[squid-protocol]

Closes #3222. Part of #3122.

All three baselined offenders had the same shape: an unbounded run before a required terminator, so the scan restarts from every candidate start position. That is exactly what #3205 fixed for EXEC CICS … END-EXEC..

The three

site	before	after
cobol_dag_architect.py OPEN operands	\bOPEN\s+((?:INPUT|OUTPUT|I-O|EXTEND)\b[^.]*)\.	_OPEN_ANCHOR + str.find(".")
cobol_jcl_forge.py SELECT/ASSIGN	SELECT …\s+ASSIGN\s+…([A-Z0-9\-]+)[^.]*\.	_FILE_ASSIGN_ANCHOR + str.find(".")
cobol_graveyard_finder.py REPLACING pairs	(?:==)?([A-Z0-9_\-]+)(?:==)?\s+BY\s+…	_REPLACING_PAIR, with a (?<![A-Z0-9_\-]) boundary lookbehind

Each sliced run keeps the old pattern's two rules: the terminating period is still required (an unterminated tail matched nothing before and matches nothing now), and a consumed cursor reproduces finditer's non-overlapping advance, so an anchor inside a statement already read is not a second statement.

Measured on the inputs the new tests use:

	before	after
20k unterminated OPEN INPUT WS-F	24.1s	~1ms
20k period-less SELECT F1 ASSIGN TO DD1	21.4s	~1ms
a 20k-character name in a REPLACING clause	10.0s	1.3ms

Why no output moves

The name run is greedy and the name class is closed under itself, so a run can never stop inside a token: a match that starts mid-token captures the same two names as the boundary start does. The lookbehind can therefore move a match's start offset but never its groups, and findall returns groups only.

Checked rather than argued: a 40,000-trial differential of old pattern vs new scan over random COBOL-ish token soup (including ==, X==A==, OPENX, SELECTX, stray periods and quotes) found 0 divergences — plus everything below.

Proof

tool_regex_redos.py --ci      3 offenders -> 0 offenders   (baseline now empty)
refraction_snapshot.py check                    0 of 87 excerpt files differ
  --corpus zopeneditor-sample                   0 of 38 differ
  --corpus cics-banking-sample-application-cbsa 0 of 166 differ
  --corpus aws-mainframe-modernization-carddemo 0 of 236 differ
mainframe_corpus.py score     byte-identical to origin/main, both corpora, both columns
pytest tests/cobol_mainframe/                   128 passed, 6 skipped
audit_check.py                                  all clear

Scores are unchanged, so no before/after table is meaningful here — the point of this PR is that the numbers do not move:

	forge	engine DB
zopeneditor units	P 58/58 · R 58/58	P 58/58 · R 58/58
CBSA units	P 680/680 · R 680/680	P 680/680 · R 680/680
CBSA dead	P 62/62 · R 62/62	P 29/247 · R 29/62

Tests

Six added, two per site: an adversarial-input test with a generous absolute 5s bound (the old code takes 10–24s on the same input; per #2901 no ratio between small samples is asserted), and a semantics test pinning what the site must still extract — #3204's multi-mode OPEN INPUT A OUTPUT B. walk, the UT-/UR-S- DD strip across a multi-line SELECT, and the REPLACING pairs including the pre-existing (unchanged) fact that a :TAG: pseudo-text name matches neither pattern.

The baseline JSON is now "offenders": [], with a note that an entry may only be added alongside an issue tracking its fix.

🤖 Generated with Claude Code

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab