fix: only a definite release makes a call-site handoff (INF-S2, #380)

.github/workflows/ci.yml

@@ -802,6 +802,14 @@ jobs:
         env:
           OWN_TIERB_REQUIRED: "1"
         run: python tests/test_extractor_columns.py
+      - name: Guarded release is not a call-site handoff (INF-S2, #380)
+        # A callee that releases its parameter only under a guard is a PARTIAL release, so
+        # its call must not be lowered as the caller's `release` (the fabricated `must`),
+        # while a definite consumer stays a handoff. Facts and verdicts on the real
+        # extractor; REQUIRED here, skips cleanly in the offline Tier-A job.
+        env:
+          OWN_TIERB_REQUIRED: "1"
+        run: python tests/test_guarded_consume.py
       - name: S2 step 10 analyzer-delta verifier (Tier B, full public CLI)
         env:
           OWN_TIERB_REQUIRED: "1"

corpus/p036-bakeoff/gv4-control-aliased-self-null/expected.json

@@ -3,15 +3,13 @@
   "control": "gv4-control-aliased-self-null",
   "p037": "§8 row 19 — G-V4, writably aliased self-null resource parameter",
   "classification": "KNOWN_FALSE_POSITIVE",
-  "measured_at": "70189a3",
+  "measured_at": "f164dd3",
   "owner_ruling": "2026-09-18: accepted as pre-A1 regression anchors, not as authorization for a pre-cutover fix; no ConsumesParam change before P-022 Stage 3",
   "call_site_line": 29,
   "defensive_dispose_line": 30,
   "current": {
-    "findings": [
-      "OWN003"
-    ],
-    "fabricated_release_at_call_site": true
+    "findings": [],
+    "fabricated_release_at_call_site": false
   },
   "post_a1": {
     "findings": [],
@@ -37,7 +35,34 @@
         }
       },
       "result": "UNCHANGED — both engines reproduce the `current` record above exactly, on both layers. Stage 3 moved none of this control, which is what the two-layer design predicted: the fabricated release is decided in the Roslyn extractor, before either engine runs."
+    },
+    {
+      "at": "f164dd3",
+      "on": "2026-09-29",
+      "why": "PhysShell/Own.NET#380 — an independent INF-S2 correctness fix: ConsumesParam now counts a release (or a forward to another consumer) only when it is definite on every normal-return path of the callee, so a guarded one is no longer lowered as the caller's `release`. The `current` record pinned the fabricated call-site release and, for the three G-V4 controls, the KNOWN_FALSE_POSITIVE OWN003 it caused; once an independent correctness fix removes the release, continuing to require it would require the bug. Re-measured on both engines explicitly.",
+      "engines": {
+        "python": {
+          "findings": [],
+          "fabricated_release_at_call_site": false
+        },
+        "rust": {
+          "findings": [],
+          "fabricated_release_at_call_site": false
+        }
+      },
+      "superseded_current": {
+        "measured_at": "70189a3",
+        "current": {
+          "findings": [
+            "OWN003"
+          ],
+          "fabricated_release_at_call_site": true
+        }
+      },
+      "result": "CHANGED — `current` re-recorded to the new measurement, which equals the `post_a1` record this file has carried since the controls landed on main (afeca38, 2026-09-18; the record was measured at 70189a3) and which is unchanged here: the new expectation was not chosen after the fix. P-037 is not implemented by this; `post_a1` being met is a consequence of removing the fabricated release, not of cell selection.",
+      "classification": "ACCEPTED BASELINE MOVEMENT CAUSED BY #380 — NOT a P-037 implementation, NOT a reopen of #304, NOT evidence that the A2 contract is satisfied"
     }
   ],
-  "note": "Close disposes r through the alias, not the caller's s; today Close(s, other) is lowered to a release of s (may-as-must), so s.Dispose() is a false OWN003. After A1: no split for the aliased q, no release op at the call, the dispose is clean."
+  "note": "Close disposes r through the alias, not the caller's s; today Close(s, other) is lowered to a release of s (may-as-must), so s.Dispose() is a false OWN003. After A1: no split for the aliased q, no release op at the call, the dispose is clean.",
+  "resolved_by": "#380 (fix commit f164dd3)"
 }

corpus/p036-bakeoff/gv4-control-mutated-guard/expected.json

@@ -3,15 +3,13 @@
   "control": "gv4-control-mutated-guard",
   "p037": "§8 row 18a — G-V4, mutated guard (direct write)",
   "classification": "KNOWN_FALSE_POSITIVE",
-  "measured_at": "70189a3",
+  "measured_at": "f164dd3",
   "owner_ruling": "2026-09-18: accepted as pre-A1 regression anchors, not as authorization for a pre-cutover fix; no ConsumesParam change before P-022 Stage 3",
   "call_site_line": 39,
   "defensive_dispose_line": 40,
   "current": {
-    "findings": [
-      "OWN003"
-    ],
-    "fabricated_release_at_call_site": true
+    "findings": [],
+    "fabricated_release_at_call_site": false
   },
   "post_a1": {
     "findings": [],
@@ -37,7 +35,34 @@
         }
       },
       "result": "UNCHANGED — both engines reproduce the `current` record above exactly, on both layers. Stage 3 moved none of this control, which is what the two-layer design predicted: the fabricated release is decided in the Roslyn extractor, before either engine runs."
+    },
+    {
+      "at": "f164dd3",
+      "on": "2026-09-29",
+      "why": "PhysShell/Own.NET#380 — an independent INF-S2 correctness fix: ConsumesParam now counts a release (or a forward to another consumer) only when it is definite on every normal-return path of the callee, so a guarded one is no longer lowered as the caller's `release`. The `current` record pinned the fabricated call-site release and, for the three G-V4 controls, the KNOWN_FALSE_POSITIVE OWN003 it caused; once an independent correctness fix removes the release, continuing to require it would require the bug. Re-measured on both engines explicitly.",
+      "engines": {
+        "python": {
+          "findings": [],
+          "fabricated_release_at_call_site": false
+        },
+        "rust": {
+          "findings": [],
+          "fabricated_release_at_call_site": false
+        }
+      },
+      "superseded_current": {
+        "measured_at": "70189a3",
+        "current": {
+          "findings": [
+            "OWN003"
+          ],
+          "fabricated_release_at_call_site": true
+        }
+      },
+      "result": "CHANGED — `current` re-recorded to the new measurement, which equals the `post_a1` record this file has carried since the controls landed on main (afeca38, 2026-09-18; the record was measured at 70189a3) and which is unchanged here: the new expectation was not chosen after the fix. P-037 is not implemented by this; `post_a1` being met is a consequence of removing the fabricated release, not of cell selection.",
+      "classification": "ACCEPTED BASELINE MOVEMENT CAUSED BY #380 — NOT a P-037 implementation, NOT a reopen of #304, NOT evidence that the A2 contract is satisfied"
     }
   ],
-  "note": "Today the extractor lowers Outer(r, true) to a release of r (may-as-must ConsumesParam), so the honest r.Dispose() is a false OWN003. After A1 the call must carry no release op and lower to plain + OWN051; the dispose is clean."
+  "note": "Today the extractor lowers Outer(r, true) to a release of r (may-as-must ConsumesParam), so the honest r.Dispose() is a false OWN003. After A1 the call must carry no release op and lower to plain + OWN051; the dispose is clean.",
+  "resolved_by": "#380 (fix commit f164dd3)"
 }

corpus/p036-bakeoff/gv4-control-ref-alias-guard/expected.json

@@ -3,15 +3,13 @@
   "control": "gv4-control-ref-alias-guard",
   "p037": "§8 row 18b — G-V4, writable ref-alias of the guard",
   "classification": "KNOWN_FALSE_POSITIVE",
-  "measured_at": "70189a3",
+  "measured_at": "f164dd3",
   "owner_ruling": "2026-09-18: accepted as pre-A1 regression anchors, not as authorization for a pre-cutover fix; no ConsumesParam change before P-022 Stage 3",
   "call_site_line": 36,
   "defensive_dispose_line": 37,
   "current": {
-    "findings": [
-      "OWN003"
-    ],
-    "fabricated_release_at_call_site": true
+    "findings": [],
+    "fabricated_release_at_call_site": false
   },
   "post_a1": {
     "findings": [],
@@ -37,7 +35,34 @@
         }
       },
       "result": "UNCHANGED — both engines reproduce the `current` record above exactly, on both layers. Stage 3 moved none of this control, which is what the two-layer design predicted: the fabricated release is decided in the Roslyn extractor, before either engine runs."
+    },
+    {
+      "at": "f164dd3",
+      "on": "2026-09-29",
+      "why": "PhysShell/Own.NET#380 — an independent INF-S2 correctness fix: ConsumesParam now counts a release (or a forward to another consumer) only when it is definite on every normal-return path of the callee, so a guarded one is no longer lowered as the caller's `release`. The `current` record pinned the fabricated call-site release and, for the three G-V4 controls, the KNOWN_FALSE_POSITIVE OWN003 it caused; once an independent correctness fix removes the release, continuing to require it would require the bug. Re-measured on both engines explicitly.",
+      "engines": {
+        "python": {
+          "findings": [],
+          "fabricated_release_at_call_site": false
+        },
+        "rust": {
+          "findings": [],
+          "fabricated_release_at_call_site": false
+        }
+      },
+      "superseded_current": {
+        "measured_at": "70189a3",
+        "current": {
+          "findings": [
+            "OWN003"
+          ],
+          "fabricated_release_at_call_site": true
+        }
+      },
+      "result": "CHANGED — `current` re-recorded to the new measurement, which equals the `post_a1` record this file has carried since the controls landed on main (afeca38, 2026-09-18; the record was measured at 70189a3) and which is unchanged here: the new expectation was not chosen after the fix. P-037 is not implemented by this; `post_a1` being met is a consequence of removing the fabricated release, not of cell selection.",
+      "classification": "ACCEPTED BASELINE MOVEMENT CAUSED BY #380 — NOT a P-037 implementation, NOT a reopen of #304, NOT evidence that the A2 contract is satisfied"
     }
   ],
-  "note": "Same mechanism as row 18a; the alias write must disqualify the guard (fail-closed) and the call must not fabricate a consume."
+  "note": "Same mechanism as row 18a; the alias write must disqualify the guard (fail-closed) and the call must not fabricate a consume.",
+  "resolved_by": "#380 (fix commit f164dd3)"
 }

corpus/p036-bakeoff/legacy-honesty-else-unresolved-forward/expected.json

@@ -3,13 +3,13 @@
   "control": "legacy-honesty-else-unresolved-forward",
   "p037": "G-T2b class 3 — guarded local release, unresolved forward on the other branch",
   "classification": "VERDICT_COMPATIBLE_VALUE_DIFFERENCE",
-  "measured_at": "70189a3",
+  "measured_at": "f164dd3",
   "owner_ruling": "2026-09-18: accepted as pre-A1 regression anchors, not as authorization for a pre-cutover fix; no ConsumesParam change before P-022 Stage 3",
   "call_site_line": 41,
   "defensive_dispose_line": null,
   "current": {
     "findings": [],
-    "fabricated_release_at_call_site": true
+    "fabricated_release_at_call_site": false
   },
   "post_a1": {
     "findings": [],
@@ -31,7 +31,32 @@
         }
       },
       "result": "UNCHANGED — both engines reproduce the `current` record above exactly, on both layers. Stage 3 moved none of this control, which is what the two-layer design predicted: the fabricated release is decided in the Roslyn extractor, before either engine runs."
+    },
+    {
+      "at": "f164dd3",
+      "on": "2026-09-29",
+      "why": "PhysShell/Own.NET#380 — an independent INF-S2 correctness fix: ConsumesParam now counts a release (or a forward to another consumer) only when it is definite on every normal-return path of the callee, so a guarded one is no longer lowered as the caller's `release`. The `current` record pinned the fabricated call-site release and, for the three G-V4 controls, the KNOWN_FALSE_POSITIVE OWN003 it caused; once an independent correctness fix removes the release, continuing to require it would require the bug. Re-measured on both engines explicitly.",
+      "engines": {
+        "python": {
+          "findings": [],
+          "fabricated_release_at_call_site": false
+        },
+        "rust": {
+          "findings": [],
+          "fabricated_release_at_call_site": false
+        }
+      },
+      "superseded_current": {
+        "measured_at": "70189a3",
+        "current": {
+          "findings": [],
+          "fabricated_release_at_call_site": true
+        }
+      },
+      "result": "CHANGED — `current` re-recorded to the new measurement, which equals the `post_a1` record this file has carried since the controls landed on main (afeca38, 2026-09-18; the record was measured at 70189a3) and which is unchanged here: the new expectation was not chosen after the fix. P-037 is not implemented by this; `post_a1` being met is a consequence of removing the fabricated release, not of cell selection.",
+      "classification": "ACCEPTED BASELINE MOVEMENT CAUSED BY #380 — NOT a P-037 implementation, NOT a reopen of #304, NOT evidence that the A2 contract is satisfied"
     }
   ],
-  "note": "0 findings at warning severity today AND after A1 (class 3 is verdict-equivalent). The facts layer differs: today the extractor lowers M(r, flag, sink) to a release (may-as-must) and even the OWN051 advisory is suppressed; after A1 the guarded value is unknown, the call is plain + OWN051 at note level, and no release op may appear at the call site. The value-level pin (unknown, never repaired to may) is the kernel test k11_finding_release_priority_drops_an_unresolved_forward."
+  "note": "0 findings at warning severity today AND after A1 (class 3 is verdict-equivalent). The facts layer differs: today the extractor lowers M(r, flag, sink) to a release (may-as-must) and even the OWN051 advisory is suppressed; after A1 the guarded value is unknown, the call is plain + OWN051 at note level, and no release op may appear at the call site. The value-level pin (unknown, never repaired to may) is the kernel test k11_finding_release_priority_drops_an_unresolved_forward.",
+  "resolved_by": "#380 (fix commit f164dd3)"
 }

corpus/p037-shapes/README.md

@@ -32,3 +32,18 @@ of aggregated into a number.
 
 Checked by `scripts/p037_fact_shapes.py`, which names its engine explicitly
 (#262 Stage 3) and runs one extractor invocation per case.
+
+## Baseline transitions
+
+A record that moves because a step *meant* to move it is re-recorded
+deliberately, with the move written into the record itself
+(`baseline_transitions[]`, which keeps the superseded facts, verdicts and
+`a2_expect` verbatim). An `a2_expect` entry of the form
+`{"function": …, "record": "absent"}` asserts that a record is gone on
+purpose; the checker fails by name if it comes back.
+
+- **#380** (`23e3203` → `f164dd3`): an independent INF-S2 fix stopped lowering
+  a guarded release as a call-site release. Seven caller records and their
+  sidecars disappear, and two wrappers move `release` → `use`. This is not a
+  P-037 implementation, not a #304 reopen, and not evidence that A2 holds.
+  See [`docs/notes/p037-fact-shape-baseline-transition-380.md`](../../docs/notes/p037-fact-shape-baseline-transition-380.md).