COBOL semantic-coverage assessment: new CICS corpus revealed 7 uncovered verb families (Async API scores zero concurrency)

[squid-protocol]

What surfaced this

Four repos were added to data/corpus_cobol/ on 2026-09-13 to broaden CICS coverage — aws-mainframe-modernization-carddemo, cics-async-api-credit-card-application-example, cics-async-fetch-variation-example, cics-event-consumer. An empirical audit (every EXEC CICS line in the new repos run against all 52 rules in gitgalaxy/standards/language_standards/languages/cobol.py) found no verb is invisible (the EXEC CICS blanket in the embedded-language rule catches everything) but seven verb families carry no semantic signal — they fall through to the blanket only:

verbs (n in new corpus)	semantics	rule that should own it
RUN TRANSID (11) + FETCH CHILD/ANY/COMMANDS (9)	Async API — CICS's task spawn/join model	concurrency (currently ENQ/DEQ/WAIT/START/DELAY — pre-async-era)
STARTBR/READNEXT/READPREV/ENDBR (21)	VSAM browse (cursor iteration)	io
SEND / SEND TEXT (36)	bare terminal output (non-map)	ui_framework (has SEND MAP only)
HANDLE ABEND (10)	abend-handler registration	the handler/events rule (has HANDLE CONDITION only)
SYNCPOINT (7)	UOW commit/rollback	io or state_mutation (design call)
ASKTIME/FORMATTIME (10)	time logic	time_date_logic (rule exists, lacks the CICS idioms)
RETRIEVE (3)	START's data partner	concurrency

The headline: the Async API registers zero arch_concurrency — a modern CICS app full of parallel tasks scores as single-threaded.

Why the scope should be broader than these 7 rows

Four sample repos found seven gaps in an afternoon — the honest conclusion is not "add 7 verbs" but that the COBOL standard has never had a systematic semantic-coverage assessment against the language's real surface. Scope for this issue:

1. Full CICS command inventory (the IBM command reference lists ~150 API commands) mapped to rule-or-deliberately-blanket, with the mapping recorded — so future gaps are diffs against a table, not archaeology. The audit harness from 2026-09-13 (rules × every EXEC CICS line, per-verb rule attribution) is the method; commit it as a reusable tool.
2. The other embedded surfaces: EXEC SQL (Db2) and EXEC DLI (IMS) deserve the same table — SQL verbs are security-relevant (GRANT, dynamic PREPARE/EXECUTE IMMEDIATE = injection surface).
3. Native COBOL beyond CICS: intrinsic functions, JSON PARSE/XML PARSE (modern COBOL 6), UNSTRING/STRING (buffer-adjacent), file-status idioms.
4. JCL sibling pass (languages/jcl.py): the corpus now carries substantial JCL (GenApp 24%, CardDemo 6%); same method.
5. Acceptance: every verb/idiom in the corpus ground-truth inventory is either (a) owned by a semantic rule, or (b) recorded as deliberately blanket-only with a one-line reason.

Process note

Rule changes go through the rule-contract discipline (crucible bless, baselines, ruff/mypy audits) — this is a dedicated-session task, not a drive-by patch. The corpus that powers the assessment is already in place.

[squid-protocol]

Vocabulary-rot evidence from the temporal-crucible walk panel (2026-09-13): curl's 8.17→8.18 curlx allocator-wrapping refactor makes summed state_memory_alloc drop −86% in one release (1197→171) and def_cleanup −83%, while LOC grows and every other signal stays continuous — literal malloc/free-family matching goes blind the moment a project wraps its idioms. Same failure class as def_auth ≡ 0 across 1.05M C rows (curl delegates crypto/auth to backends). The assessment this issue scopes should therefore include idiom-wrapper tracking (project-local allocator/wrapper vocabularies) as a first-class concern, not just verb-list completeness — two independent, documented instances now on record.

[squid-protocol]

Claiming this (2026-09-13). Scope as planned: (1) a committed harness tests/tools/embedded_verb_coverage.py (block-level EXEC … END-EXEC census with per-verb rule attribution, an owner-or-reason inventory for CICS/SQL/DLI/native COBOL/JCL, and a --check mode that fails on any unowned-and-unrecorded verb); (2) cobol.py rule edits for the owned families — async API + interval/task control → concurrency, browse verbs + named counters → io, SEND* → ui_framework, HANDLE AID → listeners, ASKTIME/FORMATTIME + date intrinsics → time_date_logic, SYNCPOINT/COMMIT/ROLLBACK + the HANDLE family + DFHRESP(/IF SQLCODE checks → safety (the stated #2869 sentence: an installed failure handler / value-level failure check; sqlite already owns COMMIT/ROLLBACK there), NOHANDLE/WHENEVER … CONTINUE → safety_bypasses, dynamic SQL (PREPARE/EXECUTE IMMEDIATE/TRUNCATE) → high_risk_execution; plus three mis-attributions found by the census (HANDLE ABEND CANCEL / ABEND … CANCEL fire high_risk_execution via bare CANCEL; EXEC CICS START fires io via the bare file-positioning verb; FREE CHILD fires memory_alloc); (3) docs/cobol_semantic_coverage.md generated from the tool, incl. the JCL pass and a wrapper-vocabularies section for the temporal-crucible comment. Block-level crucible census (591 files) puts the uncovered surface well beyond the seven rows here: ASSIGN 264 (introspection — the reflection blanket is its semantic owner, recorded), ASKTIME+FORMATTIME 119, named counters 112, DFHRESP( 393, SYNCPOINT 29. The three cicsdev async repos are not in language-crucible v1.2.0 (only carddemo is); they feed the inventory via a scratch clone and get a crucible follow-up issue rather than a pin bump inside this PR. No keyword-rosetta cell should move (no plant carries any of these tokens); golden masters will be blessed and scoped.