@@ -0,0 +1,22 @@
+# ownership-semantics-lab (research/ownership-semantics-lab-v1, EXPLORATORY)
+
+Research-only fixtures and tooling of the ownership-semantics-lab track. Nothing here is part of a
+production test or build; every analyzer change on this branch sits behind an opt-in environment
+flag (`OWEN_LAB_NULLINIT`, `OWEN_LAB_NULLGUARD`, `OWEN_LAB_THROWEXIT`) and is byte-identical off.
+Records: Own.NET-paperwork `paper-eval/ownership-lab/` (taxonomy, prior-art map, hypothesis register,
+probes, discovery protocol and results).
+
+| dir | what |
+|---|---|
+| `adoption-probe/` | the four fixture variants of the RLC# held-out wrapper (classification probe) |
+| `depid/` | LibA/LibB/LibC/App: the runtime-effective dependency identity falsifier |
+| `h01/` | F0 (null-guard control), F1 (H-01 null-initialised locals), F2 (H-19 twins) with observed outputs |
+| `h09/` | the MVID-pinned row falsifier inputs (consumer, keys) |
+| `h16/` | the Z3 symbolic probe and the complementary-guard fixture |
+| `h20/` | F3 (throw-exit versus bare return) with observed outputs off/on |
+| `witness/` | the runtime-witness generator (`gen.py`), its ten rows and results |
+| `discovery/` | the discovery-experiment pipeline scripts (acquire, API surface, fetch, derive, consumers, scan) |
+
+Tools: `frontend/roslyn/OwnSharp.AsmId` (assembly identity facets), `frontend/roslyn/OwnSharp.ApiList`
+(public resource-bearing API surface). Scratch paths inside the scripts point at the session
+container and are recorded as such.
@@ -0,0 +1,43 @@
+"""discovery S5: derive BODY_PROVED rows from the fetched source files of one library through the research body arms
+(E1 fresh returns, E2 receiver releases, E3 mixed returns) and pin them to the deployed assembly's MVID.
+usage: derive.py <PackageId>  (reads libs/<id>/acquire.json and libs/<id>/src/**.cs)"""
+import sys, os, json, subprocess, glob, re
+S='/tmp/claude-0/-home-user/8a9da608-aa27-5449-8306-1fae9426f9b9/scratchpad'; R='/home/user/Own.NET'
+pid=sys.argv[1]; d=f'{S}/lab/disc/libs/{pid}'; acq=json.load(open(f'{d}/acquire.json'))
+src=sorted(glob.glob(f'{d}/src/**/*.cs', recursive=True))
+env={**os.environ,'PATH':'/root/.dotnet:'+os.environ['PATH'],'DOTNET_NOLOGO':'1','DOTNET_CLI_TELEMETRY_OPTOUT':'1','PYTHONPATH':R,
+     'OWEN_RE_BODY':'1','OWEN_RE_MINTED_RETURN':'1','OWEN_RE_MIXED_RETURN':'1','OWEN_RE_DUMP_EFFECTS':f'{d}/dump.json'}
+for k in ('OWEN_RE_ORACLE','OWEN_P037X_RELATIONAL','OWEN_LAB_NULLINIT','OWEN_LAB_NULLGUARD'): env.pop(k,None)
+refdir=os.path.dirname(acq['main_assembly']) if acq.get('main_assembly') else None
+argv=['dotnet',f'{R}/frontend/roslyn/OwnSharp.Extractor/bin/Release/net8.0/ownsharp-extract.dll','--flow-locals',*src,'-o',f'{d}/facts.json']
+if refdir: argv+=['--ref-dir',refdir]
+r=subprocess.run(argv,cwd=R,capture_output=True,text=True,env=env)
+open(f'{d}/derive.err','w').write(r.stderr)
+summ=subprocess.run(['python3','-m','ownlang','summaries',f'{d}/facts.json'],cwd=R,capture_output=True,text=True,env=env).stdout
+try: summaries=json.loads(summ)['summaries']
+except Exception: summaries=[]
+api=json.load(open(f'{d}/api.json')) if os.path.exists(f'{d}/api.json') else {'factories':[],'release_name_candidates':[],'types':[]}
+public_callables={f['callable'] for f in api['factories']} | {r['callable'] for r in api['release_name_candidates']} | {f"{t['type']}.Dispose" for t in api['types']}
+public_types={t['type'] for t in api['types']}
+mvid=(acq.get('identity') or {}).get('mvid'); asm=acq['package']
+rows=[]; seen=set()
+for s in summaries:
+    if s.get('returns',{}).get('owned')=='fresh':
+        m=s['method'].split('(')[0]; sig=s.get('sig')
+        # method summaries are keyed Namespace.Type.Method[(sig)]; keep only PUBLIC factories of the API surface;
+        # explicit interface implementations (Type.IFace.Method) never match a public callable
+        if m in public_callables and (m,'fresh') not in seen:
+            seen.add((m,'fresh')); rows.append({'callable':m,'effect':'return_fresh_owned','provenance':'BODY_PROVED','assembly':{'name':asm,'mvid':mvid},'derived_from':f"{acq.get('repository_url')}@{acq.get('repository_commit')} via E1/E3 ({s.get('source')})"})
+dump=json.load(open(f'{d}/dump.json')) if os.path.exists(f'{d}/dump.json') else {}
+for e in dump.get('receiver_release',[]):
+    if e.get('releases') and e['callable'] in public_callables and not e['callable'].endswith('.Dispose') and (e['callable'],e.get('arity')) not in seen:
+        seen.add((e['callable'],e.get('arity'))); rows.append({'callable':e['callable'],'effect':'receiver_terminal_release','arity':e.get('arity'),'provenance':'BODY_PROVED','assembly':{'name':asm,'mvid':mvid},'derived_from':f"{acq.get('repository_url')}@{acq.get('repository_commit')} via E2"})
+census=re.search(r're-body: (.*)',r.stderr); stats=json.load(open(f'{d}/facts.json')).get('stats') if os.path.exists(f'{d}/facts.json') else None
+key={'schema':'own.net/re-oracle/v1','label':f'discovery BODY_PROVED rows for {pid} {acq["version"]} (pinned to MVID {mvid})','entries':rows}
+json.dump(key,open(f'{d}/rows-bodyproved.json','w'),indent=1)
+fresh_all=[s['method'] for s in summaries if s.get('returns',{}).get('owned')=='fresh']
+fresh_public_missing=[s['method'] for s in summaries if s.get('returns',{}).get('owned')=='fresh' and s['method'].split('(')[0] not in public_callables]
+rel_all=[e['callable'] for e in dump.get('receiver_release',[]) if e.get('releases')]
+json.dump({'source_files':len(src),'extractor_stats':stats,'re_body_census':census.group(1) if census else None,'fresh_summaries_all':fresh_all,'receiver_release_all':rel_all,'fresh_not_public_surface':fresh_public_missing,'instance_methods_evaluated':dump.get('instance_methods_evaluated'),'public_rows':len(rows)},open(f'{d}/derive-summary.json','w'),indent=1)
+print(json.dumps({'package':pid,'files':len(src),'stats':stats,'census':census.group(1) if census else None,'fresh_all':len(fresh_all),'release_all':len(rel_all),'public_rows':len(rows)}))
+for x in rows: print('  ROW', x['effect'], x['callable'], x.get('arity',''))
@@ -0,0 +1,35 @@
+"""discovery S1: acquire the exact binary (nupkg from the NuGet flat container), its nuspec repository pin, the
+highest-TFM lib assembly and its identity (MVID/sha256). usage: fetch.py <PackageId> <version>"""
+import sys, os, json, hashlib, zipfile, urllib.request, re, subprocess
+S='/tmp/claude-0/-home-user/8a9da608-aa27-5449-8306-1fae9426f9b9/scratchpad'; R='/home/user/Own.NET'
+pid, ver = sys.argv[1], sys.argv[2]
+d=f'{S}/lab/disc/libs/{pid}'; os.makedirs(d, exist_ok=True)
+nupkg=f'{d}/{pid.lower()}.{ver}.nupkg'
+if not os.path.exists(nupkg):
+    urllib.request.urlretrieve(f'https://api.nuget.org/v3-flatcontainer/{pid.lower()}/{ver}/{pid.lower()}.{ver}.nupkg', nupkg)
+sha=hashlib.sha256(open(nupkg,'rb').read()).hexdigest()
+z=zipfile.ZipFile(nupkg)
+spec=[n for n in z.namelist() if n.endswith('.nuspec')][0]; xml=z.read(spec).decode('utf-8','replace')
+repo=re.search(r'<repository[^>]*url="([^"]+)"[^>]*commit="([^"]+)"', xml) or re.search(r'<repository[^>]*commit="([^"]+)"[^>]*url="([^"]+)"', xml)
+url=commit=None
+if repo:
+    a,b=repo.group(1),repo.group(2); (url,commit)=(a,b) if a.startswith('http') else (b,a)
+tfms=['net8.0','net9.0','net10.0','net7.0','net6.0','netstandard2.1','netstandard2.0','net462','net461','net45']
+libs=[n for n in z.namelist() if n.startswith('lib/') and n.endswith('.dll')]
+chosen=None
+for t in tfms:
+    c=[n for n in libs if n.split('/')[1]==t]
+    if c: chosen=c; break
+if chosen is None and libs: chosen=libs
+out=[]
+if chosen:
+    for n in chosen:
+        p=f'{d}/lib/{n.split("/")[1]}/{os.path.basename(n)}'; os.makedirs(os.path.dirname(p), exist_ok=True); open(p,'wb').write(z.read(n)); out.append(p)
+main=[p for p in out if os.path.basename(p).lower()==f'{pid.lower()}.dll'] or out[:1]
+ident=None
+if main:
+    r=subprocess.run(['dotnet',f'{R}/frontend/roslyn/OwnSharp.AsmId/bin/Release/net8.0/ownsharp-asmid.dll',main[0]],capture_output=True,text=True,env={**os.environ,'PATH':'/root/.dotnet:'+os.environ['PATH'],'DOTNET_NOLOGO':'1','DOTNET_CLI_TELEMETRY_OPTOUT':'1'})
+    try: ident=json.loads(r.stdout.strip().splitlines()[-1])
+    except Exception: ident={'error':r.stderr[-300:]}
+rec={'package':pid,'version':ver,'nupkg_sha256':sha,'repository_url':url,'repository_commit':commit,'lib_files':out,'main_assembly':main[0] if main else None,'identity':ident,'xmldoc':[n for n in z.namelist() if n.endswith('.xml') and n.startswith('lib/')][:3]}
+json.dump(rec, open(f'{d}/acquire.json','w'), indent=1); print(json.dumps({k:rec[k] for k in ('package','version','repository_url','repository_commit','main_assembly')}), 'mvid=', (ident or {}).get('mvid'))
@@ -0,0 +1,13 @@
+"""discovery S8 (acquire): fetch consumer source files at a commit into libs/<pkg>/consumers/<tag>/ (cap 40)."""
+import sys, os, json, hashlib, urllib.request
+S='/tmp/claude-0/-home-user/8a9da608-aa27-5449-8306-1fae9426f9b9/scratchpad'
+pid, tag, repo, commit, paths = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4], sys.argv[5:][:40]
+d=f'{S}/lab/disc/libs/{pid}/consumers/{tag}'; os.makedirs(d, exist_ok=True); rec=[]
+for p in paths:
+    url=f'https://raw.githubusercontent.com/{repo}/{commit}/{p}'; out=f'{d}/{p.replace("/","__")}'
+    try:
+        with urllib.request.urlopen(url, timeout=60) as r: data=r.read()
+        open(out,'wb').write(data); rec.append({'path':p,'sha256':hashlib.sha256(data).hexdigest(),'bytes':len(data)})
+    except Exception as e: rec.append({'path':p,'error':str(e)[:80]})
+json.dump({'package':pid,'consumer':tag,'repo':repo,'commit':commit,'files':rec}, open(f'{S}/lab/disc/libs/{pid}/s8-consumers-{tag}.json','w'), indent=1)
+print(pid, tag, 'fetched', len([r for r in rec if 'sha256' in r]), 'of', len(rec), 'errors:', [r['path'] for r in rec if 'error' in r])
@@ -0,0 +1,15 @@
+"""discovery S4: fetch the resource-bearing source files at the nuspec-pinned commit from raw.githubusercontent.com.
+usage: fetchsrc.py <PackageId> <owner/repo> <commit> <path> [<path> ...]   (cap 25 files; digests recorded)"""
+import sys, os, json, hashlib, urllib.request
+S='/tmp/claude-0/-home-user/8a9da608-aa27-5449-8306-1fae9426f9b9/scratchpad'
+pid, repo, commit, paths = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4:][:25]
+d=f'{S}/lab/disc/libs/{pid}/src'; os.makedirs(d, exist_ok=True); rec=[]
+for p in paths:
+    url=f'https://raw.githubusercontent.com/{repo}/{commit}/{p}'; out=f'{d}/{p.replace("/","__")}'
+    try:
+        with urllib.request.urlopen(url, timeout=60) as r: data=r.read()
+        open(out,'wb').write(data); rec.append({'path':p,'sha256':hashlib.sha256(data).hexdigest(),'bytes':len(data)})
+    except Exception as e:
+        rec.append({'path':p,'error':str(e)[:80]})
+json.dump({'package':pid,'repo':repo,'commit':commit,'files':rec}, open(f'{S}/lab/disc/libs/{pid}/s4-source.json','w'), indent=1)
+ok=[r for r in rec if 'sha256' in r]; print(pid, 'fetched', len(ok), 'of', len(rec), 'errors:', [r['path'] for r in rec if 'error' in r])
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# discovery S1+S2 for a list of "Package version" pairs
+export PATH=/root/.dotnet:$PATH DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1
+S=/tmp/claude-0/-home-user/8a9da608-aa27-5449-8306-1fae9426f9b9/scratchpad; cd $S/lab/disc
+while read -r pid ver; do
+  [ -z "$pid" ] && continue
+  python3 fetch.py "$pid" "$ver" 2>&1 | tail -1
+  main=$(python3 -c "import json;print(json.load(open('libs/$pid/acquire.json')).get('main_assembly') or '')")
+  if [ -n "$main" ]; then dotnet /home/user/Own.NET/frontend/roslyn/OwnSharp.ApiList/bin/Release/net8.0/ownsharp-apilist.dll "$main" > libs/$pid/api.json 2> libs/$pid/api.err
+    python3 -c "import json;a=json.load(open('libs/$pid/api.json'));print('  API $pid: types',a['disposable_types'],'factories',len(a['factories']),'adopting ctors',len(a['adopting_ctors']),'release names',len(a['release_name_candidates']))" || echo "  API $pid: FAILED $(head -c 200 libs/$pid/api.err)"
+  else echo "  $pid: no main assembly"; fi
+done <<'LIST'
+MySqlConnector 2.6.2
+StackExchange.Redis 3.3.1
+RabbitMQ.Client 7.2.2
+MQTTnet 5.2.0.1603
+SSH.NET 2026.0.0
+MailKit 4.18.1
+SharpZipLib 1.4.2
+SharpCompress 1.0.0
+SixLabors.ImageSharp 4.1.2
+BouncyCastle.Cryptography 2.7.0
+NSec.Cryptography 26.4.0
+SkiaSharp 4.153.1
+LibGit2Sharp 0.32.0
+CsvHelper 33.1.0
+Newtonsoft.Json 13.0.4
+LIST
+echo S12_DONE
@@ -0,0 +1,28 @@
+"""discovery S8 (scan): OFF (no key) versus KEY (applied rows) over a consumer set; findings diffed per file (Rust engine,
+guarded off); python==rust checked. usage: scan.py <pkg> <consumer-tag> [applied-rows.json]"""
+import sys, os, json, subprocess, glob, re, hashlib
+S='/tmp/claude-0/-home-user/8a9da608-aa27-5449-8306-1fae9426f9b9/scratchpad'; R='/home/user/Own.NET'
+pid, tag = sys.argv[1], sys.argv[2]; L=f'{S}/lab/disc/libs/{pid}'
+key = sys.argv[3] if len(sys.argv)>3 else f'{L}/rows-applied.json'
+acq=json.load(open(f'{L}/acquire.json')); refdir=os.path.dirname(acq['main_assembly'])
+files=sorted(glob.glob(f'{L}/consumers/{tag}/*.cs'))
+DLL=f'{R}/frontend/roslyn/OwnSharp.Extractor/bin/Release/net8.0/ownsharp-extract.dll'; OWN=f'{R}/rust/target/release/own-cli'
+FIND=re.compile(r'([^/\s]+\.cs):(\d+): (\w+): \[(OWN\d+)\] (.*)')
+env={**os.environ,'PATH':'/root/.dotnet:'+os.environ['PATH'],'DOTNET_NOLOGO':'1','DOTNET_CLI_TELEMETRY_OPTOUT':'1','PYTHONPATH':R}
+for k in ('OWEN_RE_ORACLE','OWEN_RE_BODY','OWEN_RE_MINTED_RETURN','OWEN_RE_MIXED_RETURN','OWEN_P037X_RELATIONAL','OWEN_P037X_GUARDED','OWEN_LAB_NULLINIT','OWEN_LAB_NULLGUARD'): env.pop(k,None)
+def run(arm, e):
+    out=f'{L}/s8-{tag}.{arm}.facts.json'
+    r=subprocess.run(['dotnet',DLL,'--flow-locals',*files,'--ref-dir',refdir,'-o',out],cwd=R,capture_output=True,text=True,env=e)
+    census=re.findall(r'(re-oracle[^\n]*)',r.stderr)
+    v=subprocess.run([OWN,'ownir',out,'--format','human','--severity','warning','--verbosity','verbose'],cwd=R,capture_output=True,text=True,env={**e,'OWEN_P037X_GUARDED':'0'}).stdout
+    p=subprocess.run(['python3','-m','ownlang','ownir',out,'--format','human','--severity','warning','--verbosity','verbose'],cwd=R,capture_output=True,text=True,env=e).stdout
+    f=sorted(set((m.group(1),int(m.group(2)),m.group(4),m.group(5)) for m in FIND.finditer(v)))
+    fp=sorted(set((m.group(1),int(m.group(2)),m.group(4),m.group(5)) for m in FIND.finditer(p)))
+    return {'findings':f,'python_equals_rust':f==fp,'census':census,'stats':json.load(open(out)).get('stats') if os.path.exists(out) else None}
+off=run('off',env); key_=run('key',{**env,'OWEN_RE_ORACLE':key})
+new=[x for x in key_['findings'] if x not in off['findings']]; lost=[x for x in off['findings'] if x not in key_['findings']]
+res={'package':pid,'consumer':tag,'files':len(files),'key':key,'key_sha256':hashlib.sha256(open(key,'rb').read()).hexdigest(),'off':off,'key_arm':key_,'new_findings':new,'lost_findings':lost}
+json.dump(res,open(f'{L}/s8-scan-{tag}.json','w'),indent=1)
+print(json.dumps({'package':pid,'consumer':tag,'files':len(files),'off_findings':len(off['findings']),'key_findings':len(key_['findings']),'new':len(new),'lost':len(lost),'py==rs':off['python_equals_rust'] and key_['python_equals_rust'],'census':key_['census'],'stats':key_['stats']}))
+for x in new: print('  NEW', x)
+for x in lost: print('  LOST', x)
@@ -0,0 +1,23 @@
+using System;
+using System.IO;
+public static class F0
+{
+    public static void NullGuardRelease()
+    {
+        var x = new MemoryStream();
+        x.WriteByte(1);
+        if (x != null) x.Dispose();       // control: a null guard on a tracked local must not read as 'may not release'
+    }
+    public static void NullConditionalRelease()
+    {
+        var x = new MemoryStream();
+        x.WriteByte(1);
+        x?.Dispose();
+    }
+    public static void TryFinallyNullGuard()
+    {
+        var x = new MemoryStream();
+        try { x.WriteByte(1); }
+        finally { if (x != null) x.Dispose(); }
+    }
+}
@@ -0,0 +1,3 @@
+F0.guard2.facts.json: ok — no subscription leaks found
+
+0 findings.
@@ -0,0 +1,4 @@
+F0.cs:7: warning: [OWN001] IDisposable local 'x' may not be disposed on every path (leak) [resource: disposable]
+F0.cs:19: warning: [OWN001] IDisposable local 'x' may not be disposed on every path (leak) [resource: disposable]
+
+2 findings.
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+F0.guard2.facts.json: ok — no subscription leaks found`
	`2`	`+`
	`3`	`+0 findings.`