exited **0** over a
/// server writing to whoever connected — EXECUTED: a client on 127.0.0.1 received the bytes.
///
/// The membership, by spelling (`path` is the resolved call path, `leaf` its last segment):
///   * `accept`, `accept4` (libc/nix/rustix), `poll_accept` (tokio's poll form), `incoming` and
///     `into_incoming` (std's iterator forms) — exact LEAF. `accept_bi`/`accept_uni` (quinn) are NOT here:
///     they accept a STREAM on a connection whose peer was already fixed by the endpoint's `accept`.
///   * tonic's `Router::serve`/`Router::serve_with_shutdown` and `TcpIncoming::new`, the server bootstraps
///     `classify` already charges `Net` — each binds a listener and begins accepting on it (classify's own
///     tonic arm cites the source lines). By PATH, because `serve`/`new` are not accept verbs anywhere else.
///
/// A wrong `true` over-masks and fails CLOSED, saying so; a wrong `false` is the benign-sibling-literal
/// bypass this row closed. An exact `accept` leaf also matches a TLS/WebSocket acceptor wrapping a stream
/// that was already accepted (`TlsAcceptor::accept(stream)`, `tungstenite::accept`) — whose peer is likewise
/// whoever connected, so the mark is redundant there, never false.
pub fn is_net_accepting(path: &str, leaf: &str) -> bool {
    matches!(leaf, "accept" | "accept4" | "poll_accept" | "incoming" | "into_incoming")
        || (path.starts_with("tonic::")
            && (path.ends_with("::Router::serve")
                || path.ends_with("::Router::serve_with_shutdown")
                || path.ends_with("::TcpIncoming::new")))
}

/// The masking guard (AS-EFF-008), the `Fs` analog of `is_net_establishing`: whether an `Fs`-classified
/// call takes the filesystem PATH as a string argument (so a missing literal leaves the path
/// structurally INVISIBLE — a runtime-built path — and the surface is incomplete, fail-closed). An
/// ALLOWLIST of the path-NAMING free functions / constructors (`fs::write`/`read`/`File::open`/…), the
/// SAFE direction: a path-stat METHOD whose path is the RECEIVER (`p.metadata()`, `p.exists()`) is
/// invoked method-form and the caller gates on `!is_method`, so this never sees it; an op on an
/// already-opened handle (`file.write_all`, `mmap.flush`, `tempfile()` — a random name, no path arg)
/// is not here, so a missing literal there never false-positives. Under-catching an unusual
/// path-naming fn is a missed mask (sound-with-disclosure), ~~never a broken gate~~ — **AND THAT LAST
/// CLAUSE IS FALSE. SOUNDNESS R399.** R379 withdrew this exact sentence from `is_net_establishing` after
/// MEASURING it wrong, and R383 and R386 are counter-examples on this guard and its Db sibling: an
/// unlisted path-taking call contributes no locator, nothing marks the surface incomplete, and a benign
/// sibling literal then CERTIFIES the invisible destination — `allow Fs /etc/hostname` exit 0 over
/// `unixfs::chown(caller, …)`, with the control (`OpenOptions::open(caller)`) exiting 1. The sentence
/// survived here only because nobody re-read it after R379, and it is what licenses leaving the list
/// short. Under-catching is a BROKEN GATE, not a missed mask. The arg is the
/// method/fn leaf (the path's last segment).
pub fn is_fs_path_arg(leaf: &str) -> bool {
    matches!(
        leaf,
        // SOUNDNESS R399 — the POSIX ownership/root verbs take a path as argument 0 and were absent, so a
        // benign sibling literal certified them: `allow Fs /etc/hostname` exit 0 over
        // `unixfs::chown(caller, …)`, control `OpenOptions::open(caller)` exit 1. `std::os::unix::fs`.
        "chown"
            | "lchown"
            | "chroot"
        // std::fs / tokio::fs / async_std::fs / fs_err free functions taking a path argument
            | "write"
            | "read"
            | "read_to_string"
            | "read_dir"
            | "read_link"
            | "copy"
            | "rename"
            | "remove_file"
            | "remove_dir"
            | "remove_dir_all"
            | "create_dir"
            | "create_dir_all"
            | "hard_link"
            | "soft_link"
            | "symlink"
            | "symlink_file"
            | "symlink_dir"
            | "symlink_metadata"
            | "canonicalize"
            | "metadata"
            | "set_permissions"
            | "exists"
            | "try_exists"
            // File / OpenOptions constructors taking a path argument
            | "open"
            | "create"
            | "create_new"
    )
}

/// SOUNDNESS R334 — IS THIS PATH SEGMENT THE OS ENTROPY SOURCE ITSELF (as a VALUE, not a verb)?
///
/// **THE DEFECT THIS EXISTS FOR.** Every entropy rule in the `rand` block keys on the CALLEE — a verb
/// (`from_os_rng`, `next_u32`, `fill_bytes`) or the source type in RECEIVER position
/// (`contains("OsRng")`/`contains("SysRng")`, R320). The idiomatic way to seed a userspace CSPRNG from
/// the OS puts the source in ARGUMENT position, where neither key can see it. Executed, one fixture,
/// four rows:
///
/// ```text
/// StdRng::try_from_rng(&mut SysRng)   ABSENT   quinn-proto-0.11.17 endpoint.rs:81
/// StdRng::from_rng(&mut OsRng)        ABSENT   the same hole in the OLD spelling
/// StdRng::from_seed([0u8; 32])        ABSENT   correct — deterministic, and the control
/// StdRng::from_os_rng()               ['Rand'] the verb form
/// ```
///
/// Both spellings, so this is NOT a rename residual and predates R320 — whose "stale `OsRng` clause"
/// framing would have sent the audit straight past it.
///
/// **WHY THE ARGUMENT AND NOT THE VERB.** `from_rng`/`try_from_rng` cannot simply be charged: their
/// effect is decided by what is passed to them, `from_rng(&mut pcg)` is deterministic, and there are
/// 802 `from_seed`/`seed_from_u64` call sites in this machine's registry cache — the deterministic
/// population is the larger one. Charging the verb is R330's mistake one crate over. The discriminator
/// is the ARGUMENT, so that is what is read.
///
/// **THE OVER-APPROXIMATION IS DELIBERATE AND STATED.** Naming one of these types as a VALUE is charged
/// wherever it appears in an argument list, including moves that do not themselves draw (`Some(OsRng)`,
/// `Box::new(SysRng)`). That is sound and it is also the ONLY place candor can see it: a source handed
/// off into a struct field is drawn from in some later function whose own call list never mentions it.
/// A user type coincidentally named `OsRng` would be charged too — an over-report, the safe direction,
/// and cheaper than the silence it replaces.
pub fn is_entropy_source_ident(seg: &str) -> bool {
    matches!(seg, "OsRng" | "SysRng")
}

/// SOUNDNESS R338 — DOES THIS CALL ALSO READ THE SYSTEM TRUST STORE? A SECOND effect, not a
/// replacement for the one `classify` returns.
///
/// **THE DEFECT.** candor charges `native_tls::TlsConnector::new` `Fs` because on the openssl backend
/// it loads the probed cert file/dir from disk. Several calibrated crates construct that connector
/// INSIDE a public entry point, so the consumer's call discloses the transport effect and drops the
/// `Fs` — `tungstenite::client_tls` reports `['Net']`, and `deny Fs` passes over a real trust-store
/// read. `wrap_stream` does `tls_connector.map_or_else(TlsConnector::new, Ok)`
/// (`tungstenite-0.30.0/src/tls.rs:54`), so a caller supplying no connector gets `TlsConnector::new()`.
/// (The row the coverage gate nominated — `tungstenite::tls::encryption::native_tls::wrap_stream` — is
/// unreachable from outside: `mod tls;` is private at `lib.rs:32`. The reachable form is one level up.)
///
/// **WHY THIS IS SO SHORT: the sweep found four more crates and every one was PRICED AND REJECTED,
/// which is the deliverable rather than a gap.** Callers of `native_tls::TlsConnector::new` in the
/// local registry are redis, tungstenite, ureq, minreq and tokio-websockets.
///   - `minreq`, `tokio_websockets` — NOT calibrated, so their calls already disclose rather than
///     claim purity. No rule can improve them.
///   - `redis` — `ActualConnection::new` (`redis-1.6.0/src/connection.rs:932`) constructs it only for a
///     `rediss://` address, and the consumer-visible verb is `Client::get_connection`. Charging that
///     `Fs` would fabricate on every PLAIN redis user, which is the majority. Rejected on the trade.
///   - `ureq` — `agent.rs:265` takes `crate::default_tls_config()`, and ureq's default features are
///     `["tls", "gzip"]`: `native-certs` is OFF, so the default build resolves to
///     `rtls::root_certs()`'s `#[cfg(not(feature = "native-certs"))]` arm, which is
///     `webpki_roots::TLS_SERVER_ROOTS` — COMPILED IN, no disk read (`ureq-2.12.1/src/rtls.rs:82`).
///     Charging it would fabricate on the default build. Rejected on the evidence.
///
/// What is left is tungstenite's two explicitly-TLS-named entry points, where no caller is
/// over-charged: `client_tls` passes `None` for the connector unconditionally, and
/// `client_tls_with_config`'s callers are by definition doing TLS. **`tungstenite::connect` is a stated
/// residual, not an oversight** — it serves `ws://` and `wss://` alike, so charging it would hit real
/// plain-WebSocket users; the scheme is often a string literal candor already captures in `str_arg`,
/// which is the shape a future fix should use rather than a blanket charge.
pub fn reads_trust_store(crate_name: &str, path: &str) -> bool {
    crate_name == "tungstenite"
        && (path.ends_with("::client_tls") || path.ends_with("::client_tls_with_config"))
}

/// SOUNDNESS R330 — IS THIS `hash_password` CALL PROVABLY THE EXPLICIT-SALT ONE (password-hash 0.5.x)?
///
/// **THE DEFECT THIS EXISTS FOR, and it was mine, introduced by R318's fix the previous day.** R318
/// correctly found that `hash_password` mints OS entropy — at password-hash **0.6.x**, where
/// `fn hash_password(&self, password)` (`lib.rs:107`) has the body `let salt = try_generate_salt()?;`.
/// At **0.5.0** (`traits.rs:33`) and argon2 **0.5.3** (`lib.rs:572`) the identical name is
/// `fn hash_password(&self, password, salt)`: the caller supplies the salt and the call is deterministic
/// recomputation — PURE. So the `ends_with`-not-`contains` guard R318 relied on was keyed on the 0.6.x
/// name, and at 0.5.x the explicit-salt call IS named `hash_password`. Measured: two calls with the same
/// stored salt produce byte-identical hashes, and all four 0.5.x spellings were charged `Rand`.
///
/// **Why arity and not the resolved version.** R330's remedy offered both. The version is only knowable
/// where a lockfile resolves, and `calibration_exceeded` is ONE-SIDED — it fires when resolved > ceiling,
/// so it can never see a rule that mis-describes an OLDER release, which is exactly this direction. The
/// arity is written at the call site, needs no lockfile, and distinguishes the two signatures exactly.
///
/// **The direction is stated so it cannot drift:** this returns true only for the shape it can PROVE is
/// explicit-salt. An unrecorded arity (`argc == 0`, every synthesized edge and every pre-R330 cache
/// entry) returns false and the call stays charged. Narrowing a sound over-approximation by DENYLIST,
/// never by allowlist — the family rule.
pub fn password_hash_explicit_salt(crate_name: &str, path: &str, argc: u8, method: bool) -> bool {
    if !matches!(crate_name, "argon2" | "scrypt" | "pbkdf2" | "password_hash")
        || !path.ends_with("::hash_password")
    {
        return false;
    }
    if argc == 0 {
        return false; // NOT RECORDED — see `Call::argc`. Unknown charges.
    }
    // `syn` hands a method call its args WITHOUT the receiver and a UFCS `Trait::method(&recv, ..)`
    // WITH it, so normalize to the non-receiver count before comparing: 0.5.x is `(password, salt)` = 2,
    // 0.6.x is `(password)` = 1.
    let non_receiver = if method { argc } else { argc - 1 };
    let hit = non_receiver == 2;
    // §E1 HIT COUNTER, the `CANDOR_ALIAS_DEBUG` pattern. A refinement that narrows a charge must be
    // able to prove it REACHED real code, because "nothing moved" and "the branch never ran" print the
    // same corpus A/B. This is what `bin/corpus-ab.py --mark` counts.
    if hit && std::env::var("CANDOR_ALIAS_DEBUG").is_ok() {
        eprintln!("R330EXPLICITSALT {path} argc={argc} method={method}");
    }
    hit
}

/// ⟨0.29⟩ HOW MANY LEADING ARGUMENTS OF AN `Fs` PATH-TAKING CALL ARE PATHS.
///
/// **THE DEFECT THIS EXISTS FOR.** The literal harvester took the first string literal found ANYWHERE in
/// the argument list, so `fs::write(user_path, "/tmp/lit")` published `paths: ["/tmp/lit"]` — the BYTES
/// BEING WRITTEN — as the destination surface, and `allow Fs /tmp/lit` certified a write to an
/// attacker-controlled path at exit 0. Measured on candor-scan and candor-ts; candor-java and
/// candor-swift read the path POSITION and fail closed correctly. Removing the sibling literal made the
/// same call fail closed, which is what identified the mechanism: any literal in the call, in any
/// position, defeated the runtime-path incompleteness marker.
///
/// So the surface is read from the PATH POSITIONS and nowhere else, and every one of them must be a
/// literal for the surface to be complete. Two-path operations are the reason this is an arity and not a
/// boolean: `fs::copy("/safe", user_path)` has a literal at position 0 and still writes somewhere
/// nobody can see, so requiring only position 0 would leave the identical hole one argument along.
pub fn fs_path_arity(leaf: &str) -> usize {
    match leaf {
        "copy" | "rename" | "hard_link" | "soft_link" | "symlink" | "symlink_file" | "symlink_dir" => 2,
        _ => 1,
    }
}

/// SOUNDNESS R383 — THE METHOD FORMS WHOSE PATH IS AN ARGUMENT, not the receiver.
///
/// `scan.rs`'s Fs masking arm reads `!c.method && is_fs_path_arg(leaf)`. The `!c.method` gate exists for
/// a real reason — the path-STAT methods (`p.metadata()`, `p.exists()`) carry the path as the RECEIVER,
/// so masking them would be wrong — but it excluded EVERY method form, and `OpenOptions::open(path)` is
/// a method whose path IS the argument. Measured, with the instrument calibrated first: a function doing
/// `File::open("/etc/hostname")` beside `OpenOptions::new().read(true).open(caller_path)` reported
/// `paths:['/etc/hostname'] incomplete:NONE`; `deny Fs` exited 1 and **`allow Fs /etc/hostname` exited
/// 0** — a policy saying "only /etc/hostname" going green over a caller-supplied path. The FREE-fn
/// spelling of the same call is the isolating control: it marks incomplete and fails closed.
///
/// **`argc` does not discriminate; the RECEIVER TYPE does.** Instrumented, the four shapes are
/// `OpenOptions::open` (argc 1, path IS the arg), `File::read_to_string` and `File::write` (argc 1,
/// BUFFER arg) and `Path::exists` (argc 0, path is the receiver).
///
/// **The family is from a 1,545-crate sweep, not from the one spelling that was found (R346):** the only
/// path-taking METHOD pairs in the registry are `OpenOptions::open` (69 std + 2 tokio + 9
/// `cap_primitives`) and `DirBuilder::create` (5 std + tokio). Every other method on those same receivers
/// is a builder modifier (`read`/`write`/`truncate`/`mode`) or a combinator (`map`/`map_err`/`or_else`/
/// `with_context`), and `std::fs::File`'s 267 method hits are all use-verbs whose path was fixed at open.
///
/// Matched on the TAIL of the resolved call path, so std, tokio, `cap_primitives` and `fs_err` are all
/// covered by one rule without naming a crate. **Stays an ALLOWLIST:** R379 built the denylist inversion
/// for the Net twin and the corpus refused it, and here a denylist over method forms would mask all 267
/// `File` use-verbs and every combinator on a whole-crate-Fs receiver.
///
/// **SOUNDNESS R417 — THE CAPABILITY-`Dir` FAMILY WAS ABSENT, AND IT IS A LIVE GATE BYPASS.**
/// `cap_std::fs::Dir` (and its `fs_utf8`/`cap_async_std` twins, and `openat::Dir`) is a whole second
/// filesystem API whose path is an ARGUMENT to a METHOD on a directory handle — `d.write(caller, …)`,
/// `d.open(caller)`, `d.remove_file(caller)`. MEASURED, with the free-fn spelling as the isolating
/// control in the same fixture:
///
/// ```text
/// control(caller)  std::fs::write("/tmp/benign",…); std::fs::write(caller,…)
///                  → paths:['/tmp/benign'] incomplete:['Fs']   allow Fs /tmp/benign → exit 1  ✔
/// mixed(d,caller)  std::fs::write("/tmp/benign",…); d.write(caller,…)
///                  → paths:['/tmp/benign'] incomplete:NONE     allow Fs /tmp/benign → exit 0  ✘
/// ```
///
/// The call path resolves in full (`cap_std::fs::Dir::write`), so this is not a resolution gap — the
/// guard simply had two names in it. `alone(d,caller)` confirms the call IS classified `Fs`: the
/// effect was seen, the locator was not, and nothing said so.
///
/// **WHY THIS HALF IS A DENYLIST WHILE THE REST OF THE GUARD IS AN ALLOWLIST**, which is not a
/// contradiction but the point: the allowlist above exists because the receiver is UNKNOWN, so masking
/// by default would swallow `File`'s 267 use-verbs. Here the receiver is KNOWN to be a directory
/// capability, and on that receiver essentially every method names a path — 24 of the 49 declared on
/// `cap_std::fs::Dir` are already `is_fs_path_arg` leaves, and most of the remaining 25 (`open_with`,
/// `open_dir`, `is_file`, `is_dir`, `symlink_contents`, `read_link_contents`, `create_dir_with`,
/// the `bind_unix_*`/`connect_unix_*` socket-path verbs) take one too. An allowlist here would be the
/// R346→R348 hand-list vein by construction: every name I failed to write down is a silent bypass, and
/// R399 settled that an under-catch on this guard is a BROKEN GATE, not a missed mask.
///
/// So the default on a `Dir` receiver is MASK, and the exceptions are the handful of methods that
/// provably take no path: handle-to-handle conversions and the iterator/`self`-only verbs. Being wrong
/// about one of those costs an over-mask on a rare API (fails CLOSED, disclosed); being wrong the other
/// way is the exit-0 above. [[candor-denylist-over-allowlist]] — say which direction it fails in first.
///
/// Scoped on the RECEIVER SEGMENT being exactly `Dir`, so `cap_std`, `cap_std::fs_utf8`,
/// `cap_async_std` and `openat` are covered by one rule without naming a crate — the same tail-matching
/// discipline as the two names above. A non-filesystem type that happens to be called `Dir` would be
/// over-masked, which fails closed.
/// SOUNDNESS R414 / SPEC ⟨0.37⟩ — **a RECEIVER-form path stat names its destination, and every engine
/// in this family was silent on it.** `p.exists()`, `p.metadata()`, `p.canonicalize()` reach the
/// filesystem against the path they are invoked ON; the locator is the RECEIVER, not an argument.
/// MEASURED before the clause was written, one variable, a benign allowed literal beside a
/// caller-chosen path:
///
/// ```text
/// fn f(p: &Path) { fs::write("/tmp/benign", b"x"); p.exists(); }
///   -> paths:['/tmp/benign'] incomplete:NONE   allow Fs /tmp/benign -> exit 0, "nothing hidden"
/// ```
///
/// The ARGUMENT spelling of the identical reach (`fs::metadata(p)`) was already marked, which is what
/// makes this a drift rather than a policy: `is_fs_path_arg` deliberately excluded the method form
/// because its receiver was assumed to be an OPEN HANDLE. That assumption holds for `File` and is
/// false for `Path` — a `Path` is a path VALUE, and a stat on it is `Fs` reaching that value.
///
/// **NO CARVE-OUT LIST, and that is structural rather than lucky.** The pure `Path` algebra —
/// `join`, `parent`, `file_name`, `extension`, `to_str`, `display`, `starts_with`, `to_path_buf`,
/// `as_path` — is NOT classified `Fs` (measured: a function calling all nine reports `fs:['write']`
/// from an unrelated sibling call and nothing else), so it never reaches the branch that consults
/// this predicate. The carve-out falls out of the classification, exactly as it does on the java
/// side, instead of being a list that must be kept in sync with `std`.
///
/// Matched on the RECEIVER SEGMENT so `std::path` and the `camino` mirrors are covered by one rule
/// without naming a crate. Being generous here is the SAFE direction: the predicate is only ever
/// consulted for a call the classifier ALREADY resolved to `Fs`, so an extra receiver name can at
/// worst over-mask (fails closed, disclosed), while a missing one is the exit-0 above — R399's
/// ruling that an under-catch on a masking guard is a broken gate, not a missed mask.
pub fn is_fs_receiver_locator(call_path: &str) -> bool {
    let mut segs = call_path.rsplit("::");
    let (Some(_leaf), Some(recv)) = (segs.next(), segs.next()) else { return false };
    matches!(recv, "Path" | "PathBuf" | "Utf8Path" | "Utf8PathBuf")
}

/// SOUNDNESS R460 / SPEC ⟨0.37⟩ — **the Exec twin of `is_fs_receiver_locator`: a spawn's locator is
/// its RECEIVER, and rust was silent on it.** `is_cmd_naming_method` marks the surface incomplete at
/// `Command::new(<runtime value>)`, which covers every spelling that NAMES the program inside the
/// function. It cannot cover the spelling that names it somewhere else:
///
/// ```text
/// fn masked(cmd: &mut Command) { Command::new("git").status(); cmd.spawn(); }
///   -> cmds:['git'] incomplete:NONE   allow Exec git -> exit 0, "nothing hidden"
/// ```
///
/// MEASURED on the pre-fix binary, one variable — deleting the benign `Command::new("git")` line, and
/// nothing else, turns the same gate to exit 1. The real instance is tokio's own
/// `process::unix::spawn_child(cmd: &mut std::process::Command) { cmd.spawn()? }`, production source,
/// charged `Exec` with no `cmds` and no `incomplete`.
///
/// **A DENYLIST, and the direction is the point.** On a `Command` receiver essentially every method
/// that is not a documented BUILDER modifier reaches the boundary (`spawn`, `status`, `output`, `exec`,
/// and every async / pty mirror of them), so an allowlist of terminal names would be the R346→R348
/// hand-list vein by construction: each name not written down is a silent bypass. The carve-out is
/// `is_cmd_builder_method` — the SAME list the head-refinement already trusts, not a second copy of it
/// (§G, ask the authority) — plus the `get_*` getters that list's own doc-block names. Being wrong
/// about a carve-out costs an over-mask on a configure-only call (fails closed, disclosed); being
/// wrong the other way is the exit-0 above.
///
/// Scoped on the RECEIVER SEGMENT being exactly `Command`, so `std::process`, `tokio::process`,
/// `async_process` and the `std::os::unix` extension trait are one rule without naming a crate — the
/// same tail-matching discipline as `is_fs_receiver_locator`. The predicate is only ever consulted for
/// a call the classifier ALREADY resolved to `Exec`, so a non-spawning type that happens to be called
/// `Command` (clap's builder) is unreachable unless something already charged it Exec.
///
/// The DETERMINED receiver does not arrive here: the collector resolves a builder chain rooted at
/// `Command::new("git")` — inline or through a `let` binding — into `str_arg`, so only a receiver whose
/// program was never named in this function reaches the mask. That split is this fix's over-charge
/// control, and it is what keeps the dominant spelling certifiable.
pub fn is_exec_receiver_locator(call_path: &str) -> bool {
    let mut segs = call_path.rsplit("::");
    let (Some(leaf), Some(recv)) = (segs.next(), segs.next()) else { return false };
    // SOUNDNESS R808 — AND ITS EXTENSION TRAIT. The deep engine resolves `cmd.exec()` to the TRAIT method
    // `std::os::unix::process::CommandExt::exec`, not to `Command::exec`, so a receiver test on the
    // literal segment `Command` let the deep engine certify a caller-supplied `exec` while `candor-scan`
    // (which forms `Command::exec` from the typed receiver) flagged it — the R808 port's own boundary,
    // measured on the port's fixture one method over. `CommandExt`'s other members (`uid`, `gid`,
    // `groups`, `pre_exec`, `arg0`, `process_group`) are already `is_cmd_builder_method` carve-outs.
    matches!(recv, "Command" | "CommandExt") && !is_cmd_builder_method(leaf) && !leaf.starts_with("get_")
}

pub fn is_fs_path_arg_method(call_path: &str) -> bool {
    if call_path.ends_with("OpenOptions::open") || call_path.ends_with("DirBuilder::create") {
        return true;
    }
    let mut segs = call_path.rsplit("::");
    let (Some(leaf), Some(recv)) = (segs.next(), segs.next()) else { return false };
    if recv != "Dir" {
        return false;
    }
    // The no-path exceptions on a directory capability: handle↔handle conversions, the entry
    // iterators, and the verbs whose only operand is `self`. Everything else on a `Dir` names a path.
    //
    // EVERY NAME HERE WAS CHECKED AGAINST ITS SIGNATURE, because a wrong entry here is not a precision
    // loss, it is the exit-0 above. `read_dir` was in this list on the first cut on the reasonable-
    // sounding grounds that `entries()` is the self-only form — and `cap_std::fs::Dir::read_dir` is
    // `fn read_dir<P: AsRef<Path>>(&self, path: P)`, so that entry was a bypass I had just written.
    // Adding a name here requires reading its signature, not recognising it.
    !matches!(
        leaf,
        "try_clone"
            | "into_std_file"
            | "from_std_file"
            | "into_std"
            | "from_std"
            | "entries"
            | "entries_utf8"
            | "dir_metadata"
            | "reopen_dir"
            | "remove_open_dir"
            | "remove_open_dir_all"
            | "open_parent_dir"
            | "rewind"
            | "as_raw_fd"
            | "as_fd"
    )
}

/// The masking guard (AS-EFF-008), the `Db` analog of `is_net_establishing`: whether a `Db`-classified
/// call takes the raw SQL QUERY as a string argument (so a missing literal leaves the table
/// structurally INVISIBLE — a runtime-built query — and the surface is incomplete, fail-closed). An
/// ALLOWLIST of the SQL-string-bearing execution/prepare verbs, the SAFE direction: a
/// build-then-execute terminal that takes NO SQL string (sqlx/diesel/sea_orm `fetch*`/`load*`/`first`/
/// `all`/`one`/`stream`, the document-store `find*`/`insert*`/…), and a non-query op (`connect`/
/// `open`/`acquire`/`begin`/`commit`/`ping`/`get_conn`), are NOT here — their query is built
/// structurally (never a maskable string literal) so a missing literal must not false-positive.
/// Under-catching an unusual query verb is a missed mask (sound-with-disclosure), ~~never a broken
/// gate~~ — **FALSE, SOUNDNESS R399**, and R386 three lines below is this guard's own counter-example.
/// `mysql`'s `query_drop`/`query_iter` are that crate's PRIMARY API, take `Q: AsRef<str>`, and were
/// absent: `allow Db users` exited 0 over `c.query_drop(caller_sql)` beside one literal query, with the
/// verb-only control exiting 1. The arg is the method leaf (the path's last segment).
pub fn is_db_query_arg(leaf: &str) -> bool {
    // SOUNDNESS R386 — THE `sqlite3_*` C API TAKES SQL AND WAS ABSENT, so a benign sibling literal
    // certified arbitrary caller-supplied SQL. `classify` in this same crate maps `sqlite3_exec`/
    // `sqlite3_step`/`sqlite3_prepare*` to `Db`; this list had none of them, while candor-swift covers
    // the whole family by prefix — a cross-engine divergence, which is how it was found.
    //
    // MEASURED, calibrated first (`deny Db` exits 1): `conn.execute("INSERT INTO users (id) VALUES (1)",
    // [])` beside `sqlite3_exec(db, caller_sql, …)` reported `tables:['users'] incomplete:NONE` and
    // **`allow Db users` exited 0**. R383 recorded this gap as "REAL BUT NOT LIVE" on the grounds that a
    // C-string literal never reaches `tables` — true of an ISOLATED function, and the wrong shape: the
    // literal does not have to come from the masked call, only from the same FUNCTION.
    //
    // ONLY THE SQL-BEARING SPELLINGS. `sqlite3_step`/`_close`/`_serialize`/`_deserialize` carry no query,
    // and `sqlite3_open*` takes a FILENAME — masking that would claim a Db surface for an Fs locator,
    // which is the over-mask this allowlist exists to avoid. Direction stays an ALLOWLIST for the reason
    // R379 measured: a denylist over a whole-crate-Db crate masks every lifecycle verb in it.
    if matches!(
        leaf,
        "sqlite3_exec"
            | "sqlite3_prepare"
            | "sqlite3_prepare_v2"
            | "sqlite3_prepare_v3"
            | "sqlite3_prepare16"
            | "sqlite3_prepare16_v2"
            | "sqlite3_prepare16_v3"
            // R386's OWN BOUNDARY DEFECT, found by a release panel: `sqlite3_get_table(db, zSql, …)`
            // takes SQL as its second argument and `classify` maps it to `Db`, and the first cut of
            // this list — which cites R346 — omitted it. Two of the family's SQL-bearing spellings
            // written down out of three. Reach on the local registry is ZERO call sites (only
            // declarations in `libsqlite3-sys` and `sqlite-wasm-rs`), so this is latent, not live.
            | "sqlite3_get_table"
    ) {
        return true;
    }
    matches!(
        leaf,
        "execute"
            | "execute_batch"
            | "execute_unprepared"
            | "batch_execute"
            | "simple_query"
            | "query"
            | "query_one"
            | "query_opt"
            | "query_raw"
            | "query_row"
            | "query_map"
            // SOUNDNESS R399 — `mysql`'s OWN PRIMARY API was absent, and this is a live gate bypass rather
            // than the "missed mask" the struck sentence above promised. All four take `Q: AsRef<str>`
            // (`mysql-28.0.2/src/conn/queryable.rs:29,50,126`), so the SQL is a maskable string argument of
            // THIS call, which is the exact condition this list encodes. Measured: `allow Db users` exits 0
            // over `c.query_drop(caller_sql)` beside one literal query; the control, the same fixture with
            // the verb changed to `query`, exits 1.
            | "query_drop"
            | "query_iter"
            | "query_first"
            | "query_fold"
            // postgres COPY: the statement is a SQL string argument (`postgres-0.19.14/src/client.rs:492,520`).
            | "copy_in"
            | "copy_out"
            | "query_and_then"
            | "query_typed"
            | "query_all"
            | "prepare"
            | "prepare_typed"
            | "prepare_cached"
            | "exec"
            | "exec_first"
            | "exec_iter"
            | "exec_map"
            | "exec_fold"
            | "exec_drop"
            | "exec_batch"
            | "prep"
            | "run_command"
    )
}

/// THE AS-EFF-008 MASKING GUARD, ONE AUTHORITY FOR BOTH RUST ENGINES. SOUNDNESS R806 / R808.
///
/// The question: this call carries a surface effect `eff` and NO literal locator was captured for it —
/// is its locator (host, program, path, SQL) therefore a RUNTIME value the gate cannot see? If so the
/// caller marks the surface `incomplete`, so a benign sibling literal cannot certify it.
///
/// **WHY ONE FUNCTION.** Both rust engines asked this question, each with its own copy of the
/// disjunction over the `is_*` predicates below, and the copies drifted: R460's receiver-locator arm and
/// R383's `OpenOptions::open` arm reached `candor-scan` and never the deep engine (R808). A rule added
/// here now reaches both, which is the only way this class stops recurring one crate over.
///
/// `leaf` is the call's own method/function name; `path` the resolved call path; `method` whether the
/// call is written in method form on a receiver (so a path-stat `p.exists()` is not mistaken for an
/// argument-form `fs::metadata(p)`, and the receiver-locator arms can fire). `crate_name` is the
/// resolved crate, used only to scope the table-derived FFI arms.
///
/// **THE DIRECTION, stated so it cannot drift:** a wrong `true` over-masks — the gate fails CLOSED and
/// says so; a wrong `false` is the benign-sibling-literal bypass, a broken gate (R399). Every arm that
/// reads a `classify` table below reads it with a NO-LOCATOR DENYLIST, so a leaf added to that table is
/// masked until someone reads its signature and says otherwise.
pub fn masks_locator(eff: &str, crate_name: &str, path: &str, leaf: &str, method: bool) -> bool {
    let by_list = match eff {
        "Net" => is_net_establishing(leaf),
        // SOUNDNESS R808 — the receiver arm is NOT gated on method form. `Command::spawn(cmd)` (UFCS)
        // runs the same caller-supplied program as `cmd.spawn()`, and with the gate BOTH engines
        // certified it at exit 0 on the unit and its caller. In call form the receiver is argument 0;
        // neither engine resolves a determined argument-0 command, so a UFCS spawn on a command built
        // in the same function over-masks (fails closed) — the rare spelling paying for the silent one.
        "Exec" => is_cmd_naming_method(leaf) || is_exec_receiver_locator(path),
        "Fs" => {
            (!method && is_fs_path_arg(leaf))
                || (method && is_fs_path_arg_method(path))
                || (method && is_fs_receiver_locator(path))
        }
        "Db" => is_db_query_arg(leaf),
        _ => false,
    };
    by_list || masks_locator_by_table(eff, crate_name, path, leaf)
}

/// SOUNDNESS R806 — THE TABLE-DERIVED HALF OF `masks_locator`, separate only so a reach probe can ask
/// the very function the guard asks (`R806MASK` in candor-scan) rather than a copy of it.
///
/// Each hand list in `masks_locator` was SHORT against the `classify` table that charges the effect:
/// `is_fs_path_arg` held 28 names while `LIBC_FS` charges 92, `is_cmd_naming_method` held `new`/`cmd`
/// while `LIBC_EXEC` names `system`/`popen`/`exec*`/`posix_spawn*`, `is_net_establishing` lacked
/// `getaddrinfo`, and `is_db_query_arg` lacked `prepare_typed_cached` from `PG_DB_VERBS`. EXECUTED on
/// each: a caller's file really unlinked, a caller's shell command really run, a real resolver lookup,
/// all under `allow <E> in <unit> <benign literal>` at exit 0 on the unit AND its caller.
///
/// Adding the missing names would leave two tables to drift again the next time one grows — the shape
/// swift closed as R787 and java as R794, both by derivation. So these arms READ the charging table and
/// subtract a signature-checked NO-LOCATOR denylist: a leaf added to the table is masked by default.
pub fn masks_locator_by_table(eff: &str, crate_name: &str, path: &str, leaf: &str) -> bool {
    let syscall = is_syscall_crate(crate_name);
    match eff {
        "Net" => {
            syscall
                && LIBC_NET.contains(&leaf)
                && !LIBC_NET_NO_DESTINATION.contains(&leaf)
                // `rustix::net::sendmsg(socket, iov, control, flags)` takes NO address — rustix spells
                // the addressed forms `sendmsg_addr`/`sendmsg_v4`/`sendmsg_v6`/`sendmsg_unix` (not in
                // `LIBC_NET`, so unclassified). libc's and nix's `sendmsg` DO carry one (`msg_name` /
                // `addr: Option<&S>`), which is why this is scoped to the crate rather than the leaf.
                // Measured on the A/B: x11rb's `DefaultStream::do_write` over its connected X11 socket
                // was the only reach, an over-mask, removed here.
                && !(crate_name == "rustix" && leaf == "sendmsg")
        }
        "Exec" => syscall && LIBC_EXEC.contains(&leaf) && !LIBC_EXEC_NO_PROGRAM.contains(&leaf),
        "Fs" => syscall && LIBC_FS.contains(&leaf) && !LIBC_FS_NO_PATH.contains(&leaf),
        "Db" => {
            (matches!(crate_name, "postgres" | "tokio_postgres" | "deadpool_postgres" | "rusqlite")
                && PG_DB_VERBS.iter().any(|v| path.ends_with(v))
                && !PG_DB_VERBS_NO_SQL.iter().any(|v| path.ends_with(v)))
                // `sqlx_core`'s `Executor::prepare_with(sql, params)` — the one SQL-TEXT verb in that
                // crate's Db rule that the leaf list lacked (`prepare` is there). The rest of that rule
                // (`fetch*`/`execute*` on a `Query`) takes an EXECUTOR at argument 0, so deriving the
                // whole rule would mask every `query(lit).fetch_all(&pool)`; it is a named member
                // rather than a derivation for that reason.
                || (crate_name == "sqlx_core" && leaf == "prepare_with")
        }
        _ => false,
    }
}

/// Map a cap-std capability *type* to the effect it authorises. Holding one of these
/// (e.g. `&Dir`) is the real, unforgeable right to perform that effect — so candor
/// treats it as a declared capability, exactly like its own `&Fs` token.
pub fn capstd_cap(crate_name: &str, type_name: &str) -> Option<&'static str> {
    if !crate_name.starts_with("cap_") {
        return None;
    }
    Some(match type_name {
        "Dir" => "Fs",
        "TcpListener" | "TcpStream" | "UdpSocket" | "Pool" => "Net",
        "UnixListener" | "UnixStream" | "UnixDatagram" => "Ipc",
        "SystemClock" | "MonotonicClock" => "Clock",
        _ => return None,
    })
}

/// Table names a SQL string literal STATICALLY reaches — the `Db` analog of the `Net` host /
/// `Exec` command / `Fs` path literal surface (feeds `allow Db in <scope> <table>…`, AS-EFF-008).
/// Conservative by construction, because a wrong capture here would FABRICATE: the string must
/// open with a SQL statement keyword, and only identifiers in table position are taken —
/// `FROM`/`JOIN` anywhere, `INTO` anywhere, statement-leading `UPDATE`/`TRUNCATE`, and
/// `TABLE` (create/drop/alter), skipping `ONLY`/`IF NOT EXISTS`. `UPDATE` mid-statement is
/// deliberately ignored (`FOR UPDATE SKIP LOCKED` must not yield a table "skip"). A
/// dynamically-built query yields nothing — the gate's opaque case — never a guess.
/// Output is lower-cased, quote/backtick-stripped, `schema.table` kept qualified, deduped.
/// SPEC §2 pins this algorithm token-for-token across engines; the cross-impl vector battery
/// (candor-spec conformance/tables/vectors.json, run.sh Part 4b) enforces the JVM/TS mirrors.
pub fn tables_in_sql(sql: &str) -> Vec<String> {
    const STMT: &[&str] =
        &["select", "insert", "update", "delete", "create", "drop", "alter", "truncate", "merge", "replace", "with"];
    // Tokens that can FOLLOW a table-introducing keyword without being a table.
    const SKIP: &[&str] = &["only", "if", "not", "exists", "table"];
    // Identifier-position tokens that are grammar, not a table (subqueries, locking clauses…).
    const STOP: &[&str] = &[
        "select", "set", "where", "values", "on", "using", "group", "order", "by", "limit",
        "returning", "as", "inner", "outer", "left", "right", "cross", "lateral", "natural",
        "union", "all", "distinct", "case", "when", "null", "default", "skip", "nowait", "of",
        "from", "join", "into", "update", "delete", "insert",
    ];
    // `,` survives as its OWN token (not a space): it's what lets `FROM t1, t2` continue the table
    // list without fabricating from other comma-ridden positions (column lists, ON clauses).
    let cleaned: String = sql
        .to_lowercase()
        .chars()
        .flat_map(|c| match c {
            '(' | ')' | ';' => vec![' '],
            ',' => vec![' ', ',', ' '],
            _ => vec![c],
        })
        .collect();
    let toks: Vec<&str> = cleaned.split_whitespace().collect();
    let Some(first) = toks.first() else { return Vec::new() };
    if !STMT.contains(first) {
        return Vec::new(); // not SQL — nothing to certify, nothing fabricated
    }
    let ident = |t: &str| -> Option<String> {
        let t = t.trim_matches(|c| matches!(c, '"' | '`' | '\''));
        let mut chars = t.chars();
        let ok_first = chars.next().is_some_and(|c| c.is_ascii_alphabetic() || c == '_');
        let ok_rest = t.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '$' | '"' | '`'));
        (ok_first && ok_rest && !STOP.contains(&t)).then(|| t.replace(['"', '`'], ""))
    };
    let mut out: Vec<String> = Vec::new();
    let mut push = |t: Option<String>| {
        if let Some(t) = t {
            if !out.contains(&t) {
                out.push(t);
            }
        }
    };
    for (i, tok) in toks.iter().enumerate() {
        let table_pos = match *tok {
            "from" | "join" | "into" | "table" => true,
            // statement-leading only (see doc comment): `update t set …`, `truncate [table] t`.
            "update" | "truncate" => i == 0,
            _ => false,
        };
        if !table_pos {
            continue;
        }
        let mut j = i + 1;
        while j < toks.len() && SKIP.contains(&toks[j]) {
            j += 1;
        }
        let Some(next) = toks.get(j) else { continue };
        let Some(first) = ident(next) else { continue };
        push(Some(first));
        // Comma-ADJACENT continuation only: `FROM t1, t2, t3` takes all three, while an alias breaks
        // the chain (`FROM t1 a, t2` keeps just t1 — an under-report, never a guess: skipping an
        // alias to chase the comma would fabricate tables out of `INSERT INTO t (a, b)`'s column
        // list, whose parens are spaces by the time we tokenize).
        while j + 2 < toks.len() && toks[j + 1] == "," {
            let Some(more) = ident(toks[j + 2]) else { break };
            push(Some(more));
            j += 2;
        }
    }
    out
}

#[cfg(test)]
mod tests {
    #[test]
    fn model_host_recognizes_known_providers_and_special_forms() {
        use super::is_model_host as m;
        // exact known hosts (case-insensitive), with/without a port
        assert!(m("api.openai.com"));
        assert!(m("API.OpenAI.com"));
        assert!(m("api.anthropic.com:443"));
        assert!(m("generativelanguage.googleapis.com"));
        assert!(m("api.mistral.ai"));
        assert!(m("api.cohere.ai"));
        assert!(m("api.cohere.com")); // BOTH cohere hosts
        assert!(m("api.groq.com"));
        assert!(m("api.together.xyz"));
        assert!(m("api.perplexity.ai"));
        assert!(m("openrouter.ai"));
        // a subdomain of a known host counts
        assert!(m("eu.api.openai.com"));
        // Ollama: :11434 on a LOOPBACK host only (max-review r3 — a remote host on 11434 is not Ollama)
        assert!(m("localhost:11434"));
        assert!(m("127.0.0.1:11434"));
        assert!(!m("ollama.internal:11434")); // a remote/internal service on 11434 is NOT a model host
        // Bedrock: the FIRST label is the model-inference service, not the substring "bedrock"
        assert!(m("bedrock-runtime.us-east-1.amazonaws.com"));
        assert!(m("bedrock-runtime.eu-west-1.amazonaws.com"));
        assert!(m("bedrock-agent-runtime.us-east-1.amazonaws.com"));
        // NOT model hosts (never guessed)
        assert!(!m("example.com"));
        assert!(!m("api.stripe.com"));
        assert!(!m("localhost:8080")); // a non-Ollama local port
        assert!(!m("s3.us-east-1.amazonaws.com")); // amazonaws but not bedrock
        assert!(!m("bedrock-backups.s3.amazonaws.com")); // an S3 bucket merely NAMED bedrock — not the runtime
        assert!(!m("bedrock.us-east-1.amazonaws.com")); // the Bedrock CONTROL plane — not model inference
        assert!(!m("openai.com.evil.com")); // suffix trick — not a subdomain of a known host
    }

    #[test]
    fn model_sdk_crate_is_crate_level_no_method_gating() {
        use super::is_model_sdk_crate as s;
        assert!(s("async_openai"));
        assert!(s("aws_sdk_bedrockruntime"));
        assert!(s("ollama_rs"));
        assert!(s("langchain_rust"));
        assert!(!s("reqwest"));
        assert!(!s("aws_sdk_s3"));
    }

    #[test]
    fn sql_table_extraction_is_conservative() {
        use super::tables_in_sql as t;
        assert_eq!(t("SELECT id FROM users WHERE x = 1"), vec!["users"]);
        assert_eq!(t("select * from ledger.entries e join customers c on c.id = e.cid"),
                   vec!["ledger.entries", "customers"]);
        assert_eq!(t("INSERT INTO audit_log (a) VALUES (?1)"), vec!["audit_log"]);
        assert_eq!(t("UPDATE accounts SET v = ?"), vec!["accounts"]);
        assert_eq!(t("DELETE FROM sessions WHERE id = ?"), vec!["sessions"]);
        assert_eq!(t("CREATE TABLE IF NOT EXISTS cache (k TEXT)"), vec!["cache"]);
        assert_eq!(t("TRUNCATE TABLE staging"), vec!["staging"]);
        // FOR UPDATE locking clause must not yield a phantom table (mid-statement update ignored)
        assert_eq!(t("SELECT * FROM jobs FOR UPDATE SKIP LOCKED"), vec!["jobs"]);
        // a subquery in FROM position yields nothing for that position
        assert_eq!(t("SELECT * FROM (SELECT 1) q"), Vec::<String>::new());
        // not SQL -> nothing (never fabricate)
        assert_eq!(t("/tmp/some/path"), Vec::<String>::new());
        assert_eq!(t("hello world from nowhere"), Vec::<String>::new());
        // comma-ADJACENT continuation: a FROM list takes every table in the chain…
        assert_eq!(t("SELECT a FROM t1, t2, s.t3 WHERE x = 1"), vec!["t1", "t2", "s.t3"]);
        // …but an alias breaks it (under-report, never a guess)…
        assert_eq!(t("SELECT a FROM t1 a1, t2 WHERE x = 1"), vec!["t1"]);
        // …which is exactly what keeps a column list from fabricating (parens are spaces by now).
        assert_eq!(t("INSERT INTO t (a, b) VALUES (1, 2)"), vec!["t"]);
        // a subquery after the comma stops the chain too
        assert_eq!(t("SELECT a FROM t1, (SELECT 1) q"), vec!["t1"]);
    }

    use super::*;

    /// The routed-handle list's MEMBERSHIP RULE, enforced rather than merely documented.
    ///
    /// (a) Every routed type must have a whole-type rule that answers an ARBITRARY method on it.
    /// If it did not, routing it would hand the scanner a path the classifier drops — motion with no
    /// effect, and the silent under-report would survive the fix that was supposed to close it. The
    /// probe leaf is deliberately a name no carve-out lists, so it measures the BASE rule.
    ///
    /// (b) The named exclusions stay excluded. `ReadDir` cannot have a verb-precise rule written for it
    /// (its `next` is a syscall and is spelled like every other iterator's), and `Metadata`/`DirEntry`/
    /// `Permissions`/`FileType` are pure DATA under the coarse `std::fs::` prefix — routing any of them
    /// charges an effect for reading a field. `OpenOptions`/`DirBuilder` LEFT this list by the route the
    /// list's own comment prescribed: their type-keyed setter carve-outs were written first, so the
    /// whole-type rule under them now answers only for the terminal verb.
    #[test]
    fn std_effect_handles_have_a_whole_type_rule_and_exclude_the_pure_surfaces() {
        for ty in STD_EFFECT_HANDLES {
            let probe = format!("{ty}::__candor_probe_verb");
            assert!(
                classify("std", &probe).is_some(),
                "`{ty}` is routed into the classifier by receiver inference, but an arbitrary method \
                 on it classifies to NOTHING — the routing cannot close any under-report"
            );
            assert!(is_std_effect_handle(ty), "the predicate must agree with the list");
        }
        for ty in [
            "std::fs::ReadDir",
            "std::fs::Metadata", "std::fs::DirEntry", "std::fs::Permissions", "std::fs::FileType",
            "std::path::Path", "std::path::PathBuf", "std::vec::Vec",
        ] {
            assert!(!is_std_effect_handle(ty),
                    "`{ty}` has a pure surface the coarse prefix rules would charge — it must not be \
                     routed as a handle (Path/PathBuf route through their own verb-precise carve-out)");
        }
    }

    /// The pure read-backs on the ROUTED types, which is what makes (a) above safe: a whole-type rule
    /// answering every method is only acceptable because the genuinely-pure methods were carved out
    /// first. Receiver routing is a second door into these rules, so it must not re-fabricate.
    #[test]
    fn routed_std_handles_keep_their_pure_accessor_carve_outs() {
        for p in [
            "std::process::Command::get_program", "std::process::Command::get_args",
            "std::process::Command::get_envs", "std::process::Command::get_current_dir",
            "std::process::Child::id",
            "std::net::TcpStream::local_addr", "std::net::TcpStream::peer_addr",
            "std::net::TcpStream::nodelay", "std::net::TcpStream::ttl",
            "std::net::UdpSocket::take_error",
            "std::fs::File::as_raw_fd", "std::fs::File::into_raw_fd",
            "std::os::unix::net::UnixStream::as_raw_fd",
            // The OPTION-BUILDER setters (SPEC §1 ⟨0.32⟩): flags in a struct, no file named, nothing
            // opened. `create` is here as `OpenOptions`' setter and is a VERB on `DirBuilder` below —
            // one leaf, two answers, which is why these carve-outs are keyed on the TYPE.
            "std::fs::OpenOptions::new", "std::fs::OpenOptions::read", "std::fs::OpenOptions::write",
            "std::fs::OpenOptions::append", "std::fs::OpenOptions::truncate",
            "std::fs::OpenOptions::create", "std::fs::OpenOptions::create_new",
            "std::fs::OpenOptions::mode", "std::fs::OpenOptions::custom_flags",
            "std::fs::DirBuilder::new", "std::fs::DirBuilder::recursive", "std::fs::DirBuilder::mode",
        ] {
            assert_eq!(classify("std", p), None, "`{p}` is a pure read-back");
        }
        // …and the verbs on the same types still answer, or the carve-outs would have eaten the rule.
        for (p, want) in [
            ("std::process::Command::spawn", "Exec"),
            ("std::process::Child::wait", "Exec"),
            ("std::fs::File::write_all", "Fs"),
            ("std::net::TcpStream::write_all", "Net"),
            ("std::os::unix::net::UnixStream::send", "Ipc"),
            // the TERMINAL VERBS of the two option-builders — the whole point of routing them.
            ("std::fs::OpenOptions::open", "Fs"),
            ("std::fs::DirBuilder::create", "Fs"),
        ] {
            assert_eq!(classify("std", p), Some(want), "`{p}` must stay {want}");
        }
    }

    #[test]
    fn db_crates_are_calibrated() {
        // The calibrated set must cover every DB client the classifier knows, or the receipt's coverage
        // check would flag a recognized crate as a blind spot. (Was nightly-lint-only; now runs on stable.)
        for c in DB_CRATES {
            assert!(
                CALIBRATED_CRATES.contains(&c),
                "DB crate `{c}` is matched by classify() but missing from CALIBRATED_CRATES"
            );
        }
    }

    /// The two coverage lists mean OPPOSITE things and must stay disjoint.
    ///
    /// `CALIBRATED_CRATES` = "classify has effect rules here". `REVIEWED_PURE_CRATES` = "read it, it
    /// performs nothing". A crate in both would be asserting both at once, and the ledger consults them
    /// with an OR — so the contradiction would resolve silently to "covered" and nobody would look again.
    #[test]
    fn reviewed_pure_and_calibrated_are_disjoint() {
        for c in REVIEWED_PURE_CRATES {
            assert!(!CALIBRATED_CRATES.contains(&c),
                    "`{c}` is in BOTH lists — it cannot be rule-covered AND effect-free");
            assert!(!PATH_CALIBRATED_CRATES.contains(&c), "`{c}` is in BOTH lists (path-calibrated)");
            assert!(!CALIBRATED_PREFIXES.iter().any(|p| c.starts_with(p)),
                    "`{c}` is covered by a calibrated PREFIX as well as the pure list");
        }
    }

    /// A reviewed-pure crate must actually classify as pure — the mirror of `calibrated_crates_are_live`.
    ///
    /// The list makes candor BELIEVE these crates rather than disclose them, so if someone later adds a
    /// rule for one, the claim "performs no effect of its own" is dead and the entry has to be re-read,
    /// not silently outvoted by the rule. Probed with the same tails the liveness test uses, which is a
    /// broad sweep of the effectful verb shapes candor knows.
    #[test]
    fn reviewed_pure_crates_classify_as_pure() {
        for c in REVIEWED_PURE_CRATES {
            for t in CALIBRATION_PROBE_TAILS {
                assert!(classify(c, &format!("{c}{t}")).is_none(),
                        "`{c}` is listed REVIEWED-PURE but classify() gives it an effect on `{c}{t}` — \
                         one of the two is wrong, and the list is the claim");
            }
        }
    }

    /// ⟨CALIBRATION CEILING — the table must agree with the REVIEW RECORD⟩ SOUNDNESS R328.
    ///
    /// `CALIBRATED_CEILINGS` is the version each crate's rules were actually written against. Nothing
    /// derived it from, or checked it against, the review record — and three separate failures followed
    /// in one day: a wholesale table rewrite silently DROPPED nine entries while the commit message
    /// claimed four were absent "each with a stated reason"; `git2` was ceilinged ABOVE the only version
    /// its rules record reading (the SILENT direction, and 0.21 added `author_from_env` /
    /// `committer_from_env` / `Oid::hash_file_ext`, none of them ruled); and `sqlx_core` sat BELOW the
    /// version its own comment says was verified, which is also an impossible sibling of `sqlx 0.9.0`'s
    /// `=0.9.0` pin. All three were invisible to 410 tests and 29 gates.
    ///
    /// This asserts the one invariant that catches all of them: **a crate whose rules cite a reviewed
    /// version must carry a ceiling, and it must be THAT version.** Citations are read with wrapped
    /// comment lines joined and both name spellings tried — R315, where a line-by-line dashed-only
    /// sweep silently under-counted the citations by three.
    #[test]
    fn calibration_ceilings_match_the_recorded_review() {
        let src = include_str!("lib.rs");
        // join wrapped comment continuations, then collapse whitespace: a citation is prose and prose wraps.
        let flat = src
            .replace("\n    //", " ")
            .replace("\n        //", " ")
            .replace("\n            //", " ");
        let flat: String = flat.split_whitespace().collect::<Vec<_>>().join(" ");
        let ceilings: std::collections::HashMap<&str, &str> =
            CALIBRATED_CEILINGS.iter().copied().collect();
        // Absences are deliberate and enumerated in the table's own comment; keep the list HERE too so
        // dropping one silently is impossible — that is exactly what happened.
        let deliberate = ["postgres", "async_fs", "getrandom", "rand_core"];
        let mut problems: Vec<String> = Vec::new();
        for c in CALIBRATED_CRATES {
            if deliberate.contains(&c) {
                continue;
            }
            // EVERY citation, both verbs, both name spellings, and slash-separated lists —
            // "verified against sqlx-core 0.8.6/0.9.0" records TWO reviewed versions, and a crate may
            // be cited in more than one comment ("validated against rusqlite 0.39" elsewhere). An
            // extractor that stops at the first hit under-collects, and under-collecting here makes a
            // correct ceiling look like it is above the record — R315's lesson, one level up.
            let mut cited: Vec<String> = Vec::new();
            for form in [c.to_string(), c.replace('_', "-")] {
                for verb in ["verified against ", "validated against "] {
                    let pat = format!("{verb}{form} ");
                    let mut from = 0usize;
                    while let Some(i) = flat[from..].find(&pat) {
                        let at = from + i + pat.len();
                        let tail: String = flat[at..]
                            .chars()
                            .take_while(|ch| ch.is_ascii_digit() || *ch == '.' || *ch == '/')
                            .collect();
                        for v in tail.split('/') {
                            let v = v.trim_end_matches('.').to_string();
                            if v.split('.').count() >= 2 && !cited.contains(&v) {
                                cited.push(v);
                            }
                        }
                        from = at;
                    }
                }
            }
            if cited.is_empty() {
                continue;
            }
            match ceilings.get(c) {
                None => problems.push(format!(
                    "{c}: rules cite {} but there is NO ceiling — the exemption is unconditional",
                    cited.join("/")
                )),
                // A comment may legitimately record MORE THAN ONE reviewed version
                // ("verified against sqlx-core 0.8.6/0.9.0"), so matching any of them is fine, and a
                // ceiling BELOW the newest review is merely noisy. The failure that matters is a
                // ceiling ABOVE EVERY recorded review: that grants reviewed-purity over source nobody
                // read, which is the SILENT direction and the whole reason this table exists.
                Some(have) => {
                    let ok = cited.iter().any(|v| have.starts_with(v) || v.starts_with(*have))
                        || cited.iter().any(|v| calibration_exceeded_raw(v, have));
                    if !ok {
                        problems.push(format!(
                            "{c}: ceiling {have} is ABOVE every recorded review ({}) — it grants \
                             reviewed-purity over source no comment records anyone reading",
                            cited.join("/")
                        ));
                    }
                }
            }
        }
        assert!(
            problems.is_empty(),
            "CALIBRATED_CEILINGS disagrees with the review record:\n  {}\n\n\
             A ceiling ABOVE the recorded review grants reviewed-purity over source nobody read (SILENT); \
             a ceiling BELOW it is noisy but safe. Either way the table and the record must agree, or \
             neither is evidence.",
            problems.join("\n  ")
        );
    }

    #[test]
    fn calibrated_crates_are_live() {
        // Conversely, every crate advertised as calibrated must actually be matched by classify() for
        // some representative path — a dead entry would silently suppress a real coverage warning.
        for c in CALIBRATED_CRATES {
            assert!(
                CALIBRATION_PROBE_TAILS.iter().any(|t| classify(c, &format!("{c}{t}")).is_some()),
                "calibrated crate `{c}` is matched by no path in classify() — dead list entry"
            );
        }
    }

    #[test]
    fn async_http_stack_classifies() {
        // The modern async-HTTP/TLS/QUIC/DNS stack (found by the independent-method differential on oha):
        // verb-keyed Net/Ipc/Fs/Env, crate-gated so generic verbs never fabricate across crates.
        assert_eq!(classify("hyper", "hyper::client::conn::http1::SendRequest::send_request"), Some("Net"));
        assert_eq!(classify("hyper", "hyper::client::conn::http1::handshake"), Some("Net"));
        assert_eq!(classify("hyper_util", "hyper_util::client::legacy::Client::request"), Some("Net"));
        assert_eq!(classify("hickory_resolver", "hickory_resolver::Resolver::lookup_ip"), Some("Net"));
        assert_eq!(classify("quinn", "quinn::Endpoint::connect"), Some("Net"));
        assert_eq!(classify("quinn", "quinn::RecvStream::read_to_end"), Some("Net")); // stream byte I/O, not just open
        assert_eq!(classify("quinn", "quinn::SendStream::write_all"), Some("Net"));
        assert_eq!(classify("tokio_rustls", "tokio_rustls::TlsConnector::connect"), Some("Net"));
        assert_eq!(classify("native_tls", "native_tls::TlsConnector::connect"), Some("Net"));
        assert_eq!(classify("tokio_vsock", "tokio_vsock::VsockStream::connect"), Some("Ipc"));
        assert_eq!(classify("rustls_native_certs", "rustls_native_certs::load_native_certs"), Some("Fs"));
        assert_eq!(classify("rlimit", "rlimit::setrlimit"), Some("Env"));
        // num_cpus is deliberately PURE (consistency with std::thread::available_parallelism; avoids Env spray)
        assert_eq!(classify("num_cpus", "num_cpus::get"), None);
        assert_eq!(classify("num_cpus", "num_cpus::get_physical"), None);
        // pure surface stays None (no fabrication): builder/type/config paths, and other crates' generic verbs
        assert_eq!(classify("hyper", "hyper::Request::builder"), None);
        assert_eq!(classify("hyper", "hyper::body::Bytes::new"), None);
        assert_eq!(classify("native_tls", "native_tls::TlsConnectorBuilder::min_protocol_version"), None);
        assert_eq!(classify("serde", "serde::Deserialize::request"), None); // generic verb, wrong crate
    }

    #[test]
    fn coverage_differential_crates_classify() {
        // Crates the coverage differential found DISCLOSED-but-unmodeled. Each rule is verb-keyed +
        // crate-gated; the EFFECT verbs map to the right bucket and the PURE surface stays None (a
        // wrongly-flagged pure crate is a fabrication, so the negatives matter as much as the positives).

        // rustls (sync TLS core) — record I/O is Net; config/cert + the buffered-decrypt step are pure.
        assert_eq!(classify("rustls", "rustls::ClientConnection::read_tls"), Some("Net"));
        assert_eq!(classify("rustls", "rustls::ConnectionCommon::write_tls"), Some("Net"));
        assert_eq!(classify("rustls", "rustls::Connection::complete_io"), Some("Net"));
        assert_eq!(classify("rustls", "rustls::ConnectionCommon::process_new_packets"), None); // buffered decrypt, no I/O
        assert_eq!(classify("rustls", "rustls::ClientConfig::builder"), None); // pure config

        // native-tls variants — handshake is Net; builder is pure.
        assert_eq!(classify("native_tls_crate", "native_tls_crate::TlsConnector::connect"), Some("Net"));
        assert_eq!(classify("tokio_native_tls", "tokio_native_tls::TlsAcceptor::accept"), Some("Net"));
        assert_eq!(classify("native_tls_crate", "native_tls_crate::TlsConnectorBuilder::min_protocol_version"), None);

        // etcetera — dir resolution reads env; the args data type is pure.
        assert_eq!(classify("etcetera", "etcetera::home_dir"), Some("Env"));
        assert_eq!(classify("etcetera", "etcetera::base_strategy::choose_base_strategy"), Some("Env"));
        assert_eq!(classify("etcetera", "etcetera::base_strategy::Xdg::config_dir"), Some("Env"));
        assert_eq!(classify("etcetera", "etcetera::app_strategy::AppStrategyArgs::new"), None); // pure data

        // sqlx-core — connect is Net, execute/fetch round-trips are Db; options/builders pure.
        assert_eq!(classify("sqlx_core", "sqlx_core::connection::Connection::connect"), Some("Net"));
        assert_eq!(classify("sqlx_core", "sqlx_core::executor::Executor::fetch_one"), Some("Db"));
        assert_eq!(classify("sqlx_core", "sqlx_core::executor::Executor::execute"), Some("Db"));
        assert_eq!(classify("sqlx_core", "sqlx_core::pool::Pool::acquire"), Some("Db"));
        assert_eq!(classify("sqlx_core", "sqlx_core::pool::PoolOptions::max_connections"), None); // pure builder

        // walkdir — charged at construction (`WalkDir::new`, mirroring `ignore`/`glob`), NOT solely at
        // the lazy `next()`/`metadata()` read: candor-scan's receiver-typing blocklist hard-blocks
        // `.into_iter()`, so a typed `IntoIter::next` receiver is unreachable from the idiomatic
        // `WalkDir::new(p).into_iter()...` chain — `WalkDir::new` is the only point every real usage
        // (for-loop, `.count()`, untyped `.next()`) actually reaches. `IntoIter::next`/`DirEntry::metadata`
        // stay Some("Fs") as a secondary rule for the narrower explicit-type-annotation case. Builder
        // setters (`into_iter` itself, `max_depth`, …) and cached accessors stay pure.
        assert_eq!(classify("walkdir", "walkdir::WalkDir::new"), Some("Fs"));
        assert_eq!(classify("walkdir", "walkdir::IntoIter::next"), Some("Fs"));
        assert_eq!(classify("walkdir", "walkdir::DirEntry::metadata"), Some("Fs"));
        assert_eq!(classify("walkdir", "walkdir::WalkDir::into_iter"), None); // no I/O until pulled
        assert_eq!(classify("walkdir", "walkdir::WalkDir::max_depth"), None); // builder setter
        assert_eq!(classify("walkdir", "walkdir::DirEntry::file_type"), None); // cached, no syscall

        // filetime — set_* are utimes (Fs), now is Clock; from_* constructors pure.
        assert_eq!(classify("filetime", "filetime::set_file_mtime"), Some("Fs"));
        assert_eq!(classify("filetime", "filetime::set_file_handle_times"), Some("Fs"));
        assert_eq!(classify("filetime", "filetime::FileTime::now"), Some("Clock"));
        assert_eq!(classify("filetime", "filetime::FileTime::from_unix_time"), None);
        assert_eq!(classify("filetime", "filetime::FileTime::from_last_modification_time"), None); // reads &Metadata, not disk

        // execute — the execute* verbs spawn (Exec); command/shell builders pure.
        assert_eq!(classify("execute", "execute::Execute::execute"), Some("Exec"));
        assert_eq!(classify("execute", "execute::Execute::execute_output"), Some("Exec"));
        assert_eq!(classify("execute", "execute::Execute::execute_multiple_output"), Some("Exec"));
        assert_eq!(classify("execute", "execute::command"), None); // only builds a Command
        assert_eq!(classify("execute", "execute::shell"), None);

        // ctrlc — install signal handler (Ipc).
        assert_eq!(classify("ctrlc", "ctrlc::set_handler"), Some("Ipc"));
        assert_eq!(classify("ctrlc", "ctrlc::try_set_handler"), Some("Ipc"));

        // clap — only the argv-reading terminals are Env; the whole builder + *_from variants pure.
        assert_eq!(classify("clap", "clap::Command::get_matches"), Some("Env"));
        assert_eq!(classify("clap", "clap::Command::try_get_matches"), Some("Env"));
        assert_eq!(classify("clap", "clap::Parser::parse"), Some("Env"));
        assert_eq!(classify("clap", "clap::Command::new"), None); // builder
        assert_eq!(classify("clap", "clap::Arg::about"), None); // builder
        assert_eq!(classify("clap", "clap::Command::get_matches_from"), None); // explicit args, no argv read
        // R59-class audit: `Arg::env` calls `env::var_os` DIRECTLY at builder time (verified against
        // clap_builder 4.6.6) — unambiguous (the crate's only `::env` method), so classify it rather
        // than leave a real effect to fall silently into the CALIBRATED_CRATES purity exemption.
        assert_eq!(classify("clap", "clap::Arg::env"), Some("Env"));
        assert_eq!(classify("clap", "clap::Arg::env_os"), Some("Env"));

        // jiff — now* is Clock; tz lookups read the tzdb (Fs); span/civil math pure.
        assert_eq!(classify("jiff", "jiff::Timestamp::now"), Some("Clock"));
        assert_eq!(classify("jiff", "jiff::Zoned::now_with"), Some("Clock"));
        assert_eq!(classify("jiff", "jiff::tz::TimeZone::system"), Some("Fs"));
        assert_eq!(classify("jiff", "jiff::tz::TimeZone::get"), Some("Fs"));
        assert_eq!(classify("jiff", "jiff::Span::checked_add"), None); // pure arithmetic

        // env_logger — init installs the logger + reads RUST_LOG (Log); config setters pure.
        // TUI — the tty is a user dialogue channel (Ipc), the ruling dialoguer/console already carry.
        // Each verb below was read off the crate source (crossterm-0.28.1, ratatui-0.29.0), not guessed.
        assert_eq!(classify("crossterm", "crossterm::ExecutableCommand::execute"), Some("Ipc"));
        assert_eq!(classify("crossterm", "crossterm::QueueableCommand::queue"), Some("Ipc"));
        assert_eq!(classify("crossterm", "crossterm::event::read"), Some("Ipc"));
        assert_eq!(classify("crossterm", "crossterm::event::poll"), Some("Ipc"));
        assert_eq!(classify("crossterm", "crossterm::terminal::enable_raw_mode"), Some("Ipc"));
        // a tty IOCTL must not fall through: in a CALIBRATED crate an unmatched path is a purity CLAIM
        assert_eq!(classify("crossterm", "crossterm::terminal::size"), Some("Ipc"));
        // the Command VALUE types are pure — they describe an action, they do not perform one
        assert_eq!(classify("crossterm", "crossterm::style::Print"), None);
        assert_eq!(classify("crossterm", "crossterm::cursor::MoveTo"), None);

        // ratatui: the backlog said "mark reviewed-pure"; the SOURCE says `Terminal::draw` ends in a
        // backend flush, so the write surface is Ipc and only the render surface is pure.
        assert_eq!(classify("ratatui", "ratatui::Terminal::draw"), Some("Ipc"));
        assert_eq!(classify("ratatui", "ratatui::Terminal::flush"), Some("Ipc"));
        assert_eq!(classify("ratatui", "ratatui::Terminal::clear"), Some("Ipc"));
        assert_eq!(classify("ratatui", "ratatui::Terminal::hide_cursor"), Some("Ipc"));
        // REGRESSION: `widgets::canvas` is an in-memory grid. `Context::draw` ends in `::draw` and was
        // FABRICATING Ipc — caught in review, measured on a fixture, and a hot path (per shape, per frame).
        assert_eq!(classify("ratatui", "ratatui::widgets::canvas::Context::draw"), None);
        assert_eq!(classify("ratatui", "ratatui::widgets::canvas::Context::layer"), None);
        // …while the real write surface still classifies, including a DIRECT backend call (which is why
        // the carve-out is a denylist on canvas rather than an allowlist on `Terminal::`).
        assert_eq!(classify("ratatui", "ratatui::backend::CrosstermBackend::flush"), Some("Ipc"));
        // the BULK of the 3,345 disclosed calls — widgets, layout, style — are genuinely pure
        assert_eq!(classify("ratatui", "ratatui::widgets::Paragraph::new"), None);
        assert_eq!(classify("ratatui", "ratatui::layout::Layout::split"), None);
        assert_eq!(classify("ratatui", "ratatui::style::Style::fg"), None);
        assert_eq!(classify("ratatui", "ratatui::buffer::Buffer::set_string"), None);

        // tracing_subscriber — two effects, both read off 0.3.23. The filing said "Log/Fs"; the Fs half
        // is wrong (the crate ACCEPTS a File as a writer, it never opens one).
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::init"), Some("Log"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::try_init"), Some("Log"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::SubscriberBuilder::init"), Some("Log"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::EnvFilter::from_default_env"), Some("Env"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::EnvFilter::from_env"), Some("Env"));
        // builders DESCRIBE a subscriber; they do not install one
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::layer"), None);
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::SubscriberBuilder::with_target"), None);
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::EnvFilter::new"), None);

        assert_eq!(classify("env_logger", "env_logger::init"), Some("Log"));
        assert_eq!(classify("env_logger", "env_logger::try_init"), Some("Log"));
        assert_eq!(classify("env_logger", "env_logger::Builder::init"), Some("Log"));
        assert_eq!(classify("env_logger", "env_logger::Builder::format_timestamp"), None); // config
        assert_eq!(classify("env_logger", "env_logger::Builder::build"), None); // pure build

        // dialoguer — interact* is tty I/O (Ipc); builders pure.
        assert_eq!(classify("dialoguer", "dialoguer::Input::interact_text"), Some("Ipc"));
        assert_eq!(classify("dialoguer", "dialoguer::Confirm::interact"), Some("Ipc"));
        assert_eq!(classify("dialoguer", "dialoguer::Select::interact_opt"), Some("Ipc"));
        assert_eq!(classify("dialoguer", "dialoguer::Input::with_prompt"), None); // builder
        // widened-CORE audit: `Editor::new`/`::default` read VISUAL/EDITOR at construction, independent
        // of `Editor::edit`'s already-covered Exec (spawning that editor is a separate, later step).
        assert_eq!(classify("dialoguer", "dialoguer::Editor::new"), Some("Env"));
        assert_eq!(classify("dialoguer", "dialoguer::Editor::default"), Some("Env"));
        assert_eq!(classify("dialoguer", "dialoguer::Editor::edit"), Some("Exec"));
        assert_eq!(classify("dialoguer", "dialoguer::Editor::extension"), None); // pure setter

        // console — Term I/O is Ipc, detection is Env, Style is pure.
        assert_eq!(classify("console", "console::Term::write_line"), Some("Ipc"));
        assert_eq!(classify("console", "console::Term::read_key"), Some("Ipc"));
        assert_eq!(classify("console", "console::colors_enabled"), Some("Env"));
        assert_eq!(classify("console", "console::Style::cyan"), None); // pure styling
        assert_eq!(classify("console", "console::strip_ansi_codes"), None); // pure text util
        // R59-class audit: `Term` also implements raw `io::{Read,Write}` (console 0.15.11) — the same
        // tty channel as `write_line`/`read_key`, reached through the generic trait methods instead of
        // the crate's own named convenience methods. Crate-gated and `Term::`-scoped, so it cannot spread.
        assert_eq!(classify("console", "console::Term::write"), Some("Ipc"));
        assert_eq!(classify("console", "console::Term::flush"), Some("Ipc"));
        assert_eq!(classify("console", "console::Term::read"), Some("Ipc"));

        // terminal_colorsaurus — tty colour query (Ipc).
        assert_eq!(classify("terminal_colorsaurus", "terminal_colorsaurus::background_color"), Some("Ipc"));
        assert_eq!(classify("terminal_colorsaurus", "terminal_colorsaurus::color_palette"), Some("Ipc"));

        // backoff — retry sleeps + reads the clock (Clock); config pure.
        assert_eq!(classify("backoff", "backoff::retry"), Some("Clock"));
        assert_eq!(classify("backoff", "backoff::retry_notify"), Some("Clock"));
        assert_eq!(classify("backoff", "backoff::ExponentialBackoff::default"), None);

        // lscolors — ONLY from_env reads the environment; from_string/style_for_path pure.
        assert_eq!(classify("lscolors", "lscolors::LsColors::from_env"), Some("Env"));
        assert_eq!(classify("lscolors", "lscolors::LsColors::from_string"), None);
        assert_eq!(classify("lscolors", "lscolors::LsColors::style_for_path"), None);

        // wild — argv readers (Env).
        assert_eq!(classify("wild", "wild::args"), Some("Env"));
        assert_eq!(classify("wild", "wild::args_os"), Some("Env"));

        // grep_cli — only the firm Exec (CommandReader spawn); the isatty probes stay unmodeled.
        assert_eq!(classify("grep_cli", "grep_cli::CommandReaderBuilder::build"), Some("Exec"));
        assert_eq!(classify("grep_cli", "grep_cli::is_readable_stdin"), None); // isatty/fstat, not modeled
        assert_eq!(classify("grep_cli", "grep_cli::is_tty_stdout"), None);

        // clircle — same-file detection issues fstat/lseek (Fs); equality is pure.
        assert_eq!(classify("clircle", "clircle::Identifier::try_from"), Some("Fs"));
        assert_eq!(classify("clircle", "clircle::Clircle::surely_conflicts_with"), Some("Fs"));
    }

    #[test]
    fn log_tracing_emit_macros_classify_pre_expansion() {
        // candor-scan is pre-expansion: it sees the raw macro path (`log::info`, `tracing::warn`), not the
        // expanded dispatch the deep engine sees. Both the user-facing macro names AND the type surface:
        assert_eq!(classify("log", "log::info"), Some("Log"));
        assert_eq!(classify("log", "log::error"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::warn"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::info_span"), Some("Log"));
        // pure data-type surface stays None (no fabricated Log)
        assert_eq!(classify("log", "log::Level::as_str"), None);
        assert_eq!(classify("tracing", "tracing::Level::INFO"), None);
    }

    #[test]
    fn classify_core_effects() {
        // A representative smoke test of the classifier's main families, so the published crate is not
        // shipped untested (these used to live only in the nightly-only src/lib.rs).
        assert_eq!(classify("std", "std::fs::read_to_string"), Some("Fs"));
        // std::path stat-family methods are Fs (each is a stat/readdir syscall); the pure
        // string-manipulation surface stays unclassified (the blackout screen's gix-dir find).
        assert_eq!(classify("std", "std::path::Path::symlink_metadata"), Some("Fs"));
        assert_eq!(classify("std", "std::path::PathBuf::read_dir"), Some("Fs"));
        assert_eq!(classify("std", "std::path::Path::exists"), Some("Fs"));
        assert_eq!(classify("std", "std::path::Path::join"), None); // pure string manipulation
        assert_eq!(classify("std", "std::path::PathBuf::file_name"), None);
        assert_eq!(classify("std", "std::path::Path::parent"), None);
        assert_eq!(classify("std", "std::process::Command::new"), Some("Exec"));
        assert_eq!(classify("std", "std::env::var"), Some("Env"));
        assert_eq!(classify("reqwest", "reqwest::Client::execute"), Some("Net"));
        // one-shot convenience fns send immediately → Net.
        assert_eq!(classify("reqwest", "reqwest::get"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::blocking::get"), Some("Net"));
        // the URL-BEARING builder methods classify Net too — the DOMINANT idiom is the builder chain
        // `Client::new().post(url).send()`, whose URL literal rides the `.post(url)` step (NOT `.send()`),
        // so the endpoint (and the Llm host refinement) only get captured if the URL-naming step is Net.
        assert_eq!(classify("reqwest", "reqwest::Client::get"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::Client::post"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::Client::put"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::Client::delete"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::Client::request"), Some("Net"));
        // the PURE builder surface stays None (no URL, no dispatch).
        assert_eq!(classify("reqwest", "reqwest::RequestBuilder::header"), None);
        assert_eq!(classify("reqwest", "reqwest::RequestBuilder::json"), None);
        assert_eq!(classify("reqwest", "reqwest::ClientBuilder::build"), None);
        // RAW POSIX SOCKETS — the lowest network tier, pinned as a regression guard (four-way close:
        // swift got a raw-socket regression this week from a bare-identifier collision; rust never had
        // the gap because it classifies path-QUALIFIED via the syscall-leaf table, but pin it so the
        // `socket`/`connect` Net rows can't silently drop). `libc::connect`/`libc::socket` are the direct
        // FFI syscalls; `nix::sys::socket::connect` is the safe wrapper; both bottom out in the NET table.
        assert_eq!(classify("libc", "libc::connect"), Some("Net"));
        assert_eq!(classify("libc", "libc::socket"), Some("Net"));
        assert_eq!(classify("libc", "libc::bind"), Some("Net"));
        assert_eq!(classify("libc", "libc::accept"), Some("Net"));
        // nix routes through the libc syscall table (same leaves): I/O classified, generic fd ops skipped.
        assert_eq!(classify("nix", "nix::fcntl::open"), Some("Fs"));
        assert_eq!(classify("nix", "nix::sys::socket::connect"), Some("Net"));
        assert_eq!(classify("nix", "nix::sys::socket::socket"), Some("Net"));
        assert_eq!(classify("nix", "nix::unistd::execvp"), Some("Exec"));
        assert_eq!(classify("nix", "nix::unistd::write"), None); // generic fd op — deliberately unclassified
        assert_eq!(classify("nix", "nix::unistd::getpid"), None); // not I/O
        // rustix does raw syscalls (no libc underneath) → classified directly by leaf, same table.
        assert_eq!(classify("rustix", "rustix::time::clock_settime"), Some("Clock"));
        assert_eq!(classify("rustix", "rustix::fs::symlink"), Some("Fs"));
        assert_eq!(classify("rustix", "rustix::net::connect"), Some("Net"));
        assert_eq!(classify("rustix", "rustix::io::read"), None); // generic fd op
        // pnet raw packet capture: channel openers are Net, packet construction stays pure.
        assert_eq!(classify("pnet", "pnet::datalink::channel"), Some("Net"));
        assert_eq!(classify("pnet", "pnet::transport::transport_channel"), Some("Net"));
        assert_eq!(classify("pnet_datalink", "pnet_datalink::channel"), Some("Net"));
        assert_eq!(classify("pnet", "pnet::packet::ethernet::EthernetPacket::new"), None);
        assert_eq!(classify("pnet_base", "pnet_base::MacAddr::new"), None);
        // ignore (gitignore-aware walker): walk executors are Fs, config builders stay pure.
        assert_eq!(classify("ignore", "ignore::WalkBuilder::build_parallel"), Some("Fs"));
        assert_eq!(classify("ignore", "ignore::WalkBuilder::build"), Some("Fs"));
        assert_eq!(classify("ignore", "ignore::WalkParallel::run"), Some("Fs"));
        assert_eq!(classify("ignore", "ignore::WalkBuilder::add_ignore"), Some("Fs")); // reads the ignore file
        assert_eq!(classify("ignore", "ignore::overrides::OverrideBuilder::build"), None); // pure config
        assert_eq!(classify("ignore", "ignore::gitignore::GitignoreBuilder::build"), None); // pure config
        assert_eq!(classify("ignore", "ignore::DirEntry::path"), None); // pure accessor
        // THE FIX: `Walk::new`/`Walk::from_iter` are `WalkBuilder::new(path).build()` /
        // `WalkBuilder::from_iter(paths).build()` in ignore's own source — the crate's documented
        // convenience constructors, and its own top-level doc example (`for entry in Walk::new(path)`).
        // A corpus round caught `deny Fs` exiting 0 over exactly that idiom.
        assert_eq!(classify("ignore", "ignore::Walk::new"), Some("Fs"));
        assert_eq!(classify("ignore", "ignore::Walk::from_iter"), Some("Fs"));
        // NO FABRICATION: a same-named `Walk::new` from an unrelated crate must not gain Fs — crate-gated.
        assert_eq!(classify("walkdir", "walkdir::Walk::new"), None);
        assert_eq!(classify("some_local_crate", "some_local_crate::Walk::new"), None);
        // notify fs-watching: watcher constructors + watch/unwatch are Fs, data types stay pure.
        assert_eq!(classify("notify", "notify::RecommendedWatcher::new"), Some("Fs"));
        assert_eq!(classify("notify", "notify::PollWatcher::new"), Some("Fs"));
        assert_eq!(classify("notify", "notify::recommended_watcher"), Some("Fs"));
        assert_eq!(classify("notify", "notify::INotifyWatcher::watch"), Some("Fs"));
        assert_eq!(classify("notify", "notify::Config::default"), None); // pure config
        assert_eq!(classify("notify", "notify::Event::new"), None); // pure data type
        assert_eq!(classify("rusqlite", "rusqlite::Connection::execute"), Some("Db"));
        // the rusqlite verb DIALECT (a verb probe found the canonical consumer API classifying pure):
        assert_eq!(classify("rusqlite", "rusqlite::Connection::query_row"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Statement::query_map"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::execute_batch"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::prepare_cached"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::open"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::open_in_memory"), Some("Db"));
        // THE FIX: three more real `Connection::open*` constructors an exact-suffix list missed
        // (`open_in_memory_with_flags` doesn't END in `open_with_flags`), plus the documented blob-I/O
        // API (`blob_open`/`Blob::reopen`), each calling the real sqlite3 FFI directly.
        assert_eq!(classify("rusqlite", "rusqlite::Connection::open_in_memory_with_flags"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::open_with_flags_and_vfs"), Some("Db"));
        assert_eq!(
            classify("rusqlite", "rusqlite::Connection::open_in_memory_with_flags_and_vfs"),
            Some("Db")
        );
        assert_eq!(classify("rusqlite", "rusqlite::Connection::blob_open"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::blob::Blob::reopen"), Some("Db"));
        // NO FABRICATION: a same-crate, DIFFERENT type's `open`-prefixed method (rusqlite's own private
        // `pragma::Sql::open_brace`, which pushes one char to a string buffer) must not gain Db — the
        // fix keys on the `Connection::` segment, not a bare leaf prefix.
        assert_eq!(classify("rusqlite", "rusqlite::pragma::Sql::open_brace"), None);
        // THE COVERAGE-GATE SWEEP FIX: the online-backup API and incremental-BLOB positional I/O,
        // verified against rusqlite 0.32.1 (each calls an `ffi::sqlite3_*` leaf already in this file's
        // own FFI-leaf DB table, but the `crate_name == "rusqlite"` block above returned before ever
        // reaching it — same shape as the git2 fix elsewhere in this file).
        assert_eq!(classify("rusqlite", "rusqlite::Backup::new"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Backup::new_with_names"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Backup::step"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Backup::run_to_completion"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::backup"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::restore"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::read_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::read_at_exact"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::raw_read_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::raw_read_at_exact"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::write_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::write_all_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::from_handle"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::from_handle_owned"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::extension_init2"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::init_auto_extension"), Some("Db"));
        // …and the REAL module-qualified spellings (`Backup`/`Blob`/`init_auto_extension` are not
        // re-exported at rusqlite's crate root, unlike `Connection` — a real consumer's source, proven
        // against a compiling fixture, must use these, not the short forms above).
        assert_eq!(classify("rusqlite", "rusqlite::backup::Backup::new"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::blob::Blob::read_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::auto_extension::init_auto_extension"), Some("Db"));
        // NO FABRICATION: `InnerConnection`/`RawStatement` live in PRIVATE modules (lib.rs `mod
        // inner_connection;`/`mod raw_statement;`, no `pub`) — no external consumer can ever name either
        // type, so no rule was added despite self-scan flagging them too.
        assert_eq!(classify("rusqlite", "rusqlite::InnerConnection::close"), None);
        assert_eq!(classify("rusqlite", "rusqlite::RawStatement::step"), None);
        // …but `open` stays rusqlite-only (postgres has no open; nothing else may borrow it):
        assert_eq!(classify("postgres", "postgres::Client::open"), None);
        assert_eq!(classify("tokio_postgres", "tokio_postgres::Client::query_typed"), Some("Db"));
        // THE FIX: `Config::connect_raw` does the same protocol handshake as `Config::connect`, over a
        // caller-supplied stream instead of one it dials itself.
        assert_eq!(classify("tokio_postgres", "tokio_postgres::Config::connect_raw"), Some("Db"));
        // diesel's LIMIT-1 + streaming executions; sqlx's multi-result stream:
        assert_eq!(classify("diesel", "diesel::RunQueryDsl::first"), Some("Db"));
        assert_eq!(classify("diesel", "diesel::RunQueryDsl::load_iter"), Some("Db"));
        // THE FIX: `Connection::establish` is diesel's own name for `::connect` — the crate's canonical,
        // most-used connection entry point (`SqliteConnection::establish(url)` in every diesel
        // quickstart), implemented by really opening the backend handle — but shared no verb spelling
        // with `::connect`, so it read pure with zero `coverage.uncovered` disclosure (diesel is
        // calibrated, so the miss reads as reviewed-pure, not as a gap).
        assert_eq!(classify("diesel", "diesel::sqlite::SqliteConnection::establish"), Some("Db"));
        assert_eq!(classify("diesel", "diesel::pg::PgConnection::establish"), Some("Db"));
        assert_eq!(classify("diesel", "diesel::mysql::MysqlConnection::establish"), Some("Db"));
        assert_eq!(classify("diesel", "diesel::Connection::establish"), Some("Db"));
        // NO FABRICATION: diesel's own private plumbing shares the substring but not the exact verb.
        assert_eq!(classify("diesel", "diesel::sqlite::SqliteConnection::establish_inner"), None);
        assert_eq!(classify("sqlx", "sqlx::query::Query::fetch_many"), Some("Db"));
        // sqlx's bare `query()` builder must STAY pure (the original sqlx lesson):
        assert_eq!(classify("sqlx", "sqlx::query"), None);
        // tracing: the emit/span-lifecycle dispatch is Log; the pure DATA-type accessors are not
        // (whole-crate Log fabricated Log on `Level::as_str` / `Span::is_disabled` — the data types are
        // pure, same principle as the `log` facade).
        assert_eq!(classify("tracing", "tracing::event"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::Span::new_span"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::Span::record"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::Span::enter"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::Level::as_str"), None); // pure accessor
        assert_eq!(classify("tracing", "tracing::Span::is_disabled"), None); // pure state read
        assert_eq!(classify("tracing", "tracing::Span::metadata"), None); // pure accessor
        assert_eq!(classify("tracing", "tracing::metadata::Level::TRACE"), None); // pure data type
        assert_eq!(classify("tracing", "tracing::field::Field::name"), None); // pure data type
        // git2 (high-level Rust API, not the `raw::git_*` FFI tier tested above): remote verbs are Net.
        assert_eq!(classify("git2", "git2::Remote::fetch"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::push"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::download"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::connect"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::connect_auth"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::ls"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::upload"), Some("Net"));
        // THE COVERAGE-GATE SWEEP FIX: `Repository::open`/`init` (and every other local .git-directory
        // operation below) used to read PURE here — the comment this replaced called that "honest, no
        // network", but candor-scan self-scanning git2's OWN source (eval/coverage-gate) proved these
        // reach a REAL Fs effect (`raw::git_repository_open`/`_init_ext`, already in this file's FFI-tier
        // table) that a real consumer's call to the safe wrapper could never surface, because THIS
        // block's early `return None` sat in front of that table for every `crate_name == "git2"` call.
        // "local, no network" was true and beside the point: Fs was the effect being missed. See MEMORY /
        // the commit that added this block for the full sweep (Config/Index/Odb/PackBuilder/Reference/
        // Repository/TreeBuilder — every FQN below calls a listed FS FFI leaf; verified against git2
        // 0.20.4 source).
        assert_eq!(classify("git2", "git2::Repository::open"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::init"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::open_bare"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::open_ext"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::open_from_env"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::discover"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::discover_path"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::init_bare"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::init_opts"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::blob_path"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::checkout_head"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::checkout_index"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::checkout_tree"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::commit"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::reference"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::tag"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Config::add_file"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Config::open"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Config::open_default"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::add_all"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::add_path"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::read"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::write"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::write_tree"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::write_tree_to"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Odb::read"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Odb::reader"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Odb::write"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Odb::writer"), Some("Fs"));
        assert_eq!(classify("git2", "git2::PackBuilder::write"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Reference::delete"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Reference::set_target"), Some("Fs"));
        assert_eq!(classify("git2", "git2::TreeBuilder::write"), Some("Fs"));
        // `Remote::list`/`RemoteConnection::list` call `raw::git_remote_ls` directly — the same
        // reference-advertisement Net effect `Remote::ls` was meant to catch, under the name git2 0.20
        // actually uses (there is no `ls` method left in the crate at all — that suffix rule is dead
        // weight, kept rather than removed since deleting it is a separate, unrelated cleanup).
        assert_eq!(classify("git2", "git2::Remote::list"), Some("Net"));
        assert_eq!(classify("git2", "git2::RemoteConnection::list"), Some("Net"));
        // `Cred::credential_helper` spawns a real `sh -c "<helper> get"` subprocess to resolve
        // `credential.helper` config (cred.rs:370-390) — a real consumer's most common way to honor it.
        assert_eq!(classify("git2", "git2::Cred::credential_helper"), Some("Exec"));
        assert_eq!(classify("git2", "git2::CredentialHelper::execute"), Some("Exec"));
        // NO FABRICATION controls: a `write`/`read`/`open` on some OTHER git2 type (not FQN-listed above)
        // must stay pure — this fix is FQN-exact, not a suffix re-widen.
        assert_eq!(classify("git2", "git2::Repository::state"), None);
        assert_eq!(classify("git2", "git2::Blob::content"), None);
        // tonic's SERVER half (the coverage-gate sweep found only the client verbs were covered):
        // `Router::serve`/`::serve_with_shutdown` bind a real listening socket via `TcpIncoming::new`
        // (`StdTcpListener::bind`), verified against tonic 0.12.3 source.
        assert_eq!(classify("tonic", "tonic::transport::server::Router::serve"), Some("Net"));
        assert_eq!(
            classify("tonic", "tonic::transport::server::Router::serve_with_shutdown"),
            Some("Net")
        );
        assert_eq!(classify("tonic", "tonic::TcpIncoming::new"), Some("Net"));
        // NO FABRICATION control: `Server<L>::serve_with_shutdown` (mod.rs:530) is a DIFFERENT,
        // `pub(crate)` method on a different type — not reachable by any consumer, and this fix does not
        // fabricate an effect for it by widening past the `Router::` FQN.
        assert_eq!(classify("tonic", "tonic::transport::server::Server::serve_with_shutdown"), None);
        // THE FIX: `Repository::clone`/`clone_recurse` and `RepoBuilder::clone` ARE libgit2's real
        // network clone — a corpus round found `git2::Repository::clone(url, path)` reporting ZERO
        // effects and passing `deny Net` at exit 0, because the bare `::clone` denylist meant to keep
        // out `Remote`'s derived `Clone` dup (below) also excluded the one thing the old comment named
        // as NOT meant to be excluded.
        assert_eq!(classify("git2", "git2::Repository::clone"), Some("Net"));
        assert_eq!(classify("git2", "git2::Repository::clone_recurse"), Some("Net"));
        assert_eq!(classify("git2", "git2::build::RepoBuilder::clone"), Some("Net"));
        // THE CONTROL: `Remote::clone` is the DERIVED `Clone` trait impl (an Arc/handle duplication, no
        // libgit2 call) — it must stay pure. Re-fabricating Net here would undo the very over-charge the
        // original exclusion existed to prevent. FQN-exact matching (not a bare `::clone` re-widen) keeps
        // this pure while catching `Repository::clone` above.
        assert_eq!(classify("git2", "git2::Remote::clone"), None);
        // THE SWEEP FIX: a fourth+fifth true positive in the SAME gap — `Submodule::clone`/
        // `Submodule::update` call `raw::git_submodule_clone`/`git_submodule_update` directly (the exact
        // leaves already in this file's FFI-tier NET table), but git2's documented submodule-init idiom
        // calls the safe Rust wrapper, which carried no rule of its own.
        assert_eq!(classify("git2", "git2::Submodule::clone"), Some("Net"));
        assert_eq!(classify("git2", "git2::Submodule::update"), Some("Net"));
        // NO FABRICATION: git2's many pure `update_*` setters (CheckoutBuilder/DiffOptions/StatusOptions)
        // must not gain Net — FQN-exact, not a bare `::update` substring.
        assert_eq!(classify("git2", "git2::build::CheckoutBuilder::update_only"), None);
        assert_eq!(classify("git2", "git2::DiffOptions::update_index"), None);
        assert_eq!(classify("git2", "git2::Submodule::update_strategy"), None);
        // memmap2: only the syscall-issuing map/flush/protect verbs are Fs; reads over an already-mapped
        // region (len/as_ptr/is_empty) and the request builder are PURE (whole-crate Fs fabricated Fs).
        assert_eq!(classify("memmap2", "memmap2::MmapOptions::map"), Some("Fs"));
        assert_eq!(classify("memmap2", "memmap2::MmapOptions::map_mut"), Some("Fs"));
        assert_eq!(classify("memmap2", "memmap2::Mmap::flush"), Some("Fs"));
        assert_eq!(classify("memmap2", "memmap2::MmapMut::make_read_only"), Some("Fs"));
        assert_eq!(classify("memmap2", "memmap2::Mmap::len"), None); // length read — pure
        assert_eq!(classify("memmap2", "memmap2::Mmap::is_empty"), None); // pure
        assert_eq!(classify("memmap2", "memmap2::Mmap::as_ptr"), None); // pointer — pure
        assert_eq!(classify("memmap2", "memmap2::MmapOptions::new"), None); // request builder — pure
        // arboard: the Clipboard handle's read/write verbs are Clipboard; `arboard::Error` formatting
        // and option data types are PURE (whole-crate Clipboard fabricated Clipboard on `Error::to_string`).
        assert_eq!(classify("arboard", "arboard::Clipboard::new"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Clipboard::get_text"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Clipboard::set_text"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Clipboard::clear"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Error::to_string"), None); // error formatting — pure
        assert_eq!(classify("arboard", "arboard::Error::fmt"), None); // Display impl — pure
        assert_eq!(classify("arboard", "arboard::ImageData::to_owned_img"), None); // pure data type
        // R59-class audit: `file_list` is `Get`/`Set`'s sibling terminal beside `text`/`image`/`html`
        // (verified against arboard 3.6.1 — the only `file_list` in the crate, so no ambiguity survives
        // the crate gate); `Clear::default` is `clear()`'s own alternate entry point.
        assert_eq!(classify("arboard", "arboard::Get::file_list"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Set::file_list"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Clear::default"), Some("Clipboard"));
        // fastrand: value draws + entropy-seeded entry points are Rand; the DETERMINISTIC seeded ctor
        // `with_seed` and state split/copy (`fork`/`clone`) are PURE (whole-crate Rand fabricated Rand).
        assert_eq!(classify("fastrand", "fastrand::u32"), Some("Rand")); // top-level draw
        assert_eq!(classify("fastrand", "fastrand::Rng::usize"), Some("Rand"));
        assert_eq!(classify("fastrand", "fastrand::Rng::shuffle"), Some("Rand"));
        assert_eq!(classify("fastrand", "fastrand::Rng::new"), Some("Rand")); // entropy-seeded
        assert_eq!(classify("fastrand", "fastrand::Rng::with_seed"), None); // deterministic ctor — pure
        assert_eq!(classify("fastrand", "fastrand::Rng::fork"), None); // state split — pure
        assert_eq!(classify("fastrand", "fastrand::Rng::clone"), None); // state copy — pure
        // portable_pty / async_process: spawn/wait keep Exec; config GETTERS and pure data ctors/setters
        // do NOT (base Exec fabricated on `CommandBuilder::get_cwd` / `PtySize::default` / `Stdio::piped`).
        assert_eq!(classify("portable_pty", "portable_pty::PtySystem::openpty"), Some("Exec"));
        assert_eq!(classify("portable_pty", "portable_pty::SlavePty::spawn_command"), Some("Exec"));
        assert_eq!(classify("portable_pty", "portable_pty::CommandBuilder::get_argv"), None); // getter
        assert_eq!(classify("portable_pty", "portable_pty::CommandBuilder::get_cwd"), None); // getter
        assert_eq!(classify("portable_pty", "portable_pty::PtySize::default"), None); // pure data type
        assert_eq!(classify("portable_pty", "portable_pty::CommandBuilder::new"), None); // builder ctor
        assert_eq!(classify("async_process", "async_process::Command::spawn"), Some("Exec"));
        assert_eq!(classify("async_process", "async_process::Command::output"), Some("Exec"));
        assert_eq!(classify("async_process", "async_process::Stdio::piped"), None); // pure data type
        assert_eq!(classify("async_process", "async_process::Stdio::null"), None); // pure data type
        // FFI tiers (matched by distinctive leaf, alias-independent)
        assert_eq!(classify("libc", "libc::open"), Some("Fs"));
        assert_eq!(classify("libc", "libc::connect"), Some("Net"));
        assert_eq!(classify("libc", "libc::read"), None); // generic fd op — deliberately unclassified
        assert_eq!(classify("ffi", "ffi::sqlite3_step"), Some("Db"));
        // SOUNDNESS R166 — the PROCESS-GLOBAL extension registry. `rusqlite::register_auto_extension`
        // calls `ffi::sqlite3_auto_extension` directly and read `[]` on the 0.34.0 binary: an explicit
        // empty effect set over a call that changes what every LATER `sqlite3_open` executes.
        assert_eq!(classify("ffi", "ffi::sqlite3_auto_extension"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_cancel_auto_extension"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_reset_auto_extension"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_enable_load_extension"), Some("Db"));
        // …and the database-CONTENT I/O the same sweep found unlisted beside it.
        assert_eq!(classify("ffi", "ffi::sqlite3_deserialize"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_serialize"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_db_cacheflush"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_file_control"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_wal_autocheckpoint"), Some("Db"));
        // CONTROLS for the boundary this list deliberately stops at — an in-memory accessor and a
        // per-connection callback INSTALLER stay unclassified, so the additions above are not read as
        // "every `sqlite3_*` is Db". Both pass before and after R166; recorded as boundary, not coverage.
        assert_eq!(classify("ffi", "ffi::sqlite3_column_int64"), None);
        assert_eq!(classify("ffi", "ffi::sqlite3_create_function_v2"), None);
        assert_eq!(classify("raw", "raw::git_remote_fetch"), Some("Net"));
        // libgit2 clone + submodule clone/update fetch over the network (an A/B on git2 0.20 caught
        // `Submodule::update`/`clone` and `Repository::clone` reporting no Net — the latter because the
        // `src/build.rs` module was being dropped as if it were the Cargo build script).
        assert_eq!(classify("raw", "raw::git_clone"), Some("Net"));
        assert_eq!(classify("raw", "raw::git_submodule_clone"), Some("Net"));
        assert_eq!(classify("raw", "raw::git_submodule_update"), Some("Net"));
        assert_eq!(classify("raw", "raw::git_submodule_open"), None); // local subrepo open — not Net
        // libcurl: the transfer/raw-socket entry points are Net (an A/B on curl 0.4 caught the whole
        // crate reporting ZERO Net); the big setopt/init/getinfo surface — and the readiness-wait
        // multi_wait/poll — stay unclassified (the loop's perform is the boundary).
        assert_eq!(classify("curl_sys", "curl_sys::curl_easy_perform"), Some("Net"));
        assert_eq!(classify("curl_sys", "curl_sys::curl_easy_send"), Some("Net"));
        assert_eq!(classify("curl_sys", "curl_sys::curl_multi_perform"), Some("Net"));
        assert_eq!(classify("curl_sys", "curl_sys::curl_multi_socket_action"), Some("Net"));
        assert_eq!(classify("curl_sys", "curl_sys::curl_easy_setopt"), None); // in-memory option write
        assert_eq!(classify("curl_sys", "curl_sys::curl_easy_init"), None); // handle alloc
        assert_eq!(classify("curl_sys", "curl_sys::curl_multi_wait"), None); // readiness wait, no payload
        // consumer-side `curl` crate rule: the dispatch verbs are Net, the setopt builders pure.
        assert_eq!(classify("curl", "curl::easy::Easy::perform"), Some("Net"));
        assert_eq!(classify("curl", "curl::multi::Multi::perform"), Some("Net"));
        assert_eq!(classify("curl", "curl::easy::Easy::send"), Some("Net"));
        assert_eq!(classify("curl", "curl::easy::Easy::url"), None); // CURLOPT setter — pure
        assert_eq!(classify("curl", "curl::easy::Easy::timeout"), None); // pure setter; Multi::timeout under-reported by design
        assert_eq!(classify("ffi", "ffi::SSL_connect"), Some("Net"));
        // pure crates stay pure
        assert_eq!(classify("serde", "serde::Serialize::serialize"), None);
        assert_eq!(classify("std", "std::vec::Vec::push"), None);

        // ── sweep 2026-06-17: fabrication carve-outs + DNS coverage (each fails pre-fix) ──
        // [24] std::net socket accessors are pure; the I/O verbs stay Net.
        assert_eq!(classify("std", "std::net::TcpStream::connect"), Some("Net"));
        assert_eq!(classify("std", "std::net::TcpStream::local_addr"), None);
        assert_eq!(classify("std", "std::net::TcpStream::nodelay"), None);
        assert_eq!(classify("std", "std::net::TcpStream::ttl"), None);
        assert_eq!(classify("std", "std::net::UdpSocket::peer_addr"), None);
        // [37] std DNS resolution is Net (was floored).
        assert_eq!(classify("std", "std::net::lookup_host"), Some("Net"));
        assert_eq!(classify("std", "core::net::ToSocketAddrs::to_socket_addrs"), Some("Net"));
        // [23] std::process getters are pure; spawn/new stay Exec.
        assert_eq!(classify("std", "std::process::Command::get_program"), None);
        assert_eq!(classify("std", "std::process::Command::get_args"), None);
        assert_eq!(classify("std", "std::process::Child::id"), None);
        assert_eq!(classify("std", "std::process::Command::spawn"), Some("Exec"));
        // [27] redis ConnectionManager::clone is an Arc bump (pure); a query round-trips.
        assert_eq!(classify("redis", "redis::aio::ConnectionManager::clone"), None);
        assert_eq!(classify("redis", "redis::aio::ConnectionManager::send_packed_command"), Some("Db"));
        // [5] sea_orm re-exported sea_query builder algebra is pure; execution verbs stay Db.
        assert_eq!(classify("sea_orm", "sea_orm::sea_query::Func::count"), None);
        assert_eq!(classify("sea_orm", "sea_orm::sea_query::Condition::all"), None);
        assert_eq!(classify("sea_orm", "sea_orm::Select::all"), Some("Db"));
        // THE FIX: `Database::connect_proxy` (the `proxy`-feature sibling of `Database::connect`) opens
        // a live `DatabaseConnection` through a caller-supplied `ProxyDatabaseTrait` — same effect,
        // missing from an allowlist keyed on the plain `connect` spelling.
        assert_eq!(classify("sea_orm", "sea_orm::Database::connect_proxy"), Some("Db"));
        // THE COVERAGE-GATE SWEEP: the transaction and pagination families, verified against sea-orm
        // 1.1.20 source.
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseConnection::transaction"), Some("Db"));
        assert_eq!(
            classify("sea_orm", "sea_orm::DatabaseConnection::transaction_with_config"),
            Some("Db")
        );
        // BONUS (found proving the above reachable with a real fixture, not in the original ratchet):
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseConnection::ping"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseConnection::begin"), Some("Db"));
        assert_eq!(
            classify("sea_orm", "sea_orm::DatabaseConnection::begin_with_config"),
            Some("Db")
        );
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseTransaction::commit"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseTransaction::rollback"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxMySqlPoolConnection::begin"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxMySqlPoolConnection::ping"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxMySqlPoolConnection::transaction"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxPostgresPoolConnection::begin"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxSqlitePoolConnection::ping"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::fetch"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::fetch_and_next"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::into_stream"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::num_pages"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::num_items_and_pages"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Insert::exec_with_returning_keys"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Inserter::exec_with_returning_many"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::TryInsert::exec_with_returning_keys"), Some("Db"));
        // NO FABRICATION: the mock/proxy backends share every one of these verb names but perform no
        // real I/O (mock) or dispatch through a caller-supplied trait (proxy) — FQN-exact, not a bare
        // `::ping`/`::begin`/`::transaction`/`::commit`/`::rollback` suffix, keeps them pure/unknown.
        assert_eq!(classify("sea_orm", "sea_orm::MockDatabaseConnection::ping"), None);
        assert_eq!(classify("sea_orm", "sea_orm::MockDatabaseConnection::begin"), None);
        assert_eq!(classify("sea_orm", "sea_orm::ProxyDatabaseConnection::commit"), None);
        assert_eq!(classify("sea_orm", "sea_orm::ProxyDatabaseConnection::ping"), None);
    }

    #[test]
    fn lettre_tls_setup_and_connection_family_is_covered() {
        // THE COVERAGE-GATE SWEEP, verified against lettre 0.11.23 source. `build_rustls` calls
        // `rustls_native_certs::load_native_certs()` (a real OS-trust-store read) + `tracing::debug!`.
        assert_eq!(
            classify("lettre", "lettre::transport::smtp::client::TlsParametersBuilder::build_rustls"),
            Some("Fs")
        );
        assert_eq!(classify("lettre", "lettre::TlsParametersBuilder::build"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::TlsParameters::new"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::TlsParameters::new_rustls"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::SmtpTransport::from_url"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::SmtpTransport::relay"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::SmtpTransport::starttls_relay"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::AsyncSmtpTransport::from_url"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::AsyncSmtpTransport::relay"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::AsyncSmtpTransport::starttls_relay"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::FileTransport::read"), Some("Fs"));
        // The sealed `Executor` trait impl — `#[doc(hidden)]`, a narrower surface, but genuinely
        // reachable (both the trait and `AsyncStd1Executor` are `pub`, re-exported at the crate root).
        assert_eq!(classify("lettre", "lettre::AsyncStd1Executor::connect"), Some("Net"));
        assert_eq!(classify("lettre", "lettre::AsyncStd1Executor::fs_read"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::AsyncStd1Executor::fs_write"), Some("Fs"));
        // Only reachable via the module-qualified path — neither type is re-exported at the crate root.
        assert_eq!(
            classify(
                "lettre",
                "lettre::transport::smtp::client::AsyncSmtpConnection::connect_asyncstd1"
            ),
            Some("Net")
        );
        assert_eq!(
            classify(
                "lettre",
                "lettre::transport::smtp::client::AsyncNetworkStream::connect_asyncstd1"
            ),
            Some("Net")
        );
        // NO FABRICATION: `NetworkStream` lives in a PRIVATE module (`mod net;`, never re-exported) — no
        // external consumer can ever name it, so no rule was added despite self-scan flagging its
        // `shutdown`/`set_read_timeout`/`set_write_timeout` (propagated from the coarse
        // `std::net::TcpStream` whole-handle rule).
        assert_eq!(classify("lettre", "lettre::NetworkStream::shutdown"), None);
        assert_eq!(classify("lettre", "lettre::NetworkStream::set_read_timeout"), None);
    }

    #[test]
    fn rand_osrng_handle_ops_are_pure_but_draws_are_rand() {
        // Adversarial-review fabrication: the blanket `contains("OsRng")` tagged `OsRng::clone` Rand,
        // but OsRng is a unit struct — clone/fork/default draw no entropy. The real draws still fire.
        assert_eq!(classify("rand", "rand::rngs::OsRng::clone"), None);
        assert_eq!(classify("rand", "rand::rngs::OsRng::default"), None);
        assert_eq!(classify("rand", "rand::rngs::OsRng::fill_bytes"), Some("Rand")); // a real draw
        assert_eq!(classify("rand", "rand::rngs::OsRng::next_u32"), Some("Rand"));
        assert_eq!(classify("rand", "rand::Rng::gen"), Some("Rand")); // verb path unaffected
        assert_eq!(classify("rand", "rand::distributions::Uniform::new"), None); // pure ctor still pure
    }

    #[test]
    fn redis_connection_manager_config_builder_is_pure() {
        // Adversarial-review fabrication: `contains("ConnectionManager")` hit the pure *Config* builder.
        assert_eq!(classify("redis", "redis::aio::ConnectionManagerConfig::new"), None);
        assert_eq!(classify("redis", "redis::aio::ConnectionManagerConfig::set_max_delay"), None);
        // the LIVE manager still round-trips (Db).
        assert_eq!(classify("redis", "redis::aio::ConnectionManager::new"), Some("Db"));
        assert_eq!(classify("redis", "redis::Commands::get"), Some("Db"));
    }

    #[test]
    fn redis_get_connection_info_is_a_pure_accessor_not_swept_by_the_substring() {
        // coverage-gate sweep (2026-08-27): `contains("::get_connection")` also matched
        // `Client::get_connection_info` (a pure accessor over an already-stored field) because it is a
        // literal substring of that name — the real connection-getters stay caught.
        assert_eq!(classify("redis", "redis::Client::get_connection_info"), None);
        assert_eq!(classify("redis", "redis::Client::get_connection"), Some("Db"));
        assert_eq!(classify("redis", "redis::Client::get_async_connection"), Some("Db"));
        assert_eq!(
            classify("redis", "redis::Client::get_multiplexed_async_connection"),
            Some("Db")
        );
    }

    #[test]
    fn aws_config_load_from_env_is_loads_own_convenience_wrapper() {
        // THE FIX: `load_from_env()` is the crate's OWN "convenience wrapper" (its doc comment's words)
        // around `from_env().load().await` — the exact already-modelled effect one call down — but
        // "load_from_env".ends_with("::load") is false.
        assert_eq!(classify("aws_config", "aws_config::load"), Some("Net"));
        assert_eq!(classify("aws_config", "aws_config::load_defaults"), Some("Net"));
        assert_eq!(classify("aws_config", "aws_config::load_from_env"), Some("Net"));
        assert_eq!(classify("aws_config", "aws_config::from_env"), None); // pure builder
    }

    #[test]
    fn tungstenite_stream_first_handshake_entry_points_are_net() {
        // THE FIX: `client`/`client_with_config`/`client_tls`/`client_tls_with_config` (client.rs:176,
        // 159; tls.rs:163,179) and `accept`/`accept_with_config`/`accept_hdr`/`accept_hdr_with_config`
        // (server.rs:23-63) each run `{Client,Server}Handshake::start(stream, ..).handshake()` — the real
        // WS upgrade I/O over an already-open stream. tungstenite's OWN documented way to run over a
        // caller-managed TCP/TLS/mio stream, missing from a verb list keyed only on `connect`.
        assert_eq!(classify("tungstenite", "tungstenite::client::client"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::client::client_with_config"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::tls::client_tls"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::tls::client_tls_with_config"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::server::accept"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::server::accept_with_config"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::server::accept_hdr"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::server::accept_hdr_with_config"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::client::connect_with_config"), Some("Net"));
    }

    #[test]
    fn mysql_conn_new_is_the_real_connect() {
        // THE FIX: `mysql::Conn::new` (conn/mod.rs:342) calls `connect_stream()?; connect()?` directly;
        // `mysql_async::Conn::new` (conn/mod.rs:921) is the async equivalent. Each crate's own primary
        // connection constructor, the crate's own first doctest example — but `::new` never appeared in
        // the verb list.
        assert_eq!(classify("mysql", "mysql::Conn::new"), Some("Db"));
        assert_eq!(classify("mysql_async", "mysql_async::Conn::new"), Some("Db"));
        // NO FABRICATION: the SAME two crates' unrelated pure `new`s (Opts/PoolConstraints/TxOpts/…)
        // must not gain Db — scoped to the `Conn::` segment, not a bare `::new` suffix.
        assert_eq!(classify("mysql", "mysql::Opts::new"), None);
        assert_eq!(classify("mysql", "mysql::PoolConstraints::new"), None);
        assert_eq!(classify("mysql_async", "mysql_async::TxOpts::new"), None);
    }

    #[test]
    fn mongodb_with_options_is_the_same_effect_as_with_uri_str() {
        // THE FIX: `with_uri_str` (client.rs:179) is `ClientOptions::parse(uri).await?;
        // Client::with_options(options)` one call down — `with_options` (client.rs:188) is where the
        // topology/monitoring actually spins up, and mongodb's own doc calls it the entry point for a
        // caller who already holds parsed `ClientOptions`. Verified against mongodb 3.8.1 (both the
        // async `client.rs` and sync `sync/client.rs` `Client`).
        assert_eq!(classify("mongodb", "mongodb::Client::with_uri_str"), Some("Db"));
        assert_eq!(classify("mongodb", "mongodb::Client::with_options"), Some("Db"));
        assert_eq!(classify("mongodb", "mongodb::sync::Client::with_options"), Some("Db"));
        assert_eq!(classify("mongodb", "mongodb::Collection::find_one"), Some("Db"));
        // NO FABRICATION: an unrelated crate's `with_options` builder must not gain Db — crate-gated.
        assert_eq!(classify("some_other_crate", "some_other_crate::Widget::with_options"), None);
    }

    #[test]
    fn pure_fd_transfer_is_not_an_effect() {
        // ADOPTING / EXTRACTING / BORROWING an already-open descriptor (or unwrapping an async type back
        // to its std type) issues NO syscall — it must be PURE even though it hangs off a std I/O type
        // whose prefix rule would otherwise fire Net/Fs/Ipc. (Real tokio sweep: `into_std`, `from_raw_fd`,
        // `as_raw_fd` all fabricated effects.)
        assert_eq!(classify("std", "std::net::TcpStream::from_raw_fd"), None);
        assert_eq!(classify("std", "std::net::TcpStream::into_raw_fd"), None);
        assert_eq!(classify("std", "std::net::TcpStream::as_raw_fd"), None);
        assert_eq!(classify("std", "std::net::TcpListener::from_raw_fd"), None);
        assert_eq!(classify("std", "std::net::UdpSocket::from_raw_socket"), None);
        assert_eq!(classify("std", "std::fs::File::from_raw_fd"), None);
        assert_eq!(classify("std", "std::fs::File::into_raw_fd"), None);
        assert_eq!(classify("std", "std::fs::File::as_raw_handle"), None);
        assert_eq!(classify("std", "std::os::unix::net::UnixStream::from_raw_fd"), None);
        // `SocketAddr::from_pathname` builds an address struct, opens no socket — pure. (socket2 sweep.)
        assert_eq!(classify("std", "std::os::unix::net::SocketAddr::from_pathname"), None);
        assert_eq!(classify("tokio", "tokio::net::TcpStream::from_raw_fd"), None);
        assert_eq!(classify("tokio", "tokio::net::TcpStream::into_std"), None); // unwrap → std type, pure
        assert_eq!(classify("tokio", "tokio::fs::File::into_std"), None);
        // …but a REAL open/connect on the SAME types still fires the effect — the carve-out is leaf-precise.
        assert_eq!(classify("std", "std::net::TcpStream::connect"), Some("Net"));
        assert_eq!(classify("std", "std::fs::File::open"), Some("Fs"));
        assert_eq!(classify("std", "std::fs::read"), Some("Fs"));
        assert_eq!(classify("std", "std::os::unix::net::UnixStream::connect"), Some("Ipc"));
        assert_eq!(classify("tokio", "tokio::net::TcpStream::connect"), Some("Net"));
    }

    /// THE PLATFORM `fs` MODULES. `std::fs::` was the whole filesystem rule, so every function in
    /// `std::os::{unix,windows,wasi}::fs` read PURE — measured with EXECUTED ground truth (a `cargo run`
    /// that created a real symlink and stat'd it back), `deny Fs` over a crate whose only filesystem
    /// write was `std::os::unix::fs::symlink` exited 0.
    ///
    /// The controls are the point: the `*Ext` DATA/BUILDER traits must stay pure, or the fix trades a
    /// silent under-report for a fabrication on every `m.uid()` — and `FileExt` must NOT, because
    /// `read_at`/`write_at` are the positional-I/O syscalls this rule exists to catch.
    #[test]
    fn the_platform_fs_modules_are_filesystem_io_and_their_data_traits_are_not() {
        for p in [
            "std::os::unix::fs::symlink", "std::os::unix::fs::chown", "std::os::unix::fs::lchown",
            "std::os::unix::fs::fchown", "std::os::unix::fs::chroot",
            "std::os::windows::fs::symlink_dir", "std::os::windows::fs::symlink_file",
            "std::os::windows::fs::junction_point",
            "std::os::unix::fs::FileExt::read_at", "std::os::unix::fs::FileExt::write_at",
            "std::os::windows::fs::FileExt::seek_read", "std::os::windows::fs::FileExt::seek_write",
        ] {
            assert_eq!(classify("std", p), Some("Fs"), "{p} performs filesystem I/O");
        }
        for p in [
            "std::os::unix::fs::MetadataExt::uid", "std::os::unix::fs::MetadataExt::mode",
            "std::os::unix::fs::PermissionsExt::mode", "std::os::unix::fs::PermissionsExt::set_mode",
            "std::os::unix::fs::OpenOptionsExt::custom_flags",
            "std::os::unix::fs::DirBuilderExt::mode",
            "std::os::unix::fs::DirEntryExt::ino", "std::os::unix::fs::FileTypeExt::is_fifo",
            "std::os::windows::fs::MetadataExt::file_attributes",
        ] {
            assert_eq!(classify("std", p), None,
                       "{p} reads or configures data already in hand — charging it would FABRICATE Fs");
        }
        // `std::os::unix::net` is Ipc and must be untouched by a rule keyed one segment along.
        assert_eq!(classify("std", "std::os::unix::net::UnixStream::connect"), Some("Ipc"));
    }

    /// SOUNDNESS R141 — the platform `process` modules, the sibling `fs` had a rule and `process` did
    /// not. `CommandExt::exec` is `execvp`: it REPLACES the process image, ground-truthed by a
    /// `cargo run` that printed a line from the exec'd image and never reached the line after the call.
    /// Both directions are driven here: the spawn surface must charge Exec (without the rule every
    /// assertion in the first loop returns `None` and `deny Exec` over a library whose only function
    /// calls `CommandExt::exec` exits 0), and the already-collected-status traits must NOT, or the fix
    /// trades a silent under-report for a fabrication on every `status.signal()` — the same control
    /// shape as the `fs` test above.
    #[test]
    fn the_platform_process_modules_are_exec_and_their_status_traits_are_not() {
        for p in [
            "std::os::unix::process::CommandExt::exec",
            "std::os::unix::process::CommandExt::pre_exec",
            "std::os::unix::process::CommandExt::arg0",
            "std::os::unix::process::CommandExt::uid",
            "std::os::unix::process::CommandExt::gid",
            "std::os::unix::process::CommandExt::groups",
            "std::os::unix::process::CommandExt::process_group",
            "std::os::windows::process::CommandExt::creation_flags",
            "std::os::windows::process::CommandExt::raw_arg",
            "std::os::windows::process::ChildExt::main_thread_handle",
            "std::os::wasi::process::CommandExt::exec",
        ] {
            assert_eq!(classify("std", p), Some("Exec"), "{p} is subprocess machinery");
        }
        for p in [
            "std::os::unix::process::ExitStatusExt::signal",
            "std::os::unix::process::ExitStatusExt::core_dumped",
            "std::os::unix::process::ExitStatusExt::from_raw",
            "std::os::unix::process::ExitStatusExt::into_raw",
            "std::os::unix::process::ExitStatusError::signal",
            "std::os::windows::process::ExitStatusExt::from_raw",
            "std::os::windows::process::ExitCodeExt::from_raw",
            "std::os::unix::process::parent_id",
        ] {
            assert_eq!(classify("std", p), None,
                       "{p} reads a status already collected (or this process's own pid) — charging it \
                        would FABRICATE Exec");
        }
        // Keyed one segment along: `fs` and `net` under the same platform root must be untouched.
        assert_eq!(classify("std", "std::os::unix::fs::FileExt::read_at"), Some("Fs"));
        assert_eq!(classify("std", "std::os::unix::net::UnixStream::connect"), Some("Ipc"));
    }

    #[test]
    fn command_head_refines_the_exec_cliff() {
        use super::classify_command_head as h;
        // unambiguous external tools classify by basename (spec §4 ⟨0.5⟩)
        assert_eq!(h("curl"), &["Net"]);
        assert_eq!(h("telnet"), &["Net"]);
        assert_eq!(h("sftp"), &["Net"]);
        assert_eq!(h("/usr/local/bin/psql"), &["Db"]); // basename match strips the path
        assert_eq!(h("mongo"), &["Db"]);
        assert_eq!(h("cqlsh"), &["Db"]);
        // a candor engine is Fs/Env — spec-SUPPLIED by §7 item 12, not curation
        assert_eq!(h("candor-scan"), &["Env", "Fs"]);
        assert_eq!(h("candor-run.sh"), &["Env", "Fs"]);
        // an unrecognised head adds nothing — the bare Exec cliff stands (never guess). `make`/`npm`
        // run the project's own code; `git`/`rsync` are multi-modal (local vs remote) — all keep the
        // cliff rather than fabricate an effect for the common case.
        assert_eq!(h("some-unknown-tool"), &[] as &[&str]);
        assert_eq!(h("make"), &[] as &[&str]);
        assert_eq!(h("npm"), &[] as &[&str]);
        assert_eq!(h("git"), &[] as &[&str]);
        assert_eq!(h("rsync"), &[] as &[&str]);
        // a builder MODIFIER (`.arg`/`.env`) names no program — its literal must NOT refine (a
        // whole-crate-Exec crate classifies every method; `.env("psql",..)` must not fabricate Db).
        assert!(is_cmd_builder_method("env") && is_cmd_builder_method("arg") && is_cmd_builder_method("current_dir"));
        assert!(!is_cmd_builder_method("new")); // Command::new NAMES the program
        assert!(!is_cmd_builder_method("cmd")); // duct::cmd NAMES the program
        // The gate that ADMITS a literal to classify_command_head is an ALLOWLIST of program-NAMING
        // methods, not the builder denylist. Inversion matters: a whole-crate-Exec crate (portable_pty)
        // classifies EVERY method as Exec, so a getter like `cmd.get_env("psql")` — absent from the
        // builder denylist — would have leaked "psql" to the head and FABRICATED Db. Only `new`/`cmd`
        // name a program, so only they may refine.
        assert!(is_cmd_naming_method("new") && is_cmd_naming_method("cmd"));
        assert!(!is_cmd_naming_method("get_env")); // a GETTER, not a namer — the leak this closes
        assert!(!is_cmd_naming_method("arg") && !is_cmd_naming_method("env") && !is_cmd_naming_method("current_dir"));
    }

    /// SOUNDNESS R379 — THE MASKING GUARD'S ALLOWLIST, AND THE DENYLIST THAT WAS MEASURED AND REJECTED.
    ///
    /// The verbs here take the HOST as an argument, so a runtime value in that position is invisible to
    /// the gate and the surface must be marked incomplete. The DNS resolver verbs were missing, and
    /// their absence was a GATE BYPASS, not a missed disclosure: `allow Net good.example.com` exited 0
    /// over `r.lookup_ip(caller_host)` sitting beside a benign literal, measured against real
    /// hickory-resolver 0.26.2.
    /// SOUNDNESS R386 — the `sqlite3_*` C API takes SQL, and its absence let a benign SIBLING literal
    /// certify arbitrary caller-supplied SQL.
    ///
    /// R383 recorded this gap as "REAL BUT NOT LIVE" because a C-string literal never reaches `tables`.
    /// That is true of an ISOLATED function and is the WRONG SHAPE: the literal only has to come from
    /// the same FUNCTION, not the same call. Measured, calibrated first (`deny Db` exits 1):
    /// `conn.execute("INSERT INTO users (id) VALUES (1)", [])` beside `sqlite3_exec(db, caller_sql, …)`
    /// gave `tables:['users'] incomplete:NONE` and `allow Db users` exited 0.
    #[test]
    fn db_query_arg_covers_the_sqlite3_sql_bearing_family() {
        // Every spelling that TAKES SQL — the whole family, not the one that was measured (R346).
        for f in ["sqlite3_exec", "sqlite3_prepare", "sqlite3_prepare_v2", "sqlite3_prepare_v3",
                  "sqlite3_prepare16", "sqlite3_prepare16_v2", "sqlite3_prepare16_v3",
                  // R386's own boundary, found by a release panel: SQL is arg 1 here too.
                  "sqlite3_get_table"] {
            assert!(is_db_query_arg(f), "{f} carries SQL — a runtime query there is invisible (R386)");
        }
        // THE OVER-MASK CONTROLS, and they carry as much weight as the fix. These take no query, so
        // masking them would fail `allow Db` closed over nothing. `sqlite3_open*` is the sharpest: it
        // takes a FILENAME, so masking it would claim a Db surface for an Fs locator.
        for f in ["sqlite3_step", "sqlite3_close", "sqlite3_open", "sqlite3_open_v2", "sqlite3_open16",
                  "sqlite3_serialize", "sqlite3_deserialize", "sqlite3_finalize", "sqlite3_reset",
                  // the backup/blob handle verbs carry no query either — the other half of the family
                  "sqlite3_backup_init", "sqlite3_backup_step", "sqlite3_blob_open", "sqlite3_blob_read"] {
            assert!(!is_db_query_arg(f),
                    "{f} carries no SQL — masking it claims an incomplete surface over nothing, and for \
                     the open* family it would claim a Db surface for a FILENAME");
        }
        // The pre-existing high-level verbs must survive.
        for f in ["execute", "query", "prepare", "prepare_cached", "simple_query"] {
            assert!(is_db_query_arg(f), "{f} was already covered and must stay covered");
        }
    }

    /// SOUNDNESS R383 — the METHOD forms whose path is an ARGUMENT. The guard's `!c.method` gate
    /// excluded every method form because the path-STAT methods carry the path as their RECEIVER;
    /// `OpenOptions::open(path)` is the counter-example, and `allow Fs <lit>` exited 0 over a
    /// caller-supplied path because of it.
    #[test]
    fn fs_path_arg_methods_are_the_receiver_pairs_not_the_leaf() {
        // The path-taking pairs, matched on the TAIL so std/tokio/cap_primitives/fs_err all qualify.
        for p in ["std::fs::OpenOptions::open", "tokio::fs::OpenOptions::open",
                  "cap_primitives::fs::OpenOptions::open", "fs_err::OpenOptions::open",
                  "std::fs::DirBuilder::create", "tokio::fs::DirBuilder::create"] {
            assert!(is_fs_path_arg_method(p), "{p} takes its path as an ARGUMENT — R383");
        }
        // THE CONTROLS, and they are the row: every other method on the SAME receivers is a builder
        // modifier or a combinator, and `File`'s methods are use-verbs whose path was fixed at open.
        // Masking these is the over-mask a denylist would have caused (R379 measured that cost).
        for p in ["std::fs::File::read_to_string", "std::fs::File::write", "std::fs::File::write_all",
                  "std::fs::File::read", "std::fs::File::seek", "std::path::Path::exists",
                  "std::fs::OpenOptions::read", "std::fs::OpenOptions::truncate",
                  "std::fs::OpenOptions::map_err", "tokio::fs::OpenOptions::mode"] {
            assert!(!is_fs_path_arg_method(p),
                    "{p} hides no path — it is a builder modifier, a combinator, or a use-verb whose \
                     path was fixed at open. Masking it is the over-mask this allowlist avoids.");
        }
    }

    #[test]
    fn net_establishing_allowlist() {
        // Host-bearing verbs establish — a runtime value here is invisible, so the gate must fail closed.
        for m in ["connect", "connect_timeout", "get", "post", "put", "patch", "delete", "head",
                  "request", "send_to", "lookup_host", "to_socket_addrs"] {
            assert!(is_net_establishing(m), "`{m}` takes the host as an argument and must establish");
        }
        // R379: the DNS resolver verbs `classify` already maps to Net. The WHOLE FAMILY, not the one
        // spelling that was found — `_lookup` is a suffix test mirroring `classify`'s own.
        for m in ["lookup", "lookup_ip", "resolve", "reverse_lookup", "srv_lookup", "mx_lookup",
                  "txt_lookup", "ipv4_lookup", "ipv6_lookup", "ns_lookup", "soa_lookup"] {
            assert!(is_net_establishing(m),
                    "`{m}` resolves a caller-supplied host — R379. Without it, `allow Net <benign \
                     literal>` exits 0 over a DNS lookup of a runtime hostname.");
        }
        // USE-verbs on an already-established connection: the host was fixed at `connect`, so a missing
        // literal here hides nothing and must NOT flag — else `connect("h").write(..)` fails closed.
        for m in ["write", "read", "send", "flush", "recv", "peek", "write_all", "read_to_end",
                  "write_vectored", "shutdown", "status", "headers", "text", "json"] {
            assert!(!is_net_establishing(m), "`{m}` is a use-verb on an established connection");
        }
    }

    /// ⟨0.40⟩ SOUNDNESS R817 — an ACCEPT is not a BIND. The two lists answer different questions and must
    /// not share a member: a binding verb's literal is withheld and marks nothing, an accepting verb marks
    /// the surface incomplete. `accept`/`incoming` used to be binding verbs, which is the defect.
    #[test]
    fn r817_accepting_is_not_binding() {
        for (path, leaf) in [
            ("std::net::TcpListener::accept", "accept"),
            ("std::net::TcpListener::incoming", "incoming"),
            ("std::net::TcpListener::into_incoming", "into_incoming"),
            ("tokio::net::TcpListener::accept", "accept"),
            ("tokio::net::TcpListener::poll_accept", "poll_accept"),
            ("libc::accept", "accept"),
            ("libc::accept4", "accept4"),
            ("quinn::Endpoint::accept", "accept"),
            ("tonic::transport::server::Router::serve", "serve"),
            ("tonic::transport::server::Router::serve_with_shutdown", "serve_with_shutdown"),
            ("tonic::transport::server::TcpIncoming::new", "new"),
        ] {
            assert!(is_net_accepting(path, leaf), "`{path}` accepts connections: its peers are unseen");
            assert!(!is_net_binding(leaf), "`{leaf}` must not be a binding verb — binding withholds and marks nothing");
        }
        // CONTROLS — binds mark nothing; a stream accepted on an ESTABLISHED connection (quinn) has a peer
        // fixed at the endpoint's accept; a datagram receive is not an accept; `serve`/`new` elsewhere are
        // not accepts.
        for (path, leaf) in [
            ("std::net::UdpSocket::bind", "bind"),
            ("std::net::TcpListener::bind", "bind"),
            ("libc::listen", "listen"),
            ("quinn::Connection::accept_bi", "accept_bi"),
            ("quinn::Connection::accept_uni", "accept_uni"),
            ("std::net::UdpSocket::recv_from", "recv_from"),
            ("tonic::transport::server::Server::serve_with_shutdown", "serve_with_shutdown"),
            ("reqwest::Client::new", "new"),
        ] {
            assert!(!is_net_accepting(path, leaf), "`{path}` does not accept a connection");
        }
        for m in ["bind", "listen", "bind_to_device"] {
            assert!(is_net_binding(m), "`{m}` names a LOCAL address");
        }
    }

    /// R379 — WHY THIS STAYS AN ALLOWLIST, which is NOT this family's usual direction.
    ///
    /// `candor-denylist-over-allowlist` says narrow a sound over-approximation with a denylist, and
    /// R350 made exactly that inversion one list over. It is wrong HERE, for the reason
    /// `is_cmd_naming_method` states two doc-blocks above for Exec: a WHOLE-CRATE-Net crate classifies
    /// every method as Net, so a denylist of use-verbs masks essentially everything in one. Measured by
    /// building the inversion and A/B-ing all 1,545 registry crates: **544 rows gained `incomplete`,
    /// none lost it** — `cap-std` 66, `hickory-net` 44 — and the triggers were conversions, accessors
    /// and combinators that hide no host.
    ///
    /// These are the measured leaks, pinned so the inversion cannot be re-attempted without meeting
    /// them. `bind` is the sharpest: this file has `is_net_binding` precisely because a bind address
    /// is where the process LISTENS, never a destination it reaches.
    #[test]
    fn the_rejected_denylist_leaks_are_not_establishing() {
        for m in ["bind", "into", "from", "from_std", "as_socket", "setsockopt", "getsockopt",
                  "map_err", "map", "ok", "try_clone", "complete_io"] {
            assert!(!is_net_establishing(m),
                    "`{m}` hides no host and must not mark a surface incomplete. It was a MEASURED \
                     trigger of the rejected denylist inversion (544 rows gained `incomplete` over the \
                     registry, 0 lost) — a whole-crate-Net crate classifies every method as Net, which \
                     is why the allowlist is the precise side here. See R379.");
        }
    }

    #[test]
    fn fs_path_arg_allowlist() {
        // The Fs masking guard's path-naming-fn allowlist — free fns / constructors take the path as a
        // string arg (a runtime path there is invisible to the gate). Stat methods (path on the receiver)
        // and handle ops carry no path arg and must NOT flag — but they're caught by the caller's
        // `!is_method` gate; the allowlist itself just enumerates the path-NAMING leaves.
        assert!(is_fs_path_arg("write") && is_fs_path_arg("read") && is_fs_path_arg("read_to_string"));
        assert!(is_fs_path_arg("open") && is_fs_path_arg("create") && is_fs_path_arg("create_new"));
        assert!(is_fs_path_arg("remove_file") && is_fs_path_arg("rename") && is_fs_path_arg("copy"));
        assert!(is_fs_path_arg("create_dir_all") && is_fs_path_arg("canonicalize") && is_fs_path_arg("metadata"));
        // handle ops / pure builders take NO path arg — never path-naming.
        assert!(!is_fs_path_arg("write_all") && !is_fs_path_arg("flush") && !is_fs_path_arg("read_exact"));
        assert!(!is_fs_path_arg("new") && !is_fs_path_arg("sync_all") && !is_fs_path_arg("set_len"));
    }

    #[test]
    fn db_query_arg_allowlist() {
        // The Db masking guard's query-bearing-verb allowlist — these take the raw SQL as a string arg
        // (a runtime query there is invisible to the gate). Build-then-execute terminals and non-query
        // ops carry no SQL string and must NOT flag.
        assert!(is_db_query_arg("execute") && is_db_query_arg("query") && is_db_query_arg("query_one"));
        assert!(is_db_query_arg("prepare") && is_db_query_arg("batch_execute") && is_db_query_arg("execute_batch"));
        assert!(is_db_query_arg("query_row") && is_db_query_arg("query_map") && is_db_query_arg("exec"));
        // build-then-execute terminals (query built structurally, no SQL string) must NOT flag.
        assert!(!is_db_query_arg("fetch_all") && !is_db_query_arg("load") && !is_db_query_arg("first"));
        assert!(!is_db_query_arg("all") && !is_db_query_arg("one") && !is_db_query_arg("stream"));
        // connection / lifecycle ops take no SQL — must NOT flag.
        assert!(!is_db_query_arg("connect") && !is_db_query_arg("open") && !is_db_query_arg("begin"));
        assert!(!is_db_query_arg("commit") && !is_db_query_arg("ping") && !is_db_query_arg("get_conn"));
    }
}

#[cfg(test)]
mod fs_kind_tests {
    use super::fs_kind;

    /// SPEC §2 `fs`. Most of what these assert is what the classifier REFUSES to say: §2 requires the
    /// field be "omitted rather than guessed", because an empty or partial `fs` reads as a positive claim
    /// ("reads but never writes") — the §4 trust contract's forbidden direction.
    #[test]
    fn write_verbs() {
        for p in ["std::fs::write", "std::fs::create_dir_all", "std::fs::remove_file",
                  "File::create", "std::fs::set_permissions", "f::write_all"] {
            assert_eq!(fs_kind(p), &["write"], "{p} mutates the disk");
        }
    }

    #[test]
    fn read_verbs() {
        for p in ["std::fs::read_to_string", "std::fs::read_dir", "std::fs::metadata",
                  "File::open", "std::fs::canonicalize", "f::read_to_end"] {
            assert_eq!(fs_kind(p), &["read"], "{p} observes without mutating");
        }
    }

    /// A copy/rename reads the source AND writes the destination — one call, both kinds.
    #[test]
    fn two_locator_verbs_are_both() {
        for p in ["std::fs::copy", "std::fs::rename", "std::fs::hard_link"] {
            assert_eq!(fs_kind(p), &["read", "write"], "{p}");
        }
    }

    /// THE LOAD-BEARING CASE. A verb that does not reveal direction must contribute NOTHING — not a
    /// default, not a guess. Anything here returning a kind would let a function claim "reads but never
    /// writes" on the strength of a verb that said neither.
    #[test]
    fn unrevealing_verbs_make_no_claim() {
        for p in ["std::fs::OpenOptions", "some_crate::do_thing", "std::fs::File", "f::seek"] {
            assert!(fs_kind(p).is_empty(), "{p} must not claim a direction it did not reveal");
        }
    }

    /// `OpenOptions::open` is `File::open`'s leaf and NOT its verb: the direction lives in the builder
    /// chain (`.read(true)`/`.write(true)`), which `fs_kind` cannot see. A `write(true)` builder claiming
    /// `["read"]` is the forbidden direction, so the type wins over the leaf here. `File::open` — where
    /// `open` DOES mean read — is unaffected, which is the whole reason this is keyed on the type.
    #[test]
    fn openoptions_open_claims_no_direction_but_file_open_still_reads() {
        for p in ["std::fs::OpenOptions::open", "fs_err::OpenOptions::open",
                  "tokio::fs::OpenOptions::open"] {
            assert!(fs_kind(p).is_empty(),
                    "{p}'s direction was set by the builder chain, which this function cannot see");
        }
        assert_eq!(fs_kind("std::fs::File::open"), &["read"], "`File::open` is unambiguously a read");
    }
}

#[cfg(test)]
mod masks_locator_tests {
    use super::*;

    /// SOUNDNESS R806 — each no-locator DENYLIST must be a SUBSET of the table it subtracts from. A
    /// typo'd or stale entry that is not in the table would subtract nothing and read as a decision;
    /// a table entry renamed without its denylist twin would silently start masking (the safe
    /// direction) — but only this check says which happened.
    #[test]
    fn every_no_locator_denylist_is_a_subset_of_its_charging_table() {
        for n in LIBC_FS_NO_PATH {
            assert!(LIBC_FS.contains(n), "LIBC_FS_NO_PATH names `{n}`, which LIBC_FS does not charge");
        }
        for n in LIBC_EXEC_NO_PROGRAM {
            assert!(LIBC_EXEC.contains(n), "LIBC_EXEC_NO_PROGRAM names `{n}`, absent from LIBC_EXEC");
        }
        for n in LIBC_NET_NO_DESTINATION {
            assert!(LIBC_NET.contains(n), "LIBC_NET_NO_DESTINATION names `{n}`, absent from LIBC_NET");
        }
        for n in PG_DB_VERBS_NO_SQL {
            assert!(PG_DB_VERBS.contains(n), "PG_DB_VERBS_NO_SQL names `{n}`, absent from PG_DB_VERBS");
        }
    }

    /// SOUNDNESS R806 — THE DERIVATION, pinned from the table side: every leaf the table charges that is
    /// not on the denylist MASKS. So a leaf added to `LIBC_FS` tomorrow is masked with no second edit,
    /// which is the property the hand list lacked.
    #[test]
    fn every_charged_libc_leaf_off_the_denylist_masks() {
        for (eff, table, deny) in [
            ("Fs", LIBC_FS, LIBC_FS_NO_PATH),
            ("Exec", LIBC_EXEC, LIBC_EXEC_NO_PROGRAM),
            ("Net", LIBC_NET, LIBC_NET_NO_DESTINATION),
        ] {
            for leaf in table.iter().filter(|l| !deny.contains(l)) {
                for cr in ["libc", "nix"] {
                    let path = format!("{cr}::{leaf}");
                    assert_eq!(classify(cr, &path), Some(eff), "{path} must still be charged {eff}");
                    assert!(masks_locator(eff, cr, &path, leaf, false), "{path} names a locator — must mask");
                }
            }
            for leaf in deny.iter() {
                let path = format!("libc::{leaf}");
                assert!(!masks_locator(eff, "libc", &path, leaf, false) || is_net_establishing(leaf),
                        "{path} is on the no-locator denylist — must not mask via the table");
            }
        }
        // The named members, from the row: the sweep's EXECUTED arms.
        for (eff, leaf) in [("Fs", "unlink"), ("Fs", "unlinkat"), ("Fs", "utimensat"), ("Exec", "system"),
                            ("Exec", "popen"), ("Exec", "execvp"), ("Exec", "posix_spawn"), ("Net", "getaddrinfo"),
                            ("Net", "sendto")] {
            assert!(masks_locator(eff, "libc", &format!("libc::{leaf}"), leaf, false), "libc::{leaf}");
        }
        // Scoped to the syscall crates: the same leaf on an unrelated crate is not this table's to judge.
        assert!(!masks_locator("Fs", "mycrate", "mycrate::unlink", "unlink", false));
        // rustix spells `sendmsg` WITHOUT an address; libc and nix carry one.
        assert!(!masks_locator("Net", "rustix", "rustix::net::sendmsg", "sendmsg", false));
        assert!(masks_locator("Net", "libc", "libc::sendmsg", "sendmsg", false));
    }

    #[test]
    fn pg_verbs_take_sql_except_the_named_three() {
        for v in PG_DB_VERBS.iter().filter(|v| !PG_DB_VERBS_NO_SQL.contains(v)) {
            let path = format!("deadpool_postgres::Client{v}");
            let leaf = &v[2..];
            assert!(masks_locator("Db", "deadpool_postgres", &path, leaf, true), "{path} takes SQL — must mask");
        }
        assert!(masks_locator("Db", "tokio_postgres", "tokio_postgres::Client::prepare_typed_cached",
                              "prepare_typed_cached", true));
        assert!(!masks_locator("Db", "tokio_postgres", "tokio_postgres::Client::transaction", "transaction", true));
        assert!(masks_locator("Db", "sqlx_core", "sqlx_core::executor::Executor::prepare_with", "prepare_with", true));
        assert!(!masks_locator("Db", "sqlx_core", "sqlx_core::query::Query::fetch_all", "fetch_all", true),
                "a Query terminal takes an EXECUTOR at arg 0 — masking it would swallow every literal query");
    }
}