diff --git a/benchmarks/pairs/advisory-fixes-2/catalog.toml b/benchmarks/pairs/advisory-fixes-2/catalog.toml
index ce1aa45..77bb86f 100644
--- a/benchmarks/pairs/advisory-fixes-2/catalog.toml
+++ b/benchmarks/pairs/advisory-fixes-2/catalog.toml
@@ -1460,42 +1460,6 @@ mechanism = "source_reaches_sink"
 family = "injection"
 evidence = "GHSA-2w86-xfrc-g85r: Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator"
 
-[[pair]]
-name = "typeorm-handler-41d1c62"
-slice = "advisory-fixes"
-batch = "2026-10-03"
-language = "typescript"
-origin = "github-advisory"
-license = "MIT"
-repo = "typeorm/typeorm"
-cve = "CVE-2026-73651 GHSA-2rp8-mm9q-fp49"
-cwe = "CWE-94"
-ecosystem = "npm"
-published_at = "2026-07-21T21:59:23Z"
-post_cutoff = true
-commit = "41d1c62fe49f99c3ca916d4d986f61ee9f45d519"
-parent = "8a51b756bf31c885da1e1d92cb17d94819c7040a"
-commit_url = "https://github.com/typeorm/typeorm/commit/41d1c62fe49f99c3ca916d4d986f61ee9f45d519"
-vendored = false
-host = "github"
-path = "src/commands/MigrationGenerateCommand.ts"
-mode = "name"
-relpath = "src/commands/MigrationGenerateCommand.ts"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-07-13"
-fix_lines = { in_function = 8, in_file = 20, source_total = 22 }
-
-[[pair.expected]]
-cwe = "CWE-94"
-class = "code-injection"
-path = "src/commands/MigrationGenerateCommand.ts"
-function = "handler"
-mechanism = "source_reaches_sink"
-family = "injection"
-evidence = "GHSA-2rp8-mm9q-fp49:  TypeORM: migration:generate template-literal code injection"
-
 [[pair]]
 name = "velocity-js-isblockedpathkey-f8e47a6"
 slice = "advisory-fixes"
@@ -1604,42 +1568,6 @@ mechanism = "source_reaches_sink"
 family = "injection"
 evidence = "GHSA-9473-5f9j-94wq: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props"
 
-[[pair]]
-name = "gitpython-option-candidates-96a888f"
-slice = "advisory-fixes"
-batch = "2026-10-03"
-language = "python"
-origin = "github-advisory"
-license = "BSD-3-Clause"
-repo = "gitpython-developers/gitpython"
-cve = "CVE-2026-76220 GHSA-wvpp-8hx9-p66j"
-cwe = "CWE-88"
-ecosystem = "pip"
-published_at = "2026-08-07T15:49:07Z"
-post_cutoff = true
-commit = "96a888f4d782cb2f80452148e48e60ce4af6d541"
-parent = "a495ccd3b547ccd60b2187215823b72a9c0188bf"
-commit_url = "https://github.com/gitpython-developers/gitpython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541"
-vendored = false
-host = "github"
-path = "git/cmd.py"
-mode = "name"
-relpath = "git/cmd.py"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-08-04"
-fix_lines = { in_function = 13, in_file = 10, source_total = 12 }
-
-[[pair.expected]]
-cwe = "CWE-88"
-class = "argument-injection"
-path = "git/cmd.py"
-function = "_option_candidates"
-mechanism = "source_reaches_sink"
-family = "injection"
-evidence = "GHSA-wvpp-8hx9-p66j: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution"
-
 [[pair]]
 name = "mermaid-addnamespace-12d472c"
 slice = "advisory-fixes"
@@ -2540,42 +2468,6 @@ mechanism = "path_join_user_input"
 family = "path"
 evidence = "GHSA-m9mq-7m7q-xc6p: browse-mcp has an arbitrary file write via unconfined download and state paths"
 
-[[pair]]
-name = "notebooklm-mcp-makeslug-13828d9"
-slice = "advisory-fixes"
-batch = "2026-10-03"
-language = "typescript"
-origin = "github-advisory"
-license = "MIT"
-repo = "roomi-fields/notebooklm-mcp"
-cve = "CVE-2026-61647 GHSA-jjhp-8crj-mppq"
-cwe = "CWE-22"
-ecosystem = "npm"
-published_at = "2026-09-22T14:43:26Z"
-post_cutoff = true
-commit = "13828d9ff3933839ce14c1797d3b20a6bb7694a6"
-parent = "50f74d6bec799687066a25355894077577683231"
-commit_url = "https://github.com/roomi-fields/notebooklm-mcp/commit/13828d9ff3933839ce14c1797d3b20a6bb7694a6"
-vendored = false
-host = "github"
-path = "src/utils/vault-writer.ts"
-mode = "name"
-relpath = "src/utils/vault-writer.ts"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-06-20"
-fix_lines = { in_function = 10, in_file = 45, source_total = 54 }
-
-[[pair.expected]]
-cwe = "CWE-22"
-class = "path-traversal"
-path = "src/utils/vault-writer.ts"
-function = "makeSlug"
-mechanism = "path_join_user_input"
-family = "path"
-evidence = "GHSA-jjhp-8crj-mppq: @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory"
-
 [[pair]]
 name = "langchain-nvidia-url-to-b64-string-b483c7c"
 slice = "advisory-fixes"
@@ -3008,42 +2900,6 @@ mechanism = "validation_strength"
 family = "untrusted_destination"
 evidence = "GHSA-fp4x-ggrf-wmc6: H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation"
 
-[[pair]]
-name = "axios-setproxy-fb3befb"
-slice = "advisory-fixes"
-batch = "2026-10-03"
-language = "javascript"
-origin = "github-advisory"
-license = "MIT"
-repo = "axios/axios"
-cve = "CVE-2025-62718 GHSA-3p68-rc4w-qgx5"
-cwe = "CWE-441"
-ecosystem = "npm"
-published_at = "2026-04-09T17:32:19Z"
-post_cutoff = false
-commit = "fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
-parent = "8023035109c9de959ca47a64658dd97258d5eca7"
-commit_url = "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
-vendored = false
-host = "github"
-path = "lib/adapters/http.js"
-mode = "name"
-relpath = "lib/adapters/http.js"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-04-06"
-fix_lines = { in_function = 4, in_file = 4, source_total = 111 }
-
-[[pair.expected]]
-cwe = "CWE-441"
-class = "ssrf"
-path = "lib/adapters/http.js"
-function = "setProxy"
-mechanism = "source_reaches_sink"
-family = "untrusted_destination"
-evidence = "GHSA-3p68-rc4w-qgx5: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF"
-
 [[pair]]
 name = "rembg-s-command-07ad0d4"
 slice = "advisory-fixes"
diff --git a/benchmarks/pairs/advisory-fixes-2/verification.json b/benchmarks/pairs/advisory-fixes-2/verification.json
index 41985e8..45f17d3 100644
--- a/benchmarks/pairs/advisory-fixes-2/verification.json
+++ b/benchmarks/pairs/advisory-fixes-2/verification.json
@@ -200,11 +200,6 @@
       "ok": true,
       "bytes_read": 2607
     },
-    {
-      "name": "typeorm-handler-41d1c62",
-      "ok": true,
-      "bytes_read": 11977
-    },
     {
       "name": "velocity-js-isblockedpathkey-f8e47a6",
       "ok": true,
@@ -220,11 +215,6 @@
       "ok": true,
       "bytes_read": 6805
     },
-    {
-      "name": "gitpython-option-candidates-96a888f",
-      "ok": true,
-      "bytes_read": 3421
-    },
     {
       "name": "mermaid-addnamespace-12d472c",
       "ok": true,
@@ -350,11 +340,6 @@
       "ok": true,
       "bytes_read": 5302
     },
-    {
-      "name": "notebooklm-mcp-makeslug-13828d9",
-      "ok": true,
-      "bytes_read": 2103
-    },
     {
       "name": "langchain-nvidia-url-to-b64-string-b483c7c",
       "ok": true,
@@ -415,11 +400,6 @@
       "ok": true,
       "bytes_read": 2750
     },
-    {
-      "name": "axios-setproxy-fb3befb",
-      "ok": true,
-      "bytes_read": 4403
-    },
     {
       "name": "rembg-s-command-07ad0d4",
       "ok": true,
@@ -491,6 +471,6 @@
       "bytes_read": 3385
     }
   ],
-  "verified": 98,
-  "bytes_read": 526134
+  "verified": 94,
+  "bytes_read": 504230
 }
diff --git a/benchmarks/pairs/advisory-fixes-3/catalog.toml b/benchmarks/pairs/advisory-fixes-3/catalog.toml
index 00cf6a0..c7e05fa 100644
--- a/benchmarks/pairs/advisory-fixes-3/catalog.toml
+++ b/benchmarks/pairs/advisory-fixes-3/catalog.toml
@@ -1352,42 +1352,6 @@ mechanism = "source_reaches_sink"
 family = "injection"
 evidence = "GHSA-3mpg-q26j-83j5: Command injection in yiisoft/yii2-gii"
 
-[[pair]]
-name = "contao-tablelookupwizard-preparewhere-a5e723a"
-slice = "advisory-fixes"
-batch = "2026-10-04"
-language = "php"
-origin = "github-advisory"
-license = "MIT"
-repo = "terminal42/contao-tablelookupwizard"
-cve = "GHSA-7fpj-wc8v-9cgc"
-cwe = "CWE-89"
-ecosystem = "composer"
-published_at = "2024-05-30T13:12:13Z"
-post_cutoff = false
-commit = "a5e723a28f110b7df8ffc4175cef9b061d3cc717"
-parent = "ae6c82f10b0f1e87226079ebaa78ac630b05279a"
-commit_url = "https://github.com/terminal42/contao-tablelookupwizard/commit/a5e723a28f110b7df8ffc4175cef9b061d3cc717"
-vendored = false
-host = "github"
-path = "TableLookupWizard.php"
-mode = "name"
-relpath = "TableLookupWizard.php"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2022-02-04"
-fix_lines = { in_function = 4, in_file = 2, source_total = 4 }
-
-[[pair.expected]]
-cwe = "CWE-89"
-class = "sqli"
-path = "TableLookupWizard.php"
-function = "prepareWhere"
-mechanism = "source_reaches_sink"
-family = "injection"
-evidence = "GHSA-7fpj-wc8v-9cgc: Duplicate Advisory: terminal42/contao-tablelookupwizard possible SQL injection in widget field value"
-
 [[pair]]
 name = "spring-module-core-getschema-d374a5f"
 slice = "advisory-fixes"
@@ -3512,42 +3476,6 @@ mechanism = "source_reaches_sink"
 family = "output_encoding"
 evidence = "GHSA-rrj2-ph5q-jxw2: jquery-validation vulnerable to Cross-site Scripting"
 
-[[pair]]
-name = "email-ext-plugin-rendertemplate-7b2bd25"
-slice = "advisory-fixes"
-batch = "2026-10-04"
-language = "java"
-origin = "github-advisory"
-license = "MIT"
-repo = "jenkinsci/email-ext-plugin"
-cve = "CVE-2023-25764 GHSA-p2fr-mq9m-6w6p"
-cwe = "CWE-79"
-ecosystem = "maven"
-published_at = "2023-02-15T15:30:41Z"
-post_cutoff = false
-commit = "7b2bd251aa0193d009d85b713362d965dab262d0"
-parent = "f715c42d186f363f64b64a6a6ed76ed241e702c9"
-commit_url = "https://github.com/jenkinsci/email-ext-plugin/commit/7b2bd251aa0193d009d85b713362d965dab262d0"
-vendored = false
-host = "github"
-path = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java"
-mode = "name"
-relpath = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2023-02-08"
-fix_lines = { in_function = 2, in_file = 1, source_total = 2 }
-
-[[pair.expected]]
-cwe = "CWE-79"
-class = "xss"
-path = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java"
-function = "renderTemplate"
-mechanism = "source_reaches_sink"
-family = "output_encoding"
-evidence = "GHSA-p2fr-mq9m-6w6p: Cross-site Scripting in Jenkins Email Extension Plugin"
-
 [[pair]]
 name = "archiva-checkparamchars-d62e81c"
 slice = "advisory-fixes"
@@ -5096,42 +5024,6 @@ mechanism = "source_reaches_sink"
 family = "output_encoding"
 evidence = "GHSA-3843-rr4g-m8jq: Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)"
 
-[[pair]]
-name = "graby-cleanupxss-0295d82"
-slice = "advisory-fixes"
-batch = "2026-10-04"
-language = "php"
-origin = "github-advisory"
-license = "MIT"
-repo = "j0k3r/graby"
-cve = "GHSA-3h6j-9x8m-rg3g"
-cwe = "CWE-79"
-ecosystem = "composer"
-published_at = "2026-03-31T23:12:36Z"
-post_cutoff = false
-commit = "0295d828822f7a59c5751a8199973a4f965a99b0"
-parent = "5c5870bd0e8b03c9ea3e7c056d013cd9e4ab2f9a"
-commit_url = "https://github.com/j0k3r/graby/commit/0295d828822f7a59c5751a8199973a4f965a99b0"
-vendored = false
-host = "github"
-path = "src/Graby.php"
-mode = "name"
-relpath = "src/Graby.php"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-03-27"
-fix_lines = { in_function = 2, in_file = 1, source_total = 2 }
-
-[[pair.expected]]
-cwe = "CWE-79"
-class = "xss"
-path = "src/Graby.php"
-function = "cleanupXss"
-mechanism = "source_reaches_sink"
-family = "output_encoding"
-evidence = "GHSA-3h6j-9x8m-rg3g: Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config"
-
 [[pair]]
 name = "unhead-getstreamkey-64b5ac0"
 slice = "advisory-fixes"
@@ -5384,42 +5276,6 @@ mechanism = "source_reaches_sink"
 family = "output_encoding"
 evidence = "GHSA-f3cj-j4f6-wq85: Svelte: SSR XSS via Insecure Promise Serialization in hydratable"
 
-[[pair]]
-name = "marimo-inject-service-worker-fdd55c8"
-slice = "advisory-fixes"
-batch = "2026-10-04"
-language = "python"
-origin = "github-advisory"
-license = "Apache-2.0"
-repo = "marimo-team/marimo"
-cve = "CVE-2026-54386 GHSA-8m59-7xv8-735h"
-cwe = "CWE-79"
-ecosystem = "pip"
-published_at = "2026-06-18T00:32:36Z"
-post_cutoff = true
-commit = "fdd55c8cf6260ae23bb411dc9d9269def5cf75d6"
-parent = "dc35cdfecf4f9b918d9c40faa92e2ad0d71501c4"
-commit_url = "https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6"
-vendored = false
-host = "github"
-path = "marimo/_server/api/endpoints/assets.py"
-mode = "name"
-relpath = "marimo/_server/api/endpoints/assets.py"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-06-04"
-fix_lines = { in_function = 2, in_file = 6, source_total = 7 }
-
-[[pair.expected]]
-cwe = "CWE-79"
-class = "xss"
-path = "marimo/_server/api/endpoints/assets.py"
-function = "_inject_service_worker"
-mechanism = "source_reaches_sink"
-family = "output_encoding"
-evidence = "GHSA-8m59-7xv8-735h: marimo contains a reflected cross-site scripting vulnerability in the notebook page"
-
 [[pair]]
 name = "jupyterlab-git-diffheader-c6d37b8"
 slice = "advisory-fixes"
@@ -5564,42 +5420,6 @@ mechanism = "source_reaches_sink"
 family = "output_encoding"
 evidence = "GHSA-3753-m2x2-q623: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer"
 
-[[pair]]
-name = "twig-validatename-3d19a2e"
-slice = "advisory-fixes"
-batch = "2026-10-04"
-language = "php"
-origin = "github-advisory"
-license = "BSD-3-Clause"
-repo = "fabpot/twig"
-cve = "GHSA-7cvr-xhm5-x998"
-cwe = "CWE-22"
-ecosystem = "composer"
-published_at = "2024-05-30T13:42:49Z"
-post_cutoff = false
-commit = "3d19a2eed53570776af313593aaeb5ad62cf4980"
-parent = "481abb83323f4dcabadc9292b0e9f104df0719de"
-commit_url = "https://github.com/fabpot/twig/commit/3d19a2eed53570776af313593aaeb5ad62cf4980"
-vendored = false
-host = "github"
-path = "lib/Twig/Loader/Filesystem.php"
-mode = "name"
-relpath = "lib/Twig/Loader/Filesystem.php"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2013-04-08"
-fix_lines = { in_function = 1, in_file = 1, source_total = 1 }
-
-[[pair.expected]]
-cwe = "CWE-22"
-class = "path-traversal"
-path = "lib/Twig/Loader/Filesystem.php"
-function = "validateName"
-mechanism = "path_join_user_input"
-family = "path"
-evidence = "GHSA-7cvr-xhm5-x998: Twig Path Traversal vulnerability in the filesystem loader"
-
 [[pair]]
 name = "bazingajstranslationbundle-getlocales-7accee9"
 slice = "advisory-fixes"
@@ -6284,42 +6104,6 @@ mechanism = "path_join_user_input"
 family = "path"
 evidence = "GHSA-gv7f-w92j-383q: DreamFactory has a directory traversal"
 
-[[pair]]
-name = "simile-butterfly-getresource-537f64b"
-slice = "advisory-fixes"
-batch = "2026-10-04"
-language = "java"
-origin = "github-advisory"
-license = "Apache-2.0"
-repo = "openrefine/simile-butterfly"
-cve = "CVE-2024-47883 GHSA-3p8v-w8mr-m3x8"
-cwe = "CWE-22"
-ecosystem = "maven"
-published_at = "2024-10-24T18:16:43Z"
-post_cutoff = false
-commit = "537f64bfa72746f8b21d4bda461fad843435319c"
-parent = "2ad1fa4cd8afe3c920c8e6e04fe7a7df5cf8294e"
-commit_url = "https://github.com/openrefine/simile-butterfly/commit/537f64bfa72746f8b21d4bda461fad843435319c"
-vendored = false
-host = "github"
-path = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java"
-mode = "name"
-relpath = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2024-10-19"
-fix_lines = { in_function = 12, in_file = 13, source_total = 18 }
-
-[[pair.expected]]
-cwe = "CWE-22"
-class = "path-traversal"
-path = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java"
-function = "getResource"
-mechanism = "path_join_user_input"
-family = "path"
-evidence = "GHSA-3p8v-w8mr-m3x8: Butterfly has path/URL confusion in resource handling leading to multiple weaknesses"
-
 [[pair]]
 name = "oak-send-4b2f27e"
 slice = "advisory-fixes"
@@ -8084,42 +7868,6 @@ mechanism = "path_join_user_input"
 family = "path"
 evidence = "GHSA-78v8-vpjp-cjqh: PDM  wheel installation leads to Path Traversal via overridden write_to_fs"
 
-[[pair]]
-name = "xiaomusic-music-file-88404da"
-slice = "advisory-fixes"
-batch = "2026-10-04"
-language = "python"
-origin = "github-advisory"
-license = "MIT"
-repo = "hanxi/xiaomusic"
-cve = "CVE-2026-10108 GHSA-5j8p-5rrj-8wjg"
-cwe = "CWE-22"
-ecosystem = "pip"
-published_at = "2026-05-29T18:31:35Z"
-post_cutoff = false
-commit = "88404da7a283f2c0a796a4cd16bbb6e6aa1f4722"
-parent = "c6679a69e4295a7e508f5ec157b60c5ac5b8a041"
-commit_url = "https://github.com/hanxi/xiaomusic/commit/88404da7a283f2c0a796a4cd16bbb6e6aa1f4722"
-vendored = false
-host = "github"
-path = "xiaomusic/api/routers/file.py"
-mode = "name"
-relpath = "xiaomusic/api/routers/file.py"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-05-26"
-fix_lines = { in_function = 4, in_file = 3, source_total = 6 }
-
-[[pair.expected]]
-cwe = "CWE-22"
-class = "path-traversal"
-path = "xiaomusic/api/routers/file.py"
-function = "music_file"
-mechanism = "path_join_user_input"
-family = "path"
-evidence = "GHSA-5j8p-5rrj-8wjg: xiaomusic contains an unauthenticated path traversal vulnerability"
-
 [[pair]]
 name = "serializer-decode-0943a06"
 slice = "advisory-fixes"
@@ -8480,42 +8228,6 @@ mechanism = "source_reaches_sink"
 family = "untrusted_destination"
 evidence = "GHSA-3ppr-72x5-x67q: XML external entity vulnerability on agents in Jenkins MSTest Plugin "
 
-[[pair]]
-name = "request-redirect-c5bcf21"
-slice = "advisory-fixes"
-batch = "2026-10-04"
-language = "javascript"
-origin = "github-advisory"
-license = "Apache-2.0"
-repo = "cypress-io/request"
-cve = "CVE-2023-28155 GHSA-p8p7-x288-28g6"
-cwe = "CWE-918"
-ecosystem = "npm"
-published_at = "2023-03-16T15:30:19Z"
-post_cutoff = false
-commit = "c5bcf21d40fb61feaff21a0e5a2b3934a440024f"
-parent = "0664780557c95610eafeedff6067bacac6783705"
-commit_url = "https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f"
-vendored = false
-host = "github"
-path = "lib/redirect.js"
-mode = "name"
-relpath = "lib/redirect.js"
-provenance = "agent"
-split = "train"
-review_tier = "advisory"
-fix_date = "2023-08-08"
-fix_lines = { in_function = 4, in_file = 5, source_total = 6 }
-
-[[pair.expected]]
-cwe = "CWE-918"
-class = "ssrf"
-path = "lib/redirect.js"
-function = "Redirect"
-mechanism = "source_reaches_sink"
-family = "untrusted_destination"
-evidence = "GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request"
-
 [[pair]]
 name = "drill-xmlreader-0e88b7a"
 slice = "advisory-fixes"
diff --git a/benchmarks/pairs/advisory-fixes-3/verification.json b/benchmarks/pairs/advisory-fixes-3/verification.json
index 70ece08..8ff1e63 100644
--- a/benchmarks/pairs/advisory-fixes-3/verification.json
+++ b/benchmarks/pairs/advisory-fixes-3/verification.json
@@ -185,11 +185,6 @@
       "ok": true,
       "bytes_read": 1699
     },
-    {
-      "name": "contao-tablelookupwizard-preparewhere-a5e723a",
-      "ok": true,
-      "bytes_read": 3698
-    },
     {
       "name": "spring-module-core-getschema-d374a5f",
       "ok": true,
@@ -485,11 +480,6 @@
       "ok": true,
       "bytes_read": 77807
     },
-    {
-      "name": "email-ext-plugin-rendertemplate-7b2bd25",
-      "ok": true,
-      "bytes_read": 3416
-    },
     {
       "name": "archiva-checkparamchars-d62e81c",
       "ok": true,
@@ -705,11 +695,6 @@
       "ok": true,
       "bytes_read": 2205
     },
-    {
-      "name": "graby-cleanupxss-0295d82",
-      "ok": true,
-      "bytes_read": 1678
-    },
     {
       "name": "unhead-getstreamkey-64b5ac0",
       "ok": true,
@@ -745,11 +730,6 @@
       "ok": true,
       "bytes_read": 3716
     },
-    {
-      "name": "marimo-inject-service-worker-fdd55c8",
-      "ok": true,
-      "bytes_read": 5331
-    },
     {
       "name": "jupyterlab-git-diffheader-c6d37b8",
       "ok": true,
@@ -770,11 +750,6 @@
       "ok": true,
       "bytes_read": 2858
     },
-    {
-      "name": "twig-validatename-3d19a2e",
-      "ok": true,
-      "bytes_read": 1956
-    },
     {
       "name": "bazingajstranslationbundle-getlocales-7accee9",
       "ok": true,
@@ -870,11 +845,6 @@
       "ok": true,
       "bytes_read": 2927
     },
-    {
-      "name": "simile-butterfly-getresource-537f64b",
-      "ok": true,
-      "bytes_read": 3893
-    },
     {
       "name": "oak-send-4b2f27e",
       "ok": true,
@@ -1120,11 +1090,6 @@
       "ok": true,
       "bytes_read": 3554
     },
-    {
-      "name": "xiaomusic-music-file-88404da",
-      "ok": true,
-      "bytes_read": 5275
-    },
     {
       "name": "serializer-decode-0943a06",
       "ok": true,
@@ -1175,11 +1140,6 @@
       "ok": true,
       "bytes_read": 3652
     },
-    {
-      "name": "request-redirect-c5bcf21",
-      "ok": true,
-      "bytes_read": 5438
-    },
     {
       "name": "drill-xmlreader-0e88b7a",
       "ok": true,
@@ -1256,6 +1216,6 @@
       "bytes_read": 4668
     }
   ],
-  "verified": 251,
-  "bytes_read": 1297516
+  "verified": 243,
+  "bytes_read": 1266831
 }
diff --git a/benchmarks/pairs/advisory-fixes/catalog.toml b/benchmarks/pairs/advisory-fixes/catalog.toml
index 6f31c2d..bc72557 100644
--- a/benchmarks/pairs/advisory-fixes/catalog.toml
+++ b/benchmarks/pairs/advisory-fixes/catalog.toml
@@ -139,38 +139,6 @@ mechanism = "source_reaches_sink"
 family = "untrusted_destination"
 evidence = "GHSA-28mg-98xm-q493: login redirects to next only when is_safe_redirect_url (same host, http/https) holds"
 
-[[pair]]
-name = "google-login-plugin-docommencelogin-532d714"
-slice = "advisory-fixes"
-language = "java"
-framework = "jenkins"
-origin = "github-advisory"
-license = "Apache-2.0"
-repo = "jenkinsci/google-login-plugin"
-cve = "CVE-2022-46683 GHSA-v93c-cxj5-c398"
-cwe = "CWE-601"
-commit = "532d714943ff8ae8dc862427d39a4b78b7f6a375"
-parent = "6b616f7709037a9bde1ee1646b18811a45e0b1fd"
-commit_url = "https://github.com/jenkinsci/google-login-plugin/commit/532d714943ff8ae8dc862427d39a4b78b7f6a375"
-vendored = false
-host = "github"
-path = "src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java"
-mode = "name"
-relpath = "src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java"
-provenance = "human"
-split = "train"
-review_tier = "advisory"
-fix_date = "2022-12-05"
-
-[[pair.expected]]
-cwe = "CWE-601"
-class = "open_redirect"
-path = "src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java"
-function = "doCommenceLogin"
-mechanism = "validation_strength"
-family = "untrusted_destination"
-evidence = "GHSA-v93c-cxj5-c398: doCommenceLogin used from/Referer only when Util.isSafeToRedirectTo was FALSE (inverted); fix routes through a correct safe-redirect check"
-
 [[pair]]
 name = "truelayer-dotnet-getpayment-75e436e"
 slice = "advisory-fixes"
@@ -459,38 +427,6 @@ mechanism = "source_reaches_sink"
 family = "untrusted_destination"
 evidence = "GHSA-7j2f-6h2r-6cqc: createForEpisode refuses to Http::sink()->get() an episode enclosure URL unless Network::isSafeUrl (public host, http/https)"
 
-[[pair]]
-name = "authentication-getloginredirect-1c1e29c"
-slice = "advisory-fixes"
-language = "php"
-framework = "cakephp"
-origin = "github-advisory"
-license = "MIT"
-repo = "cakephp/authentication"
-cve = "CVE-2026-55590 GHSA-hhpq-7wg4-36jm"
-cwe = "CWE-601"
-commit = "1c1e29c7e8129cfbcae74558316ecd3ea50a8273"
-parent = "3f7cb4a7a0313139d5d3ce2bdd7854c19bae2491"
-commit_url = "https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273"
-vendored = false
-host = "github"
-path = "src/AuthenticationService.php"
-mode = "name"
-relpath = "src/AuthenticationService.php"
-provenance = "human"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-06-24"
-
-[[pair.expected]]
-cwe = "CWE-601"
-class = "open_redirect"
-path = "src/AuthenticationService.php"
-function = "getLoginRedirect"
-mechanism = "validation_strength"
-family = "untrusted_destination"
-evidence = "GHSA-hhpq-7wg4-36jm: getLoginRedirect normalises backslashes to slashes and rejects values starting with // before the host/scheme check"
-
 [[pair]]
 name = "og-image-resolve-243cac2"
 slice = "advisory-fixes"
@@ -1707,38 +1643,6 @@ mechanism = "source_reaches_sink"
 family = "output_encoding"
 evidence = "GHSA-gcr2-9v8m-gq45: addRotate XML-escapes the rotate option before interpolating it into the SVG transform attribute"
 
-[[pair]]
-name = "omnifaces-getupdatescript-c43eef0"
-slice = "advisory-fixes"
-language = "java"
-framework = "jsf"
-origin = "github-advisory"
-license = "Apache-2.0"
-repo = "omnifaces/omnifaces"
-cve = "GHSA-fp43-vj7g-pg92"
-cwe = "CWE-79"
-commit = "c43eef01174a4dc09cec44eff553ff6284150af7"
-parent = "6e43429276dc558887bfa5f6ae6e04d90983b951"
-commit_url = "https://github.com/omnifaces/omnifaces/commit/c43eef01174a4dc09cec44eff553ff6284150af7"
-vendored = false
-host = "github"
-path = "src/main/java/org/omnifaces/component/input/HashParam.java"
-mode = "name"
-relpath = "src/main/java/org/omnifaces/component/input/HashParam.java"
-provenance = "human"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-07-23"
-
-[[pair.expected]]
-cwe = "CWE-79"
-class = "xss"
-path = "src/main/java/org/omnifaces/component/input/HashParam.java"
-function = "getUpdateScript"
-mechanism = "source_reaches_sink"
-family = "output_encoding"
-evidence = "GHSA-fp43-vj7g-pg92: getUpdateScript JS-escapes the request-derived hash param name and value with escapeJS before formatting them into the ajax callback script"
-
 [[pair]]
 name = "tablib-export-book-b0ff39f"
 slice = "advisory-fixes"
@@ -1771,38 +1675,6 @@ mechanism = "source_reaches_sink"
 family = "output_encoding"
 evidence = "GHSA-gqgw-jghv-mxwx: export_book stops interpolating the dataset title raw into the HTML heading and serialises it through an ElementTree element, which escapes it"
 
-[[pair]]
-name = "hono-resolvechildearly-2b8ed40"
-slice = "advisory-fixes"
-language = "typescript"
-framework = "hono"
-origin = "github-advisory"
-license = "MIT"
-repo = "honojs/hono"
-cve = "CVE-2026-93981 GHSA-hxh3-vqpv-xpqv"
-cwe = "CWE-79"
-commit = "2b8ed402cdab6dfc5e829b480806dcd8db94161e"
-parent = "cac0c4d3fe29aca4e426031067cbbb3b9131e30c"
-commit_url = "https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e"
-vendored = false
-host = "github"
-path = "src/jsx/components.ts"
-mode = "name"
-relpath = "src/jsx/components.ts"
-provenance = "human"
-split = "train"
-review_tier = "advisory"
-fix_date = "2026-09-04"
-
-[[pair.expected]]
-cwe = "CWE-79"
-class = "xss"
-path = "src/jsx/components.ts"
-function = "resolveChildEarly"
-mechanism = "source_reaches_sink"
-family = "output_encoding"
-evidence = "GHSA-hxh3-vqpv-xpqv: resolveChildEarly stops returning plain string children as already-escaped HTML and routes them through renderChildren, which escapes them"
-
 [[pair]]
 name = "serialize-to-js-deserialize-1cd4339"
 slice = "advisory-fixes"
diff --git a/benchmarks/pairs/advisory-fixes/verification.json b/benchmarks/pairs/advisory-fixes/verification.json
index 665cefe..2de3fe2 100644
--- a/benchmarks/pairs/advisory-fixes/verification.json
+++ b/benchmarks/pairs/advisory-fixes/verification.json
@@ -20,11 +20,6 @@
       "ok": true,
       "bytes_read": 2273
     },
-    {
-      "name": "google-login-plugin-docommencelogin-532d714",
-      "ok": true,
-      "bytes_read": 2790
-    },
     {
       "name": "truelayer-dotnet-getpayment-75e436e",
       "ok": true,
@@ -70,11 +65,6 @@
       "ok": true,
       "bytes_read": 1867
     },
-    {
-      "name": "authentication-getloginredirect-1c1e29c",
-      "ok": true,
-      "bytes_read": 3975
-    },
     {
       "name": "og-image-resolve-243cac2",
       "ok": true,
@@ -265,21 +255,11 @@
       "ok": true,
       "bytes_read": 1368
     },
-    {
-      "name": "omnifaces-getupdatescript-c43eef0",
-      "ok": true,
-      "bytes_read": 1491
-    },
     {
       "name": "tablib-export-book-b0ff39f",
       "ok": true,
       "bytes_read": 1683
     },
-    {
-      "name": "hono-resolvechildearly-2b8ed40",
-      "ok": true,
-      "bytes_read": 3041
-    },
     {
       "name": "serialize-to-js-deserialize-1cd4339",
       "ok": true,
@@ -486,6 +466,6 @@
       "bytes_read": 2462
     }
   ],
-  "verified": 97,
-  "bytes_read": 367053
+  "verified": 93,
+  "bytes_read": 355756
 }
diff --git a/src/openultrasast/learn/sources.toml b/src/openultrasast/learn/sources.toml
index 42ca283..a3c3795 100644
--- a/src/openultrasast/learn/sources.toml
+++ b/src/openultrasast/learn/sources.toml
@@ -141,6 +141,16 @@ reason = "v3 selection research; never opened"
 file = "protocol-v3.md"
 reason = "v3 protocol; never opened"
 
+# Counts derived from the advisory-fix catalog, not an independent labelled population.
+[[excluded]]
+file = "advisory-fixes-spread.json"
+reason = "advisory-fix catalog spread report; never opened"
+
+# Selection write-up: rejected-candidate mentions are narrative, not labelled cases.
+[[excluded]]
+file = "research-2026-09-26.md"
+reason = "v2 selection research write-up; never opened"
+
 # Repository aliases: forks and renames that are one repository group. Groups sharing an advisory id (CVE/GHSA) or
 # a fix commit are merged automatically; list here only what those cannot see.
 # [[alias]]
diff --git a/tests/test_advisory_fix_pairs.py b/tests/test_advisory_fix_pairs.py
index fb8134d..a232915 100644
--- a/tests/test_advisory_fix_pairs.py
+++ b/tests/test_advisory_fix_pairs.py
@@ -93,6 +93,13 @@ def test_no_pair_repeats_a_repository_the_benchmarks_already_name(source_id: str
     ours = {repo_name(item["repo"]) for item in _raw(folder)}
     elsewhere: set[str] = set()
     for path in (ROOT / "benchmarks").rglob("*"):
+        # A vendored dependency tree is not the benchmarks NAMING a repository as a population member: it is a
+        # checked-out application's own `node_modules`, where any dependency's README or package.json mentions
+        # its upstream repo. benchmarks/search/private/runs/*/checkout/ carries ~49k such files, so grepping
+        # them deletes a labelled advisory pair the moment a vendored dep happens to name its repo -- corpus
+        # loss masquerading as hygiene. Skip vendored trees; the leak guard is about our own populations.
+        if "node_modules" in path.parts or "vendor" in path.parts:
+            continue
         if not path.is_file() or folder in path.parents or path.name in excluded or path.suffix in {".pyc", ".bin", ".gz", ".jsonl"}:
             continue
         try: