P-037 PCS-0: KILL — driver 68 / 40, total 208 / 180, not run

The first complete, lint-clean draft exceeds the binding driver cap and the
total (C# producer shadow 83/100 and tests + probe 57/60 are within).
Per the pre-registered §E/§G this is a KILL of the gate; nothing was run
(no falsifier, no C1 byte-identity control, no A18-0 row) and the draft
was not reworked to fit after the count. The unrun draft is committed as
the artifact; §I records the breakdown: the overrun is the standalone
driver's own plumbing, not the producer shadow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KmiyfrkaG9sJruTcshM2oq

Author: claude

docs/evidence/p037-pcs0-probes/Transitive.cs

@@ -0,0 +1,36 @@
+// P-037 PCS-0 probe (docs/notes/p037-pcs0-producer-canonical-shadow.md §D), not population.
+// F0: the natural transitive chain Top -> Outer -> Inner. The legacy body folds Top's
+// forward into a `release` because ConsumesParam(Outer) is true; the canonical shadow must
+// keep it an honest `call` so the ordinary MOS reads Outer's own `may`.
+// F1: the borrow chain Pass -> Peek. The shadow forwards it just the same and the MOS, not
+// the producer, keeps `no`.
+using System.IO;
+
+static class PcsTransitive
+{
+    static void Inner(Stream s, bool keep)
+    {
+        if (!keep)
+            s.Dispose();
+    }
+
+    static void Outer(Stream s, bool keep)
+    {
+        Inner(s, keep);
+    }
+
+    static void Top(Stream s)
+    {
+        Outer(s, true);
+    }
+
+    static void Peek(Stream s)
+    {
+        s.ReadByte();
+    }
+
+    static void Pass(Stream s)
+    {
+        Peek(s);
+    }
+}

docs/notes/p037-pcs0-producer-canonical-shadow.md

@@ -224,3 +224,51 @@ This gate does not touch any of these:
 - the three P-037 classes and `own-guarded`.
 
 There is no population run in this gate.
+
+## I. RESULT: KILL — PCS-0 (BUDGET), not run
+
+```text
+STATE:  KILL — driver 68 / 40, total 208 / 180 (first complete, lint-clean draft)
+WITHIN: C# producer shadow 83 / 100 · tests + probe 57 / 60
+RUN:    NONE — no falsifier, no C1 byte-identity control, no A18-0 row
+```
+
+- **The count.** Measured with the §G rule (`git diff ca14336`; excludes
+  blank, `//` and `#` lines; counts braces, docstrings and usage text), the
+  first complete draft exceeds two binding caps:
+  - the driver: 61 lines as first written, 68 once wrapped to the repo's
+    100-column ruff limit;
+  - the total.
+
+  Per §E/§G that is a KILL. The draft was not reworked to fit after the
+  count, and nothing was run. The unrun, lint-clean draft is committed as
+  the artifact.
+- **Where the lines are.**
+
+| part | lines | cap |
+|------|------:|----:|
+| C#: `CanonicalForward` (the whole honest-forward representation) | 38 | |
+| C#: the A2.2 unwrap lifted into a shared `ValueUnwrap` (a move, counted as added) | 24 | |
+| C#: switch, `--fix-candidates` refusal, second lowering, shadow write, three `EmitFlowExpr` hook lines | 21 | |
+| **C# total** | **83** | 100 |
+| driver `scripts/p037_pcs0.py`: header and imports 18, `extract()` 13, `main()` 35, entry 2 | **68** | 40 |
+| falsifiers `tests/p037_pcs0_falsifiers.py` 32 + probe `Transitive.cs` 25 | **57** | 60 |
+| **total** | **208** | 180 |
+
+- **Reading.** The premise-specific cap held with room: the producer shadow
+  is 83/100 C# lines. It adds no schema change, and with the switch off the
+  ordinary lowering path is unchanged. It makes no `ConsumesParam` call,
+  computes no transfer value, builds no call graph, and shares the unwrap
+  instead of copying it.
+- **Why it still died.** The overrun is entirely measurement plumbing. The
+  driver was written as a **new standalone script**, so it pays its own
+  docstring, imports, argparse, clean-tree refusal, frozen-tree
+  materialization and evidence writing. That is about 45 of its 68 lines.
+  §G budgeted "driver changes", and extending the existing A18-0 driver,
+  which already has that plumbing, might have fit. That judgment comes after
+  the count, so it was not acted on: reworking code until it fits a cap
+  after seeing the count is what kill-first forbids.
+- **What the KILL does not say.** Nothing was measured, neither F0 nor the
+  8 rows. The producer-shadow premise is neither confirmed nor refuted. Per
+  §0 there is no PCS-1R2. Whether this is the point to freeze the P-037
+  implementation as a whole, as §E anticipates, is the owner's decision.

frontend/roslyn/OwnSharp.Extractor/Program.cs

@@ -152,6 +152,7 @@ events bind to real symbols instead of OWN050 (repeatable)
   --flow-locals      path-sensitive flow analysis of non-escaping local IDisposables
   --stats            print flow-locals coverage (requires --flow-locals)
   --dispatch-report FILE  P-037 A14 measurement: dispatch facts per relevant call (not OwnIR)
+  --p037-canonical-shadow FILE  P-037 PCS-0 measurement: also write a canonical-forward shadow OwnIR
   --body-throw-edges treat escaping body-level may-throw as a dispose-on-throw point (needs --flow-locals)
   -h, --help         show this help and exit
 """;
@@ -187,6 +188,8 @@ events bind to real symbols instead of OWN050 (repeatable)
     else if (args0[i] == "--stats") reportStats = true;
     // P-037 B1 A14 measurement (DispatchReport.cs): a separate JSON, never OwnIR.
     else if (args0[i] == "--dispatch-report" && i + 1 < args0.Length) DispatchReport.Path = args0[++i];
+    // P-037 PCS-0 measurement: a second, canonical-forward OwnIR document (see CanonicalForward).
+    else if (args0[i] == "--p037-canonical-shadow" && i + 1 < args0.Length) CanonicalShadowPath = args0[++i];
     else rawInputs.Add(args0[i]);
 }
 
@@ -196,6 +199,12 @@ events bind to real symbols instead of OWN050 (repeatable)
     Console.Error.WriteLine("       ownsharp-extract --help   for the full option list");
     return 2;
 }
+// PCS-0: the shadow is defined for the plain facts shape only.
+if (CanonicalShadowPath is not null && emitFixCandidates)
+{
+    Console.Error.WriteLine("extractor: --p037-canonical-shadow is not defined with --fix-candidates");
+    return 2;
+}
 
 // --stats reports flow-locals coverage; the counters only move inside the
 // --flow-locals pass. Without it they would all be zero and the summary would
@@ -2955,6 +2964,39 @@ bool Refers(ExpressionSyntax? e) =>
     return true;
 }
 
+// A2.2: a VALUE-PRESERVING wrapper is the same value as its operand, so it is looked
+// through before classifying — parentheses, the null-forgiving `!` (no runtime effect),
+// and a cast whose conversion is identity or a non-user-defined reference conversion
+// (the same object, only a different static type). Any other cast (boxing, unboxing,
+// numeric, user-defined) produces a different value and is left in place.
+static ExpressionSyntax? ValueUnwrap(ExpressionSyntax? e, SemanticModel model)
+{
+    while (true)
+    {
+        e = StripParens(e);
+        switch (e)
+        {
+            case PostfixUnaryExpressionSyntax bang
+                when bang.IsKind(SyntaxKind.SuppressNullableWarningExpression):
+                e = bang.Operand;
+                continue;
+            // The cast's OWN conversion (operand -> cast type). `GetConversion(cast)`
+            // would answer the contextual conversion of the cast node instead — for
+            // `Sink((object)h)` that is object -> object, identity, and a boxing cast
+            // would pass as value-preserving (caught by corpus/p037-shapes/arg-cast-and-bang).
+            case CastExpressionSyntax cast
+                when model.GetTypeInfo(cast.Type).Type is { } castTo
+                     && model.ClassifyConversion(cast.Expression, castTo, isExplicitInSource: true)
+                         is var conv
+                     && (conv.IsIdentity || (conv.IsReference && !conv.IsUserDefined)):
+                e = cast.Expression;
+                continue;
+            default:
+                return e;
+        }
+    }
+}
+
 static object? BuildGuardedFacts(BaseMethodDeclarationSyntax method, BlockSyntax mbody,
                                  HashSet<string> handles, HashSet<string> ownedParamNames,
                                  SemanticModel model, string where)
@@ -2977,38 +3019,8 @@ bool Stable(IParameterSymbol p)
         return known;
     }
 
-    // A2.2: a VALUE-PRESERVING wrapper is the same value as its operand, so it is looked
-    // through before classifying — parentheses, the null-forgiving `!` (no runtime effect),
-    // and a cast whose conversion is identity or a non-user-defined reference conversion
-    // (the same object, only a different static type). Any other cast (boxing, unboxing,
-    // numeric, user-defined) produces a different value and is left in place.
-    ExpressionSyntax? Unwrap(ExpressionSyntax? e)
-    {
-        while (true)
-        {
-            e = StripParens(e);
-            switch (e)
-            {
-                case PostfixUnaryExpressionSyntax bang
-                    when bang.IsKind(SyntaxKind.SuppressNullableWarningExpression):
-                    e = bang.Operand;
-                    continue;
-                // The cast's OWN conversion (operand -> cast type). `GetConversion(cast)`
-                // would answer the contextual conversion of the cast node instead — for
-                // `Sink((object)h)` that is object -> object, identity, and a boxing cast
-                // would pass as value-preserving (caught by corpus/p037-shapes/arg-cast-and-bang).
-                case CastExpressionSyntax cast
-                    when model.GetTypeInfo(cast.Type).Type is { } castTo
-                         && model.ClassifyConversion(cast.Expression, castTo, isExplicitInSource: true)
-                             is var conv
-                         && (conv.IsIdentity || (conv.IsReference && !conv.IsUserDefined)):
-                    e = cast.Expression;
-                    continue;
-                default:
-                    return e;
-            }
-        }
-    }
+    // A2.2 value-preserving unwrap, shared with the PCS-0 shadow (ValueUnwrap).
+    ExpressionSyntax? Unwrap(ExpressionSyntax? e) => ValueUnwrap(e, model);
 
     // One argument expression -> one raw fact, plus whether a HANDLE of this method flowed.
     (Dictionary<string, object?> fact, bool handle) ArgFact(ExpressionSyntax? raw)
@@ -4247,7 +4259,11 @@ static void EmitFlowExpr(ExpressionSyntax expr, HashSet<string> tracked, Semanti
     // modelled at the call site like pool Return). A later use of an argument is then a
     // use-after-handoff (OWN002). Do NOT return — other tracked arguments of the same call
     // (`Consume(s, t)`) still need their `use` below; a consumed arg is excluded from it.
+    // P-037 PCS-0: under the shadow switch only, honest forwards become one `call` op and get
+    // neither the handoff `release` nor a `use` below. With the switch off `forwarded` is empty.
+    var forwarded = CanonicalForwards ? CanonicalForward(expr, tracked, model, nodes) : new List<string>();
     var consumed = ConsumeReleaseArgs(expr, model);
+    consumed.RemoveAll(forwarded.Contains);
     foreach (var c in consumed)
         if (tracked.Contains(c))
             nodes.Add(new { op = "release", var = c, line = LineOf(expr) });
@@ -4277,6 +4293,7 @@ static void EmitFlowExpr(ExpressionSyntax expr, HashSet<string> tracked, Semanti
                  && tracked.Contains(owner) && !consumed.Contains(owner))
             used.Add(owner);
     }
+    used.ExceptWith(forwarded);
     foreach (var u in used)
         nodes.Add(new { op = "use", var = u, line = LineOf(expr) });
     // POOL005: a full-length view of a pooled buffer anywhere in this expression -> overspan/OWN025.
@@ -5007,6 +5024,49 @@ static List<string> ConsumeReleaseArgs(ExpressionSyntax e, SemanticModel model)
     return consumed;
 }
 
+// P-037 PCS-0 (measurement only; runs solely under --p037-canonical-shadow): the HONEST
+// representation of a forwarding call. Each argument that, after the A2.2 value-preserving
+// unwrap, is a tracked identifier bound to one of the callee's `functions[].params` becomes a
+// positional slot of ONE legacy `call` op (the D5.2 op the bridge already reads as a forward),
+// instead of the `release`/`use` the ordinary lowering folds it into. It decides nothing — no
+// ConsumesParam, no transfer value: the MOS reads the callee's summary. Returns the forwarded
+// identifiers, which then get no `release`/`use` op for this expression.
+static List<string> CanonicalForward(ExpressionSyntax e, HashSet<string> tracked,
+                                     SemanticModel model, List<object> nodes)
+{
+    var forwarded = new List<string>();
+    if (e is not InvocationExpressionSyntax inv
+        || model.GetSymbolInfo(inv).Symbol is not IMethodSymbol { ReducedFrom: null } sym
+        || sym.DeclaringSyntaxReferences.Length == 0)
+        return forwarded;
+    var decl = sym.OriginalDefinition;
+    // The callee's params[] list, by the predicate that builds it: by-value, owned disposable.
+    var owned = decl.Parameters.Where(p => p.RefKind == RefKind.None
+        && p.DeclaringSyntaxReferences.FirstOrDefault()?.GetSyntax() is ParameterSyntax { Type: { } pt } ps
+        && IsOwnedDisposableType(pt, model.Compilation.GetSemanticModel(ps.SyntaxTree))).ToList();
+    var slots = new List<string>();
+    var args = inv.ArgumentList.Arguments;
+    for (var i = 0; i < args.Count; i++)
+    {
+        var p = args[i].NameColon is { } nc
+            ? decl.Parameters.FirstOrDefault(q => q.Name == nc.Name.Identifier.Text)
+            : (i < decl.Parameters.Length ? decl.Parameters[i] : null);
+        var k = p is null || p.IsParams ? -1 : owned.FindIndex(q => SymbolEqualityComparer.Default.Equals(q, p));
+        if (k < 0 || !args[i].RefKindKeyword.IsKind(SyntaxKind.None)
+            || ValueUnwrap(args[i].Expression, model) is not IdentifierNameSyntax id
+            || !tracked.Contains(id.Identifier.Text))
+            continue;
+        while (slots.Count <= k)
+            slots.Add("_");
+        slots[k] = id.Identifier.Text;
+        forwarded.Add(id.Identifier.Text);
+    }
+    if (forwarded.Count > 0)
+        nodes.Add(new { op = "call", callee = $"{decl.ContainingType.ToDisplayString()}.{decl.Name}",
+                        sig = CanonicalSig(sym), args = slots, line = LineOf(e) });
+    return forwarded;
+}
+
 // The body of a first-party method or LOCAL FUNCTION (block or expression-bodied), scanning
 // partial declarations; null for an interface/abstract/extern method (no body to inspect). A
 // directly-called local function runs synchronously, so a forwarding chain through one must be
@@ -5661,6 +5721,8 @@ static bool IsPublicCtor(SyntaxTokenList modifiers)
 var components = new List<object>();
 // P-016 B0b/B2: per-method flow bodies (only when --flow-locals).
 var flowFunctions = new List<object>();
+// P-037 PCS-0: the same records with the canonical-forward body (only under the shadow flag).
+var shadowFunctions = new List<object>();
 
 // Parse every input into a syntax tree first (keeping the file path we report
 // it under), then build ONE compilation over all of them so the SemanticModel
@@ -7207,6 +7269,15 @@ or ImplicitObjectCreationExpressionSyntax } init
                 if (guardedFacts is not null)
                     record["guarded_facts"] = guardedFacts;
                 flowFunctions.Add(record);
+                // P-037 PCS-0: lower the same body a second time with honest forwards; the
+                // record above (and so `-o`) was built with the switch off and is untouched.
+                if (CanonicalShadowPath is not null)
+                {
+                    CanonicalForwards = true;
+                    var shadowBody = LowerFlowBody(mbody, flowNames, model);
+                    CanonicalForwards = false;
+                    shadowFunctions.Add(new Dictionary<string, object?>(record) { ["body"] = shadowBody });
+                }
             }
 
         if (subs.Count > 0)
@@ -7287,6 +7358,12 @@ or ImplicitObjectCreationExpressionSyntax } init
 
 if (outPath is null) Console.WriteLine(json);
 else File.WriteAllText(outPath, json);
+// P-037 PCS-0: the shadow document — the plain shape, only `functions[].body` differs.
+if (CanonicalShadowPath is not null)
+    File.WriteAllText(CanonicalShadowPath, JsonSerializer.Serialize(
+        new { ownir_version = 0, module = "Extracted", components, services = factServices,
+              functions = shadowFunctions, stats = factStats },
+        new JsonSerializerOptions { WriteIndented = true }));
 DispatchReport.Write();
 return 0;
 
@@ -7298,6 +7375,11 @@ partial class Program
 {
     internal static bool BodyThrowEdges;
 
+    // P-037 PCS-0 (measurement only): where the canonical-forward shadow document goes, and
+    // the switch the SECOND lowering of each method runs under. Off for the ordinary lowering.
+    internal static string? CanonicalShadowPath;
+    internal static bool CanonicalForwards;
+
     // #240 (Codex review): full paths of files compiled by a Fody-enabled PROJECT, recorded
     // while expanding its <Compile> items — a linked source outside the project directory
     // would otherwise dodge the ancestor-walk weaver check (the FodyWeavers.xml lives next