[SizzleUnrlsd]

Summary

First point of the consolidation: the bodies of nested functions and lambdas.

• Tests first (test: define closure bodies, captured parameters and factory routes), implementation follows.
• Every nested def and every lambda inside an analysable function is an analysable function of its own, named after its enclosing functions (outer.inner, outer.lambda_L_C); a lambda is synthesized as a function returning its body. Coverage counts them, plugins see them, and --emit-ir prints them.
• The variables a nested function captures, the names its scope resolves as free, are implicit parameters appended to its explicit ones. MakeFunction carries the captured values at the definition point, and the call graph maps a call to a nested function to a known function, so summaries and taint map the callee's captured parameters onto those values: a sink inside a closure is reached through the call, reported at the call site with through, like a call to any helper. A closure that is never called stays silent. nonlocal assignments remain unsupported.
• Routes defined inside an application factory (app = Flask(__name__) in create_app, then @app.route on a nested function) resolve through the enclosing function's locals, so they are entry points.

On the sixteen repositories nothing changes: none of them keeps a sink inside a callback, which is what the manual reading had suggested and why this came second.