fix(roslyn): a region opened inside the protocol's own types is refused, not skipped

The types that declare a protocol are trusted: their bodies implement it and
are not lowered. The lowering skipped every method of such a type — including
one that USES the protocol. A handler written in the same class as the region
entry it calls was therefore never analysed, and read as clean:

    public static class ParcelHandlers
    {
        [ProtocolRegion] public static void WithPacked(...) => ...;

        public static void Dispatch(Parcel parcel)
        {
            WithPacked(parcel, packed => { packed.Send(); packed.Send(); });
        }
    }

Before: exit 0, no function emitted, verdict clean — a token spent twice.
After: exit 2. Trusted is not the same as checked, and an unanalysed region
must not read as a clean one. The remedy is in the message: use the protocol
from outside the types that declare it.

Found while probing what an unrelated attribute that merely shares the name
[ProtocolRegion] does to a scan. refused/R15 pins it; no committed fact moves
(18 cases, 15 refused, 0 failures), and the extractor's output on every C#
sample CI scans is still equal to main's, 122 of 122.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: PhysShell

frontend/roslyn/OwnSharp.Extractor/ProtocolLowering.cs

@@ -117,7 +117,17 @@ public static Result Lower(Compilation compilation,
                 if (model.GetDeclaredSymbol(method) is not IMethodSymbol msym)
                     continue;
                 if (IsApiType(msym.ContainingType))
-                    continue;   // the protocol API itself: its tokens' own bodies are not user code
+                {
+                    // The protocol's own types are TRUSTED: their bodies implement the
+                    // protocol and are not lowered. So a region OPENED in one of them — a
+                    // handler written next to the region entry it calls — would never be
+                    // analysed and would read as clean. Trusted is not the same as checked.
+                    foreach (var opened in method.DescendantNodes().OfType<InvocationExpressionSyntax>()
+                                 .Where(i => IsRegionEntry(MethodOf(model, i))))
+                        refusals.Add(At(file, opened,
+                            $"a protocol region is opened inside '{msym.ContainingType.Name}', one of the protocol's own types: code there implements the protocol and is not analysed, so this region would read as clean. Use the protocol from outside the types that declare it"));
+                    continue;
+                }
                 try
                 {
                     foreach (var p in msym.Parameters)

frontend/roslyn/README.md

@@ -135,6 +135,10 @@ not skipped: the extractor exits `2` and writes no facts, for the whole scan.
   `nameof`, `typeof` and reads are mentions, not operations.
 - *Source.* The protocol and its entity must be in the scan as source; one that
   arrives only as a compiled reference cannot be admitted.
+- *Trusted types.* The types that declare a protocol (the tokens, the class
+  holding a region entry) implement it and are not analysed as user code. A
+  region opened inside one of them is refused rather than skipped: write the
+  code that uses a protocol outside the types that declare it.
 - *Binding.* The scan does not read `obj/`, so usings a project only gets
   **implicitly** are not there. A region whose entity does not bind is refused;
   write the usings out in the files that open regions (or qualify the names).

frontend/roslyn/protocol-samples/refused/R15_region_opened_inside_protocol_type.cs.txt

@@ -0,0 +1,41 @@
+using System;
+using Own.Protocols.Sample;
+
+namespace Own.Protocols.Cases;
+
+// The types that DECLARE a protocol are trusted: their bodies are the protocol, and the
+// lowering does not read them as user code. A handler written in the same class as the
+// region entry it calls would therefore never be analysed — and this one spends a token
+// twice. It is refused, not skipped: an unanalysed region must not read as a clean one.
+public sealed class Parcel
+{
+    public bool Sent { get; private set; }
+
+    internal void MarkSent() => Sent = true;
+}
+
+[ProtocolToken]
+public readonly ref struct PackedParcel
+{
+    private readonly Parcel _parcel;
+    internal PackedParcel(Parcel parcel) => _parcel = parcel;
+
+    public void Send() => _parcel.MarkSent();
+}
+
+public delegate void PackedParcelRegion(PackedParcel packed);
+
+public static class ParcelHandlers
+{
+    [ProtocolRegion]
+    public static void WithPacked(Parcel parcel, PackedParcelRegion body) => body(new PackedParcel(parcel));
+
+    public static void Dispatch(Parcel parcel)
+    {
+        WithPacked(parcel, packed =>
+        {
+            packed.Send();
+            packed.Send();           // a stale token: OWN002 anywhere else
+        });
+    }
+}

frontend/roslyn/protocol-samples/refused/expected.json

@@ -4,6 +4,7 @@
   "R12_default_token_temporary": "a protocol token 'ApprovedOrder' is created outside the protocol's own types",
   "R13_public_mutator_reaches_protocol_state": "'Doc.Publish' is public and writes 'Published', state the protocol's transitions own",
   "R14_public_setter_of_protocol_state": "'Ticket.State' is public and writes 'State', state the protocol's transitions own",
+  "R15_region_opened_inside_protocol_type": "a protocol region is opened inside 'ParcelHandlers', one of the protocol's own types",
   "R1_default_token": "has no lowerable origin",
   "R2_token_outside_region": "is declared outside a protocol region",
   "R3_return_inside_region": "`return` inside a protocol region",