Skip to content

docs(evidence): N3 pilot G1–G4 — KILL-N3-PILOT at G3 - #416

Merged
PhysShell merged 5 commits into
mainfrom
research/n3-pilot-g1
Oct 20, 2026
Merged

PhysShell merged 5 commits into
mainfrom
research/n3-pilot-g1

Conversation

@PhysShell

Copy link
Copy Markdown
Owner

N3 bounded pilot, gates G1–G4, under ACCEPT-PASS-G0 / GO-G1-PREREG-AND-BOUNDED-EXECUTION / NO-PRODUCTION. Stacked on #415 (G0).

Result: KILL-N3-PILOT at G3.

Gate Verdict
G1 tiny PoC PASS: mars-vista-api#26 (S1×D3b), DotNetCloud#43 (S3×D1), DFY-BE#35 (S3×D3a) report on the buggy tree at a line the fix changes, and are silent on the fixed code
G2 negative controls PASS: C1–C15 silent; 15/15 positive samples reported
G3 independent precision KILL: 0 warnings over the 27 pre-registered mature repositories (fewer than 5 = not enough data for a GO); sample not widened
G4 not run
  • Rules: 01-preregistration-g1-g4.md (797f74c5), committed before any PoC code. The table of ownership evidence follows the owner's table: HttpClient is never scoped, a controller is request-bound by activation, and IServiceProvider is split into root and scope.
  • Disclosed, REPORT §2.
    • PoC v1 → v2 brings D3b in line with §3 as written (a Task-returning callee, and the callee's own first await). Control C15 was added for this case.
    • The buggy tree is the PR base.sha, not the merge parent: mars-vista was rebase-merged.
  • The zero is checked independently. A grep of all 526 fire-and-forget sites finds none that captures a scope-owned object in a request-bound type. The controller sites in Jellyfin, Radarr and Jackett use singletons or statics.
  • Limit. Only about 7 of the 27 sample repositories are web applications. Yield on a web-application-only sample is not tested.

Research only, under docs/evidence/n3-pilot-2026-10/; no production, OwnIR, CI or golden change. Third-party trees were parsed only (D13 isolation).

🤖 Generated with Claude Code

https://claude.ai/code/session_01TFkNAFFQz9KoTzpPws8vYG

PhysShell and others added 5 commits October 20, 2026 20:25
Fixed before any PoC code: scope-ownership evidence S1–S5 (HttpContext,
AddDbContext, proven-scoped service, request-scope IServiceProvider;
HttpClient never), request-bound holders R1–R3, detached forms D1–D3c
(one same-class hop, no cross-class), required pairs mars-vista-api#26,
DotNetCloud#43, DFY-BE#35, 14 negative controls, G3 sample (28 saved
mature repos, >=5 warnings, precision >=80% with UNCLEAR as FP) and G4.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TFkNAFFQz9KoTzpPws8vYG
Roslyn scan for §2/§3 of the G1–G4 pre-registration, built against the
e7d33e3 extractor's Roslyn DLLs with no package reference; the runner
derives lifetimes from extractor services facts under G0 rules 1, 2, 4.
On the G2 control file: 15/15 positive samples reported, C1–C14 silent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TFkNAFFQz9KoTzpPws8vYG
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TFkNAFFQz9KoTzpPws8vYG
PoC v1 counted a call to a void same-class method as D3b and took an
await inside a nested lambda as the callee's first await (3 extra
warnings on DotNetCloud#43). v2 requires a Task-returning callee and the
callee's own first await, as §3 states; it also records the capture
line. Control C15 added for this case (controls may be added).

G1: mars-vista-api#26 (S1xD3b), DotNetCloud#43 (S3xD1, capture line
removed by the fix), DFY-BE#35 (S3xD3a) report on base and are silent on
the code each fix touches. Reported-only: Vendorea#49 caught (S4xD1);
microting#1669 (transient holder) and escalated#162 (DbContext
registered by the consumer app) silent by rule. G2: C1-C15 silent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TFkNAFFQz9KoTzpPws8vYG
…ependent sample)

G1 PASS (3/3 required pairs), G2 PASS (C1-C15 silent). G3: PoC v2 over
the 27 pre-registered mature repositories gives 0 warnings, below the
pre-registered minimum of 5; the sample is not widened. An independent
grep (526 fire-and-forget sites) confirms no scope-owned capture in a
request-bound type. G4 not run.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TFkNAFFQz9KoTzpPws8vYG
@PhysShell
PhysShell changed the base branch from research/n3-pilot-g0 to main October 20, 2026 16:07
@PhysShell
PhysShell merged commit d947db8 into main Oct 20, 2026
77 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant