@portll/cobolwork 0.2.117 → 0.2.150

package/lib/compliance.mjs

@@ -5,10 +5,10 @@
 // against each. The difference between them is this file, and it is the difference between a
 // tooling budget and a compliance budget.
 //
-// DORA, NIST SP 800-53 and the FFIEC IT Examination Handbook ship here because their instruments
-// may be reproduced: one is EU law, the other two US Government works. PCI DSS and the COBIT-derived SOX material may not be
-// redistributed, so those mappings belong in the licensed feed rather than in an AGPL repository.
-// The split is a licensing fact before it is a product decision.
+// DORA, NIST SP 800-53 and the FFIEC IT Examination Handbook ship with quotes because their
+// instruments may be reproduced: one is EU law, the other two US Government works. COBIT 2019 ships
+// as identifiers with this project's own rationale and no ISACA text. PCI DSS may not be
+// redistributed and is not mapped.
 //
 // A framework may decline to cover a rule. Neither NIST nor FFIEC has a control that genuinely
 // covers committing an LPAR name to a repository, and that is recorded as an unmapped rule with a
@@ -19,6 +19,7 @@ const FRAMEWORKS = [
   { id: 'dora', file: '../rules/compliance-dora.json' },
   { id: 'nist-800-53r5', file: '../rules/compliance-nist80053.json' },
   { id: 'ffiec', file: '../rules/compliance-ffiec.json' },
+  { id: 'cobit-2019', file: '../rules/compliance-cobit2019.json' },
 ];
 
 // A framework that will not parse is a framework this scan cannot map against, which is the same
@@ -64,7 +65,7 @@ const byRule = new Map();
 for (const d of loaded) {
   for (const r of d.rows) {
     if (!byRule.has(r.ruleId)) byRule.set(r.ruleId, []);
-    byRule.get(r.ruleId).push({ framework: r.framework, clause: r.clause, title: r.title });
+    byRule.get(r.ruleId).push({ framework: r.framework, clause: r.clause, ...(r.title ? { title: r.title } : {}) });
   }
 }
 

package/lib/control.mjs

@@ -251,6 +251,12 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
   const loopBody = new Map();
   const stmtAt = new Map();
   for (const st of prog.statements) if (st.at != null && st.verb !== 'WHEN') stmtAt.set(st.at, st);
+  const unpassedBy = new Map();
+  for (const c of prog.calls || []) {
+    const st = prog.statements[c.stmtIndex];
+    if (st) unpassedBy.set(st, new Set([c.targetTok, ...c.using.filter((a) => a.mode !== 'REFERENCE' && a.tok).map((a) => a.tok)]));
+  }
+  const external = (it) => { for (let a = it; a; a = a.parent) if (a.external) return true; return false; };
   const labelAt = new Map();
   for (const l of prog.labels) if (l.at != null) labelAt.set(l.at, l);
   const labelNames = new Set(prog.labels.map((l) => l.name));
@@ -574,7 +580,7 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
         const body = n.k === 'perform' ? add('call', { st: n.st, range: rangeOf(n.target, n.thru), succ: [step] }) : lowerList(n.body, step, loopCtx);
         nodes[t].succ = [outcome(t, true, next), outcome(t, false, body)];
         nodes[head].succ = [n.testAfter ? body : t];
-        if (n.st.loops) loopHeads.push({ head, step, loops: n.st.loops });
+        if (n.st.loops) loopHeads.push({ head, step, loops: n.st.loops, test: t, testAfter: n.testAfter, body: n.k === 'inline' ? n.body : null });
         return head;
       }
       case 'goto': {
@@ -640,11 +646,14 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
       for (const t of n.st.targets || []) add(t);
       if (n.st.verb === 'CALL' || n.st.verb === 'READ' || n.st.verb === 'RETURN') {
         // A callee may write what it is passed by reference, and a READ fills the file's records.
+        // The field naming the program called, and what goes BY CONTENT or BY VALUE, is not passed
+        // for the callee to write - unless it is EXTERNAL, which any program can.
+        const unpassed = n.st.verb === 'CALL' ? unpassedBy.get(n.st) : null;
         for (const t of n.st.sources || []) {
           const f = resolve(t);
           if (!f) continue;
           if (f.records) for (const r of f.records) out.push(r);
-          else if (n.st.verb === 'CALL') out.push(f);
+          else if (n.st.verb === 'CALL' && !(unpassed && unpassed.has(t) && !external(f))) out.push(f);
         }
       }
     }
@@ -1083,7 +1092,10 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
       const bounds = { lo: 1, hi };
       const c = { id: checks.length, key, field, file: list[0].n.st.file, line: list[0].n.st.line, tCons: { numeric: true, lo: 1, loInc: true, hi, hiInc: true }, fCons: null, restricts: false, assigned: true, bounds };
       checks.push(c);
-      for (const a of list) if (Number(a.value) <= hi) (a.upTo ||= []).push(c);
+      // "At most v" alone, which a decrement that cannot go below 0 leaves standing.
+      const top = { id: checks.length, key, field, file: c.file, line: c.line, tCons: { numeric: true, hi, hiInc: true }, fCons: null, restricts: false, assigned: true, bounds: { hi } };
+      checks.push(top);
+      for (const a of list) if (Number(a.value) <= hi) (a.upTo ||= []).push(c, top);
     }
   }
   // Fact numbers: for each check, `x` that it ran (only a restricting one), `t` and `f` that it came
@@ -1419,6 +1431,40 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     (a.n.genStmt ||= []).push(newLo(a.field, v, a.n.st).t);
   }
   // An increment by at least m turns "at least k" into "at least k + m", where the sum fits the field.
+  // The fields a statement only ever lowers, by a constant, and by how much at most.
+  const decrements = (st) => {
+    const seg = segOf(st);
+    let fields = [];
+    let max = 0;
+    const amount = (t) => { const v = t && (t.t === 'word' || t.t === 'num') ? numberOf(constValue([t])) : null; return v != null && Number.isInteger(v) && v >= 0 ? v : null; };
+    if (st.verb === 'SUBTRACT') {
+      const from = seg.findIndex((t) => WORD(t, 'FROM'));
+      if (from < 1 || seg.some((t) => WORD(t, 'GIVING') || WORD(t, 'CORRESPONDING') || WORD(t, 'CORR'))) return null;
+      for (const t of seg.slice(0, from)) { const v = amount(t); if (v == null) return null; max += v; }
+      const end = seg.findIndex((t, i) => i > from && PHRASE_AT(t));
+      if (seg.slice(from + 1, end < 0 ? seg.length : end).some((t) => t.t === 'sep')) return null;
+      fields = (st.targets || []).map((t) => resolve(t));
+    } else if (st.verb === 'SET') {
+      const down = seg.findIndex((t) => WORD(t, 'DOWN'));
+      if (down < 1 || !WORD(seg[down + 1], 'BY') || seg.length !== down + 3 || seg.slice(0, down).some((t) => t.t !== 'word')) return null;
+      max = amount(seg[down + 2]);
+      if (max == null) return null;
+      fields = (st.targets || []).map((t) => resolve(t));
+    } else if (st.verb === 'COMPUTE') {
+      const eq = seg.findIndex((t) => t.t === 'op' && t.v === '=');
+      const lhs = seg.slice(0, eq).filter((t) => !WORD(t, 'ROUNDED'));
+      const end = seg.findIndex((t, i) => i > eq && PHRASE_AT(t));
+      const rhs = seg.slice(eq + 1, end < 0 ? seg.length : end);
+      if (eq < 1 || lhs.length !== 1 || lhs[0].t !== 'word' || rhs.length !== 3 || rhs[1].t !== 'op' || rhs[1].v !== '-') return null;
+      const target = resolve(lhs[0]);
+      if (rhs[0].t !== 'word' || resolve(rhs[0]) !== target) return null;
+      max = amount(rhs[2]);
+      if (max == null) return null;
+      fields = [target];
+    } else return null;
+    fields = [...new Set(fields.filter((f) => intCap(f) != null))];
+    return fields.length ? { fields, max } : null;
+  };
   const lifted = new Map();
   for (const [id, inc] of raisers) {
     const list = [];
@@ -1486,6 +1532,118 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
   // so the pair is joined at whichever of the two checks comes last.
   const outcomeAt = new Map();
   for (const node of nodes) if (node.kind === 'outcome') outcomeAt.set(`${node.test}|${node.value}`, node);
+  // A backward scan for the last byte past the spaces, VARYING I FROM the field's length BY -1 UNTIL
+  // I < 1 OR F(I:1) > SPACE, leaves I from 1 to that length where F > SPACES held as it began: a
+  // field that compares above spaces has a byte above a space, under any collating sequence, and the
+  // scan meets it before 0. The witness dies with a write to F or to anything its subscript reads.
+  const keptOnStep = new Map();
+  const isSpaces = (toks) => toks.length === 1 && (WORD(toks[0], 'SPACE') || WORD(toks[0], 'SPACES') || (toks[0].t === 'lit' && !toks[0].prefix && /^ +$/.test(String(toks[0].v))));
+  const textOf = (toks) => toks.map((t) => (t.t === 'word' ? t.u : String(t.v))).join(' ');
+  // A whole alphanumeric item or table element, with the fields its subscript reads.
+  const scanned = (toks) => {
+    const base = toks[0] && toks[0].t === 'word' ? resolve(toks[0]) : null;
+    if (!base || base.index || base.level === 88 || base.size == null || categoryOf(base)?.k !== 'A' || variableLength(base)) return null;
+    let i = 1;
+    while (i + 1 < toks.length && (WORD(toks[i], 'OF') || WORD(toks[i], 'IN')) && toks[i + 1].t === 'word') i += 2;
+    const reads = [];
+    if (i < toks.length) {
+      if (toks[i].v !== '(' || toks[toks.length - 1].v !== ')') return null;
+      let depth = 0;
+      for (let j = i; j < toks.length; j++) {
+        const t = toks[j];
+        if (t.v === ':') return null;
+        if (t.v === '(' || t.v === ')') { depth += t.v === '(' ? 1 : -1; if (!depth && j < toks.length - 1) return null; continue; }
+        const f = t.t === 'word' ? resolve(t) : null;
+        if (f) reads.push(f.level === 88 && f.parent ? f.parent : f);
+      }
+    }
+    return { base, reads };
+  };
+  // What an outcome says is above spaces (`above`) or only not all spaces.
+  const notBlank = (tree, outcome, out = []) => {
+    if (tree.k === 'not') return notBlank(tree.a, !outcome, out);
+    if ((tree.k === 'and' && outcome) || (tree.k === 'or' && !outcome)) { notBlank(tree.a, outcome, out); notBlank(tree.b, outcome, out); return out; }
+    if (tree.k !== 'rel') return out;
+    const op = outcome ? tree.op : NEGATE[tree.op];
+    if (isSpaces(tree.right) && (op === '>' || op === '<>')) out.push({ toks: tree.left, above: op === '>' });
+    else if (isSpaces(tree.left) && (op === '<' || op === '<>')) out.push({ toks: tree.right, above: op === '<' });
+    return out;
+  };
+  const scans = [];
+  for (const { head, step, test, testAfter, body, loops } of loopHeads) {
+    if (testAfter || !body || loops.length !== 1 || !body.every((el) => el.k === 'stmt' && el.st.verb === 'CONTINUE')) continue;
+    const loop = loops[0];
+    const counter = loop.counter ? resolve(loop.counter) : null;
+    const cap = intCap(counter);
+    const tree = nodes[test].tree;
+    if (cap == null || !tree || tree.k !== 'or' || !loop.by || loop.by.map((t) => t.v).join('') !== '-1') continue;
+    const from = loop.from || [];
+    let start = numberOf(constValue(from));
+    if (start == null && WORD(from[0], 'LENGTH') && WORD(from[1], 'OF')) start = scanned(from.slice(2))?.base.size ?? null;
+    if (start == null || !Number.isInteger(start) || start < 1 || start > cap) continue;
+    const isCounter = (toks) => toks.length === 1 && toks[0].t === 'word' && resolve(toks[0]) === counter;
+    const done = (r) => r.k === 'rel' && isCounter(r.left) && (r.op === '<' ? numberOf(constValue(r.right)) === 1 : (r.op === '<=' || r.op === '=') && numberOf(constValue(r.right)) === 0);
+    const probe = (r) => {
+      if (r.k !== 'rel') return null;
+      const [el, op] = isSpaces(r.right) ? [r.left, r.op] : isSpaces(r.left) ? [r.right, FLIP[r.op]] : [null, null];
+      if (!el || (op !== '>' && op !== '<>') || el.length < 6) return null;
+      const tail = el.slice(-5);
+      if (tail[0].v !== '(' || !isCounter([tail[1]]) || tail[2].v !== ':' || numberOf(constValue([tail[3]])) !== 1 || tail[4].v !== ')') return null;
+      const toks = el.slice(0, -5);
+      const s = scanned(toks);
+      return s && s.base.size === start ? { toks, above: op === '>' } : null;
+    };
+    const p = done(tree.a) ? probe(tree.b) : done(tree.b) ? probe(tree.a) : null;
+    const exit = p && outcomeAt.get(`${test}|true`);
+    if (exit) scans.push({ ...p, counter, start, exit, head, step, at: loop.counter });
+  }
+  // The scan's counter never passes its start: the step runs only once I < 1 has failed, so it
+  // cannot wrap, and the body writes nothing.
+  for (const s of scans) {
+    const key = fieldKey(s.counter);
+    noteField(key, s.counter);
+    const h = { id: checks.length, key, field: s.counter, file: s.at.file, line: s.at.line, tCons: { hi: s.start, hiInc: true }, fCons: null, restricts: false, x: null, t: nFacts++, f: null };
+    checks.push(h);
+    nodes[s.head].genStmt = [...(nodes[s.head].genStmt || []), h.t];
+    keptOnStep.set(s.step, [...(keptOnStep.get(s.step) || []), h.t]);
+  }
+  if (scans.length) {
+    const witness = new Map();
+    const bitFor = (toks, above) => {
+      const k = `${above ? '>' : '<>'}|${textOf(toks)}`;
+      if (witness.has(k)) return witness.get(k);
+      const s = scanned(toks);
+      const bit = nFacts++;
+      for (const f of [s.base, ...s.reads]) {
+        const key = fieldKey(f);
+        noteField(key, f);
+        checks.push({ pseudo: true, key, field: f, x: null, t: bit, f: null });
+      }
+      witness.set(k, bit);
+      return bit;
+    };
+    const wanted = new Set(scans.map((s) => textOf(s.toks)));
+    for (const id of tests) {
+      const n = nodes[id];
+      if (!n.tree) continue;
+      for (const outcome of [true, false]) {
+        for (const nb of notBlank(n.tree, outcome)) {
+          if (!wanted.has(textOf(nb.toks)) || !scanned(nb.toks)) continue;
+          n.gen[String(outcome)].push(bitFor(nb.toks, false));
+          if (nb.above) n.gen[String(outcome)].push(bitFor(nb.toks, true));
+        }
+      }
+    }
+    for (const s of scans) {
+      const bit = witness.get(`${s.above ? '>' : '<>'}|${textOf(s.toks)}`);
+      if (bit == null) continue;
+      const key = fieldKey(s.counter);
+      noteField(key, s.counter);
+      const y = { id: checks.length, key, field: s.counter, file: s.at.file, line: s.at.line, tCons: { numeric: true, lo: 1, loInc: true, hi: s.start, hiInc: true }, fCons: null, restricts: false, x: null, t: nFacts++, f: null, bounds: { lo: 1, hi: s.start } };
+      checks.push(y);
+      (s.exit.implies ||= []).push([bit, y.t]);
+    }
+  }
   const MAX_BOUNDS_PER_RELATION = 8;
   for (const c of [...checks]) {
     if (c.pseudo || c.test == null) continue;
@@ -1600,7 +1758,7 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     const r = rangeOfField(leaf.f);
     const base = { needs: [], lo: r.hold.lo, hi: r.hold.hi };
     if (!leaf.plain) return [base];
-    const cv = numberOf(constValue([leaf.tok]));
+    const cv = leaf.tok ? numberOf(constValue([leaf.tok])) : null;
     if (cv != null && Number.isInteger(cv)) return [{ needs: [], lo: BigInt(cv), hi: BigInt(cv) }];
     if (!heldBits) return [base];
     let lo = null;
@@ -1669,9 +1827,19 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     }
     return out;
   };
+  // The derived intervals that hold every whole number from lo to hi, an open end holding nothing.
+  const containing = (key, lo, hi) => {
+    const out = [];
+    for (const c of factsByKey.get(key) || []) {
+      if (!c.derived) continue;
+      const e = wholeEnds(c.tCons);
+      if (e && (e.lo == null || (lo != null && e.lo <= lo)) && (e.hi == null || (hi != null && e.hi >= hi))) out.push(c.t);
+    }
+    return out;
+  };
   const expandRules = () => {
     indexFacts();
-    for (const n of nodes) { n.derive = undefined; n.genArith = undefined; }
+    for (const n of nodes) { n.derive = undefined; n.genArith = undefined; n.genArithOn = undefined; }
     for (const r of rules) {
       const bits = withLooser(r.fact);
       const at = r.bucket == null ? r.n : nodes[r.n.test];
@@ -1680,6 +1848,26 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
         else ((at.genArithOn ||= { true: [], false: [] })[r.bucket]).push(...bits);
       } else (r.n.derive ||= []).push({ needs: r.needs, to: bits });
     }
+    // A constant moved, and a check's outcome, are values too: routes that reached an interval by
+    // arithmetic and routes that reached it by a move or a test meet at it.
+    for (const a of assigns) {
+      const v = numberOf(a.value);
+      if (v == null || !Number.isInteger(v)) continue;
+      const bits = containing(fieldKey(a.field), BigInt(v), BigInt(v));
+      if (bits.length) (a.n.genArith ||= []).push(...bits);
+    }
+    for (const id of tests) {
+      const n = nodes[id];
+      for (const c of n.checks || []) {
+        for (const [cons, bucket] of [[c.tCons, 'true'], [c.fCons, 'false']]) {
+          if (!cons || (cons.set && cons.set.size)) continue;
+          const e = wholeEnds(cons);
+          if (!e || (e.lo == null && e.hi == null)) continue;
+          const bits = containing(c.key, e.lo, e.hi);
+          if (bits.length) ((n.genArithOn ||= { true: [], false: [] })[bucket]).push(...bits);
+        }
+      }
+    }
   };
 
   const ARITH_VERBS = new Set(['COMPUTE', 'ADD', 'SUBTRACT', 'MULTIPLY', 'DIVIDE', 'MOVE']);
@@ -1873,6 +2061,8 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     const before = relevant.size;
     for (const a of arith) if (a.targets.some((r) => r.f && relevant.has(r.f))) for (const tree of a.trees) for (const l of tree ? leaves(tree) : []) relevant.add(l.f);
     for (const r of relations.values()) if (relevant.has(r.f) || relevant.has(r.g)) { relevant.add(r.f); relevant.add(r.g); }
+    // A loop condition that bounds a relevant counter through another field makes that field relevant.
+    for (const c of checks) { if (c.pseudo || !c.field || !relevant.has(c.field)) continue; for (const d of [c.tDep, c.fDep]) if (d?.g) relevant.add(d.g); }
     more = relevant.size > before;
   }
 
@@ -1884,6 +2074,20 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     let grew = false;
     try {
     indexFacts();
+    // A check's outcome as an interval of its own, which arithmetic's intervals can widen into at a join.
+    for (const id of tests) {
+      for (const c of nodes[id].checks || []) {
+        if (!relevant.has(c.field) || !rangeOfField(c.field) || inTable(c.field)) continue;
+        for (const cons of [c.tCons, c.fCons]) {
+          if (!cons || (cons.set && cons.set.size)) continue;
+          const e = wholeEnds(cons);
+          if (!e || (e.lo == null && e.hi == null)) continue;
+          const had = derivedOf.get(c.field)?.size || 0;
+          derivedFact(c.field, e.lo, e.hi, nodes[id].at || nodes[id].st);
+          if ((derivedOf.get(c.field)?.size || 0) > had) grew = true;
+        }
+      }
+    }
     for (const a of arith) {
       a.trees.forEach((tree, i) => {
         const r = a.targets[i];
@@ -1920,6 +2124,27 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
         }
       }
     }
+    // A bound over an expression in one other field, X <= G - 1, takes the interval G holds at the test.
+    for (const c of checks) {
+      if (c.pseudo || c.test == null || !relevant.has(c.field) || !rangeOfField(c.field) || inTable(c.field)) continue;
+      for (const o of [true, false]) {
+        const dep = o ? c.tDep : c.fDep;
+        const at = dep && outcomeAt.get(`${c.test}|${o}`);
+        if (!at || !rangeOfField(dep.g) || inTable(dep.g) || !Number.isInteger(dep.m) || !Number.isInteger(dep.b)) continue;
+        const hold = rangeOfField(c.field).hold;
+        heldBits = prev ? prev.get(c.test) || null : null;
+        for (const cand of leafCands({ f: dep.g, tok: null, plain: true })) {
+          const v = BigInt(dep.m) * (dep.needs === 'hi' ? cand.hi : cand.lo) + BigInt(dep.b);
+          let lo = null, hi = null;
+          if (dep.side === 'hi') hi = dep.inc ? v : v - 1n; else lo = dep.inc ? v : v + 1n;
+          if (lo != null && lo <= hold.lo) lo = null;
+          if (hi != null && hi >= hold.hi) hi = null;
+          if ((lo == null && hi == null) || (hi != null && hi < hold.lo) || (lo != null && lo > hold.hi)) continue;
+          const fact = derivedFact(c.field, lo, hi, at.st || nodes[c.test].at || nodes[c.test].st);
+          if (fact && derive(at, cand.needs, fact, String(o))) grew = true;
+        }
+      }
+    }
     // A relation holds after the outcome of its test that makes it true, and the fields it bounds hold
     // what the other side could hold.
     for (const id of tests) {
@@ -2049,6 +2274,36 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     } else if (n.kind === 'step' && stepped.has(id)) {
       keepAcross(n, [{ ...stepped.get(id), sizeError: false }]);
     }
+    // An upper bound survives a decrement that cannot go below 0: one where the field was at least the
+    // amount before it, so nothing is stored as an absolute value or wraps.
+    if (n.kind === 'stmt' && n.st && n.st.at != null) {
+      const dec = decrements(n.st);
+      const wrote = dec ? writtenBy(n) : [];
+      for (const field of dec ? dec.fields : []) {
+        if (wrote.some((w) => w !== field && overlaps(w, field))) continue;
+        const key = fieldKey(field);
+        const keep = [];
+        const guards = [];
+        for (const c of checks) {
+          if (c.key !== key || c.pseudo) continue;
+          for (const [bit, cons] of [[c.t, c.tCons], [c.f, c.fCons]]) {
+            if (bit == null || !cons || cons.dep || (cons.set && cons.set.size)) continue;
+            const r = asRange(cons);
+            if (r.hi != null && r.lo == null) keep.push(bit);
+            if (r.lo != null && (r.loInc ? r.lo : Math.floor(r.lo) + 1) >= dec.max) guards.push(bit);
+          }
+        }
+        if (!keep.length || !guards.length) continue;
+        const bits = new Uint32Array(words);
+        for (const b of keep) bits[b >>> 5] |= 1 << (b & 31);
+        (n.keeps ||= []).push({ bits, guards });
+      }
+    }
+    if (n.kind === 'step' && keptOnStep.has(id)) {
+      const bits = new Uint32Array(words);
+      for (const b of keptOnStep.get(id)) bits[b >>> 5] |= 1 << (b & 31);
+      (n.keeps ||= []).push({ bits, guards: null });
+    }
   });
 
   // ---- must-analysis ----
@@ -2323,6 +2578,39 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
   const posOf = new Map();
   const places = [];
   let placeFacts = nFacts;
+  // The tightest end of a field's value the facts `bits` hold, or its picture's.
+  const boundAt = (g, needs, bits) => {
+    const hold = rangeOfField(g)?.hold;
+    let best = hold ? Number(needs === 'hi' ? hold.hi : hold.lo) : null;
+    if (best != null && !Number.isFinite(best)) best = null;
+    for (const c of checks) {
+      if (c.pseudo || c.key !== fieldKey(g)) continue;
+      for (const [bit, cons] of [[c.t, c.tCons], [c.f, c.fCons]]) {
+        if (!cons || !hasFact(bits, bit)) continue;
+        const e = wholeEnds(cons);
+        const v = e && (needs === 'hi' ? e.hi : e.lo);
+        if (v == null) continue;
+        const n = Number(v);
+        if (best == null || (needs === 'hi' ? n < best : n > best)) best = n;
+      }
+    }
+    return best;
+  };
+  // A relation over an expression, X <= G - 1, read with what G held at the test.
+  const resolveDeps = (map, bits) => {
+    const out = new Map();
+    for (const [key, c] of map) {
+      const dep = c && c.dep;
+      const g = dep ? boundAt(dep.g, dep.needs, bits) : null;
+      if (g == null || !Number.isInteger(dep.m) || !Number.isInteger(dep.b)) { out.set(key, c); continue; }
+      const v = dep.m * g + dep.b;
+      const plain = plainCons(c) || {};
+      const had = plain[dep.side];
+      const tighter = had == null || (dep.side === 'hi' ? v < had : v > had);
+      out.set(key, tighter ? { ...plain, [dep.side]: v, [`${dep.side}Inc`]: dep.inc } : plain);
+    }
+    return out;
+  };
   for (const id of tests) {
     const n = nodes[id];
     if (!n.st || !n.st.indexes || !n.tree || n.evaluate || !(n.st.verb === 'IF' || n.loop)) continue;
@@ -2337,7 +2625,8 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
       for (const g of guards || []) {
         let cons = new Map();
         const r = new Map();
-        for (const [sub, outcome] of g) { cons = meetMaps(cons, consOf(sub, outcome)); testedWhen(sub, outcome, r); }
+        const atTest = facts.get(id);
+        for (const [sub, outcome] of g) { cons = meetMaps(cons, atTest ? resolveDeps(consOf(sub, outcome), atTest) : consOf(sub, outcome)); testedWhen(sub, outcome, r); }
         said = said ? joinMaps(said, cons) : cons;
         ran = ran ? new Map([...ran].filter(([k]) => r.has(k))) : r;
       }