Taint enforce: directory open backstops, single-key search filename