P-037 controls: owner ruling (no pre-cutover ConsumesParam fix), explicit current/post-A1 expectations, two-layer checker

Owner ruling recorded verbatim (docs/notes/p037-formal-kernel.md §8.2): the
three measured false-OWN003 controls are pre-A1 regression anchors, not
authorization for a pre-cutover fix; Roslyn ConsumesParam semantics do not
change before P-022 Stage 3 — the freeze is on verdict-changing inference,
the shared-extractor location is no exception, and #305 (bounded P1
false-negative soundness holes under the pre-cutover floor doctrine) is not
controlling precedent for a false-positive precision failure that is A1's
first target.

Consequences: each control now carries expected.json with a classification
(KNOWN_FALSE_POSITIVE x3, VERDICT_COMPATIBLE_VALUE_DIFFERENCE for the class-3
shape), the `current` record measured at 70189a3 and the `post_a1`
acceptance, replacing the empty expected-diagnostics.txt that would have
read as clean today. scripts/p037_controls.py (held to mypy --strict)
verifies them on two layers — the fabricated `release` op at the call site
in the emitted facts, and the finding codes at warning severity — so a
summary engine can never compensate a bad extractor fact and hand A1 a
green end-to-end result over a broken seam. Today: current record 4/4
match; --post-a1 fails 4/4 as expected until A1 lands after Stage 3. All
four controls carry the fabricated release at the call site today, the
class-3 shape included (where it also suppresses the OWN051 advisory).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfeUtLRm6KFRWcTGQZxQQb

Author: claude

corpus/p036-bakeoff/README.md

@@ -49,23 +49,34 @@ from every preregistered decision predicate and read only in
 ## G-V4 / trusted-input negative controls and the class-3 shape (class 4)
 
 Not bug fixtures and not bakeoff cases: each `control.cs` carries an honest
-defensive dispose that a *fabricated* `must` would charge a false OWN003,
-so the required verdict at `--severity warning` is **no findings** (the empty
-`expected-diagnostics.txt` is the post-A1 target). They are the executable
-form of P-037 §8 rows 18–19 and G-T2b class 3, and A1's acceptance items 5
-and 8 (`docs/notes/p037-formal-kernel.md` §8.1). Measured on Owen today
-(`70189a3`, `scripts/own-check.sh --severity warning`):
+defensive dispose that a *fabricated* `must` would charge a false OWN003.
+Each directory holds `expected.json` with **both** the `current` record
+(measured on Owen at `70189a3`) and the `post_a1` acceptance, plus a
+`classification` — three are `KNOWN_FALSE_POSITIVE`, the class-3 shape is
+`VERDICT_COMPATIBLE_VALUE_DIFFERENCE` — so the evidence lies about neither
+today nor the target. `scripts/p037_controls.py` verifies them on two layers
+(the fabricated `release` op at the call site in the emitted facts; the
+finding codes at `--severity warning`): the default mode must pass today,
+`--post-a1` is the acceptance A1 discharges after P-022 Stage 3 and fails
+until then. They are the executable form of P-037 §8 rows 18–19 and G-T2b
+class 3, and A1's acceptance items 5 and 8
+(`docs/notes/p037-formal-kernel.md` §8.1). Owner ruling (2026-09-18): the
+three false positives are pre-A1 regression anchors, **not** authorization
+for a pre-cutover `ConsumesParam` fix — the P-022 freeze is on
+verdict-changing inference, and the shared-extractor location is no
+exception. Measured today:
 
 | control | P-037 | today | why |
 |---|---|---|---|
 | `gv4-control-mutated-guard` | §8 row 18a | **OWN003 (false)** on `r.Dispose()` | the extractor's flow-insensitive `ConsumesParam` lowers `Inner(p, g)` to a release because `Inner` disposes on *some* path — the may-as-must hole, A1's first bug; the mutated guard never even gets a say |
 | `gv4-control-ref-alias-guard` | §8 row 18b | **OWN003 (false)** | same mechanism |
 | `gv4-control-aliased-self-null` | §8 row 19 | **OWN003 (false)** on `s.Dispose()` | `q.Dispose()` somewhere in `Close` ⇒ the call is a release of the caller's argument, which the alias write makes untrue |
-| `legacy-honesty-else-unresolved-forward` | G-T2b class 3 | 0 findings | plain + OWN051 for the unknown guard, as required; the value-level pin (`unknown`, never repaired to `may`) is the kernel test `k11_finding_release_priority_drops_an_unresolved_forward` |
+| `legacy-honesty-else-unresolved-forward` | G-T2b class 3 | 0 findings at warning severity — but the facts layer shows the same fabricated release at the call site, which today also suppresses the OWN051 advisory | verdict-compatible today and after A1; after A1 the call is plain + OWN051 with no release op; the value-level pin (`unknown`, never repaired to `may`) is the kernel test `k11_finding_release_priority_drops_an_unresolved_forward` |
 
-Three of four are therefore **red today**: they pin a production false-positive
-class that A1's first target removes, and they must turn green without any
-of them turning into a fabricated consume elsewhere. Owner ruling: nothing in
-the extractor, the engines or the launcher surfaces changes before P-022
-Stage 3; these anchors wait with A1.
+Three of four are therefore **red today** on the end-to-end layer and all
+four on the facts layer: they pin a production false-positive class that
+A1's first target removes, and they must turn green on both layers without
+any of them turning into a fabricated consume elsewhere. Nothing in the
+extractor, the engines or the launcher surfaces changes before P-022 Stage
+3; these anchors wait with A1.
 

corpus/p036-bakeoff/gv4-control-aliased-self-null/expected-diagnostics.txt

@@ -0,0 +1,21 @@
+{
+  "schema": "p037-control-expectation/1",
+  "control": "gv4-control-aliased-self-null",
+  "p037": "§8 row 19 — G-V4, writably aliased self-null resource parameter",
+  "classification": "KNOWN_FALSE_POSITIVE",
+  "measured_at": "70189a3",
+  "owner_ruling": "2026-09-18: accepted as pre-A1 regression anchors, not as authorization for a pre-cutover fix; no ConsumesParam change before P-022 Stage 3",
+  "call_site_line": 29,
+  "defensive_dispose_line": 30,
+  "current": {
+    "findings": [
+      "OWN003"
+    ],
+    "fabricated_release_at_call_site": true
+  },
+  "post_a1": {
+    "findings": [],
+    "fabricated_release_at_call_site": false
+  },
+  "note": "Close disposes r through the alias, not the caller's s; today Close(s, other) is lowered to a release of s (may-as-must), so s.Dispose() is a false OWN003. After A1: no split for the aliased q, no release op at the call, the dispose is clean."
+}

corpus/p036-bakeoff/gv4-control-aliased-self-null/expected.json

@@ -0,0 +1,21 @@
+{
+  "schema": "p037-control-expectation/1",
+  "control": "gv4-control-mutated-guard",
+  "p037": "§8 row 18a — G-V4, mutated guard (direct write)",
+  "classification": "KNOWN_FALSE_POSITIVE",
+  "measured_at": "70189a3",
+  "owner_ruling": "2026-09-18: accepted as pre-A1 regression anchors, not as authorization for a pre-cutover fix; no ConsumesParam change before P-022 Stage 3",
+  "call_site_line": 39,
+  "defensive_dispose_line": 40,
+  "current": {
+    "findings": [
+      "OWN003"
+    ],
+    "fabricated_release_at_call_site": true
+  },
+  "post_a1": {
+    "findings": [],
+    "fabricated_release_at_call_site": false
+  },
+  "note": "Today the extractor lowers Outer(r, true) to a release of r (may-as-must ConsumesParam), so the honest r.Dispose() is a false OWN003. After A1 the call must carry no release op and lower to plain + OWN051; the dispose is clean."
+}

corpus/p036-bakeoff/gv4-control-mutated-guard/expected-diagnostics.txt

@@ -0,0 +1,21 @@
+{
+  "schema": "p037-control-expectation/1",
+  "control": "gv4-control-ref-alias-guard",
+  "p037": "§8 row 18b — G-V4, writable ref-alias of the guard",
+  "classification": "KNOWN_FALSE_POSITIVE",
+  "measured_at": "70189a3",
+  "owner_ruling": "2026-09-18: accepted as pre-A1 regression anchors, not as authorization for a pre-cutover fix; no ConsumesParam change before P-022 Stage 3",
+  "call_site_line": 36,
+  "defensive_dispose_line": 37,
+  "current": {
+    "findings": [
+      "OWN003"
+    ],
+    "fabricated_release_at_call_site": true
+  },
+  "post_a1": {
+    "findings": [],
+    "fabricated_release_at_call_site": false
+  },
+  "note": "Same mechanism as row 18a; the alias write must disqualify the guard (fail-closed) and the call must not fabricate a consume."
+}

corpus/p036-bakeoff/gv4-control-mutated-guard/expected.json

@@ -0,0 +1,19 @@
+{
+  "schema": "p037-control-expectation/1",
+  "control": "legacy-honesty-else-unresolved-forward",
+  "p037": "G-T2b class 3 — guarded local release, unresolved forward on the other branch",
+  "classification": "VERDICT_COMPATIBLE_VALUE_DIFFERENCE",
+  "measured_at": "70189a3",
+  "owner_ruling": "2026-09-18: accepted as pre-A1 regression anchors, not as authorization for a pre-cutover fix; no ConsumesParam change before P-022 Stage 3",
+  "call_site_line": 41,
+  "defensive_dispose_line": null,
+  "current": {
+    "findings": [],
+    "fabricated_release_at_call_site": true
+  },
+  "post_a1": {
+    "findings": [],
+    "fabricated_release_at_call_site": false
+  },
+  "note": "0 findings at warning severity today AND after A1 (class 3 is verdict-equivalent). The facts layer differs: today the extractor lowers M(r, flag, sink) to a release (may-as-must) and even the OWN051 advisory is suppressed; after A1 the guarded value is unknown, the call is plain + OWN051 at note level, and no release op may appear at the call site. The value-level pin (unknown, never repaired to may) is the kernel test k11_finding_release_priority_drops_an_unresolved_forward."
+}

corpus/p036-bakeoff/gv4-control-ref-alias-guard/expected-diagnostics.txt

@@ -284,14 +284,20 @@ A1 ACCEPTANCE
 4. Application on FINALIZED state only: a raw solver cell is never consumable
    (kernel K7 witness ported as a production test).
 5. G-V4 failures — mutable / ref / out / aliased guard: the edge degrades to
-   opaque, never fabricates must (P-037 §8 rows 18-19 as fixtures).
+   opaque, never fabricates must (P-037 §8 rows 18-19 as fixtures) — on BOTH
+   layers: no fabricated `release` op at the call site in the emitted facts
+   (extractor-fact acceptance) AND no false OWN003 end to end
+   (`scripts/p037_controls.py --post-a1`, the three KNOWN_FALSE_POSITIVE
+   controls turning red -> green).
 6. The formal kernel's twins run over the SAME production functions, not a
    copy: the kernel is moved, its properties move with it.
 7. Kani: value-level harnesses mandatory (PR gate); solver-heavy harnesses
    opt-in / nightly.
 8. The F1 pin: `if (g) p.Dispose(); else Extern(p);` with Extern unresolved
    yields the collapsed value UNKNOWN (class 3), lowered to plain + OWN051 —
-   an implementation that "repairs" it to legacy's optimistic MAY fails.
+   an implementation that "repairs" it to legacy's optimistic MAY fails;
+   on the facts layer the call site carries no release op (today it does:
+   the class-3 control's `current` record), and the OWN051 advisory appears.
 ```
 
 **The gate, as a REPOSITORY FACT that needs a ruling before any production
@@ -431,7 +437,62 @@ target, now with
 three executable witnesses that fail until it is fixed and must pass
 without a fabricated consume appearing anywhere else. It lives in the
 extractor (`frontend/roslyn/OwnSharp.Extractor/Program.cs`), which both
-engines share — a fix there would not split the compare gate, but it is
-launcher-visible behaviour and therefore waits, per the ruling, unless the
-owner rules otherwise for the extractor-side floor specifically (the #305
-precedent).
+engines share. The owner ruled on the carve-out question the same day:
+
+```text
+OWNER RULING — ConsumesParam false OWN003 controls (2026-09-18)
+
+The three newly measured false-OWN003 cases are accepted as
+pre-A1 regression anchors, not as authorization for a pre-cutover fix.
+
+Do NOT change Roslyn ConsumesParam semantics before P-022 Stage 3.
+
+Reason:
+- the defect is launcher-visible;
+- fixing it changes interprocedural inference verdicts;
+- the P-022 freeze is on verdict-changing inference, not merely
+  on Python/Rust divergence;
+- the shared-extractor location therefore does not create an exception.
+
+#305 is not controlling precedent:
+- it repaired bounded P1 false-negative soundness holes in teardown
+  crediting under the explicit pre-cutover floor doctrine;
+- this defect is a false-positive / precision failure in cross-call
+  consume inference and is the first target of post-cutover A1.
+
+Keep the three failing controls exactly as measured.
+They become mandatory red→green acceptance witnesses for A1 after Stage 3.
+
+No production fix before cutover.
+```
+
+In the owner's words on why a "small bounded fix" is a trap here: the
+moment `ConsumesParam` is restricted to unconditional disposes, the next
+questions are `if (x) Dispose(); else Dispose();`, early return,
+`try/finally`, the self-null guard, forwarding helpers, exception paths,
+guards on parameters vs locals vs fields, callee forwarding into another
+consumer — three patches later the guarded-summary semantics is being
+written into the Roslyn extractor under the name of a bugfix, which is the
+road the bakeoff already mapped. The freeze stopped exactly the kind of work
+it exists to stop; drilling neat holes in it right after it first worked
+would be comic.
+
+**Consequences applied.** The controls no longer carry an empty
+`expected-diagnostics.txt` that would read as "clean today": each has an
+`expected.json` with `classification` (`KNOWN_FALSE_POSITIVE` for the three
+G-V4 controls, `VERDICT_COMPATIBLE_VALUE_DIFFERENCE` for the class-3 shape),
+the `current` record measured at `70189a3`, and the `post_a1` acceptance —
+so the evidence lies about neither. `scripts/p037_controls.py` checks them
+on **two layers**, because the facts showed the defect is decided before the
+engine boundary: (1) the extractor-fact layer — does the call site carry a
+fabricated `release` op in the emitted facts; (2) the end-to-end layer — the
+finding codes at `--severity warning`. Default mode checks `current` and
+must pass today (a mismatch means Owen's behaviour moved and the record must
+be re-measured, never silently); `--post-a1` checks the acceptance and is
+expected to fail until A1 lands after Stage 3. Two layers so that a Rust
+summary engine can never compensate a bad extractor fact with another
+heuristic and hand A1 a green end-to-end result over a still-broken seam.
+Measured today, all four controls carry the fabricated release at the call
+site — including the class-3 shape, where it also suppresses the OWN051
+advisory the unknown guard should earn (0 findings either way at warning
+severity: verdict-compatible, value-different, exactly class 3).