@portll/cobolwork 0.5.0 → 0.7.0

package/lib/dataflow.mjs

@@ -1,23 +1,43 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import { inScope, isProgram, isBms, relPath } from './sources.mjs';
+import { inScope, isProgram, isBms, isPli, relPath } from './sources.mjs';
 import { parseBms, symbolicNames } from './bms.mjs';
 import { dirname, join } from 'node:path';
 import { parseSource, buildFileIndex } from './parser.mjs';
 import { parseJcl } from './jcl.mjs';
 import { holdsDecimal } from './layout.mjs';
 import { hostVariablesIn } from './embedded-sql.mjs';
+import { execReading } from './exec-reading.mjs';
+import { DLI_ROUTINE, dliFunction, isGet } from './ims/dli.mjs';
+import { CICS_EVERY_COMMAND } from './cics-commands.mjs';
+
+// RESP and RESP2, which every command returns and the response-code source already reads.
+const CICS_EVERY_COMMAND_OPTIONS = new Set(Object.keys(CICS_EVERY_COMMAND));
+import { parsePliSource } from './pli/program.mjs';
+import { membersOf, chooseMember } from './pli/include.mjs';
 import { tsoCommands } from './utilities.mjs';
 import { parseCsd, ddOfQueue } from './csd.mjs';
 import { loadSite } from './site.mjs';
 import { ssrangeAbends } from './options.mjs';
 import { isJcl } from './sources.mjs';
-import { eachWithinMemory, watchMemoryBuffer } from './kernel/memory.mjs';
+import { watchMemoryBuffer } from './kernel/memory.mjs';
+import { drive, loopOver } from './kernel/shared-pass.mjs';
+import { keep, parseOrder, restore, sameAnalysis } from './control-reuse.mjs';
+import { CONTROL_WORKER_MIN_BYTES, controlAhead, controlWorkerCount, programFiles } from './control-workers.mjs';
+import { statSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+
 // A flow finding is located by source and sink rather than by one path and line, so it keeps its
 // own comparator. The text comparison underneath it is the shared one.
 import { byText } from './kernel/findings.mjs';
-import { buildControl, creditOf, hasFact, topOf, within, wholeTop } from './control.mjs';
+import { buildControl, creditOf, hasFact, internFacts, namesOf, topOf, within, wholeTop } from './control.mjs';
 import { directoryTree } from './kernel/source-tree.mjs';
 
+// Every reused control analysis checked against the program's own: for the equivalence runs and tests.
+const verifyReuse = () => process.env.COBOLWORK_VERIFY_REUSE === '1';
+// The size of program text from which a copy's control analysis is restored rather than redone. On
+// one repository of 14,500 copied small programs restoring took longer than analysing.
+const REUSE_MIN_BYTES = 256 * 1024;
+
 const OS_COMMAND_ROUTINE = /^(SYSTEM|C\$SYSTEM|CBL_EXEC_RUN_UNIT|CBL_GC_HOSTED|BXPSYSTM)$/i;
 
 export const SOURCE_KINDS = {
@@ -25,6 +45,7 @@ export const SOURCE_KINDS = {
   'cics-terminal': 'EXEC CICS RECEIVE',
   'cics-web': 'EXEC CICS WEB RECEIVE or EXTRACT',
   'file-record': 'record read from a file',
+  'cics-queue': 'an item EXEC CICS READQ TS or TD returns, or the data RETRIEVE returns from the START that began the task',
   'database': 'host variable filled by EXEC SQL',
   'jcl-parm': 'PARM= on a JCL EXEC statement',
   'jcl-instream': 'in-stream data on a JCL DD statement',
@@ -36,7 +57,7 @@ export const SINK_KINDS = {
   'dynamic-program-load': 'CALL whose target is a variable',
   'cics-dynamic-transfer': 'EXEC CICS LINK, XCTL or START with a variable program or transaction',
   'dynamic-sql': 'EXEC SQL EXECUTE IMMEDIATE or PREPARE from a host variable',
-  'dynamic-file-path': 'SELECT ... ASSIGN TO a variable',
+  'dynamic-file-path': 'SELECT ... ASSIGN TO a variable, or EXEC CICS READ, WRITE, DELETE or STARTBR with FILE or DATASET from a variable',
   'outbound-http': 'EXEC CICS WEB CONVERSE, WEB SEND on a client session, or the containers INVOKE SERVICE sends',
   'socket-send': 'CALL EZASOKET or EZACICAL with SEND, SENDTO or WRITE',
   'message-queue': 'CALL MQPUT or MQPUT1',
@@ -73,6 +94,28 @@ const computes = (st) => ARITHMETIC.has(st.verb) || st.counts === true || (st.fn
 const computedOnRoute = (state) => { for (let s = state; s; s = s.prev) if (s.why && s.why.computes) return true; return false; };
 const typedOnRoute = (state) => { for (let s = state; s; s = s.prev) if (s.node.typed) return true; return false; };
 
+// Most nodes are never a source or a sink. They share one empty list, frozen, so that adding to it
+// fails rather than reaching every node.
+const NO_ENDS = Object.freeze([]);
+const addSource = (n, x) => { if (n.sources === NO_ENDS) n.sources = []; n.sources.push(x); };
+const addSink = (n, x) => { if (n.sinks === NO_ENDS) n.sinks = []; n.sinks.push(x); };
+
+// What a check's condition says, as text that differs whenever anything a reader could observe
+// differs: property order, a set's order, undefined, -0 and NaN. Null for anything but plain data.
+function consKey(v) {
+  if (v === undefined) return 'u';
+  if (v === null) return 'n';
+  if (typeof v === 'number') return Object.is(v, -0) ? '#-0' : `#${v}`;
+  if (typeof v === 'string') return JSON.stringify(v);
+  if (typeof v === 'boolean') return v ? 't' : 'f';
+  if (typeof v !== 'object') return null;
+  const parts = v instanceof Set ? [...v] : Array.isArray(v) ? v : Object.getPrototypeOf(v) === Object.prototype ? null : undefined;
+  if (parts === undefined) return null;
+  const keys = parts ? parts.map(consKey) : Object.keys(v).map((k) => { const s = consKey(v[k]); return s === null ? null : `${JSON.stringify(k)}:${s}`; });
+  if (keys.includes(null)) return null;
+  return `${v instanceof Set ? 'S' : parts ? 'A' : 'O'}[${keys.join(',')}]`;
+}
+
 // Every literal a program holds that could be a program name: its VALUE clauses and the literals its
 // statements and commands use. A menu that XCTLs through a table of names starts every one of them.
 function literalNames(prog) {
@@ -124,18 +167,21 @@ function boundsOf(counter, until) {
 // nearly every subscript descends from a file record, and reporting those would be reporting batch.
 const FROM_OUTSIDE = ['argv-or-env', 'cics-terminal', 'cics-web', 'jcl-parm', 'jcl-instream'];
 // What can reach a CICS command: a batch job never issues one.
-const IN_CICS = ['cics-web', 'cics-terminal', 'file-record', 'database'];
+const IN_CICS = ['cics-web', 'cics-terminal', 'file-record', 'cics-queue', 'database'];
 const REFLECTED = ['cics-web', 'cics-terminal'];
 // What the system says about a failure: a command's RESP, the EIB's copy of it, the SQLCA. Sent to a
 // web client it describes the system behind the program (CWE-209); written anywhere else it is the
 // program's own business, so these reach only a response, and Db2's message text the terminal too.
 const SYSTEM_FIELDS = new Set(['EIBRESP', 'EIBRESP2', 'SQLCODE', 'SQLSTATE', 'SQLERRMC']);
+// PL/I's SQLCA holds Db2's message text in SQLERRM, a CHAR(70) VARYING, where COBOL's has SQLERRMC.
+const PLI_SYSTEM_FIELDS = new Set([...SYSTEM_FIELDS, 'SQLERRM']);
 const TO_CLIENT = ['web-response', 'http-header'];
 
 // Exfiltration is data at rest leaving the program. Terminal or web input reaching the same channel
 // is the program relaying its own caller's data, and pairing it would fire on every gateway.
 
 // A trace longer than this keeps its two ends and says how many hops it dropped.
+
 export const TRACE_MAX = 64;
 export const TRACE_KEEP = 24;
 // Edges one source's walk may examine, and all walks together: about fifteen times what the largest
@@ -143,7 +189,7 @@ export const TRACE_KEEP = 24;
 export const WALK_EDGES = 5_000_000;
 export const TOTAL_EDGES = 500_000_000;
 
-const DATA_AT_REST = ['database', 'file-record'];
+const DATA_AT_REST = ['database', 'file-record', 'cics-queue'];
 // The class tests a condition can make, which restrict what a field holds rather than compare it.
 const CLASS_TEST = new Set(['NUMERIC', 'ALPHABETIC', 'ALPHABETIC-LOWER', 'ALPHABETIC-UPPER', 'POSITIVE', 'NEGATIVE']);
 const SOCKET_ROUTINE = /^(EZASOKET|EZACICAL)$/i;
@@ -153,28 +199,7 @@ const SOCKET_SEND = /^(SEND|SENDTO|WRITE|SENDMSG|WRITEV)$/i;
 // MsgDesc, PutMsgOpts, BufferLength, Buffer, …): the buffer is the sixth argument of both.
 const MQ_BUFFER_ARG = { MQPUT: 5, MQPUT1: 5 };
 
-function execOptions(exec) {
-  const opts = new Map();
-  const toks = exec.toks;
-  const words = [];
-  for (let i = 0; i < toks.length; i++) {
-    const t = toks[i];
-    if (t.t !== 'word') continue;
-    words.push(t.u);
-    if (toks[i + 1] && toks[i + 1].t === 'sep' && toks[i + 1].v === '(') {
-      const inner = [];
-      let depth = 1;
-      for (let k = i + 2; k < toks.length && depth > 0; k++) {
-        if (toks[k].t === 'sep') { depth += toks[k].v === '(' ? 1 : -1; if (depth === 0) break; continue; }
-        inner.push(toks[k]);
-      }
-      if (!opts.has(t.u)) opts.set(t.u, inner);
-    }
-  }
-  return { opts, words };
-}
-
-export function analyze(root, opts = {}) {
+export function* analyzeSteps(root, opts = {}) {
   const repos = opts.repos || [''];
   const stats = { files: 0, programs: 0, edges: 0, nodes: 0, threw: 0, overBudget: 0, unreadable: 0, ebcdic: 0,
     jclFiles: 0, jclSteps: 0, jclStepsResolved: 0, jclCrossings: 0,
@@ -221,9 +246,33 @@ export function analyze(root, opts = {}) {
   // passes an argument, the PUT or GET of a container.
   // `link` marks an edge into a callee at a call site ({ call }) or back out to it ({ ret }), and
   // `stmt` names the statement that carries an edge whose `why` is text.
+  // Edges are kept as columns and laid out by source node before the walk. Most are a group's, a
+  // REDEFINES' or a RENAMES', and those share one record of why they exist.
+  const edgeFrom = [];
+  const edgeTo = [];
+  const edgeMeta = [];
+  const sharedMeta = new Map();
+  // Checks share a condition with the same content: 107,547 conditions of 66 Unieuro programs had
+  // 2,423 contents. Conditions are read and never changed once the check model has made them.
+  const conditions = new Map();
+  const sameCondition = (c) => {
+    const k = c ? consKey(c) : null;
+    if (k === null) return c;
+    let kept = conditions.get(k);
+    if (!kept) conditions.set(k, kept = c);
+    return kept;
+  };
   const edge = (a, b, why, dir, at, link) => {
     if (!a || !b || a === b) return;
-    a.edgesOut.push({ to: b, why, dir, ...(at != null ? { at } : {}), ...link });
+    let meta;
+    if (typeof why === 'string' && at == null && !link) {
+      const k = `${why}|${dir || ''}`;
+      meta = sharedMeta.get(k);
+      if (!meta) sharedMeta.set(k, meta = { why, dir });
+    } else meta = { why, dir, ...(at != null ? { at } : {}), ...link };
+    edgeFrom.push(a.id);
+    edgeTo.push(b.id);
+    edgeMeta.push(meta);
     stats.edges++;
   };
   let callSites = 0;
@@ -231,10 +280,58 @@ export function analyze(root, opts = {}) {
   // Everything the graph needs from one program is taken while its parse tree is in hand, and the
   // tree is then released. Holding every tree until the end is what exhausted a 4 GB heap on an
   // 8,024-file repository; nodes, edges and a few cross-program sites are all that survive.
-  function summarise(prog, file, pk, options = []) {
+  // A flow node holds what differs between nodes. Its program and file come from the program it
+  // belongs to, and every other field from the class until the node sets its own.
+  const programOf = [];
+  class FlowNode {
+    constructor(id, pk, name) { this.id = id; this.pk = pk; this.name = name; }
+    get program() { return programOf[this.pk].id; }
+    get file() { return programOf[this.pk].file; }
+  }
+  Object.assign(FlowNode.prototype, { off: null, size: null, repeats: false, sources: NO_ENDS, sinks: NO_ENDS });
+
+  // A program whose text another program file repeats has its control analysis kept for the copies,
+  // keyed by its place in its file and by what each copybook it resolved holds (lib/control-reuse.mjs).
+  // Only a large one: below REUSE_MIN_BYTES (opts.reuseMinBytes) keeping and restoring costs more
+  // than analysing again.
+  const reuseMin = opts.reuseMinBytes ?? REUSE_MIN_BYTES;
+  const textKey = (src) => createHash('sha1').update(src).digest('base64');
+  function repeatedTexts(tree, files) {
+    const count = new Map();
+    const later = new Set();
+    for (const f of files) {
+      let src;
+      try { src = tree.text(f).text; } catch { continue; }
+      if (src.length < reuseMin) continue;
+      const k = textKey(src);
+      if (count.has(k)) later.add(f);
+      count.set(k, (count.get(k) || 0) + 1);
+    }
+    const repeated = new Map();
+    for (const [k, n] of count) if (n > 1) repeated.set(k, { text: k, left: n, kept: new Map() });
+    return { repeated, later };
+  }
+  const copyText = new Map();
+  const copyKey = (r, tree) => r.copies.map((c) => {
+    if (!c.path) return `${c.status}:${c.name}`;
+    if (!copyText.has(c.path)) { let k = null; try { k = textKey(tree.text(c.path).text); } catch { /* unread: compared by status */ } copyText.set(c.path, k); }
+    return `${c.status}:${copyText.get(c.path)}`;
+  }).join('|');
+  const reuseOf = (copied, k, r, f, tree) => ({ kept: copied.kept, key: `${k}|${copyKey(r, tree)}`, files: programFiles(r, f) });
+  // A restored analysis checked against the program's own, where COBOLWORK_VERIFY_REUSE asks.
+  function sameAsOwn(ctl, prog, resolver, file, from) {
+    let own = null;
+    try { own = buildControl(prog, resolver); } catch { /* the restored one threw too, or it differs */ }
+    if (own) internFacts(own.facts);
+    if (!own !== !ctl || (own && !sameAnalysis(own, ctl, new Set(parseOrder(prog))))) throw new Error(`the control analysis ${from} for ${file} differs from its own`);
+  }
+
+  // `built` is the program's analysis from a worker thread (lib/control-workers.mjs), with the files
+  // its references name.
+  function summarise(prog, file, pk, options = [], reuse = null, built = null) {
+    programOf[pk] = { id: prog.id, file };
     const byItem = new Map();
-    const byName = new Map();
-    for (const it of prog.items) if (!byName.has(it.name)) byName.set(it.name, it);
+    const { byName, itemOfToken, indexNames, resolve: resolver } = namesOf(prog);
     const nodeOf = (item) => {
       let n = byItem.get(item);
       if (!n) {
@@ -245,7 +342,11 @@ export function analyze(root, opts = {}) {
         for (let a = item; a; a = a.parent) if ((a.occurs || 1) > 1) { repeats = true; table = a; }
         let top = item;
         while (top.parent) top = top.parent;
-        n = { id: nodes.length, pk, program: prog.id, file, name: item.name, off: item.offset ?? null, size: item.size ?? null, repeats, edgesOut: [], sources: [], sinks: [], ...(top.section === 'LINKAGE' ? { linkage: true } : {}) };
+        n = new FlowNode(nodes.length, pk, item.name);
+        n.off = item.offset ?? null;
+        n.size = item.size ?? null;
+        if (repeats) n.repeats = true;
+        if (top.section === 'LINKAGE') n.linkage = true;
         // Where the outermost table holding this item sits in the record: every occurrence of the
         // item is somewhere inside it. A group's size already counts its occurrences; an
         // elementary item's is one element.
@@ -259,15 +360,12 @@ export function analyze(root, opts = {}) {
       }
       return n;
     };
-    // Names inside EXEC blocks never pass through the parser's reference resolution, so fall back to the name.
-    const itemOfToken = (tok) => (tok ? prog.resolved.get(tok) || (tok.t === 'word' ? byName.get(tok.u) || null : null) : null);
     // An INDEXED BY name is not a data item, so it needs a node of its own to carry taint.
-    const indexNames = new Set(prog.items.flatMap((it) => it.indexNames || []));
     const indexNodes = new Map();
     const indexNode = (name) => {
       let n = indexNodes.get(name);
       if (!n) {
-        n = { id: nodes.length, pk, program: prog.id, file, name, off: null, size: null, repeats: false, edgesOut: [], sources: [], sinks: [] };
+        n = new FlowNode(nodes.length, pk, name);
         nodes.push(n);
         indexNodes.set(name, n);
         stats.nodes++;
@@ -277,16 +375,17 @@ export function analyze(root, opts = {}) {
     // A system field the program never declares - the EIB's, or an SQLCA the precompiler supplies -
     // still holds a value, so it needs a node of its own, as an index name does.
     const systemNodes = new Map();
+    const systemFields = isPli(file) ? PLI_SYSTEM_FIELDS : SYSTEM_FIELDS;
     // A code on a terminal's error line is ordinary; Db2's message text names tables, columns and
     // constraints, so only SQLERRMC reaches the screen sink.
     const systemSource = (n, detail, at) => {
-      const onlyTo = /^SQLERRMC\b/.test(detail) ? [...TO_CLIENT, 'screen'] : TO_CLIENT;
-      if (!n.sources.some((x) => x.kind === 'system-response')) n.sources.push({ kind: 'system-response', onlyTo, noCredit: true, ...at, detail });
+      const onlyTo = /^SQLERRMC?\b/.test(detail) ? [...TO_CLIENT, 'screen'] : TO_CLIENT;
+      if (!n.sources.some((x) => x.kind === 'system-response')) addSource(n, { kind: 'system-response', onlyTo, noCredit: true, ...at, detail });
     };
     const systemNode = (tok) => {
       let n = systemNodes.get(tok.u);
       if (!n) {
-        n = { id: nodes.length, pk, program: prog.id, file, name: tok.u, off: null, size: null, repeats: false, edgesOut: [], sources: [], sinks: [] };
+        n = new FlowNode(nodes.length, pk, tok.u);
         nodes.push(n);
         systemNodes.set(tok.u, n);
         stats.nodes++;
@@ -299,19 +398,34 @@ export function analyze(root, opts = {}) {
       if (it) return nodeOf(it);
       if (!tok || tok.t !== 'word') return null;
       if (indexNames.has(tok.u)) return indexNode(tok.u);
-      return SYSTEM_FIELDS.has(tok.u) ? systemNode(tok) : null;
+      return systemFields.has(tok.u) ? systemNode(tok) : null;
     };
     // The program's statement order, where its structure could be read. Without it a check is
     // credited as it always was, wherever its field is used, and never clears anything.
     let ctl = null;
-    try {
-      ctl = buildControl(prog, (tok) => itemOfToken(tok) || (tok && tok.t === 'word' && indexNames.has(tok.u) ? { index: tok.u } : null));
-    } catch { stats.programsUnordered++; }
+    // A kept or worker-built analysis is { value }, { threw } or { none }, the last for a program
+    // with no procedure division, which is not counted as unordered.
+    const kept = reuse && reuse.kept.get(reuse.key);
+    const given = kept || (built && !built.local ? built : null);
+    if (given) {
+      ctl = given.value ? restore(given.value, parseOrder(prog), kept ? reuse.files : built.files) : null;
+      if (given.threw) stats.programsUnordered++;
+      if (verifyReuse()) sameAsOwn(ctl, prog, resolver, file, kept ? 'reused' : 'built in a worker');
+      if (reuse && !kept) reuse.kept.set(reuse.key, given);
+    } else {
+      let threw = false;
+      try { ctl = buildControl(prog, resolver); } catch { threw = true; stats.programsUnordered++; }
+      if (ctl) internFacts(ctl.facts);
+      if (reuse) {
+        const value = ctl ? keep(ctl, parseOrder(prog), reuse.files) : null;
+        if (!ctl || value) reuse.kept.set(reuse.key, value ? { value } : threw ? { threw: true } : { none: true });
+      }
+    }
     const pointOf = (x) => (ctl ? ctl.nodeOf.get(x) : undefined);
     // Where a name inside a condition is read, which can know more than the statement does.
     const placeOf = (tok, st) => (ctl && ctl.posOf.get(tok)) ?? pointOf(st);
 
-    for (const it of prog.items) if (SYSTEM_FIELDS.has(it.name)) systemSource(nodeOf(it), `${it.name}, which the system sets`, { file: it.file || file, line: it.line });
+    for (const it of prog.items) if (systemFields.has(it.name)) systemSource(nodeOf(it), `${it.name}, which the system sets`, { file: it.file || file, line: it.line });
     // What a program in a CICS region DISPLAYs goes to its CESE and CESO queues, a log. Terminal or web
     // input written there unchecked can carry the control characters that start a line the program
     // did not write (CWE-117). A batch program's DISPLAY is its job's own log, which no terminal
@@ -323,7 +437,7 @@ export function analyze(root, opts = {}) {
       const device = upon >= 0 && st.sources[upon + 1] ? ` UPON ${st.sources[upon + 1].u}` : '';
       for (const t of upon >= 0 ? st.sources.slice(0, upon) : st.sources) {
         const n = nodeOfToken(t);
-        if (n) n.sinks.push({ kind: 'log', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `DISPLAY ${n.name}${device}` });
+        if (n) addSink(n, { kind: 'log', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `DISPLAY ${n.name}${device}` });
       }
     }
     // The document XML PARSE reads is the operand after PARSE; what the parser does with a DTD in
@@ -331,7 +445,7 @@ export function analyze(root, opts = {}) {
     for (const st of prog.statements) {
       if (st.verb !== 'XML' || !st.sources[0] || st.sources[0].u !== 'PARSE') continue;
       const n = st.sources[1] ? nodeOfToken(st.sources[1]) : null;
-      if (n) n.sinks.push({ kind: 'xml-document', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `XML PARSE ${n.name}` });
+      if (n) addSink(n, { kind: 'xml-document', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `XML PARSE ${n.name}` });
     }
     for (const it of prog.items) {
       const n = nodeOf(it);
@@ -366,15 +480,37 @@ export function analyze(root, opts = {}) {
       const recordOf = (it) => { let top = it; while (top.parent) top = top.parent; return top; };
       for (const it of prog.items) { const top = recordOf(it); if (!byRecord.has(top)) byRecord.set(top, []); byRecord.get(top).push(it); }
       const extent = (it) => (it.offset != null && it.size != null ? [it.offset, it.offset + (it.contributes || it.size)] : null);
+      // Each record's items with a known extent, by where they start, so a check finds the items
+      // inside its field without testing every item of the record. They are then taken in the
+      // record's order, which is the order their nodes are made in.
+      const layouts = new Map();
+      const layoutOf = (top, items) => {
+        let l = layouts.get(top);
+        if (!l) {
+          const at = [];
+          items.forEach((it, i) => { if (it.level !== 88 && it.offset != null && it.size != null) at.push({ i, start: it.offset, end: it.offset + (it.contributes || it.size) }); });
+          at.sort((a, b) => a.start - b.start || a.i - b.i);
+          layouts.set(top, l = { at, position: new Map(items.map((it, i) => [it, i])) });
+        }
+        return l;
+      };
       for (const c of ctl.checks) {
-        const entry = { x: c.x, t: c.t, f: c.f, tCons: c.tCons, fCons: c.fCons, file: c.file, line: c.line, item: c.field.index || c.field.name, ...(c.bounds ? { bounds: c.bounds } : {}), ...(c.mono ? { mono: true } : {}) };
+        const entry = { x: c.x, t: c.t, f: c.f, tCons: sameCondition(c.tCons), fCons: sameCondition(c.fCons), file: c.file, line: c.line, item: c.field.index || c.field.name, ...(c.bounds ? { bounds: c.bounds } : {}), ...(c.mono ? { mono: true } : {}) };
         if (c.field.index) { (indexNode(c.field.index).checks ||= []).push(entry); continue; }
+        const top = recordOf(c.field);
+        const items = byRecord.get(top);
+        if (!items) { if (c.field.level !== 88) (nodeOf(c.field).checks ||= []).push(entry); continue; }
+        const { at, position } = layoutOf(top, items);
+        const inside = new Set();
+        if (c.field.level !== 88 && position.has(c.field)) inside.add(position.get(c.field));
         const span = extent(c.field);
-        for (const it of byRecord.get(recordOf(c.field)) || [c.field]) {
-          if (it.level === 88) continue;
-          const e = extent(it);
-          if (it === c.field || (span && e && e[0] >= span[0] && e[1] <= span[1])) (nodeOf(it).checks ||= []).push(entry);
+        if (span) {
+          let lo = 0;
+          let hi = at.length;
+          while (lo < hi) { const mid = (lo + hi) >>> 1; if (at[mid].start < span[0]) lo = mid + 1; else hi = mid; }
+          for (let k = lo; k < at.length && at[k].start <= span[1]; k++) if (at[k].end <= span[1]) inside.add(at[k].i);
         }
+        for (const i of [...inside].sort((a, b) => a - b)) (nodeOf(items[i]).checks ||= []).push(entry);
       }
     }
     // Without the order, a condition that restricts what an item may hold is credited wherever the
@@ -455,7 +591,7 @@ export function analyze(root, opts = {}) {
         if (indexed.has(use)) continue;
         indexed.add(use);
         const start = kind === 'reference-modification' && x.from && base != null ? startOf(x.from, idx, base) : null;
-        at.sinks.push({
+        addSink(at, {
           kind, onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point, group: `${pk}|${key}`, limit, ...(start ? { start } : {}), ...(offset ? { offset } : {}), ...(offset > 0 && idx && unsignedWhole(idx) ? { nonNeg: true } : {}), ...(ssrange ? { ssrange } : {}),
           detail: kind === 'subscript'
             ? `${at.name} subscripts ${host.name}, a table of ${table.occurs}`
@@ -486,7 +622,7 @@ export function analyze(root, opts = {}) {
           const use = `${key}|${pointOf(st) ?? `s${st.at}`}`;
           if (indexed.has(use)) continue;
           indexed.add(use);
-          nodeOf(it).sinks.push({
+          addSink(nodeOf(it), {
             kind: 'loop-bound', onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point: pointOf(st), group: `${pk}|${key}`, limit: limitOf(walks.host, walks.table), counterUses: bodyUses(st, usesOf.get(counter)), ...(ssrange ? { ssrange } : {}),
             detail: `${it.name} decides where PERFORM VARYING ${counter} stops, and ${counter} subscripts ${walks.host.name}, a table of ${walks.table.occurs}`,
           });
@@ -507,7 +643,7 @@ export function analyze(root, opts = {}) {
         const use = `arithmetic|${n.id}|${pointOf(st) ?? `s${st.at}`}`;
         if (indexed.has(use)) continue;
         indexed.add(use);
-        n.sinks.push({
+        addSink(n, {
           kind: 'arithmetic', onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point: pointOf(st), group: `${pk}|arithmetic|${n.id}`,
           detail: `${it.name} (PIC ${it.picture}${it.effectiveUsage && it.effectiveUsage !== 'DISPLAY' ? ` ${it.effectiveUsage}` : ''}) is an operand of ${st.verb}${numproc === 'PFD' ? ', compiled NUMPROC(PFD), which repairs no sign' : ''}`,
         });
@@ -529,7 +665,7 @@ export function analyze(root, opts = {}) {
       const sts = touching.get(it);
       for (const st of sts.length ? sts : [null]) {
         const point = st ? pointOf(st) : undefined;
-        nodeOf(count).sinks.push({
+        addSink(nodeOf(count), {
           kind: 'occurs-depending-count', onlyFrom: FROM_OUTSIDE, file: it.file, line: it.line, ...(st ? { point, group: `${pk}|odo|${it.name}` } : {}), top: it.occurs, ...(ssrange ? { ssrange } : {}),
           detail: `${count.name} sets how many ${it.name} entries there are, up to ${it.occurs}`,
         });
@@ -539,18 +675,18 @@ export function analyze(root, opts = {}) {
       if (st.verb !== 'READ' && st.verb !== 'RETURN') continue;
       for (const t of st.targets) {
         const n = nodeOfToken(t);
-        if (n) n.sources.push({ kind: 'file-record', file: st.file, line: st.line, detail: `${st.verb} ... INTO` });
+        if (n) addSource(n, { kind: 'file-record', file: st.file, line: st.line, detail: `${st.verb} ... INTO` });
       }
     }
     for (const fd of prog.fds || []) for (const rec of fd.records || []) {
       const readsFile = prog.statements.some(st => (st.verb === 'READ') && st.sources.concat(st.targets).some(t => t.u === fd.name));
-      if (readsFile) nodeOf(rec).sources.push({ kind: 'file-record', file: fd.file, line: fd.line, detail: `record of file ${fd.name}` });
+      if (readsFile) addSource(nodeOf(rec), { kind: 'file-record', file: fd.file, line: fd.line, detail: `record of file ${fd.name}` });
     }
     for (const a of prog.accepts) {
       const item = (a.targetTok ? itemOfToken(a.targetTok) : null) || byName.get(a.target);
       if (!item) continue;
       const kind = /^(COMMAND-LINE|ARGUMENT-VALUE|ENVIRONMENT|ENVIRONMENT-VALUE)$/.test(a.from || '') ? 'argv-or-env' : null;
-      if (kind) nodeOf(item).sources.push({ kind, file: a.file, line: a.line, detail: `ACCEPT ... FROM ${a.from}` });
+      if (kind) addSource(nodeOf(item), { kind, file: a.file, line: a.line, detail: `ACCEPT ... FROM ${a.from}` });
     }
     // A SELECT assigns either to a data item, which makes the path dynamic, or to an external
     // name. On z/OS that external name is the DD name a JCL step fills, and it is how a job's
@@ -561,7 +697,7 @@ export function analyze(root, opts = {}) {
       if (f.assign.t === 'word') {
         const item = byName.get(f.assign.v);
         if (item) {
-          nodeOf(item).sinks.push({ kind: 'dynamic-file-path', file: f.file, line: f.line, detail: `SELECT ${f.name} ASSIGN TO ${f.assign.v}` });
+          addSink(nodeOf(item), { kind: 'dynamic-file-path', file: f.file, line: f.line, detail: `SELECT ${f.name} ASSIGN TO ${f.assign.v}` });
           continue;                       // a variable path is not a DD name
         }
       }
@@ -570,7 +706,9 @@ export function analyze(root, opts = {}) {
       if (!external) continue;
       const fd = (prog.fds || []).find((x) => x.name === f.name);
       const recs = (fd?.records || []).map(nodeOf);
-      if (recs.length) ddFiles.push({ dd: external, nodes: recs, file: f.file, line: f.line, select: f.name });
+      // READ ... INTO moves the record it read into an item, which then holds the DD's data too.
+      const into = prog.statements.filter((st) => st.verb === 'READ' && st.sources[0]?.u === f.name).flatMap((st) => st.targets.map(nodeOfToken).filter(Boolean));
+      if (recs.length) ddFiles.push({ dd: external, nodes: recs, into, file: f.file, line: f.line, select: f.name });
     }
     const topOf = (it) => { let t = it; while (t && t.parent) t = t.parent; return t; };
     const ownParams = new Set((prog.paramTokens || []).map((pt) => topOf(itemOfToken(pt.tok))).filter(Boolean));
@@ -593,14 +731,14 @@ export function analyze(root, opts = {}) {
       const point = pointOf(prog.statements[c.stmtIndex]);
       if (c.kind === 'I') {
         const n = nodeOfToken(c.targetTok);
-        if (n) n.sinks.push({ kind: 'dynamic-program-load', file: c.file, line: c.line, point, detail: `CALL ${c.name}` });
+        if (n) addSink(n, { kind: 'dynamic-program-load', file: c.file, line: c.line, point, detail: `CALL ${c.name}` });
         continue;
       }
       callSites.push({ name: String(c.name).toUpperCase(), display: c.name, file: c.file, line: c.line, point, args: c.using.map(a => ({ node: a.tok ? nodeOfToken(a.tok) : null, mode: a.mode, extent: a.tok ? argExtent(itemOfToken(a.tok)) : null })) });
       if (OS_COMMAND_ROUTINE.test(c.name)) {
         for (const a of c.using) {
           const n = a.tok ? nodeOfToken(a.tok) : null;
-          if (n) n.sinks.push({ kind: 'os-command', file: c.file, line: c.line, point, detail: `CALL '${c.name}' USING ${a.word}` });
+          if (n) addSink(n, { kind: 'os-command', file: c.file, line: c.line, point, detail: `CALL '${c.name}' USING ${a.word}` });
         }
       } else if (SOCKET_ROUTINE.test(c.name)) {
         // IBM's own examples hold the function code in a field: 01 SOC-FUNCTION PIC X(16) VALUE 'SEND'.
@@ -611,23 +749,30 @@ export function analyze(root, opts = {}) {
         if (fn && SOCKET_SEND.test(String(fn).trim())) {
           for (const a of c.using.slice(1)) {
             const n = a.tok ? nodeOfToken(a.tok) : null;
-            if (n) n.sinks.push({ kind: 'socket-send', onlyFrom: DATA_AT_REST, file: c.file, line: c.line, point, detail: `CALL '${c.name}' ${String(fn).trim()} USING ${a.word}` });
+            if (n) addSink(n, { kind: 'socket-send', onlyFrom: DATA_AT_REST, file: c.file, line: c.line, point, detail: `CALL '${c.name}' ${String(fn).trim()} USING ${a.word}` });
           }
         }
       } else if (Object.hasOwn(MQ_BUFFER_ARG, String(c.name).toUpperCase())) {
         const a = c.using[MQ_BUFFER_ARG[String(c.name).toUpperCase()]];
         const n = a && a.tok ? nodeOfToken(a.tok) : null;
-        if (n) n.sinks.push({ kind: 'message-queue', onlyFrom: DATA_AT_REST, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with buffer ${a.word}` });
+        if (n) addSink(n, { kind: 'message-queue', onlyFrom: DATA_AT_REST, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with buffer ${a.word}` });
       } else if (/^MQCONNX?$/i.test(String(c.name))) {
         // MQCONN(QMgrName, Hconn, CompCode, Reason); MQCONNX puts its options second.
         const a = c.using[0];
         const n = a && a.tok ? nodeOfToken(a.tok) : null;
-        if (n) n.sinks.push({ kind: 'connection-target', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with queue manager ${a.word}, which decides the queue manager the program connects to` });
+        if (n) addSink(n, { kind: 'connection-target', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with queue manager ${a.word}, which decides the queue manager the program connects to` });
+      } else if (DLI_ROUTINE.test(c.name)) {
+        // A get call fills the I/O area, the argument after the PCB, with the segment it retrieves.
+        const valueOf = (a) => a.lit ?? (a.tok ? ((itemOfToken(a.tok) || {}).values || []).find(v => v.t === 'lit')?.v : null);
+        const call = dliFunction(c.using, valueOf);
+        const a = call && isGet(call.fn) ? c.using[call.index + 2] : null;
+        const n = a && a.tok ? nodeOfToken(a.tok) : null;
+        if (n) addSource(n, { kind: 'database', file: c.file, line: c.line, point, detail: `CALL '${c.name}' ${call.fn} fills ${a.word}` });
       } else if (String(c.name).toUpperCase() === 'CEEGTST') {
         // CEEGTST(heap id, size, address, feedback code): the size is the second argument.
         const a = c.using[1];
         const n = a && a.tok ? nodeOfToken(a.tok) : null;
-        if (n) n.sinks.push({ kind: 'storage-length', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL 'CEEGTST' with size ${a.word}, which decides how much heap storage is acquired` });
+        if (n) addSink(n, { kind: 'storage-length', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL 'CEEGTST' with size ${a.word}, which decides how much heap storage is acquired` });
       }
     }
     const transfers = [];
@@ -643,7 +788,10 @@ export function analyze(root, opts = {}) {
     const containerNode = (name) => {
       let n = containers.get(name);
       if (!n) {
-        n = { id: nodes.length, pk, program: prog.id, file, name: `CONTAINER(${name})`, edgesOut: [], sources: [], sinks: [] };
+        n = new FlowNode(nodes.length, pk, `CONTAINER(${name})`);
+        n.off = undefined;
+        n.size = undefined;
+        n.repeats = undefined;
         nodes.push(n);
         containers.set(name, n);
         stats.nodes++;
@@ -731,7 +879,7 @@ export function analyze(root, opts = {}) {
         if (typed) continue;
         stats.protectedFields++;
         const back = field.effective.has('FSET') ? ' with FSET' : '';
-        n.sources.push({ kind: 'cics-protected-field', onlyTo: ['record-key', 'record-update'], ...at,
+        addSource(n, { kind: 'cics-protected-field', onlyTo: ['record-key', 'record-update'], ...at,
           detail: `EXEC CICS RECEIVE MAP(${map.name}) returns ${item.name}, field ${field.name} of map ${map.name} in mapset ${mapset.name}, which the map marks ${marks.join(' and ')}${field.attrb ? '' : ' by default'}${back}` });
       }
     };
@@ -740,45 +888,44 @@ export function analyze(root, opts = {}) {
     const changes = new Map();
     for (const e of prog.execs) {
       if (e.kind !== 'CICS') continue;
-      const { opts: o, words } = execOptions(e);
-      if (words[0] !== 'REWRITE' && !(words[0] === 'DELETE' && !o.has('RIDFLD'))) continue;
+      const { opts: o, verb } = execReading(e);
+      if (verb !== 'REWRITE' && !(verb === 'DELETE' && !o.has('RIDFLD'))) continue;
       const file = optionName(o, 'DATASET') || optionName(o, 'FILE');
-      if (file && !changes.has(file)) changes.set(file, words[0] === 'REWRITE' ? 'rewrites' : 'deletes');
+      if (file && !changes.has(file)) changes.set(file, verb === 'REWRITE' ? 'rewrites' : 'deletes');
     }
     for (const e of prog.execs) {
-      const { opts: o, words } = execOptions(e);
+      const { opts: o, words, verb, sub, command, direction } = execReading(e);
       const at = { file: e.file, line: e.line, point: pointOf(e) };
       if (e.kind === 'CICS') {
-        const verb = words[0];
         const intoTok = (o.get('INTO') || o.get('SET') || [])[0];
         for (const opt of ['RESP', 'RESP2']) {
           const r = nodeOfToken((o.get(opt) || [])[0]);
           if (r) systemSource(r, `the ${opt} of EXEC CICS ${verb}`, at);
         }
-        if (verb === 'WRITE' && ['OPERATOR', 'JOURNALNAME', 'JOURNALNUM'].includes(words[1])) {
-          const opt = words[1] === 'OPERATOR' ? 'TEXT' : 'FROM';
+        if (verb === 'WRITE' && ['OPERATOR', 'JOURNALNAME', 'JOURNALNUM'].includes(sub)) {
+          const opt = sub === 'OPERATOR' ? 'TEXT' : 'FROM';
           const n = nodeOfToken((o.get(opt) || [])[0]);
-          if (n) n.sinks.push({ kind: 'log', onlyFrom: REFLECTED, ...at, detail: `EXEC CICS WRITE ${words[1]} ${opt}(${n.name}), ${words[1] === 'OPERATOR' ? 'to the operator console' : 'to a journal'}` });
+          if (n) addSink(n, { kind: 'log', onlyFrom: REFLECTED, ...at, detail: `EXEC CICS WRITE ${sub} ${opt}(${n.name}), ${sub === 'OPERATOR' ? 'to the operator console' : 'to a journal'}` });
         }
         if (verb === 'RECEIVE') {
           const isWeb = words.includes('WEB');
           const n = nodeOfToken(intoTok);
-          if (n) n.sources.push({ kind: isWeb ? 'cics-web' : 'cics-terminal', ...at, detail: `EXEC CICS ${isWeb ? 'WEB ' : ''}RECEIVE` });
+          if (n) addSource(n, { kind: isWeb ? 'cics-web' : 'cics-terminal', ...at, detail: `EXEC CICS ${isWeb ? 'WEB ' : ''}RECEIVE` });
           // RECEIVE MAP with no INTO fills the symbolic map, whose input record is <map>I.
           const map = optionName(o, 'MAP');
           if (!n && map) {
             const sym = byName.get(`${map}I`);
-            if (sym) nodeOf(sym).sources.push({ kind: 'cics-terminal', ...at, detail: `EXEC CICS RECEIVE MAP(${map}) into the symbolic map` });
+            if (sym) addSource(nodeOf(sym), { kind: 'cics-terminal', ...at, detail: `EXEC CICS RECEIVE MAP(${map}) into the symbolic map` });
           }
           if (!isWeb && o.has('MAP')) receiveMap(e, o, itemOfToken(intoTok), at);
         }
         // What the terminal shows: SEND TEXT's FROM, or the map's output record, <map>O without FROM.
-        if (verb === 'SEND' && (words[1] === 'TEXT' || words[1] === 'MAP')) {
+        if (verb === 'SEND' && (sub === 'TEXT' || sub === 'MAP')) {
           const from = nodeOfToken((o.get('FROM') || [])[0]);
-          const map = words[1] === 'MAP' ? optionName(o, 'MAP') : null;
+          const map = sub === 'MAP' ? optionName(o, 'MAP') : null;
           const sym = !from && map ? byName.get(`${map}O`) : null;
           const n = from || (sym ? nodeOf(sym) : null);
-          if (n) n.sinks.push({ kind: 'screen', onlyFrom: ['system-response'], ...at, detail: `EXEC CICS SEND ${words[1]}${map ? `(${map})` : ''}${from ? ` FROM(${n.name})` : ', from its symbolic map'}, to the terminal` });
+          if (n) addSink(n, { kind: 'screen', onlyFrom: ['system-response'], ...at, detail: `EXEC CICS SEND ${sub}${map ? `(${map})` : ''}${from ? ` FROM(${n.name})` : ', from its symbolic map'}, to the terminal` });
         }
         // RIDFLD decides which record a READ or DELETE reaches, or where a browse starts. A key the
         // user types is how a lookup works; a key the program put in a protected field and read back
@@ -790,12 +937,12 @@ export function analyze(root, opts = {}) {
           const detail = verb === 'DELETE' ? `EXEC CICS DELETE RIDFLD(${k && k.name}), which decides which record it deletes`
             : then ? `EXEC CICS READ UPDATE RIDFLD(${k && k.name}), which decides which record the program then ${then}`
               : `EXEC CICS ${verb} RIDFLD(${k && k.name}), which decides which record it reaches`;
-          if (k) k.sinks.push({ kind: verb === 'DELETE' || then ? 'record-update' : 'record-key', onlyFrom: ['cics-protected-field'], noCredit: true, ...at, detail });
+          if (k) addSink(k, { kind: verb === 'DELETE' || then ? 'record-update' : 'record-key', onlyFrom: ['cics-protected-field'], noCredit: true, ...at, detail });
         }
         if (verb === 'GETMAIN') {
           for (const opt of ['FLENGTH', 'LENGTH']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'storage-length', onlyFrom: REFLECTED, ...at, detail: `EXEC CICS GETMAIN ${opt}(${n.name}), which decides how much storage is acquired` });
+            if (n) addSink(n, { kind: 'storage-length', onlyFrom: REFLECTED, ...at, detail: `EXEC CICS GETMAIN ${opt}(${n.name}), which decides how much storage is acquired` });
           }
         }
         if (verb === 'PUT' && o.has('CONTAINER')) {
@@ -805,11 +952,11 @@ export function analyze(root, opts = {}) {
           if (name) channelOf.set(name, optionName(o, 'CHANNEL'));
         }
         // A service call sends every container on its channel, and its URI decides where they go.
-        if (verb === 'INVOKE' && (words[1] === 'SERVICE' || words[1] === 'WEBSERVICE')) {
-          invokes.push({ at, what: words[1], channel: optionName(o, 'CHANNEL') });
+        if (verb === 'INVOKE' && (sub === 'SERVICE' || sub === 'WEBSERVICE')) {
+          invokes.push({ at, what: sub, channel: optionName(o, 'CHANNEL') });
           for (const opt of ['URI', 'URIMAP']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'outbound-host', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS INVOKE ${words[1]} ${opt}(...), which decides where the request goes` });
+            if (n) addSink(n, { kind: 'outbound-host', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS INVOKE ${sub} ${opt}(...), which decides where the request goes` });
           }
         }
         if (verb === 'GET' && o.has('CONTAINER')) {
@@ -819,51 +966,60 @@ export function analyze(root, opts = {}) {
         }
         // CONVERSE is always a client call; SEND is one only on a session this program opened. A
         // plain WEB SEND answers the request that started the program, which is its job.
-        if (verb === 'WEB' && (words[1] === 'CONVERSE' || (words[1] === 'SEND' && o.has('SESSTOKEN')))) {
+        if (verb === 'WEB' && (sub === 'CONVERSE' || (sub === 'SEND' && o.has('SESSTOKEN')))) {
           const n = nodeOfToken((o.get('FROM') || [])[0]);
-          if (n) n.sinks.push({ kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...at, detail: `EXEC CICS WEB ${words[1]} to a remote server` });
+          if (n) addSink(n, { kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...at, detail: `EXEC CICS WEB ${sub} to a remote server` });
           // The request may be a container rather than a field.
           const sent = o.has('CONTAINER') ? optionName(o, 'CONTAINER') : null;
-          if (sent) containerNode(sent).sinks.push({ kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...at, detail: `EXEC CICS WEB ${words[1]} sending CONTAINER(${sent})` });
+          if (sent) addSink(containerNode(sent), { kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...at, detail: `EXEC CICS WEB ${sub} sending CONTAINER(${sent})` });
         }
         // The response this program returns to its own caller, and the document built for it. CICS
         // escapes nothing on the way out - DOCUMENT SET's UNESCAPED option is about URL decoding,
         // not HTML - so whatever reaches here is what the browser is handed.
-        if (verb === 'WEB' && words[1] === 'SEND' && !o.has('SESSTOKEN')) {
+        if (verb === 'WEB' && sub === 'SEND' && !o.has('SESSTOKEN')) {
           const n = nodeOfToken((o.get('FROM') || [])[0]);
           // A stored value becomes script only where the reply is markup, and a web program
           // answering with a database row is the ordinary shape of one. Input echoed back is a
           // defect whatever the reply holds.
           const media = (o.get('MEDIATYPE') || [])[0];
           const markup = media && media.t === 'lit' && /html|xml|svg/i.test(String(media.v));
-          if (n) n.sinks.push({ kind: 'web-response', onlyFrom: [...(markup ? IN_CICS : REFLECTED), 'system-response'], ...at, detail: `EXEC CICS WEB SEND answering this program's caller${markup ? ` as ${String(media.v).trim()}` : ''}` });
+          if (n) addSink(n, { kind: 'web-response', onlyFrom: [...(markup ? IN_CICS : REFLECTED), 'system-response'], ...at, detail: `EXEC CICS WEB SEND answering this program's caller${markup ? ` as ${String(media.v).trim()}` : ''}` });
         }
         if (verb === 'DOCUMENT') {
-          const what = words[1] === 'SET' ? ['VALUE', 'SYMBOLLIST'] : ['TEXT', 'FROM', 'BINARY'];
+          const what = sub === 'SET' ? ['VALUE', 'SYMBOLLIST'] : ['TEXT', 'FROM', 'BINARY'];
           for (const opt of what) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'web-response', onlyFrom: [...IN_CICS, 'system-response'], ...at, detail: `EXEC CICS DOCUMENT ${words[1]} ${opt}(...), which is sent as the response` });
+            if (n) addSink(n, { kind: 'web-response', onlyFrom: [...IN_CICS, 'system-response'], ...at, detail: `EXEC CICS DOCUMENT ${sub} ${opt}(...), which is sent as the response` });
           }
         }
-        if (verb === 'WEB' && words[1] === 'WRITE' && o.has('HTTPHEADER')) {
+        if (verb === 'WEB' && sub === 'WRITE' && o.has('HTTPHEADER')) {
           for (const opt of ['HTTPHEADER', 'VALUE']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'http-header', onlyFrom: [...IN_CICS, 'system-response'], ...at, detail: `EXEC CICS WEB WRITE HTTPHEADER ${opt}(...)` });
+            if (n) addSink(n, { kind: 'http-header', onlyFrom: [...IN_CICS, 'system-response'], ...at, detail: `EXEC CICS WEB WRITE HTTPHEADER ${opt}(...)` });
           }
         }
-        if (verb === 'WEB' && (words[1] === 'OPEN' || words[1] === 'CONVERSE')) {
+        if (verb === 'WEB' && (sub === 'OPEN' || sub === 'CONVERSE')) {
           for (const opt of ['HOST', 'URIMAP', 'PATH']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'outbound-host', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS WEB ${words[1]} ${opt}(...), which decides where the request goes` });
+            if (n) addSink(n, { kind: 'outbound-host', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS WEB ${sub} ${opt}(...), which decides where the request goes` });
+          }
+        }
+        // FILE or DATASET picks the file a command reads, writes or browses from every file the region
+        // defines; the commands that carry on from these act on the file already picked.
+        if (['READ', 'WRITE', 'DELETE', 'STARTBR'].includes(verb)) {
+          for (const opt of ['FILE', 'DATASET']) {
+            const t = (o.get(opt) || [])[0];
+            const n = t && t.t === 'word' ? nodeOfToken(t) : null;
+            if (n) addSink(n, { kind: 'dynamic-file-path', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} ${opt}(${n.name}), which decides the file the command acts on` });
           }
         }
         // The queue a command acts on, as distinct from what it writes there: a name from input
         // reads, overwrites or deletes whatever queue the input asks for.
         if (['WRITEQ', 'READQ', 'DELETEQ'].includes(verb)) {
-          const ts = words[1] === 'TS' || !words.includes('TD');
+          const ts = sub === 'TS' || !words.includes('TD');
           for (const opt of ['QUEUE', 'QNAME']) {
             const n = nodeOfToken((o.get(opt) || [])[0]);
-            if (n) n.sinks.push({ kind: 'queue-name', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} ${ts ? 'TS' : 'TD'} ${opt}(...) names the queue` });
+            if (n) addSink(n, { kind: 'queue-name', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} ${ts ? 'TS' : 'TD'} ${opt}(...) names the queue` });
           }
         }
         // SYSID ships a command to the region it names; SET's first option names the resource a
@@ -871,25 +1027,42 @@ export function analyze(root, opts = {}) {
         // INQUIRE and EXTRACT return SYSID into the field rather than read it.
         if (o.has('SYSID') && !['ASSIGN', 'INQUIRE', 'EXTRACT'].includes(verb)) {
           const n = nodeOfToken((o.get('SYSID') || [])[0]);
-          if (n) n.sinks.push({ kind: 'cics-sysid', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} SYSID(${n.name}), which decides the region the command is shipped to` });
+          if (n) addSink(n, { kind: 'cics-sysid', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} SYSID(${n.name}), which decides the region the command is shipped to` });
         }
-        if (verb === 'SET' && words[1] && o.has(words[1])) {
-          const n = nodeOfToken((o.get(words[1]) || [])[0]);
-          if (n) n.sinks.push({ kind: 'cics-system-resource', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS SET ${words[1]}(${n.name}), which decides the resource the command changes` });
+        // The resource option is the one the table names the command by, or the synonym written (SET
+        // DATASET is SET FILE).
+        const resource = o.has(sub) ? sub : words[1];
+        if (verb === 'SET' && resource && o.has(resource)) {
+          const n = nodeOfToken((o.get(resource) || [])[0]);
+          if (n) addSink(n, { kind: 'cics-system-resource', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS SET ${resource}(${n.name}), which decides the resource the command changes` });
         }
         if (verb === 'READ' || verb === 'READNEXT' || verb === 'READPREV') {
           const n = nodeOfToken(intoTok);
-          if (n && (o.has('FILE') || o.has('DATASET'))) n.sources.push({ kind: 'file-record', ...at, detail: `EXEC CICS ${verb} FILE ... INTO` });
+          if (n && (o.has('FILE') || o.has('DATASET'))) addSource(n, { kind: 'file-record', ...at, detail: `EXEC CICS ${verb} FILE ... INTO` });
         }
         // A CONVERSE response is the remote server's data, which is untrusted input like any other.
-        if ((verb === 'WEB' && words[1] !== 'SEND') || verb === 'EXTRACT') {
+        if ((verb === 'WEB' && sub !== 'SEND') || verb === 'EXTRACT') {
           const n = nodeOfToken(intoTok);
-          if (n) n.sources.push({ kind: 'cics-web', ...at, detail: `EXEC CICS ${words.slice(0, 2).join(' ')}` });
+          if (n) addSource(n, { kind: 'cics-web', ...at, detail: `EXEC CICS ${[verb, sub].filter(Boolean).join(' ')}` });
+        }
+        // The request's form fields, query parameters and headers, and what WEB EXTRACT says about the
+        // request, come back in options other than INTO: each one CICS returns a value in.
+        if (/^(WEB (READ|READNEXT|EXTRACT)|EXTRACT WEB)/.test(command || '')) {
+          for (const [opt, toks] of o) {
+            if (opt === 'INTO' || !['receives', 'both'].includes(direction(opt)) || CICS_EVERY_COMMAND_OPTIONS.has(opt)) continue;
+            const n = nodeOfToken(toks[0]);
+            if (n) addSource(n, { kind: 'cics-web', ...at, detail: `EXEC CICS ${command} ${opt}` });
+          }
+        }
+        // A queue item, and the data a START passed, were stored by another task.
+        if (/^READQ /.test(command || '') || command === 'RETRIEVE') {
+          const n = nodeOfToken(intoTok);
+          if (n) addSource(n, { kind: 'cics-queue', ...at, detail: `EXEC CICS ${command} INTO` });
         }
         // Where a transient-data write lands is not in the program: the CSD maps the queue to a DD
         // and the region's JCL maps the DD to a destination. Collected here, resolved once every
         // definition has been read.
-        if (verb === 'WRITEQ' && words[1] === 'TD') {
+        if (verb === 'WRITEQ' && sub === 'TD') {
           const from = nodeOfToken((o.get('FROM') || [])[0]);
           const qTok = (o.get('QUEUE') || o.get('TDQUEUE') || [])[0];
           const qItem = qTok && qTok.t === 'word' ? itemOfToken(qTok) : null;
@@ -901,7 +1074,7 @@ export function analyze(root, opts = {}) {
           const pgm = (o.get('PROGRAM') || o.get('TRANSID') || [])[0];
           if (pgm && pgm.t === 'word') {
             const n = nodeOfToken(pgm);
-            if (n) n.sinks.push({ kind: 'cics-dynamic-transfer', ...at, detail: `EXEC CICS ${verb} with a variable program name` });
+            if (n) addSink(n, { kind: 'cics-dynamic-transfer', ...at, detail: `EXEC CICS ${verb} with a variable program name` });
           }
           const commarea = (o.get('COMMAREA') || o.get('FROM') || [])[0];
           const argNode = commarea ? nodeOfToken(commarea) : null;
@@ -917,15 +1090,20 @@ export function analyze(root, opts = {}) {
           if (t && t.t === 'lit') startsTransactions.add(String(t.v).trim().toUpperCase());
         }
       }
+      if (e.kind === 'DLI' && isGet(verb)) {
+        for (const tok of o.get('INTO') || []) {
+          const n = nodeOfToken(tok);
+          if (n) addSource(n, { kind: 'database', ...at, detail: `EXEC DLI ${verb} INTO ${n.name}` });
+        }
+      }
       if (e.kind === 'SQL') {
         // A host variable names the item a qualified :G.F resolves to; the statement fills the ones
         // Db2 writes, and those hold what the database held.
         const hv = e.hostVariables || hostVariablesIn(e.toks);
-        const verb = words[0];
         for (const h of hv) {
           if (!h.written) continue;
           const n = nodeOfToken(h.tok);
-          if (n) n.sources.push({ kind: 'database', ...at, detail: `EXEC SQL ${verb} ${verb === 'SELECT' || verb === 'FETCH' ? 'INTO' : 'writes'} host variable` });
+          if (n) addSource(n, { kind: 'database', ...at, detail: `EXEC SQL ${verb} ${verb === 'SELECT' || verb === 'FETCH' ? 'INTO' : 'writes'} host variable` });
         }
         // The location CONNECT TO or SET CONNECTION names, where a host variable holds it; what
         // follows USER and USING is the credential, not the target.
@@ -933,19 +1111,19 @@ export function analyze(root, opts = {}) {
           const to = e.toks.findIndex((t) => t.t === 'word' && (t.u === 'TO' || t.u === 'CONNECTION'));
           const colon = to >= 0 ? e.toks[to + 1] : null;
           const n = colon && colon.t === 'op' && colon.v === ':' && e.toks[to + 2] ? nodeOfToken(e.toks[to + 2]) : null;
-          if (n) n.sinks.push({ kind: 'connection-target', onlyFrom: FROM_OUTSIDE, ...at, detail: `EXEC SQL ${verb === 'SET' ? 'SET CONNECTION' : 'CONNECT TO'} :${n.name}, which decides the database the program connects to` });
+          if (n) addSink(n, { kind: 'connection-target', onlyFrom: FROM_OUTSIDE, ...at, detail: `EXEC SQL ${verb === 'SET' ? 'SET CONNECTION' : 'CONNECT TO'} :${n.name}, which decides the database the program connects to` });
         }
         const dynamic = words.some((w, i) => w === 'PREPARE' || (w === 'EXECUTE' && words[i + 1] === 'IMMEDIATE'));
         if (dynamic) for (const h of hv) {
           const n = nodeOfToken(h.tok);
-          if (n) n.sinks.push({ kind: 'dynamic-sql', ...at, detail: `EXEC SQL ${words.slice(0, 2).join(' ')} from a host variable` });
+          if (n) addSink(n, { kind: 'dynamic-sql', ...at, detail: `EXEC SQL ${words.slice(0, 2).join(' ')} from a host variable` });
         }
       }
     }
     for (const inv of invokes) {
       for (const [name, channel] of channelOf) {
         if (inv.channel && channel && channel !== inv.channel) continue;
-        containerNode(name).sinks.push({ kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...inv.at, detail: `EXEC CICS INVOKE ${inv.what} sending CONTAINER(${name})${inv.channel ? ` on CHANNEL(${inv.channel})` : ''}` });
+        addSink(containerNode(name), { kind: 'outbound-http', onlyFrom: DATA_AT_REST, ...inv.at, detail: `EXEC CICS INVOKE ${inv.what} sending CONTAINER(${name})${inv.channel ? ` on CHANNEL(${inv.channel})` : ''}` });
       }
     }
     const commareaItem = byName.get('DFHCOMMAREA');
@@ -977,6 +1155,16 @@ export function analyze(root, opts = {}) {
     const tree = (!repo && opts.tree) ? opts.tree : directoryTree(base, opts);
     const idx = tree.index;
     const files = tree.list().filter(isProgram).filter(inScope(opts));
+    // PL/I programs join the same graph unless the scan is told not to read them.
+    const readsPli = opts.pli ?? process.env.COBOLWORK_PLI !== '0';
+    if (readsPli) files.push(...tree.list().filter(isPli).filter(inScope(opts)));
+    // A PL/I %INCLUDE names a member by base name; any file of the tree may hold it.
+    const pliMembers = readsPli ? membersOf(tree.list()) : null;
+    const readMember = (name, from) => {
+      const path = chooseMember(pliMembers.get(name), from);
+      if (!path) return null;
+      try { return { path, text: tree.text(path).text }; } catch { return null; }
+    };
     for (const f of tree.list().filter(isJcl).filter(inScope(opts))) { jclPending.push(f); jclTrees.set(f, tree); }
     for (const f of tree.list().filter((p) => /\.csd$/i.test(p)).filter(inScope(opts))) {
       try { addCsd(tree.text(f).text, f); } catch (e) { stats.unreadable++; unread.push(`${tree.rel(f)}: ${e.code || e.name}`); }
@@ -995,20 +1183,38 @@ export function analyze(root, opts = {}) {
     // edges are proportional to data items and statements, not to bytes, so a repository of small
     // programs with large record layouts can exhaust a heap the budget believes is untouched. The
     // shared loop watches the heap itself, and the budget stays as the cheaper first line.
-    const run = eachWithinMemory(files, (f) => {
+    const { repeated, later } = repeatedTexts(tree, files);
+    // The larger COBOL programs' control analyses are built in worker threads ahead of the loop, where
+    // the tree can say how it parses as data. A copy whose first is analysed already is restored instead.
+    const workers = tree.parseSpec ? (opts.controlWorkers ?? controlWorkerCount()) : 0;
+    const minWorkerBytes = opts.controlWorkerMinBytes ?? CONTROL_WORKER_MIN_BYTES;
+    const sizeOf = (f) => { try { return statSync(f).size; } catch { return 0; } };
+    const toWorkers = new Set(workers > 0 ? files.filter((f) => !isPli(f) && !later.has(f) && sizeOf(f) >= minWorkerBytes) : []);
+    const ahead = toWorkers.size ? controlAhead(tree.parseSpec, files, (f) => toWorkers.has(f), { workers }) : null;
+    const readProgram = (f, i) => {
       let src;
       try { const s = tree.text(f); src = s.text; if (s.encoding === 'ebcdic') stats.ebcdic++; } catch (e) { stats.unreadable++; unread.push(`${tree.rel(f)}: ${e.code || e.name}`); return 0; }
-      if (!/PROCEDURE\s+DIVISION|PROGRAM-ID/i.test(src)) return 0;
+      const pli = isPli(f);
+      if (!pli && !/PROCEDURE\s+DIVISION|PROGRAM-ID/i.test(src)) return 0;
       if (held + src.length > budget) { stats.overBudget++; return 0; }
       held += src.length;
       let r;
       try {
-        r = tree.parse(f, src);
+        r = pli ? parsePliSource(src, f, { readMember }) : tree.parse(f, src);
       } catch (e) { stats.threw++; unparsed.push(`${tree.rel(f)}: ${e.code || e.name}`); return src.length; }
       stats.files++;
-      for (const p of r.programs) { programs.push(summarise(p, f, programs.length, r.options)); stats.programs++; }
+      const copied = src.length >= reuseMin && repeated.size ? repeated.get(textKey(src)) : undefined;
+      const answer = ahead ? ahead.take(f, i) : null;
+      const builtFiles = answer && answer.length === r.programs.length ? programFiles(r, f) : null;
+      r.programs.forEach((p, k) => {
+        programs.push(summarise(p, f, programs.length, r.options, copied ? reuseOf(copied, k, r, f, tree) : null, builtFiles && { ...answer[k], files: builtFiles }));
+        stats.programs++;
+      });
+      if (copied && --copied.left === 0) repeated.delete(copied.text);
       return src.length;
-    }, { label: 'flow', watcher: memoryWatcher });
+    };
+    let run;
+    try { run = yield loopOver(files, readProgram, { label: 'flow', watcher: memoryWatcher }); } finally { ahead?.close(); }
 
     // A file the loop never reached is not the same as one past the byte budget, and they are
     // counted separately so a report can say which limit it hit.
@@ -1142,7 +1348,7 @@ export function analyze(root, opts = {}) {
           // followed by the text. A program with no USING cannot receive one, and saying it does
           // would be a path nobody could follow.
           if (run.parm !== null && callee.params && callee.params[0] && callee.params[0].node) {
-            callee.params[0].node.sources.push({
+            addSource(callee.params[0].node, {
               kind: 'jcl-parm', file: f, line: run.line,
               detail: `${run.how}, which runs ${run.pgm}${amb}`,
             });
@@ -1159,7 +1365,7 @@ export function analyze(root, opts = {}) {
               for (const m of callee.ddFiles || []) {
                 if (m.dd !== dd.name.toUpperCase()) continue;
                 for (const n of m.nodes) {
-                  n.sinks.push({ kind: 'internal-reader', file: m.file, line: m.line,
+                  addSink(n, { kind: 'internal-reader', file: m.file, line: m.line,
                     detail: `records written through SELECT ${m.select} to //${dd.name}, which step ${step.name || '(unnamed)'} of ${rel(f)} sends to the internal reader${amb}` });
                 }
               }
@@ -1167,8 +1373,8 @@ export function analyze(root, opts = {}) {
             if (!dd.inStream || !dd.inStream.length || !dd.name) continue;
             for (const m of callee.ddFiles || []) {
               if (m.dd !== dd.name.toUpperCase()) continue;
-              for (const n of m.nodes) {
-                n.sources.push({
+              for (const n of [...m.nodes, ...m.into]) {
+                addSource(n, {
                   kind: 'jcl-instream', file: f, line: dd.line,
                   detail: `${dd.inStream.length} lines of in-stream data on //${dd.name} in step ${step.name || '(unnamed)'}, read through SELECT ${m.select}${amb}`,
                 });
@@ -1237,21 +1443,21 @@ export function analyze(root, opts = {}) {
       const def = w.queue ? csd.tdqueues.get(w.queue) : null;
       const dd = w.queue ? ddOfQueue(csd, w.queue) : null;
       if (w.queue && (readerQueues.has(w.queue) || (dd && readerDds.has(dd)))) {
-        w.node.sinks.push({ kind: 'internal-reader', file: w.file, line: w.line, point: w.point,
+        addSink(w.node, { kind: 'internal-reader', file: w.file, line: w.line, point: w.point,
           detail: `EXEC CICS WRITEQ TD QUEUE('${w.queue}')${dd ? `, which the CSD sends to DD ${dd}` : ''}, declared as reaching the internal reader` });
         continue;
       }
       // Any other queue is where a region writes what it logs or prints, unless it starts a
       // transaction, when it is a channel to that transaction instead.
       if (!(def && def.transid)) {
-        w.node.sinks.push({ kind: 'log', onlyFrom: REFLECTED, file: w.file, line: w.line, point: w.point,
+        addSink(w.node, { kind: 'log', onlyFrom: REFLECTED, file: w.file, line: w.line, point: w.point,
           detail: `EXEC CICS WRITEQ TD QUEUE(${w.queue ? `'${w.queue}'` : 'a name the program computes'})` });
       }
       if (!w.queue) { stats.tdWritesUndecided++; continue; }
       if (def && def.type === 'INTRA') continue;
       // A queue the CSD sends to a DD leaves the region: to a dataset, a printer or another job.
       if (dd) {
-        w.node.sinks.push({ kind: 'extrapartition-queue', onlyFrom: DATA_AT_REST, file: w.file, line: w.line, point: w.point,
+        addSink(w.node, { kind: 'extrapartition-queue', onlyFrom: DATA_AT_REST, file: w.file, line: w.line, point: w.point,
           detail: `EXEC CICS WRITEQ TD QUEUE('${w.queue}'), which the CSD sends out of the region to DD ${dd}` });
       }
       if (!declared) stats.tdWritesUndecided++;
@@ -1259,6 +1465,19 @@ export function analyze(root, opts = {}) {
     }
   }
 
+  // Each node's edges, in the order they were added: outStart[id] up to outStart[id + 1] index outTo
+  // and outMeta.
+  const outStart = new Int32Array(nodes.length + 1);
+  for (let k = 0; k < edgeFrom.length; k++) outStart[edgeFrom[k] + 1]++;
+  for (let i = 0; i < nodes.length; i++) outStart[i + 1] += outStart[i];
+  const outTo = new Int32Array(edgeFrom.length);
+  const outMeta = new Array(edgeFrom.length);
+  {
+    const fill = outStart.slice(0, nodes.length);
+    for (let k = 0; k < edgeFrom.length; k++) { const at = fill[edgeFrom[k]]++; outTo[at] = edgeTo[k]; outMeta[at] = edgeMeta[k]; }
+    edgeFrom.length = 0; edgeTo.length = 0; edgeMeta.length = 0;
+  }
+
   // Only nodes that can reach some sink are worth walking into. One backward pass over a transient
   // reverse index answers that for every source at once; it is a superset, so nothing is lost.
   // Two answers, one bit each: whether a node reaches a sink a source at rest could be reported at,
@@ -1269,11 +1488,11 @@ export function analyze(root, opts = {}) {
   const canReach = new Uint8Array(nodes.length);
   {
     const revStart = new Int32Array(nodes.length + 1);
-    for (const n of nodes) for (const e of n.edgesOut) revStart[e.to.id + 1]++;
+    for (let k = 0; k < outTo.length; k++) revStart[outTo[k] + 1]++;
     for (let i = 0; i < nodes.length; i++) revStart[i + 1] += revStart[i];
     const fill = revStart.slice(0, nodes.length);
     const rev = new Int32Array(revStart[nodes.length]);
-    for (const n of nodes) for (const e of n.edgesOut) rev[fill[e.to.id]++] = n.id;
+    for (let id = 0; id < nodes.length; id++) for (let k = outStart[id]; k < outStart[id + 1]; k++) rev[fill[outTo[k]]++] = id;
     const mark = (bit, seeds) => {
       const queue = [];
       for (const n of nodes) if (seeds(n)) { canReach[n.id] |= bit; queue.push(n.id); }
@@ -1381,25 +1600,26 @@ export function analyze(root, opts = {}) {
     for (let i = 0; i < open.length; i++) {
       const st = open[i];
       for (const c of at.get(st.node.id) || []) if (!holds(st.since, c.sink.point, c.sink.kind, c.sink.limit, c.sink.offset, c.sink.nonNeg, c.sink)) lost.add(c);
-      for (const e of st.node.edgesOut) {
+      for (let k = outStart[st.node.id]; k < outStart[st.node.id + 1]; k++) {
         edgesWalked++;
-        const to = e.to;
+        const e = outMeta[k];
+        const to = nodes[outTo[k]];
         if (!(canReach[to.id] & reach)) continue;
         const mv = moves(e);
         if (mv && holds(st.since, pointOfEdge(e), kind, null, shift)) continue;
-        const t = cross(st, e);
+        const t = cross(st, e, to);
         if (!t) continue;
         const since = mv ? [to] : [...st.since, to];
         // An arrival carrying a checked node is refused more than one that does not, so it must not
         // stand in for it.
         const guarded = since.some((n) => n.checks || n.guard);
         if (t.partial) {
-          const key = `${to.id}|${guarded}|${t.ctx}`;
+          const key = atContext(to.id, t.ctx, guarded ? 1 : 0);
           const held = parts.get(key);
           if (held && held.some((r) => (r[2] ? t.vague : !t.vague && r[0] <= t.lo && t.hi <= r[1]))) continue;
           if (held) held.push([t.lo, t.hi, t.vague]); else parts.set(key, [[t.lo, t.hi, t.vague]]);
         } else if (guarded) {
-          const dk = `${to.id}|${t.ctx}`;
+          const dk = atContext(to.id, t.ctx);
           if (stampWhole[to.id] === walk || dirty.get(dk) === walk) continue;
           dirty.set(dk, walk);
         } else if (!firstVisit(to.id, t.ctx)) continue;
@@ -1423,10 +1643,12 @@ export function analyze(root, opts = {}) {
   const stampWhole = new Int32Array(nodes.length);
   // A whole node reached with a call context, per walk. Reached with none, it stands in for every context.
   const stampCtx = new Map();
+  // A node and a call context as one number, with room for a second bit of state.
+  const atContext = (id, ctx, bit = 0) => (ctx * 2 + bit) * nodes.length + id;
   const firstVisit = (id, ctx) => {
     if (stampWhole[id] === walk) return false;
     if (!ctx) { stampWhole[id] = walk; return true; }
-    const key = `${id}|${ctx}`;
+    const key = atContext(id, ctx);
     if (stampCtx.get(key) === walk) return false;
     stampCtx.set(key, walk);
     return true;
@@ -1447,24 +1669,49 @@ export function analyze(root, opts = {}) {
   // it does not. Both walks below cross edges through this, so neither can take a route the other
   // would refuse.
   const known = (n) => n.off != null && n.size != null && !n.repeats;
-  // The call sites a value entered its callees through, innermost last, as a string; empty where any
-  // caller may be returned to: a value born in the callee, or one that rested in storage a program
-  // keeps between calls, which a later call from any caller can read.
+  // The call sites a value entered its callees through, innermost last, as a number standing for
+  // that sequence; 0 where any caller may be returned to: a value born in the callee, or one that
+  // rested in storage a program keeps between calls, which a later call from any caller can read.
   const CONTEXT_DEPTH = 4;
-  function contextOver(state, e) {
-    const ctx = state.ctx || '';
+  const contextSites = [[]];
+  const contextNumber = new Map([['', 0]]);
+  const entered = new Map();
+  const returned = new Map();
+  const contextOf = (sites) => {
+    const k = sites.join('/');
+    let c = contextNumber.get(k);
+    if (c === undefined) { c = contextSites.length; contextSites.push(sites); contextNumber.set(k, c); }
+    return c;
+  };
+  function contextOver(state, e, to) {
+    const ctx = state.ctx || 0;
     if (e.ret != null) {
-      if (!ctx) return '';
-      const sites = ctx.split('/');
-      return Number(sites[sites.length - 1]) === e.ret ? sites.slice(0, -1).join('/') : null;
+      if (!ctx) return 0;
+      let byRet = returned.get(ctx);
+      if (!byRet) returned.set(ctx, byRet = new Map());
+      let out = byRet.get(e.ret);
+      if (out === undefined) {
+        const sites = contextSites[ctx];
+        out = Number(sites[sites.length - 1]) === e.ret ? contextOf(sites.slice(0, -1)) : null;
+        byRet.set(e.ret, out);
+      }
+      return out;
     }
-    if (e.call != null) return [...(ctx ? ctx.split('/') : []), String(e.call)].slice(-CONTEXT_DEPTH).join('/');
-    return e.to.linkage ? ctx : '';
+    if (e.call != null) {
+      let byCall = entered.get(ctx);
+      if (!byCall) entered.set(ctx, byCall = new Map());
+      let out = byCall.get(e.call);
+      if (out === undefined) {
+        out = contextOf([...contextSites[ctx], String(e.call)].slice(-CONTEXT_DEPTH));
+        byCall.set(e.call, out);
+      }
+      return out;
+    }
+    return to.linkage ? ctx : 0;
   }
-  function cross(state, e) {
+  function cross(state, e, to) {
     const cur = state.node;
-    const to = e.to;
-    const ctx = contextOver(state, e);
+    const ctx = contextOver(state, e, to);
     if (ctx === null) return null;
     let partial = false, lo = 0, hi = 0, vague = false;
     if (opts.legacyGroupEdges) { /* every edge carries the whole item */ }
@@ -1613,16 +1860,17 @@ export function analyze(root, opts = {}) {
           if (best.level && !own) credited.push({ finding: findings[findings.length - 1], node: cur, sink, level: best.level });
           if (sink.group) useGroup.set(findings[findings.length - 1], `${src.kind}|${src.file}:${src.line}|${sink.kind}|${sink.group}`);
         }
-        for (const e of cur.edgesOut) {
+        for (let k = outStart[cur.id]; k < outStart[cur.id + 1]; k++) {
           if (++edgesWalked - began > walkBudget) { cut = true; break; }
-          if (!(canReach[e.to.id] & reach)) continue;
-          const to = e.to;
-          const crossed = cross(state, e);
+          const e = outMeta[k];
+          const to = nodes[outTo[k]];
+          if (!(canReach[to.id] & reach)) continue;
+          const crossed = cross(state, e, to);
           if (!crossed) continue;
           if (crossedEdges) crossedEdges.push({ from: cur.id, to: to.id, e });
           const { partial, lo, hi, vague, ctx } = crossed;
           if (partial) {
-            const pk = `${to.id}|${ctx}`;
+            const pk = atContext(to.id, ctx);
             const held = partSeen.get(pk);
             if (held && held.some(r => (r[2] ? vague : !vague && r[0] <= lo && hi <= r[1]))) continue;
             if (held) held.push([lo, hi, vague]); else partSeen.set(pk, [[lo, hi, vague]]);
@@ -1715,6 +1963,8 @@ export function analyze(root, opts = {}) {
   return { findings, constructs, unstarted, startedBy, stats, sourceKinds: SOURCE_KINDS, sinkKinds: SINK_KINDS, ...(sinks ? { sinks } : {}), ...(sources ? { sources } : {}) };
 }
 
+export const analyze = (root, opts = {}) => drive(analyzeSteps(root, opts));
+
 // What the size check across a CALL needs from an item: its bytes, the bytes from it to the end of
 // the record it sits in, whether a table inside it is variable, and where it was declared.
 function extentOf(item) {