diff --git a/CHANGELOG.md b/CHANGELOG.md
index ebd2ab7..cf72852 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@ Notable changes to JevGate. Versions follow [Semantic Versioning](https://semver
 
 ## [Unreleased]
 
-Measured on 103 pinned projects (24 new open-source ones of kinds not tried before, among them intentionally vulnerable Rails, Node, GraphQL, C# and Java apps, a Deno framework, a WordPress plugin, a cookiecutter template and projects in Kotlin, Swift, Elixir and C, and 8 more of the maintainer's own), with findings labeled by hand: on the 70 labeled projects JevGate was tuned on, 75% of reviews were right against 69% with 0.20.0 (136 wrong reviews against 192), and 72% of considers against 65% (254 wrong considers against 354); on 11 held-out projects, 61% of reviews against 57%, and 56% of considers against 54%. Undecided units went from 2.2% to 1.5% of judged units.
+Measured on 103 pinned projects (24 new open-source ones of kinds not tried before, among them intentionally vulnerable Rails, Node, GraphQL, C# and Java apps, a Deno framework, a WordPress plugin, a cookiecutter template and projects in Kotlin, Swift, Elixir and C, and 8 more of the maintainer's own), with findings labeled by hand: on the 72 labeled projects JevGate was tuned on, 76% of reviews were right against 69% with 0.20.0 (142 wrong reviews against 192), and 73% of considers against 64% (239 wrong considers against 355); on 11 held-out projects, 63% of reviews against 57%, and 56% of considers against 54%. On 14 projects added after that tuning (9 of the maintainer's own, Online Boutique, a browser extension, a React Native template, a Solidity and a dbt project), 64% of reviews and 65% of considers were right, against 53% and 47%. Undecided units went from 2.2% to 1.5% of judged units.
 
 - Server templates: ERB, EJS, JSP, Handlebars, Mustache, Nunjucks, Twig, Jinja and Go templates, and HTML under `templates/`, `views/`, `layouts/`, `partials/` or `includes/`, are judged. Their inline `<script>` code is parsed with the template's tags blanked and judged as the page's JavaScript in the visitor's browser, its top-level statements by every security rule, as a PHP page script is. Their `template code` is one more unit: each tag that writes request, cookie, session or signed-in-user data unescaped (ERB `raw` and `html_safe`, `<%== … %>`, EJS `<%- … %>`, `{{{ … }}}`, `|safe`, `|raw`), judged by injection, and every scriptlet and declaration of a JSP page once one reads the request, judged by every security rule. A template holding neither is not selected, so 900 of the corpus's 1,003 templates stay out of reports. On the intentionally vulnerable apps, 24 documented vulnerabilities that no rule read are found: RailsGoat's and DVNA's three XSS each, DVGA's paste-page XSS, DVJA's reflected XSS, and JavaVulnerableLab's JSP-only SQL, HQL and command injections, XSS, path traversal, SSRF and leaked stack traces. Of the labeled findings in templates, 42 of 49 reviews and 16 of 25 considers were right. About $0.1 on the corpus.
 - Node views: a handler that renders a view by name (`res.render('app/products', …)`, a view under `views/` named without its extension) is sent the view's lines that write values unescaped (EJS `<%- … %>`, Handlebars `{{{ … }}}`, Pug `!=`, Nunjucks's and Swig's `|safe`), as a Django view is sent its templates, and its presence question, markup check and markup Choice name such templates. DVNA's reflected XSS in the product search is a review and the stored XSS of its product list a consider; only such handlers' requests change.
@@ -29,6 +29,12 @@ Measured on 103 pinned projects (24 new open-source ones of kinds not tried befo
 - Documentation: Claude Code skills, commands and subagent definitions (Markdown under `.claude/skills`, `.claude/commands` and `.claude/agents`) are project documentation, checked for stale paths, repetition and size; a session loads only their descriptions, so they do not count toward what loads at its start. One project's skill cited documentation paths a rename had removed, which nothing reported. A path holding a `$` placeholder, such as a command's `.kiro/specs/$1/spec.json`, names no file.
 - Project templates: a file under a directory whose name holds a `{{ … }}` placeholder, as a cookiecutter template's `{{cookiecutter.project_slug}}` does, is parsed without its Jinja tags (statements and comments blanked, each placeholder read as a name of the same length, so lines stay the file's) and judged; the evidence keeps the tags. 31 of cookiecutter-django's Python and JavaScript files, the generated application's settings, models, views and tests, were skipped for syntax errors and are judged; its Celery settings turning off Redis certificate checks (`ssl.CERT_NONE`) are a review.
 - Tests: a test said to assert internal details is asked, with the bodies of the functions it calls, what its assertions read: results, state the program shows or acts on next, or effects a caller observes clear the consider; stored input or calls between the program's own functions keep it. Asked of the test and the signatures it calls, the check read a debug panel's recorded queries (`panel._queries`, which the panel renders), Devise's documented hooks and an app's state after an action as internals: 49 of 66 such considers labeled on the corpus were wrong. A test that reads members through reflection or a cast to `any` keeps its consider without being asked. Labeled tests/value considers went from 29% to 77% right (20 right and 6 wrong, against 22 and 55), and on held-out projects from 2 right and 13 wrong to 1 wrong. About $0.006 of follow-ups on the corpus.
+- Injection: a consider that rests on the function's parameters ("a caller passing outside input would make it exploitable") is asked, with the functions that call it, what the values it places can hold. It becomes a note when text the program fixes (literals its callers pass, numbers, names from a fixed list), values it creates or a local tool's own arguments lead; text another party can set, or callers that are not shown, keep it. Asked where the values come from, the recheck answered "the function's parameters" at 0.9 even for a Rust helper whose four callers pass literal SQL fragments. On the labeled projects, such considers went from 30 right and 51 wrong to 30 right and 32 wrong. Only these follow-ups are asked.
+- Hardcoded values: the Choice that names a finding's value lists, with each value, the other lines of its file that write it. A consider that rests only on a value's name, whose file writes that value again, is then asked what the value is: copies that must change together, or a value nothing near it explains, keep it; a value that the field or argument it fills or a comment beside it explains, an idiom such as a tolerance near zero or a unit conversion, or a hand-tuned number, clearly chosen, make it a note. On the labeled projects, such considers went from 53 right and 77 wrong (41%) to 32 right and 28 wrong (53%); the others are notes. Offered instead as the locate's "no value stands out", those kinds also took values with copies that must stay equal. Only these follow-ups are asked.
+- Hardcoded values: a review or consider that rests only on a value changing between environments is asked, once its value or constant is named and with the function or the lines that use the constant, where that value would differ. A value each installation must set, or the author's own account or domain, keeps it; the same value in every copy on purpose (the program's own service or registered client id, a provider's fixed address, a path the platform fixes), a fallback used only when configuration gives none, or code no deployment runs, at 0.80, make it a note. The Choice that names a file's constant lists the lines that use each one. On the labeled projects, such findings went from 17 right and 36 wrong to 15 right and 19 wrong: a desktop app's own license server, a provider's registered redirect and fallbacks behind environment variables are notes; a frontend's API host edited in code three times and a template author's domain as a fallback are the right ones lowered. Only these follow-ups are asked.
+- Injection: outside PHP, a path check left undecided after its trace and recheck is asked, with the functions that call it, where the paths come from: the program's own directories or configuration, the command line or settings of the person running a local program, a whole path its caller gives, or another party's input (a request, an uploaded file or archive entry, a record users can edit). The program's own or the local user's clear it. A path, URL or redirect check still undecided on the function's parameters, whose Choice does not lean toward another party's input, is a note naming the path, URL or redirect, as a found one already was. Undecided injection units on the corpus went from 813 to 289, and no review or consider changed; the new Choice costs about $0.02 on the corpus.
+- Tests: a test whose "checks only its mocks" or "recomputes its expected value" answer stays undecided after its recheck leans: below 0.50 it is clear. Labeled from the code, 4 of 43 such tests below 0.50 were hollow, against 10 of 35 at 0.50 or more. Undecided tests on the corpus went from 792 to 156, and undecided units overall from 1.39% to 0.83% of judged units. Nothing is asked again.
+- Unsafe settings: outside C#, PHP and Django, the TLS check asks whether code accepts a server's certificate, host key or host name without verifying it, and names a connection made without TLS (gRPC's insecure credentials, an insecure OpenTelemetry exporter, `sslmode=disable`) and verification skipped only when a caller or the operator asks for it as not turning it off. Asked whether code turns verification off, Online Boutique's gRPC clients and telemetry exporters inside its cluster, and its database reached through the AlloyDB connector, were seven reviews whatever the examples said, and httpx's `verify=False` branch and vaultwarden's opt-in setting for invalid SMTP certificates were reviews too. The escape check names i18next's `escapeValue: false` in a React app, whose components escape what they render, as escaping kept. Labeled unsafe-settings reviews went from 54 right and 24 wrong to 54 right and 14 wrong; pgweb defaulting a bookmark's `sslmode` to `disable`, which turns off TLS rather than verification, is no longer one. Only unsafe-settings traces are asked again.
 - Tests: Deno tests are test cases, in each of their forms: `Deno.test("name", fn)`, `Deno.test({ name: "name", fn() {…} })` and `Deno.test(function name() {…})`, with `.only` and `.ignore`. oak writes its 266 tests in the object form, and none of them was judged: its test files got a file-purpose request each and the test rules found nothing to ask. Only Deno projects' requests change.
 
 ## [0.20.0] - 2026-09-26
diff --git a/docs/classification-cascade.md b/docs/classification-cascade.md
index 47ec914..ca473bc 100644
--- a/docs/classification-cascade.md
+++ b/docs/classification-cascade.md
@@ -158,6 +158,8 @@ signatures, or one candidate pair.
    its mocks is asked again with the bodies of the functions it calls and its
    file's imports, mocks and setup hooks (a part too long is left out, never
    cut); each answer replaces the first unless only the first is decisive.
+   One still undecided then leans: below 0.50 it is clear. Labeled from the
+   code, 4 of 43 such tests below 0.50 were hollow, against 10 of 35 above.
    A Ruby test is sent with the groups it is declared in, since an RSpec
    example reads as a sentence continuing them and the outer group often names
    the class under test. Its recheck shows, instead of every hook of the
@@ -190,7 +192,20 @@ signatures, or one candidate pair.
    again with the body of the function both call: whether it throws before
    the rest of a test runs is in that body.
    Then one locate Choice per split finding picks the body block to extract,
-   and one per hardcoded-value review or consider names the value it is about.
+   and one per hardcoded-value review or consider names the value it is about,
+   each value listed with the other lines of its file that write it. A
+   consider that rests only on a value's name, whose file writes that value
+   again, is then asked what the value is: copies that must change together,
+   or a value nothing near it explains, keep it; a value that the field or
+   argument it fills or a comment beside it explains, an idiom such as a
+   tolerance near zero or a unit conversion, or a hand-tuned number make it a
+   note. A finding that rests only on a value changing between environments
+   is asked, with the value's function or the lines that use the constant,
+   where it would differ: each installation or the author's own account
+   keeps it; the same in every copy on purpose (the program's own service, a
+   provider's fixed address, a path the platform fixes), a fallback used only
+   when configuration gives none, or code no deployment runs, at 0.80, make it
+   a note.
    Special-case findings in different files that name the same identity
    become one finding at the strongest site; the others are notes pointing at
    it. Numbers and paths are not grouped: `1000` meant metres per kilometre in
@@ -202,7 +217,14 @@ signatures, or one candidate pair.
    `eval` of model output; a check per kind decides and names the kind. An
    injection whose origin stays unclear or is the function's parameters is
    asked its origin and checks again with up to three callers; its answer
-   replaces the traced one unless only the traced one is decisive.
+   replaces the traced one unless only the traced one is decisive. A consider
+   that still rests on the function's parameters is asked, with its callers,
+   what the values it places can hold: text the program fixes (literals its
+   callers pass, numbers, names from a fixed list), values it creates itself,
+   or a local tool's own arguments make it a note; text another party can set,
+   or callers not shown, keep it. Asked where the values come from, the
+   recheck answered "the function's parameters" at 0.9 even for a helper
+   whose every caller passed a literal SQL fragment.
    The markup check names text shown as a JSX child and CSS values or class
    names as escaped or inert; sending where each built string goes did not
    settle React units, the examples did. A sensitive-data trace lists the
@@ -244,7 +266,16 @@ signatures, or one candidate pair.
    trace in C# also gets the `const` and `static readonly` fields the code
    names, often declared in another file, so a key written in the code does
    not read as configuration. Other languages keep their wording: the
-   additions were measured on ASP.NET Core projects only. A broad weak-setting
+   additions were measured on ASP.NET Core projects only. Outside C#, PHP and
+   Django, the TLS check asks whether code accepts a server's certificate,
+   host key or host name without verifying it, so a connection made without
+   TLS (gRPC's insecure credentials, an insecure OpenTelemetry exporter,
+   `sslmode=disable`) presents nothing to verify, and verification skipped
+   only when a caller or the operator asks for it is not turned off: asked
+   whether code turns verification off, a microservices demo's
+   cluster-internal gRPC clients stayed reviews whatever the examples said.
+   The escape check names i18next's `escapeValue: false` in a React app as
+   escaping kept. A broad weak-setting
    answer that none of the specific checks leans toward names no setting to
    change and is at most a note: on an action marked `[AllowAnonymous]` on
    purpose it was 0.85 while every check stayed at 0.30 or less.
@@ -343,8 +374,15 @@ signatures, or one candidate pair.
    numbers, or values handed to it) was tried for considers on parameters
    and dropped: it cleared a sort column taken from the request as readily
    as clauses with placeholders. The same question about paths cleared real
-   traversals, reading names stored in an index as the program's own, so path
-   checks stay undecided until callers show more. The SQL check counts
+   traversals, reading names stored in an index as the program's own. Outside
+   PHP, an undecided path check is now asked, with its callers, where the
+   paths come from, naming a record users can edit as another party's input
+   and offering the local user's command line or settings: the program's own
+   paths or the local user's at 0.80 clear it (74 units on the corpus, among
+   them httprouter serving a directory through `http.Dir`). A path, URL or
+   redirect check still undecided on the function's parameters, whose Choice
+   does not lean toward another party's input, is a note, as a found one
+   already was: 450 injection units had stayed uncertain that way. The SQL check counts
    identifiers quoted by doubling embedded quotes as handled (identifiers
    cannot be bound), and the URL check excludes requests a web page sends from
    the user's browser; on fresh repositories both had flagged such code, while
diff --git a/site/src/how-it-works.md b/site/src/how-it-works.md
index 55df00b..bbf95af 100644
--- a/site/src/how-it-works.md
+++ b/site/src/how-it-works.md
@@ -176,6 +176,8 @@ signatures, or one candidate pair.
    its mocks is asked again with the bodies of the functions it calls and its
    file's imports, mocks and setup hooks (a part too long is left out, never
    cut); each answer replaces the first unless only the first is decisive.
+   One still undecided then leans: below 0.50 it is clear. Labeled from the
+   code, 4 of 43 such tests below 0.50 were hollow, against 10 of 35 above.
    A Ruby test is sent with the groups it is declared in, since an RSpec
    example reads as a sentence continuing them and the outer group often names
    the class under test. Its recheck shows, instead of every hook of the
@@ -208,7 +210,20 @@ signatures, or one candidate pair.
    again with the body of the function both call: whether it throws before
    the rest of a test runs is in that body.
    Then one locate Choice per split finding picks the body block to extract,
-   and one per hardcoded-value review or consider names the value it is about.
+   and one per hardcoded-value review or consider names the value it is about,
+   each value listed with the other lines of its file that write it. A
+   consider that rests only on a value's name, whose file writes that value
+   again, is then asked what the value is: copies that must change together,
+   or a value nothing near it explains, keep it; a value that the field or
+   argument it fills or a comment beside it explains, an idiom such as a
+   tolerance near zero or a unit conversion, or a hand-tuned number make it a
+   note. A finding that rests only on a value changing between environments
+   is asked, with the value's function or the lines that use the constant,
+   where it would differ: each installation or the author's own account
+   keeps it; the same in every copy on purpose (the program's own service, a
+   provider's fixed address, a path the platform fixes), a fallback used only
+   when configuration gives none, or code no deployment runs, at 0.80, make it
+   a note.
    Special-case findings in different files that name the same identity
    become one finding at the strongest site; the others are notes pointing at
    it. Numbers and paths are not grouped: `1000` meant metres per kilometre in
@@ -220,7 +235,14 @@ signatures, or one candidate pair.
    `eval` of model output; a check per kind decides and names the kind. An
    injection whose origin stays unclear or is the function's parameters is
    asked its origin and checks again with up to three callers; its answer
-   replaces the traced one unless only the traced one is decisive.
+   replaces the traced one unless only the traced one is decisive. A consider
+   that still rests on the function's parameters is asked, with its callers,
+   what the values it places can hold: text the program fixes (literals its
+   callers pass, numbers, names from a fixed list), values it creates itself,
+   or a local tool's own arguments make it a note; text another party can set,
+   or callers not shown, keep it. Asked where the values come from, the
+   recheck answered "the function's parameters" at 0.9 even for a helper
+   whose every caller passed a literal SQL fragment.
    The markup check names text shown as a JSX child and CSS values or class
    names as escaped or inert; sending where each built string goes did not
    settle React units, the examples did. A sensitive-data trace lists the
@@ -270,7 +292,15 @@ signatures, or one candidate pair.
    `escape_html_entities_in_json = false`) and whether passwords are saved
    or checked as plain text: in DVGA, JavaVulnerableLab, NodeGoat and
    RailsGoat the broad question found these at 0.93 to 0.98 while no check
-   named the setting, so they were notes. A broad weak-setting
+   named the setting, so they were notes. The TLS check asks whether code
+   accepts a server's certificate, host key or host name without verifying
+   it, so a connection made without TLS (gRPC's insecure credentials, an
+   insecure OpenTelemetry exporter, `sslmode=disable`) presents nothing to
+   verify, and verification skipped only when a caller or the operator asks
+   for it is not turned off: asked whether code turns verification off, a
+   microservices demo's cluster-internal gRPC clients stayed reviews
+   whatever the examples said. The escape check names i18next's
+   `escapeValue: false` in a React app as escaping kept. A broad weak-setting
    answer that none of the specific checks leans toward names no setting to
    change and is at most a note: on an action marked `[AllowAnonymous]` on
    purpose it was 0.85 while every check stayed at 0.30 or less.
@@ -393,8 +423,15 @@ signatures, or one candidate pair.
    numbers, or values handed to it) was tried for considers on parameters
    and dropped: it cleared a sort column taken from the request as readily
    as clauses with placeholders. The same question about paths cleared real
-   traversals, reading names stored in an index as the program's own, so path
-   checks stay undecided until callers show more. The SQL check counts
+   traversals, reading names stored in an index as the program's own. Outside
+   PHP, an undecided path check is now asked, with its callers, where the
+   paths come from, naming a record users can edit as another party's input
+   and offering the local user's command line or settings: the program's own
+   paths or the local user's at 0.80 clear it (74 units on the corpus, among
+   them httprouter serving a directory through `http.Dir`). A path, URL or
+   redirect check still undecided on the function's parameters, whose Choice
+   does not lean toward another party's input, is a note, as a found one
+   already was: 450 injection units had stayed uncertain that way. The SQL check counts
    identifiers quoted by doubling embedded quotes as handled (identifiers
    cannot be bound), and the URL check excludes requests a web page sends from
    the user's browser; on fresh repositories both had flagged such code, while
diff --git a/src/catalog.rs b/src/catalog.rs
index 01c3b77..f48a9b3 100644
--- a/src/catalog.rs
+++ b/src/catalog.rs
@@ -275,11 +275,12 @@ pub fn rule_version(key: &str) -> &'static str {
         FILE_ORGANIZATION => "19",
         FUNCTION_SIMPLIFICATION => "14",
         SHARED_LOGIC => "20",
-        TEST_VALUE => "6",
+        TEST_VALUE => "7",
         TEST_REDUNDANCY => "4",
-        INJECTION => "8",
+        INJECTION => "10",
         SENSITIVE_DATA => "7",
-        HARDCODED_VALUES | UNSAFE_SETTINGS => "5",
+        HARDCODED_VALUES => "7",
+        UNSAFE_SETTINGS => "6",
         AGENT_CONTEXT => "3",
         COMMENTS => "3",
         LARGE_DOCS => "3",
diff --git a/src/evaluate.rs b/src/evaluate.rs
index d90e1d4..c88c426 100644
--- a/src/evaluate.rs
+++ b/src/evaluate.rs
@@ -216,8 +216,9 @@ impl Session<'_> {
         // Traces judge where a security concern's values come from; rechecks
         // settle uncertain units; a security check still undecided is asked
         // where its URL comes from or its output goes, and an outline its kind;
-        // locate follow-ups then point split findings at a block. Each depends
-        // on the answers before it.
+        // locate follow-ups then point split findings at a block, and a
+        // located value is asked what it is. Each depends on the answers
+        // before it.
         for follow_up in [
             crate::units::doc_checks,
             crate::units::traces,
@@ -225,6 +226,7 @@ impl Session<'_> {
             crate::units::settles,
             crate::units::kinds,
             crate::units::locates,
+            crate::units::value_kinds,
         ] {
             let tasks: Vec<_> = follow_up(&plan, &report.files)
                 .iter()
diff --git a/src/units/compose.rs b/src/units/compose.rs
index 19f61eb..9687473 100644
--- a/src/units/compose.rs
+++ b/src/units/compose.rs
@@ -3,8 +3,9 @@
 use super::{
     Access, Block, Detail, FilePlan, Presence, UnitPlan,
     outcome::{
-        Answers, Outcome, at_most_note, benefit, checks, choice, document_split, lowered, noul,
-        open, origin_outcome, score, settled_checks, several_kind, unit_outcome, value_signals,
+        Answers, Outcome, at_most_note, benefit, checks, choice, choice_mass, document_split,
+        lowered, noul, open, origin_outcome, score, settled_checks, several_kind, unit_outcome,
+        value_signals,
     },
     wording::{Wording, comment_reason, comment_wording},
     wording::{
@@ -59,8 +60,10 @@ fn security_answers<'a>(unit: &UnitPlan, judgments: &'a [Judgment]) -> Answers<'
             merged.insert(question, answer);
         }
     }
-    // The settle answers sit beside the checks they settle, under their own names.
+    // The settle answers sit beside the checks they settle, under their own
+    // names, and so does what an injection consider's values can hold.
     merged.extend(answers(judgments, &unit.id, Pass::Settle));
+    merged.extend(answers(judgments, &unit.id, Pass::Locate));
     merged
 }
 
@@ -119,7 +122,9 @@ fn resolved<'a>(unit: &UnitPlan, judgments: &'a [Judgment]) -> (Outcome, Answers
     } else if unit.rule == catalog::COMMENTS {
         comment_answers(unit, judgments)
     } else if unit.rule == catalog::TEST_VALUE {
-        test_value_answers(unit, judgments)
+        let merged = test_value_answers(unit, judgments);
+        let outcome = leaning_test(unit, judgments, unit_outcome(unit, &merged));
+        return (outcome, merged);
     } else if unit.rule == catalog::TEST_REDUNDANCY {
         // Whether each test checks something the other does not, asked of a
         // pair that reached a review, sits beside its answers.
@@ -132,6 +137,26 @@ fn resolved<'a>(unit: &UnitPlan, judgments: &'a [Judgment]) -> (Outcome, Answers
     (unit_outcome(unit, &merged), merged)
 }
 
+/// A test whose hollow checks stay undecided once its recheck is asked (or
+/// when it has none) leans: below 0.50 it is clear. Labeled from the code,
+/// 4 of 43 such tests below 0.50 checked only their mocks or recomputed
+/// their expected value (5 counting a test whose one real check is weak),
+/// against 10 of 35 at 0.50 or more; 636 of the 792 undecided tests on the
+/// corpus lean below.
+fn leaning_test(unit: &UnitPlan, judgments: &[Judgment], outcome: Outcome) -> Outcome {
+    let rechecked =
+        unit.recheck.is_none() || !answers(judgments, &unit.id, Pass::Recheck).is_empty();
+    match outcome {
+        Outcome::Uncertain(p)
+            if rechecked
+                && !crate::policy::probability_at_least(p, crate::policy::LEADING_PROBABILITY) =>
+        {
+            Outcome::Clear
+        }
+        other => other,
+    }
+}
+
 /// The pass of the follow-ups whose questions sit beside the first answers
 /// under their own ids: document section and pair checks, the kind of a
 /// large document, and benign-kind value checks.
@@ -248,6 +273,16 @@ pub fn unlocated_units(plan: &FilePlan, judgments: &[Judgment]) -> BTreeSet<Stri
                 } => matches!(outcome, Outcome::Review(_)),
                 // Only the internal-details check raises a test's consider.
                 Detail::Test { confirm: Some(_) } => matches!(outcome, Outcome::Consider(_)),
+                // An injection consider rests on the function's parameters
+                // unless its origin was another party.
+                Detail::Security {
+                    confirm: Some(_), ..
+                } => {
+                    matches!(outcome, Outcome::Consider(_))
+                        && !resolved
+                            .get("origin")
+                            .is_some_and(|a| matches!(origin_outcome(a), Outcome::Review(_)))
+                }
                 Detail::Function {
                     locate: Some(_), ..
                 } => raised(resolved.get("split").map(|a| benefit(a))),
@@ -1076,7 +1111,12 @@ fn capped(
     if unnamed_value(unit, judgments) {
         return lowered(lowered(outcome));
     }
-    if single_use_value(unit, judgments) || short_outline(unit) || small_section(unit) {
+    if single_use_value(unit, judgments)
+        || readable_value(unit, judgments)
+        || same_everywhere(unit, judgments)
+        || short_outline(unit)
+        || small_section(unit)
+    {
         return at_most_note(outcome);
     }
     if named_value_only(unit, judgments) {
@@ -1089,6 +1129,90 @@ fn capped(
     if lower { lowered(outcome) } else { outcome }
 }
 
+/// The kind follow-up of each hardcoded-value finding not yet asked one:
+/// what the value is, for a consider that rests on a value's name whose
+/// file writes the value again; where the value or constant would differ,
+/// for a finding that rests on the environment. Both need the value or
+/// constant the locate named.
+pub fn unkinded_values(
+    plan: &FilePlan,
+    judgments: &[Judgment],
+) -> Vec<(serde_json::Value, super::Asked)> {
+    plan.units
+        .iter()
+        .filter(|u| u.presence == Presence::Judged)
+        .filter_map(|u| {
+            let asked = answers(judgments, &u.id, Pass::Locate);
+            if asked.contains_key("value_kind") || asked.contains_key("environment_kind") {
+                return None;
+            }
+            match &u.detail {
+                Detail::Values {
+                    locate: Some(locate),
+                    repeated,
+                    ..
+                } => {
+                    let option = located_option(u, judgments, ("value", 'v'))?;
+                    if named_value_only(u, judgments) && repeated.get(option) == Some(&true) {
+                        super::hardcoded::value_kind(locate, option, &u.id)
+                    } else if environment_only(u, judgments) {
+                        super::hardcoded::environment_kind(locate, option, &u.id)
+                    } else {
+                        None
+                    }
+                }
+                Detail::Constants {
+                    locate: Some(locate),
+                    ..
+                } if environment_only(u, judgments) => {
+                    let option = located_constant(u, judgments)?;
+                    super::hardcoded::environment_kind(locate, option, &u.id)
+                }
+                _ => None,
+            }
+        })
+        .collect()
+}
+
+/// Such a consider whose value, asked what it is, clearly reads for itself
+/// where it is used: the field or argument it fills or a comment beside it
+/// says what it is, or it is an idiom or a hand-tuned number, together at
+/// the threshold of a clear located part. Its finding is a note; a value
+/// with copies that must change together, or that nothing explains, stays
+/// a consider. Leaning toward those kinds was not enough: at 0.50 they took
+/// 30 of 46 right considers with 47 of 64 wrong ones.
+fn readable_value(unit: &UnitPlan, judgments: &[Judgment]) -> bool {
+    named_value_only(unit, judgments)
+        && choice_mass(
+            answers(judgments, &unit.id, Pass::Locate)
+                .get("value_kind")
+                .copied(),
+            &super::questions::READABLE_VALUES,
+        )
+        .is_some_and(|p| {
+            crate::policy::probability_at_least(p, crate::policy::LOCATION_PROBABILITY)
+        })
+}
+
+/// A finding that rests on the environment whose value or constant, asked
+/// where it would differ, needs no configuration at the review threshold:
+/// the same in every copy of the program on purpose, a fallback used only
+/// when configuration gives none, or code no deployment runs. Its finding
+/// is a note. Labeled by hand, that took 17 of 36 wrong reviews and
+/// considers and 2 of 17 right ones (a frontend's API host, edited in code
+/// three times, and a template author's domain as a fallback); leaning at
+/// 0.50 would have taken 25 wrong and 6 right.
+fn same_everywhere(unit: &UnitPlan, judgments: &[Judgment]) -> bool {
+    environment_only(unit, judgments)
+        && choice_mass(
+            answers(judgments, &unit.id, Pass::Locate)
+                .get("environment_kind")
+                .copied(),
+            &super::questions::SAME_EVERYWHERE,
+        )
+        .is_some_and(|p| crate::policy::probability_at_least(p, crate::policy::REVIEW_PROBABILITY))
+}
+
 /// A function's hardcoded-value review or consider whose value was not
 /// named: the locate Choice picked none clearly, or there were too many
 /// values to offer. Its finding is a note, since a reader cannot tell what
@@ -1108,7 +1232,22 @@ fn unnamed_value(unit: &UnitPlan, judgments: &[Judgment]) -> bool {
 /// wrong ones tuning in game, audio and animation code (a scheduler's
 /// 500 ms, a hash seed, a mix gain, a float epsilon).
 fn named_value_only(unit: &UnitPlan, judgments: &[Judgment]) -> bool {
-    if !matches!(unit.detail, Detail::Values { .. }) {
+    matches!(unit.detail, Detail::Values { .. }) && rests_only_on(unit, judgments, "magic")
+}
+
+/// A hardcoded-value review or consider that rests only on whether a value
+/// changes between environments: a file's constants always do.
+fn environment_only(unit: &UnitPlan, judgments: &[Judgment]) -> bool {
+    rests_only_on(unit, judgments, "environment")
+}
+
+/// A hardcoded-value review or consider whose raised questions are all
+/// `question`.
+fn rests_only_on(unit: &UnitPlan, judgments: &[Judgment], question: &str) -> bool {
+    if !matches!(
+        unit.detail,
+        Detail::Values { .. } | Detail::Constants { .. }
+    ) {
         return false;
     }
     let (outcome, answers) = resolved(unit, judgments);
@@ -1120,7 +1259,7 @@ fn named_value_only(unit: &UnitPlan, judgments: &[Judgment]) -> bool {
         .unwrap_or_default()
         .iter()
         .filter(|(_, o, _)| matches!(o, Outcome::Review(_) | Outcome::Consider(_)))
-        .all(|(question, ..)| *question == "magic")
+        .all(|(raised, ..)| *raised == question)
 }
 
 /// Such a finding about a value its file writes once is a note: labeled by
@@ -1219,6 +1358,10 @@ fn lowered_value(unit: &UnitPlan, judgments: &[Judgment]) -> Option<(Strength, &
         "No single value stood out, so it is a note."
     } else if single_use_value(unit, judgments) {
         "It is written once in its file, so it is a note."
+    } else if readable_value(unit, judgments) {
+        "It reads for itself where it is used, so it is a note."
+    } else if same_everywhere(unit, judgments) {
+        "It likely stays the same wherever the program runs, or is only a fallback, so it is a note."
     } else if named_value_only(unit, judgments)
         && matches!(resolved(unit, judgments).0, Outcome::Review(_))
     {
diff --git a/src/units/follow_ups.rs b/src/units/follow_ups.rs
index 196f95c..6b4376f 100644
--- a/src/units/follow_ups.rs
+++ b/src/units/follow_ups.rs
@@ -7,7 +7,8 @@ use std::collections::BTreeSet;
 
 /// One locate follow-up per function whose split raised a review or consider,
 /// per hardcoded-value function raised to a review or consider, per redundant
-/// test pair raised to a review, and per test that asserts internal details.
+/// test pair raised to a review, per test that asserts internal details, and
+/// per injection consider that rests on its parameters.
 pub fn locates(plan: &Plan, files: &[FileResult]) -> Vec<Planned> {
     follow_ups(plan, files, compose::unlocated_units, |unit| {
         match &unit.detail {
@@ -15,12 +16,35 @@ pub fn locates(plan: &Plan, files: &[FileResult]) -> Vec<Planned> {
             | Detail::Document { locate, .. }
             | Detail::Values { locate, .. }
             | Detail::Constants { locate, .. } => locate.as_ref(),
-            Detail::TestPair { confirm, .. } | Detail::Test { confirm } => confirm.as_ref(),
+            Detail::TestPair { confirm, .. }
+            | Detail::Test { confirm }
+            | Detail::Security { confirm, .. } => confirm.as_ref(),
             _ => None,
         }
     })
 }
 
+/// One question per hardcoded-value consider resting on a value's name
+/// whose value its file writes again: what that value is. It needs the
+/// value the locate named, so it follows the locates.
+pub fn value_kinds(plan: &Plan, files: &[FileResult]) -> Vec<Planned> {
+    let mut planned = Vec::new();
+    for (&owner, file_plan) in &plan.files {
+        let file = &files[owner];
+        if file.status == Status::Error {
+            continue;
+        }
+        for (request, asked) in compose::unkinded_values(file_plan, &file.judgments) {
+            planned.push(Planned {
+                owner,
+                request,
+                asked,
+            });
+        }
+    }
+    planned
+}
+
 /// The section and pair checks of documents that are not finished plans.
 pub fn doc_checks(plan: &Plan, files: &[FileResult]) -> Vec<Planned> {
     let finished = compose::finished_plans(plan, files);
diff --git a/src/units/hardcoded.rs b/src/units/hardcoded.rs
index b204c9e..ae3dfc0 100644
--- a/src/units/hardcoded.rs
+++ b/src/units/hardcoded.rs
@@ -4,15 +4,16 @@
 //! a Noul on whether the function special-cases one identity. A unit left
 //! undecided is asked, alone, whether every value is of an acceptable kind.
 use super::{
-    Detail, FileContext, FilePlan, Planned, Presence, Questions, UnitPlan, compact, identity,
-    pack_runs, questions, unique_ids,
+    Asked, Detail, FileContext, FilePlan, FollowUp, Planned, Presence, Questions, UnitPlan,
+    compact, identity, pack_runs, questions, unique_ids,
 };
 use crate::{
-    analysis::{literals::Constant, units::Unit},
+    analysis::{literals::Constant, sites::clip, units::Unit},
     catalog::HARDCODED_VALUES,
     schema::Pass,
 };
 use serde_json::{Value, json};
+use std::path::Path;
 
 pub(super) fn plan(
     file: &FileContext<'_>,
@@ -49,7 +50,7 @@ pub(super) fn plan(
                     }
                 }
                 let locate = (choices.len() <= LOCATE_CHOICES)
-                    .then(|| locate(file, &unit.name, source, &id, &choices));
+                    .then(|| locate(file, (unit, source), &id, &choices));
                 Detail::Values {
                     values: unit.literals.iter().map(|l| l.text.clone()).collect(),
                     repeated: choices
@@ -82,46 +83,213 @@ pub(super) fn plan(
 /// Most distinct values a locate Choice offers; a unit with more is not located.
 const LOCATE_CHOICES: usize = 24;
 
-/// How often a literal is written in `source`: a number as a whole token (not
+/// How often a literal is written in `source`.
+fn occurrences(source: &str, literal: &str) -> usize {
+    written_at(source, literal).count()
+}
+
+/// Where a literal is written in `source`: a number as a whole token (not
 /// part of `100` or `10.5` for `10`), other text wherever it appears without
 /// its quotes.
-fn occurrences(source: &str, literal: &str) -> usize {
+fn written_at<'a>(source: &'a str, literal: &'a str) -> impl Iterator<Item = usize> + 'a {
     let text = literal.trim_matches(['"', '\'', '`']);
-    if text.is_empty() {
-        return 0;
-    }
     let number = text.starts_with(|c: char| c.is_ascii_digit() || c == '-' || c == '.');
     let word = |c: char| c.is_alphanumeric() || c == '_' || c == '.';
-    source
-        .match_indices(text)
-        .filter(|(at, _)| {
+    (!text.is_empty())
+        .then_some(text)
+        .into_iter()
+        .flat_map(move |text| source.match_indices(text))
+        .filter(move |(at, _)| {
             !number
                 || !(source[..*at].chars().next_back().is_some_and(word)
                     || source[at + text.len()..].chars().next().is_some_and(word))
         })
-        .count()
+        .map(|(at, _)| at)
+}
+
+/// Lines of the file outside a unit shown with each of its values or
+/// constants, at most.
+const ELSEWHERE_LINES: usize = 3;
+
+/// The lines of `source` outside `lines` that write `literal`, numbered.
+fn elsewhere(source: &str, literal: &str, lines: (usize, usize)) -> Vec<String> {
+    numbered_lines(source, written_at(source, literal), lines)
+}
+
+/// The lines of `source` outside a constant's own `lines` that name it.
+fn used_at(source: &str, name: &str, lines: (usize, usize)) -> Vec<String> {
+    let word = |c: char| c.is_alphanumeric() || c == '_' || c == '$';
+    let named = source.match_indices(name).map(|(at, _)| at).filter(|&at| {
+        !(source[..at].chars().next_back().is_some_and(word)
+            || source[at + name.len()..].chars().next().is_some_and(word))
+    });
+    numbered_lines(source, named, lines)
+}
+
+/// The lines holding the ascending byte offsets `at`, outside `lines`,
+/// numbered and at most `ELSEWHERE_LINES`.
+fn numbered_lines(
+    source: &str,
+    at: impl Iterator<Item = usize>,
+    lines: (usize, usize),
+) -> Vec<String> {
+    let mut found: Vec<(usize, String)> = Vec::new();
+    let (mut line, mut counted) = (1, 0);
+    for at in at {
+        line += source.as_bytes()[counted..at]
+            .iter()
+            .filter(|b| **b == b'\n')
+            .count();
+        counted = at;
+        if (lines.0..=lines.1).contains(&line) || found.last().is_some_and(|(l, _)| *l == line) {
+            continue;
+        }
+        let start = source[..at].rfind('\n').map_or(0, |i| i + 1);
+        let end = source[at..].find('\n').map_or(source.len(), |i| at + i);
+        found.push((line, format!("{line}: {}", clip(source[start..end].trim()))));
+        if found.len() == ELSEWHERE_LINES {
+            break;
+        }
+    }
+    found.into_iter().map(|(_, text)| text).collect()
 }
 
-/// Which value a finding is about: the function's source and its distinct values.
+/// Which value a finding is about: the function's source and its distinct
+/// values, each with the other lines of the file that write it. Without
+/// them, a value that must stay equal to a copy in another function read as
+/// clear where it was used, and a value that merely recurs, such as the 4
+/// of quarters in a year, read as a value to share.
 fn locate(
     file: &FileContext<'_>,
-    name: &str,
-    source: &str,
+    (unit, source): (&Unit, &str),
     id: &str,
     choices: &[String],
-) -> (Value, super::Asked) {
+) -> (Value, Asked) {
     let ids = option_ids('v', choices.len());
+    let values: Vec<Value> = ids
+        .iter()
+        .zip(choices)
+        .map(|(id, value)| {
+            let mut entry = json!({"id": id, "value": value});
+            let lines = elsewhere(file.source, value, (unit.line, unit.end_line));
+            if !lines.is_empty() {
+                entry["elsewhere"] = json!(lines);
+            }
+            entry
+        })
+        .collect();
     let state = json!({
         "file": file.file_state(),
         "function": {
-            "name": name,
+            "name": unit.name,
             "source": source,
-            "values": ids.iter().zip(choices).map(|(id, value)| json!({"id": id, "value": value})).collect::<Vec<_>>(),
+            "values": values,
         },
     });
     locate_request(file, id, ("value", questions::hardcoded_value(&ids)), state)
 }
 
+/// What a consider's value is, asked about the value its locate named: the
+/// function, the value and the other lines of its file that write it, taken
+/// from the locate request.
+pub(super) fn value_kind(locate: &FollowUp, option: usize, id: &str) -> Option<(Value, Asked)> {
+    let located = locate.request();
+    let function = &located["state"]["function"];
+    let entry = function["values"].get(option)?;
+    let mut state = json!({
+        "file": located["state"]["file"],
+        "function": {"name": function["name"], "source": function["source"]},
+        "value": entry["value"],
+    });
+    if let Some(lines) = entry.get("elsewhere") {
+        state["elsewhere"] = lines.clone();
+    }
+    let mut questions = Questions::default();
+    questions.ask(
+        "value_kind".into(),
+        questions::hardcoded_value_kind(),
+        id,
+        HARDCODED_VALUES,
+        "value_kind",
+        Pass::Locate,
+    );
+    Some(located_request(&located, state, questions))
+}
+
+/// Where an environment finding's value or constant would differ, asked
+/// about the one its locate named: the function and the value with the
+/// other lines that write it, or the constant with the lines that use it,
+/// taken from the locate request.
+pub(super) fn environment_kind(
+    locate: &FollowUp,
+    option: usize,
+    id: &str,
+) -> Option<(Value, Asked)> {
+    let located = locate.request();
+    let file = &located["state"]["file"];
+    let (state, subject, note) = if let Some(constants) = located["state"]["constants"].as_array() {
+        let mut constant = constants.get(option)?.clone();
+        let used = constant.as_object_mut()?.remove("used_at");
+        constant.as_object_mut()?.remove("id");
+        let mut state = json!({"file": file, "constant": constant});
+        if let Some(lines) = used {
+            state["used_at"] = lines;
+        }
+        (
+            state,
+            "constant",
+            "`used_at` lists lines of the file that use the constant.",
+        )
+    } else {
+        let function = &located["state"]["function"];
+        let entry = function["values"].get(option)?;
+        let mut state = json!({
+            "file": file,
+            "function": {"name": function["name"], "source": function["source"]},
+            "value": entry["value"],
+        });
+        if let Some(lines) = entry.get("elsewhere") {
+            state["elsewhere"] = lines.clone();
+        }
+        (
+            state,
+            "value",
+            "`elsewhere` lists other lines of the file that write the same value.",
+        )
+    };
+    let mut questions = Questions::default();
+    questions.ask(
+        "environment_kind".into(),
+        questions::hardcoded_environment_kind(subject, note),
+        id,
+        HARDCODED_VALUES,
+        "environment_kind",
+        Pass::Locate,
+    );
+    Some(located_request(&located, state, questions))
+}
+
+/// A follow-up of the file a locate request was made for: its model, its
+/// sources and `state`, asking `questions`.
+fn located_request(located: &Value, state: Value, questions: Questions) -> (Value, Asked) {
+    let language = located["state"]["file"]["language"]
+        .as_str()
+        .unwrap_or_default();
+    let sources: Vec<(&Path, &str)> = located["jevgate"]["sources"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .filter_map(|s| Some((Path::new(s["path"].as_str()?), s["source_hash"].as_str()?)))
+        .collect();
+    super::evidence::request(
+        located["model"].as_str().unwrap_or_default(),
+        "locate",
+        &sources,
+        state,
+        questions.reworded(language),
+    )
+}
+
 /// Option ids `{prefix}0`, `{prefix}1`, … for a locate Choice over `count` entries.
 fn option_ids(prefix: char, count: usize) -> Vec<String> {
     (0..count).map(|i| format!("{prefix}{i}")).collect()
@@ -133,7 +301,7 @@ fn locate_request(
     id: &str,
     (question, body): (&'static str, Value),
     state: Value,
-) -> (Value, super::Asked) {
+) -> (Value, Asked) {
     let mut questions = Questions::default();
     questions.ask(
         question.into(),
@@ -177,10 +345,7 @@ fn send_or_split(
     }
 }
 
-fn functions_request(
-    file: &FileContext<'_>,
-    items: &[(usize, String, Value)],
-) -> (Value, super::Asked) {
+fn functions_request(file: &FileContext<'_>, items: &[(usize, String, Value)]) -> (Value, Asked) {
     let mut questions = Questions::default();
     for (index, (_, id, _)) in items.iter().enumerate() {
         let values = format!("functions[{index}].values");
@@ -247,10 +412,19 @@ fn plan_constants(
         let with_ids: Vec<Value> = ids
             .iter()
             .zip(&listed)
-            .map(|(id, constant)| {
-                let mut constant = constant.clone();
-                constant["id"] = json!(id);
-                constant
+            .zip(constants)
+            .map(|((id, listed), constant)| {
+                let mut listed = listed.clone();
+                listed["id"] = json!(id);
+                let lines = used_at(
+                    file.source,
+                    &constant.name,
+                    (constant.line, constant.end_line),
+                );
+                if !lines.is_empty() {
+                    listed["used_at"] = json!(lines);
+                }
+                listed
             })
             .collect();
         locate_request(
@@ -302,7 +476,7 @@ fn benign_request(
     id: &str,
     evidence: Value,
     function: bool,
-) -> Option<(Value, super::Asked)> {
+) -> Option<(Value, Asked)> {
     let (values, code, asked): (&str, &str, &[&'static str]) = if function {
         (
             "functions[0].values",
diff --git a/src/units/mod.rs b/src/units/mod.rs
index a4e9ef3..355349e 100644
--- a/src/units/mod.rs
+++ b/src/units/mod.rs
@@ -32,7 +32,7 @@ mod workflows;
 use answers::Questions;
 pub use answers::{Asked, record};
 use evidence::{FileContext, compact, identity, pack, pack_runs, request, unique_ids};
-pub use follow_ups::{doc_checks, kinds, locates, rechecks, settles, traces};
+pub use follow_ups::{doc_checks, kinds, locates, rechecks, settles, traces, value_kinds};
 use plan::Scope;
 pub use plan::plan;
 pub use spacetimedb::spacetimedb_module;
@@ -186,6 +186,9 @@ pub enum Detail {
         /// trace and recheck, such as where its URLs come from or its output
         /// goes; each is asked only while its checks are undecided.
         settles: Vec<Settle>,
+        /// For injection, what the values it places can hold, asked only
+        /// after a consider that rests on its parameters.
+        confirm: Option<FollowUp>,
         /// Django code, asked the Django checks: a weak setting must be
         /// named by one of them.
         django: bool,
diff --git a/src/units/outcome/injection.rs b/src/units/outcome/injection.rs
index 62c7efc..c459c86 100644
--- a/src/units/outcome/injection.rs
+++ b/src/units/outcome/injection.rs
@@ -26,7 +26,7 @@ pub(in crate::units) fn origin_outcome(answer: &Answer) -> Outcome {
 /// Kinds where a variable is a concern only when another party controls it:
 /// helpers that build a path, URL or redirect target from their parameters
 /// are everywhere.
-const RESOURCE_CHECKS: [&str; 3] = ["path", "url", "redirect"];
+pub(in crate::units) const RESOURCE_CHECKS: [&str; 3] = ["path", "url", "redirect"];
 
 /// Presence alone never raises an injection: it only decides whether the
 /// trace is asked. When every specific check clears the unit, it is clear;
@@ -60,7 +60,19 @@ pub(in crate::units) fn injection_outcome<'a>(
         (_, Some(p)) => Outcome::Review(p),
         (outcome, None) => outcome,
     };
-    Some(by_origin(origin, &found, get))
+    Some(match by_origin(origin, &found, get) {
+        Outcome::Consider(p) if program_values(get) => Outcome::Note(p),
+        outcome => outcome,
+    })
+}
+
+/// Whether what a consider's values can hold, asked after it, leans toward
+/// the program's own: literals its callers pass, values it creates, or the
+/// arguments of a local tool. Such a consider, resting on the function's
+/// parameters, is a note.
+fn program_values<'a>(get: &impl Fn(&str) -> Option<&'a Answer>) -> bool {
+    choice_mass(get("values"), &questions::PROGRAM_VALUES)
+        .is_some_and(|p| probability_at_least(p, LEADING_PROBABILITY))
 }
 
 /// When the markup check found a variable and the PHP markup Choice names
@@ -84,6 +96,24 @@ fn found_injections<'a>(get: &impl Fn(&str) -> Option<&'a Answer>) -> Vec<&'stat
         .collect()
 }
 
+/// Whether the Choice that settles an undecided resource check was asked
+/// (where its paths, URLs or redirect targets come from) without leaning
+/// toward another party's input, which keeps the check open.
+fn settle_asked<'a>(check: &str, get: &impl Fn(&str) -> Option<&'a Answer>) -> bool {
+    let question = match check {
+        "path" if get("path_parts").is_some() => "path_parts",
+        "path" => "path_source",
+        "url" => "url_parts",
+        "redirect" => "redirect_target",
+        _ => return false,
+    };
+    choice_mass(get(question), &OUTSIDE_SOURCES)
+        .is_some_and(|p| !probability_at_least(p, LEADING_PROBABILITY))
+}
+
+/// Options of the settle Choices that name another party's input.
+const OUTSIDE_SOURCES: [&str; 3] = ["outside", "request", "stored"];
+
 /// The origin's outcome given the checks that found something: with none,
 /// another party's values are a note and parameters a note only when a
 /// check leans toward a concern; parameters only in paths or URLs are lower.
@@ -96,14 +126,26 @@ fn by_origin<'a>(
     match outcome {
         Outcome::Review(p) if found.is_empty() => Outcome::Note(p),
         Outcome::Consider(p) if found.is_empty() => {
-            let leaning = settled_checks(catalog::INJECTION, get)
+            let open: Vec<(&str, Outcome)> = settled_checks(catalog::INJECTION, get)
                 .into_iter()
                 .filter(|(_, o)| *o != Outcome::Clear)
+                .collect();
+            let leaning = open
+                .iter()
                 .filter_map(|(id, _)| get(id))
                 .map(lean)
                 .fold(0.0, f64::max);
-            if probability_at_least(leaning, LEADING_PROBABILITY) {
-                Outcome::Note(leaning)
+            // Parameters in a path, URL or redirect are a note until a caller
+            // shows another party controls them, found or not: undecided,
+            // 320 such units on the corpus stayed uncertain while a found one
+            // was a note. Only once the Choice that settles each check was
+            // asked and did not clear it.
+            let resources_open = !open.is_empty()
+                && open
+                    .iter()
+                    .all(|(id, _)| RESOURCE_CHECKS.contains(id) && settle_asked(id, get));
+            if probability_at_least(leaning, LEADING_PROBABILITY) || resources_open {
+                Outcome::Note(leaning.max(p))
             } else {
                 Outcome::Uncertain(p)
             }
diff --git a/src/units/outcome/mod.rs b/src/units/outcome/mod.rs
index 9b409b4..0d37662 100644
--- a/src/units/outcome/mod.rs
+++ b/src/units/outcome/mod.rs
@@ -27,14 +27,14 @@ pub(super) use comments::{comment_concern_kind, comment_outcome, comment_signals
 use documentation::stale_outcome;
 pub(super) use documentation::{document_outcome, document_split, section_signals};
 pub(super) use exposure::{Messages, django_settings_outcome, exposure_outcome, messages};
-pub(super) use injection::{injection_outcome, origin_outcome};
+pub(super) use injection::{RESOURCE_CHECKS, injection_outcome, origin_outcome};
 pub(super) use maintainability::{
     benign_key, function_outcome, organization_outcome, several_kind, shared_outcome,
     value_signals, values_outcome,
 };
 use pairs::doc_pair_outcome;
 pub(super) use pairs::{disagreement, pair_signals, repeated};
-pub(super) use security::{checks, settled_checks};
+pub(super) use security::{checks, choice_mass, settled_checks};
 pub(super) use test_rules::{redundancy_outcome, test_value_outcome};
 
 #[derive(Clone, Copy, Debug, PartialEq)]
diff --git a/src/units/outcome/security.rs b/src/units/outcome/security.rs
index c203586..0914cdf 100644
--- a/src/units/outcome/security.rs
+++ b/src/units/outcome/security.rs
@@ -55,7 +55,7 @@ pub(super) fn settled<'a>(
 }
 
 /// The share of a Choice's probability on `options`, when it was answered.
-pub(super) fn choice_mass(answer: Option<&Answer>, options: &[&str]) -> Option<f64> {
+pub(in crate::units) fn choice_mass(answer: Option<&Answer>, options: &[&str]) -> Option<f64> {
     let Answer::Choice { probabilities, .. } = answer? else {
         return None;
     };
diff --git a/src/units/questions/maintainability.rs b/src/units/questions/maintainability.rs
index 14b4a95..69b3744 100644
--- a/src/units/questions/maintainability.rs
+++ b/src/units/questions/maintainability.rs
@@ -181,7 +181,9 @@ pub fn outline_kind(tests: bool) -> Value {
 pub fn hardcoded_constant(ids: &[String]) -> Value {
     choose_id(
         "Which constant in `constants` most needs to come from configuration because it would change in another environment?",
-        format!("Options are the `id` values in `constants`. {EVIDENCE}"),
+        format!(
+            "Options are the `id` values in `constants`; a constant's `used_at` lists lines of the file that use it. {EVIDENCE}"
+        ),
         ids,
         "No single constant stands out.",
     )
@@ -191,12 +193,72 @@ pub fn hardcoded_constant(ids: &[String]) -> Value {
 pub fn hardcoded_value(ids: &[String]) -> Value {
     choose_id(
         "Which value in `function.values` most needs to come from configuration, get a descriptive name, or be read from data instead of being written in `function.source`?",
-        format!("Options are the `id` values in `function.values`. {EVIDENCE}"),
+        format!(
+            "Options are the `id` values in `function.values`; a value's `elsewhere` lists other lines of the file that write it. {EVIDENCE}"
+        ),
         ids,
         "No single value stands out.",
     )
 }
 
+/// Asked only about the value a consider resting on a value's name names,
+/// when its file writes that value again: what a reader needs to understand
+/// it. Labeled by hand, 77 of 130 such considers were wrong, their values
+/// explained by the field or argument they fill, a comment beside them, or
+/// an idiom such as a zero-length guard, while right ones had copies that
+/// must change together. Offered as the locate's `none`, those kinds also
+/// took values with such copies: 6 right considers became notes for 17
+/// wrong ones. Told that copies win over the other kinds, it chose them for
+/// wrong considers too: 22 became notes instead of 42.
+pub fn hardcoded_value_kind() -> Value {
+    json!({
+        "type": "choice",
+        "instructions": {
+            "question": "What best describes `value` where `function.source` uses it?",
+            "note": format!("`elsewhere` lists other lines of the file that write the same value. {EVIDENCE}"),
+        },
+        "criteria": {
+            "copies": "It stands for the same quantity as a copy in `elsewhere` or in this function, and the copies must change together while nothing ties them.",
+            "unexplained": "Nothing near it says what it stands for or why it has this value.",
+            "named": "The parameter, field, variable or function it goes into, or a comment beside it, says what it is.",
+            "idiom": "A common constant or idiom that reads for itself, such as a tolerance near zero, a half, a unit conversion such as 60, 1000 or 100 for percent, or a size a format fixes.",
+            "tuning": "One of many hand-tuned numbers for look, sound, motion or layout, whose exact value is a matter of taste.",
+        },
+    })
+}
+
+/// The options of `hardcoded_value_kind` under which a value reads for itself.
+pub const READABLE_VALUES: [&str; 3] = ["named", "idiom", "tuning"];
+
+/// Asked only about the value or constant an environment finding names,
+/// with the code around it: where it would differ. Labeled by hand, 39 of
+/// 57 such reviews and considers were wrong: a desktop app's own license
+/// server and OIDC client id, a redirect registered with a provider, a
+/// fallback used only when configuration gives none, a path the platform
+/// fixes, and fixtures, generator templates and scripts no deployment runs;
+/// right ones named a server, path or secret each installation must set, or
+/// the author's own account or domain. `subject` names the state key.
+pub fn hardcoded_environment_kind(subject: &str, note: &str) -> Value {
+    json!({
+        "type": "choice",
+        "instructions": {
+            "question": format!("Where would `{subject}` differ between the places this program runs?"),
+            "note": format!("{note} {EVIDENCE}"),
+        },
+        "criteria": {
+            "each": "Each installation, server, account or machine that runs the program needs its own value, and the code does not read it from configuration or the environment.",
+            "author": "It names the author's own account, domain, machine, path or credentials, which anyone else running the program would have to change.",
+            "fallback": "It is only the default used when configuration or the environment gives none.",
+            "same": "Every copy of the program uses it on purpose: the program's own public service or registered client id, a provider's fixed address, a path the platform fixes, or text shown to users.",
+            "not_run": "The code does not run where the program is deployed: a test fixture or mock, an example, a template a generator copies, or a script run by hand.",
+        },
+    })
+}
+
+/// The options of `hardcoded_environment_kind` under which the value needs
+/// no configuration.
+pub const SAME_EVERYWHERE: [&str; 3] = ["fallback", "same", "not_run"];
+
 /// Whether a value fixed in code changes between environments. `values` names
 /// the list of candidate values; `code` describes the code that uses them.
 /// Criteria name what is not environment-specific (the program's own routes,
diff --git a/src/units/questions/security.rs b/src/units/questions/security.rs
index a2ec26d..7dee56a 100644
--- a/src/units/questions/security.rs
+++ b/src/units/questions/security.rs
@@ -185,6 +185,46 @@ pub fn security_origin(code: &str, callers: bool, django: bool) -> Value {
     )
 }
 
+/// What the values of an injection consider resting on the function's
+/// parameters can hold, asked only for such a finding, with its callers.
+/// Labeled by hand, those considers were right 30 times in 81: most wrong
+/// ones placed text every caller passes as a literal, such as a Rust
+/// helper's SQL fragments, or a command-line tool's own arguments, while
+/// right ones placed names from a database others write, fetched page
+/// titles or model output. Asked where the values come from, the recheck
+/// answered "the function's parameters" at 0.9 even when its callers passed
+/// literals.
+pub fn injection_values(code: &str, callers: bool) -> Value {
+    let (fixed, note) = if callers {
+        (
+            "Only text the program fixes: literals and constants, written in this code or passed by every caller in `callers`; numbers, dates or other typed values that cannot hold markup or syntax; or names chosen from a fixed list.",
+            format!("{CALLERS} {EVIDENCE}"),
+        )
+    } else {
+        (
+            "Only text the program fixes: literals and constants written in this code; numbers, dates or other typed values that cannot hold markup or syntax; or names chosen from a fixed list.",
+            EVIDENCE.to_string(),
+        )
+    };
+    json!({
+        "type": "choice",
+        "instructions": {
+            "question": format!("What can the values that `{code}` places into a query, command, code or markup without binding or escaping them hold?"),
+            "note": note,
+        },
+        "criteria": {
+            "fixed": fixed,
+            "own": "Values the program creates or keeps for itself, such as ids it generates, the names of its own tables, files or settings, or text it wrote itself.",
+            "local": "The arguments of a command-line program, build script or code generator, typed by the person who runs it on their own machine, or text that person runs on purpose, such as a query they typed.",
+            "outside": "Text another party can set: a network request, message or uploaded file, a page or feed fetched from the network, a language model's output, or records and names other users can write, such as rows of a shared database.",
+            "unknown": "Values from parameters or calls whose origin is not shown, which may hold any of these.",
+        },
+    })
+}
+
+/// The options of `injection_values` that hold only the program's own values.
+pub const PROGRAM_VALUES: [&str; 3] = ["fixed", "own", "local"];
+
 /// Asked in the sensitive-data trace: whether every error message is the
 /// program's own. It can only clear the error-detail signals; functions that
 /// throw the program's typed errors otherwise stayed undecided, since the
@@ -438,13 +478,27 @@ pub const VIEW_MARKUP: Check = Check {
 /// Specific weak settings, asked when the broad presence question is not clear.
 /// Turning off output escaping had no check: NodeGoat's `autoescape: false`
 /// and RailsGoat's `escape_html_entities_in_json = false` were at most notes.
+/// The TLS check's examples name what turns no verification off: in
+/// microservices-demo, gRPC's insecure credentials between the cluster's
+/// services, OpenTelemetry exporters sending to a local collector and
+/// `sslmode=disable` behind the AlloyDB connector were seven wrong reviews,
+/// and so were httpx's `verify=False` branch and vaultwarden's setting that
+/// lets the operator accept invalid SMTP certificates. Asked whether code
+/// turns verification off, gRPC's insecure credentials stayed reviews
+/// whatever the examples said, as turning TLS off; asked whether code
+/// accepts what a server presents without verifying it, a connection
+/// without TLS presents nothing. i18next's `escapeValue: false` in a React
+/// Native app was a wrong escape review.
 pub const WEAK_SETTINGS: [Check; 7] = [
     Check {
         id: "tls",
-        question: "Does `{code}` turn off certificate or host name verification?",
-        yes: "It turns off certificate or host name checks, or accepts invalid certificates or host names.",
-        no: "It keeps verification on, or makes no TLS connection.",
-        no_examples: &[],
+        question: "Does `{code}` accept a server's certificate, host key or host name without verifying it?",
+        yes: "It turns off certificate, host key or host name checks, or accepts invalid ones, such as with `verify=False`, `InsecureSkipVerify`, `rejectUnauthorized: false`, `CERT_NONE` or a host key callback that accepts any key.",
+        no: "It verifies what the server presents; it connects without TLS, where no certificate is presented to verify; or it skips verification only when its caller or the operator asks for it, and verifies by default.",
+        no_examples: &[
+            "A connection made without TLS, such as gRPC's `insecure.NewCredentials()` or `insecure_channel`, an OpenTelemetry exporter with `insecure=True`, or `sslmode=disable`",
+            "A library function that builds a TLS context without verification only when its caller passes `verify=False`, or a mail transport that accepts invalid certificates only when the operator turns on a setting for it",
+        ],
     },
     Check {
         id: "hash",
@@ -489,7 +543,9 @@ pub const WEAK_SETTINGS: [Check; 7] = [
         question: "Does `{code}` turn off the automatic escaping of values written into HTML?",
         yes: "It turns off a template engine's or serializer's escaping of HTML for output that browsers render, such as autoescape set to false or escape_html_entities_in_json set to false.",
         no: "Escaping stays on; the output is not HTML that browsers render, such as Markdown, plain-text email or source code; or it configures no escaping.",
-        no_examples: &[],
+        no_examples: &[
+            "i18next's `escapeValue: false` in a React or React Native app, whose components escape the translated text they render",
+        ],
     },
 ];
 
diff --git a/src/units/questions/settle.rs b/src/units/questions/settle.rs
index 9e4db02..db0c6c9 100644
--- a/src/units/questions/settle.rs
+++ b/src/units/questions/settle.rs
@@ -6,6 +6,46 @@
 use super::{EVIDENCE, security::CALLERS};
 use serde_json::{Value, json};
 
+/// Where a source Choice looks for the variables it asks about, and its
+/// note: with `callers`, also in what the functions that call it pass.
+fn sources_shown(callers: bool) -> (&'static str, String) {
+    if callers {
+        (
+            ", in the function or in what `callers` pass it",
+            format!("{CALLERS} {EVIDENCE}"),
+        )
+    } else {
+        ("", EVIDENCE.to_string())
+    }
+}
+
+/// Options of the path-source Choice that rule a path concern out: the
+/// program's own paths, the local user's, or no file.
+pub const OWN_PATHS: [&str; 3] = ["own", "local", "none"];
+
+/// Where the file paths a function opens, writes or deletes come from,
+/// asked outside PHP when the path check stays undecided (PHP asks its own
+/// `path_parts`). Undecided path checks were 348 units across the corpus,
+/// mostly command-line tools writing where their user points them and
+/// helpers joining a fixed directory with a name.
+pub fn security_path_source(code: &str, callers: bool) -> Value {
+    let (shown, note) = sources_shown(callers);
+    json!({
+        "type": "choice",
+        "instructions": {
+            "question": format!("Where do the file paths that `{code}` opens, writes or deletes come from?"),
+            "note": note,
+        },
+        "criteria": {
+            "own": format!("Directories and file names written in the code, the program's own directories, or its configuration or environment, with only names, ids or numbers from variables{shown}."),
+            "local": "The command line, settings or files of the person running a local program or script, such as an output path they pass.",
+            "given": "A whole path handed to the function as a parameter or field, whose origin this code does not show.",
+            "outside": "Partly from outside the program: a network request, message, uploaded file or archive entry, or a record users can edit.",
+            "none": "It opens, writes or deletes no file.",
+        },
+    })
+}
+
 /// Options of the URL-parts Choice that rule a URL concern out: a host of the
 /// program's own, or no request.
 pub const OWN_PARTS: [&str; 2] = ["own", "none"];
@@ -14,20 +54,12 @@ pub const OWN_PARTS: [&str; 2] = ["own", "none"];
 /// stays undecided: on clients of a fixed or configured service the check
 /// split on a variable path or query, while naming the host decided them. A
 /// host that is sent another URL to fetch is its own option, since internal
-/// proxies fetched what users sent. The same question about paths cleared
-/// real traversals, reading names stored in an index as the program's own,
-/// so paths are not settled this way.
+/// proxies fetched what users sent. The same question about paths once
+/// cleared real traversals, reading names stored in an index as the
+/// program's own; `security_path_source` names such records as another
+/// party's input.
 pub fn security_url_parts(code: &str, callers: bool) -> Value {
-    let shown = if callers {
-        ", in the function or in what `callers` pass it"
-    } else {
-        ""
-    };
-    let note = if callers {
-        format!("{CALLERS} {EVIDENCE}")
-    } else {
-        EVIDENCE.to_string()
-    };
+    let (shown, note) = sources_shown(callers);
     json!({
         "type": "choice",
         "instructions": {
diff --git a/src/units/security.rs b/src/units/security.rs
index 90097ef..f135e4a 100644
--- a/src/units/security.rs
+++ b/src/units/security.rs
@@ -325,6 +325,9 @@ fn push_unit(
     let recheck = (rule == INJECTION)
         .then(|| recheck(file, subject, id))
         .flatten();
+    let confirm = (rule == INJECTION)
+        .then(|| confirm(file, subject, id))
+        .flatten();
     let settles = settles(file, subject, rule, id);
     out.units.push(UnitPlan {
         rule,
@@ -344,6 +347,7 @@ fn push_unit(
             },
             trace: trace.map(Into::into),
             settles,
+            confirm: confirm.map(Into::into),
             django: subject.django,
             test_path: subject.test_path,
         },
@@ -386,9 +390,16 @@ fn send(
                 let unit = &mut out.units[*index];
                 unit.presence = Presence::NeedsContext;
                 unit.recheck = None;
-                if let Detail::Security { trace, settles, .. } = &mut unit.detail {
+                if let Detail::Security {
+                    trace,
+                    settles,
+                    confirm,
+                    ..
+                } = &mut unit.detail
+                {
                     *trace = None;
                     settles.clear();
+                    *confirm = None;
                 }
             }
         }
@@ -718,15 +729,47 @@ fn recheck(file: &FileContext<'_>, subject: &Subject<'_>, id: &str) -> Option<(V
             Pass::Recheck,
         );
     }
+    let (request, asked) = file.request("recheck", with_callers(file, subject), questions);
+    file.budget.fits(&request).then_some((request, asked))
+}
+
+/// The unit's code with the functions that call it and the enums its sites
+/// name: the evidence of its recheck and of what its values can hold.
+fn with_callers(file: &FileContext<'_>, subject: &Subject<'_>) -> Value {
     let mut state = json!({
         "file": file.file_state(),
         subject.kind: subject.state(),
-        "callers": subject.callers.iter().map(|(name, source)| json!({"name": name, "source": source})).collect::<Vec<_>>(),
     });
+    if !subject.callers.is_empty() {
+        state["callers"] = json!(
+            subject
+                .callers
+                .iter()
+                .map(|(name, source)| json!({"name": name, "source": source}))
+                .collect::<Vec<_>>()
+        );
+    }
     if !subject.enums.is_empty() {
         state["enums_named_in_sites"] = json!(subject.enums);
     }
-    let (request, asked) = file.request("recheck", state, questions);
+    state
+}
+
+/// What the values an injection consider rests on can hold, asked only
+/// when its origin was the function's parameters: the function, and the
+/// functions that call it.
+fn confirm(file: &FileContext<'_>, subject: &Subject<'_>, id: &str) -> Option<(Value, Asked)> {
+    let code = subject.code();
+    let mut questions = Questions::default();
+    questions.ask(
+        "values".into(),
+        questions::injection_values(&code, !subject.callers.is_empty()),
+        id,
+        INJECTION,
+        "values",
+        Pass::Locate,
+    );
+    let (request, asked) = file.request("locate", with_callers(file, subject), questions);
     file.budget.fits(&request).then_some((request, asked))
 }
 
@@ -812,7 +855,7 @@ pub(in crate::units) enum SettleWhen {
 /// does with tokens and how it handles passwords settle those checks
 /// whenever they are not clear: front ends that send their own token and
 /// HMAC signing split on them or were reviews.
-pub(in crate::units) const SETTLES: [SettleKind; 13] = [
+pub(in crate::units) const SETTLES: [SettleKind; 14] = [
     SettleKind {
         rule: INJECTION,
         question: "url_parts",
@@ -876,6 +919,15 @@ pub(in crate::units) const SETTLES: [SettleKind; 13] = [
         when: SettleWhen::NotClear,
         files: SettleFiles::Only(questions::PHP),
     },
+    SettleKind {
+        rule: INJECTION,
+        question: "path_source",
+        checks: &["path"],
+        clears: &questions::OWN_PATHS,
+        callers: true,
+        when: SettleWhen::Undecided,
+        files: SettleFiles::Except(questions::PHP),
+    },
     SettleKind {
         rule: SENSITIVE_DATA,
         question: "destination",
@@ -963,6 +1015,7 @@ fn settle(
     let callers = kind.callers && !subject.callers.is_empty();
     let body = match kind.question {
         "url_parts" => questions::security_url_parts(&code, callers),
+        "path_source" => questions::security_path_source(&code, callers),
         "runs_in" => questions::security_runs_in(&code),
         "redirect_target" => questions::security_redirect_target(&code, callers),
         "markup_output" => {
diff --git a/src/units/tests/hardcoded.rs b/src/units/tests/hardcoded.rs
index 9bf07ed..c9d404a 100644
--- a/src/units/tests/hardcoded.rs
+++ b/src/units/tests/hardcoded.rs
@@ -1,6 +1,31 @@
 //! Hardcoded values: value units, benign kinds and repeated literals.
 use super::*;
 
+/// A run answering `overrides`, the finding on `symbol` and how many locate
+/// requests it asked; later runs with `options` ask again.
+fn judged(
+    project: &Project,
+    options: &mut CheckArgs,
+    overrides: Vec<(&'static str, Value)>,
+    symbol: &str,
+) -> (crate::schema::Finding, u64) {
+    let mut eval = scripted(0);
+    eval.overrides = overrides;
+    let report = run(project, options, &mut eval);
+    options.refresh = true;
+    let asked = report
+        .stages
+        .get("locate")
+        .map_or(0, |stage| stage.successful_requests);
+    let finding = report.files[0]
+        .findings
+        .iter()
+        .find(|f| f.symbol.as_deref() == Some(symbol))
+        .cloned()
+        .unwrap();
+    (finding, asked)
+}
+
 #[test]
 fn functions_with_literals_and_module_constants_are_hardcoded_value_units() {
     let (project, options) = hardcoded_project();
@@ -46,6 +71,49 @@ fn a_finding_on_module_constants_points_at_the_constant_it_is_about() {
     );
 }
 
+#[test]
+fn an_environment_finding_whose_constant_stays_the_same_everywhere_is_a_note() {
+    let source = "const API_URL: &str = \"https://api.prod.example.com\";\nconst RETRIES: u32 = 3;\n\nfn client() -> Client {\n    Client::new(API_URL)\n}\n";
+    let (project, mut options) = rule_project(source, catalog::HARDCODED_VALUES);
+    let (_, plan) = planned(&project, &options);
+    let locate = plan.files[&0]
+        .units
+        .iter()
+        .find_map(|u| match &u.detail {
+            Detail::Constants {
+                locate: Some(locate),
+                ..
+            } => Some(locate.request()),
+            _ => None,
+        })
+        .expect("a locate for the constants");
+    assert_eq!(
+        locate["state"]["constants"][0]["used_at"],
+        json!(["5: Client::new(API_URL)"])
+    );
+    assert!(locate["state"]["constants"][1].get("used_at").is_none());
+    let kinds = ["author", "each", "fallback", "not_run", "same"];
+    let overrides = |kind: &str| {
+        vec![
+            ("environment", spread(0.0, 0.05, 0.95)),
+            ("constant", choice_of("c0", &["c0", "c1", "none"])),
+            ("environment_kind", choice_of(kind, &kinds)),
+        ]
+    };
+    // A server each installation must set keeps the review.
+    let (kept, _) = judged(&project, &mut options, overrides("each"), "API_URL");
+    assert_eq!(kept.strength, Strength::Review, "{}", kept.message);
+    let (same, _) = judged(&project, &mut options, overrides("same"), "API_URL");
+    assert_eq!(same.strength, Strength::Note);
+    assert!(
+        same.message.ends_with(
+            "The constant is `API_URL`. It likely stays the same wherever the program runs, or is only a fallback, so it is a note."
+        ),
+        "{}",
+        same.message
+    );
+}
+
 #[test]
 fn a_local_default_is_a_note_and_a_special_case_is_a_review() {
     let (project, mut options) = hardcoded_project();
@@ -162,6 +230,64 @@ fn a_value_that_needs_a_name_but_is_written_once_is_a_note() {
     );
 }
 
+#[test]
+fn a_named_value_that_reads_for_itself_is_a_note() {
+    let source = format!(
+        "{HARDCODED}\nfn backup() -> Client {{\n    Client::new(\"db.backup:5432\", 30_000)\n}}\n"
+    );
+    let (project, mut options) = rule_project(&source, catalog::HARDCODED_VALUES);
+    let kinds = ["copies", "idiom", "named", "tuning", "unexplained"];
+    let overrides = |kind: &str| {
+        vec![
+            ("magic", spread(0.1, 0.35, 0.55)),
+            ("value", choice_of("v1", &["v0", "v1", "none"])),
+            ("value_kind", choice_of(kind, &kinds)),
+        ]
+    };
+    // Copies that must change together keep the consider.
+    let (kept, asked) = judged(&project, &mut options, overrides("copies"), "connect");
+    assert_eq!(kept.strength, Strength::Consider, "{}", kept.message);
+    // Both functions' values are located, then both are asked their kind.
+    assert_eq!(asked, 4);
+    let (named, _) = judged(&project, &mut options, overrides("named"), "connect");
+    assert_eq!(named.strength, Strength::Note);
+    assert!(
+        named
+            .message
+            .ends_with("It reads for itself where it is used, so it is a note."),
+        "{}",
+        named.message
+    );
+}
+
+#[test]
+fn the_value_locate_lists_the_other_lines_that_write_each_value() {
+    let source = format!(
+        "{HARDCODED}\nfn backup() -> Client {{\n    Client::new(\"db.backup:5432\", 30_000)\n}}\n\nconst CAP: u64 = 300_000;\n"
+    );
+    let (project, options) = rule_project(&source, catalog::HARDCODED_VALUES);
+    let (_, plan) = planned(&project, &options);
+    let locate = plan.files[&0]
+        .units
+        .iter()
+        .find_map(|u| match &u.detail {
+            Detail::Values {
+                locate: Some(locate),
+                ..
+            } if u.name == "connect" => Some(locate.request()),
+            _ => None,
+        })
+        .expect("a locate for connect");
+    let values = &locate["state"]["function"]["values"];
+    assert_eq!(values[0]["value"], "\"db.internal:5432\"");
+    assert!(values[0].get("elsewhere").is_none(), "written once");
+    // `300_000` holds `30_000` only as part of a longer number.
+    assert_eq!(
+        values[1]["elsewhere"],
+        json!(["12: Client::new(\"db.backup:5432\", 30_000)"])
+    );
+}
+
 #[test]
 fn undecided_units_are_listed_with_the_questions_left_undecided() {
     let (project, mut options) = function_rule_project(&function("borderline"));
diff --git a/src/units/tests/nextjs.rs b/src/units/tests/nextjs.rs
index 6f7e93e..f418ec5 100644
--- a/src/units/tests/nextjs.rs
+++ b/src/units/tests/nextjs.rs
@@ -215,11 +215,13 @@ fn an_undecided_redirect_is_settled_by_where_its_target_comes_from() {
         settled_redirect(&project, &options, "own"),
         (Status::Clear, 1)
     );
-    for chosen in ["given", "outside"] {
+    // A target its caller gives is a note, as a found one would be; one a
+    // request carries stays open.
+    for (chosen, status) in [("given", Status::Note), ("outside", Status::Uncertain)] {
         options.refresh = true;
         assert_eq!(
             settled_redirect(&project, &options, chosen),
-            (Status::Uncertain, 1),
+            (status, 1),
             "{chosen}"
         );
     }
diff --git a/src/units/tests/security.rs b/src/units/tests/security.rs
index fa921ba..7d0f184 100644
--- a/src/units/tests/security.rs
+++ b/src/units/tests/security.rs
@@ -70,6 +70,9 @@ fn an_unhandled_value_from_another_party_is_a_located_injection_review() {
     assert!(finding.action.contains("bound query parameters"));
 }
 
+/// The options of the Choice on what an injection consider's values can hold.
+const VALUES: [&str; 5] = ["fixed", "local", "outside", "own", "unknown"];
+
 #[test]
 fn a_parameter_origin_is_a_consider_that_callers_can_settle() {
     let caller = format!(
@@ -80,6 +83,7 @@ fn a_parameter_origin_is_a_consider_that_callers_can_settle() {
             ("interpreted", noul_at(0.95)),
             ("sql", noul_at(0.95)),
             ("origin", spread(0.0, 0.9, 0.1)),
+            ("values", choice_of("unknown", &VALUES)),
         ]
     };
     let (project, options) = security_project(QUERY);
@@ -96,7 +100,7 @@ fn a_parameter_origin_is_a_consider_that_callers_can_settle() {
     eval.overrides = overrides();
     eval.recheck_level = Some(0);
     let report = run(&project, &options, &mut eval);
-    assert_eq!(eval.stages.last().unwrap(), "recheck");
+    assert!(eval.stages.contains(&"recheck".to_string()));
     let find = |report: &Report| {
         report.files[0]
             .findings
@@ -106,6 +110,56 @@ fn a_parameter_origin_is_a_consider_that_callers_can_settle() {
     assert!(!find(&report), "the caller passes a fixed value");
 }
 
+#[test]
+fn a_parameter_consider_is_a_note_when_its_values_are_the_programs_own() {
+    let caller = format!(
+        "{QUERY}\nfn handler(conn: &Connection) -> Result<Row> {{\n    find(conn, \"admin\")\n}}\n"
+    );
+    let (project, mut options) = security_project(&caller);
+    let mut judged = |values: Value| {
+        let mut eval = scripted(0);
+        eval.overrides = vec![
+            ("interpreted", noul_at(0.95)),
+            ("sql", noul_at(0.95)),
+            ("origin", spread(0.0, 0.9, 0.1)),
+        ];
+        // The recheck with callers keeps the parameters as the origin.
+        eval.recheck_overrides = vec![
+            ("sql", noul_at(0.95)),
+            ("origin", spread(0.0, 0.9, 0.1)),
+            ("values", values),
+        ];
+        let report = run(&project, &options, &mut eval);
+        options.refresh = true;
+        report.files[0]
+            .findings
+            .iter()
+            .find(|f| f.rule == "security/injection" && f.symbol.as_deref() == Some("find"))
+            .map(|f| f.strength)
+    };
+    assert_eq!(
+        judged(choice_of("fixed", &VALUES)),
+        Some(Strength::Note),
+        "the caller passes a literal"
+    );
+    assert_eq!(
+        judged(choice_of("outside", &VALUES)),
+        Some(Strength::Consider)
+    );
+    let mut split: serde_json::Map<String, Value> =
+        VALUES.iter().map(|k| (k.to_string(), json!(0.0))).collect();
+    split.insert("own".into(), json!(0.3));
+    split.insert("local".into(), json!(0.25));
+    split.insert("unknown".into(), json!(0.45));
+    let leaning =
+        json!({"type":"choice","choice":"unknown","confidence":0.4,"probabilities":split});
+    assert_eq!(
+        judged(leaning),
+        Some(Strength::Note),
+        "the program's own options together lead"
+    );
+}
+
 #[test]
 fn a_check_left_undecided_is_decided_again_with_callers() {
     let caller = format!(
@@ -154,6 +208,8 @@ const FETCH_QUOTE: &str = "fn quote(client: &Client, base: &Url, symbol: &str) -
 
 const URL_PARTS: [&str; 5] = ["own", "forwards", "given", "outside", "none"];
 
+const PATH_SOURCE: [&str; 5] = ["own", "local", "given", "outside", "none"];
+
 const RUNS_IN: [&str; 3] = ["browser", "server", "either"];
 
 /// Injection status and settle requests with the URL (or path) check at
@@ -170,6 +226,7 @@ fn settled_injection(
         (check, noul_at(0.4)),
         ("origin", spread(0.0, 0.9, 0.1)),
         ("url_parts", choice_of(parts, &URL_PARTS)),
+        ("path_source", choice_of(parts, &PATH_SOURCE)),
         ("runs_in", choice_of("server", &RUNS_IN)),
     ];
     let report = run(project, options, &mut eval);
@@ -192,19 +249,52 @@ fn an_undecided_url_is_settled_only_by_a_host_of_the_programs_own() {
         (Status::Clear, 2),
         "where its URLs come from and where it runs"
     );
-    for parts in ["forwards", "given", "outside"] {
+    // A URL its caller gives or forwards is a note, as a found one would be;
+    // one from another party stays open.
+    for (parts, status) in [
+        ("forwards", Status::Note),
+        ("given", Status::Note),
+        ("outside", Status::Uncertain),
+    ] {
         options.refresh = true;
         assert_eq!(
             settled_injection(&project, &options, "url", parts).0,
-            Status::Uncertain,
+            status,
             "{parts}"
         );
     }
-    options.refresh = true;
-    assert_eq!(
-        settled_injection(&project, &options, "path", "own"),
-        (Status::Uncertain, 0),
-        "an undecided path is not settled"
+}
+
+#[test]
+fn an_undecided_path_is_settled_by_the_programs_own_or_its_local_users_paths() {
+    let (project, mut options) = security_project(FETCH_QUOTE);
+    for (parts, status) in [
+        ("own", Status::Clear),
+        ("local", Status::Clear),
+        ("given", Status::Note),
+        ("outside", Status::Uncertain),
+    ] {
+        assert_eq!(
+            settled_injection(&project, &options, "path", parts),
+            (status, 1),
+            "{parts}"
+        );
+        options.refresh = true;
+    }
+    // The note names the path it left undecided.
+    let mut eval = scripted(0);
+    eval.overrides = vec![
+        ("resource", noul_at(0.95)),
+        ("path", noul_at(0.4)),
+        ("origin", spread(0.0, 0.9, 0.1)),
+        ("path_source", choice_of("given", &PATH_SOURCE)),
+    ];
+    let report = run(&project, &options, &mut eval);
+    let note = &report.files[0].findings[0];
+    assert!(
+        note.message.contains("places a parameter into a file path"),
+        "{}",
+        note.message
     );
 }
 
@@ -1277,6 +1367,8 @@ fn settled_status(
     let mut eval = scripted(0);
     eval.overrides = nouls.iter().map(|&(q, p)| (q, noul_at(p))).collect();
     eval.overrides.push(("origin", spread(0.0, 0.9, 0.1)));
+    eval.overrides
+        .push(("values", choice_of("unknown", &VALUES)));
     eval.overrides.push(settle);
     let report = run(project, options, &mut eval);
     (
diff --git a/src/units/tests/test_rules.rs b/src/units/tests/test_rules.rs
index 4bdbe2e..bfc671e 100644
--- a/src/units/tests/test_rules.rs
+++ b/src/units/tests/test_rules.rs
@@ -460,6 +460,29 @@ fn copies_inside_tests_a_redundancy_finding_names_are_reported_once() {
     assert_eq!(rules, [catalog::id(catalog::TEST_REDUNDANCY)], "{rules:?}");
 }
 
+#[test]
+fn a_test_still_undecided_after_its_recheck_leans_clear_below_half() {
+    let (project, mut options) = tests_project(&[("lib.rs", TESTS)], catalog::TEST_VALUE);
+    let mut status = |mock_only: f64| {
+        let mut eval = scripted(0);
+        eval.overrides.push(("mock_only", noul_at(mock_only)));
+        eval.recheck_overrides
+            .push(("mock_only", noul_at(mock_only)));
+        let report = run(&project, &options, &mut eval);
+        options.refresh = true;
+        (
+            report.files[0].dimensions["test_value"].status.clone(),
+            report
+                .stages
+                .get("recheck")
+                .map_or(0, |stage| stage.successful_requests),
+        )
+    };
+    // Asked again first: the lean follows the recheck.
+    assert_eq!(status(0.4), (Status::Clear, 3));
+    assert_eq!(status(0.6), (Status::Uncertain, 3));
+}
+
 #[test]
 fn an_internal_details_consider_is_confirmed_by_what_its_assertions_read() {
     let (project, mut options) = tests_project(&[("lib.rs", TESTS)], catalog::TEST_VALUE);
diff --git a/src/units/wording/mod.rs b/src/units/wording/mod.rs
index 3da40e2..329bf5d 100644
--- a/src/units/wording/mod.rs
+++ b/src/units/wording/mod.rs
@@ -3,9 +3,9 @@
 use super::{
     Block, Detail, GroupInfo,
     outcome::{
-        Answers, Outcome, benefit, comment_concern_kind, comment_signals, disagreement,
-        document_split, noul, origin_outcome, repeated, section_signals, settled_checks,
-        value_signals,
+        Answers, Outcome, RESOURCE_CHECKS, benefit, comment_concern_kind, comment_signals,
+        disagreement, document_split, noul, origin_outcome, repeated, section_signals,
+        settled_checks, value_signals,
     },
 };
 use crate::catalog;
diff --git a/src/units/wording/security.rs b/src/units/wording/security.rs
index 0fe98fb..aedfb9f 100644
--- a/src/units/wording/security.rs
+++ b/src/units/wording/security.rs
@@ -245,7 +245,7 @@ fn found_checks(rule: &str, answers: &Answers<'_>) -> Vec<&'static str> {
         return found.into_iter().map(|(id, _)| id).collect();
     }
     // A note from a leaning check names the kind it leaned toward.
-    crate::units::security::checks(rule)
+    let leaning: Vec<&'static str> = crate::units::security::checks(rule)
         .iter()
         .filter_map(|check| match answers.get(check.id) {
             Some(Answer::Noul { noul })
@@ -261,6 +261,15 @@ fn found_checks(rule: &str, answers: &Answers<'_>) -> Vec<&'static str> {
         .max_by(|a, b| a.1.total_cmp(&b.1))
         .map(|(id, _)| id)
         .into_iter()
+        .collect();
+    if !leaning.is_empty() {
+        return leaning;
+    }
+    // A note from undecided checks of paths, URLs or redirects names them.
+    settled_checks(rule, &get)
+        .into_iter()
+        .filter(|(id, outcome)| *outcome != Outcome::Clear && RESOURCE_CHECKS.contains(id))
+        .map(|(id, _)| id)
         .collect()
 }