[PhysShell]

What this is

The bounded design packet for P-014, requested by the owner's ruling GO-P014-BOUNDED-DESIGN / NO-PRODUCTION
(#420 §8.7). It contains documentation and research files only, all under
docs/evidence/p014-bounded-design-2026-10/.

This PR does not allow production work. It changes no extractor, core, OwnIR, golden or CI file. The KILL and
deferral of #407 stand unchanged. #420 is a separate evidence package and is not touched.

Owner decision on this packet: ACCEPT-PHASE-0 / GO-EVIDENCE-PR / GO-METRICS-ONLY-POC / NO-PRODUCTION, recorded
in DESIGN.md §12.

Order of work

1. a8f3ea37 — pre-registration (gates D1–D5, KILL rules, verdict rule), committed before the audit and before
   any falsifier ran. Unchanged since.
2. 3e736b7 — source audit at main ad17d7b2, falsifiers, design packet (DESIGN.md).
3. 3d6be6c — wording after owner review: D1 scope, CS0101 vs CS0433, owner ruling.

Results

D1, reference selection: a counterexample to the #419 "framework-first" rule.

• Input. nats.net @ 176e52b, project sandbox/MicroBench2, net8.0, with its existing
  project.assets.json.
• The conflict. The project references package System.Collections.Immutable 9.0.0, whose assembly version
  is 9.0.0.0. The 8.0.31 framework reference pack has 8.0.0.0. The dotnet/sdk conflict order (package overrides,
  then assembly version, then the later steps) picks the package. The docs(evidence): P-014 reference coverage — GO-P014-BOUNDED-DESIGN / NO-PRODUCTION (research only) #419 rule picks the framework.
• docs(evidence): P-014 reference coverage — GO-P014-BOUNDED-DESIGN / NO-PRODUCTION (research only) #419 is unaffected. For P2, P4 and P5 the docs(evidence): P-014 reference coverage — GO-P014-BOUNDED-DESIGN / NO-PRODUCTION (research only) #419 rule happens to agree with the dotnet/sdk order.
• Not proven here. This does not prove any replacement rule. The script applies only the first two steps of
  the order, and the exact rule is left to be written from the SDK's contract before a PoC.

D2, project isolation: 5 synthetic cases, Roslyn 4.9.2 (the extractor's version), in-memory projects.

• Today's shape fails. One shared compilation gives a wrong result in 4 of 5 cases. In 3 of them the error is
  silent: the call binds with no error at the site.
  • F2.1: P2's Dup.T().One() binds to P1's class.
  • F2.3: one project's implicit usings take effect in another project (the Extractor: project-aware semantic resolution — types from SDK implicit usings do not resolve #407 problem).
  • F2.5: a project whose dependency is missing binds an event through another project's references.
• One compilation per project is correct in all 5 cases.
• CS0101 vs CS0433. CS0101 is the shared-compilation form: two source definitions, reported once at
  compilation level. CS0433 appears only at a site that references the two projects as separate assemblies.

Extractor audit (from reading the code, not from a run):

• Silently dropped subscription. An unresolved += whose right side is a lambda or new EventHandler(...) is
  dropped with neither a fact nor OWN050 (Program.cs:6368).
• Unmarked disposable guess. An unresolved disposable type falls back to a guess by type name, and the fact
  does not say so (:5347).
• Unread coverage block. Neither core reads the stats block.

D4, diagnostic precision.

• The 6 FPs are correct bindings. The 6 FPs from docs(evidence): P-014 reference coverage — GO-P014-BOUNDED-DESIGN / NO-PRODUCTION (research only) #419 are correctly bound events. They come from weaknesses
  in the lifetime model (P-004), not from wrong references.
• Outcome:
  • turning all new facts into findings at once: KILL;
  • measuring coverage only: passes;
  • enabling findings by flag: deferred.
• Proposed thresholds, not accepted: ≥ 3 actionable TPs in ≥ 2 repositories, and ≥ 50% precision of the added
  findings. Today's data does not meet them.

Next step (separate, after this is accepted)

A metrics-only Tiny PoC, with a ceiling of 0.25 agent-day:

• one compilation per project;
• existing assets and reference packs only, with no third-party restore or build;
• no change to OwnIR or verdicts.

The contract is in DESIGN.md §8 and §12.

Not checked

• No timing or memory figures: these are left for the PoC.
• No byte-level check that reference-pack APIs stay the same across servicing patches.
• The symbols recovered in docs(evidence): P-014 reference coverage — GO-P014-BOUNDED-DESIGN / NO-PRODUCTION (research only) #419 were not re-read.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TFkNAFFQz9KoTzpPws8vYG