callbacks: a function is handed over only where it is written into the argument

[swapnilpaliwal-sd]

A function was registered as a callback at every call whose argument's abstract value might hold it: Map keys, strings, promises, a key destructured from a Map of handler sets, an object literal whose member held a parameter. Config default arrows and bus handlers each collected edges from unrelated get/set/has/emit/assert sites, and path printed them as verified.

• JS: at a project callee, only a function written at the argument (literal, declaration, import, const, method read, call result) is registered; the callee's own body carries the rest.
• JS: an options object hands over only functions written into a literal (or the variable it initialises), at any nesting depth; the old abstract-value join is gone.
• JS/TS: Map/Set/WeakMap/WeakSet methods other than forEach never register; TS recognises them by declared reference or new initialiser, with no lib staged.
• Cases: JS 34 gains the near misses and the loop-key bus shape (8 invented edges before, 0 after; controls setTimeout/forEach/options literal unchanged). TS 78 gains store.ts (3 before, 0 after). JS 50 loses 2 invented edges at an Object.keys alias.

Checked: JS suite 88/88, TS 97/97; product callback_registered 1190 -> 1070 (edges 8944 -> 8824), per bus handler 11 -> 1, handler still reached via the bus's invoke; probes 46/70 -> 46/70, none regressed; index 21s -> 40s (shared VM).