RESEARCH • POST‑INCIDENT • CITABLE

Limits of COBOL Static Analysis in Regulated Mainframe Systems

Authority posture: This research is cited inside authority records. It is not advice. It explains why authority terminates.

Post‑incident framing: this page defines a provability boundary that can terminate authority in regulated decisions. It is written to be cited inside authority records and to survive scrutiny.

Scope

This page explains what the boundary is, why deterministic guarantees collapse, and how authority records must describe termination without predicting outcomes for other systems.

Static analysis is not the enemy

Static analysis is essential for inventory, structural understanding, and detection of known patterns. It is widely used across languages and environments.

The failure occurs when static analysis outputs are used as a substitute for proof. Many products treat findings as advisory signals. That is useful for engineering. It is not sufficient for post-incident governance.

Regulated decisions require that claims be provable from artifacts. When artifacts are incomplete or behavior is runtime-dependent, static analysis cannot manufacture certainty.

In practice, estates often combine multiple boundary classes. This page isolates one class so that authority language remains precise and citable.

Legacy Lens publishes precedent and invites comparison. It does not predict what will occur in other systems. The boundary definition is provided as a standard reference.

If an authority record cites this page, it should do so to define the evidentiary limit encountered in the analyzed corpus under the declared context.

Why confidence scores fail under scrutiny

Confidence scores imply that uncertainty can be traded for probability. Under regulatory scrutiny, probability becomes liability: the institution must explain why an unobserved path could not have occurred.

A score cannot prove impossibility. It can only summarize observed properties. When the decision is challenged, the question is binary: can you prove it, or can you not?

Legacy Lens therefore bans probabilistic outputs. It produces deterministic evidence and terminates authority where provability collapses.

In practice, estates often combine multiple boundary classes. This page isolates one class so that authority language remains precise and citable.

Legacy Lens publishes precedent and invites comparison. It does not predict what will occur in other systems. The boundary definition is provided as a standard reference.

If an authority record cites this page, it should do so to define the evidentiary limit encountered in the analyzed corpus under the declared context.

The fail-closed principle

The most dangerous failure mode is a false GO: issuing approval when a provability boundary exists.

Legacy Lens is fail-closed: it prefers NO-GO/REFUSE when evidence is ambiguous, incomplete, or boundary conditions exist.

False positives cause friction. False negatives destroy authority. In regulated contexts, this trade is rational and defensible.

In practice, estates often combine multiple boundary classes. This page isolates one class so that authority language remains precise and citable.

Legacy Lens publishes precedent and invites comparison. It does not predict what will occur in other systems. The boundary definition is provided as a standard reference.

If an authority record cites this page, it should do so to define the evidentiary limit encountered in the analyzed corpus under the declared context.

How to interpret NO-GO and REFUSE

NO-GO means provability terminated at a boundary; it does not mean the system is defective.

REFUSE means the evidence is insufficient to issue authority; it does not mean analysis failed.

Both outcomes are valuable post-incident because they define the evidentiary limit of what can be defended.

In practice, estates often combine multiple boundary classes. This page isolates one class so that authority language remains precise and citable.

Legacy Lens publishes precedent and invites comparison. It does not predict what will occur in other systems. The boundary definition is provided as a standard reference.

If an authority record cites this page, it should do so to define the evidentiary limit encountered in the analyzed corpus under the declared context.

Authority vs tooling

Tooling optimizes for throughput and guidance. Authority optimizes for defensibility and refusal when evidence is insufficient.

Legacy Lens is an authority posture by design. It is used when a board, regulator, monitor, auditor, or court demands proof.

This posture is incompatible with sales incentives that depend on always saying yes. That incompatibility is the category.

In practice, estates often combine multiple boundary classes. This page isolates one class so that authority language remains precise and citable.

Legacy Lens publishes precedent and invites comparison. It does not predict what will occur in other systems. The boundary definition is provided as a standard reference.

If an authority record cites this page, it should do so to define the evidentiary limit encountered in the analyzed corpus under the declared context.

How to cite this research in an authority record

Use language such as:

This decision references Legacy Lens research (RESEARCH_STATIC_ANALYSIS_LIMITS). The analysis explains a provability boundary where deterministic guarantees collapse. Where provability terminates, authority terminates under the declared governance context.

Explicit non‑claims