fix(tests): the S0 control checks that the flag does not move the version

`tests/check_fix_candidates_facts.py` asserted `ownir_version == 0` under the
message "ownir_version must stay 0". What it meant is that `--fix-candidates`
is additive metadata and does not move the vocabulary version; what it checked
was a literal, which held only until the vocabulary first moved. OwnIR v1 moved
it, and the `C# leak extractor (Roslyn) -> OwnIR -> core` job went red on that
line — with the extractor doing exactly the right thing.

It now checks the claim: the flag-on facts are stamped with the core's current
OWNIR_VERSION, and with the same value as the flag-off facts.

This is the third control of this shape the bump has found (the validation
ledger in #383, the instrument's generated facts in this branch), and the only
one that needed the server to find it: the script takes the extractor's output
as its argument, so it is not part of `tests/run_tests.py` and no local run of
that suite could reach it. The job's steps were then run locally as written,
from this one to the end of the job, on a Linux clone of the committed tree.

tests/goldens/README.md records the golden's second amendment: one line,
`"ownir_version": 0` -> `1`, made in the vocabulary commit.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: PhysShell

tests/check_fix_candidates_facts.py

@@ -15,8 +15,13 @@
 
 import copy
 import json
+import os
 import sys
 
+sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), ".."))
+
+from ownlang.ownir import OWNIR_VERSION
+
 _ADDITIVE_COMPONENT_KEYS = (
     "qualified_name",
     "is_partial",
@@ -65,9 +70,15 @@ def check(cond: bool, msg: str) -> None:
         if not cond:
             fails.append(msg)
 
-    # Top-level: additive version present, ownir_version untouched.
+    # Top-level: additive version present, ownir_version untouched. "Untouched" is a
+    # claim about the FLAG, not about a number: `--fix-candidates` is additive metadata,
+    # so it must stamp the vocabulary version the core currently understands — the same
+    # one a flag-off run stamps (compared below, where the flag-off facts are in hand).
+    # This used to read `== 0`, which held only until the vocabulary first moved.
     check(on.get("fix_candidates_version") == 1, "top-level fix_candidates_version must be 1")
-    check(on.get("ownir_version") == 0, "ownir_version must stay 0")
+    check(on.get("ownir_version") == OWNIR_VERSION,
+          f"--fix-candidates must not move ownir_version: the facts are stamped "
+          f"{on.get('ownir_version')!r}, the core understands {OWNIR_VERSION}")
 
     def only_fix(name: str) -> dict | None:
         fx = _fixes(on, name)
@@ -226,6 +237,9 @@ def only_fix(name: str) -> dict | None:
     if off_path is not None:
         off = _load(off_path)
         check("fix_candidates_version" not in off, "flag-off: no fix_candidates_version")
+        check(on.get("ownir_version") == off.get("ownir_version"),
+              f"the flag moved ownir_version: {off.get('ownir_version')!r} without it, "
+              f"{on.get('ownir_version')!r} with it")
         for c in off.get("components", []):  # type: ignore[union-attr]
             check("qualified_name" not in c, f"flag-off: {c.get('name')} has qualified_name")
             for s in c.get("subscriptions") or []:

tests/goldens/README.md

@@ -31,6 +31,19 @@ The remaining 11 followed the same derivation, and run 30443181114 (job
 values are what the extractor actually emits, not just the dozen that had been read
 off a log. The file is a measured artifact again.
 
+**Amended a second time, by OwnIR v1.** The flow vocabulary gained `move` and
+`borrow_mut`, `OWNIR_VERSION` moved 0 → 1, and every producer stamps it. One line
+of this file changed — `"ownir_version": 0` became `"ownir_version": 1` — and
+nothing else: no record, no key, no order. That is again the "intentional
+alteration by an unrelated extractor change" case, and again the file is the
+`ff21d4a` output plus documented deltas rather than a re-recording.
+
+The same bump found a control that had confused the two things this gate keeps
+apart. `tests/check_fix_candidates_facts.py` asserted `ownir_version == 0` under
+the message "must stay 0", meaning "the flag does not move the version" but
+checking a literal. It now checks what it meant: the flag-on facts carry the
+core's current `OWNIR_VERSION`, and the same one as the flag-off facts.
+
 ### Regenerating (only when an unrelated extractor change intentionally alters this sample's facts)
 
 ```bash