Effects, and the tiers that discharge them

Tier::discharges evaluated at every pair — the predicate the placement solver calls.

Atom	client	server	data	any
`ingress`	—	yes	—	—	The merge point: arbitrary interleaving of client proposals. A program has exactly one.
`durable`	—	yes	yes	—	A persistent accumulator — the log.
`dom`	yes	—	—	—	Touches the document.
`nondet`	yes	yes	—	—	Reads a clock or a random source, or mints an id.
`net.out(host)`	—	yes	—	—	An outbound call to a named host. The host is what becomes a NetworkPolicy peer (§6.5).
`net.in`	—	yes	—	—	Accepts inbound connections.
`fs.read(path)`	—	yes	—	—	Reads a path.
`fs.write(path)`	—	yes	—	—	Writes a path.
`env`	—	yes	—	—	Reads process environment.
`spawn`	—	yes	—	—	Starts concurrent work.
`cap.x`	—	yes	—	—	A capability the caller must hold. Forgetting an auth check leaves `cap.*` undischarged — a compile error, not a pentest finding (§3.5).
`partial`	yes	yes	yes	yes	May diverge or panic.
`raises(E)`	yes	yes	yes	yes	May fail with a value of the named type. A signature without this provably cannot fail; `try:` reifies it into a `Result[T, E]`.
`external.read(store)`	—	yes	—	—	Reads a store the program does not own — §3.8's escape hatch.
`external.write(store)`	—	yes	—	—	Writes a store the program does not own.
`log`	yes	yes	yes	yes	Ambient: available everywhere, elided from signatures, never a reason to place anything.
`metrics`	yes	yes	yes	yes	Ambient, as `log` is.

any is not a fourth tier: it means unplaced — legal everywhere, and compiled into each tier that calls it.