I'm quite sure flow-based static analysis can be done for Tex, the question is how expensive it is to perform and how useful the results are. With respect to c

I'm quite sure flow-based static analysis can be done for Tex, the question is how expensive it is to perform and how useful the results are. With respect to catcode-changing code, you can model its possible execution paths: while you can construct example Tex code where you can't infer anything past this point without having complete information from before, in practice with, say a package, you do have example documents which the package is meant to work with, and you can use that in the static analysis. I've thought about this a fair bit, at least in the context of typical Plain Tex, but not written much code. I should try and enough time for a proof of concept: there's a lot that could be built on it.