diff --git a/benchmarks/pairs/catalog_gen.py b/benchmarks/pairs/catalog_gen.py
index b863a3a..8f6b2fb 100644
--- a/benchmarks/pairs/catalog_gen.py
+++ b/benchmarks/pairs/catalog_gen.py
@@ -269,10 +269,11 @@ def _language(recipe: dict[str, object]) -> str:
 
 
 def _ranges(path: Path, language: str) -> tuple[tuple[str, int, int], ...] | None:
-    ranges = source_ranges(str(path), path.read_text(errors="ignore"), language)
-    if ranges is None:
+    try:
+        ranges = source_ranges(str(path), path.read_text(errors="ignore"), language)
+    except ValueError:
         return None  # parser rejected the excerpt; a regex label would not scope
-    return tuple(r for r in ranges if r[0] != ANON_FUNCTION)
+    return tuple((r.name, r.start, r.end) for r in ranges if r.kind == "function" and r.name != ANON_FUNCTION)
 
 
 def _innermost(ranges: tuple[tuple[str, int, int], ...], line: int) -> str | None:
diff --git a/docs/deployment.md b/docs/deployment.md
index d47688a..d6eebf5 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -148,7 +148,7 @@ files live in `~/.cache/ousast/ax-src/` (`OUSAST_AX_SRC`).
     - An admin must set up the bucket once, as [RustFS setup](rustfs.md) describes. The store verifies
       it at every start.
 
-5. **Run a real Run**, as in [Examples](examples.md#7-running-the-agentic-plane): `ousast plane run
+5. **Run a real Run**, as in [Examples](examples.md#6-running-the-agentic-plane): `ousast plane run
     plane/runs/validation-46.yaml`, then `status` and `remember`.
 
 6. **Tear down** with `ops/ax/down.sh`. It deletes the cluster and its registry.
diff --git a/docs/threat-model.md b/docs/threat-model.md
index 048d7a5..ad467c5 100644
--- a/docs/threat-model.md
+++ b/docs/threat-model.md
@@ -12,8 +12,8 @@ It also lists the controls that keep a scan safe to run in CI and safe to share.
     control flow and data flow) with Joern. It uses `joern-parse`, a parser, not a build.
     Standard mode may send code excerpts to the configured model.
   - No scan mode executes target-derived code any more: the deep-mode REGRESS stage was retired on 2026-10-13
-    and is recorded as `regress_retired`. Execution happens only in the search-with-proof arm's sandbox,
-    described in `.kiro/specs/search-with-proof/`.
+    and is recorded as `regress_retired`. Execution happens only in the search-with-proof arm's sandbox
+    (`src/openultrasast/search/_sandbox.py`).
 - **The ruleset and CWE policy are trusted, governed data.** They change
   through reviewed commits.
 - **Provider credentials are the operator's.** The core install (PyYAML only) makes no network
@@ -94,4 +94,4 @@ internal hunter tools. No tool accepts a free-form command argument.
 
 Retired on 2026-10-13 with the REGRESS stage. The search-with-proof arm runs demos under bubblewrap with
 seccomp, no network unless the oracle needs a namespace, and differential runs against owned canaries;
-see `src/openultrasast/search/_sandbox.py` and `.kiro/specs/search-with-proof/`.
+see `src/openultrasast/search/_sandbox.py`.
diff --git a/src/openultrasast/model/candidates.py b/src/openultrasast/model/candidates.py
index ba9ba95..5d141f2 100644
--- a/src/openultrasast/model/candidates.py
+++ b/src/openultrasast/model/candidates.py
@@ -379,7 +379,7 @@ def labeled_spans(
     wanted.discard("")
     found: list[tuple[str, int, int]] = []
     for path, entries in ranges.items():
-        for name, start, end in entries:
+        for name, start, end, *_kind in entries:
             if name in wanted:
                 found.append((path, start, end))
     return tuple(found)
diff --git a/src/openultrasast/source.py b/src/openultrasast/source.py
index 7bba6d0..441179c 100644
--- a/src/openultrasast/source.py
+++ b/src/openultrasast/source.py
@@ -238,7 +238,7 @@ def ranges_from_ir(ir: FileIR, text: str) -> tuple[FunctionRange, ...]:
         if fn.name == MODULE_FUNCTION:
             continue
         line = lines[fn.start_line - 1] if 0 < fn.start_line <= len(lines) else ""
-        declared = declarator_name(line, ir.language)
+        declared = declarator_name(line)  # the declaration tables would name a callback call (`exec(..., function () {`)
         name = declared or fn.name
         if (
             name in RESERVED_FUNCTION_LABELS
diff --git a/tests/test_pair_harvest.py b/tests/test_pair_harvest.py
index 805d111..78946a3 100644
--- a/tests/test_pair_harvest.py
+++ b/tests/test_pair_harvest.py
@@ -360,7 +360,7 @@ def test_catalog_gen_fails_loud_without_the_package_and_refuses_to_prune_an_empt
         gen["generate"]("s", prune=True)
     assert pair.is_dir()
     # The package import must fail loud, never degrade into "no named function".
-    monkeypatch.setitem(sys.modules, "openultrasast.semantic.functions", None)
+    monkeypatch.setitem(sys.modules, "openultrasast.source", None)
     with pytest.raises((SystemExit, ImportError)):
         runpy.run_path(str(Path("benchmarks/pairs/catalog_gen.py")), run_name="catalog_gen_lib_blocked")