diff --git a/outbound-hosts.json b/outbound-hosts.json
index 7d092a07..0f0a2dbb 100644
--- a/outbound-hosts.json
+++ b/outbound-hosts.json
@@ -8,24 +8,23 @@
       "user_data": "true when the request itself discloses something about the user or their work \u2014 a repo name in the path, an account token, their IP. false for anonymous public fetches.",
       "readme": "true when this host must appear in the README outbound table. Every user_data host must.",
       "request_from": "Files allowed to actually REACH this host. A whole-file permission, because a file listed here is declared to be a caller of this host.",
-      "link_from": "Places the host appears as something the USER clicks, never a request this code makes. Pinned per URL: {\"file\": ..., \"url\": ...}, where url is the literal as the scanner reads it. A bare filename is rejected — it waived the whole file forever, so a later <img src> in that file passed silently, which is the shape of #100.",
-      "data_from": "Same pinned form. The host is a value this codebase stores or renders and never fetches — a mock fixture's project_ref, for instance."
+      "link_from": "Places the host appears as something the USER clicks, never a request this code makes. Pinned per URL: {\"file\": ..., \"url\": ...}, where url is the literal as the scanner reads it. A bare filename is rejected \u2014 it waived the whole file forever, so a later <img src> in that file passed silently, which is the shape of #100.",
+      "data_from": "Same pinned form. The host is a value this codebase stores or renders and never fetches \u2014 a mock fixture's project_ref, for instance.",
+      "unresolved_authorities": "Authorities the scanner cannot reduce to a host. Dropping them silently meant a destination it could not model went unmentioned; failing closed with no list fired on ordinary code and would have got the check switched off. So each is declared with a why, matched on file + authority text, and a NEW one fails CI."
     }
   },
   "hosts": [
     {
-      "host": "raw.githubusercontent.com",
-      "from": "server",
+      "host": "1.1.1.1",
+      "from": "browser",
       "user_data": true,
       "readme": true,
-      "purpose": "Two uses. The public LiteLLM price list (anonymous, nothing sent, works offline from a bundled snapshot), and downloading the FILES of a public skill you chose to install \u2014 that request carries the repository owner, name, branch and file path.",
+      "purpose": "IP-check page only: Cloudflare's trace endpoint, which is how the page learns your public IP. Showing you your own IP is that page's entire purpose.",
       "seen_in": [
-        "src/lib/pricing/litellm-fetcher.js",
-        "src/lib/skills-manager.js"
+        "dashboard/src/pages/IpCheckPage.jsx"
       ],
       "request_from": [
-        "src/lib/pricing/litellm-fetcher.js",
-        "src/lib/skills-manager.js"
+        "dashboard/src/pages/IpCheckPage.jsx"
       ]
     },
     {
@@ -42,89 +41,93 @@
       ]
     },
     {
-      "host": "chatgpt.com",
-      "from": "server",
+      "host": "api.github.com",
+      "from": "both",
       "user_data": true,
       "readme": true,
-      "purpose": "Codex plan limits for the signed-in account.",
+      "purpose": "Server: GitHub Copilot quota for the signed-in account. Browser: the header star count for THIS repository only \u2014 a fixed public repo that says nothing about the user. The per-project variant, which put a repo you have checked out in the URL path, was removed in #100. Also used server-side by the Skills tab to read public repository metadata.",
       "seen_in": [
+        "dashboard/src/ui/components/HeaderGithubStar.jsx",
+        "src/lib/skills-manager.js",
         "src/lib/usage-limits.js"
       ],
       "request_from": [
+        "dashboard/src/ui/components/HeaderGithubStar.jsx",
+        "src/lib/skills-manager.js",
         "src/lib/usage-limits.js"
       ]
     },
     {
-      "host": "api.openai.com",
+      "host": "api.kimi.com",
       "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "OpenAI usage/limits for the signed-in account.",
+      "purpose": "Kimi plan usage for the signed-in account.",
       "seen_in": [
-        "src/lib/subscriptions.js"
+        "src/lib/usage-limits.js"
       ],
       "request_from": [
-        "src/lib/subscriptions.js"
+        "src/lib/usage-limits.js"
       ]
     },
     {
-      "host": "auth.openai.com",
+      "host": "api.openai.com",
       "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "Refreshes the OpenAI credential when it expires.",
+      "purpose": "OpenAI usage/limits for the signed-in account.",
       "seen_in": [
-        "src/lib/codex-token-refresh.js"
+        "src/lib/subscriptions.js"
       ],
       "request_from": [
-        "src/lib/codex-token-refresh.js"
+        "src/lib/subscriptions.js"
       ]
     },
     {
-      "host": "cursor.com",
+      "host": "api.z.ai",
       "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "Cursor plan usage for the signed-in account.",
+      "purpose": "Z.AI / GLM coding-plan quota, using ZAI_API_KEY or a reused Anthropic-compatible token.",
       "seen_in": [
-        "src/lib/cursor-config.js"
+        "src/lib/usage-limits.js"
       ],
       "request_from": [
-        "src/lib/cursor-config.js"
+        "src/lib/usage-limits.js"
       ]
     },
     {
-      "host": "www.cursor.com",
+      "host": "auth.kimi.com",
       "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "Same as cursor.com; both hosts appear in Cursor's own endpoints.",
+      "purpose": "Refreshes the Kimi credential when it expires.",
       "seen_in": [
-        "src/lib/cursor-config.js"
+        "src/lib/usage-limits.js"
       ],
       "request_from": [
-        "src/lib/cursor-config.js"
+        "src/lib/usage-limits.js"
       ]
     },
     {
-      "host": "cloudcode-pa.googleapis.com",
+      "host": "auth.openai.com",
       "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "Gemini Code Assist quota for the signed-in account.",
+      "purpose": "Refreshes the OpenAI credential when it expires.",
       "seen_in": [
-        "src/lib/usage-limits.js"
+        "src/lib/codex-token-refresh.js"
       ],
       "request_from": [
-        "src/lib/usage-limits.js"
+        "src/lib/codex-token-refresh.js"
       ]
     },
     {
-      "host": "oauth2.googleapis.com",
+      "host": "chatgpt.com",
       "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "Refreshes the Google credential when it expires.",
+      "purpose": "Codex plan limits for the signed-in account.",
       "seen_in": [
         "src/lib/usage-limits.js"
       ],
@@ -133,24 +136,24 @@
       ]
     },
     {
-      "host": "api.kimi.com",
-      "from": "server",
+      "host": "claude.ai",
+      "from": "browser",
       "user_data": true,
       "readme": true,
-      "purpose": "Kimi plan usage for the signed-in account.",
+      "purpose": "IP-check page only: a reachability probe measuring whether Anthropic is reachable from this network.",
       "seen_in": [
-        "src/lib/usage-limits.js"
+        "dashboard/src/pages/IpCheckPage.jsx"
       ],
       "request_from": [
-        "src/lib/usage-limits.js"
+        "dashboard/src/pages/IpCheckPage.jsx"
       ]
     },
     {
-      "host": "auth.kimi.com",
+      "host": "cloudcode-pa.googleapis.com",
       "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "Refreshes the Kimi credential when it expires.",
+      "purpose": "Gemini Code Assist quota for the signed-in account.",
       "seen_in": [
         "src/lib/usage-limits.js"
       ],
@@ -159,33 +162,29 @@
       ]
     },
     {
-      "host": "api.z.ai",
+      "host": "cursor.com",
       "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "Z.AI / GLM coding-plan quota, using ZAI_API_KEY or a reused Anthropic-compatible token.",
+      "purpose": "Cursor plan usage for the signed-in account.",
       "seen_in": [
-        "src/lib/usage-limits.js"
+        "src/lib/cursor-config.js"
       ],
       "request_from": [
-        "src/lib/usage-limits.js"
+        "src/lib/cursor-config.js"
       ]
     },
     {
-      "host": "api.github.com",
-      "from": "both",
+      "host": "d.ip.net.coffee",
+      "from": "browser",
       "user_data": true,
       "readme": true,
-      "purpose": "Server: GitHub Copilot quota for the signed-in account. Browser: the header star count for THIS repository only \u2014 a fixed public repo that says nothing about the user. The per-project variant, which put a repo you have checked out in the URL path, was removed in #100. Also used server-side by the Skills tab to read public repository metadata.",
+      "purpose": "IP-check page only. The browser loads image probes at a unique per-run subdomain so ip.net.coffee's authoritative DNS server can observe WHICH RESOLVER asked \u2014 that is how the page detects a DNS leak, and it is the page's stated purpose. The hostname is built by interpolation, which is why an earlier version of this check could not see the destination at all.",
       "seen_in": [
-        "dashboard/src/ui/components/HeaderGithubStar.jsx",
-        "src/lib/skills-manager.js",
-        "src/lib/usage-limits.js"
+        "dashboard/src/pages/IpCheckPage.jsx"
       ],
       "request_from": [
-        "dashboard/src/ui/components/HeaderGithubStar.jsx",
-        "src/lib/skills-manager.js",
-        "src/lib/usage-limits.js"
+        "dashboard/src/pages/IpCheckPage.jsx"
       ]
     },
     {
@@ -195,6 +194,7 @@
       "readme": false,
       "purpose": "Link targets only \u2014 the repository, releases and skill sources, which are requests the user makes by clicking. The server never fetches github.com: skills-manager builds these URLs for the UI and fetches api.github.com and raw.githubusercontent.com instead. No avatar or image is loaded from here (issue 100).",
       "seen_in": [
+        "dashboard/index.html",
         "dashboard/src/components/LocalOnlyNotice.jsx",
         "dashboard/src/lib/mock-data.ts",
         "dashboard/src/pages/SkillDetailPanel.jsx",
@@ -239,6 +239,14 @@
         {
           "file": "src/lib/skills-manager.js",
           "url": "https://github.com/${owner}/${repoName}"
+        },
+        {
+          "file": "dashboard/index.html",
+          "url": "https://github.com/mm7894215/TokenTracker"
+        },
+        {
+          "file": "dashboard/index.html",
+          "url": "https://github.com/mm7894215/TokenTracker/issues"
         }
       ],
       "data_from": [
@@ -249,16 +257,33 @@
       ]
     },
     {
-      "host": "skills.sh",
+      "host": "ip.net.coffee",
+      "from": "both",
+      "user_data": true,
+      "readme": true,
+      "purpose": "Backs the optional IP-check page. The server proxies the data endpoints at /proxy/ipcheck; the browser also loads image probes directly. Only reached when that page is opened. The dev server proxies the same endpoints (dashboard/vite.config.js), so 5173 behaves like the packaged build.",
+      "seen_in": [
+        "dashboard/src/pages/IpCheckPage.jsx",
+        "dashboard/vite.config.js",
+        "src/lib/local-api.js"
+      ],
+      "request_from": [
+        "dashboard/src/pages/IpCheckPage.jsx",
+        "dashboard/vite.config.js",
+        "src/lib/local-api.js"
+      ]
+    },
+    {
+      "host": "oauth2.googleapis.com",
       "from": "server",
-      "user_data": false,
+      "user_data": true,
       "readme": true,
-      "purpose": "Public skills directory searched by the Skills tab. Sends the terms you typed. Installing a skill then reads repository metadata from api.github.com and files from raw.githubusercontent.com, which carry owner, repo, branch and path. No usage data is attached to any of it.",
+      "purpose": "Refreshes the Google credential when it expires.",
       "seen_in": [
-        "src/lib/skills-manager.js"
+        "src/lib/usage-limits.js"
       ],
       "request_from": [
-        "src/lib/skills-manager.js"
+        "src/lib/usage-limits.js"
       ]
     },
     {
@@ -275,39 +300,57 @@
       ]
     },
     {
-      "host": "ip.net.coffee",
-      "from": "both",
+      "host": "raw.githubusercontent.com",
+      "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "Backs the optional IP-check page. The server proxies the data endpoints at /proxy/ipcheck; the browser also loads image probes directly. Only reached when that page is opened.",
+      "purpose": "Two uses. The public LiteLLM price list (anonymous, nothing sent, works offline from a bundled snapshot), and downloading the FILES of a public skill you chose to install \u2014 that request carries the repository owner, name, branch and file path. The vendored seed is built by scripts/build-pricing-seed.cjs, which fetches that same list; the seed file records the source URL as a value and fetches nothing.",
       "seen_in": [
-        "dashboard/src/pages/IpCheckPage.jsx",
-        "src/lib/local-api.js"
+        "scripts/build-pricing-seed.cjs",
+        "src/lib/pricing/litellm-fetcher.js",
+        "src/lib/pricing/seed-snapshot.json",
+        "src/lib/skills-manager.js"
       ],
       "request_from": [
-        "dashboard/src/pages/IpCheckPage.jsx",
-        "src/lib/local-api.js"
+        "scripts/build-pricing-seed.cjs",
+        "src/lib/pricing/litellm-fetcher.js",
+        "src/lib/skills-manager.js"
+      ],
+      "data_from": [
+        {
+          "file": "src/lib/pricing/seed-snapshot.json",
+          "url": "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json"
+        }
       ]
     },
     {
-      "host": "d.ip.net.coffee",
-      "from": "browser",
-      "user_data": true,
+      "host": "registry.npmjs.org",
+      "from": "server",
+      "user_data": false,
       "readme": true,
-      "purpose": "IP-check page only. The browser loads image probes at a unique per-run subdomain so ip.net.coffee's authoritative DNS server can observe WHICH RESOLVER asked \u2014 that is how the page detects a DNS leak, and it is the page's stated purpose. The hostname is built by interpolation, which is why an earlier version of this check could not see the destination at all.",
+      "purpose": "Not called by our code \u2014 this is npx fetching the package when TokenTracker is started that way. Listed because a user watching their network sees it and deserves an explanation.",
+      "seen_in": [],
+      "request_from": []
+    },
+    {
+      "host": "skills.sh",
+      "from": "server",
+      "user_data": false,
+      "readme": true,
+      "purpose": "Public skills directory searched by the Skills tab. Sends the terms you typed. Installing a skill then reads repository metadata from api.github.com and files from raw.githubusercontent.com, which carry owner, repo, branch and path. No usage data is attached to any of it.",
       "seen_in": [
-        "dashboard/src/pages/IpCheckPage.jsx"
+        "src/lib/skills-manager.js"
       ],
       "request_from": [
-        "dashboard/src/pages/IpCheckPage.jsx"
+        "src/lib/skills-manager.js"
       ]
     },
     {
-      "host": "stun.l.google.com",
+      "host": "stun.cloudflare.com",
       "from": "browser",
       "user_data": true,
       "readme": true,
-      "purpose": "IP-check page only. A WebRTC STUN binding request to Google, which is how the page detects whether a VPN leaks your real address \u2014 the probe necessarily discloses that address to the STUN server. Only reached when that page is opened. The `stun:` scheme has no `//` and no https literal, so an earlier version of the check could not see it at all.",
+      "purpose": "IP-check page only. A WebRTC STUN binding request to Cloudflare, which is how the page detects whether a VPN leaks your real address \u2014 the probe necessarily discloses that address to the STUN server. Only reached when that page is opened. The `stun:` scheme has no `//` and no https literal, so an earlier version of the check could not see it at all.",
       "seen_in": [
         "dashboard/src/pages/IpCheckPage.jsx"
       ],
@@ -316,11 +359,11 @@
       ]
     },
     {
-      "host": "stun.cloudflare.com",
+      "host": "stun.l.google.com",
       "from": "browser",
       "user_data": true,
       "readme": true,
-      "purpose": "IP-check page only. A WebRTC STUN binding request to Cloudflare, which is how the page detects whether a VPN leaks your real address \u2014 the probe necessarily discloses that address to the STUN server. Only reached when that page is opened. The `stun:` scheme has no `//` and no https literal, so an earlier version of the check could not see it at all.",
+      "purpose": "IP-check page only. A WebRTC STUN binding request to Google, which is how the page detects whether a VPN leaks your real address \u2014 the probe necessarily discloses that address to the STUN server. Only reached when that page is opened. The `stun:` scheme has no `//` and no https literal, so an earlier version of the check could not see it at all.",
       "seen_in": [
         "dashboard/src/pages/IpCheckPage.jsx"
       ],
@@ -329,11 +372,11 @@
       ]
     },
     {
-      "host": "1.1.1.1",
+      "host": "www.anthropic.com",
       "from": "browser",
       "user_data": true,
       "readme": true,
-      "purpose": "IP-check page only: Cloudflare's trace endpoint, which is how the page learns your public IP. Showing you your own IP is that page's entire purpose.",
+      "purpose": "IP-check page only: the second reachability probe, alongside claude.ai.",
       "seen_in": [
         "dashboard/src/pages/IpCheckPage.jsx"
       ],
@@ -342,58 +385,159 @@
       ]
     },
     {
-      "host": "claude.ai",
-      "from": "browser",
+      "host": "www.cursor.com",
+      "from": "server",
       "user_data": true,
       "readme": true,
-      "purpose": "IP-check page only: a reachability probe measuring whether Anthropic is reachable from this network.",
+      "purpose": "Same as cursor.com; both hosts appear in Cursor's own endpoints.",
       "seen_in": [
-        "dashboard/src/pages/IpCheckPage.jsx"
+        "src/lib/cursor-config.js"
       ],
       "request_from": [
-        "dashboard/src/pages/IpCheckPage.jsx"
+        "src/lib/cursor-config.js"
       ]
     },
     {
-      "host": "www.anthropic.com",
+      "host": "www.npmjs.com",
       "from": "browser",
-      "user_data": true,
-      "readme": true,
-      "purpose": "IP-check page only: the second reachability probe, alongside claude.ai.",
+      "user_data": false,
+      "readme": false,
+      "purpose": "The package page, named as downloadUrl/installUrl in the same JSON-LD block. Not fetched. Distinct from registry.npmjs.org, which npx really does contact.",
       "seen_in": [
-        "dashboard/src/pages/IpCheckPage.jsx"
+        "dashboard/index.html"
       ],
-      "request_from": [
-        "dashboard/src/pages/IpCheckPage.jsx"
+      "request_from": [],
+      "data_from": [
+        {
+          "file": "dashboard/index.html",
+          "url": "https://www.npmjs.com/package/tokentracker-cli"
+        }
       ]
     },
     {
-      "host": "registry.npmjs.org",
-      "from": "server",
+      "host": "www.tokentracker.cc",
+      "from": "browser",
       "user_data": false,
-      "readme": true,
-      "purpose": "Not called by our code \u2014 this is npx fetching the package when TokenTracker is started that way. Listed because a user watching their network sees it and deserves an explanation.",
-      "seen_in": [],
-      "request_from": []
+      "readme": false,
+      "purpose": "The project's own site, named inside the page's JSON-LD structured-data block (canonical url, logo, breadcrumbs). Metadata for search engines; the browser does not fetch it, and the local dashboard never reaches it.",
+      "seen_in": [
+        "dashboard/index.html"
+      ],
+      "request_from": [],
+      "data_from": [
+        {
+          "file": "dashboard/index.html",
+          "url": "https://www.tokentracker.cc/"
+        },
+        {
+          "file": "dashboard/index.html",
+          "url": "https://www.tokentracker.cc/icon-512.png"
+        },
+        {
+          "file": "dashboard/index.html",
+          "url": "https://www.tokentracker.cc/ip-check"
+        }
+      ]
     }
   ],
   "ignored_hosts": {
     "_note": "Matched on host exactly. Not prefixes \u2014 a path here would be ignored, exempting the whole host.",
     "hosts": [
-      "localhost",
       "127.0.0.1",
-      "local.tokentracker",
-      "www.w3.org",
-      "example.com",
+      "codex.ai",
       "evil",
-      "codex.ai"
+      "example.com",
+      "example.invalid",
+      "local.tokentracker",
+      "localhost",
+      "schema.org",
+      "www.w3.org"
     ],
     "why": {
       "localhost / 127.0.0.1": "loopback",
       "local.tokentracker": "a synthetic project_ref identifier for claude-mem observer sessions (src/lib/rollout.js:19), never requested",
       "www.w3.org": "the SVG XML namespace",
       "example.com / evil": "appear only inside comments illustrating attacks and enterprise host shapes",
-      "codex.ai": "named in a comment about provider domains; not a request target"
+      "codex.ai": "named in a comment about provider domains; not a request target",
+      "schema.org": "the JSON-LD @context identifier, the same class as the www.w3.org XML namespace \u2014 an identifier, not a URL anything fetches",
+      "example.invalid": "the reserved TLD that is guaranteed never to resolve; used as a deliberately dead endpoint in scripts/acceptance/*"
+    }
+  },
+  "unresolved_authorities": [
+    {
+      "file": "dashboard/index.html",
+      "authority": "localhost:7680.",
+      "why": "Prose inside the JSON-LD HowTo block telling the reader to open the local dashboard. Text in a sentence, not a link."
+    },
+    {
+      "file": "dashboard/vite.config.js",
+      "authority": "${req.headers.host}",
+      "why": "Dev server only: proxying to the local CLI on 127.0.0.1:7680, parsing the incoming request URL, and a mock project_ref whose ${source}.ai pins nothing because .ai is the TLD itself."
+    },
+    {
+      "file": "dashboard/vite.config.js",
+      "authority": "${source}.ai",
+      "why": "Dev server only: proxying to the local CLI on 127.0.0.1:7680, parsing the incoming request URL, and a mock project_ref whose ${source}.ai pins nothing because .ai is the TLD itself."
+    },
+    {
+      "file": "dashboard/vite.config.js",
+      "authority": "127.0.0.1:7680${req.url}",
+      "why": "Dev server only: proxying to the local CLI on 127.0.0.1:7680, parsing the incoming request URL, and a mock project_ref whose ${source}.ai pins nothing because .ai is the TLD itself."
+    },
+    {
+      "file": "scripts/acceptance/offline-replay.cjs",
+      "authority": "127.0.0.1:${stub.port}",
+      "why": "A loopback stub server started by the acceptance test itself."
+    },
+    {
+      "file": "scripts/validate-outbound.cjs",
+      "authority": "${authorityText.replace(",
+      "why": "This scanner building a probe URL so new URL() can parse an authority for it. Never requested \u2014 it is the parsing step itself."
+    },
+    {
+      "file": "scripts/validate-outbound.cjs",
+      "authority": "pinned${tail}",
+      "why": "This scanner building a probe URL so new URL() can parse an authority for it. Never requested \u2014 it is the parsing step itself."
+    },
+    {
+      "file": "src/commands/init.js",
+      "authority": "localhost:7680${RESET}",
+      "why": "The startup banner printed to the terminal, with an ANSI reset after the URL. Text, not a request."
+    },
+    {
+      "file": "src/commands/serve.js",
+      "authority": "${hostHeader}",
+      "why": "Parses the INCOMING Host header, or uses it as a base to parse req.url. Inbound request handling; nothing is fetched. serve.js:146 returns the local bind URL for display."
+    },
+    {
+      "file": "src/commands/serve.js",
+      "authority": "${LOCAL_BIND_HOST}:${port}",
+      "why": "Parses the INCOMING Host header, or uses it as a base to parse req.url. Inbound request handling; nothing is fetched. serve.js:146 returns the local bind URL for display."
+    },
+    {
+      "file": "src/commands/serve.js",
+      "authority": "${req.headers.host",
+      "why": "Parses the INCOMING Host header, or uses it as a base to parse req.url. Inbound request handling; nothing is fetched. serve.js:146 returns the local bind URL for display."
+    },
+    {
+      "file": "src/lib/proxy-env.js",
+      "authority": "${values.HTTPSProxy}:${values.HTTPSPort}",
+      "why": "The proxy the USER configured in HTTPS_PROXY. The destination is whatever they set, which is the honest answer and cannot be a literal here."
+    },
+    {
+      "file": "src/lib/rollout.js",
+      "authority": "${gitAtMatch[1]}",
+      "why": "Normalises a git remote into the project_ref string stored on each row (ssh, git:// and https forms). A value written to the queue, never fetched."
+    },
+    {
+      "file": "src/lib/rollout.js",
+      "authority": "${parsed.hostname}${parsed.pathname}",
+      "why": "Normalises a git remote into the project_ref string stored on each row (ssh, git:// and https forms). A value written to the queue, never fetched."
+    },
+    {
+      "file": "src/lib/rollout.js",
+      "authority": "${ref.slice(",
+      "why": "Normalises a git remote into the project_ref string stored on each row (ssh, git:// and https forms). A value written to the queue, never fetched."
     }
-  }
+  ]
 }
diff --git a/scripts/validate-outbound.cjs b/scripts/validate-outbound.cjs
index 4f409c79..07b0113e 100644
--- a/scripts/validate-outbound.cjs
+++ b/scripts/validate-outbound.cjs
@@ -15,8 +15,13 @@
 // srcSet disclose exactly as much as a fetch does. Matching on call sites would
 // have reproduced the original blind spot in code.
 //
-// What it cannot see: a host assembled at runtime from parts. That hole is
-// closed by convention rather than by grep — dashboard network calls go through
+// A host assembled at runtime from parts still cannot be RESOLVED here, but it
+// is no longer silently dropped: every unresolvable authority is reported unless
+// it is declared in outbound-hosts.json with a reason (see checkUnresolved).
+// What remains genuinely invisible is a URL that never exists as one literal —
+// concatenation, an imported base, a join at the call site. That is #110 item 5,
+// and closing it means following expressions rather than scanning literals.
+// Until then it is held by convention: dashboard network calls go through
 // dashboard/src/lib/api.ts, and validate:guardrails rejects a raw fetch( to a
 // non-local host elsewhere. Ship both halves or neither.
 
@@ -24,8 +29,36 @@ const fs = require("node:fs");
 const path = require("node:path");
 
 const ROOT = path.resolve(__dirname, "..");
-const SCAN_DIRS = ["src", "dashboard/src"];
-const SCAN_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".cjs", ".mjs"]);
+// The walker used to see two directories and one extension set, which left
+// named places a host could live and be missed (#110 item 2):
+//
+//   dashboard/*.html          the served SPA shell — a <link rel=preconnect>,
+//                             font CDN or <script src> here is a browser request
+//   dashboard/src/styles.css  inside a scanned directory, skipped by extension.
+//                             CSS url() is a request
+//   .../i18n/*.json           strings that flow into href/src props
+//   dashboard/vite.config.js  dev proxy target; a new one was invisible
+//   scripts/                  build-pricing-seed.cjs fetches
+//                             raw.githubusercontent.com outside the scan
+//
+// scripts/ is maintainer-run rather than shipped, but the README's promise is
+// about what this codebase reaches, and "only when the maintainer runs it" is a
+// caveat for the purpose field, not a reason to be invisible.
+const SCAN_DIRS = ["src", "dashboard/src", "scripts"];
+// Individually named because dashboard/ as a whole holds build output and
+// assets; only these three are source.
+const SCAN_FILES = ["dashboard/index.html", "dashboard/pet.html", "dashboard/vite.config.js"];
+const SCAN_EXTENSIONS = new Set([
+  ".js",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".cjs",
+  ".mjs",
+  ".css",
+  ".html",
+  ".json",
+]);
 // Matches the scheme, then the authority up to the first delimiter. Deliberately
 // permissive about what the authority contains, because a host is often built by
 // interpolation — `http://${token}-${i}.d.ip.net.coffee/pixel.gif` is a real
@@ -236,51 +269,70 @@ function isTestFile(filePath) {
   return /\.test\.[jt]sx?$/.test(filePath) || /(^|[\\/])__tests__[\\/]/.test(filePath);
 }
 
-// Returns two views of the same scan: every file that NAMES each host, and every
-// file that REQUESTS it. The second is the one with security meaning.
+// One line of one file, folded into the three views the caller is building.
+function scanLine({ line, index, relative, mentions, requests, unresolved }) {
+  for (const match of [...line.matchAll(URL_RE), ...line.matchAll(PROTOCOL_RELATIVE_RE)]) {
+    // String surgery and comments are filtered from EVERY view. A prefix being
+    // stripped off user input is not a destination this code can reach, so it
+    // does not belong in the inventory either — and a regex literal like
+    // `/^https:\/\/github\.com\//` otherwise resolves to a bare `github`,
+    // demanding a declaration for a host that does not exist.
+    if (isMentionOnly(line, match.index)) continue;
+
+    const { host } = resolveHost(match[1]);
+    // An authority that cannot be reduced to a host used to be DROPPED, so a
+    // real destination the scanner could not model went unmentioned. Reporting
+    // it is right in principle and was tried as a flag flip inside #109; it
+    // fired on ordinary code immediately, and a check that flags ordinary code
+    // is a check someone turns off. So each is declared with a reason instead,
+    // and a NEW one fails — see checkUnresolved.
+    if (!host) {
+      unresolved.push({
+        file: relative,
+        line: index + 1,
+        authority: decodeSourceEscapes(match[1]).split(/[/\\?#]/)[0],
+      });
+      continue;
+    }
+
+    if (!mentions.has(host)) mentions.set(host, new Set());
+    mentions.get(host).add(relative);
+    // Every occurrence, not one per file. This was a Map keyed by file, so a
+    // second request to the same host from the same file overwrote the first and
+    // only the LAST line was ever reported — and with waivers now pinned to the
+    // URL text, each occurrence has to be matched on its own.
+    if (!requests.has(host)) requests.set(host, []);
+    requests.get(host).push({
+      file: relative,
+      line: index + 1,
+      text: match[0].replace(/^["'`{\s]+/, ""),
+    });
+  }
+}
+
+// Returns three views of the same scan: every file that NAMES each host, every
+// file that REQUESTS it, and every authority that could not be resolved at all.
+// The second is the one with security meaning; the third is what used to be
+// thrown away.
 function collectHosts({ root = ROOT } = {}) {
   const mentions = new Map();
   const requests = new Map();
-  for (const dir of SCAN_DIRS) {
-    for (const filePath of walk(path.join(root, dir))) {
-      if (isTestFile(filePath)) continue;
-      const relative = path.relative(root, filePath);
-      const lines = fs.readFileSync(filePath, "utf8").split("\n");
-      lines.forEach((line, index) => {
-        const matches = [...line.matchAll(URL_RE), ...line.matchAll(PROTOCOL_RELATIVE_RE)];
-        for (const match of matches) {
-          // NOTE: an authority that cannot be reduced to a host is currently
-          // dropped. Reporting it instead (fail-closed) is right in principle and
-          // was tried here — it fired on eight legitimate patterns immediately
-          // (`${hostHeader}` for the local bind, a log string with an ANSI reset
-          // after the URL, git-remote parsing), and a check that flags ordinary
-          // code is a check someone turns off. Tracked separately so it can be
-          // done with the per-pattern care it needs.
-          const { host } = resolveHost(match[1]);
-          if (!host) continue;
-          // String surgery and comments are filtered from BOTH views. A prefix
-          // being stripped off user input is not a destination this code can
-          // reach, so it does not belong in the inventory either — and a regex
-          // literal like `/^https:\/\/github\.com\//` otherwise resolves to a
-          // bare `github`, demanding a declaration for a host that does not exist.
-          if (isMentionOnly(line, match.index)) continue;
-          if (!mentions.has(host)) mentions.set(host, new Set());
-          mentions.get(host).add(relative);
-          // Every occurrence, not one per file. This was a Map keyed by file, so
-          // a second request to the same host from the same file overwrote the
-          // first and only the LAST line was ever reported — and with waivers now
-          // pinned to the URL text, each occurrence has to be matched on its own.
-          if (!requests.has(host)) requests.set(host, []);
-          requests.get(host).push({
-            file: relative,
-            line: index + 1,
-            text: match[0].replace(/^["'`{\s]+/, ""),
-          });
-        }
+  const unresolved = [];
+  const targets = [
+    ...SCAN_DIRS.flatMap((dir) => walk(path.join(root, dir))),
+    ...SCAN_FILES.map((f) => path.join(root, f)).filter((f) => fs.existsSync(f)),
+  ];
+  for (const filePath of targets) {
+    if (isTestFile(filePath)) continue;
+    const relative = path.relative(root, filePath);
+    fs.readFileSync(filePath, "utf8")
+      .split("\n")
+      .forEach((line, index) => {
+        scanLine({ line, index, relative, mentions, requests, unresolved });
       });
-    }
   }
   mentions.requests = requests;
+  mentions.unresolved = unresolved;
   return mentions;
 }
 
@@ -425,6 +477,96 @@ function checkRequestPermission(entry, records) {
   return findings;
 }
 
+// An authority the scanner cannot reduce to a host is a destination it cannot
+// vouch for, so each one is declared with a reason. The issue's three original
+// examples — bracketed IPv6, a Cyrillic lookalike, a single-label intranet host
+// — all resolve now: they predate deferring to `new URL()`. What is left is
+// interpolation that pins nothing, which is ordinary code, which is exactly why
+// the flag-flip version of this had to be reverted.
+//
+// Matched on file + authority text. A new unresolvable authority anywhere is a
+// finding; a declaration that no longer matches is reported as stale, so this
+// list cannot quietly outlive the code it excuses.
+function checkUnresolved(inventory, unresolved) {
+  const declared = inventory.unresolved_authorities || [];
+  const findings = [];
+  const used = new Set();
+
+  for (const item of unresolved) {
+    const index = declared.findIndex(
+      (d) => d && d.file === item.file && d.authority === item.authority,
+    );
+    if (index >= 0) {
+      used.add(index);
+      continue;
+    }
+    findings.push(
+      `${item.file}:${item.line} builds a URL whose authority cannot be resolved to a host:` +
+        ` ${JSON.stringify(item.authority)} — the scanner cannot say where this goes. Declare it in` +
+        ` outbound-hosts.json under unresolved_authorities with a why, or make the host a literal`,
+    );
+  }
+
+  declared.forEach((entry, index) => {
+    if (used.has(index)) return;
+    findings.push(
+      `outbound-hosts.json declares unresolved authority ${JSON.stringify(entry?.authority)} in` +
+        ` ${entry?.file}, but it is no longer there — remove it`,
+    );
+  });
+
+  return findings;
+}
+
+const VALID_FROM = new Set(["server", "browser", "both"]);
+
+// Which side of the product a file runs on. `dashboard/` is what the user's
+// browser loads; everything else is the local Node process.
+function sideOf(file) {
+  return file.startsWith("dashboard/") && !file.startsWith("dashboard/vite.config")
+    ? "browser"
+    : "server";
+}
+
+// The inventory's prose was unchecked: `user_data: true` with `readme: false`
+// passed, so did a wrong `from` and purpose text describing something the code
+// does not do. Only the readme flag and a substring search were enforced, which
+// left the fields a reader trusts most as the ones nothing verified.
+//
+// `from` is checked against where the host is ACTUALLY reached, not just for
+// being one of three words — a host only ever requested from src/ cannot
+// honestly be `browser`. Entries with nothing observed (npx fetching the package)
+// are exempt, since there is no evidence either way.
+function checkInventoryMetadata(entry, records) {
+  const findings = [];
+  const bad = (message) => findings.push(`outbound-hosts.json entry '${entry.host}': ${message}`);
+
+  if (typeof entry.host !== "string" || !entry.host.trim()) bad("host must be a non-empty string");
+  if (!VALID_FROM.has(entry.from)) {
+    bad(`from must be one of ${[...VALID_FROM].join(", ")}, got ${JSON.stringify(entry.from)}`);
+  }
+  if (typeof entry.user_data !== "boolean") bad("user_data must be a boolean");
+  if (typeof entry.readme !== "boolean") bad("readme must be a boolean");
+  if (typeof entry.purpose !== "string" || entry.purpose.trim().length < 20) {
+    bad("purpose must say something — it is what a reader of the privacy table relies on");
+  }
+  if (entry.user_data === true && entry.readme !== true) {
+    bad("user_data is true, so readme must be true: every host that discloses something about the user belongs in the README table");
+  }
+
+  const sides = new Set(records.map((r) => sideOf(r.file)));
+  if (sides.size > 0 && VALID_FROM.has(entry.from)) {
+    const expected = sides.size === 2 ? "both" : [...sides][0];
+    if (entry.from !== expected) {
+      bad(
+        `from is ${JSON.stringify(entry.from)} but the host is reached only from the ${expected}` +
+          ` side (${[...new Set(records.map((r) => r.file))].sort().join(", ")})`,
+      );
+    }
+  }
+  return findings;
+}
+
 // Every host that discloses something about the user must be in the README
 // table. The table is the promise; this is what keeps it true.
 function checkReadmeTable(root, inventory) {
@@ -471,12 +613,17 @@ function checkOutbound({ root = ROOT } = {}) {
 
   // 3.
   for (const entry of inventory.hosts || []) {
-    findings.push(...checkRequestPermission(entry, found.requests.get(entry.host) || []));
+    const records = found.requests.get(entry.host) || [];
+    findings.push(...checkRequestPermission(entry, records));
+    findings.push(...checkInventoryMetadata(entry, records));
   }
 
   // 4.
   findings.push(...checkReadmeTable(root, inventory));
 
+  // 5. Nothing may be silently dropped for being unparseable.
+  findings.push(...checkUnresolved(inventory, found.unresolved || []));
+
   findings.push(...checkDynamicFetches(root, inventory));
 
   return findings;
diff --git a/test/outbound-inventory.test.js b/test/outbound-inventory.test.js
index d7604e35..682cf5fa 100644
--- a/test/outbound-inventory.test.js
+++ b/test/outbound-inventory.test.js
@@ -9,7 +9,7 @@ const { checkOutbound, collectHosts } = require("../scripts/validate-outbound.cj
 // A throwaway repo shaped like this one. The validator reads the tree it is
 // pointed at, so probing the real tree would mean editing tracked source — the
 // hazard already caught once in test/openwiki-facts.test.js.
-function fixture({ files = {}, hosts = [], ignored = [], readme = "" }) {
+function fixture({ files = {}, hosts = [], ignored = [], readme = "", unresolved = [] }) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "tt-outbound-"));
   for (const [relative, content] of Object.entries(files)) {
     const full = path.join(root, relative);
@@ -18,18 +18,21 @@ function fixture({ files = {}, hosts = [], ignored = [], readme = "" }) {
   }
   fs.writeFileSync(
     path.join(root, "outbound-hosts.json"),
-    JSON.stringify({ hosts, ignored_hosts: { hosts: ignored } }),
+    JSON.stringify({ hosts, ignored_hosts: { hosts: ignored }, unresolved_authorities: unresolved }),
   );
   fs.writeFileSync(path.join(root, "README.md"), readme);
   return root;
 }
 
+// A minimally VALID entry. It has to satisfy the metadata check too, which is
+// why `purpose` is a sentence and `from` says which side: those fields stopped
+// being free text in #110 item 6.
 const declared = (host, extra = {}) => ({
   host,
   from: "server",
   user_data: false,
   readme: false,
-  purpose: "test",
+  purpose: "a purpose long enough to be worth reading",
   seen_in: ["src/a.js"],
   request_from: ["src/a.js"],
   ...extra,
@@ -142,6 +145,7 @@ test("a request from a file that only had permission to MENTION the host is caug
     },
     hosts: [
       declared("shared.example", {
+        from: "browser",
         seen_in: ["dashboard/src/Allowed.jsx", "dashboard/src/Mentions.jsx"],
         request_from: ["dashboard/src/Allowed.jsx"],
       }),
@@ -228,7 +232,14 @@ test("an unresolvable interpolated host is not invented", () => {
   const root = fixture({
     files: { "src/serve.js": 'const u = new URL(p, `http://${req.headers.host || "localhost"}`);\n' },
   });
-  assert.deepEqual(checkOutbound({ root }), []);
+  const findings = checkOutbound({ root });
+  assert.ok(
+    !findings.some((f) => f.includes("undeclared outbound host")),
+    `no host may be invented from the remainder: ${JSON.stringify(findings)}`,
+  );
+  // It is now REPORTED as unresolvable rather than dropped (#110 item 1) — the
+  // scanner saying "I cannot tell where this goes" instead of staying silent.
+  assert.ok(findings.some((f) => f.includes("cannot be resolved to a host")));
 });
 
 test("a comment is a mention; a clickable link needs link_from", () => {
@@ -246,6 +257,7 @@ test("a comment is a mention; a clickable link needs link_from", () => {
     },
     hosts: [
       declared("docs.example", {
+        from: "browser",
         seen_in: ["dashboard/src/Doc.jsx"],
         request_from: [],
         link_from: [{ file: "dashboard/src/Doc.jsx", url: "https://docs.example/guide" }],
@@ -326,6 +338,7 @@ test("a waiver covers the URL it names, not the file it sits in", () => {
     },
     hosts: [
       declared("docs.example", {
+        from: "browser",
         seen_in: ["dashboard/src/Panel.jsx"],
         request_from: [],
         link_from: [{ file: "dashboard/src/Panel.jsx", url: "https://docs.example/guide" }],
@@ -350,7 +363,11 @@ test("every request to a host from one file is reported, not just the last", ()
       ].join("\n"),
     },
     hosts: [
-      declared("docs.example", { seen_in: ["dashboard/src/Panel.jsx"], request_from: [] }),
+      declared("docs.example", {
+        from: "browser",
+        seen_in: ["dashboard/src/Panel.jsx"],
+        request_from: [],
+      }),
     ],
   });
   const findings = checkOutbound({ root });
@@ -364,6 +381,7 @@ test("a pin that matches nothing is reported as a stale waiver", () => {
     files: { "dashboard/src/Panel.jsx": 'const link = <a href="https://docs.example/guide">d</a>;\n' },
     hosts: [
       declared("docs.example", {
+        from: "browser",
         seen_in: ["dashboard/src/Panel.jsx"],
         request_from: [],
         link_from: [
@@ -385,6 +403,7 @@ test("a bare filename is rejected as a waiver, not read as an unmatched pin", ()
     files: { "dashboard/src/Panel.jsx": 'const link = <a href="https://docs.example/guide">d</a>;\n' },
     hosts: [
       declared("docs.example", {
+        from: "browser",
         seen_in: ["dashboard/src/Panel.jsx"],
         request_from: [],
         link_from: ["dashboard/src/Panel.jsx"],
@@ -406,7 +425,7 @@ const shared = (extra = {}) => ({
   from: "browser",
   user_data: false,
   readme: true,
-  purpose: "test",
+  purpose: "a purpose long enough to be worth reading",
   seen_in: ["dashboard/src/Ok.jsx", "dashboard/src/A.jsx"],
   request_from: ["dashboard/src/Ok.jsx"],
   link_from: [],
@@ -548,7 +567,12 @@ test("an interpolated suffix pins only a real zone, never a bare TLD", () => {
   // `${sub}github.com` can resolve to the registrable `evilgithub.com`, so no pin.
   // `${src}.ai` pins nothing either — `ai` is the TLD itself, and a comment
   // illustrating a bad URL should not be reported as a destination.
-  assert.deepEqual(attack('const u = `https://${sub}shared.example/x`;'), []);
+  // No host is pinned — but since #110 item 1 the authority is reported as
+  // unresolvable rather than silently dropped.
+  const suffix = attack('const u = `https://${sub}shared.example/x`;');
+  assert.ok(!suffix.some((f) => f.includes("undeclared outbound host")));
+  assert.ok(suffix.some((f) => f.includes("cannot be resolved to a host")));
+  // A comment is still a mention, so it is not even reported as unresolvable.
   assert.deepEqual(attack("// fabricating `https://${src}.ai` resolves to unrelated domains"), []);
   // A boundary that IS a zone still pins.
   assert.ok(
@@ -631,3 +655,145 @@ test("a regex literal stripping a URL prefix is not a destination", () => {
     [],
   );
 });
+
+// --- Scan scope (#110 item 2) -------------------------------------------------
+// The walker saw two directories and one extension set. Each place below is one
+// the issue named, where a host could live and never be mentioned.
+
+test("the served HTML shell is scanned", () => {
+  // dashboard/index.html is what the browser loads. A <link rel=preconnect>, a
+  // font CDN or a <script src> here is a browser request, and none of it was
+  // visible to a walker that only knew dashboard/src.
+  const root = fixture({
+    files: { "dashboard/index.html": '<link rel="preconnect" href="https://fonts.example">\n' },
+  });
+  assert.ok(
+    checkOutbound({ root }).some((f) => f.includes("fonts.example")),
+    "a preconnect in the shell is a request",
+  );
+});
+
+test("CSS url() is scanned, though it sits in an already-scanned directory", () => {
+  // dashboard/src/styles.css was skipped by EXTENSION, not by directory — the
+  // more embarrassing kind of gap, since the walker was already standing in it.
+  const root = fixture({
+    files: { "dashboard/src/styles.css": "body { background: url(https://tracker.example/bg.png); }\n" },
+  });
+  assert.ok(checkOutbound({ root }).some((f) => f.includes("tracker.example")));
+});
+
+test("scripts/ is scanned", () => {
+  // build-pricing-seed.cjs really does fetch raw.githubusercontent.com and was
+  // outside the scan entirely. Maintainer-run is a caveat for the purpose field,
+  // not a reason to be invisible.
+  const root = fixture({ files: { "scripts/build.cjs": 'fetch("https://seed.example/list.json");\n' } });
+  assert.ok(checkOutbound({ root }).some((f) => f.includes("seed.example")));
+});
+
+test("the dev-server config is scanned, so a new proxy target is visible", () => {
+  const root = fixture({
+    files: { "dashboard/vite.config.js": 'export default { server: { proxy: { "/p": { target: "https://proxy.example" } } } };\n' },
+  });
+  assert.ok(checkOutbound({ root }).some((f) => f.includes("proxy.example")));
+});
+
+// --- Inventory metadata (#110 item 6) -----------------------------------------
+// The fields a reader trusts most were the ones nothing checked.
+
+const metaFixture = (extra) =>
+  fixture({
+    files: { "src/a.js": 'fetch("https://x.example/1");\n' },
+    hosts: [
+      {
+        host: "x.example",
+        from: "server",
+        user_data: false,
+        readme: false,
+        purpose: "a purpose long enough to be worth reading",
+        seen_in: ["src/a.js"],
+        request_from: ["src/a.js"],
+        ...extra,
+      },
+    ],
+  });
+
+test("a valid entry produces no metadata findings", () => {
+  assert.deepEqual(checkOutbound({ root: metaFixture({}) }), []);
+});
+
+test("user_data true with readme false is caught", () => {
+  // The exact combination that lets a disclosing host stay out of the privacy
+  // table while the JSON looks honest.
+  assert.ok(
+    checkOutbound({ root: metaFixture({ user_data: true }) }).some((f) =>
+      f.includes("user_data is true, so readme must be true"),
+    ),
+  );
+});
+
+test("`from` is checked against where the host is actually reached", () => {
+  // A host only ever requested from src/ cannot honestly be `browser`. This is
+  // the half that makes `from` a claim about the code rather than a label.
+  assert.ok(
+    checkOutbound({ root: metaFixture({ from: "browser" }) }).some((f) =>
+      f.includes("reached only from the server side"),
+    ),
+  );
+});
+
+test("a from outside the three known values is caught", () => {
+  assert.ok(
+    checkOutbound({ root: metaFixture({ from: "backend" }) }).some((f) =>
+      f.includes("from must be one of"),
+    ),
+  );
+});
+
+test("a non-boolean flag and an empty purpose are caught", () => {
+  assert.ok(
+    checkOutbound({ root: metaFixture({ user_data: "true" }) }).some((f) =>
+      f.includes("user_data must be a boolean"),
+    ),
+  );
+  assert.ok(
+    checkOutbound({ root: metaFixture({ purpose: "" }) }).some((f) => f.includes("purpose must say something")),
+  );
+});
+
+// --- Unresolvable authorities (#110 item 1) -----------------------------------
+
+test("an authority that cannot be resolved is reported, not dropped", () => {
+  // Dropping it meant a destination the scanner could not model went unmentioned
+  // — green, with no line anywhere saying "I could not tell where this goes".
+  const root = fixture({ files: { "src/a.js": "const u = `https://${host}${suffix}/x`;\n" } });
+  assert.ok(
+    checkOutbound({ root }).some((f) => f.includes("cannot be resolved to a host")),
+    "an unpinnable interpolated authority must be reported",
+  );
+});
+
+test("a declared unresolved authority passes", () => {
+  // Failing closed with no list fired on eight legitimate patterns at once and
+  // would have got the check switched off. Each one is declared with a why.
+  const root = fixture({
+    files: { "src/a.js": "const u = `https://${host}${suffix}/x`;\n" },
+    unresolved: [
+      { file: "src/a.js", authority: "${host}${suffix}", why: "the local bind, configured at runtime" },
+    ],
+  });
+  assert.deepEqual(checkOutbound({ root }), []);
+});
+
+test("a declaration that no longer matches the code is reported as stale", () => {
+  // Otherwise the list outlives the code it excuses and quietly covers whatever
+  // drifts onto that authority next.
+  const root = fixture({
+    files: { "src/a.js": 'fetch("https://x.example/1");\n' },
+    hosts: [declared("x.example")],
+    unresolved: [{ file: "src/a.js", authority: "${gone}", why: "removed in a refactor" }],
+  });
+  assert.ok(
+    checkOutbound({ root }).some((f) => f.includes("no longer there")),
+    "a stale declaration must not sit there silently",
+  );
+});