candor_classify/

lib.rs

//! candor-classify — the curated effect classifier (crate+path -> effect), extracted to a STABLE
//! crate so both the nightly `rustc_private` lint AND a stable backend share ONE source of truth
//! (no drift). Pure string logic; no rustc internals. The effect vocabulary lives in candor-report.

use candor_report::EFFECTS;

/// The canonical CANDOR_POLICY DSL parser (SPEC §6.2), shared by the nightly gate and candor-query.
pub mod policy;
#[cfg(test)]
mod policy_props;

/// The SURPRISE heuristic (the cold-repo hook) — SHARED so candor-scan's scan-time note and
/// candor-query's `tour` verb can't drift. Generic over the effect element type.
pub mod surface;

/// The transitive least fixed point over a call graph — SHARED so the scanner's gate-side reason-class
/// accumulator and candor-query's `unverified --class` filter resolve over the SAME reach.
pub mod propagate;

/// ⟨0.24⟩ The §6.2 GATE over an already-accumulated signature — SHARED so `candor-scan --policy` and
/// `candor-query gate --report` (SPEC §3.1) are the same gate reached by two routes, not two gates.
pub mod gate;

/// ⟨0.41⟩ `accept` lines for known policy violations (SPEC §6.2) — matched over a whole run's rows.
pub mod accept;

/// Project-supplied rules, consulted only when the built-in `classify` returns None.
pub fn classify_extra(
    crate_name: &str,
    path: &str,
    extra: &[(&'static str, bool, String)],
) -> Option<&'static str> {
    for (eff, is_crate, prefix) in extra {
        let hit = if *is_crate { crate_name.starts_with(prefix.as_str()) } else { path.starts_with(prefix.as_str()) };
        if hit {
            return Some(eff);
        }
    }
    None
}

/// The exact third-party crates `classify` has effect rules for, and the crate-name
/// PREFIXES it recognizes. This is the single source of truth for "what candor knows":
/// it is emitted beside the JSON report (`<prefix>.calibrated.json`) so the Claude Code
/// receipt's coverage check reads candor's real coverage instead of a hand-copied list.
/// Keep in lockstep with `classify` below — the `db_crates_are_calibrated` and
/// `calibrated_crates_are_live` tests (in this crate's `tests` module) enforce both directions.
pub const CALIBRATED_CRATES: [&str; 82] = [
    // network (aws_config resolves credentials over the network on `.load()`;
    // git2 remote ops — fetch/push/connect — contact the network; async_net is smol's net layer;
    // pnet is raw L2/L3 packet capture)
    "reqwest", "isahc", "ureq", "curl", "aws_config", "git2", "tokio_tcp", "tokio_udp", "async_net",
    "async_nats", "lapin", "lettre", "tungstenite", "elasticsearch", "tonic", "rdkafka", "pnet",
    // directory traversal (ignore = gitignore-aware walker, powers ripgrep/fd; its walk executors are Fs)
    // + filesystem watching (notify = inotify/FSEvents/kqueue wrapper; powers watchexec/cargo-watch)
    "ignore", "notify",
    // database (see DB_CRATES in classify)
    "sqlx", "rusqlite", "postgres", "tokio_postgres", "diesel", "redis", "mongodb",
    "mysql", "mysql_async", "sea_orm", "deadpool_postgres",
    // filesystem (async_fs = smol; fs_err = std::fs wrapper; tempfile; glob) / entropy /
    // subprocess (async_process = smol; duct) / env (dotenvy/dotenv) / clock (time) / log / clipboard
    "memmap2", "fs_err", "async_fs", "tempfile", "glob",
    "rand", "getrandom", "fastrand",
    // entropy: the password-hashing tier (salt mints + bcrypt's internal salt) + the OsRng source
    "argon2", "bcrypt", "scrypt", "pbkdf2", "password_hash", "rand_core",
    "portable_pty", "async_process", "duct",
    "dotenvy", "dotenv",
    "chrono", "time", "tracing", "log", "arboard",
    // compiler diagnostic emission (a dylint lint's output) — see the Log rules in classify
    "rustc_lint", "rustc_errors",
    // raw syscalls via FFI — the syscall-name table that lights up the FFI-thin tier (nix is routed
    // through the same table by leaf name, so a consumer of nix is covered without nix's own source)
    "libc", "nix", "rustix",
    // coverage-differential additions (verb-keyed; see the per-crate rules near the end of classify):
    // sync TLS core + native-tls variants (Net); env/dir resolution + argv + LS_COLORS (Env);
    // sqlx-core execution terminals (Net/Db); directory walk + timestamp mutation + same-file (Fs);
    // process-spawn helpers (Exec); signal handler + interactive-tty prompts (Ipc); env_logger (Log);
    // jiff/backoff clock reads (Clock).
    "rustls", "native_tls_crate", "tokio_native_tls",
    "etcetera", "wild", "lscolors",
    "sqlx_core", "walkdir", "filetime", "clircle",
    "execute", "ctrlc", "clap", "jiff", "env_logger",
    "dialoguer", "console", "terminal_colorsaurus", "backoff", "grep_cli",
    // TUI: the terminal is a user dialogue channel (Ipc), exactly as dialoguer/console already rule.
    // crossterm does the tty I/O; ratatui renders to a Buffer and drives a backend that does.
    "crossterm", "ratatui",
    // tracing_subscriber: the fmt INIT terminals write program output (Log); the EnvFilter constructors
    // read RUST_LOG (Env). Everything else — layers, formatters, filter types — is a builder.
    "tracing_subscriber",
];

pub const CALIBRATED_PREFIXES: [&str; 3] = ["aws_sdk_", "aws_smithy", "cap_"];

/// Crates `classify` matches by PATH prefix rather than crate-name equality (their effectful modules
/// are recognised, e.g. `tokio::net::`/`async_std::fs::`/`mio::net::`), so they're absent from
/// `CALIBRATED_CRATES` (which the liveness test probes by crate name). The coverage check must still
/// treat them as *covered* — otherwise it would mislabel the most common async crates as blind spots.
pub const PATH_CALIBRATED_CRATES: [&str; 3] = ["tokio", "async_std", "mio"];

/// The FFI-thin syscall crates whose `CALIBRATED_CRATES` membership is INCOMPLETE BY DESIGN.
///
/// For every OTHER calibrated crate, "classify returned None" is a REVIEWED verdict — the table covers
/// the crate's effectful surface, so a miss means the call really is pure, and candor-scan's coverage
/// ledger exempts all of `CALIBRATED_CRATES` from blind-spot disclosure on exactly that theory (a
/// calibrated crate's silence is informative). That does not hold for `libc`/`nix`/`rustix`: the table
/// above DELIBERATELY skips their generic fd verbs (`read`/`write`/`close`/`lseek`/`dup`/`fcntl`/...)
/// because a fixed label would mis-categorise an ambiguous fd (file? socket? pipe?) as often as it
/// helps — an honest no-classify, not a purity finding. Real programs that touch these crates go
/// through those exact verbs constantly (`libc::read(fd, ..)` IS the effect, not a builder step), so the
/// blanket exemption converted "no rule here" into a confident, silent purity claim: `fn drain(fd: i32)
/// { libc::read(fd, buf, 64); }` reported zero effects AND zero disclosure (R59, SOUNDNESS.md) — worse
/// than an uncalibrated dependency, which at least discloses `invisible`.
///
/// Consumed ONLY by candor-scan's coverage-ledger filter (the same one-consumer site
/// `coverage_has_exactly_one_anchor_and_exactly_one_consumer` enforces), to carve these three OUT of the
/// `CALIBRATED_CRATES` exemption there — an unclassified call into them still joins the ledger and
/// disclosed `invisible`, exactly like a call into an uncalibrated dependency, while their CLASSIFIED
/// calls (`open`/`close`/`socket`/...) are untouched (they never reach the ledger at all — see
/// `blind_direct`'s `classified.is_none()` gate). Deliberately NOT removed from `CALIBRATED_CRATES`
/// itself: that list means "classify has SOME live rules here" (true — the FS/NET/EXEC/IPC/ENV/CLOCK/
/// RAND tables all fire for these three), and stays the honest `.calibrated.json` sidecar contract.
pub const CALIBRATED_BUT_PARTIAL_CRATES: [&str; 3] = ["libc", "nix", "rustix"];

/// SOUNDNESS R311 — the version each calibrated crate's rules were actually WRITTEN AGAINST.
///
/// `CALIBRATED_CRATES` converts "no rule matched" into "reviewed, and pure", with no disclosure. That
/// claim is evidence about SOURCE SOMEONE READ, and it was being granted on the crate NAME alone — so
/// an upstream release extended it, silently, to code that did not exist when the review happened.
/// Measured 2026-09-07: the sea_orm rule block says in terms that it was "verified against sea-orm
/// 1.1.20 source"; the calibrated fixture resolved 2.0.2, whose `DatabaseExecutor`,
/// `RestrictedConnection`, `RestrictedTransaction`, `RbacContext` and `RusqliteSharedConnection` carry
/// 43 public entry points that no rule can name and every one of which read PURE.
///
/// A crate resolving ABOVE its ceiling is downgraded to `CALIBRATED_BUT_PARTIAL_CRATES` behaviour:
/// matched calls keep their rules (they are still right), unmatched calls rejoin the ledger and
/// disclose `invisible` instead of reading as reviewed-pure. Fail-closed AT THE POINT THE CLAIM IS
/// MADE — the coverage gate can only ever notify us afterwards.
///
/// EXACT, not major-only, and the direction is deliberate: an exact ceiling fails NOISY (a minor bump
/// discloses until someone re-reviews and moves the line) while major-only fails SILENT — and the
/// minor direction is not hypothetical, since redis 1.6.0 -> 1.7.0 and mongodb 3.8.1 -> 3.9.0 both
/// produced real uncovered entry points in the same measurement. Per the family's denylist rule, start
/// strict and relax against measured disclosure volume, never the reverse.
///
/// A crate ABSENT from this table keeps its unconditional exemption: the ceiling is a denylist of
/// versions known to be beyond the review, not an allowlist of versions blessed by it. Adding a crate
/// here is what makes its claim honest, so the table is expected to grow toward `CALIBRATED_CRATES`.
// SOUNDNESS R328 — this table is MERGED, never rewritten. `bbd7615` replaced it wholesale with a
// freshly-computed dict and silently dropped NINE entries (dialoguer, dotenv, dotenvy, grep_cli, isahc,
// lettre, portable_pty, tempfile, postgres) while its own commit message claimed "four crates are
// deliberately absent, each with a stated reason in the code". Eight had no stated reason and every one
// of them cites a version in its own rules — they are exactly the crates the ceiling exists to protect,
// and the protection would have been gone the moment any of them published. Effect classes at stake:
// Net (isahc), SMTP (lettre), Exec (portable_pty), Fs (tempfile), Env (dotenv/dotenvy), Ipc (dialoguer).
//
// DELIBERATELY ABSENT, and this is the complete list:
//   postgres  — R313. Its recorded 0.7.10 was TOKIO-postgres's version, lifted by a regex from a comment
//               about a different crate; postgres ships 0.19.x. No verified baseline exists and inventing
//               one is the claim-without-review this table exists to stop.
//   async_fs, getrandom — their rules match on CRATE NAME alone, so no path can go stale.
//   rand_core — R320/R333 unresolved.
pub const CALIBRATED_CEILINGS: [(&str, &str); 70] = [
    ("arboard", "3.6.1"),
    ("argon2", "0.6.0"),
    ("async_nats", "0.35.1"),
    ("async_process", "2.5.0"),
    ("aws_config", "1.12.0"),
    ("backoff", "0.4.0"),
    ("bcrypt", "0.19.3"),
    ("chrono", "0.4.45"),
    ("clap", "4.6.6"),
    ("clircle", "0.6.1"),
    ("console", "0.15.11"),
    ("crossterm", "0.28.1"),
    ("ctrlc", "3.5.2"),
    ("curl", "0.4.50"),
    ("deadpool_postgres", "0.14.2"),
    ("dialoguer", "0.12.0"),
    ("diesel", "2.3.13"),
    ("dotenv", "0.15.0"),
    ("dotenvy", "0.15.7"),
    ("duct", "1.1.2"),
    ("elasticsearch", "8.19.0-alpha.1"),
    ("env_logger", "0.11.11"),
    ("etcetera", "0.11.0"),
    ("execute", "0.3.0"),
    ("fastrand", "2.5.0"),
    ("filetime", "0.2.29"),
    ("fs_err", "3.3.1"),
    ("git2", "0.20.4"),
    ("glob", "0.3.4"),
    ("grep_cli", "0.1.12"),
    ("ignore", "0.4.33"),
    ("isahc", "2.0.1"),
    ("jiff", "0.2.35"),
    ("lapin", "4.10.0"),
    ("lettre", "0.11.23"),
    ("log", "0.4.34"),
    ("lscolors", "0.21.0"),
    ("memmap2", "0.9.11"),
    ("mongodb", "3.8.1"),
    ("mysql", "28.0.0"),
    ("mysql_async", "0.37.0"),
    ("native_tls_crate", "0.2.18"),
    ("notify", "8.2.0"),
    ("password_hash", "0.6.1"),
    ("pbkdf2", "0.13.0"),
    ("pnet", "0.35.0"),
    ("portable_pty", "0.9.0"),
    ("rand", "0.10.2"),
    ("ratatui", "0.29.0"),
    ("rdkafka", "0.39.0"),
    ("redis", "1.6.0"),
    ("reqwest", "0.13.4"),
    ("rusqlite", "0.39"),
    ("rustls", "0.23.43"),
    ("scrypt", "0.12.0"),
    ("sea_orm", "1.1.20"),
    ("sqlx", "0.9.0"),
    ("sqlx_core", "0.9.0"),
    ("tempfile", "3.27.0"),
    ("terminal_colorsaurus", "1.0.3"),
    ("time", "0.3.55"),
    ("tokio_native_tls", "0.3.1"),
    ("tokio_postgres", "0.7.18"),
    ("tonic", "0.12.3"),
    ("tracing", "0.1.44"),
    ("tracing_subscriber", "0.3.23"),
    ("tungstenite", "0.30.0"),
    ("ureq", "2.12.1"),
    ("walkdir", "2.5.0"),
    ("wild", "2.2.1"),
];

/// `true` when `resolved` is a version this crate's rules were NOT written against — i.e. strictly
/// newer than its ceiling. Unknown crate, unparseable version, or an exact match: `false`, keep the
/// exemption. Comparison is numeric per dotted component so `1.10.0 > 1.9.0`; a pre-release or build
/// suffix on the resolved version is treated as ABOVE the release it decorates, which is the
/// charging direction.
/// Version-only comparison: is `a` strictly newer than `b`? Shared with `candor-scan`'s lockfile
/// parser so "which of two versions of one crate do we keep" is answered by the SAME comparator that
/// decides whether a version is beyond review — one authority, not two spellings that drift.
pub fn calibration_exceeded_raw(a: &str, b: &str) -> bool {
    let parts = |v: &str| -> Vec<u64> {
        v.split(['+', '-']).next().unwrap_or("")
            .split('.')
            .map(|p| p.parse::<u64>().unwrap_or(0))
            .collect()
    };
    let (x, y) = (parts(a), parts(b));
    for i in 0..x.len().max(y.len()) {
        let (p, q) = (x.get(i).copied().unwrap_or(0), y.get(i).copied().unwrap_or(0));
        if p != q {
            return p > q;
        }
    }
    a != b
}

pub fn calibration_exceeded(crate_name: &str, resolved: &str) -> bool {
    let Some((_, ceiling)) = CALIBRATED_CEILINGS.iter().find(|(c, _)| *c == crate_name) else {
        return false;
    };
    let parts = |v: &str| -> Vec<u64> {
        v.split(['+', '-']).next().unwrap_or("")
            .split('.')
            .map(|p| p.parse::<u64>().unwrap_or(0))
            .collect()
    };
    let (r, c) = (parts(resolved), parts(ceiling));
    if r.is_empty() {
        return false;
    }
    for i in 0..r.len().max(c.len()) {
        let (a, b) = (r.get(i).copied().unwrap_or(0), c.get(i).copied().unwrap_or(0));
        if a != b {
            return a > b;
        }
    }
    // Equal numerically (trailing zero components are padding: `0.39` == `0.39.0`). A pre-release/build
    // suffix means it is not the reviewed artifact, so the SUFFIXES must agree — comparing the whole strings
    // read the two-component ceiling `("rusqlite", "0.39")` as exceeded by the very release it was reviewed
    // against (`0.39.0`) and withheld the exemption (SOUNDNESS R1528; pinned by a test until the reachable
    // rusqlite rows had rules).
    let suffix = |v: &str| -> String { v.find(['+', '-']).map(|i| v[i..].to_string()).unwrap_or_default() };
    suffix(resolved) != suffix(ceiling)
}


/// Crates REVIEWED AND FOUND TO PERFORM NO EFFECT OF THEIR OWN — the κ ledger treats them as covered, so
/// their calls stop being disclosed blind spots.
///
/// SEPARATE FROM `CALIBRATED_CRATES` BY NECESSITY, not taste. That list means "classify has effect rules
/// here", and `calibrated_crates_are_live` fails any entry no rule matches — "a dead entry would silently
/// suppress a real coverage warning". A genuinely pure crate has no rule to be live, so it cannot go
/// there; without this list the only way to silence its noise would be to invent a rule, which is worse.
///
/// **THIS LIST MANUFACTURES PURITY CLAIMS, so an entry needs evidence and not a reputation.** A crate here
/// stops being disclosed and starts being believed. Each of these was checked against its source in the
/// local cargo registry for `std::{fs,net,process,env}` and stdio use, and every apparent hit was a DOC
/// COMMENT (serde_json's `/// [`File`]: std::fs::File`, serde_yml's `///  io::stdout()`):
///
///   serde_json 1.0.151, serde_yml 0.0.12, toml 1.1.3, regex 1.13.1, sha2 0.11.0
///
/// `color_eyre` was on the same filing and is NOT here — FETCHED AND CHECKED 2026-08-03, and it is not
/// pure. It reads `RUST_BACKTRACE` / `RUST_LIB_BACKTRACE` / `RUST_SPANTRACE` / `COLORBT_SHOW_HIDDEN`
/// (Env, `config.rs:939..1175`) and **opens source files to render code snippets** (Fs,
/// `config.rs:248`). It is also not CALIBRATED, deliberately: the `File::open` sits inside
/// `impl fmt::Display for SourceSection`, reached when a report is RENDERED rather than through any named
/// verb a caller invokes — so there is no path for a rule to match, and calibrating the crate would turn
/// that render path into an unmatched path, i.e. a PURITY CLAIM over the file read. Its calls therefore
/// stay disclosed as a blind spot. The noise is real; it is also honest, and that is the right trade.
///
/// THE SERIALIZER CAVEAT, worth stating because it is the one that looks wrong: `serde_json::from_reader`
/// and `to_writer` do move bytes — but through a handle the CALLER had to obtain, and obtaining it (a
/// `File::open`, a `TcpStream::connect`) is already classified on the caller. The crate performs no
/// syscall of its own, so charging it would double-count an effect the caller already carries.
pub const REVIEWED_PURE_CRATES: [&str; 5] = ["serde_json", "serde_yml", "toml", "regex", "sha2"];

/// The completeness gate's escape hatch (`eval/coverage-gate/`, `tests/coverage_gate.rs`): exact
/// (crate, consumer-facing path) pairs a human has read and found genuinely pure, despite `candor-scan`
/// self-scanning the crate's own vendored source finding a reachable Fs/Net/Db/Exec effect there. SEPARATE
/// from `REVIEWED_PURE_CRATES` — that list exempts a WHOLE crate from the coverage LEDGER's crate-level
/// disclosure; this one exempts a single ENTRY from the completeness GATE's per-function differential.
/// The gate's generator run (2026-08-27) found 669 self-scan-confirmed entries `classify()` already
/// recognizes (checked in as `covered.tsv`, asserted every push) and 251 it did not yet recognize under
/// any guessed spelling (checked in as `open.tsv`, a ratchet — NOT individually hand-verified, see that
/// file's header). An `open.tsv` row belongs here ONLY once read against the crate's real source and
/// confirmed to perform no effect (the SAME evidence bar `REVIEWED_PURE_CRATES` documents) — until then
/// it stays in the ratchet as an open question, not a silent assumption. The five below were the first
/// batch, from the 2026-08-27 coverage-gate triage:
///
///   - `curl::Multi::timeout` — this file's own `curl` rule (above) already documents WHY: `Easy::
///     timeout` is a pure `CURLOPT_TIMEOUT` setter sharing the `::timeout` leaf, and an under-report on
///     the rare event-loop kick beats mis-tagging every consumer that sets a timeout.
///   - `execute::command` / `execute::shell` — this file's own `execute` rule (above) already documents
///     WHY: both free functions only BUILD a `std::process::Command` (no `.spawn()`/`.output()`/
///     `.status()` call in either body) and return it to the caller, who spawns it themselves — the
///     caller's own `Command::spawn()` carries the effect. Self-scan's raw "Exec" signal comes from
///     `std::process::Command::new`'s coarse whole-type rule (constructing a `Command` is Exec by
///     default, narrowed only for crates like `async_process` that document their own pure-setter
///     surface), not from an actual subprocess launch in either function.
///   - `elasticsearch::Response::content_type` — a pure accessor reading a header off an ALREADY-received
///     response (`self.response.headers().get(..)`, http/response.rs:61) — no I/O of its own. Self-scan's
///     raw "Net" signal is the underlying HTTP client response type's coarse whole-type propagation, not
///     a second network round-trip.
///   - `rusqlite::Context::get_connection` — this file's own rusqlite rule (above) already documents WHY:
///     it hands back a `ConnectionRef` BORROWED from the ALREADY-established connection a running SQL
///     function executes within (`ffi::sqlite3_context_db_handle`, not a syscall) — the same "handle
///     accessor, not a syscall" shape as `TcpStream::local_addr`.
///
/// The next two (2026-08-28, the widened-CORE audit's `Ipc` batch — see `eval/coverage-gate/generate.py`
/// for why `Ipc` only entered the trigger set that day) are a DIFFERENT reason than the five above: not
/// "no effect", but genuinely UNREACHABLE — the item really does perform the effect self-scan found, but
/// no external consumer can ever name it, because the module it lives in is declared with no `pub` at
/// all and neither the module nor the item is re-exported anywhere in the crate root (checked against
/// real source, both ways):
///   - `dialoguer::Paging::render_prompt` — `dialoguer::paging` is a bare `mod paging;` (dialoguer
///     0.12.0, lib.rs:62: `use paging::Paging;`, not `pub use`), so `pub struct Paging` and its `pub fn
///     render_prompt` (which DOES call `Term::flush`, a real Ipc effect per this file's own `console`
///     rule) are internal machinery every `Select`/`MultiSelect`-style prompt uses to render its own
///     paginated view — the effect is already charged at THOSE public entry points' own `::interact*`
///     rule (above), not double-counted here.
///   - `mysql::Stream::connect_socket` — `mysql::io` is a bare `mod io;` (mysql 28.0.0, lib.rs:897, no
///     `pub use` of `io::*` or `Stream` anywhere), so `pub enum Stream` and its `pub fn connect_socket`
///     (a real Unix-domain-socket `connect()`, Ipc) are reachable only from within the crate's own
///     connection-establishment code — a real consumer can't name `mysql::Stream` at all, let alone call
///     a bare constructor on it.
pub const REVIEWED_PURE_ENTRIES: &[(&str, &str)] = &[
    ("curl", "curl::Multi::timeout"),
    ("execute", "execute::command"),
    ("execute", "execute::shell"),
    ("elasticsearch", "elasticsearch::Response::content_type"),
    ("rusqlite", "rusqlite::Context::get_connection"),
    ("dialoguer", "dialoguer::Paging::render_prompt"),
    ("mysql", "mysql::Stream::connect_socket"),
    // SOUNDNESS R1528 — ureq 3.4.2. Both only ASSEMBLE an agent from parts the caller already holds: a boxed
    // connector (`boxed_connector`, a one-field wrapper that forwards `connect` and is never invoked here), a
    // resolver, and a `ConnectionPool::new` whose `Pool::new` copies three numbers out of the `Config`
    // (agent.rs:112-150, pool.rs:21-27/225-232), plus `SharedCookieJar::new` (an empty in-memory
    // `cookie_store`). No call opens a socket, reads the environment, touches a file or reads a clock: EXECUTED,
    // an agent built from a config whose proxy is a live 127.0.0.1 listener made ZERO connections. Self-scan's
    // `Fs,Net,Unknown` is the dispatch union over every `Connector` implementor reached through the
    // `Box<dyn Connector>` field, which is never called in these bodies. (`Agent::new_with_defaults` is NOT
    // here: it builds `Config::default()`, which reads `HTTP_PROXY`/`ALL_PROXY` — it carries an `Env` rule.)
    ("ureq", "ureq::Agent::new_with_config"),
    ("ureq", "ureq::Agent::with_parts"),
    // SOUNDNESS R1528 — chrono 0.4.45, seven rows the self-scan charged `Clock,Env,Fs,Unknown`, which is the
    // dispatch union over every `TimeZone` implementor reached through a generic bound, including `Local`. Each
    // body was READ and none reaches a generic zone, the clock, the environment or a file:
    //   * `DateTime::{parse_from_rfc3339, parse_from_rfc2822, parse_from_str, parse_and_remainder}` and
    //     `Parsed::to_datetime` (datetime/mod.rs:1051-1160, format/parsed.rs:903) only parse text (`parse`,
    //     `parse_rfc3339`, `Parsed::to_naive_datetime_with_offset` — no `env::`, `fs::`, `SystemTime` or `Local` in
    //     format/parse.rs or format/parsed.rs) and build the result with the CONCRETE `FixedOffset`
    //     (`FixedOffset::east_opt(..)` then `and_local_timezone(tz)` / `offset.from_local_datetime`, parse.rs:99-104,
    //     parsed.rs:913): `FixedOffset`'s `TimeZone` impl is in-memory arithmetic. EXECUTED: all four return the same
    //     result with `TZ` unset and `TZ=Asia/Tokyo`, offset +05:30 taken from the text.
    //   * `DateTime::fixed_offset` is `with_timezone(&self.offset().fix())` and `DateTime::years_since` compares
    //     calendar fields: both touch only the offset already stored in `self` (`Offset::fix`, whose implementors in
    //     the family — `FixedOffset`, `Utc`, `Local`'s `FixedOffset`, `chrono_tz`'s `TzOffset` — are arithmetic) and
    //     the target zone `FixedOffset`. EXECUTED: a `DateTime<Local>` converts with `fixed_offset` to the same instant
    //     and offset whatever `TZ` says afterwards. The rows that DO depend on the zone (`with_timezone` and its
    //     kin) are filed instead: R1557.
    ("chrono", "chrono::DateTime::fixed_offset"),
    ("chrono", "chrono::DateTime::years_since"),
    ("chrono", "chrono::DateTime::parse_and_remainder"),
    ("chrono", "chrono::DateTime::parse_from_rfc2822"),
    ("chrono", "chrono::DateTime::parse_from_rfc3339"),
    ("chrono", "chrono::DateTime::parse_from_str"),
    ("chrono", "chrono::Parsed::to_datetime"),
    // SOUNDNESS R1528 — mysql_async 0.37.1, `StatementLike::to_statement` on `Arc`/`Box`/`Cow`/`String`/`Vec`. Each
    // body is `to_statement_move` (queryable/stmt.rs:43-68): it BUILDS a boxed `async move` block (parse the named
    // params, look in the statement cache, `prepare_statement`) and wraps it in `ToStatementResult::Mediate`; nothing
    // runs until that future is polled. A consumer CANNOT poll it: `ToStatementResult` lives in the private
    // `queryable::stmt` module and is not re-exported, it has no methods and is not a `Future`, and the library itself
    // never calls `to_statement` (grep: no other use in the crate; `exec`/`prep` go through `get_statement`). The trait
    // is nameable only as the prelude's SUB-trait bound (`prelude::StatementLike: queryable::stmt::StatementLike`), so
    // the call is reachable in a generic body and nowhere else. EXECUTED (fx_mysql, docker mysql:8 behind a counting
    // proxy): `to_statement` through that bound with a `String`, a `&str` and a `Statement`, result held then dropped =
    // 0 bytes up/down and Com_stmt_prepare +0, against `Conn::prep` beside it (13 up / 43 down, Com_stmt_prepare +1);
    // compile errors E0599 (`resolve` not found on the returned enum) and E0603 (module `queryable` is private) for
    // every attempt to drive it.
    ("mysql_async", "mysql_async::Arc::to_statement"),
    ("mysql_async", "mysql_async::Box::to_statement"),
    ("mysql_async", "mysql_async::Cow::to_statement"),
    ("mysql_async", "mysql_async::String::to_statement"),
    ("mysql_async", "mysql_async::Vec::to_statement"),
    // SOUNDNESS R1528 — sqlx-core 0.9.0, `PoolConnection::{detach, leak}`. Both return the connection's inner
    // `DB::Connection` after `take_live()` (pool/connection.rs:113-124); `detach` floats it and drops the size guard
    // (`DecrementSizeGuard::drop`, pool/inner.rs:614: an atomic decrement and a semaphore release). The doc comment's
    // "a task will be spawned to replace this connection" is NOT in the body. EXECUTED against postgres 16 behind a
    // counting proxy: both calls moved 0 bytes and opened 0 connections, in the `sqlx` and `sqlx_core` spellings.
    ("sqlx_core", "sqlx_core::pool::connection::PoolConnection::detach"),
    ("sqlx_core", "sqlx_core::pool::connection::PoolConnection::leak"),
    // SOUNDNESS R1528 — redis 1.7.1, `Client::build_with_tls` and `ClusterClientBuilder::build`. The first is
    // `into_connection_info` plus `inner_build_with_tls` (tls.rs:32), which `retrieve_tls_certificates` parses from
    // the PEM BYTES the caller put in `TlsCertificates` (`CertificateDer::pem_slice_iter`, in memory) and stores in a
    // `Client { connection_info }`; the second assembles `ClusterParams` the same way and opens no socket
    // (cluster_handling/client.rs:296). The generator's `Fs` came from the `pem` vocabulary, not a file read: neither
    // body names `std::fs`, a path, or `rustls_native_certs`. EXECUTED: `build_with_tls("rediss://..")` moved 0
    // commands and 0 connections on the server.
    ("redis", "redis::client::Client::build_with_tls"),
    ("redis", "redis::cluster_handling::client::ClusterClientBuilder::build"),
    // SOUNDNESS R1528 — lettre 0.11.23, `SmtpTransport::unencrypted_localhost` and `AsyncSmtpTransport::unencrypted_localhost`.
    // Both are `builder_dangerous("localhost").build()` with NO argument, so the connection pool is always the default
    // (`PoolConfig::min_idle` 0): the maintenance thread (sync) / task (async) loops over `count..0` and has nothing to
    // connect (pool/sync_impl.rs:60-83, async_impl.rs:55). EXECUTED, the transport HELD 1.5 s: no `connect` logged, 0
    // connections through the counting proxy, sync and async. The self-scan's `Net` is the loop body's `client.connection()`
    // that `min_idle` can never reach from these two entries. (`SmtpTransportBuilder::build` is NOT pure: a caller's
    // `pool_config(.min_idle(1))` makes it connect, EXECUTED, R1592.)
    ("lettre", "lettre::transport::smtp::transport::SmtpTransport::unencrypted_localhost"),
    ("lettre", "lettre::transport::smtp::async_transport::AsyncSmtpTransport::unencrypted_localhost"),
    // SOUNDNESS R1528 — lapin 4.12.0, `Channel::wait_for_confirms`. It drains the returned-messages queue and awaits the last
    // pending publisher confirm, a promise the connection's IO loop thread resolves (channel.rs:324-332); it writes no frame.
    // EXECUTED against RabbitMQ behind a counting proxy: 0 bytes UP both with nothing pending and with a publish pending (the
    // 21 bytes DOWN in the second case are the confirmation, read by the IO loop that `connect` started, charged there; the
    // `basic_publish` carries the `Net`).
    ("lapin", "lapin::channel::Channel::wait_for_confirms"),
    // SOUNDNESS R1528 (b10) — mysql 28.0.3, `PooledConn::unwrap`: `self.conn.take().unwrap()`, it moves the `Conn` out of the pool wrapper
    // (conn/pool/mod.rs:272). EXECUTED against MySQL 8 behind a counting proxy: 0 connections and 0 bytes in either direction. The
    // `Fs` and `Unknown` the self-scan reports are the drop glue of the consumed wrapper, which holds no connection by then.
    ("mysql", "mysql::conn::pool::PooledConn::unwrap"),
    // SOUNDNESS R1528 (b10) — reqwest 0.13.5, `PoolClient::send_request` (the HTTP/3 pool client): it really does dispatch, but
    // `mod async_impl;` is a bare private module (lib.rs:372) whose only re-exports are `Body, Client, ClientBuilder, Request,
    // RequestBuilder, Response, Upgraded` and `multipart`, so no consumer can name `PoolClient` at all — the same shape as
    // `mysql::Stream::connect_socket` above. The reachable HTTP/3 dispatch is `Client::{execute,send}`, already `Net`. (The comment
    // above `reqwest::multipart::Part::file` already said this row was "removed from open.tsv rather than guessed"; it never was.)
    ("reqwest", "reqwest::async_impl::h3_client::pool::PoolClient::send_request"),
];

/// SOUNDNESS R1528 step 3 — THE VERDICT REGISTER for `eval/coverage-gate/open.tsv`, keyed on the row's
/// IDENTITY (`(crate, entry)`, the manifest's last column — not the guessed consumer path, which a rule
/// change can rewrite).
///
/// Every `open.tsv` row is an effectful public function of a calibrated crate that `classify()` names
/// no effect for — and, within the crate's ceiling, the coverage ledger exempts the call, so a consumer
/// is told nothing (R1528, EXECUTED). Until 2026-11-08 a row that GREW in the weekly refresh left the red
/// by being copied into `open.tsv`: 108 rows that way since the 10-08 regeneration, with no rule, no
/// read and no filed row. **Tom's ruling (2026-11-08): a newly grown row clears the red ONLY with a
/// recorded verdict, paid for by the engine lane that caused it.** The three verdicts are:
///   1. a `classify()` rule — the row then leaves `open.tsv` for `covered.tsv` on regeneration;
///   2. read-and-pure — an entry in `REVIEWED_PURE_ENTRIES` above, at that list's evidence bar;
///   3. a FILED SOUNDNESS row — an entry HERE: `(crate, entry, "R<id>:<kind>")`, where `<kind>` is
///      `silent` (a real effect a consumer is not told about; rule pending), `overcharge` (the self-scan
///      oracle fabricates the effect — a scanner row, R1420(a)'s class), or `conditional` (the effect
///      depends on a type argument or a configuration the caller chooses; the row says which).
///
/// The rows that were already in `open.tsv` when the ruling was made are the pre-ruling backlog,
/// tracked as a population by R1528 itself and listed in `eval/coverage-gate/grandfathered.tsv`, which
/// may only shrink. Enforced twice, on purpose: `tests/coverage_gate.rs` on every push (a row in
/// `open.tsv` that is neither grandfathered nor here fails — closing the splice route), and the weekly
/// `generate.py --diff-manifests` (a grown row without a verdict fails the job; one with a verdict does
/// not). A verdict is DATA the gate checks, not prose: a malformed kind, an unknown crate or a verdict
/// for a row that is not in `open.tsv` fails the push-time test.
/// ureq 3.4.2 (SOUNDNESS R1528, ureq lane). R1553: every `ConfigBuilder<S>` setter and `RequestScope::config`
/// reach `Env` only through `RequestBuilder::request_level_config` (request.rs:405-413), which builds
/// `Config::default()` — and so reads `HTTP_PROXY`/`ALL_PROXY` — only when the builder already holds a URL
/// error; `AgentScope`, `HttpCrateScope` and `RequestExtScope` setters are pure, and the chain's own start
/// (`ureq::get`, `Config::builder`, `Agent::new_with_defaults`) already carries the unconditional read.
/// R1554: `Either`/`Box<dyn Transport>`/`ChainedConnector` forward to the transport or connectors they wrap,
/// so the effect is the type argument's: EXECUTED `Net` over a TCP transport, and a caller-supplied in-memory
/// transport has none. R1555: the nine free verbs only build a request; the unreported effect is the `Env`
/// read in `Config::default` (Net is charged by candor-scan's scan-only builder-entry table, by design).
pub const OPEN_ENTRY_VERDICTS: &[(&str, &str, &str)] = &[
    ("ureq", "ureq::unversioned::transport::Box::await_input", "R1554:conditional"),
    ("ureq", "ureq::unversioned::transport::Box::is_open", "R1554:conditional"),
    ("ureq", "ureq::unversioned::transport::Box::transmit_output", "R1554:conditional"),
    ("ureq", "ureq::unversioned::transport::chain::ChainedConnector::connect", "R1554:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::accept", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::accept_encoding", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::allow_non_standard_methods", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::http_status_as_error", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::https_only", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::input_buffer_size", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::ip_family", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::max_idle_age", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::max_idle_connections", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::max_idle_connections_per_host", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::max_redirects", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::max_redirects_will_error", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::max_response_header_size", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::middleware", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::no_delay", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::output_buffer_size", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::proxy", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::redirect_auth_headers", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::save_redirect_history", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_await_100", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_connect", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_global", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_per_call", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_recv_body", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_recv_response", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_resolve", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_send_body", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_send_request", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::tls_config", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::user_agent", "R1553:conditional"),
    ("ureq", "ureq::unversioned::transport::chain::Either::await_input", "R1554:conditional"),
    ("ureq", "ureq::unversioned::transport::chain::Either::is_open", "R1554:conditional"),
    ("ureq", "ureq::unversioned::transport::chain::Either::transmit_output", "R1554:conditional"),
    ("ureq", "ureq::config::typestate::RequestScope::config", "R1553:conditional"),
    ("ureq", "ureq::connect", "R1555:silent"),
    ("ureq", "ureq::delete", "R1555:silent"),
    ("ureq", "ureq::get", "R1555:silent"),
    ("ureq", "ureq::head", "R1555:silent"),
    ("ureq", "ureq::options", "R1555:silent"),
    ("ureq", "ureq::patch", "R1555:silent"),
    ("ureq", "ureq::post", "R1555:silent"),
    ("ureq", "ureq::put", "R1555:silent"),
    ("ureq", "ureq::trace", "R1555:silent"),
    // chrono 0.4.45, R1557 (SOUNDNESS R1528, clock/env lane): the effect of each row below is the EFFECT OF THE
    // `TimeZone` TYPE ARGUMENT, which `classify` cannot see. `with_timezone`, `checked_{add,sub}_months`,
    // `duration_{round,round_up,trunc}` (via `Add<TimeDelta>`), `NaiveDateTime::and_local_timezone` and
    // `Parsed::to_datetime_with_timezone` end in `tz.from_utc_datetime(..)`/`from_local_datetime(..)`, so with `Utc` or
    // `FixedOffset` they are arithmetic and with `Local` they read `TZ`, `/etc/localtime` and the wall clock (the same
    // reads the `Local::offset_from_*` rules charge). EXECUTED (fx_chrono `tz_env`/`cond`): `utc.with_timezone(&Local)`
    // gave +01:00, +09:00, -04:00 for TZ unset/Asia/Tokyo/America/New_York; the same call with `&FixedOffset` ignored TZ.
    // A rule would charge every `Utc` consumer (fabrication), so the consumer stays silent: a type-argument locator.
    // tracing-subscriber 0.3.23, R1558: `Layer::on_{event,new_span,enter,exit,close}` over `Layered`, `Filtered`,
    // `Option<L>` and `fmt::Layer`, `Context::event` and `Format::format_event` forward to the layer, subscriber,
    // timer (`T: FormatTime`) or writer (`W: MakeWriter`) they wrap. EXECUTED (fx_ts `fwd`/`fmtevent`): a wrapper around
    // `fmt::layer()` printed "<timestamp>  INFO ..: ..." to stdout (Log + Clock); the same wrapper's `Option<Counter>`
    // printed nothing and read no clock; `Format<Full, ()>` (`without_time`) printed no timestamp. `Layer::on_event` is
    // also the TRAIT method every layer shares (consumer path `tracing_subscriber::Layer::on_event`), so a rule on it
    // would charge every pure layer.
    // jiff 0.2.38, R1559: `*_with(db, ..)` use the caller's `TimeZoneDatabase`, and the disk read happens where that
    // database was built (`from_env`/`from_dir`/`from_concatenated_path`/`tz::db()` carry `Fs` rules); EXECUTED, the
    // same `to_time_zone_with` call succeeded over a `from_dir` database and failed over `bundled()` (no disk).
    // `TimeZoneDatabase::bundled` reaches a `warn!` only under jiff's non-default `logging` feature AND an empty bundle.
    ("chrono", "chrono::date::Date::with_timezone", "R1557:conditional"),
    ("chrono", "chrono::datetime::DateTime::checked_add_months", "R1557:conditional"),
    ("chrono", "chrono::datetime::DateTime::checked_sub_months", "R1557:conditional"),
    ("chrono", "chrono::round::DateTime::duration_round", "R1557:conditional"),
    ("chrono", "chrono::round::DateTime::duration_round_up", "R1557:conditional"),
    ("chrono", "chrono::round::DateTime::duration_trunc", "R1557:conditional"),
    ("chrono", "chrono::datetime::DateTime::with_timezone", "R1557:conditional"),
    ("chrono", "chrono::naive::datetime::NaiveDateTime::and_local_timezone", "R1557:conditional"),
    ("chrono", "chrono::format::parsed::Parsed::to_datetime_with_timezone", "R1557:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::context::Context::event", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::filter::layer_filters::Filtered::on_close", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::filter::layer_filters::Filtered::on_enter", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::filter::layer_filters::Filtered::on_event", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::filter::layer_filters::Filtered::on_exit", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::filter::layer_filters::Filtered::on_new_span", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::fmt::format::json::Format::format_event", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::fmt::format::Format::format_event", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::fmt::format::pretty::Format::format_event", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::fmt::fmt_layer::Layer::on_close", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::fmt::fmt_layer::Layer::on_enter", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::fmt::fmt_layer::Layer::on_event", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::fmt::fmt_layer::Layer::on_exit", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::fmt::fmt_layer::Layer::on_new_span", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::layered::Layered::on_close", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::layered::Layered::on_enter", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::layered::Layered::on_event", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::layered::Layered::on_exit", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::layered::Layered::on_new_span", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::Option::on_close", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::Option::on_enter", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::Option::on_event", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::Option::on_exit", "R1558:conditional"),
    ("tracing_subscriber", "tracing_subscriber::layer::Option::on_new_span", "R1558:conditional"),
    ("jiff", "jiff::fmt::strtime::BrokenDownTime::to_zoned_with", "R1559:conditional"),
    ("jiff", "jiff::fmt::temporal::pieces::Pieces::to_time_zone_with", "R1559:conditional"),
    ("jiff", "jiff::fmt::temporal::pieces::TimeZoneAnnotation::to_time_zone_with", "R1559:conditional"),
    ("jiff", "jiff::tz::db::TimeZoneDatabase::bundled", "R1559:conditional"),
    // sea-orm 2.0.4, R1570 (SOUNDNESS R1528, sea_orm lane): the six `LoaderTrait` methods on `Vec<M>` perform a real
    // SELECT per call (query/loader.rs:337-430 forward to the `&[M]` impl, which runs `select(..).all(db)`; EXECUTED:
    // `load_one`, `load_many`, `load_self`, `load_self_many`, `load_self_via`, `load_self_via_rev` each issued a
    // `sea_orm.query_all` and returned the related rows), but a consumer's `models.load_many(Entity, db)` has a std
    // `Vec` receiver and a method that lives in an UNSCANNED dependency, so no path reaches `classify` at all (a
    // debug trace of every `sea_orm` path the scan asked about holds no `Vec::load_*`), and R1540's std-receiver
    // edge needs the method's definition in the scan or in a chained report. Measured both arms: `deny Db`,
    // `deny Log`, `deny Unknown` all exit 0 over a function whose only call is `ms.load_many(..)`; the lockless arm
    // drops the function from `functions[]`. No rule can fix it (there is no path to match), so the row stays open.
    // R1571: the six `RusqliteSharedConnection` rows are not reachable by name. In the crates.io `sea-orm` 2.0.4 the
    // `rusqlite` feature is an empty stub (`rusqlite = []`, no `sea-query-rusqlite` dependency: enabling it fails to
    // compile, EXECUTED), and in `sea-orm-sync` 2.0.4 (lib name `sea_orm`) the module is `pub(crate)`, so the type can
    // only be obtained through `match &db.inner { DatabaseConnectionType::RusqliteSharedConnection(c) => c.ping() }`.
    // EXECUTED there: `begin` held the connection (a second `acquire` timed out at the 400 ms deadline), `ping` ran
    // SELECT 1, `close`/`close_by_ref` took the open file descriptors on the database from 4 to 0 and made later calls
    // fail with `Connection closed`. The variant-payload binding has no type, so no path reaches `classify`: all six
    // functions read pure with NO row and NO `invisible` in both arms (the lock lists `sea-orm-sync`, which the
    // ceiling table does not match), so a classify rule would be dead code claiming coverage.
    ("sea_orm", "sea_orm::query::loader::Vec::load_many", "R1570:silent"),
    ("sea_orm", "sea_orm::query::loader::Vec::load_one", "R1570:silent"),
    ("sea_orm", "sea_orm::query::loader::Vec::load_self", "R1570:silent"),
    ("sea_orm", "sea_orm::query::loader::Vec::load_self_many", "R1570:silent"),
    ("sea_orm", "sea_orm::query::loader::Vec::load_self_via", "R1570:silent"),
    ("sea_orm", "sea_orm::query::loader::Vec::load_self_via_rev", "R1570:silent"),
    ("sea_orm", "sea_orm::driver::rusqlite::RusqliteSharedConnection::acquire", "R1571:silent"),
    ("sea_orm", "sea_orm::driver::rusqlite::RusqliteSharedConnection::begin", "R1571:silent"),
    ("sea_orm", "sea_orm::driver::rusqlite::RusqliteSharedConnection::close", "R1571:silent"),
    ("sea_orm", "sea_orm::driver::rusqlite::RusqliteSharedConnection::close_by_ref", "R1571:silent"),
    ("sea_orm", "sea_orm::driver::rusqlite::RusqliteSharedConnection::ping", "R1571:silent"),
    ("sea_orm", "sea_orm::driver::rusqlite::RusqliteSharedConnection::transaction", "R1571:silent"),
    // async-nats 0.50.0, R1576 (SOUNDNESS R1528, async_nats lane): `jetstream::{new, with_domain, with_prefix}` and
    // `ContextBuilder::build` share one body that opens NO connection (EXECUTED against a nats-server: zero messages,
    // zero bytes, zero subscriptions) and ends in `spawn_acker`, whose task logs `debug!("Acker task exited")` when the
    // `Context` is dropped (EXECUTED with a tracing layer). So the rows' own effect is a `Log` and a rule would be
    // true. It is not added: the engine does not type `let js = jetstream::new(c)` (a dependency's free fn has no
    // `ReturnIndex` entry), so every `js.<verb>()` after it (`query_account`, `get_stream`, `get_key_value`...) reaches
    // no classify path and its `Net` is unreported. MEASURED both arms on `let js = jetstream::new(c);
    // js.query_account().await`: no rule, `invisible:[async_nats]` (lock) / absent (lockless); with a `Log` rule,
    // `['Log']` alone and the `invisible` disclosure GONE, `deny Net` exit 0 either way. A rule would delete the one
    // accidental disclosure of a `Net` it cannot supply. The annotated spelling `let js: Context = ...` does classify.
    ("async_nats", "async_nats::jetstream::new", "R1576:silent"),
    ("async_nats", "async_nats::jetstream::with_domain", "R1576:silent"),
    ("async_nats", "async_nats::jetstream::with_prefix", "R1576:silent"),
    ("async_nats", "async_nats::jetstream::context::ContextBuilder::build", "R1576:silent"),
    // rdkafka 0.39.0, SOUNDNESS R1528 (rdkafka lane). Every row below was EXECUTED against a real Kafka broker
    // (docker `apache/kafka` behind a counting TCP proxy) and the 45 other grandfathered rows were given rules
    // (`rdkafka_r1528`).
    // R1581: `FutureProducerContext::{log, error, stats, stats_raw}` forward to the WRAPPED context
    // (producer/future_producer.rs:157-171), so the effect is the type argument's. EXECUTED with
    // `DefaultClientContext`: the `log` callback re-emits librdkafka's records through the `log` crate (hundreds of
    // `Log` events across a `FutureProducer`'s life); a caller-supplied context that records nothing has none.
    // R1582: the rows whose ONLY effect is the `trace!("Destroying {}: {:?}", ..)` / `trace!("Destroyed ..")` pair
    // that `NativePtr::drop` (util.rs:331-335) emits when a librdkafka handle is dropped. EXECUTED with a Trace-level
    // `log` logger: two `rdkafka`-target records per dropped `TopicPartitionList`, `OwnedHeaders`, `OwnedMessage`
    // detach and so on, and ZERO bytes through the broker proxy on a quiet client for every one of them
    // (`assignment`, `subscription`, `position`, `incremental_unassign` and `begin_transaction` are local state;
    // `TopicPartitionList::{new, with_capacity, from_topic_map}`, `OwnedHeaders::{new, new_with_capacity}`,
    // `{Borrowed,}Headers::detach`, `BorrowedMessage::detach` and `ClientConfig::create_native_config` build or copy
    // a value). The `Log` is real, Trace-level, and lands at the DROP, wherever the value dies — a per-constructor
    // rule cannot say that, and charging only these rows would leave every other handle type (`BorrowedMessage`,
    // `Metadata`, `NativeClientConfig`, the `Err` path of `RDKafkaError`) silent on the same trace. So it is filed,
    // not ruled: a consumer's `deny Log` is not told. Severity floor: Trace level, no I/O.
    // R1583: `BaseConsumer::close_queue` only ENQUEUES the termination (EXECUTED on a live group member: 0 bytes up
    // from the call, 76 down; the LeaveGroup and heartbeat go out during the `poll` that serves the queue, 120 bytes
    // up in the next three seconds). The wire effect belongs to the serving `poll` (already `Net`) or to the
    // consumer's drop, not to this call.
    ("rdkafka", "rdkafka::consumer::base_consumer::BaseConsumer::assignment", "R1582:silent"),
    ("rdkafka", "rdkafka::consumer::base_consumer::BaseConsumer::close_queue", "R1583:conditional"),
    ("rdkafka", "rdkafka::consumer::base_consumer::BaseConsumer::incremental_unassign", "R1582:silent"),
    ("rdkafka", "rdkafka::consumer::base_consumer::BaseConsumer::position", "R1582:silent"),
    ("rdkafka", "rdkafka::consumer::base_consumer::BaseConsumer::subscription", "R1582:silent"),
    ("rdkafka", "rdkafka::producer::base_producer::BaseProducer::begin_transaction", "R1582:silent"),
    ("rdkafka", "rdkafka::message::BorrowedHeaders::detach", "R1582:silent"),
    ("rdkafka", "rdkafka::message::BorrowedMessage::detach", "R1582:silent"),
    ("rdkafka", "rdkafka::config::ClientConfig::create_native_config", "R1582:silent"),
    ("rdkafka", "rdkafka::producer::future_producer::FutureProducer::begin_transaction", "R1582:silent"),
    ("rdkafka", "rdkafka::producer::future_producer::FutureProducerContext::error", "R1581:conditional"),
    ("rdkafka", "rdkafka::producer::future_producer::FutureProducerContext::log", "R1581:conditional"),
    ("rdkafka", "rdkafka::producer::future_producer::FutureProducerContext::stats", "R1581:conditional"),
    ("rdkafka", "rdkafka::producer::future_producer::FutureProducerContext::stats_raw", "R1581:conditional"),
    ("rdkafka", "rdkafka::message::OwnedHeaders::new", "R1582:silent"),
    ("rdkafka", "rdkafka::message::OwnedHeaders::new_with_capacity", "R1582:silent"),
    ("rdkafka", "rdkafka::consumer::stream_consumer::StreamConsumer::assignment", "R1582:silent"),
    ("rdkafka", "rdkafka::consumer::stream_consumer::StreamConsumer::incremental_unassign", "R1582:silent"),
    ("rdkafka", "rdkafka::consumer::stream_consumer::StreamConsumer::position", "R1582:silent"),
    ("rdkafka", "rdkafka::consumer::stream_consumer::StreamConsumer::subscription", "R1582:silent"),
    ("rdkafka", "rdkafka::producer::base_producer::ThreadedProducer::begin_transaction", "R1582:silent"),
    ("rdkafka", "rdkafka::topic_partition_list::TopicPartitionList::from_topic_map", "R1582:silent"),
    ("rdkafka", "rdkafka::topic_partition_list::TopicPartitionList::new", "R1582:silent"),
    ("rdkafka", "rdkafka::topic_partition_list::TopicPartitionList::with_capacity", "R1582:silent"),
    // mongodb 3.9.1 and mysql_async 0.37.1, SOUNDNESS R1528 (dbs lane). 68 other rows of the two crates were given
    // rules (`mongodb_r1528`, `mysql_async_r1528`), five were read and found pure (`REVIEWED_PURE_ENTRIES`).
    // R1584: `conditional` on a setting the caller chooses. `AuthMechanism::validate_credential` (and
    // `ConnectionString::parse`, which calls it) only reaches an output when the `aws-auth` feature is on AND the
    // mechanism is MONGODB-AWS AND the URI carries credentials (client/auth.rs:195-210: `log_warning!`, which is
    // `log::warn!` under the `log` feature and a debug-build `eprintln!` otherwise); with default features both are
    // pure. `ParseConnectionString::execute` (`ClientOptions::parse(..).await`) does the SRV and TXT DNS lookups ONLY
    // for a `mongodb+srv` scheme (client/options/parse.rs:33-35). EXECUTED: `mongodb://` parses in 0.5 ms and
    // `mongodb+srv://nonexistent-cluster.invalid` fails with `DNS error: no records found for Query { name:
    // "_mongodb._tcp.nonexistent-cluster.invalid.", query_type: SRV }`. Not charged `Net`: every `mongodb` consumer calls
    // it, so a rule would fabricate `Net` for every plain URI.
    ("mongodb", "mongodb::client::auth::AuthMechanism::validate_credential", "R1584:conditional"),
    ("mongodb", "mongodb::client::options::ConnectionString::parse", "R1584:conditional"),
    ("mongodb", "mongodb::client::options::parse::ParseConnectionString::execute", "R1584:conditional"),
    // R1585: the client-side field-level encryption surface exists only under the `in-use-encryption` feature, which
    // links libmongocrypt (`mongocrypt-sys` build.rs: `rustc-link-lib=dylib=mongocrypt`, no copy bundled; absent
    // here), so none of these five could be EXECUTED. Read: `EncryptedClientBuilder::build` is
    // `Client::with_options` plus `init_csfle` ("May perform DNS lookups and/or spawn mongocryptd", its own doc);
    // `CreateDataKey::execute` / `Encrypt::execute` are the macro inputs whose creators `ClientEncryption::
    // {create_data_key, encrypt}` run the same `run_ctx` state machine as the already-`Net` `decrypt`;
    // `ClientEncryption::new` / `ClientEncryptionBuilder::build` look pure but call `Crypt::builder().build()` (an FFI
    // object) and build a rayon pool sized by `num_cpus::get()` (cgroup reads on Linux). Filed `silent`, rule pending an
    // executed fixture, rather than claimed pure from a read that stops at an FFI boundary.
    ("mongodb", "mongodb::client::csfle::client_encryption::ClientEncryption::new", "R1585:silent"),
    ("mongodb", "mongodb::client::csfle::client_encryption::ClientEncryptionBuilder::build", "R1585:silent"),
    ("mongodb", "mongodb::client::csfle::client_encryption::create_data_key::CreateDataKey::execute", "R1585:silent"),
    ("mongodb", "mongodb::client::csfle::client_encryption::encrypt::Encrypt::execute", "R1585:silent"),
    ("mongodb", "mongodb::client::csfle::client_builder::EncryptedClientBuilder::build", "R1585:silent"),
    // R1586: no spelling of the row can reach `classify`, so no rule can fire and a rule here would only hide the gap.
    // `PathOrBuf::read` (opts/mod.rs:153) is `tokio::fs::read` of a `Path` variant. EXECUTED: the same call returns
    // the file's bytes for an existing path and `No such file or directory (os error 2)` for a missing one. The type
    // is not nameable (`mysql_async::PathOrBuf` does not resolve, E0425) and is reached only as a value out of
    // `SslOpts::root_certs()`, whose return the scan does not type (the trace shows `SslOpts::root_certs`,
    // `SslOpts::first`, and nothing for `read`), so every consumer is silent on a real file read.
    ("mysql_async", "mysql_async::opts::PathOrBuf::read", "R1586:silent"),
    // R1586, second half: `QueryResult::map` is a real `Db` (EXECUTED: 29.6 MB read) but the bare name is also what the
    // scan attributes to every `.map(..)` chained off a `QueryResult` accessor (`r.columns().map(..)` is `Option::map`
    // and traces as `mysql_async::QueryResult::map`), so a rule would fabricate `Db` on a pure idiom. Filed, not ruled.
    ("mysql_async", "mysql_async::queryable::query_result::QueryResult::map", "R1586:silent"),
    // aws-config 1.12.0, R1588. `RegionProviderChain::region` and `Box<dyn ProvideRegion>::region` forward to whichever
    // providers the chain holds: EXECUTED, `RegionProviderChain::default_provider().region()` read the AWS_* variables and
    // both profile files and (no region configured) asked the IMDS mock, while `first_try(Region::new(..)).region()` and a
    // boxed `Region` read nothing. A rule would charge the literal-only chain; the default chain's effect is the chain
    // BUILDER's, which is not a row.
    ("aws_config", "aws_config::meta::region::Box::region", "R1588:conditional"),
    ("aws_config", "aws_config::meta::region::RegionProviderChain::region", "R1588:conditional"),
    // R1588, second half: `profile::{credentials, token}::Builder::build` only CONSTRUCT a provider (credentials: a
    // `tracing::debug_span!` and one `AWS_EXECUTION_ENV` read, EXECUTED; token: nothing). The profile files, IMDS and ECS
    // are touched by the later `provide_credentials` / `provide_token`, which carries no rule. A `Log` or `Env` rule here
    // would delete, above the 1.12.0 ceiling, the `invisible:[aws_config]` that is today's only disclosure of that I/O.
    ("aws_config", "aws_config::profile::credentials::Builder::build", "R1588:silent"),
    ("aws_config", "aws_config::profile::token::Builder::build", "R1588:silent"),
    // sqlx-core 0.9.0, R1589. `connect_lazy{,_with}` open nothing, EXECUTED in five spellings (0 connections, 0 bytes in a
    // held two-second window) EXCEPT `min_connections(1)` with `idle_timeout(None).max_lifetime(None)`, where the spawned
    // maintenance task opened 1 connection and sent 411 bytes (pool/inner.rs:517-524). A rule would charge every lazy pool.
    ("sqlx_core", "sqlx_core::pool::Pool::connect_lazy", "R1589:conditional"),
    ("sqlx_core", "sqlx_core::pool::Pool::connect_lazy_with", "R1589:conditional"),
    ("sqlx_core", "sqlx_core::pool::options::PoolOptions::connect_lazy", "R1589:conditional"),
    ("sqlx_core", "sqlx_core::pool::options::PoolOptions::connect_lazy_with", "R1589:conditional"),
    // R1589, second half: the `Box<S: Socket>` forwarders are the socket type's own effect (a TcpStream polls a real
    // descriptor, a caller's in-memory socket does not). The consumer spelling is the trait path `Socket::poll_*`.
    ("sqlx_core", "sqlx_core::net::socket::Box::poll_flush", "R1589:conditional"),
    ("sqlx_core", "sqlx_core::net::socket::Box::poll_read_ready", "R1589:conditional"),
    ("sqlx_core", "sqlx_core::net::socket::Box::poll_shutdown", "R1589:conditional"),
    ("sqlx_core", "sqlx_core::net::socket::Box::poll_write_ready", "R1589:conditional"),
    // R1589, third half: `MigrationSource::resolve` for `PathBuf` and `ResolveWith` reads the migrations directory
    // (EXECUTED: 1 then 2 migrations as a file is added) but NO spelling reaches it: `p.resolve()` on a `std::path::PathBuf`
    // receiver and on a `ResolveWith(..)` tuple-struct value (also as a typed parameter) produce no callee path at all.
    // `Migrator::new` is the consumer-facing verb and is charged `Fs`.
    ("sqlx_core", "sqlx_core::migrate::source::PathBuf::resolve", "R1589:silent"),
    ("sqlx_core", "sqlx_core::migrate::source::ResolveWith::resolve", "R1589:silent"),
    // redis 1.7.1, R1590. `MultiplexedConnection::{new, new_with_config}` write the handshake to the caller-supplied
    // STREAM: EXECUTED 110 bytes through a TCP proxy to a real server, and the same 110 bytes into an in-memory `duplex`
    // peer with no server at all. The effect is the stream type's.
    ("redis", "redis::aio::multiplexed_connection::MultiplexedConnection::new", "R1590:conditional"),
    ("redis", "redis::aio::multiplexed_connection::MultiplexedConnection::new_with_config", "R1590:conditional"),
    // R1590, second half: `EntraIdCredentialsProvider::start` spawns a refresh loop over the caller's
    // `Arc<dyn TokenCredential>` (entra_id.rs:387-432); what it does is that credential's. READ only: no Azure to run it
    // against (weaker than the rows above).
    ("redis", "redis::entra_id::EntraIdCredentialsProvider::start", "R1590:conditional"),
    // R1590, third half: the three Sentinel `build`s draw a random replica index (`rand::rng().random_range`; EXECUTED, 1-2
    // OS entropy reads on a fresh thread). A `Rand` rule was written and REMOVED: `let mut s = Sentinel::build(u)?;
    // s.master_for(..)` (and `SentinelClient::build(..)?` then `get_connection()`) leaves `s` untyped, so with the rule the
    // lock arm reported `['Rand']` and nothing for the `Db` that follows, where before it reported `invisible:[redis]`.
    ("redis", "redis::sentinel::Sentinel::build", "R1590:silent"),
    ("redis", "redis::sentinel::SentinelClient::build", "R1590:silent"),
    ("redis", "redis::sentinel::SentinelClientBuilder::build", "R1590:silent"),
    // isahc 2.0.1, R1592. `CookieJar::{get_by_name, get_for_uri, set}` read the clock (`Cookie::is_expired`, cookies/cookie.rs:273)
    // only for a cookie that carries an `expiration`: EXECUTED 1 `clock_gettime` between start and end markers with an
    // expiring cookie, 0 with an empty jar and 0 with a session cookie, for all three. A `Clock` rule would charge two of the
    // three shapes of jar the caller can hold. `Response::text` blocks on the response BODY: EXECUTED returning the tail the
    // server sent 1.5 s after the headers (sync and async), and reading nothing from a response built in memory; the request
    // that produced the response is charged where it is sent.
    ("isahc", "isahc::cookies::jar::CookieJar::get_by_name", "R1592:conditional"),
    ("isahc", "isahc::cookies::jar::CookieJar::get_for_uri", "R1592:conditional"),
    ("isahc", "isahc::cookies::jar::CookieJar::set", "R1592:conditional"),
    ("isahc", "isahc::response::Response::text", "R1592:conditional"),
    // lettre 0.11.23, R1592. `SmtpTransportBuilder::build` and `AsyncSmtpTransportBuilder::build` spawn the pool's maintenance
    // thread / task, which connects only when the caller asked for `PoolConfig::min_idle(n > 0)`: EXECUTED 0 connections and 0
    // bytes by default, and 1 connection with 23 bytes up (the EHLO) with `min_idle(1)`, sync and async. `Auth::new_from_response`
    // emits two `debug!` records (the encoded and the decoded SASL challenge) only when lettre's `tracing` feature is on, which
    // is off by default: EXECUTED with the feature and a subscriber, 2 records.
    ("lettre", "lettre::transport::smtp::transport::SmtpTransportBuilder::build", "R1592:conditional"),
    ("lettre", "lettre::transport::smtp::async_transport::AsyncSmtpTransportBuilder::build", "R1592:conditional"),
    ("lettre", "lettre::transport::smtp::commands::Auth::new_from_response", "R1592:conditional"),
    // lapin 4.12.0, R1593. `Connection::connector` runs a CALLER-SUPPLIED connect closure: EXECUTED 1 connection with a closure that
    // dials the broker, 0 bytes with one that returns an error. `Connection::run` is `drop(self)` then a join on the IO loop:
    // EXECUTED 0 bytes while another handle (a channel) is alive, but 21 up / 12 down when `self` is the LAST handle, because the
    // drop closes the connection. `Consumer::set_delegate` runs the caller's delegate on every queued delivery (EXECUTED: it
    // ran, twice) and moves no byte of its own.
    ("lapin", "lapin::connection::Connection::connector", "R1593:conditional"),
    ("lapin", "lapin::connection::Connection::run", "R1593:conditional"),
    ("lapin", "lapin::consumer::Consumer::set_delegate", "R1593:conditional"),
    // tonic 0.14.6, R1594. `serve_with_incoming{,_shutdown}` (Server and Router) serve whatever stream they are handed: EXECUTED
    // over a `TcpIncoming` a client connected and got a reply, and over an in-memory `duplex` stream the request was served with no
    // `bind`, `listen` or `connect` logged. `Endpoint::tls_config{,_with_verifier}` read `SSL_CERT_FILE` / `SSL_CERT_DIR` and open the
    // root store only for `ClientTlsConfig::with_native_roots()` (EXECUTED: the bundle was opened with it and not with
    // `with_webpki_roots()` or a bare config), and read `SSLKEYLOGFILE` and open that file for `use_key_log()` (EXECUTED through
    // `tls_config_with_verifier`; native roots with a verifier is an error before any read). `Code::from_bytes` and
    // `Status::from_header_map` log only on malformed input (EXECUTED: 0 records for `"0"` / a valid header map, 1 `trace!` and
    // 1 `warn!` for the malformed ones). `Streaming::{message, trailers}` read the body they were given: EXECUTED `message` returned
    // a status the server pushed 1.75 s later and `trailers` was still waiting on a live stream after 1.2 s.
    ("tonic", "tonic::codec::decode::Streaming::message", "R1594:conditional"),
    ("tonic", "tonic::codec::decode::Streaming::trailers", "R1594:conditional"),
    ("tonic", "tonic::status::Code::from_bytes", "R1594:conditional"),
    ("tonic", "tonic::status::Status::from_header_map", "R1594:conditional"),
    ("tonic", "tonic::transport::channel::endpoint::Endpoint::tls_config", "R1594:conditional"),
    ("tonic", "tonic::transport::channel::endpoint::Endpoint::tls_config_with_verifier", "R1594:conditional"),
    ("tonic", "tonic::transport::server::Router::serve_with_incoming", "R1594:conditional"),
    ("tonic", "tonic::transport::server::Router::serve_with_incoming_shutdown", "R1594:conditional"),
    ("tonic", "tonic::transport::server::Server::serve_with_incoming", "R1594:conditional"),
    ("tonic", "tonic::transport::server::Server::serve_with_incoming_shutdown", "R1594:conditional"),
    // tempfile 3.27.0 and crossterm 0.29.0, R1595. `TempPath::{from_path, try_from_path}` call `std::env::current_dir()` only for a
    // RELATIVE path (EXECUTED: 1 `getcwd` for `rel/x`, 0 for an absolute path and for the empty path) and open nothing.
    // `Print::write_ansi` and `SetTitle::write_ansi` write the caller's `T: Display` into the caller's writer: EXECUTED 0 events for
    // `&str`, and 1 `NO_COLOR` read for `Print(Colored::..)`, so the effect is the type argument's. `SetTitle::execute_winapi` (a
    // console-title call) and `ansi_support::supports_ansi` (console VT mode, then `TERM` only when that fails) are `cfg(windows)`:
    // real, READ only, no host to execute them on, so no rule.
    ("tempfile", "tempfile::file::TempPath::from_path", "R1595:conditional"),
    ("tempfile", "tempfile::file::TempPath::try_from_path", "R1595:conditional"),
    // `TempDir::keep` and its deprecated `into_path` (R1595:overcharge, the scan oracle fabricates): the self-scan reads `Fs` because the
    // consumed `self` drops at the end of the body and `TempDir`'s `Drop` removes the directory — but `keep` has just set
    // `disable_cleanup`, so nothing is removed (EXECUTED: 0 `unlink`, 0 `mkdir`, 0 `open`, 0 `getenv` for both). Carved out of the `::keep`
    // suffix rule for the same reason; that rule had charged `TempDir::keep` `Fs` since the sweep that wrote it.
    ("tempfile", "tempfile::dir::TempDir::keep", "R1595:overcharge"),
    ("tempfile", "tempfile::dir::TempDir::into_path", "R1595:overcharge"),
    ("crossterm", "crossterm::style::Print::write_ansi", "R1595:conditional"),
    ("crossterm", "crossterm::terminal::SetTitle::write_ansi", "R1595:conditional"),
    ("crossterm", "crossterm::terminal::SetTitle::execute_winapi", "R1595:silent"),
    ("crossterm", "crossterm::ansi_support::supports_ansi", "R1595:silent"),
    // The last nine rows of the R1528 backlog (b11, R1598), every one `conditional`, each with an EXECUTED arm on each side.
    // deadpool-postgres 0.14.2 `Config::{get_pg_config, builder, create_pool}` read `USER` ONLY when neither the config's `user` nor
    // the url's names one (EXECUTED 1 `getenv USER` with no user, 0 with `user` set, 0 with a url that carries one, 1 with a url that
    // does not); they open no connection (the pool is lazy: 0 connections). A rule would charge every configured pool.
    ("deadpool_postgres", "deadpool_postgres::config::Config::get_pg_config", "R1598:conditional"),
    ("deadpool_postgres", "deadpool_postgres::config::Config::builder", "R1598:conditional"),
    ("deadpool_postgres", "deadpool_postgres::config::Config::create_pool", "R1598:conditional"),
    // grep-cli 0.1.12. `resolve_binary` and the default-command resolution inside `DecompressionMatcher::new` and
    // `DecompressionMatcherBuilder::build` search `PATH` and `stat` each directory only under `cfg!(windows)` (EXECUTED on macOS: 0
    // events for all three; `try_associate`/`associate`, which call the unconditional resolver, ARE charged `Env`). `build` was
    // charged `Exec` by the `::build` suffix rule meant for `CommandReaderBuilder::build` and spawns nothing (EXECUTED 0
    // fork/spawn/exec), so it is carved out of it and left here. `is_readable_stdin` is an `fstat` on stdin (EXECUTED: `isatty` and
    // one `ioctl`, no read) plus `log::debug!` records that emit only under a debug-level logger.
    ("grep_cli", "grep_cli::decompress::DecompressionMatcher::new", "R1598:conditional"),
    ("grep_cli", "grep_cli::decompress::DecompressionMatcherBuilder::build", "R1598:conditional"),
    ("grep_cli", "grep_cli::decompress::resolve_binary", "R1598:conditional"),
    ("grep_cli", "grep_cli::is_readable_stdin", "R1598:conditional"),
    // rand 0.10.3 `Fill::fill_slice` draws from the caller's `R` (EXECUTED: 0 entropy reads for a seeded `StdRng`, 1 for the thread
    // RNG). tokio-postgres 0.7.18 `Connection::poll_message` drives the caller's stream `S` (EXECUTED: 65 bytes up / 92 down over TCP
    // with a query in flight, 0 with nothing in flight, 0 over an in-memory `duplex` whose server never opens a socket).
    ("rand", "rand::rng::u8::fill_slice", "R1598:conditional"),
    ("tokio_postgres", "tokio_postgres::connection::Connection::poll_message", "R1598:conditional"),
    // SOUNDNESS R1528 — the 2026-11-11 weekly refresh (64 grown rows on main aacd3880; 58 at 7e8870b, reproduced exactly on macOS, so
    // the checked-in-macOS / CI-Linux split (R212) explains none). 30 got classify rules (postgres sync, sqlx Migrator, redis PubSub,
    // mongodb Aggregate, async-nats unpin_consumer, sea-orm accepts, tracing-subscriber OffsetTime); the 34 below hold a verdict.
    //
    // R1693 (conditional x16): chrono 0.4.45 `Date<Tz>::{and_time, and_hms*}` and `DateTime<Tz>::{checked_add/sub_days,
    // checked_add/sub_signed, with_time}` forward to `TimeZone::from_local_datetime`, so the effect is the caller's `Tz`: EXECUTED
    // (macOS interposer, TZ unset, offsets built without reading the zone) `Local` = getenv(TZ) + lstat/open(/etc/localtime) + 1
    // clock read for and_hms_opt, and_time, checked_add_days, checked_add_signed, with_time (and `Local::from_utc_datetime`), `Utc` =
    // 0 events on the same five; the other seven spellings share those bodies and are READ. diesel 2.3.14 `DateTime::from_sql` is the
    // same fact one hop out: the key merges the `DateTime<Utc>` impl (`Utc.from_utc_datetime`, pure) with the `DateTime<Local>` one
    // (`Local::from_utc_datetime`, the executed read) — READ, not executed.
    ("chrono", "chrono::date::Date::and_hms", "R1693:conditional"),
    ("chrono", "chrono::date::Date::and_hms_micro", "R1693:conditional"),
    ("chrono", "chrono::date::Date::and_hms_micro_opt", "R1693:conditional"),
    ("chrono", "chrono::date::Date::and_hms_milli", "R1693:conditional"),
    ("chrono", "chrono::date::Date::and_hms_milli_opt", "R1693:conditional"),
    ("chrono", "chrono::date::Date::and_hms_nano", "R1693:conditional"),
    ("chrono", "chrono::date::Date::and_hms_nano_opt", "R1693:conditional"),
    ("chrono", "chrono::date::Date::and_hms_opt", "R1693:conditional"),
    ("chrono", "chrono::date::Date::and_time", "R1693:conditional"),
    ("chrono", "chrono::datetime::DateTime::checked_add_days", "R1693:conditional"),
    ("chrono", "chrono::datetime::DateTime::checked_add_signed", "R1693:conditional"),
    ("chrono", "chrono::datetime::DateTime::checked_sub_days", "R1693:conditional"),
    ("chrono", "chrono::datetime::DateTime::checked_sub_signed", "R1693:conditional"),
    ("chrono", "chrono::datetime::DateTime::with_time", "R1693:conditional"),
    ("diesel", "diesel::pg::types::date_and_time::chrono::DateTime::from_sql", "R1693:conditional"),
    ("diesel", "diesel::sqlite::types::date_and_time::chrono::DateTime::from_sql", "R1693:conditional"),
    // R1694 (overcharge x4): the self-scan fabricates the effect on a body that reads none. (a) chrono `NaiveDateTime::
    // {parse_from_str, parse_and_remainder}` and `Parsed::to_naive_datetime_with_offset` are arithmetic on `NaiveDate`/`NaiveDateTime`/
    // `Parsed`, but `date.and_time(t)` / `datetime.hour()` on those receivers are resolved to the `Date<Tz>` / `DateTime<Tz>`
    // generic impls and so inherit the `Local` arm of R1693 (EXECUTED: all three 0 events). (b) ureq 3.5.1 `Config::new_agent` is
    // `self.clone().into()` -> `Agent::new_with_config`, already `REVIEWED_PURE_ENTRIES`; the scan charges the pool's connector
    // CLOSURE (built, never called) at its creator (EXECUTED: 0 connect, 0 getenv in the window).
    ("chrono", "chrono::format::parsed::Parsed::to_naive_datetime_with_offset", "R1694:overcharge"),
    ("chrono", "chrono::naive::datetime::NaiveDateTime::parse_and_remainder", "R1694:overcharge"),
    ("chrono", "chrono::naive::datetime::NaiveDateTime::parse_from_str", "R1694:overcharge"),
    ("ureq", "ureq::config::Config::new_agent", "R1694:overcharge"),
    // R1695 (conditional x11): ureq 3.5.1 `Body`/`BodyWithConfig` readers and `Body::as_body` take their effect from where the body
    // came from — a connection (`BodyDataSource::Handler`: the read blocks on the socket, EXECUTED 810 ms against a server that
    // withholds the tail 0.8 s; the Net is charged at `.call()`) or memory (`Body::builder().data(..)`, 0 ms, EXECUTED); the oracle's
    // `Log` is a `debug!` on gzip/brotli/charset/unknown-encoding only. `DefaultResolver::host_and_port` is a `format!`; its `Log`
    // is `Scheme::default_port`'s `debug!("Unknown scheme")`, emitted only for a non-http(s)/proxy scheme under a debug logger.
    ("ureq", "ureq::body::Body::as_reader", "R1695:conditional"),
    ("ureq", "ureq::body::Body::into_reader", "R1695:conditional"),
    ("ureq", "ureq::body::Body::read_json", "R1695:conditional"),
    ("ureq", "ureq::body::Body::read_to_string", "R1695:conditional"),
    ("ureq", "ureq::body::Body::read_to_vec", "R1695:conditional"),
    ("ureq", "ureq::body::BodyWithConfig::read_json", "R1695:conditional"),
    ("ureq", "ureq::body::BodyWithConfig::read_to_string", "R1695:conditional"),
    ("ureq", "ureq::body::BodyWithConfig::read_to_vec", "R1695:conditional"),
    ("ureq", "ureq::body::BodyWithConfig::reader", "R1695:conditional"),
    ("ureq", "ureq::send_body::Body::as_body", "R1695:conditional"),
    ("ureq", "ureq::unversioned::resolver::DefaultResolver::host_and_port", "R1695:conditional"),
    // R1553 (+2): `ConfigBuilder::timeout_per_read` / `timeout_per_write`, setters new in ureq 3.5.x and the same shape as the 30 above.
    ("ureq", "ureq::config::ConfigBuilder::timeout_per_read", "R1553:conditional"),
    ("ureq", "ureq::config::ConfigBuilder::timeout_per_write", "R1553:conditional"),
    // R1696 (conditional x1): ureq 3.5.1 `TcpStream::shutdown` is `shutdown(2)` on the socket, but `mod tcp;` is private and the type
    // has no re-export, so no consumer spelling reaches it; the one consumer route is `Agent::shutdown`, which the scan marks
    // `Unknown` alone (a `dyn ShutdownHandle`) and which now carries a `Net` rule (EXECUTED: a worker blocked in a body read ended at
    // 260 ms with an error after `agent.shutdown()`, ran 811 ms to success without it).
    ("ureq", "ureq::unversioned::transport::tcp::TcpStream::shutdown", "R1696:conditional"),
    // R1732 (overcharge x3): reqwest 0.13.5 blocking `Part::text`, `Part::bytes` and `Form::text` build an in-memory `Bytes` body
    // (`Body::from(&'static str | String | &'static [u8] | Vec<u8>)`, then `Part::new`): no `std::fs` anywhere in the three bodies.
    // The `Fs` is blocking `Body`'s SIX `From<_> for Body` impls sharing one key, one of which (`From<File>`, `f.metadata()`)
    // reads the file; `Part::text`'s `Body::from(..)` call used to be disclosed `ambiguous:same-name local defs` and R1657
    // stage 2's re-export table now resolves it to the merged unit (`CANDOR_R1657S2_OFF` turns the `Fs` off). `Part::file` /
    // `Form::file`, which really open a path, keep their rule.
    ("reqwest", "reqwest::blocking::multipart::Form::text", "R1732:overcharge"),
    ("reqwest", "reqwest::blocking::multipart::Part::bytes", "R1732:overcharge"),
    ("reqwest", "reqwest::blocking::multipart::Part::text", "R1732:overcharge"),
    // R1733 (conditional x1): rustls 0.23.46 `Accepted::into_connection` runs the ClientHello handshake step, which calls
    // `config.key_log.log(..)` (`dyn KeyLog`): with `ServerConfig::key_log = Arc::new(KeyLogFile::new())` and `SSLKEYLOGFILE` set it
    // APPENDS to that file (EXECUTED: 5 lines written), with the default `NoKeyLog` nothing is touched (EXECUTED: no file). The
    // report's `Fs` is the `dyn KeyLog` union (`KeyLogFile::log` is the one visible implementor that writes), surfaced when R1657
    // stage 2 resolved `with_certified_key`'s `handle_client_hello` calls that were `ambiguous:same-name local methods`.
    ("rustls", "rustls::server::server_conn::Accepted::into_connection", "R1733:conditional"),
    // R1734 (overcharge x1): redis 1.8.1 `ClusterClient::new` is `Self::builder(nodes).build()`; `ClusterClientBuilder::build` is a
    // `REVIEWED_PURE_ENTRIES` read (PEM bytes the caller supplied, nothing opened). The scan dropped the `.build()` edge on a
    // `Self::builder(..)` receiver until R1717's builder typing (`CANDOR_R1717_OFF` makes the row vanish), so the wrapper now inherits the
    // `Fs` the `pem` vocabulary puts on `ClusterParams::from` -> `retrieve_tls_certificates`. The edge is real; the effect is not.
    ("redis", "redis::cluster_handling::client::ClusterClient::new", "R1734:overcharge"),
];

/// Representative path tails (each appended to a crate name) that the `calibrated_crates_are_live`
/// liveness test probes: at least one must match for every `CALIBRATED_CRATES` entry, else the entry is
/// dead. Exported as ONE source of truth because the nightly lint crate (`src/lib.rs`) runs the SAME
/// liveness test — when the two probe lists were duplicated they drifted, and a rule keyed on a
/// distinctive tail (pnet `::datalink::channel`, ignore `::WalkBuilder::build_parallel`, notify
/// `::RecommendedWatcher::new`) added to only one list silently broke the other crate's `cargo test`.
pub const CALIBRATION_PROBE_TAILS: &[&str] = &[
    "::X::send", "::X::execute", "::X::call", "::X::query", "::X::fetch_one", "::Remote::fetch",
    "::datalink::channel", "::WalkBuilder::build_parallel", "::RecommendedWatcher::new",
    "::X::connect", "::Utc::now", "::X::load", "::__private_api::log", "::tempfile", "::glob",
    "::X::run", "::dotenv", "::random", "::emit", "::X::emit_span_lint", "::X::anything",
    "::X::draw",
    "::SaltString::generate", "::hash", "::OsRng::fill_bytes",
    // verb-precise crates whose whole-crate rules were narrowed to the effectful surface (the pure
    // accessors/ctors/data-types now return None), so the liveness probe must name an EFFECTFUL path:
    "::Mmap::map", "::event", "::u32", "::Clipboard::get_text", "::spawn_command",
    // coverage-differential crates (each needs ≥1 effectful tail; existing tails already cover
    // native_tls_crate/tokio_native_tls/sqlx_core via ::X::connect, execute via ::X::execute, jiff via ::now):
    "::read_tls", "::home_dir", "::args", "::from_env", "::IntoIter::next", "::set_file_mtime",
    "::surely_conflicts_with", "::set_handler", "::get_matches", "::init", "::interact",
    "::write_line", "::background_color", "::retry", "::build",
];

/// Database client crates whose execution verbs are I/O (see the DB branch in `classify`).
/// Module-level so `db_crates_are_calibrated` can enforce `DB_CRATES ⊆ CALIBRATED_CRATES`.
pub const DB_CRATES: [&str; 11] = [
    "sqlx", "rusqlite", "postgres", "tokio_postgres", "diesel", "redis", "mongodb",
    "mysql", "mysql_async", "sea_orm", "deadpool_postgres",
];

/// Pure file-descriptor *ownership-transfer* leaves. These ADOPT an already-open descriptor
/// (`from_raw_fd`/`from_raw_socket`/`from_raw_handle`), EXTRACT/BORROW one
/// (`into_raw_fd`/`into_raw_socket`/`into_raw_handle`, `as_raw_fd`/`as_raw_socket`/`as_raw_handle`),
/// or UNWRAP an async wrapper back to its std type (`into_std`) — none of them issue a syscall or
/// perform I/O. calling a PURE function effectful is a FABRICATION — the precision failure (candor's cardinal sin is the opposite direction, the silent under-report) — and these collide with the
/// coarse std-type PREFIX rules (`std::net::TcpStream`/`std::fs::File`/`std::os::unix::net` → Net/Fs/Ipc)
/// even though the descriptor was opened ELSEWHERE. The portable_pty/async_process Exec rule already
/// exempts `from_raw_fd`; this generalises the same carve-out across the net/fs/ipc prefix rules.
/// (Found by a real-world sweep of tokio: `TcpStream::into_std`, `*::from_raw_fd`, `*::as_raw_fd` all
/// fabricated Net/Fs/Ipc.)
const PURE_FD_TRANSFER: &[&str] = &[
    "from_raw_fd", "from_raw_socket", "from_raw_handle",
    "into_raw_fd", "into_raw_socket", "into_raw_handle",
    "as_raw_fd", "as_raw_socket", "as_raw_handle",
    "into_std",
    // `SocketAddr::from_pathname` (std/async-std unix net) builds an address STRUCT from a path —
    // it opens no socket. The `std::os::unix::net` prefix rule below would otherwise fabricate Ipc
    // on it. (Found sweeping socket2: `SockAddr::as_unix` → `from_pathname` reported Ipc.)
    "from_pathname",
];

/// The std I/O **handle** types whose methods the scanner's receiver inference may route into
/// `classify` as `Type::method`.
///
/// WHY A LIST AND NOT "std". The std rules in `classify` are a MIXTURE: a few are type-precise with
/// reviewed pure-accessor carve-outs (`std::net::TcpStream` → Net minus `local_addr`/`peer_addr`/…;
/// `std::process::Command` → Exec minus `get_program`/`get_args`/…), but most are coarse MODULE
/// prefixes (`std::fs::` → Fs) written for free functions and constructors. Applied to arbitrary
/// method calls, a coarse prefix charges an effect for reading a struct field: `std::fs::Metadata`,
/// `DirEntry`, `Permissions` and `FileType` all sit under `std::fs::` and are pure DATA. So the
/// scanner used to skip EVERY std-rooted receiver — which shut the door on the pure data types and on
/// the real handles alike, and `fn run(cmd: &mut Command) { cmd.spawn(); }` certified PURE while it
/// spawned a process (a silent false all-clear; the `cc` crate's `command_helpers::spawn` was a live
/// instance). This list re-opens the door for the handles ONLY.
///
/// MEMBERSHIP RULE, and the reason it is safe to apply a whole-type rule to an inferred method call:
/// a type belongs here only when EVERY method on it is either the effect itself or an already-carved-
/// out pure read-back. That holds for an open descriptor's handle — a `File`/`TcpStream`/`Child` does
/// nothing but I/O on the thing it owns — and the `PURE_FD_TRANSFER` guard at the top of `classify`
/// exempts the `as_raw_fd`/`into_std` family for all of them before any prefix rule runs.
///
/// THE OPTION-BUILDERS, `OpenOptions` and `DirBuilder`, were absent for exactly this rule and now
/// satisfy it: each has a type-keyed carve-out in `classify` subtracting its pure setters, so only its
/// TERMINAL VERB (`open` / `create`) is Fs. The exclusion was written as "a narrow residual, not the
/// reported hole" and MEASURED otherwise — `fn load(o: &OpenOptions, p: &Path) { o.open(p) }` opened a
/// file and reported NOTHING, the same silent false all-clear as the `Command` parameter, while a
/// setter-only `OpenOptions::new().read(true)` reported `Fs` for opening nothing. The order the old
/// comment prescribed is the order taken: the verb-precise rules went in FIRST, and this list widened
/// onto them. `ReadDir` stays out — its `next` IS a syscall, but nothing distinguishes it from any
/// other iterator's `next`, so no verb-precise rule can be written and the honest miss stands.
///
/// `std::path::Path`/`PathBuf` are NOT here: they are pure data with an effectful STAT sub-surface —
/// the exact inverse shape — and they route through their own verb-precise carve-out in the scanner.
const STD_EFFECT_HANDLES: &[&str] = &[
    // Exec — the whole type is the subprocess boundary (`new` names a program, `arg`/`env` build the
    // invocation, `spawn`/`output`/`status` run it); the read-back getters are already carved out.
    "std::process::Command",
    "std::process::Child",
    // Net — an open socket. `connect`/`accept`/`read`/`write`/`shutdown`/`set_*` are socket syscalls;
    // `local_addr`/`peer_addr`/`nodelay`/`ttl`/`take_error` are carved out.
    "std::net::TcpStream",
    "std::net::TcpListener",
    "std::net::UdpSocket",
    // Ipc — a Unix-domain socket, the same shape as the TCP/UDP handles above.
    "std::os::unix::net::UnixStream",
    "std::os::unix::net::UnixListener",
    "std::os::unix::net::UnixDatagram",
    // Fs — an open file. Every method reads, writes, syncs, truncates or stats it; the descriptor
    // conversions are carved out by `PURE_FD_TRANSFER`.
    "std::fs::File",
    // Fs — the option-builders, whose PURE setters are subtracted by the type-keyed carve-outs in
    // `classify` so that only the terminal verb (`OpenOptions::open`, `DirBuilder::create`) routes to Fs.
    "std::fs::OpenOptions",
    "std::fs::DirBuilder",
];

/// Is `ty` a std I/O handle type whose methods may be routed into `classify` by the scanner's
/// receiver inference? See `STD_EFFECT_HANDLES` for the membership rule and the named exclusions.
pub fn is_std_effect_handle(ty: &str) -> bool {
    STD_EFFECT_HANDLES.contains(&ty)
}

/// Classify a resolved callee by the crate it belongs to and its full path.
pub fn classify(crate_name: &str, path: &str) -> Option<&'static str> {
    // Pure fd ownership-transfer/extraction leaves are never an effect, regardless of which std I/O
    // type they hang off — exempt them BEFORE the coarse prefix rules can fabricate Net/Fs/Ipc.
    if PURE_FD_TRANSFER.contains(&path.rsplit("::").next().unwrap_or(path)) {
        return None;
    }
    // SOUNDNESS R1528 (b11) — the last grandfathered rows. See `b11_r1528`; `Some(None)` is a proven-pure CARVE-OUT of a
    // suffix rule further down (`DecompressionMatcherBuilder::build` is not the `::build` that spawns).
    if let Some(verdict) = b11_r1528(crate_name, path) {
        return verdict;
    }
    if crate_name.starts_with("aws_sdk_") || crate_name.starts_with("aws_smithy") {
        // Only request dispatch is network I/O; builder setters/accessors are pure.
        if path.ends_with("::send") || path.ends_with("::send_with") {
            return Some("Net");
        }
        return None;
    }
    // aws-config resolves credentials/region on `.load()` — it reaches the IMDS metadata
    // endpoint / STS over the network (and reads ~/.aws + env). Builders (`defaults()`,
    // `SdkConfig::builder()`, `BehaviorVersion::latest()`) are pure; the `load` is the I/O.
    // (Found hardening on a real app, ebman: `builder.load().await` was classified pure.)
    //
    // THE FIX: `load_from_env()` (lib.rs:170/188, both the `behavior-version-latest` and deprecated
    // forms) is `from_env().load().await` / `load_defaults(latest).await` one call down — the crate's OWN
    // "convenience wrapper" (its own doc comment's phrase) around the already-modelled `.load()` — but
    // `"load_from_env".ends_with("::load")` is false, so the wrapper read pure. Same vein as
    // `ignore::Walk::new`.
    if crate_name == "aws_config" {
        if path.ends_with("::load") || path.ends_with("::load_defaults") || path.ends_with("::load_from_env") {
            return Some("Net");
        }
        // SOUNDNESS R1528 — aws-config 1.12.0, the grandfathered rows that are not `.load()`. See `aws_config_r1528`.
        return aws_config_r1528(path);
    }
    // git2 (libgit2 FFI): remote operations contact the network; everything else is local
    // to the .git directory. Match the remote verbs precisely — NOT bare `::clone`, which is
    // the `Clone`-trait dup of a `Remote` handle (pure), not `Repository::clone`. (Found
    // hardening on gitui: `remote.fetch`/`remote.push` were classified network-free — a git
    // client reporting it makes no network calls.)
    //
    // `Repository::clone`/`clone_recurse`/`clone_local`/`init` (via `RepoBuilder::clone`) IS the
    // thing the comment above named and then excluded anyway: the bare `::clone` denylist meant
    // to keep out `Remote::clone` (the derived trait dup) also swallowed `Repository::clone` —
    // libgit2's actual network clone, and arguably git2's single most common entry point. A
    // fabrication corpus round caught it: `git2::Repository::clone(url, path)` reported ZERO
    // effects and passed `deny Net` at exit 0. FQN-exact (like the `reqwest::get` disambiguation
    // a few lines up) so the fix doesn't just re-widen `::clone` and reintroduce the very
    // over-charge the comment was written to prevent: `Remote::clone` (and `Repository::clone`'s
    // own `Clone` derive, if it has one) must still read pure.
    if crate_name == "git2" {
        if path.ends_with("::fetch")
            || path.ends_with("::push")
            || path.ends_with("::download")
            || path.ends_with("::connect")
            || path.ends_with("::connect_auth")
            || path.ends_with("::ls")
            || path.ends_with("::upload")
            || path == "git2::Repository::clone"
            || path == "git2::Repository::clone_recurse"
            || path == "git2::build::RepoBuilder::clone"
            // A FOURTH+FIFTH true positive in the same gap the `Repository::clone` fix left open:
            // `Submodule::clone`/`Submodule::update` (submodule.rs:39,234) call `raw::git_submodule_clone`/
            // `git_submodule_update` DIRECTLY — the exact FFI leaves already in this file's own
            // FFI-tier NET table below, but only when a caller names the raw `ffi`/`raw::` leaf itself.
            // git2's documented, standard submodule-init idiom (`sub.clone(None)` /
            // `sub.update(true, None)`) never does that — it calls the safe wrapper, which carried no
            // rule of its own and read pure under `deny Net`. FQN-exact, matching the `Repository::clone`
            // fix's own discipline: a bare `::update`/`::clone` substring would sweep in git2's many pure
            // `update_*` setters (`CheckoutBuilder::update_only`, `DiffOptions::update_index`, …) and the
            // derive-`Clone` dup on every other git2 type.
            || path == "git2::Submodule::clone"
            || path == "git2::Submodule::update"
            // `Remote::list`/`RemoteConnection::list` (remote.rs:378,755) call `raw::git_remote_ls`
            // directly — the reference-advertisement fetch already in the FFI-tier NET table below,
            // reached the same way `Submodule::clone`/`update` were: the safe wrapper's OWN name
            // (`list`, not `ls`) never matched the `::ls` suffix this block already carried (which, on
            // git2 0.20, matches no real method at all — dead weight kept for whatever older API it once
            // fit). FQN-exact so a `list` on some other git2 type (none exist today, but the same
            // discipline as `Submodule::clone` above) can't be swept in by a bare suffix later.
            || path == "git2::Remote::list"
            || path == "git2::RemoteConnection::list"
        {
            return Some("Net");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27): every one of these is a public entry point whose body
        // calls a `raw::git_*` FFI leaf ALREADY in this file's own FS FFI-tier table below (config.rs/
        // index.rs/odb.rs/packbuilder.rs/reference.rs/repo.rs/treebuilder.rs, verified against git2
        // 0.20.4 source) — but that table is UNREACHABLE for a real consumer's call, because it only
        // fires when self-scan resolves the FFI leaf's OWN crate (`libgit2_sys`, via git2's internal
        // `use libgit2_sys as raw`), never for `crate_name == "git2"`, which returns from THIS block
        // first. A consumer never spells `raw::git_repository_open`; they call `git2::Repository::open`,
        // which fell through this entire branch to `None` — the exact `ignore::Walk::new` shape (a
        // lower-level rule the top-level entry point never reaches) but affecting git2's single most
        // common local operations (`Repository::open`/`init`), not an edge case. FQN-exact, not a
        // `::open`/`::write`/`::read` suffix — those verbs are common enough elsewhere (`Odb::reader`
        // isn't `::read`, `TreeBuilder`/`Index`/`PackBuilder::write` share the name with plenty of pure
        // builder setters on other types) that a bare suffix would either miss these or over-charge.
        if path == "git2::Config::add_file"
            || path == "git2::Config::open"
            || path == "git2::Config::open_default"
            || path == "git2::Index::add_all"
            || path == "git2::Index::add_path"
            || path == "git2::Index::read"
            || path == "git2::Index::write"
            || path == "git2::Index::write_tree"
            || path == "git2::Index::write_tree_to"
            || path == "git2::Odb::read"
            || path == "git2::Odb::reader"
            || path == "git2::Odb::write"
            || path == "git2::Odb::writer"
            || path == "git2::PackBuilder::write"
            || path == "git2::Reference::delete"
            || path == "git2::Reference::set_target"
            || path == "git2::Repository::blob_path"
            || path == "git2::Repository::checkout_head"
            || path == "git2::Repository::checkout_index"
            || path == "git2::Repository::checkout_tree"
            || path == "git2::Repository::commit"
            || path == "git2::Repository::discover"
            || path == "git2::Repository::discover_path"
            || path == "git2::Repository::init"
            || path == "git2::Repository::init_bare"
            || path == "git2::Repository::init_opts"
            || path == "git2::Repository::open"
            || path == "git2::Repository::open_bare"
            || path == "git2::Repository::open_ext"
            || path == "git2::Repository::open_from_env"
            || path == "git2::Repository::reference"
            || path == "git2::Repository::tag"
            || path == "git2::TreeBuilder::write"
        {
            return Some("Fs");
        }
        // `Cred::credential_helper` (cred.rs:121) calls `CredentialHelper::execute` (cred.rs:326),
        // which — on every code path — spawns a REAL `sh -c "<helper> get"` (or, if `sh` itself fails to
        // spawn, the helper binary directly) via `std::process::Command::spawn` to resolve
        // `credential.helper`-configured auth (cred.rs:370-390): a real subprocess launch a caller
        // authenticating against a private remote is one call away from (`Cred::credential_helper(cfg,
        // url, user)` is the crate's own documented way to honor `credential.helper`), not a lower-level
        // implementation detail. FQN-exact: `execute` alone is far too generic to key on blindly.
        if path == "git2::Cred::credential_helper" || path == "git2::CredentialHelper::execute" {
            return Some("Exec");
        }
        return None;
    }
    // libc — raw syscalls via FFI. The FFI-thin tier (nix, and the syscall layer beneath rusqlite/git2)
    // is invisible to a name classifier unless we model libc directly: a 35-crate calibration
    // (eval/calibration) showed nix reporting ZERO library effects because every wrapper bottoms out in
    // an unrecognised `libc::*` call. Classify by syscall name, but ONLY the UNAMBIGUOUS ones — the
    // socket family is Net, path/dir syscalls are Fs, spawn/exec/wait is Exec, SysV/pipe IPC is Ipc,
    // env/clock/entropy each their own. We deliberately SKIP the generic file-descriptor ops
    // (read/write/close/lseek/dup/fcntl/ioctl/poll/select/epoll*/mmap): they operate on ANY fd — file,
    // socket, or pipe — so a fixed label would mis-categorise as often as it helps. An honest
    // no-classify (under-report) beats emitting the WRONG effect. Pure conversions (htons/inet_pton/
    // gmtime) are also skipped.
    //
    // `nix` (the idiomatic SAFE libc wrapper, in ~every Rust systems/CLI crate) is routed through the
    // SAME table: its functions keep the syscall leaf name (`nix::fcntl::open`, `nix::sys::socket::connect`,
    // `nix::unistd::execvp`). Without this, a CONSUMER of nix analysed without nix's own source (the
    // stable scanner, single-crate) sees `nix::*` cross-crate and under-reports — serialport-rs opens its
    // device via `nix::fcntl::open` and reported ZERO Fs. The nightly lint reaches `libc::*` THROUGH nix's
    // body; this gives the scanner the same coverage directly. (Found sweeping serialport-rs.)
    // `rustix` is the same shape as nix but does RAW syscalls (no libc underneath), so its functions MUST
    // be classified directly. Its leaf names are the syscall names too (`rustix::time::clock_settime`,
    // `rustix::fs::mkfifoat`/`symlink`/`stat`, `rustix::net::connect`) — route it through the same table.
    // The rustix-specific `*at`/variant leaves it doesn't share with libc just under-report (the safe
    // direction). VALIDATED, not speculative: coreutils' `date` reads/sets the clock via
    // `rustix::time::clock_getres`/`clock_settime` and reported Clock=0; the file I/O that goes through
    // std::fs was already correct, which is why only the rustix-only effects (Clock/Ipc) were missing.
    if crate_name == "libc" || crate_name == "nix" || crate_name == "rustix" {
        let f = path.rsplit("::").next().unwrap_or(path);
        // path / directory / metadata syscalls (incl. *64 and *at variants) — `LIBC_FS`, hoisted to module
        // level so the AS-EFF-008 masking guard reads THE SAME TABLE (SOUNDNESS R806); see `masks_locator`.
        const FS: &[&str] = LIBC_FS;
        // socket family — these operate only on sockets, so Net is unambiguous (AF_UNIX domain isn't
        // visible at the call, so a Unix socket reads as Net rather than Ipc; acceptable over-general).
        const NET: &[&str] = LIBC_NET;
        // process creation / replacement / reaping
        const EXEC: &[&str] = LIBC_EXEC;
        // pipes / FIFOs / SysV + POSIX message queues, semaphores, shared memory; socketpair (AF_UNIX)
        const IPC: &[&str] = &[
            "pipe", "pipe2", "mkfifo", "mkfifoat", "socketpair", "msgget", "msgsnd", "msgrcv", "msgctl",
            "semget", "semop", "semtimedop", "semctl", "shmget", "shmat", "shmdt", "shmctl", "mq_open",
            "mq_send", "mq_receive", "mq_timedsend", "mq_timedreceive", "mq_close", "mq_unlink",
        ];
        const ENV: &[&str] = &["getenv", "secure_getenv", "setenv", "putenv", "unsetenv", "clearenv"];
        const CLOCK: &[&str] = &[
            "time", "gettimeofday", "clock_gettime", "clock_getres", "nanosleep", "clock_nanosleep",
            // SETTING the system clock is a clock effect too (was unclassified — found on coreutils `date`,
            // which sets it via `clock_settime`).
            "clock_settime", "settimeofday", "stime", "adjtime", "adjtimex", "clock_adjtime",
        ];
        const RAND: &[&str] = &["getrandom", "getentropy", "arc4random", "arc4random_buf", "arc4random_uniform"];
        if FS.contains(&f) {
            return Some("Fs");
        }
        if NET.contains(&f) {
            return Some("Net");
        }
        if EXEC.contains(&f) {
            return Some("Exec");
        }
        if IPC.contains(&f) {
            return Some("Ipc");
        }
        if ENV.contains(&f) {
            return Some("Env");
        }
        if CLOCK.contains(&f) {
            return Some("Clock");
        }
        if RAND.contains(&f) {
            return Some("Rand");
        }
        return None;
    }
    // C-library FFI bindings: libsqlite3 (under rusqlite) and libgit2 (under git2). Like the libc tier,
    // these crates are thin Rust over a C library, so their real I/O is invisible until the C entry
    // points are named. Match by the DISTINCTIVE C function name (`sqlite3_*` / `git_*`) via the call's
    // LEAF — independent of the binding crate's alias: rusqlite calls `ffi::sqlite3_step`, git2 calls
    // `raw::git_remote_fetch`, and the nightly lint resolves the same to `libsqlite3_sys`/`libgit2_sys`;
    // all spellings share the leaf. Only the I/O-performing entry points are listed — the in-memory
    // accessors (`sqlite3_bind_*`/`sqlite3_column_*`, `git_*_oid`/strarray/options builders) stay pure,
    // so a non-listed `sqlite3_`/`git_` leaf returns None (under-report, never a wrong effect). Calibrated
    // + validated against rusqlite 0.39 / git2 0.20 source (eval/calibration).
    {
        let leaf = path.rsplit("::").next().unwrap_or(path);
        if let Some(rest) = leaf.strip_prefix("sqlite3_") {
            let _ = rest;
            // SQLite C API operations that touch the database (open/exec/step/prepare/backup/blob/wal).
            //
            // SOUNDNESS R166 — MEMBERSHIP CRITERION, stated because the list was extended and the next
            // reader needs to know what "already audited" covers. A leaf belongs here when it either
            // (a) reads or writes DATABASE CONTENT (disk or the in-memory image), or (b) mutates the
            // registry of code the engine will later RUN — the extension/auto-extension registry, whose
            // effect is not local to the calling frame. The audit boundary was the WHOLE `sqlite3_*`
            // surface rusqlite 0.40.2 mentions (185 distinct symbols diffed against this list), not the
            // one name the row was filed for: `sqlite3_auto_extension` arrived with its `_cancel_`/
            // `_reset_` siblings and with four content-I/O leaves nobody had looked at.
            //
            // DELIBERATELY STILL ABSENT, so this is not read as "the surface is covered": the
            // CALLBACK-INSTALLING entry points (`sqlite3_create_function[_v2]`,
            // `sqlite3_create_window_function`, `sqlite3_create_collation_v2`, `sqlite3_create_module_v2`,
            // `sqlite3_*_hook`, `sqlite3_set_authorizer`, `sqlite3_progress_handler`, `sqlite3_trace_v2`).
            // Those register a UDF/hook on ONE connection for the life of that connection; they perform no
            // database I/O themselves, and the opaque-callback boundary is already disclosed by the
            // scanner's own `Unknown` at the call site that hands the function pointer across. The
            // auto-extension registry is the case that differs: it is PROCESS-GLOBAL and outlives every
            // connection, so its consequence cannot be attributed to a caller's own frame at all.
            // Unexamined and named as such: the libgit2 (`git_*`) table below got no equivalent sweep.
            const DB: &[&str] = &[
                "sqlite3_open", "sqlite3_open_v2", "sqlite3_open16", "sqlite3_close", "sqlite3_close_v2",
                "sqlite3_exec", "sqlite3_step", "sqlite3_prepare", "sqlite3_prepare_v2",
                "sqlite3_prepare_v3", "sqlite3_prepare16", "sqlite3_prepare16_v2", "sqlite3_prepare16_v3",
                "sqlite3_get_table", "sqlite3_backup_init", "sqlite3_backup_step", "sqlite3_backup_finish",
                "sqlite3_blob_open", "sqlite3_blob_read", "sqlite3_blob_write", "sqlite3_blob_reopen",
                "sqlite3_load_extension", "sqlite3_wal_checkpoint", "sqlite3_wal_checkpoint_v2",
                // (b) the PROCESS-GLOBAL extension registry — every one of these changes what a LATER
                // `sqlite3_open` on any connection will execute, and `sqlite3_load_extension` (already
                // above) is the same capability one call along.
                "sqlite3_auto_extension", "sqlite3_cancel_auto_extension", "sqlite3_reset_auto_extension",
                "sqlite3_enable_load_extension",
                // (a) further DATABASE-CONTENT I/O the original list missed: whole-image load/save,
                // a forced page-cache flush to disk, a direct VFS file operation, and arming the
                // automatic WAL checkpoint writes whose manual twin is already listed.
                "sqlite3_deserialize", "sqlite3_serialize", "sqlite3_db_cacheflush",
                "sqlite3_file_control", "sqlite3_wal_autocheckpoint",
            ];
            return DB.contains(&leaf).then_some("Db");
        }
        if leaf.starts_with("git_") {
            // libgit2: remote/transport operations contact the network … (incl. submodule clone/update,
            // which `git_clone`/fetch the subrepo over its remote — `allow_fetch` defaults on; an A/B on
            // git2 0.20 caught `Submodule::update`/`clone` reporting no `Net`).
            const NET: &[&str] = &[
                "git_clone", "git_remote_connect", "git_remote_connect_ext", "git_remote_fetch",
                "git_remote_download", "git_remote_upload", "git_remote_push", "git_remote_ls",
                "git_submodule_clone", "git_submodule_update",
            ];
            // … and repository/index/odb/checkout/ref/config operations touch the on-disk .git store.
            const FS: &[&str] = &[
                "git_repository_open", "git_repository_open_ext", "git_repository_open_bare",
                "git_repository_init", "git_repository_init_ext", "git_repository_discover",
                "git_checkout_tree", "git_checkout_head", "git_checkout_index", "git_index_read",
                "git_index_write", "git_index_write_tree", "git_index_write_tree_to",
                "git_index_add_bypath", "git_index_add_all", "git_odb_open", "git_odb_read",
                "git_odb_write", "git_odb_open_wstream", "git_odb_open_rstream",
                "git_blob_create_fromdisk", "git_blob_create_fromworkdir", "git_blob_create_from_disk",
                "git_blob_create_from_workdir", "git_blob_create_from_stream", "git_commit_create",
                "git_commit_create_v", "git_reference_create", "git_reference_set_target",
                "git_reference_delete", "git_config_open_default", "git_config_open_ondisk",
                "git_config_add_file_ondisk", "git_tag_create", "git_treebuilder_write",
                "git_packbuilder_write",
            ];
            if NET.contains(&leaf) {
                return Some("Net");
            }
            if FS.contains(&leaf) {
                return Some("Fs");
            }
            return None;
        }
        if leaf.starts_with("curl_") {
            // libcurl (under the `curl` crate, called `curl_sys::curl_*`). Only the entry points that
            // PERFORM network I/O: the blocking transfer (`curl_easy_perform`), raw socket send/recv,
            // the HTTP/2 keepalive PING (`upkeep`), and the multi-interface transfer pumps. The large
            // pure surface (setopt/init/cleanup/reset/getinfo/escape/multi_add_handle/fdset/info_read)
            // stays unclassified, as do `curl_multi_wait`/`poll` (readiness WAIT on sockets, no payload —
            // the loop's `perform` is the tagged boundary, per the I/O-boundary principle). An A/B on
            // curl 0.4 caught the whole crate reporting ZERO Net (`Easy::perform` read as pure).
            const NET: &[&str] = &[
                "curl_easy_perform", "curl_easy_send", "curl_easy_recv", "curl_easy_upkeep",
                "curl_multi_perform", "curl_multi_socket_action",
            ];
            return NET.contains(&leaf).then_some("Net");
        }
        if let Some(op) = leaf.strip_prefix("SSL_") {
            // OpenSSL (libssl, under the `openssl`/`native-tls` crates, called `ffi::SSL_*`). The TLS
            // handshake and record I/O run over the peer socket -> Net. Unlike libc read/write, an SSL_*
            // op is ~always over a network BIO (the rare memory-BIO/sans-IO case is the honest exception
            // we accept). The crypto surface (EVP_*/SHA*/AES*) and pure setup (SSL_CTX_new/SSL_set_fd) are
            // NOT here; `BIO_*` is skipped (a BIO may be memory or socket). Validated vs openssl 0.9 source.
            const SSL_NET: &[&str] = &[
                "connect", "accept", "do_handshake", "read", "read_ex", "write", "write_ex", "peek",
                "peek_ex", "shutdown",
            ];
            return SSL_NET.contains(&op).then_some("Net");
        }
    }
    // HTTP clients use the same builder pattern as the AWS SDK: only the dispatch is
    // I/O. (Found by the eval: ebman's reqwest calls to the Anthropic API + webhooks
    // were silently classified network-free because reqwest wasn't recognized.)
    if crate_name == "reqwest" || crate_name == "isahc" {
        // SOUNDNESS R1528 — isahc 2.0.1, the grandfathered rows that are not the `::send`/`::get` family. See `isahc_r1528`.
        if crate_name == "isahc" {
            if let Some(effect) = isahc_r1528(path) {
                return Some(effect);
            }
        }
        // The dispatch (`::send`/`::execute`) is the I/O. PLUS the one-shot CONVENIENCE functions
        // `reqwest::get` / `reqwest::blocking::get` / `isahc::get`, which send immediately — they're
        // an EXACT match (not `Client::get`, the builder) to avoid false-positiving the builder path.
        // (Found running on `xh`: a one-shot `reqwest::get(url)` was classified network-free.)
        if path.ends_with("::send")
            || path.ends_with("::execute")
            || path == "reqwest::get"
            || path == "reqwest::blocking::get"
            || path == "isahc::get"
        {
            return Some("Net");
        }
        // THE URL-BEARING BUILDER METHODS: `Client::{get,post,put,delete,patch,head,request}(URL)`.
        // Real code almost never uses `reqwest::get(url)`; the DOMINANT idiom is the builder chain
        // `Client::new().post(url).send()` / `Client::builder().build()?.post(url).send()`. The `.send()`
        // already classifies `Net` — but the URL literal rides the `.post(url)` call, NOT `.send()`, so
        // without classifying the URL-naming step `Net` the endpoint is NEVER captured and the `Llm`
        // host refinement can't fire (ebman's `api.anthropic.com` call read as bare Net, undisclosed as
        // Llm — the dogfood silent under-report). Classifying these `Net` (idempotent with the eventual
        // `.send()`) makes the scanner capture the URL from their string arg. `request(method, url)`'s
        // url is its SECOND arg — the scanner's first-string-literal capture still gets it when the
        // method is a literal string, and misses it (honest under-report) when the method is an
        // expression. The pure builder surface (`::header`, `::json`, `::body`, `::query`, …) stays None.
        // SOUNDNESS R1604 — the URL-naming suffix rule below also fires on `get` hops that read an in-memory header map.
        // See `http_header_get_r1604`.
        if http_header_get_r1604(path) {
            return None;
        }
        if path.ends_with("::get")
            || path.ends_with("::post")
            || path.ends_with("::put")
            || path.ends_with("::delete")
            || path.ends_with("::patch")
            || path.ends_with("::head")
            || path.ends_with("::request")
        {
            return Some("Net");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against isahc 2.0.1 — isahc-only, since
        // reqwest has no equivalent free-function async family:
        //
        // `get_async`/`head_async`/`post_async`/`put_async`/`delete_async`/`send_async` (lib.rs:357-500)
        // are the crate's async one-shot convenience functions — `HttpClient::shared().get_async(uri)`
        // etc., the exact async mirror of the already-covered `isahc::get`, dispatching immediately.
        // `HttpClient::new`/`HttpClientBuilder::build` (client.rs:629,444) are genuinely NOT lazy like
        // reqwest's `Client::new`: `build()` unconditionally calls `agent_builder.spawn()`
        // (agent/mod.rs:63), which spawns a background OS thread running `AgentContext::run` — curl's
        // multi-handle event loop that DOES perform the real socket reads/writes for every request later
        // sent through this client. Confirmed via self-scan on isahc's own source: `AgentBuilder::spawn`
        // reaches `Net` through that same call chain, not a guess.
        if crate_name == "isahc"
            && (path == "isahc::get_async"
                || path == "isahc::head_async"
                || path == "isahc::post_async"
                || path == "isahc::put_async"
                || path == "isahc::delete_async"
                || path == "isahc::send_async"
                || path.ends_with("HttpClient::new")
                || path.ends_with("HttpClientBuilder::build"))
        {
            return Some("Net");
        }
        // `reqwest::multipart::Part::file` (blocking/multipart.rs:223) opens the given path directly
        // (`std::fs::File::open`) to attach it as a form part — genuinely Fs, not Net (the eventual
        // upload is charged at `.send()`, already covered above).
        //
        // NOT modelled: `h3_client::pool::PoolClient::send_request` (async_impl/h3_client/pool.rs:207)
        // — `mod async_impl;` is PRIVATE in reqwest's lib.rs (only `self::async_impl::multipart` is
        // selectively re-exported), so `PoolClient` is unreachable from outside the crate; the real
        // HTTP/3 dispatch a consumer can actually reach is the already-covered `::send`/`::execute`.
        // Removed from open.tsv rather than guessed.
        // SOUNDNESS R337 — THE WRAPPER, not the wrapped. candor already charges
        // `native_tls_crate::Identity::from_pkcs8`/`from_pkcs12` `Fs` (the clause below), and the reason
        // it does is concrete rather than defensive: on the security-framework backend those create a
        // real `tempfile::TempDir` and write a keychain into it —
        // `native-tls-0.2.18/src/imp/security_framework.rs:93` (`identity.keychain`, `from_pkcs8`) and
        // `:167` (`tmp.keychain`, `from_pkcs12`). But candor classifies the call a CONSUMER writes, not
        // the dependency body behind it, so a consumer who reaches that code through its idiomatic
        // wrapper matched no rule at all — and in a CALIBRATED crate an unmatched path is a claim of
        // reviewed purity with no disclosure. A call taking only BYTES writes a file on macOS, and it
        // read pure.
        //
        // Swept for the CLASS rather than the two rows the coverage gate handed me: every caller of
        // `native_tls{,_crate}::Identity::from_pkcs8|from_pkcs12` in the local registry is reqwest
        // (0.11/0.12/0.13, all three spelling these the same way), lettre, and `tcp_stream` — which is
        // NOT calibrated, so its calls disclose rather than claim purity and it needs no rule.
        //
        // Suffix-matched, not exact-path, because all three reqwest majors carry the same names; and
        // narrow on purpose. The SIBLINGS are the fabrication control and they must stay pure:
        // `reqwest::tls::Identity::from_pem` is rustls-only, a `Cursor` over a buffer (tls.rs:373), and
        // lettre's `Certificate::from_der`/`from_pem` reach `native_tls::Certificate::*`, which imports
        // items with no keychain and no temp dir (security_framework.rs:206,212).
        // SOUNDNESS R342 — THE RESPONSE BODY IS READ FROM THE SOCKET, and `resp.text().await` is one of
        // the most-written lines in Rust networking. `send()` is charged; the methods that DRAIN what it
        // returned were not, so a helper that takes a `Response` and reads it — an extremely common
        // shape — was a positive purity claim on a CALIBRATED crate. Executed at reqwest 0.13.4:
        // `r.text()`, `r.json()` and `r.bytes()` all ABSENT while `c.get(..).send()` was `['Net']`.
        //
        // Verified in the source rather than assumed: `text` -> `text_with_charset` -> `bytes` ->
        // `do_bytes`, which is `BodyExt::collect(self.res.into_body()).await`
        // (`async_impl/response.rs:433`) — it drains the body off the wire. `chunk` and `bytes_stream`
        // are the streaming spellings of the same read; charging the stream CONSTRUCTOR follows this
        // file's own `Command::new` convention, where the effect is attributed at the point the caller
        // asks for it rather than at the poll nobody can see.
        //
        // Scoped by `Response::` and not by the bare verb: `::text` and `::json` are far too common a
        // leaf to match crate-wide. Found by the coverage gate the moment R185 taught the scanner to
        // see through `Option`/`Result` unwraps — the same "closing a silence makes consumers' gaps
        // visible" shape recorded on R302 and R337.
        if crate_name == "reqwest"
            && path.contains("Response::")
            && (path.ends_with("::text")
                || path.ends_with("::text_with_charset")
                || path.ends_with("::json")
                || path.ends_with("::bytes")
                || path.ends_with("::chunk")
                || path.ends_with("::bytes_stream")
                // SOUNDNESS R1528 (b10) — `blocking::Response::copy_to(w)` is the blocking drain of the same body
                // (EXECUTED: it blocked 1.5 s on a slow server and wrote the tail; a response built in memory: 0 ms).
                || path.ends_with("::copy_to"))
        {
            return Some("Net");
        }
        if crate_name == "reqwest" {
            if let Some(effect) = reqwest_r1528(path) {
                return Some(effect);
            }
        }
        if crate_name == "reqwest"
            && (path.ends_with("::Identity::from_pkcs12_der")
                || path.ends_with("::Identity::from_pkcs8_pem"))
        {
            return Some("Fs");
        }
        if crate_name == "reqwest" && path.ends_with("::Part::file") {
            return Some("Fs");
        }
        return None;
    }
    if crate_name == "ureq" && path.ends_with("::call") {
        return Some("Net");
    }
    // THE COVERAGE-GATE SWEEP (2026-08-27), verified against ureq 2.12.1 (the version this ratchet's
    // rows were generated from — 3.x, also cached locally, rewrote this surface beyond recognition and
    // is a different question for a future pass). `::call` above is the no-body dispatch terminal;
    // these are its siblings:
    //
    // `Request::send`/`send_bytes`/`send_form`/`send_json`/`send_string` (request.rs:78-296) are the
    // WITH-BODY dispatch terminals — `do_call(Payload::..)`, the exact same terminal `call` reaches with
    // an empty payload. Missing them left every `agent.post(url).send_json(&body)` (the dominant idiom
    // for a JSON API call) silently pure.
    // `ureq::agent`/`request`/`request_url` (lib.rs:513,539,561) are real gaps in a stranger way: each
    // one's own body contains a REACHABLE (if `is_test(true)` was ever called — itself a `pub fn` a
    // consumer or another dependency could invoke) call to `testserver::test_agent()`, which binds a
    // real listening `TcpStream` (see `TestServer::new` below) — self-scan's whole-body reachability
    // treats that as real, and per this project's over-approximate-rather-than-miss discipline (a
    // toggleable global flag routing traffic through an internal listener is exactly the kind of path a
    // security-conscious caller wants disclosed, not silently pure), so does this rule. `agent()` is also
    // the crate's OWN base for `request`/`request_url` (`agent().request(..)`), and `request`/
    // `request_url` additionally carry the URL argument — matching the reqwest/isahc precedent above of
    // classifying the URL-bearing constructor `Net` too (idempotent with the eventual `.call()`/`.send()`)
    // so the destination is captured even if a caller never re-touches the returned `Request`.
    if crate_name == "ureq"
        && (path.ends_with("::send")
            || path.ends_with("::send_bytes")
            || path.ends_with("::send_form")
            || path.ends_with("::send_json")
            || path.ends_with("::send_string")
            || path == "ureq::agent"
            || path == "ureq::request"
            || path == "ureq::request_url"
            || path == "ureq::unversioned::transport::RustlsConnector::connect"
            || path == "ureq::tls::rustls::RustlsConnector::connect"
            || path == "ureq::RustlsConnector::connect")
    {
        return Some("Net");
    }
    // SOUNDNESS R1528 — ureq 3.4.2 (the version `open.tsv` was generated from; 3.x REWROTE the surface the
    // 2.12.1 rules above were written against). Every body READ in ureq-3.4.2 and every row EXECUTED against a
    // consumer fixture whose server is a 127.0.0.1 listener (the handoff REPORT). The partition:
    //   * Net — the dispatch TERMINALS (`Agent::run` -> `run_via_middleware` -> `MiddlewareNext::handle` ->
    //     `run::run` -> the pool's connector; `WithAgent::run`, `ConfigBuilder<RequestExtScope>::run`,
    //     `RequestBuilder::send_empty` = `send`, free `ureq::run`), the resolver (`DefaultResolver::resolve`
    //     = `to_socket_addrs`), and the connectors/transports that open or drive a socket
    //     (`TcpConnector`/`DefaultConnector`/`ConnectProxyConnector`/`SocksConnector`/`NativeTlsConnector::
    //     connect`, `TcpTransport::{transmit_output,await_input,is_open}`). A connector is charged although it
    //     skips itself when its config does not apply (no proxy, chained transport already present): the rule
    //     is "may", exactly as `RustlsConnector::connect` above.
    //   * The free verbs `ureq::{get,post,put,delete,head,patch,options,trace,connect}` are request BUILDERS,
    //     kept pure here by design (the deep engine charges the terminal `.call()`; candor-scan's
    //     `scan_builder_entry_effect` table over-approximates the entry, and now also `options`/`trace`/
    //     `connect`, which were silent siblings). Their real effect is the `Config::default` env read: R1555.
    //   * Env — `Config::default` -> `Proxy::try_from_env` (`HTTP_PROXY`/`ALL_PROXY`/`NO_PROXY`), reached from
    //     `Config::builder`, `Agent::config_builder`, `Agent::new_with_defaults` and `Proxy::try_from_env`
    //     itself. EXECUTED: the agent's `config().proxy()` is `Some` only when `HTTP_PROXY` is set.
    //   * Fs / Rand / Clock — `multipart::{Form::file,Part::file}` open the path (`File::open`), `Form::new`
    //     draws its boundary from `getrandom::fill`, `send_body::File::as_body` is `metadata()` on the
    //     caller's file, `transport::time::Instant::now` is `std::time::Instant::now`.
    // NOT claimed, and why (each filed or reviewed in the handoff REPORT): `ConfigBuilder::<setter>` and
    // `RequestScope::config` read the environment ONLY through `RequestBuilder::request_level_config` when the
    // builder already holds a URL error (request.rs:405-413) — conditional (R1553); `Either`/`Box<dyn
    // Transport>` forward to whatever transport they wrap and `ChainedConnector::connect` to whatever two
    // connectors it chains — the effect is the type argument's (R1554); `Agent::new_with_config`/`with_parts`
    // only box a connector and build a pool (REVIEWED_PURE_ENTRIES).
    if crate_name == "ureq" {
        // The free verbs `ureq::{get,post,...}` are deliberately NOT here: they only build a request (and read
        // the env, see R1555); candor-scan's `scan_builder_entry_effect` table over-approximates them as Net
        // for the syntactic scanner and a test pins them pure in THIS classifier for the deep engine.
        if path == "ureq::run" {
            return Some("Net");
        }
        if let Some((ty, m)) = type_method(
            path,
            "ureq",
            &["", "agent", "request", "request_ext", "config", "config::typestate", "middleware", "proxy",
              "unversioned::transport", "unversioned::transport::tcp", "unversioned::transport::connect",
              "unversioned::transport::socks", "unversioned::transport::time", "unversioned::resolver",
              "unversioned::multipart", "multipart", "tls::native_tls", "tls", "send_body"],
        ) {
            let hit = match (ty, m) {
                ("Agent", "run") | ("WithAgent", "run") | ("ConfigBuilder", "run")
                | ("RequestBuilder", "send_empty") | ("MiddlewareNext", "handle")
                | ("DefaultResolver", "resolve") => Some("Net"),
                ("TcpConnector" | "DefaultConnector" | "ConnectProxyConnector" | "SocksConnector"
                    | "NativeTlsConnector", "connect") => Some("Net"),
                ("TcpTransport", "transmit_output" | "await_input" | "is_open") => Some("Net"),
                // `Agent::shutdown` (ureq 3.5.x; SOUNDNESS R1528 refresh, covgate lane, R1696): the consumer-callable route to the
                // `ShutdownHandle::shutdown` of every transport the agent registered, which `TcpStream::shutdown` implements with
                // `shutdown(2)` on the socket — the self-scan nominates `Unknown` alone for `Agent::shutdown` (a `dyn` handle),
                // so the row it DID nominate, `TcpStream::shutdown` (in a private module), has no consumer spelling. EXECUTED
                // (slow local HTTP server, a worker blocked in `read_to_string`): `agent.shutdown()` after 250 ms ended the
                // worker's read at 260 ms with an error; the same program without the call ran 811 ms to success. An agent with
                // no live transport shuts nothing down: charged on the call, like the other pool-level verbs.
                ("Agent", "shutdown") => Some("Net"),
                ("Config", "builder" | "default") | ("Agent", "config_builder" | "new_with_defaults")
                | ("Proxy", "try_from_env") => Some("Env"),
                ("Form", "file") | ("Part", "file") | ("File", "as_body") => Some("Fs"),
                ("Form", "new") => Some("Rand"),
                ("Instant", "now") => Some("Clock"),
                _ => None,
            };
            if hit.is_some() {
                return hit;
            }
        }
    }
    // NOT modelled (both removed from open.tsv, not guessed):
    //   `ureq::Arc::connect` — the ratchet's generator strips generic arguments from an impl header, so
    //   `impl TlsConnector for Arc<rustls::ClientConfig>` (rtls.rs:88) produced the type name "Arc" — a
    //   bogus path (`ureq::Arc` names nothing; `Arc` is std's, not ureq's) that no consumer could ever
    //   write. The trait method itself is real (ureq's own internal TLS dispatch, invoked by `.call()`,
    //   already covered), but no FQN a real caller would spell resolves through this guess.
    //   `ureq::TestServer::new` — `TestServer` (testserver.rs:62) lives in `mod testserver;` (lib.rs:444),
    //   PRIVATE with no re-export, so `ureq::TestServer` is unreachable from outside the crate (the
    //   listener it binds is real, but only `agent()`'s internal `is_test` branch above can reach it).
    // The `curl` crate (libcurl's safe binding — cargo's own HTTP client): the dispatch verbs are
    // `perform` (Easy/Easy2/Transfer/Multi), raw-socket `send`/`recv`, the keepalive `upkeep`, and the
    // multi-interface `action` (socket_action). The big setopt-style builder surface stays pure.
    // `Multi::timeout` is deliberately NOT matched: `Easy::timeout` is a pure CURLOPT_TIMEOUT setter
    // sharing the leaf — an under-report on the rare event-loop kick beats mis-tagging every consumer
    // that sets a timeout. (Consumer-side companion to the curl_* FFI tier, same A/B finding.)
    if crate_name == "curl"
        && (path.ends_with("::perform")
            || path.ends_with("::send")
            || path.ends_with("::recv")
            || path.ends_with("::upkeep")
            || path.ends_with("::action"))
    {
        return Some("Net");
    }
    // The modern async-HTTP / TLS / QUIC / DNS stack — the LAYER reqwest/ureq/isahc build on, and that
    // crates use DIRECTLY. Found by the independent-method differential on `oha` (2026-06-17): candor
    // honestly DISCLOSED these as blind but never CLASSIFIED them, leaving real Net reaches uncovered.
    // Verb-keyed (the pure type/builder/codec surface stays None) and CRATE-GATED, so generic verbs
    // (request/connect/get/read/write/accept) never fabricate across unrelated crates. Same precision
    // discipline as the reqwest/curl rules above; complements the scan_builder_entry_effect entries.
    match crate_name {
        // hyper 1.x client connection I/O (the builder/Body/Request types stay pure).
        "hyper" if path.ends_with("::send_request") || path.ends_with("::handshake") => return Some("Net"),
        // hyper-util's pooled legacy Client + its TCP connectors.
        "hyper_util" if path.ends_with("::request") || path.ends_with("::connect") => return Some("Net"),
        // hickory (trust-dns) resolver — issues DNS queries over the network.
        "hickory_resolver"
            if path.ends_with("::lookup_ip") || path.ends_with("::lookup") || path.ends_with("_lookup")
                || path.ends_with("::resolve") => return Some("Net"),
        // HTTP/3 over QUIC.
        "h3" if path.ends_with("::send_request") || path.ends_with("::recv_data")
            || path.ends_with("::recv_response") || path.ends_with("::send_data") => return Some("Net"),
        // QUIC transport (UDP socket send/recv): connection setup, datagrams, AND the stream byte I/O
        // (`RecvStream::read*` / `SendStream::write*` / `finish`). Opening a stream is caught above, but a
        // fn that only HOLDS a stream and reads/writes it would otherwise read silent-pure (review: a Net
        // under-report). Crate-gated to quinn, where these verbs are unambiguously the socket I/O.
        "quinn" if path.ends_with("::connect") || path.ends_with("::accept") || path.ends_with("::open_bi")
            || path.ends_with("::open_uni") || path.ends_with("::accept_bi") || path.ends_with("::accept_uni")
            || path.ends_with("::send_datagram") || path.ends_with("::read_datagram")
            || path.ends_with("::read") || path.ends_with("::read_chunk") || path.ends_with("::read_chunks")
            || path.ends_with("::read_to_end") || path.ends_with("::write") || path.ends_with("::write_all")
            || path.ends_with("::write_chunk") || path.ends_with("::write_chunks")
            || path.ends_with("::finish") => return Some("Net"),
        // TLS-over-TCP stream adapters — the actual socket handshake/I/O (the config/cert types stay pure).
        "tokio_rustls" | "native_tls"
            if path.ends_with("::connect") || path.ends_with("::accept") || path.ends_with("::handshake") =>
            return Some("Net"),
        // AF_VSOCK host<->guest sockets — inter-process / VM comms.
        "tokio_vsock" if path.ends_with("::connect") || path.ends_with("::bind") || path.ends_with("::accept") =>
            return Some("Ipc"),
        // Loads the OS trust store from disk (cert files / keychain).
        "rustls_native_certs" if path.ends_with("::load_native_certs") => return Some("Fs"),
        // `rlimit` reads/mutates the process's kernel resource limits — the closest bucket is Env (host/
        // process config); no dedicated process-state bucket exists, so getrlimit (read) and setrlimit
        // (mutate) share it. NOTE: `num_cpus::get`/`get_physical` are deliberately NOT modeled — asking the
        // OS for the CPU count is a near-pure topology query, and std's equivalent `thread::
        // available_parallelism` classifies pure; modeling it as Env would spray Env over every thread-pool
        // constructor (review: a high-noise over-report) for no capability a reviewer cares about.
        "rlimit" if path.ends_with("::getrlimit") || path.ends_with("::setrlimit")
            || path.ends_with("::increase_nofile_limit") => return Some("Env"),
        // rustls — the SYNC TLS core (tokio_rustls/native_tls above are the async/system adapters). The
        // record-layer I/O is `read_tls`/`write_tls` (pull/push raw bytes through a held `io::Read`/`Write`)
        // and `complete_io` (loops them until the handshake/buffers drain). The config/cert/builder types
        // (`ClientConfig`/`ServerConfig`/`ConfigBuilder`) are PURE. `process_new_packets` is deliberately
        // EXCLUDED — it only decrypts ALREADY-buffered bytes (no socket touch; docs say call it AFTER
        // read_tls), so flagging it would over-report Net on the pure decrypt step.
        "rustls" if path.ends_with("::read_tls") || path.ends_with("::write_tls")
            || path.ends_with("::complete_io") => return Some("Net"),
        // native-tls under its alternate crate name + the tokio async wrapper (the `native_tls` arm above
        // is the common name). The TLS handshake over a TcpStream is Net; the builder/cert types are pure.
        "native_tls_crate" | "tokio_native_tls"
            if path.ends_with("::connect") || path.ends_with("::accept")
                || path.ends_with("::handshake") => return Some("Net"),
        _ => {}
    }
    // THE COVERAGE-GATE SWEEP (2026-08-27) — two crate-root CONSTRUCTORS the verb-keyed match above
    // never reached because neither ends in connect/accept/handshake, verified against their real
    // per-platform impl (native-tls 0.2.18, rustls 0.23.43):
    //
    // `native_tls_crate::TlsConnector::new` (lib.rs:481, the PUBLIC newtype wrapper around the private
    // per-platform `imp::TlsConnector`) reads the system trust store — on the openssl backend it loads
    // the probed cert file/dir from disk before any socket exists. `Identity::from_pkcs8` (lib.rs:178,
    // wrapping `imp::Identity::from_pkcs8`) on the security-framework (macOS) backend creates a real
    // temporary keychain file on disk to import the PKCS8 key into.
    // `rustls::KeyLogFile::new` (key_log_file.rs:88) reads `$SSLKEYLOGFILE` and, if set, opens (creating
    // if needed) that file in append mode — a real, if opt-in, disk write path independent of the sync
    // TLS record-layer I/O the `rustls` arm above already covers.
    // SOUNDNESS R331 — …and `TlsConnector::builder`, which is the SAME trust-store read reached by the
    // other spelling. `TlsConnector::new` is literally `TlsConnector::builder().build()`
    // (`native-tls-0.2.18/src/lib.rs:481`), and `TlsConnectorBuilder::build` (`:451`) is where
    // `imp::TlsConnector::new` — the openssl-backend cert-file/dir load — actually runs. The builder
    // spelling is the DOMINANT idiom the moment any option is set, and it is what `reqwest` itself
    // writes (`reqwest-0.12.28/src/async_impl/client.rs:529`).
    //
    // **KEYED ON `builder`, NOT ON `build`, AND THAT IS THE WHOLE FIX.** The first attempt added
    // `ends_with("TlsConnectorBuilder::build")` and moved nothing, so the row was closed with the
    // conclusion that the scanner "never types `TlsConnector::builder()`" and the repair had to be
    // receiver typing. **That conclusion was wrong.** `.build()` is a method on a foreign-returned
    // receiver and cannot be typed without a return index for a foreign crate — but `TlsConnector::
    // builder()` is a PATH call, recorded and classified exactly like `TlsConnector::new` beside it.
    // Charging the constructor rather than the terminal is also this file's own convention
    // (`Command::new`). Over-charge direction: a `builder()` whose `.build()` never happens, which is
    // not a shape anyone writes.
    //
    // WHY IT LOOKED LIKE NOTHING WAS RECORDED: under the calibration exemption a call that classifies
    // `None` is DROPPED from the report, so "no calls recorded" is what a correct scan of an exempt
    // crate looks like — not evidence that the receiver went untyped. Measured: under the PLAIN
    // `native_tls::` spelling (not calibrated) the same body is PRESENT with `invisible: ["native_tls"]`,
    // a disclosure; under `native_tls_crate` (the calibrated rename reqwest and tungstenite use) it is
    // ABSENT with nothing hidden. The rename is what turns a disclosure into a purity claim.
    if matches!(crate_name, "native_tls" | "native_tls_crate")
        && (path.ends_with("TlsConnector::new")
            || path.ends_with("TlsConnector::builder")
            || path.ends_with("Identity::from_pkcs8")
            || path.ends_with("Identity::from_pkcs12"))
    {
        return Some("Fs");
    }
    if crate_name == "rustls" && path.ends_with("KeyLogFile::new") {
        return Some("Fs");
    }
    // THE COVERAGE-GATE REFRESH (2026-10-08): `KeyLogFile::log` (rustls-0.23.45 key_log_file.rs:100) is
    // `try_write` -> `file.write_all(..)` (:67) on the SSLKEYLOGFILE it opened.
    if crate_name == "rustls"
        && matches!(path, "rustls::KeyLogFile::log" | "rustls::key_log_file::KeyLogFile::log")
    {
        return Some("Fs");
    }
    // Message-queue clients fully encapsulate the socket (the underlying tokio::net lives
    // inside the crate, unseen), so a user's connect/publish/consume calls ARE the I/O
    // boundary — to a remote broker, hence Net. Match the broker round-trip verbs (snake_case
    // methods); the CamelCase option/property builders stay pure. (Found hardening on consumer
    // apps: lapin `basic_publish`/`queue_declare` and async-nats `publish`/`subscribe` were
    // classified pure — a message-queue client reporting no I/O.)
    if crate_name == "async_nats" {
        if path.ends_with("::connect")
            || path.contains("::publish")
            || path.ends_with("::subscribe")
            || path.ends_with("::queue_subscribe")
            || path.contains("::request")
            || path.ends_with("::flush")
        {
            return Some("Net");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against async-nats 0.35.1 (the version this
        // ratchet's rows were generated from — 0.50.0, also cached locally, removed/relocated this
        // exact surface, a separate question for a future pass):
        //
        // `connect_with_options` (lib.rs:891) is the crate's OWN real entry point `connect()` calls one
        // hop down — the actual handshake, missing because the verb list above matches the bare
        // `::connect` suffix, not the `_with_options` sibling.
        // `ConnectOptions::credentials_file`/`with_credentials_file` (options.rs:417,438) load a real
        // credentials file off disk via `auth_utils::load_creds` before authenticating — Fs, not Net
        // (the network round-trip these feed happens later, at `connect`).
        // `ServerAddr::socket_addrs` (lib.rs:1473) does `tokio::net::lookup_host` — a real DNS query.
        if path == "async_nats::connect_with_options" {
            return Some("Net");
        }
        if path == "async_nats::ConnectOptions::credentials_file"
            || path == "async_nats::ConnectOptions::with_credentials_file"
        {
            return Some("Fs");
        }
        if path == "async_nats::ServerAddr::socket_addrs" {
            return Some("Net");
        }
        // SOUNDNESS R1528 — async-nats 0.50.0, the 105 grandfathered rows (above the 0.35.1 ceiling: a Cargo.lock
        // consumer got `invisible:[async_nats]`, a lockless one nothing). Every body was READ and EXECUTED against a
        // real nats-server with JetStream (docker `nats:latest -js`, monitoring port `/varz` read around each call;
        // handoff `rust-r1528/nats/`). See `async_nats_r1528`.
        if let Some(effect) = async_nats_r1528(path) {
            return Some(effect);
        }
        return None;
    }
    if crate_name == "lapin" {
        if path.ends_with("::connect")
            || path.ends_with("::create_channel")
            || path.contains("::basic_")
            || path.contains("::queue_")
            || path.contains("::exchange_")
            || path.contains("::tx_")
            || path.ends_with("::confirm_select")
            || path.ends_with("::close")
        {
            return Some("Net");
        }
        // SOUNDNESS R1528 — lapin 4.12.0 (above its 4.10.0 ceiling). See `lapin_r1528`.
        return lapin_r1528(path);
    }
    // SMTP email — lettre's `Transport::send` is the network dispatch; Message building is
    // pure. (Found hardening on a lettre consumer: `mailer.send(&email)` classified pure.)
    //
    // THE COVERAGE-GATE SWEEP (2026-08-27), verified against lettre 0.11.23 source — the TLS-setup and
    // connection-establishment family this crate's own `send` rule never reached:
    //
    // `TlsParameters::new`/`new_rustls` (client/tls.rs:598,617) and `TlsParametersBuilder::build`/
    // `build_rustls` (tls.rs:325,446) — `build_rustls` calls `rustls_native_certs::load_native_certs()`
    // (a real OS-trust-store read) plus `tracing::debug!`; `build()` dispatches to it under the
    // (textually-visible, cfg-gated) `rustls` feature. `SmtpTransport`/`AsyncSmtpTransport::{from_url,
    // relay,starttls_relay}` (transport.rs:90,114,243; async_transport.rs:135,169,306) each construct a
    // `TlsParameters` directly (`relay`/`starttls_relay`) or via the crate's OWN `pub(crate)
    // from_connection_url` (`from_url`) — real TLS setup a consumer never spells `TlsParameters` to
    // reach. `FileTransport::read` (transport/file/mod.rs:216) calls `std::fs::read` directly.
    if crate_name == "lettre" {
        // SOUNDNESS R1597 — a transport's `send` does the TRANSPORT's effect, not the SMTP one. See `lettre_send_r1597`.
        if let Some(effect) = lettre_send_r1597(path) {
            return Some(effect);
        }
        // SOUNDNESS R1604 — `StubTransport` records the message in memory. See `lettre_stub_send_r1604`.
        if lettre_stub_send_r1604(path) {
            return None;
        }
        if path.ends_with("::send") || path.ends_with("::send_raw") {
            return Some("Net");
        }
        // SOUNDNESS R1528 — lettre 0.11.23, the message-building, DKIM and file rows. See `lettre_r1528`.
        if let Some(effect) = lettre_r1528(path) {
            return Some(effect);
        }
        // THE COVERAGE-GATE REFRESH (2026-10-08), read against lettre-0.11.23 source: the SMTP client
        // connection layer, which `send` above reaches but a consumer driving the protocol by hand never
        // names. `SmtpConnection::connect` -> `NetworkStream::connect` (connection.rs:66, a TCP dial);
        // `command` -> `write_all` + `flush` on the stream (:275); `read_response` -> `read_line` (:289);
        // `quit`/`test_connected`/`auth`/`message`/`message_iter`/`starttls` are `command` +
        // `read_response`; `abort` sends QUIT and `shutdown`s the socket (:178). The async twins
        // (async_connection.rs) are the same over tokio, `connect_with_transport` reading the greeting.
        // `AsyncNetworkStream::{connect_tokio1, upgrade_tls}` dial / handshake the socket (the sync
        // `NetworkStream` is in the private `mod net;` and nameable by no consumer — no rule, as before);
        // `Tokio1Executor::connect` is `AsyncSmtpConnection::connect_tokio1` (executor.rs:140). NOT charged:
        // the accessors (`server_info`, `has_broken`, `can_starttls`, `is_encrypted`, `peer_*`,
        // `certificate_chain`, `tls_verify_result`, `set_stream`).
        if let Some((ty, m)) = type_method(path, "lettre", &["", "transport::smtp::client"]) {
            const CONN: &[&str] = &["connect", "connect_tokio1", "connect_with_transport", "starttls", "quit",
                "abort", "test_connected", "auth", "message", "message_iter", "command", "read_response"];
            let hit = match ty {
                "SmtpConnection" | "AsyncSmtpConnection" => CONN.contains(&m),
                "AsyncNetworkStream" => matches!(m, "connect_tokio1" | "upgrade_tls"),
                "Tokio1Executor" => m == "connect",
                _ => false,
            };
            if hit {
                return Some("Net");
            }
        }
        // SOUNDNESS R337 — lettre's half of the same wrapper gap. `Identity::from_pem(pem, key)`
        // (transport/smtp/client/tls.rs:749) is `native_tls::Identity::from_pkcs8(pem, key)`, which on
        // macOS writes a temporary keychain. The `::Identity::` in the suffix is load-bearing: the
        // `Certificate::from_pem` twenty lines above it (`:676`) is in-memory and must stay pure, and a
        // bare `::from_pem` would charge both.
        if path.ends_with("::Identity::from_pem") {
            return Some("Fs");
        }
        if path == "lettre::TlsParametersBuilder::build"
            || path == "lettre::transport::smtp::client::TlsParametersBuilder::build"
            || path == "lettre::TlsParametersBuilder::build_rustls"
            || path == "lettre::transport::smtp::client::TlsParametersBuilder::build_rustls"
            || path == "lettre::TlsParameters::new"
            || path == "lettre::transport::smtp::client::TlsParameters::new"
            || path == "lettre::TlsParameters::new_rustls"
            || path == "lettre::transport::smtp::client::TlsParameters::new_rustls"
            // SOUNDNESS R331 — the `_native` half of the same family, which this enumeration never had.
            // It surfaced the moment `TlsConnector::builder` started charging: the coverage gate's
            // oracle saw `Fs` on `TlsParameters::new_native` and `TlsParametersBuilder::build_native`
            // and `classify()` had no rule for either. `build_native` is `TlsConnector::builder()`
            // (`lettre-0.11.23/src/transport/smtp/client/tls.rs:338`) and `new_native` delegates
            // straight to it (`:610`); the already-listed `build`/`new` reach whichever backend is
            // enabled and were covered, so the list held every variant EXCEPT the one named after the
            // backend that does the disk read.
            //
            // `build_boring`/`new_boring` are deliberately NOT added. `build_boring` (`:384`) builds a
            // `boring::ssl::SslConnector`, and openssl's `SslConnector::builder` calls
            // `set_default_verify_paths()` — so it is PROBABLY `Fs` too, but `boring` is not a crate
            // this file has read, and the last three defects in this area came from charging a path
            // whose body nobody had opened. Left for a pass that reads it.
            || path == "lettre::TlsParameters::new_native"
            || path == "lettre::transport::smtp::client::TlsParameters::new_native"
            || path == "lettre::TlsParametersBuilder::build_native"
            || path == "lettre::transport::smtp::client::TlsParametersBuilder::build_native"
            || path == "lettre::SmtpTransport::from_url"
            || path == "lettre::SmtpTransport::relay"
            || path == "lettre::SmtpTransport::starttls_relay"
            || path == "lettre::AsyncSmtpTransport::from_url"
            || path == "lettre::AsyncSmtpTransport::relay"
            || path == "lettre::AsyncSmtpTransport::starttls_relay"
            || path == "lettre::FileTransport::read"
        {
            return Some("Fs");
        }
        // `AsyncStd1Executor::{connect,fs_read,fs_write}` (executor.rs:223,260,265, the sealed
        // `Executor` trait impl — `#[doc(hidden)]` in lettre's own source, so this is a narrower, less-
        // visited surface than the others above, but genuinely reachable: both the trait and the type
        // are `pub`, re-exported at the crate root) dial a real connection / read+write real files.
        // `AsyncSmtpConnection`/`AsyncNetworkStream::connect_asyncstd1` (client/async_connection.rs:121,
        // client/async_net.rs:207) dial a real `async-std` TCP connection — reachable only via the
        // module-qualified path (`transport::smtp::client::`), since neither type is re-exported at the
        // crate root (unlike `TlsParameters`'s sibling forms, which at least reach `client::` — the dual
        // spellings above, same shape as rusqlite's `Blob`/`Backup`).
        if path == "lettre::AsyncStd1Executor::connect"
            || path == "lettre::AsyncSmtpConnection::connect_asyncstd1"
            || path == "lettre::transport::smtp::client::AsyncSmtpConnection::connect_asyncstd1"
            || path == "lettre::AsyncNetworkStream::connect_asyncstd1"
            || path == "lettre::transport::smtp::client::AsyncNetworkStream::connect_asyncstd1"
        {
            return Some("Net");
        }
        if path == "lettre::AsyncStd1Executor::fs_read" || path == "lettre::AsyncStd1Executor::fs_write" {
            return Some("Fs");
        }
        // NOT included: `NetworkStream::{shutdown,set_read_timeout,set_write_timeout}` (client/net.rs)
        // LOOK like three more hits (self-scan flags them too, propagating from the coarse
        // `std::net::TcpStream` whole-handle rule) but `mod net;` (client/mod.rs:50) is PRIVATE and
        // `NetworkStream` is never re-exported (only imported crate-internally via a bare `use
        // self::net::NetworkStream;`, mod.rs:35) — no external consumer can ever name the type, so no
        // rule was added despite self-scan flagging it (the same `InnerConnection`/`RawStatement` shape
        // as the rusqlite fix elsewhere in this file).
        return None;
    }
    // WebSockets — tungstenite (the modern successor to the old `websocket` crate). connect
    // and the socket read/write/send are network; Message constructors are pure. (Found on a
    // tungstenite consumer: connect + send + read classified pure.)
    //
    // THE FIX: `connect` only names the URL-dialing client entry point. tungstenite ALSO ships the
    // stream-first client/server handshake free functions — `client`/`client_with_config` (client.rs:176,
    // 152: "use this if you need a nonblocking handshake ... or a custom stream") and
    // `accept`/`accept_with_config`/`accept_hdr`/`accept_hdr_with_config` (server.rs:23-63) — each of
    // which does `{Client,Server}Handshake::start(stream, ..).handshake()`, the REAL WS upgrade
    // handshake read/write over an already-open stream. These are the documented way to run tungstenite
    // over a caller-managed TCP/TLS/mio stream (exactly the shape most async runtimes use, since
    // tungstenite itself is sync/transport-agnostic) — missing from a verb list keyed only on the
    // dial-it-yourself `connect` spelling. Same vein as `git2::Submodule::clone`/`ignore::Walk::new`: an
    // established effect's SIBLING entry point absent from the allowlist.
    if crate_name == "tungstenite" {
        // SOUNDNESS R1528 (b10) — the grandfathered rows the verb list below never reached. See `tungstenite_r1528`.
        if let Some(effect) = tungstenite_r1528(path) {
            return Some(effect);
        }
        if path.ends_with("::connect")
            || path.ends_with("::connect_with_config")
            || path.ends_with("::client")
            || path.ends_with("::client_with_config")
            || path.ends_with("::client_tls")
            || path.ends_with("::client_tls_with_config")
            || path.ends_with("::accept")
            || path.ends_with("::accept_with_config")
            || path.ends_with("::accept_hdr")
            || path.ends_with("::accept_hdr_with_config")
            || path.ends_with("::read")
            || path.ends_with("::write")
            || path.ends_with("::send")
            || path.ends_with("::close")
            || path.ends_with("::flush")
            || path.ends_with("::read_message")
            || path.ends_with("::write_message")
        {
            // SOUNDNESS R1604 — `WebSocket<S>` / `WebSocketContext` I/O does whatever `S` does, and classify never sees `S` (the
            // scan strips type arguments). Over a `Cursor` it performs no syscall (EXECUTED); over a `TcpStream` or the
            // `MaybeTlsStream` that `connect` returns it writes the socket (EXECUTED). Kept `Net` for every `S`: an over-charge on
            // an in-memory stream instead of a silence on a socket.
            return Some("Net");
        }
        return None;
    }
    // elasticsearch: request builders are pure; only the `.send()` dispatch is HTTP I/O
    // (same shape as reqwest / the AWS SDK). (Found on an elasticsearch consumer.)
    // SOUNDNESS R342 — …and the RESPONSE BODY, one wrapper up from reqwest's. `Response::json` is
    // `self.response.json::<B>().await` (`http/response.rs:102`) — reqwest's body drain, which this file
    // now charges — and `text`/`bytes`/`exception` are the same read. A consumer writing
    // `client.search(..).send().await?.json().await?` had the `send` charged and the read silent.
    //
    // This is EXACTLY the distinction this file's own exclusion list already draws for this type:
    // `Response::content_type` is documented there as a pure accessor reading a header off an
    // ALREADY-received response. `status_code`/`headers` are the same shape and stay pure; the body
    // methods are not accessors, they pull the remaining bytes off the wire. Both halves are asserted
    // in the test so the line between them cannot move by accident.
    if crate_name == "elasticsearch"
        && path.contains("Response::")
        && (path.ends_with("::json")
            || path.ends_with("::text")
            || path.ends_with("::bytes")
            || path.ends_with("::exception"))
    {
        return Some("Net");
    }
    if crate_name == "elasticsearch" && path.ends_with("::send") {
        return Some("Net");
    }
    // gRPC — tonic. The transport connect and the Grpc client RPC dispatch are network;
    // codecs and request/response wrappers are pure. (connect repro-confirmed on a consumer;
    // the unary/streaming RPC verbs are from the tonic::client::Grpc API.)
    //
    // THE COVERAGE-GATE FIX: the rule above only ever covered the CLIENT half. `Router::serve`/
    // `::serve_with_shutdown` (transport/server/mod.rs:783,811) are the SERVER's own most common entry
    // points — a tonic quickstart's last line — and both bind a real listening socket via
    // `TcpIncoming::new` (incoming.rs:197: `StdTcpListener::bind(addr)`), the crate's other bare-`pub`
    // constructor (`Server<L>::serve_with_shutdown` at mod.rs:530 is a DIFFERENT, `pub(crate)` method on
    // a different receiver — not reachable, and not this one). A `deny Net` on a gRPC SERVER app missed
    // its own listen call entirely.
    if crate_name == "tonic" {
        if path.ends_with("::connect")
            || path.ends_with("::unary")
            || path.ends_with("::server_streaming")
            || path.ends_with("::client_streaming")
            || path.ends_with("::streaming")
            || path.ends_with("::Router::serve")
            || path.ends_with("::Router::serve_with_shutdown")
            || path == "tonic::TcpIncoming::new"
            || path == "tonic::transport::server::TcpIncoming::new"
        {
            return Some("Net");
        }
        // SOUNDNESS R1528 — tonic 0.14.6 (above its 0.12.3 ceiling). See `tonic_r1528`.
        return tonic_r1528(path);
    }
    // Kafka — rdkafka (FFI to librdkafka). Producer send + consumer poll/recv/subscribe/
    // commit are network round-trips to the brokers. (API-calibrated + unit-tested; a real
    // repro needs librdkafka/cmake, deferred.)
    if crate_name == "rdkafka" {
        if path.ends_with("::send")
            || path.ends_with("::send_result")
            || path.ends_with("::recv")
            || path.ends_with("::poll")
            || path.ends_with("::subscribe")
            || path.ends_with("::commit")
            || path.ends_with("::commit_message")
            || path.ends_with("::commit_consumer_state")
            || path.ends_with("::store_offset")
            || path.ends_with("::seek")
            || path.ends_with("::fetch_metadata")
            || path.ends_with("::fetch_watermarks")
            // SOUNDNESS R1528 — `fetch_group_list` (`Client`, `BaseConsumer`, `StreamConsumer`, and the
            // `Consumer` trait method; client.rs:509 is the one body, the others delegate) calls
            // `rd_kafka_list_groups`, a blocking broker request like `fetch_metadata` above. EXECUTED
            // 2026-11-08: against a local listener the call sent 41 bytes to the broker address. The
            // self-scan oracle said only `Log` (a trace event) — the Net is what a `deny Net` gate needs.
            || path.ends_with("::fetch_group_list")
            || path.ends_with("::flush")
        {
            return Some("Net");
        }
        // SOUNDNESS R1528 — rdkafka 0.39.0, the grandfathered rows above the 0.39.0 ceiling are not the point here
        // (the ceiling IS 0.39.0); these are the broker-touching verbs the suffix list cannot see. See
        // `rdkafka_r1528`.
        return rdkafka_r1528(path);
    }
    // cap-std: capability-oriented std. I/O goes *through* a held capability handle
    // (Dir/Pool/Clock/...), so these calls ARE the effect. Recognising them means a
    // cap-std project's real I/O is detected and matches the capability it declared
    // (via `declared_caps`/`capstd_cap`) — conformance against unforgeable capabilities.
    if crate_name.starts_with("cap_") {
        if path.contains("::net::Unix") || path.contains("::os::") {
            return Some("Ipc");
        }
        if path.contains("::net") {
            return Some("Net");
        }
        if path.contains("::time") {
            return Some("Clock");
        }
        if path.contains("::fs") || crate_name == "cap_tempfile" || crate_name == "cap_directories" {
            return Some("Fs");
        }
        return None;
    }
    // Local IPC (Unix-domain sockets) is I/O but not *network* — keep it distinct so
    // CANDOR_NO_AMBIENT and audits don't conflate it with internet access. async-std puts its
    // Unix sockets under `os::unix::net` (mirroring std); async-net (smol's net layer) under
    // `unix`.
    if path.starts_with("tokio::net::Unix")
        || path.starts_with("std::os::unix::net")
        || path.starts_with("async_std::os::unix::net")
        || path.starts_with("async_net::unix")
    {
        return Some("Ipc");
    }
    // Raw packet capture / raw sockets — libpnet (the dominant low-level networking crate; powers
    // bandwhich, sniffers, custom-protocol tools). `datalink::channel` opens an L2 socket and
    // `transport::transport_channel` an L3/L4 raw socket — both ARE network I/O. Packet construction
    // (pnet_packet / pnet_base, MacAddr, Ethernet frames…) is pure and stays unclassified. The actual
    // frame read/write happens via methods on the returned Sender/Receiver (trait-object dispatch the
    // syntactic backend can't resolve), so the channel-open call is the precise Net boundary. (Found
    // scanning bandwhich — a packet sniffer — which reported Net 0.)
    if crate_name == "pnet" || crate_name == "pnet_datalink" || crate_name == "pnet_transport" {
        if path.ends_with("::channel") || path.ends_with("::transport_channel") {
            return Some("Net");
        }
        return None;
    }
    // Directory traversal — `ignore` (BurntSushi's gitignore-aware walker; powers ripgrep, fd). The walk
    // EXECUTORS read the directory tree from disk = Fs. Type-precise on purpose: the configuration builders
    // (`OverrideBuilder::build`, `GitignoreBuilder::build`, the `WalkBuilder` setters) and `DirEntry`
    // accessors are PURE — only `WalkBuilder::build`/`build_parallel` (which kick off the walk) and
    // `WalkParallel::run` (which drives it) touch the filesystem. A bare `build` would wrongly flag the
    // config builders. (Found scanning fd — a file finder — which reported Fs 2: its own `fs::read_dir`
    // was caught, but the `ignore`-based traversal that IS fd was invisible cross-crate.)
    //
    // `Walk::new`/`Walk::from_iter` are the crate's own documented convenience constructors — literally
    // `WalkBuilder::new(path).build()` / `WalkBuilder::from_iter(paths).build()` in `ignore`'s own source
    // (walk.rs:1128-1146) — but a verb list keyed only on `WalkBuilder::build`/`build_parallel`/
    // `WalkParallel::run`/`add_ignore` never sees `Walk::new(root)` (the crate's own top-level doc example
    // and the SAME shape as the already-fixed `walkdir::WalkDir::new`/`git2::Repository::clone`: a
    // documented public entry point that reaches the modelled effect through a wrapper the allowlist
    // didn't name). `deny Fs` over `for e in Walk::new(root) { .. }` exited 0. Charged at the SAME
    // construction site as `WalkBuilder::build` — no receiver typing needed, it's a plain `Expr::Call` on
    // `ignore::Walk::new`/`ignore::Walk::from_iter`, crate-gated so an unrelated `Walk::new` (a different
    // crate, or a local type) cannot match this arm.
    if crate_name == "ignore" {
        if path == "ignore::WalkBuilder::build"
            || path == "ignore::WalkBuilder::build_parallel"
            || path.ends_with("::WalkParallel::run")
            // `add_ignore(path)` LOOKS like a config setter but reads that ignore file from disk at call
            // time (it returns the read error) — unlike the pure `add_custom_ignore_filename(name)` which
            // only stores a filename string. The lone Fs-touching builder method in the otherwise-pure setter
            // surface, so it was silently pure under the covered-crate floor.
            || path == "ignore::WalkBuilder::add_ignore"
            || path == "ignore::Walk::new"
            || path == "ignore::Walk::from_iter"
        {
            return Some("Fs");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against ignore 0.4.33 — the gitignore-matcher
        // construction family, a DIFFERENT public surface from the walk-builder family above:
        //
        // `Gitignore::new` (gitignore.rs:103) opens and reads the given file directly via
        // `GitignoreBuilder::add`. `Gitignore::global` (gitignore.rs:141) reads `$PWD` then delegates to
        // `GitignoreBuilder::new(cwd).build_global()`. `GitignoreBuilder::add` (gitignore.rs:405) is the
        // crate's own per-file loader — `File::open` + line-by-line read — the same shape `add_ignore`
        // above was fixed for, on the SIBLING type. `GitignoreBuilder::build_global`/
        // `gitconfig_excludes_path` (gitignore.rs:377,583) resolve git's global excludesfile: read
        // `GIT_CONFIG_GLOBAL`/`XDG_CONFIG_HOME`/`HOME` env vars, then open and parse whichever gitconfig
        // file they point at. `WalkBuilder::build_matchers` (walk.rs:675) is the incremental-walk
        // sibling of the already-covered `build_parallel` — same `self.build_ignore()` call, different
        // caller-facing verb. `IncrementalIgnore::matched`/`matched_with_errors` (incremental.rs:194,213)
        // are the newer per-directory incremental-walk API: each lazily loads that directory's ignore
        // files (and, when `max_filesize` is set, `stat`s the candidate file) as the walk descends.
        //
        // `Gitignore`/`GitignoreBuilder`/`gitconfig_excludes_path` live in `pub mod gitignore;`
        // (lib.rs:59) but — unlike `Walk`/`WalkBuilder` two lines up (`pub use crate::walk::{..}`,
        // lib.rs:52) — are NOT re-exported at the crate root, so the only real, compilable spelling is
        // the module-qualified one (proven by a consumer fixture: `ignore::Gitignore::new` does not
        // exist, `ignore::gitignore::Gitignore::new` does). `IncrementalIgnore` IS re-exported at the
        // root (`pub use crate::incremental::{..}`, lib.rs:51), so the bare form is correct there.
        if path == "ignore::gitignore::Gitignore::new"
            || path == "ignore::gitignore::Gitignore::global"
            || path == "ignore::gitignore::GitignoreBuilder::add"
            || path == "ignore::gitignore::GitignoreBuilder::build_global"
            || path == "ignore::gitignore::gitconfig_excludes_path"
            || path == "ignore::WalkBuilder::build_matchers"
            || path == "ignore::IncrementalIgnore::matched"
            || path == "ignore::IncrementalIgnore::matched_with_errors"
            || path == "ignore::DirEntry::metadata"
            || path == "ignore::walk::DirEntry::metadata"
            || path == "ignore::WalkParallel::visit"
            || path == "ignore::walk::WalkParallel::visit"
        {
            return Some("Fs");
        }
        return None;
    }
    // Filesystem watching — `notify` (the de-facto fs-watch crate: watchexec, cargo-watch, mdbook). A
    // watcher opens an OS notification handle (inotify / FSEvents / kqueue / ReadDirectoryChanges) and
    // registers paths — observing filesystem state changes = Fs. The lifecycle boundary: any
    // `*Watcher::new` constructor (RecommendedWatcher/PollWatcher/INotifyWatcher/FsEventWatcher/…), the
    // `recommended_watcher` convenience fn, and the `watch`/`unwatch` registration verbs. `Config`/`Event`/
    // `EventKind` data types stay pure. (Found scanning watchexec: its watcher-`create` read Fs 0.)
    if crate_name == "notify" {
        if path.ends_with("Watcher::new")
            || path.ends_with("::recommended_watcher")
            || path.ends_with("::watch")
            || path.ends_with("::unwatch")
            // `ReadDirectoryChangesWatcher::create` (windows.rs:475, `pub use windows::
            // ReadDirectoryChangesWatcher` at the crate root) is a SECOND, directly-callable
            // constructor distinct from the `Watcher::new` trait method above — it takes a raw
            // meta-event channel `Watcher::new`'s impl builds internally by calling THIS same
            // `create`, then spawns the real ReadDirectoryChangesW watch server thread.
            || path.ends_with("ReadDirectoryChangesWatcher::create")
        {
            return Some("Fs");
        }
        return None;
    }
    // std DNS resolution — `("host", 80).to_socket_addrs()` / `std::net::lookup_host("host")` perform a
    // real getaddrinfo query (Net), but the classify table covered only the socket I/O *types*, so they
    // floored silently (sweep [37]; the syntactic engine modelled DNS only at the libc layer).
    if path.ends_with("::to_socket_addrs")
        || path == "std::net::lookup_host"
        || path.ends_with("ToSocketAddrs::to_socket_addrs")
    {
        return Some("Net");
    }
    // Raw sockets. Match the I/O *types* only — `std::net` also holds pure data types
    // (SocketAddr, IpAddr, …) whose construction must NOT be flagged.
    if path.starts_with("std::net::TcpStream")
        || path.starts_with("std::net::TcpListener")
        || path.starts_with("std::net::UdpSocket")
        || path.starts_with("tokio::net::")
    {
        // …but the PURE accessors read back local/option state — no network I/O — so the whole-type Net
        // rule fabricated Net on them (sweep [24], the precision failure; mirrors the arboard/memmap2 accessor
        // carve-outs). local_addr/peer_addr return bound/connected addresses; nodelay/ttl/take_error read
        // socket options/state. Every genuine verb (connect/read/write/send/recv/accept) stays Net.
        if path.ends_with("::local_addr")
            || path.ends_with("::peer_addr")
            || path.ends_with("::nodelay")
            || path.ends_with("::ttl")
            || path.ends_with("::take_error")
        {
            return None;
        }
        return Some("Net");
    }
    // Legacy tokio 0.1 socket crates — `tokio_tcp`/`tokio_udp` are *entirely* networking
    // (no pure types to over-flag), so the whole crate is Net. (Found hardening on websocat,
    // which is still on tokio 0.1: its `tokio_tcp::TcpStream::connect` was classified
    // network-free — a network tool confidently reporting 0 Net.)
    if matches!(crate_name, "tokio_tcp" | "tokio_udp") {
        return Some("Net");
    }
    // The other async runtimes mirror tokio's module layout, and their `net` modules hold only
    // socket I/O types (the pure `SocketAddr`/`IpAddr` are re-exports that resolve to `std::net`,
    // so they're excluded by def-path). `mio` is the low-level non-blocking-socket layer under
    // tokio/others; `async_net` is smol's net crate. Closes the async-std/smol/mio gap the
    // tokio_tcp note flagged. (Calibrated by module structure — these crates ARE networking — not
    // a live repro; the TCP/UDP types are defined in-crate so the def-path prefix is exact.)
    if path.starts_with("async_std::net::")
        || path.starts_with("mio::net::")
        || crate_name == "async_net"
    {
        return Some("Net");
    }
    // Database clients. Like the AWS/HTTP builders, only the execution verbs are I/O;
    // query *construction* is pure. Best-effort across crates (tune via CANDOR_CONFIG).
    // Note: bare `::query` is deliberately omitted — it executes in postgres/rusqlite but
    // only *builds* in sqlx, so including it would false-positive sqlx's `query()` builder.
    if DB_CRATES.contains(&crate_name) {
        // SOUNDNESS R1528 — sqlx-core 0.9.0's pool/migrate rows, reached by a `sqlx` facade consumer under the
        // facade's own spelling (`sqlx::PgPool::begin_with`, `sqlx::pool::PoolConnection::close`). See `sqlx_r1528`.
        if crate_name == "sqlx" {
            if let Some(effect) = sqlx_r1528("sqlx", path) {
                return Some(effect);
            }
        }
        // Postgres / SQLite-family clients: `query`/`batch_execute`/`prepare`/etc. ARE the
        // execution (round-trips to the server). sqlx is the outlier where bare `query()`
        // only BUILDS — it keeps the narrow set below. (Found by running on a real
        // tokio-postgres app, pgman: candor had reported only 4 of ~20 DB call sites.)
        if matches!(crate_name, "postgres" | "tokio_postgres" | "deadpool_postgres" | "rusqlite") {
            // `PG_DB_VERBS`, hoisted to module level so the AS-EFF-008 masking guard reads the SAME
            // table (SOUNDNESS R806; see `masks_locator` and `PG_DB_VERBS_NO_SQL`).
            const PG: &[&str] = PG_DB_VERBS;
            if PG.iter().any(|v| path.ends_with(v)) {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27): `CancelToken::cancel_query` (tokio-postgres
            // cancel_token.rs:34) opens a BRAND NEW connection to the server to send a raw CancelRequest
            // packet — real socket I/O, but not a query round-trip on an existing connection like the PG
            // verb list above, so bucketed `Net` rather than `Db`.
            if matches!(crate_name, "tokio_postgres" | "postgres")
                && path.ends_with("CancelToken::cancel_query")
            {
                return Some("Net");
            }
            // SOUNDNESS R1528 — the SAME connection-opening cancel, reached through its two DEPRECATED
            // forwarders. `Client::cancel_query` (tokio-postgres client.rs:740) is `self.cancel_token()
            // .cancel_query(tls).await` and `Transaction::cancel_query` (transaction.rs:299) forwards to the
            // client's: both end in `cancel_query.rs`, which calls `connect_socket` (a fresh TcpStream/
            // UnixStream) and writes the CancelRequest packet. EXECUTED 2026-11-08 against a local socket
            // that logged what arrived: `c.cancel_query(NoTls)` made a SECOND connection and sent a
            // CancelRequest (code 80877102). Net, like `CancelToken::cancel_query` above. `postgres` has no
            // `Client::cancel_query` (only `cancel_token`), so this is tokio_postgres only. The `_raw`
            // variants write to a caller-supplied stream and are not claimed.
            if crate_name == "tokio_postgres"
                && (path.ends_with("::Client::cancel_query")
                    || path.ends_with("::Transaction::cancel_query"))
            {
                return Some("Net");
            }
            // SOUNDNESS R1528 — `postgres::Client::is_valid` (postgres-0.19.14 client.rs:550) sends
            // `simple_query("")` and awaits the reply under a timeout: a real round-trip on the connection.
            // EXECUTED: the server saw a Query message. Db, as `simple_query` is in the verb list above.
            // `postgres` only — tokio_postgres has no `is_valid`.
            if crate_name == "postgres" && path.ends_with("::Client::is_valid") {
                return Some("Db");
            }
            // SOUNDNESS R1618 — `deadpool_postgres::Pool::{get, timeout_get}` is the pool's connection-opening verb. EXECUTED
            // (macOS, DYLD interposer, postgres:16): a COLD pool's `get()` = connect(127.0.0.1:port) + 1 getentropy (the SCRAM
            // nonce) + the startup/auth exchange; a WARM pool's `get()` (an idle object, default `RecyclingMethod::Fast`) = 0
            // connects and 0 entropy. `Db` is the primary because the cold arm opens a database session, and a `Verified`/`Clean`
            // recycling method sends a query on the warm arm too. The path is `deadpool_postgres::Pool::get`: `Pool` is a
            // `deadpool::managed::Pool<Manager>` alias, which the scan keeps under the consumer's own spelling. Keyed on the exact
            // head so another crate's `Pool::get` (and `deadpool::managed::Pool::get` over a caller's own manager) is not claimed.
            if crate_name == "deadpool_postgres"
                && matches!(path, "deadpool_postgres::Pool::get" | "deadpool_postgres::Pool::timeout_get")
            {
                return Some("Db");
            }
            // SOUNDNESS R1618 — `build_transaction().start()` is `BEGIN`. EXECUTED: 1 simple_query record and a BEGIN on the wire
            // (tokio_postgres, postgres, deadpool). The scan types the builder chain `c.build_transaction().start()` as the
            // RECEIVER's type, so the consumer's path is `tokio_postgres::Client::start` (neither `Client` nor `Object` has a
            // `start` of its own, so the name can only come from the builder), and a held builder is `TransactionBuilder::start`.
            // `isolation_level` / `read_only` / `deferrable` / `build_transaction` itself send nothing (EXECUTED, 0 events).
            if let Some((head, "start")) = path.rsplit_once("::") {
                if matches!(
                    head,
                    "tokio_postgres::Client" | "tokio_postgres::TransactionBuilder"
                        | "postgres::Client" | "postgres::TransactionBuilder"
                        | "deadpool_postgres::Client" | "deadpool_postgres::Object" | "deadpool_postgres::TransactionBuilder"
                ) {
                    return Some("Db");
                }
            }
            // rusqlite only: opening the database IS the connection establishment (`Connection::
            // open`/`open_in_memory`/`open_with_flags` — the embedded analog of `::connect`).
            //
            // THE FIX: rusqlite 0.32's `Connection` type has SIX `open*` constructors, not three —
            // `open_with_flags_and_vfs` and `open_in_memory_with_flags_and_vfs` call the real
            // `InnerConnection::open_with_flags` (the sqlite3_open_v2 FFI) directly (lib.rs:492,530), and
            // `open_in_memory_with_flags` (lib.rs:515) calls `Connection::open_with_flags(":memory:", ..)`
            // — but an exact-suffix allowlist keyed on the THREE simplest names never matches any of
            // them (`"open_in_memory_with_flags".ends_with("::open_with_flags")` is false: the suffix
            // check needs the string to END in that literal tail, and `_and_vfs`/`_with_flags` add
            // characters AFTER it). The same shape as `ignore::Walk::new`: a sibling spelling of an
            // already-modelled constructor missing from the allowlist, silently pure because rusqlite is
            // calibrated. Match on the `Connection::open` PREFIX rather than enumerating every suffix —
            // every current and future `Connection::open*` constructor opens a real handle. Scoped to the
            // `Connection::` segment specifically (not a bare leaf prefix) so an unrelated same-crate
            // `open`-prefixed method on a DIFFERENT type (e.g. the private `pragma::Sql::open_brace`,
            // which pushes one char to a string buffer — no I/O) cannot be swept in by accident.
            //
            // Same sighting, different constructor: `Connection::blob_open` and `Blob::reopen` call
            // `ffi::sqlite3_blob_open`/`sqlite3_blob_reopen` directly (blob/mod.rs:218,251) — genuinely
            // Db, and `sqlite3_blob_open`/`sqlite3_blob_reopen` are already in this file's own FFI-leaf DB
            // table above (matched only when a caller names the raw `ffi::` leaf directly) — but rusqlite's
            // own documented safe wrapper, the incremental-BLOB-I/O API every rusqlite blob consumer
            // actually calls, carried no rule of its own.
            if crate_name == "rusqlite"
                && (path.contains("::Connection::open")
                    || path.ends_with("::Connection::blob_open")
                    || path.ends_with("::Blob::reopen"))
            {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27): same shape again, and the SAME root cause as
            // `git2`'s — this `if crate_name == "rusqlite"` block returns unconditionally, so it never
            // reaches this file's own `sqlite3_*` FFI-leaf table below even though every one of these
            // calls a leaf ALREADY listed there (`sqlite3_backup_init`/`_step`, `sqlite3_blob_read`/
            // `_write`). Verified against rusqlite 0.32.1 source. `Backup::new`/`new_with_names` are the
            // crate's own online-backup constructors (backup.rs:187,200); `step`/`run_to_completion`
            // drive it; `Connection::backup`/`restore` (backup.rs:61,99) are the one-call convenience
            // wrappers around the same API and need their OWN rule since a consumer calling THEM never
            // names `Backup` at all. `Blob::{read,write}_at[_exact]`/`raw_read_at[_exact]`/
            // `write_all_at` (blob/pos_io.rs) are the incremental-BLOB positional-I/O methods, each
            // calling `ffi::sqlite3_blob_read`/`_write` directly. `Connection::from_handle`/
            // `_owned`/`extension_init2` and the free fn `init_auto_extension` (lib.rs:950,999,966;
            // auto_extension.rs:26) wrap a caller-supplied raw `*mut ffi::sqlite3` into a live
            // `Connection` — the loadable-extension entry points, same "produces a live connection"
            // effect as `Connection::open`, just over a handle the caller already has instead of one
            // this call opens itself (the `tokio_postgres::connect_raw`/`sea_orm::connect_proxy` shape).
            //
            // NOT included: `InnerConnection::*` and `RawStatement::step` LOOK like six more hits (self-
            // scan flags them too) but `mod inner_connection;`/`mod raw_statement;` (lib.rs:119,127) are
            // PRIVATE — despite `pub struct InnerConnection`/`RawStatement`, neither type has any public
            // path a real consumer could ever name or obtain a value of, so no rule was added for them
            // (a rule would be dead weight, never reachable). `Context::get_connection` (functions.rs)
            // is ALSO left out, deliberately: it returns a `ConnectionRef` accessor to an
            // ALREADY-established connection (`ffi::sqlite3_context_db_handle`, not an I/O verb) — the
            // same "handle accessor, not a syscall" shape as `TcpStream::local_addr`, not confirmed
            // enough to charge without risking the over-charge this file's history has repeatedly warned
            // against. THE COVERAGE-GATE SWEEP (2026-08-27) resolved this from "left in the ratchet"
            // to a formal call: `REVIEWED_PURE_ENTRIES` now carries `("rusqlite",
            // "rusqlite::Context::get_connection")` so the gate stops re-flagging it every refresh.
            //
            // TWO SPELLINGS EACH for `Backup`/`Blob`/`init_auto_extension`: none of the three is
            // re-exported at rusqlite's crate root (unlike `Connection`, declared directly in lib.rs), so
            // the ONLY real spelling a consumer can write is the module-qualified one
            // (`rusqlite::backup::Backup::new`, `rusqlite::blob::Blob::read_at`,
            // `rusqlite::auto_extension::init_auto_extension`) — but the coverage-gate ratchet recorded
            // the SHORT, technically-unreachable guess (`generate.py` always adds a bare
            // `{crate}::{Type}::{fn}` guess as a possible root-alias, without confirming a `pub use`
            // actually exists for it). Both are listed: the short form so this fix closes the exact row
            // the ratchet carries, the long form so it fires for what a real consumer's source (proven
            // against a compiling fixture) actually contains — dropping the long form would leave the
            // real gap open while the bookkeeping said closed.
            if crate_name == "rusqlite"
                && (path == "rusqlite::Backup::new"
                    || path == "rusqlite::backup::Backup::new"
                    || path == "rusqlite::Backup::new_with_names"
                    || path == "rusqlite::backup::Backup::new_with_names"
                    || path == "rusqlite::Backup::step"
                    || path == "rusqlite::backup::Backup::step"
                    || path == "rusqlite::Backup::run_to_completion"
                    || path == "rusqlite::backup::Backup::run_to_completion"
                    || path == "rusqlite::Connection::backup"
                    || path == "rusqlite::Connection::restore"
                    || path == "rusqlite::Blob::read_at"
                    || path == "rusqlite::blob::Blob::read_at"
                    || path == "rusqlite::Blob::read_at_exact"
                    || path == "rusqlite::blob::Blob::read_at_exact"
                    || path == "rusqlite::Blob::raw_read_at"
                    || path == "rusqlite::blob::Blob::raw_read_at"
                    || path == "rusqlite::Blob::raw_read_at_exact"
                    || path == "rusqlite::blob::Blob::raw_read_at_exact"
                    || path == "rusqlite::Blob::write_at"
                    || path == "rusqlite::blob::Blob::write_at"
                    || path == "rusqlite::Blob::write_all_at"
                    || path == "rusqlite::blob::Blob::write_all_at"
                    || path == "rusqlite::Connection::from_handle"
                    || path == "rusqlite::Connection::from_handle_owned"
                    || path == "rusqlite::Connection::extension_init2"
                    || path == "rusqlite::init_auto_extension"
                    || path == "rusqlite::auto_extension::init_auto_extension"
                    || path == "rusqlite::Statement::insert"
                    || path == "rusqlite::statement::Statement::insert"
                    || path == "rusqlite::Statement::raw_execute"
                    || path == "rusqlite::statement::Statement::raw_execute"
                    // SOUNDNESS R342 — `Rows::next` STEPS the statement: it is `self.advance()?`
                    // (`rusqlite-0.39.0/src/row.rs:40`), i.e. `sqlite3_step`, which is where a query's
                    // rows actually come from. Iterating a result set is the ordinary way to read from
                    // sqlite and it carried no `Db`. `advance` is listed beside it because it is `pub`
                    // and is the same call one level down.
                    || path == "rusqlite::Rows::next"
                    || path == "rusqlite::row::Rows::next"
                    || path == "rusqlite::Rows::advance"
                    || path == "rusqlite::row::Rows::advance")
            {
                return Some("Db");
            }
            // THE COVERAGE-GATE REFRESH (2026-10-08), read against rusqlite-0.39.0 source. Transactions,
            // savepoints and pragmas are SQL round-trips through `execute_batch`/`query_row`/`prepare`,
            // which this block already charges, but a consumer calling the wrapper never names them:
            //   * `Transaction::new`/`new_unchecked` -> `conn.execute_batch("BEGIN …")` (transaction.rs:125);
            //     `commit`/`rollback`/`finish` -> `execute_batch("COMMIT"/"ROLLBACK")` (:192,:204,:219);
            //     `savepoint`/`savepoint_with_name` -> `Savepoint::with_name_` -> `execute_batch("SAVEPOINT …")` (:253).
            //   * `Savepoint::{new, with_name, savepoint, savepoint_with_name}` (same `SAVEPOINT`), `commit`
            //     (`RELEASE`, :314), `rollback` (`ROLLBACK TO`, :328), `finish` (:342).
            //   * `Connection::{transaction_with_behavior, unchecked_transaction, savepoint,
            //     savepoint_with_name}` (:427,:465,:495,:507) construct the two above.
            //   * `Connection::pragma_query_value`/`pragma_update_and_check` -> `query_row` (pragma.rs:154,:262),
            //     `pragma_query`/`pragma` -> `prepare` + rows (:172,:209), `pragma_update` -> `execute_batch` (:238).
            // NOT charged: `drop_behavior`/`set_drop_behavior` (a field), and the private `pragma::Sql` builder.
            if crate_name == "rusqlite" {
                if let Some((ty, m)) = type_method(path, "rusqlite", &["", "transaction", "pragma"]) {
                    let hit = match ty {
                        "Transaction" => matches!(m, "new" | "new_unchecked" | "commit" | "rollback" | "finish"
                            | "savepoint" | "savepoint_with_name"),
                        "Savepoint" => matches!(m, "new" | "with_name" | "savepoint" | "savepoint_with_name"
                            | "commit" | "rollback" | "finish"),
                        "Connection" => matches!(m, "transaction_with_behavior" | "unchecked_transaction"
                            | "savepoint" | "savepoint_with_name" | "pragma" | "pragma_query"
                            | "pragma_query_value" | "pragma_update" | "pragma_update_and_check"),
                        _ => false,
                    };
                    if hit {
                        return Some("Db");
                    }
                }
            }
            // SOUNDNESS R1528 — the 17 reachable `eval/coverage-gate/open.tsv` rusqlite rows that this
            // block's `return None` left silent at every consumer (the 18th, `query_row_and_then`, is a
            // `PG_DB_VERBS` member now: it takes SQL text at argument 0, so the masking guard must read it
            // too). Each body READ in rusqlite-0.39.0 and each ends in a `sqlite3_*` leaf that the FFI table
            // below ALREADY charges `Db` (its R166 membership criterion: database content, or the
            // process-global extension registry); a consumer never names that leaf, which is the whole
            // silence. All EXECUTED 2026-11-09 against a consumer fixture (see the handoff REPORT):
            //   * `Connection::close` -> `sqlite3_close` (lib.rs:803; inner_connection.rs:157): a WAL database's
            //     `-wal`/`-shm` files were gone after it. `cache_flush` -> `sqlite3_db_cacheflush`
            //     (inner_connection.rs:320): the file grew mid-transaction only after it.
            //   * `Statement::exists` -> `Rows::next` -> `sqlite3_step` (statement.rs:349).
            //   * `Connection::serialize`/`deserialize`/`deserialize_bytes`/`deserialize_read_exact` ->
            //     `sqlite3_serialize`/`sqlite3_deserialize` (serialize.rs): the in-memory image read out / a
            //     database swapped in. (`deserialize_read_exact` also reads the CALLER's reader, which is
            //     that reader's own effect, not claimed here.)
            //   * `Connection::load_extension` -> `sqlite3_load_extension` (inner_connection.rs:193): the
            //     extension's init ran. `load_extension_enable`/`_disable` and `LoadExtensionGuard::new`
            //     (which is `load_extension_enable`) -> `sqlite3_enable_load_extension`: SQL `load_extension()`
            //     was refused before and worked after.
            //   * `Wal::checkpoint`/`checkpoint_v2` (hooks/mod.rs:481,485) -> `sqlite3_wal_checkpoint[_v2]`.
            //   * `register_/cancel_/reset_auto_extension` (auto_extension.rs:50-62) -> the PROCESS-GLOBAL
            //     registry: a later `Connection::open` ran the registered routine.
            // NOT claimed (accessors/pure neighbours that stay None): `is_autocommit`, `changes`,
            // `last_insert_rowid`, `is_readonly`, `Wal::name`, `init_auto_extension` (its own rule above).
            if let Some((ty, m)) = type_method(path, "rusqlite", &["", "serialize", "hooks", "statement",
                "load_extension_guard"])
            {
                let hit = match ty {
                    "Connection" => matches!(m, "close" | "cache_flush" | "serialize" | "deserialize"
                        | "deserialize_bytes" | "deserialize_read_exact" | "load_extension"
                        | "load_extension_enable" | "load_extension_disable"),
                    "Statement" => m == "exists",
                    "LoadExtensionGuard" => m == "new",
                    "Wal" => matches!(m, "checkpoint" | "checkpoint_v2"),
                    _ => false,
                };
                if hit {
                    return Some("Db");
                }
            }
            if matches!(
                path,
                "rusqlite::register_auto_extension" | "rusqlite::auto_extension::register_auto_extension"
                    | "rusqlite::cancel_auto_extension" | "rusqlite::auto_extension::cancel_auto_extension"
                    | "rusqlite::reset_auto_extension" | "rusqlite::auto_extension::reset_auto_extension"
            ) {
                return Some("Db");
            }
            return None;
        }
        // redis: the way redis is ACTUALLY used is the high-level `Commands`/`AsyncCommands`
        // traits (`con.get`/`set`/`hset`/`lpush`/…) — every method is a round-trip — plus
        // connection establishment. The shared VERBS below only catch the low-level
        // `cmd("GET").query(con)`, so without this a normal redis user's calls classify as
        // PURE. (Found hardening on redis-rs: a fn doing `con.get`/`set` reported no effects.)
        // SOUNDNESS R335 — the SENTINEL module, which the rules above reach only by accident. redis's
        // `sentinel` surface is how a client finds the current master in a failover deployment, and
        // every lookup TALKS TO THE SENTINEL SERVERS: `Sentinel::master_for` runs
        // `find_master_address` (a `SENTINEL masters` round-trip) and its own doc says "this will
        // connect to the master node to verify that it considers itself master"; `get_sentinel_client`
        // opens a client per address and issues `ROLE` until one answers. Measured on redis 1.6.0 —
        // which is this crate's REVIEWED CEILING, so the calibration exemption applied and every one of
        // them read as a positive purity claim, in both the receiver-typed and UFCS spellings.
        //
        // A DENYLIST, not the enumeration the surrounding rules use, and that is the point. The
        // enumerate-the-connecting-verbs shape is what goes stale: a release that ADDS a lookup verb
        // adds a SILENCE, the cardinal direction. Inverted, the whole module is `Db` except its
        // config surface, so a new verb is charged by default and only a new PURE verb costs a
        // fabrication. The exempt set is not guessed: every `pub fn` leaf in redis-1.6.0/src/sentinel.rs
        // is one of 33 names, and `build` / `new` / `set_*` are exactly the ones that touch no socket
        // (`Sentinel::build` parses URLs via `into_connection_info`; `SentinelClientBuilder::build`
        // assembles a config struct). The `contains("::Sentinel")` arm is not the loose match R321
        // punished: the module's ENTIRE public surface was enumerated before writing it, and no item
        // named `Sentinel*` exists anywhere else in the crate, nor any of these verb names.
        if crate_name == "redis"
            && (path.starts_with("redis::sentinel::") || path.contains("::Sentinel"))
        {
            let m = path.rsplit("::").next().unwrap_or(path);
            // SOUNDNESS R1528 (redis 1.7.1): `build` is NOT pure either: `Sentinel::build_inner` seeds
            // `replica_start_index` with `random_replica_index` -> `rand::rng().random_range(..)` (sentinel.rs:284,752),
            // and `SentinelClient::build` / `SentinelClientBuilder::build` end in it (EXECUTED: 1-2 OS entropy reads on a
            // fresh thread, 0 on an idle one). It is still NOT charged, and the reason is the measurement that stopped
            // the rule: `let mut s = Sentinel::build(u)?; s.master_for(..)` has an untyped `s` (the `?` result), so a
            // `Rand` rule on `build` REPLACED the lock arm's `invisible:[redis]` with `['Rand']` and the `Db` of
            // `master_for` reached no rule (the scan reported `Rand` alone, on both `Sentinel::build` and
            // `SentinelClient::build` followed by `get_connection`). That deletes the only disclosure of the real
            // effect for a secondary one — not a resolution. Filed as R1590:silent.
            if m == "build" || m == "new" || m.starts_with("set_") {
                return None;
            }
            // §E1 HIT COUNTER (`CANDOR_ALIAS_DEBUG`) for `bin/corpus-ab.py --mark`.
            if candor_report::env::trace("CANDOR_ALIAS_DEBUG") {
                eprintln!("R335SENTINEL {path}");
            }
            return Some("Db");
        }
        // THE COVERAGE-GATE REFRESH (2026-10-08), read against redis-1.7.1 source. The sync `Connection`'s
        // raw protocol pair and the sync `PubSub` reader touch the socket directly:
        // `send_packed_command` -> `send_bytes` -> `reader.write_all(bytes)` (connection.rs:1661,:1053);
        // `recv_response` -> `read(true)` -> `parser.parse_value(reader)` (:1668,:1850);
        // `PubSub::get_message` -> `self.con.read(false)` (:2204). `Net`, not the `Db` the command verbs
        // carry: these move bytes, they issue no command. Exact type segment (`type_method`), so
        // `MultiplexedConnection`/`ClusterConnection` are not swept in.
        if crate_name == "redis" {
            if let Some((ty, m)) = type_method(path, "redis", &["", "connection"]) {
                if (ty == "Connection" && matches!(m, "send_packed_command" | "recv_response"))
                    || (ty == "PubSub" && m == "get_message")
                {
                    return Some("Net");
                }
            }
        }
        // SOUNDNESS R1528 — redis 1.7.1, the grandfathered rows above the 1.6.0 ceiling. See `redis_r1528`.
        if crate_name == "redis" {
            if let Some(effect) = redis_r1528(path) {
                return Some(effect);
            }
        }
        if crate_name == "redis"
            && (path.contains("Commands::")
                // THE COVERAGE-GATE SWEEP (2026-08-27), a pre-existing over-report found in passing:
                // `path.contains("::get_connection")` is a SUBSTRING match, so it also matched
                // `Client::get_connection_info` (client.rs:78) — a pure accessor returning an
                // already-stored `&ConnectionInfo`, no round-trip at all. Verified against redis 1.6.0.
                || (path.contains("::get_connection") && !path.ends_with("::get_connection_info"))
                || path.contains("::get_async_connection")
                || path.contains("::get_multiplexed_async_connection")
                // a live `ConnectionManager` round-trips (Db), but `ConnectionManagerConfig` is a pure
                // in-memory builder (set_number_of_retries/set_max_delay) — exclude it (adversarial review).
                // `ConnectionManager::clone` is an Arc refcount bump — no Db round-trip (sweep [27]).
                || (path.contains("ConnectionManager") && !path.contains("ConnectionManagerConfig")
                    && !path.ends_with("::clone"))
                || path.ends_with("::query")
                || path.ends_with("::query_async")
                || path.ends_with("::req_command")
                || path.ends_with("::req_packed_command")
                || path.ends_with("::req_packed_commands"))
        {
            return Some("Db");
        }
        // mongodb: a document-store API with none of the SQL verbs — the user calls
        // `coll.find_one`/`insert_one`/`aggregate`/… and `Client::with_uri_str`. Without
        // these a mongodb user's calls classify PURE. (Found hardening: a fn doing
        // `find_one`+`insert_one` reported no effects.) Handle accessors (name/namespace)
        // and option/doc builders don't match these verbs, so they stay pure.
        //
        // THE FIX: `Client::with_options(options)` IS `with_uri_str`'s own body one call down —
        // `with_uri_str` (client.rs:179) is literally `ClientOptions::parse(uri).await?;
        // Client::with_options(options)`, and `with_options` (client.rs:188) is where the topology/
        // monitoring actually spins up. A caller who already holds a `ClientOptions` (built
        // programmatically, or via `ClientOptions::parse` called separately) uses `with_options`
        // directly — mongodb's OWN alternate entry point for the identical effect, missing from an
        // allowlist keyed only on the URI-string spelling. Same shape as `ignore::Walk::new` and
        // diesel's `establish`: a sibling constructor of an already-modelled effect. Verified against
        // mongodb 3.8.1 source for both the async (`client.rs`) and sync (`sync/client.rs`) `Client`.
        if crate_name == "mongodb" {
            const MONGO: [&str; 28] = [
                "::with_uri_str", "::with_options", "::connect", "::find", "::find_one", "::insert_one",
                "::insert_many", "::update_one", "::update_many", "::delete_one",
                "::delete_many", "::replace_one", "::aggregate", "::count_documents",
                "::estimated_document_count", "::count", "::distinct", "::run_command",
                "::find_one_and_update", "::find_one_and_delete", "::find_one_and_replace",
                "::list_collections", "::list_collection_names", "::list_databases",
                "::list_database_names", "::create_collection", "::create_index", "::watch",
            ];
            if MONGO.iter().any(|v| path.ends_with(v)) {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27), verified against mongodb 3.8.1 — the client-side
            // field-level encryption (CSFLE) surface, entirely unrelated to the CRUD verb list above.
            //
            // `ClientEncryption::decrypt` (client/csfle/client_encryption.rs:195) is an ordinary `pub
            // async fn` that bottoms out in `CryptExecutor::run_ctx` (client/csfle/state_machine.rs:106),
            // a state-machine loop that — depending on state — runs a real `list_collections` query
            // against the key-vault database, executes a real command against `mongocryptd` (respawning
            // the child process if the connection drops), and fetches data keys from the key vault:
            // genuinely Net (and, via mongocryptd respawn, Exec), reached from a manual decrypt call, not
            // a guess. Suffix-matched because the real path runs through a re-export hop the ratchet's
            // crate-root-alias guess skips: `ClientEncryption` is defined inside `pub(crate) mod csfle;`
            // (client.rs:4) and reachable only via `pub use crate::client::csfle::client_encryption;` at
            // the crate root (lib.rs:74) — `mongodb::client_encryption::ClientEncryption`, not bare
            // `mongodb::ClientEncryption`. The name is specific enough within this crate that a suffix
            // match carries no fabrication risk (crate-gated, and `ClientEncryption` exists nowhere else
            // in mongodb's own source).
            if path.ends_with("ClientEncryption::decrypt") {
                return Some("Net");
            }
            // NOT modelled (removed from open.tsv, not guessed): `CreateDataKey::execute` /
            // `Encrypt::execute` — a DIFFERENT false-guess shape from every other row in this pass.
            // `CreateDataKey`/`Encrypt` (action/csfle/create_data_key.rs, action/csfle/encrypt.rs) are
            // the crate's real, publicly re-exported Action-builder types (`mongodb::action::csfle::
            // {CreateDataKey,Encrypt}`) — but the SAME effect self-scan found (the real `run_ctx` call)
            // lives in `impl Action for CreateDataKey<'a> { async fn execute(self) -> .. { .. } }`
            // (client/csfle/client_encryption/create_data_key.rs:14), which is the INPUT to the
            // `#[action_impl]` proc macro, not a real method: the `Action` trait (action.rs:104) declares
            // only `optional`, and its own doc comment says the crate's action types are "executed via
            // `await` (or `run` if using the sync client)" — the macro consumes this `execute` fn body
            // and re-emits it as `IntoFuture::into_future`, so no compiled `CreateDataKey`/`Encrypt`
            // value ever has a method literally named `execute` a consumer could call. Self-scan found a
            // real function performing a real effect; it is just never reachable under this spelling
            // (nor, by construction, under ANY spelling — a consumer's call site is `.await`, not a
            // `.execute()` method call, so candor-scan would need to resolve the `IntoFuture` desugaring
            // itself to see this at all, a different, deeper question than a classify() rule can answer).
            //
            // SOUNDNESS R1528 (mongodb lane, 3.9.1): the effect is not unreachable, it is reached through the
            // CREATOR the consumer does call (`coll.drop()`, `session.commit_transaction()`, ...) and charged
            // there; see `mongodb_r1528`, which also recognises the macro-input spellings so the generator's rows
            // are covered. The `in-use-encryption` rows stay unclaimed (R1585).
            return mongodb_r1528(path);
        }
        // mysql / mysql_async: the `query`/`exec` families + `get_conn`/`ping` execute
        // immediately — no build-then-execute split like sqlx, so matching `::query` is safe
        // here. Same DB-verb-dialect gap class as redis/mongodb; calibrated from the Queryable
        // API (unit-tested; a real-app repro is the remaining confirmation).
        //
        // THE FIX: `Conn::new(opts)` is each crate's OWN primary connection constructor — not a
        // pool helper like `get_conn`, but the raw handle. `mysql::Conn::new` (conn/mod.rs:342) calls
        // `conn.connect_stream()?; conn.connect()?` directly; `mysql_async::Conn::new` (conn/mod.rs:921)
        // returns a future that does the same handshake. Real connection establishment, same shape as
        // diesel's `establish`/rusqlite's `open*` — but `::new` never appeared in this verb list, so a
        // bare `Conn::new(opts)?` (the crate's OWN first doctest example) read pure. Scoped to the
        // `Conn::` segment specifically (`::new` alone is far too generic a suffix to key on blindly —
        // `Opts`/`Pool`/query-result types in the same two crates have their own pure `new`s).
        if matches!(crate_name, "mysql" | "mysql_async") {
            if path.ends_with("::Conn::new") {
                return Some("Db");
            }
            const MY: [&str; 16] = [
                "::query", "::query_first", "::query_iter", "::query_map", "::query_fold",
                "::query_drop", "::exec", "::exec_first", "::exec_iter", "::exec_map",
                "::exec_fold", "::exec_drop", "::exec_batch", "::prep", "::ping", "::get_conn",
            ];
            if MY.iter().any(|v| path.ends_with(v)) {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27), verified against mysql_async 0.37.0:
            // `Conn::from_url` (conn/mod.rs:1059) is `Conn::new(Opts::from_str(url)?)` one hop down —
            // the crate's OWN alternate entry point for the identical connect effect `Conn::new` above
            // already carries, same shape as `ignore::Walk::new`/diesel's `establish`.
            // `WhiteListFsHandler::handle` (local_infile_handler/builtin.rs:58, the `GlobalHandler` impl
            // for `LOAD DATA LOCAL INFILE`) opens a real file off the caller-supplied whitelist —
            // reachable at the crate root (`pub use self::local_infile_handler::{builtin::
            // WhiteListFsHandler, ..}`, lib.rs:500).
            if path == "mysql_async::Conn::from_url" {
                return Some("Db");
            }
            if path.ends_with("WhiteListFsHandler::handle") {
                return Some("Fs");
            }
            // NOT modelled (all three removed from open.tsv, not guessed): `mysql::MyTcpBuilder::connect`/
            // `Stream::connect_tcp`/`Stream::make_secure` (mysql, not mysql_async — io/tcp.rs, io/mod.rs,
            // io/tls/native_tls_io.rs). `mod io;` is PRIVATE in mysql's lib.rs with no re-export of
            // `MyTcpBuilder`/`Stream`, so none of the three is a path any external consumer can name —
            // the crate's real, externally-reachable connect effect is `Conn::new` above (already
            // covered), which calls into this private `io` module internally. Also NOT modelled:
            // `mysql_async::PathOrBuf::read` (opts/mod.rs) — `PathOrBuf` is declared in the same private
            // `mod opts;` whose OTHER types (`Opts`, `OptsBuilder`, …) ARE individually `pub use`-
            // re-exported at the crate root (lib.rs:493) but `PathOrBuf` specifically is not, so it too
            // is unreachable — the same private-module shape as tempfile's `imp::` functions above.
            // (R1528, 0.37.1: it IS reachable as a VALUE a public signature hands out, but no spelling of it can be
            // typed by the scan, so no rule can fire: filed R1586.)
            if crate_name == "mysql" {
                if let Some(effect) = mysql_r1528(path) {
                    return Some(effect);
                }
            }
            return mysql_async_r1528(path);
        }
        // sea_orm: an ORM whose execution is split from building (like sqlx). The query
        // BUILDERS (`Entity::find`, `Entity::insert`) are pure; execution happens at `.all`/
        // `.one`/`.count`/`.stream` and `Insert/Update/Delete::exec`. The write path via an
        // ActiveModel (`model.insert(db)`) executes too — distinguished from the `EntityTrait`
        // builder by the trait in the path (`ActiveModelTrait::`). (Found hardening on a
        // sea_orm consumer app: `.all(db)` reads and `ActiveModel::insert` writes were pure.)
        if crate_name == "sea_orm" {
            // sea_orm RE-EXPORTS sea_query (`sea_orm::sea_query::…`), whose builder algebra collides with
            // the execution verbs: `Func::count(col)` builds a COUNT() expr, `Condition::all()` AND-groups
            // filters, `Expr::count(…)` — all PURE, none touch a db. The `::all`/`::count`/`::one` execution
            // rule fabricated Db on them (sweep [5]). sea_query is pure query construction end-to-end, so
            // exclude the whole re-exported namespace first.
            if path.contains("sea_query") {
                return None;
            }
            // SOUNDNESS R1605 — the crate-root spellings of the same builders (`sea_orm::Condition::all`,
            // `sea_orm::entity::prelude::Expr::{all,count}`, `sea_orm::ExprTrait::count`) still match the verbs below and are
            // charged `Db` for pure work (EXECUTED: 0 statements). They are NOT excluded yet: with an entity declared in the
            // consumer crate, `Entity::find().filter(Condition::all()..).all(db)` reached no other rule (the derive-generated
            // `Entity` left `.all(db)` untyped), so that charge was the only `Db` on code that runs a SELECT (EXECUTED).
            // `candor-scan` now types that terminal (R1605: the derive's `Entity`, a generic `E: EntityTrait`, a let-bound
            // builder chain from the lock-pinned `EntityTrait` declaration; R1606: a chain rooted at a generic or a local
            // implementor is never typed through a local leaf record, and its steps are walked by what the source says each
            // returns). The exclusion is STILL held. Re-measured over 76 sea_orm consumer crates x {lock, lockless} on top of
            // R1606/R1607: it drops `Db` on 487 rows; an independent token checker over each row's call closure leaves 47
            // whose closure runs a query no typed terminal or on-site hedge covers, and it is BLIND to a dropped local edge
            // (cakedome `association::util::read_in`, whose `find.all()` binds to the chain root `RepoHandle` instead of the
            // declared `Find` — SOUNDNESS R1608), so its 312 "pure" rows are not a proof. See SOUNDNESS R1606.
            if path.ends_with("::all")
                || path.ends_with("::one")
                || path.ends_with("::count")
                || path.ends_with("::stream")
                || path.ends_with("::exec")
                || path.ends_with("::exec_with_returning")
                || path.ends_with("::exec_without_returning")
                || path.ends_with("::connect")
                // `Database::connect_proxy` (database/mod.rs:139, behind the `proxy` feature) is
                // `Database::connect`'s sibling for a caller-supplied `ProxyDatabaseTrait` backend —
                // same effect (produces a live `DatabaseConnection`), different verb, missing from an
                // allowlist keyed on the plain `connect` spelling.
                || path.ends_with("::connect_proxy")
                || path.ends_with("::execute")
                || path.ends_with("::execute_unprepared")
                || path.ends_with("::query_one")
                || path.ends_with("::query_all")
                || path.ends_with("::fetch_page")
                || path.ends_with("::num_items")
                || r1607_active_model_query(path)
            {
                return Some("Db");
            }
            // THE COVERAGE-GATE SWEEP (2026-08-27): sea_orm's TRANSACTION and PAGINATION families,
            // verified against sea-orm 1.1.20 source — each of these was found effectful by self-scan
            // under no guessed spelling this allowlist already covered.
            //
            // `DatabaseConnection::transaction`/`transaction_with_config` (db_connection.rs:302,345, the
            // `TransactionTrait` impl) is the crate's documented callback-transaction API
            // (`db.transaction(|txn| ...)`) — every sqlx-backed match arm dispatches to the
            // `SqlxXxxPoolConnection::transaction` methods FQN-listed below, a real BEGIN. FQN-exact
            // (not a bare `::transaction` suffix) because `MockDatabaseConnection`/`ProxyDatabaseConnection`
            // (driver/mock.rs, driver/proxy.rs, both feature-gated) have their OWN `begin`/`commit`/
            // `rollback`/`ping`/`transaction` methods sharing every one of these verb names — a mock
            // backend performs no real I/O by construction, and a caller-supplied proxy is a callback
            // boundary, not a provable effect; a bare suffix would fabricate Db on both.
            if path == "sea_orm::DatabaseConnection::transaction"
                || path == "sea_orm::DatabaseConnection::transaction_with_config"
                // BONUS, found while proving the above reachable with a real consumer fixture (not in
                // the original coverage-gate ratchet — self-scan's own reachability pass didn't flag
                // these, apparently because it doesn't track an enum match arm's payload binding as a
                // typed receiver, but they dispatch through the identical match-on-`self` shape as
                // `transaction` two lines up): `DatabaseConnection::ping` (db_connection.rs:462) and the
                // `TransactionTrait::begin`/`begin_with_config` impl (db_connection.rs:246,268) — a fixture
                // proved `ping` silently read pure with no rule at all.
                || path == "sea_orm::DatabaseConnection::ping"
                || path == "sea_orm::DatabaseConnection::begin"
                || path == "sea_orm::DatabaseConnection::begin_with_config"
                // `DatabaseTransaction::commit`/`rollback` (transaction.rs:119,159) call
                // `<sqlx::X as sqlx::Database>::TransactionManager::commit`/`rollback` directly — real
                // COMMIT/ROLLBACK, not sea_orm's OWN `::begin`/`::run` (both `pub(crate)`, unreachable).
                || path == "sea_orm::DatabaseTransaction::commit"
                || path == "sea_orm::DatabaseTransaction::rollback"
                // The three sqlx-backed pool connections' OWN `begin`/`ping`/`transaction` (driver/
                // sqlx_{mysql,postgres,sqlite}.rs) — `begin`/`transaction` acquire a pool connection and
                // start a real transaction, `ping` round-trips `conn.ping()` to the server.
                || path == "sea_orm::SqlxMySqlPoolConnection::begin"
                || path == "sea_orm::SqlxMySqlPoolConnection::ping"
                || path == "sea_orm::SqlxMySqlPoolConnection::transaction"
                || path == "sea_orm::SqlxPostgresPoolConnection::begin"
                || path == "sea_orm::SqlxPostgresPoolConnection::ping"
                || path == "sea_orm::SqlxPostgresPoolConnection::transaction"
                || path == "sea_orm::SqlxSqlitePoolConnection::begin"
                || path == "sea_orm::SqlxSqlitePoolConnection::ping"
                || path == "sea_orm::SqlxSqlitePoolConnection::transaction"
                // `Paginator::fetch`/`fetch_and_next`/`into_stream`/`num_pages`/`num_items_and_pages`
                // (executor/paginator.rs) all transitively reach `fetch_page`/`num_items` — already-
                // covered verbs — but each is ALSO a documented entry point a real consumer calls
                // directly (`cake::Entity::find().paginate(db, 50).into_stream()`, the crate's own
                // pagination doc example) and needs its own rule for the same reason
                // `Connection::backup` needed one beside `Backup::new` in rusqlite.
                || path == "sea_orm::Paginator::fetch"
                || path == "sea_orm::Paginator::fetch_and_next"
                || path == "sea_orm::Paginator::into_stream"
                || path == "sea_orm::Paginator::num_pages"
                || path == "sea_orm::Paginator::num_items_and_pages"
                // `Insert`/`Inserter`/`TryInsert::exec_with_returning_keys`/`_many` (executor/insert.rs)
                // are sibling spellings of the already-covered `::exec_with_returning` (same shape as
                // rusqlite's `open_with_flags_and_vfs` beside `open_with_flags`): each calls through to
                // the same underlying `exec_with_returning_keys`/`_many` executor, a real INSERT.
                || path.ends_with("::exec_with_returning_keys")
                || path.ends_with("::exec_with_returning_many")
            {
                return Some("Db");
            }
            // SOUNDNESS R1528 — sea-orm 2.0.4, the 76 grandfathered rows (above the 1.1.20 ceiling). Every body was READ
            // and EXECUTED against a consumer fixture on a file-backed sqlite database (handoff `rust-r1528/seaorm/`).
            //
            // Terminal verbs on a TYPED receiver. `require_one` is `one(db)` plus a not-found error
            // (executor/select.rs:591,681,817,887,1143) and `stream_partial_model` is `into_partial_model().stream(db)`
            // (select.rs:620-846, select/{three,four}.rs): the same round trip as the `::one`/`::stream` suffixes above,
            // under verbs that list missed. EXECUTED: each returned the row / issued the statement (`sea_orm.query_one`
            // span and a `sqlx::query` event). Neither name exists outside the select family, so the suffix is safe.
            if path.ends_with("::require_one") || path.ends_with("::stream_partial_model") {
                return Some("Db");
            }
            // The transaction family and the `_raw` statement verbs, FQN-exact for the reason the block above gives
            // (the mock and proxy connections share every verb name, and `RestrictedConnection::execute_raw` /
            // `query_*_raw` are PURE refusals that return `DbErr::RbacError` without touching the connection,
            // restricted_connection.rs:54-81 — a bare `::execute_raw` suffix would fabricate Db on them; EXECUTED, the
            // `RestrictedConnection::execute_raw` control returns the RBAC error and issues no statement).
            //   * `DatabaseConnection`: `begin_with_options` (db_connection.rs:430), `transaction_async` /
            //     `transaction_with_config_async` (:657/:671, `begin()` + callback + COMMIT/ROLLBACK). EXECUTED: each
            //     issued `BEGIN`/`COMMIT` (`sea_orm.begin`/`sea_orm.commit` spans, tracing-spans feature) and
            //     `begin_with_options(Immediate)` held a write lock a second process could not take. The `_raw` verbs
            //     (`execute_raw`/`query_one_raw`/`query_all_raw`/`stream_raw`, :162-326) are not rows — their self-scan set
            //     is `Unknown` alone (R1539) — but read pure at a consumer exactly as the rows did, so they carry the same
            //     rule (EXECUTED: `execute_raw` wrote a row).
            //   * `DatabaseExecutor` (executor.rs:51-258) and `DatabaseTransaction` (transaction.rs:417-770): every method
            //     forwards to the connection/transaction it wraps on EVERY arm of its `match`, so none is conditional;
            //     `DatabaseTransaction::begin*` start a nested SAVEPOINT, `stream_raw` issues the query when polled.
            //   * `RestrictedConnection` / `RestrictedTransaction` (restricted_connection.rs:150-450): `begin*` and
            //     `transaction*` call `self.conn.begin*()` before any permission check, `commit`/`rollback` call the
            //     wrapped transaction's. EXECUTED against an RBAC-enabled sqlite file: BEGIN/COMMIT/ROLLBACK spans, a
            //     write lock held across `begin_with_options(Immediate)`.
            // SOUNDNESS R1528 (sea-orm 2.0.4 refresh, covgate lane): `SqlxPostgresConnector::accepts(url)` is `url.starts_with(
            // "postgres://") && url.parse::<PgConnectOptions>().is_ok()` (driver/sqlx_postgres.rs:61), and that parse reads the
            // `PG*` environment. EXECUTED (macOS, DYLD interposer, sea-orm 2.0.4): `postgres://u@h/db` = 13 `PG*` getenv + 3
            // stat of the unix-socket candidates + open `~/.pgpass` (the second effect: `ALSO_EFFECTS`); `postgres://u:pw@h/db`
            // = 12 getenv; a `mysql://` string and a pure control = 0 (the `&&` short-circuits), so the charge is an
            // over-approximation for a non-postgres URL, the same stated trade as the `PgConnectOptions::from_str` row (R1623).
            if let Some(("SqlxPostgresConnector", "accepts")) =
                type_method(path, "sea_orm", &["", "driver", "driver::sqlx_postgres"])
            {
                return Some("Env");
            }
            if let Some((ty, m)) = type_method(path, "sea_orm", &[""]) {
                if matches!(
                    (ty, m),
                    ("DatabaseConnection", "begin_with_options" | "transaction_async" | "transaction_with_config_async"
                        | "execute_raw" | "query_one_raw" | "query_all_raw" | "stream_raw")
                        | ("DatabaseExecutor", "begin" | "begin_with_config" | "begin_with_options" | "execute_raw"
                            | "query_one_raw" | "query_all_raw" | "transaction" | "transaction_async"
                            | "transaction_with_config" | "transaction_with_config_async")
                        | ("DatabaseTransaction", "begin" | "begin_with_config" | "begin_with_options" | "execute_raw"
                            | "query_one_raw" | "query_all_raw" | "stream_raw" | "transaction" | "transaction_async"
                            | "transaction_with_config" | "transaction_with_config_async")
                        | ("RestrictedConnection", "begin" | "begin_with_config" | "begin_with_options" | "transaction"
                            | "transaction_async" | "transaction_with_config" | "transaction_with_config_async")
                        | ("RestrictedTransaction", "begin" | "begin_with_config" | "begin_with_options" | "commit"
                            | "rollback" | "transaction" | "transaction_async" | "transaction_with_config"
                            | "transaction_with_config_async")
                ) {
                    return Some("Db");
                }
            }
            // `rbac` is a `pub mod` and is NOT re-exported at the crate root, so a consumer's path is
            // `sea_orm::rbac::RbacContext::m` (the row's root-level spelling is only the generator's guess, and no
            // consumer can write it). Each `RbacContext` method opens a transaction on `db` before it
            // touches its maps (`db.begin()` / `begin_with_config`, rbac/context.rs:43-300) and `create_tables` runs one
            // CREATE TABLE per RBAC table (rbac/schema.rs:11-27). EXECUTED on a fresh sqlite file: `create_tables` made
            // the 7 `sea_orm_*` tables, `add_tables`/`add_crud_permissions`/`add_roles`/`add_role_permissions`/
            // `remove_role_permissions`/`add_user_override`/`add_role_hierarchy`/`assign_user_role` each changed their
            // table's row count (2, 4, 2, 2 then 1, 1, 1, 1) inside a BEGIN/COMMIT, and `load` ran three SELECTs.
            // `RbacContext::get_role` (a HashMap lookup) is NOT claimed.
            if let Some((ty, m)) = type_method(path, "sea_orm", &["rbac", "rbac::context"]) {
                if ty == "RbacContext"
                    && matches!(m, "load" | "add_tables" | "add_crud_permissions" | "add_roles" | "add_role_permissions"
                        | "remove_role_permissions" | "add_user_override" | "add_role_hierarchy" | "assign_user_role")
                {
                    return Some("Db");
                }
            }
            if path == "sea_orm::rbac::schema::create_tables" {
                return Some("Db");
            }
            // `SchemaBuilder::apply` (schema/builder.rs:76) runs `CREATE TABLE` for every registered entity and `sync`
            // (:88, needs `schema-sync`) discovers the live schema with a dozen `query_all`s and then migrates it.
            // EXECUTED: `apply` created table `post`; `sync` issued 40+ `sea_orm.query_all` statements. `register` /
            // `Schema::new` only build values and are NOT claimed (control fns stay 0).
            if let Some((ty, m)) = type_method(path, "sea_orm", &["", "schema", "schema::builder"]) {
                if ty == "SchemaBuilder" && matches!(m, "apply" | "sync") {
                    return Some("Db");
                }
            }
            // `get_schema_registry` and `EntityRegistry::build_schema` (entity/registry.rs) iterate the `inventory` of
            // derive-registered entities and emit one `debug!` per entity (`Registering entities with prefix`,
            // `Registered <path>`); the registered `schema_info` callbacks are macro-generated value constructors. No
            // statement is issued. EXECUTED: a tracing layer saw one event per registered entity from target
            // `sea_orm::entity::registry` (36 for the `tests_cfg` prefix), no `sea_orm.*` span. `Log` is the one effect.
            if let Some((ty, m)) = type_method(path, "sea_orm", &["", "entity", "entity::registry"]) {
                if (ty, m) == ("EntityRegistry", "build_schema") {
                    return Some("Log");
                }
            }
            if let Some((ty, m)) = type_method(path, "sea_orm", &[""]) {
                if matches!((ty, m), ("DatabaseConnection" | "DatabaseExecutor", "get_schema_registry")) {
                    return Some("Log");
                }
            }
            return None;
        }
        // (Reached by sqlx + diesel — the build-vs-execute-split crates.) `first` is diesel's
        // LIMIT-1 round trip and `load_iter` its 2.x streaming execution; `fetch_many` is sqlx's
        // multi-result stream. All crate-gated, so a std `Vec::first` never resolves here.
        //
        // `establish` is diesel's OWN name for `::connect` — `Connection::establish(url)`
        // (connection/mod.rs:243), implemented by opening the real backend handle in
        // `SqliteConnection`/`PgConnection`/`MysqlConnection::establish` (sqlite/connection/mod.rs:230,
        // pg/connection/mod.rs:176, mysql/connection/mod.rs:158 — each does the real file-open/socket-
        // connect). It is diesel's canonical, and by far most common, connection entry point — every
        // diesel quickstart opens with it — yet it shares no verb spelling with `::connect`, so it fell
        // through this allowlist to `None`, and because `diesel` IS a CALIBRATED_CRATES entry the miss
        // produced NO `coverage.uncovered` disclosure either (that ledger is crate-level: a calibrated
        // crate's unmatched path reads as reviewed-pure, not as a gap) — the same silent-purity shape as
        // `ignore::Walk::new` above, one call away from `establish_test_transaction`/`establish_inner`,
        // which are diesel's own private plumbing and stay unmatched (no `::` in the allowed suffix keeps
        // this exact-verb, not a substring match).
        // SOUNDNESS R1528 (b10) — diesel 2.3.14 (above its 2.3.13 ceiling). See `diesel_r1528`.
        if crate_name == "diesel" {
            if let Some(effect) = diesel_r1528(path) {
                return Some(effect);
            }
        }
        const VERBS: [&str; 20] = [
            "::execute", "::query_row", "::query_map", "::query_one", "::fetch_one",
            "::fetch_all", "::fetch_optional", "::fetch", "::fetch_many", "::connect",
            "::acquire", "::begin", "::commit", "::rollback", "::load", "::load_iter",
            "::first", "::get_result", "::get_results", "::establish",
        ];
        if VERBS.iter().any(|v| path.ends_with(v)) {
            return Some("Db");
        }
        return None;
    }
    // std::path::Path / PathBuf STAT-family methods hit the filesystem (each is a stat/readlink/
    // readdir syscall) — unlike the rest of the std::path surface, which is pure string manipulation
    // (join/file_name/extension/parent/…). Verb-precise so the scanner's receiver inference can safely
    // route a `path.symlink_metadata()` method call here. (A blackout screen caught gix-dir — an entire
    // directory WALKER — reporting ZERO Fs because all its I/O is Path-method calls; same class as
    // fd's residual `Path::symlink_metadata` under-report.)
    if let Some(m) = path
        .strip_prefix("std::path::Path::")
        .or_else(|| path.strip_prefix("std::path::PathBuf::"))
    {
        const STAT: &[&str] = &[
            "metadata", "symlink_metadata", "canonicalize", "read_link", "read_dir", "exists",
            "try_exists", "is_file", "is_dir", "is_symlink",
        ];
        return STAT.contains(&m).then_some("Fs");
    }
    // OPTION-BUILDERS, the shape SPEC §1 ⟨0.32⟩ separates from an invocation object: "option-builders for
    // other effects (`OpenOptions`, request builders) stay pure because their resource arrives at the
    // terminal verb, which is charged at its own call site". An `OpenOptions` holds a handful of bools and
    // names no file; `DirBuilder` holds one bool and a mode. Both sit under the coarse `std::fs::` prefix
    // below, which charged Fs for `OpenOptions::new()` and for every `o.read(true)` — MEASURED: a
    // `let o = OpenOptions::new().read(true);` with no `open` ANYWHERE reported `Fs`.
    //
    // A DENYLIST, and keyed on the TYPE. Only the provably-pure setters/ctors are subtracted; anything
    // else under the type keeps its effect, so the terminal verb (`OpenOptions::open`, `DirBuilder::create`)
    // stays Fs and a std addition we have not read about fails in the safe direction. The type key is not
    // decoration: `create` is a pure flag SETTER on `OpenOptions` and the mkdir SYSCALL on `DirBuilder` —
    // one leaf, opposite answers. (candor-java keys the same carve-out by DESCRIPTOR, because its collision
    // is an overload — `command()` reads back, `command(List)` sets. Rust has no overloads, so the type IS
    // the discriminator; a bare-name denylist would silence `DirBuilder::create`.)
    if let Some(m) = path.strip_prefix("std::fs::OpenOptions::") {
        const PURE: &[&str] = &[
            // the builder itself + the std flag setters
            "new", "read", "write", "append", "truncate", "create", "create_new",
            // the platform extension setters (`OpenOptionsExt`, unix + windows)
            "mode", "custom_flags", "security_qos_flags", "access_mode", "share_mode", "attributes",
            // derives
            "clone", "default", "fmt", "eq", "ne", "hash",
        ];
        return (!PURE.contains(&m)).then_some("Fs");
    }
    if let Some(m) = path.strip_prefix("std::fs::DirBuilder::") {
        const PURE: &[&str] = &["new", "recursive", "mode", "clone", "default", "fmt"];
        return (!PURE.contains(&m)).then_some("Fs");
    }
    // THE PLATFORM `fs` MODULES — `std::os::{unix,windows,wasi}::fs`. Measured 2026-09-02, ground truth
    // EXECUTED (a `cargo run` that really created a symlink on disk and then stat'd it back):
    // `std::os::unix::fs::symlink`, `chown`, `lchown` and `chroot` all read PURE, so `deny Fs` over a
    // crate whose only filesystem write is a symlink exited 0. The `std::fs::` prefix below is the whole
    // filesystem rule and these modules are simply not under it — the platform-specific half of std's
    // filesystem API had no rule at all. (Found tracing why `tokio::fs::symlink` carries no `Fs` of its
    // own; its body is `asyncify(move || std::os::unix::fs::symlink(..))`.)
    //
    // A DENYLIST keyed on the TRAIT, exactly like `OpenOptions`/`DirBuilder` above and for the same
    // reason: subtract only the provably-pure surfaces, so a std addition nobody here has read about
    // fails in the SAFE direction. What is subtracted, and why each is pure:
    //   * `MetadataExt` / `DirEntryExt` / `FileTypeExt` — accessors over data ALREADY fetched by the
    //     `metadata()`/`read_dir()` call that is charged at its own site. `m.uid()` issues no syscall.
    //   * `PermissionsExt` — reads/sets bits on an in-memory `Permissions`; the syscall is
    //     `set_permissions`, charged under `std::fs::`.
    //   * `OpenOptionsExt` / `DirBuilderExt` — SPEC §1 ⟨0.32⟩ option-builders: the resource arrives at
    //     the terminal verb (`open`/`create`), which is charged at its own call site.
    // `FileExt` is deliberately NOT subtracted — `read_at`/`write_at`/`seek_read`/`seek_write` are the
    // positional-I/O syscalls and are exactly what this rule must keep.
    if let Some(rest) = path
        .strip_prefix("std::os::unix::fs::")
        .or_else(|| path.strip_prefix("std::os::windows::fs::"))
        .or_else(|| path.strip_prefix("std::os::wasi::fs::"))
    {
        const PURE_TRAITS: &[&str] = &[
            "MetadataExt::", "DirEntryExt::", "DirEntryExt2::", "FileTypeExt::",
            "PermissionsExt::", "OpenOptionsExt::", "DirBuilderExt::",
        ];
        return (!PURE_TRAITS.iter().any(|t| rest.starts_with(t))).then_some("Fs");
    }
    // THE PLATFORM `process` MODULES — `std::os::{unix,windows,wasi}::process`. SOUNDNESS R141, the
    // EXACT SIBLING of the `fs` rule above, and unruled for the same reason it was: R130 closed
    // `std::os::*::fs` and translated that question across ENGINES while never translating it across
    // SIBLING MODULES of the namespace it had just found unruled.
    //
    // Ground truth EXECUTED when the row was filed: a consumer printed `before`, then
    // `EXECED-THROUGH-LIB`, and never reached the following line — `CommandExt::exec` is `execvp` and
    // really does replace the process image. Re-measured at HEAD 2026-09-27 on a 5-function fixture:
    // `CommandExt::exec(c)`, `std::os::unix::process::CommandExt::exec(c)` and
    // `fn f<C: CommandExt>(c: &mut C) { c.exec() }` were all ABSENT from `functions[]` — no `Unknown`,
    // no `unresolved` — and `deny Exec`, `pure` and `deny Exec Unknown` all exited 0, while on the SAME
    // tree the RECEIVER spelling `c.exec()` exited 1 and the sibling-namespace UFCS control
    // `FileExt::read_at(f, b, 0)` exited 1. So this is the one-spelling-of-two shape of R130 itself:
    // `c.exec()` was only ever charged because the receiver types to `std::process::Command` and the
    // whole-type rule below answers; nothing answered for the trait-path spelling.
    //
    // A DENYLIST keyed on the TRAIT, exactly like the `fs` rule and for the same reason — subtract only
    // the provably-pure surfaces so a std addition nobody here has read about fails in the SAFE
    // direction. What is subtracted, and why each is pure:
    //   * `ExitStatusExt` / `ExitStatusError` / `ExitCodeExt` — accessors and constructors over an
    //     ALREADY-COLLECTED status (`signal()`, `core_dumped()`, `from_raw(n)`). The wait that produced
    //     it is charged at its own site under `std::process::Child`.
    //   * `parent_id` — `getppid()`, a read of this process's own identity, no spawn. Kept at PARITY
    //     with `std::process::id`, which carries no rule either; subtracting it here rather than
    //     leaving it to the Exec cliff is the one place this rule departs from "unrecognised keeps
    //     Exec", and it is named rather than folded in.
    // Everything else keeps Exec: `CommandExt::{exec, pre_exec, arg0, uid, gid, groups,
    // process_group}` and the windows `CommandExt::{creation_flags, raw_arg, …}` / `ChildExt`. That is
    // also what the receiver spelling already answers — `c.uid(0)` reports `['Exec']` at HEAD — so this
    // rule makes the two spellings agree rather than inventing a new verdict for either.
    if let Some(rest) = path
        .strip_prefix("std::os::unix::process::")
        .or_else(|| path.strip_prefix("std::os::windows::process::"))
        .or_else(|| path.strip_prefix("std::os::wasi::process::"))
    {
        const PURE: &[&str] =
            &["ExitStatusExt::", "ExitStatusError::", "ExitCodeExt::", "parent_id"];
        return (!PURE.iter().any(|t| rest.starts_with(t))).then_some("Exec");
    }
    // Filesystem. `tokio::fs`/`async_std::fs` are the async mirrors of `std::fs`; `async_fs` is
    // smol's fs crate; `fs_err` is a drop-in `std::fs` wrapper (its whole surface is fs I/O).
    if path.starts_with("std::fs::")
        || path.starts_with("tokio::fs::")
        || path.starts_with("async_std::fs::")
        || crate_name == "async_fs"
        || crate_name == "fs_err"
    {
        return Some("Fs");
    }
    // memmap2: only `MmapOptions::map*` (and the in-place `Mmap::flush`/`make_*` protection
    // changes / `remap`) actually issue the mmap/msync/mprotect/mremap syscall = Fs. The rest of the
    // crate is PURE: `MmapOptions::new`/setters BUILD the request, and once a region is mapped, reads
    // over it (`Mmap::len`/`is_empty`/`as_ptr`/`as_mut_ptr`/`deref` into the byte slice) are plain
    // memory access with no syscall. Whole-crate Fs fabricated Fs on those reads (a `m.len()` the
    // scanner's receiver inference routes to `memmap2::Mmap::len`). Match the syscall-issuing verbs;
    // everything else returns None (pure). `map*` covers `map`/`map_mut`/`map_exec`/`map_copy`/
    // `map_copy_read_only`/`map_raw`/`map_raw_read_only`/`map_anon`.
    if crate_name == "memmap2" {
        let m = path.rsplit("::").next().unwrap_or(path);
        if m.starts_with("map")
            || m == "flush"
            || m == "flush_async"
            || m == "flush_range"
            || m == "flush_async_range"
            || m == "remap"
            || m.starts_with("make_")
            || m == "advise"
            || m == "advise_range"
            || m == "lock"
            || m == "unlock"
        {
            return Some("Fs");
        }
        return None;
    }
    // tempfile: creating a temp file/dir touches the disk. Match the create/persist verbs (the
    // `Builder` setters — prefix/suffix/rand_bytes — stay pure). `persist`/`keep` rename/retain
    // the file on disk; `close` removes it.
    // SOUNDNESS R1528 (b10) — `TempDir::keep` is carved OUT of the `::keep` suffix below. See `tempfile_r1528`.
    if crate_name == "tempfile" {
        if matches!(type_method(path, "tempfile", &["", "dir"]), Some(("TempDir", "keep"))) {
            return None;
        }
        if let Some(effect) = tempfile_r1528(path) {
            return Some(effect);
        }
    }
    if crate_name == "tempfile"
        && (path.ends_with("::tempfile")
            || path.ends_with("::tempfile_in")
            || path.ends_with("::tempdir")
            || path.ends_with("::tempdir_in")
            || path.ends_with("NamedTempFile::new")
            || path.ends_with("NamedTempFile::new_in")
            || path.ends_with("TempDir::new")
            || path.ends_with("TempDir::new_in")
            || path.ends_with("::persist")
            || path.ends_with("::persist_noclobber")
            || path.ends_with("::keep"))
    {
        return Some("Fs");
    }
    // THE COVERAGE-GATE SWEEP (2026-08-27), verified against tempfile 3.27.0 source — the SIBLING
    // constructors/closers the create/persist verb list above never reached:
    //
    // `Builder::make`/`make_in` (lib.rs:716,739) are the crate's OWN documented escape hatch for a
    // caller-supplied factory (`Builder::new().make_in(dir, |path| UnixListener::bind(path))`) — real
    // disk creation via `util::create_helper`, same mechanism as `Builder::tempfile`/`tempfile_in`
    // two lines up, just a different entry verb.
    // `NamedTempFile::with_prefix`/`with_prefix_in`/`with_suffix`/`with_suffix_in` (file/mod.rs:630-677)
    // are one-call convenience wrappers documented as equivalent to `Builder::new().prefix(..).tempfile()`
    // — real creation, missing because the verb list matched `NamedTempFile::new`/`new_in` but not these.
    // `NamedTempFile::reopen` (file/mod.rs:951) calls the platform `imp::reopen`, a real `open`/`fstat`
    // pair (found the original file was replaced, or hands back a fresh handle to it).
    // `TempPath::close` (file/mod.rs:161) and `TempDir::close` (dir/mod.rs:470) `fs::remove_file`/
    // `remove_dir_all` the real path — `NamedTempFile::close` (file/mod.rs:727) is a thin `self.path.close()`
    // delegate to the same `TempPath::close`, so matching the `::close` suffix (crate-gated, and the ONLY
    // three `pub fn close` in this crate) catches it too without a separate rule.
    // `SpooledTempFile::set_len` (spooled.rs:134) calls `File::set_len` on the real disk file once the
    // in-memory buffer has spilled past `max_size` — the crate's own roll-over threshold, not a corner case.
    //
    // NOT included: `tempfile::create`/`create_named`/`reopen` (dir/imp/any.rs, file/imp/windows.rs,
    // file/imp/unix.rs) — despite being `pub fn`, `mod dir;`/`mod file;` are PRIVATE at the crate root
    // (lib.rs:202,204) with no re-export of the `imp` submodules, so no external consumer can ever name
    // these paths; the ratchet's generator guesses a crate-root alias for every candidate regardless of
    // whether one is real (the same "second, related shape" gap the previous pass's rusqlite/lettre
    // private-module findings already documented — restricted_types()/is_bare_pub check a type's or fn's
    // OWN visibility keyword, not its enclosing module chain). Removed from open.tsv rather than guessed.
    if crate_name == "tempfile"
        && (path == "tempfile::Builder::make"
            || path == "tempfile::Builder::make_in"
            || path == "tempfile::NamedTempFile::with_prefix"
            || path == "tempfile::NamedTempFile::with_prefix_in"
            || path == "tempfile::NamedTempFile::with_suffix"
            || path == "tempfile::NamedTempFile::with_suffix_in"
            || path == "tempfile::NamedTempFile::reopen"
            || path == "tempfile::SpooledTempFile::set_len"
            || path.ends_with("::close"))
    {
        return Some("Fs");
    }
    // SOUNDNESS R1528 — two more families the verb lists above did not reach, both EXECUTED 2026-11-08
    // against tempfile 3.27.0 and read in source:
    //
    // `NamedTempFile::into_file` (file/mod.rs:894) moves the `File` out and DROPS the `TempPath`, whose
    // `Drop` unlinks the path (its doc: "the underlying file will be removed from the filesystem"). The run
    // printed `exists-before=true`, `exists-after-into_file=false`. A filesystem mutation with no `fs::`
    // in sight, which is why it read pure. (`SpooledTempFile::into_file` is a different body and is not
    // claimed; `TempDir::into_path` only flips a flag — verified FALSE by the independent reader.)
    //
    // `TempDir::with_prefix`/`with_prefix_in`/`with_suffix`/`with_suffix_in` (dir/mod.rs:269-350) are
    // one-line wrappers over `Builder::tempdir`/`tempdir_in`, the same directory creation `TempDir::new`
    // is already charged for. Fs (the creation), the bucket `TempDir::new` carries — the oracle's
    // Env/Rand are the name generation and are not what the call is for.
    if crate_name == "tempfile"
        && (path == "tempfile::NamedTempFile::into_file"
            || path == "tempfile::TempDir::with_prefix"
            || path == "tempfile::TempDir::with_prefix_in"
            || path == "tempfile::TempDir::with_suffix"
            || path == "tempfile::TempDir::with_suffix_in")
    {
        return Some("Fs");
    }
    // glob: walks the filesystem to expand a pattern (the returned iterator reads directories).
    // `Pattern::matches` is pure string matching — match only the directory-walking entry points.
    if crate_name == "glob" && (path.ends_with("::glob") || path.ends_with("::glob_with")) {
        return Some("Fs");
    }
    // Password-hashing / KDF crates — the entropy tier (the TS engine's CTA lesson: an invisible
    // argon2 landed on exactly the call a security review cares about). In this engine's
    // verb-precise style the ENTROPY is the salt mint: `SaltString::generate(OsRng)` in the
    // password-hash API family, and bcrypt's `hash`/`hash_with_result` (salt minted internally).
    // Verification and explicit-salt hashing are deterministic recomputation — pure. `rand_core`
    // carries the OsRng source itself (otherwise the most common salt mint is invisible).
    if matches!(crate_name, "argon2" | "scrypt" | "pbkdf2" | "password_hash") {
        // SOUNDNESS R318 — `SaltString::generate` was this block's ONLY match target and the type was
        // DELETED upstream in password-hash 0.6.0 (0.5.0: 21 occurrences; 0.6.1: zero). Everything below
        // it fell through to `return None`, so all four crates asserted purity — including on
        // `argon2.hash_password(password)`, the one-argument DEFAULT TRAIT METHOD at
        // `password-hash-0.6.1/src/lib.rs:107` whose body is `let salt = try_generate_salt()?;`. That is
        // the most documented call shape in the family, minting OS entropy, reading pure, on crates whose
        // entire purpose is a security review.
        //
        // `ends_with`, NOT `contains`: `hash_password_with_salt` takes an explicit salt and is
        // deterministic recomputation — correctly PURE — and a `contains` match would fabricate `Rand`
        // on it. `hash_password_with_rng` DOES draw, from the caller's RNG, so it is charged.
        // The old `SaltString::generate` clause is kept: it is still the right answer for 0.5.x.
        if path.contains("SaltString::generate")
            || path.ends_with("::generate_salt")
            || path.ends_with("::try_generate_salt")
            // SOUNDNESS R330 — this suffix is a DEFAULT, refined by arity at the call site. `hash_password`
            // is one name with two signatures (see `password_hash_explicit_salt` below), and the path
            // cannot tell them apart. Charging here and NARROWING there is deliberate: a consumer that
            // never consults the refinement keeps the over-report, never the silence.
            || path.ends_with("::hash_password")
            || path.ends_with("::hash_password_with_rng")
        {
            return Some("Rand");
        }
        return None;
    }
    if crate_name == "bcrypt" {
        // SOUNDNESS R319 — this list was EXACTLY bcrypt's internal-salt surface at 0.15.1 and fell
        // behind by ADDITION, not by rename: 0.19.3 adds four more verbs that each document "the salt
        // is generated randomly using the OS randomness" and reach `getrandom::fill`. A stale-PATH
        // check could never have found this, because every old path still exists and still works —
        // a version ceiling catches additions, a path check only catches removals.
        // The explicit-salt family (`hash_with_salt`, `hash_with_salt_bytes`,
        // `non_truncating_hash_with_salt*`) stays PURE: the caller supplies the salt.
        if path.ends_with("::hash")
            || path.ends_with("::hash_with_result")
            || path.ends_with("::non_truncating_hash")
            || path.ends_with("::hash_bytes")
            || path.ends_with("::non_truncating_hash_bytes")
            || path.ends_with("::non_truncating_hash_with_result")
        {
            return Some("Rand");
        }
        return None;
    }
    if crate_name == "rand_core" {
        if path.contains("OsRng")
            || path.ends_with("::next_u32")
            || path.ends_with("::next_u64")
            || path.ends_with("::fill_bytes")
            // SOUNDNESS R333 — the FALLIBLE trait. rand_core 0.10 splits `RngCore` from `TryRngCore`,
            // and `SysRng` (the renamed `OsRng`) is fallible, so `try_next_u32` is the natural API on
            // it. `ends_with("::next_u32")` does NOT match `::try_next_u32`, so the modern spelling of
            // a real entropy draw read PURE. Third instance in one day, after R319 and R321, of the
            // same shape: an upstream rename is rarely just a rename — it arrives with an API SHAPE
            // change, and a suffix list written against the old shape stops covering the new one.
            || path.ends_with("::try_next_u32")
            || path.ends_with("::try_next_u64")
            || path.ends_with("::try_fill_bytes")
        {
            return Some("Rand");
        }
        return None;
    }
    // Randomness / entropy. `getrandom`/`fastrand` are effectful end-to-end. `rand` is NOT — it
    // mixes entropy/generation (effectful) with *pure* distribution constructors (`Uniform::new`,
    // `Normal::new`) and deterministic-seed constructors (`seed_from_u64`). Flagging the whole crate
    // over-reported those as `Rand`; match only the calls that actually consume randomness — the
    // entropy sources (`OsRng`, `thread_rng`/`rng`, `from_entropy`/`from_os_rng`) and the generation
    // verbs (`gen*`/`random*`/`fill*`/`sample*`/`next_u*`). A `Uniform::new` is now correctly pure.
    if crate_name == "getrandom" {
        // SOUNDNESS R1150 — …except its ERROR VALUE. `getrandom::Error` is a wrapped error code; its own methods
        // (`raw_os_error`, `code`, `new_custom`, the derived `eq`/`hash`, `Debug`/`Display`) read or format that
        // code and draw nothing. Charged with the crate, rand_core 0.9.x's DERIVED `OsError::eq` read `Rand`
        // (EXECUTED: no draw happens). Every drawing entry point (`fill`, `fill_uninit`, `u32`, `u64`,
        // `getrandom`, `SysRng`'s methods) is not on `Error`, and keeps `Rand`.
        // `&Error` is the by-reference operator key (`getrandom::&Error::eq`, R1131).
        if path.split("::").skip(1).any(|s| s.trim_start_matches('&') == "Error") {
            return None;
        }
        return Some("Rand");
    }
    // fastrand: like `rand`, it mixes entropy-consuming generation (effectful) with PURE deterministic
    // pieces. `Rng::with_seed(42)` is a DETERMINISTIC seeded constructor (consumes no entropy — the same
    // seed gives the same stream), and `Rng::fork`/`Rng::clone` just split/copy existing state. Those are
    // PURE; whole-crate Rand fabricated Rand on them. The effect is the value-drawing methods (`u32`/
    // `usize`/`bool`/`f64`/`char`/`alphanumeric`/`choice`/`choose_multiple`/`shuffle`/`fill`/the range
    // forms) AND the entropy-seeded entry points: bare `Rng::new()` (seeds from the global entropy-backed
    // generator), `fastrand::seed`, and the top-level `fastrand::u32(..)` free functions (which draw from
    // the thread-local generator). `with_seed` is exempted explicitly; any other method on an `Rng`
    // (i.e. a value draw) is Rand.
    if crate_name == "fastrand" {
        let m = path.rsplit("::").next().unwrap_or(path);
        // Provably pure: deterministic seeded ctor + state split/copy.
        if m == "with_seed" || m == "fork" || m == "clone" {
            return None;
        }
        // Everything else fastrand exposes either draws a value or seeds from entropy → Rand. (The crate
        // has no pure data types beyond the `Rng` handle itself, so a non-draw stray would have to be a
        // method we don't recognise — keep the effect, the safe direction.)
        return Some("Rand");
    }
    if crate_name == "rand" {
        let rng_verb = path.ends_with("::gen")
            || path.ends_with("::gen_range")
            || path.ends_with("::gen_bool")
            || path.ends_with("::gen_ratio")
            || path.ends_with("::random")
            || path.ends_with("::random_range")
            || path.ends_with("::random_bool")
            || path.ends_with("::random_ratio")
            || path.ends_with("::random_iter") // rand 0.9 iterator generator
            || path.ends_with("::gen_iter")
            || path.ends_with("::fill")
            || path.ends_with("::fill_bytes")
            || path.ends_with("::try_fill")
            || path.ends_with("::try_fill_bytes")
            || path.ends_with("::sample")
            || path.ends_with("::sample_iter")
            || path.ends_with("::next_u32")
            || path.ends_with("::next_u64")
            // SOUNDNESS R333 — the FALLIBLE trait, in the `rand` block as well as `rand_core`'s. Two
            // verb lists answer one question ("is this a draw?") and only one had been widened, which
            // is why the first half of this fix moved nothing: correct code on a path the call does not
            // take. `TryRngCore`'s verbs are the natural API on the fallible `SysRng`.
            || path.ends_with("::try_next_u32")
            || path.ends_with("::try_next_u64")
            || path.ends_with("::thread_rng")
            || path.ends_with("::rng")
            || path.ends_with("::from_entropy")
            || path.ends_with("::from_os_rng");
        // `OsRng` is the OS entropy SOURCE, but `clone`/`fork`/`default` just copy or construct the
        // (zero-sized) handle and draw no entropy — pure, exactly like the `fastrand` arm's clone/fork
        // exemption above. The actual draws (`fill_bytes`/`next_u*`/…) are caught by `rng_verb`. Without
        // this exemption the blanket `contains("OsRng")` fabricated `Rand` on `OsRng::clone` (adversarial
        // review: OsRng is a unit struct, cloning consumes nothing).
        let m = path.rsplit("::").next().unwrap_or(path);
        let os_rng = path.contains("OsRng") && !matches!(m, "clone" | "fork" | "default");
        // SOUNDNESS R320 — …and the SAME clause for the type's CURRENT NAME. rand 0.10 renamed the OS
        // entropy source to `SysRng` and moved it to `getrandom`, re-exporting it as
        // `rand::rngs::SysRng` (`rand-0.10.2/src/rngs/mod.rs:119`). Measured, not assumed: candor
        // resolves the crate from the path the CONSUMER writes, so `rand::rngs::SysRng` arrives with
        // crate_name `rand` and lands here — NOT in getrandom's whole-crate exemption, which is what
        // R320 left open. The asymmetry that leaves was executed on a fixture: with `OsRng` as the
        // receiver an unrecognised verb charges `Rand` (the `contains` clause is the safety margin over
        // the verb list); with `SysRng` it read PURE. So the margin protected the DELETED spelling and
        // not its replacement, which is the wrong way round for a type whose only purpose is to draw
        // from the OS. Same construction exemption for the same reason — `SysRng` is a unit struct
        // (`getrandom-0.4.3/src/sys_rng.rs:34`), so copying the handle consumes nothing.
        let sys_rng = path.contains("SysRng") && !matches!(m, "clone" | "fork" | "default");
        // §E1 HIT COUNTER (`CANDOR_ALIAS_DEBUG`), for `bin/corpus-ab.py --mark`: a widened charge that
        // moves no rows is either inert or unreached, and those two print identically.
        if sys_rng && candor_report::env::trace("CANDOR_ALIAS_DEBUG") {
            eprintln!("R320SYSRNG {path}");
        }
        if rng_verb || os_rng || sys_rng {
            return Some("Rand");
        }
        return None;
    }
    // Subprocess spawning. `tokio::process` is the async mirror of `std::process` — it exists
    // only to spawn/control subprocesses (`Command`/`Child`, no pure data types like std's
    // `Stdio`/`ExitStatus`/`exit`), so spawning through it is Exec just the same. Without this an
    // async app's `tokio::process::Command::new(..).spawn()` classified pure — a silent under-report
    // of subprocess execution, the dangerous direction (mirrors the tokio::fs/tokio::net coverage).
    if path.starts_with("std::process::Command")
        || path.starts_with("std::process::Child")
        || path.starts_with("tokio::process::Command")
        || path.starts_with("tokio::process::Child")
        || path.starts_with("async_std::process::Command")
        || path.starts_with("async_std::process::Child")
    {
        // PURE read-backs of the builder's stored fields / the cached pid — no spawn, no syscall — so the
        // whole-type Exec rule fabricated Exec on them (sweep [23]; mirrors the portable_pty getter carve-
        // out just below). get_program/get_args/get_envs/get_current_dir read the Command; Child::id reads
        // the cached pid. Every genuine verb (new/spawn/output/status/wait/kill) stays Exec.
        if path.ends_with("::get_program")
            || path.ends_with("::get_args")
            || path.ends_with("::get_envs")
            || path.ends_with("::get_current_dir")
            || path.ends_with("Child::id")
        {
            return None;
        }
        return Some("Exec");
    }
    // portable_pty / async_process are whole-crate Exec EXCEPT for the proven-pure surface they expose:
    // the `CommandBuilder` GETTERS (`get_argv`/`get_cwd`/`get_env`/`as_unix_command_line`…) read back
    // configuration, and the PURE DATA types (`PtySize::default`, `ExitStatus`/`Stdio`/`CommandBuilder`
    // construction/setters). The earlier `is_cmd_naming_method` fix stopped the head-refinement LEAK, but
    // the BASE Exec still fabricated on these accessors (a `cmd.get_cwd()` the scanner routes to
    // `portable_pty::CommandBuilder::get_cwd`). Subtract the read-back getters and the obvious pure
    // ctors/setters; the spawn/wait/exec surface (`spawn_command`/`openpty`/`wait`/`kill`/`exec`…) keeps
    // Exec. SUBTRACT only what is provably pure — when unrecognised, KEEP Exec (the safe direction).
    if crate_name == "async_process" || crate_name == "portable_pty" {
        let m = path.rsplit("::").next().unwrap_or(path);
        // THE COVERAGE-GATE SWEEP (2026-08-27): `CommandBuilder::get_shell` (cmdbuilder.rs:544, unix)
        // LOOKS like a config read-back getter — same `get_` naming as the pure getters below — but its
        // unix body calls `nix::unistd::access(shell, X_OK)`, a real filesystem-access syscall, before
        // falling back to a password-database lookup if `$SHELL` isn't set or isn't executable. Carved
        // out of the `get_` prefix exemption BEFORE it, not folded into it — the one getter this crate
        // exposes that is not actually pure. Verified against portable-pty 0.9.0.
        if m == "get_shell" {
            return Some("Fs");
        }
        // configuration read-back getters — pure (no spawn).
        if m.starts_with("get_") || m == "as_unix_command_line" {
            return None;
        }
        // pure data-type ctors/setters/derives that NAME no program and spawn nothing.
        if matches!(
            m,
            "default" | "new" | "piped" | "null" | "inherit" | "from_raw_fd"
                | "arg" | "args" | "arg0" | "env" | "envs" | "env_clear" | "env_remove"
                | "cwd" | "current_dir" | "rows" | "cols"
                | "clone" | "fmt" | "eq" | "ne" | "hash"
        ) {
            return None;
        }
        return Some("Exec");
    }
    // duct: a subprocess-orchestration crate. `cmd()`/`cmd!` only *build* an Expression; the
    // spawn/wait happens at `run`/`read`/`start`. Match the execution verbs, not the builder.
    if crate_name == "duct"
        && (path.ends_with("::run")
            || path.ends_with("::read")
            || path.ends_with("::start")
            || path.ends_with("::read_chars")
            // `Expression::reader` (lib.rs:357) calls the already-covered `.start()` internally to
            // launch the child and hands back a streaming `ReaderHandle` — a distinct public entry
            // point from `start` itself, so the suffix match above never reached it.
            || path.ends_with("Expression::reader"))
    {
        return Some("Exec");
    }
    if path.starts_with("std::env::") {
        return Some("Env");
    }
    // dotenvy / dotenv: load environment variables (reading a `.env` file and mutating the process
    // environment). Match the load/read entry points; `Error`/builder types stay pure.
    if matches!(crate_name, "dotenvy" | "dotenv")
        && (path.ends_with("::dotenv")
            || path.ends_with("::dotenv_override")
            || path.ends_with("::from_path")
            || path.ends_with("::from_path_override")
            || path.ends_with("::from_filename")
            || path.ends_with("::from_filename_override")
            || path.ends_with("::from_read")
            || path.ends_with("::from_read_override")
            || path.ends_with("::load")
            || path.ends_with("::var")
            || path.ends_with("::vars"))
    {
        return Some("Env");
    }
    // THE COVERAGE-GATE SWEEP (2026-08-27), verified against dotenv 0.15.0 and dotenvy 0.15.7
    // (byte-identical shape in both crates) — the ITERATOR-returning siblings of the load verbs above,
    // which return the parsed pairs instead of mutating the environment but still touch disk to get
    // them: `dotenv_iter`/`from_filename_iter` (lib.rs) resolve and open a `.env`-shaped file exactly
    // like `dotenv`/`from_filename` two lines up (same `Finder::new().find()` call); `from_path_iter`
    // opens the given path directly. Bucketed `Env` for consistency with the rest of this family rather
    // than `Fs` (self-scan's raw signal): the crate's OWN purpose is env-var loading, and splitting the
    // iterator variants into a different effect bucket from their non-iterator siblings would be an
    // arbitrary distinction a reviewer gains nothing from.
    //
    // NOT included: `Finder::find` / the free fn `find` (find.rs) — both are used only via a PRIVATE
    // `use crate::find::Finder;` (no `pub use`) inside a private `mod find;` (lib.rs), so neither
    // `dotenv(y)::Finder` nor `dotenv(y)::find` is a path any external consumer can compile a call to;
    // the ratchet's generator still guesses a crate-root alias for every candidate (the same private-
    // module shape as tempfile's `imp::` functions above). Removed from open.tsv rather than guessed.
    if matches!(crate_name, "dotenvy" | "dotenv")
        && (path.ends_with("::dotenv_iter")
            || path.ends_with("::from_filename_iter")
            || path.ends_with("::from_path_iter"))
    {
        return Some("Env");
    }
    // Wall-clock reads. Match the `now` accessor precisely (ends_with), not any path
    // containing the substring "now". The `time` crate (distinct from `std::time`/`chrono`)
    // reads the clock via `now_utc`/`now_local` (and the deprecated `Instant::now`).
    if (crate_name == "chrono" || path.starts_with("std::time::")) && path.ends_with("::now") {
        return Some("Clock");
    }
    // SOUNDNESS R1528 — chrono's deprecated `Utc::today()` / `Local::today()` are `Utc::now().date()` /
    // `Local::now().date()` (offset/utc.rs:63, offset/local/mod.rs:133): the wall clock, spelled without the
    // `now` the rule above matches. Exact receivers only — `today` is not claimed for any other chrono type.
    // EXECUTED 2026-11-08: both return the current date. Their absence read PURE at every consumer.
    if crate_name == "chrono" && (path.ends_with("Utc::today") || path.ends_with("Local::today")) {
        return Some("Clock");
    }
    // SOUNDNESS R1528 — chrono 0.4.45 `Local`'s four `TimeZone` offset lookups (offset/local/mod.rs:177-194 ->
    // unix.rs `offset`): each goes through the per-thread `Cache`, whose `offset` calls `SystemTime::now()` on EVERY
    // lookup to decide whether the cached zone is older than a second, and whose first use per thread (and every
    // refresh) reads `TZ` and `/etc/localtime` (or the file `TZ` names). EXECUTED (fx_chrono): the offset follows `TZ`
    // and an unset `TZ` follows the system file; a mid-run `TZ` change is NOT seen for the first second and IS seen
    // after 1.2s, i.e. the wall clock gates the re-read. `Local::now` (above) is `Utc::now().with_timezone(&Local)`
    // and carries the same single `Clock`, so these are charged the one effect the call makes unconditionally.
    // KNOWN GAP, not a choice: `classify` carries ONE effect per path and the real set is Clock + Env + Fs (Env/Fs
    // once per thread and per refresh), so `deny Env`/`deny Fs` over a consumer of these still passes — filed with
    // the coordinator. Only the concrete `Local` receiver is claimed: the generic `TimeZone::offset_from_*` and
    // `DateTime::with_timezone<Tz>` forwarders are the type argument's effect (R1557, `OPEN_ENTRY_VERDICTS`).
    if crate_name == "chrono" {
        if let Some((ty, m)) = type_method(path, "chrono", &["", "offset", "offset::local"]) {
            if ty == "Local"
                && matches!(m, "offset_from_utc_datetime" | "offset_from_local_datetime" | "offset_from_utc_date"
                    | "offset_from_local_date")
            {
                return Some("Clock");
            }
            // SOUNDNESS R1616 (provided-member half) — `TimeZone`'s PROVIDED members on `Local`. Their default bodies
            // (offset/mod.rs) call `self.offset_from_*` (directly, or through `from_utc_datetime`/`from_local_datetime`/
            // `from_local_date`), which `Local` implements with the lookups charged above; `Local` overrides none of them.
            // The consumer's typed call is `chrono::Local::from_utc_datetime`, and with no row the calibrated crate read it
            // PURE: `chrono::Local.from_utc_datetime(n)` was ABSENT. EXECUTED (rustagent-recv `fx/c`, DYLD interposer), every
            // name below on a valid input: 2 clock reads + getenv TZ + open /etc/localtime. Same single-effect convention
            // (and the same Env/Fs gap) as the four lookups.
            if ty == "Local"
                && matches!(m, "from_utc_datetime" | "from_utc_date" | "from_local_datetime" | "from_local_date"
                    | "with_ymd_and_hms" | "ymd" | "ymd_opt" | "yo" | "yo_opt" | "isoywd" | "isoywd_opt" | "timestamp"
                    | "timestamp_opt" | "timestamp_millis" | "timestamp_millis_opt" | "timestamp_nanos" | "timestamp_micros"
                    | "datetime_from_str")
            {
                return Some("Clock");
            }
        }
    }
    if crate_name == "time"
        && (path.ends_with("::now_utc") || path.ends_with("::now_local") || path.ends_with("::now"))
    {
        return Some("Clock");
    }
    // SOUNDNESS R1288 — THIRD-PARTY CLOCK WRAPPERS. `tokio::time::Instant::now()` reads the monotonic clock (through
    // tokio's mockable time source) exactly as `std::time::Instant::now()` does, and read PURE: tokio-util's
    // `DelayQueue::insert`/`reset` and tokio-stream's `throttle` were covered only by a false `ambiguous:` hedge in
    // v0.40.13. The same `now` accessor on the dedicated clock crates' instant types: `quanta` (`Instant::now`,
    // `Clock::now`), `minstant`, `web_time`, `instant`, `coarsetime` (`Instant::now`). `now` only — their arithmetic and
    // conversions are pure.
    if path.ends_with("::now")
        && (path.starts_with("tokio::time::Instant::")
            || matches!(crate_name, "quanta" | "minstant" | "web_time" | "instant" | "coarsetime"))
    {
        return Some("Clock");
    }
    // `tracing`: same principle as the `log` facade below — the crate's TYPES are pure data, so match
    // the emit, not the whole crate. The actual program output is the macro-expanded
    // `Subscriber::event`/`event!`/`Span::*enter*` dispatch and the `Span::new*`/`Span::record`
    // recording path that drives the subscriber. The data-type accessors — `Level::as_str`,
    // `Span::is_disabled`/`metadata`/`id`, and constructing/reading `Level`/`LevelFilter`/`Span`/
    // `Event`/`Metadata`/`Field`/`FieldSet`/`Id` — are PURE (no output is produced), so whole-crate Log
    // fabricated Log on them. Match the emit verbs; everything else returns None.
    if crate_name == "tracing" {
        let m = path.rsplit("::").next().unwrap_or(path);
        // The user-facing emit MACROS (`tracing::info!`/`warn!`/…) — candor-scan is pre-expansion, so it
        // sees the raw macro path `tracing::info`, not the expanded `__tracing`/`Subscriber::event` the
        // deep (post-expansion) engine sees. Only the macro names; the pure DATA types (Level/Span/Event)
        // have other tails and stay None.
        if m == "trace" || m == "debug" || m == "info" || m == "warn" || m == "error"
            || m == "trace_span" || m == "debug_span" || m == "info_span" || m == "warn_span"
            || m == "error_span" || m == "span"
            || m == "event"
            || m == "new_span"
            || m == "record"
            || m == "record_follows_from"
            || m == "enter"
            || m == "exit"
            || m == "in_scope"
            || m == "entered"
            || path.contains("::__macro_support")
            || path.contains("::__tracing")
            || path.contains("Subscriber::event")
            || path.contains("Subscriber::new_span")
            || path.contains("Subscriber::enter")
            || path.contains("Subscriber::exit")
        {
            return Some("Log");
        }
        return None;
    }
    // The `log` facade: its macros route through `log::__private_api`; the crate's types
    // (`Level`, `LevelFilter`) are pure, so match the logging entry, not the whole crate.
    if crate_name == "log" {
        // Expanded macro form (deep engine) OR the raw user-facing macro names (candor-scan, pre-expansion).
        // `log::Level`/`LevelFilter`/`Record`/`Metadata` have other tails, so the type surface stays pure.
        let m = path.rsplit("::").next().unwrap_or(path);
        if path.contains("::__private_api")
            || m == "error" || m == "warn" || m == "info" || m == "debug" || m == "trace" || m == "log"
        {
            return Some("Log");
        }
    }
    // Compiler diagnostic emission — the ONE genuinely effectful operation in the otherwise-pure
    // rustc_* surface (a dylint lint's actual OUTPUT: it writes warnings/errors to the compiler's
    // diagnostic sink). Classified `Log` (same family as `tracing`/`log` — program output). Match the
    // emission verbs precisely; rustc_lint/rustc_errors are mostly pure types (Lint, LintId, the Diag
    // BUILDERS), and only the terminal `emit`/`emit_span_lint` actually produces output.
    if crate_name == "rustc_lint"
        && (path.ends_with("::emit_span_lint")
            || path.ends_with("::span_lint")
            || path.ends_with("::span_lint_hir"))
    {
        return Some("Log");
    }
    if crate_name == "rustc_errors"
        && (path.ends_with("::emit")
            || path.ends_with("::emit_diagnostic")
            || path.ends_with("::emit_now"))
    {
        return Some("Log");
    }
    // arboard: the effectful surface is the `Clipboard` handle's read/write verbs (each talks to the
    // OS clipboard / X11/Wayland/Win32/NSPasteboard server). The data types — chiefly `arboard::Error`
    // (whose `Display`/`to_string` formatting is pure) and the `ImageData`/`GetExtLinux`/`SetExtLinux`
    // option types — are PURE, so whole-crate Clipboard fabricated Clipboard on e.g. an error
    // `to_string()`. Match the handle verbs; everything else returns None. `Clipboard::new` opens the
    // connection to the clipboard server, so it's an effect too; `get`/`set` return the
    // builder-then-read `Get`/`Set` cursors whose `text`/`image`/`html` terminals do the I/O.
    //
    // THE ~79-CRATE R59-CLASS AUDIT (2026-08-28), verified against arboard 3.6.1: `file_list`
    // (lib.rs:205,251, `Get::file_list`/`Set::file_list`) is the SAME builder-then-terminal shape as
    // `text`/`image`/`html` two lines up — reading/writing the clipboard's file-path list — but was
    // missing, not because it's ambiguous (it's the only `file_list` in the crate) but because
    // `eval/coverage-gate/generate.py`'s own generator only triggers on a self-scan `inferred` set
    // containing Fs/Net/Db/Exec; Clipboard isn't in that trigger set, so a missing Clipboard verb is
    // structurally invisible to the completeness gate regardless of phrasing. `Clear::default`
    // (lib.rs:265) is `Clipboard::clear`'s own documented alternate entry point
    // (`clear() { self.clear_with().default() }`, lib.rs:156-158) — the SAME "sibling constructor"
    // shape as `ignore::Walk::new` beside `WalkBuilder::build`; `clear_with()` itself doesn't share
    // `clear`'s leaf, so neither the constructor nor its terminal was covered. `default` is otherwise
    // unused in this crate (no derived `Default` impls), so the bare leaf carries no fabrication risk
    // once crate-gated.
    if crate_name == "arboard" {
        let m = path.rsplit("::").next().unwrap_or(path);
        if m == "new"
            || m == "get"
            || m == "set"
            || m == "clear"
            || m == "get_text"
            || m == "set_text"
            || m == "set_html"
            || m == "get_image"
            || m == "set_image"
            || m == "text"
            || m == "image"
            || m == "html"
            || m == "file_list"
            || m == "default"
        {
            return Some("Clipboard");
        }
        return None;
    }
    // ── Coverage-differential additions (calibrated against each crate's real API; see the per-crate
    //    notes). All verb-keyed + crate-gated, with the pure builder/config/data surface returning None.

    // `etcetera` — XDG/known-folder base+app directory resolution. Each dir ACCESSOR reads the
    // environment at call time (`$HOME`/`$XDG_*` on Unix, `%APPDATA%`/`%LOCALAPPDATA%` on Windows), and
    // the `choose_*`/`home_dir` entry points read `$HOME`. The `AppStrategyArgs` data struct and the
    // strategy types themselves are PURE. (Found DISCLOSED-but-unmodeled in 3/4 differential projects.)
    if crate_name == "etcetera" {
        let m = path.rsplit("::").next().unwrap_or(path);
        if m == "home_dir"
            || m == "choose_base_strategy" || m == "choose_native_strategy" || m == "choose_app_strategy"
            || m == "config_dir" || m == "data_dir" || m == "cache_dir"
            || m == "state_dir" || m == "runtime_dir" || m == "data_local_dir"
        {
            return Some("Env");
        }
        return None;
    }
    // `sqlx-core` (crate `sqlx_core`) — the execution terminals under the sqlx core (the `sqlx` builder
    // table maps `sqlx::query*`; here it's the core `Executor`/`Connection`/`Pool` round-trips). Opening
    // the connection is the network boundary (Net); the query/transaction round-trips are Db. The
    // `*Options`/query-builder/row data types are PURE. Crate-gated so the generic verbs never spread.
    if crate_name == "sqlx_core" {
        if path.ends_with("::connect") || path.ends_with("::connect_with") {
            return Some("Net");
        }
        // SOUNDNESS R1528 — sqlx-core 0.9.0, the pool / migrate / net / logger rows. See `sqlx_r1528`.
        if let Some(effect) = sqlx_r1528("sqlx_core", path) {
            return Some(effect);
        }
        if path.ends_with("::fetch") || path.ends_with("::fetch_all") || path.ends_with("::fetch_one")
            || path.ends_with("::fetch_optional") || path.ends_with("::fetch_many")
            || path.ends_with("::execute") || path.ends_with("::execute_many")
            || path.ends_with("::prepare") || path.ends_with("::prepare_with")
            || path.ends_with("::acquire") || path.ends_with("::begin") || path.ends_with("::ping")
        {
            return Some("Db");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against sqlx-core 0.8.6/0.9.0 (identical
        // shape in both) — the free-function surface under `pub mod fs`/`pub mod net::tls`/
        // `pub mod migrate`, none of which end in the connect/fetch/execute verbs above:
        //
        // `fs::{read,read_to_string,create_dir_all,remove_file,remove_dir,remove_dir_all,read_dir}`
        // (fs.rs) are direct `std::fs::*` calls off-loaded to `spawn_blocking` — sqlx's OWN async
        // filesystem shim, used by the migrator to read `.sql` files and by SQLite to manage on-disk
        // databases. `net::tls::handshake` (net/tls/mod.rs:69) is the real TLS handshake dispatch
        // reqwest/ureq-style crates already model — sqlx has its OWN copy because it drives the
        // handshake over its own `Socket` trait rather than a `TcpStream` directly.
        // `migrate::resolve_blocking`/`resolve_blocking_with_config` (migrate/source.rs:151,156) are
        // `#[doc(hidden)]` but still `pub use`-exported at `sqlx_core::migrate` (mod.rs:16) — real,
        // callable, and reads the migrations directory off disk (`fs::read_dir` + per-file `canonicalize`).
        //
        // NOT included: `net::tls::tls_rustls::RustlsSocket::poll_{flush,read_ready,write_ready,
        // shutdown}` — `RustlsSocket` is declared inside `mod tls_rustls;` (net/tls/mod.rs), which is
        // PRIVATE with no re-export, so no external consumer can ever name it (the same private-module
        // shape as tempfile's `imp::` functions above). Removed from open.tsv rather than guessed.
        if path == "sqlx_core::fs::read"
            || path == "sqlx_core::fs::read_to_string"
            || path == "sqlx_core::fs::create_dir_all"
            || path == "sqlx_core::fs::remove_file"
            || path == "sqlx_core::fs::remove_dir"
            || path == "sqlx_core::fs::remove_dir_all"
            || path == "sqlx_core::fs::read_dir"
            || path.ends_with("::migrate::resolve_blocking")
            || path.ends_with("::migrate::resolve_blocking_with_config")
            || path == "sqlx_core::config::Config::try_from_path"
            || path == "sqlx_core::Config::try_from_path"
            || path == "sqlx_core::config::Config::try_from_path_or_default"
            || path == "sqlx_core::Config::try_from_path_or_default"
            || path == "sqlx_core::config::Config::try_from_crate_or_default"
            || path == "sqlx_core::Config::try_from_crate_or_default"
        {
            return Some("Fs");
        }
        if path.ends_with("::net::tls::handshake") {
            return Some("Net");
        }
        return None;
    }
    // `walkdir` — recursive directory traversal. Charged at `WalkDir::new` (construction), the SAME
    // point `ignore::WalkBuilder::build`/`glob::glob` are charged, and NOT at `IntoIter::next` (driving
    // the iterator) as this rule originally read. The disk read (`read_dir`+`stat`) is technically lazy
    // — nothing happens until the value is iterated — but `.next()` is reached ONLY through a receiver
    // typed as `walkdir::IntoIter`, and candor-scan's receiver-typing (`ctor_type`/`resolve_recv_type`)
    // hard-blocks the `.into_iter()` verb (a guard against fabricating onto a DIFFERENT std type, e.g.
    // `Vec::into_iter()` -> `std::vec::IntoIter`) with no per-crate exception for the SAME-crate case.
    // `WalkDir::into_iter()` returns `walkdir::IntoIter` (same crate as `WalkDir` itself, exactly the
    // shape the blocklist exists to protect, not the shape it should be blocking) — so every idiomatic
    // form (`for e in WalkDir::new(p)`, `.into_iter().count()`, `.into_iter().filter_map(..)`, an
    // untyped `let it = ...into_iter(); it.next()`) never reaches a typed `IntoIter::next` receiver and
    // read silent-pure under the OLD rule, with `deny Fs` exiting 0 over code that walks the filesystem.
    // Charging at `WalkDir::new` needs no receiver typing at all — it's a plain `Expr::Call`, robust to
    // however the iterator is later consumed. `max_depth`/`follow_links`/`sort_by`/`into_iter` (the
    // BUILDER chain, no I/O until pulled) and the cached `DirEntry::path`/`file_name`/`file_type`/`depth`
    // accessors (`file_type` makes NO syscall) stay PURE — matched by nothing here, so they fall through.
    // The `IntoIter::next`/`DirEntry::metadata` rule is KEPT, not dead: it still fires whenever the
    // concrete `walkdir::IntoIter` type reaches `.next()` by a route the blocklist doesn't gate — an
    // EXPLICIT type annotation (`let it: walkdir::IntoIter = ...`), a struct field declared with that
    // type, or a local fn's declared return type — real, if rarer, shapes than the inline-chain idiom.
    // (Companion to the already-modeled `ignore`.)
    if crate_name == "walkdir" {
        if path.ends_with("::WalkDir::new")
            || path.ends_with("::IntoIter::next")
            || path.ends_with("::DirEntry::metadata")
        {
            return Some("Fs");
        }
        return None;
    }
    // `filetime` — file-timestamp mutation. The `set_*` free fns issue utimes/utimensat/futimens (Fs).
    // `FileTime::now` reads the system clock (Clock). The `FileTime::from_*`/`zero` value constructors
    // (incl. `from_last_modification_time(&Metadata)` etc., which read an ALREADY-loaded `&Metadata`, not
    // the disk) and the `seconds`/`nanoseconds` accessors are PURE.
    if crate_name == "filetime" {
        if path.ends_with("::set_file_mtime") || path.ends_with("::set_file_atime")
            || path.ends_with("::set_file_times") || path.ends_with("::set_symlink_file_times")
            || path.ends_with("::set_file_handle_times")
        {
            return Some("Fs");
        }
        if path.ends_with("::FileTime::now") {
            return Some("Clock");
        }
        return None;
    }
    // `execute` — the `Execute` trait that extends `std::process::Command` with run helpers. The
    // `execute*` verbs SPAWN a child process (Exec). The `execute::command`/`shell` free fns and the
    // `command!`/`command_args!` macros only BUILD a Command (no spawn) and stay PURE.
    if crate_name == "execute" {
        if path.contains("::execute") {
            return Some("Exec");
        }
        return None;
    }
    // `ctrlc` — installs an OS signal handler (Unix SIGINT/SIGTERM/SIGHUP, Windows CTRL_C_EVENT) and
    // spawns its handler thread. Signals are an inter-process control channel, so the closest bucket is
    // Ipc (candor has no dedicated Signal effect; same judgment as routing SysV/pipe IPC to Ipc).
    if crate_name == "ctrlc" {
        if path.ends_with("::set_handler") || path.ends_with("::try_set_handler") {
            return Some("Ipc");
        }
        return None;
    }
    // `clap` — argument parsing. ONLY the terminals that read `std::env::args_os` at call time are an
    // effect (Env): `get_matches`/`get_matches_mut`/`try_get_matches` and the derive `parse`/`try_parse`.
    // clap is MOSTLY PURE: the ENTIRE builder surface (`Command::new`/`arg`/`about`/`Arg::new`) stays
    // None, and crucially the `*_from`/`*_parse_from` variants take an EXPLICIT iterator (they do NOT
    // read argv) so they stay pure too.
    //
    // THE ~79-CRATE R59-CLASS AUDIT (2026-08-28): this file used to leave `Arg::env` unmodeled, calling
    // bare `::env` "too generic to gate safely" — the same words used for libc's genuinely ambiguous fd
    // verbs. It isn't the same shape: `Arg::env(name)` calls `env::var_os(&name)` DIRECTLY at builder
    // time (verified against clap_builder 4.6.6, builder/arg.rs:2205-2213 — real, immediate, not
    // deferred to `get_matches()`), and — unlike a bare fd, which could be Fs/Net/Ipc — `clap_builder`
    // has exactly ONE `pub fn` ending `::env` in its entire source (`Arg::env`; the deprecated
    // `Arg::env_os` is a one-line delegate to it). This whole match arm is already crate-gated on
    // `crate_name == "clap"`, so no ambiguity survives to fabricate on: a fixture proved the untreated
    // gap silently vanishes the function ("functions": [] — the exact R59 shape, worse than an
    // uncalibrated dependency, since `clap` is fully `CALIBRATED_CRATES` and the miss reads as
    // reviewed-pure rather than disclosed). Classified, not carved into
    // `CALIBRATED_BUT_PARTIAL_CRATES`, because the effect IS unambiguous once actually checked.
    if crate_name == "clap" {
        if path.ends_with("::get_matches") || path.ends_with("::get_matches_mut")
            || path.ends_with("::try_get_matches")
            || path.ends_with("::parse") || path.ends_with("::try_parse")
            || path.ends_with("::env") || path.ends_with("::env_os")
        {
            return Some("Env");
        }
        return None;
    }
    // `jiff` — date/time. `Timestamp::now`/`Zoned::now`/`Zoned::now_with` read the wall clock (Clock).
    // `tz::TimeZone::system`/`get` and `tz::db().get` read the system tzdb files from disk
    // (`/etc/localtime`, `/usr/share/zoneinfo`; `system` is also `$TZ`-overridable — Fs is the dominant
    // op, modeled as Fs). The `Span`/`civil` date math and `Timestamp`/`Zoned` arithmetic are PURE.
    if crate_name == "jiff" {
        if path.ends_with("::now") || path.ends_with("::now_with") {
            return Some("Clock");
        }
        if path.ends_with("::TimeZone::system") || path.ends_with("::TimeZone::get")
            || path.ends_with("::TimeZoneDatabase::get")
            // `TimeZone::try_system` (tz/timezone.rs:391) is `TimeZone::system`'s fallible sibling —
            // same `crate::tz::system::get(crate::tz::db())` call, real localtime/zoneinfo disk read.
            || path.ends_with("::TimeZone::try_system")
        {
            return Some("Fs");
        }
        // SOUNDNESS R1528 — jiff 0.2.38 (above the 0.2.35 ceiling; the rules still apply to any version). Every row
        // below was read in 0.2.38 and EXECUTED against a consumer fixture whose `TZDIR` names a directory holding
        // ONE zone file `Fake/Zone` (a copy of Asia/Tokyo): the lookup succeeds with that file's offset when the
        // directory exists and errors when it is empty or `TZDIR` is unset, so the answer comes from the disk.
        //   * `tz::db()` (tz/db/mod.rs:31) is a `OnceLock` whose initialiser is `TimeZoneDatabase::from_env`: it
        //     reads `TZDIR` and opens the zoneinfo directories. `from_env`, `from_dir(path)` (opens the directory,
        //     `ZoneInfoNames::new`) and `from_concatenated_path(path)` (opens the file, `Names::new`) are the database
        //     CONSTRUCTORS; executed, `from_dir`/`from_concatenated_path` return `Err` for a missing path.
        //   * `Date::in_tz`, `DateTime::in_tz`, `Timestamp::in_tz`, `Zoned::in_tz` are `tz::db().get(name)` plus a
        //     conversion (civil/date.rs:1114, civil/datetime.rs:1446, timestamp.rs:1263, zoned.rs:655).
        //   * `DateTimeParser::{parse_zoned, parse_time_zone}`, `BrokenDownTime::to_zoned`, `Pieces::to_time_zone` and
        //     `TimeZoneAnnotation::to_time_zone` are `<same>_with(crate::tz::db(), ..)`: the global database is an
        //     ARGUMENT evaluated before the body branches, so it is initialised (TZDIR read, directory opened) even
        //     for an offset-only annotation that never looks a name up. Fs is therefore unconditional on first use.
        // Single effect, as the `TimeZone::get` rule above: the `TZDIR` Env read rides with the same call. NOT claimed:
        // the three `_with(db)` variants (the effect is the caller-supplied database's, charged at the constructor
        // above; a `bundled()` database makes the same call pure — EXECUTED) and `TimeZoneDatabase::bundled` (a
        // `warn!` only with jiff's non-default `logging` feature AND an empty bundle) — filed as R1559.
        if let Some((ty, m)) = type_method(
            path,
            "jiff",
            &["", "civil", "civil::date", "civil::datetime", "timestamp", "zoned", "tz", "tz::db", "fmt", "fmt::strtime",
              "fmt::temporal", "fmt::temporal::pieces", "fmt::temporal::mod"],
        ) {
            if matches!(
                (ty, m),
                ("Date" | "DateTime" | "Timestamp" | "Zoned", "in_tz")
                    | ("TimeZoneDatabase", "from_env" | "from_dir" | "from_concatenated_path")
                    | ("DateTimeParser", "parse_zoned" | "parse_time_zone")
                    | ("BrokenDownTime", "to_zoned")
                    | ("Pieces" | "TimeZoneAnnotation", "to_time_zone")
            ) {
                return Some("Fs");
            }
        }
        if path == "jiff::db" || path == "jiff::tz::db" || path == "jiff::tz::db::db" {
            return Some("Fs");
        }
        return None;
    }
    // `env_logger` — installs the global logger and emits to stderr; reads `RUST_LOG`/`RUST_LOG_STYLE`.
    // The init terminals are the effect (Log — program output, same family as `log`/`tracing`). The
    // `Builder::new`/`build` and the format/filter/target config setters are PURE.
    if crate_name == "env_logger" {
        if path.ends_with("::init") || path.ends_with("::try_init")
            || path.ends_with("::init_from_env") || path.ends_with("::try_init_from_env")
        {
            return Some("Log");
        }
        return None;
    }
    // `dialoguer` — interactive terminal prompts. The `interact*` verbs read stdin + write the tty (a
    // console dialogue with the user — Ipc, like the other local-channel effects). The
    // `with_prompt`/`default`/`items`/`validate_with` BUILDERS are PURE.
    if crate_name == "dialoguer" {
        if path.ends_with("::interact") || path.ends_with("::interact_on")
            || path.ends_with("::interact_text") || path.ends_with("::interact_text_on")
            || path.ends_with("::interact_opt") || path.ends_with("::interact_on_opt")
        {
            return Some("Ipc");
        }
        // `Editor::edit` (edit.rs:93) writes the caller's string to a real tempfile, spawns
        // `$VISUAL`/`$EDITOR` on it via `process::Command::spawn().wait()`, then reads the result back
        // — a real subprocess launch, not a terminal-dialogue read/write like the verbs above.
        if path.ends_with("Editor::edit") {
            return Some("Exec");
        }
        // WIDENED-CORE AUDIT (2026-08-28): `Editor::new`/`Editor::default` (edit.rs:54,44) call
        // `get_default_editor()` (edit.rs:31), which reads `env::var_os("VISUAL")` then `("EDITOR")`
        // IMMEDIATELY at construction — a real, independent Env read a consumer triggers just by
        // building an `Editor`, whether or not `.edit()` is ever called (the SAME "builder-time env
        // read, separate from the terminal verb" shape as `clap::Arg::env`, R59-class). Verified against
        // dialoguer 0.12.0: `get_default_editor` is the ONLY caller of either `env::var_os`, so there is
        // no ambiguity gating this to just these two constructors.
        if path.ends_with("Editor::new") || path.ends_with("Editor::default") {
            return Some("Env");
        }
        return None;
    }
    // `tracing_subscriber` — the subscriber that gives `tracing` somewhere to go. TWO effects, and the
    // filing said "Log/Fs": VERIFIED against 0.3.23, the Fs half is WRONG.
    //
    //   Log — `fmt/fmt_layer.rs:749` defaults `make_writer: io::stdout`, so the fmt INIT terminals install
    //         a subscriber that writes program output. Same family as `log`/`tracing`/`env_logger`.
    //   Env — `fmt/mod.rs:1219` reads `RUST_LOG` on the `init()` path, `fmt_layer.rs` reads `NO_COLOR`,
    //         and `filter/env/builder.rs:189,203` read `env::var(self.env_var_name())`.
    //
    // NOT Fs. The only `std::fs` in the crate is `impl MakeWriter for std::fs::File` — the crate ACCEPTING
    // a caller-supplied File, not opening one. The caller's `File::create` is classified on the caller, so
    // charging Fs here would double-count, exactly the `serde_json::from_reader` caveat one crate over.
    //
    // The builders (`fmt()`, `layer()`, `with_writer`, `with_target`, `EnvFilter::new`) are PURE: they
    // describe a subscriber. Only the INIT terminals install one, and only the from-env constructors read.
    if crate_name == "tracing_subscriber" {
        if path.ends_with("::init") || path.ends_with("::try_init") {
            return Some("Log");
        }
        // SOUNDNESS R1528 — `fmt::Layer::new()` is `Self::default()`, and `Default for Layer`
        // (fmt/fmt_layer.rs:743) reads `env::var("NO_COLOR")` to decide ANSI. EXECUTED 2026-11-08: the
        // same program emitted ANSI escapes with NO_COLOR unset and none with `NO_COLOR=1`, so the
        // layer's behaviour depends on the environment at construction. Both module spellings are
        // matched; `tracing_subscriber::Layer` at the crate root is the TRAIT, which has no `new`.
        // NOT claimed here: `fmt::layer()` and `Layer::default()` reach the same read, but a rule
        // for them contradicts the assertion below that `fmt::layer` is pure — filed for decision.
        if path.ends_with("::fmt::Layer::new") || path.ends_with("::fmt_layer::Layer::new") {
            return Some("Env");
        }
        // SOUNDNESS R1528 — the rest of the `NO_COLOR` family. `Layer::new` is `Self::default()` and every one of
        // `fmt::layer()` (fmt/mod.rs:337), `fmt::Layer::default()` (fmt_layer.rs:739), `fmt::fmt()` (mod.rs:324),
        // `fmt::Subscriber::builder()` (:352) and `SubscriberBuilder::default()`/`Subscriber::default()` (:467/:362) reach
        // the same `env::var("NO_COLOR")` through `Layer::default`. EXECUTED (fx_ts, `layer`/`builders`): each emitted
        // ANSI escapes with `NO_COLOR` unset and none with `NO_COLOR=1`. This REVERSES the earlier "the builders are
        // PURE" reading in the comment above and the `fmt::layer` assertion that went with it: that reading missed the
        // `Default` dispatch. The setters (`with_target`, `with_writer`, ...) stay pure — they only move the value.
        if path == "tracing_subscriber::fmt::layer" || path == "tracing_subscriber::fmt::fmt"
            || path == "tracing_subscriber::fmt"
            || path.ends_with("::fmt::Layer::default") || path.ends_with("::fmt_layer::Layer::default")
            || path == "tracing_subscriber::FmtSubscriber::builder" || path.ends_with("::fmt::Subscriber::builder")
            || path.ends_with("::fmt::Subscriber::default") || path.ends_with("::fmt::SubscriberBuilder::default")
        {
            return Some("Env");
        }
        // SOUNDNESS R1528 — the `FormatTime` implementors that READ THE CLOCK when formatting (fmt/time/mod.rs:136,
        // time_crate.rs, chrono_crate.rs: `SystemTime::now()`, `OffsetDateTime::now_{utc,local}()`, `chrono::{Utc,
        // Local}::now()`), and `Uptime`'s constructors, whose epoch is `Instant::now()` (mod.rs:85,122). EXECUTED (fx_ts,
        // `times`): each formatter printed a different timestamp 1.1s apart; `uptime()` printed the time elapsed since the
        // call. `Uptime::format_time` itself only subtracts (`epoch.elapsed()` — a clock read, but the unit is not a
        // row) and `From<Instant>` and `time()` (a unit struct) read nothing: NOT claimed.
        if let Some((ty, m)) = type_method(
            path,
            "tracing_subscriber",
            &["", "fmt", "fmt::time", "fmt::time::time_crate", "fmt::time::chrono_crate", "time"],
        ) {
            // `OffsetTime::local_rfc_3339` (tracing-subscriber 0.3.23, the refresh's drift row): `Self::new(UtcOffset::
            // current_local_offset()?, Rfc3339)` (fmt/time/time_crate.rs:363), the `time` crate's local-offset probe that this
            // file already charges `Clock` + `Fs` (R1612). EXECUTED (macOS, DYLD interposer, TZ unset): 1 `clock_gettime` +
            // `access(/etc/localtime)`; a pure control in the same harness 0.
            if (m == "format_time"
                && matches!(ty, "SystemTime" | "UtcTime" | "LocalTime" | "OffsetTime" | "ChronoLocal" | "ChronoUtc"))
                || (ty == "Uptime" && m == "default")
                || (ty == "OffsetTime" && m == "local_rfc_3339")
            {
                return Some("Clock");
            }
        }
        if path == "tracing_subscriber::uptime" || path == "tracing_subscriber::fmt::uptime"
            || path == "tracing_subscriber::fmt::time::uptime"
        {
            return Some("Clock");
        }
        if path.ends_with("::from_default_env") || path.ends_with("::try_from_default_env")
            || path.ends_with("::from_env") || path.ends_with("::from_env_lossy")
            || path.ends_with("::try_from_env")
        {
            return Some("Env");
        }
        return None;
    }
    // `crossterm` — the terminal driver. The tty is a USER DIALOGUE CHANNEL, so this is Ipc, matching the
    // ruling `dialoguer`/`console`/`terminal_colorsaurus` already carry rather than a new one.
    //
    // VERIFIED against crossterm-0.28.1 rather than assumed: `command.rs` `execute`/`queue` end in
    // `self.flush()?` on the writer (real code, not a doc example), `event::read`/`poll` read tty input,
    // and `terminal::{enable,disable}_raw_mode` + `size`/`window_size` talk to the device.
    //
    // `size`/`window_size`/`is_raw_mode_enabled` ARE classified, and that is deliberate: once a crate is
    // CALIBRATED every unmatched path becomes a PURITY CLAIM rather than a disclosed blind spot, so a tty
    // ioctl left to fall through would be claimed pure. The genuinely pure surface — the Command VALUE
    // types (`Print`, `MoveTo`, `SetForegroundColor`), the style/event data types — carries none of these
    // tails and stays pure correctly.
    if crate_name == "crossterm" {
        // SOUNDNESS R1528 (b10) — crossterm 0.29.0 (above its 0.28.1 ceiling). See `crossterm_r1528`.
        if let Some(effect) = crossterm_r1528(path) {
            return Some(effect);
        }
        if path.ends_with("::execute") || path.ends_with("::queue")
            || path.ends_with("::event::read") || path.ends_with("::event::poll")
            || path.ends_with("::enable_raw_mode") || path.ends_with("::disable_raw_mode")
            || path.ends_with("::size") || path.ends_with("::window_size")
            || path.ends_with("::is_raw_mode_enabled")
        {
            return Some("Ipc");
        }
        // `terminal::supports_keyboard_enhancement` (terminal/sys/unix.rs:188, re-exported `pub use
        // sys::supports_keyboard_enhancement` in terminal.rs) drives the SAME channel as
        // `event::read`/`enable_raw_mode` above (it toggles raw mode, then reads/polls terminal events
        // to detect the kitty keyboard protocol) — bucketed `Ipc` for consistency with the rest of this
        // tty-dialogue family rather than the `Fs` self-scan's raw signal reports (that signal traces
        // through the crate's internal event source opening `/dev/tty` as a fallback fd, the same
        // primitive `tty_fd` below wraps — not a distinct effect from the terminal channel itself).
        //
        // NOT modelled: `tty_fd` (terminal/sys/file_descriptor.rs:124) — declared inside `pub(crate) mod
        // sys;` (terminal.rs:99), so despite being `pub fn` it is unreachable from outside the crate
        // (only used internally by the event source). Removed from open.tsv rather than guessed.
        if path.ends_with("::supports_keyboard_enhancement") {
            return Some("Ipc");
        }
        return None;
    }
    // `ratatui` — the TUI renderer, and the single loudest source of disclosed-blind calls measured in the
    // 2026-07-14 four-ecosystem sweep (3,345 across three real repos). The backlog filed it as
    // "mark reviewed-pure"; VERIFYING against ratatui-0.29.0 REFUTES that for part of the surface:
    // `terminal/terminal.rs` `draw`/`flush`/`clear`/`autoresize`/`hide_cursor`/`show_cursor` end in a
    // backend flush, and `backend/` writes to the terminal. Marking the whole crate pure would have
    // claimed purity over the one API that actually writes.
    //
    // So the split is where the sweep's noise actually is: the BULK of those 3,345 calls are widget,
    // layout, buffer, style and text constructors — genuinely pure, and now covered rather than disclosed.
    // The Terminal/backend verbs are Ipc, same channel as crossterm underneath them.
    if crate_name == "ratatui" {
        // CARVE-OUT FIRST: `widgets::canvas` is an IN-MEMORY grid. `Context::draw(&shape)` sets
        // `self.dirty` and paints into a `Painter` — no terminal, no writer, provably pure — but it ends
        // in `::draw` and the tails below would have charged it `Ipc`. MEASURED as a live fabrication on a
        // fixture (`plot(ctx) -> ['Ipc']`) before this line existed, and it is a HOT path: a TUI drawing
        // charts or maps calls it per shape per frame.
        //
        // A DENYLIST (carve out the proven-pure module) rather than an allowlist of `Terminal::`, per the
        // family rule: an allowlist silently under-reports whatever it forgot, and the write surface here
        // is Terminal AND the backends (`CrosstermBackend::flush`), so pinning to `Terminal::` would drop
        // a direct backend call. Reading the crate, canvas is the only module whose methods collide with
        // these tails.
        if path.contains("::canvas::") {
            return None;
        }
        if path.ends_with("::draw") || path.ends_with("::try_draw") || path.ends_with("::flush")
            || path.ends_with("::autoresize") || path.ends_with("::clear")
            || path.ends_with("::hide_cursor") || path.ends_with("::show_cursor")
            || path.ends_with("::insert_before")
            || path.ends_with("::set_cursor_position") || path.ends_with("::get_cursor_position")
        {
            return Some("Ipc");
        }
        return None;
    }
    // `console` — terminal handle + styling. The `Term` read/write verbs do tty I/O (Ipc, the user
    // dialogue channel; note there is NO `write_str` — `Term` impls `io::Write`). The free-fn terminal
    // detection (`colors_enabled`/`user_attended`) reads `CLICOLOR`/`CLICOLOR_FORCE` (Env). The `Style`
    // color/format methods and the text utils (`strip_ansi_codes`/`pad_str`/`measure_text_width`) are PURE.
    //
    // THE ~79-CRATE R59-CLASS AUDIT (2026-08-28): the note above ("no `write_str` — `Term` impls
    // `io::Write`") RECORDED the trait impl without covering it. `Term::write`/`Term::flush` (console
    // 0.15.11, term.rs:622-633) call `self.write_through(buf)` — the SAME primitive `write_line` already
    // charges Ipc for — and `Term::read` (term.rs:650-654) calls `io::stdin().read(buf)` directly. These
    // are a second, real entry point to the identical tty channel, missed because `read`/`write`/`flush`
    // are the names every I/O type shares — but crate-gated on `crate_name == "console"`, term.rs
    // defines exactly one of each (verified against the real source; no ambiguity survives the gate,
    // same shape as `clap::Arg::env`). Left unclassified, a fn calling only `term.write_all(..)` (no
    // `write_line`) read as reviewed-pure, since `console` is fully `CALIBRATED_CRATES`.
    if crate_name == "console" {
        if path.ends_with("::write_line") || path.ends_with("::read_line")
            || path.ends_with("::read_line_initial_text") || path.ends_with("::read_char")
            || path.ends_with("::read_key") || path.ends_with("::read_key_raw")
            || path.ends_with("::read_secure_line")
            || path.ends_with("Term::write") || path.ends_with("Term::flush")
            || path.ends_with("Term::read")
        {
            return Some("Ipc");
        }
        if path.ends_with("::colors_enabled") || path.ends_with("::colors_enabled_stderr")
            || path.ends_with("::user_attended") || path.ends_with("::user_attended_stderr")
        {
            return Some("Env");
        }
        return None;
    }
    // `terminal_colorsaurus` — queries the terminal's colours by writing OSC 10/11 escapes and reading the
    // reply (bidirectional tty dialogue — Ipc, consistent with dialoguer/console). Nothing else is I/O.
    if crate_name == "terminal_colorsaurus" {
        if path.ends_with("::background_color") || path.ends_with("::foreground_color")
            || path.ends_with("::color_palette")
            // SOUNDNESS R321 — FQN-exact, not a suffix. `1.0.3` added
            // `ColorPalette::theme_mode(&self)` (src/lib.rs:112), a PURE derived accessor
            // comparing `perceived_lightness()` on two already-fetched colours, alongside the
            // effectful free `theme_mode(options)` (src/lib.rs:157). A `::theme_mode` suffix
            // charges `Ipc` to both. Counterpart to R319: the same upstream mechanism — a
            // release ADDING a name — under-reports in one crate and fabricates in another,
            // depending only on whether the new name is effectful.
            || path == "terminal_colorsaurus::theme_mode"
        {
            return Some("Ipc");
        }
        return None;
    }
    // `backoff` — retry-with-backoff. `retry`/`retry_notify` consult the clock and `thread::sleep`
    // between attempts (Clock). The `ExponentialBackoff`/builder config is PURE. (The user closure's own
    // effects are out of scope here — we model only backoff's own Clock effect.)
    if crate_name == "backoff" {
        if path.ends_with("::retry") || path.ends_with("::retry_notify") {
            return Some("Clock");
        }
        return None;
    }
    // `lscolors` — LS_COLORS parsing. ONLY `from_env` reads the environment (Env). `from_string`/
    // `style_for_path`/`style_for*` and the `Style` type take explicit input and are PURE.
    if crate_name == "lscolors" {
        if path.ends_with("::from_env") {
            return Some("Env");
        }
        return None;
    }
    // `wild` — argv with glob expansion. `args`/`args_os` read `std::env::args(_os)` (Env). Nothing else.
    if crate_name == "wild" {
        if path.ends_with("::args") || path.ends_with("::args_os") {
            return Some("Env");
        }
        return None;
    }
    // `grep_cli` — only the firm effect is modeled: `CommandReaderBuilder::build` spawns a child process
    // (Exec). The `is_readable_stdin`/`is_tty_*` fd probes (isatty/fstat on the std descriptors) are
    // deliberately NOT modeled — candor doesn't classify `IsTerminal`/isatty as an effect anywhere, and
    // they read no data; flagging them would be an inconsistent over-report.
    if crate_name == "grep_cli" {
        if path.ends_with("::build") {
            return Some("Exec");
        }
        // THE COVERAGE-GATE SWEEP (2026-08-27), verified against grep-cli 0.1.12 — the sibling entry
        // points to `::build` above, none of which end in that suffix:
        //
        // `CommandReader::new` (process.rs:195) is `CommandReaderBuilder::new().build(cmd)` — the same
        // spawn, reached through the type's own one-call constructor instead of the builder.
        // `CommandReader::close` (process.rs:218) drops the child's stdout handle then calls
        // `self.child.wait()` — `std::process::Child::wait` is ALREADY classified `Exec` elsewhere in
        // this file (reaping/blocking on a spawned child is part of the subprocess lifecycle this
        // project tracks), and self-scan resolves `self.child`'s concrete `process::Child` type to
        // confirm it, not a guess.
        // `DecompressionMatcher::command` (decompress.rs:179) builds a REAL `Command::new(&decomp_cmd.bin)`
        // naming an actual decompressor binary (gzip/xz/bzip2/…) and returns it un-spawned — the same
        // "constructs a real argv, caller spawns it" shape `Cred::credential_helper` was classified for
        // in git2 (see the FQN-exact rule near this file's top).
        // `DecompressionReader::new` (decompress.rs:352) is `DecompressionReaderBuilder::new().build(path)`,
        // which calls the already-covered `CommandReaderBuilder::build` two hops down.
        // `patterns_from_path` (pattern.rs:82) opens and reads the given file directly (`std::fs::File::
        // open`) — unrelated to the Exec family above, genuinely Fs.
        // SOUNDNESS R342 — `DecompressionReader::close` was the sibling this enumeration missed. It is
        // `match self.rdr { Ok(ref mut rdr) => rdr.close(), Err(_) => Ok(()) }` (`decompress.rs:383`),
        // i.e. the already-listed `CommandReader::close` one level up, so it reaps the same child. Its
        // `CommandReader` counterpart was listed and it was not — measured on a consumer fixture:
        // `CommandReader::close` charged `Exec` and `DecompressionReader::close` read ABSENT.
        //
        // The `read` pair is listed for the same reason one hop over: reading a `DecompressionReader`
        // or a `CommandReader` pulls bytes from the child's stdout, which is the point of having
        // spawned it. FQN-exact rather than a `::read`/`::close` suffix, because both are far too
        // common a leaf to match crate-wide — the R321 lesson.
        //
        // Found because R185 taught the scanner to see through `match self.rdr { Ok(..) }`, which made
        // grep-cli's own self-scan nominate it. The rule is what a CONSUMER needs; the self-scan only
        // pointed at it.
        if path == "grep_cli::CommandReader::new"
            || path == "grep_cli::CommandReader::close"
            || path == "grep_cli::CommandReader::read"
            || path == "grep_cli::DecompressionMatcher::command"
            || path == "grep_cli::DecompressionReader::new"
            || path == "grep_cli::DecompressionReader::close"
            || path == "grep_cli::DecompressionReader::read"
            || path == "grep_cli::decompress::DecompressionReader::close"
            || path == "grep_cli::decompress::DecompressionReader::read"
            || path == "grep_cli::process::CommandReader::close"
            || path == "grep_cli::process::CommandReader::read"
        {
            return Some("Exec");
        }
        if path == "grep_cli::patterns_from_path" {
            return Some("Fs");
        }
        return None;
    }
    // `clircle` — detects whether two handles are the same file (cycle protection). `Identifier::try_from`
    // (File/Stdio) issues an `fstat`, and `surely_conflicts_with` does an `lseek` (`stream_position`) — both
    // Fs. The `PartialEq`/`Hash` comparisons read stored dev/ino and are PURE. (The named methods
    // `are_identical`/`same_file` do NOT exist in the crate — not modeled.)
    if crate_name == "clircle" {
        if path.ends_with("::try_from") || path.ends_with("::surely_conflicts_with") {
            return Some("Fs");
        }
        return None;
    }
    None
}

pub fn cap_from_name(name: &str) -> Option<&'static str> {
    EFFECTS.iter().copied().find(|e| *e == name)
}

/// Refine the `Exec` cliff (spec §4 ⟨0.5⟩): the effects a *literal, statically-known* subprocess
/// head implies, matched by basename (`/usr/bin/curl` → `curl`). The head's effects are ADDED to a
/// caller that already carries `Exec` (a subprocess is still spawned — `Exec` is never dropped); an
/// unrecognised or dynamically-built head returns `&[]` and keeps the bare cliff (never guess). A
/// **candor engine** reads `Fs`/`Env` only — spec §7 item 12 (the analyzer self-boundary) guarantees
/// that, so that case is spec-supplied, not curation. The rest is a small curated table under the
/// same under-report rule as the crate classifier. INVARIANT: every head here is an external tool
/// that does NOT run the analysed project's own code (so `make`/`npm`/`cargo` are deliberately
/// absent — they stay the cliff). The reference engines share this table so the `Exec` boundary —
/// the one boundary every engine hits — refines identically (the §4-consistency argument).
/// SPEC §2 `fs` — for a call ALREADY classified `Fs`, the read/write direction its path implies.
/// `["read"]`, `["write"]`, `["read","write"]`, or `[]` when the verb does not say.
///
/// THE EMPTY CASE IS THE DISCIPLINE. §2: *"when `Fs` is reached but its kind is unknown … the field MUST
/// be omitted rather than guessed. An empty or partial `fs` would be read as a positive claim ('reads but
/// never writes'), which is the §4 trust contract's forbidden direction."* So an unrecognised verb
/// contributes nothing and the field stays absent; absence means "kind undetermined", never "read-only".
///
/// A syntactic refinement of an effect already proved, NOT a soundness claim. Deliberately the same
/// vocabulary as candor-java's `fsKind`, candor-swift's and candor-ts's — the surface is spec'd four-way,
/// and four engines inventing four verb tables for one field is how a shared field stops meaning one thing.
pub fn fs_kind(path: &str) -> &'static [&'static str] {
    // the terminal segment is the verb (`std::fs::write`, `File::create`, `f.read_to_string`)
    let leaf = path.rsplit("::").next().unwrap_or(path);
    // `OpenOptions::open` is the one verb that does NOT carry its own direction — the direction was set
    // by the BUILDER chain (`.read(true)`/`.write(true)`), which this function cannot see. The READ list
    // below holds a bare `open` for `File::open`, unambiguously a read; letting an `OpenOptions` receiver
    // reach it publishes `fs: ["read"]` for a builder configured `write(true)`, and §2 reads that as the
    // positive claim "reads but never writes" — the forbidden direction. The paragraph under the READ
    // list has always SAID this; nothing implemented it, and it only became REACHABLE when
    // `OpenOptions::open` started classifying on its own — before, the `Fs` came from the
    // `OpenOptions::new` constructor, whose leaf claims nothing, so the field was simply absent.
    // MEASURED on this commit's own fix before this guard: `OpenOptions::new().read(true).open(p)` went
    // from `fs` ABSENT to `fs: ["read"]`, i.e. the fix minted a claim the engine cannot support. Keyed on
    // the TYPE segment, so it holds for the `fs_err`/`tokio::fs`/`async_std::fs` spellings too.
    if path.rsplit("::").nth(1) == Some("OpenOptions") {
        return &[];
    }
    // Reads the source AND writes the destination in one call.
    if matches!(leaf, "copy" | "rename" | "hard_link" | "soft_link" | "symlink") {
        return &["read", "write"];
    }
    const WRITE: &[&str] = &[
        "write", "write_all", "write_fmt", "write_vectored", "create", "create_new", "create_dir",
        "create_dir_all", "remove_file", "remove_dir", "remove_dir_all", "set_permissions",
        "set_len", "set_modified", "set_times", "append", "flush", "sync_all", "sync_data",
        "write_at", "truncate",
    ];
    const READ: &[&str] = &[
        "read", "read_to_string", "read_to_end", "read_exact", "read_dir", "read_link",
        "metadata", "symlink_metadata", "exists", "try_exists", "canonicalize", "open",
        "read_at", "file_type", "permissions", "modified", "accessed", "created", "len",
    ];
    if WRITE.contains(&leaf) { return &["write"]; }
    if READ.contains(&leaf) { return &["read"]; }
    // `OpenOptions` carries the direction in its BUILDER chain, not its terminal verb, so `.open()` on one
    // says nothing here and is deliberately left to the READ arm above only when it is `File::open`
    // (unambiguously a read). Anything else: no claim.
    if leaf.starts_with("write") || leaf.starts_with("append") { return &["write"]; }
    if leaf.starts_with("read") { return &["read"]; }
    &[]
}

pub fn classify_command_head(cmd: &str) -> &'static [&'static str] {
    // Only UNAMBIGUOUS single-effect tools belong here. A multi-modal head (`git status` is local,
    // `git push` is Net; `rsync` local-vs-remote) would FABRICATE the effect for its common case —
    // the under-report rule forbids it, so such heads keep the bare cliff.
    match cmd.rsplit(['/', '\\']).next().unwrap_or(cmd) {
        "curl" | "wget" | "http" | "ssh" | "scp" | "sftp" | "ftp" | "telnet" => &["Net"],
        "psql" | "mysql" | "sqlite3" | "mongosh" | "mongo" | "redis-cli" | "cqlsh" | "influx" => &["Db"],
        // candor engines — Fs/Env only, guaranteed by spec §7 item 12 (the analyzer self-boundary)
        "candor" | "candor-run.sh" | "candor-scan" | "candor-query" | "candor-java"
        | "candor-classify" | "candor-report" | "cargo-candor" => &["Env", "Fs"],
        _ => &[],
    }
}

/// Known machine-learning MODEL-provider hosts — the SPEC §1 ⟨0.13⟩ `Llm` host-literal refinement:
/// a statically-known `Net` request to one of these classifies `Llm` IN ADDITION to `Net` (Net is
/// never dropped — a model call IS network I/O, exactly as an `Exec`-refined subprocess keeps `Exec`),
/// just as a jdbc URL classifies `Db`. Matched by host, case-insensitive; a SUBDOMAIN of a listed host
/// counts. The reference engines share this table VERBATIM with candor-java's `Literals.MODEL_HOSTS`
/// (the analog of `classify_command_head`) so the `Net` boundary refines to `Llm` identically. An
/// UNKNOWN host stays bare `Net` — never guessed. Curated STARTER set; the §7 coverage ledger
/// discloses an uncovered provider like any other.
pub const MODEL_HOSTS: &[&str] = &[
    "api.openai.com",
    "api.anthropic.com",
    "generativelanguage.googleapis.com",
    "api.mistral.ai",
    "api.cohere.ai",
    "api.cohere.com",
    "api.groq.com",
    "api.together.xyz",
    "api.perplexity.ai",
    "openrouter.ai",
];

/// Whether an endpoint HOST literal is a known model provider (case-insensitive; a subdomain of a
/// `MODEL_HOSTS` entry counts). Strips a `:port` suffix first. Two special forms carry their own rule,
/// matching candor-java's `Literals.isModelHost` exactly: any host whose port is `11434` is a local
/// Ollama endpoint (a LOOPBACK host — `localhost`/`127.0.0.1`/`::1` — on port 11434); and an AWS Bedrock
/// runtime host (the model-inference service label `bedrock-runtime`/`bedrock-agent-runtime`).
pub fn is_model_host(host_literal: &str) -> bool {
    // Strip any `:port` (via the shared host_part) and lowercase for the name comparisons.
    let host = policy::host_part(host_literal).to_ascii_lowercase();
    // Ollama is a LOCAL endpoint: :11434 → Llm ONLY on a loopback host (max-review r3 parity fix — "any
    // host on :11434" fabricated Llm on unrelated internal services on that port).
    if let Some((_, port)) = host_literal.rsplit_once(':') {
        if port == "11434" {
            return matches!(host.as_str(), "localhost" | "127.0.0.1" | "::1");
        }
    }
    if MODEL_HOSTS.contains(&host.as_str()) {
        return true;
    }
    // A subdomain of a known model host counts (`eu.api.openai.com` → api.openai.com).
    if MODEL_HOSTS.iter().any(|m| host.ends_with(&format!(".{m}"))) {
        return true;
    }
    // AWS Bedrock runtime: the FIRST label is the model-inference service (`bedrock-runtime.<region>.
    // amazonaws.com`), NOT the substring "bedrock" (which caught `bedrock-backups.s3.amazonaws.com`, an
    // S3 bucket) and NOT the control-plane `bedrock.<region>.amazonaws.com`.
    host.ends_with(".amazonaws.com")
        && matches!(host.split('.').next(), Some("bedrock-runtime") | Some("bedrock-agent-runtime"))
}

/// ⟨0.20⟩ Curated telemetry / analytics / APM hosts — the `Net` destination-class `known-telemetry` set
/// (NET-DESTINATION-CLASS-DESIGN.md), shared VERBATIM with candor-java's `Literals.TELEMETRY_HOSTS` (like
/// `MODEL_HOSTS`). A benign observability endpoint. Matched by host, case-insensitive; a SUBDOMAIN of a
/// listed host counts. Tight, high-precision STARTER set — mis-including an exfil-capable host would
/// under-gate `deny Net[unknown-host]`.
pub const TELEMETRY_HOSTS: &[&str] = &[
    "sentry.io",
    "bugsnag.com",
    "rollbar.com",
    "segment.io",
    "segment.com",
    "mixpanel.com",
    "amplitude.com",
    "google-analytics.com",
    "analytics.google.com",
    "datadoghq.com",
    "datadoghq.eu",
    "newrelic.com",
    "nr-data.net",
    "honeycomb.io",
    "logtail.com",
    // ⟨0.20.1⟩ corpus-grown (a real-repo dogfood): more single-purpose analytics / session-replay / RUM
    // providers — vendor-specific product domains only (no general-purpose host), so no under-gate risk.
    "posthog.com",
    "plausible.io",
    "usefathom.com",
    "heapanalytics.com",
    "fullstory.com",
    "hotjar.com",
    "logrocket.com",
    "cloudflareinsights.com",
];

/// Whether an endpoint HOST literal is in `set` (case-insensitive; a subdomain of a listed host counts).
/// Strips a `:port` suffix first via `host_part`. The shared membership test for `TELEMETRY_HOSTS` and the
/// config-declared partner set (mirrors candor-java's `Literals.hostInSet`).
pub fn host_in_set(host_literal: &str, set: &[&str]) -> bool {
    let host = policy::host_part(host_literal).to_ascii_lowercase();
    set.contains(&host.as_str()) || set.iter().any(|e| host.ends_with(&format!(".{e}")))
}

/// Whether an endpoint HOST literal is a known telemetry/analytics/APM host (`TELEMETRY_HOSTS`).
pub fn is_telemetry_host(host_literal: &str) -> bool {
    host_in_set(host_literal, TELEMETRY_HOSTS)
}

/// ⟨0.20⟩ The `Net` DESTINATION CLASS of a host literal (NET-DESTINATION-CLASS-DESIGN.md): `known-telemetry`
/// (curated), `known-partner` (config `net-partner` OR a model host — a declared-ish external API), else
/// `unknown-host` — the HONEST default (candor makes no claim; the security gate bites this). A partner set
/// is per-project (config-declared). Never fabricated onto a safe class: an unresolved host is unknown-host.
/// Mirrors candor-java's `Literals.netDestClass`.
pub fn net_dest_class(host_literal: &str, partners: &std::collections::BTreeSet<String>) -> &'static str {
    if is_telemetry_host(host_literal) {
        return "known-telemetry";
    }
    if partner_for(host_literal, partners).is_some() || is_model_host(host_literal) {
        return "known-partner";
    }
    "unknown-host"
}

/// ⟨0.31⟩ WHICH declared partner a host matched, or `None` — the SAME match `net_dest_class` decides on,
/// extracted so the DISCLOSURE and the DECISION cannot use different rules.
///
/// That is not a stylistic preference. The reverted first attempt at the `net-partner` disclosure
/// re-implemented this match against a normaliser that KEEPS the port, so an observed
/// `partner.example:443` never equalled a declared `partner.example` and the disclosure came back
/// SILENTLY EMPTY on every real run — while the verdicts it was reporting on had flipped. A disclosure
/// normalised differently from the decision it reports can only be wrong, and one function with two
/// callers is what makes writing one impossible.
pub fn partner_for(
    host_literal: &str,
    partners: &std::collections::BTreeSet<String>,
) -> Option<String> {
    if partners.is_empty() {
        return None;
    }
    let host = policy::host_part(host_literal).to_ascii_lowercase();
    if partners.contains(&host) {
        return Some(host);
    }
    partners
        .iter()
        .find(|p| host.ends_with(&format!(".{p}")))
        .cloned()
}

/// ⟨0.20⟩ The closed `Net` destination-class vocabulary, for the `deny Net[<dest…>]` policy filter.
pub const NET_DEST_CLASSES: &[&str] = &["known-telemetry", "known-partner", "unknown-host"];

/// Curated Rust model-provider SDK crates — the SPEC §1 ⟨0.13⟩ `Llm` model-SDK surface, the Rust analog
/// of candor-java's `Rules.MODEL_SDK_PACKAGES`. A resolved call into one of these crates classifies
/// `Llm` + `Net` (the caller adds both — a model dispatch IS network I/O). NO method-name gating: these
/// are single-purpose provider clients, so ANY call into the crate is a model dispatch (matches the java
/// reference's judgment call). Curated STARTER list; the §7 coverage ledger discloses the rest.
pub const MODEL_SDK_CRATES: &[&str] = &[
    "async_openai",           // async-openai — the de-facto OpenAI client
    "anthropic_sdk",          // anthropic-sdk
    "anthropic",              // anthropic (community client crate)
    "aws_sdk_bedrockruntime", // AWS Bedrock runtime (invoke/converse) — the model surface of the aws-sdk family
    "ollama_rs",              // ollama-rs — local Ollama client
    "langchain_rust",         // langchain-rust — the LangChain invoke surfaces
    "mistralai",              // mistralai (Mistral client)
    "genai",                  // genai — a multi-provider model client
];

/// Whether a resolved call's CRATE is a curated model-provider SDK (`MODEL_SDK_CRATES`) → the SPEC §1
/// ⟨0.13⟩ `Llm` model-SDK classification (the caller adds both `Llm` and `Net`). Crate-level, no
/// method gating — a single-purpose client, matching candor-java's `isModelSdkOwner`.
pub fn is_model_sdk_crate(crate_name: &str) -> bool {
    MODEL_SDK_CRATES.contains(&crate_name)
}

/// The libc / nix / rustix PATH-and-directory syscall leaves `classify` charges `Fs` (incl. `*64` and
/// `*at` variants). Module-level, not local to `classify`, because it is ONE of the two answers to one
/// question: the AS-EFF-008 masking guard (`masks_locator`) reads this same table, so a leaf added here
/// is masked by default — see `LIBC_FS_NO_PATH` for the direction. SOUNDNESS R806.
pub const LIBC_FS: &[&str] = &[
            "open", "open64", "openat", "openat2", "creat", "creat64", "stat", "stat64", "lstat",
            "lstat64", "fstatat", "fstatat64", "newfstatat", "statx", "access", "faccessat",
            "faccessat2", "mkdir", "mkdirat", "rmdir", "unlink", "unlinkat", "rename", "renameat",
            "renameat2", "link", "linkat", "symlink", "symlinkat", "readlink", "readlinkat", "chmod",
            "fchmodat", "chown", "lchown", "fchownat", "truncate", "truncate64", "ftruncate",
            "ftruncate64", "opendir", "fdopendir", "readdir", "readdir64", "readdir_r", "closedir",
            "rewinddir", "seekdir", "telldir", "scandir", "mkstemp", "mkstemps", "mkostemp", "mkdtemp",
            "mknod", "mknodat", "chdir", "fchdir", "getcwd", "get_current_dir_name", "chroot",
            "pivot_root", "statfs", "statfs64", "fstatfs", "fstatfs64", "statvfs", "fstatvfs", "mount",
            "umount", "umount2", "fsync", "fdatasync", "sync", "syncfs", "sync_file_range", "fallocate",
            "posix_fallocate", "posix_fadvise", "sendfile", "sendfile64", "copy_file_range", "flock",
            "getdents", "getdents64", "utime", "utimes", "lutimes", "futimens", "utimensat", "futimesat",
            "realpath",
        ];

/// The libc / nix / rustix socket-family leaves `classify` charges `Net`. See `LIBC_NET_NO_DESTINATION`.
pub const LIBC_NET: &[&str] = &[
            "socket", "setsockopt", "getsockopt", "bind", "listen", "accept", "accept4", "connect",
            "shutdown", "send", "sendto", "sendmsg", "sendmmsg", "recv", "recvfrom", "recvmsg",
            "recvmmsg", "getpeername", "getsockname", "getaddrinfo", "freeaddrinfo", "getnameinfo",
        ];

/// The libc / nix / rustix process creation / replacement / reaping leaves `classify` charges `Exec`.
/// See `LIBC_EXEC_NO_PROGRAM`.
pub const LIBC_EXEC: &[&str] = &[
            "fork", "vfork", "clone", "clone3", "execl", "execlp", "execle", "execv", "execvp",
            "execvpe", "execve", "execveat", "fexecve", "posix_spawn", "posix_spawnp", "system",
            "popen", "pclose", "wait", "waitpid", "wait3", "wait4", "waitid",
        ];

/// The Postgres / SQLite-family client verbs `classify` charges `Db` for `postgres`, `tokio_postgres`,
/// `deadpool_postgres` and `rusqlite` — the round-trips themselves. Module-level because the masking
/// guard reads it too (`masks_locator`, SOUNDNESS R806): every verb here takes the SQL text at
/// argument 0 except the three in `PG_DB_VERBS_NO_SQL`, so a verb added here is masked by default.
/// `(type, method)` of a `crate::[modules::]Type::method` path whose modules are exactly one of `mods`
/// (the crate-root re-export when `mods` holds `""`). Used by the coverage-gate rules below that name a
/// method on ONE type: comparing the type SEGMENT, not a suffix, so `MultiplexedConnection::recv_response`
/// can never satisfy a rule written for `Connection::recv_response`.
/// SOUNDNESS R1607 — the sea_orm `ActiveModelTrait` / `ModelTrait` members that run a statement: the provided `insert`,
/// `update`, `update_without_returning`, `save`, `delete` and the link-table writers (`entity/active_model.rs`, async, each
/// through a connection; `ModelTrait::delete`, `entity/model.rs`). Read from sea-orm 2.0.4 and EXECUTED for `insert`
/// (2 statements, INSERT and the read-back) and `ModelTrait::delete` (1). The rule was `path.contains("ActiveModelTrait::")`,
/// which also charged the pure accessors (`get`, `set`, `take`, `is_changed`, `from_json`, `find_related` — a builder);
/// those are named only now that a dot-call on a derive-generated `ActiveModel` reaches the trait's spelling (`scan.rs`
/// R1607), so the rule names the member.
fn r1607_active_model_query(path: &str) -> bool {
    let Some((head, m)) = path.rsplit_once("::") else { return false };
    if head.ends_with("::ActiveModelTrait") || head == "ActiveModelTrait" {
        return matches!(
            m,
            "insert" | "update" | "update_without_returning" | "save" | "delete" | "establish_links" | "establish_links_self"
                | "establish_links_self_rev" | "delete_links" | "delete_links_self"
        );
    }
    (head.ends_with("::ModelTrait") || head == "ModelTrait") && m == "delete"
}

fn type_method<'a>(path: &'a str, krate: &str, mods: &[&str]) -> Option<(&'a str, &'a str)> {
    let rest = path.strip_prefix(krate)?.strip_prefix("::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    mods.contains(&module).then_some((ty, method))
}

/// SOUNDNESS R1528 — isahc 2.0.1 (ceiling 2.0.1, resolved 2.0.1: in-ceiling, so a `Cargo.lock` consumer and a lockless
/// one both got NOTHING for these rows). EXECUTED in a consumer fixture against a local HTTP server that counts requests,
/// beside an interposer logging `connect`, `getenv` and `clock_gettime` between a start and an end marker (handoff
/// `rust-r1528/mq/`).
///
/// CHARGED `Net`: `HttpClient::{get,head,post,put,delete,send}_async` and `Request::send_async` (the `RequestExt` method)
/// each put ONE request on the wire (EXECUTED: the server counted exactly one request and the process connected to it for
/// every one of the seven; the sync twins already classify through `::get`/`::send`). The existing rule only named the
/// FREE functions `isahc::get_async` / `isahc::send_async`; the comment beside it spoke of `HttpClient::shared()`, which
/// is `pub(crate)` and cannot be called at all, so the method spelling was never reachable by a rule.
/// CHARGED `Env`: `TrustStore::native` reads `SSL_CERT_FILE` (EXECUTED: the `getenv` is logged inside the window and the
/// control logs none). It is a `LazyLock`, so the read happens on the FIRST call in a process only: a second call in the
/// same process reads nothing. That over-charge is accepted, because the first call is the one every program makes and
/// the alternative is a silence on it.
///
/// NOT charged, and filed (R1592): `CookieJar::{get_by_name, get_for_uri, set}` read the clock (`SystemTime::now`)
/// only when the stored cookie carries an `expiration` (`Cookie::is_expired`): EXECUTED 1 `clock_gettime` with an
/// expiring cookie and 0 with an empty jar and with a session cookie, for all three. A `Clock` rule would charge two of the
/// three shapes of jar. `Response::text` blocks on the response body: EXECUTED returning the tail the server sent 1.5 s
/// after the headers, and reading nothing from a response built in memory.
fn isahc_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("isahc::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        ("" | "client", "HttpClient", "get_async" | "head_async" | "post_async" | "put_async" | "delete_async" | "send_async")
        | ("" | "request", "Request", "send_async") => Some("Net"),
        ("" | "tls" | "tls::trust", "TrustStore", "native") => Some("Env"),
        _ => None,
    }
}

/// SOUNDNESS R1528 — lettre 0.11.23 (ceiling 0.11.23, resolved 0.11.23: in-ceiling, both arms got nothing). EXECUTED in a
/// consumer fixture under an interposer (`getenv`, `open`, `connect`, `clock_gettime`, entropy between a start and an end
/// marker) beside an SMTP sink (docker `axllent/mailpit` behind a counting TCP proxy), handoff `rust-r1528/mq/`.
///
/// The scan attributes every chain hop off `Message::builder()` / `MultiPart::builder()` to the ROOT type
/// (`Message::builder().from(..).to(..).body(..)` reaches classify as `lettre::message::Message::body`), so each rule below
/// is keyed on BOTH spellings, `MessageBuilder::<m>` (a typed receiver, the grandfathered rows) and `Message::<m>` (the
/// chain). `Message` has no method of those names, so the second spelling cannot fabricate.
///
/// CHARGED `Clock`: `Date::now`, `MessageBuilder::date_now`, `Message::sign` and `dkim::dkim_sign` read `SystemTime::now`
/// (EXECUTED 1 `clock_gettime` each, 0 for the control), and so do `body`, `singlepart` and `multipart` whenever the builder
/// holds no `Date` header (`build` inserts `date_now()`, mod.rs:418): EXECUTED 1 read, and 0 once `.date(ts)` was set. The
/// over-charge on `.date(ts).body(..)` is accepted: the common idiom sets no date.
/// CHARGED `Rand`: `MultiPartBuilder::kind` (and its constructors `MultiPart::{mixed, alternative, related, signed,
/// encrypted, alternative_plain_html}`, which are `builder().kind(..)` and were never rows: the generator's self-scan does
/// not resolve that call) draw a boundary with `fastrand` (EXECUTED: two processes printed different 40-character
/// boundaries; `mixed` and `kind` executed, the other constructors read), and `MessageBuilder::message_id` does when
/// given `None` (EXECUTED: two processes printed different ids, and `Some("<x@y>")` printed the same id twice, so
/// `message_id(Some(..))` is an accepted over-charge). `fastrand` seeds from the time and the thread id, not from OS
/// entropy (0 entropy reads): the evidence is non-determinism across processes, which is weaker than an entropy interposer.
/// CHARGED `Fs`: `AsyncFileTransport::read` (EXECUTED: the open of `<dir>/<id>.eml` is logged) and the executor's
/// `fs_read` / `fs_write` (`Executor`, `Tokio1Executor`, `AsyncStd1Executor`; EXECUTED for `Tokio1Executor`: the read
/// and the write opened and created their files; the async-std twin is READ only).
///
/// READ PURE, `REVIEWED_PURE_ENTRIES`: `SmtpTransport::unencrypted_localhost` and `AsyncSmtpTransport::
/// unencrypted_localhost` take no argument, so the pool is always the default (`min_idle` 0): the maintenance thread / task
/// has nothing to connect (EXECUTED held 1.5 s: no `connect`, 0 connections through the proxy, sync and async).
///
/// NOT charged, and filed (R1592): `SmtpTransportBuilder::build` and `AsyncSmtpTransportBuilder::build` connect from the
/// background pool only when the caller asked for `PoolConfig::min_idle(n > 0)` (EXECUTED: 0 connections by default, 1
/// connection and 23 bytes up with `min_idle(1)`, sync and async). `Auth::new_from_response` emits two `debug!` records
/// only under lettre's `tracing` feature, which is off by default (EXECUTED with the feature: two records; the feature is
/// the caller's choice, so a `Log` rule would charge every default build).
///
/// One effect is all `classify` can carry: `message_id(None)` also reads the host name, and `body` on a dateless builder
/// also formats the headers; only the effect named is charged (R1575).
fn lettre_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("lettre::")?;
    if matches!(rest, "message::dkim::dkim_sign" | "message::dkim_sign" | "dkim_sign") {
        return Some("Clock");
    }
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        ("" | "message", "MessageBuilder" | "Message", "body" | "singlepart" | "multipart" | "date_now") => Some("Clock"),
        ("" | "message", "Message", "sign") => Some("Clock"),
        ("" | "message::header" | "message::header::date", "Date", "now") => Some("Clock"),
        ("" | "message", "MessageBuilder" | "Message", "message_id") => Some("Rand"),
        ("" | "message" | "message::mimebody", "MultiPartBuilder" | "MultiPart", "kind") => Some("Rand"),
        (
            "" | "message" | "message::mimebody",
            "MultiPart",
            "mixed" | "alternative" | "related" | "signed" | "encrypted" | "alternative_plain_html",
        ) => Some("Rand"),
        ("" | "transport::file", "AsyncFileTransport", "read") => Some("Fs"),
        ("" | "executor", "Executor" | "Tokio1Executor" | "AsyncStd1Executor", "fs_read" | "fs_write") => Some("Fs"),
        _ => None,
    }
}

/// SOUNDNESS R1604 — a `get` that reads a header map, charged `Net` by the URL-naming `::get` suffix rule. The scan attributes
/// a method chain to its ROOT type, so `resp.headers().get("x")` reaches classify as `reqwest::Response::get`, and a typed
/// `HeaderMap` receiver as `reqwest::header::HeaderMap::get`. None of these types has a `get` of its own in reqwest 0.11, 0.12
/// or 0.13 (READ: the only `get`s are `Client::get`, `blocking::Client::get`, the wasm client and the two free fns), so the
/// hop is always `http::HeaderMap::get` or `http::Extensions::get`, an in-memory lookup. EXECUTED over a local HTTP server
/// with a connect/send/recv interposer (handoff `rust-fab/`): 0 socket calls for the typed map, the response and request
/// header chains and the blocking response; every twin (`Client::get(..).send()`, `head(..).send()`, blocking, `reqwest::get`)
/// connects and is unchanged. A hop that does read the body (`resp.json().await?.get(..)`) is charged at `json`, not here.
///
/// isahc: its `Response` is `http::Response`, whose header chain is the same lookup (EXECUTED 0 socket calls). `isahc::Request::
/// {get,post,..}` is deliberately NOT here: in the crate's own idiom `Request::post(uri).body(b)?.send()?` the `.send()` hop is
/// untyped and reaches no rule, so the URL-naming constructor is the only `Net` on code that really sends (EXECUTED: connect
/// and a request at the server). Removing it would make `deny Net` pass over that code.
fn http_header_get_r1604(path: &str) -> bool {
    matches!(
        path,
        "reqwest::header::HeaderMap::get"
            | "reqwest::Response::get"
            | "reqwest::blocking::Response::get"
            | "reqwest::Request::get"
            | "reqwest::blocking::Request::get"
            | "isahc::Response::get"
            | "isahc::http::Response::get"
            | "isahc::http::response::Response::get"
            | "isahc::http::HeaderMap::get"
            | "isahc::http::header::HeaderMap::get"
    )
}

/// SOUNDNESS R1604 — lettre 0.11.23 `StubTransport` / `AsyncStubTransport` `send` / `send_raw` push the message onto an in-memory
/// `Mutex<Vec<..>>` and return the configured result (READ: transport/stub/mod.rs:156,171; the trait's provided `send` formats
/// the message into a `Vec`). EXECUTED: 0 connects, 0 file creates, 0 processes, the stub's log grows by one. The `::send` suffix
/// rule charged it `Net`. Keyed on module + type; the SMTP transports and the generic `Transport::send` keep `Net` (EXECUTED: a
/// connect and one delivered message at a local SMTP responder), File and Sendmail keep `Fs` / `Exec` (R1597).
fn lettre_stub_send_r1604(path: &str) -> bool {
    matches!(
        path,
        "lettre::transport::stub::StubTransport::send"
            | "lettre::transport::stub::StubTransport::send_raw"
            | "lettre::transport::stub::AsyncStubTransport::send"
            | "lettre::transport::stub::AsyncStubTransport::send_raw"
    )
}

/// SOUNDNESS R1597 — lettre 0.11.23 `Transport::send` / `send_raw` on the transports that do not speak SMTP. The `::send`
/// suffix rule charges `Net` for every transport, which is wrong in both directions for these types, EXECUTED in a consumer
/// fixture beside an interposer (`open`, `connect`) and a stand-in `sendmail` script that logs each invocation (handoff
/// `rust-r1528/b10/`):
///   * `FileTransport` / `AsyncFileTransport` write `<dir>/<id>.eml` (EXECUTED: the `open(..., O_CREAT|O_WRONLY)` is logged,
///     one file per send, sync and async, `send` and `send_raw`; 0 `connect`). Real effect `Fs`: `deny Fs` passed over code
///     that writes an email to disk, and `deny Net` failed over it.
///   * `SendmailTransport` / `AsyncSendmailTransport` spawn the configured `sendmail` command and pipe the message to it
///     (EXECUTED: exactly one invocation of the stand-in per send, 0 `connect`). Real effect `Exec`.
///
/// `SmtpTransport` / `AsyncSmtpTransport` stay `Net` (EXECUTED: a `connect` to the SMTP port; the generic `Transport::send`
/// on a type parameter keeps the suffix rule's `Net`, since SMTP is the idiom behind it). `StubTransport` does nothing
/// (EXECUTED: 0 files, 0 connects, 0 processes) and is carved out separately (R1604, `lettre_stub_send_r1604`). Keyed on module + type: `AsyncFileTransport<E>` reaches classify without its type argument.
fn lettre_send_r1597(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("lettre::")?;
    let (head, method) = rest.rsplit_once("::")?;
    if !matches!(method, "send" | "send_raw") {
        return None;
    }
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty) {
        ("" | "transport::file", "FileTransport" | "AsyncFileTransport") => Some("Fs"),
        ("" | "transport::sendmail", "SendmailTransport" | "AsyncSendmailTransport") => Some("Exec"),
        _ => None,
    }
}

/// SOUNDNESS R1528 (b10) — tempfile 3.27.0 (ceiling 3.27.0, resolved 3.27.0: in-ceiling, so a `Cargo.lock` consumer and a
/// lockless one both got NOTHING for these rows). EXECUTED in a consumer fixture under a DYLD interposer that logs `getenv`,
/// `open` (with O_CREAT), `unlink` and `getcwd` between a start and an end marker (handoff `rust-r1528/b10/`).
///
/// CHARGED `Fs`: `SpooledTempFile::{into_file, roll}` on an in-memory buffer create a real temporary file (EXECUTED: one
/// `open(<TMPDIR>/.tmpXXXXXX, O_CREAT|O_WRONLY)` and one `unlink`, after a `TMPDIR` read) and write the buffer into it. The
/// accepted over-charge is a receiver that already spilled past `max_size`: EXECUTED 0 events for both calls on a rolled one.
/// The alternative is a silence on the common idiom (`write` a little, then `into_file`).
/// CHARGED `Env`: `tempfile::env::temp_dir` reads `TMPDIR` (EXECUTED: `getenv TMPDIR`), unless `override_temp_dir` was called
/// first (EXECUTED: 0 reads) — an accepted over-charge, the default idiom is the one that reads.
///
/// CARVED OUT of the `::keep` suffix rule: `TempDir::keep` (and its deprecated `into_path`) only flips `disable_cleanup` and
/// moves the path out (dir/mod.rs:418, READ; EXECUTED: 0 `open`, 0 `unlink`, 0 `mkdir`, 0 `getenv` for both). `NamedTempFile::keep`
/// and `TempPath::keep` are NOT carved out: they call `imp::keep`, which is a no-op on unix and a real file-attribute change
/// on Windows, which this lane could not execute.
///
/// NOT charged, and filed (R1595): `TempPath::{from_path, try_from_path}` read the working directory only for a RELATIVE path
/// (EXECUTED: 1 `getcwd` for `"rel/x"`, 0 for an absolute path and for the empty path); they touch no file.
fn tempfile_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("tempfile::")?;
    if matches!(rest, "temp_dir" | "env::temp_dir") {
        return Some("Env");
    }
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        ("" | "spooled", "SpooledTempFile", "into_file" | "roll") => Some("Fs"),
        _ => None,
    }
}

/// SOUNDNESS R1528 (b10) — tungstenite 0.30.0 (ceiling 0.30.0, resolved 0.30.0: in-ceiling, both arms got NOTHING for these
/// rows). EXECUTED against a local hand-written WebSocket server (counting connections and received bytes) beside a DYLD
/// interposer logging `setsockopt` and entropy reads, each between start and end markers (handoff `rust-r1528/b10/`).
///
/// CHARGED `Rand`: `handshake::client::generate_key` and the `IntoClientRequest` impls that call it, `Uri` and
/// `ClientRequestBuilder` (the scan spells the typed `Uri` receiver `tungstenite::http::Uri::into_client_request`): EXECUTED
/// 1 OS entropy read on a fresh thread for each, 0 for `Request::into_client_request`, which is a pass-through and stays
/// pure (it would be charged by a `::into_client_request` suffix, so the rule keys on the type). The `&str`/`String`
/// impls forward to `Uri`; a `&str` receiver is untyped for the scan and cannot be reached by any rule.
/// CHARGED `Net`: `NoDelay::set_nodelay` on `MaybeTlsStream` and on a `TcpStream` (EXECUTED: `setsockopt(IPPROTO_TCP,
/// TCP_NODELAY)` on the socket; no byte moves, the std rule already charges every `TcpStream` method `Net`), and
/// `WebSocket::write_pending`, the deprecated alias of `flush` (EXECUTED: 0 bytes at the server with nothing buffered, 19
/// bytes — a masked text frame — with one buffered; the existing `::flush` rule charges the same call `Net`).
fn tungstenite_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("tungstenite::")?;
    if matches!(rest, "handshake::client::generate_key" | "client::generate_key" | "generate_key") {
        return Some("Rand");
    }
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        ("" | "http" | "client" | "http::uri", "Uri", "into_client_request") => Some("Rand"),
        ("" | "client", "ClientRequestBuilder", "into_client_request") => Some("Rand"),
        ("" | "stream", "MaybeTlsStream" | "TcpStream" | "NoDelay", "set_nodelay") => Some("Net"),
        ("" | "protocol", "WebSocket", "write_pending") => Some("Net"),
        _ => None,
    }
}

/// SOUNDNESS R1528 (b11) — the last 51 grandfathered rows, at the versions the manifests were generated from. EXECUTED in
/// a consumer fixture under a DYLD interposer (`getenv`, `setenv`, `open`, `stat`, `connect`, entropy, `clock_gettime`,
/// `fork`/`spawn`) and, where a service is the point, against PostgreSQL 16 behind a counting TCP proxy; the two
/// Linux-only questions (the openssl trust store) under `strace` in `rust:1-bookworm` (handoff `rust-r1528/b11/`).
/// `CALIBRATED_CEILINGS` is NOT raised for console (0.16.6 vs 0.15.11), rand (0.10.3 vs 0.10.2) or rustls (0.23.45 vs
/// 0.23.43): that needs the whole crate table re-verified at the new version.
///
/// Returns `Some(Some(effect))` for a rule, `Some(None)` for a proven-pure carve-out of a rule that fires later in
/// `classify`, and `None` to fall through. `classify` carries the PRIMARY effect; where a row does two things the second is
/// an `ALSO_EFFECTS` row (R1612, closing R1599's four): `next_backoff` draws entropy (Rand) AND reads the clock (Clock),
/// `try_associate` reads `PATH` (Env) AND stats each directory (Fs), `UtcOffset::current_local_offset` reads the clock
/// (Clock) AND the zone database (Fs), and the elasticsearch transport reads the proxy variables (Env) AND, on
/// the openssl backend, the system trust store (Fs, carried by `ALSO_EFFECTS` as the second effect).
///
/// CHARGED `Clock`: `env_logger` `Formatter::timestamp{,_seconds,_millis,_micros,_nanos}` (each reads `SystemTime::now`) and
/// `ConfigurableFormat::format` (EXECUTED: 1 read by default, 0 after `.timestamp(None)` — accepted over-charge);
/// elasticsearch `MultiNodeConnectionPool::reseed`; backoff `ExponentialBackoff::{get_elapsed_time, reset, default}`,
/// `ExponentialBackoffBuilder::build`, `SystemClock::now` (the clock is `C`, the default `SystemClock` reads it: a test
/// clock is an accepted over-charge); time `Instant::elapsed`, `{Signed}Duration::time_fn`, `UtcOffset::current_local_offset`;
/// notify `PollWatcher::with_initial_scan` (its poll thread reads the clock on every pass; no path is opened until
/// `watch`); duct `Handle::{wait_timeout, wait_deadline}` (EXECUTED 7 reads in the wait loop; `wait` and `try_wait` read none).
/// CHARGED `Env`: elasticsearch `Transport::{single_node, static_node_list, sniffing_node_list, cloud}` and
/// `TransportBuilder::build` (reqwest's `ClientBuilder::build`: 9 `getenv`, the proxy variables, on every call; no request
/// reaches the server); grep_cli `DecompressionMatcherBuilder::{associate, try_associate}` (`PATH`, for a relative program;
/// an absolute path is an accepted over-charge); etcetera `{Apple, Xdg, Unix, Windows}::new` (`HOME`, every spelling);
/// console `is_dumb` (`TERM`) and `{set_,}{true_,}colors_enabled{,_stderr}` (first call: `CLICOLOR_FORCE` or the terminal
/// variables; a second call reads none — accepted); portable_pty `CommandBuilder::{new, from_argv, new_default_prog}` (the
/// builder snapshots the whole process environment: EXECUTED, `FX_PROBE` is visible in the builder when set and absent when
/// not; NO process is spawned, 0 `fork`/`posix_spawn`/`execve`, so `from_argv` and `new_default_prog` — which the `Exec`
/// fall-through below had been charging — are carved out of it); dotenvy `Iter::load_override` (`setenv` per variable).
/// CHARGED `Rand`: backoff `ExponentialBackoff::next_backoff`; rand `make_rng` (the lazily seeded thread RNG: 1 entropy read
/// on a fresh thread, 0 on the second call — accepted); rustls `ClientConnection::{new, new_with_alpn}`,
/// `UnbufferedClientConnection::{new, new_with_alpn}` and the QUIC twins (EXECUTED: 3 to 4 entropy reads each, the
/// client random and the key share — the effect the rows' recorded `Fs` was NOT: the key log opens only for a
/// `KeyLogFile`, and only after the server hello, EXECUTED 0 bytes in the file at `new`).
/// CHARGED `Db`: tokio_postgres (and deadpool_postgres's `Client`/`Transaction`/`ClientWrapper`, EXECUTED) `Client`/`Transaction` `{execute_raw, execute_typed, query_typed_raw, query_typed_one,
/// query_typed_opt, query_scalar, query_one_scalar, query_opt_scalar, simple_query_raw, check_connection, bind, bind_raw,
/// query_portal, query_portal_raw, commit, rollback, savepoint}` — NONE was matched by the verb list (`PG_DB_VERBS`);
/// EXECUTED against PostgreSQL 16 behind a counting proxy: every one sends bytes (idle control 0/0/0).
/// CHARGED `Fs`: native_tls `TlsConnectorBuilder::build` (EXECUTED on Linux/openssl under `strace`: `openssl.cnf`,
/// `cert.pem`, `certs/`, `ca-certificates.crt`; 0 events on macOS — platform-conditional, like the `TlsConnector::new`
/// rule beside it).
///
/// NOT charged, and filed (R1598, `conditional`): `deadpool_postgres::Config::{get_pg_config, builder, create_pool}` read
/// `USER` only when neither the config nor the url names one (EXECUTED 1 read vs 0); grep_cli `DecompressionMatcher::new`
/// and `resolve_binary` read `PATH` only under `cfg!(windows)` (EXECUTED 0 events on macOS), `is_readable_stdin` is an
/// `fstat` plus a `log::debug!` that emits only under a debug-level logger; tokio_postgres `Connection::poll_message` drives
/// the caller's stream (EXECUTED 65 bytes up over TCP, 0 over an in-memory `duplex`, 0 with nothing in flight); rand
/// `Fill::fill_slice` draws from the caller's `R` (EXECUTED 0 entropy for a seeded `StdRng`, 1 for the thread RNG).
fn b11_r1528(crate_name: &str, path: &str) -> Option<Option<&'static str>> {
    let rest = path.strip_prefix(crate_name)?.strip_prefix("::")?;
    // free functions first: the module/type split below would read `term::is_dumb` as a type
    match (crate_name, rest) {
        ("console", "is_dumb" | "term::is_dumb") => return Some(Some("Env")),
        ("console", "set_colors_enabled" | "utils::set_colors_enabled" | "set_colors_enabled_stderr"
            | "utils::set_colors_enabled_stderr" | "set_true_colors_enabled" | "utils::set_true_colors_enabled"
            | "set_true_colors_enabled_stderr" | "utils::set_true_colors_enabled_stderr" | "true_colors_enabled"
            | "utils::true_colors_enabled" | "true_colors_enabled_stderr" | "utils::true_colors_enabled_stderr") => {
            return Some(Some("Env"))
        }
        ("rand", "make_rng") => return Some(Some("Rand")),
        _ => {}
    }
    let (head, method) = rest.rsplit_once("::")?;
    let ty = head.rsplit("::").next().unwrap_or(head);
    let hit = |e: &'static str| Some(Some(e));
    match (crate_name, ty, method) {
        ("env_logger", "Formatter", "timestamp" | "timestamp_seconds" | "timestamp_millis" | "timestamp_micros" | "timestamp_nanos") => hit("Clock"),
        ("env_logger", "ConfigurableFormat", "format") => hit("Clock"),
        ("elasticsearch", "Transport", "single_node" | "static_node_list" | "sniffing_node_list" | "cloud") => hit("Env"),
        ("elasticsearch", "TransportBuilder", "build") => hit("Env"),
        ("elasticsearch", "MultiNodeConnectionPool", "reseed") => hit("Clock"),
        ("tokio_postgres" | "deadpool_postgres" | "postgres", "Client" | "Transaction" | "ClientWrapper", "execute_raw" | "execute_typed"
            | "query_typed_raw" | "query_typed_one" | "query_typed_opt" | "query_scalar" | "query_one_scalar"
            | "query_opt_scalar" | "bind" | "bind_raw" | "query_portal" | "query_portal_raw" | "commit" | "rollback"
            | "savepoint") => hit("Db"),
        ("tokio_postgres" | "deadpool_postgres" | "postgres", "Client" | "ClientWrapper", "simple_query_raw" | "check_connection") => hit("Db"),
        // deadpool's sealed `GenericClient` (implemented for its `Client` and `Transaction` only, both EXECUTED above)
        ("deadpool_postgres", "GenericClient", "execute_raw") => hit("Db"),
        // `ToStatementType` lives in tokio-postgres's private `to_statement::private` module and the method needs the
        // crate-private `Arc<InnerClient>`, so no consumer can call it; it is `prepare::prepare` (a Parse round trip), and
        // that is what is charged should a spelling ever reach it.
        ("tokio_postgres", "ToStatementType", "into_statement") => hit("Db"),
        // `DecompressionMatcherBuilder::build` is a glob-set compile plus `resolve_binary` (a no-op off Windows): it spawns
        // nothing, and the `::build` suffix rule for `CommandReaderBuilder::build` was charging it `Exec`. EXECUTED 0 spawns.
        ("grep_cli", "DecompressionMatcherBuilder", "build") => Some(None),
        ("grep_cli", "DecompressionMatcherBuilder", "associate" | "try_associate") => hit("Env"),
        ("backoff", "ExponentialBackoff", "get_elapsed_time" | "reset" | "default") => hit("Clock"),
        ("backoff", "ExponentialBackoff", "next_backoff") => hit("Rand"),
        ("backoff", "ExponentialBackoffBuilder", "build") => hit("Clock"),
        ("backoff", "SystemClock", "now") => hit("Clock"),
        ("rustls", "ClientConnection" | "UnbufferedClientConnection", "new" | "new_with_alpn") => hit("Rand"),
        ("etcetera", "Apple" | "Xdg" | "Unix" | "Windows", "new") => hit("Env"),
        ("time", "Instant", "elapsed") => hit("Clock"),
        ("time", "SignedDuration" | "Duration", "time_fn") => hit("Clock"),
        ("time", "UtcOffset", "current_local_offset") => hit("Clock"),
        ("portable_pty", "CommandBuilder", "new" | "from_argv" | "new_default_prog") => hit("Env"),
        ("notify", "PollWatcher", "with_initial_scan") => hit("Clock"),
        ("native_tls_crate" | "native_tls", "TlsConnectorBuilder", "build") => hit("Fs"),
        ("duct", "Handle", "wait_timeout" | "wait_deadline") => hit("Clock"),
        ("dotenvy", "Iter", "load_override") => hit("Env"),
        _ => None,
    }
}

/// SOUNDNESS R1528 (b10) — crossterm 0.29.0, ABOVE its 0.28.1 ceiling (`CALIBRATED_CEILINGS` is NOT raised): a `Cargo.lock`
/// consumer got `invisible:[crossterm]` on every unmatched call and a lockless one nothing; a rule replaces that disclosure
/// with the concrete effect. EXECUTED in a consumer fixture under a DYLD interposer (`getenv`, `open`, `isatty`, `ioctl`,
/// `tcgetattr`, `tcsetattr`) and, for the terminal calls, under a pseudo-terminal whose master answers the cursor query
/// (handoff `rust-r1528/b10/`).
///
/// CHARGED `Env`: `Colored::{ansi_color_disabled, ansi_color_disabled_memoized, set_ansi_color_disabled}`,
/// `style::force_color_output` (`NO_COLOR`; EXECUTED 1 `getenv NO_COLOR` each; the memoized and the setter read it ONCE per
/// process — EXECUTED 0 reads on a second call, an accepted over-charge: the first call is the one every program makes) and
/// `style::available_color_count` (`COLORTERM`, then `TERM`; EXECUTED, on every call).
/// CHARGED `Ipc`: `cursor::position` (EXECUTED under a pty: `ESC [ 6 n` written to the terminal, raw mode toggled with
/// 2 `tcsetattr`, the reply read; with no controlling terminal it opens `/dev/tty` and returns an error), and
/// `event::EventStream::{new, next, poll_next}`: `next` is the read (EXECUTED: `block_on(stream.next())` returned the key typed
/// on the pty); `new` is charged by this file's own constructor convention (the `reqwest` `bytes_stream` rule) because the
/// terminal read hides behind a `Stream::next` a consumer often holds untyped — EXECUTED: `new` itself writes and reads
/// nothing, it probes the tty (`isatty`/`ioctl`, or opens `/dev/tty` when stdin is not one, panicking when there is none)
/// and spawns the poller thread. An accepted over-charge when the stream is never polled.
///
/// NOT charged, and filed (R1595): `Print::write_ansi` and `SetTitle::write_ansi` write the caller's `T: Display` into the
/// caller's writer (EXECUTED: 0 events for `&str`, and 1 `NO_COLOR` read for `Print(Colored::..)`), so the effect is the type
/// argument's; `SetTitle::execute_winapi` and `ansi_support::supports_ansi` are `cfg(windows)` and cannot be executed on
/// this host (read only).
fn crossterm_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("crossterm::")?;
    match rest {
        "style::available_color_count" | "available_color_count" | "style::force_color_output" | "force_color_output" => {
            return Some("Env")
        }
        "cursor::position" | "position" | "cursor::sys::unix::position" | "cursor::sys::position" => return Some("Ipc"),
        _ => {}
    }
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        (
            "" | "style" | "style::types" | "style::types::colored",
            "Colored",
            "ansi_color_disabled" | "ansi_color_disabled_memoized" | "set_ansi_color_disabled",
        ) => Some("Env"),
        ("" | "event" | "event::stream", "EventStream", "new" | "next" | "poll_next") => Some("Ipc"),
        _ => None,
    }
}

/// SOUNDNESS R1528 (b10) — reqwest 0.13.5, ABOVE its 0.13.4 ceiling (`CALIBRATED_CEILINGS` is NOT raised). EXECUTED in a
/// consumer fixture under a DYLD interposer (`getenv`, `open`) and a local HTTP server (handoff `rust-r1528/b10/`).
///
/// CHARGED `Env`: `ClientBuilder::build` (async and blocking) and `Client::new`/`Client::build` (the scan attributes a chain
/// hop off `Client::builder()` to the root type, so `Client::builder().timeout(..).build()` reaches classify as
/// `reqwest::Client::build`): EXECUTED `ALL_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY` (and lowercase) read on EVERY call
/// (a second build in the same process reads them again), 0 for `ClientBuilder::new()`; with `HTTP_PROXY` set the call still
/// opens nothing but the platform's own configuration plumbing. The `Fs` the self-scan also saw depends on the TLS feature set
/// (native roots): no file was opened by `build` on this macOS host with the default features, and Linux was not executed, so
/// it is NOT charged. `NoProxy::from_env` reads `NO_PROXY` / `no_proxy` (EXECUTED).
/// CHARGED `Fs`: `multipart::Form::file`, async and blocking (EXECUTED: `open(<path>)` is attempted, including for a missing path).
fn reqwest_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("reqwest::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        ("" | "async_impl::client" | "blocking" | "blocking::client", "ClientBuilder" | "Client", "build") => Some("Env"),
        ("" | "blocking" | "blocking::client", "Client", "new") => Some("Env"),
        ("" | "multipart" | "async_impl::multipart" | "blocking::multipart", "Form", "file") => Some("Fs"),
        ("" | "proxy", "NoProxy", "from_env") => Some("Env"),
        _ => None,
    }
}

/// SOUNDNESS R1528 (b10) — mysql 28.0.3, ABOVE its 28.0.0 ceiling (`CALIBRATED_CEILINGS` is NOT raised). EXECUTED against
/// MySQL 8 (docker) behind a counting TCP proxy that the fixture resets and reads at its own start and end markers, beside
/// an idle control (0 conns, 0 bytes) (handoff `rust-r1528/b10/`).
///
/// CHARGED `Db`: `Conn::reset` (5 bytes up / 11 down), `Conn::change_user` and `PooledConn::change_user` (110 / 65),
/// `Pool::try_get_conn` (10 / 22 on an idle pool), `Pool::start_transaction` (40 / 33), `Conn::start_transaction` and
/// `PooledConn::start_transaction` (35 / 22; never rows), `Conn::get_binlog_stream` and `PooledConn::get_binlog_stream`
/// (feature `binlog`; COM_BINLOG_DUMP, 80 / 22), and `Pool::new`: EXECUTED 10 connections and 4,040 bytes with the default
/// pool constraints (min 10). The accepted over-charge is `PoolConstraints::new(0, ..)`, with which `Pool::new` connects
/// nothing (EXECUTED 0 / 0): the default is the idiom that connects.
///
/// READ PURE, `REVIEWED_PURE_ENTRIES`: `PooledConn::unwrap` (EXECUTED 0 conns, 0 bytes: it moves the `Conn` out).
fn mysql_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("mysql::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        ("" | "conn", "Conn", "reset" | "change_user" | "start_transaction" | "get_binlog_stream") => Some("Db"),
        ("" | "conn::pool", "PooledConn", "change_user" | "start_transaction" | "get_binlog_stream") => Some("Db"),
        ("" | "conn::pool", "Pool", "new" | "try_get_conn" | "start_transaction") => Some("Db"),
        _ => None,
    }
}

/// SOUNDNESS R1528 (b10) — diesel 2.3.14, ABOVE its 2.3.13 ceiling (`CALIBRATED_CEILINGS` is NOT raised). EXECUTED against a
/// file-backed SQLite (bundled) and PostgreSQL 16 (docker), the ground truth read from the database itself (handoff
/// `rust-r1528/b10/`).
///
/// CHARGED `Db`: `batch_execute` (EXECUTED: the table it creates exists afterwards, on SQLite), `SqliteConnection::
/// {immediate_transaction, exclusive_transaction}` and `AnsiTransactionManager::begin_transaction_sql` (EXECUTED: a second
/// connection's write fails with `database is locked` inside them and succeeds inside a deferred `transaction`),
/// `SqliteConnection::serialize_database_to_buffer` (8,192 bytes of the database image) and `deserialize_readonly_database_
/// from_buffer` (EXECUTED: the table of the buffer's database exists afterwards, the connection's own table does not), and
/// `TransactionBuilder::run` (EXECUTED on PostgreSQL: `current_setting('transaction_read_only')` is `on` inside it), and the
/// sibling `Connection::transaction` (below). The
/// scan attributes `conn.build_transaction().read_only().run(..)` to the ROOT type, so the same rule keys on
/// `PgConnection::run`, which has no such method of its own.
fn diesel_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("diesel::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        ("" | "sqlite" | "sqlite::connection" | "pg" | "pg::connection" | "connection", "SqliteConnection" | "PgConnection" | "SimpleConnection", "batch_execute") => Some("Db"),
        (
            "" | "sqlite" | "sqlite::connection",
            "SqliteConnection",
            "immediate_transaction" | "exclusive_transaction" | "serialize_database_to_buffer" | "deserialize_readonly_database_from_buffer",
        ) => Some("Db"),
        ("" | "connection" | "connection::transaction_manager", "AnsiTransactionManager", "begin_transaction_sql") => Some("Db"),
        // `Connection::transaction`, a sibling the generator never listed (a provided trait method): EXECUTED on PostgreSQL, the
        // closure ran inside an explicit transaction (`clock_timestamp() - now()` > 80 ms after a 100 ms sleep) and in the
        // autocommit control it did not. SQLite takes the same `AnsiTransactionManager` path (READ).
        ("" | "sqlite" | "sqlite::connection" | "pg" | "pg::connection" | "connection", "SqliteConnection" | "PgConnection" | "Connection", "transaction") => {
            Some("Db")
        }
        ("" | "pg" | "pg::transaction", "TransactionBuilder", "run") => Some("Db"),
        ("" | "pg" | "pg::connection", "PgConnection", "run") => Some("Db"),
        _ => None,
    }
}

/// SOUNDNESS R1528 — lapin 4.12.0, ABOVE its 4.10.0 ceiling (`CALIBRATED_CEILINGS` is NOT raised: that needs the whole
/// crate table re-verified at 4.12). A `Cargo.lock` consumer therefore already got `invisible:[lapin]` on every unmatched
/// lapin call and a lockless one nothing; a rule here replaces that disclosure with the concrete effect. EXECUTED against a
/// real RabbitMQ 3 (docker, behind a counting TCP proxy that the fixture reads at its own start and end markers, so the
/// delta is exact) beside an idle control (handoff `rust-r1528/mq/`).
///
/// CHARGED `Net`: every connection opener the existing `::connect` rule did not reach, `Connection::{connect_uri,
/// connect_uri_with_runtime, connect_uri_with_config}` and the `AMQPUri` / `Connect` `connect_with_config`, plus the two
/// siblings that were never rows, `Connection::{connect_with_config, connect_with_runtime}` (EXECUTED: each opened exactly
/// 1 connection and moved 373 bytes up / 567 down); `Connection::update_secret` (19 up / 12 down); the generated
/// `Channel::{access_request, channel_flow}` that the `::basic_` / `::queue_` / `::exchange_` family never covered (19 / 13
/// bytes up); and `Acker::{ack, nack, reject}` (21 bytes up: the `basic.ack` / `basic.nack` / `basic.reject` frame).
///
/// READ PURE, `REVIEWED_PURE_ENTRIES`: `Channel::wait_for_confirms` sends nothing (EXECUTED: 0 bytes up with nothing pending
/// and with a publish pending; the 21 bytes DOWN in the second case are the confirmation, read by the IO loop thread that
/// `connect` started, and `basic_publish` carries the `Net`).
///
/// NOT charged, and filed (R1593): `Connection::connector` runs a CALLER-SUPPLIED connect closure (EXECUTED: 1
/// connection with a closure that dials, 0 bytes with one that returns an error), `Connection::run` (EXECUTED: 0 bytes up
/// while another handle is alive, but 21 up / 12 down when it holds the LAST handle: `drop(self)` closes the connection)
/// and `Consumer::set_delegate` (EXECUTED: it runs the caller's delegate on every queued delivery, 0 bytes of its own).
fn lapin_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("lapin::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        (
            "" | "connection",
            "Connection",
            "connect_uri" | "connect_uri_with_runtime" | "connect_uri_with_config" | "connect_with_config"
            | "connect_with_runtime" | "update_secret",
        ) => Some("Net"),
        ("" | "connection" | "uri", "AMQPUri" | "Connect", "connect_with_config") => Some("Net"),
        ("" | "channel" | "generated::channel", "Channel", "access_request" | "channel_flow") => Some("Net"),
        ("" | "acker", "Acker", "ack" | "nack" | "reject") => Some("Net"),
        _ => None,
    }
}

/// SOUNDNESS R1528 — tonic 0.14.6, ABOVE its 0.12.3 ceiling (`CALIBRATED_CEILINGS` is NOT raised: that needs the whole
/// crate table re-verified at 0.14). A `Cargo.lock` consumer already got `invisible:[tonic]` on every unmatched tonic
/// call and a lockless one nothing. EXECUTED in a consumer fixture under a `bind` / `listen` / `connect` / `getenv` / `open`
/// interposer, with a probe that dials the port before and after the call (handoff `rust-r1528/mq/`).
///
/// THE LOAD-BEARING FINDING: the quickstart `Server::builder().add_service(svc).serve(addr).await` reaches classify as
/// `tonic::transport::Server::serve` — the scan attributes `.add_service(..)` and the chain after it to the ROOT type
/// `Server`, not to `Router` — so the existing `Router::serve` rule never fired for it, and the rows that name `Server::
/// serve` are the common idiom, not an obscure one. EXECUTED: `serve` and `serve_with_shutdown` bound and listened on
/// the port (the probe could not connect before and could after), in the builder spelling and the quickstart chain.
///
/// CHARGED `Net`: `Server::{serve, serve_with_shutdown}` (and so the quickstart chain) and `TcpIncoming::bind` (EXECUTED:
/// `bind` + `listen` logged; 0.14.6 has no `TcpIncoming::new`, which is what the older rule named).
///
/// NOT charged, and filed (R1594): `serve_with_incoming{,_shutdown}` on `Server` and `Router` serve whatever stream they are
/// handed (EXECUTED: over a `TcpIncoming` a client connected and got a reply; over an in-memory `duplex` stream the request was
/// served with no `bind`, `listen` or `connect` at all); `Endpoint::tls_config{,_with_verifier}` read `SSL_CERT_FILE` /
/// `SSL_CERT_DIR` and the root store only for `ClientTlsConfig::with_native_roots()` (EXECUTED: opens of the bundle with
/// it, none with `with_webpki_roots()` or a bare config), and for `use_key_log()` read `SSLKEYLOGFILE` and open the file
/// (EXECUTED, `tls_config_with_verifier`; native roots plus a verifier is an error before any read); `Code::from_bytes`
/// and `Status::from_header_map` log (`trace!` / `warn!`) only on malformed input (EXECUTED: 0 records valid, 1 invalid);
/// `Streaming::{message, trailers}` read the body they were given (EXECUTED: `message` returned a status the server pushed
/// 1.75 s later; `trailers` did not return within 1.2 s on a live stream).
fn tonic_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("tonic::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        ("" | "transport" | "transport::server" | "server", "Server", "serve" | "serve_with_shutdown") => Some("Net"),
        ("" | "transport" | "transport::server" | "transport::server::incoming" | "server::incoming", "TcpIncoming", "bind") => {
            Some("Net")
        }
        _ => None,
    }
}

/// SOUNDNESS R1528 — aws-config 1.12.0 (the version the rules were written against AND the resolved one: ceiling
/// 1.12.0, so a `Cargo.lock` consumer and a lockless one both got NOTHING for these rows — in-ceiling exemption).
/// Every body READ, and each EXECUTED in a consumer fixture under a DYLD interposer that logs every `getenv`, `open`
/// and `connect` the process makes, beside a local IMDS / ECS mock that counts requests (handoff `rust-r1528/awsq/`).
///
/// CHARGED `Fs` — the profile-file readers. `ProviderConfig::profile()` loads `~/.aws/config` and `~/.aws/credentials`
/// (EXECUTED: both opened, with `AWS_CONFIG_FILE` / `AWS_SHARED_CREDENTIALS_FILE` / `AWS_PROFILE` read first) and the
/// setting's own `AWS_*` variable is read beside it: `endpoint_url_provider{,_with_origin}`,
/// `ignore_configured_endpoint_urls_provider`, `{request_checksum_calculation,response_checksum_validation}_provider`,
/// `use_dual_stack_provider`, `use_fips_provider`, `app_name::Builder::app_name`, `ProfileFileRegionProvider::region`,
/// and a sibling the generator never listed because its body has no `tracing` call: `retry_config::Builder::retry_config`
/// (EXECUTED the same). `ProviderConfig`'s `env` / `fs` setters are `pub(crate)`, so no consumer can hand one a fake
/// environment: the reads are always real.
///
/// CHARGED `Net` — the verbs that can reach IMDS or STS, the effect `.load()` already carries: the default region chain
/// (`DefaultRegionChain::region`, `ProviderConfig::{load_default_region, with_default_region}`) asks IMDS when the
/// environment and the profile give no region; `ImdsRegionProvider::region` always does; `default_provider::{credentials,
/// token}::Builder::build` resolve that region chain first; `AssumeRoleProvider::{build, build_from_provider}` and
/// `SsoTokenProvider::build` call `load_defaults(..)` unless an `SdkConfig` was supplied; `EcsCredentialsProvider::
/// credentials` GETs the container-credentials URL. EXECUTED: with no region anywhere the mock IMDS counted a token PUT
/// and a region GET for each of them (`assume build` 3 hits), and with a profile region none — so the `Net` is
/// STATE-CONDITIONAL, kept for the reason `load` is (the default idiom with no configured region does reach it).
/// Two over-charges follow and are accepted: a `.region(Region::new(..))` override (EXECUTED: 3 `AWS_*` reads, no file, no
/// socket) and `AssumeRoleProvider::builder(..).configure(&sdk).build()` (EXECUTED: nothing) read pure.
/// `credentials::default_provider` and `token::default_provider` (not rows; the same `Builder::build` behind a free fn)
/// are charged with them.
/// 2026-11-13 refresh: `CredentialsProviderChain::{default_provider, or_default_provider}` and `TokenProviderChain::{..}` are
/// `first_try(.., default_provider().await)` / `or_else(.., default_provider().await)` (meta/credentials/chain.rs:79-93,
/// meta/token.rs:70-84), so they are those free fns' effect and charged with them. The scan used to DROP the
/// `DefaultCredentialsChain::builder().build()` edge inside the free fn (R1717's builder typing restored it, which is what grew
/// the four rows as `Log,Unknown`), so the reading above carries over unchanged: `Net`, state-conditional.
///
/// ONE EFFECT IS ALL `classify` CAN CARRY (R1575 class): every `Fs` row also reads `AWS_*` (`Env`) and every `Net` row also
/// reads the environment and the profile files (`Env`, `Fs`); only the one named is charged.
///
/// NOT charged, and filed (R1588): `RegionProviderChain::region` and `Box<dyn ProvideRegion>::region` forward to whichever
/// providers the chain holds (`conditional`: EXECUTED `RegionProviderChain::default_provider()` reaches the env, the profile
/// and IMDS and `first_try(Region::new(..))` reaches nothing), and `profile::{credentials, token}::Builder::build` only
/// construct a provider whose I/O is its later `provide_credentials` / `provide_token` (`silent`: a rule there would charge
/// the span `tracing::debug_span!` and one `AWS_EXECUTION_ENV` read and, above the ceiling, delete the `invisible` that is
/// the only disclosure of that later I/O). The scan types `.build()` after `builder()` as the root type, so the paths
/// below are the root-typed spellings as well as the declaring `Builder` ones.
fn aws_config_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("aws_config::")?;
    match rest {
        "default_provider::endpoint_url::endpoint_url_provider"
        | "default_provider::endpoint_url::endpoint_url_provider_with_origin"
        | "default_provider::ignore_configured_endpoint_urls::ignore_configured_endpoint_urls_provider"
        | "default_provider::checksums::request_checksum_calculation_provider"
        | "default_provider::checksums::response_checksum_validation_provider"
        | "default_provider::use_dual_stack::use_dual_stack_provider"
        | "default_provider::use_fips::use_fips_provider" => return Some("Fs"),
        "default_provider::credentials::default_provider" | "default_provider::token::default_provider" => {
            return Some("Net")
        }
        _ => {}
    }
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    match (module, ty, method) {
        ("default_provider::app_name", "Builder", "app_name")
        | ("default_provider::retry_config", "Builder", "retry_config")
        | ("profile::region", "ProfileFileRegionProvider", "region") => Some("Fs"),
        ("default_provider::region", "DefaultRegionChain", "region")
        | ("imds::region", "ImdsRegionProvider", "region")
        | ("provider_config", "ProviderConfig", "load_default_region" | "with_default_region")
        | ("default_provider::credentials", "DefaultCredentialsChain" | "Builder", "build")
        | ("default_provider::token", "DefaultTokenChain" | "Builder", "build")
        | ("sts" | "sts::assume_role", "AssumeRoleProvider" | "AssumeRoleProviderBuilder", "build" | "build_from_provider")
        | ("sso::token", "SsoTokenProvider" | "Builder", "build")
        | ("ecs", "EcsCredentialsProvider", "credentials")
        // the chain constructors that `.await` the free `default_provider` above (aws-config 1.13.2; the 2026-11-13 refresh)
        // (`""` is the crate-root spelling the coverage-gate's consumer-path guess records, `aws_config::TokenProviderChain::..`)
        | ("meta::credentials::chain" | "meta::credentials" | "", "CredentialsProviderChain", "default_provider" | "or_default_provider")
        | ("meta::token" | "", "TokenProviderChain", "default_provider" | "or_default_provider") => Some("Net"),
        _ => None,
    }
}

/// SOUNDNESS R1528 — sqlx-core 0.9.0 (ceiling 0.9.0, resolved 0.9.0: in-ceiling, so both arms got nothing). EXECUTED
/// against a real postgres 16 (docker) reached through a counting TCP proxy with idle windows beside it, plus a `log`
/// logger and a `clock_gettime` interposer for the two logger rows (handoff `rust-r1528/awsq/`). A `sqlx` FACADE
/// consumer spells these `sqlx::PgPool::begin_with` / `sqlx::pool::PoolConnection::close` — crate `sqlx`, not
/// `sqlx_core`, so the `sqlx_core` rows are reached by a facade user only through this function's `sqlx` arm.
///
///   * `Db`: `Pool::begin_with` (35 bytes up, 49 down: acquire + `BEGIN`), `PoolConnection::return_to_pool` (5 up, 6
///     down: the unconditional `ping` in `Floating::return_to_pool`, pool/connection.rs:275-309).
///   * `Net`: `PoolConnection::close` (5 bytes up: the protocol `Terminate`, then the socket closes) and `net::connect_tcp`
///     (1 connection: the consumer spelling is the `net::` re-export, which no rule matched; the file-path spelling
///     `net::socket::connect_tcp` is recognised too).
///   * `Fs`: `Migrator::new` over a path, `fs::ReadDir::next`, and `migrate::source::resolve_blocking{,_with_config}`
///     (the file-path spelling of the two the `::migrate::resolve_blocking` rule already charges). EXECUTED: the result
///     follows the directory (1 migration, then 2 after a file is added; an error on a missing path).
///   * `Clock`: `logger::QueryLogger::new` (`Instant::now()`, EXECUTED 1 `clock_gettime` against 0 for an empty bracket).
///   * `Log`: `QueryLogger::finish` (EXECUTED: 1 record on target `sqlx::query` at the default statement level; the
///     record is gated on the active level, charged like `tracing::info!`).
///
/// READ PURE, `REVIEWED_PURE_ENTRIES`: `PoolConnection::{detach, leak}` return the inner connection and drop a size guard;
/// the doc comment's "a task will be spawned to replace this connection" is not in the body (EXECUTED: 0 bytes, 0
/// connections).
///
/// NOT charged, and filed (R1589): `Pool::connect_lazy{,_with}` / `PoolOptions::connect_lazy{,_with}` (`conditional`:
/// EXECUTED 0 connections in 5 spellings, but 1 connection and 411 bytes up when `min_connections(1)` is set with both
/// timeouts disabled and the pool is HELD, because the maintenance task is spawned), the four `Box<S: Socket>` `poll_*`
/// forwarders (`conditional`: the socket type's own effect; the consumer spelling is the trait path `Socket::poll_*`),
/// and `MigrationSource::resolve` for `PathBuf` / `ResolveWith` (`silent`: no spelling reaches them — `p.resolve()` on a
/// `std::path::PathBuf` or on a `ResolveWith` tuple struct is untyped to the scan, EXECUTED to read the directory).
fn sqlx_r1528(krate: &str, path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix(krate)?.strip_prefix("::")?;
    if krate == "sqlx_core" {
        match rest {
            "net::connect_tcp" | "net::socket::connect_tcp" => return Some("Net"),
            "migrate::source::resolve_blocking" | "migrate::source::resolve_blocking_with_config" => {
                return Some("Fs")
            }
            _ => {}
        }
    }
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    let pool = ty == "Pool" || (krate == "sqlx" && ty.ends_with("Pool"));
    if pool && matches!(module, "" | "pool" | "postgres" | "mysql" | "sqlite" | "any") && method == "begin_with" {
        return Some("Db");
    }
    // SOUNDNESS R1618 — `connect_with` is the sqlx facade's OTHER connection-opening verb. The facade's `VERBS` list names
    // `::connect` only, so `MySqlConnection::connect_with(&opts)`, `MySqlPool::connect_with(opts)` and
    // `MySqlPoolOptions::connect_with(opts)` read PURE (absent from `functions[]`, no `invisible`; the lane that filed
    // R1618 found them while executing the `::connect` rows). EXECUTED against mysql:8 (macOS, DYLD interposer): each opens a
    // TCP connection and draws TLS entropy, exactly as the `::connect` spelling. Keyed on module + type + method: the
    // facade's root re-export or a driver module, a `*Connection` / `*Pool` / `*PoolOptions` type.
    if krate == "sqlx"
        && method == "connect_with"
        && matches!(module, "" | "pool" | "mysql" | "postgres" | "sqlite" | "any")
        && (ty.ends_with("Connection") || ty.ends_with("Pool") || ty.ends_with("PoolOptions"))
    {
        return Some("Db");
    }
    // SOUNDNESS R1623 — sqlx 0.9.0 Postgres/SQLite/pool entries that read pure or silent. See `sqlx_r1623`.
    if krate == "sqlx" {
        if let Some(effect) = sqlx_r1623(module, ty, method) {
            return Some(effect);
        }
    }
    match (module, ty, method) {
        ("" | "pool" | "pool::connection", "PoolConnection", "close") => Some("Net"),
        ("" | "pool" | "pool::connection", "PoolConnection", "return_to_pool") => Some("Db"),
        ("" | "migrate" | "migrate::migrator", "Migrator", "new") => Some("Fs"),
        // SOUNDNESS R1528 (sqlx-core 0.9.0 refresh, covgate lane) — the four migration RUNNERS. EXECUTED (sqlite file db behind
        // `connect_lazy`, so the file exists only if the verb touched it): `run`, `run_to`, `skip`, `undo` and the doc-hidden
        // `run_direct` each created the db file and `_sqlx_migrations` (`run`/`run_to`/`run_direct` also applied the migration:
        // table `t1`; `skip` marked it applied: 1 row; `undo` ensured the table: 0 rows); the pure control `Migrator::iter` and a
        // constructed-but-not-run `Migrator`: no file. The scan could not reach this itself: the connection is the caller's
        // `A: Acquire` and the `Migrate` impl is dispatched, so the oracle nominated `Clock,Log,Unknown` and no rule named `Db`.
        ("" | "migrate" | "migrate::migrator", "Migrator", "run" | "run_to" | "skip" | "undo" | "run_direct") => Some("Db"),
        ("fs", "ReadDir", "next") if krate == "sqlx_core" => Some("Fs"),
        ("logger", "QueryLogger", "new") if krate == "sqlx_core" => Some("Clock"),
        ("logger", "QueryLogger", "finish") if krate == "sqlx_core" => Some("Log"),
        _ => None,
    }
}

/// SOUNDNESS R1623 — the sqlx 0.9.0 entries R1618 left (its residual (c)), EXECUTED on macOS (DYLD interposer) against
/// postgres:16 (TLS on, SCRAM), mysql:8 and real sqlite files, plus the postgres server's `log_statement=all` for the one
/// round-trip the interposer cannot see (handoff `rust-r1623/`). Primary effects only; the second effects are `ALSO_EFFECTS`.
///
///   * `Env` (PRIMARY): `PgConnectOptions::{new, new_without_pgpass, default, from_str, from_url}` read the twelve `PG*`
///     variables (14 with `.pgpass`: `HOME`/`PGPASSFILE`), and so does `PgPool::connect_lazy(url)` /
///     `PgPoolOptions::connect_lazy(url)`, whose URL is parsed with no connect. EXECUTED: 12 `getenv` + 3 `stat` on every one,
///     0 connections for the lazy pair. All were ABSENT, so a `deny Env` over code that builds Postgres options passed.
///     `connect_lazy_with(opts)` parses nothing and stays pure, as do the option setters (`host`, `port`, `ssl_mode`, ...).
///   * `Db`: `Pool::try_begin` (EXECUTED against `log_statement=all`: a warm pool's `try_begin` sent `BEGIN`; the cold pool's
///     returns `None` with no I/O, which is the stated over-charge) and `PgListener::connect_with(&pool)` (a COLD pool connects:
///     1 connect, 6 `getentropy`; a warm pool does not). `try_acquire` stays pure (EXECUTED: 0 events cold and warm).
///
/// The facade spells a driver type under the root (`sqlx::PgPool`) or its driver module (`sqlx::postgres::PgPool`); both are
/// accepted. A generic `sqlx::Pool<DB>` is not claimed: the driver, and so the effect, is not in the path.
fn sqlx_r1623(module: &str, ty: &str, method: &str) -> Option<&'static str> {
    if !matches!(module, "" | "postgres" | "mysql" | "sqlite" | "any" | "pool") {
        return None;
    }
    let pg_mod = matches!(module, "" | "postgres");
    match (ty, method) {
        ("PgConnectOptions", "new" | "new_without_pgpass" | "default" | "from_str" | "from_url") if pg_mod => Some("Env"),
        ("PgPool" | "PgPoolOptions", "connect_lazy") if pg_mod => Some("Env"),
        ("PgListener", "connect_with") if pg_mod => Some("Db"),
        (t, "try_begin") if t == "Pool" || t.ends_with("Pool") => Some("Db"),
        _ => None,
    }
}

/// SOUNDNESS R1528 — redis 1.7.1, ABOVE the 1.6.0 ceiling (`CALIBRATED_CEILINGS` is NOT raised: that needs the whole crate
/// table re-verified at 1.7.1, which this lane did not do). A `Cargo.lock` consumer therefore already got
/// `invisible:[redis]` on every unmatched redis call and a lockless one nothing; a rule here replaces that disclosure
/// with the concrete effect. EXECUTED against a real redis 7 (docker, standalone and a 3-master cluster), the server's
/// `total_commands_processed` / `total_connections_received` read around each call beside an idle control, a counting TCP
/// proxy where the stream is caller-supplied, and an entropy interposer for the `Rand` rows (handoff `rust-r1528/awsq/`).
///
/// CHARGED `Db` (the redis rules' own class for a connection or a command): `Client::{is_open, check_connection}` (both
/// OPEN A NEW CONNECTION: +1 connection, +2 and +3 commands — `is_open` is not a flag read on a `Client`),
/// `Client::{get_async_pubsub, get_async_monitor}`, `Cmd::iter_async` (+1 `SCAN`), `aio::MultiplexedConnection::
/// {send_packed_command, send_packed_commands}` (+1 command, 0 connections), the sync and async `ClusterConnection::
/// route_command` and `ClusterPipeline::exec` (+1 command each), `MultiplexedConnection::connect_with_config` (+1
/// connection, +2 commands) and `ClusterClient::get_pending_async_connection_with_config` (+13 commands and +3
/// connections within two seconds of being HELD, never used: the pending connection is a background task).
/// CHARGED `Rand`: `Replicas::choose_random` and `RandomReplicaStrategy::route_read` (`rand::rng()`; EXECUTED 1 OS
/// entropy read on a fresh thread against 0 for an idle one; `route_read` is READ only — `ReadCandidates` has no public
/// constructor, so a consumer reaches it only by delegating from its own `ReadRoutingStrategy`).
///
/// READ PURE, `REVIEWED_PURE_ENTRIES`: `Client::build_with_tls` and `ClusterClientBuilder::build` parse PEM bytes the caller
/// SUPPLIED (`retrieve_tls_certificates`) and assemble a struct; EXECUTED `build_with_tls` made no server contact.
///
/// NOT charged, and filed (R1590): `Sentinel::build`, `SentinelClient::build` and `SentinelClientBuilder::build` (`silent`:
/// they draw a random replica index, EXECUTED, but a `Rand` rule on the constructor deleted the lock arm's `invisible:[redis]`
/// and left the `Db` of the `master_for` / `get_connection` that follows unreported: the receiver is untyped after the `?`),
/// `MultiplexedConnection::{new, new_with_config}` (`conditional`: the handshake is
/// written to the caller's stream — EXECUTED 110 bytes through a TCP proxy and the same 110 bytes into an in-memory
/// `duplex` peer with no server), `EntraIdCredentialsProvider::start` (`conditional`: it spawns a loop over the
/// caller-supplied `TokenCredential`; READ only, no Azure to run it against).
///
/// One effect is all `classify` can carry: connection openers also move bytes (`Net`) and the cluster verbs draw `Rand`.
fn redis_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("redis::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    let cluster_mod = matches!(
        module,
        "cluster" | "cluster_async" | "cluster_handling::sync_connection" | "cluster_handling::async_connection"
    );
    let hit = match ty {
        "Client" => {
            matches!(module, "" | "client")
                && matches!(method, "is_open" | "check_connection" | "get_async_pubsub" | "get_async_monitor")
        }
        "Cmd" => matches!(module, "" | "cmd") && method == "iter_async",
        // SOUNDNESS R1528 (redis 1.8.1 refresh, covgate lane): the SYNC `PubSub`'s command verbs — each writes a command and reads
        // its reply through `cache_messages_until_received_response` (connection.rs:2232-2266). EXECUTED against redis:7 behind a
        // counting proxy, idle window beside each: subscribe 27 up / 31 down, psubscribe 29/33, unsubscribe 30/34, punsubscribe 31/35,
        // ping 14/7, ping_message 21/7; the pure control and an idle window 0/0. `Db` like the `Commands` verbs (these ISSUE a
        // command), where `PubSub::get_message` above only reads. The sync module guard keeps the async `aio` pub/sub out.
        "PubSub" => {
            matches!(module, "" | "connection")
                && matches!(method, "subscribe" | "psubscribe" | "unsubscribe" | "punsubscribe" | "ping" | "ping_message")
        }
        "MultiplexedConnection" => {
            (matches!(module, "aio" | "aio::multiplexed_connection")
                && matches!(method, "send_packed_command" | "send_packed_commands" | "connect_with_config"))
                || (cluster_mod && method == "connect_with_config")
        }
        "ClusterConnection" => cluster_mod && method == "route_command",
        "ClusterPipeline" => {
            (cluster_mod || module == "cluster_handling::sync_connection::pipeline") && method == "exec"
        }
        "ClusterClient" => {
            matches!(module, "cluster" | "cluster_handling::client")
                && method == "get_pending_async_connection_with_config"
        }
        _ => false,
    };
    if hit {
        return Some("Db");
    }
    let rand = match ty {
        "RandomReplicaStrategy" => {
            matches!(module, "cluster_read_routing" | "cluster_handling::read_routing::random_replica")
                && method == "route_read"
        }
        "Replicas" => {
            matches!(module, "cluster_read_routing" | "cluster_handling::read_routing::interface")
                && method == "choose_random"
        }
        _ => false,
    };
    rand.then_some("Rand")
}

/// SOUNDNESS R1528 — the async-nats 0.50.0 broker surface the verb list in `classify` cannot see by name
/// (`get_stream`, `put`, `info`, `keys`, `messages`, `add`, `double_ack`...). The `async_nats` arm already charges
/// every `::publish*`/`::request*`/`::subscribe`/`::flush`/`::connect` suffix; these are the verbs that list misses.
///
/// Matching is on the RECEIVER TYPE NAME plus the method, because the method names are generic (`get`, `put`,
/// `info`, `list`, `delete`) and a bare suffix would fabricate. The module is taken from the consumer's own spelling
/// (`async_nats::jetstream::Context`, `...::kv::Store`, `...::consumer::PullConsumer`; TRACED: the scan hands
/// `classify` exactly the path the consumer wrote, including the `PullConsumer` alias and the receiver type a
/// builder CHAIN inherits, so `stream.direct_get_builder().sequence(1).send()` arrives as `Stream::send` and
/// `consumer.fetch().max_messages(2).messages()` as `PullConsumer::messages`).
///
/// EXECUTED against nats-server with JetStream, one fixture function per row, the server's received messages /
/// bytes / subscription count read before and after (`/varz`): every entry below moved at least one of the three
/// (`Net`), and the pure constructors did not move any (`jetstream::{new,with_domain,with_prefix}`,
/// `ContextBuilder::build`, `Client::new_inbox`, `datetime::now`). The cases worth stating:
///   * `Context::get_stream_no_info` does NOT touch the broker (EXECUTED: zero messages, zero bytes, zero
///     subscriptions; it builds an empty `Stream` handle) and is NOT claimed.
///   * `Store::status`, `Service::{info,stats,reset}`, `Context::wait_for_acks` and the builder constructors
///     (`Consumer::{stream,fetch,batch}`, `Stream::{info_builder,direct_get_builder,raw_message_builder}`,
///     `Service::{group,endpoint_builder}`) read cached/local state and are NOT claimed.
///   * `Consumer::messages` (pull, push, ordered), `Service::endpoint`, `Group::endpoint`, `EndpointBuilder::add`,
///     `ServiceBuilder::start` and `ServiceExt::add_service` are a `SUB` to the broker (EXECUTED: the server's
///     subscription count rose by one or more while the handle was held), not a message; `Net` is the existing
///     family's answer for `::subscribe` and these are that call one hop down.
///   * `jetstream::new`, `with_domain`, `with_prefix` and `ContextBuilder::build` (they share one body) open no
///     connection and are DELIBERATELY NOT RULES (R1576). Their own effect is a `Log` when the `Context` is dropped
///     (EXECUTED with a tracing layer: `spawn_acker`'s `debug!("Acker task exited")`), but the engine does not type
///     `let js = jetstream::new(c)` (a dependency's free fn has no entry in the `ReturnIndex`), so every
///     `js.<verb>()` after it reaches no classify path. MEASURED both arms: with a `Log` rule the function
///     `let js = jetstream::new(c); js.query_account().await` goes from `invisible:[async_nats]` to `['Log']` alone,
///     so the rule would delete the only disclosure of a `Net` it cannot see.
///   * `Client::new_inbox` is a `nuid::next()` draw (EXECUTED: two calls never agree) and `datetime::now` is
///     `OffsetDateTime::now_utc()` (EXECUTED: it advances).
///
/// One effect is all `classify` can carry: these calls also draw an inbox nonce (`Rand`) and most emit two to four
/// `debug!` events (`Log`, EXECUTED through a span-scoped tracing layer); neither is charged (R1575).
fn async_nats_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("async_nats::")?;
    if rest == "datetime::now" {
        return Some("Clock");
    }
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    let js = |m: &str| module == "jetstream" || module == m;
    let hit = match ty {
        "Context" => {
            js("jetstream::context")
                && matches!(
                    method,
                    "query_account" | "create_stream" | "get_stream" | "get_or_create_stream" | "delete_stream"
                        | "update_stream" | "create_or_update_stream" | "stream_by_subject" | "send_publish"
                        | "send_request" | "get_key_value" | "create_key_value" | "update_key_value"
                        | "create_or_update_key_value" | "delete_key_value" | "get_consumer_from_stream"
                        | "delete_consumer_from_stream" | "create_consumer_on_stream" | "update_consumer_on_stream"
                        | "create_consumer_strict_on_stream" | "create_object_store" | "get_object_store"
                        | "delete_object_store"
                )
        }
        // `send` / `fetch` are the DirectGetBuilder / RawMessageBuilder / StreamInfoBuilder terminals, which a
        // builder chain (or a bound builder) reports under the `Stream` receiver it started from.
        "Stream" | "DirectGetBuilder" | "RawMessageBuilder" | "StreamInfoBuilder" => {
            js("jetstream::stream")
                && matches!(
                    method,
                    "info" | "get_info" | "info_with_subjects" | "consumer_info" | "create_consumer"
                        | "create_consumer_strict" | "update_consumer" | "get_consumer" | "get_or_create_consumer"
                        | "delete_consumer" | "pause_consumer" | "resume_consumer" | "reset_consumer"
                        // `unpin_consumer` (async-nats 0.52.0, feature `server_2_11`; the 0.50.0 lane found it absent): one
                        // `CONSUMER.UNPIN.<stream>.<name>` request/reply through `Context::request`. EXECUTED against nats
                        // `-js` behind a counting proxy: 106 up / 198 down (the stream existed, the consumer did not: the
                        // request still goes out); an idle window and a pure control 0.
                        | "unpin_consumer"
                        | "delete_message" | "purge_subject" | "direct_get" | "direct_get_first_for_subject"
                        | "direct_get_last_for_subject" | "direct_get_next_for_subject" | "get_raw_message"
                        | "get_first_raw_message_by_subject" | "get_next_raw_message_by_subject"
                        | "get_last_raw_message_by_subject" | "send" | "fetch"
                )
        }
        "Store" => {
            module == "jetstream::kv"
                && matches!(
                    method,
                    "create" | "create_with_ttl" | "put" | "entry" | "entry_for_revision" | "get" | "update"
                        | "delete" | "delete_expect_revision" | "purge" | "purge_with_ttl"
                        | "purge_expect_revision" | "purge_expect_revision_with_ttl" | "history" | "keys"
                        | "watch" | "watch_many" | "watch_from_revision" | "watch_with_history"
                        | "watch_many_with_history" | "watch_all" | "watch_all_from_revision"
                )
        }
        "ObjectStore" => {
            module == "jetstream::object_store"
                && matches!(
                    method,
                    "get" | "delete" | "info" | "put" | "watch" | "watch_with_history" | "list" | "seal"
                        | "update_metadata" | "add_link" | "add_bucket_link"
                )
        }
        // `Consumer<pull::Config>` and its aliases; `info`/`get_info`/`reset` ask the broker, `messages` subscribes
        // (pull: inbox + a pull request, push: the deliver subject). `stream`/`fetch`/`batch` only build a request.
        "Consumer" | "PullConsumer" | "PushConsumer" | "OrderedPullConsumer" | "OrderedPushConsumer" => {
            matches!(module, "jetstream::consumer" | "jetstream::consumer::pull" | "jetstream::consumer::push")
                && matches!(method, "info" | "get_info" | "reset" | "messages")
        }
        "StreamBuilder" | "FetchBuilder" | "BatchBuilder" => {
            module == "jetstream::consumer::pull" && method == "messages"
        }
        "Message" | "Acker" => {
            js("jetstream::message") && matches!(method, "ack" | "ack_with" | "double_ack" | "double_ack_with")
        }
        // `ServiceExt::add_service` and `ServiceBuilder::start` (a builder chain reports `Client::start`),
        // `Service::endpoint`, `Group::endpoint`, `EndpointBuilder::add` (a chain reports `Service::add`).
        "Client" if matches!(module, "" | "client" | "service") => {
            return match method {
                "add_service" | "start" | "send_request" => Some("Net"),
                "new_inbox" => Some("Rand"),
                _ => None,
            };
        }
        "ServiceBuilder" => module == "service" && method == "start",
        "Service" | "Group" | "EndpointBuilder" => {
            module == "service" && matches!(method, "endpoint" | "add")
        }
        _ => false,
    };
    if !hit {
        return None;
    }
    Some("Net")
}

/// SOUNDNESS R1528 — rdkafka 0.39.0, EXECUTED against a real Kafka broker (docker `apache/kafka`, advertised through
/// a counting TCP proxy: connections / bytes up / bytes down read around ONE call, an idle window of 0 read before it
/// on the same live client; handoff `rust-r1528/kafka/`). The suffix list in `classify` names `send`/`poll`/`flush`/
/// `subscribe`/`commit`/`fetch_*`; these are the verbs that list misses. Matching is on the receiver TYPE NAME plus
/// the method, with the module taken from the consumer's own spelling (crate root, the re-exporting module, or the
/// declaring module), because the method names are generic.
///
/// CHARGED `Net` (each moved the proxy's byte counters; every one of them with a quiet window beside it):
///   * every constructor that builds a librdkafka client (`ClientConfig::{create, create_with_context}`,
///     `Client::new`, and `from_config` / `from_config_and_context` of `AdminClient`, `BaseConsumer`,
///     `StreamConsumer`, `BaseProducer`, `ThreadedProducer`, `FutureProducer`): `rd_kafka_new` starts the broker
///     threads, which dial the bootstrap address on their own. EXECUTED: 1 to 4 connections and 67 to 372 bytes up
///     inside five seconds with NO further call, on 17 of 18 constructors in each of two runs (the 18th reads 0 once
///     and 2 on the repeat, a race with the previous client's teardown); a control pointed at a dead address moved
///     nothing through the proxy. `MockCluster::new` binds a loopback listener (EXECUTED: its bootstrap address
///     accepts a TCP connection), the same `Net` as a `TcpListener::bind`.
///   * `AdminClient::{create_topics, delete_topics, create_partitions, delete_groups, delete_records,
///     describe_configs, alter_configs}`: one admin request each (37 to 186 bytes up, 26 to 2,168 down).
///   * `{Base,Stream}Consumer::{committed, offsets_for_timestamp}` (an OffsetFetch / ListOffsets round trip, EXECUTED
///     with an assigned partition: 47 to 56 bytes up), `incremental_assign` (EXECUTED 391 to 587 bytes up: the
///     partition's leader is looked up and the fetcher starts) and `seek_partitions` (EXECUTED 51 bytes up when the
///     target is a logical offset on a live group partition, 0 on a manual one). Conditional on the state the caller
///     is in, exactly like the existing `::seek` rule beside it, and charged for the same reason: a `Net` that is
///     sometimes absent is an over-approximation, a silent one is not.
///   * `{Base,Threaded,Future}Producer::{init_transactions, commit_transaction, abort_transaction,
///     send_offsets_to_transaction}`: the transaction coordinator round trips.
///
/// CHARGED `Clock`: `Timestamp::now` and `util::current_time_millis` (EXECUTED: two reads five milliseconds apart
/// differ).
///
/// NOT claimed, and why (each EXECUTED to move no byte on a quiet client): `assignment`, `subscription`, `position`
/// (local state), `incremental_unassign`, `begin_transaction` (a local state change). The Rust bodies of `TopicPartitionList::{new,
/// with_capacity, from_topic_map}`, `OwnedHeaders::{new, new_with_capacity}`, `{Borrowed,}Headers::detach`,
/// `BorrowedMessage::detach` and `ClientConfig::create_native_config` do no I/O: their only effect is the `trace!`
/// that `NativePtr::drop` emits (R1582, `OPEN_ENTRY_VERDICTS`).
///
/// One effect is all `classify` can carry: every constructor also emits `trace!`/`debug!` events (`Log`, EXECUTED
/// through a Trace-level `log` logger: 1 to 46 records per call) and the transaction verbs a `flush` (`Clock`); neither
/// is charged (the one-effect limit R1575 records for the same shape).
fn rdkafka_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("rdkafka::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    let from_config = matches!(method, "from_config" | "from_config_and_context");
    let txn = matches!(method, "init_transactions" | "commit_transaction" | "abort_transaction" | "send_offsets_to_transaction");
    let consumer_net = matches!(method, "committed" | "offsets_for_timestamp" | "incremental_assign" | "seek_partitions");
    let hit = match ty {
        "ClientConfig" => matches!(module, "" | "config") && matches!(method, "create" | "create_with_context"),
        "Client" => matches!(module, "" | "client") && method == "new",
        "MockCluster" => matches!(module, "" | "mocking") && method == "new",
        "AdminClient" => {
            matches!(module, "" | "admin")
                && (from_config
                    || matches!(
                        method,
                        "create_topics" | "delete_topics" | "create_partitions" | "delete_groups" | "delete_records"
                            | "describe_configs" | "alter_configs"
                    ))
        }
        "BaseConsumer" => {
            matches!(module, "" | "consumer" | "consumer::base_consumer") && (from_config || consumer_net)
        }
        "StreamConsumer" => {
            matches!(module, "" | "consumer" | "consumer::stream_consumer") && (from_config || consumer_net)
        }
        "BaseProducer" | "ThreadedProducer" => {
            matches!(module, "" | "producer" | "producer::base_producer") && (from_config || txn)
        }
        "FutureProducer" => {
            matches!(module, "" | "producer" | "producer::future_producer") && (from_config || txn)
        }
        "Timestamp" => {
            return (matches!(module, "" | "message") && method == "now").then_some("Clock");
        }
        // `util::current_time_millis` (a free fn: `head` is its module, the "type" is the module name).
        "util" => {
            return (module.is_empty() && method == "current_time_millis").then_some("Clock");
        }
        _ => false,
    };
    hit.then_some("Net")
}

/// SOUNDNESS R1528 — mongodb 3.9.1, EXECUTED against a real mongod (docker `mongo`, replica set, reached through a
/// counting TCP proxy; the driver's own connection only, `heartbeatFrequencyMS` one hour so the idle window reads 0;
/// the server's `serverStatus` opcounters / `transactions` read beside it; handoff `rust-r1528/dbs/`). The macro
/// `#[action_impl]` turns every `impl Action for X { async fn execute }` into `IntoFuture::into_future` (and a sync
/// `run`), so `X::execute` is a spelling NO consumer can write; what a consumer writes is the CREATOR
/// (`coll.drop()`, `session.commit_transaction()`), whose return value it awaits. The existing rule above already
/// charges the creators it lists (`find`, `count_documents`, ...). These are the creators it misses, charged `Db`,
/// plus the `X::execute` / `X::batch` spellings the coverage generator guesses (a phantom spelling, recognised so the
/// row is not a standing alarm; the effect it names is the creator's).
///
/// CHARGED `Db` (each moved the proxy's byte counters, with a quiet window beside it; the sync client's variants
/// share the async body through `TOKIO_RUNTIME.block_on` and were run too):
///   * `ClientSession::{commit_transaction, abort_transaction}`: 283 / 282 bytes up WHEN THE TRANSACTION HOLDS AN
///     OPERATION (server `transactions.totalCommitted` / `totalAborted` +1); an EMPTY transaction sends nothing (0 up),
///     so the charge is state-conditional, kept for the reason `rdkafka::seek` is.
///   * `StartTransaction::{and_run, and_run2}` (reached as `ClientSession::and_run`): 675 bytes up with a callback
///     that inserts, against 392 for the same insert in a manual transaction with no commit, so the difference is
///     the `commitTransaction`; a callback that does nothing sends 0.
///   * `Client::{bulk_write, shutdown}` (384 up; `endSessions` 351 up), `Database::{drop, run_cursor_command}`,
///     `Collection::{drop, drop_index, drop_indexes, list_indexes, list_index_names}`.
///   * `Collection::{create_search_index, create_search_indexes}`: the request goes out (284 up, 505 down) and a
///     community mongod answers `SearchNotEnabled` (31082); on Atlas it succeeds. WEAKER: not run to success.
///   * `ChangeStream::next_if_any`, `SessionChangeStream::{next, next_if_any}`: the FIRST call returns the initial
///     batch with no I/O and every later call is a `getMore` (264 up, 292 to 845 down); state-conditional.
///   * `GridFsBucket::delete` (677 up), `GridFsUploadStream::abort` (332 up).
///
/// CHARGED `Clock`: `oidc::Callback::{human, machine}` build a `Cache` whose `last_call_time` is `Instant::now()`
/// (client/auth/oidc.rs:343). WEAKER: read, not observable from outside the process.
///
/// NOT claimed: `ClientSession::start_transaction` alone (EXECUTED 0 bytes), `ClientOptions::parse` and
/// `ConnectionString::parse` (R1584), the `in-use-encryption` surface (R1585).
fn mongodb_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("mongodb::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    // A consumer's spelling: the crate root, the `sync` re-export, or the declaring `action::..` module.
    let consumer = module.is_empty() || module == "sync" || module.starts_with("action") || module.starts_with("sync::");
    let hit = match (ty, method) {
        ("ClientSession", "commit_transaction" | "abort_transaction" | "and_run" | "and_run2") => consumer,
        ("Client", "shutdown" | "bulk_write") => consumer,
        ("Database", "drop" | "run_cursor_command") => consumer,
        ("Collection", "drop" | "drop_index" | "drop_indexes" | "list_indexes" | "list_index_names"
            | "create_search_index" | "create_search_indexes") => consumer,
        ("ChangeStream", "next_if_any") => {
            matches!(module, "" | "sync" | "change_stream" | "sync::change_stream")
        }
        ("SessionChangeStream", "next" | "next_if_any") => {
            matches!(module, "" | "sync" | "change_stream" | "change_stream::session" | "sync::change_stream")
        }
        ("GridFsBucket", "delete") | ("GridFsUploadStream", "abort") => {
            matches!(module, "" | "sync" | "gridfs" | "sync::gridfs")
        }
        // The macro-input / action-type spellings (no consumer can write them; see above).
        ("StartTransaction", "and_run" | "and_run2") => true,
        // `Aggregate` (SOUNDNESS R1528, mongodb 3.10.0 refresh): EXECUTED against mongo:latest behind a counting proxy after a
        // warm-up op: `.await`, `.batch().await`, and both with `.session(..)` each moved 139 up / 92 down; the builder
        // `aggregate(..)` held without awaiting, and an idle window, 0.
        ("Aggregate" | "AbortTransaction" | "CommitTransaction" | "BulkWrite" | "CountDocuments" | "CreateCollection"
            | "CreateSearchIndex" | "DropCollection" | "DropDatabase" | "DropIndex" | "Find" | "FindOneAndDelete"
            | "FindOneAndReplace" | "FindOneAndUpdate" | "ListCollections" | "ListDatabases" | "ListIndexes"
            | "RunCommand" | "RunCursorCommand" | "Shutdown" | "Watch", "execute" | "batch") => true,
        // `Delete` is also the collection delete action; only the GridFS one is a row here.
        ("Delete", "execute") => module.contains("gridfs"),
        ("Callback", "human" | "machine") => {
            return matches!(module, "" | "options::oidc" | "client::auth::oidc").then_some("Clock");
        }
        _ => false,
    };
    hit.then_some("Db")
}

/// SOUNDNESS R1528 — mysql_async 0.37.1, EXECUTED against a real mysqld (docker `mysql:8.4`, binary log on, reached
/// through a counting TCP proxy; the server's `Com_*` status beside it; handoff `rust-r1528/dbs/`). Matching is on the
/// receiver TYPE NAME plus the method, because the method names are generic.
///
/// CHARGED `Db` (each moved the proxy's byte counters, or a server `Com_*` counter, with a quiet window beside it):
///   * `Conn::{change_user, reset, disconnect, get_binlog_stream, close, start_transaction}`, `BinlogStream::close`,
///     `Transaction::{close, commit, rollback}`, `Connection::close`: `close(stmt)` is `COM_STMT_CLOSE` (9 up, 0 down,
///     `Com_stmt_close` +1); `commit` / `rollback` move `Com_commit` / `Com_rollback`; `Conn::start_transaction` is
///     not a coverage-gate row (the generator's self-scan gave it no concrete effect) but is the same `BEGIN` round trip
///     as the `Pool::start_transaction` row, so it is charged with it.
///   * `Pool::{start_transaction, to_connection}`: a NEW connection (1 connection, 160 to 195 bytes up). The effect is
///     in the future `to_connection()` returns and a consumer drives with `.resolve().await`; EXECUTED: the same call NOT
///     resolved moves 0 bytes. Charged at the creator, the only attributed path, like `get_conn`.
///   * `QueryResult::{next, collect, try_collect, *_and_drop, for_each, reduce, drop_result}`: socket reads of the
///     result set. The proxy counts what the SERVER sends, which stalls on a full client buffer, so a 30 MB result held
///     idle reads 0 and each of these then moved ~29.6 MB down; `next` x5000 moved 6.4 MB. `stream` / `stream_and_drop`
///     moved 0 at creation and 5.2 MB when the returned stream was polled 5000 times: charged at the creator (WEAKER).
///     Reached only where the receiver is TYPED (a parameter or annotation): a result held in an untyped `let` carries
///     the `query_iter` / `exec_iter` that produced it, which is already `Db`.
///   * `QueryWithParams::{run, batch, first, fetch, ignore, reduce, stream}`, `prelude::Query::{..}`,
///     `prelude::BatchQuery::batch` and `Q::run` (the generator's spelling of `impl<Q: AsQuery> Query for Q`): the
///     query goes out (13 to 81 bytes up, `Com_stmt_execute`). EXECUTED for `run`, `first` and `batch` on a typed
///     `QueryWithParams` and for `run` / `fetch` / `ignore` through a `T: Query` bound; `reduce` and `stream`
///     share the default-method body (`self.run(conn).await?...`): WEAKER, read. ONLY the typed and bound spellings
///     reach this rule: `"SELECT 1".run(conn)` and `"..".with(p).run(conn)` carry no mysql_async path at all (the trace
///     shows an unattributed `run`), EXECUTED to send the query and filed as R1586.
///
/// CHARGED `Env`: `test_misc::{get_opts, test_compression, test_ssl}` read `DATABASE_URL`, `COMPRESS`, `SSL`
/// (lib.rs:621-678); a `doc(hidden)` public module.
///
/// NOT claimed, and why: `QueryResult::map` and the `map` of `QueryWithParams` / `Query` (R1586: the scan attributes
/// EVERY `.map(..)` hanging off a typed root to that root's type, so a rule on the bare name charges `Db` to the pure
/// `r.columns().map(..)`; MEASURED on `c_qr_cols_first`, the trace shows `mysql_async::QueryResult::map` for it, and
/// the same trace shows `Conn::map`, `Pool::iter`, `Transaction::map` for the other accessors), `StatementLike::
/// to_statement` (read and pure: `REVIEWED_PURE_ENTRIES`), `PathOrBuf::read` (R1586), `Pool::get_conn` /
/// `Conn::new` / `Conn::from_url` (already `Db` above).
fn mysql_async_r1528(path: &str) -> Option<&'static str> {
    let rest = path.strip_prefix("mysql_async::")?;
    let (head, method) = rest.rsplit_once("::")?;
    let (module, ty) = head.rsplit_once("::").unwrap_or(("", head));
    if ty == "test_misc" && module.is_empty() {
        return matches!(method, "get_opts" | "test_compression" | "test_ssl").then_some("Env");
    }
    let hit = match ty {
        "Conn" => {
            matches!(module, "" | "conn" | "conn::binlog_stream" | "queryable" | "queryable::transaction")
                && matches!(method, "change_user" | "reset" | "disconnect" | "get_binlog_stream" | "close" | "start_transaction")
        }
        "BinlogStream" => matches!(module, "" | "conn::binlog_stream") && method == "close",
        "Connection" => matches!(module, "" | "queryable") && method == "close",
        "Transaction" => {
            matches!(module, "" | "queryable" | "queryable::transaction") && matches!(method, "close" | "commit" | "rollback")
        }
        "Pool" => {
            matches!(module, "" | "conn::pool" | "connection_like") && matches!(method, "start_transaction" | "to_connection")
        }
        "QueryResult" => {
            matches!(module, "" | "queryable::query_result" | "queryable::query_result::result_set_stream")
                && matches!(
                    method,
                    "next" | "collect" | "try_collect" | "collect_and_drop" | "try_collect_and_drop" | "for_each"
                        | "for_each_and_drop" | "map_and_drop" | "reduce" | "reduce_and_drop" | "drop_result"
                        | "stream" | "stream_and_drop"
                )
        }
        "QueryWithParams" => {
            matches!(module, "" | "query")
                && matches!(method, "run" | "batch" | "first" | "fetch" | "ignore" | "reduce" | "stream")
        }
        "Query" => {
            module == "prelude" && matches!(method, "run" | "first" | "fetch" | "ignore" | "reduce" | "stream")
        }
        "BatchQuery" => module == "prelude" && method == "batch",
        "Q" => matches!(module, "" | "query") && method == "run",
        _ => false,
    };
    hit.then_some("Db")
}

pub const PG_DB_VERBS: &[&str] = &[
                "::query", "::query_one", "::query_opt", "::query_raw", "::execute",
                "::batch_execute", "::simple_query", "::prepare", "::prepare_typed",
                "::copy_in", "::copy_out", "::transaction", "::connect",
                // `Config::connect_raw` (tokio-postgres config.rs:739) does the SAME protocol handshake
                // as `Config::connect` over a caller-supplied stream (a Unix socket, a TLS-terminated
                // proxy) instead of dialing one itself — real Db/Net I/O, missing because the verb
                // doesn't end in the plain `connect` spelling.
                "::connect_raw",
                // rusqlite's dialect of the same verbs (a verb-probe found the CANONICAL rusqlite
                // consumer API classifying pure): `query_row` is the one-row read, `query_map`/
                // `query_and_then` the many-row reads, `execute_batch` is rusqlite's name for
                // batch_execute, `prepare_cached` round-trips like prepare. `query_typed` is
                // tokio_postgres 0.7.10+.
                "::query_row", "::query_map", "::query_and_then", "::execute_batch",
                "::prepare_cached", "::query_typed",
                "::prepare_typed_cached",
                // SOUNDNESS R1528 — rusqlite 0.39 `Connection::query_row_and_then(sql, params, f)` (lib.rs:741)
                // is `prepare(sql)` + `query` + `get_expected_row`, and `prepare_with_flags(sql, flags)`
                // (lib.rs:783) is `InnerConnection::prepare` -> `sqlite3_prepare_v3`: the same one-statement
                // round-trips as `query_row`/`prepare` above, with the SQL text at argument 0, so they join
                // the table the masking guard reads. No other table crate has either name.
                "::query_row_and_then", "::prepare_with_flags",
];

/// The members of `PG_DB_VERBS` that take NO SQL text, each checked against its signature:
/// `Client::transaction(&mut self)`, `connect(params, tls)` / `Config::connect_raw(stream, tls)` —
/// a connection string or a stream, never a query. A name wrongly listed here is a silent bypass;
/// a name missing from here is an over-mask that fails closed. SOUNDNESS R806.
pub const PG_DB_VERBS_NO_SQL: &[&str] = &["::transaction", "::connect", "::connect_raw"];

/// The members of `LIBC_FS` that take NO path — every one operates on a file DESCRIPTOR, a `DIR*`
/// stream, or nothing — so a missing literal there hides no locator. **CHECKED AGAINST EACH SIGNATURE,
/// because this is a denylist on a masking guard: a path-taking name wrongly listed here is the
/// benign-sibling-literal bypass (R399), while a no-path name missing from here only over-masks.**
/// Everything else in `LIBC_FS` names a path, at argument 0 or — for the `*at` family — argument 1.
pub const LIBC_FS_NO_PATH: &[&str] = &[
    "ftruncate", "ftruncate64", "fdopendir", "readdir", "readdir64", "readdir_r", "closedir",
    "rewinddir", "seekdir", "telldir", "fchdir", "getcwd", "get_current_dir_name", "fstatfs",
    "fstatfs64", "fstatvfs", "fsync", "fdatasync", "sync", "syncfs", "sync_file_range", "fallocate",
    "posix_fallocate", "posix_fadvise", "sendfile", "sendfile64", "copy_file_range", "flock",
    "getdents", "getdents64", "futimens",
];

/// The members of `LIBC_EXEC` that name NO program: process duplication (`fork`/`vfork`/`clone*`,
/// which run THIS image) and reaping (`wait*`, `pclose`). Every other member names what runs —
/// `system`/`popen` a shell command line, `exec*`/`posix_spawn*` a path or file name, `fexecve` an fd
/// whose program is invisible at the call. Same direction rule as `LIBC_FS_NO_PATH`.
pub const LIBC_EXEC_NO_PROGRAM: &[&str] = &[
    "fork", "vfork", "clone", "clone3", "wait", "waitpid", "wait3", "wait4", "waitid", "pclose",
];

/// The members of `LIBC_NET` that name NO destination: socket setup and options, the LOCAL side
/// (`bind`/`listen`/`accept*` — where the process listens, never a place it reaches; ⟨0.29⟩
/// `is_net_binding`), use-verbs on an already-connected or already-bound socket (`send`/`recv*`),
/// teardown and read-backs. The destination-naming remainder is `connect`, `sendto`, `sendmsg`,
/// `sendmmsg`, and the resolver pair `getaddrinfo`/`getnameinfo`.
pub const LIBC_NET_NO_DESTINATION: &[&str] = &[
    "socket", "setsockopt", "getsockopt", "bind", "listen", "accept", "accept4", "shutdown", "send",
    "recv", "recvfrom", "recvmsg", "recvmmsg", "getpeername", "getsockname", "freeaddrinfo",
];

/// Whether `crate_name` is one of the three crates `classify` routes through the libc syscall tables.
pub fn is_syscall_crate(crate_name: &str) -> bool {
    matches!(crate_name, "libc" | "nix" | "rustix")
}

/// Whether a subprocess-builder method only MODIFIES the command (`.arg`, `.env`, `.current_dir`)
/// rather than NAMING the program (`Command::new`, `duct::cmd`). A WHOLE-CRATE-Exec crate
/// (`portable_pty`, `duct`, `async_process`) classifies *every* method as `Exec`, so the
/// head-refinement must skip these: an arg or env-var-name literal that happened to match a head
/// (`.env("psql", …)`, `.arg("curl")`) would FABRICATE that effect — the §1 under-report rule. The
/// method is the call path's last segment.
pub fn is_cmd_builder_method(method: &str) -> bool {
    matches!(
        method,
        "arg" | "args" | "arg0" | "env" | "envs" | "env_clear" | "env_remove" | "current_dir"
            | "cwd" | "stdin" | "stdout" | "stderr" | "pre_exec" | "creation_flags" | "uid" | "gid"
            | "groups" | "process_group"
    )
}

/// Whether a subprocess method NAMES the program (so its first string literal IS the command head to
/// refine): `Command::new("curl")`, `duct::cmd("curl", …)`. The head-refinement must fire ONLY here —
/// an ALLOWLIST, not "any method except known modifiers". A whole-crate-Exec crate classifies EVERY
/// method as `Exec`, so a denylist leaked NON-naming methods that aren't modifiers — a getter like
/// `CommandBuilder::get_env("psql")` (reading back an env-var KEY, not a program) fed `"psql"` to the
/// head classifier and FABRICATED `Db` (review find). Only `new`/`cmd` name a program; everything else
/// (modifiers, getters `get_*`, custom builder methods) keeps the bare `Exec` cliff — under-refine
/// (safe) rather than fabricate. `std::process::Command` is verb-precise so getters never fire `Exec`
/// there anyway; the allowlist makes the whole-crate-Exec crates safe too.
pub fn is_cmd_naming_method(method: &str) -> bool {
    matches!(method, "new" | "cmd")
}

/// The masking guard (AS-EFF-008): a Net call whose method takes the HOST/URL as an argument is
/// "establishing" — a classified Net call here with no captured host literal leaves the endpoint
/// structurally INVISIBLE (a runtime-built host), so the surface is incomplete and the gate must fail
/// closed (else a benign sibling literal masks the runtime endpoint). An ALLOWLIST of connection-
/// establishing verbs — the SAFE direction: a USE-verb on an already-connected socket
/// (`stream.write`/`read`/`flush`, `socket.send`/`recv`) is NOT here, so a missing literal there (the
/// host was fixed at `connect`) never false-positives. **THAT LAST CLAIM WAS FALSE AND IS WITHDRAWN —
/// see R379 in the body: under-catching an establishing verb IS a broken gate whenever a benign sibling
/// literal sits in the same function, which is the exact scenario the first sentence names.** The list is
/// now an ALLOWLIST still — see the R379 body below: the denylist inversion was BUILT, A/B'd over
/// 1,545 crates and REFUSED (544 rows over-masked). An earlier draft of this line said "now a
/// DENYLIST", which was a leftover from the rejected cut and asserted the opposite of the code it
/// sits on — the comment-asserting-safety shape this register records. The arg is the method (path's
/// last segment).
pub fn is_net_establishing(method: &str) -> bool {
    // SOUNDNESS R379 — the DNS RESOLVER verbs were missing, and their absence was a GATE BYPASS.
    //
    // `classify` (see the `hickory_resolver` arm) already maps `::lookup_ip`, `::lookup` and any
    // `*_lookup` to `Net`, and asserts it. This list did not, so a `Net` call whose host is a runtime
    // value was never marked `incomplete` and a benign sibling literal certified it. Measured against
    // real hickory-resolver 0.26.2, on a fixture that builds clean:
    //
    //     pub async fn masked(r: &Resolver<TokioRuntimeProvider>, host: &str) {
    //         let _ = r.lookup_ip("good.example.com").await;   // the benign literal
    //         let _ = r.lookup_ip(host).await;                 // the runtime target
    //     }
    //
    // reported `hosts:['good.example.com'] incomplete:NONE`, and `allow Net good.example.com` exited
    // **0** over a DNS resolution of a caller-controlled hostname. `TcpStream::connect(host)` — one
    // verb over, same fixture — marked `incomplete:['Net']` and failed closed. The mechanism was
    // sound; only the enumeration was short.
    //
    // THE DOC ABOVE USED TO CLAIM under-catching here is "a missed mask (sound-with-disclosure), never
    // a broken gate". That is false and is withdrawn: it is a broken gate whenever a benign sibling
    // literal shares the function, which is the scenario the guard's own first sentence names.
    //
    // **AND IT STAYS AN ALLOWLIST, WHICH IS NOT THE FAMILY'S USUAL DIRECTION — the exception is
    // measured and it is the same one `is_cmd_naming_method` states two doc-blocks up.** Inverting to
    // a denylist of use-verbs was built and A/B'd over all 1,545 registry crates: **544 rows gained
    // `incomplete` and none lost it**, because a WHOLE-CRATE-Net crate classifies EVERY method as Net,
    // so a denylist masks essentially everything in one — `cap-std` 66 rows, `hickory-net` 44. The
    // triggers it added were conversions, accessors and combinators (`into` 24, `from_std` 20,
    // `as_socket` 15, `setsockopt` 32, `map_err` 7, `ok` 5, `try_clone` 4) — none of which hides a
    // host. Worse, it masked **`bind` (31)**, which this very file has `is_net_binding` to exclude
    // because a bind address is where the process LISTENS, never a destination it reaches. So here the
    // allowlist is the precise side and the denylist is the leaky one, exactly as recorded for Exec.
    //
    // The resolver family is written out rather than the one spelling in hand (R346): `_lookup`
    // catches `reverse_lookup`/`srv_lookup`/`mx_lookup`/`txt_lookup`/`ipv4_lookup`/`ipv6_lookup` and
    // the rest of the record-type verbs in one test, mirroring `classify`'s own `ends_with("_lookup")`.
    method.ends_with("_lookup")
        || matches!(
            method,
            "connect"
                | "connect_timeout"
                | "get"
                | "post"
                | "put"
                | "patch"
                | "delete"
                | "head"
                | "request"
                | "send_to"
                | "lookup_host"
                | "to_socket_addrs"
                // R379 — the DNS resolver verbs `classify` already calls Net.
                | "lookup"
                | "lookup_ip"
                | "resolve"
        )
}

/// ⟨0.29⟩ The Net verbs whose LOCATOR is at argument **1**, not 0 — the rust analogue of candor-ts's
/// `NET_URL_ARG1_MEMBERS`.
///
/// **A REGRESSION FOUND IN REVIEW, and the direction matters.** The positional-literal rung replaced
/// `first_str_lit` ("the first string literal ANYWHERE in the call") with `positional_str_lit(args, 0)`
/// as the UNIVERSAL default. That is right for `Fs`/`Db`/`Exec`, whose locator is always argument 0 —
/// but `is_net_establishing` already listed two verbs whose locator is not: `reqwest::Client::request`
/// takes `(Method, url)` and `UdpSocket::send_to` takes `(buf, addr)`. MEASURED after the swap:
/// `c.request(Method::GET, "https://api.example.com/v1")` published NO `hosts` at all and could not be
/// certified, while `c.get("https://api.example.com/v1")` certified normally.
///
/// ⟨0.29⟩ MEASURED FOR `request` ONLY. `send_to` is a METHOD on a receiver the STABLE syntactic backend
/// does not type, so `s.send_to(buf, "203.0.113.9:53")` is not classified at all there and its arg-1
/// literal is still uncaptured on the floor; the position is right and the deep engine can use it. Said
/// plainly because the first version of this fix's changelog listed both verbs as measured.
///
/// The direction is SAFE — an uncaptured locator fails closed, it never certifies something invisible —
/// which is exactly why it needed a review to find: the gate stayed sound and quietly stopped being
/// USABLE for a common shape. candor-ts avoided this by making its resolver verb-aware in the same rung;
/// this is that discipline arriving one engine late.
pub fn is_net_host_arg1(method: &str) -> bool {
    matches!(method, "request" | "send_to")
}

/// ⟨0.29⟩ / ⟨0.40⟩ A LOCAL BIND/LISTEN VERB — the address it names is where the process LISTENS, never a
/// destination it reaches (SPEC §2 ⟨0.40⟩ *A BIND OR LISTEN ADDRESS IS WHERE THE PROCESS LISTENS*, PART 96
/// `a_litbind`). Its literal never enters `hosts`.
///
/// **MEASURED, and it is a false all-clear rather than a naming quibble.** `UdpSocket::bind("0.0.0.0:0")`
/// put `0.0.0.0:0` into `hosts`, the DESTINATION surface `allow Net` gates on (§2), and — because a
/// literal had been captured — nothing marked the surface incomplete. So:
///
/// ```text
/// let s = UdpSocket::bind("0.0.0.0:0")?;   // local
/// s.send_to(b"secrets", dst);              // destination is a RUNTIME value
/// allow Net 0.0.0.0   ->   policy ✓, exit 0
/// ```
///
/// A local listen address certified a send to an endpoint nobody can see. That is the masking evasion
/// AS-EFF-008 exists to close, reached through a verb whose literal is not a destination at all.
///
/// **A BIND MARKS NOTHING** (⟨0.40⟩). This doc used to say *"A BIND CANNOT BE CERTIFIED, EVER, which is
/// why this marks the surface incomplete"*, and that has been false since `16fb46f` dropped the hedge:
/// neither rust engine marks a bind, and both only withhold its literal. ⟨0.40⟩ makes the withholding the
/// rule — an ephemeral client's own `send_to`/`connect` carries its locator under `is_net_establishing`,
/// so hedging the bind as well made every UDP client uncertifiable while adding nothing a gate could use;
/// and a bind with nothing beside it still fails `allow Net` closed on its EMPTY literal surface. The
/// half of the old sentence that WAS right — *a server that binds and accepts talks to whoever connects*
/// — belongs to the ACCEPT, not the bind, and lives in `is_net_accepting`, which is why `accept` and
/// `incoming` are no longer members here.
pub fn is_net_binding(method: &str) -> bool {
    matches!(method, "bind" | "listen" | "bind_to_device")
}

/// ⟨0.40⟩ A CALL THAT ACCEPTS CONNECTIONS — its peers are chosen by whoever connects, so no literal can name
/// them, and the unit's `Net` surface is INCOMPLETE (SPEC §2 ⟨0.40⟩ *A UNIT THAT ACCEPTS A CONNECTION …*,
/// AS-EFF-008, SEMANTICS §6 `masked_Net`; PART 96 `c_accept`). Both rust engines mark `incomplete` on a
/// `Net`-classified call this answers, WHETHER OR NOT a literal was captured (a server bootstrap's literal is
/// a LISTEN address, withheld like a bind's), and contribute no `hosts` entry for it.
///
/// **SOUNDNESS R817 — `accept`/`incoming` WERE MEMBERS OF `is_net_binding`, WHICH WITHHOLDS AND NEVER
/// MARKS**, so they were read exactly like a use-verb. `pub fn f(l: &TcpListener) { let _ =
/// TcpStream::connect("ok.example:80"); if let Ok((mut s, _)) = l.accept() { s.write_all(b"hi") } }`
/// reported `hosts: ["ok.example:80"]`, no `incomplete`, and `allow Net in f ok.example` exited **0** over a
/// server writing to whoever connected — EXECUTED: a client on 127.0.0.1 received the bytes.
///
/// The membership, by spelling (`path` is the resolved call path, `leaf` its last segment):
///   * `accept`, `accept4` (libc/nix/rustix), `poll_accept` (tokio's poll form), `incoming` and
///     `into_incoming` (std's iterator forms) — exact LEAF. `accept_bi`/`accept_uni` (quinn) are NOT here:
///     they accept a STREAM on a connection whose peer was already fixed by the endpoint's `accept`.
///   * tonic's `Router::serve`/`Router::serve_with_shutdown` and `TcpIncoming::new`, the server bootstraps
///     `classify` already charges `Net` — each binds a listener and begins accepting on it (classify's own
///     tonic arm cites the source lines). By PATH, because `serve`/`new` are not accept verbs anywhere else.
///
/// A wrong `true` over-masks and fails CLOSED, saying so; a wrong `false` is the benign-sibling-literal
/// bypass this row closed. An exact `accept` leaf also matches a TLS/WebSocket acceptor wrapping a stream
/// that was already accepted (`TlsAcceptor::accept(stream)`, `tungstenite::accept`) — whose peer is likewise
/// whoever connected, so the mark is redundant there, never false.
pub fn is_net_accepting(path: &str, leaf: &str) -> bool {
    matches!(leaf, "accept" | "accept4" | "poll_accept" | "incoming" | "into_incoming")
        || (path.starts_with("tonic::")
            && (path.ends_with("::Router::serve")
                || path.ends_with("::Router::serve_with_shutdown")
                || path.ends_with("::TcpIncoming::new")))
}

/// The masking guard (AS-EFF-008), the `Fs` analog of `is_net_establishing`: whether an `Fs`-classified
/// call takes the filesystem PATH as a string argument (so a missing literal leaves the path
/// structurally INVISIBLE — a runtime-built path — and the surface is incomplete, fail-closed). An
/// ALLOWLIST of the path-NAMING free functions / constructors (`fs::write`/`read`/`File::open`/…), the
/// SAFE direction: a path-stat METHOD whose path is the RECEIVER (`p.metadata()`, `p.exists()`) is
/// invoked method-form and the caller gates on `!is_method`, so this never sees it; an op on an
/// already-opened handle (`file.write_all`, `mmap.flush`, `tempfile()` — a random name, no path arg)
/// is not here, so a missing literal there never false-positives. Under-catching an unusual
/// path-naming fn is a missed mask (sound-with-disclosure), ~~never a broken gate~~ — **AND THAT LAST
/// CLAUSE IS FALSE. SOUNDNESS R399.** R379 withdrew this exact sentence from `is_net_establishing` after
/// MEASURING it wrong, and R383 and R386 are counter-examples on this guard and its Db sibling: an
/// unlisted path-taking call contributes no locator, nothing marks the surface incomplete, and a benign
/// sibling literal then CERTIFIES the invisible destination — `allow Fs /etc/hostname` exit 0 over
/// `unixfs::chown(caller, …)`, with the control (`OpenOptions::open(caller)`) exiting 1. The sentence
/// survived here only because nobody re-read it after R379, and it is what licenses leaving the list
/// short. Under-catching is a BROKEN GATE, not a missed mask. The arg is the
/// method/fn leaf (the path's last segment).
pub fn is_fs_path_arg(leaf: &str) -> bool {
    matches!(
        leaf,
        // SOUNDNESS R399 — the POSIX ownership/root verbs take a path as argument 0 and were absent, so a
        // benign sibling literal certified them: `allow Fs /etc/hostname` exit 0 over
        // `unixfs::chown(caller, …)`, control `OpenOptions::open(caller)` exit 1. `std::os::unix::fs`.
        "chown"
            | "lchown"
            | "chroot"
        // std::fs / tokio::fs / async_std::fs / fs_err free functions taking a path argument
            | "write"
            | "read"
            | "read_to_string"
            | "read_dir"
            | "read_link"
            | "copy"
            | "rename"
            | "remove_file"
            | "remove_dir"
            | "remove_dir_all"
            | "create_dir"
            | "create_dir_all"
            | "hard_link"
            | "soft_link"
            | "symlink"
            | "symlink_file"
            | "symlink_dir"
            | "symlink_metadata"
            | "canonicalize"
            | "metadata"
            | "set_permissions"
            | "exists"
            | "try_exists"
            // File / OpenOptions constructors taking a path argument
            | "open"
            | "create"
            | "create_new"
    )
}

/// SOUNDNESS R334 — IS THIS PATH SEGMENT THE OS ENTROPY SOURCE ITSELF (as a VALUE, not a verb)?
///
/// **THE DEFECT THIS EXISTS FOR.** Every entropy rule in the `rand` block keys on the CALLEE — a verb
/// (`from_os_rng`, `next_u32`, `fill_bytes`) or the source type in RECEIVER position
/// (`contains("OsRng")`/`contains("SysRng")`, R320). The idiomatic way to seed a userspace CSPRNG from
/// the OS puts the source in ARGUMENT position, where neither key can see it. Executed, one fixture,
/// four rows:
///
/// ```text
/// StdRng::try_from_rng(&mut SysRng)   ABSENT   quinn-proto-0.11.17 endpoint.rs:81
/// StdRng::from_rng(&mut OsRng)        ABSENT   the same hole in the OLD spelling
/// StdRng::from_seed([0u8; 32])        ABSENT   correct — deterministic, and the control
/// StdRng::from_os_rng()               ['Rand'] the verb form
/// ```
///
/// Both spellings, so this is NOT a rename residual and predates R320 — whose "stale `OsRng` clause"
/// framing would have sent the audit straight past it.
///
/// **WHY THE ARGUMENT AND NOT THE VERB.** `from_rng`/`try_from_rng` cannot simply be charged: their
/// effect is decided by what is passed to them, `from_rng(&mut pcg)` is deterministic, and there are
/// 802 `from_seed`/`seed_from_u64` call sites in this machine's registry cache — the deterministic
/// population is the larger one. Charging the verb is R330's mistake one crate over. The discriminator
/// is the ARGUMENT, so that is what is read.
///
/// **THE OVER-APPROXIMATION IS DELIBERATE AND STATED.** Naming one of these types as a VALUE is charged
/// wherever it appears in an argument list, including moves that do not themselves draw (`Some(OsRng)`,
/// `Box::new(SysRng)`). That is sound and it is also the ONLY place candor can see it: a source handed
/// off into a struct field is drawn from in some later function whose own call list never mentions it.
/// A user type coincidentally named `OsRng` would be charged too — an over-report, the safe direction,
/// and cheaper than the silence it replaces.
pub fn is_entropy_source_ident(seg: &str) -> bool {
    matches!(seg, "OsRng" | "SysRng")
}

/// SOUNDNESS R1612 — THE EFFECTS A CALL PERFORMS BESIDE THE ONE `classify` RETURNS.
///
/// `classify` answers ONE effect per path, and that one is the call's PRIMARY: the effect whose locator (path, host,
/// program, SQL) is the call's own argument or receiver, which is why every surface rule (`str_arg` capture, the masking
/// guard, `fs_kind`) is keyed on it. Some library entry points do a second thing whose locator the caller never sees —
/// `next_backoff` draws entropy AND reads the clock, `try_associate` reads `PATH` AND stats the directories on it. Those
/// are declared HERE, one row per rule, and charged beside the primary by [`also_effects`], never instead of it.
///
/// **Why a table and not a set-valued `classify`.** The set is not uniform: the primary carries the call's locator and the
/// rest do not. A flat set would invite a charging site to publish the call's literal as the locator of every effect in it
/// (a fabricated surface), and the one thing every site must do for a secondary is the OPPOSITE — a secondary `Fs`/`Net`/
/// `Exec`/`Db` has a locator nobody can see, so it is marked `incomplete` ([`also_hides_locator`]) and a benign sibling
/// literal cannot certify it. And the second-effect hook this replaces (`reads_trust_store`, R338) was asked by ONE of the
/// four sites that charge a `classify` answer: `candor-scan`'s main path. The `use`-alias arm, the R1607 trait-dispatch
/// arm and the deep engine (`src/lib.rs`) never asked it, so the trust-store `Fs` was charged or silent by spelling and by
/// engine. One table, one function, every site — the shape `masks_locator` already has for the same reason (R806/R808).
///
/// **The bar for a row** is the family's for any charge: an EXECUTED observation of the second effect inside the call, a
/// pure neighbour of the same type that is not charged, and `deny <E2>` flipping 0→1 on a consumer. A row whose second
/// effect is platform- or configuration-conditional says so in `evidence`; it is charged on the configuration where it was
/// observed (the R338 trade: the default build on the platform the crate's users run), and the condition is the row's
/// stated over-charge. Do NOT seed this table from `covered.tsv`'s `self_scan_effects`: that oracle's extra effects are a
/// union over every branch (1,306 of 2,020 covered rows carry one, 792 of them `Clock` and 468 `Log`, mostly timeouts and
/// debug events inside a request), and adopting them is a priced decision, not a transcription (R1613).
pub struct AlsoEffect {
    /// Crate names (post `-`→`_`) this row applies to.
    pub krate: &'static [&'static str],
    /// Which paths in those crates.
    pub on: AlsoOn,
    /// The effects charged beside the primary. An entry equal to the primary is dropped by [`also_effects`].
    pub effects: &'static [&'static str],
    /// The §2 `fs` direction of an `Fs` in `effects` — `&["read"]` only where the executed window showed no write
    /// (no `O_WRONLY`/`O_RDWR`/`O_CREAT`, only `stat`/`access`/read-only opens). Empty means the direction is unknown and
    /// the charging site records the poison marker, never a guess.
    pub fs_kind: &'static [&'static str],
    /// The SOUNDNESS row that carries the evidence.
    pub row: &'static str,
    /// What was executed, where, and under which condition.
    pub evidence: &'static str,
}

/// How an [`AlsoEffect`] row names its paths — the two shapes the rule tables already use.
pub enum AlsoOn {
    /// `(type, methods)`: the path's second-to-last segment is `type` and its last is one of `methods` — the key
    /// `b11_r1528` matches on, so a row here names exactly the spellings the primary rule beside it names.
    Method(&'static str, &'static [&'static str]),
    /// A free function: the path ends in `::<leaf>` for one of these leaves.
    Leaf(&'static [&'static str]),
    /// These exact paths and no others — for a free function whose name a method of the same crate also ends in
    /// (`tokio_postgres::connect` against `TlsConnect::connect`), where a [`AlsoOn::Leaf`] tail would charge both.
    Exact(&'static [&'static str]),
    /// A free function: every path segment after the crate name starts with a lower-case letter (`fastrand::u32`,
    /// `fastrand::global_rng::u32`), so no type's method of the same name (`fastrand::Rng::u32`) matches, and neither does a
    /// trait-impl spelling such as `fastrand::&Rng::eq` (a segment that is not an identifier).
    FreeFn,
}

impl AlsoOn {
    pub fn matches(&self, path: &str) -> bool {
        match self {
            AlsoOn::Method(ty, methods) => path.rsplit_once("::").is_some_and(|(head, m)| {
                methods.contains(&m) && head.rsplit("::").next() == Some(*ty)
            }),
            AlsoOn::Leaf(leaves) => leaves.iter().any(|l| path.strip_suffix(l).is_some_and(|h| h.ends_with("::"))),
            AlsoOn::Exact(paths) => paths.contains(&path),
            AlsoOn::FreeFn => path.split("::").skip(1).all(|seg| seg.starts_with(|c: char| c.is_ascii_lowercase() || c == '_')),
        }
    }
}

pub const ALSO_EFFECTS: &[AlsoEffect] = &[
    // SOUNDNESS R338 — the system trust store, read by a native-tls connector the crate builds INSIDE its own entry point.
    // **THE DEFECT.** candor charges `native_tls::TlsConnector::new` `Fs` because on the openssl backend
    // it loads the probed cert file/dir from disk. Several calibrated crates construct that connector
    // INSIDE a public entry point, so the consumer's call discloses the transport effect and drops the
    // `Fs` — `tungstenite::client_tls` reports `['Net']`, and `deny Fs` passes over a real trust-store
    // read. `wrap_stream` does `tls_connector.map_or_else(TlsConnector::new, Ok)`
    // (`tungstenite-0.30.0/src/tls.rs:54`), so a caller supplying no connector gets `TlsConnector::new()`.
    // (The row the coverage gate nominated — `tungstenite::tls::encryption::native_tls::wrap_stream` — is
    // unreachable from outside: `mod tls;` is private at `lib.rs:32`. The reachable form is one level up.)
    //
    // **WHY THIS IS SO SHORT: the sweep found four more crates and every one was PRICED AND REJECTED,
    // which is the deliverable rather than a gap.** Callers of `native_tls::TlsConnector::new` in the
    // local registry are redis, tungstenite, ureq, minreq and tokio-websockets.
    //   - `minreq`, `tokio_websockets` — NOT calibrated, so their calls already disclose rather than
    //     claim purity. No rule can improve them.
    //   - `redis` — `ActualConnection::new` (`redis-1.6.0/src/connection.rs:932`) constructs it only for a
    //     `rediss://` address, and the consumer-visible verb is `Client::get_connection`. Charging that
    //     `Fs` would fabricate on every PLAIN redis user, which is the majority. Rejected on the trade.
    //   - `ureq` — `agent.rs:265` takes `crate::default_tls_config()`, and ureq's default features are
    //     `["tls", "gzip"]`: `native-certs` is OFF, so the default build resolves to
    //     `rtls::root_certs()`'s `#[cfg(not(feature = "native-certs"))]` arm, which is
    //     `webpki_roots::TLS_SERVER_ROOTS` — COMPILED IN, no disk read (`ureq-2.12.1/src/rtls.rs:82`).
    //     Charging it would fabricate on the default build. Rejected on the evidence.
    //
    // What is left is tungstenite's two explicitly-TLS-named entry points, where no caller is
    // over-charged: `client_tls` passes `None` for the connector unconditionally, and
    // `client_tls_with_config`'s callers are by definition doing TLS. **`tungstenite::connect` is a stated
    // residual, not an oversight** — it serves `ws://` and `wss://` alike, so charging it would hit real
    // plain-WebSocket users; the scheme is often a string literal candor already captures in `str_arg`,
    // which is the shape a future fix should use rather than a blanket charge.
    AlsoEffect {
        krate: &["tungstenite"],
        on: AlsoOn::Leaf(&["client_tls", "client_tls_with_config"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R338",
        evidence: "openssl backend: TlsConnector::new loads the probed cert file/dir; client_tls passes no connector \
                   (tungstenite-0.30.0 src/tls.rs:54). macOS (Security framework) reads no file.",
    },
    // SOUNDNESS R1528 (b11) — elasticsearch builds a reqwest client with the DEFAULT `native-tls` feature.
    AlsoEffect {
        krate: &["elasticsearch"],
        on: AlsoOn::Method("Transport", &["single_node", "static_node_list", "sniffing_node_list", "cloud"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1598",
        evidence: "EXECUTED under strace in rust:1-bookworm: Transport::single_node opens openssl.cnf, cert.pem, certs/, \
                   ca-certificates.crt; 0 opens on macOS. Primary Env is the proxy-variable read.",
    },
    AlsoEffect {
        krate: &["elasticsearch"],
        on: AlsoOn::Method("TransportBuilder", &["build"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1598",
        evidence: "as Transport::single_node (EXECUTED under strace, Linux/openssl).",
    },
    // SOUNDNESS R1612 — R1599's four rule rows.
    AlsoEffect {
        krate: &["backoff"],
        on: AlsoOn::Method("ExponentialBackoff", &["next_backoff"]),
        effects: &["Clock"],
        fs_kind: &[],
        row: "R1612",
        evidence: "EXECUTED (macOS, DYLD interposer): next_backoff on a default ExponentialBackoff = 1 getentropy (the \
                   Rand primary) + 1 clock_gettime (the max_elapsed_time check reads clock.now()). Pure neighbour \
                   ExponentialBackoffBuilder::new: 0 events.",
    },
    AlsoEffect {
        krate: &["grep_cli"],
        on: AlsoOn::Method("DecompressionMatcherBuilder", &["associate", "try_associate"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1612",
        evidence: "EXECUTED (macOS, DYLD interposer): a relative program (`gzip`) = getenv(PATH) (the Env primary) + \
                   stat(<PATH dir>/gzip) per directory until found; an absolute program = 0 events, the same accepted \
                   over-charge as the Env primary. Pure neighbour DecompressionMatcherBuilder::new: 0 events.",
    },
    AlsoEffect {
        krate: &["time"],
        on: AlsoOn::Method("UtcOffset", &["current_local_offset"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1612",
        evidence: "EXECUTED (macOS, DYLD interposer), TZ unset: 1 clock_gettime (the Clock primary) + localtime_r + \
                   access(/etc/localtime). With TZ set the interposer saw no file call (libc's own zone-file open is \
                   not interposable), so the TZ-set arm is not claimed either way. libc caches the zone: first call per \
                   process. Pure neighbour UtcOffset::from_hms: 0 events.",
    },
    AlsoEffect {
        krate: &["portable_pty"],
        on: AlsoOn::Method("CommandBuilder", &["new", "from_argv", "new_default_prog"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1612",
        evidence: "EXECUTED (macOS, DYLD interposer), SHELL unset: each of the three ctors = access(<passwd shell>, X_OK) \
                   (get_base_env -> get_shell, cmdbuilder.rs:43-71); SHELL set: 0 events. Charged on the unset arm, \
                   which is the default in containers and service managers; SHELL-set callers are the stated \
                   over-charge. Pure neighbour CommandBuilder::arg: 0 events.",
    },

    // SOUNDNESS R1617 — LOG ROWS: a call into a logging/tracing framework INSIDE a dependency is `Log` at the consumer's call
    // (SPEC.md:427-431; FABLE-LOG-POLICY, R1613), whether or not a subscriber is installed. Every row below was EXECUTED with a
    // `log::Log` implementation AND a `tracing::Subscriber` installed (macOS, tokio-postgres 0.7.18, postgres 0.19.14,
    // deadpool-postgres 0.14.2, reqwest 0.13.5, default features, no `log` `max_level_*` feature), the record's file:line printed
    // inside the call window. CONDITION, for every `tokio_postgres` row: the `debug!` sites are `query.rs:45/:220`
    // (gated by `log_enabled!(Level::Debug)`), `prepare.rs:122/:124`, `copy_out.rs:14`, `copy_in.rs:195`, `simple_query.rs:35/:47`:
    // they emit at DEBUG, so a logger enabled at INFO saw 0 records (EXECUTED) and the row is charged on the DEBUG-enabled
    // configuration the policy prices. NOT charged, EXECUTED 0 records at DEBUG: the `query_typed*` / `execute_typed` family (their
    // own protocol path has no log site) and `Client::is_closed` / `cancel_token` / `build_transaction` (no I/O).
    AlsoEffect {
        krate: &["tokio_postgres", "postgres"],
        on: AlsoOn::Method(
            "Client",
            &["query", "query_one", "query_opt", "query_raw", "execute", "batch_execute", "simple_query", "prepare",
              "prepare_typed", "copy_in", "copy_out", "transaction"],
        ),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED, logger at DEBUG: 1 `log` record from tokio_postgres per call (query* query.rs:45, execute query.rs:220, \
                   batch_execute/transaction simple_query.rs:47, simple_query :35, prepare* prepare.rs:122, copy_out copy_out.rs:14, \
                   copy_in copy_in.rs:195); a `&str` statement adds the prepare.rs:122 record. 0 at INFO. Pure neighbours \
                   is_closed/cancel_token/build_transaction: 0. Same records via postgres::Client (it wraps tokio_postgres).",
    },
    AlsoEffect {
        krate: &["tokio_postgres"],
        on: AlsoOn::Method("Client", &["execute_raw", "simple_query_raw"]),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED, logger at DEBUG: execute_raw query.rs:220, simple_query_raw simple_query.rs:35, 1 record each. 0 at INFO. \
                   Not charged (0 records, EXECUTED): query_typed_raw, query_typed_one, execute_typed.",
    },
    AlsoEffect {
        krate: &["postgres"],
        on: AlsoOn::Method("Client", &["is_valid"]),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED, logger at DEBUG: is_valid sends simple_query(\"\") -> simple_query.rs:35, 1 record.",
    },
    AlsoEffect {
        krate: &["tokio_postgres", "postgres"],
        on: AlsoOn::Method(
            "Transaction",
            &["query", "query_one", "query_opt", "query_raw", "execute", "batch_execute", "simple_query", "prepare",
              "prepare_typed", "copy_in", "copy_out", "transaction", "commit", "rollback"],
        ),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED, logger at DEBUG, inside an open transaction: the same record per verb as Client (query* query.rs:45, \
                   execute :220, prepare* prepare.rs:122, copy_* copy_out.rs:14/copy_in.rs:195, simple_query :35); \
                   batch_execute/transaction/commit/rollback each 1 simple_query.rs:47 record. 0 at INFO. Not charged: query_typed (0).",
    },
    AlsoEffect {
        krate: &["deadpool_postgres"],
        on: AlsoOn::Method(
            "Client",
            &["query", "query_one", "query_opt", "query_raw", "execute", "batch_execute", "prepare", "prepare_typed",
              "prepare_cached", "prepare_typed_cached", "transaction"],
        ),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED, logger at DEBUG, through deadpool's GenericClient spelling and its inherent prepare_cached/\
                   prepare_typed_cached: tokio_postgres records as above. prepare_cached/prepare_typed_cached log only on a \
                   statement-cache MISS (prepare.rs:122); a warm cache hit: 0 records (EXECUTED), the same cold-cache arm the \
                   Db primary already charges unconditionally.",
    },
    AlsoEffect {
        krate: &["deadpool_postgres"],
        on: AlsoOn::Method("ClientWrapper", &["prepare_cached", "prepare_typed_cached", "transaction"]),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED, logger at DEBUG: the inherent ClientWrapper methods; prepare_* only on a statement-cache miss (warm: 0).",
    },
    AlsoEffect {
        krate: &["deadpool_postgres"],
        on: AlsoOn::Method(
            "Transaction",
            &["query", "query_one", "query_opt", "query_raw", "execute", "batch_execute", "prepare", "prepare_typed",
              "prepare_cached", "prepare_typed_cached", "transaction", "commit", "rollback"],
        ),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED, logger at DEBUG, deadpool Transaction through GenericClient: tokio_postgres records as Client; \
                   commit/rollback/transaction 1 simple_query.rs:47 each; prepare_*_cached only on a cache miss.",
    },
    // reqwest 0.13.5. FABLE-LOG-POLICY read the log as proxy-path only (`connect.rs:784/:805`); EXECUTED, that is wrong: the call logs
    // WITHOUT a proxy. Every `execute` emits `tracing` events from hyper-util's pool/client (4 on a pooled keep-alive reuse:
    // pool.rs:659/:267/:352/:400), a fresh connection adds the `log` record `connect.rs:929` ("starting new connection") and 6 more
    // hyper-util events (11 in all); `connect.rs:784` ("proxy(..) intercepts") appears only when HTTP_PROXY/HTTPS_PROXY selects a
    // proxy (12 records with it). Measured with BOTH a `log` logger and a `tracing` subscriber at TRACE; the `tracing` events need
    // a subscriber, the `log` record a logger. Builders `get`/`post`/`build` and `RequestBuilder` setters: 0 records.
    AlsoEffect {
        krate: &["reqwest"],
        on: AlsoOn::Method("Client", &["execute"]),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED (async Client + blocking::Client), logger + tracing subscriber installed: pooled reuse 4 tracing events \
                   (hyper_util pool.rs); new connection 11 (connect.rs:929 `log` + hyper_util); HTTP_PROXY adds connect.rs:784. \
                   Client::get/build: 0.",
    },
    AlsoEffect {
        krate: &["reqwest"],
        on: AlsoOn::Method("RequestBuilder", &["send"]),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED (async + blocking), as Client::execute: 11 records on a new connection. RequestBuilder::get/build: 0.",
    },
    // SOUNDNESS R1617 — NON-LOG EXTRAS. postgres / tokio_postgres connect: EXECUTED against postgres:16 (macOS, DYLD interposer).
    // Net: connect(127.0.0.1:55432). Ipc: connect(AF_UNIX path) for a unix-socket host. Rand: 1 getentropy for the SCRAM nonce,
    // ONLY when the server asks SCRAM (a `trust` server: 0 getentropy, same runtime). A single call performs ONE of Net/Ipc
    // (by the host string) and Rand only against SCRAM, so each is a configuration arm charged where observed; the Db primary
    // already charges the call without a host. deadpool-postgres's consumer-callable `Pool::{get, timeout_get}` is a primary `Db`
    // since R1618 (it was an unclassified path, so the call read pure), and carries the same three extras below.
    AlsoEffect {
        krate: &["tokio_postgres", "postgres"],
        on: AlsoOn::Method("Config", &["connect"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED (postgres:16, interposer): TCP host = connect(127.0.0.1:port) [Net]; unix host = connect(unix:<dir>/.s.PGSQL.n) \
                   [Ipc]; SCRAM server = 1 getentropy [Rand], trust server = 0. Pure neighbour Config::from_str / Config::host: 0 events. \
                   connect_raw (caller's stream) is not claimed.",
    },
    AlsoEffect {
        krate: &["tokio_postgres"],
        on: AlsoOn::Exact(&["tokio_postgres::connect"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED as Config::connect (tokio_postgres::connect parses the string and calls it): TCP 127.0.0.1 Net, unix \
                   socket Ipc, SCRAM nonce 1 getentropy Rand (trust server: 0).",
    },
    AlsoEffect {
        krate: &["postgres"],
        on: AlsoOn::Method("Client", &["connect"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED as Config::connect (postgres::Client::connect parses and calls it): TCP Net, SCRAM Rand. (The unix-host arm \
                   was EXECUTED through postgres::Config::connect.)",
    },
    // SOUNDNESS R1618 — deadpool_postgres `Pool::{get, timeout_get}` (primary Db, see `classify`). EXECUTED (postgres:16, macOS,
    // DYLD interposer, rows in handoff `rust-r1617/`): a COLD pool's get = connect(127.0.0.1:55432) [Net] + 1 getentropy [Rand] (the
    // SCRAM nonce; 0 against a trust server, as for `Config::connect`); a WARM pool's get = 0 connects, 0 entropy. The unix-host arm
    // is the same `Config::connect` the manager calls. OVER-CHARGE, stated: a call that finds an idle object (the steady state of a
    // long-lived pool) performs none of these; the cold arm is the only one a static scan cannot rule out. `Log`: 0 records.
    AlsoEffect {
        krate: &["deadpool_postgres"],
        on: AlsoOn::Method("Pool", &["get", "timeout_get"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1618",
        evidence: "EXECUTED cold pool: connect(127.0.0.1:55432) + 1 getentropy; warm pool (idle object): 0 of both. get and timeout_get \
                   identical. Pure neighbours status/is_closed/manager/resize/close: 0 events.",
    },
    // SOUNDNESS R1618 — `build_transaction().start()` = BEGIN, and one `log` record like `transaction()` (simple_query.rs:47). EXECUTED
    // through the tokio_postgres, postgres (sync; 2 records: BEGIN and the drop's ROLLBACK) and deadpool spellings. The consumer path of
    // a chained call is the receiver's type (`Client::start`, `Object::start`); a held builder is `TransactionBuilder::start`.
    AlsoEffect {
        krate: &["tokio_postgres", "postgres", "deadpool_postgres"],
        on: AlsoOn::Method("Client", &["start"]),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1618",
        evidence: "EXECUTED, logger at DEBUG: build_transaction().start() = 1 record, simple_query.rs:47 (also with isolation_level/read_only \
                   in the chain). 0 at INFO. build_transaction / isolation_level / read_only alone: 0.",
    },
    AlsoEffect {
        krate: &["tokio_postgres", "postgres", "deadpool_postgres"],
        on: AlsoOn::Method("TransactionBuilder", &["start"]),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1618",
        evidence: "EXECUTED, logger at DEBUG: a held TransactionBuilder's start = 1 record, simple_query.rs:47 (sync postgres: 2, BEGIN and the \
                   drop's ROLLBACK).",
    },
    AlsoEffect {
        krate: &["deadpool_postgres"],
        on: AlsoOn::Method("Object", &["start"]),
        effects: &["Log"],
        fs_kind: &[],
        row: "R1618",
        evidence: "EXECUTED, logger at DEBUG: pooled Object .build_transaction().start() = 1 record, simple_query.rs:47.",
    },
    // SOUNDNESS R1618 — sqlx MySQL connect: the facade's primary is Db (`VERBS` for `::connect`, `sqlx_r1528` for `::connect_with`),
    // and every connecting spelling EXECUTED against mysql:8 (macOS, sqlx 0.9.0, tls-rustls, DYLD interposer) = connect(127.0.0.1:53306)
    // [Net] + 5 getentropy [Rand] on the default `ssl-mode=preferred` (also `required`; `ssl-mode=disabled`: connect only, 0 entropy);
    // `?socket=<path>` = connect(AF_UNIX path) [Ipc] with the same entropy. Spellings executed: MySqlConnection::{connect,
    // connect_with}, MySqlPool::{connect, connect_with}, MySqlPoolOptions::{connect, connect_with}, MySqlConnectOptions::connect
    // (the `ConnectOptions` trait method). `connect_lazy` opens nothing (R1589). OVER-CHARGE, stated: a `disabled` URL draws no
    // entropy, and Net / Ipc are the two arms of one call (the host string picks). `ssl-ca=<file>` opens that file (Fs, EXECUTED) and
    // is NOT charged here: see R1618, a URL-conditional Fs needs a literal-keyed charge, not a table row. Postgres and sqlite via
    // sqlx are not executed and not claimed.
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("MySqlConnection", &["connect", "connect_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1618",
        evidence: "EXECUTED (mysql:8, interposer): connect(127.0.0.1) + 5 getentropy on the default/required TLS arms; ssl-mode=disabled: connect \
                   only; ?socket= : connect(AF_UNIX). Neighbour connect_lazy and MySqlConnectOptions parse/new: 0 events.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("MySqlPool", &["connect", "connect_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1618",
        evidence: "EXECUTED (mysql:8): Pool::connect / connect_with open one connection eagerly = connect + 5 getentropy; connect_lazy: 0.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("MySqlPoolOptions", &["connect", "connect_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1618",
        evidence: "EXECUTED (mysql:8): PoolOptions::connect / connect_with = connect + 5 getentropy. max_connections / new: 0.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("MySqlConnectOptions", &["connect"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1618",
        evidence: "EXECUTED (mysql:8): ConnectOptions::connect on MySqlConnectOptions = connect + 5 getentropy.",
    },
    // fastrand 2.5.0 seeds its THREAD-LOCAL generator from `Instant::now()` on a thread's first use (global_rng.rs:203-212), so
    // the first fastrand call per thread reads the clock. EXECUTED (macOS, fresh thread, interposer): fastrand::{u32, seed,
    // get_seed, alphabetic}, Rng::new, Rng::default = 1 clock read on the first call, 0 on the second; Rng::with_seed and an
    // instance draw on a seeded Rng = 0. tempfile (every name-generating entry) and async-executor (Executor::run) inherit it.
    AlsoEffect {
        krate: &["fastrand"],
        on: AlsoOn::FreeFn,
        effects: &["Clock"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED (fresh thread, interposer): fastrand::u32/seed/get_seed/alphabetic = 1 clock read on the thread's FIRST use \
                   (Instant::now() seeds the thread-local RNG), 0 on the second call.",
    },
    AlsoEffect {
        krate: &["fastrand"],
        on: AlsoOn::Method("Rng", &["new", "default"]),
        effects: &["Clock"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED (fresh thread): Rng::new and Rng::default fork the thread-local generator, whose first use reads the clock: \
                   1 on the first call per thread, 0 after. Rng::with_seed: 0.",
    },
    AlsoEffect {
        krate: &["tempfile"],
        on: AlsoOn::Method(
            "Builder",
            &["tempfile", "tempfile_in", "make", "make_in", "tempdir", "tempdir_in"],
        ),
        effects: &["Clock"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED (fresh thread, interposer): 1 clock read on the first name generated per thread (create_helper -> \
                   fastrand::Rng::new), 0 on the second call. Builder::new().prefix().suffix().rand_bytes(): 0.",
    },
    AlsoEffect {
        krate: &["tempfile"],
        on: AlsoOn::Method(
            "NamedTempFile",
            &["new", "new_in", "with_prefix", "with_prefix_in", "with_suffix", "with_suffix_in"],
        ),
        effects: &["Clock"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED (fresh thread): 1 clock read on the first name generated per thread, 0 on the second. NamedTempFile::close \
                   and ::persist (no name generation): 0.",
    },
    AlsoEffect {
        krate: &["tempfile"],
        on: AlsoOn::Method(
            "TempDir",
            &["new", "new_in", "with_prefix", "with_prefix_in", "with_suffix", "with_suffix_in"],
        ),
        effects: &["Clock"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED (fresh thread): 1 clock read on the first name generated per thread, 0 on the second.",
    },
    AlsoEffect {
        krate: &["tempfile"],
        on: AlsoOn::Leaf(&["tempfile", "tempfile_in", "tempdir", "tempdir_in"]),
        effects: &["Clock"],
        fs_kind: &[],
        row: "R1617",
        evidence: "EXECUTED (fresh thread): the free functions tempfile()/tempfile_in()/tempdir()/tempdir_in(), 1 clock read on the \
                   first name generated per thread.",
    },

    // SOUNDNESS R1623 — sqlx 0.9.0 POSTGRES, MYSQL-ACQUIRE and SQLITE second effects (R1618's residual (c)). EXECUTED on macOS (DYLD
    // interposer) against postgres:16 with TLS on and SCRAM, mysql:8 and real sqlite files; handoff `rust-r1623/`.
    //   Postgres connect (any of the 8 spellings, with options already built): 1 connect (TCP, or AF_UNIX for a socket host) +
    //   1-6 `getentropy` (1 with `sslmode=disable`: the SCRAM nonce only; 5-6 with TLS). A URL SPELLING (`connect(url)`,
    //   `connect_lazy(url)`, `.parse()`) also parses the URL, and the parse reads the twelve `PG*` variables and `stat`s the three
    //   candidate unix-socket directories, plus opens `~/.pgpass` when the URL has no password (14 `getenv`, 1 `open`).
    //   Acquire-class (`acquire`, `begin`, `begin_with`) on a COLD pool is the same connect; on a WARM pool (an idle connection)
    //   it performs NONE of these (EXECUTED: 0 connect, 0 entropy, 0 stat). That is the stated over-charge, as for deadpool's `Pool::get`.
    //   SQLite connect: opens the database file read-write (`open(db, +creat)` under `mode=rwc`, plus `stat`/`lstat` of its path),
    //   opens `/dev/urandom` (SQLite seeds its PRNG on first use in the process: Rand), and reads `SQLITE_TMPDIR`/`TMPDIR`/`RUST_MIN_STACK`
    //   (the last is std's thread-spawn read). `sqlite::memory:` opens only `/dev/urandom` and reads the three variables: the file
    //   open is the URL-conditional over-charge. Not charged: `Clock` (the SCRAM key derivation yields to the runtime between
    //   iterations, so tokio reads the clock ~2,500 times; it is scheduler plumbing, uncharged as for R1618), sslrootcert/ssl-ca `Fs`
    //   (URL-conditional, R1618 residual (b)), and the per-query `stat` of `-journal`/`-wal` on SQLite (`Query::execute` is driver-agnostic).
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgConnection", &["connect", "connect_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, TLS+SCRAM, interposer): 1 connect (AF_UNIX for a socket host) + 1-6 getentropy per call with options already built; a warm pool's acquire/begin: 0 of both.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgPool", &["connect", "connect_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, TLS+SCRAM, interposer): 1 connect (AF_UNIX for a socket host) + 1-6 getentropy per call with options already built; a warm pool's acquire/begin: 0 of both.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgPoolOptions", &["connect", "connect_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, TLS+SCRAM, interposer): 1 connect (AF_UNIX for a socket host) + 1-6 getentropy per call with options already built; a warm pool's acquire/begin: 0 of both.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgListener", &["connect", "connect_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, TLS+SCRAM, interposer): 1 connect (AF_UNIX for a socket host) + 1-6 getentropy per call with options already built; a warm pool's acquire/begin: 0 of both.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgConnectOptions", &["connect"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, TLS+SCRAM, interposer): 1 connect (AF_UNIX for a socket host) + 1-6 getentropy per call with options already built; a warm pool's acquire/begin: 0 of both.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgPool", &["acquire", "begin", "begin_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, TLS+SCRAM, interposer): 1 connect (AF_UNIX for a socket host) + 1-6 getentropy per call with options already built; a warm pool's acquire/begin: 0 of both.",
    },
    // The `*PoolOptions` acquire rows below name a type that has no `acquire`: `let p = PgPoolOptions::new().connect_lazy(u)
    // .unwrap(); p.acquire()` is typed by the builder walk as its ROOT (`PgPoolOptions`), not the `PgPool` it returns, so the
    // call forms `PgPoolOptions::acquire` (R1608 family: the chain root is the guess). Without them that spelling reads `Db` only.
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgPoolOptions", &["acquire", "begin", "begin_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, TLS+SCRAM, interposer): 1 connect (AF_UNIX for a socket host) + 1-6 getentropy per call with options already built; a warm pool's acquire/begin: 0 of both.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("MySqlPool", &["acquire", "begin", "begin_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (mysql:8, interposer): a cold pool's acquire/begin = 1 connect + 5 getentropy; a warm pool's acquire: 0 of both.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("MySqlPoolOptions", &["acquire", "begin", "begin_with"]),
        effects: &["Net", "Ipc", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (mysql:8, interposer): a cold pool's acquire/begin = 1 connect + 5 getentropy; a warm pool's acquire: 0 of both.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgConnection", &["connect"]),
        effects: &["Env", "Fs"],
        fs_kind: &["read"],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, interposer): a URL spelling parses the URL = 12 PG* getenv + 3 stat of the unix-socket candidate dirs (+ HOME/PGPASSFILE and an open of ~/.pgpass when the URL has no password). connect_with(&opts) parses nothing.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgPool", &["connect"]),
        effects: &["Env", "Fs"],
        fs_kind: &["read"],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, interposer): a URL spelling parses the URL = 12 PG* getenv + 3 stat of the unix-socket candidate dirs (+ HOME/PGPASSFILE and an open of ~/.pgpass when the URL has no password). connect_with(&opts) parses nothing.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgPoolOptions", &["connect"]),
        effects: &["Env", "Fs"],
        fs_kind: &["read"],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, interposer): a URL spelling parses the URL = 12 PG* getenv + 3 stat of the unix-socket candidate dirs (+ HOME/PGPASSFILE and an open of ~/.pgpass when the URL has no password). connect_with(&opts) parses nothing.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgListener", &["connect"]),
        effects: &["Env", "Fs"],
        fs_kind: &["read"],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, interposer): a URL spelling parses the URL = 12 PG* getenv + 3 stat of the unix-socket candidate dirs (+ HOME/PGPASSFILE and an open of ~/.pgpass when the URL has no password). connect_with(&opts) parses nothing.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgPool", &["connect_lazy"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, interposer): connect_lazy(url) = 12 PG* getenv [Env primary] + 3 stat, 0 connections.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgPoolOptions", &["connect_lazy"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, interposer): connect_lazy(url) = 12 PG* getenv [Env primary] + 3 stat, 0 connections.",
    },
    AlsoEffect {
        krate: &["tracing_subscriber"],
        on: AlsoOn::Method("OffsetTime", &["local_rfc_3339"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1528",
        evidence: "EXECUTED (tracing-subscriber 0.3.23, macOS interposer, TZ unset): 1 clock_gettime [Clock primary] + access(/etc/localtime) \
                   (the `time` crate's current_local_offset, R1612); a pure control: 0.",
    },
    AlsoEffect {
        krate: &["sea_orm"],
        on: AlsoOn::Method("SqlxPostgresConnector", &["accepts"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1528",
        evidence: "EXECUTED (sea-orm 2.0.4, macOS interposer): accepts(\"postgres://u@h/db\") = 13 PG* getenv [Env primary] + stat of \
                   /var/run/postgresql, /private/tmp, /tmp `.s.PGSQL.5432` + open ~/.pgpass; a `mysql://` string and a pure control: 0.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("PgConnectOptions", &["new", "new_without_pgpass", "default", "from_str", "from_url"]),
        effects: &["Fs"],
        fs_kind: &["read"],
        row: "R1623",
        evidence: "EXECUTED (postgres:16, interposer): 12 PG* getenv [Env primary] + 3 stat of the unix-socket candidate dirs; new()/default() also open ~/.pgpass (14 getenv) when no password is set.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("SqliteConnection", &["connect", "connect_with"]),
        effects: &["Env", "Fs", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (sqlite via sqlx 0.9.0, interposer): connect opens the db file read-write (+creat under mode=rwc) with stat/lstat of its path, opens /dev/urandom (first sqlite use in the process), reads SQLITE_TMPDIR/TMPDIR/RUST_MIN_STACK. sqlite::memory: opens only /dev/urandom. Fs direction depends on mode=: unknown.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("SqlitePool", &["connect", "connect_with"]),
        effects: &["Env", "Fs", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (sqlite via sqlx 0.9.0, interposer): connect opens the db file read-write (+creat under mode=rwc) with stat/lstat of its path, opens /dev/urandom (first sqlite use in the process), reads SQLITE_TMPDIR/TMPDIR/RUST_MIN_STACK. sqlite::memory: opens only /dev/urandom. Fs direction depends on mode=: unknown.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("SqlitePoolOptions", &["connect", "connect_with"]),
        effects: &["Env", "Fs", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (sqlite via sqlx 0.9.0, interposer): connect opens the db file read-write (+creat under mode=rwc) with stat/lstat of its path, opens /dev/urandom (first sqlite use in the process), reads SQLITE_TMPDIR/TMPDIR/RUST_MIN_STACK. sqlite::memory: opens only /dev/urandom. Fs direction depends on mode=: unknown.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("SqliteConnectOptions", &["connect", "connect_with"]),
        effects: &["Env", "Fs", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (sqlite via sqlx 0.9.0, interposer): connect opens the db file read-write (+creat under mode=rwc) with stat/lstat of its path, opens /dev/urandom (first sqlite use in the process), reads SQLITE_TMPDIR/TMPDIR/RUST_MIN_STACK. sqlite::memory: opens only /dev/urandom. Fs direction depends on mode=: unknown.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("SqlitePool", &["acquire", "begin", "begin_with"]),
        effects: &["Env", "Fs", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (sqlite, interposer): a cold pool's acquire/begin = the connect above; a warm pool's: 0 events.",
    },
    AlsoEffect {
        krate: &["sqlx"],
        on: AlsoOn::Method("SqlitePoolOptions", &["acquire", "begin", "begin_with"]),
        effects: &["Env", "Fs", "Rand"],
        fs_kind: &[],
        row: "R1623",
        evidence: "EXECUTED (sqlite, interposer): a cold pool's acquire/begin = the connect above; a warm pool's: 0 events.",
    },
];

/// The effects `(crate_name, path)` performs BESIDE its primary `classify` answer — see [`ALSO_EFFECTS`]. Empty unless
/// `classify` charges the path (a second effect never stands alone: the κ ledger's "was this call classified" question
/// stays the primary's), and never contains the primary itself.
pub fn also_effects(crate_name: &str, path: &str) -> Vec<&'static str> {
    let Some(primary) = classify(crate_name, path) else { return Vec::new() };
    let mut out: Vec<&'static str> = Vec::new();
    for row in ALSO_EFFECTS {
        if row.krate.contains(&crate_name) && row.on.matches(path) {
            for e in row.effects {
                if *e != primary && !out.contains(e) {
                    out.push(e);
                }
            }
        }
    }
    out
}

/// SOUNDNESS R1617(4) — the second effects of EVERY `AlsoOn::Method` row of `crate_name` that names `method`, whatever its
/// type. For a call whose receiver type is a GUESS — a dependency builder chain the scan types as its ROOT (`c.get(u).send()`
/// reaches here as `Client::send`, the step's real type `RequestBuilder` being unknown) — and whose primary the rule tables
/// already charge on that guessed path: the step's type is one of the crate's, so the union over the crate's rows for the
/// method over-approximates the row that applies. Empty when no row names the method.
pub fn also_effects_by_method(crate_name: &str, method: &str) -> Vec<&'static str> {
    let mut out: Vec<&'static str> = Vec::new();
    for row in ALSO_EFFECTS {
        if row.krate.contains(&crate_name) && matches!(row.on, AlsoOn::Method(_, ms) if ms.contains(&method)) {
            for e in row.effects {
                if !out.contains(e) {
                    out.push(e);
                }
            }
        }
    }
    out
}

/// The §2 `fs` direction of the second `Fs` [`also_effects`] charges for this path: the union of the matching rows'
/// `fs_kind`, or empty (direction unknown — record the poison marker) if any matching `Fs` row declares none.
pub fn also_fs_kind(crate_name: &str, path: &str) -> Vec<&'static str> {
    let mut out: Vec<&'static str> = Vec::new();
    for row in ALSO_EFFECTS {
        if row.krate.contains(&crate_name) && row.on.matches(path) && row.effects.contains(&"Fs") {
            if row.fs_kind.is_empty() {
                return Vec::new();
            }
            for k in row.fs_kind {
                if !out.contains(k) {
                    out.push(k);
                }
            }
        }
    }
    out
}

/// Every effect a `classify`-charged call performs: the primary first, then [`also_effects`]. `None` when `classify` is.
pub fn classify_all(crate_name: &str, path: &str) -> Option<Vec<&'static str>> {
    let primary = classify(crate_name, path)?;
    let mut v = vec![primary];
    v.extend(also_effects(crate_name, path));
    Some(v)
}

/// The coverage-gate rendering of [`classify_all`]: `Rand` for a one-effect rule (the pre-R1612 column, unchanged), and
/// `Rand+Clock` — primary, then the second effects in table order — for a rule with more.
pub fn classify_rendered(crate_name: &str, path: &str) -> Option<String> {
    classify_all(crate_name, path).map(|v| v.join("+"))
}

/// Does a SECOND effect of this name have a locator surface (§2 `hosts`/`fs`/`cmds`/`tables`) that the call does not
/// show? Then the charging site marks it `incomplete`: the call's argument is the PRIMARY's locator, never the second
/// effect's, so without the mark a benign sibling literal would certify it (`allow Fs /etc/hosts` over a function that
/// also stats `PATH`). Effects with no surface (`Env`/`Clock`/`Rand`/`Log`/`Ipc`/`Clipboard`) need nothing.
pub fn also_hides_locator(eff: &str) -> bool {
    matches!(eff, "Fs" | "Net" | "Llm" | "Exec" | "Db")
}


/// SOUNDNESS R330 — IS THIS `hash_password` CALL PROVABLY THE EXPLICIT-SALT ONE (password-hash 0.5.x)?
///
/// **THE DEFECT THIS EXISTS FOR, and it was mine, introduced by R318's fix the previous day.** R318
/// correctly found that `hash_password` mints OS entropy — at password-hash **0.6.x**, where
/// `fn hash_password(&self, password)` (`lib.rs:107`) has the body `let salt = try_generate_salt()?;`.
/// At **0.5.0** (`traits.rs:33`) and argon2 **0.5.3** (`lib.rs:572`) the identical name is
/// `fn hash_password(&self, password, salt)`: the caller supplies the salt and the call is deterministic
/// recomputation — PURE. So the `ends_with`-not-`contains` guard R318 relied on was keyed on the 0.6.x
/// name, and at 0.5.x the explicit-salt call IS named `hash_password`. Measured: two calls with the same
/// stored salt produce byte-identical hashes, and all four 0.5.x spellings were charged `Rand`.
///
/// **Why arity and not the resolved version.** R330's remedy offered both. The version is only knowable
/// where a lockfile resolves, and `calibration_exceeded` is ONE-SIDED — it fires when resolved > ceiling,
/// so it can never see a rule that mis-describes an OLDER release, which is exactly this direction. The
/// arity is written at the call site, needs no lockfile, and distinguishes the two signatures exactly.
///
/// **The direction is stated so it cannot drift:** this returns true only for the shape it can PROVE is
/// explicit-salt. An unrecorded arity (`argc == 0`, every synthesized edge and every pre-R330 cache
/// entry) returns false and the call stays charged. Narrowing a sound over-approximation by DENYLIST,
/// never by allowlist — the family rule.
pub fn password_hash_explicit_salt(crate_name: &str, path: &str, argc: u8, method: bool) -> bool {
    if !matches!(crate_name, "argon2" | "scrypt" | "pbkdf2" | "password_hash")
        || !path.ends_with("::hash_password")
    {
        return false;
    }
    if argc == 0 {
        return false; // NOT RECORDED — see `Call::argc`. Unknown charges.
    }
    // `syn` hands a method call its args WITHOUT the receiver and a UFCS `Trait::method(&recv, ..)`
    // WITH it, so normalize to the non-receiver count before comparing: 0.5.x is `(password, salt)` = 2,
    // 0.6.x is `(password)` = 1.
    let non_receiver = if method { argc } else { argc - 1 };
    let hit = non_receiver == 2;
    // §E1 HIT COUNTER, the `CANDOR_ALIAS_DEBUG` pattern. A refinement that narrows a charge must be
    // able to prove it REACHED real code, because "nothing moved" and "the branch never ran" print the
    // same corpus A/B. This is what `bin/corpus-ab.py --mark` counts.
    if hit && candor_report::env::trace("CANDOR_ALIAS_DEBUG") {
        eprintln!("R330EXPLICITSALT {path} argc={argc} method={method}");
    }
    hit
}

/// ⟨0.29⟩ HOW MANY LEADING ARGUMENTS OF AN `Fs` PATH-TAKING CALL ARE PATHS.
///
/// **THE DEFECT THIS EXISTS FOR.** The literal harvester took the first string literal found ANYWHERE in
/// the argument list, so `fs::write(user_path, "/tmp/lit")` published `paths: ["/tmp/lit"]` — the BYTES
/// BEING WRITTEN — as the destination surface, and `allow Fs /tmp/lit` certified a write to an
/// attacker-controlled path at exit 0. Measured on candor-scan and candor-ts; candor-java and
/// candor-swift read the path POSITION and fail closed correctly. Removing the sibling literal made the
/// same call fail closed, which is what identified the mechanism: any literal in the call, in any
/// position, defeated the runtime-path incompleteness marker.
///
/// So the surface is read from the PATH POSITIONS and nowhere else, and every one of them must be a
/// literal for the surface to be complete. Two-path operations are the reason this is an arity and not a
/// boolean: `fs::copy("/safe", user_path)` has a literal at position 0 and still writes somewhere
/// nobody can see, so requiring only position 0 would leave the identical hole one argument along.
pub fn fs_path_arity(leaf: &str) -> usize {
    match leaf {
        "copy" | "rename" | "hard_link" | "soft_link" | "symlink" | "symlink_file" | "symlink_dir" => 2,
        _ => 1,
    }
}

/// SOUNDNESS R383 — THE METHOD FORMS WHOSE PATH IS AN ARGUMENT, not the receiver.
///
/// `scan.rs`'s Fs masking arm reads `!c.method && is_fs_path_arg(leaf)`. The `!c.method` gate exists for
/// a real reason — the path-STAT methods (`p.metadata()`, `p.exists()`) carry the path as the RECEIVER,
/// so masking them would be wrong — but it excluded EVERY method form, and `OpenOptions::open(path)` is
/// a method whose path IS the argument. Measured, with the instrument calibrated first: a function doing
/// `File::open("/etc/hostname")` beside `OpenOptions::new().read(true).open(caller_path)` reported
/// `paths:['/etc/hostname'] incomplete:NONE`; `deny Fs` exited 1 and **`allow Fs /etc/hostname` exited
/// 0** — a policy saying "only /etc/hostname" going green over a caller-supplied path. The FREE-fn
/// spelling of the same call is the isolating control: it marks incomplete and fails closed.
///
/// **`argc` does not discriminate; the RECEIVER TYPE does.** Instrumented, the four shapes are
/// `OpenOptions::open` (argc 1, path IS the arg), `File::read_to_string` and `File::write` (argc 1,
/// BUFFER arg) and `Path::exists` (argc 0, path is the receiver).
///
/// **The family is from a 1,545-crate sweep, not from the one spelling that was found (R346):** the only
/// path-taking METHOD pairs in the registry are `OpenOptions::open` (69 std + 2 tokio + 9
/// `cap_primitives`) and `DirBuilder::create` (5 std + tokio). Every other method on those same receivers
/// is a builder modifier (`read`/`write`/`truncate`/`mode`) or a combinator (`map`/`map_err`/`or_else`/
/// `with_context`), and `std::fs::File`'s 267 method hits are all use-verbs whose path was fixed at open.
///
/// Matched on the TAIL of the resolved call path, so std, tokio, `cap_primitives` and `fs_err` are all
/// covered by one rule without naming a crate. **Stays an ALLOWLIST:** R379 built the denylist inversion
/// for the Net twin and the corpus refused it, and here a denylist over method forms would mask all 267
/// `File` use-verbs and every combinator on a whole-crate-Fs receiver.
///
/// **SOUNDNESS R417 — THE CAPABILITY-`Dir` FAMILY WAS ABSENT, AND IT IS A LIVE GATE BYPASS.**
/// `cap_std::fs::Dir` (and its `fs_utf8`/`cap_async_std` twins, and `openat::Dir`) is a whole second
/// filesystem API whose path is an ARGUMENT to a METHOD on a directory handle — `d.write(caller, …)`,
/// `d.open(caller)`, `d.remove_file(caller)`. MEASURED, with the free-fn spelling as the isolating
/// control in the same fixture:
///
/// ```text
/// control(caller)  std::fs::write("/tmp/benign",…); std::fs::write(caller,…)
///                  → paths:['/tmp/benign'] incomplete:['Fs']   allow Fs /tmp/benign → exit 1  ✔
/// mixed(d,caller)  std::fs::write("/tmp/benign",…); d.write(caller,…)
///                  → paths:['/tmp/benign'] incomplete:NONE     allow Fs /tmp/benign → exit 0  ✘
/// ```
///
/// The call path resolves in full (`cap_std::fs::Dir::write`), so this is not a resolution gap — the
/// guard simply had two names in it. `alone(d,caller)` confirms the call IS classified `Fs`: the
/// effect was seen, the locator was not, and nothing said so.
///
/// **WHY THIS HALF IS A DENYLIST WHILE THE REST OF THE GUARD IS AN ALLOWLIST**, which is not a
/// contradiction but the point: the allowlist above exists because the receiver is UNKNOWN, so masking
/// by default would swallow `File`'s 267 use-verbs. Here the receiver is KNOWN to be a directory
/// capability, and on that receiver essentially every method names a path — 24 of the 49 declared on
/// `cap_std::fs::Dir` are already `is_fs_path_arg` leaves, and most of the remaining 25 (`open_with`,
/// `open_dir`, `is_file`, `is_dir`, `symlink_contents`, `read_link_contents`, `create_dir_with`,
/// the `bind_unix_*`/`connect_unix_*` socket-path verbs) take one too. An allowlist here would be the
/// R346→R348 hand-list vein by construction: every name I failed to write down is a silent bypass, and
/// R399 settled that an under-catch on this guard is a BROKEN GATE, not a missed mask.
///
/// So the default on a `Dir` receiver is MASK, and the exceptions are the handful of methods that
/// provably take no path: handle-to-handle conversions and the iterator/`self`-only verbs. Being wrong
/// about one of those costs an over-mask on a rare API (fails CLOSED, disclosed); being wrong the other
/// way is the exit-0 above. [[candor-denylist-over-allowlist]] — say which direction it fails in first.
///
/// Scoped on the RECEIVER SEGMENT being exactly `Dir`, so `cap_std`, `cap_std::fs_utf8`,
/// `cap_async_std` and `openat` are covered by one rule without naming a crate — the same tail-matching
/// discipline as the two names above. A non-filesystem type that happens to be called `Dir` would be
/// over-masked, which fails closed.
/// SOUNDNESS R414 / SPEC ⟨0.37⟩ — **a RECEIVER-form path stat names its destination, and every engine
/// in this family was silent on it.** `p.exists()`, `p.metadata()`, `p.canonicalize()` reach the
/// filesystem against the path they are invoked ON; the locator is the RECEIVER, not an argument.
/// MEASURED before the clause was written, one variable, a benign allowed literal beside a
/// caller-chosen path:
///
/// ```text
/// fn f(p: &Path) { fs::write("/tmp/benign", b"x"); p.exists(); }
///   -> paths:['/tmp/benign'] incomplete:NONE   allow Fs /tmp/benign -> exit 0, "nothing hidden"
/// ```
///
/// The ARGUMENT spelling of the identical reach (`fs::metadata(p)`) was already marked, which is what
/// makes this a drift rather than a policy: `is_fs_path_arg` deliberately excluded the method form
/// because its receiver was assumed to be an OPEN HANDLE. That assumption holds for `File` and is
/// false for `Path` — a `Path` is a path VALUE, and a stat on it is `Fs` reaching that value.
///
/// **NO CARVE-OUT LIST, and that is structural rather than lucky.** The pure `Path` algebra —
/// `join`, `parent`, `file_name`, `extension`, `to_str`, `display`, `starts_with`, `to_path_buf`,
/// `as_path` — is NOT classified `Fs` (measured: a function calling all nine reports `fs:['write']`
/// from an unrelated sibling call and nothing else), so it never reaches the branch that consults
/// this predicate. The carve-out falls out of the classification, exactly as it does on the java
/// side, instead of being a list that must be kept in sync with `std`.
///
/// Matched on the RECEIVER SEGMENT so `std::path` and the `camino` mirrors are covered by one rule
/// without naming a crate. Being generous here is the SAFE direction: the predicate is only ever
/// consulted for a call the classifier ALREADY resolved to `Fs`, so an extra receiver name can at
/// worst over-mask (fails closed, disclosed), while a missing one is the exit-0 above — R399's
/// ruling that an under-catch on a masking guard is a broken gate, not a missed mask.
pub fn is_fs_receiver_locator(call_path: &str) -> bool {
    let mut segs = call_path.rsplit("::");
    let (Some(_leaf), Some(recv)) = (segs.next(), segs.next()) else { return false };
    matches!(recv, "Path" | "PathBuf" | "Utf8Path" | "Utf8PathBuf")
}

/// SOUNDNESS R460 / SPEC ⟨0.37⟩ — **the Exec twin of `is_fs_receiver_locator`: a spawn's locator is
/// its RECEIVER, and rust was silent on it.** `is_cmd_naming_method` marks the surface incomplete at
/// `Command::new(<runtime value>)`, which covers every spelling that NAMES the program inside the
/// function. It cannot cover the spelling that names it somewhere else:
///
/// ```text
/// fn masked(cmd: &mut Command) { Command::new("git").status(); cmd.spawn(); }
///   -> cmds:['git'] incomplete:NONE   allow Exec git -> exit 0, "nothing hidden"
/// ```
///
/// MEASURED on the pre-fix binary, one variable — deleting the benign `Command::new("git")` line, and
/// nothing else, turns the same gate to exit 1. The real instance is tokio's own
/// `process::unix::spawn_child(cmd: &mut std::process::Command) { cmd.spawn()? }`, production source,
/// charged `Exec` with no `cmds` and no `incomplete`.
///
/// **A DENYLIST, and the direction is the point.** On a `Command` receiver essentially every method
/// that is not a documented BUILDER modifier reaches the boundary (`spawn`, `status`, `output`, `exec`,
/// and every async / pty mirror of them), so an allowlist of terminal names would be the R346→R348
/// hand-list vein by construction: each name not written down is a silent bypass. The carve-out is
/// `is_cmd_builder_method` — the SAME list the head-refinement already trusts, not a second copy of it
/// (§G, ask the authority) — plus the `get_*` getters that list's own doc-block names. Being wrong
/// about a carve-out costs an over-mask on a configure-only call (fails closed, disclosed); being
/// wrong the other way is the exit-0 above.
///
/// Scoped on the RECEIVER SEGMENT being exactly `Command`, so `std::process`, `tokio::process`,
/// `async_process` and the `std::os::unix` extension trait are one rule without naming a crate — the
/// same tail-matching discipline as `is_fs_receiver_locator`. The predicate is only ever consulted for
/// a call the classifier ALREADY resolved to `Exec`, so a non-spawning type that happens to be called
/// `Command` (clap's builder) is unreachable unless something already charged it Exec.
///
/// The DETERMINED receiver does not arrive here: the collector resolves a builder chain rooted at
/// `Command::new("git")` — inline or through a `let` binding — into `str_arg`, so only a receiver whose
/// program was never named in this function reaches the mask. That split is this fix's over-charge
/// control, and it is what keeps the dominant spelling certifiable.
pub fn is_exec_receiver_locator(call_path: &str) -> bool {
    let mut segs = call_path.rsplit("::");
    let (Some(leaf), Some(recv)) = (segs.next(), segs.next()) else { return false };
    // SOUNDNESS R808 — AND ITS EXTENSION TRAIT. The deep engine resolves `cmd.exec()` to the TRAIT method
    // `std::os::unix::process::CommandExt::exec`, not to `Command::exec`, so a receiver test on the
    // literal segment `Command` let the deep engine certify a caller-supplied `exec` while `candor-scan`
    // (which forms `Command::exec` from the typed receiver) flagged it — the R808 port's own boundary,
    // measured on the port's fixture one method over. `CommandExt`'s other members (`uid`, `gid`,
    // `groups`, `pre_exec`, `arg0`, `process_group`) are already `is_cmd_builder_method` carve-outs.
    matches!(recv, "Command" | "CommandExt") && !is_cmd_builder_method(leaf) && !leaf.starts_with("get_")
}

pub fn is_fs_path_arg_method(call_path: &str) -> bool {
    if call_path.ends_with("OpenOptions::open") || call_path.ends_with("DirBuilder::create") {
        return true;
    }
    let mut segs = call_path.rsplit("::");
    let (Some(leaf), Some(recv)) = (segs.next(), segs.next()) else { return false };
    if recv != "Dir" {
        return false;
    }
    // The no-path exceptions on a directory capability: handle↔handle conversions, the entry
    // iterators, and the verbs whose only operand is `self`. Everything else on a `Dir` names a path.
    //
    // EVERY NAME HERE WAS CHECKED AGAINST ITS SIGNATURE, because a wrong entry here is not a precision
    // loss, it is the exit-0 above. `read_dir` was in this list on the first cut on the reasonable-
    // sounding grounds that `entries()` is the self-only form — and `cap_std::fs::Dir::read_dir` is
    // `fn read_dir<P: AsRef<Path>>(&self, path: P)`, so that entry was a bypass I had just written.
    // Adding a name here requires reading its signature, not recognising it.
    !matches!(
        leaf,
        "try_clone"
            | "into_std_file"
            | "from_std_file"
            | "into_std"
            | "from_std"
            | "entries"
            | "entries_utf8"
            | "dir_metadata"
            | "reopen_dir"
            | "remove_open_dir"
            | "remove_open_dir_all"
            | "open_parent_dir"
            | "rewind"
            | "as_raw_fd"
            | "as_fd"
    )
}

/// The masking guard (AS-EFF-008), the `Db` analog of `is_net_establishing`: whether a `Db`-classified
/// call takes the raw SQL QUERY as a string argument (so a missing literal leaves the table
/// structurally INVISIBLE — a runtime-built query — and the surface is incomplete, fail-closed). An
/// ALLOWLIST of the SQL-string-bearing execution/prepare verbs, the SAFE direction: a
/// build-then-execute terminal that takes NO SQL string (sqlx/diesel/sea_orm `fetch*`/`load*`/`first`/
/// `all`/`one`/`stream`, the document-store `find*`/`insert*`/…), and a non-query op (`connect`/
/// `open`/`acquire`/`begin`/`commit`/`ping`/`get_conn`), are NOT here — their query is built
/// structurally (never a maskable string literal) so a missing literal must not false-positive.
/// Under-catching an unusual query verb is a missed mask (sound-with-disclosure), ~~never a broken
/// gate~~ — **FALSE, SOUNDNESS R399**, and R386 three lines below is this guard's own counter-example.
/// `mysql`'s `query_drop`/`query_iter` are that crate's PRIMARY API, take `Q: AsRef<str>`, and were
/// absent: `allow Db users` exited 0 over `c.query_drop(caller_sql)` beside one literal query, with the
/// verb-only control exiting 1. The arg is the method leaf (the path's last segment).
pub fn is_db_query_arg(leaf: &str) -> bool {
    // SOUNDNESS R386 — THE `sqlite3_*` C API TAKES SQL AND WAS ABSENT, so a benign sibling literal
    // certified arbitrary caller-supplied SQL. `classify` in this same crate maps `sqlite3_exec`/
    // `sqlite3_step`/`sqlite3_prepare*` to `Db`; this list had none of them, while candor-swift covers
    // the whole family by prefix — a cross-engine divergence, which is how it was found.
    //
    // MEASURED, calibrated first (`deny Db` exits 1): `conn.execute("INSERT INTO users (id) VALUES (1)",
    // [])` beside `sqlite3_exec(db, caller_sql, …)` reported `tables:['users'] incomplete:NONE` and
    // **`allow Db users` exited 0**. R383 recorded this gap as "REAL BUT NOT LIVE" on the grounds that a
    // C-string literal never reaches `tables` — true of an ISOLATED function, and the wrong shape: the
    // literal does not have to come from the masked call, only from the same FUNCTION.
    //
    // ONLY THE SQL-BEARING SPELLINGS. `sqlite3_step`/`_close`/`_serialize`/`_deserialize` carry no query,
    // and `sqlite3_open*` takes a FILENAME — masking that would claim a Db surface for an Fs locator,
    // which is the over-mask this allowlist exists to avoid. Direction stays an ALLOWLIST for the reason
    // R379 measured: a denylist over a whole-crate-Db crate masks every lifecycle verb in it.
    if matches!(
        leaf,
        "sqlite3_exec"
            | "sqlite3_prepare"
            | "sqlite3_prepare_v2"
            | "sqlite3_prepare_v3"
            | "sqlite3_prepare16"
            | "sqlite3_prepare16_v2"
            | "sqlite3_prepare16_v3"
            // R386's OWN BOUNDARY DEFECT, found by a release panel: `sqlite3_get_table(db, zSql, …)`
            // takes SQL as its second argument and `classify` maps it to `Db`, and the first cut of
            // this list — which cites R346 — omitted it. Two of the family's SQL-bearing spellings
            // written down out of three. Reach on the local registry is ZERO call sites (only
            // declarations in `libsqlite3-sys` and `sqlite-wasm-rs`), so this is latent, not live.
            | "sqlite3_get_table"
    ) {
        return true;
    }
    matches!(
        leaf,
        "execute"
            | "execute_batch"
            | "execute_unprepared"
            | "batch_execute"
            | "simple_query"
            | "query"
            | "query_one"
            | "query_opt"
            | "query_raw"
            | "query_row"
            | "query_map"
            // SOUNDNESS R399 — `mysql`'s OWN PRIMARY API was absent, and this is a live gate bypass rather
            // than the "missed mask" the struck sentence above promised. All four take `Q: AsRef<str>`
            // (`mysql-28.0.2/src/conn/queryable.rs:29,50,126`), so the SQL is a maskable string argument of
            // THIS call, which is the exact condition this list encodes. Measured: `allow Db users` exits 0
            // over `c.query_drop(caller_sql)` beside one literal query; the control, the same fixture with
            // the verb changed to `query`, exits 1.
            | "query_drop"
            | "query_iter"
            | "query_first"
            | "query_fold"
            // postgres COPY: the statement is a SQL string argument (`postgres-0.19.14/src/client.rs:492,520`).
            | "copy_in"
            | "copy_out"
            | "query_and_then"
            | "query_typed"
            | "query_all"
            | "prepare"
            | "prepare_typed"
            | "prepare_cached"
            | "exec"
            | "exec_first"
            | "exec_iter"
            | "exec_map"
            | "exec_fold"
            | "exec_drop"
            | "exec_batch"
            | "prep"
            | "run_command"
    )
}

/// THE AS-EFF-008 MASKING GUARD, ONE AUTHORITY FOR BOTH RUST ENGINES. SOUNDNESS R806 / R808.
///
/// The question: this call carries a surface effect `eff` and NO literal locator was captured for it —
/// is its locator (host, program, path, SQL) therefore a RUNTIME value the gate cannot see? If so the
/// caller marks the surface `incomplete`, so a benign sibling literal cannot certify it.
///
/// **WHY ONE FUNCTION.** Both rust engines asked this question, each with its own copy of the
/// disjunction over the `is_*` predicates below, and the copies drifted: R460's receiver-locator arm and
/// R383's `OpenOptions::open` arm reached `candor-scan` and never the deep engine (R808). A rule added
/// here now reaches both, which is the only way this class stops recurring one crate over.
///
/// `leaf` is the call's own method/function name; `path` the resolved call path; `method` whether the
/// call is written in method form on a receiver (so a path-stat `p.exists()` is not mistaken for an
/// argument-form `fs::metadata(p)`, and the receiver-locator arms can fire). `crate_name` is the
/// resolved crate, used only to scope the table-derived FFI arms.
///
/// **THE DIRECTION, stated so it cannot drift:** a wrong `true` over-masks — the gate fails CLOSED and
/// says so; a wrong `false` is the benign-sibling-literal bypass, a broken gate (R399). Every arm that
/// reads a `classify` table below reads it with a NO-LOCATOR DENYLIST, so a leaf added to that table is
/// masked until someone reads its signature and says otherwise.
pub fn masks_locator(eff: &str, crate_name: &str, path: &str, leaf: &str, method: bool) -> bool {
    let by_list = match eff {
        "Net" => is_net_establishing(leaf),
        // SOUNDNESS R808 — the receiver arm is NOT gated on method form. `Command::spawn(cmd)` (UFCS)
        // runs the same caller-supplied program as `cmd.spawn()`, and with the gate BOTH engines
        // certified it at exit 0 on the unit and its caller. In call form the receiver is argument 0;
        // neither engine resolves a determined argument-0 command, so a UFCS spawn on a command built
        // in the same function over-masks (fails closed) — the rare spelling paying for the silent one.
        "Exec" => is_cmd_naming_method(leaf) || is_exec_receiver_locator(path),
        "Fs" => {
            (!method && is_fs_path_arg(leaf))
                || (method && is_fs_path_arg_method(path))
                || (method && is_fs_receiver_locator(path))
        }
        "Db" => is_db_query_arg(leaf),
        _ => false,
    };
    by_list || masks_locator_by_table(eff, crate_name, path, leaf)
}

/// SOUNDNESS R806 — THE TABLE-DERIVED HALF OF `masks_locator`, separate only so a reach probe can ask
/// the very function the guard asks (`R806MASK` in candor-scan) rather than a copy of it.
///
/// Each hand list in `masks_locator` was SHORT against the `classify` table that charges the effect:
/// `is_fs_path_arg` held 28 names while `LIBC_FS` charges 92, `is_cmd_naming_method` held `new`/`cmd`
/// while `LIBC_EXEC` names `system`/`popen`/`exec*`/`posix_spawn*`, `is_net_establishing` lacked
/// `getaddrinfo`, and `is_db_query_arg` lacked `prepare_typed_cached` from `PG_DB_VERBS`. EXECUTED on
/// each: a caller's file really unlinked, a caller's shell command really run, a real resolver lookup,
/// all under `allow <E> in <unit> <benign literal>` at exit 0 on the unit AND its caller.
///
/// Adding the missing names would leave two tables to drift again the next time one grows — the shape
/// swift closed as R787 and java as R794, both by derivation. So these arms READ the charging table and
/// subtract a signature-checked NO-LOCATOR denylist: a leaf added to the table is masked by default.
pub fn masks_locator_by_table(eff: &str, crate_name: &str, path: &str, leaf: &str) -> bool {
    let syscall = is_syscall_crate(crate_name);
    match eff {
        "Net" => {
            syscall
                && LIBC_NET.contains(&leaf)
                && !LIBC_NET_NO_DESTINATION.contains(&leaf)
                // `rustix::net::sendmsg(socket, iov, control, flags)` takes NO address — rustix spells
                // the addressed forms `sendmsg_addr`/`sendmsg_v4`/`sendmsg_v6`/`sendmsg_unix` (not in
                // `LIBC_NET`, so unclassified). libc's and nix's `sendmsg` DO carry one (`msg_name` /
                // `addr: Option<&S>`), which is why this is scoped to the crate rather than the leaf.
                // Measured on the A/B: x11rb's `DefaultStream::do_write` over its connected X11 socket
                // was the only reach, an over-mask, removed here.
                && !(crate_name == "rustix" && leaf == "sendmsg")
        }
        "Exec" => syscall && LIBC_EXEC.contains(&leaf) && !LIBC_EXEC_NO_PROGRAM.contains(&leaf),
        "Fs" => syscall && LIBC_FS.contains(&leaf) && !LIBC_FS_NO_PATH.contains(&leaf),
        "Db" => {
            (matches!(crate_name, "postgres" | "tokio_postgres" | "deadpool_postgres" | "rusqlite")
                && PG_DB_VERBS.iter().any(|v| path.ends_with(v))
                && !PG_DB_VERBS_NO_SQL.iter().any(|v| path.ends_with(v)))
                // `sqlx_core`'s `Executor::prepare_with(sql, params)` — the one SQL-TEXT verb in that
                // crate's Db rule that the leaf list lacked (`prepare` is there). The rest of that rule
                // (`fetch*`/`execute*` on a `Query`) takes an EXECUTOR at argument 0, so deriving the
                // whole rule would mask every `query(lit).fetch_all(&pool)`; it is a named member
                // rather than a derivation for that reason.
                || (crate_name == "sqlx_core" && leaf == "prepare_with")
        }
        _ => false,
    }
}

/// Map a cap-std capability *type* to the effect it authorises. Holding one of these
/// (e.g. `&Dir`) is the real, unforgeable right to perform that effect — so candor
/// treats it as a declared capability, exactly like its own `&Fs` token.
pub fn capstd_cap(crate_name: &str, type_name: &str) -> Option<&'static str> {
    if !crate_name.starts_with("cap_") {
        return None;
    }
    Some(match type_name {
        "Dir" => "Fs",
        "TcpListener" | "TcpStream" | "UdpSocket" | "Pool" => "Net",
        "UnixListener" | "UnixStream" | "UnixDatagram" => "Ipc",
        "SystemClock" | "MonotonicClock" => "Clock",
        _ => return None,
    })
}

/// Table names a SQL string literal STATICALLY reaches — the `Db` analog of the `Net` host /
/// `Exec` command / `Fs` path literal surface (feeds `allow Db in <scope> <table>…`, AS-EFF-008).
/// Conservative by construction, because a wrong capture here would FABRICATE: the string must
/// open with a SQL statement keyword, and only identifiers in table position are taken —
/// `FROM`/`JOIN` anywhere, `INTO` anywhere, statement-leading `UPDATE`/`TRUNCATE`, and
/// `TABLE` (create/drop/alter), skipping `ONLY`/`IF NOT EXISTS`. `UPDATE` mid-statement is
/// deliberately ignored (`FOR UPDATE SKIP LOCKED` must not yield a table "skip"). A
/// dynamically-built query yields nothing — the gate's opaque case — never a guess.
/// Output is lower-cased, quote/backtick-stripped, `schema.table` kept qualified, deduped.
/// SPEC §2 pins this algorithm token-for-token across engines; the cross-impl vector battery
/// (candor-spec conformance/tables/vectors.json, run.sh Part 4b) enforces the JVM/TS mirrors.
pub fn tables_in_sql(sql: &str) -> Vec<String> {
    const STMT: &[&str] =
        &["select", "insert", "update", "delete", "create", "drop", "alter", "truncate", "merge", "replace", "with"];
    // Tokens that can FOLLOW a table-introducing keyword without being a table.
    const SKIP: &[&str] = &["only", "if", "not", "exists", "table"];
    // Identifier-position tokens that are grammar, not a table (subqueries, locking clauses…).
    const STOP: &[&str] = &[
        "select", "set", "where", "values", "on", "using", "group", "order", "by", "limit",
        "returning", "as", "inner", "outer", "left", "right", "cross", "lateral", "natural",
        "union", "all", "distinct", "case", "when", "null", "default", "skip", "nowait", "of",
        "from", "join", "into", "update", "delete", "insert",
    ];
    // `,` survives as its OWN token (not a space): it's what lets `FROM t1, t2` continue the table
    // list without fabricating from other comma-ridden positions (column lists, ON clauses).
    let cleaned: String = sql
        .to_lowercase()
        .chars()
        .flat_map(|c| match c {
            '(' | ')' | ';' => vec![' '],
            ',' => vec![' ', ',', ' '],
            _ => vec![c],
        })
        .collect();
    let toks: Vec<&str> = cleaned.split_whitespace().collect();
    let Some(first) = toks.first() else { return Vec::new() };
    if !STMT.contains(first) {
        return Vec::new(); // not SQL — nothing to certify, nothing fabricated
    }
    let ident = |t: &str| -> Option<String> {
        let t = t.trim_matches(|c| matches!(c, '"' | '`' | '\''));
        let mut chars = t.chars();
        let ok_first = chars.next().is_some_and(|c| c.is_ascii_alphabetic() || c == '_');
        let ok_rest = t.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '$' | '"' | '`'));
        (ok_first && ok_rest && !STOP.contains(&t)).then(|| t.replace(['"', '`'], ""))
    };
    let mut out: Vec<String> = Vec::new();
    let mut push = |t: Option<String>| {
        if let Some(t) = t {
            if !out.contains(&t) {
                out.push(t);
            }
        }
    };
    for (i, tok) in toks.iter().enumerate() {
        let table_pos = match *tok {
            "from" | "join" | "into" | "table" => true,
            // statement-leading only (see doc comment): `update t set …`, `truncate [table] t`.
            "update" | "truncate" => i == 0,
            _ => false,
        };
        if !table_pos {
            continue;
        }
        let mut j = i + 1;
        while j < toks.len() && SKIP.contains(&toks[j]) {
            j += 1;
        }
        let Some(next) = toks.get(j) else { continue };
        let Some(first) = ident(next) else { continue };
        push(Some(first));
        // Comma-ADJACENT continuation only: `FROM t1, t2, t3` takes all three, while an alias breaks
        // the chain (`FROM t1 a, t2` keeps just t1 — an under-report, never a guess: skipping an
        // alias to chase the comma would fabricate tables out of `INSERT INTO t (a, b)`'s column
        // list, whose parens are spaces by the time we tokenize).
        while j + 2 < toks.len() && toks[j + 1] == "," {
            let Some(more) = ident(toks[j + 2]) else { break };
            push(Some(more));
            j += 2;
        }
    }
    out
}

#[cfg(test)]
mod tests {
    #[test]
    fn r1150_getrandom_error_values_draw_nothing_but_the_draws_do() {
        for p in ["getrandom::Error::eq", "getrandom::&Error::eq", "getrandom::Error::raw_os_error", "getrandom::Error::fmt",
                  "getrandom::error::Error::new_custom", "getrandom::Error::UNSUPPORTED"] {
            assert_eq!(classify("getrandom", p), None, "{p}");
        }
        for p in ["getrandom::fill", "getrandom::fill_uninit", "getrandom::u32", "getrandom::u64", "getrandom::getrandom",
                  "getrandom::SysRng::try_fill_bytes", "getrandom::getrandom_uninit"] {
            assert_eq!(classify("getrandom", p), Some("Rand"), "{p}");
        }
    }
    #[test]
    fn model_host_recognizes_known_providers_and_special_forms() {
        use super::is_model_host as m;
        // exact known hosts (case-insensitive), with/without a port
        assert!(m("api.openai.com"));
        assert!(m("API.OpenAI.com"));
        assert!(m("api.anthropic.com:443"));
        assert!(m("generativelanguage.googleapis.com"));
        assert!(m("api.mistral.ai"));
        assert!(m("api.cohere.ai"));
        assert!(m("api.cohere.com")); // BOTH cohere hosts
        assert!(m("api.groq.com"));
        assert!(m("api.together.xyz"));
        assert!(m("api.perplexity.ai"));
        assert!(m("openrouter.ai"));
        // a subdomain of a known host counts
        assert!(m("eu.api.openai.com"));
        // Ollama: :11434 on a LOOPBACK host only (max-review r3 — a remote host on 11434 is not Ollama)
        assert!(m("localhost:11434"));
        assert!(m("127.0.0.1:11434"));
        assert!(!m("ollama.internal:11434")); // a remote/internal service on 11434 is NOT a model host
        // Bedrock: the FIRST label is the model-inference service, not the substring "bedrock"
        assert!(m("bedrock-runtime.us-east-1.amazonaws.com"));
        assert!(m("bedrock-runtime.eu-west-1.amazonaws.com"));
        assert!(m("bedrock-agent-runtime.us-east-1.amazonaws.com"));
        // NOT model hosts (never guessed)
        assert!(!m("example.com"));
        assert!(!m("api.stripe.com"));
        assert!(!m("localhost:8080")); // a non-Ollama local port
        assert!(!m("s3.us-east-1.amazonaws.com")); // amazonaws but not bedrock
        assert!(!m("bedrock-backups.s3.amazonaws.com")); // an S3 bucket merely NAMED bedrock — not the runtime
        assert!(!m("bedrock.us-east-1.amazonaws.com")); // the Bedrock CONTROL plane — not model inference
        assert!(!m("openai.com.evil.com")); // suffix trick — not a subdomain of a known host
    }

    #[test]
    fn model_sdk_crate_is_crate_level_no_method_gating() {
        use super::is_model_sdk_crate as s;
        assert!(s("async_openai"));
        assert!(s("aws_sdk_bedrockruntime"));
        assert!(s("ollama_rs"));
        assert!(s("langchain_rust"));
        assert!(!s("reqwest"));
        assert!(!s("aws_sdk_s3"));
    }

    #[test]
    fn sql_table_extraction_is_conservative() {
        use super::tables_in_sql as t;
        assert_eq!(t("SELECT id FROM users WHERE x = 1"), vec!["users"]);
        assert_eq!(t("select * from ledger.entries e join customers c on c.id = e.cid"),
                   vec!["ledger.entries", "customers"]);
        assert_eq!(t("INSERT INTO audit_log (a) VALUES (?1)"), vec!["audit_log"]);
        assert_eq!(t("UPDATE accounts SET v = ?"), vec!["accounts"]);
        assert_eq!(t("DELETE FROM sessions WHERE id = ?"), vec!["sessions"]);
        assert_eq!(t("CREATE TABLE IF NOT EXISTS cache (k TEXT)"), vec!["cache"]);
        assert_eq!(t("TRUNCATE TABLE staging"), vec!["staging"]);
        // FOR UPDATE locking clause must not yield a phantom table (mid-statement update ignored)
        assert_eq!(t("SELECT * FROM jobs FOR UPDATE SKIP LOCKED"), vec!["jobs"]);
        // a subquery in FROM position yields nothing for that position
        assert_eq!(t("SELECT * FROM (SELECT 1) q"), Vec::<String>::new());
        // not SQL -> nothing (never fabricate)
        assert_eq!(t("/tmp/some/path"), Vec::<String>::new());
        assert_eq!(t("hello world from nowhere"), Vec::<String>::new());
        // comma-ADJACENT continuation: a FROM list takes every table in the chain…
        assert_eq!(t("SELECT a FROM t1, t2, s.t3 WHERE x = 1"), vec!["t1", "t2", "s.t3"]);
        // …but an alias breaks it (under-report, never a guess)…
        assert_eq!(t("SELECT a FROM t1 a1, t2 WHERE x = 1"), vec!["t1"]);
        // …which is exactly what keeps a column list from fabricating (parens are spaces by now).
        assert_eq!(t("INSERT INTO t (a, b) VALUES (1, 2)"), vec!["t"]);
        // a subquery after the comma stops the chain too
        assert_eq!(t("SELECT a FROM t1, (SELECT 1) q"), vec!["t1"]);
    }

    use super::*;

    /// The routed-handle list's MEMBERSHIP RULE, enforced rather than merely documented.
    ///
    /// (a) Every routed type must have a whole-type rule that answers an ARBITRARY method on it.
    /// If it did not, routing it would hand the scanner a path the classifier drops — motion with no
    /// effect, and the silent under-report would survive the fix that was supposed to close it. The
    /// probe leaf is deliberately a name no carve-out lists, so it measures the BASE rule.
    ///
    /// (b) The named exclusions stay excluded. `ReadDir` cannot have a verb-precise rule written for it
    /// (its `next` is a syscall and is spelled like every other iterator's), and `Metadata`/`DirEntry`/
    /// `Permissions`/`FileType` are pure DATA under the coarse `std::fs::` prefix — routing any of them
    /// charges an effect for reading a field. `OpenOptions`/`DirBuilder` LEFT this list by the route the
    /// list's own comment prescribed: their type-keyed setter carve-outs were written first, so the
    /// whole-type rule under them now answers only for the terminal verb.
    #[test]
    fn std_effect_handles_have_a_whole_type_rule_and_exclude_the_pure_surfaces() {
        for ty in STD_EFFECT_HANDLES {
            let probe = format!("{ty}::__candor_probe_verb");
            assert!(
                classify("std", &probe).is_some(),
                "`{ty}` is routed into the classifier by receiver inference, but an arbitrary method \
                 on it classifies to NOTHING — the routing cannot close any under-report"
            );
            assert!(is_std_effect_handle(ty), "the predicate must agree with the list");
        }
        for ty in [
            "std::fs::ReadDir",
            "std::fs::Metadata", "std::fs::DirEntry", "std::fs::Permissions", "std::fs::FileType",
            "std::path::Path", "std::path::PathBuf", "std::vec::Vec",
        ] {
            assert!(!is_std_effect_handle(ty),
                    "`{ty}` has a pure surface the coarse prefix rules would charge — it must not be \
                     routed as a handle (Path/PathBuf route through their own verb-precise carve-out)");
        }
    }

    /// The pure read-backs on the ROUTED types, which is what makes (a) above safe: a whole-type rule
    /// answering every method is only acceptable because the genuinely-pure methods were carved out
    /// first. Receiver routing is a second door into these rules, so it must not re-fabricate.
    #[test]
    fn routed_std_handles_keep_their_pure_accessor_carve_outs() {
        for p in [
            "std::process::Command::get_program", "std::process::Command::get_args",
            "std::process::Command::get_envs", "std::process::Command::get_current_dir",
            "std::process::Child::id",
            "std::net::TcpStream::local_addr", "std::net::TcpStream::peer_addr",
            "std::net::TcpStream::nodelay", "std::net::TcpStream::ttl",
            "std::net::UdpSocket::take_error",
            "std::fs::File::as_raw_fd", "std::fs::File::into_raw_fd",
            "std::os::unix::net::UnixStream::as_raw_fd",
            // The OPTION-BUILDER setters (SPEC §1 ⟨0.32⟩): flags in a struct, no file named, nothing
            // opened. `create` is here as `OpenOptions`' setter and is a VERB on `DirBuilder` below —
            // one leaf, two answers, which is why these carve-outs are keyed on the TYPE.
            "std::fs::OpenOptions::new", "std::fs::OpenOptions::read", "std::fs::OpenOptions::write",
            "std::fs::OpenOptions::append", "std::fs::OpenOptions::truncate",
            "std::fs::OpenOptions::create", "std::fs::OpenOptions::create_new",
            "std::fs::OpenOptions::mode", "std::fs::OpenOptions::custom_flags",
            "std::fs::DirBuilder::new", "std::fs::DirBuilder::recursive", "std::fs::DirBuilder::mode",
        ] {
            assert_eq!(classify("std", p), None, "`{p}` is a pure read-back");
        }
        // …and the verbs on the same types still answer, or the carve-outs would have eaten the rule.
        for (p, want) in [
            ("std::process::Command::spawn", "Exec"),
            ("std::process::Child::wait", "Exec"),
            ("std::fs::File::write_all", "Fs"),
            ("std::net::TcpStream::write_all", "Net"),
            ("std::os::unix::net::UnixStream::send", "Ipc"),
            // the TERMINAL VERBS of the two option-builders — the whole point of routing them.
            ("std::fs::OpenOptions::open", "Fs"),
            ("std::fs::DirBuilder::create", "Fs"),
        ] {
            assert_eq!(classify("std", p), Some(want), "`{p}` must stay {want}");
        }
    }

    #[test]
    fn db_crates_are_calibrated() {
        // The calibrated set must cover every DB client the classifier knows, or the receipt's coverage
        // check would flag a recognized crate as a blind spot. (Was nightly-lint-only; now runs on stable.)
        for c in DB_CRATES {
            assert!(
                CALIBRATED_CRATES.contains(&c),
                "DB crate `{c}` is matched by classify() but missing from CALIBRATED_CRATES"
            );
        }
    }

    /// The two coverage lists mean OPPOSITE things and must stay disjoint.
    ///
    /// `CALIBRATED_CRATES` = "classify has effect rules here". `REVIEWED_PURE_CRATES` = "read it, it
    /// performs nothing". A crate in both would be asserting both at once, and the ledger consults them
    /// with an OR — so the contradiction would resolve silently to "covered" and nobody would look again.
    #[test]
    fn reviewed_pure_and_calibrated_are_disjoint() {
        for c in REVIEWED_PURE_CRATES {
            assert!(!CALIBRATED_CRATES.contains(&c),
                    "`{c}` is in BOTH lists — it cannot be rule-covered AND effect-free");
            assert!(!PATH_CALIBRATED_CRATES.contains(&c), "`{c}` is in BOTH lists (path-calibrated)");
            assert!(!CALIBRATED_PREFIXES.iter().any(|p| c.starts_with(p)),
                    "`{c}` is covered by a calibrated PREFIX as well as the pure list");
        }
    }

    /// A reviewed-pure crate must actually classify as pure — the mirror of `calibrated_crates_are_live`.
    ///
    /// The list makes candor BELIEVE these crates rather than disclose them, so if someone later adds a
    /// rule for one, the claim "performs no effect of its own" is dead and the entry has to be re-read,
    /// not silently outvoted by the rule. Probed with the same tails the liveness test uses, which is a
    /// broad sweep of the effectful verb shapes candor knows.
    #[test]
    fn reviewed_pure_crates_classify_as_pure() {
        for c in REVIEWED_PURE_CRATES {
            for t in CALIBRATION_PROBE_TAILS {
                assert!(classify(c, &format!("{c}{t}")).is_none(),
                        "`{c}` is listed REVIEWED-PURE but classify() gives it an effect on `{c}{t}` — \
                         one of the two is wrong, and the list is the claim");
            }
        }
    }

    /// ⟨CALIBRATION CEILING — the table must agree with the REVIEW RECORD⟩ SOUNDNESS R328.
    ///
    /// `CALIBRATED_CEILINGS` is the version each crate's rules were actually written against. Nothing
    /// derived it from, or checked it against, the review record — and three separate failures followed
    /// in one day: a wholesale table rewrite silently DROPPED nine entries while the commit message
    /// claimed four were absent "each with a stated reason"; `git2` was ceilinged ABOVE the only version
    /// its rules record reading (the SILENT direction, and 0.21 added `author_from_env` /
    /// `committer_from_env` / `Oid::hash_file_ext`, none of them ruled); and `sqlx_core` sat BELOW the
    /// version its own comment says was verified, which is also an impossible sibling of `sqlx 0.9.0`'s
    /// `=0.9.0` pin. All three were invisible to 410 tests and 29 gates.
    ///
    /// This asserts the one invariant that catches all of them: **a crate whose rules cite a reviewed
    /// version must carry a ceiling, and it must be THAT version.** Citations are read with wrapped
    /// comment lines joined and both name spellings tried — R315, where a line-by-line dashed-only
    /// sweep silently under-counted the citations by three.
    #[test]
    fn calibration_ceilings_match_the_recorded_review() {
        let src = include_str!("lib.rs");
        // join wrapped comment continuations, then collapse whitespace: a citation is prose and prose wraps.
        let flat = src
            .replace("\n    //", " ")
            .replace("\n        //", " ")
            .replace("\n            //", " ");
        let flat: String = flat.split_whitespace().collect::<Vec<_>>().join(" ");
        let ceilings: std::collections::HashMap<&str, &str> =
            CALIBRATED_CEILINGS.iter().copied().collect();
        // Absences are deliberate and enumerated in the table's own comment; keep the list HERE too so
        // dropping one silently is impossible — that is exactly what happened.
        let deliberate = ["postgres", "async_fs", "getrandom", "rand_core"];
        let mut problems: Vec<String> = Vec::new();
        for c in CALIBRATED_CRATES {
            if deliberate.contains(&c) {
                continue;
            }
            // EVERY citation, both verbs, both name spellings, and slash-separated lists —
            // "verified against sqlx-core 0.8.6/0.9.0" records TWO reviewed versions, and a crate may
            // be cited in more than one comment ("validated against rusqlite 0.39" elsewhere). An
            // extractor that stops at the first hit under-collects, and under-collecting here makes a
            // correct ceiling look like it is above the record — R315's lesson, one level up.
            let mut cited: Vec<String> = Vec::new();
            for form in [c.to_string(), c.replace('_', "-")] {
                for verb in ["verified against ", "validated against "] {
                    let pat = format!("{verb}{form} ");
                    let mut from = 0usize;
                    while let Some(i) = flat[from..].find(&pat) {
                        let at = from + i + pat.len();
                        let tail: String = flat[at..]
                            .chars()
                            .take_while(|ch| ch.is_ascii_digit() || *ch == '.' || *ch == '/')
                            .collect();
                        for v in tail.split('/') {
                            let v = v.trim_end_matches('.').to_string();
                            if v.split('.').count() >= 2 && !cited.contains(&v) {
                                cited.push(v);
                            }
                        }
                        from = at;
                    }
                }
            }
            if cited.is_empty() {
                continue;
            }
            match ceilings.get(c) {
                None => problems.push(format!(
                    "{c}: rules cite {} but there is NO ceiling — the exemption is unconditional",
                    cited.join("/")
                )),
                // A comment may legitimately record MORE THAN ONE reviewed version
                // ("verified against sqlx-core 0.8.6/0.9.0"), so matching any of them is fine, and a
                // ceiling BELOW the newest review is merely noisy. The failure that matters is a
                // ceiling ABOVE EVERY recorded review: that grants reviewed-purity over source nobody
                // read, which is the SILENT direction and the whole reason this table exists.
                Some(have) => {
                    let ok = cited.iter().any(|v| have.starts_with(v) || v.starts_with(*have))
                        || cited.iter().any(|v| calibration_exceeded_raw(v, have));
                    if !ok {
                        problems.push(format!(
                            "{c}: ceiling {have} is ABOVE every recorded review ({}) — it grants \
                             reviewed-purity over source no comment records anyone reading",
                            cited.join("/")
                        ));
                    }
                }
            }
        }
        assert!(
            problems.is_empty(),
            "CALIBRATED_CEILINGS disagrees with the review record:\n  {}\n\n\
             A ceiling ABOVE the recorded review grants reviewed-purity over source nobody read (SILENT); \
             a ceiling BELOW it is noisy but safe. Either way the table and the record must agree, or \
             neither is evidence.",
            problems.join("\n  ")
        );
    }

    #[test]
    fn calibrated_crates_are_live() {
        // Conversely, every crate advertised as calibrated must actually be matched by classify() for
        // some representative path — a dead entry would silently suppress a real coverage warning.
        for c in CALIBRATED_CRATES {
            assert!(
                CALIBRATION_PROBE_TAILS.iter().any(|t| classify(c, &format!("{c}{t}")).is_some()),
                "calibrated crate `{c}` is matched by no path in classify() — dead list entry"
            );
        }
    }

    #[test]
    fn async_http_stack_classifies() {
        // The modern async-HTTP/TLS/QUIC/DNS stack (found by the independent-method differential on oha):
        // verb-keyed Net/Ipc/Fs/Env, crate-gated so generic verbs never fabricate across crates.
        assert_eq!(classify("hyper", "hyper::client::conn::http1::SendRequest::send_request"), Some("Net"));
        assert_eq!(classify("hyper", "hyper::client::conn::http1::handshake"), Some("Net"));
        assert_eq!(classify("hyper_util", "hyper_util::client::legacy::Client::request"), Some("Net"));
        assert_eq!(classify("hickory_resolver", "hickory_resolver::Resolver::lookup_ip"), Some("Net"));
        assert_eq!(classify("quinn", "quinn::Endpoint::connect"), Some("Net"));
        assert_eq!(classify("quinn", "quinn::RecvStream::read_to_end"), Some("Net")); // stream byte I/O, not just open
        assert_eq!(classify("quinn", "quinn::SendStream::write_all"), Some("Net"));
        assert_eq!(classify("tokio_rustls", "tokio_rustls::TlsConnector::connect"), Some("Net"));
        assert_eq!(classify("native_tls", "native_tls::TlsConnector::connect"), Some("Net"));
        assert_eq!(classify("tokio_vsock", "tokio_vsock::VsockStream::connect"), Some("Ipc"));
        assert_eq!(classify("rustls_native_certs", "rustls_native_certs::load_native_certs"), Some("Fs"));
        assert_eq!(classify("rlimit", "rlimit::setrlimit"), Some("Env"));
        // num_cpus is deliberately PURE (consistency with std::thread::available_parallelism; avoids Env spray)
        assert_eq!(classify("num_cpus", "num_cpus::get"), None);
        assert_eq!(classify("num_cpus", "num_cpus::get_physical"), None);
        // pure surface stays None (no fabrication): builder/type/config paths, and other crates' generic verbs
        assert_eq!(classify("hyper", "hyper::Request::builder"), None);
        assert_eq!(classify("hyper", "hyper::body::Bytes::new"), None);
        assert_eq!(classify("native_tls", "native_tls::TlsConnectorBuilder::min_protocol_version"), None);
        assert_eq!(classify("serde", "serde::Deserialize::request"), None); // generic verb, wrong crate
    }

    #[test]
    fn coverage_differential_crates_classify() {
        // Crates the coverage differential found DISCLOSED-but-unmodeled. Each rule is verb-keyed +
        // crate-gated; the EFFECT verbs map to the right bucket and the PURE surface stays None (a
        // wrongly-flagged pure crate is a fabrication, so the negatives matter as much as the positives).

        // rustls (sync TLS core) — record I/O is Net; config/cert + the buffered-decrypt step are pure.
        assert_eq!(classify("rustls", "rustls::ClientConnection::read_tls"), Some("Net"));
        assert_eq!(classify("rustls", "rustls::ConnectionCommon::write_tls"), Some("Net"));
        assert_eq!(classify("rustls", "rustls::Connection::complete_io"), Some("Net"));
        assert_eq!(classify("rustls", "rustls::ConnectionCommon::process_new_packets"), None); // buffered decrypt, no I/O
        assert_eq!(classify("rustls", "rustls::ClientConfig::builder"), None); // pure config

        // native-tls variants — handshake is Net; builder is pure.
        assert_eq!(classify("native_tls_crate", "native_tls_crate::TlsConnector::connect"), Some("Net"));
        assert_eq!(classify("tokio_native_tls", "tokio_native_tls::TlsAcceptor::accept"), Some("Net"));
        assert_eq!(classify("native_tls_crate", "native_tls_crate::TlsConnectorBuilder::min_protocol_version"), None);

        // etcetera — dir resolution reads env; the args data type is pure.
        assert_eq!(classify("etcetera", "etcetera::home_dir"), Some("Env"));
        assert_eq!(classify("etcetera", "etcetera::base_strategy::choose_base_strategy"), Some("Env"));
        assert_eq!(classify("etcetera", "etcetera::base_strategy::Xdg::config_dir"), Some("Env"));
        assert_eq!(classify("etcetera", "etcetera::app_strategy::AppStrategyArgs::new"), None); // pure data

        // sqlx-core — connect is Net, execute/fetch round-trips are Db; options/builders pure.
        assert_eq!(classify("sqlx_core", "sqlx_core::connection::Connection::connect"), Some("Net"));
        assert_eq!(classify("sqlx_core", "sqlx_core::executor::Executor::fetch_one"), Some("Db"));
        assert_eq!(classify("sqlx_core", "sqlx_core::executor::Executor::execute"), Some("Db"));
        assert_eq!(classify("sqlx_core", "sqlx_core::pool::Pool::acquire"), Some("Db"));
        assert_eq!(classify("sqlx_core", "sqlx_core::pool::PoolOptions::max_connections"), None); // pure builder

        // walkdir — charged at construction (`WalkDir::new`, mirroring `ignore`/`glob`), NOT solely at
        // the lazy `next()`/`metadata()` read: candor-scan's receiver-typing blocklist hard-blocks
        // `.into_iter()`, so a typed `IntoIter::next` receiver is unreachable from the idiomatic
        // `WalkDir::new(p).into_iter()...` chain — `WalkDir::new` is the only point every real usage
        // (for-loop, `.count()`, untyped `.next()`) actually reaches. `IntoIter::next`/`DirEntry::metadata`
        // stay Some("Fs") as a secondary rule for the narrower explicit-type-annotation case. Builder
        // setters (`into_iter` itself, `max_depth`, …) and cached accessors stay pure.
        assert_eq!(classify("walkdir", "walkdir::WalkDir::new"), Some("Fs"));
        assert_eq!(classify("walkdir", "walkdir::IntoIter::next"), Some("Fs"));
        assert_eq!(classify("walkdir", "walkdir::DirEntry::metadata"), Some("Fs"));
        assert_eq!(classify("walkdir", "walkdir::WalkDir::into_iter"), None); // no I/O until pulled
        assert_eq!(classify("walkdir", "walkdir::WalkDir::max_depth"), None); // builder setter
        assert_eq!(classify("walkdir", "walkdir::DirEntry::file_type"), None); // cached, no syscall

        // filetime — set_* are utimes (Fs), now is Clock; from_* constructors pure.
        assert_eq!(classify("filetime", "filetime::set_file_mtime"), Some("Fs"));
        assert_eq!(classify("filetime", "filetime::set_file_handle_times"), Some("Fs"));
        assert_eq!(classify("filetime", "filetime::FileTime::now"), Some("Clock"));
        assert_eq!(classify("filetime", "filetime::FileTime::from_unix_time"), None);
        assert_eq!(classify("filetime", "filetime::FileTime::from_last_modification_time"), None); // reads &Metadata, not disk

        // execute — the execute* verbs spawn (Exec); command/shell builders pure.
        assert_eq!(classify("execute", "execute::Execute::execute"), Some("Exec"));
        assert_eq!(classify("execute", "execute::Execute::execute_output"), Some("Exec"));
        assert_eq!(classify("execute", "execute::Execute::execute_multiple_output"), Some("Exec"));
        assert_eq!(classify("execute", "execute::command"), None); // only builds a Command
        assert_eq!(classify("execute", "execute::shell"), None);

        // ctrlc — install signal handler (Ipc).
        assert_eq!(classify("ctrlc", "ctrlc::set_handler"), Some("Ipc"));
        assert_eq!(classify("ctrlc", "ctrlc::try_set_handler"), Some("Ipc"));

        // clap — only the argv-reading terminals are Env; the whole builder + *_from variants pure.
        assert_eq!(classify("clap", "clap::Command::get_matches"), Some("Env"));
        assert_eq!(classify("clap", "clap::Command::try_get_matches"), Some("Env"));
        assert_eq!(classify("clap", "clap::Parser::parse"), Some("Env"));
        assert_eq!(classify("clap", "clap::Command::new"), None); // builder
        assert_eq!(classify("clap", "clap::Arg::about"), None); // builder
        assert_eq!(classify("clap", "clap::Command::get_matches_from"), None); // explicit args, no argv read
        // R59-class audit: `Arg::env` calls `env::var_os` DIRECTLY at builder time (verified against
        // clap_builder 4.6.6) — unambiguous (the crate's only `::env` method), so classify it rather
        // than leave a real effect to fall silently into the CALIBRATED_CRATES purity exemption.
        assert_eq!(classify("clap", "clap::Arg::env"), Some("Env"));
        assert_eq!(classify("clap", "clap::Arg::env_os"), Some("Env"));

        // jiff — now* is Clock; tz lookups read the tzdb (Fs); span/civil math pure.
        assert_eq!(classify("jiff", "jiff::Timestamp::now"), Some("Clock"));
        assert_eq!(classify("jiff", "jiff::Zoned::now_with"), Some("Clock"));
        assert_eq!(classify("jiff", "jiff::tz::TimeZone::system"), Some("Fs"));
        assert_eq!(classify("jiff", "jiff::tz::TimeZone::get"), Some("Fs"));
        assert_eq!(classify("jiff", "jiff::Span::checked_add"), None); // pure arithmetic

        // env_logger — init installs the logger + reads RUST_LOG (Log); config setters pure.
        // TUI — the tty is a user dialogue channel (Ipc), the ruling dialoguer/console already carry.
        // Each verb below was read off the crate source (crossterm-0.28.1, ratatui-0.29.0), not guessed.
        assert_eq!(classify("crossterm", "crossterm::ExecutableCommand::execute"), Some("Ipc"));
        assert_eq!(classify("crossterm", "crossterm::QueueableCommand::queue"), Some("Ipc"));
        assert_eq!(classify("crossterm", "crossterm::event::read"), Some("Ipc"));
        assert_eq!(classify("crossterm", "crossterm::event::poll"), Some("Ipc"));
        assert_eq!(classify("crossterm", "crossterm::terminal::enable_raw_mode"), Some("Ipc"));
        // a tty IOCTL must not fall through: in a CALIBRATED crate an unmatched path is a purity CLAIM
        assert_eq!(classify("crossterm", "crossterm::terminal::size"), Some("Ipc"));
        // the Command VALUE types are pure — they describe an action, they do not perform one
        assert_eq!(classify("crossterm", "crossterm::style::Print"), None);
        assert_eq!(classify("crossterm", "crossterm::cursor::MoveTo"), None);

        // ratatui: the backlog said "mark reviewed-pure"; the SOURCE says `Terminal::draw` ends in a
        // backend flush, so the write surface is Ipc and only the render surface is pure.
        assert_eq!(classify("ratatui", "ratatui::Terminal::draw"), Some("Ipc"));
        assert_eq!(classify("ratatui", "ratatui::Terminal::flush"), Some("Ipc"));
        assert_eq!(classify("ratatui", "ratatui::Terminal::clear"), Some("Ipc"));
        assert_eq!(classify("ratatui", "ratatui::Terminal::hide_cursor"), Some("Ipc"));
        // REGRESSION: `widgets::canvas` is an in-memory grid. `Context::draw` ends in `::draw` and was
        // FABRICATING Ipc — caught in review, measured on a fixture, and a hot path (per shape, per frame).
        assert_eq!(classify("ratatui", "ratatui::widgets::canvas::Context::draw"), None);
        assert_eq!(classify("ratatui", "ratatui::widgets::canvas::Context::layer"), None);
        // …while the real write surface still classifies, including a DIRECT backend call (which is why
        // the carve-out is a denylist on canvas rather than an allowlist on `Terminal::`).
        assert_eq!(classify("ratatui", "ratatui::backend::CrosstermBackend::flush"), Some("Ipc"));
        // the BULK of the 3,345 disclosed calls — widgets, layout, style — are genuinely pure
        assert_eq!(classify("ratatui", "ratatui::widgets::Paragraph::new"), None);
        assert_eq!(classify("ratatui", "ratatui::layout::Layout::split"), None);
        assert_eq!(classify("ratatui", "ratatui::style::Style::fg"), None);
        assert_eq!(classify("ratatui", "ratatui::buffer::Buffer::set_string"), None);

        // tracing_subscriber — two effects, both read off 0.3.23. The filing said "Log/Fs"; the Fs half
        // is wrong (the crate ACCEPTS a File as a writer, it never opens one).
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::init"), Some("Log"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::try_init"), Some("Log"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::SubscriberBuilder::init"), Some("Log"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::EnvFilter::from_default_env"), Some("Env"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::EnvFilter::from_env"), Some("Env"));
        // the setters DESCRIBE a subscriber; they do not install one. (`fmt::layer`/`fmt::fmt` are NOT setters:
        // they construct through `Layer::default`, which reads NO_COLOR — R1528, `r1528_clock_env_rows_classify`.)
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::layer"), Some("Env"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::SubscriberBuilder::with_target"), None);
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::EnvFilter::new"), None);

        assert_eq!(classify("env_logger", "env_logger::init"), Some("Log"));
        assert_eq!(classify("env_logger", "env_logger::try_init"), Some("Log"));
        assert_eq!(classify("env_logger", "env_logger::Builder::init"), Some("Log"));
        assert_eq!(classify("env_logger", "env_logger::Builder::format_timestamp"), None); // config
        assert_eq!(classify("env_logger", "env_logger::Builder::build"), None); // pure build

        // dialoguer — interact* is tty I/O (Ipc); builders pure.
        assert_eq!(classify("dialoguer", "dialoguer::Input::interact_text"), Some("Ipc"));
        assert_eq!(classify("dialoguer", "dialoguer::Confirm::interact"), Some("Ipc"));
        assert_eq!(classify("dialoguer", "dialoguer::Select::interact_opt"), Some("Ipc"));
        assert_eq!(classify("dialoguer", "dialoguer::Input::with_prompt"), None); // builder
        // widened-CORE audit: `Editor::new`/`::default` read VISUAL/EDITOR at construction, independent
        // of `Editor::edit`'s already-covered Exec (spawning that editor is a separate, later step).
        assert_eq!(classify("dialoguer", "dialoguer::Editor::new"), Some("Env"));
        assert_eq!(classify("dialoguer", "dialoguer::Editor::default"), Some("Env"));
        assert_eq!(classify("dialoguer", "dialoguer::Editor::edit"), Some("Exec"));
        assert_eq!(classify("dialoguer", "dialoguer::Editor::extension"), None); // pure setter

        // console — Term I/O is Ipc, detection is Env, Style is pure.
        assert_eq!(classify("console", "console::Term::write_line"), Some("Ipc"));
        assert_eq!(classify("console", "console::Term::read_key"), Some("Ipc"));
        assert_eq!(classify("console", "console::colors_enabled"), Some("Env"));
        assert_eq!(classify("console", "console::Style::cyan"), None); // pure styling
        assert_eq!(classify("console", "console::strip_ansi_codes"), None); // pure text util
        // R59-class audit: `Term` also implements raw `io::{Read,Write}` (console 0.15.11) — the same
        // tty channel as `write_line`/`read_key`, reached through the generic trait methods instead of
        // the crate's own named convenience methods. Crate-gated and `Term::`-scoped, so it cannot spread.
        assert_eq!(classify("console", "console::Term::write"), Some("Ipc"));
        assert_eq!(classify("console", "console::Term::flush"), Some("Ipc"));
        assert_eq!(classify("console", "console::Term::read"), Some("Ipc"));

        // terminal_colorsaurus — tty colour query (Ipc).
        assert_eq!(classify("terminal_colorsaurus", "terminal_colorsaurus::background_color"), Some("Ipc"));
        assert_eq!(classify("terminal_colorsaurus", "terminal_colorsaurus::color_palette"), Some("Ipc"));

        // backoff — retry sleeps + reads the clock (Clock); the setters are pure, but the CONSTRUCTORS are not: `default()` and
        // `ExponentialBackoffBuilder::build` stamp `start_time: Instant::now()` (EXECUTED 2 / 1 clock reads, R1528 b11).
        assert_eq!(classify("backoff", "backoff::retry"), Some("Clock"));
        assert_eq!(classify("backoff", "backoff::retry_notify"), Some("Clock"));
        assert_eq!(classify("backoff", "backoff::ExponentialBackoff::default"), Some("Clock"));

        // lscolors — ONLY from_env reads the environment; from_string/style_for_path pure.
        assert_eq!(classify("lscolors", "lscolors::LsColors::from_env"), Some("Env"));
        assert_eq!(classify("lscolors", "lscolors::LsColors::from_string"), None);
        assert_eq!(classify("lscolors", "lscolors::LsColors::style_for_path"), None);

        // wild — argv readers (Env).
        assert_eq!(classify("wild", "wild::args"), Some("Env"));
        assert_eq!(classify("wild", "wild::args_os"), Some("Env"));

        // grep_cli — only the firm Exec (CommandReader spawn); the isatty probes stay unmodeled.
        assert_eq!(classify("grep_cli", "grep_cli::CommandReaderBuilder::build"), Some("Exec"));
        assert_eq!(classify("grep_cli", "grep_cli::is_readable_stdin"), None); // isatty/fstat, not modeled
        assert_eq!(classify("grep_cli", "grep_cli::is_tty_stdout"), None);

        // clircle — same-file detection issues fstat/lseek (Fs); equality is pure.
        assert_eq!(classify("clircle", "clircle::Identifier::try_from"), Some("Fs"));
        assert_eq!(classify("clircle", "clircle::Clircle::surely_conflicts_with"), Some("Fs"));
    }

    #[test]
    fn log_tracing_emit_macros_classify_pre_expansion() {
        // candor-scan is pre-expansion: it sees the raw macro path (`log::info`, `tracing::warn`), not the
        // expanded dispatch the deep engine sees. Both the user-facing macro names AND the type surface:
        assert_eq!(classify("log", "log::info"), Some("Log"));
        assert_eq!(classify("log", "log::error"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::warn"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::info_span"), Some("Log"));
        // pure data-type surface stays None (no fabricated Log)
        assert_eq!(classify("log", "log::Level::as_str"), None);
        assert_eq!(classify("tracing", "tracing::Level::INFO"), None);
    }

    #[test]
    fn classify_core_effects() {
        // A representative smoke test of the classifier's main families, so the published crate is not
        // shipped untested (these used to live only in the nightly-only src/lib.rs).
        assert_eq!(classify("std", "std::fs::read_to_string"), Some("Fs"));
        // std::path stat-family methods are Fs (each is a stat/readdir syscall); the pure
        // string-manipulation surface stays unclassified (the blackout screen's gix-dir find).
        assert_eq!(classify("std", "std::path::Path::symlink_metadata"), Some("Fs"));
        assert_eq!(classify("std", "std::path::PathBuf::read_dir"), Some("Fs"));
        assert_eq!(classify("std", "std::path::Path::exists"), Some("Fs"));
        assert_eq!(classify("std", "std::path::Path::join"), None); // pure string manipulation
        assert_eq!(classify("std", "std::path::PathBuf::file_name"), None);
        assert_eq!(classify("std", "std::path::Path::parent"), None);
        assert_eq!(classify("std", "std::process::Command::new"), Some("Exec"));
        assert_eq!(classify("std", "std::env::var"), Some("Env"));
        assert_eq!(classify("reqwest", "reqwest::Client::execute"), Some("Net"));
        // one-shot convenience fns send immediately → Net.
        assert_eq!(classify("reqwest", "reqwest::get"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::blocking::get"), Some("Net"));
        // the URL-BEARING builder methods classify Net too — the DOMINANT idiom is the builder chain
        // `Client::new().post(url).send()`, whose URL literal rides the `.post(url)` step (NOT `.send()`),
        // so the endpoint (and the Llm host refinement) only get captured if the URL-naming step is Net.
        assert_eq!(classify("reqwest", "reqwest::Client::get"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::Client::post"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::Client::put"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::Client::delete"), Some("Net"));
        assert_eq!(classify("reqwest", "reqwest::Client::request"), Some("Net"));
        // the PURE builder surface stays None (no URL, no dispatch).
        assert_eq!(classify("reqwest", "reqwest::RequestBuilder::header"), None);
        assert_eq!(classify("reqwest", "reqwest::RequestBuilder::json"), None);
        // R1528 (b10): `build` dispatches nothing (still not `Net`), but it reads the proxy variables on every call (EXECUTED:
        // `ALL_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY` and lowercase), so it is `Env`, not "pure".
        assert_eq!(classify("reqwest", "reqwest::ClientBuilder::build"), Some("Env"));
        // RAW POSIX SOCKETS — the lowest network tier, pinned as a regression guard (four-way close:
        // swift got a raw-socket regression this week from a bare-identifier collision; rust never had
        // the gap because it classifies path-QUALIFIED via the syscall-leaf table, but pin it so the
        // `socket`/`connect` Net rows can't silently drop). `libc::connect`/`libc::socket` are the direct
        // FFI syscalls; `nix::sys::socket::connect` is the safe wrapper; both bottom out in the NET table.
        assert_eq!(classify("libc", "libc::connect"), Some("Net"));
        assert_eq!(classify("libc", "libc::socket"), Some("Net"));
        assert_eq!(classify("libc", "libc::bind"), Some("Net"));
        assert_eq!(classify("libc", "libc::accept"), Some("Net"));
        // nix routes through the libc syscall table (same leaves): I/O classified, generic fd ops skipped.
        assert_eq!(classify("nix", "nix::fcntl::open"), Some("Fs"));
        assert_eq!(classify("nix", "nix::sys::socket::connect"), Some("Net"));
        assert_eq!(classify("nix", "nix::sys::socket::socket"), Some("Net"));
        assert_eq!(classify("nix", "nix::unistd::execvp"), Some("Exec"));
        assert_eq!(classify("nix", "nix::unistd::write"), None); // generic fd op — deliberately unclassified
        assert_eq!(classify("nix", "nix::unistd::getpid"), None); // not I/O
        // rustix does raw syscalls (no libc underneath) → classified directly by leaf, same table.
        assert_eq!(classify("rustix", "rustix::time::clock_settime"), Some("Clock"));
        assert_eq!(classify("rustix", "rustix::fs::symlink"), Some("Fs"));
        assert_eq!(classify("rustix", "rustix::net::connect"), Some("Net"));
        assert_eq!(classify("rustix", "rustix::io::read"), None); // generic fd op
        // pnet raw packet capture: channel openers are Net, packet construction stays pure.
        assert_eq!(classify("pnet", "pnet::datalink::channel"), Some("Net"));
        assert_eq!(classify("pnet", "pnet::transport::transport_channel"), Some("Net"));
        assert_eq!(classify("pnet_datalink", "pnet_datalink::channel"), Some("Net"));
        assert_eq!(classify("pnet", "pnet::packet::ethernet::EthernetPacket::new"), None);
        assert_eq!(classify("pnet_base", "pnet_base::MacAddr::new"), None);
        // ignore (gitignore-aware walker): walk executors are Fs, config builders stay pure.
        assert_eq!(classify("ignore", "ignore::WalkBuilder::build_parallel"), Some("Fs"));
        assert_eq!(classify("ignore", "ignore::WalkBuilder::build"), Some("Fs"));
        assert_eq!(classify("ignore", "ignore::WalkParallel::run"), Some("Fs"));
        assert_eq!(classify("ignore", "ignore::WalkBuilder::add_ignore"), Some("Fs")); // reads the ignore file
        assert_eq!(classify("ignore", "ignore::overrides::OverrideBuilder::build"), None); // pure config
        assert_eq!(classify("ignore", "ignore::gitignore::GitignoreBuilder::build"), None); // pure config
        assert_eq!(classify("ignore", "ignore::DirEntry::path"), None); // pure accessor
        // THE FIX: `Walk::new`/`Walk::from_iter` are `WalkBuilder::new(path).build()` /
        // `WalkBuilder::from_iter(paths).build()` in ignore's own source — the crate's documented
        // convenience constructors, and its own top-level doc example (`for entry in Walk::new(path)`).
        // A corpus round caught `deny Fs` exiting 0 over exactly that idiom.
        assert_eq!(classify("ignore", "ignore::Walk::new"), Some("Fs"));
        assert_eq!(classify("ignore", "ignore::Walk::from_iter"), Some("Fs"));
        // NO FABRICATION: a same-named `Walk::new` from an unrelated crate must not gain Fs — crate-gated.
        assert_eq!(classify("walkdir", "walkdir::Walk::new"), None);
        assert_eq!(classify("some_local_crate", "some_local_crate::Walk::new"), None);
        // notify fs-watching: watcher constructors + watch/unwatch are Fs, data types stay pure.
        assert_eq!(classify("notify", "notify::RecommendedWatcher::new"), Some("Fs"));
        assert_eq!(classify("notify", "notify::PollWatcher::new"), Some("Fs"));
        assert_eq!(classify("notify", "notify::recommended_watcher"), Some("Fs"));
        assert_eq!(classify("notify", "notify::INotifyWatcher::watch"), Some("Fs"));
        assert_eq!(classify("notify", "notify::Config::default"), None); // pure config
        assert_eq!(classify("notify", "notify::Event::new"), None); // pure data type
        assert_eq!(classify("rusqlite", "rusqlite::Connection::execute"), Some("Db"));
        // the rusqlite verb DIALECT (a verb probe found the canonical consumer API classifying pure):
        assert_eq!(classify("rusqlite", "rusqlite::Connection::query_row"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Statement::query_map"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::execute_batch"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::prepare_cached"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::open"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::open_in_memory"), Some("Db"));
        // THE FIX: three more real `Connection::open*` constructors an exact-suffix list missed
        // (`open_in_memory_with_flags` doesn't END in `open_with_flags`), plus the documented blob-I/O
        // API (`blob_open`/`Blob::reopen`), each calling the real sqlite3 FFI directly.
        assert_eq!(classify("rusqlite", "rusqlite::Connection::open_in_memory_with_flags"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::open_with_flags_and_vfs"), Some("Db"));
        assert_eq!(
            classify("rusqlite", "rusqlite::Connection::open_in_memory_with_flags_and_vfs"),
            Some("Db")
        );
        assert_eq!(classify("rusqlite", "rusqlite::Connection::blob_open"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::blob::Blob::reopen"), Some("Db"));
        // NO FABRICATION: a same-crate, DIFFERENT type's `open`-prefixed method (rusqlite's own private
        // `pragma::Sql::open_brace`, which pushes one char to a string buffer) must not gain Db — the
        // fix keys on the `Connection::` segment, not a bare leaf prefix.
        assert_eq!(classify("rusqlite", "rusqlite::pragma::Sql::open_brace"), None);
        // THE COVERAGE-GATE SWEEP FIX: the online-backup API and incremental-BLOB positional I/O,
        // verified against rusqlite 0.32.1 (each calls an `ffi::sqlite3_*` leaf already in this file's
        // own FFI-leaf DB table, but the `crate_name == "rusqlite"` block above returned before ever
        // reaching it — same shape as the git2 fix elsewhere in this file).
        assert_eq!(classify("rusqlite", "rusqlite::Backup::new"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Backup::new_with_names"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Backup::step"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Backup::run_to_completion"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::backup"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::restore"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::read_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::read_at_exact"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::raw_read_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::raw_read_at_exact"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::write_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Blob::write_all_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::from_handle"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::from_handle_owned"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::Connection::extension_init2"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::init_auto_extension"), Some("Db"));
        // …and the REAL module-qualified spellings (`Backup`/`Blob`/`init_auto_extension` are not
        // re-exported at rusqlite's crate root, unlike `Connection` — a real consumer's source, proven
        // against a compiling fixture, must use these, not the short forms above).
        assert_eq!(classify("rusqlite", "rusqlite::backup::Backup::new"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::blob::Blob::read_at"), Some("Db"));
        assert_eq!(classify("rusqlite", "rusqlite::auto_extension::init_auto_extension"), Some("Db"));
        // NO FABRICATION: `InnerConnection`/`RawStatement` live in PRIVATE modules (lib.rs `mod
        // inner_connection;`/`mod raw_statement;`, no `pub`) — no external consumer can ever name either
        // type, so no rule was added despite self-scan flagging them too.
        assert_eq!(classify("rusqlite", "rusqlite::InnerConnection::close"), None);
        assert_eq!(classify("rusqlite", "rusqlite::RawStatement::step"), None);
        // …but `open` stays rusqlite-only (postgres has no open; nothing else may borrow it):
        assert_eq!(classify("postgres", "postgres::Client::open"), None);
        assert_eq!(classify("tokio_postgres", "tokio_postgres::Client::query_typed"), Some("Db"));
        // THE FIX: `Config::connect_raw` does the same protocol handshake as `Config::connect`, over a
        // caller-supplied stream instead of one it dials itself.
        assert_eq!(classify("tokio_postgres", "tokio_postgres::Config::connect_raw"), Some("Db"));
        // diesel's LIMIT-1 + streaming executions; sqlx's multi-result stream:
        assert_eq!(classify("diesel", "diesel::RunQueryDsl::first"), Some("Db"));
        assert_eq!(classify("diesel", "diesel::RunQueryDsl::load_iter"), Some("Db"));
        // THE FIX: `Connection::establish` is diesel's own name for `::connect` — the crate's canonical,
        // most-used connection entry point (`SqliteConnection::establish(url)` in every diesel
        // quickstart), implemented by really opening the backend handle — but shared no verb spelling
        // with `::connect`, so it read pure with zero `coverage.uncovered` disclosure (diesel is
        // calibrated, so the miss reads as reviewed-pure, not as a gap).
        assert_eq!(classify("diesel", "diesel::sqlite::SqliteConnection::establish"), Some("Db"));
        assert_eq!(classify("diesel", "diesel::pg::PgConnection::establish"), Some("Db"));
        assert_eq!(classify("diesel", "diesel::mysql::MysqlConnection::establish"), Some("Db"));
        assert_eq!(classify("diesel", "diesel::Connection::establish"), Some("Db"));
        // NO FABRICATION: diesel's own private plumbing shares the substring but not the exact verb.
        assert_eq!(classify("diesel", "diesel::sqlite::SqliteConnection::establish_inner"), None);
        assert_eq!(classify("sqlx", "sqlx::query::Query::fetch_many"), Some("Db"));
        // sqlx's bare `query()` builder must STAY pure (the original sqlx lesson):
        assert_eq!(classify("sqlx", "sqlx::query"), None);
        // tracing: the emit/span-lifecycle dispatch is Log; the pure DATA-type accessors are not
        // (whole-crate Log fabricated Log on `Level::as_str` / `Span::is_disabled` — the data types are
        // pure, same principle as the `log` facade).
        assert_eq!(classify("tracing", "tracing::event"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::Span::new_span"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::Span::record"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::Span::enter"), Some("Log"));
        assert_eq!(classify("tracing", "tracing::Level::as_str"), None); // pure accessor
        assert_eq!(classify("tracing", "tracing::Span::is_disabled"), None); // pure state read
        assert_eq!(classify("tracing", "tracing::Span::metadata"), None); // pure accessor
        assert_eq!(classify("tracing", "tracing::metadata::Level::TRACE"), None); // pure data type
        assert_eq!(classify("tracing", "tracing::field::Field::name"), None); // pure data type
        // git2 (high-level Rust API, not the `raw::git_*` FFI tier tested above): remote verbs are Net.
        assert_eq!(classify("git2", "git2::Remote::fetch"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::push"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::download"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::connect"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::connect_auth"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::ls"), Some("Net"));
        assert_eq!(classify("git2", "git2::Remote::upload"), Some("Net"));
        // THE COVERAGE-GATE SWEEP FIX: `Repository::open`/`init` (and every other local .git-directory
        // operation below) used to read PURE here — the comment this replaced called that "honest, no
        // network", but candor-scan self-scanning git2's OWN source (eval/coverage-gate) proved these
        // reach a REAL Fs effect (`raw::git_repository_open`/`_init_ext`, already in this file's FFI-tier
        // table) that a real consumer's call to the safe wrapper could never surface, because THIS
        // block's early `return None` sat in front of that table for every `crate_name == "git2"` call.
        // "local, no network" was true and beside the point: Fs was the effect being missed. See MEMORY /
        // the commit that added this block for the full sweep (Config/Index/Odb/PackBuilder/Reference/
        // Repository/TreeBuilder — every FQN below calls a listed FS FFI leaf; verified against git2
        // 0.20.4 source).
        assert_eq!(classify("git2", "git2::Repository::open"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::init"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::open_bare"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::open_ext"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::open_from_env"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::discover"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::discover_path"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::init_bare"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::init_opts"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::blob_path"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::checkout_head"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::checkout_index"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::checkout_tree"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::commit"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::reference"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Repository::tag"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Config::add_file"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Config::open"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Config::open_default"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::add_all"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::add_path"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::read"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::write"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::write_tree"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Index::write_tree_to"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Odb::read"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Odb::reader"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Odb::write"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Odb::writer"), Some("Fs"));
        assert_eq!(classify("git2", "git2::PackBuilder::write"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Reference::delete"), Some("Fs"));
        assert_eq!(classify("git2", "git2::Reference::set_target"), Some("Fs"));
        assert_eq!(classify("git2", "git2::TreeBuilder::write"), Some("Fs"));
        // `Remote::list`/`RemoteConnection::list` call `raw::git_remote_ls` directly — the same
        // reference-advertisement Net effect `Remote::ls` was meant to catch, under the name git2 0.20
        // actually uses (there is no `ls` method left in the crate at all — that suffix rule is dead
        // weight, kept rather than removed since deleting it is a separate, unrelated cleanup).
        assert_eq!(classify("git2", "git2::Remote::list"), Some("Net"));
        assert_eq!(classify("git2", "git2::RemoteConnection::list"), Some("Net"));
        // `Cred::credential_helper` spawns a real `sh -c "<helper> get"` subprocess to resolve
        // `credential.helper` config (cred.rs:370-390) — a real consumer's most common way to honor it.
        assert_eq!(classify("git2", "git2::Cred::credential_helper"), Some("Exec"));
        assert_eq!(classify("git2", "git2::CredentialHelper::execute"), Some("Exec"));
        // NO FABRICATION controls: a `write`/`read`/`open` on some OTHER git2 type (not FQN-listed above)
        // must stay pure — this fix is FQN-exact, not a suffix re-widen.
        assert_eq!(classify("git2", "git2::Repository::state"), None);
        assert_eq!(classify("git2", "git2::Blob::content"), None);
        // tonic's SERVER half (the coverage-gate sweep found only the client verbs were covered):
        // `Router::serve`/`::serve_with_shutdown` bind a real listening socket via `TcpIncoming::new`
        // (`StdTcpListener::bind`), verified against tonic 0.12.3 source.
        assert_eq!(classify("tonic", "tonic::transport::server::Router::serve"), Some("Net"));
        assert_eq!(
            classify("tonic", "tonic::transport::server::Router::serve_with_shutdown"),
            Some("Net")
        );
        assert_eq!(classify("tonic", "tonic::TcpIncoming::new"), Some("Net"));
        // THIS CONTROL WAS STALE, SOUNDNESS R1528 (R1594's lane). It asserted `None` on the premise that `Server<L>::
        // serve_with_shutdown` (mod.rs:530 at 0.12.x) is a DIFFERENT, `pub(crate)` method that no consumer can reach, so a rule
        // there would fabricate. Two things made that wrong: tonic 0.14.6 made `Server::{serve, serve_with_shutdown}` PUBLIC
        // (mod.rs:663,678; EXECUTED: both bind and listen), and — independent of version — the scan attributes every chain hop
        // after `Server::builder()` to the ROOT type, so the quickstart `Server::builder().add_service(svc).serve_with_shutdown(
        // addr, f)` reaches classify as `Server::serve_with_shutdown` although at runtime it is `Router`'s. The `None` therefore
        // asserted that the quickstart is silent. It is a real listener either way, so the spelling is charged (`tonic_r1528`).
        assert_eq!(classify("tonic", "tonic::transport::server::Server::serve_with_shutdown"), Some("Net"));
        assert_eq!(classify("tonic", "tonic::transport::Server::serve_with_shutdown"), Some("Net"));
        // THE FIX: `Repository::clone`/`clone_recurse` and `RepoBuilder::clone` ARE libgit2's real
        // network clone — a corpus round found `git2::Repository::clone(url, path)` reporting ZERO
        // effects and passing `deny Net` at exit 0, because the bare `::clone` denylist meant to keep
        // out `Remote`'s derived `Clone` dup (below) also excluded the one thing the old comment named
        // as NOT meant to be excluded.
        assert_eq!(classify("git2", "git2::Repository::clone"), Some("Net"));
        assert_eq!(classify("git2", "git2::Repository::clone_recurse"), Some("Net"));
        assert_eq!(classify("git2", "git2::build::RepoBuilder::clone"), Some("Net"));
        // THE CONTROL: `Remote::clone` is the DERIVED `Clone` trait impl (an Arc/handle duplication, no
        // libgit2 call) — it must stay pure. Re-fabricating Net here would undo the very over-charge the
        // original exclusion existed to prevent. FQN-exact matching (not a bare `::clone` re-widen) keeps
        // this pure while catching `Repository::clone` above.
        assert_eq!(classify("git2", "git2::Remote::clone"), None);
        // THE SWEEP FIX: a fourth+fifth true positive in the SAME gap — `Submodule::clone`/
        // `Submodule::update` call `raw::git_submodule_clone`/`git_submodule_update` directly (the exact
        // leaves already in this file's FFI-tier NET table), but git2's documented submodule-init idiom
        // calls the safe Rust wrapper, which carried no rule of its own.
        assert_eq!(classify("git2", "git2::Submodule::clone"), Some("Net"));
        assert_eq!(classify("git2", "git2::Submodule::update"), Some("Net"));
        // NO FABRICATION: git2's many pure `update_*` setters (CheckoutBuilder/DiffOptions/StatusOptions)
        // must not gain Net — FQN-exact, not a bare `::update` substring.
        assert_eq!(classify("git2", "git2::build::CheckoutBuilder::update_only"), None);
        assert_eq!(classify("git2", "git2::DiffOptions::update_index"), None);
        assert_eq!(classify("git2", "git2::Submodule::update_strategy"), None);
        // memmap2: only the syscall-issuing map/flush/protect verbs are Fs; reads over an already-mapped
        // region (len/as_ptr/is_empty) and the request builder are PURE (whole-crate Fs fabricated Fs).
        assert_eq!(classify("memmap2", "memmap2::MmapOptions::map"), Some("Fs"));
        assert_eq!(classify("memmap2", "memmap2::MmapOptions::map_mut"), Some("Fs"));
        assert_eq!(classify("memmap2", "memmap2::Mmap::flush"), Some("Fs"));
        assert_eq!(classify("memmap2", "memmap2::MmapMut::make_read_only"), Some("Fs"));
        assert_eq!(classify("memmap2", "memmap2::Mmap::len"), None); // length read — pure
        assert_eq!(classify("memmap2", "memmap2::Mmap::is_empty"), None); // pure
        assert_eq!(classify("memmap2", "memmap2::Mmap::as_ptr"), None); // pointer — pure
        assert_eq!(classify("memmap2", "memmap2::MmapOptions::new"), None); // request builder — pure
        // arboard: the Clipboard handle's read/write verbs are Clipboard; `arboard::Error` formatting
        // and option data types are PURE (whole-crate Clipboard fabricated Clipboard on `Error::to_string`).
        assert_eq!(classify("arboard", "arboard::Clipboard::new"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Clipboard::get_text"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Clipboard::set_text"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Clipboard::clear"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Error::to_string"), None); // error formatting — pure
        assert_eq!(classify("arboard", "arboard::Error::fmt"), None); // Display impl — pure
        assert_eq!(classify("arboard", "arboard::ImageData::to_owned_img"), None); // pure data type
        // R59-class audit: `file_list` is `Get`/`Set`'s sibling terminal beside `text`/`image`/`html`
        // (verified against arboard 3.6.1 — the only `file_list` in the crate, so no ambiguity survives
        // the crate gate); `Clear::default` is `clear()`'s own alternate entry point.
        assert_eq!(classify("arboard", "arboard::Get::file_list"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Set::file_list"), Some("Clipboard"));
        assert_eq!(classify("arboard", "arboard::Clear::default"), Some("Clipboard"));
        // fastrand: value draws + entropy-seeded entry points are Rand; the DETERMINISTIC seeded ctor
        // `with_seed` and state split/copy (`fork`/`clone`) are PURE (whole-crate Rand fabricated Rand).
        assert_eq!(classify("fastrand", "fastrand::u32"), Some("Rand")); // top-level draw
        assert_eq!(classify("fastrand", "fastrand::Rng::usize"), Some("Rand"));
        assert_eq!(classify("fastrand", "fastrand::Rng::shuffle"), Some("Rand"));
        assert_eq!(classify("fastrand", "fastrand::Rng::new"), Some("Rand")); // entropy-seeded
        assert_eq!(classify("fastrand", "fastrand::Rng::with_seed"), None); // deterministic ctor — pure
        assert_eq!(classify("fastrand", "fastrand::Rng::fork"), None); // state split — pure
        assert_eq!(classify("fastrand", "fastrand::Rng::clone"), None); // state copy — pure
        // portable_pty / async_process: spawn/wait keep Exec; config GETTERS and pure data ctors/setters
        // do NOT (base Exec fabricated on `CommandBuilder::get_cwd` / `PtySize::default` / `Stdio::piped`).
        assert_eq!(classify("portable_pty", "portable_pty::PtySystem::openpty"), Some("Exec"));
        assert_eq!(classify("portable_pty", "portable_pty::SlavePty::spawn_command"), Some("Exec"));
        assert_eq!(classify("portable_pty", "portable_pty::CommandBuilder::get_argv"), None); // getter
        assert_eq!(classify("portable_pty", "portable_pty::CommandBuilder::get_cwd"), None); // getter
        assert_eq!(classify("portable_pty", "portable_pty::PtySize::default"), None); // pure data type
        // `CommandBuilder::new` snapshots the process environment (b11, EXECUTED) — Env; see `r1528_b11_rows_classify`.
        assert_eq!(classify("async_process", "async_process::Command::spawn"), Some("Exec"));
        assert_eq!(classify("async_process", "async_process::Command::output"), Some("Exec"));
        assert_eq!(classify("async_process", "async_process::Stdio::piped"), None); // pure data type
        assert_eq!(classify("async_process", "async_process::Stdio::null"), None); // pure data type
        // FFI tiers (matched by distinctive leaf, alias-independent)
        assert_eq!(classify("libc", "libc::open"), Some("Fs"));
        assert_eq!(classify("libc", "libc::connect"), Some("Net"));
        assert_eq!(classify("libc", "libc::read"), None); // generic fd op — deliberately unclassified
        assert_eq!(classify("ffi", "ffi::sqlite3_step"), Some("Db"));
        // SOUNDNESS R166 — the PROCESS-GLOBAL extension registry. `rusqlite::register_auto_extension`
        // calls `ffi::sqlite3_auto_extension` directly and read `[]` on the 0.34.0 binary: an explicit
        // empty effect set over a call that changes what every LATER `sqlite3_open` executes.
        assert_eq!(classify("ffi", "ffi::sqlite3_auto_extension"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_cancel_auto_extension"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_reset_auto_extension"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_enable_load_extension"), Some("Db"));
        // …and the database-CONTENT I/O the same sweep found unlisted beside it.
        assert_eq!(classify("ffi", "ffi::sqlite3_deserialize"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_serialize"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_db_cacheflush"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_file_control"), Some("Db"));
        assert_eq!(classify("ffi", "ffi::sqlite3_wal_autocheckpoint"), Some("Db"));
        // CONTROLS for the boundary this list deliberately stops at — an in-memory accessor and a
        // per-connection callback INSTALLER stay unclassified, so the additions above are not read as
        // "every `sqlite3_*` is Db". Both pass before and after R166; recorded as boundary, not coverage.
        assert_eq!(classify("ffi", "ffi::sqlite3_column_int64"), None);
        assert_eq!(classify("ffi", "ffi::sqlite3_create_function_v2"), None);
        assert_eq!(classify("raw", "raw::git_remote_fetch"), Some("Net"));
        // libgit2 clone + submodule clone/update fetch over the network (an A/B on git2 0.20 caught
        // `Submodule::update`/`clone` and `Repository::clone` reporting no Net — the latter because the
        // `src/build.rs` module was being dropped as if it were the Cargo build script).
        assert_eq!(classify("raw", "raw::git_clone"), Some("Net"));
        assert_eq!(classify("raw", "raw::git_submodule_clone"), Some("Net"));
        assert_eq!(classify("raw", "raw::git_submodule_update"), Some("Net"));
        assert_eq!(classify("raw", "raw::git_submodule_open"), None); // local subrepo open — not Net
        // libcurl: the transfer/raw-socket entry points are Net (an A/B on curl 0.4 caught the whole
        // crate reporting ZERO Net); the big setopt/init/getinfo surface — and the readiness-wait
        // multi_wait/poll — stay unclassified (the loop's perform is the boundary).
        assert_eq!(classify("curl_sys", "curl_sys::curl_easy_perform"), Some("Net"));
        assert_eq!(classify("curl_sys", "curl_sys::curl_easy_send"), Some("Net"));
        assert_eq!(classify("curl_sys", "curl_sys::curl_multi_perform"), Some("Net"));
        assert_eq!(classify("curl_sys", "curl_sys::curl_multi_socket_action"), Some("Net"));
        assert_eq!(classify("curl_sys", "curl_sys::curl_easy_setopt"), None); // in-memory option write
        assert_eq!(classify("curl_sys", "curl_sys::curl_easy_init"), None); // handle alloc
        assert_eq!(classify("curl_sys", "curl_sys::curl_multi_wait"), None); // readiness wait, no payload
        // consumer-side `curl` crate rule: the dispatch verbs are Net, the setopt builders pure.
        assert_eq!(classify("curl", "curl::easy::Easy::perform"), Some("Net"));
        assert_eq!(classify("curl", "curl::multi::Multi::perform"), Some("Net"));
        assert_eq!(classify("curl", "curl::easy::Easy::send"), Some("Net"));
        assert_eq!(classify("curl", "curl::easy::Easy::url"), None); // CURLOPT setter — pure
        assert_eq!(classify("curl", "curl::easy::Easy::timeout"), None); // pure setter; Multi::timeout under-reported by design
        assert_eq!(classify("ffi", "ffi::SSL_connect"), Some("Net"));
        // pure crates stay pure
        assert_eq!(classify("serde", "serde::Serialize::serialize"), None);
        assert_eq!(classify("std", "std::vec::Vec::push"), None);

        // ── sweep 2026-06-17: fabrication carve-outs + DNS coverage (each fails pre-fix) ──
        // [24] std::net socket accessors are pure; the I/O verbs stay Net.
        assert_eq!(classify("std", "std::net::TcpStream::connect"), Some("Net"));
        assert_eq!(classify("std", "std::net::TcpStream::local_addr"), None);
        assert_eq!(classify("std", "std::net::TcpStream::nodelay"), None);
        assert_eq!(classify("std", "std::net::TcpStream::ttl"), None);
        assert_eq!(classify("std", "std::net::UdpSocket::peer_addr"), None);
        // [37] std DNS resolution is Net (was floored).
        assert_eq!(classify("std", "std::net::lookup_host"), Some("Net"));
        assert_eq!(classify("std", "core::net::ToSocketAddrs::to_socket_addrs"), Some("Net"));
        // [23] std::process getters are pure; spawn/new stay Exec.
        assert_eq!(classify("std", "std::process::Command::get_program"), None);
        assert_eq!(classify("std", "std::process::Command::get_args"), None);
        assert_eq!(classify("std", "std::process::Child::id"), None);
        assert_eq!(classify("std", "std::process::Command::spawn"), Some("Exec"));
        // [27] redis ConnectionManager::clone is an Arc bump (pure); a query round-trips.
        assert_eq!(classify("redis", "redis::aio::ConnectionManager::clone"), None);
        assert_eq!(classify("redis", "redis::aio::ConnectionManager::send_packed_command"), Some("Db"));
        // [5] sea_orm re-exported sea_query builder algebra is pure; execution verbs stay Db.
        assert_eq!(classify("sea_orm", "sea_orm::sea_query::Func::count"), None);
        assert_eq!(classify("sea_orm", "sea_orm::sea_query::Condition::all"), None);
        assert_eq!(classify("sea_orm", "sea_orm::Select::all"), Some("Db"));
        // THE FIX: `Database::connect_proxy` (the `proxy`-feature sibling of `Database::connect`) opens
        // a live `DatabaseConnection` through a caller-supplied `ProxyDatabaseTrait` — same effect,
        // missing from an allowlist keyed on the plain `connect` spelling.
        assert_eq!(classify("sea_orm", "sea_orm::Database::connect_proxy"), Some("Db"));
        // THE COVERAGE-GATE SWEEP: the transaction and pagination families, verified against sea-orm
        // 1.1.20 source.
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseConnection::transaction"), Some("Db"));
        assert_eq!(
            classify("sea_orm", "sea_orm::DatabaseConnection::transaction_with_config"),
            Some("Db")
        );
        // BONUS (found proving the above reachable with a real fixture, not in the original ratchet):
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseConnection::ping"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseConnection::begin"), Some("Db"));
        assert_eq!(
            classify("sea_orm", "sea_orm::DatabaseConnection::begin_with_config"),
            Some("Db")
        );
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseTransaction::commit"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::DatabaseTransaction::rollback"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxMySqlPoolConnection::begin"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxMySqlPoolConnection::ping"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxMySqlPoolConnection::transaction"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxPostgresPoolConnection::begin"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::SqlxSqlitePoolConnection::ping"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::fetch"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::fetch_and_next"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::into_stream"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::num_pages"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Paginator::num_items_and_pages"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Insert::exec_with_returning_keys"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::Inserter::exec_with_returning_many"), Some("Db"));
        assert_eq!(classify("sea_orm", "sea_orm::TryInsert::exec_with_returning_keys"), Some("Db"));
        // NO FABRICATION: the mock/proxy backends share every one of these verb names but perform no
        // real I/O (mock) or dispatch through a caller-supplied trait (proxy) — FQN-exact, not a bare
        // `::ping`/`::begin`/`::transaction`/`::commit`/`::rollback` suffix, keeps them pure/unknown.
        assert_eq!(classify("sea_orm", "sea_orm::MockDatabaseConnection::ping"), None);
        assert_eq!(classify("sea_orm", "sea_orm::MockDatabaseConnection::begin"), None);
        assert_eq!(classify("sea_orm", "sea_orm::ProxyDatabaseConnection::commit"), None);
        assert_eq!(classify("sea_orm", "sea_orm::ProxyDatabaseConnection::ping"), None);
    }

    #[test]
    fn lettre_tls_setup_and_connection_family_is_covered() {
        // THE COVERAGE-GATE SWEEP, verified against lettre 0.11.23 source. `build_rustls` calls
        // `rustls_native_certs::load_native_certs()` (a real OS-trust-store read) + `tracing::debug!`.
        assert_eq!(
            classify("lettre", "lettre::transport::smtp::client::TlsParametersBuilder::build_rustls"),
            Some("Fs")
        );
        assert_eq!(classify("lettre", "lettre::TlsParametersBuilder::build"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::TlsParameters::new"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::TlsParameters::new_rustls"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::SmtpTransport::from_url"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::SmtpTransport::relay"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::SmtpTransport::starttls_relay"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::AsyncSmtpTransport::from_url"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::AsyncSmtpTransport::relay"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::AsyncSmtpTransport::starttls_relay"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::FileTransport::read"), Some("Fs"));
        // The sealed `Executor` trait impl — `#[doc(hidden)]`, a narrower surface, but genuinely
        // reachable (both the trait and `AsyncStd1Executor` are `pub`, re-exported at the crate root).
        assert_eq!(classify("lettre", "lettre::AsyncStd1Executor::connect"), Some("Net"));
        assert_eq!(classify("lettre", "lettre::AsyncStd1Executor::fs_read"), Some("Fs"));
        assert_eq!(classify("lettre", "lettre::AsyncStd1Executor::fs_write"), Some("Fs"));
        // Only reachable via the module-qualified path — neither type is re-exported at the crate root.
        assert_eq!(
            classify(
                "lettre",
                "lettre::transport::smtp::client::AsyncSmtpConnection::connect_asyncstd1"
            ),
            Some("Net")
        );
        assert_eq!(
            classify(
                "lettre",
                "lettre::transport::smtp::client::AsyncNetworkStream::connect_asyncstd1"
            ),
            Some("Net")
        );
        // NO FABRICATION: `NetworkStream` lives in a PRIVATE module (`mod net;`, never re-exported) — no
        // external consumer can ever name it, so no rule was added despite self-scan flagging its
        // `shutdown`/`set_read_timeout`/`set_write_timeout` (propagated from the coarse
        // `std::net::TcpStream` whole-handle rule).
        assert_eq!(classify("lettre", "lettre::NetworkStream::shutdown"), None);
        assert_eq!(classify("lettre", "lettre::NetworkStream::set_read_timeout"), None);
    }

    #[test]
    fn rand_osrng_handle_ops_are_pure_but_draws_are_rand() {
        // Adversarial-review fabrication: the blanket `contains("OsRng")` tagged `OsRng::clone` Rand,
        // but OsRng is a unit struct — clone/fork/default draw no entropy. The real draws still fire.
        assert_eq!(classify("rand", "rand::rngs::OsRng::clone"), None);
        assert_eq!(classify("rand", "rand::rngs::OsRng::default"), None);
        assert_eq!(classify("rand", "rand::rngs::OsRng::fill_bytes"), Some("Rand")); // a real draw
        assert_eq!(classify("rand", "rand::rngs::OsRng::next_u32"), Some("Rand"));
        assert_eq!(classify("rand", "rand::Rng::gen"), Some("Rand")); // verb path unaffected
        assert_eq!(classify("rand", "rand::distributions::Uniform::new"), None); // pure ctor still pure
    }

    #[test]
    fn redis_connection_manager_config_builder_is_pure() {
        // Adversarial-review fabrication: `contains("ConnectionManager")` hit the pure *Config* builder.
        assert_eq!(classify("redis", "redis::aio::ConnectionManagerConfig::new"), None);
        assert_eq!(classify("redis", "redis::aio::ConnectionManagerConfig::set_max_delay"), None);
        // the LIVE manager still round-trips (Db).
        assert_eq!(classify("redis", "redis::aio::ConnectionManager::new"), Some("Db"));
        assert_eq!(classify("redis", "redis::Commands::get"), Some("Db"));
    }

    #[test]
    fn redis_get_connection_info_is_a_pure_accessor_not_swept_by_the_substring() {
        // coverage-gate sweep (2026-08-27): `contains("::get_connection")` also matched
        // `Client::get_connection_info` (a pure accessor over an already-stored field) because it is a
        // literal substring of that name — the real connection-getters stay caught.
        assert_eq!(classify("redis", "redis::Client::get_connection_info"), None);
        assert_eq!(classify("redis", "redis::Client::get_connection"), Some("Db"));
        assert_eq!(classify("redis", "redis::Client::get_async_connection"), Some("Db"));
        assert_eq!(
            classify("redis", "redis::Client::get_multiplexed_async_connection"),
            Some("Db")
        );
    }

    #[test]
    fn aws_config_load_from_env_is_loads_own_convenience_wrapper() {
        // THE FIX: `load_from_env()` is the crate's OWN "convenience wrapper" (its doc comment's words)
        // around `from_env().load().await` — the exact already-modelled effect one call down — but
        // "load_from_env".ends_with("::load") is false.
        assert_eq!(classify("aws_config", "aws_config::load"), Some("Net"));
        assert_eq!(classify("aws_config", "aws_config::load_defaults"), Some("Net"));
        assert_eq!(classify("aws_config", "aws_config::load_from_env"), Some("Net"));
        assert_eq!(classify("aws_config", "aws_config::from_env"), None); // pure builder
    }

    #[test]
    fn tungstenite_stream_first_handshake_entry_points_are_net() {
        // THE FIX: `client`/`client_with_config`/`client_tls`/`client_tls_with_config` (client.rs:176,
        // 159; tls.rs:163,179) and `accept`/`accept_with_config`/`accept_hdr`/`accept_hdr_with_config`
        // (server.rs:23-63) each run `{Client,Server}Handshake::start(stream, ..).handshake()` — the real
        // WS upgrade I/O over an already-open stream. tungstenite's OWN documented way to run over a
        // caller-managed TCP/TLS/mio stream, missing from a verb list keyed only on `connect`.
        assert_eq!(classify("tungstenite", "tungstenite::client::client"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::client::client_with_config"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::tls::client_tls"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::tls::client_tls_with_config"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::server::accept"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::server::accept_with_config"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::server::accept_hdr"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::server::accept_hdr_with_config"), Some("Net"));
        assert_eq!(classify("tungstenite", "tungstenite::client::connect_with_config"), Some("Net"));
    }

    #[test]
    fn mysql_conn_new_is_the_real_connect() {
        // THE FIX: `mysql::Conn::new` (conn/mod.rs:342) calls `connect_stream()?; connect()?` directly;
        // `mysql_async::Conn::new` (conn/mod.rs:921) is the async equivalent. Each crate's own primary
        // connection constructor, the crate's own first doctest example — but `::new` never appeared in
        // the verb list.
        assert_eq!(classify("mysql", "mysql::Conn::new"), Some("Db"));
        assert_eq!(classify("mysql_async", "mysql_async::Conn::new"), Some("Db"));
        // NO FABRICATION: the SAME two crates' unrelated pure `new`s (Opts/PoolConstraints/TxOpts/…)
        // must not gain Db — scoped to the `Conn::` segment, not a bare `::new` suffix.
        assert_eq!(classify("mysql", "mysql::Opts::new"), None);
        assert_eq!(classify("mysql", "mysql::PoolConstraints::new"), None);
        assert_eq!(classify("mysql_async", "mysql_async::TxOpts::new"), None);
    }

    #[test]
    fn mongodb_with_options_is_the_same_effect_as_with_uri_str() {
        // THE FIX: `with_uri_str` (client.rs:179) is `ClientOptions::parse(uri).await?;
        // Client::with_options(options)` one call down — `with_options` (client.rs:188) is where the
        // topology/monitoring actually spins up, and mongodb's own doc calls it the entry point for a
        // caller who already holds parsed `ClientOptions`. Verified against mongodb 3.8.1 (both the
        // async `client.rs` and sync `sync/client.rs` `Client`).
        assert_eq!(classify("mongodb", "mongodb::Client::with_uri_str"), Some("Db"));
        assert_eq!(classify("mongodb", "mongodb::Client::with_options"), Some("Db"));
        assert_eq!(classify("mongodb", "mongodb::sync::Client::with_options"), Some("Db"));
        assert_eq!(classify("mongodb", "mongodb::Collection::find_one"), Some("Db"));
        // NO FABRICATION: an unrelated crate's `with_options` builder must not gain Db — crate-gated.
        assert_eq!(classify("some_other_crate", "some_other_crate::Widget::with_options"), None);
    }

    #[test]
    fn pure_fd_transfer_is_not_an_effect() {
        // ADOPTING / EXTRACTING / BORROWING an already-open descriptor (or unwrapping an async type back
        // to its std type) issues NO syscall — it must be PURE even though it hangs off a std I/O type
        // whose prefix rule would otherwise fire Net/Fs/Ipc. (Real tokio sweep: `into_std`, `from_raw_fd`,
        // `as_raw_fd` all fabricated effects.)
        assert_eq!(classify("std", "std::net::TcpStream::from_raw_fd"), None);
        assert_eq!(classify("std", "std::net::TcpStream::into_raw_fd"), None);
        assert_eq!(classify("std", "std::net::TcpStream::as_raw_fd"), None);
        assert_eq!(classify("std", "std::net::TcpListener::from_raw_fd"), None);
        assert_eq!(classify("std", "std::net::UdpSocket::from_raw_socket"), None);
        assert_eq!(classify("std", "std::fs::File::from_raw_fd"), None);
        assert_eq!(classify("std", "std::fs::File::into_raw_fd"), None);
        assert_eq!(classify("std", "std::fs::File::as_raw_handle"), None);
        assert_eq!(classify("std", "std::os::unix::net::UnixStream::from_raw_fd"), None);
        // `SocketAddr::from_pathname` builds an address struct, opens no socket — pure. (socket2 sweep.)
        assert_eq!(classify("std", "std::os::unix::net::SocketAddr::from_pathname"), None);
        assert_eq!(classify("tokio", "tokio::net::TcpStream::from_raw_fd"), None);
        assert_eq!(classify("tokio", "tokio::net::TcpStream::into_std"), None); // unwrap → std type, pure
        assert_eq!(classify("tokio", "tokio::fs::File::into_std"), None);
        // …but a REAL open/connect on the SAME types still fires the effect — the carve-out is leaf-precise.
        assert_eq!(classify("std", "std::net::TcpStream::connect"), Some("Net"));
        assert_eq!(classify("std", "std::fs::File::open"), Some("Fs"));
        assert_eq!(classify("std", "std::fs::read"), Some("Fs"));
        assert_eq!(classify("std", "std::os::unix::net::UnixStream::connect"), Some("Ipc"));
        assert_eq!(classify("tokio", "tokio::net::TcpStream::connect"), Some("Net"));
        // R1288 — tokio's clock, and only its `now`.
        assert_eq!(classify("tokio", "tokio::time::Instant::now"), Some("Clock"));
        assert_eq!(classify("tokio", "tokio::time::Instant::from_std"), None);
        assert_eq!(classify("quanta", "quanta::Instant::now"), Some("Clock"));
        assert_eq!(classify("web_time", "web_time::Instant::now"), Some("Clock"));
    }

    /// THE PLATFORM `fs` MODULES. `std::fs::` was the whole filesystem rule, so every function in
    /// `std::os::{unix,windows,wasi}::fs` read PURE — measured with EXECUTED ground truth (a `cargo run`
    /// that created a real symlink and stat'd it back), `deny Fs` over a crate whose only filesystem
    /// write was `std::os::unix::fs::symlink` exited 0.
    ///
    /// The controls are the point: the `*Ext` DATA/BUILDER traits must stay pure, or the fix trades a
    /// silent under-report for a fabrication on every `m.uid()` — and `FileExt` must NOT, because
    /// `read_at`/`write_at` are the positional-I/O syscalls this rule exists to catch.
    #[test]
    fn the_platform_fs_modules_are_filesystem_io_and_their_data_traits_are_not() {
        for p in [
            "std::os::unix::fs::symlink", "std::os::unix::fs::chown", "std::os::unix::fs::lchown",
            "std::os::unix::fs::fchown", "std::os::unix::fs::chroot",
            "std::os::windows::fs::symlink_dir", "std::os::windows::fs::symlink_file",
            "std::os::windows::fs::junction_point",
            "std::os::unix::fs::FileExt::read_at", "std::os::unix::fs::FileExt::write_at",
            "std::os::windows::fs::FileExt::seek_read", "std::os::windows::fs::FileExt::seek_write",
        ] {
            assert_eq!(classify("std", p), Some("Fs"), "{p} performs filesystem I/O");
        }
        for p in [
            "std::os::unix::fs::MetadataExt::uid", "std::os::unix::fs::MetadataExt::mode",
            "std::os::unix::fs::PermissionsExt::mode", "std::os::unix::fs::PermissionsExt::set_mode",
            "std::os::unix::fs::OpenOptionsExt::custom_flags",
            "std::os::unix::fs::DirBuilderExt::mode",
            "std::os::unix::fs::DirEntryExt::ino", "std::os::unix::fs::FileTypeExt::is_fifo",
            "std::os::windows::fs::MetadataExt::file_attributes",
        ] {
            assert_eq!(classify("std", p), None,
                       "{p} reads or configures data already in hand — charging it would FABRICATE Fs");
        }
        // `std::os::unix::net` is Ipc and must be untouched by a rule keyed one segment along.
        assert_eq!(classify("std", "std::os::unix::net::UnixStream::connect"), Some("Ipc"));
    }

    /// SOUNDNESS R141 — the platform `process` modules, the sibling `fs` had a rule and `process` did
    /// not. `CommandExt::exec` is `execvp`: it REPLACES the process image, ground-truthed by a
    /// `cargo run` that printed a line from the exec'd image and never reached the line after the call.
    /// Both directions are driven here: the spawn surface must charge Exec (without the rule every
    /// assertion in the first loop returns `None` and `deny Exec` over a library whose only function
    /// calls `CommandExt::exec` exits 0), and the already-collected-status traits must NOT, or the fix
    /// trades a silent under-report for a fabrication on every `status.signal()` — the same control
    /// shape as the `fs` test above.
    #[test]
    fn the_platform_process_modules_are_exec_and_their_status_traits_are_not() {
        for p in [
            "std::os::unix::process::CommandExt::exec",
            "std::os::unix::process::CommandExt::pre_exec",
            "std::os::unix::process::CommandExt::arg0",
            "std::os::unix::process::CommandExt::uid",
            "std::os::unix::process::CommandExt::gid",
            "std::os::unix::process::CommandExt::groups",
            "std::os::unix::process::CommandExt::process_group",
            "std::os::windows::process::CommandExt::creation_flags",
            "std::os::windows::process::CommandExt::raw_arg",
            "std::os::windows::process::ChildExt::main_thread_handle",
            "std::os::wasi::process::CommandExt::exec",
        ] {
            assert_eq!(classify("std", p), Some("Exec"), "{p} is subprocess machinery");
        }
        for p in [
            "std::os::unix::process::ExitStatusExt::signal",
            "std::os::unix::process::ExitStatusExt::core_dumped",
            "std::os::unix::process::ExitStatusExt::from_raw",
            "std::os::unix::process::ExitStatusExt::into_raw",
            "std::os::unix::process::ExitStatusError::signal",
            "std::os::windows::process::ExitStatusExt::from_raw",
            "std::os::windows::process::ExitCodeExt::from_raw",
            "std::os::unix::process::parent_id",
        ] {
            assert_eq!(classify("std", p), None,
                       "{p} reads a status already collected (or this process's own pid) — charging it \
                        would FABRICATE Exec");
        }
        // Keyed one segment along: `fs` and `net` under the same platform root must be untouched.
        assert_eq!(classify("std", "std::os::unix::fs::FileExt::read_at"), Some("Fs"));
        assert_eq!(classify("std", "std::os::unix::net::UnixStream::connect"), Some("Ipc"));
    }

    #[test]
    fn command_head_refines_the_exec_cliff() {
        use super::classify_command_head as h;
        // unambiguous external tools classify by basename (spec §4 ⟨0.5⟩)
        assert_eq!(h("curl"), &["Net"]);
        assert_eq!(h("telnet"), &["Net"]);
        assert_eq!(h("sftp"), &["Net"]);
        assert_eq!(h("/usr/local/bin/psql"), &["Db"]); // basename match strips the path
        assert_eq!(h("mongo"), &["Db"]);
        assert_eq!(h("cqlsh"), &["Db"]);
        // a candor engine is Fs/Env — spec-SUPPLIED by §7 item 12, not curation
        assert_eq!(h("candor-scan"), &["Env", "Fs"]);
        assert_eq!(h("candor-run.sh"), &["Env", "Fs"]);
        // an unrecognised head adds nothing — the bare Exec cliff stands (never guess). `make`/`npm`
        // run the project's own code; `git`/`rsync` are multi-modal (local vs remote) — all keep the
        // cliff rather than fabricate an effect for the common case.
        assert_eq!(h("some-unknown-tool"), &[] as &[&str]);
        assert_eq!(h("make"), &[] as &[&str]);
        assert_eq!(h("npm"), &[] as &[&str]);
        assert_eq!(h("git"), &[] as &[&str]);
        assert_eq!(h("rsync"), &[] as &[&str]);
        // a builder MODIFIER (`.arg`/`.env`) names no program — its literal must NOT refine (a
        // whole-crate-Exec crate classifies every method; `.env("psql",..)` must not fabricate Db).
        assert!(is_cmd_builder_method("env") && is_cmd_builder_method("arg") && is_cmd_builder_method("current_dir"));
        assert!(!is_cmd_builder_method("new")); // Command::new NAMES the program
        assert!(!is_cmd_builder_method("cmd")); // duct::cmd NAMES the program
        // The gate that ADMITS a literal to classify_command_head is an ALLOWLIST of program-NAMING
        // methods, not the builder denylist. Inversion matters: a whole-crate-Exec crate (portable_pty)
        // classifies EVERY method as Exec, so a getter like `cmd.get_env("psql")` — absent from the
        // builder denylist — would have leaked "psql" to the head and FABRICATED Db. Only `new`/`cmd`
        // name a program, so only they may refine.
        assert!(is_cmd_naming_method("new") && is_cmd_naming_method("cmd"));
        assert!(!is_cmd_naming_method("get_env")); // a GETTER, not a namer — the leak this closes
        assert!(!is_cmd_naming_method("arg") && !is_cmd_naming_method("env") && !is_cmd_naming_method("current_dir"));
    }

    /// SOUNDNESS R379 — THE MASKING GUARD'S ALLOWLIST, AND THE DENYLIST THAT WAS MEASURED AND REJECTED.
    ///
    /// The verbs here take the HOST as an argument, so a runtime value in that position is invisible to
    /// the gate and the surface must be marked incomplete. The DNS resolver verbs were missing, and
    /// their absence was a GATE BYPASS, not a missed disclosure: `allow Net good.example.com` exited 0
    /// over `r.lookup_ip(caller_host)` sitting beside a benign literal, measured against real
    /// hickory-resolver 0.26.2.
    /// SOUNDNESS R386 — the `sqlite3_*` C API takes SQL, and its absence let a benign SIBLING literal
    /// certify arbitrary caller-supplied SQL.
    ///
    /// R383 recorded this gap as "REAL BUT NOT LIVE" because a C-string literal never reaches `tables`.
    /// That is true of an ISOLATED function and is the WRONG SHAPE: the literal only has to come from
    /// the same FUNCTION, not the same call. Measured, calibrated first (`deny Db` exits 1):
    /// `conn.execute("INSERT INTO users (id) VALUES (1)", [])` beside `sqlite3_exec(db, caller_sql, …)`
    /// gave `tables:['users'] incomplete:NONE` and `allow Db users` exited 0.
    #[test]
    fn db_query_arg_covers_the_sqlite3_sql_bearing_family() {
        // Every spelling that TAKES SQL — the whole family, not the one that was measured (R346).
        for f in ["sqlite3_exec", "sqlite3_prepare", "sqlite3_prepare_v2", "sqlite3_prepare_v3",
                  "sqlite3_prepare16", "sqlite3_prepare16_v2", "sqlite3_prepare16_v3",
                  // R386's own boundary, found by a release panel: SQL is arg 1 here too.
                  "sqlite3_get_table"] {
            assert!(is_db_query_arg(f), "{f} carries SQL — a runtime query there is invisible (R386)");
        }
        // THE OVER-MASK CONTROLS, and they carry as much weight as the fix. These take no query, so
        // masking them would fail `allow Db` closed over nothing. `sqlite3_open*` is the sharpest: it
        // takes a FILENAME, so masking it would claim a Db surface for an Fs locator.
        for f in ["sqlite3_step", "sqlite3_close", "sqlite3_open", "sqlite3_open_v2", "sqlite3_open16",
                  "sqlite3_serialize", "sqlite3_deserialize", "sqlite3_finalize", "sqlite3_reset",
                  // the backup/blob handle verbs carry no query either — the other half of the family
                  "sqlite3_backup_init", "sqlite3_backup_step", "sqlite3_blob_open", "sqlite3_blob_read"] {
            assert!(!is_db_query_arg(f),
                    "{f} carries no SQL — masking it claims an incomplete surface over nothing, and for \
                     the open* family it would claim a Db surface for a FILENAME");
        }
        // The pre-existing high-level verbs must survive.
        for f in ["execute", "query", "prepare", "prepare_cached", "simple_query"] {
            assert!(is_db_query_arg(f), "{f} was already covered and must stay covered");
        }
    }

    /// SOUNDNESS R383 — the METHOD forms whose path is an ARGUMENT. The guard's `!c.method` gate
    /// excluded every method form because the path-STAT methods carry the path as their RECEIVER;
    /// `OpenOptions::open(path)` is the counter-example, and `allow Fs <lit>` exited 0 over a
    /// caller-supplied path because of it.
    #[test]
    fn fs_path_arg_methods_are_the_receiver_pairs_not_the_leaf() {
        // The path-taking pairs, matched on the TAIL so std/tokio/cap_primitives/fs_err all qualify.
        for p in ["std::fs::OpenOptions::open", "tokio::fs::OpenOptions::open",
                  "cap_primitives::fs::OpenOptions::open", "fs_err::OpenOptions::open",
                  "std::fs::DirBuilder::create", "tokio::fs::DirBuilder::create"] {
            assert!(is_fs_path_arg_method(p), "{p} takes its path as an ARGUMENT — R383");
        }
        // THE CONTROLS, and they are the row: every other method on the SAME receivers is a builder
        // modifier or a combinator, and `File`'s methods are use-verbs whose path was fixed at open.
        // Masking these is the over-mask a denylist would have caused (R379 measured that cost).
        for p in ["std::fs::File::read_to_string", "std::fs::File::write", "std::fs::File::write_all",
                  "std::fs::File::read", "std::fs::File::seek", "std::path::Path::exists",
                  "std::fs::OpenOptions::read", "std::fs::OpenOptions::truncate",
                  "std::fs::OpenOptions::map_err", "tokio::fs::OpenOptions::mode"] {
            assert!(!is_fs_path_arg_method(p),
                    "{p} hides no path — it is a builder modifier, a combinator, or a use-verb whose \
                     path was fixed at open. Masking it is the over-mask this allowlist avoids.");
        }
    }

    #[test]
    fn net_establishing_allowlist() {
        // Host-bearing verbs establish — a runtime value here is invisible, so the gate must fail closed.
        for m in ["connect", "connect_timeout", "get", "post", "put", "patch", "delete", "head",
                  "request", "send_to", "lookup_host", "to_socket_addrs"] {
            assert!(is_net_establishing(m), "`{m}` takes the host as an argument and must establish");
        }
        // R379: the DNS resolver verbs `classify` already maps to Net. The WHOLE FAMILY, not the one
        // spelling that was found — `_lookup` is a suffix test mirroring `classify`'s own.
        for m in ["lookup", "lookup_ip", "resolve", "reverse_lookup", "srv_lookup", "mx_lookup",
                  "txt_lookup", "ipv4_lookup", "ipv6_lookup", "ns_lookup", "soa_lookup"] {
            assert!(is_net_establishing(m),
                    "`{m}` resolves a caller-supplied host — R379. Without it, `allow Net <benign \
                     literal>` exits 0 over a DNS lookup of a runtime hostname.");
        }
        // USE-verbs on an already-established connection: the host was fixed at `connect`, so a missing
        // literal here hides nothing and must NOT flag — else `connect("h").write(..)` fails closed.
        for m in ["write", "read", "send", "flush", "recv", "peek", "write_all", "read_to_end",
                  "write_vectored", "shutdown", "status", "headers", "text", "json"] {
            assert!(!is_net_establishing(m), "`{m}` is a use-verb on an established connection");
        }
    }

    /// ⟨0.40⟩ SOUNDNESS R817 — an ACCEPT is not a BIND. The two lists answer different questions and must
    /// not share a member: a binding verb's literal is withheld and marks nothing, an accepting verb marks
    /// the surface incomplete. `accept`/`incoming` used to be binding verbs, which is the defect.
    #[test]
    fn r817_accepting_is_not_binding() {
        for (path, leaf) in [
            ("std::net::TcpListener::accept", "accept"),
            ("std::net::TcpListener::incoming", "incoming"),
            ("std::net::TcpListener::into_incoming", "into_incoming"),
            ("tokio::net::TcpListener::accept", "accept"),
            ("tokio::net::TcpListener::poll_accept", "poll_accept"),
            ("libc::accept", "accept"),
            ("libc::accept4", "accept4"),
            ("quinn::Endpoint::accept", "accept"),
            ("tonic::transport::server::Router::serve", "serve"),
            ("tonic::transport::server::Router::serve_with_shutdown", "serve_with_shutdown"),
            ("tonic::transport::server::TcpIncoming::new", "new"),
        ] {
            assert!(is_net_accepting(path, leaf), "`{path}` accepts connections: its peers are unseen");
            assert!(!is_net_binding(leaf), "`{leaf}` must not be a binding verb — binding withholds and marks nothing");
        }
        // CONTROLS — binds mark nothing; a stream accepted on an ESTABLISHED connection (quinn) has a peer
        // fixed at the endpoint's accept; a datagram receive is not an accept; `serve`/`new` elsewhere are
        // not accepts.
        for (path, leaf) in [
            ("std::net::UdpSocket::bind", "bind"),
            ("std::net::TcpListener::bind", "bind"),
            ("libc::listen", "listen"),
            ("quinn::Connection::accept_bi", "accept_bi"),
            ("quinn::Connection::accept_uni", "accept_uni"),
            ("std::net::UdpSocket::recv_from", "recv_from"),
            ("tonic::transport::server::Server::serve_with_shutdown", "serve_with_shutdown"),
            ("reqwest::Client::new", "new"),
        ] {
            assert!(!is_net_accepting(path, leaf), "`{path}` does not accept a connection");
        }
        for m in ["bind", "listen", "bind_to_device"] {
            assert!(is_net_binding(m), "`{m}` names a LOCAL address");
        }
    }

    /// R379 — WHY THIS STAYS AN ALLOWLIST, which is NOT this family's usual direction.
    ///
    /// `candor-denylist-over-allowlist` says narrow a sound over-approximation with a denylist, and
    /// R350 made exactly that inversion one list over. It is wrong HERE, for the reason
    /// `is_cmd_naming_method` states two doc-blocks above for Exec: a WHOLE-CRATE-Net crate classifies
    /// every method as Net, so a denylist of use-verbs masks essentially everything in one. Measured by
    /// building the inversion and A/B-ing all 1,545 registry crates: **544 rows gained `incomplete`,
    /// none lost it** — `cap-std` 66, `hickory-net` 44 — and the triggers were conversions, accessors
    /// and combinators that hide no host.
    ///
    /// These are the measured leaks, pinned so the inversion cannot be re-attempted without meeting
    /// them. `bind` is the sharpest: this file has `is_net_binding` precisely because a bind address
    /// is where the process LISTENS, never a destination it reaches.
    #[test]
    fn the_rejected_denylist_leaks_are_not_establishing() {
        for m in ["bind", "into", "from", "from_std", "as_socket", "setsockopt", "getsockopt",
                  "map_err", "map", "ok", "try_clone", "complete_io"] {
            assert!(!is_net_establishing(m),
                    "`{m}` hides no host and must not mark a surface incomplete. It was a MEASURED \
                     trigger of the rejected denylist inversion (544 rows gained `incomplete` over the \
                     registry, 0 lost) — a whole-crate-Net crate classifies every method as Net, which \
                     is why the allowlist is the precise side here. See R379.");
        }
    }

    #[test]
    fn fs_path_arg_allowlist() {
        // The Fs masking guard's path-naming-fn allowlist — free fns / constructors take the path as a
        // string arg (a runtime path there is invisible to the gate). Stat methods (path on the receiver)
        // and handle ops carry no path arg and must NOT flag — but they're caught by the caller's
        // `!is_method` gate; the allowlist itself just enumerates the path-NAMING leaves.
        assert!(is_fs_path_arg("write") && is_fs_path_arg("read") && is_fs_path_arg("read_to_string"));
        assert!(is_fs_path_arg("open") && is_fs_path_arg("create") && is_fs_path_arg("create_new"));
        assert!(is_fs_path_arg("remove_file") && is_fs_path_arg("rename") && is_fs_path_arg("copy"));
        assert!(is_fs_path_arg("create_dir_all") && is_fs_path_arg("canonicalize") && is_fs_path_arg("metadata"));
        // handle ops / pure builders take NO path arg — never path-naming.
        assert!(!is_fs_path_arg("write_all") && !is_fs_path_arg("flush") && !is_fs_path_arg("read_exact"));
        assert!(!is_fs_path_arg("new") && !is_fs_path_arg("sync_all") && !is_fs_path_arg("set_len"));
    }

    #[test]
    fn db_query_arg_allowlist() {
        // The Db masking guard's query-bearing-verb allowlist — these take the raw SQL as a string arg
        // (a runtime query there is invisible to the gate). Build-then-execute terminals and non-query
        // ops carry no SQL string and must NOT flag.
        assert!(is_db_query_arg("execute") && is_db_query_arg("query") && is_db_query_arg("query_one"));
        assert!(is_db_query_arg("prepare") && is_db_query_arg("batch_execute") && is_db_query_arg("execute_batch"));
        assert!(is_db_query_arg("query_row") && is_db_query_arg("query_map") && is_db_query_arg("exec"));
        // build-then-execute terminals (query built structurally, no SQL string) must NOT flag.
        assert!(!is_db_query_arg("fetch_all") && !is_db_query_arg("load") && !is_db_query_arg("first"));
        assert!(!is_db_query_arg("all") && !is_db_query_arg("one") && !is_db_query_arg("stream"));
        // connection / lifecycle ops take no SQL — must NOT flag.
        assert!(!is_db_query_arg("connect") && !is_db_query_arg("open") && !is_db_query_arg("begin"));
        assert!(!is_db_query_arg("commit") && !is_db_query_arg("ping") && !is_db_query_arg("get_conn"));
    }
}

#[cfg(test)]
mod fs_kind_tests {
    use super::fs_kind;

    /// SPEC §2 `fs`. Most of what these assert is what the classifier REFUSES to say: §2 requires the
    /// field be "omitted rather than guessed", because an empty or partial `fs` reads as a positive claim
    /// ("reads but never writes") — the §4 trust contract's forbidden direction.
    #[test]
    fn write_verbs() {
        for p in ["std::fs::write", "std::fs::create_dir_all", "std::fs::remove_file",
                  "File::create", "std::fs::set_permissions", "f::write_all"] {
            assert_eq!(fs_kind(p), &["write"], "{p} mutates the disk");
        }
    }

    #[test]
    fn read_verbs() {
        for p in ["std::fs::read_to_string", "std::fs::read_dir", "std::fs::metadata",
                  "File::open", "std::fs::canonicalize", "f::read_to_end"] {
            assert_eq!(fs_kind(p), &["read"], "{p} observes without mutating");
        }
    }

    /// A copy/rename reads the source AND writes the destination — one call, both kinds.
    #[test]
    fn two_locator_verbs_are_both() {
        for p in ["std::fs::copy", "std::fs::rename", "std::fs::hard_link"] {
            assert_eq!(fs_kind(p), &["read", "write"], "{p}");
        }
    }

    /// THE LOAD-BEARING CASE. A verb that does not reveal direction must contribute NOTHING — not a
    /// default, not a guess. Anything here returning a kind would let a function claim "reads but never
    /// writes" on the strength of a verb that said neither.
    #[test]
    fn unrevealing_verbs_make_no_claim() {
        for p in ["std::fs::OpenOptions", "some_crate::do_thing", "std::fs::File", "f::seek"] {
            assert!(fs_kind(p).is_empty(), "{p} must not claim a direction it did not reveal");
        }
    }

    /// `OpenOptions::open` is `File::open`'s leaf and NOT its verb: the direction lives in the builder
    /// chain (`.read(true)`/`.write(true)`), which `fs_kind` cannot see. A `write(true)` builder claiming
    /// `["read"]` is the forbidden direction, so the type wins over the leaf here. `File::open` — where
    /// `open` DOES mean read — is unaffected, which is the whole reason this is keyed on the type.
    #[test]
    fn openoptions_open_claims_no_direction_but_file_open_still_reads() {
        for p in ["std::fs::OpenOptions::open", "fs_err::OpenOptions::open",
                  "tokio::fs::OpenOptions::open"] {
            assert!(fs_kind(p).is_empty(),
                    "{p}'s direction was set by the builder chain, which this function cannot see");
        }
        assert_eq!(fs_kind("std::fs::File::open"), &["read"], "`File::open` is unambiguously a read");
    }
}

#[cfg(test)]
mod masks_locator_tests {
    use super::*;

    /// SOUNDNESS R806 — each no-locator DENYLIST must be a SUBSET of the table it subtracts from. A
    /// typo'd or stale entry that is not in the table would subtract nothing and read as a decision;
    /// a table entry renamed without its denylist twin would silently start masking (the safe
    /// direction) — but only this check says which happened.
    #[test]
    fn every_no_locator_denylist_is_a_subset_of_its_charging_table() {
        for n in LIBC_FS_NO_PATH {
            assert!(LIBC_FS.contains(n), "LIBC_FS_NO_PATH names `{n}`, which LIBC_FS does not charge");
        }
        for n in LIBC_EXEC_NO_PROGRAM {
            assert!(LIBC_EXEC.contains(n), "LIBC_EXEC_NO_PROGRAM names `{n}`, absent from LIBC_EXEC");
        }
        for n in LIBC_NET_NO_DESTINATION {
            assert!(LIBC_NET.contains(n), "LIBC_NET_NO_DESTINATION names `{n}`, absent from LIBC_NET");
        }
        for n in PG_DB_VERBS_NO_SQL {
            assert!(PG_DB_VERBS.contains(n), "PG_DB_VERBS_NO_SQL names `{n}`, absent from PG_DB_VERBS");
        }
    }

    /// SOUNDNESS R806 — THE DERIVATION, pinned from the table side: every leaf the table charges that is
    /// not on the denylist MASKS. So a leaf added to `LIBC_FS` tomorrow is masked with no second edit,
    /// which is the property the hand list lacked.
    #[test]
    fn every_charged_libc_leaf_off_the_denylist_masks() {
        for (eff, table, deny) in [
            ("Fs", LIBC_FS, LIBC_FS_NO_PATH),
            ("Exec", LIBC_EXEC, LIBC_EXEC_NO_PROGRAM),
            ("Net", LIBC_NET, LIBC_NET_NO_DESTINATION),
        ] {
            for leaf in table.iter().filter(|l| !deny.contains(l)) {
                for cr in ["libc", "nix"] {
                    let path = format!("{cr}::{leaf}");
                    assert_eq!(classify(cr, &path), Some(eff), "{path} must still be charged {eff}");
                    assert!(masks_locator(eff, cr, &path, leaf, false), "{path} names a locator — must mask");
                }
            }
            for leaf in deny.iter() {
                let path = format!("libc::{leaf}");
                assert!(!masks_locator(eff, "libc", &path, leaf, false) || is_net_establishing(leaf),
                        "{path} is on the no-locator denylist — must not mask via the table");
            }
        }
        // The named members, from the row: the sweep's EXECUTED arms.
        for (eff, leaf) in [("Fs", "unlink"), ("Fs", "unlinkat"), ("Fs", "utimensat"), ("Exec", "system"),
                            ("Exec", "popen"), ("Exec", "execvp"), ("Exec", "posix_spawn"), ("Net", "getaddrinfo"),
                            ("Net", "sendto")] {
            assert!(masks_locator(eff, "libc", &format!("libc::{leaf}"), leaf, false), "libc::{leaf}");
        }
        // Scoped to the syscall crates: the same leaf on an unrelated crate is not this table's to judge.
        assert!(!masks_locator("Fs", "mycrate", "mycrate::unlink", "unlink", false));
        // rustix spells `sendmsg` WITHOUT an address; libc and nix carry one.
        assert!(!masks_locator("Net", "rustix", "rustix::net::sendmsg", "sendmsg", false));
        assert!(masks_locator("Net", "libc", "libc::sendmsg", "sendmsg", false));
    }

    #[test]
    fn pg_verbs_take_sql_except_the_named_three() {
        for v in PG_DB_VERBS.iter().filter(|v| !PG_DB_VERBS_NO_SQL.contains(v)) {
            let path = format!("deadpool_postgres::Client{v}");
            let leaf = &v[2..];
            assert!(masks_locator("Db", "deadpool_postgres", &path, leaf, true), "{path} takes SQL — must mask");
        }
        assert!(masks_locator("Db", "tokio_postgres", "tokio_postgres::Client::prepare_typed_cached",
                              "prepare_typed_cached", true));
        assert!(!masks_locator("Db", "tokio_postgres", "tokio_postgres::Client::transaction", "transaction", true));
        assert!(masks_locator("Db", "sqlx_core", "sqlx_core::executor::Executor::prepare_with", "prepare_with", true));
        assert!(!masks_locator("Db", "sqlx_core", "sqlx_core::query::Query::fetch_all", "fetch_all", true),
                "a Query terminal takes an EXECUTOR at arg 0 — masking it would swallow every literal query");
    }

    /// THE COVERAGE-GATE REFRESH (2026-10-08) — each family's rule fires on the spellings a consumer writes
    /// and NOT on a sibling type or an accessor (each charge is traced to a body in the rule's comment).
    #[test]
    fn coverage_gate_refresh_2026_10_08_rules() {
        for p in ["rusqlite::Transaction::commit", "rusqlite::transaction::Transaction::new",
                  "rusqlite::Savepoint::rollback", "rusqlite::Connection::pragma_update",
                  "rusqlite::Connection::unchecked_transaction", "rusqlite::Connection::savepoint_with_name"] {
            assert_eq!(classify("rusqlite", p), Some("Db"), "{p}");
        }
        for p in ["rusqlite::Transaction::drop_behavior", "rusqlite::Savepoint::set_drop_behavior"] {
            assert_eq!(classify("rusqlite", p), None, "{p}");
        }
        for p in ["redis::Connection::send_packed_command", "redis::connection::Connection::recv_response",
                  "redis::PubSub::get_message"] {
            assert_eq!(classify("redis", p), Some("Net"), "{p}");
        }
        assert_eq!(classify("redis", "redis::aio::MultiplexedConnection::recv_response"), None);
        assert_eq!(classify("redis", "redis::Connection::set_write_timeout"), None);
        for p in ["lettre::SmtpConnection::command", "lettre::transport::smtp::client::SmtpConnection::connect",
                  "lettre::AsyncSmtpConnection::read_response",
                  "lettre::transport::smtp::client::AsyncNetworkStream::connect_tokio1",
                  "lettre::Tokio1Executor::connect"] {
            assert_eq!(classify("lettre", p), Some("Net"), "{p}");
        }
        for p in ["lettre::SmtpConnection::server_info", "lettre::NetworkStream::peer_addr",
                  "lettre::AsyncSmtpConnection::is_encrypted"] {
            assert_eq!(classify("lettre", p), None, "{p}");
        }
        assert_eq!(classify("rustls", "rustls::KeyLogFile::log"), Some("Fs"));
        assert_eq!(classify("rustls", "rustls::NoKeyLog::log"), None);
    }

    /// SOUNDNESS R1528 (b11) — the last 51 grandfathered rows: each rule beside a same-type pure neighbour (a rule that charged the
    /// whole type would pass without them) and the two carve-outs that REMOVE a charge. Every positive is EXECUTED in the handoff
    /// `rust-r1528/b11/`; the controls below are the idle windows of the same fixture.
    #[test]
    fn r1528_b11_rows_classify_with_pure_neighbours() {
        let eff = |c: &str, p: &str| classify(c, p);
        // env_logger: the five timestamp readers and the default format
        for m in ["timestamp", "timestamp_seconds", "timestamp_millis", "timestamp_micros", "timestamp_nanos"] {
            assert_eq!(eff("env_logger", &format!("env_logger::fmt::humantime::Formatter::{m}")), Some("Clock"));
            assert_eq!(eff("env_logger", &format!("env_logger::fmt::Formatter::{m}")), Some("Clock"));
        }
        assert_eq!(eff("env_logger", "env_logger::fmt::ConfigurableFormat::format"), Some("Clock"));
        assert_eq!(eff("env_logger", "env_logger::fmt::ConfigurableFormat::timestamp"), None); // the setter
        assert_eq!(eff("env_logger", "env_logger::fmt::Formatter::style"), None);
        // elasticsearch: the transport constructors (+ the trust store as the SECOND effect) and the pool reseed
        for m in ["single_node", "static_node_list", "sniffing_node_list", "cloud"] {
            let p = format!("elasticsearch::http::transport::Transport::{m}");
            assert_eq!(eff("elasticsearch", &p), Some("Env"), "{p}");
            assert_eq!(also_effects("elasticsearch", &p), vec!["Fs"], "{p} must carry the trust-store read");
        }
        assert_eq!(eff("elasticsearch", "elasticsearch::http::transport::TransportBuilder::build"), Some("Env"));
        assert_eq!(also_effects("elasticsearch", "elasticsearch::http::transport::TransportBuilder::build"), vec!["Fs"]);
        assert_eq!(eff("elasticsearch", "elasticsearch::http::transport::MultiNodeConnectionPool::reseed"), Some("Clock"));
        assert_eq!(eff("elasticsearch", "elasticsearch::http::transport::TransportBuilder::auth"), None);
        assert!(also_effects("elasticsearch", "elasticsearch::http::transport::TransportBuilder::auth").is_empty());
        assert!(also_effects("elasticsearch", "elasticsearch::http::transport::Transport::send").is_empty());
        assert!(also_effects("reqwest", "reqwest::ClientBuilder::build").is_empty(), "reqwest is not claimed here");
        // tokio_postgres / deadpool_postgres: the verbs `PG_DB_VERBS` never matched
        for m in ["execute_raw", "execute_typed", "query_typed_raw", "query_typed_one", "query_typed_opt", "query_scalar",
                  "query_one_scalar", "query_opt_scalar", "bind", "bind_raw", "query_portal", "query_portal_raw",
                  "commit", "rollback", "savepoint"] {
            for ty in ["Client", "Transaction"] {
                assert_eq!(eff("tokio_postgres", &format!("tokio_postgres::{ty}::{m}")), Some("Db"), "{ty}::{m}");
                assert_eq!(eff("deadpool_postgres", &format!("deadpool_postgres::{ty}::{m}")), Some("Db"), "dp {ty}::{m}");
            }
        }
        for m in ["simple_query_raw", "check_connection"] {
            assert_eq!(eff("tokio_postgres", &format!("tokio_postgres::client::Client::{m}")), Some("Db"));
        }
        assert_eq!(eff("deadpool_postgres", "deadpool_postgres::GenericClient::execute_raw"), Some("Db"));
        assert_eq!(eff("tokio_postgres", "tokio_postgres::to_statement::private::ToStatementType::into_statement"), Some("Db"));
        for p in ["tokio_postgres::Client::is_closed", "tokio_postgres::Client::cancel_token", "tokio_postgres::Client::clear_type_cache",
                  "tokio_postgres::Transaction::client", "tokio_postgres::Connection::poll_message"] {
            assert_eq!(eff("tokio_postgres", p), None, "{p} sends nothing (poll_message is filed R1598:conditional)");
        }
        assert_eq!(eff("deadpool_postgres", "deadpool_postgres::config::Config::get_pg_config"), None); // R1598:conditional
        // grep_cli: associate reads PATH; the MATCHER builder's build spawns nothing, the READER builders' do
        for m in ["associate", "try_associate"] {
            assert_eq!(eff("grep_cli", &format!("grep_cli::decompress::DecompressionMatcherBuilder::{m}")), Some("Env"));
        }
        assert_eq!(eff("grep_cli", "grep_cli::decompress::DecompressionMatcherBuilder::build"), None, "EXECUTED 0 spawns");
        assert_eq!(eff("grep_cli", "grep_cli::decompress::DecompressionReaderBuilder::build"), Some("Exec"));
        assert_eq!(eff("grep_cli", "grep_cli::process::CommandReaderBuilder::build"), Some("Exec"));
        assert_eq!(eff("grep_cli", "grep_cli::decompress::DecompressionMatcherBuilder::new"), None);
        // backoff
        for m in ["get_elapsed_time", "reset", "default"] {
            assert_eq!(eff("backoff", &format!("backoff::exponential::ExponentialBackoff::{m}")), Some("Clock"), "{m}");
        }
        assert_eq!(eff("backoff", "backoff::exponential::ExponentialBackoff::next_backoff"), Some("Rand"));
        assert_eq!(eff("backoff", "backoff::exponential::ExponentialBackoffBuilder::build"), Some("Clock"));
        assert_eq!(eff("backoff", "backoff::exponential::ExponentialBackoffBuilder::new"), None);
        assert_eq!(eff("backoff", "backoff::exponential::ExponentialBackoffBuilder::with_max_elapsed_time"), None);
        assert_eq!(eff("backoff", "backoff::clock::SystemClock::now"), Some("Clock"));
        // rustls: the client connection draws entropy; the server connection's constructor draws none
        for p in ["rustls::client::client_conn::connection::ClientConnection::new", "rustls::ClientConnection::new_with_alpn",
                  "rustls::client::client_conn::UnbufferedClientConnection::new", "rustls::client::UnbufferedClientConnection::new_with_alpn",
                  "rustls::quic::connection::ClientConnection::new", "rustls::quic::connection::ClientConnection::new_with_alpn"] {
            assert_eq!(eff("rustls", p), Some("Rand"), "{p}");
        }
        assert_eq!(eff("rustls", "rustls::ServerConnection::new"), None);
        assert_eq!(eff("rustls", "rustls::ClientConfig::builder"), None);
        assert_eq!(eff("rustls", "rustls::KeyLogFile::new"), Some("Fs"));
        // etcetera
        for p in ["etcetera::base_strategy::apple::Apple::new", "etcetera::base_strategy::xdg::Xdg::new", "etcetera::base_strategy::windows::Windows::new",
                  "etcetera::app_strategy::unix::Unix::new", "etcetera::app_strategy::xdg::Xdg::new", "etcetera::app_strategy::apple::Apple::new"] {
            assert_eq!(eff("etcetera", p), Some("Env"), "{p}");
        }
        assert_eq!(eff("etcetera", "etcetera::app_strategy::AppStrategyArgs::new"), None);
        // time
        assert_eq!(eff("time", "time::instant::Instant::elapsed"), Some("Clock"));
        assert_eq!(eff("time", "time::signed_duration::SignedDuration::time_fn"), Some("Clock"));
        assert_eq!(eff("time", "time::Duration::time_fn"), Some("Clock"));
        assert_eq!(eff("time", "time::utc_offset::UtcOffset::current_local_offset"), Some("Clock"));
        assert_eq!(eff("time", "time::Instant::checked_add"), None);
        assert_eq!(eff("time", "time::UtcOffset::from_hms"), None);
        // console (the free fns are spelled at the crate root and under `utils`/`term`)
        for p in ["console::is_dumb", "console::term::is_dumb", "console::set_colors_enabled", "console::utils::set_colors_enabled_stderr",
                  "console::set_true_colors_enabled", "console::true_colors_enabled_stderr", "console::colors_enabled"] {
            assert_eq!(eff("console", p), Some("Env"), "{p}");
        }
        assert_eq!(eff("console", "console::style"), None);
        assert_eq!(eff("console", "console::measure_text_width"), None);
        // rand
        assert_eq!(eff("rand", "rand::make_rng"), Some("Rand"));
        assert_eq!(eff("rand", "rand::SeedableRng::seed_from_u64"), None);
        assert_eq!(eff("rand", "rand::rng::u8::fill_slice"), None); // R1598:conditional
        // portable_pty: the builder snapshots the environment and spawns nothing — `from_argv`/`new_default_prog` were `Exec`
        for m in ["new", "from_argv", "new_default_prog"] {
            assert_eq!(eff("portable_pty", &format!("portable_pty::cmdbuilder::CommandBuilder::{m}")), Some("Env"), "{m}");
        }
        assert_eq!(eff("portable_pty", "portable_pty::CommandBuilder::spawn_command"), Some("Exec"));
        assert_eq!(eff("portable_pty", "portable_pty::CommandBuilder::arg"), None);
        assert_eq!(eff("portable_pty", "portable_pty::CommandBuilder::get_shell"), Some("Fs"));
        // notify / native_tls / duct / dotenvy
        assert_eq!(eff("notify", "notify::poll::PollWatcher::with_initial_scan"), Some("Clock"));
        assert_eq!(eff("notify", "notify::poll::PollWatcher::poll"), None);
        assert_eq!(eff("native_tls_crate", "native_tls_crate::TlsConnectorBuilder::build"), Some("Fs"));
        assert_eq!(eff("native_tls_crate", "native_tls_crate::TlsConnectorBuilder::min_protocol_version"), None);
        assert_eq!(eff("duct", "duct::Handle::wait_timeout"), Some("Clock"));
        assert_eq!(eff("duct", "duct::Handle::wait_deadline"), Some("Clock"));
        assert_eq!(eff("duct", "duct::Handle::try_wait"), None);
        assert_eq!(eff("duct", "duct::Handle::wait"), None);
        assert_eq!(eff("dotenvy", "dotenvy::iter::Iter::load_override"), Some("Env"));
        assert_eq!(eff("dotenvy", "dotenvy::iter::Iter::load"), Some("Env"));
    }

    /// SOUNDNESS R1528 (b10) — tempfile 3.27.0, tungstenite 0.30.0, crossterm 0.29.0, reqwest 0.13.5, mysql 28.0.3 and diesel
    /// 2.3.14: every rule against a same-type pure neighbour, in the spelling the scan produces (a chain hop is attributed to
    /// the root type) and in the declaring-module spelling.
    #[test]
    fn r1528_b10_rows_classify_with_pure_neighbours() {
        // tempfile
        for p in ["tempfile::SpooledTempFile::into_file", "tempfile::spooled::SpooledTempFile::roll"] {
            assert_eq!(classify("tempfile", p), Some("Fs"), "{p}");
        }
        assert_eq!(classify("tempfile", "tempfile::env::temp_dir"), Some("Env"));
        assert_eq!(classify("tempfile", "tempfile::temp_dir"), Some("Env"));
        for p in ["tempfile::SpooledTempFile::new", "tempfile::SpooledTempFile::flush", "tempfile::TempDir::path",
                  "tempfile::env::override_temp_dir", "tempfile::TempPath::from_path", "tempfile::TempPath::try_from_path"] {
            assert_eq!(classify("tempfile", p), None, "{p}");
        }
        // tungstenite: the pass-through `Request` impl must stay pure (a `::into_client_request` suffix would charge it)
        assert_eq!(classify("tungstenite", "tungstenite::handshake::client::generate_key"), Some("Rand"));
        for p in ["tungstenite::http::Uri::into_client_request", "tungstenite::client::ClientRequestBuilder::into_client_request"] {
            assert_eq!(classify("tungstenite", p), Some("Rand"), "{p}");
        }
        assert_eq!(classify("tungstenite", "tungstenite::http::Request::into_client_request"), None);
        assert_eq!(classify("tungstenite", "tungstenite::client::ClientRequestBuilder::new"), None);
        assert_eq!(classify("tungstenite", "tungstenite::client::ClientRequestBuilder::with_header"), None);
        for p in ["tungstenite::stream::MaybeTlsStream::set_nodelay", "tungstenite::stream::NoDelay::set_nodelay",
                  "tungstenite::WebSocket::write_pending", "tungstenite::protocol::WebSocket::write_pending"] {
            assert_eq!(classify("tungstenite", p), Some("Net"), "{p}");
        }
        assert_eq!(classify("tungstenite", "tungstenite::Message::text"), None);
        // crossterm
        for p in ["crossterm::style::Colored::ansi_color_disabled", "crossterm::style::Colored::ansi_color_disabled_memoized",
                  "crossterm::Colored::set_ansi_color_disabled", "crossterm::style::force_color_output",
                  "crossterm::style::available_color_count"] {
            assert_eq!(classify("crossterm", p), Some("Env"), "{p}");
        }
        for p in ["crossterm::cursor::position", "crossterm::cursor::sys::unix::position", "crossterm::event::EventStream::new",
                  "crossterm::event::EventStream::next"] {
            assert_eq!(classify("crossterm", p), Some("Ipc"), "{p}");
        }
        // the conditional rows and the pure neighbours stay unclaimed
        for p in ["crossterm::style::Print::write_ansi", "crossterm::terminal::SetTitle::write_ansi",
                  "crossterm::terminal::SetTitle::execute_winapi", "crossterm::ansi_support::supports_ansi",
                  "crossterm::style::Colored::ForegroundColor", "crossterm::style::Print", "crossterm::style::Color::Red"] {
            assert_eq!(classify("crossterm", p), None, "{p}");
        }
        // reqwest
        for p in ["reqwest::ClientBuilder::build", "reqwest::blocking::ClientBuilder::build", "reqwest::Client::build",
                  "reqwest::blocking::Client::build", "reqwest::Client::new", "reqwest::NoProxy::from_env"] {
            assert_eq!(classify("reqwest", p), Some("Env"), "{p}");
        }
        for p in ["reqwest::multipart::Form::file", "reqwest::blocking::multipart::Form::file"] {
            assert_eq!(classify("reqwest", p), Some("Fs"), "{p}");
        }
        assert_eq!(classify("reqwest", "reqwest::blocking::Response::copy_to"), Some("Net"));
        for p in ["reqwest::ClientBuilder::new", "reqwest::Client::builder", "reqwest::multipart::Form::new",
                  "reqwest::multipart::Form::text", "reqwest::NoProxy::from_string",
                  "reqwest::async_impl::h3_client::pool::PoolClient::send_request"] {
            assert_eq!(classify("reqwest", p), None, "{p}");
        }
        // mysql
        for p in ["mysql::Conn::reset", "mysql::Conn::change_user", "mysql::PooledConn::change_user", "mysql::Pool::new",
                  "mysql::Pool::try_get_conn", "mysql::Pool::start_transaction", "mysql::PooledConn::get_binlog_stream",
                  "mysql::Conn::start_transaction", "mysql::PooledConn::start_transaction", "mysql::Conn::get_binlog_stream",
                  "mysql::conn::pool::Pool::new"] {
            assert_eq!(classify("mysql", p), Some("Db"), "{p}");
        }
        for p in ["mysql::PooledConn::unwrap", "mysql::Pool::opts", "mysql::PoolConstraints::new", "mysql::Opts::from_url",
                  "mysql::TxOpts::default", "mysql::BinlogRequest::new"] {
            assert_eq!(classify("mysql", p), None, "{p}");
        }
        // diesel
        for p in ["diesel::sqlite::SqliteConnection::batch_execute", "diesel::SqliteConnection::immediate_transaction",
                  "diesel::sqlite::SqliteConnection::exclusive_transaction", "diesel::connection::AnsiTransactionManager::begin_transaction_sql",
                  "diesel::sqlite::SqliteConnection::serialize_database_to_buffer",
                  "diesel::sqlite::SqliteConnection::deserialize_readonly_database_from_buffer", "diesel::pg::TransactionBuilder::run",
                  "diesel::pg::PgConnection::run", "diesel::pg::PgConnection::transaction", "diesel::sqlite::SqliteConnection::transaction"] {
            assert_eq!(classify("diesel", p), Some("Db"), "{p}");
        }
        for p in ["diesel::pg::PgConnection::build_transaction", "diesel::connection::AnsiTransactionManager::new",
                  "diesel::sqlite::SqliteConnection::set_instrumentation"] {
            assert_eq!(classify("diesel", p), None, "{p}");
        }
    }

    /// SOUNDNESS R1597 — lettre `send`/`send_raw` charge the TRANSPORT's effect. SMTP and the generic trait path stay `Net`.
    #[test]
    fn r1597_lettre_send_charges_the_transports_own_effect() {
        for p in ["lettre::FileTransport::send", "lettre::FileTransport::send_raw", "lettre::AsyncFileTransport::send",
                  "lettre::AsyncFileTransport::send_raw", "lettre::transport::file::FileTransport::send",
                  "lettre::transport::file::AsyncFileTransport::send"] {
            assert_eq!(classify("lettre", p), Some("Fs"), "{p}");
        }
        for p in ["lettre::SendmailTransport::send", "lettre::AsyncSendmailTransport::send",
                  "lettre::transport::sendmail::SendmailTransport::send_raw"] {
            assert_eq!(classify("lettre", p), Some("Exec"), "{p}");
        }
        for p in ["lettre::SmtpTransport::send", "lettre::AsyncSmtpTransport::send", "lettre::transport::smtp::SmtpTransport::send_raw",
                  "lettre::Transport::send", "lettre::AsyncTransport::send"] {
            assert_eq!(classify("lettre", p), Some("Net"), "{p}");
        }
        // the sibling the file transport already had: `read` is `Fs` (unchanged)
        assert_eq!(classify("lettre", "lettre::FileTransport::read"), Some("Fs"));
    }

    /// SOUNDNESS R1528 — rules for rows EXECUTED/verified true, each with a same-crate pure neighbour.
    #[test]
    fn r1528_verified_rows_classify() {
        // tempfile: `into_file` drops the TempPath (unlinks); the `with_*` dir constructors create.
        assert_eq!(classify("tempfile", "tempfile::NamedTempFile::into_file"), Some("Fs"));
        for v in ["with_prefix", "with_prefix_in", "with_suffix", "with_suffix_in"] {
            assert_eq!(classify("tempfile", &format!("tempfile::TempDir::{v}")), Some("Fs"), "{v}");
        }
        assert_eq!(classify("tempfile", "tempfile::TempDir::into_path"), None, "flag flip only (R1528 FALSE)");
        // R1528 (b10): `TempDir::keep` is the same flag flip, EXECUTED 0 events; it was charged `Fs` by the `::keep` suffix rule.
        assert_eq!(classify("tempfile", "tempfile::TempDir::keep"), None, "flag flip only, carved out of ::keep");
        assert_eq!(classify("tempfile", "tempfile::NamedTempFile::keep"), Some("Fs"), "NamedTempFile::keep is not carved out");
        assert_eq!(classify("tempfile", "tempfile::TempPath::keep"), Some("Fs"), "TempPath::keep is not carved out");
        assert_eq!(classify("tempfile", "tempfile::NamedTempFile::path"), None);
        // R1528 (b10): `SpooledTempFile::into_file` creates a temp file for an in-memory buffer (EXECUTED), so it IS claimed now.
        assert_eq!(classify("tempfile", "tempfile::SpooledTempFile::into_file"), Some("Fs"));
        // chrono: the deprecated `today` is `now().date()`; no other `today` is claimed.
        assert_eq!(classify("chrono", "chrono::Utc::today"), Some("Clock"));
        assert_eq!(classify("chrono", "chrono::Local::today"), Some("Clock"));
        assert_eq!(classify("chrono", "chrono::offset::utc::Utc::today"), Some("Clock"));
        assert_eq!(classify("chrono", "chrono::NaiveDate::today"), None);
        assert_eq!(classify("chrono", "chrono::DateTime::parse_from_rfc2822"), None, "oracle fabrication, R1420(a)");
        // tokio_postgres cancel_query forwarders open a fresh connection; postgres is_valid is a round-trip.
        assert_eq!(classify("tokio_postgres", "tokio_postgres::Client::cancel_query"), Some("Net"));
        assert_eq!(classify("tokio_postgres", "tokio_postgres::Transaction::cancel_query"), Some("Net"));
        assert_eq!(classify("tokio_postgres", "tokio_postgres::Client::is_closed"), None);
        assert_eq!(classify("postgres", "postgres::Client::is_valid"), Some("Db"));
        assert_eq!(classify("tokio_postgres", "tokio_postgres::Client::is_valid"), None);
        // rdkafka: a broker request, every spelling.
        for p in ["rdkafka::Client::fetch_group_list", "rdkafka::BaseConsumer::fetch_group_list",
                  "rdkafka::StreamConsumer::fetch_group_list", "rdkafka::consumer::Consumer::fetch_group_list"] {
            assert_eq!(classify("rdkafka", p), Some("Net"), "{p}");
        }
        // tracing_subscriber: `fmt::Layer::new` reads NO_COLOR; the root `Layer` trait has no `new`.
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::Layer::new"), Some("Env"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::fmt_layer::Layer::new"), Some("Env"));
        assert_eq!(classify("tracing_subscriber", "tracing_subscriber::fmt::Layer::with_writer"), None);
    }

    /// SOUNDNESS R1528 — chrono 0.4.45, tracing-subscriber 0.3.23 and jiff 0.2.38 rows that carry a rule, each
    /// EXECUTED against a consumer fixture (handoff `rust-r1528/clockenv`). Pure neighbours and the rows filed as
    /// conditional (R1557/R1558/R1559) are pinned to `None` so a later "tidy-up" cannot over-charge them.
    #[test]
    fn r1528_clock_env_rows_classify() {
        for p in ["Local::offset_from_utc_datetime", "offset::local::Local::offset_from_local_datetime",
                  "Local::offset_from_utc_date", "offset::Local::offset_from_local_date"] {
            assert_eq!(classify("chrono", &format!("chrono::{p}")), Some("Clock"), "{p}");
        }
        for p in ["TimeZone::offset_from_utc_datetime", "FixedOffset::offset_from_utc_datetime",
                  "Utc::offset_from_utc_datetime", "DateTime::with_timezone", "Date::with_timezone",
                  "DateTime::checked_add_months", "DateTime::checked_sub_months", "DateTime::duration_round",
                  "DateTime::duration_round_up", "DateTime::duration_trunc", "NaiveDateTime::and_local_timezone",
                  "Parsed::to_datetime_with_timezone", "DateTime::fixed_offset", "DateTime::years_since",
                  "DateTime::parse_from_rfc3339", "DateTime::parse_from_rfc2822", "DateTime::parse_from_str",
                  "DateTime::parse_and_remainder", "Parsed::to_datetime", "NaiveDate::today"] {
            assert_eq!(classify("chrono", &format!("chrono::{p}")), None, "{p}");
        }
        assert_eq!(classify("mycrate", "mycrate::Local::offset_from_utc_datetime"), None);
        // SOUNDNESS R1616 — TimeZone's provided members on Local reach the same lookups; on Utc/FixedOffset they do not.
        for m in ["from_utc_datetime", "from_local_datetime", "timestamp_opt", "with_ymd_and_hms", "ymd_opt", "datetime_from_str"] {
            assert_eq!(classify("chrono", &format!("chrono::Local::{m}")), Some("Clock"), "{m}");
            assert_eq!(classify("chrono", &format!("chrono::offset::local::Local::{m}")), Some("Clock"), "{m}");
            assert_eq!(classify("chrono", &format!("chrono::Utc::{m}")), None, "{m}");
            assert_eq!(classify("chrono", &format!("chrono::FixedOffset::{m}")), None, "{m}");
        }

        for p in ["SystemTime::format_time", "fmt::time::SystemTime::format_time", "UtcTime::format_time",
                  "fmt::time::time_crate::LocalTime::format_time", "OffsetTime::format_time",
                  "ChronoLocal::format_time", "fmt::time::chrono_crate::ChronoUtc::format_time", "Uptime::default",
                  "fmt::time::Uptime::default", "uptime", "fmt::time::uptime"] {
            assert_eq!(classify("tracing_subscriber", &format!("tracing_subscriber::{p}")), Some("Clock"), "{p}");
        }
        for p in ["fmt::layer", "fmt::fmt", "fmt", "Layer::default", "fmt::Layer::default", "fmt::fmt_layer::Layer::default",
                  "fmt::Subscriber::builder", "FmtSubscriber::builder", "fmt::Subscriber::default",
                  "fmt::SubscriberBuilder::default"] {
            let want = if p == "Layer::default" { None } else { Some("Env") };
            assert_eq!(classify("tracing_subscriber", &format!("tracing_subscriber::{p}")), want, "{p}");
        }
        // forwarders (R1558) and pure neighbours stay unclaimed: `Layer::on_event` is ALSO the trait method every
        // layer shares, so a rule on it would charge every pure layer.
        for p in ["Layer::on_event", "Layer::on_new_span", "Layer::on_enter", "Layer::on_exit", "Layer::on_close",
                  "Layered::on_event", "Filtered::on_event", "Option::on_event", "Context::event",
                  "Format::format_event", "fmt::format::json::Format::format_event", "Uptime::format_time",
                  "Uptime::from", "time", "fmt::time::time", "SubscriberBuilder::with_target",
                  "fmt::SubscriberBuilder::with_writer"] {
            assert_eq!(classify("tracing_subscriber", &format!("tracing_subscriber::{p}")), None, "{p}");
        }

        for p in ["Date::in_tz", "civil::DateTime::in_tz", "Timestamp::in_tz", "zoned::Zoned::in_tz",
                  "TimeZoneDatabase::from_env", "tz::db::TimeZoneDatabase::from_dir",
                  "TimeZoneDatabase::from_concatenated_path", "DateTimeParser::parse_zoned",
                  "fmt::temporal::DateTimeParser::parse_time_zone", "BrokenDownTime::to_zoned",
                  "fmt::strtime::BrokenDownTime::to_zoned", "Pieces::to_time_zone",
                  "fmt::temporal::pieces::TimeZoneAnnotation::to_time_zone", "db", "tz::db", "tz::db::db"] {
            assert_eq!(classify("jiff", &format!("jiff::{p}")), Some("Fs"), "{p}");
        }
        for p in ["BrokenDownTime::to_zoned_with", "Pieces::to_time_zone_with", "TimeZoneAnnotation::to_time_zone_with",
                  "TimeZoneDatabase::bundled", "DateTimeParser::parse_zoned_with", "Date::to_zoned", "TimeZone::fixed",
                  "Span::checked_add", "Timestamp::from_second"] {
            assert_eq!(classify("jiff", &format!("jiff::{p}")), None, "{p}");
        }
        assert_eq!(classify("mycrate", "mycrate::Date::in_tz"), None);
    }

    /// SOUNDNESS R1528 — the sea-orm 2.0.4 rows that carry a rule, each EXECUTED against a consumer fixture on a
    /// file-backed sqlite database (handoff `rust-r1528/seaorm`). The pure neighbours, the `RusqliteSharedConnection`
    /// and `Vec::load_*` rows (filed as R1570/R1571: no path ever reaches `classify`) and the mock/proxy lookalikes are
    /// pinned to `None` so a later "tidy-up" cannot turn them into fabrications or dead coverage.
    #[test]
    fn r1528_sea_orm_rows_classify() {
        let db = |ty: &str, ms: &[&str]| -> Vec<(String, &'static str)> {
            ms.iter().map(|m| (format!("sea_orm::{ty}::{m}"), "Db")).collect()
        };
        let mut want: Vec<(String, &'static str)> = Vec::new();
        want.extend(db("DatabaseConnection", &["begin_with_options", "transaction_async", "transaction_with_config_async",
            "execute_raw", "query_one_raw", "query_all_raw", "stream_raw"]));
        want.extend(db("DatabaseExecutor", &["begin", "begin_with_config", "begin_with_options", "execute_raw",
            "query_one_raw", "query_all_raw", "transaction", "transaction_async", "transaction_with_config",
            "transaction_with_config_async"]));
        want.extend(db("DatabaseTransaction", &["begin", "begin_with_config", "begin_with_options", "execute_raw",
            "query_one_raw", "query_all_raw", "stream_raw", "transaction", "transaction_async",
            "transaction_with_config", "transaction_with_config_async"]));
        want.extend(db("RestrictedConnection", &["begin", "begin_with_config", "begin_with_options", "transaction",
            "transaction_async", "transaction_with_config", "transaction_with_config_async"]));
        want.extend(db("RestrictedTransaction", &["begin", "begin_with_config", "begin_with_options", "commit",
            "rollback", "transaction", "transaction_async", "transaction_with_config",
            "transaction_with_config_async"]));
        for m in ["load", "add_tables", "add_crud_permissions", "add_roles", "add_role_permissions",
                  "remove_role_permissions", "add_user_override", "add_role_hierarchy", "assign_user_role"] {
            want.push((format!("sea_orm::rbac::RbacContext::{m}"), "Db"));
            want.push((format!("sea_orm::rbac::context::RbacContext::{m}"), "Db"));
        }
        want.push(("sea_orm::rbac::schema::create_tables".into(), "Db"));
        for m in ["apply", "sync"] {
            want.push((format!("sea_orm::SchemaBuilder::{m}"), "Db"));
            want.push((format!("sea_orm::schema::builder::SchemaBuilder::{m}"), "Db"));
        }
        for ty in ["Select", "SelectTwo", "SelectTwoRequired", "Selector", "SelectorRaw"] {
            want.push((format!("sea_orm::{ty}::require_one"), "Db"));
        }
        for ty in ["Select", "SelectTwo", "SelectTwoRequired", "SelectThree", "SelectFour"] {
            want.push((format!("sea_orm::{ty}::stream_partial_model"), "Db"));
        }
        for p in ["sea_orm::DatabaseConnection::get_schema_registry", "sea_orm::DatabaseExecutor::get_schema_registry",
                  "sea_orm::EntityRegistry::build_schema", "sea_orm::entity::registry::EntityRegistry::build_schema"] {
            want.push((p.into(), "Log"));
        }
        for (p, eff) in &want {
            assert_eq!(classify("sea_orm", p), Some(*eff), "{p}");
        }
        // pure neighbours and lookalikes
        for p in [
            // RBAC refusals return an error without touching the connection (restricted_connection.rs:54-81)
            "RestrictedConnection::execute_raw", "RestrictedConnection::query_one_raw",
            "RestrictedConnection::query_all_raw", "RestrictedTransaction::execute_raw",
            // value builders / lookups
            "rbac::RbacContext::get_role", "SchemaBuilder::register", "Schema::new", "Schema::builder",
            "DatabaseConnection::get_database_backend", "DatabaseConnection::get_schema_builder",
            "DatabaseExecutor::is_transaction", "DatabaseExecutor::get_schema_builder",
            "RestrictedConnection::user_id", "RestrictedConnection::user_can", "RestrictedTransaction::user_can_run",
            // mock and proxy backends perform no real I/O and share every verb name
            "MockDatabaseConnection::begin_with_options", "MockDatabaseConnection::transaction_async",
            "ProxyDatabaseConnection::execute_raw", "ProxyDatabaseConnection::query_all_raw",
            // R1570/R1571: no consumer path reaches classify, so no rule (a rule would be dead coverage)
            "Vec::load_many", "Vec::load_one", "Vec::load_self", "Vec::load_self_many", "Vec::load_self_via",
            "Vec::load_self_via_rev", "RusqliteSharedConnection::acquire", "RusqliteSharedConnection::begin",
            "RusqliteSharedConnection::close", "RusqliteSharedConnection::close_by_ref",
            "RusqliteSharedConnection::ping", "RusqliteSharedConnection::transaction",
            "driver::rusqlite::RusqliteSharedConnection::ping",
        ] {
            assert_eq!(classify("sea_orm", &format!("sea_orm::{p}")), None, "{p}");
        }
        assert_eq!(classify("mycrate", "mycrate::DatabaseTransaction::execute_raw"), None);
        assert_eq!(classify("mycrate", "mycrate::rbac::RbacContext::load"), None);
    }

    /// SOUNDNESS R1528 — the ureq 3.4.2 rows that carry a rule: every one EXECUTED against a consumer fixture
    /// (127.0.0.1 listener / env / file / RNG observations), both the crate-root and declaring-module spellings.
    #[test]
    fn r1528_ureq3_rows_classify() {
        for (p, eff) in [
            ("Agent::run", "Net"), ("agent::Agent::run", "Net"), ("WithAgent::run", "Net"),
            ("request_ext::WithAgent::run", "Net"), ("ConfigBuilder::run", "Net"),
            ("RequestBuilder::send_empty", "Net"), ("request::RequestBuilder::send_empty", "Net"),
            ("MiddlewareNext::handle", "Net"), ("middleware::MiddlewareNext::handle", "Net"),
            ("run", "Net"),
            ("DefaultResolver::resolve", "Net"), ("unversioned::resolver::DefaultResolver::resolve", "Net"),
            ("TcpConnector::connect", "Net"), ("unversioned::transport::TcpConnector::connect", "Net"),
            ("DefaultConnector::connect", "Net"), ("ConnectProxyConnector::connect", "Net"),
            ("SocksConnector::connect", "Net"), ("NativeTlsConnector::connect", "Net"),
            ("tls::native_tls::NativeTlsConnector::connect", "Net"),
            ("TcpTransport::transmit_output", "Net"), ("TcpTransport::await_input", "Net"),
            ("unversioned::transport::tcp::TcpTransport::is_open", "Net"),
            ("Config::builder", "Env"), ("config::Config::builder", "Env"), ("Config::default", "Env"),
            ("Agent::config_builder", "Env"), ("Agent::new_with_defaults", "Env"), ("Proxy::try_from_env", "Env"),
            ("proxy::Proxy::try_from_env", "Env"),
            ("Form::file", "Fs"), ("Part::file", "Fs"), ("unversioned::multipart::Part::file", "Fs"),
            ("File::as_body", "Fs"), ("Form::new", "Rand"), ("multipart::Form::new", "Rand"),
            ("Instant::now", "Clock"), ("unversioned::transport::time::Instant::now", "Clock"),
        ] {
            assert_eq!(classify("ureq", &format!("ureq::{p}")), Some(eff), "{p}");
        }
        // Rows deliberately NOT given an effect: the conditional setters, the type-argument forwarders
        // (R1553/R1554), the free verbs (R1555) and the two pure assemblers (`REVIEWED_PURE_ENTRIES`). Pure neighbours stay pure.
        for p in ["get", "post", "put", "delete", "head", "patch", "options", "trace", "connect",
                  "ConfigBuilder::timeout_global", "ConfigBuilder::user_agent", "RequestScope::config",
                  "Either::await_input", "Box::transmit_output", "ChainedConnector::connect",
                  "Agent::new_with_config", "Agent::with_parts", "Agent::config", "Config::https_only",
                  "Part::text", "Part::file_name", "Proxy::new", "Instant::duration_since"] {
            assert_eq!(classify("ureq", &format!("ureq::{p}")), None, "{p}");
        }
        // Another crate's same-named methods are not ureq's.
        assert_eq!(classify("mycrate", "mycrate::Agent::run"), None);
        assert_eq!(classify("reqwest", "reqwest::Config::builder"), None);
    }

    /// SOUNDNESS R1528 — the async-nats 0.50.0 rows that carry a rule: each EXECUTED against a nats-server with
    /// JetStream (server message / byte / subscription counters around one call), under the spellings a consumer
    /// writes (the declaring module, the `jetstream` re-export, the `PullConsumer` alias, and the receiver a builder
    /// chain inherits).
    #[test]
    fn r1528_async_nats_rows_classify() {
        for (p, eff) in [
            ("jetstream::Context::create_stream", "Net"), ("jetstream::context::Context::get_stream", "Net"),
            ("jetstream::Context::get_or_create_stream", "Net"), ("jetstream::Context::delete_stream", "Net"),
            ("jetstream::Context::update_stream", "Net"), ("jetstream::Context::create_or_update_stream", "Net"),
            ("jetstream::Context::query_account", "Net"), ("jetstream::Context::send_publish", "Net"),
            ("jetstream::Context::send_request", "Net"), ("jetstream::Context::stream_by_subject", "Net"),
            ("jetstream::Context::create_key_value", "Net"), ("jetstream::Context::get_key_value", "Net"),
            ("jetstream::Context::update_key_value", "Net"), ("jetstream::Context::delete_key_value", "Net"),
            ("jetstream::Context::create_or_update_key_value", "Net"),
            ("jetstream::Context::create_object_store", "Net"), ("jetstream::Context::get_object_store", "Net"),
            ("jetstream::Context::delete_object_store", "Net"),
            ("jetstream::Context::create_consumer_on_stream", "Net"),
            ("jetstream::Context::create_consumer_strict_on_stream", "Net"),
            ("jetstream::Context::update_consumer_on_stream", "Net"),
            ("jetstream::Context::get_consumer_from_stream", "Net"),
            ("jetstream::Context::delete_consumer_from_stream", "Net"),
            ("jetstream::stream::Stream::info", "Net"), ("jetstream::stream::Stream::get_info", "Net"),
            ("jetstream::stream::Stream::info_with_subjects", "Net"),
            ("jetstream::stream::Stream::consumer_info", "Net"), ("jetstream::stream::Stream::create_consumer", "Net"),
            ("jetstream::stream::Stream::create_consumer_strict", "Net"),
            ("jetstream::stream::Stream::update_consumer", "Net"), ("jetstream::stream::Stream::get_consumer", "Net"),
            ("jetstream::stream::Stream::get_or_create_consumer", "Net"),
            ("jetstream::stream::Stream::delete_consumer", "Net"), ("jetstream::stream::Stream::pause_consumer", "Net"),
            ("jetstream::stream::Stream::resume_consumer", "Net"), ("jetstream::stream::Stream::reset_consumer", "Net"),
            ("jetstream::stream::Stream::delete_message", "Net"), ("jetstream::stream::Stream::purge_subject", "Net"),
            ("jetstream::stream::Stream::direct_get", "Net"),
            ("jetstream::stream::Stream::direct_get_first_for_subject", "Net"),
            ("jetstream::stream::Stream::direct_get_last_for_subject", "Net"),
            ("jetstream::stream::Stream::direct_get_next_for_subject", "Net"),
            ("jetstream::stream::Stream::get_raw_message", "Net"),
            ("jetstream::stream::Stream::get_first_raw_message_by_subject", "Net"),
            ("jetstream::stream::Stream::get_next_raw_message_by_subject", "Net"),
            ("jetstream::stream::Stream::get_last_raw_message_by_subject", "Net"),
            ("jetstream::stream::Stream::send", "Net"), ("jetstream::stream::Stream::fetch", "Net"),
            ("jetstream::stream::DirectGetBuilder::send", "Net"), ("jetstream::stream::RawMessageBuilder::send", "Net"),
            ("jetstream::stream::StreamInfoBuilder::fetch", "Net"),
            ("jetstream::kv::Store::create", "Net"), ("jetstream::kv::Store::create_with_ttl", "Net"),
            ("jetstream::kv::Store::put", "Net"), ("jetstream::kv::Store::get", "Net"),
            ("jetstream::kv::Store::entry", "Net"), ("jetstream::kv::Store::entry_for_revision", "Net"),
            ("jetstream::kv::Store::update", "Net"), ("jetstream::kv::Store::delete", "Net"),
            ("jetstream::kv::Store::delete_expect_revision", "Net"), ("jetstream::kv::Store::purge", "Net"),
            ("jetstream::kv::Store::purge_with_ttl", "Net"), ("jetstream::kv::Store::purge_expect_revision", "Net"),
            ("jetstream::kv::Store::purge_expect_revision_with_ttl", "Net"),
            ("jetstream::kv::Store::history", "Net"), ("jetstream::kv::Store::keys", "Net"),
            ("jetstream::kv::Store::watch", "Net"), ("jetstream::kv::Store::watch_many", "Net"),
            ("jetstream::kv::Store::watch_from_revision", "Net"), ("jetstream::kv::Store::watch_with_history", "Net"),
            ("jetstream::kv::Store::watch_many_with_history", "Net"), ("jetstream::kv::Store::watch_all", "Net"),
            ("jetstream::kv::Store::watch_all_from_revision", "Net"),
            ("jetstream::object_store::ObjectStore::get", "Net"), ("jetstream::object_store::ObjectStore::put", "Net"),
            ("jetstream::object_store::ObjectStore::info", "Net"), ("jetstream::object_store::ObjectStore::list", "Net"),
            ("jetstream::object_store::ObjectStore::watch", "Net"),
            ("jetstream::object_store::ObjectStore::watch_with_history", "Net"),
            ("jetstream::object_store::ObjectStore::delete", "Net"), ("jetstream::object_store::ObjectStore::seal", "Net"),
            ("jetstream::object_store::ObjectStore::update_metadata", "Net"),
            ("jetstream::object_store::ObjectStore::add_link", "Net"),
            ("jetstream::object_store::ObjectStore::add_bucket_link", "Net"),
            ("jetstream::consumer::Consumer::info", "Net"), ("jetstream::consumer::Consumer::get_info", "Net"),
            ("jetstream::consumer::Consumer::reset", "Net"), ("jetstream::consumer::PullConsumer::messages", "Net"),
            ("jetstream::consumer::PushConsumer::messages", "Net"),
            ("jetstream::consumer::OrderedPullConsumer::messages", "Net"),
            ("jetstream::consumer::OrderedPushConsumer::messages", "Net"),
            ("jetstream::consumer::pull::Consumer::messages", "Net"),
            ("jetstream::consumer::push::Consumer::messages", "Net"),
            ("jetstream::consumer::pull::StreamBuilder::messages", "Net"),
            ("jetstream::consumer::pull::FetchBuilder::messages", "Net"),
            ("jetstream::consumer::pull::BatchBuilder::messages", "Net"),
            ("jetstream::Message::double_ack", "Net"), ("jetstream::message::Message::double_ack_with", "Net"),
            ("jetstream::message::Acker::double_ack", "Net"), ("jetstream::message::Acker::double_ack_with", "Net"),
            ("jetstream::Message::ack", "Net"), ("jetstream::Message::ack_with", "Net"),
            ("jetstream::message::Acker::ack", "Net"), ("jetstream::message::Acker::ack_with", "Net"),
            ("Client::add_service", "Net"), ("service::Client::add_service", "Net"), ("Client::start", "Net"),
            ("Client::send_request", "Net"), ("client::Client::send_request", "Net"),
            ("service::ServiceBuilder::start", "Net"), ("service::Service::endpoint", "Net"),
            ("service::Group::endpoint", "Net"), ("service::EndpointBuilder::add", "Net"),
            ("service::Service::add", "Net"),
            ("Client::new_inbox", "Rand"), ("client::Client::new_inbox", "Rand"), ("datetime::now", "Clock"),
        ] {
            assert_eq!(classify("async_nats", &format!("async_nats::{p}")), Some(eff), "{p}");
        }
        // NOT claimed. The four R1576 rows (a `Log` rule would delete their only disclosure, see
        // OPEN_ENTRY_VERDICTS); calls EXECUTED to touch no broker (`get_stream_no_info` builds an empty handle);
        // cached/local reads and builder constructors; the wrong module for a type of the same name.
        for p in ["jetstream::new", "jetstream::with_domain", "jetstream::with_prefix",
                  "jetstream::context::ContextBuilder::build", "jetstream::ContextBuilder::new",
                  "jetstream::Context::get_stream_no_info", "jetstream::Context::wait_for_acks",
                  "jetstream::Context::set_timeout", "jetstream::kv::Store::status",
                  "jetstream::stream::Stream::cached_info", "jetstream::stream::Stream::info_builder",
                  "jetstream::stream::Stream::direct_get_builder", "jetstream::stream::Stream::raw_message_builder",
                  "jetstream::consumer::PullConsumer::stream", "jetstream::consumer::PullConsumer::fetch",
                  "jetstream::consumer::PullConsumer::batch", "jetstream::consumer::Consumer::cached_info",
                  "service::Service::info", "service::Service::stats", "service::Service::reset",
                  "service::Service::group", "service::Service::endpoint_builder", "Client::timeout",
                  "Client::max_payload", "jetstream::consumer::pull::Stream::info", "other::Stream::info",
                  "jetstream::object_store::Object::info", "jetstream::stream::Stream::name"] {
            assert_eq!(classify("async_nats", &format!("async_nats::{p}")), None, "{p}");
        }
        // Another crate's same-named methods are not async-nats's.
        assert_eq!(classify("mycrate", "mycrate::jetstream::Context::create_stream"), None);
        assert_eq!(classify("redis", "redis::kv::Store::put"), None);
    }

    /// SOUNDNESS R1528 — the 45 rdkafka 0.39.0 rows given rules, every one EXECUTED against a real Kafka broker
    /// (counting proxy bytes / loopback listener / two clock reads), in the crate-root, re-exporting-module and
    /// declaring-module spellings; the 24 rows with a filed verdict and their pure neighbours stay unclaimed.
    #[test]
    fn r1528_rdkafka_rows_classify() {
        let mut net: Vec<String> = vec![
            "ClientConfig::create".into(), "config::ClientConfig::create".into(), "ClientConfig::create_with_context".into(),
            "config::ClientConfig::create_with_context".into(), "Client::new".into(), "client::Client::new".into(),
            "MockCluster::new".into(), "mocking::MockCluster::new".into(),
        ];
        for v in ["create_topics", "delete_topics", "create_partitions", "delete_groups", "delete_records",
                  "describe_configs", "alter_configs", "from_config", "from_config_and_context"] {
            net.push(format!("AdminClient::{v}"));
            net.push(format!("admin::AdminClient::{v}"));
        }
        for (ty, module) in [("BaseConsumer", "consumer::base_consumer"), ("StreamConsumer", "consumer::stream_consumer")] {
            for v in ["from_config", "from_config_and_context", "committed", "offsets_for_timestamp",
                      "incremental_assign", "seek_partitions"] {
                net.push(format!("{ty}::{v}"));
                net.push(format!("consumer::{ty}::{v}"));
                net.push(format!("{module}::{ty}::{v}"));
            }
        }
        for (ty, module) in [("BaseProducer", "producer::base_producer"), ("ThreadedProducer", "producer::base_producer"),
                             ("FutureProducer", "producer::future_producer")] {
            for v in ["from_config", "from_config_and_context", "init_transactions", "commit_transaction",
                      "abort_transaction", "send_offsets_to_transaction"] {
                net.push(format!("{ty}::{v}"));
                net.push(format!("producer::{ty}::{v}"));
                net.push(format!("{module}::{ty}::{v}"));
            }
        }
        for p in &net {
            assert_eq!(classify("rdkafka", &format!("rdkafka::{p}")), Some("Net"), "{p}");
        }
        for p in ["Timestamp::now", "message::Timestamp::now", "util::current_time_millis"] {
            assert_eq!(classify("rdkafka", &format!("rdkafka::{p}")), Some("Clock"), "{p}");
        }
        // EXECUTED to move no byte on a quiet client (local state / value builders), or filed (R1581/R1582/R1583).
        for p in ["BaseConsumer::assignment", "BaseConsumer::subscription", "BaseConsumer::position",
                  "BaseConsumer::incremental_unassign", "StreamConsumer::assignment", "StreamConsumer::position",
                  "BaseProducer::begin_transaction", "ThreadedProducer::begin_transaction",
                  "FutureProducer::begin_transaction", "BaseConsumer::close_queue",
                  "ClientConfig::create_native_config", "TopicPartitionList::new", "TopicPartitionList::with_capacity",
                  "TopicPartitionList::from_topic_map", "OwnedHeaders::new", "OwnedHeaders::new_with_capacity",
                  "BorrowedHeaders::detach", "BorrowedMessage::detach", "FutureProducerContext::log",
                  "FutureProducerContext::error", "FutureProducerContext::stats", "FutureProducerContext::stats_raw",
                  // the wrong module / receiver for a name that IS claimed elsewhere
                  "other::AdminClient::create_topics", "Consumer::committed", "consumer::BaseProducer::committed",
                  "producer::BaseConsumer::init_transactions", "Foo::from_config", "Timestamp::new",
                  "other::util::current_time_millis"] {
            assert_eq!(classify("rdkafka", &format!("rdkafka::{p}")), None, "{p}");
        }
        assert_eq!(classify("mycrate", "mycrate::AdminClient::create_topics"), None);
        assert_eq!(classify("lapin", "lapin::ClientConfig::create"), None);
    }

    /// SOUNDNESS R1528 — the 36 mongodb 3.9.1 rows given rules, in the crate-root, `sync` and declaring-module
    /// spellings, the creators a consumer really calls AND the macro-input spellings the generator guesses; the 8 rows
    /// with a filed verdict (R1584, R1585) and their pure neighbours stay unclaimed.
    #[test]
    fn r1528_mongodb_rows_classify() {
        let mut db: Vec<String> = vec![];
        for m in ["", "sync::"] {
            for (ty, v) in [
                ("ClientSession", "commit_transaction"), ("ClientSession", "abort_transaction"), ("ClientSession", "and_run"),
                ("ClientSession", "and_run2"), ("Client", "shutdown"), ("Client", "bulk_write"), ("Database", "drop"),
                ("Database", "run_cursor_command"), ("Collection", "drop"), ("Collection", "drop_index"),
                ("Collection", "drop_indexes"), ("Collection", "list_indexes"), ("Collection", "list_index_names"),
                ("Collection", "create_search_index"), ("Collection", "create_search_indexes"),
                ("ChangeStream", "next_if_any"), ("SessionChangeStream", "next"), ("SessionChangeStream", "next_if_any"),
                ("GridFsBucket", "delete"), ("GridFsUploadStream", "abort"),
            ] {
                db.push(format!("{m}{ty}::{v}"));
            }
        }
        for p in [
            "change_stream::ChangeStream::next_if_any", "change_stream::session::SessionChangeStream::next",
            "change_stream::session::SessionChangeStream::next_if_any", "sync::change_stream::ChangeStream::next_if_any",
            "sync::change_stream::SessionChangeStream::next", "sync::change_stream::SessionChangeStream::next_if_any",
            "action::shutdown::Client::shutdown", "gridfs::GridFsBucket::delete", "gridfs::GridFsUploadStream::abort",
            // the macro-input spellings (generator rows)
            "client::session::action::StartTransaction::and_run", "client::session::action::StartTransaction::and_run2",
            "client::session::action::AbortTransaction::execute", "client::session::action::CommitTransaction::execute",
            "client::action::shutdown::Shutdown::execute", "action::bulk_write::BulkWrite::execute",
            "action::count::CountDocuments::execute", "db::action::create_collection::CreateCollection::execute",
            "action::search_index::CreateSearchIndex::execute", "coll::action::drop::DropCollection::execute",
            "action::drop::DropDatabase::execute", "action::drop_index::DropIndex::execute", "action::find::Find::execute",
            "action::find::Find::batch", "action::find_and_modify::FindOneAndDelete::execute",
            "action::find_and_modify::FindOneAndReplace::execute", "action::find_and_modify::FindOneAndUpdate::execute",
            "action::list_collections::ListCollections::execute", "action::list_collections::ListCollections::batch",
            "action::list_databases::ListDatabases::execute", "action::list_indexes::ListIndexes::execute",
            "action::run_command::RunCommand::execute", "action::run_command::RunCursorCommand::execute",
            "action::run_command::RunCursorCommand::batch", "action::watch::Watch::execute", "Find::execute",
            "action::gridfs::delete::Delete::execute",
        ] {
            db.push(p.to_string());
        }
        for p in &db {
            assert_eq!(classify("mongodb", &format!("mongodb::{p}")), Some("Db"), "{p}");
        }
        for p in ["Callback::human", "Callback::machine", "options::oidc::Callback::human", "client::auth::oidc::Callback::machine"] {
            assert_eq!(classify("mongodb", &format!("mongodb::{p}")), Some("Clock"), "{p}");
        }
        // EXECUTED to move no byte (`start_transaction`), read and filed (R1584, R1585), or pure neighbours.
        for p in [
            "ClientSession::start_transaction", "ClientSession::end_session", "Collection::name", "Database::name",
            "Collection::namespace", "options::ClientOptions::parse", "ClientOptions::parse", "options::ConnectionString::parse",
            "ConnectionString::parse", "client::auth::AuthMechanism::validate_credential", "AuthMechanism::validate_credential",
            "client::options::parse::ParseConnectionString::execute", "ClientEncryption::new",
            "client::csfle::client_encryption::ClientEncryptionBuilder::build", "client::csfle::client_builder::EncryptedClientBuilder::build",
            "client::csfle::client_encryption::create_data_key::CreateDataKey::execute", "client::csfle::client_encryption::encrypt::Encrypt::execute",
            // wrong receiver / module for a name that IS claimed elsewhere
            "Foo::commit_transaction", "Collection::commit_transaction", "other::Client::shutdown", "Delete::execute",
            "action::delete::Delete::execute", "Callback::new", "other::Callback::human", "ChangeStream::next", "Cursor::next_if_any",
        ] {
            assert_eq!(classify("mongodb", &format!("mongodb::{p}")), None, "{p}");
        }
        assert_eq!(classify("mycrate", "mycrate::ClientSession::commit_transaction"), None);
        assert_eq!(classify("mysql_async", "mysql_async::ClientSession::commit_transaction"), None);
    }

    /// SOUNDNESS R1528 — the mysql_async 0.37.1 rows given rules (31 of 38; 5 read pure, 2 filed R1586), in the
    /// crate-root and declaring-module spellings, plus the typed / bound spellings of the `Query` family that a scan can
    /// name. The `map` name stays unclaimed on purpose: the scan attributes every `.map` off a typed root to that root.
    #[test]
    fn r1528_mysql_async_rows_classify() {
        let mut db: Vec<String> = vec![];
        for (ty, ms, vs) in [
            ("Conn", vec!["", "conn::", "conn::binlog_stream::", "queryable::"], vec!["change_user", "reset", "disconnect", "get_binlog_stream", "close", "start_transaction"]),
            ("BinlogStream", vec!["", "conn::binlog_stream::"], vec!["close"]),
            ("Connection", vec!["", "queryable::"], vec!["close"]),
            ("Transaction", vec!["", "queryable::", "queryable::transaction::"], vec!["close", "commit", "rollback"]),
            ("Pool", vec!["", "conn::pool::", "connection_like::"], vec!["start_transaction", "to_connection"]),
            ("QueryResult", vec!["", "queryable::query_result::", "queryable::query_result::result_set_stream::"],
             vec!["next", "collect", "try_collect", "collect_and_drop", "try_collect_and_drop", "for_each", "for_each_and_drop",
                  "map_and_drop", "reduce", "reduce_and_drop", "drop_result", "stream", "stream_and_drop"]),
            ("QueryWithParams", vec!["", "query::"], vec!["run", "batch", "first", "fetch", "ignore", "reduce", "stream"]),
            ("Query", vec!["prelude::"], vec!["run", "first", "fetch", "ignore", "reduce", "stream"]),
            ("BatchQuery", vec!["prelude::"], vec!["batch"]),
            ("Q", vec!["", "query::"], vec!["run"]),
        ] {
            for m in &ms {
                for v in &vs {
                    db.push(format!("{m}{ty}::{v}"));
                }
            }
        }
        for p in &db {
            assert_eq!(classify("mysql_async", &format!("mysql_async::{p}")), Some("Db"), "{p}");
        }
        for p in ["test_misc::get_opts", "test_misc::test_compression", "test_misc::test_ssl"] {
            assert_eq!(classify("mysql_async", &format!("mysql_async::{p}")), Some("Env"), "{p}");
        }
        // existing rules untouched
        assert_eq!(classify("mysql_async", "mysql_async::Conn::new"), Some("Db"));
        assert_eq!(classify("mysql_async", "mysql_async::Pool::get_conn"), Some("Db"));
        // filed (R1586), read pure (to_statement), or pure neighbours; wrong receiver for a claimed name
        for p in [
            "QueryResult::map", "queryable::query_result::QueryResult::map", "QueryWithParams::map", "prelude::Query::map",
            "opts::PathOrBuf::read", "PathOrBuf::read", "Arc::to_statement", "String::to_statement", "Vec::to_statement",
            "prelude::StatementLike::to_statement", "Conn::map", "Conn::opts", "Conn::tcp_port", "Pool::opts", "Pool::iter",
            "Transaction::last_insert_id", "TxOpts::new", "TxOpts::with_readonly", "Opts::from_url", "Params::from",
            "QueryResult::columns_ref", "QueryResult::columns", "QueryResult::affected_rows", "QueryResult::info",
            "Foo::commit", "Pool::commit", "Conn::commit", "test_misc::other", "other::test_misc::get_opts",
            "Query::map", "BatchQuery::run",
        ] {
            assert_eq!(classify("mysql_async", &format!("mysql_async::{p}")), None, "{p}");
        }
        // R1528 (b10): this asserted `None` as a name-collision control; EXECUTED against MySQL 8, `Conn::reset` sends
        // COM_RESET_CONNECTION (5 bytes up / 11 down), so the mysql one is `Db`. The mongodb one below is not claimed.
        assert_eq!(classify("mysql", "mysql::Conn::reset"), Some("Db"));
        assert_eq!(classify("mongodb", "mongodb::Conn::reset"), None);
    }

    /// SOUNDNESS R1528 — the aws-config 1.12.0 rows given rules (19 of 23 plus three siblings the generator never
    /// listed), in the declaring-module spelling and the root-typed spelling the scan produces for a chain. The
    /// negatives are the point: the scan attributes every hop off a typed root to the root, so `.region(..)` on a
    /// credentials builder arrives as `DefaultCredentialsChain::region`, and a bare `region` / `build` rule would
    /// fabricate on setters and on pure builders.
    #[test]
    fn r1528_aws_config_rows_classify() {
        for p in [
            "default_provider::endpoint_url::endpoint_url_provider",
            "default_provider::endpoint_url::endpoint_url_provider_with_origin",
            "default_provider::ignore_configured_endpoint_urls::ignore_configured_endpoint_urls_provider",
            "default_provider::checksums::request_checksum_calculation_provider",
            "default_provider::checksums::response_checksum_validation_provider",
            "default_provider::use_dual_stack::use_dual_stack_provider",
            "default_provider::use_fips::use_fips_provider",
            "default_provider::app_name::Builder::app_name",
            "default_provider::retry_config::Builder::retry_config",
            "profile::region::ProfileFileRegionProvider::region",
        ] {
            assert_eq!(classify("aws_config", &format!("aws_config::{p}")), Some("Fs"), "{p}");
        }
        for p in [
            "default_provider::region::DefaultRegionChain::region",
            "imds::region::ImdsRegionProvider::region",
            "provider_config::ProviderConfig::load_default_region",
            "provider_config::ProviderConfig::with_default_region",
            "default_provider::credentials::DefaultCredentialsChain::build",
            "default_provider::credentials::Builder::build",
            "default_provider::credentials::default_provider",
            "default_provider::token::DefaultTokenChain::build",
            "default_provider::token::Builder::build",
            "default_provider::token::default_provider",
            "sts::AssumeRoleProvider::build",
            "sts::AssumeRoleProvider::build_from_provider",
            "sts::assume_role::AssumeRoleProviderBuilder::build",
            "sts::assume_role::AssumeRoleProviderBuilder::build_from_provider",
            "sso::token::SsoTokenProvider::build",
            "sso::token::Builder::build",
            "ecs::EcsCredentialsProvider::credentials",
        ] {
            assert_eq!(classify("aws_config", &format!("aws_config::{p}")), Some("Net"), "{p}");
        }
        // filed (R1588), setters the scan attributes to a root, pure builders, and the existing `.load()` rule
        for p in [
            "meta::region::Box::region", "meta::region::RegionProviderChain::region",
            "profile::credentials::Builder::build", "profile::token::Builder::build",
            "profile::ProfileFileCredentialsProvider::build", "profile::ProfileFileTokenProvider::build",
            "default_provider::credentials::DefaultCredentialsChain::region",
            "default_provider::token::DefaultTokenChain::region",
            "sso::token::SsoTokenProvider::region", "sso::token::SsoTokenProvider::session_name",
            "default_provider::region::DefaultRegionChain::build",
            "default_provider::region::DefaultRegionChain::profile_name",
            "default_provider::region::default_provider", "default_provider::timeout_config::Builder::timeout_config",
            "provider_config::ProviderConfig::empty", "provider_config::ProviderConfig::with_region",
            "sts::AssumeRoleProvider::configure", "sts::AssumeRoleProvider::builder",
            "imds::region::ImdsRegionProvider::build", "ecs::EcsCredentialsProvider::build",
            "default_provider::use_fips::other", "other::default_provider::credentials::DefaultCredentialsChain::build",
        ] {
            assert_eq!(classify("aws_config", &format!("aws_config::{p}")), None, "{p}");
        }
        assert_eq!(classify("aws_config", "aws_config::loader::ConfigLoader::load"), Some("Net"));
        assert_eq!(classify("mycrate", "mycrate::default_provider::use_fips::use_fips_provider"), None);
    }

    /// SOUNDNESS R1528 — the sqlx-core 0.9.0 rows given rules (10 of 22; 2 read pure, 8 conditional and 2 silent filed),
    /// under the `sqlx_core` spelling and the `sqlx` facade spelling a facade consumer actually produces.
    #[test]
    fn r1528_sqlx_core_rows_classify() {
        for (k, p, e) in [
            ("sqlx_core", "pool::Pool::begin_with", "Db"), ("sqlx_core", "Pool::begin_with", "Db"),
            ("sqlx", "PgPool::begin_with", "Db"), ("sqlx", "Pool::begin_with", "Db"), ("sqlx", "MySqlPool::begin_with", "Db"),
            ("sqlx_core", "pool::PoolConnection::close", "Net"), ("sqlx", "pool::PoolConnection::close", "Net"),
            ("sqlx_core", "pool::connection::PoolConnection::close", "Net"),
            ("sqlx_core", "pool::PoolConnection::return_to_pool", "Db"), ("sqlx", "pool::PoolConnection::return_to_pool", "Db"),
            ("sqlx_core", "net::connect_tcp", "Net"), ("sqlx_core", "net::socket::connect_tcp", "Net"),
            ("sqlx_core", "migrate::Migrator::new", "Fs"), ("sqlx_core", "migrate::migrator::Migrator::new", "Fs"),
            ("sqlx", "migrate::Migrator::new", "Fs"),
            ("sqlx_core", "fs::ReadDir::next", "Fs"),
            ("sqlx_core", "migrate::source::resolve_blocking", "Fs"),
            ("sqlx_core", "migrate::source::resolve_blocking_with_config", "Fs"),
            ("sqlx_core", "migrate::resolve_blocking", "Fs"),
            ("sqlx_core", "logger::QueryLogger::new", "Clock"), ("sqlx_core", "logger::QueryLogger::finish", "Log"),
        ] {
            assert_eq!(classify(k, &format!("{k}::{p}")), Some(e), "{k}::{p}");
        }
        // read pure (detach, leak), filed (connect_lazy, Box poll_*, resolve) and pure neighbours stay unclaimed
        for (k, p) in [
            ("sqlx_core", "pool::PoolConnection::detach"), ("sqlx_core", "pool::PoolConnection::leak"),
            ("sqlx", "pool::PoolConnection::detach"), ("sqlx", "pool::PoolConnection::leak"),
            ("sqlx_core", "pool::Pool::connect_lazy"), ("sqlx_core", "pool::Pool::connect_lazy_with"),
            ("sqlx_core", "pool::PoolOptions::connect_lazy"), ("sqlx_core", "pool::PoolOptions::connect_lazy_with"),
            // R1623: `PgPool::connect_lazy(url)` / `PgPoolOptions::connect_lazy(url)` are NOT pure: they parse the URL (12 PG* getenv,
            // EXECUTED), charged Env + Fs; the 0 CONNECTIONS of R1589 stands. `MySqlPool::connect_lazy` parses nothing: pure.
            ("sqlx", "MySqlPool::connect_lazy"), ("sqlx", "sqlite::SqlitePool::connect_lazy"),
            ("sqlx_core", "net::socket::Box::poll_flush"), ("sqlx_core", "net::Socket::poll_read_ready"),
            ("sqlx_core", "migrate::source::PathBuf::resolve"), ("sqlx_core", "migrate::source::ResolveWith::resolve"),
            ("sqlx_core", "migrate::ResolveConfig::new"), ("sqlx_core", "logger::QueryLogger::sql"),
            ("sqlx_core", "logger::QueryLogger::increment_rows_returned"),
            ("sqlx_core", "pool::PoolOptions::max_connections"), ("sqlx_core", "pool::PoolConnection::close_on_drop"),
            ("sqlx", "postgres::PgPoolOptions::new"), ("sqlx", "PgPool::size"), ("sqlx", "other::PgPool::begin_with"),
            ("sqlx", "Connection::close"), ("sqlx", "Transaction::new"),
        ] {
            assert_eq!(classify(k, &format!("{k}::{p}")), None, "{k}::{p}");
        }
        // `net::connect_tcp` is the `sqlx_core` re-export; a facade spelling of the same name is not claimed
        assert_eq!(classify("sqlx", "sqlx::net::connect_tcp"), None);
        assert_eq!(classify("mycrate", "mycrate::pool::PoolConnection::close"), None);
    }

    /// SOUNDNESS R1528 — the redis 1.7.1 rows given rules (13 of 21; 2 read pure, 6 filed), in the crate-root, the
    /// re-export and the declaring-module spellings. `Sentinel::build` was a deliberate `None` (R335: "parses URLs");
    /// it draws a random replica index but a `Rand` rule there deleted the disclosure of the `Db` that follows (R1590:silent), so it stays unclaimed.
    #[test]
    fn r1528_redis_rows_classify() {
        for (p, e) in [
            ("Client::is_open", "Db"), ("client::Client::is_open", "Db"), ("Client::check_connection", "Db"),
            ("Client::get_async_pubsub", "Db"), ("client::Client::get_async_monitor", "Db"),
            ("Cmd::iter_async", "Db"), ("cmd::Cmd::iter_async", "Db"),
            ("aio::MultiplexedConnection::send_packed_command", "Db"),
            ("aio::MultiplexedConnection::send_packed_commands", "Db"),
            ("aio::multiplexed_connection::MultiplexedConnection::send_packed_command", "Db"),
            ("aio::MultiplexedConnection::connect_with_config", "Db"),
            ("cluster_handling::async_connection::MultiplexedConnection::connect_with_config", "Db"),
            ("cluster::ClusterConnection::route_command", "Db"), ("cluster_async::ClusterConnection::route_command", "Db"),
            ("cluster_handling::sync_connection::ClusterConnection::route_command", "Db"),
            ("cluster_handling::async_connection::ClusterConnection::route_command", "Db"),
            ("cluster::ClusterPipeline::exec", "Db"), ("cluster_handling::sync_connection::pipeline::ClusterPipeline::exec", "Db"),
            ("cluster::ClusterClient::get_pending_async_connection_with_config", "Db"),
            ("cluster_handling::client::ClusterClient::get_pending_async_connection_with_config", "Db"),
            ("cluster_read_routing::Replicas::choose_random", "Rand"),
            ("cluster_handling::read_routing::interface::Replicas::choose_random", "Rand"),
            ("cluster_read_routing::RandomReplicaStrategy::route_read", "Rand"),
            ("cluster_handling::read_routing::random_replica::RandomReplicaStrategy::route_read", "Rand"),
        ] {
            assert_eq!(classify("redis", &format!("redis::{p}")), Some(e), "{p}");
        }
        // read pure (build_with_tls, cluster builder build), filed (new / new_with_config / entra start), neighbours;
        // the receiver-name guards: `is_open` on a Connection, `route_command` on a non-cluster type
        for p in [
            "Client::build_with_tls", "client::Client::build_with_tls", "cluster::ClusterClient::build",
            "cluster_handling::client::ClusterClientBuilder::build", "cluster::ClusterClientBuilder::retries",
            "aio::MultiplexedConnection::new", "aio::MultiplexedConnection::new_with_config",
            "aio::multiplexed_connection::MultiplexedConnection::new",
            "entra_id::EntraIdCredentialsProvider::start", "Client::open", "Client::get_connection_info",
            "Connection::is_open", "aio::MultiplexedConnection::is_open", "Other::route_command",
            "cluster::ClusterClient::builder", "cluster_read_routing::Replicas::new", "cluster_read_routing::Replicas::iter",
            "sentinel::Sentinel::new", "sentinel::SentinelClientBuilder::set_client_to_redis_db",
            "sentinel::Sentinel::build", "sentinel::SentinelClient::build", "sentinel::SentinelClientBuilder::build",
            "other::Client::is_open", "Cmd::arg", "Cmd::new",
        ] {
            assert_eq!(classify("redis", &format!("redis::{p}")), None, "{p}");
        }
        assert_eq!(classify("mycrate", "mycrate::Client::is_open"), None);
    }

    /// SOUNDNESS R1528 — the 18 reachable rusqlite rows, every one EXECUTED against a consumer fixture, with
    /// same-type pure neighbours left unclaimed. Both the crate-root and the declaring-module spelling.
    #[test]
    fn r1528_rusqlite_reachable_rows_classify() {
        for p in ["Connection::close", "Connection::cache_flush", "Connection::serialize", "Connection::deserialize",
                  "Connection::deserialize_bytes", "Connection::deserialize_read_exact",
                  "Connection::load_extension", "Connection::load_extension_enable",
                  "Connection::load_extension_disable", "Connection::query_row_and_then",
                  "Connection::prepare_with_flags", "Statement::exists", "LoadExtensionGuard::new",
                  "Wal::checkpoint", "Wal::checkpoint_v2", "serialize::Connection::serialize",
                  "statement::Statement::exists", "hooks::Wal::checkpoint_v2",
                  "load_extension_guard::LoadExtensionGuard::new",
                  "register_auto_extension", "cancel_auto_extension", "reset_auto_extension",
                  "auto_extension::register_auto_extension", "auto_extension::cancel_auto_extension",
                  "auto_extension::reset_auto_extension"] {
            assert_eq!(classify("rusqlite", &format!("rusqlite::{p}")), Some("Db"), "{p}");
        }
        // The two SQL-text verbs are table members, so the masking guard reads them (SQL at argument 0).
        for v in ["query_row_and_then", "prepare_with_flags"] {
            assert!(masks_locator("Db", "rusqlite", &format!("rusqlite::Connection::{v}"), v, true), "{v}");
        }
        // Same-type neighbours that touch no database stay unclaimed.
        for p in ["Connection::is_autocommit", "Connection::changes", "Connection::last_insert_rowid",
                  "Connection::is_busy", "Connection::is_readonly", "Connection::path", "Statement::column_count",
                  "Wal::name", "LoadExtensionGuard::drop", "Connection::handle"] {
            assert_eq!(classify("rusqlite", &format!("rusqlite::{p}")), None, "{p}");
        }
        // Another crate's same-named method is not rusqlite's.
        assert_eq!(classify("mycrate", "mycrate::Connection::close"), None);
        assert_eq!(classify("tokio_postgres", "tokio_postgres::Connection::close"), None);
    }

    /// SOUNDNESS R1528 (isahc 2.0.1) — the HTTP client method spellings and `TrustStore::native`, in the root-typed
    /// spelling the scan produces and the declaring-module one the manifest row names. The negatives are the cookie jar and
    /// `Response::text` (filed R1592, conditional) and the same names on another crate.
    #[test]
    fn r1528_isahc_rows_classify() {
        for m in ["get_async", "head_async", "post_async", "put_async", "delete_async", "send_async"] {
            assert_eq!(classify("isahc", &format!("isahc::HttpClient::{m}")), Some("Net"), "{m}");
            assert_eq!(classify("isahc", &format!("isahc::client::HttpClient::{m}")), Some("Net"), "{m}");
        }
        assert_eq!(classify("isahc", "isahc::Request::send_async"), Some("Net"));
        assert_eq!(classify("isahc", "isahc::request::Request::send_async"), Some("Net"));
        assert_eq!(classify("isahc", "isahc::tls::TrustStore::native"), Some("Env"));
        assert_eq!(classify("isahc", "isahc::tls::trust::TrustStore::native"), Some("Env"));
        for p in ["cookies::CookieJar::get_by_name", "cookies::CookieJar::get_for_uri", "cookies::CookieJar::set",
                  "cookies::jar::CookieJar::set", "Response::text", "response::Response::text", "HttpClient::builder",
                  "TrustStore::webpki_roots", "TrustStore::from_file", "tls::TrustStore::from_file"] {
            assert_eq!(classify("isahc", &format!("isahc::{p}")), None, "{p}");
        }
        assert_eq!(classify("mycrate", "mycrate::HttpClient::get_async"), None);
    }

    /// SOUNDNESS R1528 (lettre 0.11.23) — both the `MessageBuilder` (typed receiver) and the root `Message` (chain)
    /// spellings, since the scan attributes `Message::builder().from(..).body(..)` to `Message::body`.
    #[test]
    fn r1528_lettre_rows_classify() {
        for t in ["MessageBuilder", "Message"] {
            for m in ["body", "singlepart", "multipart", "date_now"] {
                assert_eq!(classify("lettre", &format!("lettre::message::{t}::{m}")), Some("Clock"), "{t}::{m}");
            }
            assert_eq!(classify("lettre", &format!("lettre::message::{t}::message_id")), Some("Rand"), "{t}");
        }
        for p in ["message::Message::sign", "message::header::Date::now", "message::header::date::Date::now",
                  "message::dkim::dkim_sign"] {
            assert_eq!(classify("lettre", &format!("lettre::{p}")), Some("Clock"), "{p}");
        }
        for p in ["message::MultiPartBuilder::kind", "message::MultiPart::kind", "message::mimebody::MultiPartBuilder::kind",
                  "message::MultiPart::mixed", "message::MultiPart::alternative", "message::MultiPart::related",
                  "message::MultiPart::signed", "message::MultiPart::encrypted", "message::MultiPart::alternative_plain_html"] {
            assert_eq!(classify("lettre", &format!("lettre::{p}")), Some("Rand"), "{p}");
        }
        for p in ["AsyncFileTransport::read", "transport::file::AsyncFileTransport::read", "Executor::fs_read",
                  "Executor::fs_write", "Tokio1Executor::fs_read", "executor::Tokio1Executor::fs_write",
                  "AsyncStd1Executor::fs_read"] {
            assert_eq!(classify("lettre", &format!("lettre::{p}")), Some("Fs"), "{p}");
        }
        // Filed R1592 / read pure: no rule. And the pure siblings of the Clock / Rand rows stay unclaimed.
        for p in ["transport::smtp::SmtpTransportBuilder::build", "transport::smtp::AsyncSmtpTransportBuilder::build",
                  "transport::smtp::transport::SmtpTransport::unencrypted_localhost",
                  "transport::smtp::async_transport::AsyncSmtpTransport::unencrypted_localhost",
                  "transport::smtp::commands::Auth::new_from_response", "message::Message::builder",
                  "message::Message::to", "message::Message::subject", "message::MessageBuilder::subject",
                  "message::MessageBuilder::date", "message::Message::date", "message::MultiPart::builder",
                  "message::MultiPart::singlepart", "message::MultiPartBuilder::boundary", "message::Message::formatted",
                  "message::header::Date::new", "message::SinglePart::plain"] {
            assert_eq!(classify("lettre", &format!("lettre::{p}")), None, "{p}");
        }
        assert_eq!(classify("mycrate", "mycrate::message::Message::body"), None);
    }

    /// SOUNDNESS R1528 (lapin 4.12.0) — the connection openers, `update_secret`, the two generated channel verbs and the
    /// acker. `connector`, `run`, `set_delegate` (filed R1593, conditional) and `wait_for_confirms` (read pure) stay
    /// unclaimed, as do same-named methods on other types (`Channel::reject`, `Connection::ack`).
    #[test]
    fn r1528_lapin_rows_classify() {
        for m in ["connect_uri", "connect_uri_with_runtime", "connect_uri_with_config", "connect_with_config",
                  "connect_with_runtime", "update_secret"] {
            assert_eq!(classify("lapin", &format!("lapin::Connection::{m}")), Some("Net"), "{m}");
            assert_eq!(classify("lapin", &format!("lapin::connection::Connection::{m}")), Some("Net"), "{m}");
        }
        for p in ["AMQPUri::connect_with_config", "uri::AMQPUri::connect_with_config",
                  "connection::AMQPUri::connect_with_config", "Connect::connect_with_config"] {
            assert_eq!(classify("lapin", &format!("lapin::{p}")), Some("Net"), "{p}");
        }
        for m in ["access_request", "channel_flow"] {
            assert_eq!(classify("lapin", &format!("lapin::Channel::{m}")), Some("Net"), "{m}");
            assert_eq!(classify("lapin", &format!("lapin::generated::channel::Channel::{m}")), Some("Net"), "{m}");
        }
        for m in ["ack", "nack", "reject"] {
            assert_eq!(classify("lapin", &format!("lapin::Acker::{m}")), Some("Net"), "{m}");
            assert_eq!(classify("lapin", &format!("lapin::acker::Acker::{m}")), Some("Net"), "{m}");
        }
        for p in ["Connection::connector", "connection::Connection::connector", "Connection::run",
                  "connection::Connection::run", "Consumer::set_delegate", "consumer::Consumer::set_delegate",
                  "Channel::wait_for_confirms", "channel::Channel::wait_for_confirms", "Channel::reject",
                  "Connection::ack", "Connection::status", "Channel::status", "Acker::poisoned", "Acker::usable",
                  "ConnectionProperties::default", "runtime::default_runtime"] {
            assert_eq!(classify("lapin", &format!("lapin::{p}")), None, "{p}");
        }
        // The existing `::connect` rule is untouched.
        assert_eq!(classify("lapin", "lapin::Connection::connect"), Some("Net"));
        assert_eq!(classify("mycrate", "mycrate::Acker::ack"), None);
    }

    /// SOUNDNESS R1528 (tonic 0.14.6) — `Server::serve{,_with_shutdown}` IS the quickstart (`Server::builder().add_service(..)
    /// .serve(addr)` reaches classify as `Server::serve`, the scan attributing every chain hop to the root type) and
    /// `TcpIncoming::bind`. The filed R1594 rows (`serve_with_incoming*`, `tls_config*`, `Streaming`, `Code`, `Status`) stay
    /// unclaimed.
    #[test]
    fn r1528_tonic_rows_classify() {
        for p in ["Server::serve", "Server::serve_with_shutdown", "transport::Server::serve", "transport::Server::serve_with_shutdown",
                  "transport::server::Server::serve", "transport::server::Server::serve_with_shutdown",
                  "TcpIncoming::bind", "transport::server::TcpIncoming::bind", "transport::server::incoming::TcpIncoming::bind"] {
            assert_eq!(classify("tonic", &format!("tonic::{p}")), Some("Net"), "{p}");
        }
        for p in ["transport::Server::serve_with_incoming", "transport::Server::serve_with_incoming_shutdown",
                  "transport::server::Server::serve_with_incoming", "transport::server::Router::serve_with_incoming",
                  "transport::server::Router::serve_with_incoming_shutdown",
                  "transport::Endpoint::tls_config", "transport::Endpoint::tls_config_with_verifier",
                  "transport::ClientTlsConfig::with_native_roots", "transport::ClientTlsConfig::use_key_log",
                  "Code::from_bytes", "Status::from_header_map", "Streaming::message", "Streaming::trailers",
                  "transport::Server::builder", "transport::Server::add_service", "transport::Server::tcp_nodelay",
                  "transport::server::TcpIncoming::with_nodelay"] {
            assert_eq!(classify("tonic", &format!("tonic::{p}")), None, "{p}");
        }
        // Rules that predate this row stay: the Router spelling, the connect family and the old constructor.
        assert_eq!(classify("tonic", "tonic::transport::server::Router::serve"), Some("Net"));
        assert_eq!(classify("tonic", "tonic::transport::Endpoint::connect"), Some("Net"));
        assert_eq!(classify("mycrate", "mycrate::Server::serve"), None);
    }
}