fix(refraction): graveyard reachability with a SECTION model (#3203) + per-path clean-room keys (#3218)

[squid-protocol]

Finishes the refraction dead-code finder and stops same-named programs from overwriting each other. Tool-side only: no engine files, no golden-master bless.

Closes #3203 (defect 5; defects 1–4 landed in #3217)
Closes #3218

#3203 defect 5: reachability with sections

x_ray_dead_code used to call a unit live if its name appeared after any PERFORM/GO TO. It now runs a reachability pass over paragraphs and sections, following ranges from the entry:

• fall-through until a terminal statement (GOBACK, STOP RUN, EXIT PROGRAM, unconditional GO TO, EXEC CICS RETURN/XCTL/ABEND);
• a transfer inside an unterminated IF/EVALUATE is conditional;
• PERFORM of a paragraph, of a section (to its last paragraph), and PERFORM … THRU;
• GO TO, staying inside the enclosing range when its target is in it;
• a unit ending in a PERFORM of a range that never returns is itself terminal (CBSA's PERFORM GET-ME-OUT-OF-HERE);
• EXEC CICS HANDLE ABEND/CONDITION/AID labels are entry points.

Other behaviour changes:

• Comment lines and literals are ignored.
• The rest of a multi-line PROCEDURE DIVISION USING … header is skipped.
• The *-EXIT exemption is gone. An EXIT paragraph that nothing reaches is dead; the answer key counts it as trivial dead code.

The DAG architect's and slicer's dead-unit masking now find headers with the graveyard's unit_header. Before, each had its own ^[ \t]{0,7}NAME\., which missed sections and sequence-numbered source, so a dead section's OPENs were never masked.

Answer key (#3210), forge before → after on CBSA: units R 452/680 → 680/680, dead P 57/380 → 62/62, non-trivial dead P 5/328 → 10/10. zopeneditor stays exact (0 dead, 0 claimed).

⚠️ These scores are not independent evidence. cobol_answer_key.py says the drafter is "deliberately NOT shared with, or imported by, either parser it grades". So this is the forge's own implementation, written against its input: upper-cased text with copybooks already inlined. It still follows the same control-flow model as the drafter. The key is hand-verified, but agreement is expected wherever the hand pass left the draft unchanged, and a defect in the shared model would not show up in this score. The unit tests cover each construct separately.

#3218: output keys

• Output names: clean-room outputs (IR dump, JCL, schema, slice, agent ticket) and the dead-code IR state are keyed by the stem when it is unique in the run. Otherwise the key is the path flattened with __ (multiroot__sam__SAM2). Repos without collisions, like CBSA, keep today's file names.
• Anomaly tags: these now carry the path under the target. forge_agent_jobs resolves that path directly instead of taking the first rglob(name) hit, and gets ir_keys so it joins the right IR dump.
• Dropped flags: it also used to drop every [FILE : Line N] system-limit flag, because it rglob-ed the whole FILE : Line N string.
• SQLite merge proven: test_same_named_programs_do_not_share_outputs_or_dead_code[SQLITE] fails with stem-keyed state. Program B inherits A's dead paragraph, masks its own live OPEN OUTPUT, and loses its only output.

Verification

• tests/cobol_mainframe: 94 passed (with test_batch_test_harness). The 12 new tests fail against origin/main.
• Two existing fixtures relied on the old heuristic (a MAIN paragraph with no terminal statement "not reaching" the next one). They now carry a GOBACK.
• audit_check.py: all clear.
• The new regexes scale linearly on pathological inputs of 50k–100k tokens (×4 input → ×4 time).
• End to end: cobol-refractor on both clones left them clean. zopeneditor now writes COBOL__SAM1/2 and multiroot__sam__SAM1/2 separately. CBSA's file names are unchanged, and it reports 62 unreachable units.
• docs/refraction_engine_differential.md has a new update section.

🤖 Generated with Claude Code

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab