@scriptc/compiler 0.0.10 → 0.0.12

package/dist/library/int-infer.js

@@ -0,0 +1,1314 @@
+/* ── the abstract domain ────────────────────────────────────────────────── */
+export const SAFE_MAX = 2 ** 53 - 1; // Number.MAX_SAFE_INTEGER
+export const SAFE_MIN = -SAFE_MAX;
+const normZero = (x) => (Object.is(x, -0) ? 0 : x);
+export function absVal(lo, hi, whole, maybeNaN, spelling) {
+    lo = normZero(lo);
+    hi = normZero(hi);
+    // Infinities are not integers: a set with a non-finite bound may
+    // contain them, so the wholeness claim drops.
+    if (whole && !(Number.isFinite(lo) && Number.isFinite(hi)))
+        whole = false;
+    const v = { lo, hi, whole, maybeNaN };
+    if (spelling !== undefined)
+        v.spelling = spelling;
+    return v;
+}
+/** Any f64 a caller could pass — unbounded, not whole, NaN included. */
+export const TOP = { lo: -Infinity, hi: Infinity, whole: false, maybeNaN: true };
+/** The empty set (unreachable): lo > hi and no NaN. */
+export const BOTTOM = { lo: Infinity, hi: -Infinity, whole: true, maybeNaN: false };
+export const isBottom = (v) => v.lo > v.hi && !v.maybeNaN;
+export const isSingleton = (v) => v.lo === v.hi && !v.maybeNaN;
+const hasNumeric = (v) => v.lo <= v.hi;
+export function constVal(value, spelling) {
+    if (Number.isNaN(value))
+        return { lo: Infinity, hi: -Infinity, whole: false, maybeNaN: true };
+    return absVal(value, value, Number.isInteger(value), false, spelling);
+}
+/** Least upper bound: interval hull, wholeness/NaN pessimism, spelling
+ * kept only when both sides carry the same one. */
+export function join(a, b) {
+    if (isBottom(a))
+        return b;
+    if (isBottom(b))
+        return a;
+    const numA = hasNumeric(a);
+    const numB = hasNumeric(b);
+    const lo = numA && numB ? Math.min(a.lo, b.lo) : numA ? a.lo : b.lo;
+    const hi = numA && numB ? Math.max(a.hi, b.hi) : numA ? a.hi : b.hi;
+    const whole = (numA ? a.whole : true) && (numB ? b.whole : true);
+    const spelling = a.spelling !== undefined && a.spelling === b.spelling ? a.spelling : undefined;
+    return absVal(lo, hi, whole, a.maybeNaN || b.maybeNaN, spelling);
+}
+export function sameVal(a, b) {
+    return a.lo === b.lo && a.hi === b.hi && a.whole === b.whole && a.maybeNaN === b.maybeNaN && a.spelling === b.spelling;
+}
+/* Threshold widening: when a loop-header join keeps growing, jump each
+ * still-moving bound to the next threshold instead of crawling one
+ * iteration at a time. The thresholds are the ranges the boundary check
+ * cares about, so precision is lost only past the points where the
+ * verdict would change anyway. */
+const WIDEN_THRESHOLDS = [0, 2 ** 31 - 1, 2 ** 32 - 1, SAFE_MAX, Infinity];
+const WIDEN_THRESHOLDS_NEG = [0, -(2 ** 31), SAFE_MIN, -Infinity];
+export function widen(prev, next) {
+    if (isBottom(prev))
+        return next;
+    let lo = next.lo;
+    let hi = next.hi;
+    if (next.lo < prev.lo)
+        lo = WIDEN_THRESHOLDS_NEG.find((t) => t <= next.lo) ?? -Infinity;
+    if (next.hi > prev.hi)
+        hi = WIDEN_THRESHOLDS.find((t) => t >= next.hi) ?? Infinity;
+    return absVal(lo, hi, next.whole, next.maybeNaN, next.spelling);
+}
+/* ── transfer functions (JS semantics, never idealized math) ───────────── */
+/* Endpoint product with the JS wrinkle 0 * Infinity = NaN handled for
+ * BOUND purposes: as an interval bound the correct limit is 0 (the NaN is
+ * the maybeNaN flag's business). */
+function boundMul(a, b) {
+    if (a === 0 || b === 0)
+        return 0;
+    return a * b;
+}
+function transferAdd(a, b) {
+    let maybeNaN = a.maybeNaN || b.maybeNaN;
+    if (!hasNumeric(a) || !hasNumeric(b))
+        return { ...BOTTOM, maybeNaN };
+    // Infinity + -Infinity = NaN: possible when opposite infinities meet.
+    if ((a.hi === Infinity && b.lo === -Infinity) || (a.lo === -Infinity && b.hi === Infinity))
+        maybeNaN = true;
+    return absVal(a.lo + b.lo, a.hi + b.hi, a.whole && b.whole, maybeNaN);
+}
+function transferSub(a, b) {
+    let maybeNaN = a.maybeNaN || b.maybeNaN;
+    if (!hasNumeric(a) || !hasNumeric(b))
+        return { ...BOTTOM, maybeNaN };
+    if ((a.hi === Infinity && b.hi === Infinity) || (a.lo === -Infinity && b.lo === -Infinity))
+        maybeNaN = true;
+    return absVal(a.lo - b.hi, a.hi - b.lo, a.whole && b.whole, maybeNaN);
+}
+function transferMul(a, b) {
+    let maybeNaN = a.maybeNaN || b.maybeNaN;
+    if (!hasNumeric(a) || !hasNumeric(b))
+        return { ...BOTTOM, maybeNaN };
+    // 0 * Infinity = NaN: possible when one side may be 0 and the other infinite.
+    const aHasZero = a.lo <= 0 && a.hi >= 0;
+    const bHasZero = b.lo <= 0 && b.hi >= 0;
+    const aInf = a.lo === -Infinity || a.hi === Infinity;
+    const bInf = b.lo === -Infinity || b.hi === Infinity;
+    if ((aHasZero && bInf) || (bHasZero && aInf))
+        maybeNaN = true;
+    const p = [boundMul(a.lo, b.lo), boundMul(a.lo, b.hi), boundMul(a.hi, b.lo), boundMul(a.hi, b.hi)];
+    return absVal(Math.min(...p), Math.max(...p), a.whole && b.whole, maybeNaN);
+}
+function transferDiv(a, b) {
+    const maybeNaN = a.maybeNaN || b.maybeNaN;
+    if (!hasNumeric(a) || !hasNumeric(b))
+        return { ...BOTTOM, maybeNaN };
+    // Divisor exactly 0: x/0 is ±Infinity (sign by the dividend), 0/0 NaN.
+    if (isSingleton(b) && b.lo === 0) {
+        const nanPossible = maybeNaN || (a.lo <= 0 && a.hi >= 0);
+        const lo = a.lo < 0 ? -Infinity : Infinity; // -Infinity reachable iff some dividend < 0
+        const hi = a.hi > 0 ? Infinity : -Infinity; // +Infinity reachable iff some dividend > 0
+        if (lo > hi)
+            return { ...BOTTOM, maybeNaN: nanPossible }; // only 0/0: no numeric members
+        return absVal(lo, hi, false, nanPossible);
+    }
+    // Divisor may be 0 among other values: give up on precision.
+    if (b.lo <= 0 && b.hi >= 0)
+        return { ...TOP };
+    const q = [a.lo / b.lo, a.lo / b.hi, a.hi / b.lo, a.hi / b.hi];
+    const lo = Math.min(...q);
+    const hi = Math.max(...q);
+    // Division does not preserve wholeness (7 / 2 = 3.5); the one provable
+    // case is a singleton landing on an integer.
+    return absVal(lo, hi, lo === hi && Number.isInteger(lo), maybeNaN);
+}
+function transferMod(a, b) {
+    let maybeNaN = a.maybeNaN || b.maybeNaN;
+    if (!hasNumeric(a) || !hasNumeric(b))
+        return { ...BOTTOM, maybeNaN };
+    // x % 0 = NaN; Infinity % y = NaN.
+    if (b.lo <= 0 && b.hi >= 0)
+        maybeNaN = true;
+    if (a.lo === -Infinity || a.hi === Infinity)
+        maybeNaN = true;
+    if (isSingleton(a) && isSingleton(b) && !maybeNaN)
+        return constVal(a.lo % b.lo);
+    // JS remainder: the sign follows the DIVIDEND; |r| < |divisor|.
+    const dMax = Math.max(Math.abs(b.lo), Math.abs(b.hi));
+    const bound = a.whole && b.whole && Number.isFinite(dMax) ? dMax - 1 : dMax;
+    const lo = a.lo < 0 ? -bound : 0;
+    const hi = a.hi > 0 ? bound : 0;
+    return absVal(lo, hi, a.whole && b.whole, maybeNaN);
+}
+function transferPow(a, b) {
+    const maybeNaN = a.maybeNaN || b.maybeNaN;
+    if (!hasNumeric(a) || !hasNumeric(b))
+        return { ...BOTTOM, maybeNaN };
+    if (isSingleton(a) && isSingleton(b) && !maybeNaN)
+        return constVal(a.lo ** b.lo);
+    // Provable without folding: whole base ≥ 1 with whole non-negative
+    // exponent (pow is monotone in both arguments on that region).
+    if (a.whole && b.whole && b.lo >= 0 && a.lo >= 1) {
+        return absVal(a.lo ** b.lo, a.hi ** b.hi, true, maybeNaN);
+    }
+    // Anything else (negative bases, fractional exponents): NaN is
+    // reachable ((-1) ** 0.5), so give up rather than enumerate corners.
+    return { ...TOP };
+}
+/* The bitwise coercion contract, exactly: each operand passes through
+ * ToInt32 (ToUint32 for >>>), which maps NaN and the infinities to 0 and
+ * truncates-and-wraps everything else; shift counts mask to 5 bits. The
+ * RESULT is therefore always whole and in int32 (uint32 for >>>) range
+ * no matter what the inputs were — `x | 0` is a proof, not a hint. */
+function transferBitwise(op, a, b) {
+    if (isSingleton(a) && isSingleton(b)) {
+        const x = a.lo;
+        const y = b.lo;
+        const r = op === "&" ? x & y :
+            op === "|" ? x | y :
+                op === "^" ? x ^ y :
+                    op === "<<" ? x << y :
+                        op === ">>" ? x >> y :
+                            x >>> y;
+        return constVal(r);
+    }
+    if (op === ">>>")
+        return absVal(0, 2 ** 32 - 1, true, false);
+    return absVal(-(2 ** 31), 2 ** 31 - 1, true, false);
+}
+/** JS `~`: ToInt32, complement — whole, int32 range, whatever the input. */
+export function transferBitNot(a) {
+    if (isSingleton(a))
+        return constVal(~a.lo);
+    return absVal(-(2 ** 31), 2 ** 31 - 1, true, false);
+}
+export function transferNeg(a) {
+    if (!hasNumeric(a))
+        return { ...BOTTOM, maybeNaN: a.maybeNaN };
+    return absVal(-a.hi, -a.lo, a.whole, a.maybeNaN);
+}
+export function transferBin(op, a, b) {
+    switch (op) {
+        case "+": return transferAdd(a, b);
+        case "-": return transferSub(a, b);
+        case "*": return transferMul(a, b);
+        case "/": return transferDiv(a, b);
+        case "%": return transferMod(a, b);
+        case "**": return transferPow(a, b);
+        case "&":
+        case "|":
+        case "^":
+        case "<<":
+        case ">>":
+        case ">>>":
+            return transferBitwise(op, a, b);
+        default:
+            // Comparisons produce bool, not a numeric abstract value.
+            return { ...TOP };
+    }
+}
+/** The Math rounding family is the author's stated intent: every finite
+ * input maps to a whole output, so these discharge the WHOLENESS
+ * obligation. They do not discharge range (an unbounded input stays
+ * unbounded) or NaN (Math.trunc(NaN) is NaN — maybeNaN propagates). */
+export function transferMathRound(fn, a) {
+    if (!hasNumeric(a))
+        return { ...BOTTOM, maybeNaN: a.maybeNaN };
+    const f = fn === "trunc" ? Math.trunc : fn === "floor" ? Math.floor : fn === "ceil" ? Math.ceil : Math.round;
+    return absVal(f(a.lo), f(a.hi), true, a.maybeNaN);
+}
+export function transferAbs(a) {
+    if (!hasNumeric(a))
+        return { ...BOTTOM, maybeNaN: a.maybeNaN };
+    const lo = a.lo <= 0 && a.hi >= 0 ? 0 : Math.min(Math.abs(a.lo), Math.abs(a.hi));
+    return absVal(lo, Math.max(Math.abs(a.lo), Math.abs(a.hi)), a.whole, a.maybeNaN);
+}
+/** Math.min/max propagate NaN from ANY argument, exactly as JS does. */
+export function transferMinMax(fn, args) {
+    const maybeNaN = args.some((v) => v.maybeNaN);
+    if (args.some((v) => !hasNumeric(v)))
+        return { ...BOTTOM, maybeNaN };
+    const lo = fn === "min" ? Math.min(...args.map((v) => v.lo)) : Math.max(...args.map((v) => v.lo));
+    const hi = fn === "min" ? Math.min(...args.map((v) => v.hi)) : Math.max(...args.map((v) => v.hi));
+    return absVal(lo, hi, args.every((v) => v.whole), maybeNaN);
+}
+/** Does an integer literal's source spelling survive the trip through
+ * f64? Parse, convert, format back, compare (numeric separators were
+ * stripped by the frontend — they are spelling sugar, not value). */
+export function spellingRoundTrips(spelling) {
+    return String(Number(spelling)) === spelling;
+}
+/** Check a converged abstract value against a slot's obligations, in the
+ * teaching-quality order: representability, then NaN, then range, then
+ * fractional wholeness — the FIRST failure names the refusal (a value
+ * both fractional and out of range hears about the more fundamental
+ * problem). */
+export function checkBoundary(v, path, cls, loc) {
+    // Representability first: the author wrote a number the program never held.
+    if (v.spelling !== undefined && !spellingRoundTrips(v.spelling)) {
+        return {
+            path, cls, loc, outcome: "refuse", obligation: "representability",
+            detail: `the literal ${v.spelling} is not representable as f64 — it reads back as ${Number(v.spelling)}`,
+            fix: "write the nearest representable integer explicitly, or restructure so the value stays within ±(2^53 − 1)",
+        };
+    }
+    if (isBottom(v)) {
+        // The slot is unreachable on every path; vacuously proven.
+        return { path, cls, loc, outcome: "prove", provenLo: NaN, provenHi: NaN };
+    }
+    if (v.maybeNaN) {
+        return {
+            path, cls, loc, outcome: "refuse", obligation: "wholeness",
+            detail: "the value may be NaN, which is not a whole number",
+            fix: "guard the value with a comparison before the boundary (any ordered comparison excludes NaN), then state intent with Math.trunc/Math.floor/Math.ceil/Math.round if it may be fractional",
+        };
+    }
+    const min = cls === "u64" ? 0 : SAFE_MIN;
+    if (!(v.lo >= min && v.hi <= SAFE_MAX)) {
+        return {
+            path, cls, loc, outcome: "refuse", obligation: "range",
+            detail: `the proven range [${v.lo}, ${v.hi}] does not fit ${cls === "u64" ? `[0, ${SAFE_MAX}]` : `[${SAFE_MIN}, ${SAFE_MAX}]`} — integrality is provable only within ±(2^53 − 1)` +
+                (cls === "u64" ? ", and a u64 slot additionally requires a non-negative proven range" : ""),
+            fix: "bound the value before the boundary (clamp, compare, or restructure the computation to stay in range)",
+        };
+    }
+    if (!v.whole) {
+        return {
+            path, cls, loc, outcome: "refuse", obligation: "wholeness",
+            detail: `the value is not provably whole — the proven range [${v.lo}, ${v.hi}] may contain non-integers`,
+            fix: "state intent at the boundary with Math.trunc, Math.floor, Math.ceil, or Math.round",
+        };
+    }
+    return { path, cls, loc, outcome: "prove", provenLo: v.lo, provenHi: v.hi };
+}
+export function hasIntSlots(cfg) {
+    if (cfg.records.size > 0)
+        return true;
+    for (const f of cfg.fns.values()) {
+        if (f.ret !== null || f.params.some((p) => p !== null))
+            return true;
+    }
+    return false;
+}
+/** The class seed for a declared parameter: what the slot's own contract
+ * proves about every value that ever arrives through it (internal calls
+ * are checked at their call sites; external calls range-check in the
+ * marshalling wrapper). */
+export function classSeed(cls) {
+    switch (cls) {
+        case "i64": return absVal(SAFE_MIN, SAFE_MAX, true, false);
+        case "u64": return absVal(0, SAFE_MAX, true, false);
+        case "u8": return absVal(0, 255, true, false);
+        case "u32": return absVal(0, 2 ** 32 - 1, true, false);
+        case "i32": return absVal(-(2 ** 31), 2 ** 31 - 1, true, false);
+        default: return { ...TOP };
+    }
+}
+const isGlobalId = (id) => id.startsWith("%g.");
+const defaultVal = (id) => (isGlobalId(id) ? TOP : BOTTOM);
+function envGet(env, id) {
+    return env.get(id) ?? defaultVal(id);
+}
+function joinEnv(a, b) {
+    if (a === null)
+        return b === null ? null : new Map(b);
+    if (b === null)
+        return new Map(a);
+    const out = new Map();
+    const keys = new Set([...a.keys(), ...b.keys()]);
+    for (const k of keys) {
+        out.set(k, join(a.get(k) ?? defaultVal(k), b.get(k) ?? defaultVal(k)));
+    }
+    return out;
+}
+function envEquals(a, b) {
+    const keys = new Set([...a.keys(), ...b.keys()]);
+    for (const k of keys) {
+        if (!sameVal(a.get(k) ?? defaultVal(k), b.get(k) ?? defaultVal(k)))
+            return false;
+    }
+    return true;
+}
+function widenEnv(prev, next) {
+    const out = new Map();
+    const keys = new Set([...prev.keys(), ...next.keys()]);
+    for (const k of keys) {
+        out.set(k, widen(prev.get(k) ?? defaultVal(k), next.get(k) ?? defaultVal(k)));
+    }
+    return out;
+}
+function globalEffectsOf(mod) {
+    const writes = new Map();
+    const calls = new Map();
+    const unknown = new Set();
+    const typeHasFunc = (t) => JSON.stringify(t).includes('"func"');
+    for (const fn of mod.functions) {
+        const w = new Set();
+        const c = new Set();
+        let u = false;
+        const visitExpr = (e) => {
+            switch (e.kind) {
+                case "assignExpr":
+                    if (isGlobalId(e.localId))
+                        w.add(e.localId);
+                    visitExpr(e.value);
+                    return;
+                case "incDec":
+                    if (isGlobalId(e.localId))
+                        w.add(e.localId);
+                    return;
+                case "call":
+                    c.add(e.callee);
+                    e.args.forEach(visitExpr);
+                    return;
+                case "callValue":
+                case "newValue":
+                case "dynCall":
+                case "dynInvoke":
+                case "virtualCall":
+                case "new":
+                case "intrinsic":
+                    u = true;
+                    break;
+                case "libCall":
+                    if (e.args.some((a) => typeHasFunc(a.type)))
+                        u = true;
+                    break;
+                case "seqExpr":
+                    e.stmts.forEach(visitStmt);
+                    visitExpr(e.result);
+                    return;
+                default:
+                    break;
+            }
+            for (const key of Object.keys(e)) {
+                const v = e[key];
+                if (Array.isArray(v)) {
+                    for (const item of v) {
+                        if (item !== null && typeof item === "object" && "kind" in item) {
+                            const it = item;
+                            if (typeof it.kind === "string")
+                                visitExpr(item);
+                        }
+                        else if (item !== null && typeof item === "object") {
+                            // field-shaped entries ({ name, value } etc.)
+                            for (const sub of Object.values(item)) {
+                                if (sub !== null && typeof sub === "object" && typeof sub.kind === "string") {
+                                    visitExpr(sub);
+                                }
+                            }
+                        }
+                    }
+                }
+                else if (v !== null && typeof v === "object" && typeof v.kind === "string" && key !== "type") {
+                    visitExpr(v);
+                }
+            }
+        };
+        const visitStmt = (s) => {
+            switch (s.kind) {
+                case "assign":
+                    if (isGlobalId(s.localId))
+                        w.add(s.localId);
+                    visitExpr(s.value);
+                    return;
+                case "varDecl":
+                    if (s.init !== null)
+                        visitExpr(s.init);
+                    return;
+                default:
+                    break;
+            }
+            for (const v of Object.values(s)) {
+                if (Array.isArray(v)) {
+                    for (const item of v) {
+                        if (item !== null && typeof item === "object" && typeof item.kind === "string") {
+                            const node = item;
+                            if (isStmtKind(node.kind))
+                                visitStmt(item);
+                            else
+                                visitExpr(item);
+                        }
+                        else if (item !== null && typeof item === "object") {
+                            // switch cases: { test, body }
+                            const cs = item;
+                            if (cs.test !== undefined && cs.test !== null)
+                                visitExpr(cs.test);
+                            if (Array.isArray(cs.body))
+                                cs.body.forEach(visitStmt);
+                        }
+                    }
+                }
+                else if (v !== null && typeof v === "object" && typeof v.kind === "string") {
+                    const node = v;
+                    if (isStmtKind(node.kind))
+                        visitStmt(v);
+                    else
+                        visitExpr(v);
+                }
+            }
+        };
+        fn.body.forEach(visitStmt);
+        writes.set(fn.name, w);
+        calls.set(fn.name, c);
+        if (u)
+            unknown.add(fn.name);
+    }
+    // Transitive closure over the direct-call graph.
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const [name, callees] of calls) {
+            const w = writes.get(name);
+            for (const callee of callees) {
+                if (unknown.has(callee) && !unknown.has(name)) {
+                    unknown.add(name);
+                    changed = true;
+                }
+                for (const g of writes.get(callee) ?? []) {
+                    if (!w.has(g)) {
+                        w.add(g);
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+    return { perFn: writes, havocAll: unknown };
+}
+const STMT_KINDS = new Set([
+    "varDecl", "assign", "exprStmt", "if", "while", "doWhile", "switch", "for",
+    "arraySet", "bytesSet", "forOf", "return", "fieldSet", "recordSet",
+    "recordKeySet", "recordKeyDelete", "break", "continue", "block", "throw",
+    "runtimeFence", "rethrow", "tryCatch",
+]);
+const isStmtKind = (k) => STMT_KINDS.has(k);
+/* ── the analyzer ──────────────────────────────────────────────────────── */
+const WIDEN_AFTER = 3; // plain joins at a loop header before widening
+const LOOP_CAP = 64; // hard bound; thresholds converge far earlier
+const NEGATE = { "<": ">=", "<=": ">", ">": "<=", ">=": "<", "===": "!==", "!==": "===" };
+const FLIP = { "<": ">", "<=": ">=", ">": "<", ">=": "<=", "===": "===", "!==": "!==" };
+const CMP_OPS = new Set(["<", "<=", ">", ">=", "===", "!=="]);
+/** Meet a value with an interval; `clearNaN` when the comparison's truth
+ * on this edge excludes NaN operands. */
+function meetInterval(v, lo, hi, clearNaN) {
+    const newLo = Math.max(v.lo, lo);
+    const newHi = Math.min(v.hi, hi);
+    if (newLo > newHi) {
+        // No numeric member survives this edge; NaN may still flow through.
+        return { ...BOTTOM, maybeNaN: clearNaN ? false : v.maybeNaN };
+    }
+    return absVal(newLo, newHi, v.whole, clearNaN ? false : v.maybeNaN, v.spelling);
+}
+/** Refine `a` under the assumption `a OP b` held. Wholeness sharpens the
+ * strict bounds: whole x < b ⇒ x ≤ ⌈b.hi⌉ − 1 — the rule that lets the
+ * ordinary counter loop prove a precise bound. */
+function refineLhs(op, a, b, clearNaN) {
+    if (!hasNumeric(b) || !hasNumeric(a))
+        return clearNaN ? { ...a, maybeNaN: false } : a;
+    switch (op) {
+        case "<":
+            return meetInterval(a, -Infinity, a.whole ? Math.ceil(b.hi) - 1 : b.hi, clearNaN);
+        case "<=":
+            return meetInterval(a, -Infinity, a.whole ? Math.floor(b.hi) : b.hi, clearNaN);
+        case ">":
+            return meetInterval(a, a.whole ? Math.floor(b.lo) + 1 : b.lo, Infinity, clearNaN);
+        case ">=":
+            return meetInterval(a, a.whole ? Math.ceil(b.lo) : b.lo, Infinity, clearNaN);
+        case "===":
+            return meetInterval(a, b.lo, b.hi, clearNaN);
+        case "!==": {
+            // Only endpoint exclusion is useful: whole x !== integer singleton k
+            // sitting on an endpoint of x's interval.
+            if (isSingleton(b) && a.whole && Number.isInteger(b.lo)) {
+                if (a.lo === b.lo)
+                    return meetInterval(a, a.lo + 1, a.hi, clearNaN);
+                if (a.hi === b.lo)
+                    return meetInterval(a, a.lo, a.hi - 1, clearNaN);
+            }
+            return clearNaN ? { ...a, maybeNaN: false } : a;
+        }
+        default:
+            return a;
+    }
+}
+class FnAnalyzer {
+    mod;
+    cfg;
+    effects;
+    verdicts;
+    frames = [];
+    collect = false;
+    /** Return-site abstract values (for the declared-return check). */
+    constructor(mod, cfg, effects, verdicts) {
+        this.mod = mod;
+        this.cfg = cfg;
+        this.effects = effects;
+        this.verdicts = verdicts;
+    }
+    analyze(fn) {
+        const env = new Map();
+        const slots = this.cfg.fns.get(fn.name);
+        fn.params.forEach((p, i) => {
+            if (p.type.kind !== "f64")
+                return;
+            const declared = slots?.params[i] ?? null;
+            const seed = slots?.paramSeeds[i] ?? null;
+            if (declared !== null)
+                env.set(p.localId, classSeed(declared));
+            else if (seed !== null)
+                env.set(p.localId, { ...seed });
+            else
+                env.set(p.localId, { ...TOP });
+        });
+        this.collect = true;
+        this.retSlot = slots !== undefined && slots.ret !== null ? { cls: slots.ret, path: slots.retPath } : null;
+        this.execStmts(fn.body, env);
+    }
+    retSlot = null;
+    emit(v, path, cls, loc) {
+        if (!this.collect)
+            return;
+        this.verdicts.push(checkBoundary(v, path, cls, loc));
+    }
+    /* ── statements ─────────────────────────────────────────────────────── */
+    execStmts(stmts, env) {
+        for (const s of stmts) {
+            if (env === null)
+                return null; // unreachable remainder
+            env = this.execStmt(s, env);
+        }
+        return env;
+    }
+    execStmt(s, env) {
+        switch (s.kind) {
+            case "varDecl": {
+                if (s.init === null)
+                    return env;
+                const v = this.evalExpr(s.init, env);
+                if (this.bindingIsF64(s.localId))
+                    env.set(s.localId, v);
+                return env;
+            }
+            case "assign": {
+                const v = this.evalExpr(s.value, env);
+                if (this.bindingIsF64(s.localId))
+                    env.set(s.localId, v);
+                return env;
+            }
+            case "exprStmt":
+                this.evalExpr(s.expr, env);
+                return env;
+            case "if": {
+                this.evalExpr(s.cond, env);
+                const thenEnv = this.refine(cloneEnv(env), s.cond, true);
+                const elseEnv = this.refine(cloneEnv(env), s.cond, false);
+                const a = thenEnv === null ? null : this.execStmts(s.then, thenEnv);
+                const b = s.else_ === null ? elseEnv : elseEnv === null ? null : this.execStmts(s.else_, elseEnv);
+                return joinEnv(a, b);
+            }
+            case "while":
+                return this.execLoop(env, { cond: s.cond, body: s.body, labels: s.labels ?? [] });
+            case "for": {
+                let e = env;
+                if (s.init !== null)
+                    e = this.execStmt(s.init, e);
+                if (e === null)
+                    return null;
+                return this.execLoop(e, {
+                    ...(s.cond !== null ? { cond: s.cond } : {}),
+                    body: s.body,
+                    ...(s.update !== null ? { update: s.update } : {}),
+                    labels: s.labels ?? [],
+                });
+            }
+            case "doWhile":
+                return this.execLoop(env, { cond: s.cond, body: s.body, labels: s.labels ?? [], doWhile: true });
+            case "forOf": {
+                this.evalExpr(s.iterable, env);
+                const elemF64 = this.bindingIsF64(s.localId);
+                return this.execLoop(env, {
+                    body: s.body,
+                    labels: s.labels ?? [],
+                    alwaysExits: true, // the iteration ends when the array runs out
+                    ...(elemF64 ? { seedEachIteration: s.localId } : {}),
+                });
+            }
+            case "switch": {
+                this.evalExpr(s.disc, env);
+                const frame = { kind: "switch", labels: s.labels ?? [], breaks: [], continues: [] };
+                this.frames.push(frame);
+                let running = null; // the fallthrough path
+                let hasDefault = false;
+                try {
+                    for (const c of s.cases) {
+                        if (c.test === null)
+                            hasDefault = true;
+                        else
+                            this.evalExpr(c.test, env);
+                        running = this.execStmts(c.body, joinEnv(running, cloneEnv(env)));
+                    }
+                }
+                finally {
+                    this.frames.pop();
+                }
+                let out = running;
+                for (const b of frame.breaks)
+                    out = joinEnv(out, b);
+                // Without a default (or with tests that all miss) control skips past.
+                if (!hasDefault)
+                    out = joinEnv(out, env);
+                return out;
+            }
+            case "arraySet":
+            case "bytesSet":
+                this.evalExpr(s.arr, env);
+                this.evalExpr(s.index, env);
+                this.evalExpr(s.value, env);
+                return env;
+            case "fieldSet":
+                this.evalExpr(s.obj, env);
+                this.evalExpr(s.value, env);
+                return env;
+            case "recordSet": {
+                this.evalExpr(s.obj, env);
+                const v = this.evalExpr(s.value, env);
+                const slot = this.cfg.records.get(s.shapeId)?.get(s.field);
+                if (slot !== undefined)
+                    this.emit(v, slot.path, slot.cls, s.loc);
+                return env;
+            }
+            case "recordKeySet":
+                this.evalExpr(s.obj, env);
+                this.evalExpr(s.key, env);
+                this.evalExpr(s.value, env);
+                return env;
+            case "recordKeyDelete":
+                this.evalExpr(s.obj, env);
+                this.evalExpr(s.key, env);
+                return env;
+            case "return": {
+                if (s.value !== null) {
+                    const v = this.evalExpr(s.value, env);
+                    if (this.retSlot !== null)
+                        this.emit(v, this.retSlot.path, this.retSlot.cls, s.loc);
+                }
+                return null;
+            }
+            case "throw":
+                this.evalExpr(s.value, env);
+                return null;
+            case "rethrow":
+            case "runtimeFence":
+                return null;
+            case "break": {
+                const frame = this.jumpTarget(s.label, "break");
+                if (frame !== null)
+                    frame.breaks.push(cloneEnv(env));
+                return null;
+            }
+            case "continue": {
+                const frame = this.jumpTarget(s.label, "continue");
+                if (frame !== null)
+                    frame.continues.push(cloneEnv(env));
+                return null;
+            }
+            case "block": {
+                if ((s.labels ?? []).length === 0)
+                    return this.execStmts(s.body, env);
+                const frame = { kind: "block", labels: s.labels, breaks: [], continues: [] };
+                this.frames.push(frame);
+                let out;
+                try {
+                    out = this.execStmts(s.body, env);
+                }
+                finally {
+                    this.frames.pop();
+                }
+                for (const b of frame.breaks)
+                    out = joinEnv(out, b);
+                return out;
+            }
+            case "tryCatch": {
+                const entry = cloneEnv(env);
+                const afterTry = this.execStmts(s.tryBody, env);
+                let afterCatch = null;
+                if (s.catchBody !== null) {
+                    // The exception may have unwound from ANY point of the try
+                    // body: every binding the try can write (and every global —
+                    // a callee may have mutated some before throwing) is unknown.
+                    afterCatch = this.execStmts(s.catchBody, this.havocForCatch(entry, s.tryBody));
+                }
+                let out = joinEnv(afterTry, afterCatch);
+                if (s.finallyBody !== null) {
+                    // The finally also runs on the pending-exception and
+                    // pending-return paths; obligations inside it must hold there
+                    // too, so it executes over the havoc-joined state.
+                    out = this.execStmts(s.finallyBody, joinEnv(out, this.havocForCatch(entry, s.tryBody)) ?? this.havocForCatch(entry, s.tryBody));
+                }
+                return out;
+            }
+        }
+    }
+    jumpTarget(label, kind) {
+        for (let i = this.frames.length - 1; i >= 0; i--) {
+            const f = this.frames[i];
+            if (label !== undefined) {
+                if (f.labels.includes(label) && (kind === "break" || f.kind === "loop"))
+                    return f;
+                continue;
+            }
+            if (kind === "break" && (f.kind === "loop" || f.kind === "switch"))
+                return f;
+            if (kind === "continue" && f.kind === "loop")
+                return f;
+        }
+        return null;
+    }
+    havocForCatch(entry, tryBody) {
+        const out = cloneEnv(entry);
+        const assigned = new Set();
+        const visitStmt = (s) => {
+            if (s.kind === "assign" || s.kind === "varDecl")
+                assigned.add(s.localId);
+            for (const v of Object.values(s)) {
+                if (Array.isArray(v)) {
+                    for (const item of v) {
+                        if (item !== null && typeof item === "object" && typeof item.kind === "string") {
+                            const node = item;
+                            if (isStmtKind(node.kind))
+                                visitStmt(item);
+                            else
+                                visitExpr(item);
+                        }
+                        else if (item !== null && typeof item === "object") {
+                            const cs = item;
+                            if (Array.isArray(cs.body))
+                                cs.body.forEach(visitStmt);
+                        }
+                    }
+                }
+                else if (v !== null && typeof v === "object" && typeof v.kind === "string") {
+                    const node = v;
+                    if (isStmtKind(node.kind))
+                        visitStmt(v);
+                    else
+                        visitExpr(v);
+                }
+            }
+        };
+        const visitExpr = (e) => {
+            if (e.kind === "assignExpr" || e.kind === "incDec")
+                assigned.add(e.localId);
+            if (e.kind === "seqExpr")
+                e.stmts.forEach(visitStmt);
+            for (const v of Object.values(e)) {
+                if (Array.isArray(v)) {
+                    for (const item of v) {
+                        if (item !== null && typeof item === "object" && typeof item.kind === "string") {
+                            visitExpr(item);
+                        }
+                    }
+                }
+                else if (v !== null && typeof v === "object" && typeof v.kind === "string") {
+                    visitExpr(v);
+                }
+            }
+        };
+        tryBody.forEach(visitStmt);
+        for (const id of assigned) {
+            if (this.bindingIsF64(id))
+                out.set(id, { ...TOP });
+        }
+        // Globals: any callee may have written before the throw.
+        for (const k of [...out.keys()]) {
+            if (isGlobalId(k))
+                out.delete(k); // absent global = TOP
+        }
+        return out;
+    }
+    /* ── loops: header widening + body-edge refinement ──────────────────── */
+    execLoop(env, opts) {
+        const savedCollect = this.collect;
+        this.collect = false;
+        let head = cloneEnv(env);
+        let joins = 0;
+        // Phase 1: fixpoint (collect off). `head` is the state at the loop
+        // header (the condition's evaluation point; for do-while, the body's
+        // entry). Widening applies ONLY here — an acyclic join converges by
+        // itself and keeps its precision; precision the header loses is
+        // recovered by the body-edge refinement below.
+        for (let iter = 0; iter < LOOP_CAP; iter++) {
+            const trip = this.runLoopBodyOnce(head, opts);
+            let next = joinEnv(head, trip.back);
+            joins++;
+            if (joins > WIDEN_AFTER)
+                next = widenEnv(head, next);
+            if (envEquals(head, next))
+                break;
+            head = next;
+            if (iter === LOOP_CAP - 1) {
+                // Safety net (the thresholds converge long before this): give up
+                // on precision rather than loop.
+                for (const k of [...head.keys()])
+                    head.set(k, { ...TOP });
+            }
+        }
+        // Phase 2: one collect pass over the stabilized header state — the
+        // pass that emits verdicts sees the loop-body edge's refined values
+        // (the header may have widened to [0, 2^31−1]; the body sees n < 10
+        // and proves [0, 9]).
+        this.collect = savedCollect;
+        const frame = { kind: "loop", labels: opts.labels, breaks: [], continues: [] };
+        const final = this.runLoopBodyOnce(head, opts, frame);
+        // The exit state: the condition's false edge (evaluated at the
+        // header for while/for, after the body for do-while), joined with
+        // every break's state. A condition-free, non-iterating loop
+        // (`for (;;)`) exits only through breaks.
+        let exit = null;
+        if (opts.doWhile ?? false) {
+            exit = opts.cond !== undefined && final.postBody !== null ? this.refine(final.postBody, opts.cond, false) : null;
+        }
+        else if (opts.cond !== undefined) {
+            exit = this.refine(cloneEnv(head), opts.cond, false);
+        }
+        else if (opts.alwaysExits ?? false) {
+            exit = cloneEnv(head); // for-of ends when the array runs out
+        }
+        for (const b of frame.breaks)
+            exit = joinEnv(exit, b);
+        return exit;
+    }
+    /** One trip around the loop from the header state: refine by the
+     * condition's true edge (unless do-while, whose condition sits after
+     * the body), execute the body, fold continues, run the update, and for
+     * do-while apply the condition's true edge to form the back edge.
+     * `back` is the back-edge environment (null when the body never reaches
+     * it); `postBody` is the do-while exit candidate — the state at the
+     * condition, before its verdict. */
+    runLoopBodyOnce(head, opts, frame) {
+        const f = frame ?? { kind: "loop", labels: opts.labels, breaks: [], continues: [] };
+        let bodyIn = cloneEnv(head);
+        if (opts.cond !== undefined && !(opts.doWhile ?? false)) {
+            this.evalExpr(opts.cond, bodyIn);
+            bodyIn = this.refine(bodyIn, opts.cond, true);
+        }
+        if (bodyIn !== null && opts.seedEachIteration !== undefined) {
+            bodyIn.set(opts.seedEachIteration, { ...TOP });
+        }
+        this.frames.push(f);
+        let out;
+        try {
+            out = bodyIn === null ? null : this.execStmts(opts.body, bodyIn);
+        }
+        finally {
+            this.frames.pop();
+        }
+        for (const c of f.continues)
+            out = joinEnv(out, c);
+        if (opts.update !== undefined && out !== null)
+            out = this.execStmt(opts.update, out);
+        let postBody = null;
+        if ((opts.doWhile ?? false) && opts.cond !== undefined && out !== null) {
+            this.evalExpr(opts.cond, out);
+            postBody = cloneEnv(out);
+            out = this.refine(out, opts.cond, true);
+        }
+        return { back: out, postBody };
+    }
+    /* ── branch refinement ──────────────────────────────────────────────── */
+    /** Refine an environment under `cond === branch`. Returns null when the
+     * edge is impossible. Every ordered comparison (and ===) evaluates
+     * false when either side is NaN, so the edge where one HELD proves both
+     * operands NaN-free; on the failed edge NaN survives while the negated
+     * comparison still refines the numeric members. */
+    refine(env, cond, branch) {
+        if (env === null)
+            return null;
+        switch (cond.kind) {
+            case "boolLit":
+                return cond.value === branch ? env : null;
+            case "unary":
+                if (cond.op === "!")
+                    return this.refine(env, cond.operand, !branch);
+                return env;
+            case "logical": {
+                const isAnd = cond.op === "&&";
+                if (isAnd === branch) {
+                    // (a && b) true  — both held; (a || b) false — both failed.
+                    return this.refine(this.refine(env, cond.left, branch), cond.right, branch);
+                }
+                // (a && b) false — a failed, or a held and b failed; dually for ||.
+                const viaLeft = this.refine(cloneEnv(env), cond.left, branch);
+                const viaRight = this.refine(this.refine(cloneEnv(env), cond.left, !branch), cond.right, branch);
+                return joinEnv(viaLeft, viaRight);
+            }
+            case "bin": {
+                if (!CMP_OPS.has(cond.op))
+                    return env;
+                if (cond.left.type.kind !== "f64" || cond.right.type.kind !== "f64")
+                    return env;
+                if (!this.isPure(cond.left) || !this.isPure(cond.right))
+                    return env;
+                const op = branch ? cond.op : NEGATE[cond.op];
+                // NaN makes < <= > >= === evaluate false, so the edge where one of
+                // those was TRUE proves both operands NaN-free (!== held excludes
+                // nothing — NaN !== x is true).
+                const clearNaN = op !== "!==";
+                const a = this.evalPure(cond.left, env);
+                const b = this.evalPure(cond.right, env);
+                const out = cloneEnv(env);
+                if (cond.left.kind === "varRef")
+                    out.set(cond.left.localId, refineLhs(op, a, b, clearNaN));
+                if (cond.right.kind === "varRef")
+                    out.set(cond.right.localId, refineLhs(FLIP[op], b, a, clearNaN));
+                return out;
+            }
+            case "toBool": {
+                const inner = cond.operand;
+                if (inner.type.kind !== "f64" || inner.kind !== "varRef" || !this.isPure(inner))
+                    return env;
+                const v = envGet(env, inner.localId);
+                const out = cloneEnv(env);
+                if (branch) {
+                    // Truthy: not NaN, not zero — endpoint exclusion when whole.
+                    let r = { ...v, maybeNaN: false };
+                    if (r.whole && r.lo === 0 && r.hi >= 1)
+                        r = absVal(1, r.hi, r.whole, false, r.spelling);
+                    else if (r.whole && r.hi === 0 && r.lo <= -1)
+                        r = absVal(r.lo, -1, r.whole, false, r.spelling);
+                    out.set(inner.localId, r);
+                }
+                else {
+                    // Falsy: 0, -0, or NaN.
+                    out.set(inner.localId, meetInterval(v, 0, 0, false));
+                }
+                return out;
+            }
+            default:
+                return env;
+        }
+    }
+    /** No side effects anywhere in the tree: safe to (re-)evaluate during
+     * refinement. */
+    isPure(e) {
+        switch (e.kind) {
+            case "incDec":
+            case "assignExpr":
+            case "seqExpr":
+            case "call":
+            case "callValue":
+            case "new":
+            case "newValue":
+            case "virtualCall":
+            case "dynCall":
+            case "dynInvoke":
+            case "intrinsic":
+            case "yieldExpr":
+            case "awaitExpr":
+            case "awaitUnionExpr":
+                return false;
+            case "libCall":
+                return e.fn.startsWith("math.") && e.args.every((a) => this.isPure(a));
+            case "numLit":
+            case "strLit":
+            case "boolLit":
+            case "varRef":
+            case "unitLit":
+                return true;
+            case "bin":
+                return this.isPure(e.left) && this.isPure(e.right);
+            case "unary":
+                return this.isPure(e.operand);
+            default:
+                return false;
+        }
+    }
+    /** The abstract value of a PURE f64 expression, no env writes. */
+    evalPure(e, env) {
+        switch (e.kind) {
+            case "numLit":
+                return constVal(e.value, e.spelling);
+            case "varRef":
+                return e.type.kind === "f64" ? envGet(env, e.localId) : { ...TOP };
+            case "unary":
+                if (e.op === "-")
+                    return transferNeg(this.evalPure(e.operand, env));
+                if (e.op === "~")
+                    return transferBitNot(this.evalPure(e.operand, env));
+                return { ...TOP };
+            case "bin":
+                return transferBin(e.op, this.evalPure(e.left, env), this.evalPure(e.right, env));
+            case "libCall":
+                return this.evalMath(e, env, false) ?? { ...TOP };
+            default:
+                return { ...TOP };
+        }
+    }
+    /* ── expression evaluation (side effects applied to env) ────────────── */
+    evalMath(e, env, mutate) {
+        const arg = (i) => (mutate ? this.evalExpr(e.args[i], env) : this.evalPure(e.args[i], env));
+        switch (e.fn) {
+            case "math.trunc": return transferMathRound("trunc", arg(0));
+            case "math.floor": return transferMathRound("floor", arg(0));
+            case "math.ceil": return transferMathRound("ceil", arg(0));
+            case "math.round": return transferMathRound("round", arg(0));
+            case "math.abs": return transferAbs(arg(0));
+            case "math.min": return transferMinMax("min", [arg(0), arg(1)]);
+            case "math.max": return transferMinMax("max", [arg(0), arg(1)]);
+            case "math.random": return absVal(0, 1, false, false); // [0, 1): never NaN, never whole beyond 0
+            default: return null;
+        }
+    }
+    bindingIsF64(id) {
+        return this.f64Bindings.has(id);
+    }
+    f64Bindings = new Set();
+    seedBindings(fn, mod) {
+        this.f64Bindings = new Set();
+        for (const l of fn.locals)
+            if (l.type.kind === "f64" && l.boxed !== true)
+                this.f64Bindings.add(l.id);
+        for (const g of mod.globals ?? [])
+            if (g.type.kind === "f64")
+                this.f64Bindings.add(g.id);
+    }
+    /** Evaluate an expression over the environment, applying the side
+     * effects of nested writes and calls (a call havocs the globals its
+     * transitive callee set can write; an indirect call havocs them all).
+     * The returned value is meaningful for f64-typed expressions; anything
+     * without a modeled transfer is TOP. */
+    evalExpr(e, env) {
+        switch (e.kind) {
+            case "numLit":
+                return constVal(e.value, e.spelling);
+            case "strLit":
+            case "boolLit":
+            case "unitLit":
+            case "regexLit":
+            case "templateStrings":
+            case "classRef":
+            case "selfRef":
+            case "chainRecv":
+                return { ...TOP };
+            case "varRef":
+                return e.type.kind === "f64" && this.bindingIsF64(e.localId) ? envGet(env, e.localId) : { ...TOP };
+            case "bin": {
+                const a = this.evalExpr(e.left, env);
+                const b = this.evalExpr(e.right, env);
+                if (CMP_OPS.has(e.op))
+                    return { ...TOP };
+                if (e.left.type.kind !== "f64" || e.right.type.kind !== "f64")
+                    return { ...TOP };
+                return transferBin(e.op, a, b);
+            }
+            case "unary": {
+                const v = this.evalExpr(e.operand, env);
+                if (e.op === "-")
+                    return transferNeg(v);
+                if (e.op === "~")
+                    return transferBitNot(v);
+                return { ...TOP };
+            }
+            case "incDec": {
+                const old = this.bindingIsF64(e.localId) ? envGet(env, e.localId) : { ...TOP };
+                const next = transferAdd(old, constVal(e.op === "+" ? 1 : -1));
+                if (this.bindingIsF64(e.localId))
+                    env.set(e.localId, next);
+                return e.prefix ? next : old;
+            }
+            case "assignExpr": {
+                const v = this.evalExpr(e.value, env);
+                if (this.bindingIsF64(e.localId))
+                    env.set(e.localId, v);
+                return v;
+            }
+            case "ternary": {
+                this.evalExpr(e.cond, env);
+                const thenEnv = this.refine(cloneEnv(env), e.cond, true);
+                const elseEnv = this.refine(cloneEnv(env), e.cond, false);
+                const a = thenEnv === null ? BOTTOM : this.evalExpr(e.then, thenEnv);
+                const b = elseEnv === null ? BOTTOM : this.evalExpr(e.else_, elseEnv);
+                mergeInto(env, joinEnv(thenEnv, elseEnv));
+                return join(a, b);
+            }
+            case "logical":
+            case "nullish":
+            case "orDefault": {
+                this.evalExpr(e.left, env);
+                const rightEnv = cloneEnv(env);
+                this.evalExpr(e.right, rightEnv);
+                mergeInto(env, joinEnv(env, rightEnv));
+                return { ...TOP };
+            }
+            case "optChain": {
+                this.evalExpr(e.receiver, env);
+                const bodyEnv = cloneEnv(env);
+                this.evalExpr(e.body, bodyEnv);
+                mergeInto(env, joinEnv(env, bodyEnv));
+                return { ...TOP };
+            }
+            case "seqExpr": {
+                // Expression-position statements: no jumps can escape them.
+                let running = env;
+                for (const s of e.stmts) {
+                    if (running === null)
+                        break;
+                    running = this.execStmt(s, running);
+                }
+                if (running === null)
+                    return BOTTOM;
+                if (running !== env)
+                    mergeInto(env, running);
+                return this.evalExpr(e.result, env);
+            }
+            case "call": {
+                // Arguments evaluate left to right and the VALUES captured here
+                // are exactly what the call passes (a later argument's side
+                // effect cannot reach an earlier argument's already-read value).
+                const vals = e.args.map((a) => this.evalExpr(a, env));
+                const slots = this.cfg.fns.get(e.callee);
+                if (slots !== undefined) {
+                    e.args.forEach((arg, i) => {
+                        const cls = slots.params[i] ?? null;
+                        if (cls === null)
+                            return;
+                        this.emit(vals[i], slots.paramPaths[i], cls, arg.loc);
+                    });
+                }
+                this.havocCall(e.callee, env);
+                if (slots?.ret != null)
+                    return classSeed(slots.ret);
+                return { ...TOP };
+            }
+            case "libCall": {
+                const math = this.evalMath(e, env, true);
+                if (math !== null)
+                    return math;
+                for (const a of e.args)
+                    this.evalExpr(a, env);
+                if (e.args.some((a) => typeContainsFunc(a.type)))
+                    this.havocAllGlobals(env);
+                return { ...TOP };
+            }
+            case "callValue":
+            case "newValue":
+            case "dynCall":
+            case "dynInvoke":
+            case "virtualCall":
+            case "new":
+            case "intrinsic": {
+                for (const v of childExprs(e))
+                    this.evalExpr(v, env);
+                this.havocAllGlobals(env);
+                return { ...TOP };
+            }
+            case "recordLit": {
+                const slotMap = this.cfg.records.get(e.type.shapeId);
+                for (const f of e.fields) {
+                    const v = this.evalExpr(f.value, env);
+                    const slot = slotMap?.get(f.name);
+                    if (slot !== undefined && f.value.type.kind === "f64")
+                        this.emit(v, slot.path, slot.cls, f.value.loc);
+                }
+                return { ...TOP };
+            }
+            case "recordGet": {
+                // A declared record-field slot is an assumption on the read side,
+                // exactly like a declared parameter inside its callee: every write
+                // into the field discharged the class's obligations, so the value
+                // read back is whole and in class range (the read that lets
+                // `model.count + 1` refuse RANGE — the unbounded-counter teaching
+                // — instead of a spurious may-be-NaN wholeness refusal).
+                this.evalExpr(e.obj, env);
+                const slot = this.cfg.records.get(e.shapeId)?.get(e.field);
+                if (slot !== undefined && e.type.kind === "f64")
+                    return classSeed(slot.cls);
+                return { ...TOP };
+            }
+            default: {
+                for (const v of childExprs(e))
+                    this.evalExpr(v, env);
+                return { ...TOP };
+            }
+        }
+    }
+    havocCall(callee, env) {
+        if (this.effects.havocAll.has(callee) || !this.effects.perFn.has(callee)) {
+            this.havocAllGlobals(env);
+            return;
+        }
+        for (const g of this.effects.perFn.get(callee))
+            env.delete(g); // absent global = TOP
+    }
+    havocAllGlobals(env) {
+        for (const k of [...env.keys()]) {
+            if (isGlobalId(k))
+                env.delete(k);
+        }
+    }
+}
+function cloneEnv(env) {
+    return new Map(env);
+}
+function mergeInto(dst, src) {
+    if (src === null || src === dst)
+        return;
+    dst.clear();
+    for (const [k, v] of src)
+        dst.set(k, v);
+}
+function typeContainsFunc(t) {
+    return JSON.stringify(t).includes('"func"');
+}
+/** Every direct IrExpr child of a node, order-preserving (evaluation
+ * order for the shapes we don't model precisely). */
+function childExprs(e) {
+    const out = [];
+    for (const [key, v] of Object.entries(e)) {
+        if (key === "type")
+            continue;
+        if (Array.isArray(v)) {
+            for (const item of v) {
+                if (item !== null && typeof item === "object") {
+                    if (typeof item.kind === "string" && !isStmtKind(item.kind)) {
+                        out.push(item);
+                    }
+                    else {
+                        for (const sub of Object.values(item)) {
+                            if (sub !== null && typeof sub === "object" && typeof sub.kind === "string" && !isStmtKind(sub.kind)) {
+                                out.push(sub);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        else if (v !== null && typeof v === "object" && typeof v.kind === "string" && !isStmtKind(v.kind)) {
+            out.push(v);
+        }
+    }
+    return out;
+}
+/* ── the entry point ───────────────────────────────────────────────────── */
+/** Run the inference over every function of a lowered library module and
+ * return one verdict per (obligation site) — internal call arguments into
+ * declared integer parameters, returns of declared integer returns, and
+ * writes into declared record-field slots. Callers turn REFUSE verdicts
+ * into diagnostics; PROVE verdicts carry the proven crossing range. */
+export function checkLibraryIntegerSlots(mod, cfg) {
+    const verdicts = [];
+    if (!hasIntSlots(cfg))
+        return verdicts;
+    const effects = globalEffectsOf(mod);
+    for (const fn of mod.functions) {
+        const analyzer = new FnAnalyzer(mod, cfg, effects, verdicts);
+        analyzer.seedBindings(fn, mod);
+        analyzer.analyze(fn);
+    }
+    return verdicts;
+}
+//# sourceMappingURL=int-infer.js.map