research(P-036): comparative bakeoff — preregistration, corpus, harness, partial raw outputs

Phase 0-2 of the P-036 capability bakeoff (Infer# / RLC# / CodeQL / CA2000
vs Owen): preregistered target questions, defect families, comparators and
decision predicates before any comparator ran; a 45-case manifest with
provenance classes kept apart; 12 synthetic conformance cases derived from
P-037 §8 and P-036 Phase 2; a reproducible harness that runs every tool on
identical per-file projects and records explicit statuses; two bakeoff-
written CodeQL queries as an expressiveness probe (never scored as stock);
comparator qualification, semantic-machinery matrix and diagnostics
comparison in the research note. Raw outputs are partial — the full run is
still executing; results.json / summary.md follow in the next commit.

No Owen behaviour, verdict, or performance machinery is touched.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfeUtLRm6KFRWcTGQZxQQb

Author: claude

corpus/p036-bakeoff/README.md

@@ -0,0 +1,30 @@
+# corpus/p036-bakeoff — synthetic conformance cases for the P-036 bakeoff
+
+Provenance class **4 (synthetic conformance)**: every case here was derived
+from proposal text — the P-037 §8 worked cases and the P-036 §Phase 2 fixture
+list (families 4–7) — and written **before** any comparator ran on it (see
+`docs/notes/p036-bakeoff.md` §0). They are deliberately minimal, single-file
+(`before.cs` buggy / `after.cs` fixed), and use only in-box BCL types so every
+comparator can compile them without a reference pack.
+
+They are **not** scanned by `scripts/benchmark.py`'s default corpus set and
+are **not** part of `tests/test_corpus.py` (no `case.own` reductions): they are
+bakeoff inputs, not regression anchors. Several are expected to be MISSED by
+Owen at `70189a3` — that is the point of the comparison, not a defect to fix in
+this research phase (repository-work rule: no P-036 implementation before the
+decision).
+
+| case | family | source of the shape | expected on `before.cs` |
+|---|---|---|---|
+| `guarded-consume-flag-branch` | F3 | P-037 §8 row 1 (`Teardown(true)` / `Teardown(false)`) | leak of the stream passed with `keep: true` |
+| `guarded-consume-early-return` | F3 | P-037 §8 row 2 (early-return spelling) | same leak |
+| `guarded-consume-wrapper-forward` | F3 | P-037 §8 row 7 (`id` edge through a wrapper) | same leak one hop up |
+| `guarded-consume-negation-wrapper` | F3 | P-037 §8 row 8 (`neg` edge) | same leak through `!stop` |
+| `nullguard-helper-use-after` | F3 | P-037 §8 row 4 (self-null split) | use after the helper disposed it |
+| `mixed-release-forward-use-after` | F3 | P-037 §8 row 12 (unanimous `must`) | use after a helper that consumes on both arms |
+| `enrollment-dispose-without-idisposable` | F4 | audit attack D / P-036 LifecycleEnrollment | subscription never released: `Dispose` is a name nobody calls |
+| `enrollment-owner-drops-subscriber` | F4 | P-036 LifecycleEnrollment (RAII form) | owner drops the IDisposable subscriber |
+| `subscription-release-skipped-by-throw` | F5 | P-036 §Phase 2 fixture 7 | `-=` skipped on the exceptional path of `Dispose` |
+| `release-through-delegate-target` | F6 | P-036 §Phase 2 fixture 6 | cleanup reached only through a delegate/interface |
+| `obligation-barrier-through-helper` | F7 | #272 / #274 | forbidden notification inside a helper while the obligation is open |
+| `loop-no-progress-through-helper` | F8 | #275 | back-edge without progress when the helper returns false |

corpus/p036-bakeoff/enrollment-dispose-without-idisposable/after.cs

@@ -0,0 +1,31 @@
+// FIXED (synthetic conformance). The type implements IDisposable and the owner
+// enrolls it in a `using`, so the teardown provably runs.
+using System;
+using System.ComponentModel;
+
+public sealed class Cache : IDisposable
+{
+    private readonly INotifyPropertyChanged _settings;   // injected, unknown lifetime
+
+    public Cache(INotifyPropertyChanged settings)
+    {
+        _settings = settings;
+        _settings.PropertyChanged += OnSettingsChanged;
+    }
+
+    public void Dispose()
+    {
+        _settings.PropertyChanged -= OnSettingsChanged;
+    }
+
+    private void OnSettingsChanged(object sender, PropertyChangedEventArgs e) { /* ... */ }
+}
+
+public static class CacheUser
+{
+    public static int Use(INotifyPropertyChanged settings)
+    {
+        using var cache = new Cache(settings);            // enrolled: Dispose runs at scope exit
+        return cache.GetHashCode();
+    }
+}

corpus/p036-bakeoff/enrollment-dispose-without-idisposable/before.cs

@@ -0,0 +1,34 @@
+// BUGGY (synthetic conformance, P-036 LifecycleEffect vs LifecycleEnrollment;
+// the audit's attack D). `Cache` has a perfect `Dispose()` that unsubscribes —
+// but the type does NOT implement IDisposable, so no `using`, no DI scope and
+// no owner will ever call it; the platform contract only invokes `Dispose`
+// through the interface. `Use` constructs and drops the cache: the injected
+// publisher keeps every instance alive. Effect proven, enrollment absent.
+using System.ComponentModel;
+
+public sealed class Cache
+{
+    private readonly INotifyPropertyChanged _settings;   // injected, unknown lifetime
+
+    public Cache(INotifyPropertyChanged settings)
+    {
+        _settings = settings;
+        _settings.PropertyChanged += OnSettingsChanged;
+    }
+
+    public void Dispose()                                 // a name, not a lifecycle
+    {
+        _settings.PropertyChanged -= OnSettingsChanged;
+    }
+
+    private void OnSettingsChanged(object sender, PropertyChangedEventArgs e) { /* ... */ }
+}
+
+public static class CacheUser
+{
+    public static int Use(INotifyPropertyChanged settings)
+    {
+        var cache = new Cache(settings);                  // nobody calls cache.Dispose()
+        return cache.GetHashCode();
+    }
+}

corpus/p036-bakeoff/enrollment-dispose-without-idisposable/expected-diagnostics.txt

@@ -0,0 +1 @@
+OWN001

corpus/p036-bakeoff/enrollment-owner-drops-subscriber/after.cs

@@ -0,0 +1,30 @@
+// FIXED (synthetic conformance). The owner enrolls the subscriber in a `using`.
+using System;
+using System.ComponentModel;
+
+public sealed class Subscriber : IDisposable
+{
+    private readonly INotifyPropertyChanged _source;
+
+    public Subscriber(INotifyPropertyChanged source)
+    {
+        _source = source;
+        _source.PropertyChanged += OnChanged;
+    }
+
+    public void Dispose()
+    {
+        _source.PropertyChanged -= OnChanged;
+    }
+
+    private void OnChanged(object sender, PropertyChangedEventArgs e) { /* ... */ }
+}
+
+public static class Owner
+{
+    public static int Run(INotifyPropertyChanged source)
+    {
+        using var sub = new Subscriber(source);
+        return sub.GetHashCode();
+    }
+}

corpus/p036-bakeoff/enrollment-owner-drops-subscriber/before.cs

@@ -0,0 +1,34 @@
+// BUGGY (synthetic conformance, P-036 LifecycleEnrollment — the RAII form).
+// The subscriber is a correct IDisposable: it unsubscribes in Dispose. The
+// OWNER is the bug: it constructs the subscriber and drops it, so Dispose never
+// runs and the injected publisher keeps the subscriber alive. Existing
+// Dispose/RAII checkers cover this half (an undisposed IDisposable local).
+using System;
+using System.ComponentModel;
+
+public sealed class Subscriber : IDisposable
+{
+    private readonly INotifyPropertyChanged _source;
+
+    public Subscriber(INotifyPropertyChanged source)
+    {
+        _source = source;
+        _source.PropertyChanged += OnChanged;
+    }
+
+    public void Dispose()
+    {
+        _source.PropertyChanged -= OnChanged;
+    }
+
+    private void OnChanged(object sender, PropertyChangedEventArgs e) { /* ... */ }
+}
+
+public static class Owner
+{
+    public static int Run(INotifyPropertyChanged source)
+    {
+        var sub = new Subscriber(source);                 // never disposed -> leak
+        return sub.GetHashCode();
+    }
+}

corpus/p036-bakeoff/enrollment-owner-drops-subscriber/expected-diagnostics.txt

@@ -0,0 +1 @@
+OWN001

corpus/p036-bakeoff/guarded-consume-early-return/after.cs

@@ -0,0 +1,22 @@
+// FIXED (synthetic conformance, P-037 §8 row 2). `keep: false` reaches the
+// Dispose on the only path -> clean.
+using System;
+using System.IO;
+
+static class GuardedEarlyReturn
+{
+    static void Close(Stream s, bool keep)
+    {
+        if (keep)
+            return;
+        s.Dispose();
+    }
+
+    static long Fine(string path)
+    {
+        var s = File.OpenRead(path);
+        long len = s.Length;
+        Close(s, keep: false);
+        return len;
+    }
+}

corpus/p036-bakeoff/guarded-consume-early-return/before.cs

@@ -0,0 +1,22 @@
+// BUGGY (synthetic conformance, P-037 §8 row 2 — the same guard spelled as an
+// early return; the two spellings must converge in a guarded summary).
+using System;
+using System.IO;
+
+static class GuardedEarlyReturn
+{
+    static void Close(Stream s, bool keep)
+    {
+        if (keep)
+            return;
+        s.Dispose();
+    }
+
+    static long Leak(string path)
+    {
+        var s = File.OpenRead(path);
+        long len = s.Length;
+        Close(s, keep: true);              // returns before the Dispose -> leak
+        return len;
+    }
+}

corpus/p036-bakeoff/guarded-consume-early-return/expected-diagnostics.txt

@@ -0,0 +1 @@
+OWN001