Find classified character ranges in COBOL DISPLAY

Trace individual character origins through equal-width MOVEs and bounded STRING DELIMITED BY SIZE. Retain unwritten receiver suffixes. Accept ordinary PIC X fields of at most 256 characters and at most 16 STRING operands. Reject overlapping STRING operands, pointers, overflow handlers, other delimiters and transfers exceeding capacity. Supported literal writes, SET and INITIALIZE remove field origins for overwritten characters. Unknown effects discard local facts. Across supported IF and EVALUATE branches, retain only origins with the same source declaration and character position on every branch. Do not select a feasible branch. Bound condition nesting to 16 and EVALUATE labels to 64. Summarize unique local paragraph PERFORMs with at most 64 expanded statements and 16 active paragraphs. Allow IN and OF section qualifiers. Bound each character's evidence to 64 transfer sites. Reject recursion, sections, ranges and unknown effects. Inspect plain DISPLAY statements with one to 16 operands. Accept fields, in-bounds literal slices, quoted ASCII text and SPACE or SPACES. Limit fields and text literals to 256 characters. Slice positions and lengths must be positive integer literals of at most 18 digits. An omitted length extends to the field end. Validate every operand before reporting a range. Count output positions in the concatenated sending field, including literals. These positions are not physical device columns. Report at most one finding per DISPLAY with all prohibited ranges. Join ordinary sentences within one paragraph only without NEXT SENTENCE or procedural COPY. Incomplete source, redefined storage, groups as transfer operands and unsupported layouts remain outside the proof. Report a finding only under an explicit classification prohibiting output of any copied character from the source. Unknown origins do not prove erasure or safe output. Reachability and approved redaction or audit behavior remain unproven. Preserve character origins across supported DISPLAY statements with up to 16 ordinary PIC X fields, literal slices and bounded ASCII text operands. Validate every operand before preserving facts. Device options, expressions, dynamic slices and unsupported storage remain barriers. INITIALIZE VALUE and FILLER phrases require a separate effect proof and discard default-assignment facts. An explicit TO DEFAULT without a VALUE, FILLER or replacement phrase retains the default behavior.