Research: Cilica-style analysis invalidation and pass verification for OwnIR (bounded spike) #456

Classification

• Type: bounded research / architecture donor review
• Priority: P3 backlog; no production implementation authorized
• Source: hez2010/Cilica, its IR/API walkthrough and pass list (experimental; continuation of DistIL)
• Own.NET area: Roslyn extraction → OwnIR → Rust dataflow/ownership solver → diagnostics/evidence
• Related: Research: mine G# for reusable CFG/dataflow/analyzer patterns #365 (generic CFG/dataflow donor review), Research: SootUp-inspired OwnIR/ICFG semantic-fidelity and incomplete-call audit (bounded spike) #430 (source→OwnIR fidelity), Research: evaluate LLZK dataflow lattices, SourceRef and IR validators #444 (IR validators), Research: refactoring-aware metamorphic regression testing for ownership analysis (RefactoringMiner prior art) #432 (refactoring-aware metamorphic tests), Research: semantic mutation testing harness for Own.NET analyzer coverage (bounded pilot) #405 (existing mutation harness).

Why this might matter

Cilica is a post-build IL optimizer, not an ownership analyzer. Its useful prior art is an engineering contract around transformations of an SSA-based IR, specifically:

1. Analysis dependency tracking / invalidation. Its MethodTransformContext.GetAnalysis<T>() caches analyses, records dependencies and invalidates affected results on instruction edits/method revisions.
2. Pass manager and invariants. PassRunner.Run(), CompilationPipeline.CreateDefault() and VerifyEachPass coordinate mutation, verification and inspection.
3. CFG and SSA integrity under rewrites. Dedicated graph edit methods (ReplaceTerminator(), RedirectEdge()) maintain phi inputs; import/code generation form explicit transformation boundaries.
4. Controlled failure/completeness. Its compilation distinguishes unchanged / optimized / unsupported / failed methods; failed methods keep original bodies, and --strict can prevent saving on failure. This suggests a useful comparison with Own.NET's separate unknown/incomplete versus clean analysis outcomes.

The question is not whether to optimize IL in Own.NET. It is whether a small, demonstrably useful change/invalidation/verification contract would prevent a real Own.NET regression or simplify an existing fragile analysis path.

Bounded investigation (read-only / kill-first)

• Pin the exact revisions of Own.NET and Cilica; inspect upstream implementation and tests rather than relying on feature descriptions.
• Inventory current equivalents in Own.NET: Roslyn CFG/semantic extraction, OwnIR representation and validators, Rust solver/pass invocation, caching/recomputation, provenance/source locations and existing fixtures. Record what is already solved.
• Compare at most three concrete mechanisms: (a) revisions and dependency-based invalidation, (b) post-pass structural verification, (c) pass failure vs incomplete/unknown semantics. For each, identify exact upstream code/tests and current Own.NET counterpart.
• Reuse Research: semantic mutation testing harness for Own.NET analyzer coverage (bounded pilot) #405/Research: SootUp-inspired OwnIR/ICFG semantic-fidelity and incomplete-call audit (bounded spike) #430 fixtures and traces. If and only if a plausible gap exists, design one minimal read-only regression/reproducer: edit/replace a fact or edge that should invalidate a dependent conclusion; test a changed/unrelated fact and a negative control. Consider ownership-sensitive paths (aliases, event subscription cleanup, conditional/exceptional disposal) without adding new diagnostics or a standalone harness.
• Evaluate semantic boundaries explicitly: Cilica IR verification checks its own invariants, not C#→OwnIR fidelity, observational equivalence, or ownership-soundness. Do not assume SSA, devirtualization, or IL-level optimization preserves the source evidence chain relevant to Own.NET.
• Produce a compact decision table: mechanism | Cilica implementation | Own.NET equivalent | demonstrated failure/cost | borrow small idea / defer / reject. Require a reproducible defect or maintainability win before proposing any code.

Non-goals

• Do not adopt Cilica/DistIL as an Own.NET dependency, replace Roslyn/OwnIR or the Rust solver, convert the project into an IL optimizer, or redesign its analysis pipeline for aesthetic consistency.
• Do not duplicate generic CFG, alias algorithms, verifier or mutation-framework work from Research: mine G# for reusable CFG/dataflow/analyzer patterns #365/Research: SootUp-inspired OwnIR/ICFG semantic-fidelity and incomplete-call audit (bounded spike) #430/Research: evaluate LLZK dataflow lattices, SourceRef and IR validators #444/Research: semantic mutation testing harness for Own.NET analyzer coverage (bounded pilot) #405.
• Do not claim proof of semantic preservation from VerifyEachPass. Treat upstream's experimental status and potential API churn as adoption risks.
• No production patch or broad benchmark initiative in this issue.

Exit criteria

Close as BORROW / DEFER / REJECT with cited source locations and a short evidence table. REJECT/no-action is a valid successful outcome if Own.NET already provides equivalent guarantees, or if no actual failure/maintenance benefit can be shown. Any implementation requires a separate, narrowly scoped issue and a test that fails before the change.