@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/taint/tracer.js

@@ -0,0 +1,3817 @@
+/**
+ * THE TAINT TRACER
+ * ================
+ *
+ * This is the engine that turns "signature-based" into "flow-verified".
+ *
+ * HOW IT WORKS, in one paragraph:
+ * We read each function body top to bottom, keeping a notebook of which
+ * variables currently hold dirty data. When a line assigns something, we work
+ * out whether the right-hand side is dirty and write that in the notebook. When
+ * a line calls something dangerous, we look up its arguments in the notebook.
+ * If a dirty value reaches a sink and no sanitiser washed it on the way, we can
+ * finally say the thing a pattern match never could: *this specific value, from
+ * this specific source, reaches this specific sink.* And we can show every hop.
+ *
+ * WHAT IT DELIBERATELY DOES NOT DO - each of these is a documented gap, not an
+ * oversight, and each is printed in the scan report:
+ *
+ *   1. BOUNDED REACH. Functions defined in this file are followed, and so are
+ *      functions in another file when a relative import resolves to it. What
+ *      still ends a trace: a call into a third-party package, a dynamic or
+ *      aliased import, a name several modules define (we decline rather than
+ *      guess), and any chain deeper than four calls. A cut at that depth, or at
+ *      a call that looks recursive, does NOT end the value: it is carried past
+ *      the unread call exactly as in 3 below, with the reason for the stop
+ *      written into the path.
+ *
+ *   2. STATEMENT ORDER, NOT BRANCH LOGIC. We read lines in order and ignore
+ *      whether an `if` is true. So a value cleaned only inside `if (isAdmin)`
+ *      is treated as cleaned afterwards. That direction of error loses findings
+ *      rather than inventing them, which is the right way to be wrong.
+ *
+ *   3. UNKNOWN FUNCTIONS CARRY TAINT, AND SAY SO. `foo(dirty)` keeps the taint
+ *      and records the hop as UNMODELLED, naming `foo` on the finding. Treating
+ *      unknowns as clean was tried first and produced ZERO verified flows across
+ *      2,766 Java files, every one a known vulnerability - so the quiet option
+ *      was not the honest one. This is the weakest link in any path we print,
+ *      which is exactly why it is printed rather than smoothed over.
+ *
+ *   4. CONTAINERS ARE TAINTED WHOLE. `list.add(dirty)` dirties the list, not
+ *      the slot - so a clean element read back out of that list is treated as
+ *      dirty too. Following values into objects at all requires this trade; the
+ *      alternative was the previous behaviour, which was to lose the value
+ *      entirely the moment it entered a StringBuilder or a List.
+ *
+ *   5. NO LOOP FIXPOINT. A variable that becomes dirty at the bottom of a loop
+ *      and is used at the top is missed on the first pass. Real analysers
+ *      iterate to a fixpoint; we do not, yet.
+ *
+ * Every one of those makes the tool MISS things (false negatives). None of them
+ * makes it invent things. That asymmetry is deliberate: a flow-verified label is
+ * a promise, and a promise that is sometimes wrong is worth less than no promise
+ * at all.
+ */
+import { describeFact, guardClears, guardFactsAt, guardsApply, normalizeExpression } from '../rules/lib/guards.js';
+import { nodeLocation } from '../parse/location.js';
+import { analyzeStringExpression, looksLikeHtml, looksLikeSql } from '../rules/lib/strings.js';
+import { TAINT_DICTIONARIES } from './dictionaries.js';
+import { ASSIGNMENT_NODES, SWITCH_NODES, assignmentParts, createFolder } from './fold.js';
+import { declaredImmutable, enclosingMethod, enclosingPythonFunction, mentionedBetween, resolveContainerRead, writtenBetween } from './local-map.js';
+import { SINK_KIND_RULE } from './types.js';
+/** A fresh wash for these kinds: nothing has been taken on trust since. */
+function washedNow(prior, kinds) {
+    const next = { ...(prior ?? {}) };
+    for (const k of kinds)
+        next[k] = [];
+    return next;
+}
+/** An unmodelled function the value just went through, after every wash it carries. */
+function trustedHop(prior, name) {
+    if (!prior)
+        return undefined;
+    const next = {};
+    for (const [k, names] of Object.entries(prior)) {
+        next[k] = names.includes(name) ? names : [...names, name];
+    }
+    return next;
+}
+/**
+ * Values joined into one: for each kind ALL of them are washed for, every
+ * function any of them took on trust. A part that did not track it leaves
+ * the kind untracked, so the receipt falls back to the cautious list.
+ */
+function joinedAfterWash(parts, kinds) {
+    const next = {};
+    for (const k of kinds) {
+        const lists = parts.map((p) => p.afterWash?.[k]);
+        if (lists.some((l) => l === undefined))
+            continue;
+        next[k] = [...new Set(lists.flatMap((l) => l ?? []))];
+    }
+    return Object.keys(next).length > 0 ? next : undefined;
+}
+/** How a clean part of a string is written in a urlPrefix. */
+export const CLEAN_PART = '\u0001';
+/**
+ * Does the text before a value pin the destination of the address it is part
+ * of? Only when a path, query or fragment has already begun - after a host
+ * (`https://api.example.com/`), after a clean base (`${base}/`), or in a
+ * relative path (`./`, `../`, `/api/`, `docs/`).
+ *
+ * NOT pinned, and each is a real SSRF shape: nothing before the value; a
+ * scheme with the host still open (`https://`); a host with no slash after it
+ * (`https://api.example.com` + `@evil.example`); a clean base with nothing
+ * after it, which may itself end without a slash; `https:///`, where URL
+ * parsers skip the extra slash and the value becomes the host.
+ *
+ * One shape it cannot see: a clean base holding only a scheme with no slashes
+ * (`https:`) followed by `/` and the value - parsers read `https:/evil` as
+ * host `evil`. A configuration value shaped like that is rare enough to
+ * accept, and it is written down here rather than discovered later.
+ */
+export function destinationPinned(before) {
+    if (before === '')
+        return false;
+    const scheme = before.indexOf('://');
+    if (scheme < 0 && !before.startsWith('//') && /^(\.{1,2}[/\\]|\/(?!\/))/.test(before))
+        return true;
+    const rest = scheme >= 0 ? before.slice(scheme + 3) : before.startsWith('//') ? before.slice(2) : before;
+    return rest.search(/[/?#]/) > 0;
+}
+/**
+ * The text a string-building expression contributes, clean parts written as
+ * CLEAN_PART. Like literalTextOf, except a variable or call is not nothing -
+ * it is SOMETHING, unknown but not the attacker's, and where it sits matters.
+ */
+function shapeOf(node) {
+    if (!node)
+        return '';
+    if (STRING_NODES.has(node.type)) {
+        const content = stringContent(node.text);
+        const splices = node.namedChildren.filter((c) => c !== null && (INTERPOLATION_NODES.has(c.type) || VARIABLE_NODES.has(c.type) || MEMBER_NODES.has(c.type)));
+        if (splices.length === 0)
+            return content;
+        const last = splices[splices.length - 1];
+        return last ? templateShapeBefore(node, last) + CLEAN_PART + afterSplice(node, last) : content;
+    }
+    if (node.type === 'parenthesized_expression') {
+        return shapeOf(node.namedChildren.find((c) => c !== null) ?? null);
+    }
+    if (node.type === 'binary_expression' || node.type === 'binary_operator') {
+        const operator = node.childForFieldName('operator')?.text ?? '';
+        if (operator === '+' || operator === '.') {
+            return shapeOf(node.childForFieldName('left')) + shapeOf(node.childForFieldName('right'));
+        }
+    }
+    return CLEAN_PART;
+}
+/** The literal text of a template after a splice, up to its closing delimiter. */
+function afterSplice(template, splice) {
+    const from = splice.endIndex - template.startIndex;
+    const tail = template.text.slice(from);
+    const close = template.text.match(/["'`]+$/)?.[0]?.length ?? 0;
+    // PHP's closing brace of `"{$x}"`, the twin of the one templateShapeBefore drops.
+    return tail.slice(0, Math.max(0, tail.length - close)).replace(/^\}/, '');
+}
+/** `a.b(x, y).c(z).d` -> `a.b().c().d`: a callee chain with every argument list emptied. */
+function withoutCallArguments(callee) {
+    let out = callee;
+    for (let i = 0; i < 8; i++) {
+        const next = out.replace(/\((?:[^()]|\(\))*\)/g, '()');
+        if (next === out)
+            break;
+        out = next;
+    }
+    return out;
+}
+/**
+ * Whether an SSRF flow can send the request where the attacker chooses. See
+ * FlowResult.fixedDestination and destinationPinned.
+ */
+function fixedDestinationOf(taint, kind) {
+    if (kind !== 'ssrf')
+        return undefined;
+    if (taint.fromBrowser)
+        return { kind: 'browser', before: taint.urlPrefix ?? '' };
+    if (taint.urlPrefix !== undefined && destinationPinned(taint.urlPrefix)) {
+        return { kind: 'path', before: taint.urlPrefix };
+    }
+    return undefined;
+}
+/**
+ * What precedes one splice inside a template literal or interpolated string:
+ * its literal text, with every earlier splice written as CLEAN_PART (the
+ * first dirty splice is the one being placed, so the earlier ones are clean).
+ */
+function templateShapeBefore(template, splice) {
+    let out = '';
+    let cursor = 0;
+    const head = afterOpening(template.text);
+    const opening = template.text.length - head.length;
+    for (const child of template.namedChildren) {
+        if (!child)
+            continue;
+        if (child.startIndex >= splice.startIndex)
+            break;
+        if (!(INTERPOLATION_NODES.has(child.type) || VARIABLE_NODES.has(child.type) || MEMBER_NODES.has(child.type)))
+            continue;
+        const start = child.startIndex - template.startIndex - opening;
+        if (start < cursor)
+            continue;
+        out += head.slice(cursor, start) + CLEAN_PART;
+        cursor = child.endIndex - template.startIndex - opening;
+    }
+    // PHP's `"{$x}"` keeps its brace in the literal text; it is syntax, not part of the address.
+    return (out + head.slice(cursor, splice.startIndex - template.startIndex - opening)).replace(/\{$/, '');
+}
+/* -------------------------------------------------------------------------- *
+ * Language-specific node vocabulary. Small enough to keep here rather than in
+ * the dictionaries, because it describes the GRAMMAR, not a framework.
+ * -------------------------------------------------------------------------- */
+const FUNCTION_NODES = {
+    javascript: [
+        'function_declaration', 'function_expression', 'arrow_function',
+        'method_definition', 'generator_function_declaration', 'generator_function',
+    ],
+    typescript: [
+        'function_declaration', 'function_expression', 'arrow_function',
+        'method_definition', 'generator_function_declaration', 'generator_function',
+    ],
+    python: ['function_definition', 'lambda'],
+    /*
+     * C nests the name one level down: a function_definition has a `declarator`
+     * (the function_declarator) which in turn has the `declarator` that is the
+     * identifier. There is no `name` field anywhere on it, which is why
+     * functionNameOf() below exists - without it collectFunctions found zero C
+     * functions and every cross-function trace in the language stopped dead at
+     * the call, silently.
+     */
+    c: ['function_definition'],
+    cpp: ['function_definition', 'lambda_expression'],
+    java: ['method_declaration', 'constructor_declaration', 'lambda_expression'],
+    go: ['function_declaration', 'method_declaration', 'func_literal'],
+    php: [
+        'function_definition',
+        'method_declaration',
+        'anonymous_function_creation_expression',
+        'arrow_function',
+    ],
+};
+/**
+ * Node types that ARE a reference to a variable by name.
+ *
+ * This started as a bare `node.type === 'identifier'` check, which is right for
+ * four of the five languages and silently wrong for PHP: `$x` parses as
+ * `variable_name`, so every PHP variable read fell through to "not a variable",
+ * every binding was ignored, and taint died at the first assignment. Direct
+ * source-to-sink flows still verified, which is the dangerous kind of bug -
+ * it looked like the language worked.
+ */
+const VARIABLE_NODES = new Set(['identifier', 'variable_name']);
+/**
+ * Assignment targets that bind SEVERAL names at once.
+ *
+ *     const { syncUrl } = req.body;
+ *     const [first] = request.args.getlist("x");
+ *
+ * The tracer read the whole pattern as one name - literally the string
+ * "{ syncUrl }" - which matches nothing anyone ever looks up, so the taint was
+ * recorded under a key no read could find and every destructured request field
+ * came out clean.
+ *
+ * This is not an exotic shape. It is how modern JavaScript and TypeScript read
+ * request fields, and it silently defeated every rule at once: a Gemini-written
+ * Express app had `const { syncUrl } = req.body` two lines above an SSRF, and
+ * the trace died at the brace.
+ *
+ * Every name in the pattern is bound to the taint of the whole right-hand side.
+ * That is the container rule again - if the object is dirty, everything read
+ * out of it is treated as dirty - and it errs toward reporting.
+ */
+const DESTRUCTURING_NODES = new Set([
+    'object_pattern', // JS/TS  const { a, b } = x
+    'array_pattern', // JS/TS  const [a, b] = x
+    'pattern_list', // Python a, b = x
+    'tuple_pattern',
+    'list_pattern',
+]);
+/** Every plain name a destructuring pattern introduces, however nested. */
+function namesBoundBy(pattern) {
+    const names = [];
+    const visit = (node, depth) => {
+        if (depth > 6)
+            return;
+        for (const child of node.namedChildren) {
+            if (!child)
+                continue;
+            // `{ a: renamed }` - the NAME the body will use is on the right.
+            if (child.type === 'pair_pattern' || child.type === 'object_assignment_pattern') {
+                const value = child.childForFieldName('value') ?? child.namedChildren[1] ?? null;
+                if (value)
+                    visit(value.type === 'identifier' ? child : value, depth + 1);
+                if (value && VARIABLE_NODES.has(value.type))
+                    names.push(text(value));
+                continue;
+            }
+            if (VARIABLE_NODES.has(child.type) || child.type === 'shorthand_property_identifier_pattern') {
+                names.push(text(child));
+                continue;
+            }
+            visit(child, depth + 1);
+        }
+    };
+    visit(pattern, 0);
+    return names;
+}
+const UNWRAP_NODES = new Set([
+    'parenthesized_expression',
+    'await_expression',
+    'as_expression',
+    'satisfies_expression',
+    'non_null_expression',
+    'type_assertion',
+    'expression_statement',
+    /*
+     * `(String) map.get("keyB")` - a Java cast.
+     *
+     * TypeScript's three ways of saying the same thing were all here from the
+     * start; Java's was not, and the omission cost more than every cross-file
+     * idea tried this session put together. A cast changes what the compiler
+     * calls a value. It does not change the value, so it cannot change whether
+     * an attacker chose it.
+     *
+     * Found by a ten-line fixture that put a tainted value into a HashMap three
+     * different ways. Two came out traced; the one with a cast in front did not.
+     * Written before touching the engine, on purpose - the hypothesis it killed
+     * ("the container machinery is broken") was the third wrong guess in a row
+     * that a benchmark run alone would not have corrected.
+     */
+    'cast_expression', // Java, C-style casts
+]);
+/**
+ * Wrappers whose FIRST named child is the type and whose LAST is the value.
+ *
+ * Everything else in UNWRAP_NODES puts the value first, which is why grabbing
+ * child 0 worked for years before a Java cast walked in. This is the third
+ * time the same shape has turned up wearing different clothes:
+ *
+ *     (String) map.get("k")        cast_expression   [type, value]
+ *     <string>req.query.path       type_assertion    [type, value]
+ *     req.query.path as string     as_expression     [value, type]   <- NOT here
+ *
+ * The first two look nothing alike and parse identically. The third looks
+ * almost the same as the second and parses backwards, so it must stay on the
+ * first-child path - which is the whole reason this is a set of node types
+ * and not a guess about which spelling means a cast.
+ *
+ * `type_assertion` was in UNWRAP_NODES from the beginning and still did not
+ * work, because being listed as a wrapper only says the node should be seen
+ * through; it says nothing about which side the value is on. The tracer
+ * solemnly evaluated the word `string` and reported the value clean. Found by
+ * ts-only-syntax.ts, which was written to falsify the claim that TypeScript
+ * behaves "identically to JavaScript" - and did, on the first run.
+ */
+const TYPE_FIRST_WRAPPERS = new Set(['cast_expression', 'type_assertion']);
+/**
+ * Binary operators whose result can still be attacker-chosen.
+ *
+ * Deliberately a short list. Every operator NOT here - `==`, `<`, `instanceof`,
+ * `-`, `*` - produces a value whose shape the attacker no longer controls, and
+ * carrying taint across those would manufacture flows that do not exist.
+ * Arithmetic is the clearest case: whatever `dirty - 1` is, it is a number, and
+ * a number cannot be a shell command.
+ */
+const BINARY_CARRIERS = new Set([
+    '+', // concatenation in every language here, and addition
+    '%', // Python's old-style format string
+    '.', // PHP concatenation
+    '??', // JS/TS nullish coalescing
+    '||', // returns the left operand when it is truthy
+    '&&', // returns the left operand when it is falsy
+]);
+const MEMBER_NODES = new Set([
+    'member_expression', // JS/TS   a.b
+    'attribute', // Python  a.b
+    'selector_expression', // Go      a.b
+    'field_access', // Java    a.b
+    'subscript_expression',
+    'subscript',
+    'index_expression',
+    'array_access', // Java    a[i]
+    /*
+     * C and C++: `obj.field`, `ptr->field`, and `s.c_str`.
+     *
+     * Its receiver sits in the `argument` field rather than `object`, which is
+     * why the lookup below tries several names. Without this entry `s.c_str()`
+     * had no receiver at all, so a tainted std::string went clean the moment
+     * anybody called the one method that gets the bytes out of it - which is the
+     * only way a std::string ever reaches system().
+     */
+    'field_expression',
+]);
+/** Assignment targets that write ONE element of a container: `m['k']`, `a[i]`, `$a['k']`. */
+const ELEMENT_TARGETS = new Set(['subscript', 'subscript_expression', 'index_expression', 'array_access']);
+/** Container literals: `{...}`, `[...]`, `array(...)`, Java `{a, b}`. */
+const CONTAINER_LITERALS = new Set(['dictionary', 'list', 'array', 'object', 'array_creation_expression', 'array_initializer', 'composite_literal']);
+/**
+ * Calls that COMPILE a query and hand back a statement handle.
+ *
+ * After `stmt, err := db.Prepare(sql)`, the arguments to `stmt.QueryRow(uid)`
+ * are bound parameters - the database keeps them separate from the
+ * instruction, which is the whole point of preparing. Reporting them as
+ * injection punishes the correct fix, which is the worst thing a SQL rule can
+ * do. So we remember which local names hold a prepared statement.
+ *
+ * Note what this does NOT excuse: `db.Prepare(dynamicSql)` is still a sink,
+ * because a query assembled from user input is dangerous whether or not it is
+ * prepared afterwards.
+ */
+const PREPARE_CALLS = new Set([
+    'Prepare',
+    'PrepareContext',
+    'Preparex',
+    'PrepareNamed',
+    'prepareStatement',
+    'prepareCall',
+]);
+const CALL_NODES = new Set([
+    'call_expression',
+    'call',
+    'new_expression',
+    'method_invocation', // Java
+    'object_creation_expression', // Java  new Foo(...)
+    'function_call_expression', // PHP  foo(...)
+    'member_call_expression', // PHP  $obj->foo(...)
+    'scoped_call_expression', // PHP  Foo::bar(...)
+]);
+const STRING_NODES = new Set([
+    'string',
+    'template_string',
+    'concatenated_string',
+    'string_literal', // Java
+    'text_block', // Java
+    'interpreted_string_literal', // Go
+    'raw_string_literal', // Go
+    'encapsed_string', // PHP  "text $var"
+    'heredoc', // PHP
+]);
+const INTERPOLATION_NODES = new Set(['template_substitution', 'interpolation']);
+/**
+ * A string literal's text without its prefix and delimiters: `f"..."`,
+ * `'...'`, `"""..."""`, and a PHP heredoc's first and last lines.
+ */
+function stringContent(raw) {
+    if (raw.startsWith('<<<')) {
+        const lines = raw.split('\n');
+        return lines.slice(1, -1).join('\n');
+    }
+    const open = raw.search(/["'`]/);
+    if (open === -1)
+        return raw;
+    const quote = raw[open];
+    const width = raw.startsWith(quote.repeat(3), open) ? 3 : 1;
+    const end = raw.length - width >= open + width ? raw.length - width : raw.length;
+    return raw.slice(open + width, end);
+}
+/** The text of a string literal from just after its opening delimiter - for a prefix ending mid-string. */
+function afterOpening(raw) {
+    if (raw.startsWith('<<<')) {
+        const newline = raw.indexOf('\n');
+        return newline === -1 ? '' : raw.slice(newline + 1);
+    }
+    const open = raw.search(/["'`]/);
+    if (open === -1)
+        return raw;
+    const quote = raw[open];
+    const width = raw.startsWith(quote.repeat(3), open) ? 3 : 1;
+    return raw.slice(open + width);
+}
+/**
+ * The literal text a string-building expression contributes, in order. Parts
+ * that are not literals - variables, calls - contribute nothing, which is the
+ * cautious reading: a quote this engine cannot see is not counted as there.
+ */
+function literalTextOf(node) {
+    if (!node)
+        return '';
+    if (STRING_NODES.has(node.type))
+        return stringContent(node.text);
+    if (node.type === 'parenthesized_expression') {
+        return literalTextOf(node.namedChildren.find((c) => c !== null) ?? null);
+    }
+    if (node.type === 'binary_expression' || node.type === 'binary_operator') {
+        const operator = node.childForFieldName('operator')?.text ?? '';
+        if (operator !== '+' && operator !== '.')
+            return '';
+        return literalTextOf(node.childForFieldName('left')) + literalTextOf(node.childForFieldName('right'));
+    }
+    return '';
+}
+/**
+ * Does a value spliced in right after this text sit inside a quoted string?
+ * An odd number of single or double quotes before it says it does. A backtick
+ * is NOT counted: it quotes an identifier, and escaping does not touch it.
+ */
+function opensAQuote(textBefore) {
+    const singles = (textBefore.match(/'/g) ?? []).length;
+    const doubles = (textBefore.match(/"/g) ?? []).length;
+    return singles % 2 === 1 || doubles % 2 === 1;
+}
+/**
+ * Nodes that BUILD a container out of listed elements.
+ *
+ * `Object[] obj = {"a", bar};` then `writer.format(fmt, obj)` is one of the
+ * commonest real XSS shapes in Java, and the trace used to die at the brace:
+ * `bar` was tainted, `obj` was not, and the sink saw a clean array.
+ *
+ * A container is tainted WHOLE, exactly as ENGINE_CAPABILITIES already says for
+ * `list.add(dirty)`. That is imprecise - element 0 here is the literal "a" and
+ * is perfectly clean - but a container holding one dirty element is a dirty
+ * container for every purpose a sink cares about, and erring the other way
+ * loses the finding entirely.
+ */
+/**
+ * Nodes whose body may or may not run.
+ *
+ * Used for one narrow decision: whether a CLEAN assignment is allowed to erase
+ * a variable's taint. Consider the shape that dominates the OWASP benchmark:
+ *
+ *     if ((500 / 42) + num > 200) bar = param;   // param is attacker input
+ *     else bar = "This should never happen";
+ *
+ * Reading statements in order, the else branch is simply the last write, so
+ * `bar` came out clean and the finding vanished - even though the two branches
+ * are mutually exclusive and one of them hands the attacker's value straight
+ * to the page.
+ *
+ * We do not evaluate the condition; that is a different and much larger piece
+ * of work. We make the weaker claim that a conditional write cannot PROVE a
+ * value clean. So taint set anywhere survives a clean write inside a branch,
+ * while an unconditional write still clears it, because that one really does
+ * happen every time.
+ *
+ * The direction matters: this errs toward reporting a value that might be
+ * clean, rather than staying silent about one that might be dirty.
+ */
+/**
+ * The loop variable and the collection of a for-each, per grammar.
+ *
+ * Every language spells this differently and two of them hide the parts inside
+ * an intermediate node, which is why a single childForFieldName() call would
+ * have worked for Java and quietly returned nothing for the rest - the same
+ * shape of mistake as the if-statement's `consequence` vs `body`, recorded in
+ * rules/lib/guards.ts.
+ */
+const FOREACH_NODES = new Set([
+    'enhanced_for_statement', // Java   for (String v : values)
+    'for_in_statement', // JS/TS  for (const v of values)
+    'for_statement', // Python for v in values      (also Go's plain for)
+    'for_range_loop', // Go     for _, v := range values
+    'foreach_statement', // PHP    foreach ($values as $v)
+]);
+function foreachBinding(node) {
+    // Java: `name` and `value` fields. JS/TS and Python: `left` and `right`.
+    const name = node.childForFieldName('name') ?? node.childForFieldName('left');
+    const iterable = node.childForFieldName('value') ?? node.childForFieldName('right');
+    if (name && iterable)
+        return { name, iterable };
+    // Go hides both inside a range_clause child; PHP has no fields at all and
+    // spells it `foreach (EXPR as $v)`, so the last variable before the body is
+    // the binding and the first expression is the collection.
+    const range = node.namedChildren.find((c) => c?.type === 'range_clause');
+    if (range) {
+        const left = range.childForFieldName('left');
+        const right = range.childForFieldName('right');
+        if (left && right) {
+            // `for _, v := range values` - the VALUE is the second name, not the index.
+            const names = left.namedChildren.filter((c) => c !== null);
+            const chosen = names.length > 1 ? names[names.length - 1] : names[0];
+            if (chosen)
+                return { name: chosen, iterable: right };
+        }
+        return null;
+    }
+    if (node.type === 'foreach_statement') {
+        const parts = node.namedChildren.filter((c) => c !== null);
+        const body = node.childForFieldName('body');
+        const beforeBody = body ? parts.filter((c) => c.startIndex < body.startIndex) : parts;
+        const iterablePhp = beforeBody[0];
+        const namePhp = beforeBody[beforeBody.length - 1];
+        // `foreach ($a as $k => $v)` puts the pair in a `pair` node; take its value.
+        const resolved = namePhp?.type === 'pair' || namePhp?.type === 'by_ref'
+            ? namePhp.namedChildren[namePhp.namedChildCount - 1] ?? namePhp
+            : namePhp;
+        if (iterablePhp && resolved && iterablePhp !== resolved) {
+            return { name: resolved, iterable: iterablePhp };
+        }
+    }
+    return null;
+}
+/**
+ * Calls that APPLY a function to every element of a collection.
+ *
+ * Deliberately tiny. These are the shapes where naming a sanitiser is the same
+ * as calling it on each element; anything looser would let an arbitrary
+ * callback argument read as proof of safety.
+ */
+const HIGHER_ORDER_APPLIERS = new Set(['map', 'imap', 'starmap', 'forEach']);
+/** Comprehensions, which apply their element expression to every item. */
+const COMPREHENSION_NODES = new Set([
+    'list_comprehension',
+    'dictionary_comprehension',
+    'set_comprehension',
+    'generator_expression',
+]);
+const CONDITIONAL_NODES = new Set([
+    'if_statement',
+    'else_clause',
+    'switch_statement',
+    'switch_block',
+    'switch_expression',
+    /*
+     * GO'S SWITCHES WERE MISSING FROM THIS LIST, and it cost real findings.
+     *
+     * This set is how the tracer knows a write might not happen. Go spells its
+     * switch `expression_switch_statement`, not `switch_statement`, so a clean
+     * write in ANY case of a Go switch was treated as certain and erased the
+     * taint - `bar := input; switch len(bar) { case 1: bar = "safe" }` left `bar`
+     * clean. The same logic written as an `if` was reported. switch-constant.go.
+     */
+    'expression_switch_statement',
+    'type_switch_statement',
+    'select_statement',
+    'ternary_expression',
+    'conditional_expression',
+    'case_statement',
+    'match_statement',
+    'try_statement',
+    'catch_clause',
+    'for_statement',
+    'while_statement',
+    'do_statement',
+    'enhanced_for_statement',
+    'for_in_statement',
+    'for_range_loop',
+    'foreach_statement',
+]);
+/** Java literal node types: a map value of one of these is a constant. */
+const JAVA_LITERALS = new Set([
+    'string_literal', 'character_literal', 'decimal_integer_literal', 'hex_integer_literal',
+    'octal_integer_literal', 'binary_integer_literal', 'decimal_floating_point_literal',
+    'true', 'false', 'null_literal',
+]);
+const CONTAINER_NODES = new Set([
+    'array_initializer', // Java   {"a", bar}
+    'array_creation_expression', // Java   new String[]{...}   PHP  array(...)
+    'array', // JS/TS  [a, b]
+    'list', // Python [a, b]
+    'tuple',
+    'set',
+    'dictionary',
+    'composite_literal', // Go     []string{a, b}
+]);
+function text(node) {
+    return (node?.text ?? '').replace(/\s+/g, ' ').trim();
+}
+/**
+ * The method name at the end of a callee expression.
+ *
+ * The first version cut the string at the first "(" and then split on dots.
+ * That worked for `db.query` and broke silently on Java's
+ * `Runtime.getRuntime().exec` - cutting at the paren left "Runtime.getRuntime",
+ * so the name came back as `getRuntime` and the command-injection sink never
+ * matched. Taking the trailing identifier instead is both simpler and correct
+ * for every chained call.
+ */
+function lastSegment(value) {
+    const match = value.match(/([A-Za-z_$][\w$]*)\s*$/);
+    return match?.[1] ?? value.trim();
+}
+/**
+ * Strip a C declarator down to the name it declares.
+ *
+ * `char *user = getenv("X")` gives an assignment whose TARGET is the whole
+ * declarator, `*user`, not the identifier. The binding loop below rejects any
+ * name that is not a plain identifier - a deliberate guard against binding
+ * taint to something it cannot name - so `*user` was silently dropped, `user`
+ * read as clean, and every C flow through a pointer variable died on the
+ * declaration line.
+ *
+ * It was invisible because the shapes that DO work are common enough to look
+ * like success: `char buf[64]` is an array_declarator whose text is `buf[64]`,
+ * whose last segment is a clean name, and a plain `p = argv[1]` never goes
+ * through a declarator at all. Only the pointer form broke, which is most of
+ * real C.
+ *
+ * Deliberately conservative: it removes leading `*` and `&` and any array
+ * suffix, and returns the input unchanged if what is left is not a plain
+ * identifier. A declarator this cannot reduce is still refused rather than
+ * guessed at.
+ */
+function stripDeclarator(value) {
+    const stripped = value.trim().replace(/^[*&\s]+/, '').replace(/\s*\[[^\]]*\]\s*$/, '').trim();
+    return /^[A-Za-z_$][\w$]*$/.test(stripped) ? stripped : value;
+}
+/**
+ * "What is being called, and on what?"
+ *
+ * Every grammar spells this differently. JS and Python put the whole callee in
+ * a `function` field. Java's `method_invocation` does NOT - it keeps the
+ * receiver and the method name as separate children, so `stmt.executeQuery(x)`
+ * has no single node meaning "stmt.executeQuery". We rebuild it here so the
+ * rest of the tracer can stay grammar-agnostic.
+ */
+function calleeOf(callNode) {
+    const fn = callNode.childForFieldName('function') ?? callNode.childForFieldName('constructor') ?? null;
+    if (fn) {
+        const receiver = MEMBER_NODES.has(fn.type)
+            ? fn.childForFieldName('object') ??
+                fn.childForFieldName('operand') ??
+                fn.childForFieldName('argument') ?? // C/C++ field_expression
+                fn.namedChildren[0] ??
+                null
+            : null;
+        return { node: fn, text: text(fn), receiver };
+    }
+    const name = callNode.childForFieldName('name'); // Java method_invocation
+    const object = callNode.childForFieldName('object');
+    if (name) {
+        return {
+            node: name,
+            text: object ? `${text(object)}.${text(name)}` : text(name),
+            receiver: object,
+        };
+    }
+    const type = callNode.childForFieldName('type'); // Java new Foo(...)
+    if (type)
+        return { node: type, text: text(type), receiver: null };
+    return { node: null, text: '', receiver: null };
+}
+function argumentsOf(callNode) {
+    const argsNode = callNode.childForFieldName('arguments');
+    if (!argsNode)
+        return [];
+    return argsNode.namedChildren
+        .filter((n) => n !== null)
+        // PHP wraps each argument in an `argument` node - unwrap it, or every
+        // argument the tracer inspects is a container rather than the expression.
+        .map((n) => (n.type === 'argument' ? (n.namedChildren.find((c) => c !== null) ?? n) : n));
+}
+/**
+ * The parameter NAMES of a function, in whichever way its grammar spells them.
+ * We need names, not types: to follow a value into a function we bind the
+ * incoming taint to the name the body will use to refer to it.
+ */
+/**
+ * The identifier a function definition binds, across grammars.
+ *
+ * Every language this engine supported until C put the name in a `name` field.
+ * C puts it inside a declarator: function_definition.declarator is a
+ * function_declarator, and ITS declarator is the identifier. Pointer-returning
+ * functions nest one level deeper again (`char *f(void)` wraps the whole thing
+ * in a pointer_declarator), so this walks down rather than assuming a depth.
+ */
+function functionNameOf(fnNode) {
+    const direct = fnNode.childForFieldName('name');
+    if (direct)
+        return direct;
+    let node = fnNode.childForFieldName('declarator');
+    for (let depth = 0; node && depth < 6; depth++) {
+        if (node.type === 'identifier' || node.type === 'field_identifier')
+            return node;
+        node = node.childForFieldName('declarator');
+    }
+    return null;
+}
+/** The parameter list, which C hangs off the declarator rather than the definition. */
+function parameterListOf(fnNode) {
+    const direct = fnNode.childForFieldName('parameters');
+    if (direct)
+        return direct;
+    let node = fnNode.childForFieldName('declarator');
+    for (let depth = 0; node && depth < 6; depth++) {
+        const params = node.childForFieldName('parameters');
+        if (params)
+            return params;
+        node = node.childForFieldName('declarator');
+    }
+    return null;
+}
+function parameterNames(fnNode) {
+    const container = parameterListOf(fnNode);
+    if (!container) {
+        // Single-parameter arrow function: `x => ...` has no parameter list node.
+        const bare = fnNode.childForFieldName('parameter');
+        return bare ? [text(bare)] : [];
+    }
+    const names = [];
+    for (const child of container.namedChildren) {
+        if (!child)
+            continue;
+        if (VARIABLE_NODES.has(child.type)) {
+            names.push(text(child));
+            continue;
+        }
+        // typed_parameter / required_parameter / formal_parameter / parameter_declaration
+        const named = child.childForFieldName('name') ??
+            child.childForFieldName('pattern') ??
+            // C: parameter_declaration's name lives in `declarator`, and arrives with
+            // its pointer stars attached (`*dst`). stripDeclarator removes them.
+            child.childForFieldName('declarator') ??
+            null;
+        if (named) {
+            names.push(stripDeclarator(text(named)));
+            continue;
+        }
+        const identifier = child.namedChildren.find((c) => c !== null && VARIABLE_NODES.has(c.type));
+        names.push(identifier ? text(identifier) : '');
+    }
+    return names;
+}
+/**
+ * Parameter declarations with their FULL text, annotations included.
+ *
+ * `parameterNames` above deliberately returns only names, because binding a
+ * caller's argument to a callee's name is all it is for. Recognising a Spring
+ * binding needs the opposite half - the annotation sitting in front of the
+ * name - so this returns both rather than making the other function lie about
+ * what it does.
+ */
+function parameterDeclarations(fnNode) {
+    const container = fnNode.childForFieldName('parameters');
+    if (!container)
+        return [];
+    const out = [];
+    for (const child of container.namedChildren) {
+        if (!child)
+            continue;
+        // A bare `def view(name)` parameter IS the identifier - it has no children.
+        const named = VARIABLE_NODES.has(child.type)
+            ? child
+            : child.childForFieldName('name') ??
+                child.childForFieldName('pattern') ??
+                child.namedChildren.find((c) => c !== null && VARIABLE_NODES.has(c.type)) ??
+                null;
+        if (!named)
+            continue;
+        out.push({ name: text(named), text: text(child), node: child });
+    }
+    return out;
+}
+/**
+ * A URL PATH THAT NAMES THIS PARAMETER, read off a Python route decorator.
+ *
+ *     @app.route("/user/<name>")        Flask, <converter:name> too
+ *     @router.get("/items/{item_id}")   FastAPI / Starlette
+ *     def view(name): ...
+ *
+ * The framework splits the URL and passes the segment as a plain str, so the
+ * body holds no source to match - the placeholder in the decorator is the
+ * only evidence, which is why parameterSources (one regex per parameter's own
+ * text) cannot see it. Only a parameter the path NAMES is bound: a decorator
+ * that is not a route method, or a parameter with no placeholder, binds
+ * nothing (route-path-params.py). Django binds kwargs in a separate urls.py
+ * and is not read here.
+ */
+const ROUTE_DECORATOR = /^@[\w.]+\.(?:route|get|post|put|patch|delete|api_route)\(\s*[rRbBuU]?(["'])(.*?)\1/s;
+function routePathFor(fnNode, name) {
+    const parent = fnNode.parent;
+    if (!name || parent?.type !== 'decorated_definition')
+        return null;
+    for (const decorator of parent.namedChildren) {
+        if (decorator?.type !== 'decorator')
+            continue;
+        const path = ROUTE_DECORATOR.exec(text(decorator))?.[2];
+        if (!path)
+            continue;
+        for (const match of path.matchAll(/<(?:[^<>:]+:)?(\w+)>|\{(\w+)(?::[^}]*)?\}/g)) {
+            if ((match[1] ?? match[2]) === name)
+                return `"${path}"`;
+        }
+    }
+    return null;
+}
+/**
+ * DECLARED TYPES, so a receiver check can see past the variable's name.
+ *
+ * `receiverPattern` matches the TEXT in front of the call, which works for
+ * `Runtime.getRuntime().exec(cmd)` and fails completely for the form
+ * BenchmarkJava actually uses 188 times:
+ *
+ *     Runtime r = Runtime.getRuntime();
+ *     r.exec(cmd);
+ *
+ * The receiver is `r`. Scoping `exec` to a runtime-looking receiver removed 16
+ * false positives and 13 TRUE ones in the same change - a straight trade, not
+ * an improvement, and the benchmark said so within a minute.
+ *
+ * Java, Go and TypeScript all write the type down at the declaration, so it is
+ * there to be read. This is one shallow pass over the file collecting
+ * `Type name = ...` and `var name Type`; it is not type inference and does not
+ * pretend to be. A name declared twice with different types in one file is
+ * recorded once and is a known imprecision - the alternative is threading a
+ * type environment through every scope, which is a much larger change than the
+ * problem justifies.
+ */
+function declaredTypes(root, language) {
+    const types = new Map();
+    if (language !== 'java' && language !== 'go' && language !== 'typescript')
+        return types;
+    const visit = (node, depth) => {
+        if (depth > 60)
+            return;
+        if (node.type === 'local_variable_declaration' ||
+            node.type === 'field_declaration' ||
+            node.type === 'var_declaration' ||
+            node.type === 'var_spec') {
+            const typeNode = node.childForFieldName('type');
+            const typeText = typeNode ? text(typeNode) : '';
+            if (typeText) {
+                for (const child of node.namedChildren) {
+                    if (!child)
+                        continue;
+                    const nameNode = child.type === 'variable_declarator'
+                        ? child.childForFieldName('name')
+                        : VARIABLE_NODES.has(child.type)
+                            ? child
+                            : null;
+                    if (nameNode)
+                        types.set(text(nameNode), typeText);
+                }
+            }
+        }
+        for (const child of node.namedChildren)
+            if (child)
+                visit(child, depth + 1);
+    };
+    visit(root, 0);
+    return types;
+}
+/**
+ * The bare NAME of a receiver, with the language's decoration removed.
+ *
+ * PHP writes `$conn->query(...)`, and comparing "$conn" against a list holding
+ * "conn" fails silently - which is exactly what happened: scoping the PHP SQL
+ * sink dropped two asserted flow-verified findings and resurrected a false
+ * positive in the safe fixture, because the receiver never matched anything and
+ * the tracer stopped proving the sanitiser ran.
+ *
+ * Go pointers (`*db`), references (`&db`) and PHP's sigil are punctuation about
+ * how the value is held, not about what it is. The last segment after a dot is
+ * the object being called on.
+ */
+function ownerName(receiverText) {
+    const last = receiverText.split(/[.\s(\[]/).filter(Boolean).pop() ?? receiverText;
+    return last.replace(/^[$*&]+/, '');
+}
+/**
+ * LOCAL ALIASES OF A DANGEROUS FUNCTION.
+ *
+ *     import { exec } from "child_process";
+ *     const execAsync = promisify(exec);
+ *     await execAsync(command);            // <- invisible to a name list
+ *
+ * That is CVE-2025-53107, twenty-three vulnerable files, and we found zero of
+ * them. The sink list holds `exec`; the call says `execAsync`. Nothing about
+ * the danger changed - only the label on it.
+ *
+ * The near-identical CVE-2025-59046 WAS caught, and only because that author
+ * happened to write `const exec = promisify(execCb)` - aliasing back to the
+ * name we already knew. Two CVEs, one real difference between them, and it was
+ * luck.
+ *
+ * `promisify` is the standard Node idiom for exactly these APIs, so this is not
+ * an exotic shape; it is the normal one. This pass reads the file for
+ * declarations that bind a known sink name to a new identifier and returns the
+ * mapping, so the sink check can recognise both.
+ *
+ * FILE-LOCAL ONLY. An alias exported from another module is still missed, and
+ * that is a documented gap rather than a silent one.
+ */
+function sinkAliases(root, knownSinkNames) {
+    const aliases = new Map();
+    const visit = (node, depth) => {
+        if (depth > 40)
+            return;
+        if (node.type === 'variable_declarator' || node.type === 'short_var_declaration') {
+            const nameNode = node.childForFieldName('name') ?? node.childForFieldName('left');
+            const valueNode = node.childForFieldName('value') ?? node.childForFieldName('right');
+            if (nameNode && valueNode) {
+                const alias = text(nameNode);
+                const initialiser = text(valueNode);
+                // Only wrappers that PASS THE FUNCTION ALONG: promisify(fn),
+                // util.promisify(fn), require('child_process').fn, cp.fn.
+                if (/^(?:[\w.]*\bpromisify\s*\(|require\s*\(|[\w$]+\.)/.test(initialiser)) {
+                    for (const sinkName of knownSinkNames) {
+                        if (alias === sinkName)
+                            continue;
+                        if (new RegExp(`\\b${sinkName}\\b`).test(initialiser)) {
+                            aliases.set(alias, sinkName);
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        for (const child of node.namedChildren)
+            if (child)
+                visit(child, depth + 1);
+    };
+    visit(root, 0);
+    return aliases;
+}
+/*
+ * A parameter that makes the argument count flexible: a default value, or a
+ * variadic tail. Matched on node type across the grammars, because each spells
+ * both differently - spread_parameter (Java), variadic_parameter_declaration
+ * (Go), variadic_parameter / optional_parameter_declaration (C, C++),
+ * default_parameter / list_splat_pattern (Python), rest_pattern /
+ * assignment_pattern / optional_parameter (JS, TS).
+ */
+const VARIADIC_PARAMETER = /spread|variadic|splat|rest_pattern|rest_parameter/;
+const DEFAULTED_PARAMETER = /default|optional|assignment_pattern/;
+function argumentRange(fnNode) {
+    const list = parameterListOf(fnNode);
+    if (!list)
+        return { minArgs: 0, maxArgs: Infinity };
+    const params = list.namedChildren.filter((c) => c !== null && c.type !== 'comment');
+    // C's `f(void)` is a list holding one parameter that means "none".
+    if (params.length === 1 && (params[0]?.text ?? '').trim() === 'void')
+        return { minArgs: 0, maxArgs: 0 };
+    let min = 0;
+    let max = 0;
+    for (const p of params) {
+        if (VARIADIC_PARAMETER.test(p.type) || (p.text ?? '').includes('...'))
+            return { minArgs: min, maxArgs: Infinity };
+        max++;
+        if (!DEFAULTED_PARAMETER.test(p.type))
+            min++;
+    }
+    return { minArgs: min, maxArgs: max };
+}
+/*
+ * A declaration with no body is not somewhere a value can go.
+ *
+ * An interface method, an abstract method, a signature: the tracer indexed them
+ * like functions, and the index keeps the FIRST definition of a name. So when a
+ * Java interface sat above its implementation - the normal way round - calls
+ * resolved to `String clean(String s);`, found nothing inside, and the value
+ * vanished. Swap the two declarations and the same call was flow-verified.
+ * DeclarationOrder.java is that case.
+ */
+const BODYLESS_DECLARATION = /declaration|definition|signature/;
+const FUNCTION_TYPES_BY_LANGUAGE = FUNCTION_NODES;
+/** Languages where calling with the wrong number of arguments cannot compile. */
+const ARITY_ENFORCED = new Set(['java', 'go', 'c', 'cpp']);
+/** `org.acme.Thing<String>[]` -> `Thing`. */
+function simpleTypeName(raw) {
+    return raw.replace(/<[^>]*>/g, '').replace(/\[\]/g, '').trim().split('.').pop() ?? '';
+}
+/**
+ * The declared type of a Java call's receiver, when it is written down nearby:
+ * `new X(...).m()`, or a local variable / parameter / field declared in the
+ * enclosing method or class. Anything else - `this`, a chain, a static class
+ * reference, `var` - returns null, and the call is resolved exactly as before.
+ */
+function javaReceiverType(call) {
+    if (call.type !== 'method_invocation')
+        return null;
+    const receiver = call.childForFieldName('object');
+    if (!receiver)
+        return null;
+    if (receiver.type === 'object_creation_expression') {
+        return simpleTypeName(receiver.childForFieldName('type')?.text ?? '') || null;
+    }
+    if (receiver.type !== 'identifier')
+        return null;
+    const name = receiver.text ?? '';
+    const types = new Set();
+    const collect = (scope, stopAtNested) => {
+        if (!scope)
+            return;
+        const visit = (n) => {
+            if (n.type === 'formal_parameter' && n.childForFieldName('name')?.text === name) {
+                types.add(simpleTypeName(n.childForFieldName('type')?.text ?? ''));
+            }
+            if (n.type === 'local_variable_declaration' || n.type === 'field_declaration') {
+                for (const d of n.namedChildren) {
+                    if (d?.type === 'variable_declarator' && d.childForFieldName('name')?.text === name) {
+                        types.add(simpleTypeName(n.childForFieldName('type')?.text ?? ''));
+                    }
+                }
+            }
+            for (const child of n.namedChildren) {
+                if (!child)
+                    continue;
+                if (stopAtNested && /^(method|constructor)_declaration$|^class_body$/.test(child.type))
+                    continue;
+                visit(child);
+            }
+        };
+        visit(scope);
+    };
+    let method = call.parent;
+    while (method && !/^(method|constructor)_declaration$|^lambda_expression$/.test(method.type)) {
+        method = method.parent;
+    }
+    collect(method, false);
+    if (types.size === 0) {
+        // A field of the enclosing class: search the class body, not other methods.
+        let klass = method?.parent ?? null;
+        while (klass && klass.type !== 'class_body')
+            klass = klass.parent;
+        collect(klass, true);
+    }
+    types.delete('');
+    if (types.size !== 1 || types.has('var'))
+        return null;
+    return [...types][0] ?? null;
+}
+/** The class, interface, enum or record a function body is declared in. */
+function declaringTypeOf(fn) {
+    let n = fn.body.parent;
+    while (n && !/^(class|interface|enum|record)_declaration$/.test(n.type))
+        n = n.parent;
+    return n?.childForFieldName('name')?.text ?? null;
+}
+/**
+ * Index every function in a tree by name. Exported because the cross-file
+ * resolver needs exactly the same view of another file that the tracer has of
+ * this one - if the two disagreed about what counts as a function, a value
+ * could be followed into something that is not there.
+ */
+export function collectFunctions(root, language) {
+    const functionTypes = new Set(FUNCTION_TYPES_BY_LANGUAGE[language] ?? []);
+    const found = new Map();
+    const register = (name, fnNode) => {
+        if (!name || found.has(name))
+            return;
+        const bodyNode = fnNode.childForFieldName('body');
+        if (!bodyNode && BODYLESS_DECLARATION.test(fnNode.type))
+            return; // see BODYLESS_DECLARATION
+        const body = bodyNode ?? fnNode;
+        found.set(name, { name, params: parameterNames(fnNode), body, ...argumentRange(fnNode) });
+    };
+    const visit = (node) => {
+        if (functionTypes.has(node.type)) {
+            const nameNode = functionNameOf(node);
+            if (nameNode)
+                register(text(nameNode), node);
+        }
+        // `const helper = (x) => {...}` - the name is on the declarator.
+        const value = node.childForFieldName('value') ?? node.childForFieldName('right');
+        const name = node.childForFieldName('name') ?? node.childForFieldName('left');
+        if (value && name && functionTypes.has(value.type))
+            register(text(name), value);
+        for (const child of node.namedChildren)
+            if (child)
+                visit(child);
+    };
+    visit(root);
+    return found;
+}
+/**
+ * A FLASK ROUTE RETURNING A STR IS AN HTML PAGE, TAGS OR NOT.
+ *
+ * The return sink otherwise needs visible markup, because most functions that
+ * return a string are not views. BenchmarkPython's 31 real XSS cases return
+ * `f"bar is '{bar}'"` from `@app.route` - Flask sends a returned str as
+ * text/html, so `<script>` in bar runs - and all 31 were silent.
+ *
+ * Both halves are proven, not guessed:
+ *   - the function carries a `@<x>.route(...)` decorator (Flask, Blueprint,
+ *     Quart). NOT FastAPI's `@app.get`, which JSON-encodes a returned str;
+ *   - the value is a str by construction: a string literal or f-string, a `+`
+ *     or `%` with a string literal on the left, or a name whose only writes in
+ *     the function are one `name = "<literal>"` and then `name += ...` (str +=
+ *     anything that is not a str raises, so it stays a str). A name that may
+ *     hold a dict - which Flask turns into JSON - never qualifies.
+ * A header set elsewhere (after_request, a config default) is not seen.
+ */
+function flaskRouteReturningStr(ret, expression) {
+    let fn = ret.parent;
+    while (fn && fn.type !== 'function_definition')
+        fn = fn.parent;
+    const decorated = fn?.parent?.type === 'decorated_definition' ? fn.parent : null;
+    if (!fn || !decorated)
+        return false;
+    const isRoute = decorated.namedChildren.some((d) => d?.type === 'decorator' && /^@\s*[\w.]+\.route\s*\(/.test(d.text));
+    if (!isRoute)
+        return false;
+    const strByConstruction = (e) => {
+        if (e.type === 'parenthesized_expression')
+            return !!e.namedChildren[0] && strByConstruction(e.namedChildren[0]);
+        if (e.type === 'string' || e.type === 'concatenated_string')
+            return true;
+        if (e.type === 'binary_operator') {
+            const op = e.childForFieldName('operator')?.text;
+            const left = e.childForFieldName('left');
+            return (op === '+' || op === '%') && !!left && strByConstruction(left);
+        }
+        return false;
+    };
+    if (strByConstruction(expression))
+        return true;
+    if (expression.type !== 'identifier')
+        return false;
+    const name = expression.text;
+    let initial = 0;
+    let other = false;
+    const visit = (n) => {
+        if (other)
+            return;
+        if (n.type === 'assignment' || n.type === 'augmented_assignment') {
+            const left = n.childForFieldName('left');
+            if (left?.text === name) {
+                const op = n.type === 'augmented_assignment' ? n.childForFieldName('operator')?.text : '=';
+                const right = n.childForFieldName('right');
+                if (op === '=' && right && strByConstruction(right))
+                    initial++;
+                else if (op !== '+=')
+                    other = true;
+            }
+            else if (left && new RegExp(`(^|[^\\w])${name}([^\\w]|$)`).test(left.text))
+                other = true;
+        }
+        else if (n.type === 'identifier' && n.text === name && n.parent && /^(for_statement|with_item|global_statement|nonlocal_statement|named_expression|parameters|typed_parameter|default_parameter)$/.test(n.parent.type)) {
+            other = true;
+        }
+        for (const c of n.namedChildren)
+            if (c)
+                visit(c);
+    };
+    visit(fn);
+    return !other && initial === 1;
+}
+export function traceFile(file, language, resolver, 
+/**
+ * Absolute path -> the path a human should see. Resolution needs absolute
+ * paths; reports need short ones. Keeping both straight matters more once a
+ * single finding can name two different files.
+ */
+toDisplay = (p) => p) {
+    /**
+     * Blind spots, counted by SITE rather than by visit.
+     *
+     * A note on why, because the obvious reading of this code is wrong. A scan
+     * reported "3 hops through functions we do not model" while the printed flow
+     * paths showed only two, which looks exactly like double-counting: the
+     * tracer can reach one expression from both the expression walk and the
+     * statement walk, so a tally would plausibly count it twice.
+     *
+     * It was measured, and that is NOT what was happening - raw visits equalled
+     * distinct sites on every corpus tried. The third hop was a real, separate
+     * site (`db.Query(query)`, whose tainted RESULT flows on) that simply never
+     * reached a sink, so no finding carried it.
+     *
+     * The Set stays, because counting a site twice would be wrong if the walk
+     * ever changed. But it fixed nothing that was broken, and saying otherwise
+     * here would be the same kind of confident wrong answer this file exists to
+     * avoid. What was actually wrong was the LABEL - see the blind-spot text in
+     * core/score.ts, which now says these are scan-wide rather than per-finding.
+     */
+    const seenDepth = new Set();
+    const seenRecursion = new Set();
+    const seenUnmodelled = new Set();
+    /**
+     * A call's receiver type, per call site. Working it out means walking the
+     * enclosing method for the receiver's declaration, and the same call is
+     * evaluated once per taint shape that reaches it - done eagerly for every
+     * call, that walk made a BenchmarkJava scan 65% slower (40s to 67s). Keyed by
+     * file and span rather than node id, because a node id is a memory address
+     * and can be reused once a tree is evicted from the budget.
+     */
+    const receiverTypes = new Map();
+    /** Sites where the syntax tree was deeper than MAX_AST_DEPTH. */
+    const seenDeepAst = new Set();
+    const siteOf = (n, filePath) => `${filePath}#${n.id}`;
+    const dictionary = TAINT_DICTIONARIES[language];
+    // Java and Go: no dictionary yet. Reported in the coverage section, not hidden.
+    const seenSources = new Set();
+    const limits = () => ({
+        astTruncations: seenDeepAst.size,
+        depthTruncations: seenDepth.size,
+        recursionStops: seenRecursion.size,
+        unmodelledHops: seenUnmodelled.size,
+        sourcesFound: seenSources.size,
+    });
+    if (!dictionary)
+        return { flows: [], sanitized: [], unreachable: [], resolvedReads: [], freshStops: [], limits: limits() };
+    const functionTypes = new Set(FUNCTION_NODES[language] ?? []);
+    const fileTypes = declaredTypes(file.root, language);
+    const knownSinkNames = new Set();
+    for (const sink of dictionary.callSinks)
+        for (const m of sink.methods)
+            knownSinkNames.add(m);
+    const fileAliases = sinkAliases(file.root, knownSinkNames);
+    const results = [];
+    const sanitized = [];
+    /*
+     * Every region skipped as unreachable, once each. Before this list existed the
+     * dead arm of an `if` was skipped with no record at all - a flow inside it
+     * simply never existed, and nothing in the report could say why a line that
+     * reads a request parameter went unreported.
+     */
+    const unreachable = [];
+    const unreachableSeen = new Set();
+    /*
+     * A map read answered by key rather than by "the whole collection is dirty".
+     * Recorded for the same reason as unreachable code: a finding that used to
+     * exist and now does not has to leave the decision behind it on the record.
+     */
+    const resolvedReads = [];
+    const resolvedSeen = new Set();
+    const noteResolvedRead = (node, filePath, why) => {
+        const key = `${filePath}\0${node.startIndex}:${node.endIndex}`;
+        if (resolvedSeen.has(key))
+            return;
+        resolvedSeen.add(key);
+        resolvedReads.push({ node, filePath: toDisplay(filePath), why });
+    };
+    /*
+     * Traces ended at a read whose result is new data (FreshResultSpec). The
+     * same reason as the two lists around it: a proof that used to be published
+     * and no longer is has to leave the decision on the record.
+     */
+    const freshStops = [];
+    const freshSeen = new Set();
+    const noteFreshStop = (node, filePath, why) => {
+        const key = `${filePath}\0${node.startIndex}:${node.endIndex}`;
+        if (freshSeen.has(key))
+            return;
+        freshSeen.add(key);
+        freshStops.push({ node, filePath: toDisplay(filePath), why });
+    };
+    const noteUnreachable = (node, filePath, why) => {
+        const key = `${filePath}\0${node.startIndex}:${node.endIndex}`;
+        if (unreachableSeen.has(key))
+            return;
+        unreachableSeen.add(key);
+        unreachable.push({ node, filePath: toDisplay(filePath), why });
+    };
+    /**
+     * The file we are standing in RIGHT NOW - not necessarily the file we were
+     * asked to scan. Saved and restored around every cross-file descent.
+     *
+     * A single mutable is safe here only because the walk is depth-first and
+     * synchronous: steps created during a descent get the callee's path, and the
+     * restore happens before the caller creates any more. If this ever becomes
+     * async, this variable becomes a bug.
+     */
+    let currentPath = file.path;
+    // Scopes are processed as a queue. The module top level is the first one;
+    // every nested function becomes another, seeded with a SNAPSHOT of the
+    // enclosing notebook so that callbacks can see variables defined outside them.
+    const queue = [
+        {
+            body: file.root,
+            env: new Map(),
+            filePath: file.path,
+            prepared: new Set(),
+            builders: new Set(),
+        },
+    ];
+    /* ---------------------------------------------------------------- *
+     * PHASE 3b: the call graph.
+     *
+     * Phase 3a stopped at the function boundary. `helper(req.query.id)` was the
+     * end of the trace, because guessing what `helper` does would have been
+     * exactly the kind of confident wrong answer this project refuses to give.
+     *
+     * Now we do not guess - we go and look. Every function defined in this file
+     * is indexed by name; when a tainted value is passed to one, we bind it to
+     * the parameter name and analyse that body with the taint already in place.
+     * Sinks inside the callee become findings whose path spans both functions.
+     *
+     * Three guards keep this honest and terminating:
+     *   MAX_CALL_DEPTH  stop after 4 nested calls. Deeper chains are missed and
+     *                   that is a stated gap, not a silent one.
+     *   callStack       a function already being analysed is not re-entered, so
+     *                   recursion cannot loop forever.
+     *   descendCache    each call site is followed once; both the expression path
+     *                   and the statement path read the same cached answer.
+     * ---------------------------------------------------------------- */
+    const MAX_CALL_DEPTH = 4;
+    const localFunctions = new Map();
+    const callStack = [];
+    const descendCache = new Map();
+    const localFunctionsFound = collectFunctions(file.root, language);
+    for (const [name, fn] of localFunctionsFound)
+        localFunctions.set(name, fn);
+    // Assigned after `walk` exists; `evaluateCall` reaches it through this box.
+    let descendIntoLocalCall = () => ({
+        handled: false,
+        taint: null,
+    });
+    const step = (kind, node, description, sanitizesKinds) => ({
+        kind,
+        location: nodeLocation(node, toDisplay(currentPath)),
+        description,
+        ...(sanitizesKinds ? { sanitizesKinds } : {}),
+    });
+    /**
+     * Is this WHOLE expression one a source names as not the client's - see
+     * SourceSpec.except? Then it is clean, and so is anything read straight out
+     * of it.
+     */
+    const exceptedSource = (expression) => dictionary.sources.some((s) => !!s.except && s.pattern.test(expression) && s.except.test(expression));
+    /** Does this expression's text look like a known attacker-controlled source? */
+    const sourceTaint = (node, expression) => {
+        for (const source of dictionary.sources) {
+            if (!source.pattern.test(expression))
+                continue;
+            seenSources.add(siteOf(node, currentPath));
+            return {
+                steps: [
+                    step('source', node, `\`${expression.slice(0, 60)}\` is ${source.description}`),
+                ],
+                sanitizedFor: new Set(),
+                origin: expression.slice(0, 60),
+                unknownHops: [],
+                ...(source.browserOnly ? { fromBrowser: true } : {}),
+                ...(source.localOnly ? { fromLocal: true } : {}),
+                ...(source.fileNameOnly ? { fileNameOnly: true } : {}),
+            };
+        }
+        return null;
+    };
+    const addStep = (taint, node, description) => ({
+        steps: [...taint.steps, step('propagation', node, description)],
+        sanitizedFor: taint.sanitizedFor,
+        origin: taint.origin,
+        unknownHops: taint.unknownHops,
+        compartment: taint.compartment,
+        branchAssumed: taint.branchAssumed,
+        containerGuess: taint.containerGuess,
+        collectedMany: taint.collectedMany,
+        quotePending: taint.quotePending,
+        urlPrefix: taint.urlPrefix,
+        fromBrowser: taint.fromBrowser,
+        fromLocal: taint.fromLocal,
+        fileNameOnly: taint.fileNameOnly,
+        joined: taint.joined,
+        afterWash: taint.afterWash,
+    });
+    /*
+     * A CHECK IS READ WHERE THE VALUE IS READ, not where it is used.
+     *
+     * The first version of validation guards lived at the sink: it took the
+     * text of the sink's argument, broke it into pieces, and asked whether each
+     * piece had been checked. Text is not a value. `$q = "... '$b'"` had no
+     * pieces at all - string nodes were skipped whole - so a check on `$a`
+     * vouched for `$b`, and DVWA-shaped code printed "checked and cleared" over
+     * a real injection. A call was worse: its arguments were the pieces, so a
+     * function returning request data looked like the checked value it was
+     * handed.
+     *
+     * Here a read of `$_GET['id']` inside `if (ctype_digit($_GET['id']))` comes
+     * back WASHED, like the output of a sanitiser, and everything built from it
+     * inherits that through the ordinary machinery - concatenation keeps only
+     * what both sides washed, so an unchecked value beside it stays dirty. The
+     * check becomes a step on the path, so a sink it does not cover (a URL host,
+     * which digits do not make safe) says so in words.
+     *
+     * VALUES BUILT BEFORE THE CHECK. DVWA's upload/impossible.php builds the
+     * file name from the extension FIRST and checks the extension after:
+     *
+     *     $name = bin2hex(random_bytes(16)) . '.' . $ext;
+     *     if (strtolower($ext) == 'jpg' || ...) { echo "<a href='$name'>"; }
+     *
+     * The check limits `$ext`, so it limits `$name` - but only while `$ext`
+     * still holds the very value `$name` was built from, and only if `$name`
+     * was built by joining strings, which keeps every character. `throughOf`
+     * records the variables a value was joined through, and `bindingOf` which
+     * assignment a variable's current value came from. Both live in WeakMaps
+     * and are set in exactly two places (a plain assignment, and string
+     * joining), so every other way of making a value - a call, a decode, a
+     * conditional write, a copy with one flag changed - silently has neither,
+     * and is never cleared this way. Absence is the safe default.
+     */
+    const guardOn = guardsApply(language);
+    const throughOf = new WeakMap();
+    const bindingOf = new WeakMap();
+    const guarded = (taint, node, expression, scope) => {
+        if (!guardOn)
+            return taint;
+        const facts = guardFactsAt(node, language);
+        if (facts.size === 0)
+            return taint;
+        let fact = facts.get(normalizeExpression(expression));
+        let via = null;
+        if (!fact) {
+            const through = throughOf.get(taint);
+            if (through) {
+                for (const [checked, candidate] of facts) {
+                    const current = scope.env.get(checked);
+                    const binding = current ? bindingOf.get(current) : undefined;
+                    if (binding && through.has(binding)) {
+                        fact = candidate;
+                        via = checked;
+                        break;
+                    }
+                }
+            }
+        }
+        if (!fact)
+            return taint;
+        const { kinds, insideQuotesOnly } = guardClears(fact);
+        const unconditional = kinds.filter((k) => !insideQuotesOnly.includes(k));
+        const before = taint.quotePending ?? [];
+        const added = kinds.filter((k) => !taint.sanitizedFor.has(k) || before.includes(k));
+        if (added.length === 0)
+            return taint;
+        // A kind washed for good leaves the quote question; a word adds SQL to it
+        // unless SQL was already washed for good by something earlier.
+        const pending = [
+            ...new Set([
+                ...before.filter((k) => !unconditional.includes(k)),
+                ...insideQuotesOnly.filter((k) => !taint.sanitizedFor.has(k) || before.includes(k)),
+            ]),
+        ];
+        const what = describeFact(fact);
+        return {
+            ...taint,
+            steps: [
+                ...taint.steps,
+                {
+                    ...step('sanitizer', node, via
+                        ? `built by joining strings from \`${via}\`, which still holds that same value here and was ${what}`
+                        : what, kinds),
+                    ...(insideQuotesOnly.length > 0 ? { quoteDependent: true, quoteKinds: insideQuotesOnly } : {}),
+                    guard: true,
+                },
+            ],
+            sanitizedFor: new Set([...taint.sanitizedFor, ...kinds]),
+            quotePending: pending.length > 0 ? pending : undefined,
+            afterWash: washedNow(taint.afterWash, kinds),
+        };
+    };
+    /**
+     * Several dirty values become one: a template, a container literal. The
+     * result is washed only for what EVERY part was washed for, and the path is
+     * told through the least-washed part, so a reader sees the value that is
+     * actually dangerous rather than its cleaned neighbour.
+     */
+    const joinParts = (parts) => {
+        const first = parts[0];
+        if (parts.length === 1)
+            return first;
+        const narrator = parts.reduce((a, b) => (b.sanitizedFor.size < a.sanitizedFor.size ? b : a));
+        const pending = [...new Set(parts.flatMap((p) => p.quotePending ?? []))];
+        const sanitizedFor = new Set([...first.sanitizedFor].filter((k) => parts.every((p) => p.sanitizedFor.has(k))));
+        return {
+            ...narrator,
+            sanitizedFor,
+            unknownHops: [...new Set(parts.flatMap((p) => p.unknownHops))],
+            quotePending: pending.length > 0 ? pending : undefined,
+            branchAssumed: parts.every((p) => p.branchAssumed) ? true : undefined,
+            containerGuess: parts.every((p) => p.containerGuess) ? true : undefined,
+            collectedMany: parts.some((p) => p.collectedMany) ? true : undefined,
+            // Where the FIRST dirty part starts is where the attacker's text starts.
+            urlPrefix: first.urlPrefix,
+            fromBrowser: parts.every((p) => p.fromBrowser) ? true : undefined,
+            fromLocal: parts.every((p) => p.fromLocal) ? true : undefined,
+            fileNameOnly: parts.every((p) => p.fileNameOnly) ? true : undefined,
+            joined: true,
+            afterWash: joinedAfterWash(parts, sanitizedFor),
+        };
+    };
+    /** What both joined values passed through - see `throughOf`. */
+    const joinedThrough = (left, right) => {
+        if (left && right) {
+            const a = throughOf.get(left);
+            const b = throughOf.get(right);
+            if (!a || !b)
+                return undefined;
+            const both = new Set([...a].filter((k) => b.has(k)));
+            return both.size > 0 ? both : undefined;
+        }
+        const only = left ?? right;
+        return only ? throughOf.get(only) : undefined;
+    };
+    /**
+     * WHERE AN ESCAPED VALUE IS SPLICED DECIDES WHETHER THE ESCAPING COUNTS.
+     *
+     * Inside quotes, escape-only cleaning (see SanitizerSpec.onlyInsideQuotes) is
+     * the whole defence, so it stands. Outside them it protects nothing: the
+     * kinds go back out of sanitizedFor, and the path says why, so a reader sees
+     * the escaping AND the reason it did not help.
+     */
+    const placeInString = (taint, quoted, node) => {
+        const pending = taint.quotePending;
+        if (!pending || pending.length === 0)
+            return taint;
+        if (quoted)
+            return { ...taint, quotePending: undefined };
+        return {
+            ...taint,
+            steps: [
+                ...taint.steps,
+                step('propagation', node, taint.steps.some((s) => s.quoteDependent && !s.guard)
+                    ? 'placed OUTSIDE quotes in the string it is built into, where the escaping applied earlier ' +
+                        'protects nothing - escaping only works on a value inside quotes'
+                    : 'placed OUTSIDE quotes in the string it is built into, where a word the check let through ' +
+                        'is read as SQL - a column name or a keyword - rather than as data'),
+            ],
+            sanitizedFor: new Set([...taint.sanitizedFor].filter((k) => !pending.includes(k))),
+            quotePending: undefined,
+        };
+    };
+    /**
+     * The heart of it: "is this expression dirty, and how did it get that way?"
+     * Returns null for "clean, or we cannot tell" - deliberately the same answer,
+     * because the engine never claims cleanliness it has not proven.
+     */
+    const evaluate = (node, scope, depth = 0) => {
+        if (!node || depth > 24)
+            return null;
+        const expression = text(node);
+        if (UNWRAP_NODES.has(node.type)) {
+            /*
+             * Take the VALUE, not the first named child.
+             *
+             * Every wrapper here used to be unwrapped by grabbing child 0, which is
+             * right for `(x)` and `await x` and wrong for a Java cast: the first
+             * named child of `(String) map.get("k")` is the type name `String`, so
+             * the tracer solemnly evaluated the word "String" and reported the value
+             * clean. `value` is the field the Java grammar gives the expression; the
+             * last named child is the fallback for wrappers that name no field.
+             */
+            const inner = node.childForFieldName('value') ??
+                (TYPE_FIRST_WRAPPERS.has(node.type)
+                    ? node.namedChildren.filter((c) => c !== null).pop() ?? null
+                    : node.namedChildren.find((c) => c !== null) ?? null);
+            return evaluate(inner, scope, depth + 1);
+        }
+        // Go writes `a, b := f(), g()`. A single-valued list is just the value.
+        // A multi-valued one we do not split - documented as a Go imprecision.
+        if (node.type === 'expression_list' && node.namedChildCount === 1) {
+            return evaluate(node.namedChildren[0] ?? null, scope, depth + 1);
+        }
+        if (VARIABLE_NODES.has(node.type)) {
+            const found = scope.env.get(expression) ?? sourceTaint(node, expression);
+            return found ? guarded(found, node, expression, scope) : null;
+        }
+        // `lst[1]` / `d['k']` on a local list or dict whose every write is on the
+        // page - see resolvePythonListRead / resolvePythonDictRead. A literal there
+        // is clean; a name nothing mentions between the write and here is traced
+        // as itself, with no guess attached. Anything else keeps the
+        // whole-container answer below.
+        if (language === 'python' && node.type === 'subscript') {
+            const read = resolveContainerRead(node, language);
+            const value = read?.value;
+            const where = read && `\`${expression.slice(0, 50)}\` returns what was stored at ${read.selector} on line ${read.write.startPosition.row + 1}`;
+            if (read && value &&
+                (['integer', 'float', 'true', 'false', 'none'].includes(value.type) ||
+                    (value.type === 'string' && !value.namedChildren.some((c) => c?.type === 'interpolation')))) {
+                noteResolvedRead(node, scope.filePath, `${where}, a literal`);
+                return null;
+            }
+            const fn = read && enclosingPythonFunction(node);
+            if (read && value?.type === 'identifier' && fn && !mentionedBetween(fn, value.text, read.write.endIndex, node.startIndex)) {
+                noteResolvedRead(node, scope.filePath, `${where}, \`${value.text}\``);
+                const stored = evaluate(value, scope, depth + 1);
+                return stored ? addStep(stored, node, `read back from \`${read.container}\` at ${read.selector}`) : null;
+            }
+        }
+        if (MEMBER_NODES.has(node.type)) {
+            if (exceptedSource(expression))
+                return null;
+            // `req.query.id` matches a source pattern as a whole.
+            const direct = sourceTaint(node, expression);
+            if (direct)
+                return guarded(direct, node, expression, scope);
+            // Otherwise dirt flows outward: if `data` is dirty, so is `data.name`.
+            const object = node.childForFieldName('object') ??
+                node.childForFieldName('value') ??
+                node.namedChildren.find((c) => c !== null) ??
+                null;
+            const inner = evaluate(object, scope, depth + 1);
+            if (!inner)
+                return null;
+            const read = addStep(inner, node, `read out of a tainted value as \`${expression.slice(0, 50)}\``);
+            // One element of several: which one is a guess - see collectedMany.
+            const oneOfMany = ELEMENT_TARGETS.has(node.type) && inner.collectedMany ? { ...read, containerGuess: true } : read;
+            return guarded(oneOfMany, node, expression, scope);
+        }
+        if (node.type === 'binary_expression' || node.type === 'binary_operator') {
+            const operator = node.childForFieldName('operator')?.text ?? '';
+            /*
+             * Two different reasons an operator is on this list.
+             *
+             * COMPOSITION - `+`, `%`, `.` - builds a new value that CONTAINS the
+             * operands. `.` is PHP's concatenation operator; every other language
+             * here uses `+`, and `%` is Python's old-style format.
+             *
+             * SELECTION - `??`, `||`, `&&` - builds nothing and RETURNS one of the
+             * operands unchanged. `dirty ?? "fallback"` is `dirty` on every run
+             * where `dirty` exists, which is every run an attacker cares about.
+             *
+             * Selection was missing, and the cost was quiet: the tracer returned
+             * null, the finding fell back to signature-based, and the report said a
+             * pattern had been matched when a path was in fact walkable. Nothing was
+             * hidden - the finding still appeared - but a provable claim was being
+             * reported as a guess, which is the honesty contract failing in the
+             * cautious direction rather than the loud one. Worth fixing for the same
+             * reason the loud direction is: the label is supposed to mean something.
+             *
+             * This is yesterday's Java argument - a null default is not a sanitiser -
+             * arriving in the languages that spell it with an operator instead of an
+             * `if`. It went unnoticed there because JavaScript's version has no
+             * statement to look at.
+             *
+             * The merge below is already right for both kinds. Composition needs the
+             * union of what is dirty and the intersection of what was washed;
+             * selection needs the same answer for a different reason, because either
+             * operand could be the one that comes out.
+             */
+            if (!BINARY_CARRIERS.has(operator))
+                return null;
+            const leftNode = node.childForFieldName('left');
+            let left = evaluate(leftNode, scope, depth + 1);
+            let right = evaluate(node.childForFieldName('right'), scope, depth + 1);
+            // Joining strings settles any quote-dependent cleaning - see placeInString.
+            // A right operand is quoted when the literal text before it opens a quote;
+            // a left operand still unsettled here starts the string, so nothing quotes it.
+            if (operator === '+' || operator === '.') {
+                if (right?.quotePending?.length)
+                    right = placeInString(right, opensAQuote(literalTextOf(leftNode)), node);
+                if (left?.quotePending?.length)
+                    left = placeInString(left, false, node);
+            }
+            const taint = left ?? right;
+            if (!taint)
+                return null;
+            // If both sides are dirty, keep the union of what has been washed.
+            const pendingBoth = [...new Set([...(left?.quotePending ?? []), ...(right?.quotePending ?? [])])];
+            // Told through the less-washed side - see the note on template parts.
+            const narrator = left && right && right.sanitizedFor.size < left.sanitizedFor.size ? right : left;
+            const merged = left && right
+                ? {
+                    steps: narrator.steps,
+                    sanitizedFor: new Set([...left.sanitizedFor].filter((k) => right.sanitizedFor.has(k))),
+                    origin: narrator.origin,
+                    unknownHops: [...left.unknownHops, ...right.unknownHops],
+                    quotePending: pendingBoth.length > 0 ? pendingBoth : undefined,
+                    // Joined, the string is dirty for certain if EITHER side is - so
+                    // an assumption survives only when both sides rest on one.
+                    branchAssumed: left.branchAssumed && right.branchAssumed ? true : undefined,
+                    containerGuess: left.containerGuess && right.containerGuess ? true : undefined,
+                    urlPrefix: left.urlPrefix,
+                    // The joined string is browser-only only if both halves are.
+                    fromBrowser: left.fromBrowser && right.fromBrowser ? true : undefined,
+                    // Local only if both halves are: one request value makes it the attacker's.
+                    fromLocal: left.fromLocal && right.fromLocal ? true : undefined,
+                    fileNameOnly: left.fileNameOnly && right.fileNameOnly ? true : undefined,
+                    joined: true,
+                    afterWash: joinedAfterWash([left, right], new Set([...left.sanitizedFor].filter((k) => right.sanitizedFor.has(k)))),
+                }
+                : taint;
+            /*
+             * Where the dirty part now sits. A dirty left side starts the string and
+             * keeps what it had; a dirty right side has everything on the left in
+             * front of it. `%` formats rather than joins, so the position inside the
+             * format string is not known - and unknown means "starts the string".
+             */
+            const urlPrefix = operator !== '+' && operator !== '.'
+                ? undefined
+                : left
+                    ? left.urlPrefix
+                    : shapeOf(leftNode) + (right?.urlPrefix ?? '');
+            const joined = addStep({ ...merged, urlPrefix }, node, operator === '%'
+                ? 'formatted into a larger string with %'
+                : `concatenated into a larger string with ${operator}`);
+            const through = guardOn ? joinedThrough(left, right) : undefined;
+            if (through)
+                throughOf.set(joined, through);
+            return joined;
+        }
+        if (CONTAINER_NODES.has(node.type)) {
+            /*
+             * EVERY ELEMENT, for the reason the template note below gives. This also
+             * returned on the first dirty element, so `[shellQuote(a), b]` was the
+             * quoted `a`, and `exec('ls ' + args.join(' '))` was printed as checked
+             * and cleared with a raw `b` in the command line.
+             */
+            const elements = [];
+            for (const element of node.namedChildren) {
+                if (!element)
+                    continue;
+                const taint = evaluate(element, scope, depth + 1);
+                if (taint)
+                    elements.push(taint);
+            }
+            if (elements.length === 0)
+                return null;
+            return addStep(joinParts(elements), node, 'placed into a container - we taint the container whole, not per element');
+        }
+        if (STRING_NODES.has(node.type)) {
+            /*
+             * A template literal or f-string: the dirt is inside the ${...} / {...}.
+             *
+             * EVERY PART, NOT THE FIRST DIRTY ONE. This loop used to return on the
+             * first part that carried taint, so the string took that part's washing
+             * as its own:
+             *
+             *     $a = intval($_GET['a']);
+             *     $q = "INSERT INTO t VALUES ({$a}, '{$ip}')";   // $ip is a header
+             *
+             * `$a` came first, `$a` was washed for SQL, and the query was printed as
+             * "checked and cleared" with the X-Forwarded-For header spliced into it
+             * raw. Concatenation with `.` already kept only what BOTH sides washed;
+             * interpolation is the same operation written differently and now gets
+             * the same answer. Found in DVWA's bac/medium.php, where the first part
+             * became washed once validation checks were read.
+             */
+            const parts = [];
+            for (const child of node.namedChildren) {
+                if (!child)
+                    continue;
+                // PHP splices a variable into a double-quoted string with no wrapper
+                // node at all: "id = $id" holds a `variable_name` child directly, where
+                // JS and Python wrap theirs in a substitution node. So the variable IS
+                // the interpolation, and it is evaluated in place.
+                const inner = INTERPOLATION_NODES.has(child.type)
+                    ? (child.namedChildren.find((c) => c !== null) ?? null)
+                    : VARIABLE_NODES.has(child.type) || MEMBER_NODES.has(child.type)
+                        ? child
+                        : null;
+                if (!inner)
+                    continue;
+                const taint = evaluate(inner, scope, depth + 1);
+                if (taint) {
+                    // Quote-dependent cleaning is settled by what comes before the splice
+                    // in this literal. If the offsets do not line up with the text, the
+                    // position is unknown and the value is treated as unquoted.
+                    let placed = taint;
+                    const offset = child.startIndex - node.startIndex;
+                    const lined = node.text.slice(offset, offset + child.text.length) === child.text;
+                    if (taint.quotePending?.length) {
+                        placed = placeInString(taint, lined && opensAQuote(afterOpening(node.text.slice(0, offset))), node);
+                    }
+                    // What precedes the value in this literal. If the offsets do not
+                    // line up with the text, where it sits is unknown: treated as the
+                    // start of the string, which keeps the old answer.
+                    const before = lined ? templateShapeBefore(node, child) : undefined;
+                    const shaped = { ...placed, urlPrefix: before === undefined ? undefined : before + (placed.urlPrefix ?? '') };
+                    if (throughOf.has(placed))
+                        throughOf.set(shaped, throughOf.get(placed));
+                    parts.push(shaped);
+                }
+            }
+            if (parts.length === 0)
+                return null;
+            const result = addStep(joinParts(parts), node, 'interpolated into a string template');
+            if (guardOn) {
+                const sets = parts.map((p) => throughOf.get(p));
+                if (sets.every((t) => t !== undefined)) {
+                    const shared = new Set([...sets[0]].filter((k) => sets.every((t) => t.has(k))));
+                    if (shared.size > 0)
+                        throughOf.set(result, shared);
+                }
+            }
+            return result;
+        }
+        /*
+         * A COMPREHENSION THAT ESCAPES EVERY ELEMENT.
+         *
+         *     kwargs_safe = {k: conditional_escape(v) for (k, v) in kwargs.items()}
+         *
+         * The line directly below the map() call in Django's format_html. Both
+         * idioms sit in the same six-line function, so covering one and not the
+         * other would have left the very case that started this half-fixed - and
+         * did, until the fixture caught it.
+         *
+         * Same rule as the higher-order applier: if EVERY element passes through a
+         * sanitiser, the collection is washed for that sanitiser's kinds. The
+         * element expression is the whole test - a comprehension whose body is a
+         * bare name, or a call this engine does not know, proves nothing and is
+         * asserted as still-reported in vulnerable/higher-order-escape-fence.py.
+         */
+        if (COMPREHENSION_NODES.has(node.type)) {
+            const body = node.namedChildren.find((c) => c !== null);
+            // A dict comprehension's body is a `pair`; the VALUE is what gets escaped.
+            const element = body?.type === 'pair'
+                ? body.childForFieldName('value') ?? body
+                : body;
+            const applied = element && CALL_NODES.has(element.type)
+                ? dictionary.sanitizers.find((san) => san.names.includes(lastSegment(calleeOf(element).text)))
+                : undefined;
+            if (applied && element) {
+                for (const child of node.namedChildren) {
+                    if (!child || child === body)
+                        continue;
+                    const iterated = child.childForFieldName('right') ?? child;
+                    const taint = evaluate(iterated, scope, depth + 1);
+                    if (!taint)
+                        continue;
+                    return {
+                        steps: [
+                            ...taint.steps,
+                            step('sanitizer', node, `every element passed through \`${lastSegment(calleeOf(element).text)}()\` ` +
+                                `by a comprehension - ${applied.description}`, applied.kinds),
+                        ],
+                        sanitizedFor: new Set([...taint.sanitizedFor, ...applied.kinds]),
+                        origin: taint.origin,
+                        unknownHops: taint.unknownHops,
+                        afterWash: washedNow(taint.afterWash, applied.kinds),
+                    };
+                }
+            }
+        }
+        // `cond ? a : b` and Python's `a if cond else b`. We do not evaluate the
+        // condition - if EITHER branch can be dirty, the result can be dirty.
+        if (node.type === 'ternary_expression' || node.type === 'conditional_expression') {
+            /*
+             * When the condition is decidable, only the branch that runs can carry a
+             * value. `(7*18)+106 > 200 ? "constant" : param` is the constant, every
+             * time, and the taint on the other side is in unreachable code.
+             *
+             * When it is not decidable, fall through to the original behaviour: take
+             * whichever branch is dirty, because either might run.
+             */
+            const parts = ternaryParts(node);
+            const truth = conditionTruth(parts.condition, scope.body);
+            if (truth !== undefined) {
+                const taken = truth ? parts.consequence : parts.alternative;
+                const taint = taken ? evaluate(taken, scope, depth + 1) : null;
+                return taint ? addStep(taint, node, 'returned from one branch of a conditional') : null;
+            }
+            /*
+             * The VALUE of `c ? a : b` is a or b. This loop used to walk every child,
+             * the condition included, so `isset($_COOKIE['r']) ? $_COOKIE['r'] : 'x'`
+             * was proven through isset() - a true/false answer - and
+             * `strlen($q) > 9 ? 'long' : 'short'` could only ever be the two words.
+             * The one form whose condition IS the value, `$a ?: $b`, comes back from
+             * ternaryParts with the condition as its consequence.
+             *
+             * A shape ternaryParts cannot split keeps the old walk: carrying too much
+             * is the failure this engine prefers to carrying too little.
+             */
+            const branches = [parts.consequence, parts.alternative].filter((b) => b !== null);
+            for (const child of branches.length > 0 ? branches : node.namedChildren) {
+                if (!child)
+                    continue;
+                const taint = evaluate(child, scope, depth + 1);
+                if (taint)
+                    return addStep(taint, node, 'returned from one branch of a conditional');
+            }
+            return null;
+        }
+        if (CALL_NODES.has(node.type)) {
+            return evaluateCall(node, scope, depth);
+        }
+        return null;
+    };
+    const evaluateCall = (node, scope, depth) => {
+        const { text: calleeText, receiver } = calleeOf(node);
+        const name = lastSegment(calleeText);
+        const args = argumentsOf(node);
+        // Is the CALL ITSELF a source? e.g. searchParams.get('q'), input().
+        //
+        // Test the callee only, never the whole call. Testing the whole call text
+        // was a real bug: `parseInt(req.query.id)` contains "req.query", so the
+        // sanitiser was skipped and the SANITISED value was reported as a verified
+        // vulnerability. A source is about where a value comes FROM, not about what
+        // characters appear anywhere inside the expression.
+        if (exceptedSource(text(node)))
+            return null;
+        /*
+         * ...AND NOT THE ARGUMENTS OF CALLS IN THE RECEIVER CHAIN EITHER. The callee
+         * of `crypto.createHash('sha256').update(req.query.text).digest('hex')` is
+         * everything before the last `(`, which contains `req.query` - so the digest
+         * call was treated as a SOURCE, and every sanitiser between the request and
+         * the end of the chain was skipped: `escape(req.query.q).trim()` was the
+         * raw request value. Calls in the chain are emptied before the test, so a
+         * source is matched by the names it is reached through, never by what is
+         * passed to something on the way.
+         */
+        const asSource = sourceTaint(node, `${withoutCallArguments(calleeText)}(`);
+        if (asSource)
+            return asSource;
+        /*
+         * A READ FROM A LOCAL MAP WHOSE EVERY WRITE IS ON THE PAGE.
+         *
+         * The default answer to `map.get(k)` is the whole map's taint, labelled a
+         * guess about which element came out. When local-map.ts can show which put
+         * a read returns, the answer is that put's value instead - a literal is
+         * clean, and a variable is traced as itself, with no guess attached.
+         *
+         * A variable is only read at the `get` if nothing reassigns it between the
+         * put and the read - the map keeps the value it was given, and evaluating a
+         * reassigned name here would describe the new value, not the stored one -
+         * and if its declared type cannot change in place (declaredImmutable): a
+         * StringBuilder or an array in the map changes whenever an alias of it
+         * does. Anything else falls through to the whole-collection answer.
+         */
+        if (language === 'java' && name === 'get') {
+            const read = resolveContainerRead(node, language);
+            if (read) {
+                const line = read.write.startPosition.row + 1;
+                const where = `\`${read.container}.get(${read.selector.startsWith('index') ? read.selector.slice(6) : read.selector})\` returns what was stored at ${read.selector} on line ${line}`;
+                if (JAVA_LITERALS.has(read.value.type)) {
+                    noteResolvedRead(node, scope.filePath, `${where}, a literal`);
+                    return null;
+                }
+                const method = enclosingMethod(node);
+                if (read.value.type === 'identifier' &&
+                    method &&
+                    declaredImmutable(method, read.value.text) &&
+                    !writtenBetween(method, read.value.text, read.write.endIndex, node.startIndex)) {
+                    noteResolvedRead(node, scope.filePath, `${where}, \`${read.value.text}\``);
+                    const stored = evaluate(read.value, scope, depth + 1);
+                    return stored
+                        ? addStep(stored, node, `read back from \`${read.container}\` at ${read.selector} - the value stored there on line ${line}`)
+                        : null;
+                }
+            }
+        }
+        /*
+         * A SANITISER PASSED AS A VALUE, NOT CALLED.
+         *
+         *     args_safe = map(conditional_escape, args)          django/utils/html.py
+         *
+         * That is Django's format_html - the function its own docstring calls the
+         * one you should use instead of str.format to build HTML - and this scanner
+         * reported it as flow-verified XSS. Eighth time this project has punished a
+         * fix, and the most prominent target yet.
+         *
+         * Everything needed was already present. `mark_safe` was a sink, correctly:
+         * mark_safe(user_input) really is dangerous. `conditional_escape` was in the
+         * sanitiser list. What nothing modelled is that the escaping happened
+         * through a HIGHER-ORDER call: the sanitiser was never written as
+         * `escape(x)` at a place the tracer watches, it was handed to map() as a
+         * value and applied out of sight.
+         *
+         * A sanitiser recognised only in the shape `escape(x)` stops working the
+         * moment somebody writes idiomatic Python - and both idioms sit on adjacent
+         * lines of that one Django function, map() then a dict comprehension.
+         *
+         * The cost of missing it compounds: the second Django finding was a CALLER
+         * of format_html. One unmodelled shape at the bottom of a framework
+         * propagates into every place that uses it.
+         */
+        if (HIGHER_ORDER_APPLIERS.has(name)) {
+            for (const arg of args) {
+                const applied = dictionary.sanitizers.find((san) => san.names.includes(lastSegment(text(arg))));
+                if (!applied)
+                    continue;
+                // The collection being mapped over is the OTHER argument.
+                for (const other of args) {
+                    if (other === arg)
+                        continue;
+                    const taint = evaluate(other, scope, depth + 1);
+                    if (!taint)
+                        continue;
+                    return {
+                        steps: [
+                            ...taint.steps,
+                            step('sanitizer', node, `every element passed through \`${lastSegment(text(arg))}()\` by ` +
+                                `\`${name}()\` - ${applied.description}`, applied.kinds),
+                        ],
+                        sanitizedFor: new Set([...taint.sanitizedFor, ...applied.kinds]),
+                        origin: taint.origin,
+                        unknownHops: taint.unknownHops,
+                        afterWash: washedNow(taint.afterWash, applied.kinds),
+                    };
+                }
+            }
+        }
+        // A sanitiser: the value stays traceable, but is marked washed for the
+        // kinds this particular soap actually works on.
+        // An entry with maxArgs does not describe a call that passes more - md5's
+        // raw flag - so that call falls through to the unmodelled-function rule.
+        const sanitizer = dictionary.sanitizers.find((s) => s.names.includes(name) &&
+            (s.maxArgs === undefined || args.length <= s.maxArgs) &&
+            (s.argumentPattern === undefined || (args[0] !== undefined && s.argumentPattern.test(text(args[0])))));
+        if (sanitizer) {
+            /*
+             * A method with NO arguments answers a question about its own object:
+             * `param.length()`, `name.isEmpty()`. The dirt is on the receiver, and
+             * the answer is washed all the same. Only with no arguments - when there
+             * are some, they are what the entry describes, and the receiver is
+             * usually a helper object (`$conn->real_escape_string($x)`).
+             */
+            const inputs = sanitizer.fromReceiver ? [receiver] : args.length > 0 ? args : [receiver];
+            for (const arg of inputs) {
+                const taint = evaluate(arg, scope, depth + 1);
+                if (!taint)
+                    continue;
+                const quoteDependent = sanitizer.onlyInsideQuotes ?? [];
+                const pending = [...new Set([...(taint.quotePending ?? []), ...quoteDependent])];
+                return {
+                    steps: [
+                        ...taint.steps,
+                        {
+                            ...step('sanitizer', node, `passed through \`${name}()\` - ${sanitizer.description}`, sanitizer.kinds),
+                            ...(quoteDependent.length > 0 ? { quoteDependent: true, quoteKinds: quoteDependent } : {}),
+                        },
+                    ],
+                    sanitizedFor: new Set([...taint.sanitizedFor, ...sanitizer.kinds]),
+                    origin: taint.origin,
+                    unknownHops: taint.unknownHops,
+                    afterWash: washedNow(taint.afterWash, sanitizer.kinds),
+                    quotePending: pending.length > 0 ? pending : undefined,
+                };
+            }
+            return null;
+        }
+        // A propagator: dirt survives. Check the receiver first (`dirty.trim()`),
+        // then the arguments (`String(dirty)`, `",".join(dirty)`).
+        if (dictionary.propagators.names.includes(name)) {
+            let taint = evaluate(receiver, scope, depth + 1);
+            // A propagator reached through the RECEIVER of a multi-element container
+            // is an element read - `map.get(k)`, `list.get(i)` - and `get` is in the
+            // propagator list, which is why the unmodelled-call path never sees it.
+            // Same rule, second doorway: reading one of several is a guess.
+            const fromContainer = taint?.collectedMany ?? false;
+            if (!taint) {
+                for (const arg of args) {
+                    taint = evaluate(arg, scope, depth + 1);
+                    if (taint)
+                        break;
+                }
+            }
+            if (!taint)
+                return null;
+            const carried = addStep(taint, node, `passed through \`${name}()\``);
+            return fromContainer ? { ...carried, containerGuess: true } : carried;
+        }
+        /* A function we can actually read - in this file or, since cross-file
+         * resolution, in a file this one imports. Ask the descent whether it
+         * HANDLED the call, not merely whether it produced taint: the two are
+         * different answers, and conflating them was a real bug. The gate used to
+         * be `localFunctions.get(name)`, so a sanitiser living in another module
+         * was never consulted and its call fell through to the "unknown function"
+         * branch below, which preserves taint. Result: correctly-escaped code
+         * reported as a vulnerability.                                          */
+        const descended = descendIntoLocalCall(node, scope, depth);
+        if (descended.handled)
+            return descended.taint;
+        const stoppedAt = descended.stopped;
+        /*
+         * A READ: the result is new data, not the argument - see FreshResultSpec.
+         * Checked only here, after the project's own functions have had their
+         * chance, so a project `fetch()` that returns its argument is followed.
+         * The trace ends, and the stop is put on the record when the input was
+         * dirty: a finding that would have existed must leave its reason behind.
+         */
+        const fresh = stoppedAt ? undefined : dictionary.freshResults?.find((f) => f.names.includes(name));
+        if (fresh) {
+            if (fresh.rowsFollowInjection) {
+                const sqlSink = dictionary.callSinks.find((s) => s.kind === 'sql' && s.methods.includes(name));
+                const watched = sqlSink && sqlSink.argIndexes !== 'all'
+                    ? sqlSink.argIndexes.map((i) => args[i]).filter((a) => a !== undefined)
+                    : args;
+                for (const arg of watched) {
+                    const taint = evaluate(arg, scope, depth + 1);
+                    if (!taint || retracted(taint, arg, 'sql') !== null)
+                        continue;
+                    return addStep(taint, node, sqlSink
+                        ? `the query text can be injected into (the SQL injection on this line), so the rows ` +
+                            `\`${name}()\` returns can be chosen by the attacker - for example with UNION SELECT`
+                        : `read through \`${name}()\` from a result the attacker can choose the rows of`);
+                }
+            }
+            const input = [...args, receiver].some((n) => evaluate(n, scope, depth + 1) !== null);
+            if (input)
+                noteFreshStop(node, scope.filePath, `\`${name}()\` is ${fresh.description}`);
+            return null;
+        }
+        /*
+         * A KEYED LOOKUP on a clean store. Juice Shop's
+         * `security.authenticatedUsers.get(req.cookies.token)` returns the user
+         * kept under that token, and four routes build a file path from that
+         * user's id: the cookie picks WHICH user, it writes nothing. A dirty
+         * receiver (`new URLSearchParams(dirty).get('x')`) still carries, and so
+         * does a language that lists `get` as a propagator (Java, Go).
+         */
+        if (name === 'get' && args.length === 1 && receiver && evaluate(receiver, scope, depth + 1) === null) {
+            if (evaluate(args[0] ?? null, scope, depth + 1) !== null) {
+                noteFreshStop(node, scope.filePath, '`get()` is a lookup - it returns what is stored under the key, not the key');
+            }
+            return null;
+        }
+        /* ---- A function we do not model. The hardest judgement call here. ----
+         *
+         * Two wrong answers were available:
+         *
+         *   Treat it as CLEAN. Safe-sounding, and it made the tool useless on real
+         *   Java: OWASP's own benchmark writes
+         *       param = URLDecoder.decode(request.getHeader("x"), "UTF-8");
+         *   and dropping the taint at `decode` produced ZERO verified flows across
+         *   2,766 files, every one of which is a known vulnerability.
+         *
+         *   Treat it as SANITISING. Never - assuming an unknown function fixes the
+         *   problem is how scanners miss real bugs.
+         *
+         * What we do instead: the value keeps its taint, and the hop is recorded as
+         * UNMODELLED. The path shows exactly where our knowledge ran out, and the
+         * finding's limitations names the function. If `decode` had been a custom
+         * sanitiser, the reader can see that in one glance and dismiss it.
+         *
+         * That is the honest version of a guess: make it, then show your work.  */
+        let carried = null;
+        for (const arg of args) {
+            carried = evaluate(arg, scope, depth + 1);
+            if (carried)
+                break;
+        }
+        /*
+         * TAINT ARRIVING FROM THE RECEIVER, which is where Jenkins went wrong.
+         *
+         * No argument was dirty, so the only way this call can be dirty is if the
+         * OBJECT is. Usually that is right - `sb.toString()` on a dirtied
+         * StringBuilder is exactly the dirty string. But when the object was
+         * dirtied through a KEYED write, the taint is in a named compartment and
+         * this call may have nothing to do with it:
+         *
+         *     req.setAttribute("loginForm", dirty);
+         *     req.getContextPath()      // <- not the compartment. Not dirty.
+         *
+         * So a compartmented receiver only carries taint out through a reader of
+         * that compartment. Reading it back DOES carry, and clears the compartment,
+         * because the value is now in the caller's hands rather than filed away.
+         */
+        const fromReceiver = carried === null;
+        carried ??= evaluate(receiver, scope, depth + 1);
+        if (!carried)
+            return null;
+        let compartment = carried.compartment;
+        if (fromReceiver && compartment) {
+            if (!compartment.includes(name))
+                return null;
+            compartment = undefined;
+        }
+        // A stop is already counted where it happened (depth / recursion).
+        if (!stoppedAt)
+            seenUnmodelled.add(siteOf(node, scope.filePath));
+        // A known name called with an option its entry does not cover.
+        const overArgs = dictionary.sanitizers.find((s) => s.names.includes(name) && s.maxArgs !== undefined && args.length > s.maxArgs);
+        const hopText = stoppedAt === 'depth'
+            ? `passed through \`${name}()\`, which we did NOT follow: the call chain reached ` +
+                `its depth limit here. We assume it preserves the value; if it actually ` +
+                `sanitises, this trace is wrong`
+            : stoppedAt === 'recursion'
+                ? `passed through \`${name}()\`, which resolves by name to a function already ` +
+                    `being followed on this path - a recursive call, or a same-named method on ` +
+                    `another object. We did NOT follow it again and assume it preserves the value; ` +
+                    `if it actually sanitises, this trace is wrong`
+                : overArgs
+                    ? `passed through \`${name}()\`, which is NOT in our dictionary in this form: it is ` +
+                        `called with ${args.length} arguments and our entry covers at most ${overArgs.maxArgs}, ` +
+                        `and an extra argument can change what comes back (md5's raw-binary flag does). ` +
+                        `We assume it preserves the value; if it actually sanitises, this trace is wrong`
+                    : `passed through \`${name}()\`, which is NOT in our dictionary - we assume it ` +
+                        `preserves the value; if it actually sanitises, this trace is wrong`;
+        return {
+            steps: [...carried.steps, { ...step('propagation', node, hopText), unmodelled: name }],
+            sanitizedFor: carried.sanitizedFor,
+            origin: carried.origin,
+            unknownHops: [...carried.unknownHops, name],
+            quotePending: carried.quotePending,
+            compartment,
+            collectedMany: carried.collectedMany,
+            /*
+             * Carried, not rebuilt. This return used to list its fields by hand and
+             * left this one out, so a guessed hop ERASED the record that a branch had
+             * been assumed further back - and a path resting on two assumptions was
+             * published as a proof resting on one. Found when stripslashes() and
+             * new ProcessBuilder() became known functions: their paths went through
+             * addStep, kept the flag, and ten BenchmarkJava proofs that had never
+             * been entitled to the label lost it.
+             */
+            branchAssumed: carried.branchAssumed,
+            /*
+             * THE READ IS WHERE THE AMBIGUITY IS BORN, not the write.
+             *
+             * `argList.add(a); argList.add(b); pb.command(argList)` hands the whole
+             * list over - every element arrives, nothing is guessed, and the trace
+             * stays proven. `map.put(k1,clean); map.put(k2,dirty); map.get(k1)` pulls
+             * ONE element out of several and this engine does not model which. Same
+             * container, same write count; only the read tells them apart.
+             */
+            containerGuess: carried.containerGuess ?? (fromReceiver && carried.collectedMany ? true : undefined),
+            joined: carried.joined,
+            afterWash: trustedHop(carried.afterWash, name),
+        };
+    };
+    /* ---- sinks ---- */
+    const buildPath = (taint, sinkNode, kind, description) => {
+        // Convert sanitiser steps that do NOT cover this sink kind into ordinary
+        // propagation steps, with the mismatch spelled out. This is where the
+        // kind-scoping becomes visible to the user: "you escaped it for HTML, and
+        // then put it in a SQL query".
+        const steps = taint.steps.map((s) => {
+            if (s.kind !== 'sanitizer')
+                return { kind: s.kind, location: s.location, description: s.description };
+            /*
+             * A SANITISER STEP FROM SOMEBODY ELSE'S VALUE.
+             *
+             * Scanning WordPress on the new page-buffer sink crashed the whole scan
+             * on the engine's own invariant: "path contains a sanitiser - that is a
+             * CLEAN flow, not a verified vulnerability." The invariant was right to
+             * fire and right to crash rather than publish. The path was wrong.
+             *
+             *     $html .= '<a href="' . esc_url($u) . '">' . $label . '</a>';
+             *
+             * Two tainted values merge here. `esc_url($u)` is escaped; `$label` is
+             * not. `sanitizedFor` correctly ends up WITHOUT xss - the finding is
+             * real, because $label is raw - but the merged step list still carried
+             * the esc_url sanitiser step from the other contributor. One narrative
+             * assembled out of two different values' histories.
+             *
+             * So a step only stays a SANITISER when the value actually reaching this
+             * sink was sanitised for this kind. Otherwise it is something that
+             * happened to a sibling expression, and the path says so instead of
+             * claiming a cleanliness the traced value never had.
+             */
+            const coversThisKind = s.sanitizesKinds?.includes(kind) ?? false;
+            if (coversThisKind && taint.sanitizedFor.has(kind)) {
+                return { kind: s.kind, location: s.location, description: s.description };
+            }
+            if (coversThisKind && s.quoteDependent) {
+                return {
+                    kind: 'propagation',
+                    location: s.location,
+                    description: s.guard
+                        ? `${s.description} - NOTE: this value is not inside quotes where it is used, and ` +
+                            `outside quotes a word is still SQL - a column name or a keyword - so the check does not protect it`
+                        : `${s.description} - NOTE: this value is not inside quotes where it is used, ` +
+                            `so the escaping does not protect it`,
+                };
+            }
+            if (coversThisKind) {
+                return {
+                    kind: 'propagation',
+                    location: s.location,
+                    description: `${s.description} - NOTE: this covered a DIFFERENT value in the same ` +
+                        `expression. The value followed here never went through it.`,
+                };
+            }
+            return {
+                kind: 'propagation',
+                location: s.location,
+                description: `${s.description} - NOTE: this does not make a value safe for a ${kind} sink, ` +
+                    `so the value is still dangerous here`,
+            };
+        });
+        steps.push({
+            kind: 'sink',
+            location: nodeLocation(sinkNode, toDisplay(currentPath)),
+            description,
+        });
+        return steps;
+    };
+    /**
+     * ONE RETRACTION, THREE PLACES THAT CAN REPORT.
+     *
+     * `checkTaintAtSink` says in its own comment that it was factored out "so a
+     * second kind of sink cannot get half of this right". It was, and then two
+     * more emission sites grew their own inline copies of the sanitised check -
+     * so when the validation guard was added to the one factored function, DVWA's
+     * `exec/impossible.php` carried on being reported through a path that had
+     * never heard of it.
+     *
+     * Every reason to NOT report belongs here, and `npm test` fails if a
+     * `results.push` appears in this file without a `retracted()` guarding it.
+     */
+    const retracted = (taint, _valueNode, kind) => {
+        /*
+         * WE ASSUMED A BRANCH. THAT IS NOT A PROOF.
+         *
+         * The value reached here only because a clean write was skipped for being
+         * conditional - see the note on branchAssumed. Reporting is right; calling
+         * it flow-verified is not, and the difference between those two sentences
+         * is this project's whole product. The signature rules still cover the
+         * line, so the caution survives and only the overclaim is dropped.
+         *
+         * This sits in the shared gate rather than in checkTaintAtSink, because the
+         * first attempt put it in checkTaintAtSink alone and Django carried on being
+         * reported: the finding came through one of the OTHER two emission sites.
+         * That is the fourth-time-lesson recorded on this function - every reason
+         * not to report belongs here, or it only half exists.
+         */
+        // Escaping whose protection depends on quotes, on a value whose place in
+        // the query was never seen, proves nothing either way - see quoteUnknown.
+        // That includes cleanliness established by the control flow: a value read
+        // inside `if (is_numeric($octet[0]) && ...)` arrives here already washed -
+        // see `guarded`, which replaced a text check that used to sit on this line.
+        if (taint.sanitizedFor.has(kind) && !taint.quotePending?.includes(kind))
+            return 'sanitised';
+        return null;
+    };
+    /*
+     * THE RECEIPT FOR A CLEARED LINE.
+     *
+     * The report's "Checked and cleared" section printed one sentence for every
+     * line the tracer cleared: "A sanitiser for this kind of problem was proven
+     * to run on the path into this line." It was printed for an allow-list
+     * check, which is not a sanitiser; for a hex digest; and for DVWA's ping
+     * output, which was cleared only because the ping's ADDRESS was checked and
+     * `shell_exec()` - a function this engine does not model - was assumed to
+     * hand back what it was given. A claim of safety with no stated ground is
+     * the same overclaim as a finding with no path, pointed the other way.
+     *
+     * The ground is on the path already: the last step that washed the value
+     * for THIS kind of sink. What can undo it is on the path too - a function
+     * we do not model that the value went through afterwards. Hops before the
+     * wash do not matter (the wash happened after them), so they are not
+     * listed; hops on another value joined in, whose order we cannot see, are
+     * listed, because over-disclosing an assumption costs a reader a glance and
+     * hiding one costs them the truth.
+     */
+    const cleanReason = (taint, kind) => {
+        const steps = taint.steps;
+        let at = -1;
+        for (let i = steps.length - 1; i >= 0; i--) {
+            const s = steps[i];
+            if (s.kind === 'sanitizer' && s.sanitizesKinds?.includes(kind)) {
+                at = i;
+                break;
+            }
+        }
+        const before = new Set(steps.slice(0, Math.max(at, 0)).map((s) => s.unmodelled).filter((n) => !!n));
+        const after = steps.slice(at + 1).map((s) => s.unmodelled).filter((n) => !!n);
+        const elsewhere = taint.unknownHops.filter((n) => !before.has(n) && !after.includes(n) && !steps.some((s) => s.unmodelled === n));
+        // Tracked precisely when every way this value was built kept count - see
+        // `afterWash`. Otherwise the cautious list: anything that MIGHT be after.
+        const tracked = taint.afterWash?.[kind];
+        const assumes = tracked ? [...tracked] : [...new Set([...after, ...elsewhere])];
+        if (at === -1) {
+            return { reason: 'the value was cleaned for this kind of sink on the way here, by a step this engine did not record', assumes };
+        }
+        const wash = steps[at];
+        const line = wash.location.startLine;
+        const where = wash.location.file === toDisplay(currentPath) ? `line ${line}` : `${wash.location.file}:${line}`;
+        let reason = wash.guard ? wash.description : `${wash.description} (${where})`;
+        if (wash.quoteKinds?.includes(kind))
+            reason += ' - and the value sits inside quotes where it is used, which is where that holds';
+        if (taint.joined)
+            reason += ' - one of several values joined into this one, and every one of them was cleaned for this kind of sink';
+        return { reason, assumes };
+    };
+    const recordRetraction = (sinkNode, kind, taint) => {
+        const { reason, assumes } = cleanReason(taint, kind);
+        sanitized.push({
+            ruleId: SINK_KIND_RULE[kind],
+            sinkNode,
+            kind,
+            filePath: toDisplay(currentPath),
+            reason,
+            ...(assumes.length > 0 ? { assumes } : {}),
+        });
+    };
+    /**
+     * A tainted value has arrived somewhere dangerous. Decide which of the two
+     * outcomes it is - a finding, or a proof that this line is fine.
+     *
+     * Factored out of checkCallSink so a second kind of sink cannot get half of
+     * this right. Both branches matter equally: forgetting the sanitised branch
+     * would mean correctly-escaped code gets reported, and this project treats
+     * shouting at correct code as the worse failure of the two.
+     */
+    const checkTaintAtSink = (taint, valueNode, kind, 
+    /** A NOUN PHRASE. The message reads "... reaches ${description}". */
+    description, 
+    /** The sink step's own wording, which may say more than the headline. */
+    pathDescription = `reaches ${description}`) => {
+        const verdict = retracted(taint, valueNode, kind);
+        if (verdict) {
+            if (verdict === 'sanitised')
+                recordRetraction(valueNode, kind, taint);
+            return;
+        }
+        results.push({
+            ruleId: SINK_KIND_RULE[kind],
+            kind,
+            node: valueNode,
+            sinkNode: valueNode,
+            path: buildPath(taint, valueNode, kind, pathDescription),
+            origin: taint.origin,
+            sinkDescription: description,
+            unknownHops: taint.unknownHops,
+            branchAssumed: taint.branchAssumed ?? false,
+            containerGuess: taint.containerGuess ?? false,
+            quoteUnknown: taint.quotePending?.includes(kind) ?? false,
+            fixedDestination: fixedDestinationOf(taint, kind),
+            localSource: kind === 'path' && taint.fromLocal ? true : undefined,
+            filePath: toDisplay(currentPath),
+        });
+    };
+    /**
+     * A tainted argument dirties the object it was handed to.
+     *
+     *     sb.append(param);      ->  `sb` is now tainted
+     *     argList.add(param);    ->  `argList` is now tainted
+     *
+     * The existing propagator model could not express this: it carries taint out
+     * through a RETURN VALUE, and these calls either discard theirs or hand back
+     * a boolean. `append` sat in the Java propagator list the whole time and
+     * caught nothing.
+     *
+     * HONEST ABOUT THE IMPRECISION THIS BUYS. The taint lands on the whole
+     * container, not on the element - so after
+     *
+     *     list.add(cleanValue);
+     *     list.add(dirtyValue);
+     *
+     * every read out of `list` is treated as dirty, including the clean one. That
+     * is the standard container-insensitive trade and it errs toward reporting.
+     * It is written into the flow path ("collected into ...") and into the
+     * capability block, because a new source of imprecision that nobody announced
+     * is exactly the kind of quiet overclaim this engine is built against.
+     */
+    /**
+     * THE OUTPUT-PARAMETER MUTATOR - C's version of the same idea, and the one
+     * shape without which C coverage would be nearly zero.
+     *
+     * checkMutation below binds taint to the RECEIVER, because in every language
+     * this engine supported until now the thing being filled sits to the left of
+     * the dot:
+     *
+     *     sb.append(dirty)        ->  `sb`
+     *
+     * C has no receiver. The destination is argument ZERO, and the value goes in
+     * after it:
+     *
+     *     sprintf(cmd, "ping %s", argv[1]);   ->  `cmd`
+     *     strcpy(buf, argv[1]);               ->  `buf`
+     *     strcat(path, getenv("X"));          ->  `path`
+     *
+     * That is not a corner case, it is THE C idiom - the two-line build-then-run
+     * pattern that every command injection in the language is written in. With
+     * only the receiver rule, `sprintf(cmd, ...)` would taint nothing, `cmd`
+     * would read as clean, and `system(cmd)` on the next line would be silent.
+     * Every fixture in vulnerable/cmdi.c is this shape.
+     *
+     * Argument zero is excluded from the tainted-value scan for the same reason
+     * `writerArgPattern` excludes it on the sink side: it is where the output
+     * goes, not what is written.
+     */
+    const checkOutParamMutation = (node, scope) => {
+        const method = lastSegment(calleeOf(node).text);
+        /*
+         * READER FUNCTIONS: the call IS the source, and the bytes land in an
+         * argument rather than in the return value.
+         *
+         *     fgets(line, sizeof(line), stdin);
+         *     system(line);
+         *
+         * Nothing here is an expression the source patterns could match - fgets
+         * returns a pointer nobody keeps, and `line` was declared clean on the
+         * line above. Without this the two statements are unrelated and reading a
+         * command from standard input is invisible, which is the oldest shape of
+         * this bug there is.
+         */
+        for (const reader of dictionary.outParamSources ?? []) {
+            if (!reader.names.includes(method))
+                continue;
+            const destination = argumentsOf(node)[reader.destination];
+            if (!destination)
+                continue;
+            const name = lastSegment(text(destination));
+            if (!name || !/^[A-Za-z_][\w]*$/.test(name))
+                continue;
+            seenSources.add(siteOf(node, currentPath));
+            scope.env.set(name, {
+                steps: [
+                    step('source', node, `\`${name}\` is filled by \`${method}()\` from ${reader.description}`),
+                ],
+                sanitizedFor: new Set(),
+                origin: `${method}()`,
+                unknownHops: [],
+            });
+            return;
+        }
+        const outParams = dictionary.outParamMutators;
+        if (!outParams || outParams.length === 0)
+            return;
+        if (!outParams.includes(method))
+            return;
+        const args = argumentsOf(node);
+        const destination = args[0];
+        if (!destination)
+            return;
+        // Only something we can name. `sprintf(ptr->buf, ...)` gives us no single
+        // variable to bind, so it is left alone rather than guessed at.
+        const destinationName = lastSegment(text(destination));
+        if (!destinationName || !/^[A-Za-z_][\w]*$/.test(destinationName))
+            return;
+        for (const arg of args.slice(1)) {
+            const taint = evaluate(arg, scope);
+            if (!taint)
+                continue;
+            scope.env.set(destinationName, addStep(taint, node, `written into \`${destinationName}\` by \`${method}()\``));
+            return;
+        }
+    };
+    /**
+     * HOW MANY THINGS WENT INTO THE BOX?
+     *
+     * Counts element writes to `receiverName` inside the function the write sits
+     * in. One means the value later read out is the value written, and the trace
+     * is sound. More than one means a read picks one of several and this engine
+     * does not model which - so the finding keeps travelling but loses its claim
+     * to proof.
+     *
+     * DELIBERATELY TEXTUAL, and the limitation is real: it counts writes that
+     * appear anywhere in the enclosing function, including ones AFTER the read.
+     * That over-counts, which costs confidence rather than findings - the error
+     * lands on the side of claiming less. A precise version would need ordering
+     * and reachability, which is the modelling this file has repeatedly decided
+     * not to guess at.
+     */
+    const countElementWrites = (node, receiverName) => {
+        const names = dictionary.elementMutators;
+        if (!names || names.length === 0)
+            return 0;
+        let scopeNode = node;
+        while (scopeNode && !functionTypes.has(scopeNode.type))
+            scopeNode = scopeNode.parent;
+        const escaped = receiverName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const pattern = new RegExp(`\\b${escaped}\\s*\\.\\s*(?:${names.join('|')})\\s*\\(`, 'g');
+        return (text(scopeNode ?? node).match(pattern) ?? []).length;
+    };
+    /**
+     * How many elements `name` can hold in the function around `node`: element
+     * writes `name[...] = v`, plus the entries of any container literal bound
+     * to it. Textual, like countElementWrites, and wrong the same safe way: a
+     * write after the read still counts, which costs a proof, never a finding.
+     */
+    const elementCount = (node, name) => {
+        let scopeNode = node;
+        while (scopeNode && !functionTypes.has(scopeNode.type))
+            scopeNode = scopeNode.parent;
+        let count = 0;
+        const visit = (n) => {
+            if (ASSIGNMENT_NODES.has(n.type)) {
+                const parts = assignmentParts(n);
+                if (parts && stripDeclarator(text(parts.target)) === name) {
+                    if (ELEMENT_TARGETS.has(parts.target.type))
+                        count++;
+                    else if (CONTAINER_LITERALS.has(parts.value.type))
+                        count += parts.value.namedChildCount;
+                }
+            }
+            for (const c of n.namedChildren)
+                if (c)
+                    visit(c);
+        };
+        visit(scopeNode ?? node);
+        return count;
+    };
+    const checkMutation = (node, scope) => {
+        const mutators = dictionary.mutators;
+        if (!mutators || mutators.length === 0)
+            return;
+        const callee = calleeOf(node);
+        const method = lastSegment(callee.text);
+        if (!mutators.includes(method))
+            return;
+        // We can only dirty something we can NAME. `a.b().c(dirty)` gives us no
+        // variable to bind, so it is left alone rather than guessed at.
+        const receiverName = lastSegment(text(callee.receiver));
+        if (!receiverName || !/^[A-Za-z_$][\w$]*$/.test(receiverName))
+            return;
+        // A keyed write files the value in a NAMED COMPARTMENT of an object that is
+        // primarily something else. The object is dirty for reads of that store and
+        // clean for everything else it does. See safe/keyed-container.java.
+        const keyed = dictionary.keyedMutators?.includes(method) ?? false;
+        const readers = dictionary.keyedReaders;
+        // An element write into a collection that took several elements makes any
+        // later read of it a guess about WHICH element. The taint is unchanged; only
+        // the confidence label is. Accumulators are not in `elementMutators`, so
+        // sb.append() keeps its proof however many times it runs.
+        const manyElements = (dictionary.elementMutators?.includes(method) ?? false) &&
+            countElementWrites(node, receiverName) > 1;
+        for (const arg of argumentsOf(node)) {
+            const taint = evaluate(arg, scope);
+            if (!taint)
+                continue;
+            const stored = addStep(taint, node, keyed
+                ? `filed into \`${receiverName}\` under a key via \`${method}()\` - reads of that ` +
+                    `store are tainted, other methods on \`${receiverName}\` are not`
+                : `collected into \`${receiverName}\` via \`${method}()\``);
+            const marked = manyElements ? { ...stored, collectedMany: true } : stored;
+            scope.env.set(receiverName, keyed && readers ? { ...marked, compartment: readers } : marked);
+            return;
+        }
+    };
+    /**
+     * The dangerous call took no arguments - the payload is already inside the
+     * object. `pb.command(list); pb.start();` is the canonical shape.
+     */
+    const checkReceiverSink = (node, scope) => {
+        const sinks = dictionary.receiverSinks;
+        if (!sinks || sinks.length === 0)
+            return;
+        const callee = calleeOf(node);
+        const method = lastSegment(callee.text);
+        for (const sink of sinks) {
+            if (!sink.methods.includes(method))
+                continue;
+            if (!callee.receiver)
+                continue;
+            // `new ProcessBuilder(argList).start()` already fired as an ARGUMENT
+            // sink on the constructor. Firing again on the receiver reports one bug
+            // twice at one line. This shape only adds something when the payload was
+            // loaded on an earlier line, which means the receiver is a plain name.
+            if (CALL_NODES.has(callee.receiver.type))
+                continue;
+            const taint = evaluate(callee.receiver, scope);
+            if (!taint)
+                continue;
+            checkTaintAtSink(taint, node, sink.kind, sink.description, `reaches ${sink.description} via \`${method}()\` - the value was loaded into ` +
+                `\`${lastSegment(text(callee.receiver))}\` on an earlier line, so this call carries no arguments`);
+            return;
+        }
+    };
+    const checkCallSink = (node, scope) => {
+        const callee = calleeOf(node);
+        const name = lastSegment(callee.text);
+        const wholeCall = text(node);
+        const args = argumentsOf(node);
+        for (const sink of dictionary.callSinks) {
+            // The name as written, or the sink it was locally aliased to.
+            const aliasedTo = fileAliases.get(name);
+            const effective = sink.methods.includes(name) ? name : aliasedTo;
+            if (!effective || !sink.methods.includes(effective))
+                continue;
+            if (sink.bareOnly && callee.receiver) {
+                const owner = ownerName(text(callee.receiver));
+                if (!(sink.allowedReceivers ?? []).includes(owner))
+                    continue;
+            }
+            if (sink.requiredReceivers && sink.requiredReceivers.length > 0) {
+                const receiver = callee.receiver ? text(callee.receiver) : '';
+                const last = ownerName(receiver) || receiver;
+                if (!sink.requiredReceivers.some((name) => last === name))
+                    continue;
+            }
+            if (sink.receiverPattern) {
+                const receiver = callee.receiver ? text(callee.receiver) : '';
+                // The variable's NAME, or the type it was declared with. `r.exec(cmd)`
+                // says nothing; `Runtime r = ...` two lines up says everything.
+                const declared = fileTypes.get(receiver) ?? fileTypes.get(lastSegment(receiver)) ?? '';
+                if (!sink.receiverPattern.test(receiver) && !sink.receiverPattern.test(declared))
+                    continue;
+            }
+            if (sink.requiresShellOption && !sink.requiresShellOption.test(wholeCall))
+                continue;
+            // The safe form of a deserialiser is the same call with a restriction
+            // added. Seeing that restriction means this is the FIX, not the bug.
+            if (sink.unlessOption && sink.unlessOption.test(wholeCall))
+                continue;
+            // `append`/`write`/`print` on a StringBuilder is string assembly, not a
+            // write to the page. Only the ones we KNOW are builders are excluded, so
+            // an unknown receiver is still treated as a possible writer.
+            if (sink.kind === 'xss' && scope.builders.has(lastSegment(text(callee.receiver))))
+                continue;
+            // Executing a PREPARED statement: the arguments are bound parameters, not
+            // the instruction. Recorded as a clean flow so the signature-based guess
+            // at this line is withdrawn too - correct code should end up silent.
+            if (sink.kind === 'sql' && scope.prepared.has(lastSegment(text(callee.receiver)))) {
+                sanitized.push({
+                    ruleId: SINK_KIND_RULE[sink.kind],
+                    sinkNode: node,
+                    kind: sink.kind,
+                    filePath: toDisplay(currentPath),
+                    reason: `\`${lastSegment(text(callee.receiver))}\` is a prepared statement, so what is passed here is bound ` +
+                        `as a parameter - data, never part of the query text`,
+                });
+                continue;
+            }
+            const indexes = sink.argIndexes === 'all' ? args.map((_, index) => index) : sink.argIndexes;
+            /*
+             * Sinks whose destination is ARGUMENT ZERO, not the receiver.
+             * `fmt.Fprintf(w, ...)` - see writerArgPattern in types.ts.
+             */
+            if (sink.writerArgPattern) {
+                const writer = args[0] ? text(args[0]) : '';
+                const declared = fileTypes.get(writer) ?? fileTypes.get(lastSegment(writer)) ?? '';
+                if (!sink.writerArgPattern.test(writer) && !sink.writerArgPattern.test(declared))
+                    continue;
+            }
+            for (const index of indexes) {
+                // Argument zero is the destination, not the payload.
+                if (sink.writerArgPattern && index === 0)
+                    continue;
+                const arg = args[index];
+                if (!arg)
+                    continue;
+                // Ambiguous method names need the content to agree - but ONLY when we
+                // can actually see the content. `db.query(sql)` shows us nothing: the
+                // query text was built on an earlier line. There we trust the sink name
+                // plus the traced flow instead. Demanding visible SQL in that case was
+                // a real bug - it silently discarded the most common verified flow of
+                // all, the one that goes through a variable.
+                if (sink.contentCheck) {
+                    const built = analyzeStringExpression(arg, language);
+                    if (built.literalText.length > 0) {
+                        const looksRight = sink.contentCheck === 'sql'
+                            ? looksLikeSql(built.literalText)
+                            : looksLikeHtml(built.literalText);
+                        if (!looksRight)
+                            continue;
+                    }
+                }
+                const taint = evaluate(arg, scope);
+                if (!taint)
+                    continue;
+                // Properly washed for THIS kind of sink. Not a finding - and worth
+                // recording, because it lets the scan RETRACT the signature-based
+                // guess at this line instead of nagging about code that is provably
+                // correct. Confirmed-clean is a result too.
+                const verdict = retracted(taint, arg, sink.kind);
+                if (verdict) {
+                    if (verdict === 'sanitised')
+                        recordRetraction(node, sink.kind, taint);
+                    continue;
+                }
+                // PHP's file_get_contents("http://" . $host) is a request, never a
+                // file on disk: `../` there climbs a URL. It is the SSRF sink's line.
+                if (sink.kind === 'path' && /^(https?|ftps?):\/\//i.test(taint.urlPrefix ?? ''))
+                    continue;
+                // ponytail: a bare `..` upload name still names the parent folder itself;
+                // it cannot reach a file in it. Track literal slashes joined in if that matters.
+                if (sink.kind === 'path' && taint.fileNameOnly)
+                    continue;
+                results.push({
+                    ruleId: SINK_KIND_RULE[sink.kind],
+                    kind: sink.kind,
+                    node: arg,
+                    sinkNode: node,
+                    path: buildPath(taint, node, sink.kind, `reaches ${sink.description} via \`${callee.text}()\``),
+                    origin: taint.origin,
+                    sinkDescription: sink.description,
+                    unknownHops: taint.unknownHops,
+                    branchAssumed: taint.branchAssumed ?? false,
+                    containerGuess: taint.containerGuess ?? false,
+                    quoteUnknown: taint.quotePending?.includes(sink.kind) ?? false,
+                    fixedDestination: fixedDestinationOf(taint, sink.kind),
+                    localSource: sink.kind === 'path' && taint.fromLocal ? true : undefined,
+                    filePath: toDisplay(currentPath),
+                });
+            }
+        }
+    };
+    const checkAssignSink = (assignNode, target, value, taint) => {
+        // The sigil goes the same way it does for receivers: PHP writes $html and
+        // the sink list holds html. See ownerName() for the receiver-side twin.
+        const name = lastSegment(text(target)).replace(/^["']|["']$/g, '').replace(/^[$*&]+/, '');
+        for (const sink of dictionary.assignSinks) {
+            if (!sink.properties.includes(name))
+                continue;
+            // A name-based sink has to see the shape it claims to parse. See the
+            // note on contentCheck in types.ts - `$sql .= $where` is not a page.
+            if (sink.contentCheck === 'html' && !looksLikeHtml(text(value)))
+                continue;
+            if (sink.contentCheck === 'sql' && !looksLikeSql(text(value)))
+                continue;
+            const verdict = retracted(taint, value, sink.kind);
+            if (verdict) {
+                if (verdict === 'sanitised')
+                    recordRetraction(assignNode, sink.kind, taint);
+                continue;
+            }
+            results.push({
+                ruleId: SINK_KIND_RULE[sink.kind],
+                kind: sink.kind,
+                node: value,
+                sinkNode: assignNode,
+                path: buildPath(taint, assignNode, sink.kind, `assigned to \`${text(target)}\` - ${sink.description}`),
+                origin: taint.origin,
+                sinkDescription: sink.description,
+                unknownHops: taint.unknownHops,
+                branchAssumed: taint.branchAssumed ?? false,
+                containerGuess: taint.containerGuess ?? false,
+                quoteUnknown: taint.quotePending?.includes(sink.kind) ?? false,
+                fixedDestination: fixedDestinationOf(taint, sink.kind),
+                localSource: sink.kind === 'path' && taint.fromLocal ? true : undefined,
+                filePath: toDisplay(currentPath),
+            });
+        }
+    };
+    /* ---- the statement walk ---- */
+    /** Does this node sit inside a branch or loop body within the current scope? */
+    /**
+     * A NULL DEFAULT IS NOT A SANITISER.
+     *
+     *     String param = request.getParameter("q");   // tainted
+     *     if (param == null) param = "";              // clean write, conditional
+     *
+     * `underCondition` sees a clean write it cannot prove happens and marks the
+     * taint `branchAssumed`, which costs the finding its proof. But the two cases
+     * here are DISJOINT: the write fires only when the value is null, and the
+     * taint exists only when it is not. Nothing was assumed - the tainted path is
+     * the only path there is. And in the case the guard does fire, what reaches
+     * the sink is a constant carrying no payload.
+     *
+     * THE OPERATOR IS THE WHOLE RULE. `if (x != null) x = "safe"` puts the clean
+     * write exactly on the tainted value and really might clean it; that one must
+     * stay a guess. So this matches equality-against-null only, on the same name
+     * being written, and demands that EVERY enclosing conditional qualify - one
+     * ordinary `if` in the chain and we know nothing again.
+     *
+     * Measured before building: 171 of BenchmarkJava's 320 found-but-unproven
+     * real vulnerabilities are downgraded for an unevaluated branch, and this
+     * idiom is the largest single shape among them. It is also ordinary Java
+     * rather than a benchmark artefact, which is why it was worth doing first.
+     */
+    const NULL_LITERALS = 'null|NULL|None|nil|undefined';
+    const guardCannotCleanTarget = (node, body, targetName) => {
+        const name = targetName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const test = new RegExp(`^\\(?\\s*(?:${name}\\s*={2,3}\\s*(?:${NULL_LITERALS})` +
+            `|(?:${NULL_LITERALS})\\s*={2,3}\\s*${name}` +
+            `|${name}\\s+is\\s+None)\\s*\\)?$`);
+        let current = node.parent;
+        let seen = 0;
+        while (current && current !== body) {
+            if (CONDITIONAL_NODES.has(current.type)) {
+                // An `else` branch of a null test is the NON-null path - the opposite
+                // case - so it never qualifies.
+                if (current.type !== 'if_statement')
+                    return false;
+                const condition = current.childForFieldName('condition');
+                if (!condition)
+                    return false;
+                if (!test.test(text(condition).trim()))
+                    return false;
+                seen++;
+            }
+            current = current.parent;
+        }
+        return seen > 0;
+    };
+    /*
+     * THE CLEAN WRITE AND THE DIRTY ONE ARE IN DIFFERENT ARMS OF ONE IF/ELSE.
+     *
+     *     if (values != null && values.length > 0) param = values[0];
+     *     else param = "";
+     *     ... param ...
+     *
+     * At most one arm runs, so the clean write never lands on top of the dirty
+     * one: after the if/else, on every run that took the first arm, `param` is
+     * the request value. Nothing is assumed there - the path is as proven as any
+     * other path through an `if` this engine does not evaluate. The opposite
+     * order (clean first, dirty in the else) never set the flag at all - see
+     * BranchAndContainer.java - so one decision was labelled two ways depending
+     * on which arm was written first.
+     *
+     * INSIDE the clean arm it is the other way round: after `param = ""` the
+     * value IS clean, and a sink there must not be proven (branch-assumed.py,
+     * from Django). So the flag is set as before, and taken off again only when
+     * the walk leaves the if/else - settleArms - and only if nothing has written
+     * the name since.
+     *
+     * Returns that if/else, or null. The dirty write is found by the last step
+     * of the kept taint, which is where it was stored. Every `if` around the
+     * clean write is tried, so an `else if` chain is covered: the clean write
+     * sits in one arm of the outer `if` even when nested in an inner one.
+     */
+    /** Per branch: what a name should hold once the walk leaves it, if nothing wrote it since. */
+    const armSettles = new Map();
+    /** Kinds a value is washed for, counting escaping still waiting on its quotes as not washed. */
+    const washedKinds = (t) => [...t.sanitizedFor].filter((k) => !(t.quotePending ?? []).includes(k));
+    const settleArms = (node, scope) => {
+        const key = spanKey(scope.filePath, node);
+        const pending = armSettles.get(key);
+        if (!pending)
+            return;
+        armSettles.delete(key);
+        // Newest first: a second clean arm re-flags the first one's flagged value,
+        // and unwinding in reverse lands on the original. A name written again
+        // since is left alone. That is the cautious side, kept on purpose: every
+        // case worked through gives the same or a more guarded answer with it, so
+        // no fixture can tell it apart - it is the one check here no test pins.
+        // An assumption it keeps costs a proof; an assumption it lifted wrongly
+        // would publish one.
+        for (const { target, inside, after } of [...pending].reverse()) {
+            if (scope.env.get(target) === inside)
+                scope.env.set(target, after);
+        }
+    };
+    /*
+     * The branch that can skip a write on a run where the dirty write it lands
+     * on happened: the first branch or loop around the write that does not also
+     * hold the dirty write - an `if` it sits in alone, the other arm of an
+     * if/else, a loop that may run no times. Null when there is none.
+     *
+     *     if (isset($_GET['q'])) {
+     *         $q = $_GET['q'];
+     *         $q = htmlspecialchars($q);    // same block: runs whenever the line above did
+     *         echo $q;
+     *     }
+     *
+     * That escape is certain, and the last write may win. Without this test the
+     * washed-write rule flagged it and took away a correct "cleared". A dirty
+     * write it cannot place - another file - counts as skippable by the
+     * outermost branch around the write.
+     */
+    const skippedBy = (write, kept, body, filePath) => {
+        const stored = kept.steps[kept.steps.length - 1]?.location;
+        const at = stored && stored.file === toDisplay(filePath)
+            ? { row: stored.startLine - 1, column: stored.startColumn - 1 }
+            : null;
+        let child = write;
+        let current = write.parent;
+        let outermost = null;
+        while (current && current !== body) {
+            if (CONDITIONAL_NODES.has(current.type)) {
+                // The first branch around the write that the dirty write is not in.
+                if (at && !holds(child, at))
+                    return current;
+                outermost = current;
+            }
+            child = current;
+            current = current.parent;
+        }
+        // A dirty write in another file: skippable by every branch around this one.
+        return at ? null : outermost;
+    };
+    /** Whether a 0-based position lies inside a node. */
+    const holds = (n, at) => {
+        const s = n.startPosition;
+        const e = n.endPosition;
+        const afterStart = at.row > s.row || (at.row === s.row && at.column >= s.column);
+        const beforeEnd = at.row < e.row || (at.row === e.row && at.column < e.column);
+        return afterStart && beforeEnd;
+    };
+    const inOtherArm = (clean, kept, body, filePath) => {
+        const stored = kept.steps[kept.steps.length - 1]?.location;
+        if (!stored || stored.file !== toDisplay(filePath))
+            return null;
+        const at = { row: stored.startLine - 1, column: stored.startColumn - 1 };
+        const contains = (n) => {
+            const s = n.startPosition;
+            const e = n.endPosition;
+            const afterStart = at.row > s.row || (at.row === s.row && at.column >= s.column);
+            const beforeEnd = at.row < e.row || (at.row === e.row && at.column < e.column);
+            return afterStart && beforeEnd;
+        };
+        let child = clean;
+        let current = clean.parent;
+        while (current && current !== body) {
+            if (current.type === 'if_statement' && contains(current)) {
+                const condition = current.childForFieldName('condition');
+                const sameAsChild = (n) => n.startIndex === child.startIndex && n.endIndex === child.endIndex;
+                const inCondition = condition !== null && sameAsChild(condition);
+                if (!inCondition) {
+                    for (const arm of current.namedChildren) {
+                        if (!arm || sameAsChild(arm))
+                            continue;
+                        if (condition && arm.startIndex === condition.startIndex && arm.endIndex === condition.endIndex)
+                            continue;
+                        if (contains(arm))
+                            return current;
+                    }
+                }
+            }
+            child = current;
+            current = current.parent;
+        }
+        return null;
+    };
+    // The constant folder lives in fold.ts now, shared with the signature rules.
+    const { conditionTruth, ternaryParts, deadBranchOf, switchDecision } = createFolder(language);
+    /*
+     * A switch is decided once per site, not once per statement inside it. Keyed
+     * by file and span: the tracer walks into other files' functions, and a span
+     * alone means nothing across files.
+     */
+    const switchDecisions = new Map();
+    const decideSwitch = (node, body, filePath) => {
+        const key = `${filePath}\0${node.startIndex}:${node.endIndex}`;
+        if (!switchDecisions.has(key))
+            switchDecisions.set(key, switchDecision(node, body));
+        return switchDecisions.get(key) ?? null;
+    };
+    /** Case groups of decided switches that cannot run. The walk never enters them. */
+    const deadCases = new Set();
+    const spanKey = (filePath, node) => `${filePath}\0${node.startIndex}:${node.endIndex}`;
+    /*
+     * The switch a switch-internal conditional node belongs to, within two levels.
+     * Only a PART of a switch qualifies: an `if` inside a Go case is two levels
+     * below the switch too, and mistaking it for the switch would treat the body
+     * of that `if` as certain.
+     */
+    const SWITCH_PARTS = new Set([
+        'switch_block', 'switch_body', 'case_statement', 'default_statement',
+        'switch_case', 'switch_default', 'expression_case', 'default_case',
+    ]);
+    const owningSwitch = (current) => {
+        if (SWITCH_NODES.has(current.type))
+            return current;
+        if (!SWITCH_PARTS.has(current.type))
+            return null;
+        const up = current.parent;
+        if (up && SWITCH_NODES.has(up.type))
+            return up;
+        const upper = up?.parent ?? null;
+        return upper && SWITCH_NODES.has(upper.type) ? upper : null;
+    };
+    const underCondition = (node, body, filePath) => {
+        let current = node.parent;
+        while (current && current !== body) {
+            if (CONDITIONAL_NODES.has(current.type)) {
+                /*
+                 * A case of a decided switch that runs EVERY time the switch does is no
+                 * more conditional than the if-true below - see switchDecision in
+                 * fold.ts for what "every time" has to survive.
+                 */
+                const sw = owningSwitch(current);
+                if (sw) {
+                    const decision = decideSwitch(sw, body, filePath);
+                    if (decision?.certain(node)) {
+                        current = sw.parent;
+                        continue;
+                    }
+                    return true;
+                }
+                /*
+                 * An `if` whose condition is decidably TRUE is not a condition at all -
+                 * the block runs every time. Without this the folder would silence the
+                 * dead arm and still refuse to call the live arm proven, which would be
+                 * a strange half-answer: certain enough to drop one side, not certain
+                 * enough to trust the other.
+                 */
+                if (current.type === 'if_statement' && conditionTruth(current.childForFieldName('condition'), body) === true) {
+                    current = current.parent;
+                    continue;
+                }
+                return true;
+            }
+            current = current.parent;
+        }
+        return false;
+    };
+    // assignmentParts and ASSIGNMENT_NODES live in fold.ts, which needs them too.
+    /** PHP statements that write their argument straight to the response body. */
+    const ECHO_NODES = new Set(['echo_statement', 'print_intrinsic']);
+    /**
+     * How deep the statement walk will recurse into a syntax tree.
+     *
+     * `0 + 1 + 2 + ... + 1499` parses as a binary_expression nested 1,499 deep,
+     * and each level is one stack frame here. Node's default stack takes roughly
+     * a thousand of these frames before it gives up and kills the process, which
+     * means one file in TypeScript's own test suite could destroy a 25,809-file
+     * scan and return NOTHING - no findings, no report, no partial result.
+     *
+     * 400 is comfortably under the limit and far past any hand-written code.
+     * Anything deeper is generated, minified or a stress test, and the honest
+     * response is to stop and count it rather than to crash or to pretend the
+     * file was fully examined.
+     */
+    const MAX_AST_DEPTH = 400;
+    const walk = (node, scope, depth = 0) => {
+        if (depth > MAX_AST_DEPTH) {
+            seenDeepAst.add(siteOf(node, scope.filePath));
+            return;
+        }
+        /*
+         * A case that cannot run is not walked, exactly like the dead arm of an if
+         * below: a write in it never happened, so it is never recorded - neither a
+         * tainted write that would invent a flow, nor a clean one that would cost a
+         * real flow its proof. SwitchOnConstant.java.
+         */
+        if (deadCases.size > 0 && deadCases.has(spanKey(scope.filePath, node)))
+            return;
+        if (SWITCH_NODES.has(node.type)) {
+            const decision = decideSwitch(node, scope.body, scope.filePath);
+            for (const dead of decision?.dead ?? []) {
+                deadCases.add(spanKey(scope.filePath, dead));
+                noteUnreachable(dead, scope.filePath, decision?.note ?? 'the switch is decided at compile time');
+            }
+        }
+        /*
+         * Do not walk into a branch that cannot run.
+         *
+         * The ternary case above decides which VALUE comes out of an expression.
+         * This decides which STATEMENTS happen at all, which is what the `if/else`
+         * form of the same decoy needs - a write inside the dead arm should never
+         * be recorded, rather than recorded and then reasoned about.
+         *
+         * Nothing is skipped unless the condition folded to a definite answer, so
+         * an undecidable `if` still has both arms walked exactly as before.
+         */
+        if (node.type === 'if_statement') {
+            const dead = deadBranchOf(node, scope.body);
+            if (dead) {
+                const truth = conditionTruth(node.childForFieldName('condition'), scope.body);
+                noteUnreachable(dead, scope.filePath, `the condition on line ${node.startPosition.row + 1} is always ${truth ? 'true' : 'false'}`);
+                /*
+                 * Compared by source span, not by identity. The tree-sitter binding
+                 * hands back a fresh wrapper object each time a child is asked for, so
+                 * `child !== dead` was true even for the very node we meant to skip -
+                 * the branch folded correctly and then got walked anyway.
+                 */
+                for (const child of node.namedChildren) {
+                    if (!child)
+                        continue;
+                    if (child.startIndex === dead.startIndex && child.endIndex === dead.endIndex)
+                        continue;
+                    walk(child, scope, depth + 1);
+                }
+                return;
+            }
+        }
+        // A nested function is a separate notebook. Queue it, don't descend.
+        if (node !== scope.body && functionTypes.has(node.type)) {
+            const body = node.childForFieldName('body') ?? node;
+            const env = new Map(scope.env);
+            /*
+             * PARAMETERS THAT ARE ALREADY ATTACKER-CONTROLLED WHEN THE BODY STARTS.
+             *
+             * Every other source is an expression the body evaluates. A framework
+             * binding is not: Spring reads the query string, converts it, and hands
+             * the method a plain String. By the time the body runs there is nothing
+             * left to match - the only evidence is the annotation on the declaration,
+             * which is why this has to happen HERE, as the scope is created, rather
+             * than in sourceTaint().
+             *
+             * Zero flow-verified findings on OWASP WebGoat is what this cost. See the
+             * long note on parameterSources in dictionaries.ts.
+             */
+            for (const source of dictionary.parameterSources ?? []) {
+                for (const parameter of parameterDeclarations(node)) {
+                    if (!parameter.name || !source.pattern.test(parameter.text))
+                        continue;
+                    seenSources.add(siteOf(parameter.node, scope.filePath));
+                    env.set(parameter.name, {
+                        steps: [
+                            step('source', parameter.node, `\`${parameter.name}\` is ${source.description}`),
+                        ],
+                        sanitizedFor: new Set(),
+                        origin: parameter.name,
+                        unknownHops: [],
+                    });
+                }
+            }
+            for (const parameter of parameterDeclarations(node)) {
+                const route = routePathFor(node, parameter.name);
+                if (!route)
+                    continue;
+                seenSources.add(siteOf(parameter.node, scope.filePath));
+                env.set(parameter.name, {
+                    steps: [
+                        step('source', parameter.node, `\`${parameter.name}\` is bound from the URL path ${route}`),
+                    ],
+                    sanitizedFor: new Set(),
+                    origin: parameter.name,
+                    unknownHops: [],
+                });
+            }
+            queue.push({
+                body,
+                env,
+                filePath: scope.filePath,
+                prepared: new Set(scope.prepared),
+                builders: new Set(scope.builders),
+            });
+            return;
+        }
+        /*
+         * PHP `echo $x;` and `print $x;`.
+         *
+         * These are statements, not assignments and not calls, so neither of the
+         * two shapes below sees them - and `echo` is the single most common way a
+         * PHP page writes attacker data into a page. The value it prints is the
+         * same question an assign-sink asks, so it is routed there, with the `echo`
+         * keyword itself standing in as the "property" being written.
+         */
+        if (ECHO_NODES.has(node.type)) {
+            const keyword = node.child(0);
+            for (const printed of node.namedChildren) {
+                if (!printed)
+                    continue;
+                const taint = evaluate(printed, scope);
+                if (taint && keyword)
+                    checkAssignSink(node, keyword, printed, taint);
+            }
+        }
+        /*
+         * A FOR-EACH INTRODUCES A NAME, AND NOTHING WAS BINDING IT.
+         *
+         *     String[] values = request.getParameterValues("q");
+         *     out.write(values[0]);                  // flow-verified
+         *     for (String v : values) out.write(v);  // signature-based only
+         *
+         * Subscripting a tainted array carried the taint; iterating the same array
+         * threw it away, because `v` was never entered into the environment and so
+         * evaluated to clean.
+         *
+         * The loop node types were ALREADY listed in CONDITIONAL_NODES - the tracer
+         * knew a for-each was a branch, and used that to decide a clean write inside
+         * one cannot prove a value safe. Knowing a construct exists and modelling
+         * what it does are different things, and the first reads exactly like the
+         * second until something measures it.
+         *
+         * Found by diagnosing BenchmarkJava's remaining 123 misses: every one had no
+         * source recognised, and fourteen of them were `for (Cookie c :
+         * request.getCookies())` - a source this engine has always known, thrown
+         * away by the loop around it. It looked like a cookie bug and was not.
+         *
+         * Container-insensitive, like every other collection in this engine: the
+         * loop variable takes the taint of the whole iterable, so iterating a list
+         * with one dirty element treats every element as dirty. That errs toward
+         * reporting, which is the direction this project takes on purpose.
+         */
+        if (FOREACH_NODES.has(node.type)) {
+            const binding = foreachBinding(node);
+            if (binding) {
+                const taint = evaluate(binding.iterable, scope);
+                const name = text(binding.name).replace(/^[$*&]+/, '').trim();
+                if (taint && /^[A-Za-z_$][\w$]*$/.test(name)) {
+                    scope.env.set(name, addStep(taint, binding.name, `bound to \`${name}\` by a for-each over the collection`));
+                }
+            }
+        }
+        if (ASSIGNMENT_NODES.has(node.type)) {
+            const parts = assignmentParts(node);
+            if (parts) {
+                const taint = evaluate(parts.value, scope);
+                if (taint)
+                    checkAssignSink(node, parts.target, parts.value, taint);
+                // Record it in the notebook, but only for plain variable names.
+                // `obj.field = dirty` is not tracked - tracking object fields properly
+                // needs alias analysis, which is well beyond this phase.
+                //
+                // Go's `id, err := strconv.Atoi(x)` puts several names on the left. We
+                // bind every one of them to the same taint. It is imprecise - only one
+                // of the returned values really carries it - but erring this way keeps
+                // the extremely common `value, err :=` idiom traceable, and it is
+                // recorded in the Go coverage note rather than left as a surprise.
+                const targetNames = (parts.target.type === 'expression_list'
+                    ? parts.target.namedChildren.filter((c) => c !== null).map((c) => text(c))
+                    : DESTRUCTURING_NODES.has(parts.target.type)
+                        ? namesBoundBy(parts.target)
+                        : [text(parts.target)]).map(stripDeclarator);
+                // `stmt, err := db.Prepare(sql)` - remember that `stmt` is a handle.
+                // Go wraps the right-hand side in an expression_list, so unwrap first;
+                // without this the check silently never fired.
+                const valueNode = parts.value.type === 'expression_list' && parts.value.namedChildCount >= 1
+                    ? parts.value.namedChildren[0] ?? parts.value
+                    : parts.value;
+                if (CALL_NODES.has(valueNode.type)) {
+                    const preparedBy = lastSegment(calleeOf(valueNode).text);
+                    if (/^(StringBuilder|StringBuffer)$/.test(preparedBy)) {
+                        for (const targetName of targetNames)
+                            scope.builders.add(targetName);
+                    }
+                    if (PREPARE_CALLS.has(preparedBy)) {
+                        for (const targetName of targetNames)
+                            scope.prepared.add(targetName);
+                    }
+                }
+                /*
+                 * `s += x` EXTENDS s. It does not replace it.
+                 *
+                 * Every node type in ASSIGNMENT_NODES was being applied as "the target
+                 * now holds the right-hand side", which is right for `=` and wrong for
+                 * `+=`. A clean right-hand side therefore deleted the target's taint,
+                 * and this is the shape it broke:
+                 *
+                 *     String sql = "SELECT * FROM t WHERE x = '";
+                 *     sql += request.getParameter("x");   // sql is dirty
+                 *     sql += "'";                         // sql was wiped clean here
+                 *     stmt.execute(sql);                  // reported nothing at all
+                 *
+                 * That is the canonical injection, written the way people write it.
+                 * Found in C++ and assumed to be a C++ problem; rewriting it in four
+                 * other languages showed JavaScript, Python and Java all lost the value
+                 * identically, and only PHP survived. It was never about C++.
+                 *
+                 * Only `+=` and `.=` qualify. The other compound operators keep the old
+                 * value too, but `s -= x` and `s *= x` produce a number, and a number
+                 * cannot be a shell command - the same reason BINARY_CARRIERS holds
+                 * only the operators that can still carry an attacker's shape.
+                 *
+                 * Measured per language rather than assumed: C++, Java and Go spell
+                 * this `assignment_expression`/`assignment_statement` with a `+=`
+                 * operator, while JS, Python and PHP use a distinct augmented node. All
+                 * six expose the same `operator` field, so the operator decides and the
+                 * node type does not have to.
+                 */
+                const operator = node.childForFieldName('operator')?.text ?? '';
+                const extendsTarget = operator === '+=' || operator === '.=';
+                /*
+                 * `m['k'] = v` WRITES ONE ELEMENT. It does not replace `m`.
+                 *
+                 * stripDeclarator turns `m['k']` into `m` (it exists for C's `buf[10]`),
+                 * so an element write was applied as `m = v`. BenchmarkPython 00189:
+                 *
+                 *     m['keyB'] = param           # m dirty
+                 *     m['keyC'] = 'another'       # m wiped clean - the whole dict
+                 *     bar = m['keyB']             # silent: not even "to review"
+                 *
+                 * And the mirror image claimed a proof it did not have: one dirty
+                 * element, then a read of a CLEAN key, read back the dirt as certain.
+                 * Now the container keeps every element: a clean write leaves the dirt
+                 * where it is, a dirty one joins it, and a container holding more than
+                 * one element is marked collectedMany, so reading ONE back is a guess
+                 * unless local-map.ts can show which write it returns.
+                 */
+                const elementWrite = ELEMENT_TARGETS.has(parts.target.type) && targetNames.length === 1 && /^[A-Za-z_$][\w$]*$/.test(targetNames[0]);
+                if (elementWrite) {
+                    const name = targetNames[0];
+                    const before = scope.env.get(name);
+                    const many = !!before || elementCount(node, name) > 1;
+                    if (taint) {
+                        const stored = addStep(taint, parts.target, `written into an element of \`${name}\``);
+                        // joinParts, but not `joined`: that marks a string built from parts.
+                        const both = before ? { ...joinParts([before, stored]), joined: before.joined } : stored;
+                        scope.env.set(name, many ? { ...both, collectedMany: true } : both);
+                    }
+                    else if (before) {
+                        scope.env.set(name, { ...before, collectedMany: true });
+                    }
+                }
+                for (const targetName of elementWrite ? [] : targetNames) {
+                    if (!/^[A-Za-z_$][\w$]*$/.test(targetName))
+                        continue;
+                    const before = scope.env.get(targetName);
+                    if (taint &&
+                        before &&
+                        !extendsTarget &&
+                        washedKinds(taint).some((k) => !washedKinds(before).includes(k)) &&
+                        underCondition(node, scope.body, scope.filePath) &&
+                        skippedBy(node, before, scope.body, scope.filePath) !== null) {
+                        /*
+                         * A CONDITIONAL WRITE OF A WASHED VALUE OVER A DIRTY ONE.
+                         *
+                         *     if (raw) p = input; else p = escapeHtml(input);
+                         *     out.println(p);
+                         *
+                         * This printed "checked and cleared": the last write wins in this
+                         * engine, and the last write was the escaped one. On every run that
+                         * takes the first arm the page gets the raw input. A conditional
+                         * CLEAN write was already handled below - kept the dirt, flagged the
+                         * assumption - but a washed value is not clean, it is a taint, so it
+                         * took this branch and replaced the dirt outright.
+                         *
+                         * Inside the branch, after the write, the value IS the washed one -
+                         * DVWA's sqli/source/impossible.php checks is_numeric(), calls
+                         * intval() and prints, all in one block, and that stays cleared.
+                         * When the walk leaves the branch that could skip the write, the
+                         * name holds either value, so the old dirt comes back for every
+                         * kind the new value does not wash. That is flagged as resting on a
+                         * branch, like a skipped clean write - unless the dirty write sits
+                         * in the other arm of one if/else (inOtherArm), where the run that
+                         * took that arm certainly delivers it.
+                         */
+                        const stored = addStep(taint, parts.target, `stored in \`${targetName}\``);
+                        scope.env.set(targetName, stored);
+                        const block = skippedBy(node, before, scope.body, scope.filePath);
+                        if (block) {
+                            const pendingEither = [...new Set([...(before.quotePending ?? []), ...(taint.quotePending ?? [])])];
+                            const either = {
+                                ...before,
+                                sanitizedFor: new Set([...before.sanitizedFor].filter((k) => taint.sanitizedFor.has(k))),
+                                afterWash: joinedAfterWash([before, taint], new Set([...before.sanitizedFor].filter((k) => taint.sanitizedFor.has(k)))),
+                                quotePending: pendingEither.length > 0 ? pendingEither : undefined,
+                                branchAssumed: inOtherArm(node, before, scope.body, scope.filePath) ? before.branchAssumed : true,
+                            };
+                            const key = spanKey(scope.filePath, block);
+                            armSettles.set(key, [...(armSettles.get(key) ?? []), { target: targetName, inside: stored, after: either }]);
+                        }
+                    }
+                    else if (taint) {
+                        const stored = addStep(taint, parts.target, `stored in \`${targetName}\``);
+                        // The value now has a name - see `throughOf`. Not for `.=`/`+=`,
+                        // whose result also holds whatever the name held before.
+                        if (guardOn && !extendsTarget && targetNames.length === 1) {
+                            const binding = `${scope.filePath}#${node.id}#${targetName}`;
+                            bindingOf.set(stored, binding);
+                            throughOf.set(stored, new Set([...(throughOf.get(taint) ?? []), binding]));
+                        }
+                        scope.env.set(targetName, stored);
+                    }
+                    else if (extendsTarget) {
+                        // Appending something clean to a dirty value leaves it dirty.
+                        continue;
+                    }
+                    else if (scope.env.has(targetName) && underCondition(node, scope.body, scope.filePath)) {
+                        /*
+                         * A clean write we cannot prove happens. Keep the dirt - but record
+                         * that we ASSUMED rather than followed, so no proof is claimed on
+                         * the strength of it. See the note on branchAssumed.
+                         */
+                        const kept = scope.env.get(targetName);
+                        if (kept) {
+                            const certain = guardCannotCleanTarget(node, scope.body, targetName);
+                            const assumed = { ...kept, branchAssumed: true };
+                            scope.env.set(targetName, certain ? kept : assumed);
+                            // Clean and dirty writes in different arms of one if/else: the
+                            // assumption holds only until that if/else ends - see inOtherArm.
+                            const shared = certain ? null : inOtherArm(node, kept, scope.body, scope.filePath);
+                            if (shared) {
+                                const key = spanKey(scope.filePath, shared);
+                                armSettles.set(key, [...(armSettles.get(key) ?? []), { target: targetName, inside: assumed, after: kept }]);
+                            }
+                        }
+                    }
+                    else {
+                        scope.env.delete(targetName); // reassigned to something clean
+                    }
+                }
+                // Still descend into the value: `const x = db.query(dirty)` has a sink
+                // inside an assignment.
+                //
+                // All THREE dispatches, not just the argument one. `Process p =
+                // pb.start();` is an assignment whose value is a receiver sink, and it
+                // is the standard idiom - the return is captured even though the
+                // dangerous act needs no arguments. Having one dispatch here and three
+                // in the statement branch meant the same call was analysed differently
+                // depending on whether anybody kept its result.
+                for (const child of parts.value.namedChildren)
+                    if (child)
+                        walk(child, scope, depth + 1);
+                if (CALL_NODES.has(parts.value.type)) {
+                    checkMutation(parts.value, scope);
+                    checkOutParamMutation(parts.value, scope);
+                    checkReceiverSink(parts.value, scope);
+                    checkCallSink(parts.value, scope);
+                }
+                return;
+            }
+        }
+        if (node.type === 'return_statement') {
+            const expression = node.namedChildren.find((c) => c !== null) ?? null;
+            const returned = expression ? evaluate(expression, scope) : null;
+            // Returning a page IS writing a page, in a framework where the view's
+            // return value is the response body. Without this the most ordinary
+            // reflected XSS in Flask - `return f"<h1>{name}</h1>"` - produced nothing
+            // at all, and the correctly-escaped version of the same code looked
+            // "clean" only because no sink existed for the escaping to be credited
+            // against. Two cases passing for the wrong reason is worse than one
+            // failing for the right one.
+            // `return render_template_string("<h1>" + name)` is ALREADY a call sink.
+            // Counting the return as a second sink reported the same bug twice at the
+            // same line, and double-recorded the escaped version as clean. The return
+            // only adds something when the returned expression IS the string.
+            const returnsAString = expression !== null && !CALL_NODES.has(expression.type);
+            const flaskRoute = language === 'python' && expression !== null && flaskRouteReturningStr(node, expression);
+            if (dictionary.htmlReturnIsSink &&
+                returned &&
+                expression &&
+                returnsAString &&
+                (looksLikeHtml(text(expression)) || flaskRoute)) {
+                checkTaintAtSink(returned, expression, 'xss', 'an HTML response body returned by this function', flaskRoute
+                    ? 'is returned as a str from a Flask route (`@...route`), which Flask sends as the ' +
+                        'response body with Content-Type text/html - markup in the value is rendered. A ' +
+                        'content type changed elsewhere (after_request, a config default) is not seen.'
+                    : 'is returned from this function as an HTML string - in Flask/Django a view\'s ' +
+                        'return value IS the response body. We do not verify that this function is a ' +
+                        'route handler; if it is not, this string is rendered somewhere else instead.');
+            }
+            // While analysing a called function, remember what it hands back.
+            if (scope.onReturn)
+                scope.onReturn(returned, node);
+        }
+        if (CALL_NODES.has(node.type)) {
+            checkMutation(node, scope);
+            checkOutParamMutation(node, scope);
+            checkReceiverSink(node, scope);
+            checkCallSink(node, scope);
+            // A bare call statement - `helper(req.query.id);` - is never evaluated as
+            // an expression, so without this line the cross-function trace would only
+            // work when the result was assigned to something. Easy gap to miss.
+            descendIntoLocalCall(node, scope, 0);
+        }
+        for (const child of node.namedChildren) {
+            if (child)
+                walk(child, scope, depth + 1);
+        }
+        if (armSettles.size > 0)
+            settleArms(node, scope);
+    };
+    /* ---- following a value into another function ---- */
+    descendIntoLocalCall = (node, scope, depth) => {
+        const { text: calleeText } = calleeOf(node);
+        const calleeName = lastSegment(calleeText);
+        /*
+         * A FULLY QUALIFIED CALL IS NOT A LOCAL FUNCTION, however the names line up.
+         *
+         *     java.util.Collections.list(request.getParameterNames())
+         *
+         * resolved to a fixture's own `list(HttpServletRequest, HttpServletResponse)`
+         * three files away, because resolution used the LAST SEGMENT of the callee
+         * and threw the package path away. The descent then "handled" the call and
+         * returned that unrelated method's answer, which was nothing - so a proof
+         * that existed when the file was scanned alone disappeared when it was
+         * scanned alongside its neighbours.
+         *
+         * That is the worst shape a bug can take here: the same code, analysed
+         * twice, giving two answers, with no message either time.
+         *
+         * The engine's limitations already say "whether a function is actually
+         * EXPORTED is not checked - a module-private helper with a matching name
+         * could be entered". This is that, with a fact available to rule it out and
+         * nobody reading it. `java.util.Collections` names one class in one package;
+         * a local method cannot be it.
+         *
+         * The test is the Java package convention - lowercase segments then a
+         * Capitalised type - which is deliberately narrow. `Utils.list(x)` and
+         * `this.list(x)` are unqualified enough to still resolve locally, and are
+         * left alone.
+         */
+        if (/^[a-z][\w$]*(?:\.[a-z][\w$]*)+\.[A-Z][\w$]*\.[\w$]+$/.test(calleeText.trim())) {
+            return { handled: false, taint: null };
+        }
+        /* ---- PHASE 3c: the function may live in another file. ----
+         * We look locally first, then ask the project index. The index only
+         * answers when the answer is UNAMBIGUOUS - one file, one function. If
+         * three modules export `sanitize`, it says nothing and records that it
+         * declined, which is printed in the report. Picking one at random would be
+         * how a scanner ends up proving a path that does not exist.               */
+        /*
+         * A NAME IS NOT ENOUGH WHERE THE LANGUAGE COUNTS ARGUMENTS.
+         *
+         * Calls are resolved by name, and in BenchmarkJava that name was
+         * `doSomething` - which every test file declares. So a one-argument
+         * `thing.doSomething(param)` resolved to the file's own two-parameter
+         * `doSomething(request, param)`, the tainted value was bound to `request`,
+         * `param` arrived empty, and the flow vanished. In Java, Go and the C family
+         * a one-argument call cannot run a two-parameter function; the count rules
+         * it out. Python, JavaScript and PHP accept the wrong count, so there it
+         * proves nothing and is not used.
+         *
+         * A local function the call cannot reach is set aside and the project index
+         * asked instead, exactly as if the name had not been found here.
+         */
+        const argCount = argumentsOf(node).length;
+        // Only asked for when a same-named target actually exists - most calls
+        // (println, getParameter) have none, and never pay for the lookup.
+        const receiverTypeOfCall = () => {
+            const key = `${scope.filePath}\0${node.startIndex}:${node.endIndex}`;
+            if (!receiverTypes.has(key))
+                receiverTypes.set(key, javaReceiverType(node));
+            return receiverTypes.get(key) ?? null;
+        };
+        const reachable = (fn) => {
+            if (ARITY_ENFORCED.has(language) &&
+                fn.minArgs !== undefined &&
+                (argCount < fn.minArgs || argCount > (fn.maxArgs ?? Infinity))) {
+                return false;
+            }
+            /*
+             * A CALL ON A `Fragment` CAN ONLY RUN A `Fragment` METHOD.
+             *
+             * Across files in one package, the index answers whenever exactly one
+             * file declares the name - so `f.renderFragment(param)`, with `f`
+             * declared as an interface, was followed into an unrelated class that
+             * shared the method name and returned a constant. The flow came back
+             * clean. ReceiverTypeCaller.java is that case; SameNameDelegate.java
+             * found it by accident, passing alone and failing beside a fixture that
+             * declared its own doSomething.
+             *
+             * Java writes the receiver's type down, so a target declared in some
+             * other type is ruled out. An interface-typed receiver therefore reaches
+             * no body at all - which is correct: which implementation runs is a
+             * runtime fact, and the value is carried with that assumption named.
+             */
+            if (language === 'java') {
+                const declaring = declaringTypeOf(fn);
+                const receiverType = declaring ? receiverTypeOfCall() : null;
+                if (declaring && receiverType && declaring !== receiverType)
+                    return false;
+            }
+            return true;
+        };
+        let local = localFunctions.get(calleeName);
+        if (local && !reachable(local))
+            local = undefined;
+        let targetPath = scope.filePath;
+        if (!local && resolver) {
+            const resolved = resolver.resolve(scope.filePath, calleeName);
+            if (resolved && reachable(resolved.fn)) {
+                local = resolved.fn;
+                targetPath = resolved.path;
+            }
+        }
+        if (!local)
+            return { handled: false, taint: null };
+        /*
+         * THE TWO STOPS, AND WHAT A STOP IS ALLOWED TO CONCLUDE.
+         *
+         * "Both are recorded as misses, never as invented answers" - that is what
+         * this comment used to say, above two lines that returned `taint: null`.
+         * No taint IS an answer: it is "this value is clean", and it is the
+         * dangerous one. Every flow that reached a stop was silently cut, and the
+         * only trace of it was a counter.
+         *
+         * It cost all 38 of BenchmarkJava's missed vulnerabilities (a helper named
+         * doSomething calling thing.doSomething, taken for a call to itself), and it
+         * costs every delegating method - `run` forwarding to `self.engine.run` -
+         * and every call chain deeper than MAX_CALL_DEPTH, in every language.
+         *
+         * A stop now hands the call back as NOT HANDLED, which sends it to the
+         * branch this file already has for a function it cannot read: the value
+         * keeps its taint, and the path says, at that hop, that the trace stopped
+         * following and why. The assumption is made in the open, where a reader can
+         * check it - which is what the old comment promised and the code did not do.
+         */
+        const stackKey = `${targetPath}::${local.name}`;
+        if (callStack.length >= MAX_CALL_DEPTH) {
+            seenDepth.add(siteOf(node, scope.filePath));
+            return { handled: false, taint: null, stopped: 'depth' };
+        }
+        if (callStack.includes(stackKey)) {
+            seenRecursion.add(siteOf(node, scope.filePath));
+            return { handled: false, taint: null, stopped: 'recursion' };
+        }
+        // Which arguments are dirty, and what is their history so far?
+        const argumentTaints = argumentsOf(node).map((arg) => evaluate(arg, scope, depth + 1));
+        /* ---- the cache key has to include WHICH ARGUMENTS ARE DIRTY ----
+         *
+         * It used to be the call site alone (`file#nodeId`), and that quietly
+         * capped interprocedural tracing at ONE level.
+         *
+         * Why: the main walk visits every function body at top level, where the
+         * parameters are unbound. So `return s2(x)` inside `s1` is evaluated once
+         * with `x` clean, decides "no dirty arguments, nothing to do", and caches
+         * NULL against that call site. Later, when the tracer descends into `s1`
+         * from a real caller with `x` tainted, it reaches the same node id and gets
+         * handed back that stale null. The taint dies one level in.
+         *
+         * The outermost call is never poisoned this way - it is only ever seen with
+         * tainted arguments - which is exactly why `handler -> s1` worked and
+         * `handler -> s1 -> s2` did not, and why it looked like a depth limit doing
+         * its job. MAX_CALL_DEPTH is 4; the real reach was 1, and the capability
+         * text claiming four was wrong by three.
+         *
+         * Keyed by taint shape, the same call with the same dirty arguments still
+         * hits the cache - which is all the cache was ever for.                  */
+        const taintShape = argumentTaints.map((t) => (t ? '1' : '0')).join('');
+        const cacheKey = `${scope.filePath}#${node.id}#${taintShape}`;
+        if (descendCache.has(cacheKey)) {
+            return { handled: true, taint: descendCache.get(cacheKey) ?? null };
+        }
+        /**
+         * A helper can be worth entering even with entirely clean arguments, if it
+         * fetches attacker data ITSELF:
+         *
+         *     function readId(req) { return req.query.id; }
+         *     const id = readId(req);          // <- `req` alone is not a source
+         *     db.query("... " + id);
+         *
+         * `req` on its own does not match any source pattern (we only recognise
+         * `req.query`-shaped expressions), so the argument looks clean and the old
+         * check bailed out. Peeking at whether the body mentions a source at all is
+         * a cheap text test that unlocks this very common shape.
+         */
+        const bodyText = (local.body.text ?? '').slice(0, 4000);
+        const bodyFetchesASource = dictionary.sources.some((source) => source.pattern.test(bodyText));
+        if (!argumentTaints.some((t) => t !== null) && !bodyFetchesASource) {
+            descendCache.set(cacheKey, null);
+            return { handled: true, taint: null };
+        }
+        // Bind each dirty argument to the NAME the callee will use for it. This one
+        // line is the whole idea of interprocedural analysis: the value does not
+        // change, only what it is called.
+        const env = new Map();
+        local.params.forEach((parameter, index) => {
+            const taint = argumentTaints[index];
+            if (!parameter || !taint)
+                return;
+            env.set(parameter, addStep(taint, node, `passed into \`${local.name}()\` as parameter \`${parameter}\``));
+        });
+        if (env.size === 0 && !bodyFetchesASource) {
+            descendCache.set(cacheKey, null);
+            return { handled: true, taint: null };
+        }
+        let returned = null;
+        const calleeScope = {
+            body: local.body,
+            env,
+            filePath: targetPath,
+            prepared: new Set(),
+            builders: new Set(),
+            onReturn: (taint, returnNode) => {
+                if (taint && !returned) {
+                    returned = addStep(taint, returnNode, `returned from \`${local.name}()\``);
+                }
+            },
+        };
+        callStack.push(stackKey);
+        // Step into the callee's file for the duration of the descent, so every
+        // hop recorded in there points at the right file and line. Restored below.
+        const callerPath = currentPath;
+        currentPath = targetPath;
+        if (local.body.type === 'statement_block' || local.body.namedChildCount > 0) {
+            for (const child of local.body.namedChildren) {
+                if (child)
+                    walk(child, calleeScope);
+            }
+        }
+        // A concise arrow body (`x => f(x)`) is an expression, not a block: its
+        // value IS the return value, so evaluate it directly.
+        if (local.body.type !== 'statement_block' && local.body.type !== 'block') {
+            const direct = evaluate(local.body, calleeScope);
+            if (direct && !returned) {
+                returned = addStep(direct, local.body, `returned from \`${local.name}()\``);
+            }
+        }
+        currentPath = callerPath;
+        callStack.pop();
+        descendCache.set(cacheKey, returned);
+        return { handled: true, taint: returned };
+    };
+    // Process every scope. `queue` grows as nested functions are discovered.
+    let processed = 0;
+    while (processed < queue.length && processed < 500) {
+        const scope = queue[processed];
+        processed++;
+        if (!scope)
+            continue;
+        currentPath = scope.filePath;
+        for (const child of scope.body.namedChildren) {
+            if (child)
+                walk(child, scope);
+        }
+    }
+    return { flows: results, sanitized, unreachable, resolvedReads, freshStops, limits: limits() };
+}
+//# sourceMappingURL=tracer.js.map