<!--
DO NOT EDIT BY HAND. Generated by xtask docs from docs-src/crate-gnucobol-rs-readme.model.json
+ machine evidence (crates/gnucobol-rs/Cargo.toml, reports/claim-ladder.json, reports/casefiles/*,
reports/receipts/*). Regenerate: cargo run -p xtask -- docs generate. Check: cargo run -p xtask -- docs check.
Evidence authority: the claim-ladder + generated casefiles. Legacy source preserved (lossless) under research/legacyreports/crates/gnucobol-rs/README.md (sha256 894f9d4d7b904176f4c4fb45a3a2256ed6c45b691c4b54c00afa8c423a551ae7).
-->

# gnucobol-rs

> _Generated document (TRUST.4.DOCS). Machine authority: `reports/claim-ladder.json` + `reports/casefiles/`. Legacy source preserved losslessly under `research/legacyreports/crates/gnucobol-rs/README.md`._

[![crates.io](https://img.shields.io/crates/v/gnucobol-rs.svg)](https://crates.io/crates/gnucobol-rs) [![docs.rs](https://img.shields.io/docsrs/gnucobol-rs)](https://docs.rs/gnucobol-rs) ![license](https://img.shields.io/badge/license-LGPL--3.0--or--later-blue) ![unsafe](https://img.shields.io/badge/unsafe-forbidden-success) ![oracle](https://img.shields.io/badge/oracle-GnuCOBOL_3.2-orange) ![sealed courts](https://img.shields.io/badge/sealed_courts-137-brightgreen) ![casefiles](https://img.shields.io/badge/casefiles-137-blueviolet)

**A faithful, line-cited Rust port of GnuCOBOL's packed-decimal (COMP-3), zoned, and display
numeric *byte* semantics and the `MOVE` conversions between them — proven byte-identical against
the GnuCOBOL 3.2 `libcob` oracle.**

This is a memory-safe (`#![forbid(unsafe_code)]`), dependency-free, **pure** kernel: every function
is a deterministic function of its `(bytes, attrs)` inputs — no global state, no env/locale/fs
reads, panic-free on hostile input. It is part of the [`gnucobol-rs`](https://github.com/infinityabundance/gnucobol-rs)
compatibility court.

## What it does — sealed claims

### Sealed GnuCOBOL data/arithmetic courts

| 🔒 court | name | verdict | casefile |
|---|---|:---:|---|
| `GNURUST.LINEAGE.CORPUS.20M.0` | deterministic COBOL lineage corpus ENGINE (schema/Merkle/replay/isolation/findings) | ✅ pass | `reports/casefiles/GNURUST.LINEAGE.CORPUS.20M.0/` |
| `GNURUST.LINEAGE.CORPUS.20M.SMOKE` | 200K real-cobc COBOL-witness lineage burn (pilot) | ✅ pass | `reports/casefiles/GNURUST.LINEAGE.CORPUS.20M.SMOKE/` |
| `GNURUST.CLASS.1` | class conditions (NUMERIC/ALPHABETIC) | ✅ pass | `reports/casefiles/GNURUST.CLASS.1/` |
| `GNURUST.REMAINDER.1` | DIVIDE REMAINDER receiving-field bytes | ✅ pass | `reports/casefiles/GNURUST.REMAINDER.1/` |
| `GNURUST.COVERAGE.1` | forensic coverage map of the GnuCOBOL semantic surface | ✅ pass | `reports/casefiles/GNURUST.COVERAGE.1/` |
| `GNURUST.FILE.SEQUENTIAL.1` | sequential file READ record bytes + file status | ✅ pass | `reports/casefiles/GNURUST.FILE.SEQUENTIAL.1/` |
| `GNURUST.FILE.STATUS.1` | observed FILE STATUS atlas | ✅ pass | `reports/casefiles/GNURUST.FILE.STATUS.1/` |
| `GNURUST.INITIALIZE.1` | INITIALIZE receiver byte effects | ✅ pass | `reports/casefiles/GNURUST.INITIALIZE.1/` |
| `GNURUST.INSPECT.1` | INSPECT byte effects + tally bytes | ✅ pass | `reports/casefiles/GNURUST.INSPECT.1/` |
| `GNURUST.REFMOD.1` | reference modification (substring) | ✅ pass | `reports/casefiles/GNURUST.REFMOD.1/` |
| `GNURUST.STRING.UNSTRING.1` | STRING/UNSTRING byte effects | ✅ pass | `reports/casefiles/GNURUST.STRING.UNSTRING.1/` |
| `GNURUST.INTRINSIC.ATLAS.1` | observed intrinsic-function atlas | ✅ pass | `reports/casefiles/GNURUST.INTRINSIC.ATLAS.1/` |
| `GNURUST.INTRINSIC.LENGTH.1` | FUNCTION LENGTH storage byte length | ✅ pass | `reports/casefiles/GNURUST.INTRINSIC.LENGTH.1/` |
| `GNURUST.INTRINSIC.NUMVAL.1` | FUNCTION NUMVAL numeric parse | ✅ pass | `reports/casefiles/GNURUST.INTRINSIC.NUMVAL.1/` |
| `GNURUST.ACCEPT.DISPLAY.1` | DISPLAY emitted text + ACCEPT field bytes | ✅ pass | `reports/casefiles/GNURUST.ACCEPT.DISPLAY.1/` |
| `GNURUST.PROCEDURE.FLOW.ATLAS.1` | observed control-flow atlas | ✅ pass | `reports/casefiles/GNURUST.PROCEDURE.FLOW.ATLAS.1/` |
| `GNURUST.INTRINSIC.MOD-REM.1` | FUNCTION MOD/REM integer modulo and remainder | ✅ pass | `reports/casefiles/GNURUST.INTRINSIC.MOD-REM.1/` |
| `GNURUST.INTRINSIC.INTEGER.1` | FUNCTION INTEGER (floor) and INTEGER-PART (truncate) | ✅ pass | `reports/casefiles/GNURUST.INTRINSIC.INTEGER.1/` |
| `GNURUST.INTRINSIC.CASE.1` | FUNCTION UPPER-CASE / LOWER-CASE / REVERSE | ✅ pass | `reports/casefiles/GNURUST.INTRINSIC.CASE.1/` |
| `GNURUST.INTRINSIC.ORD-CHAR.1` | FUNCTION ORD / CHAR 1-based ordinal and character | ✅ pass | `reports/casefiles/GNURUST.INTRINSIC.ORD-CHAR.1/` |
| `GNURUST.INTRINSIC.NUMVAL-C.1` | FUNCTION NUMVAL-C currency-string parse | ✅ pass | `reports/casefiles/GNURUST.INTRINSIC.NUMVAL-C.1/` |
| `GNURUST.SIZE.ERROR.1` | arithmetic SIZE ERROR truncation and condition | ✅ pass | `reports/casefiles/GNURUST.SIZE.ERROR.1/` |
| `GNURUST.FILE.WRITE.1` | sequential WRITE byte effects | ✅ pass | `reports/casefiles/GNURUST.FILE.WRITE.1/` |
| `GNURUST.FILE.REWRITE.1` | sequential REWRITE in-place update | ✅ pass | `reports/casefiles/GNURUST.FILE.REWRITE.1/` |
| `GNURUST.FILEIO.LINESEQ.1` | line-sequential WRITE config matrix | ✅ pass | `reports/casefiles/GNURUST.FILEIO.LINESEQ.1/` |
| `GNURUST.FILEIO.SEQ.1` | RECORD SEQUENTIAL read/write incl. variable-length | ✅ pass | `reports/casefiles/GNURUST.FILEIO.SEQ.1/` |
| `GNURUST.FILEIO.RELATIVE.1` | RELATIVE organization keyed + sequential access | ✅ pass | `reports/casefiles/GNURUST.FILEIO.RELATIVE.1/` |
| `GNURUST.FILEIO.VERB.1` | file verb open/access-mode preconditions | ✅ pass | `reports/casefiles/GNURUST.FILEIO.VERB.1/` |
| `GNURUST.FILEIO.SORT.1` | SORT/MERGE record comparison | ✅ pass | `reports/casefiles/GNURUST.FILEIO.SORT.1/` |
| `GNURUST.FILEIO.SORTENGINE.1` | SORT/MERGE in-memory engine (4-queue natural merge) | ✅ pass | `reports/casefiles/GNURUST.FILEIO.SORTENGINE.1/` |
| `GNURUST.FILEIO.INDEXED.1` | INDEXED organization (keyed store + record locking) | ✅ pass | `reports/casefiles/GNURUST.FILEIO.INDEXED.1/` |
| `GNURUST.FILEIO.SYS.1` | CBL_* system file/directory routines | ✅ pass | `reports/casefiles/GNURUST.FILEIO.SYS.1/` |
| `GNURUST.FILEIO.OPEN.1` | file runtime OPEN/CLOSE + lifecycle | ✅ pass | `reports/casefiles/GNURUST.FILEIO.OPEN.1/` |
| `GNURUST.FILEIO.MAPPING.1` | COBOL filename mapping (env resolution) | ✅ pass | `reports/casefiles/GNURUST.FILEIO.MAPPING.1/` |
| `GNURUST.MLIO.GENERATE.1` | XML / JSON GENERATE (native serializer) | ✅ pass | `reports/casefiles/GNURUST.MLIO.GENERATE.1/` |
| `GNURUST.MLIO.PARSE.1` | XML PARSE (native state machine) | ✅ pass | `reports/casefiles/GNURUST.MLIO.PARSE.1/` |
| `GNURUST.SCREENIO.INIT.1` | SCREEN SECTION init/teardown framing + positioned DISPLAY (native terminal bytes) | ✅ pass | `reports/casefiles/GNURUST.SCREENIO.INIT.1/` |
| `GNURUST.SCREENIO.ATTR.1` | SCREEN SECTION monochrome display attributes (HIGHLIGHT/LOWLIGHT/UNDERLINE/BLINK/REVERSE) -- native terminal bytes | ✅ pass | `reports/casefiles/GNURUST.SCREENIO.ATTR.1/` |
| `GNURUST.SCREENIO.COLOR.1` | SCREEN SECTION colour DISPLAY (FOREGROUND-COLOR/BACKGROUND-COLOR) -- the whole-screen ncurses repaint, native terminal bytes | ✅ pass | `reports/casefiles/GNURUST.SCREENIO.COLOR.1/` |
| `GNURUST.SCREENIO.NUMEDIT.1` | SCREEN SECTION numeric-edited field DISPLAY (zero-suppression / sign / CR-DB positioning) -- native terminal bytes | ✅ pass | `reports/casefiles/GNURUST.SCREENIO.NUMEDIT.1/` |
| `GNURUST.SCREENIO.ACCEPT.1` | SCREEN SECTION ACCEPT of an alphanumeric input field (prompt / reposition / echo / field-full) -- native terminal bytes | ✅ pass | `reports/casefiles/GNURUST.SCREENIO.ACCEPT.1/` |
| `GNURUST.SCREENIO.LINEDIFF.1` | multi-DISPLAY same-row refresh line-diff (ncurses doupdate/TransformLine) -- native terminal bytes | ✅ pass | `reports/casefiles/GNURUST.SCREENIO.LINEDIFF.1/` |
| `GNURUST.INTRINSIC.DATE.1` | date-conversion intrinsics | ✅ pass | `reports/casefiles/GNURUST.INTRINSIC.DATE.1/` |
| `GNURUST.IF.EVALUATE.SLICE.1` | IF/EVALUATE execution slice (alphanumeric) | ✅ pass | `reports/casefiles/GNURUST.IF.EVALUATE.SLICE.1/` |
| `GNURUST.FRONTEND.1` | clean-room COBOL front-end -- parse + EXECUTE a program subset to cobc-identical stdout | ✅ pass | `reports/casefiles/GNURUST.FRONTEND.1/` |
| `GNURUST.PERFORM.SLICE.1` | PERFORM execution slice (TIMES/UNTIL/VARYING) | ✅ pass | `reports/casefiles/GNURUST.PERFORM.SLICE.1/` |
| `GNURUST.FILE.FLOW.SLICE.1` | read-loop execution slice (file x control flow) | ✅ pass | `reports/casefiles/GNURUST.FILE.FLOW.SLICE.1/` |
| `GNURUST.FILE.FILTER.SLICE.1` | filter (conditional) read-loop | ✅ pass | `reports/casefiles/GNURUST.FILE.FILTER.SLICE.1/` |
| `GNURUST.IF.NUMERIC.SLICE.1` | numeric IF/EVALUATE execution slice | ✅ pass | `reports/casefiles/GNURUST.IF.NUMERIC.SLICE.1/` |
| `GNURUST.TABLE.PERFORM.SLICE.1` | table (OCCURS) PERFORM VARYING execution slice | ✅ pass | `reports/casefiles/GNURUST.TABLE.PERFORM.SLICE.1/` |
| `GNURUST.PUBLIC.CORPUS.1` | public-COBOL corpus index (gap discovery) | ✅ pass | `reports/casefiles/GNURUST.PUBLIC.CORPUS.1/` |
| `GNURUST.BUILD.PROFILE.1` | oracle ABI / dialect / config profile | ✅ pass | `reports/casefiles/GNURUST.BUILD.PROFILE.1/` |
| `GNURUST.PUBLIC.GAP.1` | surface gap board over the admitted GnuCOBOL testsuite | ✅ pass | `reports/casefiles/GNURUST.PUBLIC.GAP.1/` |
| `GNURUST.CALL.EXTENSION.ATLAS.1` | observed CALL / linkage atlas | ✅ pass | `reports/casefiles/GNURUST.CALL.EXTENSION.ATLAS.1/` |
| `GNURUST.INDEXED.FILE.ATLAS.1` | observed indexed-file atlas | ✅ pass | `reports/casefiles/GNURUST.INDEXED.FILE.ATLAS.1/` |
| `GNURUST.SEARCH.TABLE.1` | SEARCH / SEARCH ALL table lookup | ✅ pass | `reports/casefiles/GNURUST.SEARCH.TABLE.1/` |
| `GNURUST.SUBSCRIPT.1` | table subscript access (multi-dimensional) | ✅ pass | `reports/casefiles/GNURUST.SUBSCRIPT.1/` |
| `GNURUST.ODO.1` | OCCURS DEPENDING ON (variable length) | ✅ pass | `reports/casefiles/GNURUST.ODO.1/` |
| `GNURUST.COMMON.BOUNDCHECK.1` | Runtime bounds-check diagnostics (subscript / reference-mod / OCCURS DEPENDING ON) | ✅ pass | `reports/casefiles/GNURUST.COMMON.BOUNDCHECK.1/` |
| `GNURUST.COMMON.NUMCHECK.1` | Not-numeric runtime diagnostic + field-type explanation | ✅ pass | `reports/casefiles/GNURUST.COMMON.NUMCHECK.1/` |
| `GNURUST.COMMON.CBL.1` | CBL_ logic / bit / case builtins (CBL_AND/OR/XOR/NOR/IMP/NIMP/EQ/NOT/TOUPPER/TOLOWER) | ✅ pass | `reports/casefiles/GNURUST.COMMON.CBL.1/` |
| `GNURUST.INDEX.1` | USAGE INDEX storage + SET arithmetic | ✅ pass | `reports/casefiles/GNURUST.INDEX.1/` |
| `GNURUST.ROUND.1` | ROUNDED MODE IS (all eight rounding modes) | ✅ pass | `reports/casefiles/GNURUST.ROUND.1/` |
| `GNURUST.SORT.MERGE.ATLAS.1` | observed SORT / MERGE atlas | ✅ pass | `reports/casefiles/GNURUST.SORT.MERGE.ATLAS.1/` |
| `GNURUST.RELATIVE.FILE.ATLAS.1` | observed relative-file atlas | ✅ pass | `reports/casefiles/GNURUST.RELATIVE.FILE.ATLAS.1/` |
| `GNURUST.DIALECT.RUNTIME.ATLAS.1` | observed dialect-runtime divergence atlas | ✅ pass | `reports/casefiles/GNURUST.DIALECT.RUNTIME.ATLAS.1/` |
| `GNURUST.DIRECTIVE.VARIANCE.ATLAS.1` | observed compiler-directive byte-variance atlas | ✅ pass | `reports/casefiles/GNURUST.DIRECTIVE.VARIANCE.ATLAS.1/` |
| `GNURUST.DECLARATIVES.ATLAS.1` | observed DECLARATIVES / USE error-handler atlas | ✅ pass | `reports/casefiles/GNURUST.DECLARATIVES.ATLAS.1/` |
| `GNURUST.CALL.LAYOUT.ATLAS.1` | observed CALL parameter byte-layout atlas | ✅ pass | `reports/casefiles/GNURUST.CALL.LAYOUT.ATLAS.1/` |
| `GNURUST.LINEAGE.CORPUS.20M.1` | full 20M real-cobc COBOL-witness lineage run (complete) | ✅ pass | `reports/casefiles/GNURUST.LINEAGE.CORPUS.20M.1/` |
| `GNURUST.VALUE.NEGZERO.EDGE.1` | negative-zero VALUE sign edge (oracle-characterized + PATCHED to parity, locks both ways) | ✅ pass | `reports/casefiles/GNURUST.VALUE.NEGZERO.EDGE.1/` |
| `GNURUST.BIGNUM.1` | MULTIPLY beyond i128 (exact 256-bit product) | ✅ pass | `reports/casefiles/GNURUST.BIGNUM.1/` |
| `GNURUST.INTPOW.1` | integer exponentiation (cob_s32_pow / cob_s64_pow) | ✅ pass | `reports/casefiles/GNURUST.INTPOW.1/` |
| `GNURUST.LOGICAL.1` | bit-logical operations (B-AND/B-OR/B-XOR/B-NOT, bit shifts) | ✅ pass | `reports/casefiles/GNURUST.LOGICAL.1/` |
| `GNURUST.FLOAT.1` | floating-point fields: COMP-1/COMP-2 + FLOAT-DECIMAL-16/34 | ✅ pass | `reports/casefiles/GNURUST.FLOAT.1/` |
| `GNURUST.NUMCMP.1` | numeric comparison (cob_numeric_cmp) across type pairs | ✅ pass | `reports/casefiles/GNURUST.NUMCMP.1/` |
| `GNURUST.2` | decimal MOVE | ✅ pass | `reports/casefiles/GNURUST.2/` |
| `GNURUST.ACCEPT.DISPLAY.2` | DISPLAY of signed and V-scaled numeric fields | ✅ pass | `reports/casefiles/GNURUST.ACCEPT.DISPLAY.2/` |
| `GNURUST.FILEIO.LINESEQ.2` | line-sequential READ config matrix | ✅ pass | `reports/casefiles/GNURUST.FILEIO.LINESEQ.2/` |
| `GNURUST.SCREENIO.DISPLAY.2` | SCREEN SECTION positioned DISPLAY -- the ncurses mvcur cursor-cost model (native terminal bytes) | ✅ pass | `reports/casefiles/GNURUST.SCREENIO.DISPLAY.2/` |
| `GNURUST.SCREENIO.ACCEPT.2` | SCREEN SECTION ACCEPT overflow input (typing past the field width: BEL + overwrite) -- native terminal bytes | ✅ pass | `reports/casefiles/GNURUST.SCREENIO.ACCEPT.2/` |
| `GNURUST.3` | PIC field model | ✅ pass | `reports/casefiles/GNURUST.3/` |
| `GNURUST.SCREENIO.DISPLAY.3` | SCREEN SECTION multi-field DISPLAY -- the general ncurses mvcur (inter-field moves), native terminal bytes | ✅ pass | `reports/casefiles/GNURUST.SCREENIO.DISPLAY.3/` |
| `GNURUST.4` | record layout | ✅ pass | `reports/casefiles/GNURUST.4/` |
| `GNURUST.5` | COPY expansion | ✅ pass | `reports/casefiles/GNURUST.5/` |
| `GNURUST.6` | COPY ... REPLACING | ✅ pass | `reports/casefiles/GNURUST.6/` |
| `GNURUST.7` | arithmetic ADD/SUB/MUL | ✅ pass | `reports/casefiles/GNURUST.7/` |
| `GNURUST.8` | VALUE initial image | ✅ pass | `reports/casefiles/GNURUST.8/` |
| `GNURUST.9` | PIC P-scaling | ✅ pass | `reports/casefiles/GNURUST.9/` |
| `GNURUST.10` | ODO physical-max layout | ✅ pass | `reports/casefiles/GNURUST.10/` |
| `GNURUST.11` | LEVEL-88 eval | ✅ pass | `reports/casefiles/GNURUST.11/` |
| `GNURUST.12` | SET 88 TO TRUE | ✅ pass | `reports/casefiles/GNURUST.12/` |
| `GNURUST.12B` | SET 88 TO FALSE | ✅ pass | `reports/casefiles/GNURUST.12B/` |
| `GNURUST.13` | packed ADD/SUBTRACT (cob_add_bcd) | ✅ pass | `reports/casefiles/GNURUST.13/` |
| `GNURUST.14` | binary storage (COMP/COMP-5/COMP-X) | ✅ pass | `reports/casefiles/GNURUST.14/` |
| `GNURUST.15` | EBCDIC cp500 DISPLAY decode | ✅ pass | `reports/casefiles/GNURUST.15/` |
| `GNURUST.16` | edited-picture decode (16a+16b) | ✅ pass | `reports/casefiles/GNURUST.16/` |
| `GNURUST.16C` | edited-picture encode (numeric->edited, 16c) | ✅ pass | `reports/casefiles/GNURUST.16C/` |
| `GNURUST.17` | cp500 EBCDIC zoned numeric decode | ✅ pass | `reports/casefiles/GNURUST.17/` |
| `GNURUST.18` | COMP-6 unsigned packed storage + MOVE | ✅ pass | `reports/casefiles/GNURUST.18/` |
| `GNURUST.19` | DIVIDE receiving-field bytes | ✅ pass | `reports/casefiles/GNURUST.19/` |

> [!NOTE]
> Every court is proven **byte-identical** to GnuCOBOL 3.2's `libcob` under a differential sweep (`FAIL=0`). ✅ = proven against the oracle; the detailed claim for each follows below.

## `GNURUST.2` — decimal `MOVE` bytes

For three elementary `cob_move` type pairs on a little-endian ASCII host under `LC_ALL=C.UTF-8`:

- **DISPLAY → DISPLAY** (zoned store, scale alignment, sign)
- **DISPLAY → PACKED** (COMP-3 encode)
- **PACKED → DISPLAY** (COMP-3 decode)

`gnucobol-rs::cob_move` produces **byte-identical** destination field bytes to `libcob`'s
`cob_move`. Verified by a differential sweep of 13,152 cases/seed across 7 seeds (`FAIL=0`), two
sharp Kani proofs, and 20M fuzz runs.

```rust
use gnucobol_rs::{cob_move, FieldAttr, COB_TYPE_NUMERIC_DISPLAY, COB_TYPE_NUMERIC_PACKED, COB_FLAG_HAVE_SIGN};

// MOVE a signed display S9(3)V99 value -012.34 into a COMP-3 field.
let src = [0x30, 0x31, 0x32, 0x33, 0x74]; // "0123" + overpunched '4' ('t')
let src_attr = FieldAttr { field_type: COB_TYPE_NUMERIC_DISPLAY, digits: 5, scale: 2, flags: COB_FLAG_HAVE_SIGN };
let dst_attr = FieldAttr { field_type: COB_TYPE_NUMERIC_PACKED,  digits: 5, scale: 2, flags: COB_FLAG_HAVE_SIGN };
let mut dst = [0u8; 3];
cob_move(&src, &src_attr, &mut dst, &dst_attr).unwrap();
assert_eq!(dst, [0x01, 0x23, 0x4d]); // COMP-3, negative sign nibble 0x0d
```

## `GNURUST.3` — PIC → field model (`gnucobol_rs::pic`)

Parse a COBOL `PIC` clause + `USAGE` into the same field model, matching the GnuCOBOL compiler's
own `cob_field_attr` + storage-size computation (differential sweep vs `cobc`, `PASS=192 FAIL=0`):

```rust
use gnucobol_rs::{build_field, Usage};

let f = build_field("S9(5)V99", Usage::Comp3, false, false).unwrap();
assert_eq!((f.attr.field_type, f.attr.digits, f.attr.scale, f.size), (0x12, 7, 2, 4)); // COMP-3, 4 bytes
```

Sealed subset: `9 X A S V`, repeats `(n)`, `SIGN [LEADING|TRAILING] [SEPARATE]`,
`USAGE DISPLAY`/`COMP-3`. The `P` scaling symbol, edited pictures, and other usages **fail closed**
with a typed `PicError`. The `P` scaling symbol is **sealed** (`GNURUST.9`): trailing `999PPP` -> `digits 6, scale -3`; leading `PPP999` -> `digits 3, scale 6`; `size` = stored `9`s. `V`+`P` and VALUE/MOVE on a P field still fail closed.

## `GNURUST.4` — DATA DIVISION layout (`gnucobol_rs::layout`)

`lay_out` assigns each record item its byte **offset** and **size** — nested groups, fixed
`OCCURS n TIMES`, `REDEFINES` overlay, and `FILLER` — matching the GnuCOBOL compiler's own record
layout (differential sweep vs `cobc`, `PASS=32 FAIL=0`). `OCCURS DEPENDING ON`, `SYNCHRONIZED`, and
a `REDEFINES` larger than its target **fail closed** with a typed `LayoutError`. A single trailing `OCCURS min TO max DEPENDING ON` is sealed (`GNURUST.10`) as its **physical maximum** (proven vs `cobc`'s `b_REC` allocation); the active/logical count is a non-claim, and multiple/nested/non-last ODO fail closed.

## `GNURUST.5` / `GNURUST.6` — COPY (+ REPLACING) copybook expansion (`gnucobol_rs::copybook`)

`expand` splices `COPY <name> [REPLACING ==old== BY ==new== …].` copybooks into the source —
recursively, with cycle detection and a per-line provenance map — matching the GnuCOBOL preprocessor
(`cobc -P`) at **text-word** granularity (`programs=7 PASS=7 FAIL=0`). REPLACING is whole-text-word
(`==AA==` does not touch `AA-X`; the `:tag:` idiom works), composes across nesting, and **fails
closed** (typed `CopyError`) on `LEADING`/`TRAILING`/identifier operands, recursion, and
over-deep/over-large expansion.

## `GNURUST.7` — decimal arithmetic (`gnucobol_rs::cob_arith`)

`cob_arith(op, a, a_attr, b, b_attr, round)` computes `a := a (op) b` in pure-Rust integer decimal
(i128, zero deps, no float), matching libcob `cob_add`/`cob_sub`/`cob_mul`: ADD/SUBTRACT (DISPLAY) +
MULTIPLY (DISPLAY/COMP-3), truncation and ROUNDED (nearest-away), negative-zero-on-overflow (sweep
`PASS=1800 FAIL=0`). ADD/SUBTRACT into PACKED (libcob's separate BCD path), DIVIDE, other rounding
modes, and >38-digit (bignum) inputs **fail closed** with a typed `ArithError`. **`GNURUST.13`** additionally seals `ADD`/`SUBTRACT` into a **PACKED** receiver (libcob's `cob_add_bcd` path): byte-identical for DISPLAY/COMP-3 operands, scales, truncate/ROUNDED, carry, overflow, and negative-zero-on-truncation (sweep `5400/0`).

## `GNURUST.8` — VALUE initial record image (`gnucobol_rs::value_image`)

`value_image(items)` computes the initial WORKING-STORAGE bytes of an `01` record from `VALUE` clauses,
matching `cobc`: alphanumeric `VALUE` (left-justified, space-padded), numeric DISPLAY (zoned +
overpunch), COMP-3 (packed via the sealed `cob_move`), with type-correct defaults for unvalued fields
(DISPLAY numeric `'0'`, alnum spaces, **COMP-3 canonical packed zero**). Sweep `PASS=392 FAIL=0`.
OCCURS/REDEFINES+VALUE, edited/`P` PICs, and non-fitting literals **fail closed** (`InitError`).

## `GNURUST.11` — LEVEL-88 condition-name predicate (`gnucobol_rs::eval_88`)

`eval_88(attr, bytes, condition)` proves whether a LEVEL-88 condition name is true for a parent field's
current bytes, matching `cobc`: alphanumeric parents compare the literal **space-padded to the parent
length** (incl. `THRU` ranges); numeric DISPLAY/COMP-3 parents compare by **numeric value** (scale/
sign-aware, ranges inclusive). Sweep `total=103 PASS=103 FAIL=0`. Predicate only — `SET`, the `FALSE`
clause, condition expressions, and collating-sensitive ranges **fail closed** (`ConditionError`).

## `GNURUST.12` — SET condition-name TO TRUE (`gnucobol_rs::set_88_true`)

`set_88_true(attr, size, condition)` constructs the canonical parent bytes GnuCOBOL writes for
`SET condition-name TO TRUE` (the first `VALUE`, or a `THRU` range's lower bound, encoded into the
parent), matching `cobc` — and its output always satisfies `eval_88` (round-trip). Sweep
`total=52 PASS=52 FAIL=0`. **TRUE only**: `SET ... TO FALSE`, the `FALSE` clause, condition
expressions, and execution **fail closed** (`ConditionSetError`).

## `GNURUST.14` — binary storage (COMP / COMP-5 / COMP-X)

`build_field` admits `USAGE COMP`/`BINARY`/`COMP-5`/`COMP-X` (type/digits/scale/flags/size match `cobc`;
PIC sweep 416/0), and `cob_move` handles DISPLAY↔binary both ways — big-endian/native two's complement,
COMP digit-truncation, COMP-X/COMP-5 byte-masking (binary MOVE sweep 546/0). `Decimal::from_binary`
decodes for the read path. Binary **arithmetic**, SYNCHRONIZED, and host-portable endian are non-claims.

## `GNURUST.15` — EBCDIC code-page boundary (cp500)

`ebcdic::decode_display(CodePage::Cp500, bytes)` decodes raw EBCDIC **alphanumeric DISPLAY** bytes to
text via the cp500 table — byte-for-byte the table the admitted oracle's `cob_load_collation` produces
(sweep 256/256). Other code pages (incl. cp037), numeric EBCDIC zoned sign, national/DBCS, and
binary/packed conversion are non-claims (binary/packed bytes pass through untouched).

## `GNURUST.16` — edited-picture decode (16a + 16b)

`edited::decode_edited(pic, bytes)` recovers an edited DISPLAY field's `numeric_value` + presentation
`raw_text` for `Z 9 , . - +` (16a) and the financial decorations `$ * CR DB B 0 /` (16b) — slot-based, proven
against `cobc`'s MOVE→edited→DISPLAY (92/0). Decode-only: numeric→edited formatting, reports, locale,
EBCDIC edited, and edited arithmetic are non-claims; corrupt/foreign bytes fail closed.

## `GNURUST.17` — cp500 EBCDIC zoned numeric decode

`Decimal::from_ebcdic_zoned(data, attr)` decodes raw mainframe **zoned-decimal numeric DISPLAY** bytes:
cp500 translate (`GNURUST.15`) + the `cob_get_sign_ebcdic` overpunch sign (final byte `'A'..'I'`=+,
`'J'..'R'`=−, `'{'`/`'}'`=±0; raw zones `0xC`/`0xD`/`0xF`). Proven vs `cobc -fsign=EBCDIC` (120/0). cp037,
edited-numeric under cp500, and binary/packed via this path are non-claims.

## `GNURUST.18` — COMP-6 unsigned packed-decimal

`Usage::Comp6` → `build_field` gives `{PACKED, NO_SIGN_NIBBLE, ceil(digits/2)}` (two digits/byte, no sign
nibble), proven vs `cobc` (PIC 432/0); `cob_move` DISPLAY↔COMP-6 matches libcob (98/0); `from_packed`
decodes it. **Unsigned only** — signed COMP-6 is converted by GnuCOBOL to COMP-3 (non-claim).

## `GNURUST.19` — DIVIDE receiving-field bytes

`arith::cob_divide(lhs, lhs_attr, rhs, rhs_attr, recv_attr, round)` writes `recv := lhs/rhs` byte-for-byte
as `cobc` for `DIVIDE ... GIVING` (DISPLAY/COMP-3, truncate + ROUNDED, signed/scaled/narrowing), proven
736/0. Divide-by-zero fails closed; REMAINDER/COMPUTE/ON SIZE ERROR/float/binary-edited receivers are
non-claims.

## What it does NOT do

> [!CAUTION]
> Not a GnuCOBOL replacement, not a compiler, not `libcob`. Beyond the sealed claims above, these are **refused** (each fails closed with a typed error):

| ❌ not claimed | note |
|---|---|
| `ON SIZE ERROR` / overflow control-flow | bytes-written + branch semantics unmapped |
| `DIVIDE ... REMAINDER` | quotient bytes are `GNURUST.19`; the remainder receiver is a future court |
| rounding modes other than nearest-away | only `ROUNDED` nearest-away is proven |
| comparison / collation, binary & float arithmetic | out of the admitted numeric subset |
| `DISPLAY`-statement output, file I/O | not a runtime; see `KOBOLD.FILE.1` for container ingest only |
| `OCCURS DEPENDING ON` arithmetic | physical-max layout only (`GNURUST.4/10`) |

See [`reports/negative-capabilities.json`](reports/negative-capabilities.json) and [`docs/future-risk-register.md`](docs/future-risk-register.md) for the full machine-readable refusal set.

## License

**LGPL-3.0-or-later** — this is a faithful derivative port of `libcob/move.c`, `libcob/numeric.c`,
and `libcob/common.c` (GnuCOBOL 3.2, © Free Software Foundation, Inc.; authors Keisuke Nishida,
Roger While, Simon Sobisch, et al.), and inherits their copyleft. See `COPYING.LESSER`.

---

*This README is generated by `xtask docs` for **gnucobol-rs 0.7.85** — regenerate with `cargo run -p xtask -- docs generate`; freshness (content + version) is enforced by the `docs check` gate.*

