@portll/cobolwork 0.4.0 → 0.6.0

package/lib/dataflow.mjs

@@ -11,13 +11,23 @@ import { parseCsd, ddOfQueue } from './csd.mjs';
 import { loadSite } from './site.mjs';
 import { ssrangeAbends } from './options.mjs';
 import { isJcl } from './sources.mjs';
-import { eachWithinMemory, watchMemoryBuffer } from './kernel/memory.mjs';
+import { watchMemoryBuffer } from './kernel/memory.mjs';
+import { drive, loopOver } from './kernel/shared-pass.mjs';
+import { keep, parseOrder, restore, sameAnalysis } from './control-reuse.mjs';
+import { createHash } from 'node:crypto';
+
 // A flow finding is located by source and sink rather than by one path and line, so it keeps its
 // own comparator. The text comparison underneath it is the shared one.
 import { byText } from './kernel/findings.mjs';
-import { buildControl, creditOf, hasFact, topOf, within, wholeTop } from './control.mjs';
+import { buildControl, creditOf, hasFact, sparseFacts, topOf, within, wholeTop } from './control.mjs';
 import { directoryTree } from './kernel/source-tree.mjs';
 
+// Every reused control analysis checked against the program's own: for the equivalence runs and tests.
+const verifyReuse = () => process.env.COBOLWORK_VERIFY_REUSE === '1';
+// The size of program text from which a copy's control analysis is restored rather than redone. On
+// one repository of 14,500 copied small programs restoring took longer than analysing.
+const REUSE_MIN_BYTES = 256 * 1024;
+
 const OS_COMMAND_ROUTINE = /^(SYSTEM|C\$SYSTEM|CBL_EXEC_RUN_UNIT|CBL_GC_HOSTED|BXPSYSTM)$/i;
 
 export const SOURCE_KINDS = {
@@ -73,6 +83,58 @@ const computes = (st) => ARITHMETIC.has(st.verb) || st.counts === true || (st.fn
 const computedOnRoute = (state) => { for (let s = state; s; s = s.prev) if (s.why && s.why.computes) return true; return false; };
 const typedOnRoute = (state) => { for (let s = state; s; s = s.prev) if (s.node.typed) return true; return false; };
 
+// Most nodes are never a source or a sink. They share one empty list, frozen, so that adding to it
+// fails rather than reaching every node.
+const NO_ENDS = Object.freeze([]);
+const addSource = (n, x) => { if (n.sources === NO_ENDS) n.sources = []; n.sources.push(x); };
+const addSink = (n, x) => { if (n.sinks === NO_ENDS) n.sinks = []; n.sinks.push(x); };
+
+// What a check's condition says, as text that differs whenever anything a reader could observe
+// differs: property order, a set's order, undefined, -0 and NaN. Null for anything but plain data.
+function consKey(v) {
+  if (v === undefined) return 'u';
+  if (v === null) return 'n';
+  if (typeof v === 'number') return Object.is(v, -0) ? '#-0' : `#${v}`;
+  if (typeof v === 'string') return JSON.stringify(v);
+  if (typeof v === 'boolean') return v ? 't' : 'f';
+  if (typeof v !== 'object') return null;
+  const parts = v instanceof Set ? [...v] : Array.isArray(v) ? v : Object.getPrototypeOf(v) === Object.prototype ? null : undefined;
+  if (parts === undefined) return null;
+  const keys = parts ? parts.map(consKey) : Object.keys(v).map((k) => { const s = consKey(v[k]); return s === null ? null : `${JSON.stringify(k)}:${s}`; });
+  if (keys.includes(null)) return null;
+  return `${v instanceof Set ? 'S' : parts ? 'A' : 'O'}[${keys.join(',')}]`;
+}
+
+// The facts a program keeps per statement: one copy of each distinct set, held as the numbers of the
+// facts in it, all in one buffer per program. Neighbouring statements mostly hold the same checks, and
+// few of a program's checks hold at any one statement: 26 large programs kept 1.5 GB of bitsets, 0.4%
+// of their bits set.
+function internFacts(facts) {
+  const byHash = new Map();
+  const kept = [];
+  const keptAt = new Map();
+  for (const [point, bits] of facts) {
+    let h = 2166136261;
+    for (let i = 0; i < bits.length; i++) h = Math.imul(h ^ bits[i], 16777619);
+    let same = byHash.get(h);
+    if (!same) byHash.set(h, same = []);
+    let k = same.find((x) => x.bits.length === bits.length && x.bits.every((v, i) => v === bits[i]));
+    if (!k) { same.push(k = { bits, held: sparseFacts(bits) }); kept.push(k); }
+    keptAt.set(point, k);
+  }
+  let size = 0;
+  for (const k of kept) if (k.held instanceof Uint16Array) size += k.held.length;
+  const pool = new Uint16Array(size);
+  let at = 0;
+  for (const k of kept) {
+    if (!(k.held instanceof Uint16Array)) continue;
+    pool.set(k.held, at);
+    k.held = pool.subarray(at, at += k.held.length);
+  }
+  for (const [point, k] of keptAt) facts.set(point, k.held);
+  return facts;
+}
+
 // Every literal a program holds that could be a program name: its VALUE clauses and the literals its
 // statements and commands use. A menu that XCTLs through a table of names starts every one of them.
 function literalNames(prog) {
@@ -174,7 +236,7 @@ function execOptions(exec) {
   return { opts, words };
 }
 
-export function analyze(root, opts = {}) {
+export function* analyzeSteps(root, opts = {}) {
   const repos = opts.repos || [''];
   const stats = { files: 0, programs: 0, edges: 0, nodes: 0, threw: 0, overBudget: 0, unreadable: 0, ebcdic: 0,
     jclFiles: 0, jclSteps: 0, jclStepsResolved: 0, jclCrossings: 0,
@@ -189,6 +251,9 @@ export function analyze(root, opts = {}) {
   // Every hop of every trace, for the reader who is following one chain rather than counting
   // findings. Off by default: a chain-shaped program turns this quadratic in the chain length.
   const fullTrace = opts.fullTrace === true;
+  // Every statement on any route from a finding's source to its sink, not only the route the trace
+  // names: what a run must have executed before it can show a value does not arrive (reach.md §9.8).
+  const allRoutes = opts.allRoutes === true;
   let held = 0;
 
   // Which files, not just how many. A count names nothing to go and look at, and it cannot tell
@@ -216,10 +281,35 @@ export function analyze(root, opts = {}) {
   const rel = (p) => { let r = relOf.get(p); if (r === undefined) { r = relPath(root, p); relOf.set(p, r); } return r; };
   // `at` is the statement an edge that is not a statement's own is read at: the CALL or LINK that
   // passes an argument, the PUT or GET of a container.
-  // `link` marks an edge into a callee at a call site ({ call }) or back out to it ({ ret }).
+  // `link` marks an edge into a callee at a call site ({ call }) or back out to it ({ ret }), and
+  // `stmt` names the statement that carries an edge whose `why` is text.
+  // Edges are kept as columns and laid out by source node before the walk. Most are a group's, a
+  // REDEFINES' or a RENAMES', and those share one record of why they exist.
+  const edgeFrom = [];
+  const edgeTo = [];
+  const edgeMeta = [];
+  const sharedMeta = new Map();
+  // Checks share a condition with the same content: 107,547 conditions of 66 Unieuro programs had
+  // 2,423 contents. Conditions are read and never changed once the check model has made them.
+  const conditions = new Map();
+  const sameCondition = (c) => {
+    const k = c ? consKey(c) : null;
+    if (k === null) return c;
+    let kept = conditions.get(k);
+    if (!kept) conditions.set(k, kept = c);
+    return kept;
+  };
   const edge = (a, b, why, dir, at, link) => {
     if (!a || !b || a === b) return;
-    a.edgesOut.push({ to: b, why, dir, ...(at != null ? { at } : {}), ...link });
+    let meta;
+    if (typeof why === 'string' && at == null && !link) {
+      const k = `${why}|${dir || ''}`;
+      meta = sharedMeta.get(k);
+      if (!meta) sharedMeta.set(k, meta = { why, dir });
+    } else meta = { why, dir, ...(at != null ? { at } : {}), ...link };
+    edgeFrom.push(a.id);
+    edgeTo.push(b.id);
+    edgeMeta.push(meta);
     stats.edges++;
   };
   let callSites = 0;
@@ -227,7 +317,52 @@ export function analyze(root, opts = {}) {
   // Everything the graph needs from one program is taken while its parse tree is in hand, and the
   // tree is then released. Holding every tree until the end is what exhausted a 4 GB heap on an
   // 8,024-file repository; nodes, edges and a few cross-program sites are all that survive.
-  function summarise(prog, file, pk, options = []) {
+  // A flow node holds what differs between nodes. Its program and file come from the program it
+  // belongs to, and every other field from the class until the node sets its own.
+  const programOf = [];
+  class FlowNode {
+    constructor(id, pk, name) { this.id = id; this.pk = pk; this.name = name; }
+    get program() { return programOf[this.pk].id; }
+    get file() { return programOf[this.pk].file; }
+  }
+  Object.assign(FlowNode.prototype, { off: null, size: null, repeats: false, sources: NO_ENDS, sinks: NO_ENDS });
+
+  // A program whose text another program file repeats has its control analysis kept for the copies,
+  // keyed by its place in its file and by what each copybook it resolved holds (lib/control-reuse.mjs).
+  // Only a large one: below REUSE_MIN_BYTES (opts.reuseMinBytes) keeping and restoring costs more
+  // than analysing again.
+  const reuseMin = opts.reuseMinBytes ?? REUSE_MIN_BYTES;
+  const textKey = (src) => createHash('sha1').update(src).digest('base64');
+  function repeatedTexts(tree, files) {
+    const count = new Map();
+    for (const f of files) {
+      let src;
+      try { src = tree.text(f).text; } catch { continue; }
+      if (src.length < reuseMin) continue;
+      const k = textKey(src);
+      count.set(k, (count.get(k) || 0) + 1);
+    }
+    const out = new Map();
+    for (const [k, n] of count) if (n > 1) out.set(k, { text: k, left: n, kept: new Map() });
+    return out;
+  }
+  const copyText = new Map();
+  const copyKey = (r, tree) => r.copies.map((c) => {
+    if (!c.path) return `${c.status}:${c.name}`;
+    if (!copyText.has(c.path)) { let k = null; try { k = textKey(tree.text(c.path).text); } catch { /* unread: compared by status */ } copyText.set(c.path, k); }
+    return `${c.status}:${copyText.get(c.path)}`;
+  }).join('|');
+  const reuseOf = (copied, k, r, f, tree) => ({ kept: copied.kept, key: `${k}|${copyKey(r, tree)}`, files: [f, ...r.copies.filter((c) => c.path).map((c) => c.path)] });
+  // A reused analysis checked against the program's own, where COBOLWORK_VERIFY_REUSE asks.
+  function sameAsOwn(ctl, prog, resolver, file) {
+    let own = null;
+    try { own = buildControl(prog, resolver); } catch { /* the kept one threw too, or it differs */ }
+    if (own) internFacts(own.facts);
+    if (!own !== !ctl || (own && !sameAnalysis(own, ctl, new Set(parseOrder(prog))))) throw new Error(`the control analysis reused for ${file} differs from its own`);
+  }
+
+  function summarise(prog, file, pk, options = [], reuse = null) {
+    programOf[pk] = { id: prog.id, file };
     const byItem = new Map();
     const byName = new Map();
     for (const it of prog.items) if (!byName.has(it.name)) byName.set(it.name, it);
@@ -241,7 +376,11 @@ export function analyze(root, opts = {}) {
         for (let a = item; a; a = a.parent) if ((a.occurs || 1) > 1) { repeats = true; table = a; }
         let top = item;
         while (top.parent) top = top.parent;
-        n = { id: nodes.length, pk, program: prog.id, file, name: item.name, off: item.offset ?? null, size: item.size ?? null, repeats, edgesOut: [], sources: [], sinks: [], ...(top.section === 'LINKAGE' ? { linkage: true } : {}) };
+        n = new FlowNode(nodes.length, pk, item.name);
+        n.off = item.offset ?? null;
+        n.size = item.size ?? null;
+        if (repeats) n.repeats = true;
+        if (top.section === 'LINKAGE') n.linkage = true;
         // Where the outermost table holding this item sits in the record: every occurrence of the
         // item is somewhere inside it. A group's size already counts its occurrences; an
         // elementary item's is one element.
@@ -263,7 +402,7 @@ export function analyze(root, opts = {}) {
     const indexNode = (name) => {
       let n = indexNodes.get(name);
       if (!n) {
-        n = { id: nodes.length, pk, program: prog.id, file, name, off: null, size: null, repeats: false, edgesOut: [], sources: [], sinks: [] };
+        n = new FlowNode(nodes.length, pk, name);
         nodes.push(n);
         indexNodes.set(name, n);
         stats.nodes++;
@@ -277,12 +416,12 @@ export function analyze(root, opts = {}) {
     // constraints, so only SQLERRMC reaches the screen sink.
     const systemSource = (n, detail, at) => {
       const onlyTo = /^SQLERRMC\b/.test(detail) ? [...TO_CLIENT, 'screen'] : TO_CLIENT;
-      if (!n.sources.some((x) => x.kind === 'system-response')) n.sources.push({ kind: 'system-response', onlyTo, noCredit: true, ...at, detail });
+      if (!n.sources.some((x) => x.kind === 'system-response')) addSource(n, { kind: 'system-response', onlyTo, noCredit: true, ...at, detail });
     };
     const systemNode = (tok) => {
       let n = systemNodes.get(tok.u);
       if (!n) {
-        n = { id: nodes.length, pk, program: prog.id, file, name: tok.u, off: null, size: null, repeats: false, edgesOut: [], sources: [], sinks: [] };
+        n = new FlowNode(nodes.length, pk, tok.u);
         nodes.push(n);
         systemNodes.set(tok.u, n);
         stats.nodes++;
@@ -300,9 +439,20 @@ export function analyze(root, opts = {}) {
     // The program's statement order, where its structure could be read. Without it a check is
     // credited as it always was, wherever its field is used, and never clears anything.
     let ctl = null;
-    try {
-      ctl = buildControl(prog, (tok) => itemOfToken(tok) || (tok && tok.t === 'word' && indexNames.has(tok.u) ? { index: tok.u } : null));
-    } catch { stats.programsUnordered++; }
+    const resolver = (tok) => itemOfToken(tok) || (tok && tok.t === 'word' && indexNames.has(tok.u) ? { index: tok.u } : null);
+    const kept = reuse && reuse.kept.get(reuse.key);
+    if (kept) {
+      ctl = kept.threw ? null : restore(kept.value, parseOrder(prog), reuse.files);
+      if (!ctl) stats.programsUnordered++;
+      if (verifyReuse()) sameAsOwn(ctl, prog, resolver, file);
+    } else {
+      try { ctl = buildControl(prog, resolver); } catch { stats.programsUnordered++; }
+      if (ctl) internFacts(ctl.facts);
+      if (reuse) {
+        const value = ctl ? keep(ctl, parseOrder(prog), reuse.files) : null;
+        if (!ctl || value) reuse.kept.set(reuse.key, ctl ? { value } : { threw: true });
+      }
+    }
     const pointOf = (x) => (ctl ? ctl.nodeOf.get(x) : undefined);
     // Where a name inside a condition is read, which can know more than the statement does.
     const placeOf = (tok, st) => (ctl && ctl.posOf.get(tok)) ?? pointOf(st);
@@ -319,7 +469,7 @@ export function analyze(root, opts = {}) {
       const device = upon >= 0 && st.sources[upon + 1] ? ` UPON ${st.sources[upon + 1].u}` : '';
       for (const t of upon >= 0 ? st.sources.slice(0, upon) : st.sources) {
         const n = nodeOfToken(t);
-        if (n) n.sinks.push({ kind: 'log', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `DISPLAY ${n.name}${device}` });
+        if (n) addSink(n, { kind: 'log', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `DISPLAY ${n.name}${device}` });
       }
     }
     // The document XML PARSE reads is the operand after PARSE; what the parser does with a DTD in
@@ -327,7 +477,7 @@ export function analyze(root, opts = {}) {
     for (const st of prog.statements) {
       if (st.verb !== 'XML' || !st.sources[0] || st.sources[0].u !== 'PARSE') continue;
       const n = st.sources[1] ? nodeOfToken(st.sources[1]) : null;
-      if (n) n.sinks.push({ kind: 'xml-document', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `XML PARSE ${n.name}` });
+      if (n) addSink(n, { kind: 'xml-document', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `XML PARSE ${n.name}` });
     }
     for (const it of prog.items) {
       const n = nodeOf(it);
@@ -363,7 +513,7 @@ export function analyze(root, opts = {}) {
       for (const it of prog.items) { const top = recordOf(it); if (!byRecord.has(top)) byRecord.set(top, []); byRecord.get(top).push(it); }
       const extent = (it) => (it.offset != null && it.size != null ? [it.offset, it.offset + (it.contributes || it.size)] : null);
       for (const c of ctl.checks) {
-        const entry = { x: c.x, t: c.t, f: c.f, tCons: c.tCons, fCons: c.fCons, file: c.file, line: c.line, item: c.field.index || c.field.name, ...(c.bounds ? { bounds: c.bounds } : {}), ...(c.mono ? { mono: true } : {}) };
+        const entry = { x: c.x, t: c.t, f: c.f, tCons: sameCondition(c.tCons), fCons: sameCondition(c.fCons), file: c.file, line: c.line, item: c.field.index || c.field.name, ...(c.bounds ? { bounds: c.bounds } : {}), ...(c.mono ? { mono: true } : {}) };
         if (c.field.index) { (indexNode(c.field.index).checks ||= []).push(entry); continue; }
         const span = extent(c.field);
         for (const it of byRecord.get(recordOf(c.field)) || [c.field]) {
@@ -451,7 +601,7 @@ export function analyze(root, opts = {}) {
         if (indexed.has(use)) continue;
         indexed.add(use);
         const start = kind === 'reference-modification' && x.from && base != null ? startOf(x.from, idx, base) : null;
-        at.sinks.push({
+        addSink(at, {
           kind, onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point, group: `${pk}|${key}`, limit, ...(start ? { start } : {}), ...(offset ? { offset } : {}), ...(offset > 0 && idx && unsignedWhole(idx) ? { nonNeg: true } : {}), ...(ssrange ? { ssrange } : {}),
           detail: kind === 'subscript'
             ? `${at.name} subscripts ${host.name}, a table of ${table.occurs}`
@@ -482,7 +632,7 @@ export function analyze(root, opts = {}) {
           const use = `${key}|${pointOf(st) ?? `s${st.at}`}`;
           if (indexed.has(use)) continue;
           indexed.add(use);
-          nodeOf(it).sinks.push({
+          addSink(nodeOf(it), {
             kind: 'loop-bound', onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point: pointOf(st), group: `${pk}|${key}`, limit: limitOf(walks.host, walks.table), counterUses: bodyUses(st, usesOf.get(counter)), ...(ssrange ? { ssrange } : {}),
             detail: `${it.name} decides where PERFORM VARYING ${counter} stops, and ${counter} subscripts ${walks.host.name}, a table of ${walks.table.occurs}`,
           });
@@ -503,7 +653,7 @@ export function analyze(root, opts = {}) {
         const use = `arithmetic|${n.id}|${pointOf(st) ?? `s${st.at}`}`;
         if (indexed.has(use)) continue;
         indexed.add(use);
-        n.sinks.push({
+        addSink(n, {
           kind: 'arithmetic', onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point: pointOf(st), group: `${pk}|arithmetic|${n.id}`,
           detail: `${it.name} (PIC ${it.picture}${it.effectiveUsage && it.effectiveUsage !== 'DISPLAY' ? ` ${it.effectiveUsage}` : ''}) is an operand of ${st.verb}${numproc === 'PFD' ? ', compiled NUMPROC(PFD), which repairs no sign' : ''}`,
         });
@@ -525,7 +675,7 @@ export function analyze(root, opts = {}) {
       const sts = touching.get(it);
       for (const st of sts.length ? sts : [null]) {
         const point = st ? pointOf(st) : undefined;
-        nodeOf(count).sinks.push({
+        addSink(nodeOf(count), {
           kind: 'occurs-depending-count', onlyFrom: FROM_OUTSIDE, file: it.file, line: it.line, ...(st ? { point, group: `${pk}|odo|${it.name}` } : {}), top: it.occurs, ...(ssrange ? { ssrange } : {}),
           detail: `${count.name} sets how many ${it.name} entries there are, up to ${it.occurs}`,
         });
@@ -535,18 +685,18 @@ export function analyze(root, opts = {}) {
       if (st.verb !== 'READ' && st.verb !== 'RETURN') continue;
       for (const t of st.targets) {
         const n = nodeOfToken(t);
-        if (n) n.sources.push({ kind: 'file-record', file: st.file, line: st.line, detail: `${st.verb} ... INTO` });
+        if (n) addSource(n, { kind: 'file-record', file: st.file, line: st.line, detail: `${st.verb} ... INTO` });
       }
     }
     for (const fd of prog.fds || []) for (const rec of fd.records || []) {
       const readsFile = prog.statements.some(st => (st.verb === 'READ') && st.sources.concat(st.targets).some(t => t.u === fd.name));
-      if (readsFile) nodeOf(rec).sources.push({ kind: 'file-record', file: fd.file, line: fd.line, detail: `record of file ${fd.name}` });
+      if (readsFile) addSource(nodeOf(rec), { kind: 'file-record', file: fd.file, line: fd.line, detail: `record of file ${fd.name}` });
     }
     for (const a of prog.accepts) {
       const item = (a.targetTok ? itemOfToken(a.targetTok) : null) || byName.get(a.target);
       if (!item) continue;
       const kind = /^(COMMAND-LINE|ARGUMENT-VALUE|ENVIRONMENT|ENVIRONMENT-VALUE)$/.test(a.from || '') ? 'argv-or-env' : null;
-      if (kind) nodeOf(item).sources.push({ kind, file: a.file, line: a.line, detail: `ACCEPT ... FROM ${a.from}` });
+      if (kind) addSource(nodeOf(item), { kind, file: a.file, line: a.line, detail: `ACCEPT ... FROM ${a.from}` });
     }
     // A SELECT assigns either to a data item, which makes the path dynamic, or to an external
     // name. On z/OS that external name is the DD name a JCL step fills, and it is how a job's
@@ -557,7 +707,7 @@ export function analyze(root, opts = {}) {
       if (f.assign.t === 'word') {
         const item = byName.get(f.assign.v);
         if (item) {
-          nodeOf(item).sinks.push({ kind: 'dynamic-file-path', file: f.file, line: f.line, detail: `SELECT ${f.name} ASSIGN TO ${f.assign.v}` });
+          addSink(nodeOf(item), { kind: 'dynamic-file-path', file: f.file, line: f.line, detail: `SELECT ${f.name} ASSIGN TO ${f.assign.v}` });
           continue;                       // a variable path is not a DD name
         }
       }
@@ -566,7 +716,9 @@ export function analyze(root, opts = {}) {
       if (!external) continue;
       const fd = (prog.fds || []).find((x) => x.name === f.name);
       const recs = (fd?.records || []).map(nodeOf);
-      if (recs.length) ddFiles.push({ dd: external, nodes: recs, file: f.file, line: f.line, select: f.name });
+      // READ ... INTO moves the record it read into an item, which then holds the DD's data too.
+      const into = prog.statements.filter((st) => st.verb === 'READ' && st.sources[0]?.u === f.name).flatMap((st) => st.targets.map(nodeOfToken).filter(Boolean));
+      if (recs.length) ddFiles.push({ dd: external, nodes: recs, into, file: f.file, line: f.line, select: f.name });
     }
     const topOf = (it) => { let t = it; while (t && t.parent) t = t.parent; return t; };
     const ownParams = new Set((prog.paramTokens || []).map((pt) => topOf(itemOfToken(pt.tok))).filter(Boolean));
@@ -589,14 +741,14 @@ export function analyze(root, opts = {}) {
       const point = pointOf(prog.statements[c.stmtIndex]);
       if (c.kind === 'I') {
         const n = nodeOfToken(c.targetTok);
-        if (n) n.sinks.push({ kind: 'dynamic-program-load', file: c.file, line: c.line, point, detail: `CALL ${c.name}` });
+        if (n) addSink(n, { kind: 'dynamic-program-load', file: c.file, line: c.line, point, detail: `CALL ${c.name}` });
         continue;
       }
       callSites.push({ name: String(c.name).toUpperCase(), display: c.name, file: c.file, line: c.line, point, args: c.using.map(a => ({ node: a.tok ? nodeOfToken(a.tok) : null, mode: a.mode, extent: a.tok ? argExtent(itemOfToken(a.tok)) : null })) });
       if (OS_COMMAND_ROUTINE.test(c.name)) {
         for (const a of c.using) {
           const n = a.tok ? nodeOfToken(a.tok) : null;
-          if (n) n.sinks.push({ kind: 'os-command', file: c.file, line: c.line, point, detail: `CALL '${c.name}' USING ${a.word}` });
+          if (n) addSink(n, { kind: 'os-command', file: c.file, line: c.line, point, detail: `CALL '${c.name}' USING ${a.word}` });
         }
       } else if (SOCKET_ROUTINE.test(c.name)) {
         // IBM's own examples hold the function code in a field: 01 SOC-FUNCTION PIC X(16) VALUE 'SEND'.
@@ -607,23 +759,23 @@ export function analyze(root, opts = {}) {
         if (fn && SOCKET_SEND.test(String(fn).trim())) {
           for (const a of c.using.slice(1)) {
             const n = a.tok ? nodeOfToken(a.tok) : null;
-            if (n) n.sinks.push({ kind: 'socket-send', onlyFrom: DATA_AT_REST, file: c.file, line: c.line, point, detail: `CALL '${c.name}' ${String(fn).trim()} USING ${a.word}` });
+            if (n) addSink(n, { kind: 'socket-send', onlyFrom: DATA_AT_REST, file: c.file, line: c.line, point, detail: `CALL '${c.name}' ${String(fn).trim()} USING ${a.word}` });
           }
         }
       } else if (Object.hasOwn(MQ_BUFFER_ARG, String(c.name).toUpperCase())) {
         const a = c.using[MQ_BUFFER_ARG[String(c.name).toUpperCase()]];
         const n = a && a.tok ? nodeOfToken(a.tok) : null;
-        if (n) n.sinks.push({ kind: 'message-queue', onlyFrom: DATA_AT_REST, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with buffer ${a.word}` });
+        if (n) addSink(n, { kind: 'message-queue', onlyFrom: DATA_AT_REST, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with buffer ${a.word}` });
       } else if (/^MQCONNX?$/i.test(String(c.name))) {
         // MQCONN(QMgrName, Hconn, CompCode, Reason); MQCONNX puts its options second.
         const a = c.using[0];
         const n = a && a.tok ? nodeOfToken(a.tok) : null;
-        if (n) n.sinks.push({ kind: 'connection-target', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with queue manager ${a.word}, which decides the queue manager the program connects to` });
+        if (n) addSink(n, { kind: 'connection-target', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with queue manager ${a.word}, which decides the queue manager the program connects to` });
       } else if (String(c.name).toUpperCase() === 'CEEGTST') {
         // CEEGTST(heap id, size, address, feedback code): the size is the second argument.
         const a = c.using[1];
         const n = a && a.tok ? nodeOfToken(a.tok) : null;
-        if (n) n.sinks.push({ kind: 'storage-length', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL 'CEEGTST' with size ${a.word}, which decides how much heap storage is acquired` });
+        if (n) addSink(n, { kind: 'storage-length', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL 'CEEGTST' with size ${a.word}, which decides how much heap storage is acquired` });
       }
     }
     const transfers = [];
@@ -639,7 +791,10 @@ export function analyze(root, opts = {}) {
     const containerNode = (name) => {
       let n = containers.get(name);
       if (!n) {
-        n = { id: nodes.length, pk, program: prog.id, file, name: `CONTAINER(${name})`, edgesOut: [], sources: [], sinks: [] };
+        n = new FlowNode(nodes.length, pk, `CONTAINER(${name})`);
+        n.off = undefined;
+        n.size = undefined;
+        n.repeats = undefined;
         nodes.push(n);
         containers.set(name, n);
         stats.nodes++;
@@ -727,7 +882,7 @@ export function analyze(root, opts = {}) {
         if (typed) continue;
         stats.protectedFields++;
         const back = field.effective.has('FSET') ? ' with FSET' : '';
-        n.sources.push({ kind: 'cics-protected-field', onlyTo: ['record-key', 'record-update'], ...at,
+        addSource(n, { kind: 'cics-protected-field', onlyTo: ['record-key', 'record-update'], ...at,
           detail: `EXEC CICS RECEIVE MAP(${map.name}) returns ${item.name}, field ${field.name} of map ${map.name} in mapset ${mapset.name}, which the map marks ${marks.join(' and ')}${field.attrb ? '' : ' by default'}${back}` });
       }
     };
@@ -754,17 +909,17 @@ export function analyze(root, opts = {}) {
         if (verb === 'WRITE' && ['OPERATOR', 'JOURNALNAME', 'JOURNALNUM'].includes(words[1])) {
           const opt = words[1] === 'OPERATOR' ? 'TEXT' : 'FROM';
           const n = nodeOfToken((o.get(opt) || [])[0]);
-          if (n) n.sinks.push({ kind: 'log', onlyFrom: REFLECTED, ...at, detail: `EXEC CICS WRITE ${words[1]} ${opt}(${n.name}), ${words[1] === 'OPERATOR' ? 'to the operator console' : 'to a journal'}` });
+          if (n) addSink(n, { kind: 'log', onlyFrom: REFLECTED, ...at, detail: `EXEC CICS WRITE ${words[1]} ${opt}(${n.name}), ${words[1] === 'OPERATOR' ? 'to the operator console' : 'to a journal'}` });
         }
         if (verb === 'RECEIVE') {
           const isWeb = words.includes('WEB');
           const n = nodeOfToken(intoTok);
-          if (n) n.sources.push({ kind: isWeb ? 'cics-web' : 'cics-terminal', ...at, detail: `EXEC CICS ${isWeb ? 'WEB ' : ''}RECEIVE` });
+          if (n) addSource(n, { kind: isWeb ? 'cics-web' : 'cics-terminal', ...at, detail: `EXEC CICS ${isWeb ? 'WEB ' : ''}RECEIVE` });
           // RECEIVE MAP with no INTO fills the symbolic map, whose input record is <map>I.
           const map = optionName(o, 'MAP');
           if (!n && map) {
             const sym = byName.get(`${map}I`);
-            if (sym) nodeOf(sym).sources.push({ kind: 'cics-terminal', ...at, detail: `EXEC CICS RECEIVE MAP(${map}) into the symbolic map` });
+            if (sym) addSource(nodeOf(sym), { kind: 'cics-terminal', ...at, detail: `EXEC CICS RECEIVE MAP(${map}) into the symbolic map` });
           }
           if (!isWeb && o.has('MAP')) receiveMap(e, o, itemOfToken(intoTok), at);
         }
@@ -774,7 +929,7 @@ export function analyze(root, opts = {}) {
           const map = words[1] === 'MAP' ? optionName(o, 'MAP') : null;
           const sym = !from && map ? byName.get(`${map}O`) : null;
           const n = from || (sym ? nodeOf(sym) : null);
-          if (n) n.sinks.push({ kind: 'screen', onlyFrom: ['system-response'], ...at, detail: `EXEC CICS SEND ${words[1]}${map ? `(${map})` : ''}${from ? ` FROM(${n.name})` : ', from its symbolic map'}, to the terminal` });
+          if (n) addSink(n, { kind: 'screen', onlyFrom: ['system-response'], ...at, detail: `EXEC CICS SEND ${words[1]}${map ? `(${map})` : ''}${from ? ` FROM(${n.name})` : ', from its symbolic map'}, to the terminal` });
         }
         // RIDFLD decides which record a READ or DELETE reaches, or where a browse starts. A key the
         // user types is how a lookup works; a key the program put in a protected field and read back
@@ -786,18 +941,18 @@ export function analyze(root, opts = {}) {
           const detail = verb === 'DELETE' ? `EXEC CICS DELETE RIDFLD(${k && k.name}), which decides which record it deletes`
             : then ? `EXEC CICS READ UPDATE RIDFLD(${k && k.name}), which decides which record the program then ${then}`
               : `EXEC CICS ${verb} RIDFLD(${k && k.name}), which decides which record it reaches`;
-          if (k) k.sinks.push({ kind: verb === 'DELETE' || then ? 'record-update' : 'record-key', onlyFrom: ['cics-protected-field'], noCredit: true, ...at, detail });
+          if (k) addSink(k, { kind: verb === 'DELETE' || then ? 'record-update' : 'record-key', onlyFrom: ['cics-protected-field'], noCredit: true, ...at, detail });
         }
         if (verb === 'GETMAIN') {
           for (const opt of ['FLENGTH', 'LENGTH']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'storage-length', onlyFrom: REFLECTED, ...at, detail: `EXEC CICS GETMAIN ${opt}(${n.name}), which decides how much storage is acquired` });
+            if (n) addSink(n, { kind: 'storage-length', onlyFrom: REFLECTED, ...at, detail: `EXEC CICS GETMAIN ${opt}(${n.name}), which decides how much storage is acquired` });
           }
         }
         if (verb === 'PUT' && o.has('CONTAINER')) {
           const name = optionName(o, 'CONTAINER');
           const from = nodeOfToken((o.get('FROM') || [])[0]);
-          if (name && from) edge(from, containerNode(name), `EXEC CICS PUT CONTAINER(${name})`, undefined, at.point);
+          if (name && from) edge(from, containerNode(name), `EXEC CICS PUT CONTAINER(${name})`, undefined, at.point, { stmt: { verb: 'EXEC CICS PUT', file: rel(at.file), line: at.line } });
           if (name) channelOf.set(name, optionName(o, 'CHANNEL'));
         }
         // A service call sends every container on its channel, and its URI decides where they go.
@@ -805,22 +960,22 @@ export function analyze(root, opts = {}) {
           invokes.push({ at, what: words[1], channel: optionName(o, 'CHANNEL') });
           for (const opt of ['URI', 'URIMAP']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'outbound-host', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS INVOKE ${words[1]} ${opt}(...), which decides where the request goes` });
+            if (n) addSink(n, { kind: 'outbound-host', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS INVOKE ${words[1]} ${opt}(...), which decides where the request goes` });
           }
         }
         if (verb === 'GET' && o.has('CONTAINER')) {
           const name = optionName(o, 'CONTAINER');
           const into = nodeOfToken((o.get('INTO') || o.get('SET') || [])[0]);
-          if (name && into) edge(containerNode(name), into, `EXEC CICS GET CONTAINER(${name})`, undefined, at.point);
+          if (name && into) edge(containerNode(name), into, `EXEC CICS GET CONTAINER(${name})`, undefined, at.point, { stmt: { verb: 'EXEC CICS GET', file: rel(at.file), line: at.line } });
         }
         // CONVERSE is always a client call; SEND is one only on a session this program opened. A
         // plain WEB SEND answers the request that started the program, which is its job.
         if (verb === 'WEB' && (words[1] === 'CONVERSE' || (words[1] === 'SEND' && o.has('SESSTOKEN')))) {
           const n = nodeOfToken((o.get('FROM') || [])[0]);
-          if (n) n.sinks.push({ kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...at, detail: `EXEC CICS WEB ${words[1]} to a remote server` });
+          if (n) addSink(n, { kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...at, detail: `EXEC CICS WEB ${words[1]} to a remote server` });
           // The request may be a container rather than a field.
           const sent = o.has('CONTAINER') ? optionName(o, 'CONTAINER') : null;
-          if (sent) containerNode(sent).sinks.push({ kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...at, detail: `EXEC CICS WEB ${words[1]} sending CONTAINER(${sent})` });
+          if (sent) addSink(containerNode(sent), { kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...at, detail: `EXEC CICS WEB ${words[1]} sending CONTAINER(${sent})` });
         }
         // The response this program returns to its own caller, and the document built for it. CICS
         // escapes nothing on the way out - DOCUMENT SET's UNESCAPED option is about URL decoding,
@@ -832,25 +987,25 @@ export function analyze(root, opts = {}) {
           // defect whatever the reply holds.
           const media = (o.get('MEDIATYPE') || [])[0];
           const markup = media && media.t === 'lit' && /html|xml|svg/i.test(String(media.v));
-          if (n) n.sinks.push({ kind: 'web-response', onlyFrom: [...(markup ? IN_CICS : REFLECTED), 'system-response'], ...at, detail: `EXEC CICS WEB SEND answering this program's caller${markup ? ` as ${String(media.v).trim()}` : ''}` });
+          if (n) addSink(n, { kind: 'web-response', onlyFrom: [...(markup ? IN_CICS : REFLECTED), 'system-response'], ...at, detail: `EXEC CICS WEB SEND answering this program's caller${markup ? ` as ${String(media.v).trim()}` : ''}` });
         }
         if (verb === 'DOCUMENT') {
           const what = words[1] === 'SET' ? ['VALUE', 'SYMBOLLIST'] : ['TEXT', 'FROM', 'BINARY'];
           for (const opt of what) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'web-response', onlyFrom: [...IN_CICS, 'system-response'], ...at, detail: `EXEC CICS DOCUMENT ${words[1]} ${opt}(...), which is sent as the response` });
+            if (n) addSink(n, { kind: 'web-response', onlyFrom: [...IN_CICS, 'system-response'], ...at, detail: `EXEC CICS DOCUMENT ${words[1]} ${opt}(...), which is sent as the response` });
           }
         }
         if (verb === 'WEB' && words[1] === 'WRITE' && o.has('HTTPHEADER')) {
           for (const opt of ['HTTPHEADER', 'VALUE']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'http-header', onlyFrom: [...IN_CICS, 'system-response'], ...at, detail: `EXEC CICS WEB WRITE HTTPHEADER ${opt}(...)` });
+            if (n) addSink(n, { kind: 'http-header', onlyFrom: [...IN_CICS, 'system-response'], ...at, detail: `EXEC CICS WEB WRITE HTTPHEADER ${opt}(...)` });
           }
         }
         if (verb === 'WEB' && (words[1] === 'OPEN' || words[1] === 'CONVERSE')) {
           for (const opt of ['HOST', 'URIMAP', 'PATH']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'outbound-host', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS WEB ${words[1]} ${opt}(...), which decides where the request goes` });
+            if (n) addSink(n, { kind: 'outbound-host', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS WEB ${words[1]} ${opt}(...), which decides where the request goes` });
           }
         }
         // The queue a command acts on, as distinct from what it writes there: a name from input
@@ -859,7 +1014,7 @@ export function analyze(root, opts = {}) {
           const ts = words[1] === 'TS' || !words.includes('TD');
           for (const opt of ['QUEUE', 'QNAME']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'queue-name', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} ${ts ? 'TS' : 'TD'} ${opt}(...) names the queue` });
+            if (n) addSink(n, { kind: 'queue-name', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} ${ts ? 'TS' : 'TD'} ${opt}(...) names the queue` });
           }
         }
         // SYSID ships a command to the region it names; SET's first option names the resource a
@@ -867,20 +1022,20 @@ export function analyze(root, opts = {}) {
         // INQUIRE and EXTRACT return SYSID into the field rather than read it.
         if (o.has('SYSID') && !['ASSIGN', 'INQUIRE', 'EXTRACT'].includes(verb)) {
           const n = nodeOfToken((o.get('SYSID') || [])[0]);
-          if (n) n.sinks.push({ kind: 'cics-sysid', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} SYSID(${n.name}), which decides the region the command is shipped to` });
+          if (n) addSink(n, { kind: 'cics-sysid', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} SYSID(${n.name}), which decides the region the command is shipped to` });
         }
         if (verb === 'SET' && words[1] && o.has(words[1])) {
           const n = nodeOfToken((o.get(words[1]) || [])[0]);
-          if (n) n.sinks.push({ kind: 'cics-system-resource', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS SET ${words[1]}(${n.name}), which decides the resource the command changes` });
+          if (n) addSink(n, { kind: 'cics-system-resource', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS SET ${words[1]}(${n.name}), which decides the resource the command changes` });
         }
         if (verb === 'READ' || verb === 'READNEXT' || verb === 'READPREV') {
           const n = nodeOfToken(intoTok);
-          if (n && (o.has('FILE') || o.has('DATASET'))) n.sources.push({ kind: 'file-record', ...at, detail: `EXEC CICS ${verb} FILE ... INTO` });
+          if (n && (o.has('FILE') || o.has('DATASET'))) addSource(n, { kind: 'file-record', ...at, detail: `EXEC CICS ${verb} FILE ... INTO` });
         }
         // A CONVERSE response is the remote server's data, which is untrusted input like any other.
         if ((verb === 'WEB' && words[1] !== 'SEND') || verb === 'EXTRACT') {
           const n = nodeOfToken(intoTok);
-          if (n) n.sources.push({ kind: 'cics-web', ...at, detail: `EXEC CICS ${words.slice(0, 2).join(' ')}` });
+          if (n) addSource(n, { kind: 'cics-web', ...at, detail: `EXEC CICS ${words.slice(0, 2).join(' ')}` });
         }
         // Where a transient-data write lands is not in the program: the CSD maps the queue to a DD
         // and the region's JCL maps the DD to a destination. Collected here, resolved once every
@@ -897,13 +1052,13 @@ export function analyze(root, opts = {}) {
           const pgm = (o.get('PROGRAM') || o.get('TRANSID') || [])[0];
           if (pgm && pgm.t === 'word') {
             const n = nodeOfToken(pgm);
-            if (n) n.sinks.push({ kind: 'cics-dynamic-transfer', ...at, detail: `EXEC CICS ${verb} with a variable program name` });
+            if (n) addSink(n, { kind: 'cics-dynamic-transfer', ...at, detail: `EXEC CICS ${verb} with a variable program name` });
           }
           const commarea = (o.get('COMMAREA') || o.get('FROM') || [])[0];
           const argNode = commarea ? nodeOfToken(commarea) : null;
-          if (pgm && pgm.t === 'lit' && argNode) transfers.push({ verb, callee: pgm.v.toUpperCase(), argNode, point: at.point });
+          if (pgm && pgm.t === 'lit' && argNode) transfers.push({ verb, callee: pgm.v.toUpperCase(), argNode, point: at.point, file: at.file, line: at.line });
           else if (pgm && pgm.t === 'word' && argNode && o.has('PROGRAM')) {
-            for (const callee of programsNamed(pgm, e)) { transfers.push({ verb, callee, argNode, point: at.point, through: pgm.u }); transfersTo.add(callee); }
+            for (const callee of programsNamed(pgm, e)) { transfers.push({ verb, callee, argNode, point: at.point, file: at.file, line: at.line, through: pgm.u }); transfersTo.add(callee); }
           }
           if (pgm && pgm.t === 'lit') (o.has('TRANSID') && !o.has('PROGRAM') ? startsTransactions : transfersTo).add(String(pgm.v).trim().toUpperCase());
         }
@@ -921,7 +1076,7 @@ export function analyze(root, opts = {}) {
         for (const h of hv) {
           if (!h.written) continue;
           const n = nodeOfToken(h.tok);
-          if (n) n.sources.push({ kind: 'database', ...at, detail: `EXEC SQL ${verb} ${verb === 'SELECT' || verb === 'FETCH' ? 'INTO' : 'writes'} host variable` });
+          if (n) addSource(n, { kind: 'database', ...at, detail: `EXEC SQL ${verb} ${verb === 'SELECT' || verb === 'FETCH' ? 'INTO' : 'writes'} host variable` });
         }
         // The location CONNECT TO or SET CONNECTION names, where a host variable holds it; what
         // follows USER and USING is the credential, not the target.
@@ -929,19 +1084,19 @@ export function analyze(root, opts = {}) {
           const to = e.toks.findIndex((t) => t.t === 'word' && (t.u === 'TO' || t.u === 'CONNECTION'));
           const colon = to >= 0 ? e.toks[to + 1] : null;
           const n = colon && colon.t === 'op' && colon.v === ':' && e.toks[to + 2] ? nodeOfToken(e.toks[to + 2]) : null;
-          if (n) n.sinks.push({ kind: 'connection-target', onlyFrom: FROM_OUTSIDE, ...at, detail: `EXEC SQL ${verb === 'SET' ? 'SET CONNECTION' : 'CONNECT TO'} :${n.name}, which decides the database the program connects to` });
+          if (n) addSink(n, { kind: 'connection-target', onlyFrom: FROM_OUTSIDE, ...at, detail: `EXEC SQL ${verb === 'SET' ? 'SET CONNECTION' : 'CONNECT TO'} :${n.name}, which decides the database the program connects to` });
         }
         const dynamic = words.some((w, i) => w === 'PREPARE' || (w === 'EXECUTE' && words[i + 1] === 'IMMEDIATE'));
         if (dynamic) for (const h of hv) {
           const n = nodeOfToken(h.tok);
-          if (n) n.sinks.push({ kind: 'dynamic-sql', ...at, detail: `EXEC SQL ${words.slice(0, 2).join(' ')} from a host variable` });
+          if (n) addSink(n, { kind: 'dynamic-sql', ...at, detail: `EXEC SQL ${words.slice(0, 2).join(' ')} from a host variable` });
         }
       }
     }
     for (const inv of invokes) {
       for (const [name, channel] of channelOf) {
         if (inv.channel && channel && channel !== inv.channel) continue;
-        containerNode(name).sinks.push({ kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...inv.at, detail: `EXEC CICS INVOKE ${inv.what} sending CONTAINER(${name})${inv.channel ? ` on CHANNEL(${inv.channel})` : ''}` });
+        addSink(containerNode(name), { kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...inv.at, detail: `EXEC CICS INVOKE ${inv.what} sending CONTAINER(${name})${inv.channel ? ` on CHANNEL(${inv.channel})` : ''}` });
       }
     }
     const commareaItem = byName.get('DFHCOMMAREA');
@@ -991,7 +1146,8 @@ export function analyze(root, opts = {}) {
     // edges are proportional to data items and statements, not to bytes, so a repository of small
     // programs with large record layouts can exhaust a heap the budget believes is untouched. The
     // shared loop watches the heap itself, and the budget stays as the cheaper first line.
-    const run = eachWithinMemory(files, (f) => {
+    const repeated = repeatedTexts(tree, files);
+    const run = yield loopOver(files, (f) => {
       let src;
       try { const s = tree.text(f); src = s.text; if (s.encoding === 'ebcdic') stats.ebcdic++; } catch (e) { stats.unreadable++; unread.push(`${tree.rel(f)}: ${e.code || e.name}`); return 0; }
       if (!/PROCEDURE\s+DIVISION|PROGRAM-ID/i.test(src)) return 0;
@@ -1002,7 +1158,12 @@ export function analyze(root, opts = {}) {
         r = tree.parse(f, src);
       } catch (e) { stats.threw++; unparsed.push(`${tree.rel(f)}: ${e.code || e.name}`); return src.length; }
       stats.files++;
-      for (const p of r.programs) { programs.push(summarise(p, f, programs.length, r.options)); stats.programs++; }
+      const copied = src.length >= reuseMin && repeated.size ? repeated.get(textKey(src)) : undefined;
+      r.programs.forEach((p, k) => {
+        programs.push(summarise(p, f, programs.length, r.options, copied ? reuseOf(copied, k, r, f, tree) : null));
+        stats.programs++;
+      });
+      if (copied && --copied.left === 0) repeated.delete(copied.text);
       return src.length;
     }, { label: 'flow', watcher: memoryWatcher });
 
@@ -1046,22 +1207,24 @@ export function analyze(root, opts = {}) {
     for (const t of p.transfers) {
       const r = calleesOf(t.callee, p.file);
       const site = ++callSites;
+      const stmt = { verb: `EXEC CICS ${t.verb}`, file: rel(t.file), line: t.line };
       for (const callee of r.list) {
         if (!callee.commarea) continue;
-        edge(t.argNode, callee.commarea, `EXEC CICS ${t.verb} COMMAREA to ${t.callee}${t.through ? `, the program ${t.through} names` : ''}${ofN(r, t.callee)}`, undefined, t.point, { call: site });
-        if (t.verb === 'LINK') edge(callee.commarea, t.argNode, `COMMAREA returned from ${t.callee}${ofN(r, t.callee)}`, undefined, undefined, { ret: site });
+        edge(t.argNode, callee.commarea, `EXEC CICS ${t.verb} COMMAREA to ${t.callee}${t.through ? `, the program ${t.through} names` : ''}${ofN(r, t.callee)}`, undefined, t.point, { call: site, stmt });
+        if (t.verb === 'LINK') edge(callee.commarea, t.argNode, `COMMAREA returned from ${t.callee}${ofN(r, t.callee)}`, undefined, undefined, { ret: site, stmt });
       }
     }
     for (const c of p.callSites) {
       const r = calleesOf(c.name, p.file);
       const site = ++callSites;
+      const stmt = { verb: 'CALL', file: rel(c.file), line: c.line };
       for (const callee of r.list) {
         if (!callee.params) continue;
         c.args.forEach((arg, i) => {
           const param = callee.params[i];
           if (!param || !arg.node || !param.node) return;
-          edge(arg.node, param.node, `CALL '${c.display}' argument ${i + 1} at ${rel(c.file)}:${c.line}${ofN(r, c.display)}`, undefined, c.point, { call: site });
-          if (arg.mode === 'REFERENCE' && param.mode === 'REFERENCE') edge(param.node, arg.node, `CALL '${c.display}' argument ${i + 1} written back${ofN(r, c.display)}`, undefined, undefined, { ret: site });
+          edge(arg.node, param.node, `CALL '${c.display}' argument ${i + 1} at ${rel(c.file)}:${c.line}${ofN(r, c.display)}`, undefined, c.point, { call: site, stmt });
+          if (arg.mode === 'REFERENCE' && param.mode === 'REFERENCE') edge(param.node, arg.node, `CALL '${c.display}' argument ${i + 1} written back${ofN(r, c.display)}`, undefined, undefined, { ret: site, stmt });
         });
       }
       const callee = r.list.length === 1 ? r.list[0] : null;
@@ -1136,7 +1299,7 @@ export function analyze(root, opts = {}) {
           // followed by the text. A program with no USING cannot receive one, and saying it does
           // would be a path nobody could follow.
           if (run.parm !== null && callee.params && callee.params[0] && callee.params[0].node) {
-            callee.params[0].node.sources.push({
+            addSource(callee.params[0].node, {
               kind: 'jcl-parm', file: f, line: run.line,
               detail: `${run.how}, which runs ${run.pgm}${amb}`,
             });
@@ -1153,7 +1316,7 @@ export function analyze(root, opts = {}) {
               for (const m of callee.ddFiles || []) {
                 if (m.dd !== dd.name.toUpperCase()) continue;
                 for (const n of m.nodes) {
-                  n.sinks.push({ kind: 'internal-reader', file: m.file, line: m.line,
+                  addSink(n, { kind: 'internal-reader', file: m.file, line: m.line,
                     detail: `records written through SELECT ${m.select} to //${dd.name}, which step ${step.name || '(unnamed)'} of ${rel(f)} sends to the internal reader${amb}` });
                 }
               }
@@ -1161,8 +1324,8 @@ export function analyze(root, opts = {}) {
             if (!dd.inStream || !dd.inStream.length || !dd.name) continue;
             for (const m of callee.ddFiles || []) {
               if (m.dd !== dd.name.toUpperCase()) continue;
-              for (const n of m.nodes) {
-                n.sources.push({
+              for (const n of [...m.nodes, ...m.into]) {
+                addSource(n, {
                   kind: 'jcl-instream', file: f, line: dd.line,
                   detail: `${dd.inStream.length} lines of in-stream data on //${dd.name} in step ${step.name || '(unnamed)'}, read through SELECT ${m.select}${amb}`,
                 });
@@ -1231,21 +1394,21 @@ export function analyze(root, opts = {}) {
       const def = w.queue ? csd.tdqueues.get(w.queue) : null;
       const dd = w.queue ? ddOfQueue(csd, w.queue) : null;
       if (w.queue && (readerQueues.has(w.queue) || (dd && readerDds.has(dd)))) {
-        w.node.sinks.push({ kind: 'internal-reader', file: w.file, line: w.line, point: w.point,
+        addSink(w.node, { kind: 'internal-reader', file: w.file, line: w.line, point: w.point,
           detail: `EXEC CICS WRITEQ TD QUEUE('${w.queue}')${dd ? `, which the CSD sends to DD ${dd}` : ''}, declared as reaching the internal reader` });
         continue;
       }
       // Any other queue is where a region writes what it logs or prints, unless it starts a
       // transaction, when it is a channel to that transaction instead.
       if (!(def && def.transid)) {
-        w.node.sinks.push({ kind: 'log', onlyFrom: REFLECTED, file: w.file, line: w.line, point: w.point,
+        addSink(w.node, { kind: 'log', onlyFrom: REFLECTED, file: w.file, line: w.line, point: w.point,
           detail: `EXEC CICS WRITEQ TD QUEUE(${w.queue ? `'${w.queue}'` : 'a name the program computes'})` });
       }
       if (!w.queue) { stats.tdWritesUndecided++; continue; }
       if (def && def.type === 'INTRA') continue;
       // A queue the CSD sends to a DD leaves the region: to a dataset, a printer or another job.
       if (dd) {
-        w.node.sinks.push({ kind: 'extrapartition-queue', onlyFrom: DATA_AT_REST, file: w.file, line: w.line, point: w.point,
+        addSink(w.node, { kind: 'extrapartition-queue', onlyFrom: DATA_AT_REST, file: w.file, line: w.line, point: w.point,
           detail: `EXEC CICS WRITEQ TD QUEUE('${w.queue}'), which the CSD sends out of the region to DD ${dd}` });
       }
       if (!declared) stats.tdWritesUndecided++;
@@ -1253,6 +1416,19 @@ export function analyze(root, opts = {}) {
     }
   }
 
+  // Each node's edges, in the order they were added: outStart[id] up to outStart[id + 1] index outTo
+  // and outMeta.
+  const outStart = new Int32Array(nodes.length + 1);
+  for (let k = 0; k < edgeFrom.length; k++) outStart[edgeFrom[k] + 1]++;
+  for (let i = 0; i < nodes.length; i++) outStart[i + 1] += outStart[i];
+  const outTo = new Int32Array(edgeFrom.length);
+  const outMeta = new Array(edgeFrom.length);
+  {
+    const fill = outStart.slice(0, nodes.length);
+    for (let k = 0; k < edgeFrom.length; k++) { const at = fill[edgeFrom[k]]++; outTo[at] = edgeTo[k]; outMeta[at] = edgeMeta[k]; }
+    edgeFrom.length = 0; edgeTo.length = 0; edgeMeta.length = 0;
+  }
+
   // Only nodes that can reach some sink are worth walking into. One backward pass over a transient
   // reverse index answers that for every source at once; it is a superset, so nothing is lost.
   // Two answers, one bit each: whether a node reaches a sink a source at rest could be reported at,
@@ -1263,11 +1439,11 @@ export function analyze(root, opts = {}) {
   const canReach = new Uint8Array(nodes.length);
   {
     const revStart = new Int32Array(nodes.length + 1);
-    for (const n of nodes) for (const e of n.edgesOut) revStart[e.to.id + 1]++;
+    for (let k = 0; k < outTo.length; k++) revStart[outTo[k] + 1]++;
     for (let i = 0; i < nodes.length; i++) revStart[i + 1] += revStart[i];
     const fill = revStart.slice(0, nodes.length);
     const rev = new Int32Array(revStart[nodes.length]);
-    for (const n of nodes) for (const e of n.edgesOut) rev[fill[e.to.id]++] = n.id;
+    for (let id = 0; id < nodes.length; id++) for (let k = outStart[id]; k < outStart[id + 1]; k++) rev[fill[outTo[k]]++] = id;
     const mark = (bit, seeds) => {
       const queue = [];
       for (const n of nodes) if (seeds(n)) { canReach[n.id] |= bit; queue.push(n.id); }
@@ -1375,13 +1551,14 @@ export function analyze(root, opts = {}) {
     for (let i = 0; i < open.length; i++) {
       const st = open[i];
       for (const c of at.get(st.node.id) || []) if (!holds(st.since, c.sink.point, c.sink.kind, c.sink.limit, c.sink.offset, c.sink.nonNeg, c.sink)) lost.add(c);
-      for (const e of st.node.edgesOut) {
+      for (let k = outStart[st.node.id]; k < outStart[st.node.id + 1]; k++) {
         edgesWalked++;
-        const to = e.to;
+        const e = outMeta[k];
+        const to = nodes[outTo[k]];
         if (!(canReach[to.id] & reach)) continue;
         const mv = moves(e);
         if (mv && holds(st.since, pointOfEdge(e), kind, null, shift)) continue;
-        const t = cross(st, e);
+        const t = cross(st, e, to);
         if (!t) continue;
         const since = mv ? [to] : [...st.since, to];
         // An arrival carrying a checked node is refused more than one that does not, so it must not
@@ -1441,24 +1618,49 @@ export function analyze(root, opts = {}) {
   // it does not. Both walks below cross edges through this, so neither can take a route the other
   // would refuse.
   const known = (n) => n.off != null && n.size != null && !n.repeats;
-  // The call sites a value entered its callees through, innermost last, as a string; empty where any
-  // caller may be returned to: a value born in the callee, or one that rested in storage a program
-  // keeps between calls, which a later call from any caller can read.
+  // The call sites a value entered its callees through, innermost last, as a number standing for
+  // that sequence; 0 where any caller may be returned to: a value born in the callee, or one that
+  // rested in storage a program keeps between calls, which a later call from any caller can read.
   const CONTEXT_DEPTH = 4;
-  function contextOver(state, e) {
-    const ctx = state.ctx || '';
+  const contextSites = [[]];
+  const contextNumber = new Map([['', 0]]);
+  const entered = new Map();
+  const returned = new Map();
+  const contextOf = (sites) => {
+    const k = sites.join('/');
+    let c = contextNumber.get(k);
+    if (c === undefined) { c = contextSites.length; contextSites.push(sites); contextNumber.set(k, c); }
+    return c;
+  };
+  function contextOver(state, e, to) {
+    const ctx = state.ctx || 0;
     if (e.ret != null) {
-      if (!ctx) return '';
-      const sites = ctx.split('/');
-      return Number(sites[sites.length - 1]) === e.ret ? sites.slice(0, -1).join('/') : null;
+      if (!ctx) return 0;
+      let byRet = returned.get(ctx);
+      if (!byRet) returned.set(ctx, byRet = new Map());
+      let out = byRet.get(e.ret);
+      if (out === undefined) {
+        const sites = contextSites[ctx];
+        out = Number(sites[sites.length - 1]) === e.ret ? contextOf(sites.slice(0, -1)) : null;
+        byRet.set(e.ret, out);
+      }
+      return out;
     }
-    if (e.call != null) return [...(ctx ? ctx.split('/') : []), String(e.call)].slice(-CONTEXT_DEPTH).join('/');
-    return e.to.linkage ? ctx : '';
+    if (e.call != null) {
+      let byCall = entered.get(ctx);
+      if (!byCall) entered.set(ctx, byCall = new Map());
+      let out = byCall.get(e.call);
+      if (out === undefined) {
+        out = contextOf([...contextSites[ctx], String(e.call)].slice(-CONTEXT_DEPTH));
+        byCall.set(e.call, out);
+      }
+      return out;
+    }
+    return to.linkage ? ctx : 0;
   }
-  function cross(state, e) {
+  function cross(state, e, to) {
     const cur = state.node;
-    const to = e.to;
-    const ctx = contextOver(state, e);
+    const ctx = contextOver(state, e, to);
     if (ctx === null) return null;
     let partial = false, lo = 0, hi = 0, vague = false;
     if (opts.legacyGroupEdges) { /* every edge carries the whole item */ }
@@ -1498,6 +1700,44 @@ export function analyze(root, opts = {}) {
     }
     return { partial, lo, hi, vague, ctx };
   }
+  // The statement that carries an edge: null for storage that overlays storage, which runs nothing,
+  // and undefined where the engine does not know which statement it is.
+  const OVERLAYS = new Set(['group', 'redefines', 'renames']);
+  const statementOf = (e) => {
+    if (e.stmt) return e.stmt;
+    if (e.why && typeof e.why === 'object') return { verb: e.why.verb, file: e.why.file, line: e.why.line };
+    return OVERLAYS.has(e.why) ? null : undefined;
+  };
+  // Every route from one walk's source to each sink it reached: the edges the walk could cross that
+  // lead on to the sink, taken or not, by node rather than by call context or bytes. That lists a
+  // statement no route needs sooner than it leaves out one a route does.
+  function attachRoutes(awaiting, crossed, src, cut) {
+    const into = new Map();
+    for (const c of crossed) {
+      const list = into.get(c.to);
+      if (list) list.push(c); else into.set(c.to, [c]);
+    }
+    for (const { finding, at } of awaiting) {
+      const onRoute = new Set([at]);
+      const stack = [at];
+      const statements = new Map();
+      let unplaced = 0;
+      while (stack.length) {
+        for (const c of into.get(stack.pop()) || []) {
+          const s = statementOf(c.e);
+          if (s) statements.set(`${s.file}:${s.line}:${s.verb}`, s);
+          else if (s === undefined) unplaced++;
+          if (!onRoute.has(c.from)) { onRoute.add(c.from); stack.push(c.from); }
+        }
+      }
+      finding.routes = {
+        sources: [{ kind: src.kind, file: rel(src.file), line: src.line }],
+        statements: [...statements.values()].sort((a, b) => byText(a.file, b.file) || a.line - b.line || byText(a.verb, b.verb)),
+        ...(unplaced ? { unplaced } : {}),
+        complete: !cut && !unplaced,
+      };
+    }
+  }
   for (const start of nodes) {
     if (!start.sources.length || !canReach[start.id]) continue;
     for (const src of start.sources) {
@@ -1515,6 +1755,8 @@ export function analyze(root, opts = {}) {
       // without a layout) partial taint does not descend at all.
       const queue = [{ node: start, partial: false, lo: 0, hi: 0, vague: false, prev: null, why: 'source' }];
       const partSeen = new Map();
+      const crossedEdges = allRoutes ? [] : null;
+      const awaiting = allRoutes ? [] : null;
       stampWhole[start.id] = walk;
       let cut = false;
       const began = edgesWalked;
@@ -1563,15 +1805,18 @@ export function analyze(root, opts = {}) {
             ...(best.level ? { guard: { program: by.program, item: by.name, file: rel(best.check.file), line: best.check.line, ...(best.level === 2 ? { stops: true } : {}) } } : {}),
             ...(!best.level && missed ? { checkElsewhere: { program: missed.node.program, item: missed.node.name, file: rel(missed.check.file), line: missed.check.line } } : {}),
           });
+          if (awaiting) awaiting.push({ finding: findings[findings.length - 1], at: cur.id });
           if (best.level && !own) credited.push({ finding: findings[findings.length - 1], node: cur, sink, level: best.level });
           if (sink.group) useGroup.set(findings[findings.length - 1], `${src.kind}|${src.file}:${src.line}|${sink.kind}|${sink.group}`);
         }
-        for (const e of cur.edgesOut) {
+        for (let k = outStart[cur.id]; k < outStart[cur.id + 1]; k++) {
           if (++edgesWalked - began > walkBudget) { cut = true; break; }
-          if (!(canReach[e.to.id] & reach)) continue;
-          const to = e.to;
-          const crossed = cross(state, e);
+          const e = outMeta[k];
+          const to = nodes[outTo[k]];
+          if (!(canReach[to.id] & reach)) continue;
+          const crossed = cross(state, e, to);
           if (!crossed) continue;
+          if (crossedEdges) crossedEdges.push({ from: cur.id, to: to.id, e });
           const { partial, lo, hi, vague, ctx } = crossed;
           if (partial) {
             const pk = `${to.id}|${ctx}`;
@@ -1583,6 +1828,7 @@ export function analyze(root, opts = {}) {
         }
       }
       if (cut) stats.walksCut++;
+      if (awaiting?.length) attachRoutes(awaiting, crossedEdges, src, cut);
       // The walk keeps the shortest route to each sink, and credit on that route says nothing if
       // another reaches the sink without it. So the walk runs again, refusing to let the value leave
       // a node where the credit holds, and a sink it still reaches loses the credit: first for any
@@ -1666,6 +1912,8 @@ export function analyze(root, opts = {}) {
   return { findings, constructs, unstarted, startedBy, stats, sourceKinds: SOURCE_KINDS, sinkKinds: SINK_KINDS, ...(sinks ? { sinks } : {}), ...(sources ? { sources } : {}) };
 }
 
+export const analyze = (root, opts = {}) => drive(analyzeSteps(root, opts));
+
 // What the size check across a CALL needs from an item: its bytes, the bytes from it to the end of
 // the record it sits in, whether a table inside it is variable, and where it was declared.
 function extentOf(item) {