Attribute EVIL frontier IL diffs with an authored-body control

[richlander]

Advances #3784.

Conclusion: PASS - methodology v3 attributes every EVIL ValidDifferent frontier IL-diff row to product body, RTS shell/closure, or CompileBack floor without treating CompileBack as authoritative. Authored controls now use the product-owned frozen C# artifact; RTS no longer constructs or rewrites C# evidence.

Behavioral change

• Successful RTS OpcodeDiff/OperandDiff results run an authored-body fidelity control.
• Exact MVID + MethodDef correlation selects the authored body.
• The control receives the exact final ProductArtifact that RTS compiled.
• The product renderer freezes that compilation unit and selects its target-body range. RTS invokes CSharpSourceArtifact.ReplaceBody; it does not parse, rediscover, construct, or rewrite C#.
• Replacement preserves the supplied authored body bytes, including CRLF, blank lines, and multiline lexical tokens, while retaining every non-target artifact byte.
• Assembly identity, references, compiler options, constructor chain, async/unsafe modifiers, primary-constructor shape, closure, and sibling declarations remain those of the final RTS artifact.
• Authored Full-fidelity exact IL => BodyDefect.
• Authored compile failure or IL difference => ShellOrClosureDefect.
• Missing correlation, replacement target, or available Full comparison => no verdict.

Roslyn remains in the harness only for independent compiler diagnostics and diagnostic-span measurement. Product decompiler output is unchanged.

EVIL result

Exact 12,000-row methodology-v3 run at 7bd0ae2ae:

ValidDifferent frontier IL-diff: 2,019
  product body defect         983
  harness shell/context       518
  CompileBack floor           518
  unclassified                  0

The run evaluated 12,000/12,000 rows across 26/26 corpus assemblies with zero unmatched, malformed, drift, Not-Full, unsupported, or unknown outcomes.

Controlled A/B against the exact pre-remediation parent cf14c4aac used the same corpus and pool:

• headline outcomes were unchanged;
• the product-selected range classified all 38 formerly unclassified frontier IL-diff rows: 24 product and 14 shell;
• 291 invalid rows gained exact authored-control evidence, including 22 corrections from inferred harness attribution to measured product-body defects;
• the lexical-preservation fix changed 240 diagnostic-detail rows and zero classifications.

The 518 floor-backed rows are counted first and never become successful-RTS evidence. Frontier IL-exact rows remain excluded because they contain no semantic IL difference to isolate.

Full-census artifact SHA-256: f020780e90d2b969b6ff9155e7e07a3360110f635a35316f6f0f690c9da8ff39.

Provenance and history

• AuthoredCorpusMethodology.Version is 3.
• v1/v2 rows forbid frontierIlDiffAttribution; v3+ rows require a complete closing partition.
• Only genuinely pre-identity rows may use the unstamped v1 fallback. Any row with pool or corpus identity must state methodologyVersion.
• Unknown methodologies, malformed identities, negative counts, non-closing partitions, and multi-object JSONL lines are refused.
• CI verifies each tracked commit is on main, contains the benchmark, and implemented the recorded methodology.
• Raw frontier attribution is informational rather than ratcheted; existing quality ratchets remain correct, invalid, and invalid product-body defects.

Issue #3915 tracks replacing hand-authored history rows with typed generated rows; it is non-blocking for this PR.

Validation

Check	Result
Solution Release build	Pass
C# product tests	322/322
ValidDifferent fault-isolation controls	13/13
Recompile-failure authored controls	11/11
RoundTrip area with IL tools	611/611
Full decompiler suite	4,969 passed; one transient sweep subprocess exit-139 passed alone; one established macOS /var vs /private/var pin-path failure; one case-insensitive-filesystem skip
Exact-head CI	ci-required passed in run 31439051307
Mergeability	CLEAN / MERGEABLE
Full EVIL census	12,000/12,000; 26/26 assemblies; complete partition

Adversarial review

Earlier rounds found and fixed assembly-identity, unsafe/primary-constructor shell widening, methodology provenance, and mutable closure-state defects.

Fresh ownership-remediation review:

• Round 1 at 50911ba50: Gemini Pro clean; GPT-5.6 Sol found that display-oriented block layout could alter multiline authored literals.
• Fix 7bd0ae2ae: replacement preserves authored lexical bytes; direct product and compiler-produced IL regressions added.
• Round 2 at 7bd0ae2ae: GPT-5.6 Sol clean; Gemini Pro clean.

Ready to merge.

Non-actions

• Product defects exposed by the census are follow-up work; this PR measures rather than repairs them.
• CompileBack-floor rows remain a separate census bucket, not authority for attribution.
• Frontier attribution counts are not monotonic quality metrics and are not ratcheted.

[richlander]

Round 1 reconciliation at reviewed head b85b7b7e:

• GPT-5.6 Sol — finding reproduced and fixed: authored substitution created a fresh ProductTargetBody, dropping the final RTS constructor chain/modifiers. A compiled this(1) constructor control reproduced false ShellOrClosureDefect on the reviewed head. Commit eaf06bb3 now clones the final target body and replaces only Source/Decisions; the new gate fails on the old implementation and passes on the fix.
• GPT-5.6 Sol — finding reproduced and fixed: the general classifier reports OpcodeDiff before checking body-comparison availability, which violated methodology v3's Full-comparison requirement. Commit eaf06bb3 adds an attribution-specific classifier that returns no verdict unless IlBodyDiffResult.IsAvailable, with a direct unavailable-comparison gate.
• Claude Opus 5 — clean: no blocking findings; independently traced exact correlation, floor precedence, partition closure, ratchet lineage, post-verdict wiring, and Release gates.

After fixes, current-main integration, and exact rerun:

• Build: pass.
• Focused methodology/review gates: 218 passed.
• RoundTrip: 598 passed.
• Fast decompiler: 4,606 passed, 1 filesystem skip (known macOS case-only plant); the unrelated /var vs /private/var assertion remains excluded locally and is covered by current-head CI.
• EVIL: unchanged 12,000-row headline and 989 product / 516 harness / 516 floor / 0 unclassified frontier partition.
• Exact round-two census artifact SHA-256: 9bdb1771404a50f164560ccada6db2164e16d2c4dd73ea5aaf1aea03ea4c0b1b.

Round 2 will review exact head 5a8e9474 after its current-head CI is green.

[richlander]

Round 2 reconciliation, fixed at head 4e75d209:

• GPT-5.6 Sol — unknown methodology finding reproduced and fixed. Methodology >= 2 ? 2 : 1 let version 999 inherit the v2 invalid-attribution lineage. AuthoredCorpusMethodology now owns an explicit v1/v2/v3 lineage map; history parsing and ratchet comparison reject unknown baseline and current versions. Complete version-999 gates cover both paths.
• Claude Opus 5 — main-only trend-store finding reproduced and fixed. Removed the off-main 6fcb467a v2 row and feature-branch fae12d1b v3 row. Two exact methodology-v2 runs were rebuilt from main commits 168464d9 and 50046669; both were complete 12,000-row, 26/26 runs with identical identities and totals (1562 correct / 5277 ValidDifferent / 5161 invalid, invalid attribution 270 / 4843 / 48). Recording both makes the post-MVID append gate compare rather than skip. Raw artifact SHA-256 values: adac5cc0afbc0c127ad0c163fbef3a2e2d195c99337fa8f2eb14e5484165eaf0 and efed6ca77387db71a667cb36d242cfd3351be70da185dcd3f577b3a953b5d59a.
• Claude Opus 5 — v3 invalid-lineage finding reproduced and fixed. The round-1 constructor-chain fix changed the shared authored-body substitution used by invalid attribution, even though EVIL currently has zero constructor targets. v3 therefore has its own invalid-attribution lineage; v2→v3 still ratchets valid/correct/invalid, but not productBodyDefect. The history card likewise renders separate v2/v3 rows.
• Methodology-bump workflow corrected. The tracked store may trail code by one version while a bump PR is under review, may never move backward or ahead of known code, and receives its first v3 row only from a follow-up run at the resulting main commit.

The production frontier-control path did not change, so the exact round-two v3 census remains the applicable evidence (989 product / 516 harness / 516 floor / 0 unclassified; artifact SHA-256 9bdb1771404a50f164560ccada6db2164e16d2c4dd73ea5aaf1aea03ea4c0b1b). Round 3 will review 4e75d209 after current-head CI is green.

[richlander]

Round 3 reconciliation at reviewed head 4e75d209:

• GPT-5.6 Sol — Medium, reproduced and fixed. The store contract said every recorded commit must be on main, but the tests only constrained methodology order/version. A forged closed v3 row at feature head 4e75d209 could therefore establish an arbitrary first-lineage productBodyDefect baseline while passing the range, monotonicity, partition, and cross-lineage ratchet rules.
• Fix 5e3a9269. The changes job already checks out full history for path detection. It now runs a named Check EVIL history commits are on main step that parses every JSONL row and requires each non-null recorded commit to satisfy git merge-base --is-ancestor <commit> origin/main. The append documentation names that gate explicitly.
• Non-vacuity. The current tracked store passes. Appending the reviewer's exact defect shape — a closed v3 row recording feature head 4e75d209 with an arbitrary product count — fails the gate on ancestry.
• Claude Opus 5 — CLEAN. Independently verified unknown-version refusal, explicit v1/v2/v3 lineages, non-vacuous exact-main v2 baseline pair, split history-card rows, and the round-1 constructor/unavailable-comparison fixes.

The round is not clean because the GPT finding required a head change. Round 4 will review exact head 5e3a9269 after current-head CI is green.

[richlander]

Round 4 reconciliation at reviewed head 5e3a9269:

• GPT-5.6 Sol — Medium, and Claude Opus 5 — High: same bypass, reproduced and fixed. The ancestry loop selected only .commit != null. A newly appended closed v3 row could omit the key or set commit:null, bypass ancestry, pass all methodology/partition gates, and establish an arbitrary first-lineage product baseline. A symbolic revision such as origin/main also passed without recording immutable evidence.
• Fix 8c5c1235. The CI gate now slurps and validates the whole store before ancestry checks: exactly one commit-less row is allowed; it must be the first/original 2026-07-20 unstamped row with no invalid breakdown. Every other row must carry a bare lowercase hexadecimal commit ID (8–40 digits), then satisfy ancestry against origin/main. A tracked-store set-equality gate independently pins the sole commit-less exception and verifies every recorded ID's shape.
• Non-vacuity. The current store passes. A later row changed to commit:null fails; the same row changed to commit:"origin/main" fails; the feature-SHA case remains rejected by ancestry. Focused history/ratchet tests pass (197 total).

Both seats otherwise re-confirmed the complete methodology-v3 implementation and prior fixes. Round 5 will review exact head 8c5c1235 after current-head CI is green.

[richlander]

Round 5 reconciliation at reviewed head 8c5c1235:

• GPT-5.6 Sol — High, reproduced and fixed. Main ancestry alone did not prove that a recorded methodology was produced by that commit. A forged v3 row could reuse legitimate v2 main commit 50046669, pass ancestry and every cross-lineage ratchet rule, and establish an arbitrary first v3 product baseline.
• Fix 653f7776. The named Check EVIL history provenance gate now derives the methodology implemented at each recorded commit from the historical source owner: current AuthoredCorpusMethodology.Version, earlier SpanAttribution.MethodologyVersion, then the original AuthoredCorpusBenchmark.MethodologyVersion, defaulting to v1 before a stamp existed. The row's methodologyVersion (or v1 when absent) must equal that source value after main ancestry is proven.
• Non-vacuity. The real history passes across all historical owners. Changing the exact main row at 50046669 from v2 to v3 fails because that source implements v2. The prior null/symbolic/feature-SHA cases remain rejected. Focused history/ratchet tests pass (197 total).
• Claude Opus 5 — CLEAN. Re-confirmed all round-4 bypass shapes are closed and the complete methodology-v3 implementation remains sound; it noted commit-to-methodology binding as the residual hand-appended-store boundary, now addressed by this fix.

This head change requires round 6. Per the six-round cap, round 6 is the last round that may begin without fresh approval; if it finds another blocking issue, I will stop and present the convergence analysis before requesting any seventh round.

[richlander]

Round 6 reconciliation at reviewed head 653f7776:

• GPT-5.6 Sol — Medium, reproduced and fixed. An array/object methodologyVersion made the row-extraction jq @tsv fail inside process substitution. Bash ignored that producer exit, the loop checked only the preceding rows, and the provenance step exited 0. This is material on push CI, where the expensive C# test lanes are intentionally PR-only.
• Fix 6bc27403. The whole-store jq -s -e predicate now requires every methodology stamp to be null or a positive integral JSON number and requires at least one non-legacy row. Provenance TSV is captured in a checked command substitution before the loop, so any extraction failure terminates the step under set -e instead of truncating the checked row set.
• Non-vacuity. Current history passes. Array, object, fractional, and zero methodology tamper rows all fail before ancestry; the complete source-methodology/ancestry loop still passes; focused history/ratchet tests pass (197 total).
• Claude Opus 5 — CLEAN. Independently verified historical methodology-owner resolution, commit/methodology binding, CI blocking semantics, and the complete v3 implementation.

Six rounds did not converge because the review expanded from the original frontier-control contract into making a previously prose-only hand-appended trend store cryptographically attributable through CI. Each successive finding closed a distinct provenance layer: known methodology semantics, main ancestry, non-null immutable IDs, commit-to-methodology binding, and finally fail-closed JSON/stream extraction. The architecture is now explicit rather than convention-based: whole-store schema validation → immutable commit shape → main ancestry → source methodology equality → ratchet.

Per the six-round limit, I will not begin round 7 without explicit approval. Head 6bc27403 still needs current-head CI and one final fixed-head round before the PR can be marked ready.

[richlander]

Round 7 reconciliation at reviewed head 6bc27403:

• Claude Opus 5: CLEAN.
• GPT-5.6 Sol: found that jq -s validated a JSON stream rather than the physical JSONL framing consumed by AuthoredCorpusHistoryCard. Two objects on one line or one object split across lines could therefore pass push CI and fail later in the C# reader.

Fixed in 4f97b3e0: Check EVIL history provenance now validates every nonblank physical line independently as exactly one JSON object, reports the offending line number, and only then performs whole-store validation. The current history passes; two objects on one line and pretty-printed multi-line objects fail; blank lines remain allowed to match the C# parser.

This moves the reviewed head, so the PR is not ready to merge. Per the six-round limit, a round 8 requires fresh approval.

[richlander]

Integrated current origin/main before approved review round 8 in merge commit 69dc5596, as required by the fixed-head review gate. The merge resolved .github/workflows/ci.yml automatically and preserved the physical-line JSONL provenance check. Post-merge validation: solution Release build passed; all 208 affected authored-corpus tests passed; the full decompiler suite passed 4,889 tests with one known unrelated macOS /var versus /private/var pin-path failure and one case-sensitive-filesystem skip.

[richlander]

Round 8 reconciliation at reviewed head 69dc5596:

• Claude Opus 5: CLEAN after tracing the RTS attribution path, CompileBack-floor barriers, methodology lineages, ratchet/card behavior, main integration, and 20 provenance tamper cases. It also noted one non-blocking documentation pointer mismatch; the invariant itself is enforced by TrackedHistory_OnlyTheUnconfirmableRowIsNotTrustworthy, so no product or gate change is required here.
• GPT-5.6 Sol: found that methodology_at unconditionally returned v1 when no methodology-bearing source file existed. Reproduced on a fresh exact-head worktree: replacing tracked v1 commit d6af0165 with repository root 7cdafb51 passed framing, ancestry, and methodology checks even though that commit predates AuthoredCorpusBenchmark.cs.

Fixed in 478d8024: v1 is returned only when the benchmark source exists but predates an explicit methodology stamp; commits with no benchmark source fail lookup. A non-vacuity assertion rejects every repository root, while the tracked pre-stamp v1 rows exercise the positive fallback. Current tracked v1/v2/v3 provenance passes; root lookup fails; 197 history/ratchet tests pass.

This moves the reviewed head. The PR is not ready to merge, and round 9 requires fresh explicit approval after current-head CI is green.

[richlander]

Integrated current origin/main before approved round 9 in merge commit c4021788. The only main change touching this PR’s behavior dependency was FidelityCheck gaining an optional readSymbols parameter whose default preserves the prior symbol-reading behavior; this PR’s calls do not override it. Post-merge validation: Release solution build passed; full decompiler suite had 4,890 passes, the same known unrelated macOS /var vs /private/var pin-path failure, and one case-sensitive-filesystem skip; all 222 affected attribution/history/ratchet/span tests passed; tracked v1/v2/v3 provenance passed and repository roots remained rejected.

[richlander]

origin/main moved again while round-9 CI was running, so review remained blocked. Integrated the new non-interacting range in 22bd01aa. The range changes later CI path filtering, unrelated local-function raising, and source-path plumbing; it does not alter the EVIL provenance step, RTS attribution, or fidelity comparison. Current-head Release solution build passed, all 222 affected tests passed, and tracked methodology/provenance lineages passed.

[richlander]

origin/main moved again before the fixed-head re-review, from 592242ed to 896b812f. Because round 11 still lacks a clean fixed-head result, the main-movement carry-forward exception still does not apply.

The two new commits extract return-sinking compiler fixtures and isolate an HTTP client snapshot test. They have no file overlap with this PR and do not affect ReturnToSender, authored fidelity controls, EVIL history provenance, or the InternalsVisibleTo regression. They were integrated conflict-free in d16ed5b4.

Full Release decompiler validation on the integrated tree: 4,916 passed, 1 skipped, with only the pre-existing macOS /var versus /private/var EVIL pin failure.

[richlander]

origin/main moved once more before fixed-head re-review, from 896b812f to 151d9102. Round 11 still has no clean fixed-head result, so this non-interacting movement still had to be integrated.

The new commit moves progressive call graphs into workspace queries. It has no file overlap with this PR and does not touch decompiler, ReturnToSender, authored fidelity controls, or EVIL provenance. It was integrated conflict-free in 305d3e5c.

Full Release decompiler validation on the integrated tree: 4,916 passed, 1 skipped, with only the pre-existing macOS /var versus /private/var EVIL pin failure.

[richlander]

origin/main moved again before fixed-head re-review, from 151d9102 to 4279d718. Round 11 still has no clean fixed-head result, so the movement had to be integrated.

The new commit renames a progressive member-graph workspace API. It has no file overlap with this PR and does not touch decompiler, ReturnToSender, authored fidelity controls, or EVIL provenance. It was integrated conflict-free in c1d93f05.

Full Release decompiler validation on the integrated tree: 4,916 passed, 1 skipped, with only the pre-existing macOS /var versus /private/var EVIL pin failure.

[richlander]

origin/main moved again before fixed-head re-review, from 4279d718 to efc54854. Round 11 still has no clean fixed-head result, so the range was integrated.

The new commits affect Markout documentation and CLI section rendering only. They have no file overlap with this PR and do not touch decompiler, ReturnToSender, authored fidelity controls, or EVIL provenance. They were integrated conflict-free in ea52468e.

Local restore initially failed because this machine's enabled Azure package proxy had not mirrored newly published Markout 0.35.0; the package was present and downloadable from nuget.org. An explicit per-command nuget.org restore succeeded without changing global source configuration.

Full Release decompiler validation on the integrated tree: 4,916 passed, 1 skipped, with only the pre-existing macOS /var versus /private/var EVIL pin failure.

[richlander]

origin/main moved again before fixed-head re-review, from efc54854 to cfb406a8. Round 11 still has no clean fixed-head result, so the range was integrated.

The six commits cover typed API diff queries, multi-TFM output shapes, SourceLink encoded dots, an EH stack-slot range fix, portable annotated source maps, and NuGet source mapping. They have no file overlap with this PR. The EH change is decompiler-adjacent but does not touch ReturnToSender or the authored-control identity path. The range was integrated conflict-free in eb86335e.

Full Release decompiler validation on the integrated tree: 4,940 passed, 1 skipped, with only the pre-existing macOS /var versus /private/var EVIL pin failure.

[richlander]

Round 11 fixed-head re-review at eb86335e found two blocking attribution-control defects.

• GPT-5.6 Sol: authored-control recomposition could derive unsafe and primary-constructor shell shape from authored body text, so the control was not using the literal final RTS shell.
• Gemini Pro: an identified history row could omit methodologyVersion, fall back to v1, and silently drop the productBodyDefect ratchet against a v3 row.

Both were independently reproduced on a clean exact-head worktree. Commit 77ae153c4 fixes them by syntax-substituting only the authored target body into the already composed final RTS artifact, and by refusing identified rows without explicit methodology provenance. Compiler-produced unsafe and primary-constructor negatives now classify conservatively; parser and append-gate regressions cover the methodology bypass.

Local evidence: focused fault-isolation/history tests clean; RoundTrip 609/609; Fidelity 77/77; full decompiler suite 4,943 passed with only the established macOS /var vs /private/var failure and one case-insensitive-filesystem skip; solution Release build clean. Round 11 remains open pending green exact-head CI and clean re-review of the fix.

[richlander]

Integrated origin/main through 525699d6 after the round-11 fixes; merge commit is 536b6126. The landed range (eb2db6a0, c5e53f6c, 525699d6) changes annotated-source prototype work, call-graph projection, typed Analysis Diff queries, and related CLI/query documentation. It shares no files with this PR and does not alter ReturnToSender composition, authored-corpus history, methodology, or fault attribution.

Post-merge local evidence at 536b6126: solution Release build clean; full decompiler suite 4,943 passed, with only the established macOS /var vs /private/var pin-path failure and one case-insensitive-filesystem skip.

[richlander]

Integrated origin/main through eb20768c; merge commit is a9d5691c. The only shared file was .github/workflows/ci.yml, with disjoint additions: this PR’s EVIL provenance step and main’s skills-only change-detection trigger. No conflict resolution changed either gate.

The landed enum-switch reconstruction (31f23c25) can change decompiler output, so I did not carry forward the prior suite result. Post-merge evidence at a9d5691c: solution Release build clean; full decompiler suite 4,962 passed of 4,964, with only the established macOS /var vs /private/var pin-path failure and one case-insensitive-filesystem skip. The Windows package-concurrency stabilization in the same range is unrelated to attribution behavior.

[richlander]

Final fixed-head re-review at a9d5691c produced one additional GPT-5.6 Sol finding; Gemini Pro was clean. GPT found that a closure-root-budget stop mutates live closure collections after compiling the failing artifact. The returned source was pre-growth, but the authored control recomposed from a request whose aliased collections were post-growth, so it could compile a larger shell and falsely report BodyDefect.

The finding was independently reproduced through ReturnToSender.CompileBackTargets: the literal returned shell failed with CS0246, the recomposed shell compiled, and fault attribution flipped from the correct ShellOrClosureDefect bucket to BodyDefect.

Commit d9721e125 threads the exact compiled unit into authored-body substitution for both recompile-failure and fidelity controls; no control recomposes its final shell. ClosureRootBudgetStop_AttributesTheShellNotTheBody builds 250 compiler-produced helper types and proves a budget stop remains ShellOrClosureDefect. Local evidence: focused class 12/12; RoundTrip 610/610; full decompiler suite 4,963 passed with only the established macOS /var vs /private/var failure and one filesystem skip; solution Release build clean. Round 11 remains open pending green exact-head CI and clean re-review of this fix.

[richlander]

Round 11 reconciliation at exact base eb20768c and head d9721e125:

• GPT-5.6 Sol found the assembly-identity mismatch; reproduced with an InternalsVisibleTo canary and fixed in 52c67ca6.
• GPT-5.6 Sol found authored-shell widening through recomputed unsafe/primary-constructor shape; reproduced with compiler-produced canaries and fixed in 77ae153c4 by literal body substitution.
• Gemini Pro found the identified-row methodology fallback bypass; reproduced through parser + ratchet and fixed in 77ae153c4.
• GPT-5.6 Sol found the closure-budget mutable-alias path; reproduced through CompileBackTargets with 250 helper roots and fixed in d9721e125 by threading the exact compiled shell.

Every blocking finding was reproduced before action and now has an outcome-level regression. Final fixed-head re-review: GPT-5.6 Sol clean; Gemini Pro clean. Exact-head ci-required passed, the PR is CLEAN/MERGEABLE, and origin/main remained at the reviewed base after both clean results.

Ready to merge

[richlander]

Readiness withdrawn. Final review exposed an ownership problem: SpanAttribution.TrySubstituteBody makes RTS parse and rewrite the C# artifact it compiles as evidence. That violates the intended boundary that product C# code owns construction/transformation while the harness only orchestrates and measures.

#3858 is now blocked on a focused product-side frozen-artifact/body-replacement capability and corresponding harness guidance. The existing attribution/provenance work will be retained; the harness rewrite will be removed before another fixed-head review.

[richlander]

Ownership remediation is now pushed at 50911ba50. The authored controls consume the exact final ProductArtifact and invoke the product-owned CSharpSourceArtifact.ReplaceBody; harness-side SpanAttribution.TrySubstituteBody and its Roslyn block parser are deleted.

The prior clean review at d9721e125 does not cover this architectural change. Merge readiness remains withdrawn pending the current-head EVIL census, exact-head CI, and a fresh fixed-head GPT-5.6 Sol + second-roster review.

[richlander]

Fresh review round 1 at 50911ba50 found one real product-seam defect:

• GPT-5.6 Sol (Medium): CSharpSourceArtifact.ReplaceBody reused line-oriented display layout, which removed blank lines, normalized CRLF, and prefixed indentation inside multiline verbatim/raw string tokens. The authored control could therefore compile a different literal value and misattribute a genuine body defect.
• Gemini Pro: clean on the ownership/data-flow review.

Fixed in 7bd0ae2ae: replacement now preserves the supplied authored body bytes verbatim between product-owned structural braces; initial display rendering remains unchanged. Added a direct CRLF/blank-line artifact regression and an IL-exact compiler-produced multiline verbatim-string fidelity control. C# tests: 322/322; RoundTrip: 611/611; solution build passes.

A controlled full-corpus A/B and exact-head CI are running. Both reviewers will re-review the fixed head; readiness remains withdrawn.

[richlander]

Fresh ownership-remediation review is clean at exact head 7bd0ae2ae224e52ea9cfed92dd689f4e9d91984b:

• GPT-5.6 Sol: CLEAN; verified the multiline lexical fix, exact frozen-artifact flow, directives/empty bodies, and absence of harness recomposition.
• Gemini Pro: CLEAN; independently verified byte-preserving replacement, exact final ProductArtifact flow, methodology-v3 partition closure, and floor exclusion.

Controlled 12,000-row A/B against pre-remediation parent cf14c4aac kept headline outcomes unchanged, classified all 38 previously unclassified frontier rows, and added exact control evidence to 291 invalid rows. The lexical fix changed zero classifications. Exact-head CI run 31439051307 passed, the PR is mergeable, and origin/main has not moved.

Ready to merge