Dynamic (#77)

src/constraint/domain.rs

@@ -231,6 +231,13 @@ fn type_kind_index(kind: &TypeKind) -> u32 {
         | TypeKind::GormDb
         | TypeKind::SqlxDb
         | TypeKind::HibernateSession => 3,
+        // ProcessBuilder participates only in the type-qualified callee
+        // resolver via `label_prefix()`; no dedicated bitset slot, share
+        // the Object index like the other receiver-only TypeKinds.
+        TypeKind::ProcessBuilder => 3,
+        // Runtime is likewise a type-qualified-resolver-only receiver kind
+        // (`Runtime.exec`); no dedicated bitset slot, share the Object index.
+        TypeKind::Runtime => 3,
     }
 }
 

src/constraint/lower.rs

@@ -15,8 +15,6 @@
 //!    literal operand. Necessary because individual comparisons are NOT
 //!    decomposed into separate SSA operations (condition nodes → `Nop`).
 
-#![allow(clippy::collapsible_if)]
-
 use crate::cfg::NodeInfo;
 use crate::ssa::const_prop::ConstLattice;
 use crate::ssa::ir::{BlockId, SsaBody, SsaValue};

src/constraint/solver.rs

@@ -275,6 +275,14 @@ pub fn class_name_to_type_kind(name: &str) -> Option<TypeKind> {
         // type-qualified resolution to `Template.process`, the SSTI
         // sink defined in `labels/java.rs`.
         "Template" => Some(TypeKind::Template),
+        // `java.lang.Runtime` declared receiver type.  Routes the
+        // split-receiver shape `Runtime r = Runtime.getRuntime(); ...
+        // r.exec(...)` through type-qualified resolution to
+        // `Runtime.exec` (the only `Runtime.*` rule, always SHELL_ESCAPE),
+        // complementing the `constructor_type` factory route for
+        // `Runtime.getRuntime()`.  No benign `Runtime.exec` exists, so
+        // typing any `Runtime`-declared receiver carries no FP risk.
+        "Runtime" => Some(TypeKind::Runtime),
         // Python qualified type names.
         // Only covers raw lowered names from isinstance(). The lowering in lower.rs
         // extracts the literal type text: isinstance(x, requests.Session) produces