docs: field-note ledger for the post-D5.4-step-2 Polly oracle re-run

[PhysShell]

Что и зачем

Добавляет в docs/notes/field-notes-patterns.md запись 7 — журнал прогона (только документация) для повторного oracle-прогона Polly после D5.4 step 2 (ctor-adopt alias_join). Файл сам требует записывать триаж oracle-only находок каждого прогона; это закрывает требование для step-2 re-run и фиксирует, что новая эмиссия alias_join осталась точной (own-only-0 на реальном коде).

Записанный результат: бакеты без изменений — Own.NET 0 / Agree 0 / Own.NET-only 0 / oracle-only 16; все 16 разложены на существующие записи (11 TimedLock struct-using → запись 4, 1 strategy-ctor → 1/2, 2 BulkheadSemaphoreFactory → 1, 1 callback-CTS → 2, 1 pooled-CTS → 3), каждая — oracle FP или by-design. Зафиксирована граница recall: BulkheadSemaphoreFactory — это отложенная форма T4b (factory-returns + store-in-owning-field), а не construction-site ctor-adopt из step 2, поэтому step 2 корректно молчит, и пометить их было бы ложным срабатыванием. Диспозиции сверены с закреплённым исходником App-vNext/Polly@976983f.

Тип изменения

• docs — документация

Как проверено

• изменение только в .md; поведение анализатора не меняется
• арифметика журнала сверена с отчётом oracle (11+1+2+1+1 = 16) и с исходником Polly (пофайловая разбивка TimedLock)
• python tests/run_tests.py — не требуется (нет изменений кода)

Связанные issue

Нет связанного issue. Refs: D5.4 step 2 (PR #137), docs/notes/d5-ownership-transfer.md §7/§11.

Чеклист

• изменение покрыто тестом/селфтестом (или объяснено, почему нет) — N/A: документация; журнал сверен с источником
• README/docs обновлены при необходимости — это и есть docs-обновление (требуемое правилом сопровождения oracle)
• коммиты в conventional-commit стиле (docs:)

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fmwk5ruExKy5fQ77CJ2NtF

[coderabbitai]

📝 Walkthrough

Walkthrough

Refines one notebook entry on struct-based scoped locks and adds a new run ledger for a Polly oracle re-run, including alias_join counts, oracle-only finding mappings, and updated attribution for the remaining Infer# report.

Changes

Notebook note updates

Layer / File(s)	Summary
Scoped-lock attribution update docs/notes/field-notes-patterns.md	The struct-based scoped-lock entry changes from 12 to 11, and the extra Infer# resource-leak report is attributed to a separate strategy-constructor allocation entry.
Run ledger entry 7 docs/notes/field-notes-patterns.md	A new run ledger records the Polly D5.4 step 2 oracle re-run, the alias_join audit record, bucket counts, the 16 oracle-only finding mappings, and the step-2 recall boundary.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• PhysShell/Own.NET#110: Introduces the notebook and maintenance flow that this PR later refines with a scoped-lock attribution correction and a new run ledger.

Poem

I hopped through the notes by moonlit light,
nibbling ledger leaves so neat and white.
One lock, one ledger, a tidy trail,
alias_join twinkled in the audit tale.
🐇 Thump! The notebook gleams tonight.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the docs-only Polly oracle re-run ledger.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description matches the required template and includes the change, type, verification, issue references, and checklist.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/agenda-2rufsj

---

_{Comment @coderabbitai help to get the list of available commands.}

[PhysShell]

Triage detail behind this ledger

Both CodeQL oracle-only findings that aren't already covered by the struct-using/factory entries were checked against the pinned Polly source (App-vNext/Polly@976983f), not just the SARIF text — and both are oracle false positives Own.NET correctly stays silent on (own-only-0 holds):

ConfigureBuilderContextExtensions.cs:40 — CodeQL cs/local-not-disposed → FP. The CancellationTokenSource is disposed via a registered lifecycle callback; disposal responsibility is transferred to the pipeline (the authors even suppress it):

#pragma warning disable CA2000
var source = new CancellationTokenSource();
context.AddReloadToken(source.Token);
context.OnPipelineDisposed(() => { registration?.Dispose(); source.Dispose(); });

CodeQL doesn't follow the lambda capture into the registration. Flagging it would be a false positive → entry 2.

TimeoutResilienceStrategy.cs:67 — CodeQL cs/dispose-not-called-on-throw → FP/by-design. It's a pool rental, not a new: _cancellationTokenSourcePool.Get(timeout) released by _cancellationTokenSourcePool.Return(...) after a try { await callback... } catch (Exception) { ... }. The catch-all swallows the throwing await, so Return is reached; worst case is "not returned to the pool" (GC reclaims), not a hard leak → entry 3.

Why nothing is fixable here without an FP. The two CodeQL BulkheadSemaphoreFactory findings are the factory-returns + store-in-an-owning-field shape (deferred T4b) — the semaphores are owned by BulkheadPolicy and disposed in its Dispose(), so they are not leaks; step 2's construction-site ctor-adopt correctly doesn't touch them. The remaining 12 Infer# findings are the TimedLock struct-using over-report. So all 16 oracle-only are oracle noise or by-design, and own-only-0 on Polly is principled.

Recall boundary for next time: the evidence-backed lever for this family is the deferred field-store-to-this adopt, not anything in step 2's scope — and even that wouldn't move Polly (we're already correctly silent), so its value is recall on other codebases.

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 24081a2d82

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reconcile the oracle-only total

This ledger claims there are 16 oracle-only findings, but the newly added table totals 17 findings (12 TimedLock + 1 strategy ctor + 2 Bulkhead + 1 callback CTS + 1 pooled CTS). Since this note is the required audit record for the run, either the bucket total or one row/count is wrong, leaving readers unable to tell which findings were actually present.

Useful? React with 👍 / 👎.