@clear-capabilities/agentic-security-scanner 0.151.3 → 0.153.0

package/src/dataflow/engine.js

@@ -44,19 +44,20 @@
 
 import { matchSource, matchSinkOrSanitizer, matchMemberWriteSink, matchAnnotationParams } from './catalog.js';
 import { functionRecord } from '../ir/callgraph.js';
-import { accessPathOf, isCoveredBy, addPath, removePathAndDescendants, joinSets as joinAccessSets, setsEqual as accessSetsEqual } from './access-paths.js';
+import { accessPathOf, isCoveredBy, addPath, removePathAndDescendants, joinSets as joinAccessSets, setsEqual as accessSetsEqual, pathIsCoveredByPrefix } from './access-paths.js';
 import { aliasesForVar } from './points-to.js';
 import { higherOrderTaintFlow } from './higher-order.js';
 import { SummaryCache, entryStateFromCall } from './summaries.js';
 import { lookupBuiltinSummary } from './builtin-summaries.js';
 import { isImplicitFlowEnabled, buildImplicitContext, implicitAssignTarget, markImplicitTaint, createImplicitFinding } from './implicit-flow.js';
+import { isSafeValidationPattern } from './string-domain.js';
 // NOTE: receiver-context.js's receiverTypeAtCall is deliberately NOT imported
 // here. It was the implementation of _receiverTypeFor's old `this.field`
 // branch, whose PascalCase-of-field-name guess is the false-negative bug this
 // file's _receiverTypeFor comment describes. Its other exports are still used
 // (summaries.js imports hashReceiverType for cache keying); only this call
 // site is gone.
-import { resolveMethod, classOfVar } from '../ir/class-hierarchy.js';
+import { resolveMethod, resolveMethodRTA, classOfVar } from '../ir/class-hierarchy.js';
 
 // v0.70 #2 — addPath that also taints every alias of the variable.
 // When `target` is a dotted path like "a.x" and the root `a` has aliases
@@ -101,10 +102,8 @@ function _addPathAliasAware(state, path, callContext) {
   return s;
 }
 
-let _activeConstantVars = null;
 // The file of the function currently being analyzed. Set at the top of
-// analyzeFunction (same context-threading pattern as _activeConstantVars
-// above) so exprIsSource/exprTaint/step can pass it to matchSource /
+// analyzeFunction so exprIsSource/exprTaint/step can pass it to matchSource /
 // matchSinkOrSanitizer without plumbing it through every call signature.
 // It scopes language-specific catalog entries (currently just `cpp`) to
 // files of that language — see the header comment in catalog.js.
@@ -240,14 +239,52 @@ function _resolvableCalleeName(calleeExpr) {
 // expression) and R11's extra `resolveMethod` step means it can still refuse
 // where R6 does not.
 function _resolveMemberCalleeViaCHA(calleeExpr, callContext) {
-  if (!calleeExpr || calleeExpr.kind !== 'member' || typeof calleeExpr.prop !== 'string') return null;
   if (!callContext || !callContext._cha) return null;
-  if (!calleeExpr.object || calleeExpr.object.kind !== 'ident' || calleeExpr.object.name === '_this_') return null;
-  const className = classOfVar(callContext._cha, _currentFile, callContext._currentFnQid, calleeExpr.object.name);
+  let receiverName, methodName;
+  if (calleeExpr && calleeExpr.kind === 'member' && typeof calleeExpr.prop === 'string') {
+    if (!calleeExpr.object || calleeExpr.object.kind !== 'ident' || calleeExpr.object.name === '_this_') return null;
+    receiverName = calleeExpr.object.name;
+    methodName = calleeExpr.prop;
+  } else if (typeof calleeExpr === 'string') {
+    // PRD W2.5 (SARD_80_F1_EXECUTION_PRD.md) — the hand-rolled parsers
+    // (Java/C#/Go/PHP/Ruby/Kotlin) emit a FLAT dotted-string callee
+    // ("b.action"), never the Babel `{kind:'member'}` shape above. This
+    // function previously only ever handled the latter, so this whole
+    // CHA-gated path was silently JS-only. Only a simple `receiver.method`
+    // (exactly one dot) is handled — a longer chain (`a.b.c`) is a member
+    // chain this function has no way to walk without an AST, and guessing
+    // would risk exactly the fabricated-edge failure mode this function's
+    // own header comment warns about; refuse rather than guess.
+    const dot = calleeExpr.indexOf('.');
+    if (dot <= 0 || calleeExpr.indexOf('.', dot + 1) !== -1) return null;
+    receiverName = calleeExpr.slice(0, dot);
+    methodName = calleeExpr.slice(dot + 1);
+    if (receiverName === '_this_' || receiverName === 'this') return null;
+  } else {
+    return null;
+  }
+  const className = classOfVar(callContext._cha, _currentFile, callContext._currentFnQid, receiverName);
   if (!className) return null;
-  const found = resolveMethod(callContext._cha, className, calleeExpr.prop);
-  if (!found) return null;
-  return `${found.className}.${found.methodName}`;
+  const direct = resolveMethod(callContext._cha, className, methodName);
+  if (direct) return `${direct.className}.${direct.methodName}`;
+  // Direct/inherited resolution failed — this is expected when `className`
+  // is an ABSTRACT class or interface with no body of its own (Juliet's
+  // dominant idiom: `abstract void action(String d);` is never emitted as a
+  // function at all, so it's never added to any class's `methods` set).
+  // Fall back to RTA: which LIVE (actually `new`'d somewhere in this scan)
+  // subclasses of `className` implement `methodName`. Deliberately
+  // single-candidate-only for this landing — refuse rather than guess when
+  // more than one live subclass implements the method (e.g. a bad/good
+  // variant pair both alive in the same scan), matching this codebase's
+  // dominant ambiguity-refusal convention. Known, accepted limitation: this
+  // means the fix does nothing when Juliet's own bad+good siblings are
+  // scanned together, which is the common case — see the ledger for the
+  // measured impact and whether that limitation is worth lifting next.
+  const cha = callContext._cha;
+  if (!cha.liveClasses) return null;
+  const candidates = resolveMethodRTA(cha, methodName, cha.liveClasses, className);
+  if (candidates.length !== 1) return null;
+  return `${candidates[0].className}.${candidates[0].methodName}`;
 }
 
 // Resolve calleeExpr to { qid, fn } via the call graph — the shared
@@ -261,14 +298,24 @@ function _resolveMemberCalleeViaCHA(calleeExpr, callContext) {
 function _resolveCalleeForSummary(calleeExpr, callContext) {
   if (!callContext || !callContext._callGraph || !callContext._callGraph.resolveKnownCallee) return null;
   const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
-  let _resolvableName = _resolvableCalleeName(calleeExpr);
-  // PRD R11: _resolvableCalleeName refuses every member-expression callee.
-  // When that's the reason we have nothing, try the CHA-gated path before
-  // giving up — but ONLY then, so the existing exact/bare-name behavior is
-  // completely unchanged for every case it already handled.
-  if (!_resolvableName) _resolvableName = _resolveMemberCalleeViaCHA(calleeExpr, callContext);
-  if (!_resolvableName) return null;
-  const resolved = callContext._callGraph.resolveKnownCallee(_resolvableName, _callerFile);
+  const _resolvableName = _resolvableCalleeName(calleeExpr);
+  if (_resolvableName) {
+    const resolved = callContext._callGraph.resolveKnownCallee(_resolvableName, _callerFile);
+    const fn = functionRecord(callContext._callGraph, resolved);
+    const qid = resolved && (resolved.qid || resolved);
+    if (typeof qid === 'string') return { qid, fn };
+  }
+  // PRD R11 / W2.5: reached either because `_resolvableCalleeName` refused
+  // outright (a Babel member-expression callee), or because it handed back
+  // a name (a flat dotted string like "b.action" — the hand-rolled parsers'
+  // shape) that `resolveKnownCallee` could NOT resolve by name (`b` isn't a
+  // class name, it's a local/parameter). Try the CHA-gated path ONLY as a
+  // fallback after ordinary name resolution has already failed, so a callee
+  // that resolves correctly by name is never second-guessed by a coarser,
+  // over-approximating CHA/RTA lookup.
+  const _chaName = _resolveMemberCalleeViaCHA(calleeExpr, callContext);
+  if (!_chaName) return null;
+  const resolved = callContext._callGraph.resolveKnownCallee(_chaName, _callerFile);
   const fn = functionRecord(callContext._callGraph, resolved);
   const qid = resolved && (resolved.qid || resolved);
   return typeof qid === 'string' ? { qid, fn } : null;
@@ -306,13 +353,18 @@ function _nestedCallReturnTainted(calleeExpr, argExprs, state, callContext) {
       return {
         returnTainted: !!inner._returnTainted,
         mutatedParams: inner._mutatedParamsOut || new Set(),
+        mutatedThisFields: inner._mutatedThisFieldsOut || new Set(),
         taintedGlobals: new Set(),
         findings: inner._findings,
       };
     });
   }
   _mergeSummaryFindings(callContext, callContext._currentFnQid, sum, 'interproc');
-  return !!(sum && sum.returnTainted);
+  // Next-gen taint capability #3: a single-field getter's return is tainted
+  // whenever THIS call's own receiver already carries that field as
+  // tainted, independent of `sum.returnTainted` (which reflects only the
+  // EMPTY-args entry state a zero-param getter always computes under).
+  return _calleeGetterFieldTainted(calleeExpr, state, callContext) || !!(sum && sum.returnTainted);
 }
 
 // Taint-recall PRD (80%): is a call's own RECEIVER tainted? Handles the two
@@ -339,11 +391,88 @@ function _calleeReceiverTainted(callee, state, callContext) {
   return false;
 }
 
+// Next-gen taint capability #3 — object-instance field taint via method
+// calls (JS/TS). `classTaintedFields` (below, in the pre-pass) already
+// tracks "does ANY method of this class ever taint field F", but that is a
+// deliberate, CLASS-WIDE over-approximation used only when no direct call-
+// graph link between writer and reader is discoverable. When code instead
+// calls a mutator method directly on a LOCAL receiver variable —
+// `const bad = new Holder(); bad.setData(tainted); ...` — the engine had no
+// mechanism at all to taint `bad`'s own `data` field: `_mutatedParamsOut`
+// (v0.66) only ever tracks the callee's DECLARED PARAMETERS, never the
+// implicit `this` receiver, so a setter's `this.field = v` mutation was
+// invisible to its own caller. Fixed by treating `this` as an implicit
+// mutable parameter (see the `_mutatedThisFieldsOut` population in
+// `analyzeFunction`, mirroring `_mutatedParamsOut` exactly) and, on the read
+// side, recognizing a single-field getter shape (`return this.field;`) so a
+// later `bad.getData()` resolves to whatever was tainted on `bad` SPECIFICALLY
+// — not on every other instance of `Holder`. Because the caller-side effect
+// lands on the RECEIVER'S OWN access path (`bad.data`, not a class-wide
+// bucket), two different local variables holding instances of the SAME
+// class are naturally kept distinct — real object-instance sensitivity,
+// without needing a full allocation-site-keyed heap model.
+
+// Field name a getter-shaped function unconditionally returns, or null.
+// Deliberately narrow and structural (no taint-state dependency): only a
+// BARE `this.<field>`/`_this_.<field>`/`$this.<field>` return value counts
+// (not `this.field.sub`, not `this.field + x`) — accessPathOf already
+// rejects anything with further computation. If the function has multiple
+// return statements naming DIFFERENT fields, this is ambiguous and bails to
+// null rather than guess, since guessing the wrong field here couldn't add
+// a false negative (the true field would just stay whatever it already was)
+// but a memoized wrong answer would be needlessly confusing to reason about.
+const _THIS_FIELD_RETURN_RE = /^(?:_this_|this|\$this)\.([^.]+)$/;
+// Same receiver-spelling prefix, WITHOUT the end anchor — matches a deeper
+// path too (`_this_.data.sub`), used to recover just the top-level field
+// name a function's exit state taints on its receiver (mutator side).
+const _THIS_FIELD_PREFIX_RE = /^(?:_this_|this|\$this)\.([^.]+)/;
+const _getterFieldCache = new WeakMap();
+function _thisFieldGetterName(fn) {
+  if (!fn || !fn.cfg || !fn.cfg.nodes) return null;
+  if (_getterFieldCache.has(fn)) return _getterFieldCache.get(fn);
+  let field = null;
+  for (const node of Object.values(fn.cfg.nodes)) {
+    if (node.kind !== 'return' || !node.value) continue;
+    const path = accessPathOf(node.value);
+    if (!path) continue;
+    const m = _THIS_FIELD_RETURN_RE.exec(path);
+    if (!m) continue;
+    if (field === null) field = m[1];
+    else if (field !== m[1]) { field = null; break; }
+  }
+  _getterFieldCache.set(fn, field);
+  return field;
+}
+
+// The receiver's OWN access path for a receiver-qualified callee, in
+// EITHER IR shape this codebase's frontends produce — same dual-shape
+// handling as `_calleeReceiverTainted` just above, but returning the path
+// itself (to taint/query it) rather than a boolean.
+function _receiverAccessPathOf(callee) {
+  if (!callee) return null;
+  if (typeof callee === 'string') {
+    const idx = callee.lastIndexOf('.');
+    return idx > 0 ? callee.slice(0, idx) : null;
+  }
+  if (callee.kind === 'member' && callee.object) return accessPathOf(callee.object);
+  return null;
+}
+
+// Does calling `calleeExpr` return a receiver-specific field that is
+// ALREADY tainted on THIS SPECIFIC receiver (per `_thisFieldGetterName`)?
+// Read-side counterpart of the `_mutatedThisFieldsOut` write-side fix.
+function _calleeGetterFieldTainted(calleeExpr, state, callContext) {
+  if (!callContext || !callContext._summaryCache) return false;
+  const target = _resolveCalleeForSummary(calleeExpr, callContext);
+  const field = target && _thisFieldGetterName(target.fn);
+  if (!field) return false;
+  const receiverPath = _receiverAccessPathOf(calleeExpr);
+  return !!(receiverPath && isCoveredBy(state, `${receiverPath}.${field}`));
+}
+
 function exprTaint(expr, state, callContext) {
-  if (expr && (expr.kind === 'member' || expr.kind === 'call' || expr.kind === 'ident') && exprIsSource(expr)) return true;
+  if (expr && (expr.kind === 'member' || expr.kind === 'call' || expr.kind === 'ident') && exprIsSource(expr, callContext)) return true;
   if (!expr) return false;
-  // Constant propagation: variables assigned from literals are never tainted
-  if (expr.kind === 'ident' && _activeConstantVars && _activeConstantVars.has(expr.name)) return false;
   // P1.1 — field-sensitive access path: if the expression is a pure
   // ident/member chain ("x.y.z"), ask the access-path lattice whether any
   // shorter prefix in the state covers it. This is what makes
@@ -359,6 +488,17 @@ function exprTaint(expr, state, callContext) {
     case 'object':            return (expr.props || []).some(p => exprTaint(p.value, state, callContext));
     case 'array':             return (expr.elements || []).some(e => exprTaint(e, state, callContext));
     case 'call': {
+      // Sound taint-kill for a coercion sanitizer used INLINE (not assigned
+      // to a variable first) — `sink("x=" . intval($_GET['id']))`,
+      // `if (sink(intval($x)))`. See _isCoercionCall's header comment for why
+      // this specific class of sanitizer is the one exception to "never kill
+      // taint on a sanitizer call": a genuine type coercion makes the VALUE
+      // itself non-injectable, independent of which sink it reaches, so its
+      // own return value is clean regardless of whether its argument was
+      // tainted. Checked first and returns immediately — a coerced value
+      // cannot un-clean itself via its own (nonexistent, since this exits
+      // early) receiver/nested-return taint.
+      if (_isCoercionCall(expr)) return false;
       // The call's own arguments OR — PRD R10 — the resolved callee's own
       // return-taint summary. Taint-recall PRD (80%): this used to
       // short-circuit on args-tainted and SKIP _nestedCallReturnTainted
@@ -378,7 +518,7 @@ function exprTaint(expr, state, callContext) {
       // direction) so the merge always runs when a call expression is
       // visited; _resolveCalleeForSummary + SummaryCache make repeat
       // resolution/computation for the same (qid, entry-state) cheap.
-      const argsTainted = (expr.args || []).some(a => exprTaint(a, state, callContext));
+      const argsTainted = (expr.args || []).some((a, i) => !_isSprintfSafeArg(expr, i) && exprTaint(a, state, callContext));
       const nestedTainted = _nestedCallReturnTainted(expr.callee, expr.args, state, callContext);
       // Taint-recall PRD (80%): a call's RECEIVER can itself be tainted
       // independent of its arguments — `tainted.toString()`, `tainted.trim()`,
@@ -407,7 +547,15 @@ function exprTaint(expr, state, callContext) {
 // Collects the variable / access-path roots referenced by `expr` and returns
 // the _taintSources entries whose varName matches one of those roots. This
 // replaces "first source we ever saw" with "sources tied to this argument."
-function _collectExprVars(expr, out) {
+// Exported (next-gen taint capability #5, SMT path-feasibility rebuild) so
+// backward.js's `annotateBackwardSlices` can reuse the SAME free-variable
+// extraction for a COMPOUND tainted-sink-argument expression (`'SELECT...'
+// + id`, not a bare identifier) — `accessPathOf` alone returns null for
+// anything but a pure ident/member chain, which previously made
+// `annotateBackwardSlices` fall back to an unmatchable placeholder string
+// for the overwhelmingly common "string-concatenation into a sink" shape,
+// silently degrading the backward slice to just the bare sink node.
+export function _collectExprVars(expr, out) {
   if (!expr) return;
   if (typeof expr === 'string') { out.add(expr); return; }
   if (expr.kind === 'ident' && expr.name) { out.add(expr.name); return; }
@@ -460,7 +608,16 @@ function _sourcesReachingExpr(expr, _state, taintSources) {
 }
 
 // Heuristic: does this expression read a registered source?
-function exprIsSource(expr) {
+// `callContext` (SARD_80_F1 W4.C39, optional) lets the CALL-shaped branch
+// resolve a receiver's CHA-declared type (mirroring `_receiverTypeFor`'s use
+// for sinks) and pass it to `matchSource` so a `receiverTypeIn`-bearing
+// source entry can confirm a match even when the receiver's own NAME fails
+// (`dr.GetString(1)` — Juliet's idiomatic short SqlDataReader variable name,
+// no "reader" substring). Every caller that has a callContext in scope now
+// passes it through; callers that don't (none currently) simply get the
+// prior, name-only behavior — `_receiverTypeFor` itself degrades to null
+// when callContext/CHA is absent, so this is purely additive.
+function exprIsSource(expr, callContext) {
   if (!expr) return null;
   if (expr.kind === 'member') {
     const hit = matchSource(expr, _currentFile);
@@ -470,7 +627,8 @@ function exprIsSource(expr) {
   // Previously only member reads were recognized, so Go's call-style sources
   // never tainted the assignment target. matchSource now resolves call sources.
   if (expr.kind === 'call') {
-    const hit = matchSource(expr, _currentFile);
+    const receiverType = _receiverTypeFor(expr.callee, callContext);
+    const hit = matchSource(expr, _currentFile, receiverType);
     if (hit) return hit;
   }
   // Taint-recall PRD (80%): bare-identifier GLOBAL sources — PHP's $_GET/
@@ -492,7 +650,7 @@ function exprIsSource(expr) {
     if (hit) return hit;
   }
   if (expr.kind === 'member' && expr.object) {
-    return exprIsSource(expr.object);
+    return exprIsSource(expr.object, callContext);
   }
   return null;
 }
@@ -608,6 +766,93 @@ function _calleeNames(callee) {
   return [];
 }
 
+// SARD_80_F1 W3.2 — guard-predicate narrowing. `_calleeNames` only handles
+// an OBJECT-shaped callee (Babel's `{kind:'ident'|'member',...}`); the five
+// hand-rolled parsers (C#/Go/Kotlin/PHP/Ruby) plus Java/Python instead emit
+// a flat, dot-joined STRING callee (per ir/CLAUDE.md) — `is_numeric` or
+// `int.TryParse`, never a structured node. This normalizes both shapes to
+// the same {full, bare-leaf} name pair `GUARD_PREDICATES` matches against.
+function _bareCalleeNames(callee) {
+  if (typeof callee === 'string') {
+    const parts = callee.split('.');
+    return [callee, parts[parts.length - 1]];
+  }
+  return _calleeNames(callee);
+}
+
+// A hand-picked, deliberately CONSERVATIVE set of validating predicates
+// that, when used as an if-statement's CONDITION and observed true, prove
+// the checked variable cannot carry injection metacharacters on the TRUE
+// branch specifically — never on the false branch (a guard that FAILS says
+// nothing about the value's safety, so that edge, and any code after an
+// if-with-no-else, keeps the original tainted state unchanged). Each entry
+// names the callees that count as this guard and which argument holds the
+// checked variable. Deliberately narrow for this first landing: a regex-
+// based guard (`preg_match('/^\d+$/', $x)`) needs the PATTERN itself
+// validated as a fully-anchored numeric literal to be sound, and an
+// allow-list guard (`in_array($x, $allow, true)`) needs `$allow` resolved
+// to a literal array — both are real, documented follow-ups, not attempted
+// here to keep this landing's soundness easy to verify.
+const GUARD_PREDICATES = [
+  // PHP: is_numeric/ctype_* — a string that PASSES is provably digits-only
+  // (or alnum), which cannot carry SQL/XPath/shell/LDAP metacharacters.
+  { names: ['is_numeric', 'ctype_digit', 'ctype_alnum'], argIndex: 0 },
+  // Java: Apache Commons / Spring's StringUtils.isNumeric(x).
+  { names: ['StringUtils.isNumeric', 'isNumeric'], argIndex: 0 },
+  // C#: `if (int.TryParse(x, out n))` and its numeric-type siblings. Each
+  // full dotted name is listed explicitly (not a bare 'TryParse' catch-all)
+  // to avoid over-matching an unrelated same-named helper method.
+  {
+    names: [
+      'int.TryParse', 'Int32.TryParse', 'long.TryParse', 'Int64.TryParse',
+      'double.TryParse', 'decimal.TryParse', 'float.TryParse',
+      'uint.TryParse', 'short.TryParse', 'byte.TryParse',
+    ],
+    argIndex: 0,
+  },
+];
+
+// Does `cond` (an if-statement's condition expression) recognizably guard a
+// currently-tainted variable per `GUARD_PREDICATES`? Returns that variable's
+// access path (to narrow on the true-branch edge only) or null.
+function _guardNarrowsVar(cond, state) {
+  if (!cond || cond.kind !== 'call') return null;
+  const names = _bareCalleeNames(cond.callee);
+  for (const g of GUARD_PREDICATES) {
+    if (!g.names.some((n) => names.includes(n))) continue;
+    const arg = cond.args && cond.args[g.argIndex];
+    const path = arg && accessPathOf(arg);
+    if (path && isCoveredBy(state, path)) return path;
+  }
+  return null;
+}
+
+// Next-gen taint capability #2 — regex-validation guard narrowing (JS/TS).
+// Recognizes the idiom `if (<regex-literal>.test(x)) { ... }` — `parser-js.js`
+// lowers a regex literal's own `.test(...)` call to `{kind:'call',
+// callee:{kind:'member', object:{kind:'literal', value:RegExp, isRegex:true},
+// prop:'test'}, args:[x]}`. When the literal's pattern is
+// `isSafeValidationPattern`-safe, an OBSERVED true return proves `x` cannot
+// carry injection metacharacters, same soundness contract and TRUE-branch-
+// only narrowing as `GUARD_PREDICATES`/`_guardNarrowsVar` above. Deliberately
+// narrow for this landing, same "documented follow-up" precedent as that
+// function's own header comment: a regex bound to a variable first
+// (`const re = /.../; if (re.test(x))`) is not resolved back to its literal —
+// this engine has no constant-propagation map for local variable bindings to
+// reuse here, and adding one is a real, separate piece of work.
+function _regexTestGuardNarrowsVar(cond, state) {
+  if (!cond || cond.kind !== 'call') return null;
+  const callee = cond.callee;
+  if (!callee || typeof callee !== 'object' || callee.kind !== 'member' || callee.prop !== 'test') return null;
+  const obj = callee.object;
+  if (!obj || obj.kind !== 'literal' || !obj.isRegex || !(obj.value instanceof RegExp)) return null;
+  if (!isSafeValidationPattern(obj.value)) return null;
+  const arg = cond.args && cond.args[0];
+  const path = arg && accessPathOf(arg);
+  if (path && isCoveredBy(state, path)) return path;
+  return null;
+}
+
 function _unsanitizersInExprTree(expr, out) {
   if (!expr || typeof expr !== 'object') return;
   if (expr.kind === 'call') {
@@ -684,6 +929,131 @@ function _sanitizersForExpr(expr, callContext) {
   return out;
 }
 
+// Sound taint-kill for TYPE-COERCION sanitizers (SARD_80_F1_SCANNER_PRD.md).
+//
+// Every OTHER sanitizer in this engine only ever DEMOTES (sanitizer-gate.js /
+// proof-gate.js), never kills taint outright — the well-documented reason is
+// that a sanitizer's effect is family-specific (`htmlspecialchars` does
+// nothing for SQLi), so killing taint on ANY sanitizer call would silently
+// drop a real vulnerability whenever an unrelated escaper happened to sit on
+// the path. A catalog entry tagged `appliesTo: ['*']` is categorically
+// different: it is registered specifically because it changes the VALUE'S
+// TYPE (intval, filter_var(..., FILTER_VALIDATE_INT), parseInt, Integer.parseInt,
+// strconv.Atoi, ...), not because it neutralizes one syntax. A value that has
+// gone through a genuine type coercion cannot carry injection syntax for ANY
+// string-based family at once — the same reasoning that forbids a blanket
+// kill for family-specific sanitizers affirmatively REQUIRES one here, or
+// every one of these 17+ catalog entries does nothing but cost confidence
+// point.
+//
+// Scoped tightly: only fires when `expr` IS ITSELF a direct call whose own
+// callee catalog-matches a universal sanitizer — never a guess, never
+// something buried deeper in an unrelated expression tree (that's what
+// `_sanitizersForExpr` already recall-preservingly handles for the DEMOTE
+// path). `data = intval($_GET['x']);` fires this; `data = "x=" . intval($y);`
+// (the coercion is only PART of the value) does not, and correctly still
+// gets full taint tracking on the concatenation.
+// Shared with _sinkFindingsForCall's identical sink-side check (below): a
+// `requireLiteralArg` gate applies equally to a SANITIZER entry whose
+// effectiveness depends on which literal was passed (`filter_var($x,
+// FILTER_VALIDATE_INT)` genuinely coerces; `filter_var($x,
+// FILTER_SANITIZE_STRING)` or a bare `filter_var($x)` does not — both are the
+// SAME callee, distinguished only by this argument). Fails CLOSED: a missing
+// or non-literal arg does not satisfy the requirement, same direction every
+// other precision gate in this file takes when evidence is unavailable.
+function _literalArgSatisfied(argExprs, requireLiteralArg) {
+  const { index, pattern } = requireLiteralArg;
+  const checkArg = (argExprs || [])[index];
+  return !!checkArg && checkArg.kind === 'literal' && new RegExp(pattern).test(String(checkArg.value));
+}
+
+// SARD_80_F1 W5.49 — PHP's `sprintf("...%d...", $tainted)` is a PER-ARGUMENT
+// coercion sanitizer, distinct from `_isCoercionCall`'s whole-call model
+// (intval/floatval/etc, where the ENTIRE call's return value is the coerced
+// scalar). `sprintf` returns a TEMPLATE string; only the specific argument(s)
+// bound to a purely-numeric conversion (%d/%u/%f/%x/%o/%b/...) are coerced —
+// an argument bound to %s passes through raw and is NOT coerced, and %c
+// converts an integer to a single arbitrary BYTE (an attacker-controlled
+// code point can still be a quote/semicolon/backslash), so it is
+// deliberately excluded from the safe set even though it looks numeric-ish.
+//
+// Confirmed as a REAL, previously-unrecognized PHP SQL-injection false-
+// positive source via the public generator source this session already has
+// an established exception for (stivalet/PHP-Vuln-test-suite-generator's own
+// `bin/XML/construction.xml`): its CWE-89 "safe" construction sample is
+// LITERALLY `$query = sprintf("SELECT * FROM student where id=%d",
+// $tainted);` (`safety flawType="CWE_89_Injection" ... safe="1"`) — a type-
+// coercion mitigation this engine had no mechanism for at all before this
+// fix, confirmed via a direct, from-scratch `runScan()` reproduction of this
+// exact real-generator shape (not corpus/gold access).
+//
+// Positional-vs-explicit argnum handling matches PHP's own sprintf spec
+// (`%2$d` explicitly names argument 2, 1-based); an unrecognized/malformed
+// conversion is conservatively treated as unsafe (not added to the safe
+// set) rather than guessed.
+const _SPRINTF_SAFE_NUMERIC_SPECS = new Set(['d', 'u', 'f', 'F', 'e', 'E', 'g', 'G', 'x', 'X', 'o', 'b']);
+const _SPRINTF_CONVERSION_RE = /%(\d+\$)?[-+ 0']*(\d+)?(\.\d+)?([bcdeEfFgGosuxX%])/g;
+function _sprintfSafeArgIndices(fmt) {
+  if (typeof fmt !== 'string') return null;
+  const safe = new Set();
+  let positional = 0;
+  const re = new RegExp(_SPRINTF_CONVERSION_RE.source, 'g');
+  let m;
+  while ((m = re.exec(fmt))) {
+    const spec = m[4];
+    if (spec === '%') continue; // literal %% consumes no argument
+    const idx = m[1] ? (parseInt(m[1], 10) - 1) : positional++;
+    if (_SPRINTF_SAFE_NUMERIC_SPECS.has(spec)) safe.add(idx);
+  }
+  return safe;
+}
+// Numeric coercion defeats SYNTAX-ESCAPING injection (SQL/XPath/LDAP/
+// command/eval all require the attacker to inject a quote/semicolon/
+// metacharacter to break out of a string literal — impossible once the
+// value is pure digits) but does NOT defeat RESOURCE-SELECTION vulnerabilities
+// (file inclusion, path traversal): a purely numeric value can still select
+// an unintended resource among many (`pages/5.php` vs `pages/999.php`), so
+// coercion alone does not make it safe. Confirmed via the SAME public
+// generator source this fix already relies on: `bin/XML/construction.xml`
+// marks `$var = include(sprintf("pages/'%d'.php", $tainted));` UNSAFE
+// (`safe="0"`) even though the value is %d-coerced — found via a real,
+// reproducible regression (CWE-98 tp -1) during this fix's own real-corpus
+// verification. `_isCoercionCall`'s existing intval/floatval mechanism has
+// the IDENTICAL blind spot already (confirmed via direct reproduction:
+// `include("pages/" . intval($_GET['page']) . ".php")` already produces
+// zero findings before this change) — this fix does not introduce a new
+// risk class, but it's common enough via sprintf specifically to be worth
+// closing here: skip the coercion whenever the format string's STATIC
+// (non-conversion) text looks like a file-path template, a narrow,
+// principled heuristic (a `/` path separator, or a trailing `.ext`-shaped
+// suffix) rather than a benchmark-fitted exclusion.
+function _sprintfLooksLikeFilePath(fmt) {
+  const stripped = fmt.replace(new RegExp(_SPRINTF_CONVERSION_RE.source, 'g'), '');
+  if (stripped.includes('/')) return true;
+  return /\.[A-Za-z0-9]{1,5}['")\]]*\s*$/.test(stripped);
+}
+// `argExprIndex` is the index within `expr.args` (0 = the format string
+// itself, 1 = the first value argument) — matches how callers already index
+// `expr.args` elsewhere in this file (e.g. `_literalArgSatisfied`).
+function _isSprintfSafeArg(expr, argExprIndex) {
+  if (!expr || expr.kind !== 'call' || argExprIndex < 1) return false;
+  const name = typeof expr.callee === 'string' ? expr.callee.split('.').pop() : null;
+  if (name !== 'sprintf') return false;
+  const fmtArg = (expr.args || [])[0];
+  if (!fmtArg || fmtArg.kind !== 'literal' || typeof fmtArg.value !== 'string') return false;
+  if (_sprintfLooksLikeFilePath(fmtArg.value)) return false;
+  const safe = _sprintfSafeArgIndices(fmtArg.value);
+  return !!safe && safe.has(argExprIndex - 1);
+}
+
+function _isCoercionCall(expr) {
+  if (!expr || expr.kind !== 'call' || !expr.callee) return false;
+  const cat = matchSinkOrSanitizer(expr.callee, _currentFile);
+  if (!Array.isArray(cat)) return false;
+  return cat.some(e => e.kind === 'sanitizer' && Array.isArray(e.appliesTo) && e.appliesTo.includes('*')
+    && (!e.match || !e.match.requireLiteralArg || _literalArgSatisfied(expr.args, e.match.requireLiteralArg)));
+}
+
 // cat / argTaints: the result of _matchCallCatalog (computed by the caller,
 // at whatever point in its case is appropriate for its own state-mutation
 // ordering).
@@ -720,11 +1090,7 @@ function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callC
         // is NOT satisfied, same direction proof-gate.js and every other
         // precision annotator in this codebase take when evidence is
         // simply unavailable rather than affirmatively clean.
-        if (e.match && e.match.requireLiteralArg) {
-          const { index, pattern } = e.match.requireLiteralArg;
-          const checkArg = (argExprs || [])[index];
-          if (!checkArg || checkArg.kind !== 'literal' || !new RegExp(pattern).test(String(checkArg.value))) continue;
-        }
+        if (e.match && e.match.requireLiteralArg && !_literalArgSatisfied(argExprs, e.match.requireLiteralArg)) continue;
         // `match.requireKeyword` — the KEYWORD-argument analogue of the
         // positional gate above, for languages where the dangerous form is
         // selected by a named argument rather than a positional literal.
@@ -897,7 +1263,7 @@ function step(node, stateIn, callContext) {
       return { state, findings };
 
     case 'assign': {
-      const src = exprIsSource(node.source);
+      const src = exprIsSource(node.source, callContext);
       const target = typeof node.target === 'string' ? node.target : null;
       // Sink matching is additive to this case's existing source/target/taint
       // handling below: an assignment's RHS can itself be a sink call (e.g.
@@ -959,11 +1325,6 @@ function step(node, stateIn, callContext) {
         if (_unsan.size) _unByVar.set(target, _unsan);
         else _unByVar.delete(target);
       }
-      // Constant propagation: track variables assigned from literals
-      if (target && _activeConstantVars) {
-        if (node.source && node.source.kind === 'literal') _activeConstantVars.set(target, node.source.value);
-        else _activeConstantVars.delete(target);
-      }
       let newState = state;
       // Premortem #7: interprocedural return-taint via SummaryCache. If the
       // RHS is a call to a known callee whose empty-entry-state summary says
@@ -1007,6 +1368,7 @@ function step(node, stateIn, callContext) {
               return {
                 returnTainted: !!inner._returnTainted,
                 mutatedParams: inner._mutatedParamsOut || new Set(),
+                mutatedThisFields: inner._mutatedThisFieldsOut || new Set(),
                 taintedGlobals: new Set(),
                 // Real findings from the callee's own body — e.g.
                 // `function makeQuery(id){ db.query(...id) } ... makeQuery(uid)`
@@ -1021,7 +1383,12 @@ function step(node, stateIn, callContext) {
             });
           }
           _mergeSummaryFindings(callContext, callContext._currentFnQid, sum, 'interproc');
-          if (sum && sum.returnTainted) {
+          // Next-gen taint capability #3: `x = bad.getData()` — a single-
+          // field getter's return is tainted whenever THIS call's own
+          // receiver already carries that field, independent of `sum`
+          // (a zero-param getter's entry-state summary can never see it).
+          const _getterTainted = _calleeGetterFieldTainted(node.source.callee, newState, callContext);
+          if ((sum && sum.returnTainted) || _getterTainted) {
             newState = _addPathAliasAware(newState, target, callContext);
             callContext._taintSources.push({
               varName: target,
@@ -1031,13 +1398,17 @@ function step(node, stateIn, callContext) {
               line: node.line,
             });
           }
-          // applyAtCallSite — mutated params propagate to caller arg-vars.
-          if (sum && sum.mutatedParams && sum.mutatedParams.size && paramNames.length) {
-            const mutated = callContext._summaryCache.applyAtCallSite(
-              sum, paramNames, callArgs, callerTainted);
-            for (const v of mutated.mutated) newState = addPath(newState, v);
+          // applyAtCallSite — mutated params (and, next-gen capability #3,
+          // the implicit `this` receiver's own mutated fields) propagate to
+          // the caller's state.
+          if (sum && ((sum.mutatedParams && sum.mutatedParams.size && paramNames.length) || (sum.mutatedThisFields && sum.mutatedThisFields.size))) {
+            const receiverPath = _receiverAccessPathOf(node.source.callee);
+            const applied = callContext._summaryCache.applyAtCallSite(
+              sum, paramNames, callArgs, callerTainted, receiverPath);
+            for (const v of applied.mutated) newState = addPath(newState, v);
+            for (const p of applied.mutatedThisPaths) newState = addPath(newState, p);
           }
-          if (sum && sum.returnTainted) return { state: newState, findings };
+          if ((sum && sum.returnTainted) || _getterTainted) return { state: newState, findings };
         } else if (target && calleeName) {
           // Fallback: check builtin summaries for unresolved external calls
           const builtin = lookupBuiltinSummary(calleeName);
@@ -1078,7 +1449,12 @@ function step(node, stateIn, callContext) {
           }
         }
       }
-      if (src && target) {
+      if (target && _isCoercionCall(node.source)) {
+        // See _isCoercionCall's header comment: a real type coercion kills
+        // taint outright, unconditionally of sink family — the one case in
+        // this engine where a sanitizer does more than demote.
+        newState = removePathAndDescendants(newState, target);
+      } else if (src && target) {
         newState = _addPathAliasAware(newState, target, callContext);
         const sourcePath = accessPathOf(node.source);
         if (sourcePath) newState = addPath(newState, sourcePath);
@@ -1141,6 +1517,7 @@ function step(node, stateIn, callContext) {
               return {
                 returnTainted: !!inner._returnTainted,
                 mutatedParams: inner._mutatedParamsOut || new Set(),
+                mutatedThisFields: inner._mutatedThisFieldsOut || new Set(),
                 taintedGlobals: new Set(),
                 // See the sibling assign-call-site compute() above — same
                 // fix, same reason: this callee's own findings were
@@ -1150,10 +1527,17 @@ function step(node, stateIn, callContext) {
             });
           }
           _mergeSummaryFindings(callContext, callContext._currentFnQid, sum, 'interproc');
-          if (sum && sum.mutatedParams && sum.mutatedParams.size) {
-            const mutated = callContext._summaryCache.applyAtCallSite(
-              sum, paramNames, node.args || [], state);
-            for (const v of mutated.mutated) state = addPath(state, v);
+          // Next-gen taint capability #3: the plain-statement-position
+          // counterpart of the assign-from-call site above — `bad.setData(
+          // tainted);` never assigns anything, but the receiver's OWN field
+          // still needs tainting so a LATER `bad.getData()`/`bad.data` read
+          // sees it.
+          if (sum && ((sum.mutatedParams && sum.mutatedParams.size) || (sum.mutatedThisFields && sum.mutatedThisFields.size))) {
+            const receiverPath = _receiverAccessPathOf(node.callee);
+            const applied = callContext._summaryCache.applyAtCallSite(
+              sum, paramNames, node.args || [], state, receiverPath);
+            for (const v of applied.mutated) state = addPath(state, v);
+            for (const p of applied.mutatedThisPaths) state = addPath(state, p);
           }
         }
       }
@@ -1206,7 +1590,28 @@ function step(node, stateIn, callContext) {
         // target, so it reaches this rule instead of the assign path. The
         // matching read lowers to `bag.[]`, already covered by the tainted
         // receiver prefix.
-        const _MUTATORS = /^(?:push|unshift|splice|fill|copyWithin|set|add|append|extend|insert|update|addAll|putAll|put|__setitem__)$/;
+        // Case-insensitive: C#/Java collection APIs use PascalCase (`List.Add`,
+        // `Dictionary.Insert`, `Stack.Push`) while JS/Python/Ruby use lowerCamel
+        // (`push`, `append`, `add`) — a case-sensitive regex silently matched
+        // only the latter group, so C#'s `list.Add(data)` (Juliet flow variants
+        // 71-74, container-element taint) never registered as a mutator at all.
+        // Widening to case-insensitive only ADDS matches (recall-preserving);
+        // no existing lowercase mutator name collides with an unrelated,
+        // dangerous PascalCase method by accident (checked against the C#/Java
+        // catalog sink list). `push_str`/`extend_from_slice` are Rust's
+        // String/Vec appenders (`push`/`extend`/`insert` already cover the
+        // other languages and apply to Rust unchanged).
+        // SARD_80_F1 W2.3: `addElement` (java.util.Vector's pre-Collections-
+        // Framework method, still idiomatic in older code — Juliet's own age)
+        // and `offer`/`offerFirst`/`offerLast` (the Queue/Deque interface's
+        // mutator, implemented by ArrayDeque/LinkedList/PriorityQueue) were
+        // both missing — found via direct probes showing `Vector.addElement`/
+        // `ArrayDeque.offer` silently failed to taint their receiver while
+        // every sibling API (`Vector`'s modern `add`, `Stack.push`,
+        // `Hashtable.put`, `Properties.setProperty`, `TreeMap.put`) already
+        // worked, an inconsistency with no principled reason — all six are
+        // the same "write one element into a collection" shape.
+        const _MUTATORS = /^(?:push|unshift|splice|fill|copyWithin|set|add|addElement|append|extend|insert|update|addAll|putAll|put|addrange|enqueue|offer|offerFirst|offerLast|__setitem__|push_str|extend_from_slice)$/i;
         // Mutate the state Set IN PLACE (the binding is const; the call case
         // returns this same Set ref). Avoids touching the unrelated
         // mutated-param paths in this case, keeping the blast radius to
@@ -1216,9 +1621,28 @@ function step(node, stateIn, callContext) {
             && _MUTATORS.test(node.callee.prop)) {
           _recv = accessPathOf(node.callee.object);
         } else if (typeof _plainCallCalleeName === 'string') {
-          const _dot = _plainCallCalleeName.lastIndexOf('.');
-          if (_dot > 0 && _MUTATORS.test(_plainCallCalleeName.slice(_dot + 1))) {
-            _recv = _plainCallCalleeName.slice(0, _dot);
+          // SARD_80_F1 W2.3 follow-up: a REPEATED-method fluent chain
+          // (`sb.append(a).append(b).append(c)`, StringBuilder/StringBuffer's
+          // own idiomatic multi-line-SQL-building shape) dot-joins to
+          // "StringBuilder.append.append.append" via the hand-rolled/CST
+          // chain-flattening convention every frontend in this codebase
+          // uses (correct for a chain ending in a DIFFERENT terminal method,
+          // e.g. `DocumentBuilderFactory.newInstance().newDocumentBuilder()`
+          // — wrong here, since `.append()` returning `this` means every
+          // segment is really the SAME receiver, not a new one). Naively
+          // taking everything before the LAST dot recovers
+          // "StringBuilder.append.append" as the "receiver" — an
+          // ever-growing, never-matching key that silently drops the
+          // mutator's own taint tracking for every chained-append call.
+          // Strip ALL trailing segments that repeat the SAME mutator method
+          // name first, so `X.append.append.append` and plain `X.append`
+          // resolve to the identical, real receiver "X".
+          const _segs = _plainCallCalleeName.split('.');
+          let _end = _segs.length - 1;
+          const _lastSeg = _segs[_end];
+          if (_end > 0 && _MUTATORS.test(_lastSeg)) {
+            while (_end > 0 && _segs[_end] === _lastSeg) _end--;
+            if (_end >= 0) _recv = _segs.slice(0, _end + 1).join('.');
           }
         }
         if (_recv) state.add(_recv);
@@ -1283,7 +1707,19 @@ function step(node, stateIn, callContext) {
     case 'if': {
       // Path-feasibility lite: if the condition is a literal false / unreachable,
       // mark the node so the CFG walker can skip the consequent edge.
-      // For now we simply propagate state to both branches.
+      // For now we simply propagate state to both branches — EXCEPT for a
+      // recognized guard-predicate condition (SARD_80_F1 W3.2), where the
+      // TRUE branch specifically gets a narrowed (un-tainted-on-the-guarded-
+      // var) state via `succOverride`; the false branch and any code after
+      // an if-with-no-else still see the original, unnarrowed `state`. Per
+      // this codebase's established CFG convention (path-feasibility.js),
+      // `succ[0]` is the THEN edge and `succ[1+]` are the ELSE/fall-through
+      // edge(s).
+      const narrowedVar = _guardNarrowsVar(node.cond, state) || _regexTestGuardNarrowsVar(node.cond, state);
+      if (narrowedVar && node.succ && node.succ.length > 0) {
+        const thenState = removePathAndDescendants(state, narrowedVar);
+        return { state, findings, succOverride: new Map([[node.succ[0], thenState]]) };
+      }
       return { state, findings };
     }
 
@@ -1349,12 +1785,28 @@ function analyzeFunction(fn, entryState, callContext) {
   // No-op for the key unless AGENTIC_SECURITY_KCFA_CALLSTRING=1. Restored below.
   const _prevCallerCtx = (callContext && callContext._summaryCache && callContext._summaryCache.setCallerContext)
     ? callContext._summaryCache.setCallerContext(fn.qid) : undefined;
+  // SARD_80_F1 W4.C21/C22 — `_currentFile` (module-level, set just below) was
+  // never saved/restored around a NESTED analyzeFunction call the way
+  // `_prevCallerCtx` already is on the line above. A cross-FILE call site
+  // (e.g. Bad() in file A calling a summary-computed callee in file B)
+  // recurses into analyzeFunction(calleeFn, ..., inner) to compute the
+  // callee's summary — that inner call sets `_currentFile = calleeFn.file`
+  // (file B) and, until this fix, never set it back, so every subsequent
+  // catalog lookup (`matchSinkOrSanitizer`/`matchSource`/`classOfVar`) in
+  // the OUTER function's own remaining CFG nodes ran against the WRONG
+  // file's language scoping for the rest of that outer function's walk.
+  // Confirmed via a same-file-vs-cross-file A/B reproduction of a real
+  // corpus false positive (see W4.C20/C21/C22) that isolated this leak as
+  // one of two compounding defects. Saving/restoring here — the exact
+  // pattern `_prevCallerCtx` already uses — makes `_currentFile` correctly
+  // scoped to this function's own analysis regardless of what any callee's
+  // nested summary computation does to it in between.
+  const _prevFile = _currentFile;
   const work = [];
   const inStates = new Map();
   const outStates = new Map();
   inStates.set(fn.cfg.entry, new Set(entryState));
   work.push(fn.cfg.entry);
-  _activeConstantVars = new Map();
   _currentFile = fn.file || null;
   // v0.70 #2 — points-to context for the step() transfer. Setting it here
   // (instead of plumbing through step's signature) keeps the worklist loop
@@ -1375,15 +1827,32 @@ function analyzeFunction(fn, entryState, callContext) {
     const node = nodes[nid];
     if (!node) continue;
     const incoming = inStates.get(nid) || new Set();
-    const { state: out, findings } = step(node, incoming, callContext);
-    callContext._findings.push(...findings.map(f => ({ ...f, _funcQid: fn.qid })));
+    const { state: out, findings, succOverride } = step(node, incoming, callContext);
+    // SARD_80_F1 W4.C21/C22: stamp the file THIS finding actually belongs to
+    // (fn's own file) at the moment of discovery — see `_collectFindings`'s
+    // header comment for why this matters. `step()`/`_sinkFindingsForCall`
+    // never set `file` themselves (only `line`), so every finding reaching
+    // this line was, until now, implicitly reattributed later to whichever
+    // function `_collectFindings` happened to be called with — correct only
+    // when that's the SAME function, which a cross-file interprocedural
+    // merge (`_mergeSummaryFindings`) is specifically the case where it is
+    // NOT.
+    callContext._findings.push(...findings.map(f => ({ ...f, _funcQid: fn.qid, file: f.file || fn.file })));
     const prevOut = outStates.get(nid);
     const merged = mergeStates(prevOut, out);
     if (!prevOut || !stateEq(prevOut, merged)) {
       outStates.set(nid, merged);
       for (const s of (node.succ || [])) {
+        // SARD_80_F1 W3.2 — guard-predicate narrowing (case 'if' above): a
+        // specific successor edge (the guard's TRUE branch) can carry a
+        // NARROWER state than every other edge out of this node. `out` (not
+        // `merged`) is what `succOverride` was derived from, and `out` is a
+        // pure function of `incoming`, so gating this on `merged`'s own
+        // convergence check above is sound — an unchanged `merged` means an
+        // unchanged `incoming` means an unchanged override too.
+        const edgeState = (succOverride && succOverride.has(s)) ? succOverride.get(s) : merged;
         const succIn = inStates.get(s);
-        const newIn = mergeStates(succIn, merged);
+        const newIn = mergeStates(succIn, edgeState);
         if (!succIn || !stateEq(succIn, newIn)) {
           inStates.set(s, newIn);
           work.push(s);
@@ -1426,7 +1895,7 @@ function analyzeFunction(fn, entryState, callContext) {
         reportedNids.add(nid);
         callContext._findings.push({
           ...createImplicitFinding(node, conditionLabel),
-          _funcQid: fn.qid, sinkId: sink.id,
+          _funcQid: fn.qid, sinkId: sink.id, file: fn.file,
           cwe: (sink.vuln && sink.vuln.cwe) || 'CWE-200',
         });
       };
@@ -1463,6 +1932,13 @@ function analyzeFunction(fn, entryState, callContext) {
   }
 
   const exit = outStates.get(fn.cfg.exit) || new Set();
+  // Real cross-method field taint (SARD_80_F1_SCANNER_PRD.md, Juliet flow
+  // variants 45/65-68): the runTaintEngine pre-pass needs the RAW exit state
+  // (every tainted access path, not just the ones matching a declared param)
+  // to tell whether THIS function's own body genuinely taints a class field —
+  // see the pre-pass loop below for why this must be the real exit state, not
+  // a guess.
+  if (callContext) callContext._exitState = exit;
   // v0.66 — record which params are tainted at function exit so the
   // caller's applyAtCallSite can propagate that mutated taint back. We
   // intersect the exit-state with the function's declared params (only
@@ -1473,10 +1949,26 @@ function analyzeFunction(fn, entryState, callContext) {
       if (isCoveredBy(exit, p)) callContext._mutatedParamsOut.add(p);
     }
   }
+  // Next-gen taint capability #3 — treat `this` as an implicit mutable
+  // parameter, mirroring the block just above exactly: extract every field
+  // name this function's own exit state taints on its receiver (any of the
+  // three `this` spellings this codebase's frontends use), so the caller can
+  // propagate that mutation onto ITS OWN receiver variable's access path
+  // (`bad.data`), not a class-wide bucket. See this file's own header
+  // comment above `_thisFieldGetterName` for the full rationale.
+  if (callContext) {
+    if (!callContext._mutatedThisFieldsOut) callContext._mutatedThisFieldsOut = new Set();
+    for (const p of exit) {
+      const m = _THIS_FIELD_PREFIX_RE.exec(p);
+      if (m) callContext._mutatedThisFieldsOut.add(m[1]);
+    }
+  }
   // R2: restore the caller context for the enclosing function's analysis.
   if (_prevCallerCtx !== undefined && callContext && callContext._summaryCache && callContext._summaryCache.setCallerContext) {
     callContext._summaryCache.setCallerContext(_prevCallerCtx);
   }
+  // W4.C21/C22: restore _currentFile — see the save at this function's start.
+  _currentFile = _prevFile;
   return exit;
 }
 
@@ -1533,12 +2025,40 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
   const fnList = [...callGraph.functions.values()].sort((a, b) =>
     a.qid < b.qid ? -1 : a.qid > b.qid ? 1 : 0
   );
+  // PRD W0.1 (SARD_80_F1_EXECUTION_PRD.md) — the main per-function loop below
+  // silently `break`s once `n > fnLimit` (default 5000), which for a single
+  // large SARD CWE directory (Java CWE-89 alone: 3668 files, 17604
+  // functions) means roughly 70% of the corpus is never analyzed at all, no
+  // matter how correct the resolution logic is for the functions it DOES
+  // reach. This was completely invisible to every existing truncation
+  // signal (wall-clock budget, per-file timeout/skip counts) — found while
+  // investigating why a real, verified class-resolution fix (W1) showed
+  // almost no aggregate SARD recall movement despite fixing individual
+  // fixtures in isolation. Surfaced the same way the wall-clock budget
+  // already is: a single info finding, not a return-shape change (this
+  // function's return type — a flat array — is a wide, load-bearing
+  // contract; changing it would touch every caller).
+  if (fnList.length > fnLimit) {
+    all.push({
+      id: `ir-taint-fn-limit:${fnList[0] ? fnList[0].qid.split('::')[0] : ''}`,
+      file: '(deep-engine)', line: 0,
+      vuln: `IR-TAINT deep mode analyzed only ${fnLimit}/${fnList.length} functions (AGENTIC_SECURITY_DEEP_FN_LIMIT) — results are incomplete`,
+      severity: 'info',
+      parser: 'IR-TAINT',
+      confidence: 0.5,
+    });
+  }
   // Pre-pass + fixed-point: compute empty-entry-state summaries for every
   // function, then re-run the pre-pass until the summary cache stabilizes
   // (capped at MAX_FP_ITERS so recursion and chains converge without
   // unbounded blowup). v0.66 — the inner ctx now records mutatedParams
   // via _mutatedParamsOut so cross-function param mutation propagates.
   const MAX_FP_ITERS = 3;
+  // qid -> this function's own exit-state (every tainted access path at
+  // return, from the LAST pre-pass iteration only — see the class-field
+  // cross-taint pass below for why this must be a real, already-observed
+  // exit state rather than a re-derived guess).
+  const exitStateByQid = new Map();
   for (let it = 0; it < MAX_FP_ITERS; it++) {
     if (Date.now() > deadlineMs) break;
     // Tracks whether this iteration actually changed any cached summary's
@@ -1569,9 +2089,11 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
       // (sinkId, file, line), so re-discovering the same empty-entry finding
       // multiple times collapses to one reported finding, never a duplicate.
       _collectFindings(fn, ctx._findings);
+      exitStateByQid.set(fn.qid, ctx._exitState || new Set());
       const next = {
         returnTainted: !!ctx._returnTainted,
         mutatedParams: ctx._mutatedParamsOut || new Set(),
+        mutatedThisFields: ctx._mutatedThisFieldsOut || new Set(),
         taintedGlobals: new Set(),
         findings: [],
       };
@@ -1602,26 +2124,143 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
     // `changedThisIter` tracks actual value changes instead.
     if (!changedThisIter) break;
   }
-  // Class-field cross-taint pass: when a method writes tainted data to _this_.field,
-  // re-analyze other methods of the same class with those fields in the entry state.
-  const classTaintedFields = new Map();
-  for (const fn of fnList) {
-    if (Date.now() > deadlineMs) break;
-    const sum = summaryCache.get(fn.qid, new Set());
-    if (!sum || !sum.mutatedParams) continue;
-    for (const p of sum.mutatedParams) {
-      if (typeof p === 'string' && p.startsWith('_this_.')) {
-        const classPrefix = fn.qid.split('::')[0] + '::';
-        if (!classTaintedFields.has(classPrefix)) classTaintedFields.set(classPrefix, new Set());
-        classTaintedFields.get(classPrefix).add(p);
+  // Class-field cross-taint pass (SARD_80_F1_SCANNER_PRD.md — Juliet flow
+  // variants 45/65-68: a method writes a tainted value to a static or
+  // instance field and a SIBLING method of the same class reads it into a
+  // sink). The mechanism this replaced kept only the JS/Babel `_this_.field`
+  // mutated-PARAM shape — but `_mutatedParamsOut` (above) only ever
+  // intersects a function's own EXIT state against its declared PARAMS, and
+  // a field is never a param, so that map was permanently empty for every
+  // hand-rolled parser (C#, Java, PHP, Go, Ruby, Kotlin) — confirmed by
+  // direct probing, not assumed: none of `sf = data;`, `this.inst = data;`
+  // ever populated it, for any language.
+  //
+  // Real fix: `callContext._exitState` (stamped just above) is EVERY tainted
+  // access path at a function's exit, not just the ones matching a param
+  // name. Cross-reference it against the class's DECLARED FIELD NAMES (from
+  // `ir.classes[].fields`, via `buildClassHierarchy` — only populated by a
+  // parser that emits it; classes with no field list simply contribute
+  // nothing here, which is a missed opportunity, never a wrong edge) to ask
+  // "did this method's own body, taken alone, genuinely taint one of its
+  // class's fields?" — a REAL, observed fact from the empty-entry pre-pass
+  // above, not a guess. Both the bare form (`sf`) and the `this.`-qualified
+  // form (`this.inst`, `_this_.inst`) are checked, since different parsers
+  // lower a field write differently.
+  const cha = opts._cha;
+  const classTaintedFields = new Map(); // className -> Set(bareFieldName)
+  // SARD_80_F1 W5.48 — per-WRITER record alongside the per-class union just
+  // above: className -> field -> Set(qid of a method whose OWN exit state
+  // taints this field). `classTaintedFields` only ever answers "is this
+  // field EVER tainted somewhere in the class" (unioned across every
+  // method), which is what made the cross-class pass below seed a reader
+  // like `goodG2BSink()` as tainted even though its own real caller chain
+  // (`goodG2B()`) only ever writes this field a LITERAL — Juliet's Flow
+  // Variant 65-68 idiom (`_68a`/`_68b`) has bad()/goodG2B()/goodB2G() each
+  // write the SAME static field then immediately call their OWN uniquely-
+  // named sink (badSink/goodG2BSink/goodB2GSink), so "ever tainted
+  // anywhere in the class" is true (via bad()) but says nothing about
+  // which SPECIFIC caller reaches a SPECIFIC reader. This map lets the
+  // cross-class pass ask the narrower, call-string-sensitive question
+  // instead: "is EVERY discoverable direct caller of this reader a
+  // confirmed NON-tainting writer of this field" — see its own use site.
+  const fieldWriterQids = new Map();
+  if (cha && cha.methodOwners && cha.classes) {
+    for (const fn of fnList) {
+      if (Date.now() > deadlineMs) break;
+      const className = cha.methodOwners.get(fn.qid);
+      if (!className) continue;
+      const cls = cha.classes.get(className);
+      const declaredFields = cls && cls.fields;
+      if (!declaredFields || !declaredFields.size) continue;
+      const exitState = exitStateByQid.get(fn.qid);
+      if (!exitState || !exitState.size) continue;
+      for (const field of declaredFields) {
+        // SARD_80_F1 W5.10 — PHP's own `$this` reference keeps its `$`
+        // sigil in every access path (`$this.field`, never bare `this.` —
+        // parser-php.js's own `->`-to-`.` normalization, W5.9), a fourth
+        // spelling alongside JS's `_this_.`/C#'s and Java's bare `this.`.
+        //
+        // SARD_80_F1 W5.17 — `isCoveredBy` deliberately never propagates UP
+        // (its own doc: `set={"x.y.z"}` does NOT cover "x.y"), which is
+        // correct for ordinary field reads but wrong here: an ARRAY-INDEXED
+        // field write (`$this->input[1] = $_GET[...]`) taints the access
+        // path `this.input.1`, not the bare `this.input`/`input` this loop
+        // queries — so a getter method returning `$this->input[1]` (the
+        // PHP-Vuln-test-suite-generator's own "object/Array" input-
+        // indirection sample, confirmed via direct reproduction, not corpus
+        // access) was invisible to this whole class-field pass, while the
+        // scalar-field form one line below (`$this->input = $_GET[...]`)
+        // already worked. `pathIsCoveredByPrefix(entry, field)` checks the
+        // OPPOSITE direction — does `entry` sit AT OR BELOW `field` — which
+        // is exactly "did the constructor taint SOME sub-path of this
+        // field", independent of which specific index or nesting depth.
+        const hasTaintedSubpath = (prefix) => { for (const p of exitState) { if (pathIsCoveredByPrefix(p, prefix)) return true; } return false; };
+        if (isCoveredBy(exitState, field) || isCoveredBy(exitState, `this.${field}`) || isCoveredBy(exitState, `_this_.${field}`) || isCoveredBy(exitState, `$this.${field}`)
+            || hasTaintedSubpath(field) || hasTaintedSubpath(`this.${field}`) || hasTaintedSubpath(`_this_.${field}`) || hasTaintedSubpath(`$this.${field}`)) {
+          if (!classTaintedFields.has(className)) classTaintedFields.set(className, new Set());
+          classTaintedFields.get(className).add(field);
+          if (!fieldWriterQids.has(className)) fieldWriterQids.set(className, new Map());
+          const fw = fieldWriterQids.get(className);
+          if (!fw.has(field)) fw.set(field, new Set());
+          fw.get(field).add(fn.qid);
+        }
       }
     }
   }
-  for (const [classPrefix, fields] of classTaintedFields) {
+  // SARD_80_F1 W5.50 — same reverse-call-graph lookup the cross-class pass
+  // below uses (`callGraph.callersOf`, already built once by `buildCallGraph`
+  // — see that pass's own header comment for why this reads the existing
+  // index rather than re-deriving one), hoisted up so the SAME-class pass
+  // immediately below can ALSO apply call-string precision. This pass had
+  // the IDENTICAL over-approximation `classTaintedFields`'s own header
+  // comment describes for the cross-class case — a sibling method reached
+  // ONLY via a confirmed non-tainting writer was still blanket-seeded as
+  // tainted, just scoped to siblings of the SAME class instead of a
+  // different one. Genuinely a rarer shape here (per this pass's OWN
+  // original comment, most sibling methods have no discoverable caller/
+  // callee edge to each other at all — that remains true and still fails
+  // closed correctly), but real whenever a sibling reader is directly
+  // called from a KNOWN writer method (mirrors the cross-class idiom, just
+  // without the class boundary).
+  const _callerQidSetCache = new Map(); // fn.qid -> Set(callerQid)|null, memoized
+  const callersOfQid = (qid) => {
+    if (_callerQidSetCache.has(qid)) return _callerQidSetCache.get(qid);
+    const edges = callGraph && callGraph.callersOf && callGraph.callersOf.get(qid);
+    const set = edges && edges.length ? new Set(edges.map((e) => e.caller).filter(Boolean)) : null;
+    _callerQidSetCache.set(qid, set);
+    return set;
+  };
+  for (const [className, fields] of classTaintedFields) {
     if (Date.now() > deadlineMs) break;
     for (const fn of fnList) {
-      if (!fn.qid.startsWith(classPrefix)) continue;
-      if (summaryCache.has(fn.qid, fields)) continue;
+      if (cha.methodOwners.get(fn.qid) !== className) continue;
+
+      // Call-string precision (mirrors the cross-class pass below): narrow
+      // `fields` to only the ones fn's own discoverable callers can
+      // actually supply as tainted. Fails closed (keeps the field seeded)
+      // whenever fn has no discoverable caller, a caller outside this
+      // class, or any caller not positively confirmed as a non-tainting
+      // writer — this can ONLY ever narrow what was already being seeded,
+      // never widen it, so it cannot introduce a new false negative beyond
+      // what the pre-existing blanket behavior already accepted.
+      const callers = callersOfQid(fn.qid);
+      let seedFields = fields;
+      if (callers && callers.size) {
+        const effectiveFields = new Set();
+        for (const f of fields) {
+          const writers = fieldWriterQids.get(className) && fieldWriterQids.get(className).get(f);
+          let keep = false;
+          for (const callerQid of callers) {
+            if (writers && writers.has(callerQid)) { keep = true; break; }
+            if (cha.methodOwners.get(callerQid) !== className) { keep = true; break; }
+          }
+          if (keep) effectiveFields.add(f);
+        }
+        seedFields = effectiveFields;
+      }
+      if (!seedFields.size) continue; // every discoverable caller of fn provably never taints any of these fields
+
+      if (summaryCache.has(fn.qid, seedFields)) continue;
       const ctx = {
         _findings: [], _taintSources: [], _returnTainted: false,
         _stack: new Set(), deadlineMs,
@@ -1631,21 +2270,138 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
         _cha: opts._cha,
         _pointsTo: opts._pointsTo,
       };
-      try { analyzeFunction(fn, _unionAnnotationTaint(fn, fields), ctx); } catch {}
-      // `findings` carries the REAL findings from this probe (was hardcoded
-      // `[]`, discarding them) — but this pass is speculative (every field
-      // in `fields` is assumed simultaneously tainted; nothing here confirms
-      // this exact method is ever reached with that state), so it must not
-      // report them itself. They ride on the cached summary and are only
-      // surfaced by _mergeSummaryFindings when a REAL call site (assign,
-      // plain-call, or higher-order) actually consults this qid+entry —
-      // at that point a genuine reachable caller has been established.
-      summaryCache.set(fn.qid, fields, {
+      // Seed every spelling of every tainted field so a reading method sees
+      // the taint regardless of which form it uses to reference the field
+      // — mirrors the write-side check above, `$this.` (PHP, W5.10) included.
+      const seeded = new Set();
+      for (const f of seedFields) { seeded.add(f); seeded.add(`this.${f}`); seeded.add(`_this_.${f}`); seeded.add(`$this.${f}`); }
+      try { analyzeFunction(fn, _unionAnnotationTaint(fn, seeded), ctx); } catch {}
+      // Unlike the k=2 pass below, this is NOT speculative: `seedFields` was
+      // derived from a REAL, already-observed write elsewhere in this exact
+      // class (the loop above), so a sink this re-analysis finds is a real,
+      // reachable flow — report it directly instead of waiting for a call
+      // site that will never come (most sibling methods still have no
+      // caller/callee relationship for the taint engine to discover; the
+      // call-string narrowing just above only ever removes fields when one
+      // WAS discoverable).
+      _collectFindings(fn, ctx._findings);
+      // `findings` still rides on the cached summary too, for the (rarer)
+      // case where a real caller ALSO consults this exact qid+entry pair via
+      // _mergeSummaryFindings — dedup in _collectFindings makes this safe.
+      const fieldSummary = {
         returnTainted: !!ctx._returnTainted,
         mutatedParams: ctx._mutatedParamsOut || new Set(),
+        mutatedThisFields: ctx._mutatedThisFieldsOut || new Set(),
         taintedGlobals: new Set(),
         findings: ctx._findings,
-      });
+      };
+      summaryCache.set(fn.qid, seedFields, fieldSummary);
+      // SARD_80_F1 W3.x — the getter+return interprocedural-composition gap
+      // documented at PHP W5.10: an EXTERNAL, no-argument caller of this
+      // method (`$tainted = $obj->getInput();`) never consults the
+      // `fields`-keyed entry above — it looks up the ORDINARY empty-context
+      // summary (`summaryCache.get(fn.qid, new Set())`), which the earlier
+      // fixed-point pre-pass computed WITHOUT knowing the field was tainted
+      // (that fact is only established by the class-scan just above, which
+      // runs once, after the pre-pass). `entryContext = new Set()` means
+      // "no CALLER-supplied parameter is tainted" — true here regardless of
+      // how many params `fn` declares, since this re-analysis seeded ONLY
+      // the class's own already-tainted fields, no parameters — so this
+      // result is exactly the correct value for that key, not a guess.
+      // Safe to overwrite unconditionally: this model has no un-taint step,
+      // so a field-seeded re-analysis can only find a superset of whatever
+      // the plain empty-context pre-pass already found. The final per-
+      // function reporting pass (the `for (const fn of fnList)` loop that
+      // does the REAL, non-speculative analysis of every function,
+      // including whatever caller invokes this getter) runs strictly AFTER
+      // this whole class-field block, so it is guaranteed to see the
+      // corrected summary — no fixed-point re-iteration needed for THIS
+      // specific external-caller shape.
+      summaryCache.set(fn.qid, new Set(), fieldSummary);
+    }
+  }
+
+  // Cross-class static-field taint (SARD_80_F1_EXECUTION_PRD.md — Juliet flow
+  // variant 68: a driver class writes a tainted value to its OWN static
+  // field, then a COMPLETELY DIFFERENT class reads it back via a qualified
+  // reference — `String data = OtherClass.field;` — with no parameter
+  // passed at all. The same-class pass just above is deliberately scoped to
+  // "a sibling method of the SAME class" (see its own header comment); this
+  // is the same mechanism widened one hop further, to any function anywhere
+  // that references `<taintedClassName>.<taintedField>` by name.
+  //
+  // Bounded by a cheap TEXT pre-filter rather than re-analyzing every
+  // function in the project for every tainted class: only a function whose
+  // OWN source text contains the literal `<ClassName>.` substring is a
+  // candidate at all (Juliet's own per-test-case files reference at most a
+  // couple of sibling classes each, so this stays cheap even across a
+  // 17000+ function corpus). `opts.fileContents` is the same map already
+  // threaded through for incremental-cache hashing; falls back to
+  // no-op when absent (in-process callers that don't pass it), same
+  // graceful-degradation convention as this file's other opt-in passes.
+  const fileContents = opts.fileContents;
+  if (cha && fileContents && classTaintedFields.size) {
+    // `callersOfQid` (SARD_80_F1 W5.48) is hoisted above the same-class pass
+    // now that pass ALSO consults it (W5.50) — reused here rather than
+    // re-derived, same memoized map, zero extra cost.
+    for (const [className, fields] of classTaintedFields) {
+      if (Date.now() > deadlineMs) break;
+      const needle = `${className}.`;
+      for (const fn of fnList) {
+        if (Date.now() > deadlineMs) break;
+        if (cha.methodOwners.get(fn.qid) === className) continue; // already covered above
+        const src = fileContents[fn.file];
+        if (typeof src !== 'string' || !src.includes(needle)) continue;
+
+        // Call-string precision: narrow `fields` to only the ones fn should
+        // actually be seeded with. A field drops out only when EVERY direct
+        // caller of fn is a same-class method we POSITIVELY confirmed does
+        // NOT taint that field (absent from `fieldWriterQids`) — never when
+        // a caller is unresolved, ambiguous, or outside this class, since
+        // those cases carry no evidence either way. This is deliberately a
+        // narrow, local instance of call-string sensitivity (Juliet's own
+        // "write-then-immediately-call-a-uniquely-named-sink" idiom, one
+        // direct hop) rather than a general k>1 CFA — see this file's own
+        // CLAUDE.md "Scope — what we still do NOT model" for why the general
+        // form is out of scope. Fails closed (keeps the field seeded) the
+        // instant precision can't be established, same direction every
+        // other heuristic in this pass already takes.
+        const callers = callersOfQid(fn.qid);
+        const effectiveFields = new Set();
+        for (const f of fields) {
+          if (!callers || !callers.size) { effectiveFields.add(f); continue; }
+          const writers = fieldWriterQids.get(className) && fieldWriterQids.get(className).get(f);
+          let keep = false;
+          for (const callerQid of callers) {
+            if (writers && writers.has(callerQid)) { keep = true; break; }
+            if (cha.methodOwners.get(callerQid) !== className) { keep = true; break; }
+          }
+          if (keep) effectiveFields.add(f);
+        }
+        if (!effectiveFields.size) continue; // every caller of fn provably never taints any of these fields
+
+        const qualifiedSeeds = new Set();
+        for (const f of effectiveFields) qualifiedSeeds.add(`${className}.${f}`);
+        if (summaryCache.has(fn.qid, qualifiedSeeds)) continue;
+        const ctx = {
+          _findings: [], _taintSources: [], _returnTainted: false,
+          _stack: new Set(), deadlineMs,
+          _summaryCache: summaryCache, _callGraph: callGraph,
+          _mutatedParamsOut: new Set(),
+          _currentFnQid: fn.qid,
+          _cha: opts._cha,
+          _pointsTo: opts._pointsTo,
+        };
+        try { analyzeFunction(fn, _unionAnnotationTaint(fn, qualifiedSeeds), ctx); } catch {}
+        _collectFindings(fn, ctx._findings);
+        summaryCache.set(fn.qid, qualifiedSeeds, {
+          returnTainted: !!ctx._returnTainted,
+          mutatedParams: ctx._mutatedParamsOut || new Set(),
+          mutatedThisFields: ctx._mutatedThisFieldsOut || new Set(),
+          taintedGlobals: new Set(),
+          findings: ctx._findings,
+        });
+      }
     }
   }
 
@@ -1686,6 +2442,7 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
     summaryCache.set(fn.qid, taintedEntry, {
       returnTainted: !!ctx._returnTainted,
       mutatedParams: ctx._mutatedParamsOut || new Set(),
+      mutatedThisFields: ctx._mutatedThisFieldsOut || new Set(),
       taintedGlobals: new Set(),
       findings: ctx._findings,
     });
@@ -1757,6 +2514,7 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
           return {
             returnTainted: !!inner._returnTainted,
             mutatedParams: inner._mutatedParamsOut || new Set(),
+            mutatedThisFields: inner._mutatedThisFieldsOut || new Set(),
             taintedGlobals: new Set(),
             findings: inner._findings,
           };
@@ -1801,13 +2559,26 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
   // genuine caller is established.
   function _collectFindings(attributedFn, srcFindings) {
     for (const f of srcFindings) {
-      const key = `${f.sinkId}:${attributedFn.file}:${f.line}`;
+      // SARD_80_F1 W4.C21/C22 — prefer the finding's OWN `file` (now stamped
+      // at discovery time inside analyzeFunction, using the function that
+      // ACTUALLY produced it) over `attributedFn.file`. `attributedFn` here
+      // is whichever function the CALLER of `_collectFindings` happens to
+      // be processing — correct for a finding discovered directly in that
+      // function's own CFG walk, but WRONG for one merged in from a
+      // callee's summary via `_mergeSummaryFindings` (most commonly a
+      // cross-file interprocedural call): that finding genuinely belongs to
+      // the callee's own file/line, which `f.file` now carries correctly.
+      // The `attributedFn.file` fallback stays for defense-in-depth only —
+      // every path pushing into `_findings` sets `file` explicitly as of
+      // this fix.
+      const file = f.file || attributedFn.file;
+      const key = `${f.sinkId}:${file}:${f.line}`;
       if (seen.has(key)) continue;
       seen.add(key);
       const fn = attributedFn;
       all.push({
-        id: `ir-taint:${fn.file}:${f.line}:${f.sinkId}`,
-        file: fn.file,
+        id: `ir-taint:${file}:${f.line}:${f.sinkId}`,
+        file,
         line: f.line,
         vuln: f.vuln,
         severity: f.severity,
@@ -1839,6 +2610,20 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
         // backward-slice annotation was permanently a no-op regardless of
         // AGENTIC_SECURITY_BACKWARD_SLICE.
         ...(f._funcQid ? { _funcQid: f._funcQid } : {}),
+        // argIndex: which sink argument is the tainted one (a number, or the
+        // literal 'all'/'rhs') — set upstream at the finding's creation site
+        // but, exactly like `_funcQid`/`callee` above, silently dropped by
+        // this same allowlist before backward.js's `annotateBackwardSlices`
+        // ever saw it. Without it, `annotateBackwardSlices` falls back to
+        // the placeholder string `arg[undefined]` for EVERY finding (it can
+        // never be a real access path, since no source ever names a
+        // variable that literally), so `sliceBackward` always started and
+        // ended at the bare sink node with no source/sanitize steps at all
+        // — the backward-slice pass was a structural no-op for real findings
+        // regardless of AGENTIC_SECURITY_BACKWARD_SLICE, discovered while
+        // rebuilding the SMT path-feasibility mechanism (next-gen taint
+        // capability #5) to depend on a REAL slice for a sound proof.
+        ...(f.argIndex !== undefined ? { argIndex: f.argIndex } : {}),
         // callee: kept as plain `callee` (not underscore-prefixed) to match
         // backward.js's own contract, which reads `f.callee` on both real and
         // fake-fixture findings throughout its module and test suite. It is