[squid-protocol]

Stacked on #4654 — merge that first.

Fixes #4655

What the oracle does (GnuCOBOL 3.1.2 -std=ibm, measured 2026-10-07)

A zero divisor makes libcob's NaN intermediate (cob_decimal_div), NaN in → NaN out, and storing a NaN leaves the receiver unchanged. With or without ON SIZE ERROR:

• COMPUTE R R2 = A / Z: whole statement, no receiver changes; A / Z + 1, (A / Z) * 0 + 7, Z / Z change nothing either.
• DIVIDE Z INTO R R2: per receiver, each unchanged; DIVIDE A BY Z GIVING Q REMAINDER RM: Q and RM unchanged.
• Where ARITHMETIC-OSVS aligns the quotient (C2), cob_decimal_align turns NaN into 0: COMPUTE R = A / Z * C stores 0, and with ON SIZE ERROR the phrase still runs. In conditions an aligned NaN is 0 (A / Z = 0 true) and an unaligned one compares as dividend×10^32768 (0 = A / Z false).
• In a function argument a zero divisor gives 0 (cob_intr_binop) and raises the size error; FUNCTION MOD / REM by zero give 0 with no size error.
• 0 ** 0 = 1 with the size error raised; 0 ** -n = 0 with no size error; a negative ** fraction, or an overflowing exponent, leaves the receiver unchanged with the size error.
• Receiver overflow without ON SIZE ERROR: high-order truncation (already modelled).

Changes (arithmetic / divide path only)

• Cobol.java: NAN_SCALE, isNan, nan, a per-thread size-error state (sizeClear / sizeRaised / private raiseSize), NaN-aware add / subtract / multiply / negate (BigDecimal overloads), divide (NaN, no throw), divideIntr, remainder, NaN guards in the Dc variants and power (0 ** 0, non-finite double), store / storeChecked (NaN → unchanged / true). Cobol.align unchanged: it already truncates a NaN to 0 as libcob does.
• Funcs.java: mod, rem — zero divisor → 0.
• Hfp.java: comment only.
• gen.py: num_op (NaN-aware ops only where _may_nan: a / or ** below; divideIntr inside function args via intr_func), store_all (lifted receivers guarded with isNan; ON SIZE ERROR statements with / or ** clear and read the size-error state; after lines before the phrases), arith (REMAINDER via Cobol.remainder before the SIZE ERROR phrases; lifted DIVIDE INTO guarded), new _may_nan / _raises_size. Not touched: move, edit/num, compare paths (equivalence: model the oracle's MOVE of a non-digit zoned item to a binary item (#4652) #4663 / det translator: model DECIMAL-POINT IS COMMA; document the refusals #4462 keeps (#4462) #4666 / det: a numeric-edited item compared with a number is a text comparison (#4665) #4668).
• Also fixed in the same path: DIVIDE ... REMAINDER used the stored quotient; libcob uses the quotient truncated to the receiver's places (a ROUNDED-up or high-order-truncated quotient gave a wrong remainder; measured DIVIDE 6 INTO 59 GIVING Q ROUNDED REMAINDER RM → RM 5).
• ON SIZE ERROR / NOT ON SIZE ERROR bodies: now covered end to end, arithmetic inside them included.
• Register: oracle_assumptions.md C14 (C13 is taken on det runtime: numeric-edited item compared with a numeric literal numerically; GnuCOBOL compares it as text #4665's branch) with IBM's rule (paraphrased, marked to confirm against the Language Reference page: the page could not be fetched from the box) — undefined result / S0CB on z/OS without ON SIZE ERROR; DIFFERS: 0 ** -n is a size error on IBM, 0 in the oracle. det_port_design.md notes.

Evidence

• tests/cobol_mainframe/test_det_size_error.py: codegen unit tests + one e2e program (48 output lines, every shape above, bytes and typed modes) — cobc vs det port equal, WANT pinned to the measured oracle values. Ran with EQUIVALENCE_E2E=1: 4 passed.
• Randomized differential (det runtime: arithmetic intermediates are not truncated as the oracle's ARITHMETIC-OSVS (IBM's fixed-point decimal places) truncates them (register C2) #4287's fuzz tool with zero divisors, DIVIDE, ON SIZE ERROR / NOT ON SIZE ERROR): 56 programs (~6,000 statements), 0 differing lines; 2 seeds don't translate because of a pre-existing parse bug (det translator: NOT at the end of a line before its relational operator fails the whole PROCEDURE DIVISION #4674).
• Targeted: test_det_osvs / test_det_programs / test_det_translate / test_det_funcs / test_det_hfp: 410 passed (E2E on).
• det_port.py check vs origin/fix/4287-arith-osvs: 68/68 ports change through the runtime (Cobol.java / Funcs.java); 4 also change service code (carddemo-acctupdate: REMAINDER via Cobol.remainder; carddemo-intcalc(-generated), mortgage-mpmt: an isNan guard on a lifted COMPUTE receiver).
• proof_sweep.py --det-only (all cases): 65 PROVED, 3 NOT PROVEN, all three in the baseline (carddemo-cardupdate, carddemo-intcalc-generated, mortgage-mpmt) — "sweep: as expected", no verdict regression.
• Evidence: evidence.py status --ci rc 0 (records were already stale on harness/oracle/generator only, which the scheduled refresh handles; no port/case/pin staleness); evidence_report.py --check rc 0; test_evidence.py + test_evidence_report.py 71 passed. No evidence records changed.
• pr_gates.py --fast: 5/5 pass. pr_gates.py --ratchets: 7 pass, 0 fail, 0 skipped.

Follow-ups filed

• det translator: NOT at the end of a line before its relational operator fails the whole PROCEDURE DIVISION #4674 — NOT at end of a line before its relational operator fails the whole PROCEDURE DIVISION (medium)
• det runtime: a floating-point zero divisor still throws ArithmeticException (Hfp.divide) #4675 — floating-point zero divisor still throws (Hfp.divide) (low)
• det translator: a NOT ON SIZE ERROR after a nested unterminated arithmetic statement binds to the outer one #4676 — NOT ON SIZE ERROR after a nested unterminated arithmetic statement binds to the outer one (low)

🤖 Generated with Claude Code

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab