Drive RTS member discovery from product API surfaces

[richlander]

Advances #3091 and #2777

Conclusion: PASS — product metadata now owns accessor membership, finalizer disclosure, extension-property implementation methods, and proven MethodImpl ownership without silently dropping unresolved external declarations.

Stack

• Slice 3 of 4
• Parent: Type modern operator identity end to end #4142
• Child: Drive ReturnToSender from product member surfaces #4143
• Base: feature/rts-operator-identity
• Residual: Drive ReturnToSender from product member surfaces #4143 moves RTS reconstruction onto this product-owned inventory.

Change

• Adds the MetadataReader extraction entry point and complete typed member inventory.
• Tracks accessor ownership by metadata handle rather than name prefixes.
• Distinguishes interface MethodImpl ownership from class overrides, including generic bases and finalizers.
• Preserves unresolved external MethodImpl declarations as visible inspection evidence.
• Handles extension-property implementation accessors with generic-arity identity.
• Reuses one immutable assembly surface index across consumers.

Scope and safety

This slice changes only ApiSurfaceExtractor and its direct product tests. RTS orchestration is intentionally deferred to #4143.

Evidence

• Product test project builds independently at 2fe5a768c.
• All 63 ApiSurfaceExtractorTests pass.
• The cross-platform BodyShapeSearchMetadataTests.Search_DefaultIncludesNestedExternalExplicitInterface regression now passes.
• The complete reconstructed stack builds and passes the full 5,214-case oracle-backed decompiler suite with zero failures or skips.

Evidence revision: 2fe5a768c

[richlander]

Adversarial review round 1 at 15b65bc2: GPT-5.6 Sol and Claude Opus 5 independently found that ordinary methods legally named get_*/set_*/add_*/remove_* disappeared when RTS moved to the product surface. I reproduced the resulting incomplete surface and compile-back floor, then fixed it in 2d020ece by filtering actual accessor ownership while preserving explicit-interface accessor body entries. Product and end-to-end RTS canaries now cover the close negative. The fixed head requires a new clean round after current-head CI.

[richlander]

Adversarial review round 2 at 2d020ece: GPT-5.6 Sol found that unowned SpecialName accessor-like methods were still dropped; Claude Opus 5 found that MethodImpl-backed ordinary accessors (for example covariant returns/static abstract implementations) were misclassified as explicit-interface method rows and could leak non-public accessors. Both findings were reproduced and fixed in e82a53f5: owned accessors are suppressed unless their metadata name is qualified, unowned SpecialName methods remain ordinary methods, and RTS no longer blanket-drops special-name methods. Emitted-metadata and covariant-return close-negative tests cover both cases. The moved head requires current-head CI and another clean round.

[richlander]

Adversarial review round 3 at e82a53f5: GPT-5.6 Sol found four product-surface gaps—Other/Raiser MethodSemantics methods were folded without a representable owner token, MethodImpl ownership was inferred from dotted body spelling, op_Custom was misclassified as an operator, and lossy dotted type keys collided for top-level N.C versus global N + nested C. Claude Opus 5 found that required non-target operators were filtered before metadata-token backfill, degrading Full bodies to throw null.

All five findings were reproduced and fixed in 599db205: only getter/setter/adder/remover semantics are owner-folded; retained MethodImpl bodies must target an actual InterfaceImpl and be non-public or qualified; OperatorNames recognizes the real operator set while op_Custom remains ordinary; structured MetadataTypeDefinitionName keys drive product-surface lookup; and operator filtering now occurs after existing-requirement token backfill. Emitted-metadata and end-to-end canaries cover Other/Raiser methods, private unqualified interface implementations, class/covariant close negatives, ordinary op_* methods, required operator Full bodies, and namespace/nesting collisions. The 573-test RoundTrip gate is clean and the cap-3 three-row parity manifest is byte-identical to the parent. The moved head requires current-head CI and a new clean round.

[richlander]

Current-head CI at 599db205 found one Windows CLI compatibility regression: public non-accessor MethodImpl rows such as the static-interface int.Parse overloads were unintentionally reclassified as ordinary methods, collapsing the established member-detail summary into a flat overload index. The round-3 rule only needed to distinguish owned accessors; changing all MethodImpl rows broadened the behavior change.

Fixed in 12745549 by applying the public/unqualified suppression only to owned accessors while preserving existing disclosure for non-accessor MethodImpl rows. An emitted-metadata canary now covers both sides: a public non-accessor mapping retains its explicit-implementation row, while public ordinary accessors remain owner-folded and private unqualified interface accessors remain available. The failing int.Parse canary passes, the full 2,986-test CLI suite is clean locally, the 573-test RoundTrip gate is clean, and cap-3 parity remains byte-identical to the parent. Current-head CI must pass before round 4 starts.

[richlander]

Round 4 findings are resolved at 6898934c.

• GPT-5.6 Sol: dotted namespace/nesting collisions still selected the first
  metadata row. RTS now retains all candidates, resolves by requested-member
  identity, and throws a visible AmbiguousMatchException if multiple
  candidates remain.
• GPT-5.6 Sol: MethodImpl accessors inherited through an interface could be
  discarded. Product extraction now follows bounded same-module interface
  inheritance using structured type and assembly/module identity; direct handle
  equality remains the fast path.
• Focused follow-up review: malformed assembly/module scope reads occurred
  outside the extractor's inspection-failure contract, and candidate probing
  repeated accessor scans. Scope failures now produce an inspection failure and
  disable only identity fallback, while candidate probing resolves the target
  method once.

Deliberate boundary: external inherited-interface closure cannot be proven from
one metadata reader and remains unsupported. Ambiguous dotted input is reported
rather than silently selecting or skipping a type.

Current-head evidence: 58 product-surface tests; 574 RoundTrip tests with zero
skips; Release solution build; CoreLib extraction at the committed performance
baseline; and byte-identical cap-3 parity (28 Exact, 4 OpcodeDiff, 4
RecompileFail over 36 targets).

[richlander]

Restacked onto parent #3793 head 6a84c12b after its authorized
origin/main integration.

Old slice head: 6898934c; new slice head: 31d20611. The seven-commit
range-diff reports every slice commit as =:

ada90e0b = 96f3cf2d
15b65bc2 = e13f0d08
2d020ece = 148c3fca
e82a53f5 = a9f10acb
599db205 = 6d74434f
12745549 = 81dc7c1e
6898934c = 31d20611

Post-restack evidence: Release solution build; 58 product-surface tests; 586
RoundTrip tests with zero skips and IL oracles active; and cap-3 parity
byte-identical to the updated parent (28 Exact, 4 OpcodeDiff, 4 RecompileFail
over 36 targets).

[richlander]

Current-head CI is externally blocked by the GitHub Actions major outage:
https://www.githubstatus.com/

Run: https://github.com/richlander/dotnet-inspect/actions/runs/31114444352

The original Windows job and two failed-job retries all failed before checkout
while resolving GitHub-hosted actions (Service Unavailable, Internal Server Error, or request timeout), across west US, west-central US, and central US
runners. No repository command ran in any attempt. Linux, build, and decompiler
jobs are green at exact head 31d20611; local Windows-relevant product and
RoundTrip coverage is also clean.

I am not spending review round 5 while the stack's current-head CI is red. The
Windows job will be retried after GitHub reports Actions operational.

[richlander]

Round 5 findings are resolved in d3ea29e2:

• Claude Opus 5 found that MethodImpl bodies inherited through external interfaces could disappear and that full product-surface extraction repeated per RTS composition. The extractor now distinguishes proven non-interface ownership from unresolved external inheritance, preserving the latter, and RTS builds one immutable member-surface index per open assembly.
• GPT-5.6 Sol confirmed both findings and found that overload-ordinal fallback could make a signature-bearing dotted type target falsely ambiguous. Candidate filtering now compares the exact requested signature in both compact and corpus identity formats; ordinal fallback remains only after unique type selection.

Regression coverage includes an external ICollection/inherited IEnumerable.GetEnumerator MethodImpl with an external class-MethodImpl negative, plus colliding dotted/nested types with same-name int and string methods. The Release build, product-surface suite, full RoundTrip gate, and cap-3 parity pass; parity remains 28 Exact / 4 OpcodeDiff / 4 RecompileFail with a byte-identical three-row manifest. CoreLib multi-target timing improved from 19.96 s to 12.21 s at cap 5 and from the review's 45.8 s observation to 20.58 s at cap 20.

[richlander]

Restacked after the parent onto 499fe60e at user direction. Child head moved d3ea29e2 -> adc38bc8; git range-diff eed57330..d3ea29e2 499fe60e..adc38bc8 reports all eight child commits as =. The Release solution build, product-surface suite, full RoundTrip gate, and cap-3 parity pass at the restacked head; parity remains 28 Exact / 4 OpcodeDiff / 4 RecompileFail with a byte-identical three-row manifest. Current-head stack CI and a new fixed-head review round are required before readiness.

[richlander]

Round-six findings reconciled in 70f6cd7:

• GPT-5.6 Sol and Claude Opus 5: stale or unsupported compact/corpus signatures could delete a valid target before the documented ordinal fallback. Candidate discovery now preserves ordinal-resolvable types and uses exact signatures only to narrow real dotted-type collisions.
• GPT-5.6 Sol: an undecodable inherited-interface identity was treated as proven non-interface, and external class MethodImpl ownership checked only the immediate base. Failed identity decoding now remains unresolved, while class ownership walks the bounded in-module base chain first.
• Claude Opus 5: corpus-signature discovery imported method bodies outside the target failure boundary. Expected metadata/decode failures are now contained as non-matches.

Regression coverage includes stale compact and corpus signatures, zero-match dotted collisions, malformed method bodies, unresolved TypeSpec interface identity, and a class MethodImpl targeting an external ancestor through an in-module intermediate base. Release build, complete product-surface suite, oracle-backed RoundTrip gate, and cap-3 parity passed; parity remains 28 Exact / 4 OpcodeDiff / 4 RecompileFail with a byte-identical three-row manifest.

[richlander]

Restacked onto integrated parent 40b5c626 with the user-authorized seventh review still pending.

• Parent: 499fe60e -> 40b5c626
• Child: 70f6cd71 -> 0898af4a
• git range-diff 499fe60e..70f6cd71 40b5c626..0898af4a: all nine child commits are =; only commit identities changed. The round-six fixes remain the final child commit (0898af4a).

Release solution build, complete ApiSurfaceExtractorTests, oracle-backed RoundTrip gate, and pinned cap-3 parity passed at the restacked head. Parity remains 28 Exact / 4 OpcodeDiff / 4 RecompileFail across 36 targets, and the three-row manifest is byte-identical.

[richlander]

Round-seven findings reconciled in ed553dc9:

• GPT-5.6 Sol: a constructed in-module generic base (TypeSpec) stopped class MethodImpl ancestry before its external ancestor. The extraction-wide local type index now resolves the generic definition and continues the bounded, visited base walk; the regression uses a private MethodImpl through Intermediate<int> : Stream and proves it stays out of the default surface.
• Claude Opus 5: the operator catalog omitted C# 14 instance compound-assignment/increment operators and established VB operator names, so product output declassified them and RTS reconstructed raw op_*Assignment methods. The catalog now recognizes assignment, checked-assignment, instance increment/decrement, and VB names; C# declaration composition spells assignment operators, while unknown op_Custom remains an ordinary method.

Style oracle: dotnet/runtime’s declared .editorconfig has no key governing instance-operator form. Revealed source uses public void operator +=(...) in src/libraries/System.Numerics.Tensors/src/System/Numerics/Tensors/netcore/Tensor.op_Addition.cs and public void operator ++() in Tensor.op_Increment.cs, matching this change.

Release solution build, full ILInspector.CSharp.Tests, complete ApiSurfaceExtractorTests, OperatorNamesTests, oracle-backed RoundTrip gate, and pinned cap-3 parity passed. Parity remains 28 Exact / 4 OpcodeDiff / 4 RecompileFail across 36 targets with the byte-identical three-row manifest.

[richlander]

Round-eight base settlement:

• Parent moved 40b5c626 -> 923abca2 by integrating non-interacting origin/main range 17081213..ac02553f.
• Child restacked ed553dc9 -> df1c2e83 onto the updated parent.
• Range-diff reports all ten child commits =; only commit identities changed.
• Release solution build passed; 323 C# tests, 60 ApiSurfaceExtractorTests, 72 OperatorNamesTests, and the full RoundTrip area (596 passed, 7 skipped) passed with ilasm/ildasm active.
• The 14-assembly cap-3 parent/child differential is byte-identical: 28 Exact, 4 OpcodeDiff, 4 RecompileFail, 36 checked, with the same three-row burndown manifest.

The authorized round-eight exact range, after current-head CI clears stack-wide, is 923abca2..df1c2e83.

[richlander]

Second round-eight restack: parent 923abca2 -> 044bb1df; child df1c2e83 -> f00130a2.

#3888 renamed ILInspector.Metadata/OperatorNames.cs and its tests into CSharpText. The restack followed that rename: no old Metadata helper was recreated, Metadata/CSharp/RTS callers consume CSharpText.OperatorNames, and the modern/VB operator catalog tests now live in CSharpText.Tests. Range-diff keeps eight commits =; the two operator commits are ! solely because their patches moved from the old paths to the upstream owner paths.

Post-adaptation evidence: Release solution build passed; 72 OperatorNamesTests, 323 C# tests, 60 ApiSurfaceExtractorTests, and oracle-backed RoundTrip (603 passed, 0 skipped) passed. The 14-assembly parent/child cap-3 differential remains byte-identical: 28 Exact, 4 OpcodeDiff, 4 RecompileFail, 36 checked, same three-row manifest.

The authorized round-eight exact range is now 044bb1df..f00130a2, pending current-head stack-wide CI.

[richlander]

Final pre-round-eight restack: parent 044bb1df -> 3d9bbd76; child f00130a2 -> 8ff6a6bf. All ten child commits are = in range-diff.

Exact-head evidence: Release build passed after the NuGet-config removal; 72 operator, 323 C# composition, 60 product-surface, and 603 oracle-backed RoundTrip tests passed with zero skips. The freshly rerun 14-assembly parent/child differential remains byte-identical: 28 Exact, 4 OpcodeDiff, 4 RecompileFail, 36 checked, same three-row manifest.

Authorized round-eight range: 3d9bbd76..8ff6a6bf, pending stack-wide current-head CI.

[richlander]

Round-eight findings are resolved at d3562749:

• Claude Opus 5 — compile-back skeleton contamination: C# 14 instance assignment operators reached FidelityCheck’s sibling stub emitter, which forced static and made unrelated targets fail with CS0106. CSharpText now centralizes valid assignment-operator shape; the harness emits valid instance forms without static and raw-method stubs for non-C# shapes. SkeletonEmitTests.SkeletonCompilesPastWholeModuleHazards is the whole-module gate.
• GPT-5.6 Sol — invalid checked assignments: checked %=/bitwise/shift forms were recognized and rendered even though C# rejects them with CS9023. The checked catalog is now limited to +=, -=, *=, /=, ++, and --; invalid checked names remain raw methods. OperatorNamesTests pins both permitted and rejected forms.
• GPT-5.6 Sol — legacy assignment-shaped metadata: static, non-void, wrong-arity, or non-public op_*Assignment methods were rendered as invalid C# 14 instance operators. CSharpDeclarationWriter now validates model-bound shape and falls back to the raw method declaration. MemberDeclaration_LeavesNonCSharpAssignmentShapesAsMethods gates the close negatives.
• GPT-5.6 Sol — undecodable MethodImpl declaration identity: a null declaration identity could end as ProvenNonInterface after only decodable local interface edges, dropping a private possible explicit implementation. Decode failure now initializes unresolved ownership after class-hierarchy proof. Extract_PreservesMethodImplWhenDeclarationIdentityIsUnresolved gates the hand-authored metadata case.

Independent exact-head canaries invert all four failures: the MethodImpl is retained, invalid operator shapes stay raw, and the two-type contaminated fixture returns from 2/4 to 4/4 Exact. Release build plus 1,118 tests passed at d3562749, including the new workspace suite, 94 operator tests, 331 C# tests, 61 surface tests, 8 slow skeleton tests, and 603 oracle-backed RoundTrip tests with zero skips. Exact parent/child cap-3 parity remains byte-identical at 28 Exact / 4 OpcodeDiff / 4 RecompileFail over 36 targets with the same three-row manifest.

The c4db43c6..0ff89bef base update moved parent 3d9bbd76 -> 63646a61 and child 6364b8ec -> d3562749; range-diff reports all eleven child commits =.

[richlander]

Restacked onto parent 90f33ae4; child head is ec17c080.

git range-diff 274070ba..1cb187e5 90f33ae4..ec17c080 reports = for all 13
child commits. The restack changed only the effective base.

The incoming commits retain Markout 0.35.0 and do not touch the parity harness,
so the immediately preceding byte-identical cap-3 parity result remains
applicable. Exact-head local validation reran the Release solution build, 110
C# declaration tests, 61 product-surface tests, 217 RTS prototype tests, 9
whole-module skeleton tests, and the 611-case oracle-backed RoundTrip gate with
zero failures or skips.

[richlander]

Round ten findings are resolved at 8989cd2c.

• GPT-5.6 Sol and Claude Opus 5: C# 14 instance += and ++ declarations were
  reconstructed, but call sites remained forbidden explicit op_* calls.
  Operator facts now recognize only valid instance-assignment shapes and the
  printer emits assignment/increment syntax, including checked variants.
• GPT-5.6 Sol: All/Full token backfill matched same-name overloads before
  decoding signatures. It now matches exact structured parameter, return,
  static, and operator identity, and reports ambiguity instead of selecting the
  first name match.
• GPT-5.6 Sol: unrelated operators were skipped during All/Full surface
  materialization. They now retain typed operator identity and MethodDef tokens,
  so concrete bodies cannot disappear behind target-level Exact.
• Claude Opus 5: finalizers leaked protected, override, and potentially
  sealed metadata. Finalizer presentation now suppresses those source-invalid
  modifiers.

The child was restacked from ec17c080 onto parent 44aee3ae; all 14 commits
are = in git range-diff, and the new head is 8989cd2c.

Current-head evidence: Release solution build; 110 C# declaration tests; 62 API
surface tests; 220 RTS prototype tests; 9 skeleton tests; 614 oracle-backed
RoundTrip cases with zero skips. Parent/child cap-3 snapshots and three-row
burndowns are byte-identical: 28 Exact / 4 OpcodeDiff / 4 RecompileFail over 36.

[richlander]

Round eleven findings are resolved at bdefc7a7.

• GPT-5.6 Sol and Claude Opus 5: cross-assembly C# 14 instance operators were
  not receiving positive operator facts. Resolution now preserves definition
  signatures and supports valid in parameters while rejecting ref/out.
• GPT-5.6 Sol: constructed generic TypeSpec lookup could collapse M(T) and
  M(int) after substitution. Matching now compares definition-form return and
  parameter signatures before substitution.
• GPT-5.6 Sol: instance-assignment RHS rendering could drop an
  overload-selecting reference cast. The printer now retains the cast.
• GPT-5.6 Sol: a plain user-defined operator nested in a checked assignment
  could bind to its checked sibling. Checked-context rendering now emits the
  required unchecked(...) boundary.
• GPT-5.6 Sol: token backfill ignored generic arity. Generic and non-generic
  siblings can no longer borrow one another's MethodDef token.
• GPT-5.6 Sol: finalizers lost typed identity during All/Full materialization
  and direct targeting. Finalizer identity now flows through the product shell,
  including noncanonical-body destructor suppression.
• GPT-5.6 Sol: duplicate TypeDefs could abort construction of the entire
  assembly surface index. Duplicates are retained and ambiguity is reported
  only when that structured type name is requested.
• Claude Opus 5: C# 14 extension-property implementation accessors leaked from
  their extension class because property rows live on a generated grouping
  type. Whole-assembly ownership matching now suppresses instance, generic,
  indexed, getter/setter, and static implementation accessors.
• Claude Opus 5: malformed extension-property metadata could abort extraction.
  Accessor pre-scan now records a visible inspection failure and continues.

The child was restacked from parent 44aee3ae onto merge commit a3fdd2da;
all 15 slice commits are = in git range-diff, and the new child head is
bdefc7a7.

Current-head local evidence: Release solution build; 598 CSharpText tests; 332
ILInspector.CSharp tests; 63 product-surface tests; 623 oracle-backed RoundTrip
cases; 9 whole-module skeleton tests; and 166 authored-corpus tests, all with
zero failures or skips. Regenerated parent/child cap-3 snapshots are identical
apart from generatedUtc, and the three-row burndown manifests are
byte-identical: 28 Exact / 4 OpcodeDiff / 4 RecompileFail over 36 targets.

The earlier MAI-Code pass was a quick read only and did not satisfy a formal
review seat.

[richlander]

Current-head CI is green and mergeable at bdefc7a7. The first Ubuntu run hit the unrelated process-global cache race now tracked in #3987; the unchanged-head rerun passed, including ci-required.

[richlander]

Integrated current main through parent merge commits 88b505e8 and
6f981bfc, then restacked the child from bdefc7a7 to 2be28ef8.

git range-diff a3fdd2da..bdefc7a7 88b505e8..06f0d6dd reports = for all 15
slice commits, as does
git range-diff 88b505e8..06f0d6dd 6f981bfc..2be28ef8. Both restacks changed
only the effective base.

The incoming range (6d7b72ea, d615b65a, 5fdafb96) has no textual overlap
with the product or harness files in this slice. It moves declaration-placement
test fixtures and changes CLI type-tree limiting/output only; the pinned parity
inputs are external package assemblies. The later range (f1f7e4c8,
22a99d06, db48efe3) is likewise non-overlapping and includes the package
cache test serialization that resolves #3987.

Exact-head validation reran the Release solution build, 598 CSharpText tests,
332 ILInspector.CSharp tests, 63 product surface tests, the 623-case
oracle-backed RoundTrip gate, 9 skeleton tests, and 166 authored-corpus tests
with zero failures or skips. The previously regenerated parent/child cap-3
parity evidence therefore carries across the patch-identical restacks
unchanged.

[richlander]

Integrated current main through parent merge commit b03c9d88, then
restacked the child from dcebd39c to a687e308.

git range-diff 6f981bfc..dcebd39c b03c9d88..a687e308 reports = for all 16
slice commits. The restack changed only the effective base.

The incoming range (0aaa7838 through f77a127d) has no textual overlap with
the six round-twelve fix files. It moves Implementation Diff to a typed query,
hardens function-pointer graph identity, updates Markout guidance, and changes
enum-switch raising. The final pinned cap-3 snapshot and emitted three-row
burndown are unchanged, covering the possible behavioral interaction with the
decompiler change.

Exact-head validation reran the Release solution build, 598 CSharpText tests,
332 ILInspector.CSharp tests, all 257 selected product-surface/output cases, the
623-case oracle-backed RoundTrip gate, 9 skeleton tests, and 166 authored-corpus
tests. Every case passed with zero skips.

[richlander]

Round twelve findings are resolved at a687e308.

• GPT-5.6 Sol: requested generic surface methods were skipped before exact
  MethodDef matching, leaving a successful compile-back result with an
  incomplete generic body. Exact structured matching and token backfill now
  happen before the otherwise-unrequested generic-method skip, and the
  regression requires BodyComplete.
• GPT-5.6 Sol and Claude Opus 5: extension-property implementation matching
  ignored generic arity and could suppress a distinct public get_* method.
  Candidates now match the generated grouping type's arity; close-negative
  fixtures retain ordinary methods of another arity.
• Claude Opus 5: name-only display rewrote an ordinary
  op_AdditionAssignment method as operator +=. Member-aware output now
  applies operator spelling only when ApiMember.Kind == "operator", including
  the member sections and type table.

Current main was integrated through parent merge commit b03c9d88; the child
was restacked from dcebd39c to a687e308. All 16 child commits are = in
git range-diff.

Current-head evidence: Release solution build; 598 CSharpText tests; 332
ILInspector.CSharp tests; all 257 selected product-surface/output cases; 623
oracle-backed RoundTrip cases; 9 whole-module skeleton tests; and 166
authored-corpus tests. Every case passed with zero skips. The final cap-3
snapshot remains 28 Exact / 4 OpcodeDiff / 4 RecompileFail over 36 targets, and
its three-row emitted burndown is unchanged.

The earlier MAI-Code pass was a quick read only and did not satisfy a formal
review seat. Round twelve had findings, so the stack is not review-clean yet.

[richlander]

Integrated current main through parent merge commit 5a5fa30d, then
restacked the child from a687e308 to 4c26cd72.

git range-diff b03c9d88..a687e308 5a5fa30d..4c26cd72 reports = for 15 of
the 16 existing slice commits. Commit 15 has one semantic conflict resolution:
its finalizer SuppressDestructorSyntax flag now composes with main's
IsReplacementTarget flag on the same product-owned CSharpBlockBody.
Follow-up 4c26cd72 supplies the required product member surface to main's new
fault-isolation fixture.

The incoming range (4c7b781c through 844dd7ee) added product-owned frozen
C# body replacement, creating the conflict with the parent seam. The resolution
keeps the neutral CSharpMemberShellSpec boundary and moves replacement-target
annotation into CSharpMemberShellProducer; RTS does not regain a parallel
body-composition path.

Exact-head validation reran the Release solution build, 598 CSharpText tests,
342 ILInspector.CSharp tests, all 259 selected product-surface/output cases, the
638-case oracle-backed RoundTrip gate, 9 skeleton tests, and 179 authored-corpus
tests. Every case passed with zero skips. Parent and child normalized cap-3
snapshots and emitted three-row burndowns are identical.

[richlander]

Round twelve findings are resolved at 4c26cd72.

• GPT-5.6 Sol: requested generic surface methods were skipped before exact
  MethodDef matching, leaving a successful compile-back result with an
  incomplete generic body. Exact structured matching and token backfill now
  happen before the otherwise-unrequested generic-method skip, and the
  regression requires BodyComplete.
• GPT-5.6 Sol and Claude Opus 5: extension-property implementation matching
  ignored generic arity and could suppress a distinct public get_* method.
  Candidates now match the generated grouping type's arity; close-negative
  fixtures retain ordinary methods of another arity.
• Claude Opus 5: name-only display rewrote an ordinary
  op_AdditionAssignment method as operator +=. Member-aware output now
  applies operator spelling only when ApiMember.Kind == "operator", including
  the member sections and type table.

Current main was integrated through parent merge commit 5a5fa30d; the child
was restacked from a687e308 to 4c26cd72. Fifteen of the 16 existing child
commits are = in git range-diff. The finalizer commit now composes its
SuppressDestructorSyntax flag with main's IsReplacementTarget flag on the
same product-owned body, and follow-up 4c26cd72 supplies the required product
member surface to main's new fault-isolation fixture.

Current-head evidence: Release solution build; 598 CSharpText tests; 342
ILInspector.CSharp tests; all 259 selected product-surface/output cases; 638
oracle-backed RoundTrip cases; 9 whole-module skeleton tests; and 179
authored-corpus tests. Every case passed with zero skips. The final cap-3
parent and child snapshots are identical at 28 Exact / 4 OpcodeDiff / 4
RecompileFail over 36 targets, and their three-row emitted burndowns are
identical.

The earlier MAI-Code pass was a quick read only and did not satisfy a formal
review seat. Round twelve had findings, so the stack is not review-clean yet.

[richlander]

Restacked the slice from published head 4c26cd72 onto parent
929debd9, producing 94842731.

The parent now integrates origin/main through 9ea30ac50. The incoming
virtual-shell change in FidelityCheck lands immediately before this slice's
operator guards; range-diff shows those guards unchanged apart from that
context. The printer conflict was resolved semantically by routing validated
C# 14 instance-assignment operators through main's canonical printed-node-kind
projection, retaining owner-aware checked-statement ranges. Follow-up
94842731 adds the corresponding close negatives and checked-range coverage.

Exact-head validation passed the Release solution build, 598 CSharpText tests,
342 ILInspector.CSharp tests, all 259 selected product-surface/output tests,
and the full 5,058-case oracle-backed decompiler suite with zero failures or
skips.

Pinned 14-assembly cap-3 parity is unchanged. Parent and child normalized
snapshots are byte-identical, as are their three-row emitted burn-downs:
28 Exact / 4 OpcodeDiff / 4 RecompileFail over 36 checked targets.

[richlander]

Restacked onto parent d536acbf and published conflict-free head 6f18ae9f. All 18 slice commits are patch-identical to the previously reviewed stack; only the base moved. The combined exact head builds successfully.

[richlander]

Restacked for authorized round thirteen onto parent f0789ac6, producing 0e9b9718. All 18 slice commits are patch-identical. The exact combined head builds successfully; formal review will start after exact-head CI is green.

[richlander]

Closing this superseded monolith because GitHub refuses to retarget an existing native-stack member. Its replacement contains only the two-file product metadata slice; operator identity is #4142 and RTS orchestration is #4143. No clean adversarial verdict existed on this PR.