@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/src/taint/tracer.ts

@@ -0,0 +1,4298 @@
+/**
+ * THE TAINT TRACER
+ * ================
+ *
+ * This is the engine that turns "signature-based" into "flow-verified".
+ *
+ * HOW IT WORKS, in one paragraph:
+ * We read each function body top to bottom, keeping a notebook of which
+ * variables currently hold dirty data. When a line assigns something, we work
+ * out whether the right-hand side is dirty and write that in the notebook. When
+ * a line calls something dangerous, we look up its arguments in the notebook.
+ * If a dirty value reaches a sink and no sanitiser washed it on the way, we can
+ * finally say the thing a pattern match never could: *this specific value, from
+ * this specific source, reaches this specific sink.* And we can show every hop.
+ *
+ * WHAT IT DELIBERATELY DOES NOT DO - each of these is a documented gap, not an
+ * oversight, and each is printed in the scan report:
+ *
+ *   1. BOUNDED REACH. Functions defined in this file are followed, and so are
+ *      functions in another file when a relative import resolves to it. What
+ *      still ends a trace: a call into a third-party package, a dynamic or
+ *      aliased import, a name several modules define (we decline rather than
+ *      guess), and any chain deeper than four calls. A cut at that depth, or at
+ *      a call that looks recursive, does NOT end the value: it is carried past
+ *      the unread call exactly as in 3 below, with the reason for the stop
+ *      written into the path.
+ *
+ *   2. STATEMENT ORDER, NOT BRANCH LOGIC. We read lines in order and ignore
+ *      whether an `if` is true. So a value cleaned only inside `if (isAdmin)`
+ *      is treated as cleaned afterwards. That direction of error loses findings
+ *      rather than inventing them, which is the right way to be wrong.
+ *
+ *   3. UNKNOWN FUNCTIONS CARRY TAINT, AND SAY SO. `foo(dirty)` keeps the taint
+ *      and records the hop as UNMODELLED, naming `foo` on the finding. Treating
+ *      unknowns as clean was tried first and produced ZERO verified flows across
+ *      2,766 Java files, every one a known vulnerability - so the quiet option
+ *      was not the honest one. This is the weakest link in any path we print,
+ *      which is exactly why it is printed rather than smoothed over.
+ *
+ *   4. CONTAINERS ARE TAINTED WHOLE. `list.add(dirty)` dirties the list, not
+ *      the slot - so a clean element read back out of that list is treated as
+ *      dirty too. Following values into objects at all requires this trade; the
+ *      alternative was the previous behaviour, which was to lose the value
+ *      entirely the moment it entered a StringBuilder or a List.
+ *
+ *   5. NO LOOP FIXPOINT. A variable that becomes dirty at the bottom of a loop
+ *      and is used at the top is missed on the first pass. Real analysers
+ *      iterate to a fixpoint; we do not, yet.
+ *
+ * Every one of those makes the tool MISS things (false negatives). None of them
+ * makes it invent things. That asymmetry is deliberate: a flow-verified label is
+ * a promise, and a promise that is sometimes wrong is worth less than no promise
+ * at all.
+ */
+
+import type { Node } from 'web-tree-sitter';
+import type { FlowStep } from '../core/finding.js';
+import type { LanguageId } from '../parse/languages.js';
+import { describeFact, guardClears, guardFactsAt, guardsApply, normalizeExpression, type GuardFact } from '../rules/lib/guards.js';
+import { nodeLocation } from '../parse/location.js';
+import type { ParsedFile } from '../parse/parser.js';
+import { analyzeStringExpression, looksLikeHtml, looksLikeSql } from '../rules/lib/strings.js';
+import { TAINT_DICTIONARIES } from './dictionaries.js';
+import { ASSIGNMENT_NODES, SWITCH_NODES, assignmentParts, createFolder, type SwitchDecision } from './fold.js';
+import { declaredImmutable, enclosingMethod, enclosingPythonFunction, mentionedBetween, resolveContainerRead, writtenBetween } from './local-map.js';
+import { SINK_KIND_RULE, type SinkKind, type TaintDictionary } from './types.js';
+
+/* -------------------------------------------------------------------------- *
+ * Internal step type: a FlowStep that also remembers which sink kinds a
+ * sanitiser actually covers. See buildPath() for why this matters.
+ * -------------------------------------------------------------------------- */
+interface InternalStep extends FlowStep {
+  readonly sanitizesKinds?: readonly SinkKind[];
+  /** A sanitiser whose protection depends on landing inside quotes - see SanitizerSpec.onlyInsideQuotes. */
+  readonly quoteDependent?: boolean;
+  /** A validation check rather than a function the value went through - see `guarded`. */
+  readonly guard?: boolean;
+  /** A function this engine does not model, assumed to hand back what it was given. */
+  readonly unmodelled?: string;
+  /** The sink kinds this step's cleaning protects only inside quotes. */
+  readonly quoteKinds?: readonly SinkKind[];
+}
+
+interface Taint {
+  readonly steps: readonly InternalStep[];
+  readonly sanitizedFor: ReadonlySet<SinkKind>;
+  readonly origin: string;
+  /**
+   * Names of functions on this path that we do NOT model. See the note on
+   * unknown calls in evaluateCall - these are the hops where our claim is
+   * weakest, so we carry them all the way onto the finding.
+   */
+  readonly unknownHops: readonly string[];
+  /**
+   * Set when this taint is sitting in a NAMED COMPARTMENT of an object rather
+   * than being the object itself - `req.setAttribute("k", dirty)` leaves `req`
+   * carrying a compartmented taint, `sb.append(dirty)` does not.
+   *
+   * It only matters in one place: an unmodelled call carries its receiver's
+   * taint, and for a compartmented receiver that is wrong unless the call is
+   * actually reading the compartment. Holds the reader method names that may.
+   */
+  readonly compartment?: readonly string[] | undefined;
+  /**
+   * Set when this taint SURVIVED a clean write only because the write was
+   * inside a branch we cannot evaluate.
+   *
+   * The rule that keeps it - "a conditional write cannot PROVE a value clean" -
+   * is deliberately conservative and right for a GUESS: it errs toward
+   * reporting a value that might be clean rather than staying silent about one
+   * that might be dirty. It is not right for a PROOF. Nothing was followed at
+   * that point; an assumption was made, and `flowVerifiedFinding()` goes on to
+   * print "this is not a pattern guess - the data flow was followed".
+   *
+   * Django drew this out. In contrib/admin/options.py a tainted `msg` is
+   * assigned in an `except` block at line 1601 and a clean literal `msg` is
+   * assigned in an `elif` forty lines later; the sink at 1646 is reachable only
+   * through the second. The trace printed seven correct-looking hops across two
+   * files and claimed proof of a flow that cannot happen.
+   *
+   * So the taint still travels and the finding is still reported - the caution
+   * is preserved exactly - but it is reported as signature-based, because that
+   * is what it is.
+   */
+  readonly branchAssumed?: boolean | undefined;
+  /**
+   * Set when this taint passed through a write into a COLLECTION THAT TOOK MORE
+   * THAN ONE ELEMENT.
+   *
+   *     values.add("safe");
+   *     values.add(dirty);
+   *     values.add("alsosafe");
+   *     out.println(values.get(2));     // which one is this?
+   *
+   * The tracer taints the container whole and says so in the path - "collected
+   * into `values` via `add()`" - and then labelled the finding flow-verified
+   * anyway. The admission and the claim contradicted each other inside one
+   * report.
+   *
+   * Same treatment as branchAssumed, for the same reason: the taint still
+   * travels, the finding is still reported, and only the LABEL changes. One
+   * write leaves this unset, because then the value read is the value written
+   * and the proof is real. Accumulators never set it - see elementMutators.
+   */
+  readonly containerGuess?: boolean | undefined;
+  /**
+   * The container this taint IS took more than one element write. On its own
+   * that changes nothing - see ReceiverState.java, where `argList` takes three
+   * adds and is then handed WHOLE to ProcessBuilder. Every element reaches the
+   * process, so there is no ambiguity and the proof stands.
+   *
+   * The ambiguity only appears when something reads ONE element back out. So
+   * this marks the container, and `containerGuess` is set later, at the read.
+   */
+  readonly collectedMany?: boolean | undefined;
+  /**
+   * Kinds this value is clean for ONLY IF it ends up inside quotes - it went
+   * through an escape-only function such as mysqli_real_escape_string(). See
+   * SanitizerSpec.onlyInsideQuotes.
+   *
+   * Settled where the value is spliced into a string: inside quotes the
+   * escaping is the whole defence, so the kinds stay clean and this clears;
+   * outside quotes it protects nothing, so the kinds are taken back out of
+   * sanitizedFor and the path says why. A value that reaches a sink with this
+   * still set was assembled somewhere this engine cannot read (sprintf, a
+   * builder), so it is neither cleared nor called proven - see quoteUnknown.
+   */
+  readonly quotePending?: readonly SinkKind[] | undefined;
+  /**
+   * What comes BEFORE this value in the string it has been spliced into, with
+   * every clean part written as CLEAN_PART - `https://api.example.com/users/`,
+   * `<clean>/orders/`, `./`. Undefined means the value starts its string: the
+   * attacker writes the beginning, scheme and host included.
+   *
+   * Only the SSRF sink reads it (fixedDestination). Losing it on a path this
+   * engine rebuilds field by field falls back to "starts the string", which is
+   * the old answer - a lost prefix can keep a proof, never clear a line.
+   */
+  readonly urlPrefix?: string | undefined;
+  /** The value came from a browser-only source (SourceSpec.browserOnly). */
+  readonly fromBrowser?: boolean | undefined;
+  /** The value came from the program's own command line, environment or terminal (SourceSpec.localOnly). */
+  readonly fromLocal?: boolean | undefined;
+  /** A file name with every folder already cut off (SourceSpec.fileNameOnly). */
+  readonly fileNameOnly?: boolean | undefined;
+  /**
+   * Built by joining several dirty values. Only the receipt reads it: a
+   * cleared line's reason names one value's cleaning, and says when there
+   * were others (each cleaned too, or the kind would not be washed).
+   */
+  readonly joined?: boolean | undefined;
+  /**
+   * For each kind this value is washed for: the functions Defuse does not
+   * model that it went through SINCE that washing. A cleared line's receipt
+   * lists them as what it took on trust. Absent means "not tracked here",
+   * and the receipt then falls back to listing every unmodelled hop that
+   * could have come after - see cleanReason. Kept per kind because washing
+   * for one kind (intval, for SQL) does not reset the trust another kind's
+   * earlier washing (htmlspecialchars, for the page) has been resting on.
+   */
+  readonly afterWash?: Readonly<Partial<Record<SinkKind, readonly string[]>>> | undefined;
+}
+
+/** A fresh wash for these kinds: nothing has been taken on trust since. */
+function washedNow(
+  prior: Taint['afterWash'],
+  kinds: readonly SinkKind[],
+): Readonly<Partial<Record<SinkKind, readonly string[]>>> {
+  const next: Partial<Record<SinkKind, readonly string[]>> = { ...(prior ?? {}) };
+  for (const k of kinds) next[k] = [];
+  return next;
+}
+
+/** An unmodelled function the value just went through, after every wash it carries. */
+function trustedHop(prior: Taint['afterWash'], name: string): Taint['afterWash'] {
+  if (!prior) return undefined;
+  const next: Partial<Record<SinkKind, readonly string[]>> = {};
+  for (const [k, names] of Object.entries(prior) as [SinkKind, readonly string[]][]) {
+    next[k] = names.includes(name) ? names : [...names, name];
+  }
+  return next;
+}
+
+/**
+ * Values joined into one: for each kind ALL of them are washed for, every
+ * function any of them took on trust. A part that did not track it leaves
+ * the kind untracked, so the receipt falls back to the cautious list.
+ */
+function joinedAfterWash(parts: readonly Taint[], kinds: ReadonlySet<SinkKind>): Taint['afterWash'] {
+  const next: Partial<Record<SinkKind, readonly string[]>> = {};
+  for (const k of kinds) {
+    const lists = parts.map((p) => p.afterWash?.[k]);
+    if (lists.some((l) => l === undefined)) continue;
+    next[k] = [...new Set(lists.flatMap((l) => l ?? []))];
+  }
+  return Object.keys(next).length > 0 ? next : undefined;
+}
+
+/**
+ * A flow that reached a sink but was correctly sanitised on the way.
+ * Not a vulnerability - evidence that this line is fine.
+ */
+export interface SanitizedFlow {
+  readonly ruleId: string;
+  readonly kind: SinkKind;
+  readonly sinkNode: Node;
+  /** The file the sink is in - may not be the file being scanned. */
+  readonly filePath: string;
+  /**
+   * What made it clean, in words, with the line it happened on - the receipt.
+   * See cleanReason: a line printed as "checked and cleared" has to say what
+   * checked it.
+   */
+  readonly reason: string;
+  /**
+   * Functions Defuse does not model that the cleaned value passed through
+   * AFTER it was cleaned. Each was assumed to hand back what it was given; if
+   * one undoes the cleaning, the receipt is wrong, and it says so up front.
+   */
+  readonly assumes?: readonly string[];
+}
+
+/** One confirmed source-to-sink flow, ready to become a finding. */
+export interface FlowResult {
+  readonly ruleId: string;
+  readonly kind: SinkKind;
+  /** The exact tainted expression - what the finding points at. */
+  readonly node: Node;
+  /** The whole sink call or assignment - used to match up with signature findings. */
+  readonly sinkNode: Node;
+  readonly path: readonly FlowStep[];
+  readonly origin: string;
+  readonly sinkDescription: string;
+  /** Functions on the path that we do not model. Named on the finding. */
+  readonly unknownHops: readonly string[];
+  /**
+   * The value reached this sink only because a clean write was skipped for
+   * being conditional. The finding is still REPORTED - a missed bug is the one
+   * failure this scanner cannot see in itself - but it is reported as a guess,
+   * because a branch was assumed rather than followed. See branchAssumed.
+   */
+  readonly branchAssumed?: boolean;
+  /**
+   * The value reached this sink out of a collection that took several elements,
+   * so which one came back is a guess. Reported, not certified. See
+   * containerGuess.
+   */
+  readonly containerGuess?: boolean;
+  /**
+   * The value went through escaping that only protects inside quotes, and was
+   * put into the query somewhere this engine cannot read, so whether it is
+   * quoted is unknown. Reported, not certified - and not cleared either.
+   */
+  readonly quoteUnknown?: boolean;
+  /**
+   * An SSRF flow whose request cannot go where the attacker chooses: the value
+   * sits after a fixed start of the address (`path`, with that start), or the
+   * code runs in a browser, so the request is the user's own (`browser`).
+   * Reported as a guess with the reason, never as proven SSRF and never cleared.
+   */
+  readonly fixedDestination?: { readonly kind: 'path' | 'browser'; readonly before: string } | undefined;
+  /**
+   * A path-traversal flow whose value comes only from the program's own
+   * command line, environment or terminal. Reported as a guess with the
+   * reason, never as proven: the person who chose the path can read the file.
+   */
+  readonly localSource?: boolean | undefined;
+  /** The file the sink is in - may not be the file being scanned. */
+  readonly filePath: string;
+}
+
+/** How a clean part of a string is written in a urlPrefix. */
+export const CLEAN_PART = '\u0001';
+
+/**
+ * Does the text before a value pin the destination of the address it is part
+ * of? Only when a path, query or fragment has already begun - after a host
+ * (`https://api.example.com/`), after a clean base (`${base}/`), or in a
+ * relative path (`./`, `../`, `/api/`, `docs/`).
+ *
+ * NOT pinned, and each is a real SSRF shape: nothing before the value; a
+ * scheme with the host still open (`https://`); a host with no slash after it
+ * (`https://api.example.com` + `@evil.example`); a clean base with nothing
+ * after it, which may itself end without a slash; `https:///`, where URL
+ * parsers skip the extra slash and the value becomes the host.
+ *
+ * One shape it cannot see: a clean base holding only a scheme with no slashes
+ * (`https:`) followed by `/` and the value - parsers read `https:/evil` as
+ * host `evil`. A configuration value shaped like that is rare enough to
+ * accept, and it is written down here rather than discovered later.
+ */
+export function destinationPinned(before: string): boolean {
+  if (before === '') return false;
+  const scheme = before.indexOf('://');
+  if (scheme < 0 && !before.startsWith('//') && /^(\.{1,2}[/\\]|\/(?!\/))/.test(before)) return true;
+  const rest = scheme >= 0 ? before.slice(scheme + 3) : before.startsWith('//') ? before.slice(2) : before;
+  return rest.search(/[/?#]/) > 0;
+}
+
+/**
+ * The text a string-building expression contributes, clean parts written as
+ * CLEAN_PART. Like literalTextOf, except a variable or call is not nothing -
+ * it is SOMETHING, unknown but not the attacker's, and where it sits matters.
+ */
+function shapeOf(node: Node | null): string {
+  if (!node) return '';
+  if (STRING_NODES.has(node.type)) {
+    const content = stringContent(node.text);
+    const splices = node.namedChildren.filter(
+      (c): c is Node => c !== null && (INTERPOLATION_NODES.has(c.type) || VARIABLE_NODES.has(c.type) || MEMBER_NODES.has(c.type)),
+    );
+    if (splices.length === 0) return content;
+    const last = splices[splices.length - 1];
+    return last ? templateShapeBefore(node, last) + CLEAN_PART + afterSplice(node, last) : content;
+  }
+  if (node.type === 'parenthesized_expression') {
+    return shapeOf(node.namedChildren.find((c): c is Node => c !== null) ?? null);
+  }
+  if (node.type === 'binary_expression' || node.type === 'binary_operator') {
+    const operator = node.childForFieldName('operator')?.text ?? '';
+    if (operator === '+' || operator === '.') {
+      return shapeOf(node.childForFieldName('left')) + shapeOf(node.childForFieldName('right'));
+    }
+  }
+  return CLEAN_PART;
+}
+
+/** The literal text of a template after a splice, up to its closing delimiter. */
+function afterSplice(template: Node, splice: Node): string {
+  const from = splice.endIndex - template.startIndex;
+  const tail = template.text.slice(from);
+  const close = template.text.match(/["'`]+$/)?.[0]?.length ?? 0;
+  // PHP's closing brace of `"{$x}"`, the twin of the one templateShapeBefore drops.
+  return tail.slice(0, Math.max(0, tail.length - close)).replace(/^\}/, '');
+}
+
+/** `a.b(x, y).c(z).d` -> `a.b().c().d`: a callee chain with every argument list emptied. */
+function withoutCallArguments(callee: string): string {
+  let out = callee;
+  for (let i = 0; i < 8; i++) {
+    const next = out.replace(/\((?:[^()]|\(\))*\)/g, '()');
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+/**
+ * Whether an SSRF flow can send the request where the attacker chooses. See
+ * FlowResult.fixedDestination and destinationPinned.
+ */
+function fixedDestinationOf(taint: Taint, kind: SinkKind): FlowResult['fixedDestination'] {
+  if (kind !== 'ssrf') return undefined;
+  if (taint.fromBrowser) return { kind: 'browser', before: taint.urlPrefix ?? '' };
+  if (taint.urlPrefix !== undefined && destinationPinned(taint.urlPrefix)) {
+    return { kind: 'path', before: taint.urlPrefix };
+  }
+  return undefined;
+}
+
+/**
+ * What precedes one splice inside a template literal or interpolated string:
+ * its literal text, with every earlier splice written as CLEAN_PART (the
+ * first dirty splice is the one being placed, so the earlier ones are clean).
+ */
+function templateShapeBefore(template: Node, splice: Node): string {
+  let out = '';
+  let cursor = 0;
+  const head = afterOpening(template.text);
+  const opening = template.text.length - head.length;
+  for (const child of template.namedChildren) {
+    if (!child) continue;
+    if (child.startIndex >= splice.startIndex) break;
+    if (!(INTERPOLATION_NODES.has(child.type) || VARIABLE_NODES.has(child.type) || MEMBER_NODES.has(child.type))) continue;
+    const start = child.startIndex - template.startIndex - opening;
+    if (start < cursor) continue;
+    out += head.slice(cursor, start) + CLEAN_PART;
+    cursor = child.endIndex - template.startIndex - opening;
+  }
+  // PHP's `"{$x}"` keeps its brace in the literal text; it is syntax, not part of the address.
+  return (out + head.slice(cursor, splice.startIndex - template.startIndex - opening)).replace(/\{$/, '');
+}
+
+/* -------------------------------------------------------------------------- *
+ * Language-specific node vocabulary. Small enough to keep here rather than in
+ * the dictionaries, because it describes the GRAMMAR, not a framework.
+ * -------------------------------------------------------------------------- */
+
+const FUNCTION_NODES: Record<string, readonly string[]> = {
+  javascript: [
+    'function_declaration', 'function_expression', 'arrow_function',
+    'method_definition', 'generator_function_declaration', 'generator_function',
+  ],
+  typescript: [
+    'function_declaration', 'function_expression', 'arrow_function',
+    'method_definition', 'generator_function_declaration', 'generator_function',
+  ],
+  python: ['function_definition', 'lambda'],
+  /*
+   * C nests the name one level down: a function_definition has a `declarator`
+   * (the function_declarator) which in turn has the `declarator` that is the
+   * identifier. There is no `name` field anywhere on it, which is why
+   * functionNameOf() below exists - without it collectFunctions found zero C
+   * functions and every cross-function trace in the language stopped dead at
+   * the call, silently.
+   */
+  c: ['function_definition'],
+  cpp: ['function_definition', 'lambda_expression'],
+  java: ['method_declaration', 'constructor_declaration', 'lambda_expression'],
+  go: ['function_declaration', 'method_declaration', 'func_literal'],
+  php: [
+    'function_definition',
+    'method_declaration',
+    'anonymous_function_creation_expression',
+    'arrow_function',
+  ],
+};
+
+/**
+ * Node types that ARE a reference to a variable by name.
+ *
+ * This started as a bare `node.type === 'identifier'` check, which is right for
+ * four of the five languages and silently wrong for PHP: `$x` parses as
+ * `variable_name`, so every PHP variable read fell through to "not a variable",
+ * every binding was ignored, and taint died at the first assignment. Direct
+ * source-to-sink flows still verified, which is the dangerous kind of bug -
+ * it looked like the language worked.
+ */
+const VARIABLE_NODES = new Set(['identifier', 'variable_name']);
+
+/**
+ * Assignment targets that bind SEVERAL names at once.
+ *
+ *     const { syncUrl } = req.body;
+ *     const [first] = request.args.getlist("x");
+ *
+ * The tracer read the whole pattern as one name - literally the string
+ * "{ syncUrl }" - which matches nothing anyone ever looks up, so the taint was
+ * recorded under a key no read could find and every destructured request field
+ * came out clean.
+ *
+ * This is not an exotic shape. It is how modern JavaScript and TypeScript read
+ * request fields, and it silently defeated every rule at once: a Gemini-written
+ * Express app had `const { syncUrl } = req.body` two lines above an SSRF, and
+ * the trace died at the brace.
+ *
+ * Every name in the pattern is bound to the taint of the whole right-hand side.
+ * That is the container rule again - if the object is dirty, everything read
+ * out of it is treated as dirty - and it errs toward reporting.
+ */
+const DESTRUCTURING_NODES = new Set([
+  'object_pattern', // JS/TS  const { a, b } = x
+  'array_pattern', // JS/TS  const [a, b] = x
+  'pattern_list', // Python a, b = x
+  'tuple_pattern',
+  'list_pattern',
+]);
+
+/** Every plain name a destructuring pattern introduces, however nested. */
+function namesBoundBy(pattern: Node): string[] {
+  const names: string[] = [];
+  const visit = (node: Node, depth: number): void => {
+    if (depth > 6) return;
+    for (const child of node.namedChildren) {
+      if (!child) continue;
+      // `{ a: renamed }` - the NAME the body will use is on the right.
+      if (child.type === 'pair_pattern' || child.type === 'object_assignment_pattern') {
+        const value = child.childForFieldName('value') ?? child.namedChildren[1] ?? null;
+        if (value) visit(value.type === 'identifier' ? child : value, depth + 1);
+        if (value && VARIABLE_NODES.has(value.type)) names.push(text(value));
+        continue;
+      }
+      if (VARIABLE_NODES.has(child.type) || child.type === 'shorthand_property_identifier_pattern') {
+        names.push(text(child));
+        continue;
+      }
+      visit(child, depth + 1);
+    }
+  };
+  visit(pattern, 0);
+  return names;
+}
+
+const UNWRAP_NODES = new Set([
+  'parenthesized_expression',
+  'await_expression',
+  'as_expression',
+  'satisfies_expression',
+  'non_null_expression',
+  'type_assertion',
+  'expression_statement',
+  /*
+   * `(String) map.get("keyB")` - a Java cast.
+   *
+   * TypeScript's three ways of saying the same thing were all here from the
+   * start; Java's was not, and the omission cost more than every cross-file
+   * idea tried this session put together. A cast changes what the compiler
+   * calls a value. It does not change the value, so it cannot change whether
+   * an attacker chose it.
+   *
+   * Found by a ten-line fixture that put a tainted value into a HashMap three
+   * different ways. Two came out traced; the one with a cast in front did not.
+   * Written before touching the engine, on purpose - the hypothesis it killed
+   * ("the container machinery is broken") was the third wrong guess in a row
+   * that a benchmark run alone would not have corrected.
+   */
+  'cast_expression', // Java, C-style casts
+]);
+
+/**
+ * Wrappers whose FIRST named child is the type and whose LAST is the value.
+ *
+ * Everything else in UNWRAP_NODES puts the value first, which is why grabbing
+ * child 0 worked for years before a Java cast walked in. This is the third
+ * time the same shape has turned up wearing different clothes:
+ *
+ *     (String) map.get("k")        cast_expression   [type, value]
+ *     <string>req.query.path       type_assertion    [type, value]
+ *     req.query.path as string     as_expression     [value, type]   <- NOT here
+ *
+ * The first two look nothing alike and parse identically. The third looks
+ * almost the same as the second and parses backwards, so it must stay on the
+ * first-child path - which is the whole reason this is a set of node types
+ * and not a guess about which spelling means a cast.
+ *
+ * `type_assertion` was in UNWRAP_NODES from the beginning and still did not
+ * work, because being listed as a wrapper only says the node should be seen
+ * through; it says nothing about which side the value is on. The tracer
+ * solemnly evaluated the word `string` and reported the value clean. Found by
+ * ts-only-syntax.ts, which was written to falsify the claim that TypeScript
+ * behaves "identically to JavaScript" - and did, on the first run.
+ */
+const TYPE_FIRST_WRAPPERS = new Set(['cast_expression', 'type_assertion']);
+
+/**
+ * Binary operators whose result can still be attacker-chosen.
+ *
+ * Deliberately a short list. Every operator NOT here - `==`, `<`, `instanceof`,
+ * `-`, `*` - produces a value whose shape the attacker no longer controls, and
+ * carrying taint across those would manufacture flows that do not exist.
+ * Arithmetic is the clearest case: whatever `dirty - 1` is, it is a number, and
+ * a number cannot be a shell command.
+ */
+const BINARY_CARRIERS = new Set([
+  '+', // concatenation in every language here, and addition
+  '%', // Python's old-style format string
+  '.', // PHP concatenation
+  '??', // JS/TS nullish coalescing
+  '||', // returns the left operand when it is truthy
+  '&&', // returns the left operand when it is falsy
+]);
+
+const MEMBER_NODES = new Set([
+  'member_expression', // JS/TS   a.b
+  'attribute', // Python  a.b
+  'selector_expression', // Go      a.b
+  'field_access', // Java    a.b
+  'subscript_expression',
+  'subscript',
+  'index_expression',
+  'array_access', // Java    a[i]
+  /*
+   * C and C++: `obj.field`, `ptr->field`, and `s.c_str`.
+   *
+   * Its receiver sits in the `argument` field rather than `object`, which is
+   * why the lookup below tries several names. Without this entry `s.c_str()`
+   * had no receiver at all, so a tainted std::string went clean the moment
+   * anybody called the one method that gets the bytes out of it - which is the
+   * only way a std::string ever reaches system().
+   */
+  'field_expression',
+]);
+
+/** Assignment targets that write ONE element of a container: `m['k']`, `a[i]`, `$a['k']`. */
+const ELEMENT_TARGETS = new Set(['subscript', 'subscript_expression', 'index_expression', 'array_access']);
+
+/** Container literals: `{...}`, `[...]`, `array(...)`, Java `{a, b}`. */
+const CONTAINER_LITERALS = new Set(['dictionary', 'list', 'array', 'object', 'array_creation_expression', 'array_initializer', 'composite_literal']);
+
+/**
+ * Calls that COMPILE a query and hand back a statement handle.
+ *
+ * After `stmt, err := db.Prepare(sql)`, the arguments to `stmt.QueryRow(uid)`
+ * are bound parameters - the database keeps them separate from the
+ * instruction, which is the whole point of preparing. Reporting them as
+ * injection punishes the correct fix, which is the worst thing a SQL rule can
+ * do. So we remember which local names hold a prepared statement.
+ *
+ * Note what this does NOT excuse: `db.Prepare(dynamicSql)` is still a sink,
+ * because a query assembled from user input is dangerous whether or not it is
+ * prepared afterwards.
+ */
+const PREPARE_CALLS = new Set([
+  'Prepare',
+  'PrepareContext',
+  'Preparex',
+  'PrepareNamed',
+  'prepareStatement',
+  'prepareCall',
+]);
+
+const CALL_NODES = new Set([
+  'call_expression',
+  'call',
+  'new_expression',
+  'method_invocation', // Java
+  'object_creation_expression', // Java  new Foo(...)
+  'function_call_expression', // PHP  foo(...)
+  'member_call_expression', // PHP  $obj->foo(...)
+  'scoped_call_expression', // PHP  Foo::bar(...)
+]);
+
+const STRING_NODES = new Set([
+  'string',
+  'template_string',
+  'concatenated_string',
+  'string_literal', // Java
+  'text_block', // Java
+  'interpreted_string_literal', // Go
+  'raw_string_literal', // Go
+  'encapsed_string', // PHP  "text $var"
+  'heredoc', // PHP
+]);
+
+const INTERPOLATION_NODES = new Set(['template_substitution', 'interpolation']);
+
+/**
+ * A string literal's text without its prefix and delimiters: `f"..."`,
+ * `'...'`, `"""..."""`, and a PHP heredoc's first and last lines.
+ */
+function stringContent(raw: string): string {
+  if (raw.startsWith('<<<')) {
+    const lines = raw.split('\n');
+    return lines.slice(1, -1).join('\n');
+  }
+  const open = raw.search(/["'`]/);
+  if (open === -1) return raw;
+  const quote = raw[open]!;
+  const width = raw.startsWith(quote.repeat(3), open) ? 3 : 1;
+  const end = raw.length - width >= open + width ? raw.length - width : raw.length;
+  return raw.slice(open + width, end);
+}
+
+/** The text of a string literal from just after its opening delimiter - for a prefix ending mid-string. */
+function afterOpening(raw: string): string {
+  if (raw.startsWith('<<<')) {
+    const newline = raw.indexOf('\n');
+    return newline === -1 ? '' : raw.slice(newline + 1);
+  }
+  const open = raw.search(/["'`]/);
+  if (open === -1) return raw;
+  const quote = raw[open]!;
+  const width = raw.startsWith(quote.repeat(3), open) ? 3 : 1;
+  return raw.slice(open + width);
+}
+
+/**
+ * The literal text a string-building expression contributes, in order. Parts
+ * that are not literals - variables, calls - contribute nothing, which is the
+ * cautious reading: a quote this engine cannot see is not counted as there.
+ */
+function literalTextOf(node: Node | null): string {
+  if (!node) return '';
+  if (STRING_NODES.has(node.type)) return stringContent(node.text);
+  if (node.type === 'parenthesized_expression') {
+    return literalTextOf(node.namedChildren.find((c): c is Node => c !== null) ?? null);
+  }
+  if (node.type === 'binary_expression' || node.type === 'binary_operator') {
+    const operator = node.childForFieldName('operator')?.text ?? '';
+    if (operator !== '+' && operator !== '.') return '';
+    return literalTextOf(node.childForFieldName('left')) + literalTextOf(node.childForFieldName('right'));
+  }
+  return '';
+}
+
+/**
+ * Does a value spliced in right after this text sit inside a quoted string?
+ * An odd number of single or double quotes before it says it does. A backtick
+ * is NOT counted: it quotes an identifier, and escaping does not touch it.
+ */
+function opensAQuote(textBefore: string): boolean {
+  const singles = (textBefore.match(/'/g) ?? []).length;
+  const doubles = (textBefore.match(/"/g) ?? []).length;
+  return singles % 2 === 1 || doubles % 2 === 1;
+}
+
+/**
+ * Nodes that BUILD a container out of listed elements.
+ *
+ * `Object[] obj = {"a", bar};` then `writer.format(fmt, obj)` is one of the
+ * commonest real XSS shapes in Java, and the trace used to die at the brace:
+ * `bar` was tainted, `obj` was not, and the sink saw a clean array.
+ *
+ * A container is tainted WHOLE, exactly as ENGINE_CAPABILITIES already says for
+ * `list.add(dirty)`. That is imprecise - element 0 here is the literal "a" and
+ * is perfectly clean - but a container holding one dirty element is a dirty
+ * container for every purpose a sink cares about, and erring the other way
+ * loses the finding entirely.
+ */
+/**
+ * Nodes whose body may or may not run.
+ *
+ * Used for one narrow decision: whether a CLEAN assignment is allowed to erase
+ * a variable's taint. Consider the shape that dominates the OWASP benchmark:
+ *
+ *     if ((500 / 42) + num > 200) bar = param;   // param is attacker input
+ *     else bar = "This should never happen";
+ *
+ * Reading statements in order, the else branch is simply the last write, so
+ * `bar` came out clean and the finding vanished - even though the two branches
+ * are mutually exclusive and one of them hands the attacker's value straight
+ * to the page.
+ *
+ * We do not evaluate the condition; that is a different and much larger piece
+ * of work. We make the weaker claim that a conditional write cannot PROVE a
+ * value clean. So taint set anywhere survives a clean write inside a branch,
+ * while an unconditional write still clears it, because that one really does
+ * happen every time.
+ *
+ * The direction matters: this errs toward reporting a value that might be
+ * clean, rather than staying silent about one that might be dirty.
+ */
+
+/**
+ * The loop variable and the collection of a for-each, per grammar.
+ *
+ * Every language spells this differently and two of them hide the parts inside
+ * an intermediate node, which is why a single childForFieldName() call would
+ * have worked for Java and quietly returned nothing for the rest - the same
+ * shape of mistake as the if-statement's `consequence` vs `body`, recorded in
+ * rules/lib/guards.ts.
+ */
+const FOREACH_NODES = new Set([
+  'enhanced_for_statement', // Java   for (String v : values)
+  'for_in_statement',       // JS/TS  for (const v of values)
+  'for_statement',          // Python for v in values      (also Go's plain for)
+  'for_range_loop',         // Go     for _, v := range values
+  'foreach_statement',      // PHP    foreach ($values as $v)
+]);
+
+interface ForeachBinding {
+  readonly name: Node;
+  readonly iterable: Node;
+}
+
+function foreachBinding(node: Node): ForeachBinding | null {
+  // Java: `name` and `value` fields. JS/TS and Python: `left` and `right`.
+  const name = node.childForFieldName('name') ?? node.childForFieldName('left');
+  const iterable = node.childForFieldName('value') ?? node.childForFieldName('right');
+  if (name && iterable) return { name, iterable };
+
+  // Go hides both inside a range_clause child; PHP has no fields at all and
+  // spells it `foreach (EXPR as $v)`, so the last variable before the body is
+  // the binding and the first expression is the collection.
+  const range = node.namedChildren.find((c): c is Node => c?.type === 'range_clause');
+  if (range) {
+    const left = range.childForFieldName('left');
+    const right = range.childForFieldName('right');
+    if (left && right) {
+      // `for _, v := range values` - the VALUE is the second name, not the index.
+      const names = left.namedChildren.filter((c): c is Node => c !== null);
+      const chosen = names.length > 1 ? names[names.length - 1] : names[0];
+      if (chosen) return { name: chosen, iterable: right };
+    }
+    return null;
+  }
+
+  if (node.type === 'foreach_statement') {
+    const parts = node.namedChildren.filter((c): c is Node => c !== null);
+    const body = node.childForFieldName('body');
+    const beforeBody = body ? parts.filter((c) => c.startIndex < body.startIndex) : parts;
+    const iterablePhp = beforeBody[0];
+    const namePhp = beforeBody[beforeBody.length - 1];
+    // `foreach ($a as $k => $v)` puts the pair in a `pair` node; take its value.
+    const resolved =
+      namePhp?.type === 'pair' || namePhp?.type === 'by_ref'
+        ? namePhp.namedChildren[namePhp.namedChildCount - 1] ?? namePhp
+        : namePhp;
+    if (iterablePhp && resolved && iterablePhp !== resolved) {
+      return { name: resolved, iterable: iterablePhp };
+    }
+  }
+  return null;
+}
+
+/**
+ * Calls that APPLY a function to every element of a collection.
+ *
+ * Deliberately tiny. These are the shapes where naming a sanitiser is the same
+ * as calling it on each element; anything looser would let an arbitrary
+ * callback argument read as proof of safety.
+ */
+const HIGHER_ORDER_APPLIERS = new Set(['map', 'imap', 'starmap', 'forEach']);
+
+/** Comprehensions, which apply their element expression to every item. */
+const COMPREHENSION_NODES = new Set([
+  'list_comprehension',
+  'dictionary_comprehension',
+  'set_comprehension',
+  'generator_expression',
+]);
+
+const CONDITIONAL_NODES = new Set([
+  'if_statement',
+  'else_clause',
+  'switch_statement',
+  'switch_block',
+  'switch_expression',
+  /*
+   * GO'S SWITCHES WERE MISSING FROM THIS LIST, and it cost real findings.
+   *
+   * This set is how the tracer knows a write might not happen. Go spells its
+   * switch `expression_switch_statement`, not `switch_statement`, so a clean
+   * write in ANY case of a Go switch was treated as certain and erased the
+   * taint - `bar := input; switch len(bar) { case 1: bar = "safe" }` left `bar`
+   * clean. The same logic written as an `if` was reported. switch-constant.go.
+   */
+  'expression_switch_statement',
+  'type_switch_statement',
+  'select_statement',
+  'ternary_expression',
+  'conditional_expression',
+  'case_statement',
+  'match_statement',
+  'try_statement',
+  'catch_clause',
+  'for_statement',
+  'while_statement',
+  'do_statement',
+  'enhanced_for_statement',
+  'for_in_statement',
+  'for_range_loop',
+  'foreach_statement',
+]);
+
+/** Java literal node types: a map value of one of these is a constant. */
+const JAVA_LITERALS = new Set([
+  'string_literal', 'character_literal', 'decimal_integer_literal', 'hex_integer_literal',
+  'octal_integer_literal', 'binary_integer_literal', 'decimal_floating_point_literal',
+  'true', 'false', 'null_literal',
+]);
+
+const CONTAINER_NODES = new Set([
+  'array_initializer', // Java   {"a", bar}
+  'array_creation_expression', // Java   new String[]{...}   PHP  array(...)
+  'array', // JS/TS  [a, b]
+  'list', // Python [a, b]
+  'tuple',
+  'set',
+  'dictionary',
+  'composite_literal', // Go     []string{a, b}
+]);
+
+function text(node: Node | null | undefined): string {
+  return (node?.text ?? '').replace(/\s+/g, ' ').trim();
+}
+
+/**
+ * The method name at the end of a callee expression.
+ *
+ * The first version cut the string at the first "(" and then split on dots.
+ * That worked for `db.query` and broke silently on Java's
+ * `Runtime.getRuntime().exec` - cutting at the paren left "Runtime.getRuntime",
+ * so the name came back as `getRuntime` and the command-injection sink never
+ * matched. Taking the trailing identifier instead is both simpler and correct
+ * for every chained call.
+ */
+function lastSegment(value: string): string {
+  const match = value.match(/([A-Za-z_$][\w$]*)\s*$/);
+  return match?.[1] ?? value.trim();
+}
+
+/**
+ * Strip a C declarator down to the name it declares.
+ *
+ * `char *user = getenv("X")` gives an assignment whose TARGET is the whole
+ * declarator, `*user`, not the identifier. The binding loop below rejects any
+ * name that is not a plain identifier - a deliberate guard against binding
+ * taint to something it cannot name - so `*user` was silently dropped, `user`
+ * read as clean, and every C flow through a pointer variable died on the
+ * declaration line.
+ *
+ * It was invisible because the shapes that DO work are common enough to look
+ * like success: `char buf[64]` is an array_declarator whose text is `buf[64]`,
+ * whose last segment is a clean name, and a plain `p = argv[1]` never goes
+ * through a declarator at all. Only the pointer form broke, which is most of
+ * real C.
+ *
+ * Deliberately conservative: it removes leading `*` and `&` and any array
+ * suffix, and returns the input unchanged if what is left is not a plain
+ * identifier. A declarator this cannot reduce is still refused rather than
+ * guessed at.
+ */
+function stripDeclarator(value: string): string {
+  const stripped = value.trim().replace(/^[*&\s]+/, '').replace(/\s*\[[^\]]*\]\s*$/, '').trim();
+  return /^[A-Za-z_$][\w$]*$/.test(stripped) ? stripped : value;
+}
+
+/**
+ * "What is being called, and on what?"
+ *
+ * Every grammar spells this differently. JS and Python put the whole callee in
+ * a `function` field. Java's `method_invocation` does NOT - it keeps the
+ * receiver and the method name as separate children, so `stmt.executeQuery(x)`
+ * has no single node meaning "stmt.executeQuery". We rebuild it here so the
+ * rest of the tracer can stay grammar-agnostic.
+ */
+function calleeOf(callNode: Node): { node: Node | null; text: string; receiver: Node | null } {
+  const fn =
+    callNode.childForFieldName('function') ?? callNode.childForFieldName('constructor') ?? null;
+  if (fn) {
+    const receiver = MEMBER_NODES.has(fn.type)
+      ? fn.childForFieldName('object') ??
+        fn.childForFieldName('operand') ??
+        fn.childForFieldName('argument') ?? // C/C++ field_expression
+        fn.namedChildren[0] ??
+        null
+      : null;
+    return { node: fn, text: text(fn), receiver };
+  }
+
+  const name = callNode.childForFieldName('name'); // Java method_invocation
+  const object = callNode.childForFieldName('object');
+  if (name) {
+    return {
+      node: name,
+      text: object ? `${text(object)}.${text(name)}` : text(name),
+      receiver: object,
+    };
+  }
+
+  const type = callNode.childForFieldName('type'); // Java new Foo(...)
+  if (type) return { node: type, text: text(type), receiver: null };
+
+  return { node: null, text: '', receiver: null };
+}
+
+function argumentsOf(callNode: Node): Node[] {
+  const argsNode = callNode.childForFieldName('arguments');
+  if (!argsNode) return [];
+  return argsNode.namedChildren
+    .filter((n): n is Node => n !== null)
+    // PHP wraps each argument in an `argument` node - unwrap it, or every
+    // argument the tracer inspects is a container rather than the expression.
+    .map((n) => (n.type === 'argument' ? (n.namedChildren.find((c) => c !== null) ?? n) : n));
+}
+
+/**
+ * The parameter NAMES of a function, in whichever way its grammar spells them.
+ * We need names, not types: to follow a value into a function we bind the
+ * incoming taint to the name the body will use to refer to it.
+ */
+/**
+ * The identifier a function definition binds, across grammars.
+ *
+ * Every language this engine supported until C put the name in a `name` field.
+ * C puts it inside a declarator: function_definition.declarator is a
+ * function_declarator, and ITS declarator is the identifier. Pointer-returning
+ * functions nest one level deeper again (`char *f(void)` wraps the whole thing
+ * in a pointer_declarator), so this walks down rather than assuming a depth.
+ */
+function functionNameOf(fnNode: Node): Node | null {
+  const direct = fnNode.childForFieldName('name');
+  if (direct) return direct;
+
+  let node: Node | null = fnNode.childForFieldName('declarator');
+  for (let depth = 0; node && depth < 6; depth++) {
+    if (node.type === 'identifier' || node.type === 'field_identifier') return node;
+    node = node.childForFieldName('declarator');
+  }
+  return null;
+}
+
+/** The parameter list, which C hangs off the declarator rather than the definition. */
+function parameterListOf(fnNode: Node): Node | null {
+  const direct = fnNode.childForFieldName('parameters');
+  if (direct) return direct;
+  let node: Node | null = fnNode.childForFieldName('declarator');
+  for (let depth = 0; node && depth < 6; depth++) {
+    const params = node.childForFieldName('parameters');
+    if (params) return params;
+    node = node.childForFieldName('declarator');
+  }
+  return null;
+}
+
+function parameterNames(fnNode: Node): string[] {
+  const container = parameterListOf(fnNode);
+  if (!container) {
+    // Single-parameter arrow function: `x => ...` has no parameter list node.
+    const bare = fnNode.childForFieldName('parameter');
+    return bare ? [text(bare)] : [];
+  }
+  const names: string[] = [];
+  for (const child of container.namedChildren) {
+    if (!child) continue;
+    if (VARIABLE_NODES.has(child.type)) {
+      names.push(text(child));
+      continue;
+    }
+    // typed_parameter / required_parameter / formal_parameter / parameter_declaration
+    const named =
+      child.childForFieldName('name') ??
+      child.childForFieldName('pattern') ??
+      // C: parameter_declaration's name lives in `declarator`, and arrives with
+      // its pointer stars attached (`*dst`). stripDeclarator removes them.
+      child.childForFieldName('declarator') ??
+      null;
+    if (named) {
+      names.push(stripDeclarator(text(named)));
+      continue;
+    }
+    const identifier = child.namedChildren.find(
+      (c): c is Node => c !== null && VARIABLE_NODES.has(c.type),
+    );
+    names.push(identifier ? text(identifier) : '');
+  }
+  return names;
+}
+
+/**
+ * Parameter declarations with their FULL text, annotations included.
+ *
+ * `parameterNames` above deliberately returns only names, because binding a
+ * caller's argument to a callee's name is all it is for. Recognising a Spring
+ * binding needs the opposite half - the annotation sitting in front of the
+ * name - so this returns both rather than making the other function lie about
+ * what it does.
+ */
+function parameterDeclarations(fnNode: Node): Array<{ name: string; text: string; node: Node }> {
+  const container = fnNode.childForFieldName('parameters');
+  if (!container) return [];
+  const out: Array<{ name: string; text: string; node: Node }> = [];
+  for (const child of container.namedChildren) {
+    if (!child) continue;
+    // A bare `def view(name)` parameter IS the identifier - it has no children.
+    const named = VARIABLE_NODES.has(child.type)
+      ? child
+      : child.childForFieldName('name') ??
+        child.childForFieldName('pattern') ??
+        child.namedChildren.find((c): c is Node => c !== null && VARIABLE_NODES.has(c.type)) ??
+        null;
+    if (!named) continue;
+    out.push({ name: text(named), text: text(child), node: child });
+  }
+  return out;
+}
+
+
+/**
+ * A URL PATH THAT NAMES THIS PARAMETER, read off a Python route decorator.
+ *
+ *     @app.route("/user/<name>")        Flask, <converter:name> too
+ *     @router.get("/items/{item_id}")   FastAPI / Starlette
+ *     def view(name): ...
+ *
+ * The framework splits the URL and passes the segment as a plain str, so the
+ * body holds no source to match - the placeholder in the decorator is the
+ * only evidence, which is why parameterSources (one regex per parameter's own
+ * text) cannot see it. Only a parameter the path NAMES is bound: a decorator
+ * that is not a route method, or a parameter with no placeholder, binds
+ * nothing (route-path-params.py). Django binds kwargs in a separate urls.py
+ * and is not read here.
+ */
+const ROUTE_DECORATOR = /^@[\w.]+\.(?:route|get|post|put|patch|delete|api_route)\(\s*[rRbBuU]?(["'])(.*?)\1/s;
+
+function routePathFor(fnNode: Node, name: string): string | null {
+  const parent = fnNode.parent;
+  if (!name || parent?.type !== 'decorated_definition') return null;
+  for (const decorator of parent.namedChildren) {
+    if (decorator?.type !== 'decorator') continue;
+    const path = ROUTE_DECORATOR.exec(text(decorator))?.[2];
+    if (!path) continue;
+    for (const match of path.matchAll(/<(?:[^<>:]+:)?(\w+)>|\{(\w+)(?::[^}]*)?\}/g)) {
+      if ((match[1] ?? match[2]) === name) return `"${path}"`;
+    }
+  }
+  return null;
+}
+
+/**
+ * DECLARED TYPES, so a receiver check can see past the variable's name.
+ *
+ * `receiverPattern` matches the TEXT in front of the call, which works for
+ * `Runtime.getRuntime().exec(cmd)` and fails completely for the form
+ * BenchmarkJava actually uses 188 times:
+ *
+ *     Runtime r = Runtime.getRuntime();
+ *     r.exec(cmd);
+ *
+ * The receiver is `r`. Scoping `exec` to a runtime-looking receiver removed 16
+ * false positives and 13 TRUE ones in the same change - a straight trade, not
+ * an improvement, and the benchmark said so within a minute.
+ *
+ * Java, Go and TypeScript all write the type down at the declaration, so it is
+ * there to be read. This is one shallow pass over the file collecting
+ * `Type name = ...` and `var name Type`; it is not type inference and does not
+ * pretend to be. A name declared twice with different types in one file is
+ * recorded once and is a known imprecision - the alternative is threading a
+ * type environment through every scope, which is a much larger change than the
+ * problem justifies.
+ */
+function declaredTypes(root: Node, language: LanguageId): Map<string, string> {
+  const types = new Map<string, string>();
+  if (language !== 'java' && language !== 'go' && language !== 'typescript') return types;
+  const visit = (node: Node, depth: number): void => {
+    if (depth > 60) return;
+    if (
+      node.type === 'local_variable_declaration' ||
+      node.type === 'field_declaration' ||
+      node.type === 'var_declaration' ||
+      node.type === 'var_spec'
+    ) {
+      const typeNode = node.childForFieldName('type');
+      const typeText = typeNode ? text(typeNode) : '';
+      if (typeText) {
+        for (const child of node.namedChildren) {
+          if (!child) continue;
+          const nameNode =
+            child.type === 'variable_declarator'
+              ? child.childForFieldName('name')
+              : VARIABLE_NODES.has(child.type)
+                ? child
+                : null;
+          if (nameNode) types.set(text(nameNode), typeText);
+        }
+      }
+    }
+    for (const child of node.namedChildren) if (child) visit(child, depth + 1);
+  };
+  visit(root, 0);
+  return types;
+}
+
+
+/**
+ * The bare NAME of a receiver, with the language's decoration removed.
+ *
+ * PHP writes `$conn->query(...)`, and comparing "$conn" against a list holding
+ * "conn" fails silently - which is exactly what happened: scoping the PHP SQL
+ * sink dropped two asserted flow-verified findings and resurrected a false
+ * positive in the safe fixture, because the receiver never matched anything and
+ * the tracer stopped proving the sanitiser ran.
+ *
+ * Go pointers (`*db`), references (`&db`) and PHP's sigil are punctuation about
+ * how the value is held, not about what it is. The last segment after a dot is
+ * the object being called on.
+ */
+function ownerName(receiverText: string): string {
+  const last = receiverText.split(/[.\s(\[]/).filter(Boolean).pop() ?? receiverText;
+  return last.replace(/^[$*&]+/, '');
+}
+
+
+/**
+ * LOCAL ALIASES OF A DANGEROUS FUNCTION.
+ *
+ *     import { exec } from "child_process";
+ *     const execAsync = promisify(exec);
+ *     await execAsync(command);            // <- invisible to a name list
+ *
+ * That is CVE-2025-53107, twenty-three vulnerable files, and we found zero of
+ * them. The sink list holds `exec`; the call says `execAsync`. Nothing about
+ * the danger changed - only the label on it.
+ *
+ * The near-identical CVE-2025-59046 WAS caught, and only because that author
+ * happened to write `const exec = promisify(execCb)` - aliasing back to the
+ * name we already knew. Two CVEs, one real difference between them, and it was
+ * luck.
+ *
+ * `promisify` is the standard Node idiom for exactly these APIs, so this is not
+ * an exotic shape; it is the normal one. This pass reads the file for
+ * declarations that bind a known sink name to a new identifier and returns the
+ * mapping, so the sink check can recognise both.
+ *
+ * FILE-LOCAL ONLY. An alias exported from another module is still missed, and
+ * that is a documented gap rather than a silent one.
+ */
+function sinkAliases(root: Node, knownSinkNames: ReadonlySet<string>): Map<string, string> {
+  const aliases = new Map<string, string>();
+  const visit = (node: Node, depth: number): void => {
+    if (depth > 40) return;
+    if (node.type === 'variable_declarator' || node.type === 'short_var_declaration') {
+      const nameNode = node.childForFieldName('name') ?? node.childForFieldName('left');
+      const valueNode = node.childForFieldName('value') ?? node.childForFieldName('right');
+      if (nameNode && valueNode) {
+        const alias = text(nameNode);
+        const initialiser = text(valueNode);
+        // Only wrappers that PASS THE FUNCTION ALONG: promisify(fn),
+        // util.promisify(fn), require('child_process').fn, cp.fn.
+        if (/^(?:[\w.]*\bpromisify\s*\(|require\s*\(|[\w$]+\.)/.test(initialiser)) {
+          for (const sinkName of knownSinkNames) {
+            if (alias === sinkName) continue;
+            if (new RegExp(`\\b${sinkName}\\b`).test(initialiser)) {
+              aliases.set(alias, sinkName);
+              break;
+            }
+          }
+        }
+      }
+    }
+    for (const child of node.namedChildren) if (child) visit(child, depth + 1);
+  };
+  visit(root, 0);
+  return aliases;
+}
+
+/** A function we can follow a value into. */
+export interface LocalFunction {
+  readonly name: string;
+  readonly params: readonly string[];
+  readonly body: Node;
+  /**
+   * How many arguments a call to this function may pass: fewer than minArgs or
+   * more than maxArgs and it cannot be this function. Recorded at indexing
+   * time, while the tree is hot - a cross-file target's tree may be evicted by
+   * the time a call to it is resolved. See ARITY_ENFORCED.
+   */
+  readonly minArgs?: number | undefined;
+  readonly maxArgs?: number | undefined;
+}
+
+/*
+ * A parameter that makes the argument count flexible: a default value, or a
+ * variadic tail. Matched on node type across the grammars, because each spells
+ * both differently - spread_parameter (Java), variadic_parameter_declaration
+ * (Go), variadic_parameter / optional_parameter_declaration (C, C++),
+ * default_parameter / list_splat_pattern (Python), rest_pattern /
+ * assignment_pattern / optional_parameter (JS, TS).
+ */
+const VARIADIC_PARAMETER = /spread|variadic|splat|rest_pattern|rest_parameter/;
+const DEFAULTED_PARAMETER = /default|optional|assignment_pattern/;
+
+function argumentRange(fnNode: Node): { minArgs: number; maxArgs: number } {
+  const list = parameterListOf(fnNode);
+  if (!list) return { minArgs: 0, maxArgs: Infinity };
+  const params = list.namedChildren.filter((c): c is Node => c !== null && c.type !== 'comment');
+  // C's `f(void)` is a list holding one parameter that means "none".
+  if (params.length === 1 && (params[0]?.text ?? '').trim() === 'void') return { minArgs: 0, maxArgs: 0 };
+  let min = 0;
+  let max = 0;
+  for (const p of params) {
+    if (VARIADIC_PARAMETER.test(p.type) || (p.text ?? '').includes('...')) return { minArgs: min, maxArgs: Infinity };
+    max++;
+    if (!DEFAULTED_PARAMETER.test(p.type)) min++;
+  }
+  return { minArgs: min, maxArgs: max };
+}
+
+/*
+ * A declaration with no body is not somewhere a value can go.
+ *
+ * An interface method, an abstract method, a signature: the tracer indexed them
+ * like functions, and the index keeps the FIRST definition of a name. So when a
+ * Java interface sat above its implementation - the normal way round - calls
+ * resolved to `String clean(String s);`, found nothing inside, and the value
+ * vanished. Swap the two declarations and the same call was flow-verified.
+ * DeclarationOrder.java is that case.
+ */
+const BODYLESS_DECLARATION = /declaration|definition|signature/;
+
+const FUNCTION_TYPES_BY_LANGUAGE = FUNCTION_NODES;
+
+/** Languages where calling with the wrong number of arguments cannot compile. */
+const ARITY_ENFORCED = new Set<LanguageId>(['java', 'go', 'c', 'cpp']);
+
+/** `org.acme.Thing<String>[]` -> `Thing`. */
+function simpleTypeName(raw: string): string {
+  return raw.replace(/<[^>]*>/g, '').replace(/\[\]/g, '').trim().split('.').pop() ?? '';
+}
+
+/**
+ * The declared type of a Java call's receiver, when it is written down nearby:
+ * `new X(...).m()`, or a local variable / parameter / field declared in the
+ * enclosing method or class. Anything else - `this`, a chain, a static class
+ * reference, `var` - returns null, and the call is resolved exactly as before.
+ */
+function javaReceiverType(call: Node): string | null {
+  if (call.type !== 'method_invocation') return null;
+  const receiver = call.childForFieldName('object');
+  if (!receiver) return null;
+  if (receiver.type === 'object_creation_expression') {
+    return simpleTypeName(receiver.childForFieldName('type')?.text ?? '') || null;
+  }
+  if (receiver.type !== 'identifier') return null;
+  const name = receiver.text ?? '';
+
+  const types = new Set<string>();
+  const collect = (scope: Node | null, stopAtNested: boolean): void => {
+    if (!scope) return;
+    const visit = (n: Node): void => {
+      if (n.type === 'formal_parameter' && n.childForFieldName('name')?.text === name) {
+        types.add(simpleTypeName(n.childForFieldName('type')?.text ?? ''));
+      }
+      if (n.type === 'local_variable_declaration' || n.type === 'field_declaration') {
+        for (const d of n.namedChildren) {
+          if (d?.type === 'variable_declarator' && d.childForFieldName('name')?.text === name) {
+            types.add(simpleTypeName(n.childForFieldName('type')?.text ?? ''));
+          }
+        }
+      }
+      for (const child of n.namedChildren) {
+        if (!child) continue;
+        if (stopAtNested && /^(method|constructor)_declaration$|^class_body$/.test(child.type)) continue;
+        visit(child);
+      }
+    };
+    visit(scope);
+  };
+
+  let method: Node | null = call.parent;
+  while (method && !/^(method|constructor)_declaration$|^lambda_expression$/.test(method.type)) {
+    method = method.parent;
+  }
+  collect(method, false);
+  if (types.size === 0) {
+    // A field of the enclosing class: search the class body, not other methods.
+    let klass: Node | null = method?.parent ?? null;
+    while (klass && klass.type !== 'class_body') klass = klass.parent;
+    collect(klass, true);
+  }
+  types.delete('');
+  if (types.size !== 1 || types.has('var')) return null;
+  return [...types][0] ?? null;
+}
+
+/** The class, interface, enum or record a function body is declared in. */
+function declaringTypeOf(fn: LocalFunction): string | null {
+  let n: Node | null = fn.body.parent;
+  while (n && !/^(class|interface|enum|record)_declaration$/.test(n.type)) n = n.parent;
+  return n?.childForFieldName('name')?.text ?? null;
+}
+
+/**
+ * Index every function in a tree by name. Exported because the cross-file
+ * resolver needs exactly the same view of another file that the tracer has of
+ * this one - if the two disagreed about what counts as a function, a value
+ * could be followed into something that is not there.
+ */
+export function collectFunctions(root: Node, language: LanguageId): Map<string, LocalFunction> {
+  const functionTypes = new Set(FUNCTION_TYPES_BY_LANGUAGE[language] ?? []);
+  const found = new Map<string, LocalFunction>();
+
+  const register = (name: string, fnNode: Node): void => {
+    if (!name || found.has(name)) return;
+    const bodyNode = fnNode.childForFieldName('body');
+    if (!bodyNode && BODYLESS_DECLARATION.test(fnNode.type)) return; // see BODYLESS_DECLARATION
+    const body = bodyNode ?? fnNode;
+    found.set(name, { name, params: parameterNames(fnNode), body, ...argumentRange(fnNode) });
+  };
+
+  const visit = (node: Node): void => {
+    if (functionTypes.has(node.type)) {
+      const nameNode = functionNameOf(node);
+      if (nameNode) register(text(nameNode), node);
+    }
+    // `const helper = (x) => {...}` - the name is on the declarator.
+    const value = node.childForFieldName('value') ?? node.childForFieldName('right');
+    const name = node.childForFieldName('name') ?? node.childForFieldName('left');
+    if (value && name && functionTypes.has(value.type)) register(text(name), value);
+
+    for (const child of node.namedChildren) if (child) visit(child);
+  };
+  visit(root);
+  return found;
+}
+
+/**
+ * How the tracer asks "is there a function called X in a file this one imports?"
+ * Implemented by src/taint/project.ts; absent when scanning a single file.
+ */
+export interface CrossFileResolver {
+  resolve(
+    fromPath: string,
+    name: string,
+  ): { readonly path: string; readonly fn: LocalFunction } | null;
+  /** Called when several files export that name and we refuse to guess. */
+  noteAmbiguous(fromPath: string, name: string, candidates: number): void;
+}
+
+/* -------------------------------------------------------------------------- *
+ * The tracer
+ * -------------------------------------------------------------------------- */
+
+interface Scope {
+  readonly body: Node;
+  readonly env: Map<string, Taint>;
+  /**
+   * Which file this scope's nodes live in. Once the tracer can step into
+   * another file, "the current file" stops being a property of the SCAN and
+   * becomes a property of wherever we happen to be standing.
+   */
+  readonly filePath: string;
+  /** Local names holding a prepared statement handle. See PREPARE_CALLS. */
+  readonly prepared: Set<string>;
+  /**
+   * Local names holding a StringBuilder / StringBuffer.
+   *
+   * `append` is a genuine XSS sink on a servlet writer - `response.getWriter()
+   * .append(userInput)` writes straight to the page. It is nothing of the sort
+   * on a StringBuilder, which is just a rope of characters. Without the
+   * distinction, `sb.append(param)` reported XSS on every string-building loop
+   * in Java, and adding receiver mutation was about to make that shape the
+   * commonest thing the tracer sees.
+   */
+  readonly builders: Set<string>;
+  /**
+   * Set only while analysing a called function, so the caller can learn what
+   * the callee gives BACK. `const clean = strip(dirty)` needs this.
+   */
+  readonly onReturn?: (taint: Taint | null, node: Node) => void;
+}
+
+/**
+ * Where this trace RAN OUT, counted.
+ *
+ * The engine has always documented these limits in prose - "call chains deeper
+ * than four functions are not followed" sits in the capability block on every
+ * scan. But a general disclaimer and a measurement are different products. The
+ * disclaimer says the gap could exist; the count says it happened 38 times in
+ * YOUR code, which is the version a person can act on.
+ *
+ * A comment in this file used to claim these were "recorded as misses". They
+ * were not - they returned null and vanished. Now the claim is true.
+ */
+export interface TraceLimits {
+  /** Calls not followed because the chain already ran four deep. */
+  readonly depthTruncations: number;
+  /** Calls not re-entered because the function was already on the stack. */
+  readonly recursionStops: number;
+  /** Hops through a function we do not model, where taint was carried anyway. */
+  readonly unmodelledHops: number;
+  /**
+   * How many distinct places an attacker-controlled SOURCE was recognised.
+   *
+   * This exists because of a silence. Elasticsearch - 3,999 Java files, a REST
+   * API, a network service - produced zero flow-verified findings, and the
+   * report had no way to say why. It contains 0 `@RequestParam` and 0
+   * `getParameter()`: it uses its own REST layer, which the dictionaries do not
+   * model, so the tracer never found a single source to start from.
+   *
+   * Every number in a report is downstream of this one. Zero sources means
+   * zero flows can exist no matter how good the tracer is, and a reader
+   * deserves to be told that rather than reading "0 flow-verified" as good news.
+   */
+  readonly sourcesFound: number;
+  /**
+   * Statements not walked because the syntax tree was nested deeper than the
+   * walk will go.
+   *
+   * Distinct from depthTruncations, which counts CALL chains. This one counts
+   * places where a single EXPRESSION was too deep - and it exists because a
+   * 25,809-file scan of the TypeScript repository died with "Maximum call stack
+   * size exceeded" on a file containing one expression with 1,499 `+` operators.
+   * The walk recursed 1,499 frames and took the process with it.
+   *
+   * A crash is the worst possible answer: it produces no report at all, so a
+   * whole scan is lost to one pathological file. Stopping is better - but only
+   * if we SAY we stopped, which is what this counter is for.
+   */
+  readonly astTruncations: number;
+}
+
+/**
+ * Code the tracer did not walk because a condition fixed at compile time means
+ * it cannot run - the dead arm of an `if`, a case a decided switch cannot
+ * reach. Not a finding, and not a proof about any one line: a record of a
+ * decision, so that a flow which disappeared because of it did not disappear
+ * silently.
+ */
+export interface UnreachableRegion {
+  readonly node: Node;
+  readonly filePath: string;
+  readonly why: string;
+}
+
+/**
+ * A FLASK ROUTE RETURNING A STR IS AN HTML PAGE, TAGS OR NOT.
+ *
+ * The return sink otherwise needs visible markup, because most functions that
+ * return a string are not views. BenchmarkPython's 31 real XSS cases return
+ * `f"bar is '{bar}'"` from `@app.route` - Flask sends a returned str as
+ * text/html, so `<script>` in bar runs - and all 31 were silent.
+ *
+ * Both halves are proven, not guessed:
+ *   - the function carries a `@<x>.route(...)` decorator (Flask, Blueprint,
+ *     Quart). NOT FastAPI's `@app.get`, which JSON-encodes a returned str;
+ *   - the value is a str by construction: a string literal or f-string, a `+`
+ *     or `%` with a string literal on the left, or a name whose only writes in
+ *     the function are one `name = "<literal>"` and then `name += ...` (str +=
+ *     anything that is not a str raises, so it stays a str). A name that may
+ *     hold a dict - which Flask turns into JSON - never qualifies.
+ * A header set elsewhere (after_request, a config default) is not seen.
+ */
+function flaskRouteReturningStr(ret: Node, expression: Node): boolean {
+  let fn: Node | null = ret.parent;
+  while (fn && fn.type !== 'function_definition') fn = fn.parent;
+  const decorated = fn?.parent?.type === 'decorated_definition' ? fn.parent : null;
+  if (!fn || !decorated) return false;
+  const isRoute = decorated.namedChildren.some(
+    (d) => d?.type === 'decorator' && /^@\s*[\w.]+\.route\s*\(/.test(d.text),
+  );
+  if (!isRoute) return false;
+
+  const strByConstruction = (e: Node): boolean => {
+    if (e.type === 'parenthesized_expression') return !!e.namedChildren[0] && strByConstruction(e.namedChildren[0]);
+    if (e.type === 'string' || e.type === 'concatenated_string') return true;
+    if (e.type === 'binary_operator') {
+      const op = e.childForFieldName('operator')?.text;
+      const left = e.childForFieldName('left');
+      return (op === '+' || op === '%') && !!left && strByConstruction(left);
+    }
+    return false;
+  };
+  if (strByConstruction(expression)) return true;
+  if (expression.type !== 'identifier') return false;
+
+  const name = expression.text;
+  let initial = 0;
+  let other = false;
+  const visit = (n: Node): void => {
+    if (other) return;
+    if (n.type === 'assignment' || n.type === 'augmented_assignment') {
+      const left = n.childForFieldName('left');
+      if (left?.text === name) {
+        const op = n.type === 'augmented_assignment' ? n.childForFieldName('operator')?.text : '=';
+        const right = n.childForFieldName('right');
+        if (op === '=' && right && strByConstruction(right)) initial++;
+        else if (op !== '+=') other = true;
+      } else if (left && new RegExp(`(^|[^\\w])${name}([^\\w]|$)`).test(left.text)) other = true;
+    } else if (n.type === 'identifier' && n.text === name && n.parent && /^(for_statement|with_item|global_statement|nonlocal_statement|named_expression|parameters|typed_parameter|default_parameter)$/.test(n.parent.type)) {
+      other = true;
+    }
+    for (const c of n.namedChildren) if (c) visit(c);
+  };
+  visit(fn);
+  return !other && initial === 1;
+}
+
+export interface TraceOutcome {
+  readonly flows: readonly FlowResult[];
+  readonly sanitized: readonly SanitizedFlow[];
+  readonly unreachable: readonly UnreachableRegion[];
+  /** Reads from a local map resolved to the one put that supplies them - see local-map.ts. */
+  readonly resolvedReads: readonly UnreachableRegion[];
+  /** Traces ended at a read whose result is new data - see FreshResultSpec. */
+  readonly freshStops: readonly UnreachableRegion[];
+  readonly limits: TraceLimits;
+}
+
+export function traceFile(
+  file: ParsedFile,
+  language: LanguageId,
+  resolver?: CrossFileResolver,
+  /**
+   * Absolute path -> the path a human should see. Resolution needs absolute
+   * paths; reports need short ones. Keeping both straight matters more once a
+   * single finding can name two different files.
+   */
+  toDisplay: (absolutePath: string) => string = (p) => p,
+): TraceOutcome {
+  /**
+   * Blind spots, counted by SITE rather than by visit.
+   *
+   * A note on why, because the obvious reading of this code is wrong. A scan
+   * reported "3 hops through functions we do not model" while the printed flow
+   * paths showed only two, which looks exactly like double-counting: the
+   * tracer can reach one expression from both the expression walk and the
+   * statement walk, so a tally would plausibly count it twice.
+   *
+   * It was measured, and that is NOT what was happening - raw visits equalled
+   * distinct sites on every corpus tried. The third hop was a real, separate
+   * site (`db.Query(query)`, whose tainted RESULT flows on) that simply never
+   * reached a sink, so no finding carried it.
+   *
+   * The Set stays, because counting a site twice would be wrong if the walk
+   * ever changed. But it fixed nothing that was broken, and saying otherwise
+   * here would be the same kind of confident wrong answer this file exists to
+   * avoid. What was actually wrong was the LABEL - see the blind-spot text in
+   * core/score.ts, which now says these are scan-wide rather than per-finding.
+   */
+  const seenDepth = new Set<string>();
+  const seenRecursion = new Set<string>();
+  const seenUnmodelled = new Set<string>();
+  /**
+   * A call's receiver type, per call site. Working it out means walking the
+   * enclosing method for the receiver's declaration, and the same call is
+   * evaluated once per taint shape that reaches it - done eagerly for every
+   * call, that walk made a BenchmarkJava scan 65% slower (40s to 67s). Keyed by
+   * file and span rather than node id, because a node id is a memory address
+   * and can be reused once a tree is evicted from the budget.
+   */
+  const receiverTypes = new Map<string, string | null>();
+  /** Sites where the syntax tree was deeper than MAX_AST_DEPTH. */
+  const seenDeepAst = new Set<string>();
+  const siteOf = (n: Node, filePath: string) => `${filePath}#${n.id}`;
+
+  const dictionary = TAINT_DICTIONARIES[language];
+  // Java and Go: no dictionary yet. Reported in the coverage section, not hidden.
+  const seenSources = new Set<string>();
+  const limits = (): TraceLimits => ({
+    astTruncations: seenDeepAst.size,
+    depthTruncations: seenDepth.size,
+    recursionStops: seenRecursion.size,
+    unmodelledHops: seenUnmodelled.size,
+    sourcesFound: seenSources.size,
+  });
+
+  if (!dictionary) return { flows: [], sanitized: [], unreachable: [], resolvedReads: [], freshStops: [], limits: limits() };
+
+  const functionTypes = new Set(FUNCTION_NODES[language] ?? []);
+  const fileTypes = declaredTypes(file.root, language);
+  const knownSinkNames = new Set<string>();
+  for (const sink of dictionary.callSinks) for (const m of sink.methods) knownSinkNames.add(m);
+  const fileAliases = sinkAliases(file.root, knownSinkNames);
+  const results: FlowResult[] = [];
+  const sanitized: SanitizedFlow[] = [];
+  /*
+   * Every region skipped as unreachable, once each. Before this list existed the
+   * dead arm of an `if` was skipped with no record at all - a flow inside it
+   * simply never existed, and nothing in the report could say why a line that
+   * reads a request parameter went unreported.
+   */
+  const unreachable: UnreachableRegion[] = [];
+  const unreachableSeen = new Set<string>();
+  /*
+   * A map read answered by key rather than by "the whole collection is dirty".
+   * Recorded for the same reason as unreachable code: a finding that used to
+   * exist and now does not has to leave the decision behind it on the record.
+   */
+  const resolvedReads: UnreachableRegion[] = [];
+  const resolvedSeen = new Set<string>();
+  const noteResolvedRead = (node: Node, filePath: string, why: string): void => {
+    const key = `${filePath}\0${node.startIndex}:${node.endIndex}`;
+    if (resolvedSeen.has(key)) return;
+    resolvedSeen.add(key);
+    resolvedReads.push({ node, filePath: toDisplay(filePath), why });
+  };
+  /*
+   * Traces ended at a read whose result is new data (FreshResultSpec). The
+   * same reason as the two lists around it: a proof that used to be published
+   * and no longer is has to leave the decision on the record.
+   */
+  const freshStops: UnreachableRegion[] = [];
+  const freshSeen = new Set<string>();
+  const noteFreshStop = (node: Node, filePath: string, why: string): void => {
+    const key = `${filePath}\0${node.startIndex}:${node.endIndex}`;
+    if (freshSeen.has(key)) return;
+    freshSeen.add(key);
+    freshStops.push({ node, filePath: toDisplay(filePath), why });
+  };
+  const noteUnreachable = (node: Node, filePath: string, why: string): void => {
+    const key = `${filePath}\0${node.startIndex}:${node.endIndex}`;
+    if (unreachableSeen.has(key)) return;
+    unreachableSeen.add(key);
+    unreachable.push({ node, filePath: toDisplay(filePath), why });
+  };
+
+  /**
+   * The file we are standing in RIGHT NOW - not necessarily the file we were
+   * asked to scan. Saved and restored around every cross-file descent.
+   *
+   * A single mutable is safe here only because the walk is depth-first and
+   * synchronous: steps created during a descent get the callee's path, and the
+   * restore happens before the caller creates any more. If this ever becomes
+   * async, this variable becomes a bug.
+   */
+  let currentPath = file.path;
+
+  // Scopes are processed as a queue. The module top level is the first one;
+  // every nested function becomes another, seeded with a SNAPSHOT of the
+  // enclosing notebook so that callbacks can see variables defined outside them.
+  const queue: Scope[] = [
+    {
+      body: file.root,
+      env: new Map(),
+      filePath: file.path,
+      prepared: new Set(),
+      builders: new Set(),
+    },
+  ];
+
+  /* ---------------------------------------------------------------- *
+   * PHASE 3b: the call graph.
+   *
+   * Phase 3a stopped at the function boundary. `helper(req.query.id)` was the
+   * end of the trace, because guessing what `helper` does would have been
+   * exactly the kind of confident wrong answer this project refuses to give.
+   *
+   * Now we do not guess - we go and look. Every function defined in this file
+   * is indexed by name; when a tainted value is passed to one, we bind it to
+   * the parameter name and analyse that body with the taint already in place.
+   * Sinks inside the callee become findings whose path spans both functions.
+   *
+   * Three guards keep this honest and terminating:
+   *   MAX_CALL_DEPTH  stop after 4 nested calls. Deeper chains are missed and
+   *                   that is a stated gap, not a silent one.
+   *   callStack       a function already being analysed is not re-entered, so
+   *                   recursion cannot loop forever.
+   *   descendCache    each call site is followed once; both the expression path
+   *                   and the statement path read the same cached answer.
+   * ---------------------------------------------------------------- */
+  const MAX_CALL_DEPTH = 4;
+  const localFunctions = new Map<string, LocalFunction>();
+  const callStack: string[] = [];
+  const descendCache = new Map<string, Taint | null>();
+
+  const localFunctionsFound = collectFunctions(file.root, language);
+  for (const [name, fn] of localFunctionsFound) localFunctions.set(name, fn);
+
+  // Assigned after `walk` exists; `evaluateCall` reaches it through this box.
+  let descendIntoLocalCall: (
+    node: Node,
+    scope: Scope,
+    depth: number,
+  ) => { handled: boolean; taint: Taint | null; stopped?: 'depth' | 'recursion' } = () => ({
+    handled: false,
+    taint: null,
+  });
+
+  const step = (
+    kind: FlowStep['kind'],
+    node: Node,
+    description: string,
+    sanitizesKinds?: readonly SinkKind[],
+  ): InternalStep => ({
+    kind,
+    location: nodeLocation(node, toDisplay(currentPath)),
+    description,
+    ...(sanitizesKinds ? { sanitizesKinds } : {}),
+  });
+
+  /**
+   * Is this WHOLE expression one a source names as not the client's - see
+   * SourceSpec.except? Then it is clean, and so is anything read straight out
+   * of it.
+   */
+  const exceptedSource = (expression: string): boolean =>
+    dictionary.sources.some((s) => !!s.except && s.pattern.test(expression) && s.except.test(expression));
+
+  /** Does this expression's text look like a known attacker-controlled source? */
+  const sourceTaint = (node: Node, expression: string): Taint | null => {
+    for (const source of dictionary.sources) {
+      if (!source.pattern.test(expression)) continue;
+      seenSources.add(siteOf(node, currentPath));
+      return {
+        steps: [
+          step('source', node, `\`${expression.slice(0, 60)}\` is ${source.description}`),
+        ],
+        sanitizedFor: new Set(),
+        origin: expression.slice(0, 60),
+        unknownHops: [],
+        ...(source.browserOnly ? { fromBrowser: true } : {}),
+        ...(source.localOnly ? { fromLocal: true } : {}),
+        ...(source.fileNameOnly ? { fileNameOnly: true } : {}),
+      };
+    }
+    return null;
+  };
+
+  const addStep = (taint: Taint, node: Node, description: string): Taint => ({
+    steps: [...taint.steps, step('propagation', node, description)],
+    sanitizedFor: taint.sanitizedFor,
+    origin: taint.origin,
+    unknownHops: taint.unknownHops,
+    compartment: taint.compartment,
+    branchAssumed: taint.branchAssumed,
+    containerGuess: taint.containerGuess,
+    collectedMany: taint.collectedMany,
+    quotePending: taint.quotePending,
+    urlPrefix: taint.urlPrefix,
+    fromBrowser: taint.fromBrowser,
+    fromLocal: taint.fromLocal,
+    fileNameOnly: taint.fileNameOnly,
+    joined: taint.joined,
+    afterWash: taint.afterWash,
+  });
+
+  /*
+   * A CHECK IS READ WHERE THE VALUE IS READ, not where it is used.
+   *
+   * The first version of validation guards lived at the sink: it took the
+   * text of the sink's argument, broke it into pieces, and asked whether each
+   * piece had been checked. Text is not a value. `$q = "... '$b'"` had no
+   * pieces at all - string nodes were skipped whole - so a check on `$a`
+   * vouched for `$b`, and DVWA-shaped code printed "checked and cleared" over
+   * a real injection. A call was worse: its arguments were the pieces, so a
+   * function returning request data looked like the checked value it was
+   * handed.
+   *
+   * Here a read of `$_GET['id']` inside `if (ctype_digit($_GET['id']))` comes
+   * back WASHED, like the output of a sanitiser, and everything built from it
+   * inherits that through the ordinary machinery - concatenation keeps only
+   * what both sides washed, so an unchecked value beside it stays dirty. The
+   * check becomes a step on the path, so a sink it does not cover (a URL host,
+   * which digits do not make safe) says so in words.
+   *
+   * VALUES BUILT BEFORE THE CHECK. DVWA's upload/impossible.php builds the
+   * file name from the extension FIRST and checks the extension after:
+   *
+   *     $name = bin2hex(random_bytes(16)) . '.' . $ext;
+   *     if (strtolower($ext) == 'jpg' || ...) { echo "<a href='$name'>"; }
+   *
+   * The check limits `$ext`, so it limits `$name` - but only while `$ext`
+   * still holds the very value `$name` was built from, and only if `$name`
+   * was built by joining strings, which keeps every character. `throughOf`
+   * records the variables a value was joined through, and `bindingOf` which
+   * assignment a variable's current value came from. Both live in WeakMaps
+   * and are set in exactly two places (a plain assignment, and string
+   * joining), so every other way of making a value - a call, a decode, a
+   * conditional write, a copy with one flag changed - silently has neither,
+   * and is never cleared this way. Absence is the safe default.
+   */
+  const guardOn = guardsApply(language);
+  const throughOf = new WeakMap<Taint, ReadonlySet<string>>();
+  const bindingOf = new WeakMap<Taint, string>();
+
+  const guarded = (taint: Taint, node: Node, expression: string, scope: Scope): Taint => {
+    if (!guardOn) return taint;
+    const facts = guardFactsAt(node, language);
+    if (facts.size === 0) return taint;
+    let fact: GuardFact | undefined = facts.get(normalizeExpression(expression));
+    let via: string | null = null;
+    if (!fact) {
+      const through = throughOf.get(taint);
+      if (through) {
+        for (const [checked, candidate] of facts) {
+          const current = scope.env.get(checked);
+          const binding = current ? bindingOf.get(current) : undefined;
+          if (binding && through.has(binding)) {
+            fact = candidate;
+            via = checked;
+            break;
+          }
+        }
+      }
+    }
+    if (!fact) return taint;
+    const { kinds, insideQuotesOnly } = guardClears(fact);
+    const unconditional = kinds.filter((k) => !insideQuotesOnly.includes(k));
+    const before = taint.quotePending ?? [];
+    const added = kinds.filter((k) => !taint.sanitizedFor.has(k) || before.includes(k));
+    if (added.length === 0) return taint;
+    // A kind washed for good leaves the quote question; a word adds SQL to it
+    // unless SQL was already washed for good by something earlier.
+    const pending = [
+      ...new Set([
+        ...before.filter((k) => !unconditional.includes(k)),
+        ...insideQuotesOnly.filter((k) => !taint.sanitizedFor.has(k) || before.includes(k)),
+      ]),
+    ];
+    const what = describeFact(fact);
+    return {
+      ...taint,
+      steps: [
+        ...taint.steps,
+        {
+          ...step(
+            'sanitizer',
+            node,
+            via
+              ? `built by joining strings from \`${via}\`, which still holds that same value here and was ${what}`
+              : what,
+            kinds,
+          ),
+          ...(insideQuotesOnly.length > 0 ? { quoteDependent: true, quoteKinds: insideQuotesOnly } : {}),
+          guard: true,
+        },
+      ],
+      sanitizedFor: new Set([...taint.sanitizedFor, ...kinds]),
+      quotePending: pending.length > 0 ? pending : undefined,
+      afterWash: washedNow(taint.afterWash, kinds),
+    };
+  };
+
+  /**
+   * Several dirty values become one: a template, a container literal. The
+   * result is washed only for what EVERY part was washed for, and the path is
+   * told through the least-washed part, so a reader sees the value that is
+   * actually dangerous rather than its cleaned neighbour.
+   */
+  const joinParts = (parts: readonly Taint[]): Taint => {
+    const first = parts[0]!;
+    if (parts.length === 1) return first;
+    const narrator = parts.reduce((a, b) => (b.sanitizedFor.size < a.sanitizedFor.size ? b : a));
+    const pending = [...new Set(parts.flatMap((p) => p.quotePending ?? []))];
+    const sanitizedFor = new Set([...first.sanitizedFor].filter((k) => parts.every((p) => p.sanitizedFor.has(k))));
+    return {
+      ...narrator,
+      sanitizedFor,
+      unknownHops: [...new Set(parts.flatMap((p) => p.unknownHops))],
+      quotePending: pending.length > 0 ? pending : undefined,
+      branchAssumed: parts.every((p) => p.branchAssumed) ? true : undefined,
+      containerGuess: parts.every((p) => p.containerGuess) ? true : undefined,
+      collectedMany: parts.some((p) => p.collectedMany) ? true : undefined,
+      // Where the FIRST dirty part starts is where the attacker's text starts.
+      urlPrefix: first.urlPrefix,
+      fromBrowser: parts.every((p) => p.fromBrowser) ? true : undefined,
+      fromLocal: parts.every((p) => p.fromLocal) ? true : undefined,
+      fileNameOnly: parts.every((p) => p.fileNameOnly) ? true : undefined,
+      joined: true,
+      afterWash: joinedAfterWash(parts, sanitizedFor),
+    };
+  };
+
+  /** What both joined values passed through - see `throughOf`. */
+  const joinedThrough = (left: Taint | null, right: Taint | null): ReadonlySet<string> | undefined => {
+    if (left && right) {
+      const a = throughOf.get(left);
+      const b = throughOf.get(right);
+      if (!a || !b) return undefined;
+      const both = new Set([...a].filter((k) => b.has(k)));
+      return both.size > 0 ? both : undefined;
+    }
+    const only = left ?? right;
+    return only ? throughOf.get(only) : undefined;
+  };
+
+  /**
+   * WHERE AN ESCAPED VALUE IS SPLICED DECIDES WHETHER THE ESCAPING COUNTS.
+   *
+   * Inside quotes, escape-only cleaning (see SanitizerSpec.onlyInsideQuotes) is
+   * the whole defence, so it stands. Outside them it protects nothing: the
+   * kinds go back out of sanitizedFor, and the path says why, so a reader sees
+   * the escaping AND the reason it did not help.
+   */
+  const placeInString = (taint: Taint, quoted: boolean, node: Node): Taint => {
+    const pending = taint.quotePending;
+    if (!pending || pending.length === 0) return taint;
+    if (quoted) return { ...taint, quotePending: undefined };
+    return {
+      ...taint,
+      steps: [
+        ...taint.steps,
+        step(
+          'propagation',
+          node,
+          taint.steps.some((s) => s.quoteDependent && !s.guard)
+            ? 'placed OUTSIDE quotes in the string it is built into, where the escaping applied earlier ' +
+                'protects nothing - escaping only works on a value inside quotes'
+            : 'placed OUTSIDE quotes in the string it is built into, where a word the check let through ' +
+                'is read as SQL - a column name or a keyword - rather than as data',
+        ),
+      ],
+      sanitizedFor: new Set([...taint.sanitizedFor].filter((k) => !pending.includes(k))),
+      quotePending: undefined,
+    };
+  };
+
+  /**
+   * The heart of it: "is this expression dirty, and how did it get that way?"
+   * Returns null for "clean, or we cannot tell" - deliberately the same answer,
+   * because the engine never claims cleanliness it has not proven.
+   */
+  const evaluate = (node: Node | null, scope: Scope, depth = 0): Taint | null => {
+    if (!node || depth > 24) return null;
+    const expression = text(node);
+
+    if (UNWRAP_NODES.has(node.type)) {
+      /*
+       * Take the VALUE, not the first named child.
+       *
+       * Every wrapper here used to be unwrapped by grabbing child 0, which is
+       * right for `(x)` and `await x` and wrong for a Java cast: the first
+       * named child of `(String) map.get("k")` is the type name `String`, so
+       * the tracer solemnly evaluated the word "String" and reported the value
+       * clean. `value` is the field the Java grammar gives the expression; the
+       * last named child is the fallback for wrappers that name no field.
+       */
+      const inner =
+        node.childForFieldName('value') ??
+        (TYPE_FIRST_WRAPPERS.has(node.type)
+          ? node.namedChildren.filter((c): c is Node => c !== null).pop() ?? null
+          : node.namedChildren.find((c): c is Node => c !== null) ?? null);
+      return evaluate(inner, scope, depth + 1);
+    }
+
+    // Go writes `a, b := f(), g()`. A single-valued list is just the value.
+    // A multi-valued one we do not split - documented as a Go imprecision.
+    if (node.type === 'expression_list' && node.namedChildCount === 1) {
+      return evaluate(node.namedChildren[0] ?? null, scope, depth + 1);
+    }
+
+    if (VARIABLE_NODES.has(node.type)) {
+      const found = scope.env.get(expression) ?? sourceTaint(node, expression);
+      return found ? guarded(found, node, expression, scope) : null;
+    }
+
+    // `lst[1]` / `d['k']` on a local list or dict whose every write is on the
+    // page - see resolvePythonListRead / resolvePythonDictRead. A literal there
+    // is clean; a name nothing mentions between the write and here is traced
+    // as itself, with no guess attached. Anything else keeps the
+    // whole-container answer below.
+    if (language === 'python' && node.type === 'subscript') {
+      const read = resolveContainerRead(node, language);
+      const value = read?.value;
+      const where = read && `\`${expression.slice(0, 50)}\` returns what was stored at ${read.selector} on line ${read.write.startPosition.row + 1}`;
+      if (
+        read && value &&
+        (['integer', 'float', 'true', 'false', 'none'].includes(value.type) ||
+          (value.type === 'string' && !value.namedChildren.some((c) => c?.type === 'interpolation')))
+      ) {
+        noteResolvedRead(node, scope.filePath, `${where}, a literal`);
+        return null;
+      }
+      const fn = read && enclosingPythonFunction(node);
+      if (read && value?.type === 'identifier' && fn && !mentionedBetween(fn, value.text, read.write.endIndex, node.startIndex)) {
+        noteResolvedRead(node, scope.filePath, `${where}, \`${value.text}\``);
+        const stored = evaluate(value, scope, depth + 1);
+        return stored ? addStep(stored, node, `read back from \`${read.container}\` at ${read.selector}`) : null;
+      }
+    }
+
+    if (MEMBER_NODES.has(node.type)) {
+      if (exceptedSource(expression)) return null;
+      // `req.query.id` matches a source pattern as a whole.
+      const direct = sourceTaint(node, expression);
+      if (direct) return guarded(direct, node, expression, scope);
+      // Otherwise dirt flows outward: if `data` is dirty, so is `data.name`.
+      const object =
+        node.childForFieldName('object') ??
+        node.childForFieldName('value') ??
+        node.namedChildren.find((c): c is Node => c !== null) ??
+        null;
+      const inner = evaluate(object, scope, depth + 1);
+      if (!inner) return null;
+      const read = addStep(inner, node, `read out of a tainted value as \`${expression.slice(0, 50)}\``);
+      // One element of several: which one is a guess - see collectedMany.
+      const oneOfMany = ELEMENT_TARGETS.has(node.type) && inner.collectedMany ? { ...read, containerGuess: true } : read;
+      return guarded(oneOfMany, node, expression, scope);
+    }
+
+    if (node.type === 'binary_expression' || node.type === 'binary_operator') {
+      const operator = node.childForFieldName('operator')?.text ?? '';
+      /*
+       * Two different reasons an operator is on this list.
+       *
+       * COMPOSITION - `+`, `%`, `.` - builds a new value that CONTAINS the
+       * operands. `.` is PHP's concatenation operator; every other language
+       * here uses `+`, and `%` is Python's old-style format.
+       *
+       * SELECTION - `??`, `||`, `&&` - builds nothing and RETURNS one of the
+       * operands unchanged. `dirty ?? "fallback"` is `dirty` on every run
+       * where `dirty` exists, which is every run an attacker cares about.
+       *
+       * Selection was missing, and the cost was quiet: the tracer returned
+       * null, the finding fell back to signature-based, and the report said a
+       * pattern had been matched when a path was in fact walkable. Nothing was
+       * hidden - the finding still appeared - but a provable claim was being
+       * reported as a guess, which is the honesty contract failing in the
+       * cautious direction rather than the loud one. Worth fixing for the same
+       * reason the loud direction is: the label is supposed to mean something.
+       *
+       * This is yesterday's Java argument - a null default is not a sanitiser -
+       * arriving in the languages that spell it with an operator instead of an
+       * `if`. It went unnoticed there because JavaScript's version has no
+       * statement to look at.
+       *
+       * The merge below is already right for both kinds. Composition needs the
+       * union of what is dirty and the intersection of what was washed;
+       * selection needs the same answer for a different reason, because either
+       * operand could be the one that comes out.
+       */
+      if (!BINARY_CARRIERS.has(operator)) return null;
+      const leftNode = node.childForFieldName('left');
+      let left = evaluate(leftNode, scope, depth + 1);
+      let right = evaluate(node.childForFieldName('right'), scope, depth + 1);
+      // Joining strings settles any quote-dependent cleaning - see placeInString.
+      // A right operand is quoted when the literal text before it opens a quote;
+      // a left operand still unsettled here starts the string, so nothing quotes it.
+      if (operator === '+' || operator === '.') {
+        if (right?.quotePending?.length) right = placeInString(right, opensAQuote(literalTextOf(leftNode)), node);
+        if (left?.quotePending?.length) left = placeInString(left, false, node);
+      }
+      const taint = left ?? right;
+      if (!taint) return null;
+      // If both sides are dirty, keep the union of what has been washed.
+      const pendingBoth = [...new Set([...(left?.quotePending ?? []), ...(right?.quotePending ?? [])])];
+      // Told through the less-washed side - see the note on template parts.
+      const narrator = left && right && right.sanitizedFor.size < left.sanitizedFor.size ? right : left;
+      const merged: Taint =
+        left && right
+          ? {
+              steps: narrator!.steps,
+              sanitizedFor: new Set(
+                [...left.sanitizedFor].filter((k) => right!.sanitizedFor.has(k)),
+              ),
+              origin: narrator!.origin,
+              unknownHops: [...left.unknownHops, ...right.unknownHops],
+              quotePending: pendingBoth.length > 0 ? pendingBoth : undefined,
+              // Joined, the string is dirty for certain if EITHER side is - so
+              // an assumption survives only when both sides rest on one.
+              branchAssumed: left.branchAssumed && right.branchAssumed ? true : undefined,
+              containerGuess: left.containerGuess && right.containerGuess ? true : undefined,
+              urlPrefix: left.urlPrefix,
+              // The joined string is browser-only only if both halves are.
+              fromBrowser: left.fromBrowser && right.fromBrowser ? true : undefined,
+              // Local only if both halves are: one request value makes it the attacker's.
+              fromLocal: left.fromLocal && right.fromLocal ? true : undefined,
+              fileNameOnly: left.fileNameOnly && right.fileNameOnly ? true : undefined,
+              joined: true,
+              afterWash: joinedAfterWash(
+                [left, right],
+                new Set([...left.sanitizedFor].filter((k) => right.sanitizedFor.has(k))),
+              ),
+            }
+          : taint;
+      /*
+       * Where the dirty part now sits. A dirty left side starts the string and
+       * keeps what it had; a dirty right side has everything on the left in
+       * front of it. `%` formats rather than joins, so the position inside the
+       * format string is not known - and unknown means "starts the string".
+       */
+      const urlPrefix =
+        operator !== '+' && operator !== '.'
+          ? undefined
+          : left
+            ? left.urlPrefix
+            : shapeOf(leftNode) + (right?.urlPrefix ?? '');
+      const joined = addStep(
+        { ...merged, urlPrefix },
+        node,
+        operator === '%'
+          ? 'formatted into a larger string with %'
+          : `concatenated into a larger string with ${operator}`,
+      );
+      const through = guardOn ? joinedThrough(left, right) : undefined;
+      if (through) throughOf.set(joined, through);
+      return joined;
+    }
+
+    if (CONTAINER_NODES.has(node.type)) {
+      /*
+       * EVERY ELEMENT, for the reason the template note below gives. This also
+       * returned on the first dirty element, so `[shellQuote(a), b]` was the
+       * quoted `a`, and `exec('ls ' + args.join(' '))` was printed as checked
+       * and cleared with a raw `b` in the command line.
+       */
+      const elements: Taint[] = [];
+      for (const element of node.namedChildren) {
+        if (!element) continue;
+        const taint = evaluate(element, scope, depth + 1);
+        if (taint) elements.push(taint);
+      }
+      if (elements.length === 0) return null;
+      return addStep(
+        joinParts(elements),
+        node,
+        'placed into a container - we taint the container whole, not per element',
+      );
+    }
+
+    if (STRING_NODES.has(node.type)) {
+      /*
+       * A template literal or f-string: the dirt is inside the ${...} / {...}.
+       *
+       * EVERY PART, NOT THE FIRST DIRTY ONE. This loop used to return on the
+       * first part that carried taint, so the string took that part's washing
+       * as its own:
+       *
+       *     $a = intval($_GET['a']);
+       *     $q = "INSERT INTO t VALUES ({$a}, '{$ip}')";   // $ip is a header
+       *
+       * `$a` came first, `$a` was washed for SQL, and the query was printed as
+       * "checked and cleared" with the X-Forwarded-For header spliced into it
+       * raw. Concatenation with `.` already kept only what BOTH sides washed;
+       * interpolation is the same operation written differently and now gets
+       * the same answer. Found in DVWA's bac/medium.php, where the first part
+       * became washed once validation checks were read.
+       */
+      const parts: Taint[] = [];
+      for (const child of node.namedChildren) {
+        if (!child) continue;
+        // PHP splices a variable into a double-quoted string with no wrapper
+        // node at all: "id = $id" holds a `variable_name` child directly, where
+        // JS and Python wrap theirs in a substitution node. So the variable IS
+        // the interpolation, and it is evaluated in place.
+        const inner = INTERPOLATION_NODES.has(child.type)
+          ? (child.namedChildren.find((c): c is Node => c !== null) ?? null)
+          : VARIABLE_NODES.has(child.type) || MEMBER_NODES.has(child.type)
+            ? child
+            : null;
+        if (!inner) continue;
+        const taint = evaluate(inner, scope, depth + 1);
+        if (taint) {
+          // Quote-dependent cleaning is settled by what comes before the splice
+          // in this literal. If the offsets do not line up with the text, the
+          // position is unknown and the value is treated as unquoted.
+          let placed = taint;
+          const offset = child.startIndex - node.startIndex;
+          const lined = node.text.slice(offset, offset + child.text.length) === child.text;
+          if (taint.quotePending?.length) {
+            placed = placeInString(taint, lined && opensAQuote(afterOpening(node.text.slice(0, offset))), node);
+          }
+          // What precedes the value in this literal. If the offsets do not
+          // line up with the text, where it sits is unknown: treated as the
+          // start of the string, which keeps the old answer.
+          const before = lined ? templateShapeBefore(node, child) : undefined;
+          const shaped: Taint = { ...placed, urlPrefix: before === undefined ? undefined : before + (placed.urlPrefix ?? '') };
+          if (throughOf.has(placed)) throughOf.set(shaped, throughOf.get(placed)!);
+          parts.push(shaped);
+        }
+      }
+      if (parts.length === 0) return null;
+      const result = addStep(joinParts(parts), node, 'interpolated into a string template');
+      if (guardOn) {
+        const sets = parts.map((p) => throughOf.get(p));
+        if (sets.every((t): t is ReadonlySet<string> => t !== undefined)) {
+          const shared = new Set([...sets[0]!].filter((k) => sets.every((t) => t.has(k))));
+          if (shared.size > 0) throughOf.set(result, shared);
+        }
+      }
+      return result;
+    }
+
+    /*
+     * A COMPREHENSION THAT ESCAPES EVERY ELEMENT.
+     *
+     *     kwargs_safe = {k: conditional_escape(v) for (k, v) in kwargs.items()}
+     *
+     * The line directly below the map() call in Django's format_html. Both
+     * idioms sit in the same six-line function, so covering one and not the
+     * other would have left the very case that started this half-fixed - and
+     * did, until the fixture caught it.
+     *
+     * Same rule as the higher-order applier: if EVERY element passes through a
+     * sanitiser, the collection is washed for that sanitiser's kinds. The
+     * element expression is the whole test - a comprehension whose body is a
+     * bare name, or a call this engine does not know, proves nothing and is
+     * asserted as still-reported in vulnerable/higher-order-escape-fence.py.
+     */
+    if (COMPREHENSION_NODES.has(node.type)) {
+      const body = node.namedChildren.find((c): c is Node => c !== null);
+      // A dict comprehension's body is a `pair`; the VALUE is what gets escaped.
+      const element =
+        body?.type === 'pair'
+          ? body.childForFieldName('value') ?? body
+          : body;
+      const applied =
+        element && CALL_NODES.has(element.type)
+          ? dictionary.sanitizers.find((san) =>
+              san.names.includes(lastSegment(calleeOf(element).text)),
+            )
+          : undefined;
+      if (applied && element) {
+        for (const child of node.namedChildren) {
+          if (!child || child === body) continue;
+          const iterated = child.childForFieldName('right') ?? child;
+          const taint = evaluate(iterated, scope, depth + 1);
+          if (!taint) continue;
+          return {
+            steps: [
+              ...taint.steps,
+              step(
+                'sanitizer',
+                node,
+                `every element passed through \`${lastSegment(calleeOf(element).text)}()\` ` +
+                  `by a comprehension - ${applied.description}`,
+                applied.kinds,
+              ),
+            ],
+            sanitizedFor: new Set([...taint.sanitizedFor, ...applied.kinds]),
+            origin: taint.origin,
+            unknownHops: taint.unknownHops,
+            afterWash: washedNow(taint.afterWash, applied.kinds),
+          };
+        }
+      }
+    }
+
+    // `cond ? a : b` and Python's `a if cond else b`. We do not evaluate the
+    // condition - if EITHER branch can be dirty, the result can be dirty.
+    if (node.type === 'ternary_expression' || node.type === 'conditional_expression') {
+      /*
+       * When the condition is decidable, only the branch that runs can carry a
+       * value. `(7*18)+106 > 200 ? "constant" : param` is the constant, every
+       * time, and the taint on the other side is in unreachable code.
+       *
+       * When it is not decidable, fall through to the original behaviour: take
+       * whichever branch is dirty, because either might run.
+       */
+      const parts = ternaryParts(node);
+      const truth = conditionTruth(parts.condition, scope.body);
+      if (truth !== undefined) {
+        const taken = truth ? parts.consequence : parts.alternative;
+        const taint = taken ? evaluate(taken, scope, depth + 1) : null;
+        return taint ? addStep(taint, node, 'returned from one branch of a conditional') : null;
+      }
+      /*
+       * The VALUE of `c ? a : b` is a or b. This loop used to walk every child,
+       * the condition included, so `isset($_COOKIE['r']) ? $_COOKIE['r'] : 'x'`
+       * was proven through isset() - a true/false answer - and
+       * `strlen($q) > 9 ? 'long' : 'short'` could only ever be the two words.
+       * The one form whose condition IS the value, `$a ?: $b`, comes back from
+       * ternaryParts with the condition as its consequence.
+       *
+       * A shape ternaryParts cannot split keeps the old walk: carrying too much
+       * is the failure this engine prefers to carrying too little.
+       */
+      const branches = [parts.consequence, parts.alternative].filter((b): b is Node => b !== null);
+      for (const child of branches.length > 0 ? branches : node.namedChildren) {
+        if (!child) continue;
+        const taint = evaluate(child, scope, depth + 1);
+        if (taint) return addStep(taint, node, 'returned from one branch of a conditional');
+      }
+      return null;
+    }
+
+    if (CALL_NODES.has(node.type)) {
+      return evaluateCall(node, scope, depth);
+    }
+
+    return null;
+  };
+
+  const evaluateCall = (node: Node, scope: Scope, depth: number): Taint | null => {
+    const { text: calleeText, receiver } = calleeOf(node);
+    const name = lastSegment(calleeText);
+    const args = argumentsOf(node);
+
+    // Is the CALL ITSELF a source? e.g. searchParams.get('q'), input().
+    //
+    // Test the callee only, never the whole call. Testing the whole call text
+    // was a real bug: `parseInt(req.query.id)` contains "req.query", so the
+    // sanitiser was skipped and the SANITISED value was reported as a verified
+    // vulnerability. A source is about where a value comes FROM, not about what
+    // characters appear anywhere inside the expression.
+    if (exceptedSource(text(node))) return null;
+    /*
+     * ...AND NOT THE ARGUMENTS OF CALLS IN THE RECEIVER CHAIN EITHER. The callee
+     * of `crypto.createHash('sha256').update(req.query.text).digest('hex')` is
+     * everything before the last `(`, which contains `req.query` - so the digest
+     * call was treated as a SOURCE, and every sanitiser between the request and
+     * the end of the chain was skipped: `escape(req.query.q).trim()` was the
+     * raw request value. Calls in the chain are emptied before the test, so a
+     * source is matched by the names it is reached through, never by what is
+     * passed to something on the way.
+     */
+    const asSource = sourceTaint(node, `${withoutCallArguments(calleeText)}(`);
+    if (asSource) return asSource;
+
+    /*
+     * A READ FROM A LOCAL MAP WHOSE EVERY WRITE IS ON THE PAGE.
+     *
+     * The default answer to `map.get(k)` is the whole map's taint, labelled a
+     * guess about which element came out. When local-map.ts can show which put
+     * a read returns, the answer is that put's value instead - a literal is
+     * clean, and a variable is traced as itself, with no guess attached.
+     *
+     * A variable is only read at the `get` if nothing reassigns it between the
+     * put and the read - the map keeps the value it was given, and evaluating a
+     * reassigned name here would describe the new value, not the stored one -
+     * and if its declared type cannot change in place (declaredImmutable): a
+     * StringBuilder or an array in the map changes whenever an alias of it
+     * does. Anything else falls through to the whole-collection answer.
+     */
+    if (language === 'java' && name === 'get') {
+      const read = resolveContainerRead(node, language);
+      if (read) {
+        const line = read.write.startPosition.row + 1;
+        const where = `\`${read.container}.get(${read.selector.startsWith('index') ? read.selector.slice(6) : read.selector})\` returns what was stored at ${read.selector} on line ${line}`;
+        if (JAVA_LITERALS.has(read.value.type)) {
+          noteResolvedRead(node, scope.filePath, `${where}, a literal`);
+          return null;
+        }
+        const method = enclosingMethod(node);
+        if (
+          read.value.type === 'identifier' &&
+          method &&
+          declaredImmutable(method, read.value.text) &&
+          !writtenBetween(method, read.value.text, read.write.endIndex, node.startIndex)
+        ) {
+          noteResolvedRead(node, scope.filePath, `${where}, \`${read.value.text}\``);
+          const stored = evaluate(read.value, scope, depth + 1);
+          return stored
+            ? addStep(stored, node, `read back from \`${read.container}\` at ${read.selector} - the value stored there on line ${line}`)
+            : null;
+        }
+      }
+    }
+
+    /*
+     * A SANITISER PASSED AS A VALUE, NOT CALLED.
+     *
+     *     args_safe = map(conditional_escape, args)          django/utils/html.py
+     *
+     * That is Django's format_html - the function its own docstring calls the
+     * one you should use instead of str.format to build HTML - and this scanner
+     * reported it as flow-verified XSS. Eighth time this project has punished a
+     * fix, and the most prominent target yet.
+     *
+     * Everything needed was already present. `mark_safe` was a sink, correctly:
+     * mark_safe(user_input) really is dangerous. `conditional_escape` was in the
+     * sanitiser list. What nothing modelled is that the escaping happened
+     * through a HIGHER-ORDER call: the sanitiser was never written as
+     * `escape(x)` at a place the tracer watches, it was handed to map() as a
+     * value and applied out of sight.
+     *
+     * A sanitiser recognised only in the shape `escape(x)` stops working the
+     * moment somebody writes idiomatic Python - and both idioms sit on adjacent
+     * lines of that one Django function, map() then a dict comprehension.
+     *
+     * The cost of missing it compounds: the second Django finding was a CALLER
+     * of format_html. One unmodelled shape at the bottom of a framework
+     * propagates into every place that uses it.
+     */
+    if (HIGHER_ORDER_APPLIERS.has(name)) {
+      for (const arg of args) {
+        const applied = dictionary.sanitizers.find((san) =>
+          san.names.includes(lastSegment(text(arg))),
+        );
+        if (!applied) continue;
+        // The collection being mapped over is the OTHER argument.
+        for (const other of args) {
+          if (other === arg) continue;
+          const taint = evaluate(other, scope, depth + 1);
+          if (!taint) continue;
+          return {
+            steps: [
+              ...taint.steps,
+              step(
+                'sanitizer',
+                node,
+                `every element passed through \`${lastSegment(text(arg))}()\` by ` +
+                  `\`${name}()\` - ${applied.description}`,
+                applied.kinds,
+              ),
+            ],
+            sanitizedFor: new Set([...taint.sanitizedFor, ...applied.kinds]),
+            origin: taint.origin,
+            unknownHops: taint.unknownHops,
+            afterWash: washedNow(taint.afterWash, applied.kinds),
+          };
+        }
+      }
+    }
+
+    // A sanitiser: the value stays traceable, but is marked washed for the
+    // kinds this particular soap actually works on.
+    // An entry with maxArgs does not describe a call that passes more - md5's
+    // raw flag - so that call falls through to the unmodelled-function rule.
+    const sanitizer = dictionary.sanitizers.find(
+      (s) =>
+        s.names.includes(name) &&
+        (s.maxArgs === undefined || args.length <= s.maxArgs) &&
+        (s.argumentPattern === undefined || (args[0] !== undefined && s.argumentPattern.test(text(args[0])))),
+    );
+    if (sanitizer) {
+      /*
+       * A method with NO arguments answers a question about its own object:
+       * `param.length()`, `name.isEmpty()`. The dirt is on the receiver, and
+       * the answer is washed all the same. Only with no arguments - when there
+       * are some, they are what the entry describes, and the receiver is
+       * usually a helper object (`$conn->real_escape_string($x)`).
+       */
+      const inputs: (Node | null)[] = sanitizer.fromReceiver ? [receiver] : args.length > 0 ? args : [receiver];
+      for (const arg of inputs) {
+        const taint = evaluate(arg, scope, depth + 1);
+        if (!taint) continue;
+        const quoteDependent = sanitizer.onlyInsideQuotes ?? [];
+        const pending = [...new Set([...(taint.quotePending ?? []), ...quoteDependent])];
+        return {
+          steps: [
+            ...taint.steps,
+            {
+              ...step(
+                'sanitizer',
+                node,
+                `passed through \`${name}()\` - ${sanitizer.description}`,
+                sanitizer.kinds,
+              ),
+              ...(quoteDependent.length > 0 ? { quoteDependent: true, quoteKinds: quoteDependent } : {}),
+            },
+          ],
+          sanitizedFor: new Set([...taint.sanitizedFor, ...sanitizer.kinds]),
+          origin: taint.origin,
+          unknownHops: taint.unknownHops,
+          afterWash: washedNow(taint.afterWash, sanitizer.kinds),
+          quotePending: pending.length > 0 ? pending : undefined,
+        };
+      }
+      return null;
+    }
+
+    // A propagator: dirt survives. Check the receiver first (`dirty.trim()`),
+    // then the arguments (`String(dirty)`, `",".join(dirty)`).
+    if (dictionary.propagators.names.includes(name)) {
+      let taint = evaluate(receiver, scope, depth + 1);
+      // A propagator reached through the RECEIVER of a multi-element container
+      // is an element read - `map.get(k)`, `list.get(i)` - and `get` is in the
+      // propagator list, which is why the unmodelled-call path never sees it.
+      // Same rule, second doorway: reading one of several is a guess.
+      const fromContainer = taint?.collectedMany ?? false;
+      if (!taint) {
+        for (const arg of args) {
+          taint = evaluate(arg, scope, depth + 1);
+          if (taint) break;
+        }
+      }
+      if (!taint) return null;
+      const carried = addStep(taint, node, `passed through \`${name}()\``);
+      return fromContainer ? { ...carried, containerGuess: true } : carried;
+    }
+
+    /* A function we can actually read - in this file or, since cross-file
+     * resolution, in a file this one imports. Ask the descent whether it
+     * HANDLED the call, not merely whether it produced taint: the two are
+     * different answers, and conflating them was a real bug. The gate used to
+     * be `localFunctions.get(name)`, so a sanitiser living in another module
+     * was never consulted and its call fell through to the "unknown function"
+     * branch below, which preserves taint. Result: correctly-escaped code
+     * reported as a vulnerability.                                          */
+    const descended = descendIntoLocalCall(node, scope, depth);
+    if (descended.handled) return descended.taint;
+    const stoppedAt = descended.stopped;
+
+    /*
+     * A READ: the result is new data, not the argument - see FreshResultSpec.
+     * Checked only here, after the project's own functions have had their
+     * chance, so a project `fetch()` that returns its argument is followed.
+     * The trace ends, and the stop is put on the record when the input was
+     * dirty: a finding that would have existed must leave its reason behind.
+     */
+    const fresh = stoppedAt ? undefined : dictionary.freshResults?.find((f) => f.names.includes(name));
+    if (fresh) {
+      if (fresh.rowsFollowInjection) {
+        const sqlSink = dictionary.callSinks.find((s) => s.kind === 'sql' && s.methods.includes(name));
+        const watched =
+          sqlSink && sqlSink.argIndexes !== 'all'
+            ? sqlSink.argIndexes.map((i) => args[i]).filter((a): a is Node => a !== undefined)
+            : args;
+        for (const arg of watched) {
+          const taint = evaluate(arg, scope, depth + 1);
+          if (!taint || retracted(taint, arg, 'sql') !== null) continue;
+          return addStep(
+            taint,
+            node,
+            sqlSink
+              ? `the query text can be injected into (the SQL injection on this line), so the rows ` +
+                  `\`${name}()\` returns can be chosen by the attacker - for example with UNION SELECT`
+              : `read through \`${name}()\` from a result the attacker can choose the rows of`,
+          );
+        }
+      }
+      const input = [...args, receiver].some((n) => evaluate(n, scope, depth + 1) !== null);
+      if (input) noteFreshStop(node, scope.filePath, `\`${name}()\` is ${fresh.description}`);
+      return null;
+    }
+
+    /*
+     * A KEYED LOOKUP on a clean store. Juice Shop's
+     * `security.authenticatedUsers.get(req.cookies.token)` returns the user
+     * kept under that token, and four routes build a file path from that
+     * user's id: the cookie picks WHICH user, it writes nothing. A dirty
+     * receiver (`new URLSearchParams(dirty).get('x')`) still carries, and so
+     * does a language that lists `get` as a propagator (Java, Go).
+     */
+    if (name === 'get' && args.length === 1 && receiver && evaluate(receiver, scope, depth + 1) === null) {
+      if (evaluate(args[0] ?? null, scope, depth + 1) !== null) {
+        noteFreshStop(node, scope.filePath, '`get()` is a lookup - it returns what is stored under the key, not the key');
+      }
+      return null;
+    }
+
+    /* ---- A function we do not model. The hardest judgement call here. ----
+     *
+     * Two wrong answers were available:
+     *
+     *   Treat it as CLEAN. Safe-sounding, and it made the tool useless on real
+     *   Java: OWASP's own benchmark writes
+     *       param = URLDecoder.decode(request.getHeader("x"), "UTF-8");
+     *   and dropping the taint at `decode` produced ZERO verified flows across
+     *   2,766 files, every one of which is a known vulnerability.
+     *
+     *   Treat it as SANITISING. Never - assuming an unknown function fixes the
+     *   problem is how scanners miss real bugs.
+     *
+     * What we do instead: the value keeps its taint, and the hop is recorded as
+     * UNMODELLED. The path shows exactly where our knowledge ran out, and the
+     * finding's limitations names the function. If `decode` had been a custom
+     * sanitiser, the reader can see that in one glance and dismiss it.
+     *
+     * That is the honest version of a guess: make it, then show your work.  */
+    let carried: Taint | null = null;
+    for (const arg of args) {
+      carried = evaluate(arg, scope, depth + 1);
+      if (carried) break;
+    }
+    /*
+     * TAINT ARRIVING FROM THE RECEIVER, which is where Jenkins went wrong.
+     *
+     * No argument was dirty, so the only way this call can be dirty is if the
+     * OBJECT is. Usually that is right - `sb.toString()` on a dirtied
+     * StringBuilder is exactly the dirty string. But when the object was
+     * dirtied through a KEYED write, the taint is in a named compartment and
+     * this call may have nothing to do with it:
+     *
+     *     req.setAttribute("loginForm", dirty);
+     *     req.getContextPath()      // <- not the compartment. Not dirty.
+     *
+     * So a compartmented receiver only carries taint out through a reader of
+     * that compartment. Reading it back DOES carry, and clears the compartment,
+     * because the value is now in the caller's hands rather than filed away.
+     */
+    const fromReceiver = carried === null;
+    carried ??= evaluate(receiver, scope, depth + 1);
+    if (!carried) return null;
+    let compartment = carried.compartment;
+    if (fromReceiver && compartment) {
+      if (!compartment.includes(name)) return null;
+      compartment = undefined;
+    }
+    // A stop is already counted where it happened (depth / recursion).
+    if (!stoppedAt) seenUnmodelled.add(siteOf(node, scope.filePath));
+
+    // A known name called with an option its entry does not cover.
+    const overArgs = dictionary.sanitizers.find(
+      (s) => s.names.includes(name) && s.maxArgs !== undefined && args.length > s.maxArgs,
+    );
+    const hopText =
+      stoppedAt === 'depth'
+        ? `passed through \`${name}()\`, which we did NOT follow: the call chain reached ` +
+          `its depth limit here. We assume it preserves the value; if it actually ` +
+          `sanitises, this trace is wrong`
+        : stoppedAt === 'recursion'
+          ? `passed through \`${name}()\`, which resolves by name to a function already ` +
+            `being followed on this path - a recursive call, or a same-named method on ` +
+            `another object. We did NOT follow it again and assume it preserves the value; ` +
+            `if it actually sanitises, this trace is wrong`
+          : overArgs
+            ? `passed through \`${name}()\`, which is NOT in our dictionary in this form: it is ` +
+              `called with ${args.length} arguments and our entry covers at most ${overArgs.maxArgs}, ` +
+              `and an extra argument can change what comes back (md5's raw-binary flag does). ` +
+              `We assume it preserves the value; if it actually sanitises, this trace is wrong`
+            : `passed through \`${name}()\`, which is NOT in our dictionary - we assume it ` +
+              `preserves the value; if it actually sanitises, this trace is wrong`;
+
+    return {
+      steps: [...carried.steps, { ...step('propagation', node, hopText), unmodelled: name }],
+      sanitizedFor: carried.sanitizedFor,
+      origin: carried.origin,
+      unknownHops: [...carried.unknownHops, name],
+      quotePending: carried.quotePending,
+      compartment,
+      collectedMany: carried.collectedMany,
+      /*
+       * Carried, not rebuilt. This return used to list its fields by hand and
+       * left this one out, so a guessed hop ERASED the record that a branch had
+       * been assumed further back - and a path resting on two assumptions was
+       * published as a proof resting on one. Found when stripslashes() and
+       * new ProcessBuilder() became known functions: their paths went through
+       * addStep, kept the flag, and ten BenchmarkJava proofs that had never
+       * been entitled to the label lost it.
+       */
+      branchAssumed: carried.branchAssumed,
+      /*
+       * THE READ IS WHERE THE AMBIGUITY IS BORN, not the write.
+       *
+       * `argList.add(a); argList.add(b); pb.command(argList)` hands the whole
+       * list over - every element arrives, nothing is guessed, and the trace
+       * stays proven. `map.put(k1,clean); map.put(k2,dirty); map.get(k1)` pulls
+       * ONE element out of several and this engine does not model which. Same
+       * container, same write count; only the read tells them apart.
+       */
+      containerGuess: carried.containerGuess ?? (fromReceiver && carried.collectedMany ? true : undefined),
+      joined: carried.joined,
+      afterWash: trustedHop(carried.afterWash, name),
+    };
+  };
+
+  /* ---- sinks ---- */
+
+  const buildPath = (taint: Taint, sinkNode: Node, kind: SinkKind, description: string): FlowStep[] => {
+    // Convert sanitiser steps that do NOT cover this sink kind into ordinary
+    // propagation steps, with the mismatch spelled out. This is where the
+    // kind-scoping becomes visible to the user: "you escaped it for HTML, and
+    // then put it in a SQL query".
+    const steps: FlowStep[] = taint.steps.map((s) => {
+      if (s.kind !== 'sanitizer') return { kind: s.kind, location: s.location, description: s.description };
+      /*
+       * A SANITISER STEP FROM SOMEBODY ELSE'S VALUE.
+       *
+       * Scanning WordPress on the new page-buffer sink crashed the whole scan
+       * on the engine's own invariant: "path contains a sanitiser - that is a
+       * CLEAN flow, not a verified vulnerability." The invariant was right to
+       * fire and right to crash rather than publish. The path was wrong.
+       *
+       *     $html .= '<a href="' . esc_url($u) . '">' . $label . '</a>';
+       *
+       * Two tainted values merge here. `esc_url($u)` is escaped; `$label` is
+       * not. `sanitizedFor` correctly ends up WITHOUT xss - the finding is
+       * real, because $label is raw - but the merged step list still carried
+       * the esc_url sanitiser step from the other contributor. One narrative
+       * assembled out of two different values' histories.
+       *
+       * So a step only stays a SANITISER when the value actually reaching this
+       * sink was sanitised for this kind. Otherwise it is something that
+       * happened to a sibling expression, and the path says so instead of
+       * claiming a cleanliness the traced value never had.
+       */
+      const coversThisKind = s.sanitizesKinds?.includes(kind) ?? false;
+      if (coversThisKind && taint.sanitizedFor.has(kind)) {
+        return { kind: s.kind, location: s.location, description: s.description };
+      }
+      if (coversThisKind && s.quoteDependent) {
+        return {
+          kind: 'propagation',
+          location: s.location,
+          description: s.guard
+            ? `${s.description} - NOTE: this value is not inside quotes where it is used, and ` +
+              `outside quotes a word is still SQL - a column name or a keyword - so the check does not protect it`
+            : `${s.description} - NOTE: this value is not inside quotes where it is used, ` +
+              `so the escaping does not protect it`,
+        };
+      }
+      if (coversThisKind) {
+        return {
+          kind: 'propagation',
+          location: s.location,
+          description:
+            `${s.description} - NOTE: this covered a DIFFERENT value in the same ` +
+            `expression. The value followed here never went through it.`,
+        };
+      }
+      return {
+        kind: 'propagation',
+        location: s.location,
+        description:
+          `${s.description} - NOTE: this does not make a value safe for a ${kind} sink, ` +
+          `so the value is still dangerous here`,
+      };
+    });
+    steps.push({
+      kind: 'sink',
+      location: nodeLocation(sinkNode, toDisplay(currentPath)),
+      description,
+    });
+    return steps;
+  };
+
+  /**
+   * ONE RETRACTION, THREE PLACES THAT CAN REPORT.
+   *
+   * `checkTaintAtSink` says in its own comment that it was factored out "so a
+   * second kind of sink cannot get half of this right". It was, and then two
+   * more emission sites grew their own inline copies of the sanitised check -
+   * so when the validation guard was added to the one factored function, DVWA's
+   * `exec/impossible.php` carried on being reported through a path that had
+   * never heard of it.
+   *
+   * Every reason to NOT report belongs here, and `npm test` fails if a
+   * `results.push` appears in this file without a `retracted()` guarding it.
+   */
+  const retracted = (taint: Taint, _valueNode: Node, kind: SinkKind): 'sanitised' | null => {
+    /*
+     * WE ASSUMED A BRANCH. THAT IS NOT A PROOF.
+     *
+     * The value reached here only because a clean write was skipped for being
+     * conditional - see the note on branchAssumed. Reporting is right; calling
+     * it flow-verified is not, and the difference between those two sentences
+     * is this project's whole product. The signature rules still cover the
+     * line, so the caution survives and only the overclaim is dropped.
+     *
+     * This sits in the shared gate rather than in checkTaintAtSink, because the
+     * first attempt put it in checkTaintAtSink alone and Django carried on being
+     * reported: the finding came through one of the OTHER two emission sites.
+     * That is the fourth-time-lesson recorded on this function - every reason
+     * not to report belongs here, or it only half exists.
+     */
+    // Escaping whose protection depends on quotes, on a value whose place in
+    // the query was never seen, proves nothing either way - see quoteUnknown.
+    // That includes cleanliness established by the control flow: a value read
+    // inside `if (is_numeric($octet[0]) && ...)` arrives here already washed -
+    // see `guarded`, which replaced a text check that used to sit on this line.
+    if (taint.sanitizedFor.has(kind) && !taint.quotePending?.includes(kind)) return 'sanitised';
+    return null;
+  };
+
+  /*
+   * THE RECEIPT FOR A CLEARED LINE.
+   *
+   * The report's "Checked and cleared" section printed one sentence for every
+   * line the tracer cleared: "A sanitiser for this kind of problem was proven
+   * to run on the path into this line." It was printed for an allow-list
+   * check, which is not a sanitiser; for a hex digest; and for DVWA's ping
+   * output, which was cleared only because the ping's ADDRESS was checked and
+   * `shell_exec()` - a function this engine does not model - was assumed to
+   * hand back what it was given. A claim of safety with no stated ground is
+   * the same overclaim as a finding with no path, pointed the other way.
+   *
+   * The ground is on the path already: the last step that washed the value
+   * for THIS kind of sink. What can undo it is on the path too - a function
+   * we do not model that the value went through afterwards. Hops before the
+   * wash do not matter (the wash happened after them), so they are not
+   * listed; hops on another value joined in, whose order we cannot see, are
+   * listed, because over-disclosing an assumption costs a reader a glance and
+   * hiding one costs them the truth.
+   */
+  const cleanReason = (taint: Taint, kind: SinkKind): { reason: string; assumes: string[] } => {
+    const steps = taint.steps;
+    let at = -1;
+    for (let i = steps.length - 1; i >= 0; i--) {
+      const s = steps[i]!;
+      if (s.kind === 'sanitizer' && s.sanitizesKinds?.includes(kind)) {
+        at = i;
+        break;
+      }
+    }
+    const before = new Set(steps.slice(0, Math.max(at, 0)).map((s) => s.unmodelled).filter((n): n is string => !!n));
+    const after = steps.slice(at + 1).map((s) => s.unmodelled).filter((n): n is string => !!n);
+    const elsewhere = taint.unknownHops.filter((n) => !before.has(n) && !after.includes(n) && !steps.some((s) => s.unmodelled === n));
+    // Tracked precisely when every way this value was built kept count - see
+    // `afterWash`. Otherwise the cautious list: anything that MIGHT be after.
+    const tracked = taint.afterWash?.[kind];
+    const assumes = tracked ? [...tracked] : [...new Set([...after, ...elsewhere])];
+    if (at === -1) {
+      return { reason: 'the value was cleaned for this kind of sink on the way here, by a step this engine did not record', assumes };
+    }
+    const wash = steps[at]!;
+    const line = wash.location.startLine;
+    const where = wash.location.file === toDisplay(currentPath) ? `line ${line}` : `${wash.location.file}:${line}`;
+    let reason = wash.guard ? wash.description : `${wash.description} (${where})`;
+    if (wash.quoteKinds?.includes(kind)) reason += ' - and the value sits inside quotes where it is used, which is where that holds';
+    if (taint.joined) reason += ' - one of several values joined into this one, and every one of them was cleaned for this kind of sink';
+    return { reason, assumes };
+  };
+
+  const recordRetraction = (sinkNode: Node, kind: SinkKind, taint: Taint): void => {
+    const { reason, assumes } = cleanReason(taint, kind);
+    sanitized.push({
+      ruleId: SINK_KIND_RULE[kind],
+      sinkNode,
+      kind,
+      filePath: toDisplay(currentPath),
+      reason,
+      ...(assumes.length > 0 ? { assumes } : {}),
+    });
+  };
+
+  /**
+   * A tainted value has arrived somewhere dangerous. Decide which of the two
+   * outcomes it is - a finding, or a proof that this line is fine.
+   *
+   * Factored out of checkCallSink so a second kind of sink cannot get half of
+   * this right. Both branches matter equally: forgetting the sanitised branch
+   * would mean correctly-escaped code gets reported, and this project treats
+   * shouting at correct code as the worse failure of the two.
+   */
+  const checkTaintAtSink = (
+    taint: Taint,
+    valueNode: Node,
+    kind: SinkKind,
+    /** A NOUN PHRASE. The message reads "... reaches ${description}". */
+    description: string,
+    /** The sink step's own wording, which may say more than the headline. */
+    pathDescription = `reaches ${description}`,
+  ): void => {
+    const verdict = retracted(taint, valueNode, kind);
+    if (verdict) {
+      if (verdict === 'sanitised') recordRetraction(valueNode, kind, taint);
+      return;
+    }
+    results.push({
+      ruleId: SINK_KIND_RULE[kind],
+      kind,
+      node: valueNode,
+      sinkNode: valueNode,
+      path: buildPath(taint, valueNode, kind, pathDescription),
+      origin: taint.origin,
+      sinkDescription: description,
+      unknownHops: taint.unknownHops,
+      branchAssumed: taint.branchAssumed ?? false,
+      containerGuess: taint.containerGuess ?? false,
+      quoteUnknown: taint.quotePending?.includes(kind) ?? false,
+      fixedDestination: fixedDestinationOf(taint, kind),
+      localSource: kind === 'path' && taint.fromLocal ? true : undefined,
+      filePath: toDisplay(currentPath),
+    });
+  };
+
+  /**
+   * A tainted argument dirties the object it was handed to.
+   *
+   *     sb.append(param);      ->  `sb` is now tainted
+   *     argList.add(param);    ->  `argList` is now tainted
+   *
+   * The existing propagator model could not express this: it carries taint out
+   * through a RETURN VALUE, and these calls either discard theirs or hand back
+   * a boolean. `append` sat in the Java propagator list the whole time and
+   * caught nothing.
+   *
+   * HONEST ABOUT THE IMPRECISION THIS BUYS. The taint lands on the whole
+   * container, not on the element - so after
+   *
+   *     list.add(cleanValue);
+   *     list.add(dirtyValue);
+   *
+   * every read out of `list` is treated as dirty, including the clean one. That
+   * is the standard container-insensitive trade and it errs toward reporting.
+   * It is written into the flow path ("collected into ...") and into the
+   * capability block, because a new source of imprecision that nobody announced
+   * is exactly the kind of quiet overclaim this engine is built against.
+   */
+  /**
+   * THE OUTPUT-PARAMETER MUTATOR - C's version of the same idea, and the one
+   * shape without which C coverage would be nearly zero.
+   *
+   * checkMutation below binds taint to the RECEIVER, because in every language
+   * this engine supported until now the thing being filled sits to the left of
+   * the dot:
+   *
+   *     sb.append(dirty)        ->  `sb`
+   *
+   * C has no receiver. The destination is argument ZERO, and the value goes in
+   * after it:
+   *
+   *     sprintf(cmd, "ping %s", argv[1]);   ->  `cmd`
+   *     strcpy(buf, argv[1]);               ->  `buf`
+   *     strcat(path, getenv("X"));          ->  `path`
+   *
+   * That is not a corner case, it is THE C idiom - the two-line build-then-run
+   * pattern that every command injection in the language is written in. With
+   * only the receiver rule, `sprintf(cmd, ...)` would taint nothing, `cmd`
+   * would read as clean, and `system(cmd)` on the next line would be silent.
+   * Every fixture in vulnerable/cmdi.c is this shape.
+   *
+   * Argument zero is excluded from the tainted-value scan for the same reason
+   * `writerArgPattern` excludes it on the sink side: it is where the output
+   * goes, not what is written.
+   */
+  const checkOutParamMutation = (node: Node, scope: Scope): void => {
+    const method = lastSegment(calleeOf(node).text);
+
+    /*
+     * READER FUNCTIONS: the call IS the source, and the bytes land in an
+     * argument rather than in the return value.
+     *
+     *     fgets(line, sizeof(line), stdin);
+     *     system(line);
+     *
+     * Nothing here is an expression the source patterns could match - fgets
+     * returns a pointer nobody keeps, and `line` was declared clean on the
+     * line above. Without this the two statements are unrelated and reading a
+     * command from standard input is invisible, which is the oldest shape of
+     * this bug there is.
+     */
+    for (const reader of dictionary.outParamSources ?? []) {
+      if (!reader.names.includes(method)) continue;
+      const destination = argumentsOf(node)[reader.destination];
+      if (!destination) continue;
+      const name = lastSegment(text(destination));
+      if (!name || !/^[A-Za-z_][\w]*$/.test(name)) continue;
+      seenSources.add(siteOf(node, currentPath));
+      scope.env.set(name, {
+        steps: [
+          step('source', node, `\`${name}\` is filled by \`${method}()\` from ${reader.description}`),
+        ],
+        sanitizedFor: new Set(),
+        origin: `${method}()`,
+        unknownHops: [],
+      });
+      return;
+    }
+
+    const outParams = dictionary.outParamMutators;
+    if (!outParams || outParams.length === 0) return;
+    if (!outParams.includes(method)) return;
+
+    const args = argumentsOf(node);
+    const destination = args[0];
+    if (!destination) return;
+
+    // Only something we can name. `sprintf(ptr->buf, ...)` gives us no single
+    // variable to bind, so it is left alone rather than guessed at.
+    const destinationName = lastSegment(text(destination));
+    if (!destinationName || !/^[A-Za-z_][\w]*$/.test(destinationName)) return;
+
+    for (const arg of args.slice(1)) {
+      const taint = evaluate(arg, scope);
+      if (!taint) continue;
+      scope.env.set(
+        destinationName,
+        addStep(taint, node, `written into \`${destinationName}\` by \`${method}()\``),
+      );
+      return;
+    }
+  };
+
+  /**
+   * HOW MANY THINGS WENT INTO THE BOX?
+   *
+   * Counts element writes to `receiverName` inside the function the write sits
+   * in. One means the value later read out is the value written, and the trace
+   * is sound. More than one means a read picks one of several and this engine
+   * does not model which - so the finding keeps travelling but loses its claim
+   * to proof.
+   *
+   * DELIBERATELY TEXTUAL, and the limitation is real: it counts writes that
+   * appear anywhere in the enclosing function, including ones AFTER the read.
+   * That over-counts, which costs confidence rather than findings - the error
+   * lands on the side of claiming less. A precise version would need ordering
+   * and reachability, which is the modelling this file has repeatedly decided
+   * not to guess at.
+   */
+  const countElementWrites = (node: Node, receiverName: string): number => {
+    const names = dictionary.elementMutators;
+    if (!names || names.length === 0) return 0;
+    let scopeNode: Node | null = node;
+    while (scopeNode && !functionTypes.has(scopeNode.type)) scopeNode = scopeNode.parent;
+    const escaped = receiverName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const pattern = new RegExp(`\\b${escaped}\\s*\\.\\s*(?:${names.join('|')})\\s*\\(`, 'g');
+    return (text(scopeNode ?? node).match(pattern) ?? []).length;
+  };
+
+  /**
+   * How many elements `name` can hold in the function around `node`: element
+   * writes `name[...] = v`, plus the entries of any container literal bound
+   * to it. Textual, like countElementWrites, and wrong the same safe way: a
+   * write after the read still counts, which costs a proof, never a finding.
+   */
+  const elementCount = (node: Node, name: string): number => {
+    let scopeNode: Node | null = node;
+    while (scopeNode && !functionTypes.has(scopeNode.type)) scopeNode = scopeNode.parent;
+    let count = 0;
+    const visit = (n: Node): void => {
+      if (ASSIGNMENT_NODES.has(n.type)) {
+        const parts = assignmentParts(n);
+        if (parts && stripDeclarator(text(parts.target)) === name) {
+          if (ELEMENT_TARGETS.has(parts.target.type)) count++;
+          else if (CONTAINER_LITERALS.has(parts.value.type)) count += parts.value.namedChildCount;
+        }
+      }
+      for (const c of n.namedChildren) if (c) visit(c);
+    };
+    visit(scopeNode ?? node);
+    return count;
+  };
+
+  const checkMutation = (node: Node, scope: Scope): void => {
+    const mutators = dictionary.mutators;
+    if (!mutators || mutators.length === 0) return;
+
+    const callee = calleeOf(node);
+    const method = lastSegment(callee.text);
+    if (!mutators.includes(method)) return;
+
+    // We can only dirty something we can NAME. `a.b().c(dirty)` gives us no
+    // variable to bind, so it is left alone rather than guessed at.
+    const receiverName = lastSegment(text(callee.receiver));
+    if (!receiverName || !/^[A-Za-z_$][\w$]*$/.test(receiverName)) return;
+
+    // A keyed write files the value in a NAMED COMPARTMENT of an object that is
+    // primarily something else. The object is dirty for reads of that store and
+    // clean for everything else it does. See safe/keyed-container.java.
+    const keyed = dictionary.keyedMutators?.includes(method) ?? false;
+    const readers = dictionary.keyedReaders;
+
+    // An element write into a collection that took several elements makes any
+    // later read of it a guess about WHICH element. The taint is unchanged; only
+    // the confidence label is. Accumulators are not in `elementMutators`, so
+    // sb.append() keeps its proof however many times it runs.
+    const manyElements =
+      (dictionary.elementMutators?.includes(method) ?? false) &&
+      countElementWrites(node, receiverName) > 1;
+
+    for (const arg of argumentsOf(node)) {
+      const taint = evaluate(arg, scope);
+      if (!taint) continue;
+      const stored = addStep(
+        taint,
+        node,
+        keyed
+          ? `filed into \`${receiverName}\` under a key via \`${method}()\` - reads of that ` +
+            `store are tainted, other methods on \`${receiverName}\` are not`
+          : `collected into \`${receiverName}\` via \`${method}()\``,
+      );
+      const marked = manyElements ? { ...stored, collectedMany: true } : stored;
+      scope.env.set(
+        receiverName,
+        keyed && readers ? { ...marked, compartment: readers } : marked,
+      );
+      return;
+    }
+  };
+
+  /**
+   * The dangerous call took no arguments - the payload is already inside the
+   * object. `pb.command(list); pb.start();` is the canonical shape.
+   */
+  const checkReceiverSink = (node: Node, scope: Scope): void => {
+    const sinks = dictionary.receiverSinks;
+    if (!sinks || sinks.length === 0) return;
+    const callee = calleeOf(node);
+    const method = lastSegment(callee.text);
+    for (const sink of sinks) {
+      if (!sink.methods.includes(method)) continue;
+      if (!callee.receiver) continue;
+      // `new ProcessBuilder(argList).start()` already fired as an ARGUMENT
+      // sink on the constructor. Firing again on the receiver reports one bug
+      // twice at one line. This shape only adds something when the payload was
+      // loaded on an earlier line, which means the receiver is a plain name.
+      if (CALL_NODES.has(callee.receiver.type)) continue;
+      const taint = evaluate(callee.receiver, scope);
+      if (!taint) continue;
+      checkTaintAtSink(
+        taint,
+        node,
+        sink.kind,
+        sink.description,
+        `reaches ${sink.description} via \`${method}()\` - the value was loaded into ` +
+          `\`${lastSegment(text(callee.receiver))}\` on an earlier line, so this call carries no arguments`,
+      );
+      return;
+    }
+  };
+
+  const checkCallSink = (node: Node, scope: Scope): void => {
+    const callee = calleeOf(node);
+    const name = lastSegment(callee.text);
+    const wholeCall = text(node);
+    const args = argumentsOf(node);
+
+    for (const sink of dictionary.callSinks) {
+      // The name as written, or the sink it was locally aliased to.
+      const aliasedTo = fileAliases.get(name);
+      const effective = sink.methods.includes(name) ? name : aliasedTo;
+      if (!effective || !sink.methods.includes(effective)) continue;
+      if (sink.bareOnly && callee.receiver) {
+        const owner = ownerName(text(callee.receiver));
+        if (!(sink.allowedReceivers ?? []).includes(owner)) continue;
+      }
+      if (sink.requiredReceivers && sink.requiredReceivers.length > 0) {
+        const receiver = callee.receiver ? text(callee.receiver) : '';
+        const last = ownerName(receiver) || receiver;
+        if (!sink.requiredReceivers.some((name) => last === name)) continue;
+      }
+      if (sink.receiverPattern) {
+        const receiver = callee.receiver ? text(callee.receiver) : '';
+        // The variable's NAME, or the type it was declared with. `r.exec(cmd)`
+        // says nothing; `Runtime r = ...` two lines up says everything.
+        const declared = fileTypes.get(receiver) ?? fileTypes.get(lastSegment(receiver)) ?? '';
+        if (!sink.receiverPattern.test(receiver) && !sink.receiverPattern.test(declared)) continue;
+      }
+      if (sink.requiresShellOption && !sink.requiresShellOption.test(wholeCall)) continue;
+      // The safe form of a deserialiser is the same call with a restriction
+      // added. Seeing that restriction means this is the FIX, not the bug.
+      if (sink.unlessOption && sink.unlessOption.test(wholeCall)) continue;
+
+      // `append`/`write`/`print` on a StringBuilder is string assembly, not a
+      // write to the page. Only the ones we KNOW are builders are excluded, so
+      // an unknown receiver is still treated as a possible writer.
+      if (sink.kind === 'xss' && scope.builders.has(lastSegment(text(callee.receiver)))) continue;
+
+      // Executing a PREPARED statement: the arguments are bound parameters, not
+      // the instruction. Recorded as a clean flow so the signature-based guess
+      // at this line is withdrawn too - correct code should end up silent.
+      if (sink.kind === 'sql' && scope.prepared.has(lastSegment(text(callee.receiver)))) {
+        sanitized.push({
+          ruleId: SINK_KIND_RULE[sink.kind],
+          sinkNode: node,
+          kind: sink.kind,
+          filePath: toDisplay(currentPath),
+          reason:
+            `\`${lastSegment(text(callee.receiver))}\` is a prepared statement, so what is passed here is bound ` +
+            `as a parameter - data, never part of the query text`,
+        });
+        continue;
+      }
+
+      const indexes =
+        sink.argIndexes === 'all' ? args.map((_, index) => index) : sink.argIndexes;
+
+      /*
+       * Sinks whose destination is ARGUMENT ZERO, not the receiver.
+       * `fmt.Fprintf(w, ...)` - see writerArgPattern in types.ts.
+       */
+      if (sink.writerArgPattern) {
+        const writer = args[0] ? text(args[0]) : '';
+        const declared = fileTypes.get(writer) ?? fileTypes.get(lastSegment(writer)) ?? '';
+        if (!sink.writerArgPattern.test(writer) && !sink.writerArgPattern.test(declared)) continue;
+      }
+
+      for (const index of indexes) {
+        // Argument zero is the destination, not the payload.
+        if (sink.writerArgPattern && index === 0) continue;
+        const arg = args[index];
+        if (!arg) continue;
+
+        // Ambiguous method names need the content to agree - but ONLY when we
+        // can actually see the content. `db.query(sql)` shows us nothing: the
+        // query text was built on an earlier line. There we trust the sink name
+        // plus the traced flow instead. Demanding visible SQL in that case was
+        // a real bug - it silently discarded the most common verified flow of
+        // all, the one that goes through a variable.
+        if (sink.contentCheck) {
+          const built = analyzeStringExpression(arg, language);
+          if (built.literalText.length > 0) {
+            const looksRight =
+              sink.contentCheck === 'sql'
+                ? looksLikeSql(built.literalText)
+                : looksLikeHtml(built.literalText);
+            if (!looksRight) continue;
+          }
+        }
+
+        const taint = evaluate(arg, scope);
+        if (!taint) continue;
+
+        // Properly washed for THIS kind of sink. Not a finding - and worth
+        // recording, because it lets the scan RETRACT the signature-based
+        // guess at this line instead of nagging about code that is provably
+        // correct. Confirmed-clean is a result too.
+        const verdict = retracted(taint, arg, sink.kind);
+        if (verdict) {
+          if (verdict === 'sanitised') recordRetraction(node, sink.kind, taint);
+          continue;
+        }
+        // PHP's file_get_contents("http://" . $host) is a request, never a
+        // file on disk: `../` there climbs a URL. It is the SSRF sink's line.
+        if (sink.kind === 'path' && /^(https?|ftps?):\/\//i.test(taint.urlPrefix ?? '')) continue;
+        // ponytail: a bare `..` upload name still names the parent folder itself;
+        // it cannot reach a file in it. Track literal slashes joined in if that matters.
+        if (sink.kind === 'path' && taint.fileNameOnly) continue;
+
+        results.push({
+          ruleId: SINK_KIND_RULE[sink.kind],
+          kind: sink.kind,
+          node: arg,
+          sinkNode: node,
+          path: buildPath(taint, node, sink.kind, `reaches ${sink.description} via \`${callee.text}()\``),
+          origin: taint.origin,
+          sinkDescription: sink.description,
+          unknownHops: taint.unknownHops,
+          branchAssumed: taint.branchAssumed ?? false,
+          containerGuess: taint.containerGuess ?? false,
+          quoteUnknown: taint.quotePending?.includes(sink.kind) ?? false,
+          fixedDestination: fixedDestinationOf(taint, sink.kind),
+          localSource: sink.kind === 'path' && taint.fromLocal ? true : undefined,
+          filePath: toDisplay(currentPath),
+        });
+      }
+    }
+  };
+
+  const checkAssignSink = (assignNode: Node, target: Node, value: Node, taint: Taint): void => {
+    // The sigil goes the same way it does for receivers: PHP writes $html and
+    // the sink list holds html. See ownerName() for the receiver-side twin.
+    const name = lastSegment(text(target)).replace(/^["']|["']$/g, '').replace(/^[$*&]+/, '');
+    for (const sink of dictionary.assignSinks) {
+      if (!sink.properties.includes(name)) continue;
+      // A name-based sink has to see the shape it claims to parse. See the
+      // note on contentCheck in types.ts - `$sql .= $where` is not a page.
+      if (sink.contentCheck === 'html' && !looksLikeHtml(text(value))) continue;
+      if (sink.contentCheck === 'sql' && !looksLikeSql(text(value))) continue;
+      const verdict = retracted(taint, value, sink.kind);
+      if (verdict) {
+        if (verdict === 'sanitised') recordRetraction(assignNode, sink.kind, taint);
+        continue;
+      }
+      results.push({
+        ruleId: SINK_KIND_RULE[sink.kind],
+        kind: sink.kind,
+        node: value,
+        sinkNode: assignNode,
+        path: buildPath(taint, assignNode, sink.kind, `assigned to \`${text(target)}\` - ${sink.description}`),
+        origin: taint.origin,
+        sinkDescription: sink.description,
+        unknownHops: taint.unknownHops,
+        branchAssumed: taint.branchAssumed ?? false,
+        containerGuess: taint.containerGuess ?? false,
+        quoteUnknown: taint.quotePending?.includes(sink.kind) ?? false,
+        fixedDestination: fixedDestinationOf(taint, sink.kind),
+        localSource: sink.kind === 'path' && taint.fromLocal ? true : undefined,
+        filePath: toDisplay(currentPath),
+      });
+    }
+  };
+
+  /* ---- the statement walk ---- */
+
+  /** Does this node sit inside a branch or loop body within the current scope? */
+  /**
+   * A NULL DEFAULT IS NOT A SANITISER.
+   *
+   *     String param = request.getParameter("q");   // tainted
+   *     if (param == null) param = "";              // clean write, conditional
+   *
+   * `underCondition` sees a clean write it cannot prove happens and marks the
+   * taint `branchAssumed`, which costs the finding its proof. But the two cases
+   * here are DISJOINT: the write fires only when the value is null, and the
+   * taint exists only when it is not. Nothing was assumed - the tainted path is
+   * the only path there is. And in the case the guard does fire, what reaches
+   * the sink is a constant carrying no payload.
+   *
+   * THE OPERATOR IS THE WHOLE RULE. `if (x != null) x = "safe"` puts the clean
+   * write exactly on the tainted value and really might clean it; that one must
+   * stay a guess. So this matches equality-against-null only, on the same name
+   * being written, and demands that EVERY enclosing conditional qualify - one
+   * ordinary `if` in the chain and we know nothing again.
+   *
+   * Measured before building: 171 of BenchmarkJava's 320 found-but-unproven
+   * real vulnerabilities are downgraded for an unevaluated branch, and this
+   * idiom is the largest single shape among them. It is also ordinary Java
+   * rather than a benchmark artefact, which is why it was worth doing first.
+   */
+  const NULL_LITERALS = 'null|NULL|None|nil|undefined';
+  const guardCannotCleanTarget = (node: Node, body: Node, targetName: string): boolean => {
+    const name = targetName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const test = new RegExp(
+      `^\\(?\\s*(?:${name}\\s*={2,3}\\s*(?:${NULL_LITERALS})` +
+        `|(?:${NULL_LITERALS})\\s*={2,3}\\s*${name}` +
+        `|${name}\\s+is\\s+None)\\s*\\)?$`,
+    );
+    let current: Node | null = node.parent;
+    let seen = 0;
+    while (current && current !== body) {
+      if (CONDITIONAL_NODES.has(current.type)) {
+        // An `else` branch of a null test is the NON-null path - the opposite
+        // case - so it never qualifies.
+        if (current.type !== 'if_statement') return false;
+        const condition = current.childForFieldName('condition');
+        if (!condition) return false;
+        if (!test.test(text(condition).trim())) return false;
+        seen++;
+      }
+      current = current.parent;
+    }
+    return seen > 0;
+  };
+
+  /*
+   * THE CLEAN WRITE AND THE DIRTY ONE ARE IN DIFFERENT ARMS OF ONE IF/ELSE.
+   *
+   *     if (values != null && values.length > 0) param = values[0];
+   *     else param = "";
+   *     ... param ...
+   *
+   * At most one arm runs, so the clean write never lands on top of the dirty
+   * one: after the if/else, on every run that took the first arm, `param` is
+   * the request value. Nothing is assumed there - the path is as proven as any
+   * other path through an `if` this engine does not evaluate. The opposite
+   * order (clean first, dirty in the else) never set the flag at all - see
+   * BranchAndContainer.java - so one decision was labelled two ways depending
+   * on which arm was written first.
+   *
+   * INSIDE the clean arm it is the other way round: after `param = ""` the
+   * value IS clean, and a sink there must not be proven (branch-assumed.py,
+   * from Django). So the flag is set as before, and taken off again only when
+   * the walk leaves the if/else - settleArms - and only if nothing has written
+   * the name since.
+   *
+   * Returns that if/else, or null. The dirty write is found by the last step
+   * of the kept taint, which is where it was stored. Every `if` around the
+   * clean write is tried, so an `else if` chain is covered: the clean write
+   * sits in one arm of the outer `if` even when nested in an inner one.
+   */
+  /** Per branch: what a name should hold once the walk leaves it, if nothing wrote it since. */
+  const armSettles = new Map<string, Array<{ target: string; inside: Taint; after: Taint }>>();
+  /** Kinds a value is washed for, counting escaping still waiting on its quotes as not washed. */
+  const washedKinds = (t: Taint): SinkKind[] =>
+    [...t.sanitizedFor].filter((k) => !(t.quotePending ?? []).includes(k));
+  const settleArms = (node: Node, scope: Scope): void => {
+    const key = spanKey(scope.filePath, node);
+    const pending = armSettles.get(key);
+    if (!pending) return;
+    armSettles.delete(key);
+    // Newest first: a second clean arm re-flags the first one's flagged value,
+    // and unwinding in reverse lands on the original. A name written again
+    // since is left alone. That is the cautious side, kept on purpose: every
+    // case worked through gives the same or a more guarded answer with it, so
+    // no fixture can tell it apart - it is the one check here no test pins.
+    // An assumption it keeps costs a proof; an assumption it lifted wrongly
+    // would publish one.
+    for (const { target, inside, after } of [...pending].reverse()) {
+      if (scope.env.get(target) === inside) scope.env.set(target, after);
+    }
+  };
+  /*
+   * The branch that can skip a write on a run where the dirty write it lands
+   * on happened: the first branch or loop around the write that does not also
+   * hold the dirty write - an `if` it sits in alone, the other arm of an
+   * if/else, a loop that may run no times. Null when there is none.
+   *
+   *     if (isset($_GET['q'])) {
+   *         $q = $_GET['q'];
+   *         $q = htmlspecialchars($q);    // same block: runs whenever the line above did
+   *         echo $q;
+   *     }
+   *
+   * That escape is certain, and the last write may win. Without this test the
+   * washed-write rule flagged it and took away a correct "cleared". A dirty
+   * write it cannot place - another file - counts as skippable by the
+   * outermost branch around the write.
+   */
+  const skippedBy = (write: Node, kept: Taint, body: Node, filePath: string): Node | null => {
+    const stored = kept.steps[kept.steps.length - 1]?.location;
+    const at = stored && stored.file === toDisplay(filePath)
+      ? { row: stored.startLine - 1, column: stored.startColumn - 1 }
+      : null;
+    let child: Node = write;
+    let current: Node | null = write.parent;
+    let outermost: Node | null = null;
+    while (current && current !== body) {
+      if (CONDITIONAL_NODES.has(current.type)) {
+        // The first branch around the write that the dirty write is not in.
+        if (at && !holds(child, at)) return current;
+        outermost = current;
+      }
+      child = current;
+      current = current.parent;
+    }
+    // A dirty write in another file: skippable by every branch around this one.
+    return at ? null : outermost;
+  };
+  /** Whether a 0-based position lies inside a node. */
+  const holds = (n: Node, at: { row: number; column: number }): boolean => {
+    const s = n.startPosition;
+    const e = n.endPosition;
+    const afterStart = at.row > s.row || (at.row === s.row && at.column >= s.column);
+    const beforeEnd = at.row < e.row || (at.row === e.row && at.column < e.column);
+    return afterStart && beforeEnd;
+  };
+  const inOtherArm = (clean: Node, kept: Taint, body: Node, filePath: string): Node | null => {
+    const stored = kept.steps[kept.steps.length - 1]?.location;
+    if (!stored || stored.file !== toDisplay(filePath)) return null;
+    const at = { row: stored.startLine - 1, column: stored.startColumn - 1 };
+    const contains = (n: Node): boolean => {
+      const s = n.startPosition;
+      const e = n.endPosition;
+      const afterStart = at.row > s.row || (at.row === s.row && at.column >= s.column);
+      const beforeEnd = at.row < e.row || (at.row === e.row && at.column < e.column);
+      return afterStart && beforeEnd;
+    };
+    let child: Node = clean;
+    let current: Node | null = clean.parent;
+    while (current && current !== body) {
+      if (current.type === 'if_statement' && contains(current)) {
+        const condition = current.childForFieldName('condition');
+        const sameAsChild = (n: Node): boolean => n.startIndex === child.startIndex && n.endIndex === child.endIndex;
+        const inCondition = condition !== null && sameAsChild(condition);
+        if (!inCondition) {
+          for (const arm of current.namedChildren) {
+            if (!arm || sameAsChild(arm)) continue;
+            if (condition && arm.startIndex === condition.startIndex && arm.endIndex === condition.endIndex) continue;
+            if (contains(arm)) return current;
+          }
+        }
+      }
+      child = current;
+      current = current.parent;
+    }
+    return null;
+  };
+
+  // The constant folder lives in fold.ts now, shared with the signature rules.
+  const { conditionTruth, ternaryParts, deadBranchOf, switchDecision } = createFolder(language);
+
+  /*
+   * A switch is decided once per site, not once per statement inside it. Keyed
+   * by file and span: the tracer walks into other files' functions, and a span
+   * alone means nothing across files.
+   */
+  const switchDecisions = new Map<string, SwitchDecision | null>();
+  const decideSwitch = (node: Node, body: Node, filePath: string): SwitchDecision | null => {
+    const key = `${filePath}\0${node.startIndex}:${node.endIndex}`;
+    if (!switchDecisions.has(key)) switchDecisions.set(key, switchDecision(node, body));
+    return switchDecisions.get(key) ?? null;
+  };
+  /** Case groups of decided switches that cannot run. The walk never enters them. */
+  const deadCases = new Set<string>();
+  const spanKey = (filePath: string, node: Node): string => `${filePath}\0${node.startIndex}:${node.endIndex}`;
+
+  /*
+   * The switch a switch-internal conditional node belongs to, within two levels.
+   * Only a PART of a switch qualifies: an `if` inside a Go case is two levels
+   * below the switch too, and mistaking it for the switch would treat the body
+   * of that `if` as certain.
+   */
+  const SWITCH_PARTS = new Set([
+    'switch_block', 'switch_body', 'case_statement', 'default_statement',
+    'switch_case', 'switch_default', 'expression_case', 'default_case',
+  ]);
+  const owningSwitch = (current: Node): Node | null => {
+    if (SWITCH_NODES.has(current.type)) return current;
+    if (!SWITCH_PARTS.has(current.type)) return null;
+    const up = current.parent;
+    if (up && SWITCH_NODES.has(up.type)) return up;
+    const upper = up?.parent ?? null;
+    return upper && SWITCH_NODES.has(upper.type) ? upper : null;
+  };
+
+  const underCondition = (node: Node, body: Node, filePath: string): boolean => {
+    let current: Node | null = node.parent;
+    while (current && current !== body) {
+      if (CONDITIONAL_NODES.has(current.type)) {
+        /*
+         * A case of a decided switch that runs EVERY time the switch does is no
+         * more conditional than the if-true below - see switchDecision in
+         * fold.ts for what "every time" has to survive.
+         */
+        const sw = owningSwitch(current);
+        if (sw) {
+          const decision = decideSwitch(sw, body, filePath);
+          if (decision?.certain(node)) {
+            current = sw.parent;
+            continue;
+          }
+          return true;
+        }
+        /*
+         * An `if` whose condition is decidably TRUE is not a condition at all -
+         * the block runs every time. Without this the folder would silence the
+         * dead arm and still refuse to call the live arm proven, which would be
+         * a strange half-answer: certain enough to drop one side, not certain
+         * enough to trust the other.
+         */
+        if (current.type === 'if_statement' && conditionTruth(current.childForFieldName('condition'), body) === true) {
+          current = current.parent;
+          continue;
+        }
+        return true;
+      }
+      current = current.parent;
+    }
+    return false;
+  };
+
+  // assignmentParts and ASSIGNMENT_NODES live in fold.ts, which needs them too.
+
+  /** PHP statements that write their argument straight to the response body. */
+  const ECHO_NODES = new Set(['echo_statement', 'print_intrinsic']);
+
+  /**
+   * How deep the statement walk will recurse into a syntax tree.
+   *
+   * `0 + 1 + 2 + ... + 1499` parses as a binary_expression nested 1,499 deep,
+   * and each level is one stack frame here. Node's default stack takes roughly
+   * a thousand of these frames before it gives up and kills the process, which
+   * means one file in TypeScript's own test suite could destroy a 25,809-file
+   * scan and return NOTHING - no findings, no report, no partial result.
+   *
+   * 400 is comfortably under the limit and far past any hand-written code.
+   * Anything deeper is generated, minified or a stress test, and the honest
+   * response is to stop and count it rather than to crash or to pretend the
+   * file was fully examined.
+   */
+  const MAX_AST_DEPTH = 400;
+
+  const walk = (node: Node, scope: Scope, depth = 0): void => {
+    if (depth > MAX_AST_DEPTH) {
+      seenDeepAst.add(siteOf(node, scope.filePath));
+      return;
+    }
+    /*
+     * A case that cannot run is not walked, exactly like the dead arm of an if
+     * below: a write in it never happened, so it is never recorded - neither a
+     * tainted write that would invent a flow, nor a clean one that would cost a
+     * real flow its proof. SwitchOnConstant.java.
+     */
+    if (deadCases.size > 0 && deadCases.has(spanKey(scope.filePath, node))) return;
+    if (SWITCH_NODES.has(node.type)) {
+      const decision = decideSwitch(node, scope.body, scope.filePath);
+      for (const dead of decision?.dead ?? []) {
+        deadCases.add(spanKey(scope.filePath, dead));
+        noteUnreachable(dead, scope.filePath, decision?.note ?? 'the switch is decided at compile time');
+      }
+    }
+    /*
+     * Do not walk into a branch that cannot run.
+     *
+     * The ternary case above decides which VALUE comes out of an expression.
+     * This decides which STATEMENTS happen at all, which is what the `if/else`
+     * form of the same decoy needs - a write inside the dead arm should never
+     * be recorded, rather than recorded and then reasoned about.
+     *
+     * Nothing is skipped unless the condition folded to a definite answer, so
+     * an undecidable `if` still has both arms walked exactly as before.
+     */
+    if (node.type === 'if_statement') {
+      const dead = deadBranchOf(node, scope.body);
+      if (dead) {
+        const truth = conditionTruth(node.childForFieldName('condition'), scope.body);
+        noteUnreachable(
+          dead,
+          scope.filePath,
+          `the condition on line ${node.startPosition.row + 1} is always ${truth ? 'true' : 'false'}`,
+        );
+        /*
+         * Compared by source span, not by identity. The tree-sitter binding
+         * hands back a fresh wrapper object each time a child is asked for, so
+         * `child !== dead` was true even for the very node we meant to skip -
+         * the branch folded correctly and then got walked anyway.
+         */
+        for (const child of node.namedChildren) {
+          if (!child) continue;
+          if (child.startIndex === dead.startIndex && child.endIndex === dead.endIndex) continue;
+          walk(child, scope, depth + 1);
+        }
+        return;
+      }
+    }
+    // A nested function is a separate notebook. Queue it, don't descend.
+    if (node !== scope.body && functionTypes.has(node.type)) {
+      const body = node.childForFieldName('body') ?? node;
+      const env = new Map(scope.env);
+      /*
+       * PARAMETERS THAT ARE ALREADY ATTACKER-CONTROLLED WHEN THE BODY STARTS.
+       *
+       * Every other source is an expression the body evaluates. A framework
+       * binding is not: Spring reads the query string, converts it, and hands
+       * the method a plain String. By the time the body runs there is nothing
+       * left to match - the only evidence is the annotation on the declaration,
+       * which is why this has to happen HERE, as the scope is created, rather
+       * than in sourceTaint().
+       *
+       * Zero flow-verified findings on OWASP WebGoat is what this cost. See the
+       * long note on parameterSources in dictionaries.ts.
+       */
+      for (const source of dictionary.parameterSources ?? []) {
+        for (const parameter of parameterDeclarations(node)) {
+          if (!parameter.name || !source.pattern.test(parameter.text)) continue;
+          seenSources.add(siteOf(parameter.node, scope.filePath));
+          env.set(parameter.name, {
+            steps: [
+              step('source', parameter.node, `\`${parameter.name}\` is ${source.description}`),
+            ],
+            sanitizedFor: new Set(),
+            origin: parameter.name,
+            unknownHops: [],
+          });
+        }
+      }
+      for (const parameter of parameterDeclarations(node)) {
+        const route = routePathFor(node, parameter.name);
+        if (!route) continue;
+        seenSources.add(siteOf(parameter.node, scope.filePath));
+        env.set(parameter.name, {
+          steps: [
+            step('source', parameter.node, `\`${parameter.name}\` is bound from the URL path ${route}`),
+          ],
+          sanitizedFor: new Set(),
+          origin: parameter.name,
+          unknownHops: [],
+        });
+      }
+      queue.push({
+        body,
+        env,
+        filePath: scope.filePath,
+        prepared: new Set(scope.prepared),
+        builders: new Set(scope.builders),
+      });
+      return;
+    }
+
+    /*
+     * PHP `echo $x;` and `print $x;`.
+     *
+     * These are statements, not assignments and not calls, so neither of the
+     * two shapes below sees them - and `echo` is the single most common way a
+     * PHP page writes attacker data into a page. The value it prints is the
+     * same question an assign-sink asks, so it is routed there, with the `echo`
+     * keyword itself standing in as the "property" being written.
+     */
+    if (ECHO_NODES.has(node.type)) {
+      const keyword = node.child(0);
+      for (const printed of node.namedChildren) {
+        if (!printed) continue;
+        const taint = evaluate(printed, scope);
+        if (taint && keyword) checkAssignSink(node, keyword, printed, taint);
+      }
+    }
+
+    /*
+     * A FOR-EACH INTRODUCES A NAME, AND NOTHING WAS BINDING IT.
+     *
+     *     String[] values = request.getParameterValues("q");
+     *     out.write(values[0]);                  // flow-verified
+     *     for (String v : values) out.write(v);  // signature-based only
+     *
+     * Subscripting a tainted array carried the taint; iterating the same array
+     * threw it away, because `v` was never entered into the environment and so
+     * evaluated to clean.
+     *
+     * The loop node types were ALREADY listed in CONDITIONAL_NODES - the tracer
+     * knew a for-each was a branch, and used that to decide a clean write inside
+     * one cannot prove a value safe. Knowing a construct exists and modelling
+     * what it does are different things, and the first reads exactly like the
+     * second until something measures it.
+     *
+     * Found by diagnosing BenchmarkJava's remaining 123 misses: every one had no
+     * source recognised, and fourteen of them were `for (Cookie c :
+     * request.getCookies())` - a source this engine has always known, thrown
+     * away by the loop around it. It looked like a cookie bug and was not.
+     *
+     * Container-insensitive, like every other collection in this engine: the
+     * loop variable takes the taint of the whole iterable, so iterating a list
+     * with one dirty element treats every element as dirty. That errs toward
+     * reporting, which is the direction this project takes on purpose.
+     */
+    if (FOREACH_NODES.has(node.type)) {
+      const binding = foreachBinding(node);
+      if (binding) {
+        const taint = evaluate(binding.iterable, scope);
+        const name = text(binding.name).replace(/^[$*&]+/, '').trim();
+        if (taint && /^[A-Za-z_$][\w$]*$/.test(name)) {
+          scope.env.set(
+            name,
+            addStep(taint, binding.name, `bound to \`${name}\` by a for-each over the collection`),
+          );
+        }
+      }
+    }
+
+    if (ASSIGNMENT_NODES.has(node.type)) {
+      const parts = assignmentParts(node);
+      if (parts) {
+        const taint = evaluate(parts.value, scope);
+        if (taint) checkAssignSink(node, parts.target, parts.value, taint);
+
+        // Record it in the notebook, but only for plain variable names.
+        // `obj.field = dirty` is not tracked - tracking object fields properly
+        // needs alias analysis, which is well beyond this phase.
+        //
+        // Go's `id, err := strconv.Atoi(x)` puts several names on the left. We
+        // bind every one of them to the same taint. It is imprecise - only one
+        // of the returned values really carries it - but erring this way keeps
+        // the extremely common `value, err :=` idiom traceable, and it is
+        // recorded in the Go coverage note rather than left as a surprise.
+        const targetNames = (
+          parts.target.type === 'expression_list'
+            ? parts.target.namedChildren.filter((c): c is Node => c !== null).map((c) => text(c))
+            : DESTRUCTURING_NODES.has(parts.target.type)
+              ? namesBoundBy(parts.target)
+              : [text(parts.target)]
+        ).map(stripDeclarator);
+
+        // `stmt, err := db.Prepare(sql)` - remember that `stmt` is a handle.
+        // Go wraps the right-hand side in an expression_list, so unwrap first;
+        // without this the check silently never fired.
+        const valueNode =
+          parts.value.type === 'expression_list' && parts.value.namedChildCount >= 1
+            ? parts.value.namedChildren[0] ?? parts.value
+            : parts.value;
+        if (CALL_NODES.has(valueNode.type)) {
+          const preparedBy = lastSegment(calleeOf(valueNode).text);
+          if (/^(StringBuilder|StringBuffer)$/.test(preparedBy)) {
+            for (const targetName of targetNames) scope.builders.add(targetName);
+          }
+          if (PREPARE_CALLS.has(preparedBy)) {
+            for (const targetName of targetNames) scope.prepared.add(targetName);
+          }
+        }
+
+        /*
+         * `s += x` EXTENDS s. It does not replace it.
+         *
+         * Every node type in ASSIGNMENT_NODES was being applied as "the target
+         * now holds the right-hand side", which is right for `=` and wrong for
+         * `+=`. A clean right-hand side therefore deleted the target's taint,
+         * and this is the shape it broke:
+         *
+         *     String sql = "SELECT * FROM t WHERE x = '";
+         *     sql += request.getParameter("x");   // sql is dirty
+         *     sql += "'";                         // sql was wiped clean here
+         *     stmt.execute(sql);                  // reported nothing at all
+         *
+         * That is the canonical injection, written the way people write it.
+         * Found in C++ and assumed to be a C++ problem; rewriting it in four
+         * other languages showed JavaScript, Python and Java all lost the value
+         * identically, and only PHP survived. It was never about C++.
+         *
+         * Only `+=` and `.=` qualify. The other compound operators keep the old
+         * value too, but `s -= x` and `s *= x` produce a number, and a number
+         * cannot be a shell command - the same reason BINARY_CARRIERS holds
+         * only the operators that can still carry an attacker's shape.
+         *
+         * Measured per language rather than assumed: C++, Java and Go spell
+         * this `assignment_expression`/`assignment_statement` with a `+=`
+         * operator, while JS, Python and PHP use a distinct augmented node. All
+         * six expose the same `operator` field, so the operator decides and the
+         * node type does not have to.
+         */
+        const operator = node.childForFieldName('operator')?.text ?? '';
+        const extendsTarget = operator === '+=' || operator === '.=';
+
+        /*
+         * `m['k'] = v` WRITES ONE ELEMENT. It does not replace `m`.
+         *
+         * stripDeclarator turns `m['k']` into `m` (it exists for C's `buf[10]`),
+         * so an element write was applied as `m = v`. BenchmarkPython 00189:
+         *
+         *     m['keyB'] = param           # m dirty
+         *     m['keyC'] = 'another'       # m wiped clean - the whole dict
+         *     bar = m['keyB']             # silent: not even "to review"
+         *
+         * And the mirror image claimed a proof it did not have: one dirty
+         * element, then a read of a CLEAN key, read back the dirt as certain.
+         * Now the container keeps every element: a clean write leaves the dirt
+         * where it is, a dirty one joins it, and a container holding more than
+         * one element is marked collectedMany, so reading ONE back is a guess
+         * unless local-map.ts can show which write it returns.
+         */
+        const elementWrite =
+          ELEMENT_TARGETS.has(parts.target.type) && targetNames.length === 1 && /^[A-Za-z_$][\w$]*$/.test(targetNames[0]!);
+        if (elementWrite) {
+          const name = targetNames[0]!;
+          const before = scope.env.get(name);
+          const many = !!before || elementCount(node, name) > 1;
+          if (taint) {
+            const stored = addStep(taint, parts.target, `written into an element of \`${name}\``);
+            // joinParts, but not `joined`: that marks a string built from parts.
+            const both = before ? { ...joinParts([before, stored]), joined: before.joined } : stored;
+            scope.env.set(name, many ? { ...both, collectedMany: true } : both);
+          } else if (before) {
+            scope.env.set(name, { ...before, collectedMany: true });
+          }
+        }
+
+        for (const targetName of elementWrite ? [] : targetNames) {
+          if (!/^[A-Za-z_$][\w$]*$/.test(targetName)) continue;
+          const before = scope.env.get(targetName);
+          if (
+            taint &&
+            before &&
+            !extendsTarget &&
+            washedKinds(taint).some((k) => !washedKinds(before).includes(k)) &&
+            underCondition(node, scope.body, scope.filePath) &&
+            skippedBy(node, before, scope.body, scope.filePath) !== null
+          ) {
+            /*
+             * A CONDITIONAL WRITE OF A WASHED VALUE OVER A DIRTY ONE.
+             *
+             *     if (raw) p = input; else p = escapeHtml(input);
+             *     out.println(p);
+             *
+             * This printed "checked and cleared": the last write wins in this
+             * engine, and the last write was the escaped one. On every run that
+             * takes the first arm the page gets the raw input. A conditional
+             * CLEAN write was already handled below - kept the dirt, flagged the
+             * assumption - but a washed value is not clean, it is a taint, so it
+             * took this branch and replaced the dirt outright.
+             *
+             * Inside the branch, after the write, the value IS the washed one -
+             * DVWA's sqli/source/impossible.php checks is_numeric(), calls
+             * intval() and prints, all in one block, and that stays cleared.
+             * When the walk leaves the branch that could skip the write, the
+             * name holds either value, so the old dirt comes back for every
+             * kind the new value does not wash. That is flagged as resting on a
+             * branch, like a skipped clean write - unless the dirty write sits
+             * in the other arm of one if/else (inOtherArm), where the run that
+             * took that arm certainly delivers it.
+             */
+            const stored = addStep(taint, parts.target, `stored in \`${targetName}\``);
+            scope.env.set(targetName, stored);
+            const block = skippedBy(node, before, scope.body, scope.filePath);
+            if (block) {
+              const pendingEither = [...new Set([...(before.quotePending ?? []), ...(taint.quotePending ?? [])])];
+              const either: Taint = {
+                ...before,
+                sanitizedFor: new Set([...before.sanitizedFor].filter((k) => taint.sanitizedFor.has(k))),
+                afterWash: joinedAfterWash(
+                  [before, taint],
+                  new Set([...before.sanitizedFor].filter((k) => taint.sanitizedFor.has(k))),
+                ),
+                quotePending: pendingEither.length > 0 ? pendingEither : undefined,
+                branchAssumed: inOtherArm(node, before, scope.body, scope.filePath) ? before.branchAssumed : true,
+              };
+              const key = spanKey(scope.filePath, block);
+              armSettles.set(key, [...(armSettles.get(key) ?? []), { target: targetName, inside: stored, after: either }]);
+            }
+          } else if (taint) {
+            const stored = addStep(taint, parts.target, `stored in \`${targetName}\``);
+            // The value now has a name - see `throughOf`. Not for `.=`/`+=`,
+            // whose result also holds whatever the name held before.
+            if (guardOn && !extendsTarget && targetNames.length === 1) {
+              const binding = `${scope.filePath}#${node.id}#${targetName}`;
+              bindingOf.set(stored, binding);
+              throughOf.set(stored, new Set([...(throughOf.get(taint) ?? []), binding]));
+            }
+            scope.env.set(targetName, stored);
+          } else if (extendsTarget) {
+            // Appending something clean to a dirty value leaves it dirty.
+            continue;
+          } else if (scope.env.has(targetName) && underCondition(node, scope.body, scope.filePath)) {
+            /*
+             * A clean write we cannot prove happens. Keep the dirt - but record
+             * that we ASSUMED rather than followed, so no proof is claimed on
+             * the strength of it. See the note on branchAssumed.
+             */
+            const kept = scope.env.get(targetName);
+            if (kept) {
+              const certain = guardCannotCleanTarget(node, scope.body, targetName);
+              const assumed: Taint = { ...kept, branchAssumed: true };
+              scope.env.set(targetName, certain ? kept : assumed);
+              // Clean and dirty writes in different arms of one if/else: the
+              // assumption holds only until that if/else ends - see inOtherArm.
+              const shared = certain ? null : inOtherArm(node, kept, scope.body, scope.filePath);
+              if (shared) {
+                const key = spanKey(scope.filePath, shared);
+                armSettles.set(key, [...(armSettles.get(key) ?? []), { target: targetName, inside: assumed, after: kept }]);
+              }
+            }
+          } else {
+            scope.env.delete(targetName); // reassigned to something clean
+          }
+        }
+
+        // Still descend into the value: `const x = db.query(dirty)` has a sink
+        // inside an assignment.
+        //
+        // All THREE dispatches, not just the argument one. `Process p =
+        // pb.start();` is an assignment whose value is a receiver sink, and it
+        // is the standard idiom - the return is captured even though the
+        // dangerous act needs no arguments. Having one dispatch here and three
+        // in the statement branch meant the same call was analysed differently
+        // depending on whether anybody kept its result.
+        for (const child of parts.value.namedChildren) if (child) walk(child, scope, depth + 1);
+        if (CALL_NODES.has(parts.value.type)) {
+          checkMutation(parts.value, scope);
+          checkOutParamMutation(parts.value, scope);
+          checkReceiverSink(parts.value, scope);
+          checkCallSink(parts.value, scope);
+        }
+        return;
+      }
+    }
+
+    if (node.type === 'return_statement') {
+      const expression = node.namedChildren.find((c): c is Node => c !== null) ?? null;
+      const returned = expression ? evaluate(expression, scope) : null;
+
+      // Returning a page IS writing a page, in a framework where the view's
+      // return value is the response body. Without this the most ordinary
+      // reflected XSS in Flask - `return f"<h1>{name}</h1>"` - produced nothing
+      // at all, and the correctly-escaped version of the same code looked
+      // "clean" only because no sink existed for the escaping to be credited
+      // against. Two cases passing for the wrong reason is worse than one
+      // failing for the right one.
+      // `return render_template_string("<h1>" + name)` is ALREADY a call sink.
+      // Counting the return as a second sink reported the same bug twice at the
+      // same line, and double-recorded the escaped version as clean. The return
+      // only adds something when the returned expression IS the string.
+      const returnsAString = expression !== null && !CALL_NODES.has(expression.type);
+
+      const flaskRoute = language === 'python' && expression !== null && flaskRouteReturningStr(node, expression);
+      if (
+        dictionary.htmlReturnIsSink &&
+        returned &&
+        expression &&
+        returnsAString &&
+        (looksLikeHtml(text(expression)) || flaskRoute)
+      ) {
+        checkTaintAtSink(
+          returned,
+          expression,
+          'xss',
+          'an HTML response body returned by this function',
+          flaskRoute
+            ? 'is returned as a str from a Flask route (`@...route`), which Flask sends as the ' +
+              'response body with Content-Type text/html - markup in the value is rendered. A ' +
+              'content type changed elsewhere (after_request, a config default) is not seen.'
+            : 'is returned from this function as an HTML string - in Flask/Django a view\'s ' +
+              'return value IS the response body. We do not verify that this function is a ' +
+              'route handler; if it is not, this string is rendered somewhere else instead.',
+        );
+      }
+
+      // While analysing a called function, remember what it hands back.
+      if (scope.onReturn) scope.onReturn(returned, node);
+    }
+
+    if (CALL_NODES.has(node.type)) {
+      checkMutation(node, scope);
+      checkOutParamMutation(node, scope);
+      checkReceiverSink(node, scope);
+      checkCallSink(node, scope);
+      // A bare call statement - `helper(req.query.id);` - is never evaluated as
+      // an expression, so without this line the cross-function trace would only
+      // work when the result was assigned to something. Easy gap to miss.
+      descendIntoLocalCall(node, scope, 0);
+    }
+
+    for (const child of node.namedChildren) {
+      if (child) walk(child, scope, depth + 1);
+    }
+    if (armSettles.size > 0) settleArms(node, scope);
+  };
+
+  /* ---- following a value into another function ---- */
+
+  descendIntoLocalCall = (
+    node: Node,
+    scope: Scope,
+    depth: number,
+  ): { handled: boolean; taint: Taint | null; stopped?: 'depth' | 'recursion' } => {
+    const { text: calleeText } = calleeOf(node);
+    const calleeName = lastSegment(calleeText);
+
+    /*
+     * A FULLY QUALIFIED CALL IS NOT A LOCAL FUNCTION, however the names line up.
+     *
+     *     java.util.Collections.list(request.getParameterNames())
+     *
+     * resolved to a fixture's own `list(HttpServletRequest, HttpServletResponse)`
+     * three files away, because resolution used the LAST SEGMENT of the callee
+     * and threw the package path away. The descent then "handled" the call and
+     * returned that unrelated method's answer, which was nothing - so a proof
+     * that existed when the file was scanned alone disappeared when it was
+     * scanned alongside its neighbours.
+     *
+     * That is the worst shape a bug can take here: the same code, analysed
+     * twice, giving two answers, with no message either time.
+     *
+     * The engine's limitations already say "whether a function is actually
+     * EXPORTED is not checked - a module-private helper with a matching name
+     * could be entered". This is that, with a fact available to rule it out and
+     * nobody reading it. `java.util.Collections` names one class in one package;
+     * a local method cannot be it.
+     *
+     * The test is the Java package convention - lowercase segments then a
+     * Capitalised type - which is deliberately narrow. `Utils.list(x)` and
+     * `this.list(x)` are unqualified enough to still resolve locally, and are
+     * left alone.
+     */
+    if (/^[a-z][\w$]*(?:\.[a-z][\w$]*)+\.[A-Z][\w$]*\.[\w$]+$/.test(calleeText.trim())) {
+      return { handled: false, taint: null };
+    }
+
+    /* ---- PHASE 3c: the function may live in another file. ----
+     * We look locally first, then ask the project index. The index only
+     * answers when the answer is UNAMBIGUOUS - one file, one function. If
+     * three modules export `sanitize`, it says nothing and records that it
+     * declined, which is printed in the report. Picking one at random would be
+     * how a scanner ends up proving a path that does not exist.               */
+    /*
+     * A NAME IS NOT ENOUGH WHERE THE LANGUAGE COUNTS ARGUMENTS.
+     *
+     * Calls are resolved by name, and in BenchmarkJava that name was
+     * `doSomething` - which every test file declares. So a one-argument
+     * `thing.doSomething(param)` resolved to the file's own two-parameter
+     * `doSomething(request, param)`, the tainted value was bound to `request`,
+     * `param` arrived empty, and the flow vanished. In Java, Go and the C family
+     * a one-argument call cannot run a two-parameter function; the count rules
+     * it out. Python, JavaScript and PHP accept the wrong count, so there it
+     * proves nothing and is not used.
+     *
+     * A local function the call cannot reach is set aside and the project index
+     * asked instead, exactly as if the name had not been found here.
+     */
+    const argCount = argumentsOf(node).length;
+    // Only asked for when a same-named target actually exists - most calls
+    // (println, getParameter) have none, and never pay for the lookup.
+    const receiverTypeOfCall = (): string | null => {
+      const key = `${scope.filePath}\0${node.startIndex}:${node.endIndex}`;
+      if (!receiverTypes.has(key)) receiverTypes.set(key, javaReceiverType(node));
+      return receiverTypes.get(key) ?? null;
+    };
+    const reachable = (fn: LocalFunction): boolean => {
+      if (
+        ARITY_ENFORCED.has(language) &&
+        fn.minArgs !== undefined &&
+        (argCount < fn.minArgs || argCount > (fn.maxArgs ?? Infinity))
+      ) {
+        return false;
+      }
+      /*
+       * A CALL ON A `Fragment` CAN ONLY RUN A `Fragment` METHOD.
+       *
+       * Across files in one package, the index answers whenever exactly one
+       * file declares the name - so `f.renderFragment(param)`, with `f`
+       * declared as an interface, was followed into an unrelated class that
+       * shared the method name and returned a constant. The flow came back
+       * clean. ReceiverTypeCaller.java is that case; SameNameDelegate.java
+       * found it by accident, passing alone and failing beside a fixture that
+       * declared its own doSomething.
+       *
+       * Java writes the receiver's type down, so a target declared in some
+       * other type is ruled out. An interface-typed receiver therefore reaches
+       * no body at all - which is correct: which implementation runs is a
+       * runtime fact, and the value is carried with that assumption named.
+       */
+      if (language === 'java') {
+        const declaring = declaringTypeOf(fn);
+        const receiverType = declaring ? receiverTypeOfCall() : null;
+        if (declaring && receiverType && declaring !== receiverType) return false;
+      }
+      return true;
+    };
+
+    let local = localFunctions.get(calleeName);
+    if (local && !reachable(local)) local = undefined;
+    let targetPath = scope.filePath;
+    if (!local && resolver) {
+      const resolved = resolver.resolve(scope.filePath, calleeName);
+      if (resolved && reachable(resolved.fn)) {
+        local = resolved.fn;
+        targetPath = resolved.path;
+      }
+    }
+    if (!local) return { handled: false, taint: null };
+
+    /*
+     * THE TWO STOPS, AND WHAT A STOP IS ALLOWED TO CONCLUDE.
+     *
+     * "Both are recorded as misses, never as invented answers" - that is what
+     * this comment used to say, above two lines that returned `taint: null`.
+     * No taint IS an answer: it is "this value is clean", and it is the
+     * dangerous one. Every flow that reached a stop was silently cut, and the
+     * only trace of it was a counter.
+     *
+     * It cost all 38 of BenchmarkJava's missed vulnerabilities (a helper named
+     * doSomething calling thing.doSomething, taken for a call to itself), and it
+     * costs every delegating method - `run` forwarding to `self.engine.run` -
+     * and every call chain deeper than MAX_CALL_DEPTH, in every language.
+     *
+     * A stop now hands the call back as NOT HANDLED, which sends it to the
+     * branch this file already has for a function it cannot read: the value
+     * keeps its taint, and the path says, at that hop, that the trace stopped
+     * following and why. The assumption is made in the open, where a reader can
+     * check it - which is what the old comment promised and the code did not do.
+     */
+    const stackKey = `${targetPath}::${local.name}`;
+    if (callStack.length >= MAX_CALL_DEPTH) {
+      seenDepth.add(siteOf(node, scope.filePath));
+      return { handled: false, taint: null, stopped: 'depth' };
+    }
+    if (callStack.includes(stackKey)) {
+      seenRecursion.add(siteOf(node, scope.filePath));
+      return { handled: false, taint: null, stopped: 'recursion' };
+    }
+
+    // Which arguments are dirty, and what is their history so far?
+    const argumentTaints = argumentsOf(node).map((arg) => evaluate(arg, scope, depth + 1));
+
+    /* ---- the cache key has to include WHICH ARGUMENTS ARE DIRTY ----
+     *
+     * It used to be the call site alone (`file#nodeId`), and that quietly
+     * capped interprocedural tracing at ONE level.
+     *
+     * Why: the main walk visits every function body at top level, where the
+     * parameters are unbound. So `return s2(x)` inside `s1` is evaluated once
+     * with `x` clean, decides "no dirty arguments, nothing to do", and caches
+     * NULL against that call site. Later, when the tracer descends into `s1`
+     * from a real caller with `x` tainted, it reaches the same node id and gets
+     * handed back that stale null. The taint dies one level in.
+     *
+     * The outermost call is never poisoned this way - it is only ever seen with
+     * tainted arguments - which is exactly why `handler -> s1` worked and
+     * `handler -> s1 -> s2` did not, and why it looked like a depth limit doing
+     * its job. MAX_CALL_DEPTH is 4; the real reach was 1, and the capability
+     * text claiming four was wrong by three.
+     *
+     * Keyed by taint shape, the same call with the same dirty arguments still
+     * hits the cache - which is all the cache was ever for.                  */
+    const taintShape = argumentTaints.map((t) => (t ? '1' : '0')).join('');
+    const cacheKey = `${scope.filePath}#${node.id}#${taintShape}`;
+    if (descendCache.has(cacheKey)) {
+      return { handled: true, taint: descendCache.get(cacheKey) ?? null };
+    }
+
+    /**
+     * A helper can be worth entering even with entirely clean arguments, if it
+     * fetches attacker data ITSELF:
+     *
+     *     function readId(req) { return req.query.id; }
+     *     const id = readId(req);          // <- `req` alone is not a source
+     *     db.query("... " + id);
+     *
+     * `req` on its own does not match any source pattern (we only recognise
+     * `req.query`-shaped expressions), so the argument looks clean and the old
+     * check bailed out. Peeking at whether the body mentions a source at all is
+     * a cheap text test that unlocks this very common shape.
+     */
+    const bodyText = (local.body.text ?? '').slice(0, 4000);
+    const bodyFetchesASource = dictionary.sources.some((source) => source.pattern.test(bodyText));
+
+    if (!argumentTaints.some((t) => t !== null) && !bodyFetchesASource) {
+      descendCache.set(cacheKey, null);
+      return { handled: true, taint: null };
+    }
+
+    // Bind each dirty argument to the NAME the callee will use for it. This one
+    // line is the whole idea of interprocedural analysis: the value does not
+    // change, only what it is called.
+    const env = new Map<string, Taint>();
+    local.params.forEach((parameter, index) => {
+      const taint = argumentTaints[index];
+      if (!parameter || !taint) return;
+      env.set(
+        parameter,
+        addStep(
+          taint,
+          node,
+          `passed into \`${local.name}()\` as parameter \`${parameter}\``,
+        ),
+      );
+    });
+    if (env.size === 0 && !bodyFetchesASource) {
+      descendCache.set(cacheKey, null);
+      return { handled: true, taint: null };
+    }
+
+    let returned: Taint | null = null;
+    const calleeScope: Scope = {
+      body: local.body,
+      env,
+      filePath: targetPath,
+      prepared: new Set<string>(),
+      builders: new Set<string>(),
+      onReturn: (taint, returnNode) => {
+        if (taint && !returned) {
+          returned = addStep(taint, returnNode, `returned from \`${local.name}()\``);
+        }
+      },
+    };
+
+    callStack.push(stackKey);
+    // Step into the callee's file for the duration of the descent, so every
+    // hop recorded in there points at the right file and line. Restored below.
+    const callerPath = currentPath;
+    currentPath = targetPath;
+    if (local.body.type === 'statement_block' || local.body.namedChildCount > 0) {
+      for (const child of local.body.namedChildren) {
+        if (child) walk(child, calleeScope);
+      }
+    }
+    // A concise arrow body (`x => f(x)`) is an expression, not a block: its
+    // value IS the return value, so evaluate it directly.
+    if (local.body.type !== 'statement_block' && local.body.type !== 'block') {
+      const direct = evaluate(local.body, calleeScope);
+      if (direct && !returned) {
+        returned = addStep(direct, local.body, `returned from \`${local.name}()\``);
+      }
+    }
+    currentPath = callerPath;
+    callStack.pop();
+
+    descendCache.set(cacheKey, returned);
+    return { handled: true, taint: returned };
+  };
+
+  // Process every scope. `queue` grows as nested functions are discovered.
+  let processed = 0;
+  while (processed < queue.length && processed < 500) {
+    const scope = queue[processed];
+    processed++;
+    if (!scope) continue;
+    currentPath = scope.filePath;
+    for (const child of scope.body.namedChildren) {
+      if (child) walk(child, scope);
+    }
+  }
+
+  return { flows: results, sanitized, unreachable, resolvedReads, freshStops, limits: limits() };
+}
+
+export { type TaintDictionary };