P-037 A2.1: emit the guarded-fact sidecar from the Roslyn extractor, validated and inert

Treatment-only step of the A2 staging (docs/notes/p037-formal-kernel.md §10.3):
the extractor now writes `functions[].guarded_facts`, the raw record of what
flows into each relevant call and what each eligible `if` tests, keyed by
declared parameter ordinal. Neither engine reads it; the legacy `body` stays
authoritative; no path under the A2.0 instrument freeze is touched, so the
after-takes on M1 compare directly against the R baselines with
population_commit = T.

Producer (frontend/roslyn/OwnSharp.Extractor/Program.cs):
- calls[]: one per call a disposable candidate local or an owned parameter
  flows into (argument or reduced-extension receiver); site {line, column} of
  the invocation plus statement_line as the join identity with the legacy ops;
  form statement|initializer|expression; callee/sig or null when unresolved;
  first_party; args bound by declared ordinal (named args resolved, extension
  receiver = 0, params/ref/out = opaque, unresolved callee = source position).
- arg kinds (raw facts only, §10.2): var{name}, param{source_param[,negated]},
  bool_const{value}, null_literal, object_creation, call_result{callee,sig},
  opaque. No const-pos/id/neg and no fresh_owned are ever written.
- guards[]: one per eligible `if` on a stable by-value parameter — truth on a
  bool, is_null/not_null on a reference or Nullable<T>; G-V4 stability is
  whole-body write exposure (assignment, ++/--, ref/out, ref alias, address).
  Ineligible guards get no entry: absence is the fail-closed signal.
- Self-check: a sidecar that violates its own vocabulary makes the run refuse
  to write facts at all (exit 2), so a producer defect never reaches a door.

Contract (spec/ownir.schema.json, spec/OwnIR.md §5.2, §4.2):
- closed $defs guardedFacts/guardedCall/guardedArg/guardedGuard/sourceSite;
  the sidecar is optional and additive, OWNIR_VERSION stays 0.
- sourceSite is deliberately UNBOUND (type only): the doors do not read the
  sidecar in A2.1, and §4.2 forbids a schema narrower than the door on a
  coordinate the door does not check. tests/test_ownir_defensive_limits.py
  classifies it as the one UNBOUND entry; the instrument step that registers
  the sidecar at the doors moves it to BOUND.

Controls:
- corpus/p037-shapes: all 11 shapes re-recorded with the sidecar (body ops,
  params and both engines' verdicts byte-identical to before), status
  pending_a2 -> anchored, and a2_expect contract checks per shape that fail by
  name (scripts/p037_fact_shapes.py check).
- tests/test_p037_sidecar.py pins the schema enums against the producer's
  vocabularies and the raw-fact boundary.
- scripts/p037_sidecar_inertness.py (CI dogfood step): for every census shape
  and the samples tree, the emitted, stripped and contradictory sidecars yield
  identical lowered/summaries/verdicts layers on both engines, python == rust,
  and the control is non-vacuous (39 sidecars over 12 documents locally).

Known A2.1 boundary, owed by A2.2 (honest emission for every relevant call):
object-creation arguments (`new X(handle, leaveOpen: true)`) are not yet a
call fact; A2.1 covers invocation expressions.

Refs #304

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfeUtLRm6KFRWcTGQZxQQb

Author: claude

.github/workflows/ci.yml

@@ -3039,6 +3039,12 @@ jobs:
           # re-hashed and removed again. No baseline is taken here.
           python scripts/p037_evidence.py artifacts
           python scripts/p037_evidence.py population --source repo --materialize --cleanup
+          # A2.1: the guarded-fact sidecar is validated and INERT. Every census
+          # shape and the samples compilation go through both engines three
+          # times (as emitted, stripped, deliberately contradictory) and the
+          # lowered/summaries/verdicts layers must not move. Needs the
+          # own-shadow-engine the artifacts step just built.
+          python scripts/p037_sidecar_inertness.py
       # The Windows launcher is a separate implementation, not a wrapper around
       # the shell one, so the Windows leg has to go through it to mean anything.
       - name: Own.NET's own tree, through own-check.ps1 on the Rust core

corpus/p037-shapes/call-expression-statement/expected.json

@@ -1,9 +1,47 @@
 {
   "schema": "p037-fact-shape/1",
   "shape": "call-expression-statement",
-  "status": "pending_a2",
+  "status": "anchored",
   "why": "The heart of the a2 gap. The C# lowering emits a `call` op in exactly ONE place and only for `var x = Foo(...)` — a call whose RESULT binds to a local. `Inner(r, true);` as a STATEMENT produces no `call` node, which the recorded facts show: `Caller`'s body is `acquire:r`, `release:r` — the fabricated release — and no call at all. So F3 cannot be carried through the existing summary layer today: there is no node for a guarded summary to specialise.",
   "a2_contract": "a2 emits a real `call` op for relevant first-party statement-level calls. This is also where a2's zero-semantic-cut risk lives, and it must be measured rather than hoped: a real `call` op is ALREADY semantically active and MOS reads it, so emitting one here can move an existing summary long before the guarded kernel is anywhere near. A verdict that happens to stay the same is not a pass — an unintended MOS collapsed-view change means a2 began the semantic cut early, and the answer is to isolate it or restage, never to note that the tests are green.",
+  "a2_landed": "A2.1 landed the guarded-fact SIDECAR (`guarded_facts`, spec/OwnIR.md §5.2), not a body op: the legacy `body` stays authoritative through A2 and C+ canonicalizes the two views (docs/notes/p037-formal-kernel.md §10.3/§10.5). The `a2_expect` entries are this shape's contract, checked by name; `facts` pins the whole record byte for byte.",
+  "a2_expect": [
+    {
+      "function": "ShapeStatementCall.Caller",
+      "call": {
+        "site": {
+          "line": 26
+        },
+        "form": "statement",
+        "callee": "ShapeStatementCall.Inner",
+        "sig": "System.IO.Stream,System.Boolean",
+        "first_party": true,
+        "args": [
+          {
+            "param": 0,
+            "kind": "var",
+            "name": "r"
+          },
+          {
+            "param": 1,
+            "kind": "bool_const",
+            "value": true
+          }
+        ]
+      }
+    },
+    {
+      "function": "ShapeStatementCall.Inner",
+      "guard": {
+        "site": {
+          "line": 17
+        },
+        "param": 1,
+        "predicate": "truth",
+        "negated": true
+      }
+    }
+  ],
   "measured_at": "464308b",
   "facts": {
     "ShapeStatementCall.Inner": {
@@ -16,18 +54,66 @@
       "body": [
         "if:None@17",
         "then:release:s@19"
-      ]
+      ],
+      "guarded_facts": {
+        "version": 1,
+        "calls": [],
+        "guards": [
+          {
+            "site": {
+              "line": 17,
+              "column": 9
+            },
+            "param": 1,
+            "predicate": "truth",
+            "negated": true
+          }
+        ]
+      }
     },
     "ShapeStatementCall.Caller": {
       "params": null,
       "body": [
         "acquire:r@25",
         "release:r@26"
-      ]
+      ],
+      "guarded_facts": {
+        "version": 1,
+        "calls": [
+          {
+            "site": {
+              "line": 26,
+              "column": 9
+            },
+            "statement_line": 26,
+            "form": "statement",
+            "callee": "ShapeStatementCall.Inner",
+            "sig": "System.IO.Stream,System.Boolean",
+            "first_party": true,
+            "args": [
+              {
+                "param": 0,
+                "kind": "var",
+                "name": "r"
+              },
+              {
+                "param": 1,
+                "kind": "bool_const",
+                "value": true
+              }
+            ]
+          }
+        ],
+        "guards": []
+      }
     }
   },
   "verdict": {
     "rust": [],
     "python": []
-  }
+  },
+  "status_history": [
+    "pending_a2 (recorded at 464308b)",
+    "anchored (A2.1 sidecar)"
+  ]
 }

corpus/p037-shapes/extension-receiver/expected.json

@@ -1,9 +1,37 @@
 {
   "schema": "p037-fact-shape/1",
   "shape": "extension-receiver",
-  "status": "pending_a2",
+  "status": "anchored",
   "why": "A reduced extension method. Roslyn's reduced symbol drops `this` from Parameters while the summary lives on the UNREDUCED declaration, where the receiver is parameter 0.\n\nTwo things measured here, and the second was a surprise. (1) `CallReleasesReceiver` — the `ConsumesParam` consumer that handles this shape — is reached ONLY from two sites gated on `ThisFieldName(...)`: it is part of the FIELD disposal detector and never runs on a local. (2) Consequently `var s = ...; s.WaitForDispose(5);` is charged OWN001 even when the extension disposes its receiver UNCONDITIONALLY — verified with an unguarded probe, so it is not the guard doing it. That is a pre-existing false positive of exactly the family P-037 addresses (a first-party callee that releases, unrecognised), arriving through the RECEIVER rather than the argument. It is not A1's to fix and is recorded here so it is not mistaken for something A1 caused.",
   "a2_contract": "a2 synthesises the receiver binding against the UNREDUCED declaration: receiver -> declared parameter 0, `timeout` -> declared parameter 1. Without it `CallReleasesReceiver` can never be honestly retired — the guarded summaries would be complete except for one old tunnel under the fence, on the field path where nobody is looking.",
+  "a2_landed": "A2.1 landed the guarded-fact SIDECAR (`guarded_facts`, spec/OwnIR.md §5.2), not a body op: the legacy `body` stays authoritative through A2 and C+ canonicalizes the two views (docs/notes/p037-formal-kernel.md §10.3/§10.5). The `a2_expect` entries are this shape's contract, checked by name; `facts` pins the whole record byte for byte.",
+  "a2_expect": [
+    {
+      "function": "ShapeExtensionReceiver.Caller",
+      "call": {
+        "site": {
+          "line": 23
+        },
+        "callee": "ShapeExtensionReceiver.WaitForDispose",
+        "sig": "System.IO.Stream,System.Int32",
+        "args": [
+          {
+            "param": 0,
+            "kind": "var",
+            "name": "s"
+          },
+          {
+            "param": 1,
+            "kind": "opaque"
+          }
+        ]
+      }
+    },
+    {
+      "function": "ShapeExtensionReceiver.WaitForDispose",
+      "guarded_facts": "absent"
+    }
+  ],
   "measured_at": "464308b",
   "facts": {
     "ShapeExtensionReceiver.WaitForDispose": {
@@ -16,14 +44,43 @@
       "body": [
         "if:None@14",
         "then:release:self@16"
-      ]
+      ],
+      "guarded_facts": null
     },
     "ShapeExtensionReceiver.Caller": {
       "params": null,
       "body": [
         "acquire:s@22",
         "use:s@23"
-      ]
+      ],
+      "guarded_facts": {
+        "version": 1,
+        "calls": [
+          {
+            "site": {
+              "line": 23,
+              "column": 9
+            },
+            "statement_line": 23,
+            "form": "statement",
+            "callee": "ShapeExtensionReceiver.WaitForDispose",
+            "sig": "System.IO.Stream,System.Int32",
+            "first_party": true,
+            "args": [
+              {
+                "param": 0,
+                "kind": "var",
+                "name": "s"
+              },
+              {
+                "param": 1,
+                "kind": "opaque"
+              }
+            ]
+          }
+        ],
+        "guards": []
+      }
     }
   },
   "verdict": {
@@ -33,5 +90,9 @@
     "python": [
       "OWN001:warning@22"
     ]
-  }
+  },
+  "status_history": [
+    "pending_a2 (recorded at 464308b)",
+    "anchored (A2.1 sidecar)"
+  ]
 }

corpus/p037-shapes/guard-bool-const-false/expected.json

@@ -1,9 +1,38 @@
 {
   "schema": "p037-fact-shape/1",
   "shape": "guard-bool-const-false",
-  "status": "pending_a2",
+  "status": "anchored",
   "why": "The same call with `false`. Present so the two constants are distinguishable in the facts: a single `is a constant` bit would collapse the exact distinction cell selection turns on, and would do it invisibly.",
   "a2_contract": "{\"param\":1,\"kind\":\"bool_const\",\"value\":false}; Rust derives `const-neg`.",
+  "a2_landed": "A2.1 landed the guarded-fact SIDECAR (`guarded_facts`, spec/OwnIR.md §5.2), not a body op: the legacy `body` stays authoritative through A2 and C+ canonicalizes the two views (docs/notes/p037-formal-kernel.md §10.3/§10.5). The `a2_expect` entries are this shape's contract, checked by name; `facts` pins the whole record byte for byte.",
+  "a2_expect": [
+    {
+      "function": "ShapeConstFalse.Caller",
+      "call": {
+        "callee": "ShapeConstFalse.Inner",
+        "args": [
+          {
+            "param": 0,
+            "kind": "var",
+            "name": "r"
+          },
+          {
+            "param": 1,
+            "kind": "bool_const",
+            "value": false
+          }
+        ]
+      }
+    },
+    {
+      "function": "ShapeConstFalse.Inner",
+      "guard": {
+        "param": 1,
+        "predicate": "truth",
+        "negated": true
+      }
+    }
+  ],
   "measured_at": "464308b",
   "facts": {
     "ShapeConstFalse.Inner": {
@@ -16,18 +45,66 @@
       "body": [
         "if:None@10",
         "then:release:s@12"
-      ]
+      ],
+      "guarded_facts": {
+        "version": 1,
+        "calls": [],
+        "guards": [
+          {
+            "site": {
+              "line": 10,
+              "column": 9
+            },
+            "param": 1,
+            "predicate": "truth",
+            "negated": true
+          }
+        ]
+      }
     },
     "ShapeConstFalse.Caller": {
       "params": null,
       "body": [
         "acquire:r@18",
         "release:r@19"
-      ]
+      ],
+      "guarded_facts": {
+        "version": 1,
+        "calls": [
+          {
+            "site": {
+              "line": 19,
+              "column": 9
+            },
+            "statement_line": 19,
+            "form": "statement",
+            "callee": "ShapeConstFalse.Inner",
+            "sig": "System.IO.Stream,System.Boolean",
+            "first_party": true,
+            "args": [
+              {
+                "param": 0,
+                "kind": "var",
+                "name": "r"
+              },
+              {
+                "param": 1,
+                "kind": "bool_const",
+                "value": false
+              }
+            ]
+          }
+        ],
+        "guards": []
+      }
     }
   },
   "verdict": {
     "rust": [],
     "python": []
-  }
+  },
+  "status_history": [
+    "pending_a2 (recorded at 464308b)",
+    "anchored (A2.1 sidecar)"
+  ]
 }