@@ -1,5 +1,5 @@
 // GENERATED by scripts/p037_hostile_census.py (P-037 A2.2-4 hostile census); do not edit.
-// site form: a reduced extension method invoked through `?.` on the handle; the receiver still binds declared ordinal 0
+// site form: a reduced extension method invoked through `?.` on the handle; the receiver still binds declared ordinal 0 (F-CONDITIONAL-RECEIVER, repaired in A2.2-4R3)
 using System;
 using System.IO;
 using System.Collections.Generic;
 
@@ -278,11 +278,8 @@
      "explanation": "receiver_not_summary_parameter"
     }
    ],
-   "red": {
-    "occurrence_not_captured": 1
-   },
-   "finding": "F-CONDITIONAL-RECEIVER",
-   "why": "site form: a reduced extension method invoked through `?.` on the handle; the receiver still binds declared ordinal 0"
+   "red": {},
+   "why": "site form: a reduced extension method invoked through `?.` on the handle; the receiver still binds declared ordinal 0 (F-CONDITIONAL-RECEIVER, repaired in A2.2-4R3)"
   },
   "member-accessor": {
    "member": "H_member_accessor.M",
 
@@ -9,13 +9,6 @@
       "status": "open: a census finding; carrying these members in the orphan carrier is a production change to be classified on its own",
       "red": "occurrence_not_captured"
     },
-    "F-CONDITIONAL-RECEIVER": {
-      "class": "case 1",
-      "title": "a reduced extension receiver under `?.` is not bound to ordinal 0",
-      "evidence": "The invocation loop reads the receiver only from a MemberAccessExpressionSyntax; `r?.Ext(...)` invokes through a MemberBindingExpressionSyntax and the receiver handle is dropped, so the call is not relevant unless another argument is a handle. Witnessed by the hostile case ext-conditional-access.",
-      "status": "open: an implementation defect in the A2 classifier, to be repaired as its own classified change",
-      "red": "occurrence_not_captured"
-    },
     "F-VOCAB": {
       "class": "case 3",
       "title": "argument shapes the frozen vocabulary has no name for: a tested operand, an interpolation hole, an indexer argument, a constructor-initializer argument",
@@ -47,6 +40,13 @@
       "evidence": "For an expanded params argument the argument operation carries the call's own syntax, so the span-containment match finds nothing and the fallback classifies `model.GetOperation(expression)` of the element alone. A transparent wrapper (parentheses, the null-forgiving `!`) has no operation of its own, so the handle under it is lost and the call is not relevant; a boxing or user-defined element conversion sits on the array element, not on the expression, so a struct handle boxed into `params object[]` or a handle passed through op_Implicit into `params Box[]` yields an opaque-and-relevant slot although nothing of the handle reaches the callee. Witnessed by the hostile cases whose binding is `params` and whose value-flow shape is parens, bang, boxing or user_implicit; casts, `as` and the may-value forms have operations of their own and are classified correctly.",
       "status": "closed: A2.2-4R2. ValueOf classifies an expanded params element from the ParamArray argument's array initializer element (its conversion included) instead of the bare syntax; the affected pairwise cases are designed green by the generic rule.",
       "red": "occurrence_not_captured (lost) / fact_without_relevant_occurrence (false)"
+    },
+    "F-CONDITIONAL-RECEIVER": {
+      "class": "case 1",
+      "title": "a reduced extension receiver under `?.` is not bound to ordinal 0",
+      "evidence": "The invocation loop reads the receiver only from a MemberAccessExpressionSyntax; `r?.Ext(...)` invokes through a MemberBindingExpressionSyntax and the receiver handle is dropped, so the call is not relevant unless another argument is a handle. Witnessed by the hostile case ext-conditional-access.",
+      "status": "closed: A2.2-4R3. The invocation loop reads the reduced receiver of an invocation through a MemberBindingExpressionSyntax from the nearest enclosing ConditionalAccessExpressionSyntax's expression; ext-conditional-access is designed green.",
+      "red": "occurrence_not_captured"
     }
   }
 }
@@ -1171,7 +1171,12 @@ causes of FACT-DIFF. Tracked in #364 with its own acceptance.
   classified from the ParamArray argument's array-initializer element, its
   element conversion included, so a handle under parentheses or `!` is no
   longer lost and a boxed or user-converted element no longer yields a false
-  slot; the affected pairwise cases read green by the generic design;
+  slot; the affected pairwise cases read green by the generic design. R3
+  landed in the commit carrying this line: the reduced receiver of an
+  invocation through a member binding (`r?.Ext(...)`) is read from the
+  enclosing conditional access, so the handle binds declared ordinal 0 there
+  too; `ext-conditional-access` reads green; the three case-1 findings are
+  closed;
 - **A2.2-5** mutation campaign: remove the handle, add parentheses, perturb the
   binding, distinguish nested calls;
 - **A2.2-S** cumulative A2 after-evidence on M1 against the existing R with
@@ -1229,7 +1234,7 @@ does a pinned RED that silently disappears):
 | F-MEMBER | 3 | expression-bodied members, struct and record methods, property accessors are outside the legacy admission *and* the orphan carrier (the gates sit inside the class / block-body loop) | probe `Box.op_Implicit`; hostile `member-*` |
 | F-SHADOW | 1 | the guarded-fact handle set was keyed by spelling (`handles.Contains(lr.Local.Name)`) and the candidate collector descends into lambdas: a same-spelled non-candidate in a sibling scope, or beside a lambda-local creation, got a false `var` fact. **Repaired in A2.2-4R1** (10.6.11) | hostile `shadow-*`, now green |
 | F-PARAMS-ELEMENT | 1 | an expanded params element was classified from its bare syntax: under parentheses or `!` the handle was lost (no operation of its own); under a boxing or user-defined element conversion a false opaque-and-relevant slot was emitted. **Repaired in A2.2-4R2** (10.6.11) | hostile `pw-*-params-*` with parens / bang / boxing / user_implicit, now green |
-| F-CONDITIONAL-RECEIVER | 1 | `r?.Ext(...)` invokes through a member binding, the receiver is read from `MemberAccessExpressionSyntax` only, and ordinal 0 is dropped | hostile `ext-conditional-access` |
+| F-CONDITIONAL-RECEIVER | 1 | `r?.Ext(...)` invokes through a member binding, the receiver was read from `MemberAccessExpressionSyntax` only, and ordinal 0 was dropped. **Repaired in A2.2-4R3** (10.6.11) | hostile `ext-conditional-access`, now green |
 | F-VOCAB | 3 | four argument shapes the frozen list has no name for: a tested operand, an interpolation hole, an indexer argument, a constructor-initializer argument; production correctly emits nothing, the sentence demands a name | hostile `vocab-*` |
 
 Two rulings the oracle reads into the freeze, recorded here as §10.1 case-4
@@ -1299,3 +1304,19 @@ nested-function gap.
   expanded params binding, across site forms and carriers) read green by the
   generic design; every other pinned RED stays; inertness and the local
   rehearsal unchanged.
+- **R3, F-CONDITIONAL-RECEIVER.** In the invocation loop the reduced
+  receiver is read from a `MemberAccessExpressionSyntax` as before and, for
+  an invocation whose expression is a `MemberBindingExpressionSyntax`, from
+  the nearest enclosing `ConditionalAccessExpressionSyntax`'s expression: a
+  binding is by construction the first operation after its `?.`, so that
+  expression is the receiver (`a?.B?.Ext()` reads the inner binding `.B`, a
+  member, not a handle). The receiver then goes through `ValueOf` and the
+  walker as a member-access receiver does, with one more rule in the walker:
+  Roslyn binds such a receiver argument to an
+  `IConditionalAccessInstanceOperation` placeholder, which stands for the
+  conditional access's own operand (the same reference when the call is
+  entered at all; a null operand skips the call and yields no alternate
+  value), so the walker classifies that operand. Measured: the 52 shapes
+  and the probe byte-identical; `ext-conditional-access` reads green
+  (captured, ordinal 0, `var`); every other pinned RED stays; inertness and
+  the local rehearsal unchanged.
@@ -3063,6 +3063,17 @@ bool Stable(IParameterSymbol p)
                     }
                 }
                 return (Opaque(), false);
+            case IConditionalAccessInstanceOperation cai:
+            {
+                // `r?.Ext(...)` (A2.2-4R3): Roslyn binds the receiver argument to a placeholder that
+                // stands for the conditional access's own operand — the same reference when the
+                // call is entered at all (a null operand skips the call, never an alternate
+                // value). Classify that operand.
+                IOperation? owner = cai.Parent;
+                while (owner is not null and not IConditionalAccessOperation)
+                    owner = owner.Parent;
+                return Classify((owner as IConditionalAccessOperation)?.Operation);
+            }
             case IParameterReferenceOperation pr:
                 return ParamFact(pr.Parameter);
             case ILocalReferenceOperation lr:
@@ -3231,7 +3242,20 @@ void Bind(int ordinal, Dictionary<string, object?> fact, bool handle)
                      "delegate_invocation", firstParty: false);
             continue;
         }
-        var receiver = reduced && inv.Expression is MemberAccessExpressionSyntax ma ? ma.Expression : null;
+        // P-037 A2.2-4R3 (F-CONDITIONAL-RECEIVER): `r?.Ext(...)` invokes through a member
+        // binding, and a binding is by construction the first operation after its `?.`, so
+        // the receiver is the nearest enclosing conditional access's own expression. Read
+        // from a member access only, the reduced receiver under `?.` was dropped and the
+        // handle's declared ordinal 0 with it.
+        ExpressionSyntax? receiver = null;
+        if (reduced)
+            receiver = inv.Expression switch
+            {
+                MemberAccessExpressionSyntax ma => ma.Expression,
+                MemberBindingExpressionSyntax =>
+                    inv.Ancestors().OfType<ConditionalAccessExpressionSyntax>().FirstOrDefault()?.Expression,
+                _ => null,
+            };
         EmitCall(inv, sym, decl, reduced, receiver, inv.ArgumentList, invOp?.Arguments, null,
                  firstParty: decl is not null && decl.DeclaringSyntaxReferences.Length > 0);
     }
 
@@ -536,13 +536,13 @@ def named_cases() -> list[tuple[str, str, dict[str, Any]]]:
     out.append(named_case(
         "ext-conditional-access",
         "site form: a reduced extension method invoked through `?.` on the handle; the receiver "
-        "still binds declared ordinal 0",
+        "still binds declared ordinal 0 (F-CONDITIONAL-RECEIVER, repaired in A2.2-4R3)",
         ["static void Ext(this Stream s, bool leaveOpen) { }",
          "static void M() { MemoryStream? r = new MemoryStream(); var keep = new MemoryStream(); "
          "r?.Ext(true); keep.Dispose(); }"],
         {"carrier": "functions",
          "occurrences": [cap("r"), exc("keep", "receiver_not_summary_parameter")],
-         "red": {"occurrence_not_captured": 1}, "finding": "F-CONDITIONAL-RECEIVER"}))
+         "red": {}}))
     out.append(named_case(
         "ext-boxed-receiver",
         "site form: a struct handle as the receiver of an extension method on object; the receiver "
 
@@ -377,7 +377,9 @@ guarded_facts:
 ```
 
 Binding rules: a named argument resolves to its parameter; a reduced extension's
-receiver is ordinal 0 (the unreduced declaration is the summary's home); an
+receiver is ordinal 0 (the unreduced declaration is the summary's home),
+whether written `r.Ext(...)` or `r?.Ext(...)` (P-037 A2.2-4R3: the receiver
+of a member binding is the enclosing conditional access's expression); an
 argument bound to a `params` array collapses to one `opaque` slot, each
 expanded element classified with its own element conversion (P-037 A2.2-4R2:
 a handle under parentheses or `!` still flows, a boxed struct handle or one