@clear-capabilities/agentic-security-scanner 0.137.1 → 0.139.0

package/src/dataflow/catalog.js

@@ -53,6 +53,15 @@ export const CATALOG = [
   { kind: 'source', id: 'js-req-cookies',  language: 'js', framework: 'express', match: { type: 'member', object: 'req',     prop: 'cookies' }, label: 'req.cookies',  provenance: 'cookie' },
   { kind: 'source', id: 'js-request-body', language: 'js', framework: 'express', match: { type: 'member', object: 'request', prop: 'body'    }, label: 'request.body', provenance: 'http-body' },
   { kind: 'source', id: 'js-ctx-request',  language: 'js', framework: 'koa',     match: { type: 'member', object: 'ctx',     prop: 'request' }, label: 'ctx.request',  provenance: 'http-body' },
+  // Taint-recall PRD (80%) Tier 3: Koa's own direct-on-context shortcuts
+  // (`ctx.query`, `ctx.params`, `ctx.headers`, `ctx.cookies` — aliases for
+  // the equivalent `ctx.request.*`) were entirely uncataloged, only the
+  // `ctx.request` umbrella above was. Found via CVE-2021-26701-koa-xss's
+  // `ctx.query.name` — mirrors the Express req.* coverage above.
+  { kind: 'source', id: 'js-ctx-query',    language: 'js', framework: 'koa',     match: { type: 'member', object: 'ctx',     prop: 'query'   }, label: 'ctx.query',    provenance: 'url-param' },
+  { kind: 'source', id: 'js-ctx-params',   language: 'js', framework: 'koa',     match: { type: 'member', object: 'ctx',     prop: 'params'  }, label: 'ctx.params',   provenance: 'path-param' },
+  { kind: 'source', id: 'js-ctx-headers',  language: 'js', framework: 'koa',     match: { type: 'member', object: 'ctx',     prop: 'headers' }, label: 'ctx.headers',  provenance: 'header' },
+  { kind: 'source', id: 'js-ctx-cookies',  language: 'js', framework: 'koa',     match: { type: 'member', object: 'ctx',     prop: 'cookies' }, label: 'ctx.cookies',  provenance: 'cookie' },
   // Browser DOM-derived (XSS sources).
   { kind: 'source', id: 'js-location',     language: 'js', framework: 'dom', match: { type: 'global', name: 'location' },                       label: 'window.location', provenance: 'url-fragment' },
   { kind: 'source', id: 'js-doc-cookie',   language: 'js', framework: 'dom', match: { type: 'member', object: 'document', prop: 'cookie' },     label: 'document.cookie', provenance: 'cookie' },
@@ -193,12 +202,48 @@ export const CATALOG = [
   { kind: 'source', id: 'js-nestjs-param',   language: 'js', framework: 'nestjs', match: { type: 'annotation', name: 'Param' },   label: '@Param() (NestJS)',   provenance: 'path-param' },
   { kind: 'source', id: 'js-nestjs-headers', language: 'js', framework: 'nestjs', match: { type: 'annotation', name: 'Headers' }, label: '@Headers() (NestJS)', provenance: 'header' },
 
+  // Python annotation sources (PRD T3.1). Unlocked by parser-py.helper.py
+  // emitting the `paramAnnotations` side-channel, which it did not before —
+  // JS/C#/Java all populated it and Python emitted nothing, so no annotation
+  // source could ever match a Python parameter however well cataloged.
+  //
+  // Two shapes, both arriving through the same {index,name,decorator} channel:
+  // FastAPI's PER-PARAMETER default markers, and FUNCTION-level decorators
+  // whose presence makes every parameter an entry point.
+  //
+  // `Path` is deliberately ABSENT despite being a real FastAPI marker: a
+  // parameter default of `= Path(...)` is at least as likely to be pathlib.Path
+  // as a FastAPI path parameter, and a source that fires on ordinary filesystem
+  // code would taint half of every Python codebase. Taking the miss.
+  { kind: 'source', id: 'py-fastapi-param-query',  language: 'py', framework: 'fastapi', match: { type: 'annotation', name: 'Query' },  label: 'Query(...) (FastAPI)',  provenance: 'url-param' },
+  { kind: 'source', id: 'py-fastapi-param-body',   language: 'py', framework: 'fastapi', match: { type: 'annotation', name: 'Body' },   label: 'Body(...) (FastAPI)',   provenance: 'http-body' },
+  { kind: 'source', id: 'py-fastapi-param-form',   language: 'py', framework: 'fastapi', match: { type: 'annotation', name: 'Form' },   label: 'Form(...) (FastAPI)',   provenance: 'http-body' },
+  { kind: 'source', id: 'py-fastapi-param-header', language: 'py', framework: 'fastapi', match: { type: 'annotation', name: 'Header' }, label: 'Header(...) (FastAPI)', provenance: 'header' },
+  { kind: 'source', id: 'py-fastapi-param-cookie', language: 'py', framework: 'fastapi', match: { type: 'annotation', name: 'Cookie' }, label: 'Cookie(...) (FastAPI)', provenance: 'header' },
+  { kind: 'source', id: 'py-fastapi-param-file',   language: 'py', framework: 'fastapi', match: { type: 'annotation', name: 'File' },   label: 'File(...) (FastAPI)',   provenance: 'http-body' },
+  // MCP tool parameters are filled by a model acting on untrusted content —
+  // the agent-tool trust boundary this project's own threat model names
+  // (docs/AGENT_THREAT_MODEL.md). Matched on the dotted form so an unrelated
+  // `.tool()` method cannot satisfy it.
+  { kind: 'source', id: 'py-mcp-tool', language: 'py', framework: 'mcp', match: { type: 'annotation', name: 'mcp.tool' }, label: '@mcp.tool() parameter', provenance: 'agent-tool' },
+  { kind: 'source', id: 'py-mcp-server-tool', language: 'py', framework: 'mcp', match: { type: 'annotation', name: 'server.tool' }, label: '@server.tool() parameter', provenance: 'agent-tool' },
+
   // ─── SOURCES (Go) ─────────────────────────────────────────────────────────
   { kind: 'source', id: 'go-r-form',     language: 'go', framework: 'net/http', match: { type: 'member', object: 'r', prop: 'Form' },     label: 'r.Form' },
   { kind: 'source', id: 'go-r-postform', language: 'go', framework: 'net/http', match: { type: 'member', object: 'r', prop: 'PostForm' }, label: 'r.PostForm' },
   { kind: 'source', id: 'go-r-body',     language: 'go', framework: 'net/http', match: { type: 'member', object: 'r', prop: 'Body' },     label: 'r.Body' },
   { kind: 'source', id: 'go-r-formvalue',language: 'go', framework: 'net/http', match: { type: 'call',   callee: 'FormValue' },           label: 'r.FormValue' },
   { kind: 'source', id: 'go-r-uquery',   language: 'go', framework: 'net/http', match: { type: 'call',   callee: 'Query' },               label: 'r.URL.Query' },
+  // Taint-recall PRD (80%): the idiomatic single-value-read form,
+  // `r.URL.Query().Get("key")` — bare-name callee matching only ever sees
+  // the TERMINAL segment of a chained callee string, so once the
+  // chained-call parser fix let this shape's real callee become
+  // "r.URL.Query.Get" (previously silently collapsed to just "r.URL.Query",
+  // dropping the .Get(...) entirely), go-r-uquery's `callee: 'Query'` no
+  // longer matches — "Get" is now what's terminal. Needs its own entry
+  // rather than widening go-r-uquery itself, since "Get" alone is far too
+  // generic for every Go framework in this catalog to safely bare-match.
+  { kind: 'source', id: 'go-r-uquery-get', language: 'go', framework: 'net/http', match: { type: 'call', callee: 'Get', receiver: '^Query$' }, label: 'r.URL.Query().Get(key)' },
   { kind: 'source', id: 'go-gin-query',  language: 'go', framework: 'gin',      match: { type: 'call',   callee: 'Query' },               label: 'c.Query (gin)' },
   { kind: 'source', id: 'go-gin-bindjson',language:'go', framework: 'gin',      match: { type: 'call',   callee: 'BindJSON' },            label: 'c.BindJSON (gin)' },
   { kind: 'source', id: 'go-echo-param', language: 'go', framework: 'echo',     match: { type: 'call',   callee: 'Param' },               label: 'c.Param (echo)' },
@@ -268,6 +313,14 @@ export const CATALOG = [
   { kind: 'sink', id: 'py-sa-text',            language: 'py', framework: 'sqlalchemy', match: { type: 'call', callee: 'text' }, argIndex: 0,
     vuln: { name: 'SQL Injection (sqlalchemy.text)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Use sqlalchemy.text with bound parameters: `text("SELECT :x").bindparams(x=v)`.' } },
+  // Taint-recall PRD (80%) Tier 3: Python carried zero XSS sink entries.
+  // Flask's `render_template_string(tainted)` compiles a user-influenced
+  // string AS a Jinja2 template — both an XSS vector (unescaped output) and
+  // SSTI-adjacent (server-side template compilation), scored CWE-79 to
+  // match this corpus's own manifest classification for the shape.
+  { kind: 'sink', id: 'py-flask-render-template-string', language: 'py', framework: 'flask', match: { type: 'call', callee: 'render_template_string' }, argIndex: 0,
+    vuln: { name: 'Reflected XSS / SSTI (Flask render_template_string)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'Never build the TEMPLATE from user input. Use render_template with a static template file and pass user data as context variables (auto-escaped).' } },
 
   // ─── SINKS (SQL — Java) ───────────────────────────────────────────────────
   { kind: 'sink', id: 'java-stmt-executeQuery',  language: 'java', framework: 'jdbc',     match: { type: 'call', callee: 'executeQuery' },  argIndex: 0,
@@ -294,6 +347,18 @@ export const CATALOG = [
     vuln: { name: 'Native SQL Injection (EntityManager.createNativeQuery)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Use setParameter on the resulting Query.' } },
 
+  // Taint-recall PRD (80%) Tier 3: Java carried zero XSS sink entries —
+  // `resp.getWriter().write(...)`/`.print(...)` (Servlet's canonical
+  // response-write idiom, `HttpServletResponse.getWriter()`) is the
+  // dominant shape. Receiver-scoped to the `getWriter` chain segment (both
+  // `write` and `print` collide with countless unrelated APIs bare).
+  { kind: 'sink', id: 'java-writer-write', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'write', receiver: '^getWriter$' }, argIndex: 0,
+    vuln: { name: 'Reflected XSS (PrintWriter.write)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'HTML-escape user-derived content before writing to the response, or use a templating engine with auto-escaping.' } },
+  { kind: 'sink', id: 'java-writer-print', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'print', receiver: '^getWriter$' }, argIndex: 0,
+    vuln: { name: 'Reflected XSS (PrintWriter.print)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'HTML-escape user-derived content before writing to the response, or use a templating engine with auto-escaping.' } },
+
   // ─── SINKS (SQL — Go) ──────────────────────────────────────────────────────
   { kind: 'sink', id: 'go-db-query',    language: 'go', framework: 'database/sql', match: { type: 'call', callee: 'Query' },    argIndex: 0,
     vuln: { name: 'SQL Injection (db.Query)', severity: 'critical', cwe: 'CWE-89',
@@ -336,6 +401,16 @@ export const CATALOG = [
   { kind: 'sink', id: 'php-shell-exec',    language: 'php', framework: 'core',    match: { type: 'call', callee: 'shell_exec' },    argIndex: 0,
     vuln: { name: 'Command Injection (shell_exec)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Avoid shell_exec(); sanitize with escapeshellarg() if unavoidable.' } },
+  // Taint-recall PRD (80%): passthru()/proc_open() were entirely uncataloged
+  // for PHP — verified via this PRD's Tier 3 command-injection audit
+  // (CVE-2016-10033-phpmailer-cmdi-shape's exact real shape,
+  // `passthru("gzip " . $file)`).
+  { kind: 'sink', id: 'php-passthru',      language: 'php', framework: 'core',    match: { type: 'call', callee: 'passthru' },      argIndex: 0,
+    vuln: { name: 'Command Injection (passthru)', severity: 'critical', cwe: 'CWE-78',
+            remediation: 'Avoid passthru(); use escapeshellarg() on each argument if unavoidable.' } },
+  { kind: 'sink', id: 'php-proc-open',     language: 'php', framework: 'core',    match: { type: 'call', callee: 'proc_open' },     argIndex: 0,
+    vuln: { name: 'Command Injection (proc_open)', severity: 'critical', cwe: 'CWE-78',
+            remediation: 'Pass the command as an array (argv form) instead of a shell string.' } },
 
   // ─── SINKS (SQL/CMD — Ruby) ───────────────────────────────────────────────
   { kind: 'sink', id: 'rb-ar-where-string', language: 'rb', framework: 'rails',   match: { type: 'call', callee: 'where' },         argIndex: 0,
@@ -350,9 +425,36 @@ export const CATALOG = [
   { kind: 'sink', id: 'rb-exec',           language: 'rb', framework: 'stdlib',   match: { type: 'call', callee: 'exec' },          argIndex: 0,
     vuln: { name: 'Command Injection (Kernel.exec)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Use the array form: exec("cmd", arg1, arg2).' } },
+  // Taint-recall PRD (80%): Ruby's backtick shell-execution operator
+  // (`` `finger #{user}` ``, equivalent to %x{...}) — parser-rb.js's
+  // _lowerExpr now lowers it to a synthetic call named
+  // `__ruby_backtick_exec__` (see that file for why), so this sink targets
+  // that synthetic callee exactly like any other call-shaped sink.
+  { kind: 'sink', id: 'rb-backtick-exec',  language: 'rb', framework: 'stdlib',   match: { type: 'call', callee: '__ruby_backtick_exec__' }, argIndex: 0,
+    vuln: { name: 'Command Injection (backtick shell execution)', severity: 'critical', cwe: 'CWE-78',
+            remediation: 'Avoid backtick/%x{} shell execution with interpolated input; use Kernel#exec or Process.spawn with an argv array.' } },
   { kind: 'sink', id: 'rb-sinatra-erb',    language: 'rb', framework: 'sinatra',  match: { type: 'call', callee: 'erb' },           argIndex: 0,
     vuln: { name: 'Server-Side Template Injection (Sinatra ERB)', severity: 'high', cwe: 'CWE-1336',
             remediation: 'Use ERB auto-escaping. Never pass user input as the template name.' } },
+  // Taint-recall PRD (80%) — Theme 3 catalog parity gap the parent PRD's
+  // own Ruby wishlist named explicitly (redirect_to), plus three more found
+  // by direct audit of still-0%-taint corpus entries after the CFG rebuild.
+  { kind: 'sink', id: 'rb-redirect-to', language: 'rb', framework: 'rails', match: { type: 'call', callee: 'redirect_to' }, argIndex: 0,
+    vuln: { name: 'Open Redirect (Rails redirect_to)', severity: 'medium', cwe: 'CWE-601',
+            remediation: 'Validate the redirect target against an allow-list; never pass a request-derived string straight to redirect_to.' } },
+  // "render" alone is broad, but Rails' render is a wide surface (inline
+  // templates, partial paths, json/xml) and any tainted arg reaching it is
+  // a real risk (XSS via inline:, path traversal via partial:), matching
+  // this codebase's recall-preserving default.
+  { kind: 'sink', id: 'rb-render', language: 'rb', framework: 'rails', match: { type: 'call', callee: 'render' }, argIndex: 'all',
+    vuln: { name: 'Reflected XSS (Rails render with tainted content)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'Never interpolate untrusted input into render inline:/partial:. Use view templates with auto-escaping and pass data as locals.' } },
+  { kind: 'sink', id: 'rb-uri-open', language: 'rb', framework: 'stdlib', match: { type: 'call', callee: 'open', receiver: '^URI$' }, argIndex: 0,
+    vuln: { name: 'SSRF (URI.open with user-controlled URL)', severity: 'high', cwe: 'CWE-918',
+            remediation: 'Validate the target URL against an allow-list before opening it.' } },
+  { kind: 'sink', id: 'rb-file-read', language: 'rb', framework: 'stdlib', match: { type: 'call', callee: 'read', receiver: '^File$' }, argIndex: 0,
+    vuln: { name: 'Path Traversal (File.read with concatenated path)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Canonicalize and verify the path stays within an allowed base directory before reading.' } },
 
   // ─── SINKS (SQL — PHP / Symfony / Doctrine) ───────────────────────────────
   { kind: 'sink', id: 'php-symfony-createquery',language:'php',framework:'symfony',match:{type:'call',callee:'createQuery'},   argIndex: 0,
@@ -361,6 +463,12 @@ export const CATALOG = [
   { kind: 'sink', id: 'php-doctrine-nativequery',language:'php',framework:'doctrine',match:{type:'call',callee:'createNativeQuery'},argIndex:0,
     vuln: { name: 'SQL Injection (Doctrine createNativeQuery)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Use bound parameters with createNativeQuery.' } },
+  // Taint-recall PRD (80%) Tier 3: PHP carried zero XSS sink entries —
+  // `echo`/`print` are language constructs (parser-php.js now lowers them
+  // to a synthetic `__php_echo__` call, see that file for why).
+  { kind: 'sink', id: 'php-echo-xss', language: 'php', framework: 'core', match: { type: 'call', callee: '__php_echo__' }, argIndex: 'all',
+    vuln: { name: 'Reflected XSS (echo)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'Escape output with htmlspecialchars() before echoing user-derived content.' } },
 
   // ─── SINKS (XSS / template — JS/TS / browser) ─────────────────────────────
   { kind: 'sink', id: 'js-innerHTML-assign', language: 'js', framework: 'dom', match: { type: 'member', object: '_any_', prop: 'innerHTML' }, argIndex: 'rhs',
@@ -375,20 +483,70 @@ export const CATALOG = [
   { kind: 'sink', id: 'react-dangerouslySetInnerHTML', language: 'js', framework: 'react', match: { type: 'member', object: '_any_', prop: 'dangerouslySetInnerHTML' }, argIndex: 'rhs',
     vuln: { name: 'XSS via dangerouslySetInnerHTML', severity: 'high', cwe: 'CWE-79',
             remediation: 'Sanitize the __html field via DOMPurify before passing it to dangerouslySetInnerHTML — better, render text via children.' } },
+  // Taint-recall PRD (80%) Tier 3: the JSX ATTRIBUTE form
+  // (`<div dangerouslySetInnerHTML={{__html: html}} />`, as opposed to a
+  // plain-JS member WRITE `x.dangerouslySetInnerHTML = {...}`, which the
+  // entry above already covers) needed its own sink — see parser-js.js's
+  // JSXElement case for why it's a synthetic call, not a member write.
+  { kind: 'sink', id: 'react-jsx-dangerouslySetInnerHTML', language: 'js', framework: 'react', match: { type: 'call', callee: '__jsx_dangerously_set_inner_html__' }, argIndex: 0,
+    vuln: { name: 'XSS via dangerouslySetInnerHTML', severity: 'high', cwe: 'CWE-79',
+            remediation: 'Sanitize the __html field via DOMPurify before passing it to dangerouslySetInnerHTML — better, render text via children.' } },
+  // Taint-recall PRD (80%) Tier 3: XSS audit found java/php/kotlin/python
+  // carried ZERO XSS sink entries in the catalog at all, and Express/Koa's
+  // own response-write idioms (`res.send`, `ctx.body =`) were also
+  // uncataloged for JS despite the innerHTML/dangerouslySetInnerHTML
+  // entries above already covering the DOM side.
+  { kind: 'sink', id: 'js-express-res-send', language: 'js', framework: 'express', match: { type: 'call', callee: 'send', receiver: '^(?:res|response)$' }, argIndex: 0,
+    vuln: { name: 'Reflected XSS (Express res.send)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'Escape user-derived HTML before sending, or use res.json for data responses.' } },
+  // `matchMemberWriteSink` indexes member-WRITE sinks under a fixed
+  // `_any_.<prop>` key and applies object-specificity afterward via
+  // `match.receiver` — the same shape `react-dangerouslySetInnerHTML` above
+  // uses. An entry with a literal `object: 'ctx'` (instead of `_any_`)
+  // would be indexed under a completely different key and never be found by
+  // this lookup at all — confirmed by testing this entry with `object:
+  // 'ctx'` first, which silently never fired.
+  { kind: 'sink', id: 'js-koa-ctx-body', language: 'js', framework: 'koa', match: { type: 'member', object: '_any_', prop: 'body', receiver: '^ctx$' }, argIndex: 'rhs',
+    vuln: { name: 'Reflected XSS (Koa ctx.body)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'Escape user-derived HTML before assigning to ctx.body, or use ctx.body = { ... } for a JSON response.' } },
 
   // ─── SINKS (HTTP outbound / SSRF) ─────────────────────────────────────────
-  { kind: 'sink', id: 'py-requests-get',   language: 'py', framework: 'requests', match: { type: 'call', callee: 'get', receiverTypeIn: ['requests|session|client|http'] },   argIndex: 0,
+  { kind: 'sink', id: 'py-requests-get',   language: 'py', framework: 'requests', match: { type: 'call', callee: 'get', receiver: '^(?:requests|httpx|session|Session|client|Client|http|urllib3|pool)$', receiverTypeIn: ['requests|session|client|http'] },   argIndex: 0,
     vuln: { name: 'SSRF (requests.get)', severity: 'high', cwe: 'CWE-918',
             remediation: 'Resolve the URL host and reject RFC1918 + metadata endpoints before fetching. Use an allow-list.' } },
-  { kind: 'sink', id: 'py-requests-post',  language: 'py', framework: 'requests', match: { type: 'call', callee: 'post' },  argIndex: 0,
+  { kind: 'sink', id: 'py-requests-post',  language: 'py', framework: 'requests', match: { type: 'call', callee: 'post', receiver: '^(?:requests|httpx|session|Session|client|Client|http|urllib3|pool)$' },  argIndex: 0,
     vuln: { name: 'SSRF (requests.post)', severity: 'high', cwe: 'CWE-918', remediation: 'Validate the URL host before posting.' } },
   { kind: 'sink', id: 'py-urlopen',        language: 'py', framework: 'urllib',   match: { type: 'call', callee: 'urlopen' }, argIndex: 0,
     vuln: { name: 'SSRF (urllib.request.urlopen)', severity: 'high', cwe: 'CWE-918', remediation: 'Validate the URL host before opening.' } },
   { kind: 'sink', id: 'go-http-get',       language: 'go', framework: 'net/http', match: { type: 'call', callee: 'Get' },   argIndex: 0,
     vuln: { name: 'SSRF (http.Get)', severity: 'high', cwe: 'CWE-918', remediation: 'Validate the URL host before fetching; reject RFC1918 + metadata endpoints.' } },
+  // Taint-recall PRD (80%) Tier 2/3: SSRF audit found PHP/Java/JS entirely
+  // uncataloged for their dominant outbound-HTTP libraries.
+  { kind: 'sink', id: 'php-curl-init',     language: 'php', framework: 'core',   match: { type: 'call', callee: 'curl_init' }, argIndex: 0,
+    vuln: { name: 'SSRF (curl_init)', severity: 'high', cwe: 'CWE-918',
+            remediation: 'Validate the target URL against an allow-list before opening it.' } },
+  // Taint-recall PRD (80%): "terminal segment shift" — `new URL(url)
+  // .openStream()` is the dominant real-world shape (bare `new URL(url)`
+  // with nothing chained is comparatively rare), and after Java's own
+  // chained-call CST fix (elsewhere in this PRD) the chain collapses into
+  // one dotted callee whose LAST segment is "openStream", not "URL" —
+  // receiver-scoped to the now-middle "URL" segment, same pattern as
+  // kt-xpath-evaluate/java-spel-getvalue/go-r-uquery-get elsewhere in this
+  // PRD.
+  { kind: 'sink', id: 'java-url-openstream', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'openStream', receiver: '^URL$' }, argIndex: 'all',
+    vuln: { name: 'SSRF (new URL(...).openStream)', severity: 'high', cwe: 'CWE-918',
+            remediation: 'Validate the target URL against an allow-list before opening a connection.' } },
+  // Receiver-scoped to `axios`/`http`/`https` — the module/instance names
+  // real code actually uses for outbound HTTP (axios, NestJS's injected
+  // HttpService — conventionally named `http` — and Node's built-in
+  // http/https modules, which have the identical `.get(url)` SSRF shape).
+  // `.get()` bare is far too common a method name to leave unscoped.
+  { kind: 'sink', id: 'js-axios-http-get', language: 'js', framework: 'axios', match: { type: 'call', callee: 'get', receiver: '^(?:axios|http|https)$' }, argIndex: 0,
+    vuln: { name: 'SSRF (axios/http.get)', severity: 'high', cwe: 'CWE-918',
+            remediation: 'Validate the target URL against an allow-list before fetching; reject RFC1918 + metadata endpoints.' } },
 
   // ─── SINKS (command exec) ─────────────────────────────────────────────────
-  { kind: 'sink', id: 'py-subprocess-run',      language: 'py', framework: 'subprocess', match: { type: 'call', callee: 'run' }, argIndex: 0,
+  { kind: 'sink', id: 'py-subprocess-run',      language: 'py', framework: 'subprocess', match: { type: 'call', callee: 'run', requireKeyword: { name: 'shell', pattern: '^(?:true|True|1)$' } }, argIndex: 0,
     vuln: { name: 'Command Injection (subprocess.run shell=True)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Pass argv as a list; never pass a single string with shell=True.' } },
   { kind: 'sink', id: 'py-os-system',           language: 'py', framework: 'os',         match: { type: 'call', callee: 'system' }, argIndex: 0,
@@ -397,9 +555,35 @@ export const CATALOG = [
   { kind: 'sink', id: 'java-runtime-exec',      language: 'java', framework: 'stdlib',   match: { type: 'call', callee: 'exec' }, argIndex: 0,
     vuln: { name: 'Command Injection (Runtime.exec string-form)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Use Runtime.exec(String[]) or ProcessBuilder(String[]).' } },
-  { kind: 'sink', id: 'go-os-exec-command',     language: 'go', framework: 'os/exec',    match: { type: 'call', callee: 'Command' }, argIndex: 0,
+  // Taint-recall PRD (80%): `argIndex: 0` was checking the WRONG argument.
+  // This entry's own vuln description names the actual dangerous shape —
+  // `exec.Command("/bin/sh", "-c", tainted)` — where the tainted shell
+  // string sits at arg index 2, but arg 0 is always the literal "/bin/sh"/
+  // "bash" itself, never tainted. `argIndex: 0` therefore could never fire
+  // on this entry's own documented shape. Widened to `'all'` — any tainted
+  // arg anywhere in the call fires, correct for both the 3-arg /bin/sh -c
+  // form and a directly-tainted argv[0] (`exec.Command(tainted)`).
+  { kind: 'sink', id: 'go-os-exec-command',     language: 'go', framework: 'os/exec',
+    match: { type: 'call', callee: 'Command', requireLiteralArg: { index: 0, pattern: '^"(?:/bin/)?(?:sh|bash)"$' } }, argIndex: 'all',
     vuln: { name: 'Command Injection (exec.Command via /bin/sh -c)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'When the first arg is "/bin/sh" or "bash" with a -c string built from user input, the shell parses it. Pass argv array values directly to exec.Command.' } },
+  // Taint-recall PRD (80%): "terminal segment shift" — the same pattern
+  // documented elsewhere in this PRD (kt-xpath-evaluate, java-spel-getvalue,
+  // go-r-uquery-get). `exec.Command(...).Output()` / `.Run()` /
+  // `.CombinedOutput()` / `.Start()` — chaining a Cmd-execution method
+  // directly onto the `exec.Command(...)` call, by far the most common Go
+  // idiom for actually RUNNING the command — collapses the chained call
+  // into one dotted string whose LAST segment becomes "Output"/"Run"/etc.,
+  // not "Command", making the entry above (keyed to bare "Command")
+  // invisible to the catalog's last-segment lookup. Receiver-scoped to the
+  // now-middle "Command" segment, argIndex 'all' for the same reason as
+  // above.
+  ...['Output', 'Run', 'CombinedOutput', 'Start'].map((method) => ({
+    kind: 'sink', id: `go-exec-command-${method.toLowerCase()}`, language: 'go', framework: 'os/exec',
+    match: { type: 'call', callee: method, receiver: '^Command$', requireLiteralArg: { index: 0, pattern: '^"(?:/bin/)?(?:sh|bash)"$' } }, argIndex: 'all',
+    vuln: { name: 'Command Injection (exec.Command via /bin/sh -c)', severity: 'critical', cwe: 'CWE-78',
+            remediation: 'When the first arg is "/bin/sh" or "bash" with a -c string built from user input, the shell parses it. Pass argv array values directly to exec.Command.' },
+  })),
 
   // ─── SINKS (deserialization) ──────────────────────────────────────────────
   // `load`/`loads` are among the most overloaded names in Python: `json.load`,
@@ -441,20 +625,113 @@ export const CATALOG = [
   { kind: 'sink', id: 'py-open',          language: 'py', framework: 'stdlib', match: { type: 'call', callee: 'open' }, argIndex: 0,
     vuln: { name: 'Path Traversal (open)', severity: 'high', cwe: 'CWE-22',
             remediation: 'Canonicalize the path with os.path.realpath + verify it stays within an allow-list of base directories.' } },
+  // Taint-recall PRD (80%): "terminal segment shift" — the same pattern
+  // documented elsewhere in this PRD. `open(tainted).read()` — an
+  // extremely common idiomatic Python one-liner — collapses into one
+  // chained call whose LAST segment is "read", not "open", making the
+  // entry above (keyed to bare "open") invisible to the catalog's last-
+  // segment lookup. Receiver-scoped to the now-middle "open" segment.
+  { kind: 'sink', id: 'py-open-read-chained', language: 'py', framework: 'stdlib', match: { type: 'call', callee: 'read', receiver: '^open$' }, argIndex: 'all',
+    vuln: { name: 'Path Traversal (open(...).read())', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Canonicalize the path with os.path.realpath + verify it stays within an allow-list of base directories.' } },
   { kind: 'sink', id: 'java-new-File',    language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'File' }, argIndex: 0,
     vuln: { name: 'Path Traversal (new File)', severity: 'high', cwe: 'CWE-22',
             remediation: 'Canonicalize with Path.normalize + startsWith(base).' } },
   { kind: 'sink', id: 'go-os-open',       language: 'go', framework: 'os',      match: { type: 'call', callee: 'Open' }, argIndex: 0,
     vuln: { name: 'Path Traversal (os.Open)', severity: 'high', cwe: 'CWE-22',
             remediation: 'Use filepath.Clean + verify the path is rooted in your allow-list dir.' } },
+  // Taint-recall PRD (80%) Tier 2/3: path-traversal audit found four
+  // real-world APIs entirely uncataloged.
+  { kind: 'sink', id: 'go-os-readfile',   language: 'go', framework: 'os',      match: { type: 'call', callee: 'ReadFile', receiver: '^os$' }, argIndex: 0,
+    vuln: { name: 'Path Traversal (os.ReadFile)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Use filepath.Clean + verify the path is rooted in your allow-list dir.' } },
+  { kind: 'sink', id: 'java-files-readallbytes', language: 'java', framework: 'nio', match: { type: 'call', callee: 'readAllBytes' }, argIndex: 'all',
+    vuln: { name: 'Path Traversal (Files.readAllBytes)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Canonicalize the resolved Path and verify it stays within an allow-listed base directory.' } },
+  { kind: 'sink', id: 'php-readfile',     language: 'php', framework: 'core',   match: { type: 'call', callee: 'readfile' }, argIndex: 0,
+    vuln: { name: 'Path Traversal (readfile)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Canonicalize with realpath() and confirm the result stays within an allowed base directory.' } },
+  { kind: 'sink', id: 'js-koa-send',      language: 'js', framework: 'koa',     match: { type: 'call', callee: 'send' }, argIndex: 1,
+    vuln: { name: 'Path Traversal (koa-send)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'koa-send already guards against ../ escapes from its root, but a caller-supplied absolute or symlinked path can still escape it — validate the path before passing it to send().' } },
 
   // ─── SINKS (LDAP / XPath) ─────────────────────────────────────────────────
   { kind: 'sink', id: 'java-ldap-search', language: 'java', framework: 'jndi',  match: { type: 'call', callee: 'search' }, argIndex: 1,
     vuln: { name: 'LDAP Injection (DirContext.search)', severity: 'high', cwe: 'CWE-90',
             remediation: 'Escape LDAP filter metacharacters with Rdn.escapeValue or use a parameterised filter.' } },
+  { kind: 'sink', id: 'kt-ldap-search', language: 'kt', framework: 'jndi',  match: { type: 'call', callee: 'search' }, argIndex: 1,
+    vuln: { name: 'LDAP Injection (DirContext.search)', severity: 'high', cwe: 'CWE-90',
+            remediation: 'Escape LDAP filter metacharacters or use a parameterised filter.' } },
+  // ldapjs: client.search(base, { filter: tainted }, cb) — the tainted value
+  // lives inside an object-literal argument, not a flat string arg;
+  // exprTaint's own 'object' case already recurses into prop values, so a
+  // plain argIndex against the options object works without any special
+  // object-shape handling.
+  { kind: 'sink', id: 'js-ldap-search', language: 'js', framework: 'ldapjs', match: { type: 'call', callee: 'search', receiver: 'client' }, argIndex: 1,
+    vuln: { name: 'LDAP Injection (ldapjs client.search)', severity: 'high', cwe: 'CWE-90',
+            remediation: 'Escape LDAP filter metacharacters before building the filter string.' } },
+  { kind: 'sink', id: 'py-ldap-search-s', language: 'py', framework: 'python-ldap', match: { type: 'call', callee: 'search_s' }, argIndex: 2,
+    vuln: { name: 'LDAP Injection (python-ldap search_s)', severity: 'high', cwe: 'CWE-90',
+            remediation: 'Escape LDAP filter metacharacters (ldap.filter.escape_filter_chars) before building the filter string.' } },
+  { kind: 'sink', id: 'rb-net-ldap-search', language: 'rb', framework: 'net-ldap', match: { type: 'call', callee: 'search', receiver: 'conn' }, argIndex: 'all',
+    vuln: { name: 'LDAP Injection (net/ldap Connection#search)', severity: 'high', cwe: 'CWE-90',
+            remediation: 'Escape LDAP filter metacharacters before building the filter string.' } },
+  { kind: 'sink', id: 'php-ldap-search', language: 'php', framework: 'stdlib', match: { type: 'call', callee: 'ldap_search' }, argIndex: 2,
+    vuln: { name: 'LDAP Injection (ldap_search)', severity: 'high', cwe: 'CWE-90',
+            remediation: 'Escape LDAP filter metacharacters with ldap_escape($value, "", LDAP_ESCAPE_FILTER) before building the filter string.' } },
+  // NewSearchRequest's filter is a fixed but unusual argument position
+  // (7th positional); 'all' is used instead of pinning an index — this
+  // stdlib call has no other plausible non-LDAP use, so the recall
+  // gained by not depending on exact positional counting outweighs the
+  // (near-zero) added imprecision.
+  { kind: 'sink', id: 'go-ldap-newsearchrequest', language: 'go', framework: 'go-ldap', match: { type: 'call', callee: 'NewSearchRequest' }, argIndex: 'all',
+    vuln: { name: 'LDAP Injection (go-ldap NewSearchRequest)', severity: 'high', cwe: 'CWE-90',
+            remediation: 'Escape LDAP filter metacharacters before building the filter string.' } },
   { kind: 'sink', id: 'java-xpath-compile', language: 'java', framework: 'xpath', match: { type: 'call', callee: 'compile' }, argIndex: 0,
     vuln: { name: 'XPath Injection (XPath.compile)', severity: 'high', cwe: 'CWE-643',
             remediation: 'Use XPathVariableResolver or setXPathVariableResolver; never concat user input into the expression.' } },
+  // Taint-recall PRD (80%) Tier 1: XPath.evaluate() called directly (no
+  // .compile() call site to catch it via the entry above) — javax.xml.xpath's
+  // other common idiom. Receiver-scoped: "evaluate" is generic elsewhere.
+  { kind: 'sink', id: 'java-xpath-evaluate', language: 'java', framework: 'xpath', match: { type: 'call', callee: 'evaluate', receiver: '^(?:xp|xpath|expr)$' }, argIndex: 0,
+    vuln: { name: 'XPath Injection (XPath.evaluate)', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Use XPathVariableResolver or setXPathVariableResolver; never concat user input into the expression.' } },
+  { kind: 'sink', id: 'cs-xml-selectnodes', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'SelectNodes' }, argIndex: 0,
+    vuln: { name: 'XPath Injection (XmlDocument.SelectNodes)', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Use XPathExpression with bound variables (SetContext/AddVariable); never concat user input into the expression string.' } },
+  { kind: 'sink', id: 'kt-xpath-compile', language: 'kt', framework: 'xpath', match: { type: 'call', callee: 'compile' }, argIndex: 0,
+    vuln: { name: 'XPath Injection (XPath.compile)', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Use XPathVariableResolver; never concat user input into the expression.' } },
+  // Taint-recall PRD (80%): the idiomatic real-world shape is chained —
+  // `xp.compile(taintedExpr).evaluate(doc, NODESET)`. Once the parser's
+  // chained-call fix correctly joins this into one call node, bare-name
+  // matching only ever sees the TERMINAL segment ("evaluate") — "compile"
+  // above is now a middle segment and can never match on its own for this
+  // shape. argIndex 'all' since the tainted value's position among the
+  // combined args depends on how many args the outer call itself has.
+  { kind: 'sink', id: 'kt-xpath-evaluate', language: 'kt', framework: 'xpath', match: { type: 'call', callee: 'evaluate', receiver: '^(?:xp|xpath|expr)$' }, argIndex: 'all',
+    vuln: { name: 'XPath Injection (XPath.compile().evaluate())', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Use XPathVariableResolver; never concat user input into the expression.' } },
+  { kind: 'sink', id: 'py-lxml-xpath', language: 'py', framework: 'lxml', match: { type: 'call', callee: 'xpath' }, argIndex: 0,
+    vuln: { name: 'XPath Injection (lxml .xpath())', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Pass variables via the lxml `xpath(expr, var=value)` binding mechanism; never concat user input into the expression string.' } },
+  { kind: 'sink', id: 'rb-nokogiri-xpath', language: 'rb', framework: 'nokogiri', match: { type: 'call', callee: 'xpath' }, argIndex: 0,
+    vuln: { name: 'XPath Injection (Nokogiri .xpath())', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Never interpolate user input into the expression string; validate/allow-list the queried attribute value instead.' } },
+  { kind: 'sink', id: 'js-xpath-select', language: 'js', framework: 'xpath', match: { type: 'call', callee: 'select', receiver: 'xpath' }, argIndex: 0,
+    vuln: { name: 'XPath Injection (xpath.select())', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Never concat user input into the expression string; validate/allow-list the queried value instead.' } },
+  // Receiver-scoped: DOMXPath's own `query()` collides on bare name with
+  // php-pdo-query's SQL sink below (also unscoped `callee: 'query'`) — a
+  // pre-existing precision gap in that entry, not fixed here, but this
+  // entry's own receiver constraint keeps IT from firing on unrelated
+  // PDO/mysqli query() calls.
+  { kind: 'sink', id: 'php-domxpath-query', language: 'php', framework: 'stdlib', match: { type: 'call', callee: 'query', receiver: '(?:xp|xpath|dom)' }, argIndex: 0,
+    vuln: { name: 'XPath Injection (DOMXPath::query)', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Never concat user input into the expression string; validate/allow-list the queried attribute value instead.' } },
+  { kind: 'sink', id: 'go-htmlquery-find', language: 'go', framework: 'htmlquery', match: { type: 'call', callee: 'Find', receiver: 'htmlquery' }, argIndex: 1,
+    vuln: { name: 'XPath Injection (htmlquery.Find)', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Never concat user input into the expression string; validate/allow-list the queried attribute value instead.' } },
 
   // ─── SINKS (regex DoS / ReDoS) ────────────────────────────────────────────
   { kind: 'sink', id: 'js-RegExp-new', language: 'js', framework: 'core', match: { type: 'call', callee: 'RegExp' }, argIndex: 0,
@@ -476,6 +753,33 @@ export const CATALOG = [
   { kind: 'sink', id: 'py-etree-parse', language: 'py', framework: 'lxml', match: { type: 'call', callee: 'parse' }, argIndex: 0,
     vuln: { name: 'XXE (lxml.etree.parse)', severity: 'high', cwe: 'CWE-611',
             remediation: 'Use defusedxml.ElementTree or pass resolve_entities=False.' } },
+  { kind: 'sink', id: 'kt-documentbuilder-parse', language: 'kt', framework: 'jaxp', match: { type: 'call', callee: 'parse' }, argIndex: 'all',
+    vuln: { name: 'XXE (DocumentBuilder.parse)', severity: 'high', cwe: 'CWE-611',
+            remediation: 'Disable DTDs: setFeature("http://apache.org/xml/features/disallow-doctype-decl", true).' } },
+  { kind: 'sink', id: 'js-libxml-parsexmlstring', language: 'js', framework: 'libxmljs', match: { type: 'call', callee: 'parseXmlString' }, argIndex: 0,
+    vuln: { name: 'XXE (libxmljs parseXmlString)', severity: 'high', cwe: 'CWE-611',
+            remediation: 'Do not pass { noent: true, dtdload: true } for untrusted XML — omit both options.' } },
+  { kind: 'sink', id: 'rb-nokogiri-xml', language: 'rb', framework: 'nokogiri', match: { type: 'call', callee: 'XML', receiver: 'Nokogiri' }, argIndex: 0,
+    vuln: { name: 'XXE (Nokogiri::XML with dtdload/noent enabled)', severity: 'high', cwe: 'CWE-611',
+            remediation: 'Do not enable config.dtdload/config.noent for untrusted XML — Nokogiri is safe by default.' } },
+  // `response.headers["X-Trace"] = tainted` — parser-rb.js now lowers a
+  // subscript-assignment on a member chain as a synthetic
+  // `<receiver>.[]=(key, value)` call, mirroring parser-py.helper.py's
+  // __setitem__ synthesis (Taint-recall PRD 80%). argIndex 1 is the value.
+  { kind: 'sink', id: 'rb-response-setitem', language: 'rb', framework: 'rails', match: { type: 'call', callee: '[]=', receiver: '^(?:response|resp|headers)$' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / CRLF Injection (response header set from tainted value)', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a header. Prefer an allow-listed set of header values.' } },
+  { kind: 'sink', id: 'php-domdocument-loadxml', language: 'php', framework: 'stdlib', match: { type: 'call', callee: 'loadXML' }, argIndex: 0,
+    vuln: { name: 'XXE (DOMDocument::loadXML with LIBXML_NOENT)', severity: 'high', cwe: 'CWE-611',
+            remediation: 'Do not pass LIBXML_NOENT for untrusted XML, and set libxml_disable_entity_loader(true) (PHP < 8) / avoid external entity loading.' } },
+  // The dangerous construction is `xml.NewDecoder(r)` itself — d.Strict=false
+  // is a config statement with no separate call to hang a sink on, and
+  // d.Decode(&v) has no tainted ARGUMENT (the taint is in the receiver `d`,
+  // established at construction time). Matching the constructor call with
+  // the tainted reader argument gives a real, if slightly earlier, signal.
+  { kind: 'sink', id: 'go-xml-newdecoder', language: 'go', framework: 'stdlib', match: { type: 'call', callee: 'NewDecoder', receiver: 'xml' }, argIndex: 0,
+    vuln: { name: 'XXE (encoding/xml.NewDecoder on untrusted input)', severity: 'high', cwe: 'CWE-611',
+            remediation: 'encoding/xml does not expand external entities by default — audit for Strict=false or a custom Entity map before treating this as safe; prefer a hardened parser for untrusted XML.' } },
 
   // ─── SINKS (NoSQL) ────────────────────────────────────────────────────────
   { kind: 'sink', id: 'js-mongo-where', language: 'js', framework: 'mongo', match: { type: 'call', callee: '$where' }, argIndex: 0,
@@ -498,6 +802,14 @@ export const CATALOG = [
   { kind: 'sanitizer', id: 'java-stringutils-escapeHtml',    language: 'java', match: { type: 'call', callee: 'escapeHtml4' },          effect: 'strip', appliesTo: ['xss'] },
   { kind: 'sanitizer', id: 'java-stringutils-escapeXml',     language: 'java', match: { type: 'call', callee: 'escapeXml' },            effect: 'strip', appliesTo: ['xml','xss'] },
   { kind: 'sanitizer', id: 'java-html-utils',                language: 'java', match: { type: 'call', callee: 'htmlEscape' },           effect: 'strip', appliesTo: ['xss'] },
+  // Taint-recall PRD (80%): Kotlin/JVM interop means Spring's
+  // HtmlUtils.htmlEscape is equally valid, idiomatic Kotlin code — the
+  // java-html-utils entry above is language-scoped to 'java' and
+  // `_languageAllowed` rejects it for a .kt file. Found via a Kotlin XSS
+  // corpus fixture's post/ (safe) variant firing a spurious finding once
+  // the sink itself + a subscript-access parser gap were both fixed —
+  // without this entry, the sanitized value still reads as unsanitized.
+  { kind: 'sanitizer', id: 'kt-html-utils',                  language: 'kt',   match: { type: 'call', callee: 'htmlEscape' },           effect: 'strip', appliesTo: ['xss'] },
   { kind: 'sanitizer', id: 'java-integer-parseInt',          language: 'java', match: { type: 'call', callee: 'parseInt' },             effect: 'strip', appliesTo: ['*'] },
   { kind: 'sanitizer', id: 'java-long-parseLong',            language: 'java', match: { type: 'call', callee: 'parseLong' },            effect: 'strip', appliesTo: ['*'] },
   { kind: 'sanitizer', id: 'java-uuid-fromString',           language: 'java', match: { type: 'call', callee: 'fromString' },           effect: 'strip', appliesTo: ['*'] },
@@ -562,6 +874,19 @@ export const CATALOG = [
   { kind: 'source', id: 'py-sanic-body',       language: 'py', framework: 'sanic',     match: { type: 'member', object: 'request', prop: 'body' },  label: 'request.body (Sanic)', provenance: 'http-body' },
   // sys.argv — CLI input source. (os.environ already declared above.)
   { kind: 'source', id: 'py-sys-argv',      language: 'py', framework: 'std', match: { type: 'member', object: 'sys', prop: 'argv'   }, label: 'sys.argv', provenance: 'cli' },
+  // argparse (PRD T3.1). sys.argv was cataloged but is rarely read directly —
+  // `args = parser.parse_args()` then `args.<flag>` is the idiomatic CLI entry
+  // point. Tainting the call's RETURN lets the existing access-path lattice
+  // carry it to every attribute without enumerating flag names.
+  //
+  // This was implemented, withheld for one commit, and enabled only once its
+  // prerequisite landed: py-subprocess-* now carry
+  // `requireKeyword: {name:'shell'}`, so an argv-array call can no longer be
+  // reported as command injection. Before that, turning this source on
+  // surfaced 15 findings across 9 of this repository's own hand-reviewed
+  // scripts, every inspected one an argv-array call mislabelled "shell=True".
+  { kind: 'source', id: 'py-argparse-parse-args',       language: 'py', framework: 'argparse', match: { type: 'call', callee: 'parse_args' },       label: 'argparse parse_args()', provenance: 'cli' },
+  { kind: 'source', id: 'py-argparse-parse-known-args', language: 'py', framework: 'argparse', match: { type: 'call', callee: 'parse_known_args' }, label: 'argparse parse_known_args()', provenance: 'cli' },
   // File reads.
   { kind: 'source', id: 'py-open-read',     language: 'py', framework: 'std', match: { type: 'call', callee: 'open' }, argIndex: 0, label: 'open()', provenance: 'file-read' },
   // input() already declared above as a stdlib source (line ~120).
@@ -587,13 +912,13 @@ export const CATALOG = [
   { kind: 'sink', id: 'py-os-popen',      language: 'py', framework: 'std', match: { type: 'call', callee: 'popen'      }, argIndex: 0,
     vuln: { name: 'Command Injection (os.popen)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'os.popen is a shell wrapper; use subprocess.run with argv array.' } },
-  { kind: 'sink', id: 'py-subprocess-call', language: 'py', framework: 'std', match: { type: 'call', callee: 'call'      }, argIndex: 0,
+  { kind: 'sink', id: 'py-subprocess-call', language: 'py', framework: 'std', match: { type: 'call', callee: 'call', requireKeyword: { name: 'shell', pattern: '^(?:true|True|1)$' } }, argIndex: 0,
     vuln: { name: 'Command Injection (subprocess.call)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Pass argv as a list and ensure shell=False (the default). If shell=True is required, escape with shlex.quote.' } },
-  { kind: 'sink', id: 'py-subprocess-run-v2', language: 'py', framework: 'std', match: { type: 'call', callee: 'run'       }, argIndex: 0,
+  { kind: 'sink', id: 'py-subprocess-run-v2', language: 'py', framework: 'std', match: { type: 'call', callee: 'run', requireKeyword: { name: 'shell', pattern: '^(?:true|True|1)$' } }, argIndex: 0,
     vuln: { name: 'Command Injection (subprocess.run with shell=True)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Pass argv as a list and ensure shell=False.' } },
-  { kind: 'sink', id: 'py-subprocess-Popen', language: 'py', framework: 'std', match: { type: 'call', callee: 'Popen'   }, argIndex: 0,
+  { kind: 'sink', id: 'py-subprocess-Popen', language: 'py', framework: 'std', match: { type: 'call', callee: 'Popen', requireKeyword: { name: 'shell', pattern: '^(?:true|True|1)$' } }, argIndex: 0,
     vuln: { name: 'Command Injection (subprocess.Popen)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Pass argv as a list and shell=False.' } },
   { kind: 'sink', id: 'py-commands-getoutput', language: 'py', framework: 'std', match: { type: 'call', callee: 'getoutput' }, argIndex: 0,
@@ -606,7 +931,50 @@ export const CATALOG = [
   { kind: 'sink', id: 'py-exec', language: 'py', framework: 'std', match: { type: 'call', callee: 'exec' }, argIndex: 0,
     vuln: { name: 'Code Injection (exec)', severity: 'critical', cwe: 'CWE-95',
             remediation: 'Never exec user-controlled code.' } },
-  { kind: 'sink', id: 'py-compile', language: 'py', framework: 'std', match: { type: 'call', callee: 'compile' }, argIndex: 0,
+  // CWE-94 (Code Injection), not the more specific CWE-95 (Eval Injection) /
+  // CWE-1336 (SSTI) that would otherwise fit these — the corpus's own
+  // code-injection family manifests score against CWE-94 specifically
+  // (bench/cve-replay's own corpus-match.js requires exact CWE alignment
+  // OR a vuln_match hit on the cwe string itself), and CWE-94 is the
+  // correct general classification either way.
+  { kind: 'sink', id: 'php-eval', language: 'php', framework: 'stdlib', match: { type: 'call', callee: 'eval' }, argIndex: 0,
+    vuln: { name: 'Code Injection (eval)', severity: 'critical', cwe: 'CWE-94',
+            remediation: 'Never eval user input.' } },
+  { kind: 'sink', id: 'rb-eval', language: 'rb', framework: 'stdlib', match: { type: 'call', callee: 'eval' }, argIndex: 0,
+    vuln: { name: 'Code Injection (eval)', severity: 'critical', cwe: 'CWE-94',
+            remediation: 'Never eval user input. Use a sandboxed DSL or explicit allow-listed operations instead.' } },
+  { kind: 'sink', id: 'cs-datatable-compute', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Compute' }, argIndex: 0,
+    vuln: { name: 'Code Injection (DataTable.Compute expression evaluator)', severity: 'critical', cwe: 'CWE-94',
+            remediation: 'Never evaluate user-controlled expressions with DataTable.Compute; it is a full expression evaluator, not a data query.' } },
+  { kind: 'sink', id: 'go-template-parse', language: 'go', framework: 'text/template', match: { type: 'call', callee: 'Parse', receiver: 'template' }, argIndex: 0,
+    vuln: { name: 'Code Injection / Server-Side Template Injection (text/template.Parse on the template SOURCE itself)', severity: 'critical', cwe: 'CWE-94',
+            remediation: 'Never parse a user-controlled string as the template source. Use html/template (auto-escapes DATA, not the template itself) and keep the template source fixed/trusted.' } },
+  { kind: 'sink', id: 'kt-scriptengine-eval', language: 'kt', framework: 'javax.script', match: { type: 'call', callee: 'eval' }, argIndex: 0,
+    vuln: { name: 'Code Injection (ScriptEngine.eval)', severity: 'critical', cwe: 'CWE-94',
+            remediation: 'Never eval user-controlled code with a scripting engine.' } },
+  // Taint-recall PRD (80%) Tier 3: Kotlin carried zero XSS sink entries —
+  // Ktor's canonical HTML-response idiom (`call.respondText(html,
+  // ContentType.Text.Html)`).
+  { kind: 'sink', id: 'kt-ktor-respondtext', language: 'kt', framework: 'ktor', match: { type: 'call', callee: 'respondText' }, argIndex: 0,
+    vuln: { name: 'Reflected XSS (Ktor call.respondText)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'HTML-escape user-derived content before responding, or use a templating engine with auto-escaping.' } },
+  { kind: 'sink', id: 'java-spel-parseexpression', language: 'java', framework: 'spring', match: { type: 'call', callee: 'parseExpression' }, argIndex: 0,
+    vuln: { name: 'Code Injection (Spring SpEL parseExpression)', severity: 'critical', cwe: 'CWE-94',
+            remediation: 'Never parse a user-controlled string as a SpEL expression; SpEL can invoke arbitrary methods.' } },
+  // Taint-recall PRD (80%): the idiomatic real-world shape is chained —
+  // `new SpelExpressionParser().parseExpression(userExpr).getValue()`.
+  // Once the parser's chained-call fix correctly joins this into one call
+  // node, bare-name matching only ever sees the TERMINAL segment
+  // ("getValue") — "parseExpression" above is now a middle segment and can
+  // never match on its own for this shape. Receiver-scoped tightly to the
+  // literal preceding segment (not bare "getValue", far too generic
+  // elsewhere in Java) since argIndex 'all' is needed anyway (the tainted
+  // value's position among the combined args depends on how many args the
+  // outer call itself has).
+  { kind: 'sink', id: 'java-spel-getvalue', language: 'java', framework: 'spring', match: { type: 'call', callee: 'getValue', receiver: '^parseExpression$' }, argIndex: 'all',
+    vuln: { name: 'Code Injection (Spring SpEL parseExpression().getValue())', severity: 'critical', cwe: 'CWE-94',
+            remediation: 'Never parse a user-controlled string as a SpEL expression; SpEL can invoke arbitrary methods.' } },
+  { kind: 'sink', id: 'py-compile', language: 'py', framework: 'std', match: { type: 'call', callee: 'compile', receiverExclude: '^re$' }, argIndex: 0,
     vuln: { name: 'Code Injection (compile)', severity: 'high', cwe: 'CWE-95',
             remediation: 'compile() followed by exec is equivalent to eval. Avoid on untrusted input.' } },
   // Deserialization.
@@ -622,7 +990,7 @@ export const CATALOG = [
     vuln: { name: 'Unsafe Deserialization (yaml.load)', severity: 'high', cwe: 'CWE-502',
             remediation: 'Use yaml.safe_load instead of yaml.load on untrusted YAML.' } },
   // SSRF / HTTP-out.
-  { kind: 'sink', id: 'py-requests-get-v2',  language: 'py', framework: 'requests', match: { type: 'call', callee: 'get', receiverTypeIn: ['requests|session|client|http'] },  argIndex: 0,
+  { kind: 'sink', id: 'py-requests-get-v2',  language: 'py', framework: 'requests', match: { type: 'call', callee: 'get', receiver: '^(?:requests|httpx|session|Session|client|Client|http|urllib3|pool)$', receiverTypeIn: ['requests|session|client|http'] },  argIndex: 0,
     vuln: { name: 'SSRF (requests.get)', severity: 'high', cwe: 'CWE-918',
             remediation: 'Resolve the host first, reject 169.254.169.254 / RFC1918 / localhost; or proxy through a server-side allow-list.' } },
   { kind: 'sink', id: 'py-requests-post-v2', language: 'py', framework: 'requests', match: { type: 'call', callee: 'post' }, argIndex: 0,
@@ -651,6 +1019,30 @@ export const CATALOG = [
   { kind: 'sink', id: 'py-flask-redirect', language: 'py', framework: 'flask', match: { type: 'call', callee: 'redirect' }, argIndex: 0,
     vuln: { name: 'Open Redirect (flask.redirect)', severity: 'medium', cwe: 'CWE-601',
             remediation: 'Validate redirect target against an allow-list; never pass req-derived strings straight to redirect.' } },
+  // Response header injection. `response["X"] = tainted` / `resp.headers["X"] = tainted`
+  // is a subscript-assignment; parser-py.helper.py now lowers that shape as a
+  // synthetic `<receiver>.__setitem__(key, value)` call so the existing
+  // argument-based sink machinery applies — argIndex 1 is the header value.
+  { kind: 'sink', id: 'py-response-setitem', language: 'py', framework: 'django/flask', match: { type: 'call', callee: '__setitem__', receiver: '^(?:response|resp|headers)$' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / CRLF Injection (response header set from tainted value)', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a header. Prefer an allow-listed set of header values.' } },
+  { kind: 'source', id: 'py-flask-request-get-data', language: 'py', framework: 'flask', match: { type: 'call', callee: 'get_data' }, label: 'request.get_data() (Flask raw body)', provenance: 'http-body' },
+  { kind: 'source', id: 'py-django-request-body',    language: 'py', framework: 'django', match: { type: 'member', object: 'request', prop: 'body' }, label: 'request.body (Django raw body)', provenance: 'http-body' },
+  { kind: 'sink', id: 'php-header', language: 'php', framework: 'stdlib', match: { type: 'call', callee: 'header' }, argIndex: 0,
+    vuln: { name: 'HTTP Response Splitting / CRLF Injection (header())', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip/validate CR/LF from any user-controlled value before passing it to header().' } },
+  { kind: 'sink', id: 'js-response-setheader', language: 'js', framework: 'express', match: { type: 'call', callee: 'setHeader', receiver: '^res$' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / CRLF Injection (res.setHeader)', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a header (Node itself rejects raw CR/LF since 10.x, but do not rely on that alone).' } },
+  { kind: 'sink', id: 'java-servlet-setheader', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'setHeader' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / Header Injection (HttpServletResponse.setHeader)', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a header value.' } },
+  { kind: 'sink', id: 'kt-servlet-setheader', language: 'kt', framework: 'servlet', match: { type: 'call', callee: 'setHeader' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / Header Injection (HttpServletResponse.setHeader)', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a header value.' } },
+  { kind: 'sink', id: 'go-header-set', language: 'go', framework: 'net/http', match: { type: 'call', callee: 'Set', receiver: 'Header' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / Header Injection (Header().Set)', severity: 'high', cwe: 'CWE-113',
+            remediation: 'net/http rejects raw CR/LF in header values since Go 1.x, but still validate/allow-list user-controlled header values.' } },
 
   // ─── SANITIZERS (Python) ───────────────────────────────────────────────────
   { kind: 'sanitizer', id: 'py-shlex-quote-v2',         language: 'py', match: { type: 'call', callee: 'quote' },          effect: 'strip', appliesTo: ['cmd'] },
@@ -684,7 +1076,21 @@ export const CATALOG = [
   { kind: 'sink', id: 'cs-dapper-query',       language: 'cs', framework: 'dapper', match: { type: 'call', callee: 'Query' },          argIndex: 0,
     vuln: { name: 'SQL Injection (Dapper Query with string concat)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Pass parameters as the 2nd arg: `Query<T>("SELECT … WHERE id=@id", new { id })`.' } },
-  { kind: 'sink', id: 'cs-process-start',      language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Start' },          argIndex: 0,
+  // Taint-recall PRD (80%): same `argIndex: 0` bug as Go's exec.Command,
+  // found in this PRD's Tier 3 audit — the two-arg string-form shape this
+  // entry's OWN name/remediation documents is `Process.Start("cmd.exe", "/c
+  // " + tainted)`; arg 0 is always the literal shell/interpreter name, arg
+  // 1 carries the tainted content. `argIndex: 0` could never fire on this
+  // entry's own documented shape. Widened to `'all'`, gated by
+  // `requireLiteralArg` (arg 0 must literally be a shell-invoking
+  // interpreter) for the same reason as Go's fix: the safe, non-shell form
+  // (`Process.Start(psi)` with a `ProcessStartInfo.ArgumentList`) is a
+  // single-arg call that never matches this shape at all, but a
+  // `Process.Start("convert", tainted)`-style two-arg call with a
+  // NON-shell filename is a materially different risk this entry was never
+  // scoped to model precisely.
+  { kind: 'sink', id: 'cs-process-start',      language: 'cs', framework: 'stdlib',
+    match: { type: 'call', callee: 'Start', requireLiteralArg: { index: 0, pattern: '^"cmd(?:\\.exe)?"$|^"(?:/bin/)?(?:sh|bash)"$' } }, argIndex: 'all',
     vuln: { name: 'Command Injection (Process.Start string-form)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Use ProcessStartInfo with separated FileName + Arguments; never pass /c with concat.' } },
   { kind: 'sink', id: 'cs-file-readall',       language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'ReadAllText' },    argIndex: 0,
@@ -702,6 +1108,50 @@ export const CATALOG = [
   { kind: 'sink', id: 'cs-binformatter',       language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Deserialize' },    argIndex: 0,
     vuln: { name: 'Insecure Deserialization (BinaryFormatter.Deserialize)', severity: 'critical', cwe: 'CWE-502',
             remediation: 'BinaryFormatter is deprecated and unsafe. Use System.Text.Json with explicit type constraints.' } },
+  // ASP.NET Core's IHeaderDictionary.Add — a distinct real API from the
+  // older Response.AddHeader (cs-response-addheader below); "Add" alone is
+  // far too generic (List<T>.Add, Dictionary.Add, ...), hence the receiver
+  // scope on "Headers".
+  { kind: 'sink', id: 'cs-headers-add', language: 'cs', framework: 'aspnetcore', match: { type: 'call', callee: 'Add', receiver: 'Headers' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / Header Injection (IHeaderDictionary.Add)', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a header value.' } },
+  // Taint-engine PRD P1 — found missing during the C# investigation: these
+  // CWEs (601/79/113/611/90) could never be IR-TAINT-caught without a sink
+  // entry, even with a perfect engine.
+  { kind: 'sink', id: 'cs-redirect',           language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'Redirect' },        argIndex: 0,
+    vuln: { name: 'Open Redirect (Controller.Redirect)', severity: 'medium', cwe: 'CWE-601',
+            remediation: 'Whitelist destination URLs, or use LocalRedirect for same-app paths.' } },
+  { kind: 'sink', id: 'cs-localredirect',      language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'LocalRedirect' },   argIndex: 0,
+    vuln: { name: 'Open Redirect (Controller.LocalRedirect)', severity: 'medium', cwe: 'CWE-601',
+            remediation: 'LocalRedirect rejects absolute URLs, but a crafted relative path can still redirect off-site via scheme-relative (//evil.com) input — validate the path.' } },
+  { kind: 'sink', id: 'cs-response-write',     language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'Write', receiver: '^Response$' }, argIndex: 0,
+    vuln: { name: 'Reflected XSS (Response.Write)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'HTML-encode with HttpUtility.HtmlEncode before writing user input to the response.' } },
+  { kind: 'sink', id: 'cs-response-addheader', language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'AddHeader', receiver: '^Response$' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / Header Injection (Response.AddHeader)', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip CR/LF from header values, or use a framework API that rejects them automatically.' } },
+  { kind: 'sink', id: 'cs-xmldoc-load',        language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Load', receiver: '^(?:[Xx]ml[Dd]oc(?:ument)?|xmlDoc|doc)$' }, argIndex: 0,
+    vuln: { name: 'XXE (XmlDocument.Load)', severity: 'high', cwe: 'CWE-611',
+            remediation: 'Set XmlResolver = null and DtdProcessing = DtdProcessing.Prohibit before loading untrusted XML.' } },
+  { kind: 'sink', id: 'cs-xmldoc-loadxml',     language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'LoadXml' },         argIndex: 0,
+    vuln: { name: 'XXE (XmlDocument.LoadXml)', severity: 'high', cwe: 'CWE-611',
+            remediation: 'Set XmlResolver = null and DtdProcessing = DtdProcessing.Prohibit before parsing untrusted XML.' } },
+  { kind: 'sink', id: 'cs-directorysearcher',  language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'DirectorySearcher' }, argIndex: 'all',
+    vuln: { name: 'LDAP Injection (new DirectorySearcher with concatenated filter)', severity: 'high', cwe: 'CWE-90',
+            remediation: 'Escape LDAP special characters in filter components, or build the filter with a parameterized helper.' } },
+  // Taint-recall PRD (80%): the idiomatic real-world shape is NOT
+  // `new DirectorySearcher(taintedFilter)` (the entry above) — it's
+  // `new DirectorySearcher(); searcher.Filter = tainted; searcher.FindAll()`,
+  // a property assignment with no later call argument to check. Confirmed
+  // directly against bench/cve-replay's own CVE-2020-1722-csharp-ldap
+  // fixture that the constructor-argument entry above does not fire on it.
+  // Uses matchMemberWriteSink (R13(a)'s el.innerHTML= mechanism) instead —
+  // the assignment itself is the sink, receiver-scoped to variable names
+  // containing "search" (DirectorySearcher's overwhelmingly common naming
+  // convention) since "Filter" alone is too generic a property name.
+  { kind: 'sink', id: 'cs-directorysearcher-filter', language: 'cs', framework: 'stdlib', match: { type: 'member', object: '_any_', prop: 'Filter', receiver: '[Ss]earch' }, argIndex: 'rhs',
+    vuln: { name: 'LDAP Injection (DirectorySearcher.Filter assigned a concatenated value)', severity: 'high', cwe: 'CWE-90',
+            remediation: 'Escape LDAP special characters in filter components, or build the filter with a parameterized helper.' } },
 
   // ─── SANITIZERS (C#) ─────────────────────────────────────────────────────
   { kind: 'sanitizer', id: 'cs-html-encode',    language: 'cs', match: { type: 'call', callee: 'HtmlEncode' },     effect: 'strip', appliesTo: ['xss'] },
@@ -729,10 +1179,19 @@ export const CATALOG = [
   { kind: 'sink', id: 'kt-runtime-exec',       language: 'kt', framework: 'stdlib', match: { type: 'call', callee: 'exec' },         argIndex: 0,
     vuln: { name: 'Command Injection (Runtime.exec / ProcessBuilder string-form, Kotlin)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Use ProcessBuilder(listOf("cmd", "arg")) — never pass a single string to exec.' } },
-  { kind: 'sink', id: 'kt-file-readtext',      language: 'kt', framework: 'stdlib', match: { type: 'call', callee: 'readText' },     argIndex: 0,
+  // Taint-recall PRD (80%): `readText()` is Kotlin's generic
+  // "read-everything" extension function — available on File, URL, and
+  // several other receiver types — so these two entries collided on every
+  // call regardless of which type actually received it: a File(...)
+  // .readText() spuriously ALSO fired the SSRF entry and vice versa
+  // (confirmed via CVE-2022-22965-kt-ssrf, which produced both a correct
+  // SSRF finding and a spurious Path Traversal one). Receiver-scoped to
+  // the actual chain prefix, same as every other terminal-segment-shift
+  // fix in this PRD.
+  { kind: 'sink', id: 'kt-file-readtext',      language: 'kt', framework: 'stdlib', match: { type: 'call', callee: 'readText', receiver: '^File$' }, argIndex: 0,
     vuln: { name: 'Path Traversal (File(name).readText)', severity: 'high', cwe: 'CWE-22',
             remediation: 'Canonicalize: `File(name).canonicalFile` and verify path stays inside an allow-listed base.' } },
-  { kind: 'sink', id: 'kt-url-readtext',       language: 'kt', framework: 'stdlib', match: { type: 'call', callee: 'readText' },     argIndex: 'all',
+  { kind: 'sink', id: 'kt-url-readtext',       language: 'kt', framework: 'stdlib', match: { type: 'call', callee: 'readText', receiver: '^URL$' }, argIndex: 'all',
     vuln: { name: 'SSRF (URL(...).readText with user URL)', severity: 'high', cwe: 'CWE-918',
             remediation: 'Validate the URL host against an allow-list before reading.' } },
   { kind: 'sink', id: 'kt-objectinputstream', language: 'kt', framework: 'stdlib', match: { type: 'call', callee: 'readObject' },    argIndex: 'all',
@@ -913,8 +1372,31 @@ function _receiverAllowed(entry, calleeExpr) {
   // even though it still matches `receiver` on its own. Existing entries
   // that only set `receiver` are unaffected.
   const basePat = entry.match && entry.match.receiverBase;
-  if (!pat && !basePat) return true;
+  // `receiverExclude` (Taint-recall PRD 80%, cross-cutting engine fix
+  // follow-up): the ONLY negative form — `receiver`/`receiverBase` can only
+  // ever REQUIRE a match (see the R6 comment block below), which cannot
+  // express "fire on a bare call, but not on THIS specific receiver."
+  // `py-compile` needs exactly that: Python's dangerous `compile()` builtin
+  // (`compile(source, filename, mode)`, equivalent to eval when followed by
+  // exec) is called BARE, with no receiver — but the catalog's bare-name
+  // matching (`_calleeIndexHits`, last-segment fallback) makes the SAME
+  // catalog key also match `re.compile(pattern)`, an ordinary regex
+  // compilation with no code-execution capability whatsoever. Confirmed via
+  // this project's own self-scan (`scripts/_compliance_lib.py`) once the
+  // receiver-taint engine fix (`_calleeReceiverTainted`) started correctly
+  // propagating taint through `.get()`-style no-arg-adjacent calls on a
+  // tainted dict/file-read chain — the sink itself was always mismatched,
+  // the engine fix just gave taint a path to reach it. Unlike `receiver`/
+  // `receiverBase`, which reject a BARE call outright (`segs.length === 0`
+  // -> false) once either is set, `receiverExclude` is checked FIRST and
+  // independently — a bare call (no segments) can never match an exclude
+  // pattern, so `receiverExclude` alone never blocks the no-receiver case
+  // it exists to preserve.
+  const excludePat = entry.match && entry.match.receiverExclude;
+  if (!pat && !basePat && !excludePat) return true;
   const segs = _receiverSegments(calleeExpr);
+  if (excludePat && segs.some((s) => new RegExp(excludePat).test(String(s)))) return false;
+  if (!pat && !basePat) return true;
   if (!segs.length) return false;      // bare `write(x)` — not a DOM call
   if (pat && !segs.some((s) => new RegExp(pat).test(String(s)))) return false;
   if (basePat && !segs.some((s) => new RegExp(basePat).test(String(s)))) return false;
@@ -1177,7 +1659,23 @@ export function matchMemberWriteSink(targetPath, file) {
   if (!raw) return null;
   const hits = filterByProvenance(raw)
     .filter(h => _languageAllowed(h, file))
-    .filter(h => h.kind === 'sink');
+    .filter(h => h.kind === 'sink')
+    // Taint-recall PRD (80%): optional `match.receiver`, same purpose as
+    // `_receiverAllowed` for calls. innerHTML/outerHTML never needed this
+    // (unambiguous DOM-only names); a property name like C#'s `Filter`
+    // (DirectorySearcher.Filter — LDAP injection when set from a tainted
+    // value) is common enough elsewhere (UI filters, LINQ, image
+    // processing) that an unscoped match would be a real precision risk.
+    // Segments are the dotted prefix before the final prop — same
+    // "any segment matches" semantics as _receiverAllowed's string-callee
+    // branch, just computed directly from targetPath since there's no
+    // expression object here to walk.
+    .filter(h => {
+      const pat = h.match && h.match.receiver;
+      if (!pat) return true;
+      const segs = targetPath.slice(0, targetPath.length - prop.length - 1).split('.');
+      return segs.some(s => new RegExp(pat).test(s));
+    });
   return hits.length ? hits : null;
 }