Program.cs

// OwnSharp OwnIR extractor (P-001 v0).
//
// Scans C# and emits OwnIR facts (JSON) in the OwnLang spec's vocabulary; the
// Python core (`python -m ownlang ownir facts.json`) produces the verdict
// (OWN001 leak) at the C# location.
//
// Event subscriptions are resolved type-aware (P-014 Tier A): all inputs are
// parsed into ONE CSharpCompilation with the runtime's framework references, and
// a `target += handler` is a subscription only when the SemanticModel binds the
// left side to an event symbol — so `sum += value` (arithmetic) is not a leak.
// When the left side's declaring type is an unresolved external reference we do
// not guess: a handler-shaped RHS surfaces as an OWN050 "leakage analysis
// skipped" note, never a leak. A subscription is "released" by a matching
// `target -= handler` in a recognised TEARDOWN CONTEXT of the class (#278:
// Dispose/DisposeAsync/OnClosed/Unloaded-style methods, a handler wired in code
// to the class's own Closed/Unloaded-style lifecycle event, or a method/local
// function the teardown path provably calls intra-class, symbol-resolved) that
// is not guarded by a parameter of its enclosing method — a `-=` in an
// arbitrary method, a finalizer, an unwired lambda, an uncalled local function,
// or behind a caller-controlled flag, is not proven to run and keeps the honest
// warning.
// A `Tick`/`Elapsed` handler is tagged resource=timer (WPF002) and is released
// only by a `.Stop()` on the timer's receiver that is PROVEN to run at teardown
// (the same teardown/guard doctrine as the `-=` above — an arbitrary-method,
// finalizer, unwired-handler or parameter-guarded Stop() credits nothing).
// The IDisposable/pool/local detectors remain syntactic for now
// (P-014 rollout: the event fact goes type-aware first).
//
// Usage: ownsharp-extract [extract] <file.cs | dir | *.csproj | *.sln> [more ...] [-o|--out facts.json]
//        ownsharp-extract extract --project App.csproj --out facts.json
//        ownsharp-extract --solution App.sln
//
// `extract` is an optional leading verb (the tool's one job); the bare form is the
// default. The sibling `check`/`explain` verbs are NOT here — `check` is the
// own-check orchestrator that chains this + the core, and `explain` is `python -m
// ownlang explain OWN001`. One checker: the C# tool only emits facts.
//
// Inputs may be .cs files, directories, a .csproj, or a .sln. A directory is walked
// recursively for *.cs, skipping build output (bin/obj), VCS/vendor dirs (.git,
// node_modules) and generated files (*.g.cs, *.Designer.cs) — so you can point it at a
// whole repo (this is what the `own-check` script / GitHub Action do). A .csproj resolves
// to its source set (SDK-style directory scan + concrete linked <Compile> files; no full
// MSBuild evaluation — see ProjectCsFiles); a .sln fans out over its member projects.

using System.Text;
using System.Text.Json;
using System.Text.RegularExpressions;
using System.Xml.Linq;
using Microsoft.CodeAnalysis;
using Microsoft.CodeAnalysis.CSharp;
using Microsoft.CodeAnalysis.CSharp.Syntax;

var rawInputs = new List<string>();
string? outPath = null;
// H0 heap-effect source facts: written to THIS file, never into the facts document.
string? heapEffectsPath = null;
// --ref-dir <dir> (repeatable, P-014 Tier B): widen the compilation's reference set with the
// DLLs under <dir>, searched RECURSIVELY — point it at a project's built `bin/` output (or a
// restored package's `lib/`) and the SemanticModel can then bind events on third-party types
// (DevExpress, etc.) instead of surfacing them as OWN050. The first-class, scriptable twin of the
// OWN_EXTRA_REF_DIRS env var (which stays non-recursive, for framework ref packs). Roslyn reads
// metadata only, so it resolves a .NET Framework `bin/` exactly as a modern-.NET one — only the
// DLLs differ. First simple-name wins, so a TPA/framework reference is never double-added.
var refDirs = new List<string>();
// P-035: the project-declared weak-subscribe wrapper API, as exact
// (containing-type simple name, method name) pairs. Populated ONLY from the
// `--weak-subscribe` transport flag (own-check.sh forwards `[weak-subscription].
// subscribe` from own.toml). Empty set => the detector below is inert and facts
// are byte-for-byte unchanged. A data allowlist, never an inference.
var weakSubscribe = new HashSet<(string Type, string Method)>();
// Event-subscription detection is on by default now that it is type-aware
// (P-014 Tier A graduates it from the interim off). `--no-event-leaks` opts out
// (e.g. to run only the disposable/pool detectors); it is the first instance of
// the broader check-selection surface tracked in P-015.
bool emitEvents = true;
// --fix-candidates (S0, internal, default off): emit ADDITIVE fix-candidate metadata
// for the `own-fix subscriptions candidates` collector — a namespaced `fix` block on
// each eligible `+=` subscription fact, a `qualified_name` + type-shape metadata on the
// component, and a top-level `fix_candidates_version`. STRICTLY additive: with the flag
// OFF the facts JSON is byte-for-byte identical (no `fix`, no `qualified_name`, no
// `fix_candidates_version`), and `ownir_version` is unchanged either way. It changes NO
// existing field and NOT the `released` computation — only new optional metadata.
bool emitFixCandidates = false;
// --flow-locals (P-016 B0b/B2, EXPERIMENTAL, default off): emit per-method flow
// facts for non-escaping local IDisposables (acquire/use/release/if/return over a
// CFG) so the core checks them path-sensitively (OWN001/002/003). Supersedes the
// flat D1 local-disposable detector when on. Default off keeps the shipped surface.
bool flowLocals = false;
// --stats (coverage): print a one-line flow-locals coverage summary to stderr
// (of the methods that have a disposable local worth checking, how many were
// flow-analysed vs honestly skipped for an unmodelled construct) and stamp the
// same counts into the facts JSON. Turns "0 findings" into "clean vs didn't-reach".
bool reportStats = false;
// --no-project-refs: opt out of the automatic reference derivation below. By default, when an
// input is a `.csproj`/`.sln`, the project's built `bin/` output (if present) is auto-added to
// the reference set — the scriptable `--ref-dir` you'd otherwise pass by hand — so third-party
// events on a restored/built project bind to real symbols instead of surfacing as OWN050. This
// flag turns that off (e.g. to measure raw Tier-A coverage, or when bin/ is stale).
bool noProjectRefs = false;
// --body-throw-edges (opt-in, P-016 throw tier): also treat an ESCAPING body-level may-throw
// call/`new` (not only those inside a `try`) as a dispose-not-called-on-throw point — CodeQL
// cs/dispose-not-called-on-throw parity. OFF by default: it is the CA2000 firehose (flags even
// harmless MemoryStream/StringWriter dispose-on-throw), so the shipped posture stays low-FP; the
// oracle turns it on to measure full recall. Read deep in InjectThrowEdge via the static
// Program.BodyThrowEdges (declared at end of file) rather than threaded through the flow recursion.
// Reset the static field up front so a flag from a prior IN-PROCESS invocation can't leak into a
// run that did not request it (the other config — emitEvents/flowLocals/reportStats — are locals,
// re-initialized each call, so they need no reset; only this static one does). CodeRabbit.
BodyThrowEdges = false;
// #240 (review P2): WeaverOwnedFiles is the other process-global mutable state — a file recorded
// as belonging to a Fody-enabled project must not stay "weaver-owned" for an unrelated later
// invocation in the same process (a sticky false positive). Same reset discipline as above.
WeaverOwnedFiles.Clear();
// `extract` verb: the tool's one job is extraction, so an optional leading `extract`
// makes the advertised `ownsharp-extract extract --project App.csproj --out facts.json`
// UX real while the bare form (no verb) stays the default and back-compatible. (The
// sibling `check`/`explain` verbs live where the architecture puts them — `check` is the
// own-check orchestrator, `explain` is `python -m ownlang explain`; the C# tool is not a
// second checker.) A different first token (a path/flag) is left untouched as input.
var args0 = args.Length > 0 && args[0] == "extract" ? args[1..] : args;
// `-h` / `--help`: print the full usage (commands, inputs, options) and exit 0. A discoverable
// CLI is the value the roslyn-tools `System.CommandLine` shape buys; we render it by hand (no
// preview dependency) rather than adopt the framework — the surface is small and stable.
const string UsageText = """
ownsharp-extract — emit OwnIR leak facts from C# for the Own.NET core to check.

Usage:
  ownsharp-extract [extract] <input>... [options]

`extract` is an optional leading verb (the tool's one job; the bare form is the default).
The sibling verbs live elsewhere by design — `check` is scripts/own-check.sh (extractor +
core), `explain` is `python -m ownlang explain OWN001`. One checker: this tool only emits facts.

Inputs (any mix; positional, or via --project/--solution):
  file.cs            a single C# file
  dir                a directory, walked recursively (skips bin/obj, generated, vendor)
  App.csproj         a project — resolved to its source set (no MSBuild evaluation)
  App.sln            a solution — fans out over its member projects

Options:
  -o, --out FILE     write the OwnIR facts JSON to FILE (default: stdout)
  --project FILE     add a .csproj input (flag twin of the positional form)
  --solution FILE    add a .sln input
  --ref-dir DIR      add DIR's DLLs (recursively) to the reference set, so third-party
                     events bind to real symbols instead of OWN050 (repeatable)
  --weak-subscribe T.M  internal transport (repeatable): a declared weak-subscribe
                     wrapper "SimpleType.Method" (P-035). Pass it via own-check
                     --config own.toml, not by hand; own.toml is the public surface.
  --no-project-refs  don't auto-add a .csproj/.sln project's bin/ output to the references
  --no-event-leaks   skip event-subscription detection (run only disposable/pool detectors)
  --fix-candidates   emit additive S0 fix-candidate metadata (namespaced `fix` block +
                     component `qualified_name`/shape + top-level `fix_candidates_version`);
                     facts are byte-identical without it, `ownir_version` unchanged
  --flow-locals      path-sensitive flow analysis of non-escaping local IDisposables
  --stats            print flow-locals coverage (requires --flow-locals)
  --body-throw-edges treat escaping body-level may-throw as a dispose-on-throw point (needs --flow-locals)
  --heap-effects FILE  also write heap-effect source facts (H0, inert) to FILE; the facts
                     document is byte-identical with or without it
  -h, --help         show this help and exit
""";
if (args0.Contains("-h") || args0.Contains("--help"))
{
    Console.WriteLine(UsageText);
    return 0;
}
for (int i = 0; i < args0.Length; i++)
{
    // `--out FILE` is the long-form twin of `-o FILE` (the advertised `extract --out` UX).
    if ((args0[i] == "-o" || args0[i] == "--out") && i + 1 < args0.Length) outPath = args0[++i];
    // `--project <App.csproj>` / `--solution <App.sln>`: the explicit-flag twin of passing the
    // project/solution as a positional input (both resolve through Expand). The flag form matches
    // the advertised `ownsharp extract --project ...` UX borrowed from the roslyn-tools CLI shape;
    // the positional form keeps the command unambiguous next to dotnet's own `run --project`.
    else if ((args0[i] == "--project" || args0[i] == "--solution") && i + 1 < args0.Length) rawInputs.Add(args0[++i]);
    else if (args0[i] == "--ref-dir" && i + 1 < args0.Length) refDirs.Add(args0[++i]);
    // P-035 transport flag (repeatable): "SimpleType.Method" — one declared weak-
    // subscribe wrapper. own.toml is parsed/validated by the Python config carrier
    // (own-check.sh); this only splits the already-validated pair.
    else if (args0[i] == "--weak-subscribe" && i + 1 < args0.Length)
    {
        var parts = args0[++i].Split('.');
        if (parts.Length == 2 && parts[0].Length > 0 && parts[1].Length > 0)
            weakSubscribe.Add((parts[0], parts[1]));
    }
    else if (args0[i] == "--no-project-refs") noProjectRefs = true;
    else if (args0[i] == "--no-event-leaks") emitEvents = false;
    else if (args0[i] == "--fix-candidates") emitFixCandidates = true;
    else if (args0[i] == "--flow-locals") flowLocals = true;
    else if (args0[i] == "--body-throw-edges") BodyThrowEdges = true;
    else if (args0[i] == "--stats") reportStats = true;
    else if (args0[i] == "--heap-effects" && i + 1 < args0.Length) heapEffectsPath = args0[++i];
    else rawInputs.Add(args0[i]);
}

if (rawInputs.Count == 0)
{
    Console.Error.WriteLine("usage: ownsharp-extract [extract] <file.cs | dir | *.csproj | *.sln> [...] [-o|--out facts.json] [--ref-dir <bin-dir>]");
    Console.Error.WriteLine("       ownsharp-extract --help   for the full option list");
    return 2;
}

// --stats reports flow-locals coverage; the counters only move inside the
// --flow-locals pass. Without it they would all be zero and the summary would
// read "0/0 methods flow-analysed" — the exact ambiguous zero --stats exists to
// kill (e.g. `own-check.sh --legacy --stats`). Refuse the contradictory combo.
if (reportStats && !flowLocals)
{
    Console.Error.WriteLine("ownsharp-extract: --stats requires --flow-locals");
    return 2;
}

// --body-throw-edges only injects edges during the --flow-locals pass; without it it is a no-op.
// Warn (non-fatal) rather than fail — it is an additive recall knob layered on flow, not a mode.
if (BodyThrowEdges && !flowLocals)
    Console.Error.WriteLine("ownsharp-extract: --body-throw-edges has no effect without --flow-locals");

// A path segment we never scan: build output, VCS, and vendored trees.
static bool IsSkippedDir(string seg) =>
    seg is "bin" or "obj" or ".git" or ".vs" or "node_modules" or "packages";

// Generated C# the author did not write (and cannot fix): skip it.
static bool IsGenerated(string path) =>
    path.EndsWith(".g.cs", StringComparison.Ordinal)
    || path.EndsWith(".Designer.cs", StringComparison.Ordinal)
    || path.EndsWith(".AssemblyInfo.cs", StringComparison.Ordinal);

static bool IsSkipped(string path)
{
    foreach (var seg in path.Split('/', '\\'))
        if (IsSkippedDir(seg)) return true;
    return IsGenerated(path);
}

// Translate an MSBuild item spec (a path, optionally with `*`, `?`, `**` globs and either
// separator) into a predicate over a full file path, evaluated RELATIVE to the project dir.
// Enough for the common `<Compile Include>` / `<Compile Remove>` forms (a concrete path, `*.cs`,
// `**/*.cs`, `Folder/**`) without a full MSBuild glob engine: `**` matches across directories,
// `*` / `?` within a single path segment. Match is case-insensitive (MSBuild globbing is).
static Func<string, bool> SpecMatcher(string spec, string dir)
{
    var glob = spec.Replace('\\', '/').Trim();
    var rx = new StringBuilder("^");
    for (int i = 0; i < glob.Length; i++)
    {
        var c = glob[i];
        if (c == '*')
        {
            if (i + 1 < glob.Length && glob[i + 1] == '*')       // `**` -> any chars, including '/'
            {
                rx.Append(".*");
                i++;
                if (i + 1 < glob.Length && glob[i + 1] == '/') i++;   // swallow the slash after `**`
            }
            else rx.Append("[^/]*");                              // `*` -> within one path segment
        }
        else if (c == '?') rx.Append("[^/]");
        else rx.Append(Regex.Escape(c.ToString()));
    }
    rx.Append('$');
    // `.csproj` content is untrusted in CI, and adjacent wildcards (`**/**`, `**/*`) translate to
    // ambiguous adjacent quantifiers the backtracking .NET engine can blow up on (ReDoS). Bound the
    // match with a timeout, and treat a timeout as "no match" rather than letting it crash the run.
    var regex = new Regex(rx.ToString(), RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1));
    return path =>
    {
        var rel = Path.GetRelativePath(dir, path).Replace('\\', '/');
        try { return regex.IsMatch(rel); }
        catch (RegexMatchTimeoutException)
        {
            Console.Error.WriteLine($"ownsharp-extract: glob match timed out for '{spec}' on '{rel}'; treated as no match");
            return false;
        }
    };
}

// Resolve a `.csproj` to its C# source set. Doing this the MSBuild way needs a full
// project evaluation (and the `Microsoft.CodeAnalysis.Workspaces.MSBuild` + MSBuildLocator
// dependency that P-014 / the "ProjectDependencies as a category" note deliberately parks
// for the DI/solution-graph work — not for the v0 leak extractor). The pragmatic resolution
// that covers the SDK-style common case WITHOUT that baggage:
//   - candidates = every in-tree *.cs (SDK default-compile-items), with bin/obj and generated
//     files already excluded by IsSkipped;
//   - but honour the project's explicit compile set: `<EnableDefaultCompileItems>false` turns the
//     default OFF (then only files an explicit `<Compile Include>` selects are kept), and
//     `<Compile Remove="...">` subtracts excluded files — so `.csproj` input does not emit findings
//     from files the project does not actually compile (CodeRabbit: a source-set mismatch, not a
//     harmless over-approximation);
//   - plus any concrete linked `<Compile Include="..\Shared\Foo.cs" />` that points OUTSIDE the tree.
// Include/Remove globs are matched by SpecMatcher (not a full MSBuild engine, but enough for the
// common forms). Builds a list rather than yielding so the XML read can sit in a try/catch (an
// iterator may not yield from inside one); a malformed project degrades to the plain directory scan.
static List<string> ProjectCsFiles(string csproj, EnumerationOptions opts)
{
    var full = Path.GetFullPath(csproj);
    var result = new List<string>();
    // A missing project file must NOT degrade to "scan its parent directory": a typo'd
    // `--project src/Missing.csproj` would otherwise analyse all of src/**/*.cs (an
    // unintended source set), or throw if the parent is absent too. Skip the bad input with
    // a warning — the directory-scan fallback below is only for a PRESENT-but-malformed
    // project (whose <Compile> items we could not read), never an absent one. (Codex P2.)
    if (!File.Exists(full))
    {
        Console.Error.WriteLine($"ownsharp-extract: project not found: {csproj}");
        return result;
    }
    var dir = Path.GetDirectoryName(full) ?? ".";

    XDocument? doc = null;
    try { doc = XDocument.Load(full); }
    catch (Exception ex)
    {
        Console.Error.WriteLine(
            $"ownsharp-extract: {csproj}: reading <Compile> items failed ({ex.Message}); used directory scan only");
    }
    var elements = (doc?.Descendants() ?? Enumerable.Empty<XElement>()).ToList();

    // `<EnableDefaultCompileItems>false</…>` (last value wins, as MSBuild evaluates top-to-bottom)
    // turns off the implicit "every *.cs is compiled" default.
    var defaultItems = elements
        .Where(e => e.Name.LocalName == "EnableDefaultCompileItems")
        .Select(e => e.Value.Trim())
        .LastOrDefault();
    var defaultCompile = !string.Equals(defaultItems, "false", StringComparison.OrdinalIgnoreCase);

    var includes = elements.Where(e => e.Name.LocalName == "Compile")
        .Select(e => e.Attribute("Include")?.Value)
        .Where(v => !string.IsNullOrWhiteSpace(v)).Select(v => v!).ToList();
    var removes = elements.Where(e => e.Name.LocalName == "Compile")
        .Select(e => e.Attribute("Remove")?.Value)
        .Where(v => !string.IsNullOrWhiteSpace(v)).Select(v => v!).ToList();

    var candidates = Directory.EnumerateFiles(dir, "*.cs", opts).Where(f => !IsSkipped(f)).ToList();
    if (defaultCompile)
        result.AddRange(candidates);
    else
    {
        // Explicit-list project: keep only in-tree files an `<Compile Include>` selects.
        var incMatch = includes.Select(s => SpecMatcher(s, dir)).ToList();
        result.AddRange(candidates.Where(f => incMatch.Any(m => m(f))));
    }

    // Concrete linked `<Compile Include>` that points OUTSIDE the project tree, in either mode.
    var dirPrefix = dir.EndsWith(Path.DirectorySeparatorChar) ? dir : dir + Path.DirectorySeparatorChar;
    foreach (var inc in includes)
    {
        if (inc.IndexOfAny(new[] { '*', '?' }) >= 0) continue;            // a glob — handled above / by the scan
        var path = Path.GetFullPath(Path.Combine(dir, inc.Replace('\\', Path.DirectorySeparatorChar)));
        if (path.EndsWith(".cs", StringComparison.OrdinalIgnoreCase)
            && File.Exists(path) && !IsSkipped(path)
            && !path.StartsWith(dirPrefix, StringComparison.Ordinal))    // in-tree links already added
            result.Add(path);
    }

    // Honour `<Compile Remove="...">`: drop excluded files (concrete or glob, relative to the dir).
    if (removes.Count > 0)
    {
        var rmMatch = removes.Select(s => SpecMatcher(s, dir)).ToList();
        result.RemoveAll(f => rmMatch.Any(m => m(f)));
    }

    // #240: if THIS project is weaver-enabled (FodyWeavers.xml in its directory or above),
    // EVERY file it compiles — including linked sources outside its tree — is weavable at
    // build time; record them so the empty-Dispose kill-switch sees past the file's own path.
    if (AncestorsHaveWeaverConfig(dir))
        foreach (var f in result)
            WeaverOwnedFiles.Add(Path.GetFullPath(f));

    return result.Distinct().ToList();
}

// Extract the double-quoted fields from a solution `Project(...)` line tail, in order. The fields
// are `"Name", "relpath", "{guid}"`; splitting on quotes (not raw commas) means a comma INSIDE a
// quoted name or path no longer misreads the line — CodeRabbit flagged the naive `Split(',')`,
// which could skip a valid project or resolve the wrong path. (`.sln` does not use `""` escaping.)
static List<string> QuotedFields(string s)
{
    var fields = new List<string>();
    int i = 0;
    while (true)
    {
        int a = s.IndexOf('"', i);
        if (a < 0) break;
        int b = s.IndexOf('"', a + 1);
        if (b < 0) break;
        fields.Add(s.Substring(a + 1, b - a - 1));
        i = b + 1;
    }
    return fields;
}

// Resolve a classic `.sln` to its member `.csproj` paths. The solution file lists each project
// as `Project("{type-guid}") = "Name", "rel\path.csproj", "{guid}"`; solution folders use the
// same line shape but their path is not a `.csproj`, so filtering on the extension drops them.
// Text parsing (no MSBuild) keeps this dependency-free; a missing member is reported and skipped,
// never fatal — a solution-wide scan should survive one stale project reference.
static List<string> SolutionProjects(string sln)
{
    var dir = Path.GetDirectoryName(Path.GetFullPath(sln)) ?? ".";
    var projects = new List<string>();
    string[] lines;
    try { lines = File.ReadAllLines(sln); }
    catch (Exception ex)
    {
        Console.Error.WriteLine($"ownsharp-extract: cannot read solution {sln} ({ex.Message})");
        return projects;
    }
    foreach (var line in lines)
    {
        var t = line.TrimStart();
        if (!t.StartsWith("Project(", StringComparison.Ordinal)) continue;
        var eq = t.IndexOf('=');
        if (eq < 0) continue;
        // The path is the SECOND double-quoted field after '=' ("Name", "relpath", "{guid}");
        // quote-aware extraction tolerates a comma inside the name or path.
        var fields = QuotedFields(t.Substring(eq + 1));
        if (fields.Count < 2) continue;
        var rel = fields[1].Trim();
        if (!rel.EndsWith(".csproj", StringComparison.OrdinalIgnoreCase)) continue;
        var path = Path.GetFullPath(Path.Combine(dir, rel.Replace('\\', Path.DirectorySeparatorChar)));
        if (File.Exists(path)) projects.Add(path);
        else Console.Error.WriteLine($"ownsharp-extract: {sln}: project not found: {rel}");
    }
    return projects;
}

// The built `bin/` output directory of each `.csproj` (or each member project of a `.sln`) among
// the inputs — the references to auto-derive (P-014 Tier B convenience). Returns only directories
// that exist, deduped: an unbuilt project contributes nothing (and its third-party events degrade
// to OWN050, never a crash). The caller adds these to the reference set exactly like a hand-passed
// `--ref-dir`, so a built/restored project's third-party events bind without one.
static List<string> ProjectBinDirs(IEnumerable<string> rawInputs)
{
    var bins = new List<string>();
    var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
    void AddFor(string csproj)
    {
        var full = Path.GetFullPath(csproj);
        if (!File.Exists(full)) return;                       // missing project: nothing to derive
        var dir = Path.GetDirectoryName(full);
        if (dir is null) return;
        var bin = Path.Combine(dir, "bin");
        if (Directory.Exists(bin) && seen.Add(bin)) bins.Add(bin);
    }
    foreach (var p in rawInputs)
    {
        if (p.EndsWith(".csproj", StringComparison.OrdinalIgnoreCase)) AddFor(p);
        else if (p.EndsWith(".sln", StringComparison.OrdinalIgnoreCase))
            foreach (var proj in SolutionProjects(p)) AddFor(proj);
    }
    return bins;
}

// Expand inputs into their .cs files. A directory is walked recursively; a `.csproj`/`.sln`
// is resolved to its source set (so `ownsharp-extract App.csproj` / `App.sln` works, the
// CLI-first project input borrowed from the roslyn-tools tooling shape); an explicit file
// passes through as-is. IgnoreInaccessible tolerates an unreadable subdir mid-walk (otherwise
// the whole scan would abort with an unhandled exception on a locked directory).
static IEnumerable<string> Expand(IEnumerable<string> roots)
{
    var opts = new EnumerationOptions
    {
        RecurseSubdirectories = true,
        IgnoreInaccessible = true,
    };
    foreach (var p in roots)
    {
        if (Directory.Exists(p))
        {
            foreach (var f in Directory.EnumerateFiles(p, "*.cs", opts))
                if (!IsSkipped(f))
                    yield return f;
        }
        else if (p.EndsWith(".sln", StringComparison.OrdinalIgnoreCase))
        {
            foreach (var proj in SolutionProjects(p))
                foreach (var f in ProjectCsFiles(proj, opts))
                    yield return f;
        }
        else if (p.EndsWith(".csproj", StringComparison.OrdinalIgnoreCase))
        {
            foreach (var f in ProjectCsFiles(p, opts))
                yield return f;
        }
        else
        {
            yield return p;
        }
    }
}

// A finding's file is reported relative to the current directory (the repo root
// in CI / under the Action), with forward slashes — so a GitHub annotation or an
// MSBuild diagnostic points at the right file even when two files share a name.
// ===== OWN053 "orphaned awaitable" (promoted from ownership-semantics-lab H-29; Own.NET-paperwork h29-prereg-v1.json,
// h29-rule-prereg-v1.json, h29-promotion-v1.json, p-own053-door-v1.json). For every local declared with an UN-AWAITED
// invocation returning Task / Task<T> / ValueTask / ValueTask<T> (through parentheses / ConfigureAwait) whose operation
// is effectful — the unwrapped result is a real disposable (family A) or the member is a connection / transaction /
// persistence lifecycle call (family B) — and that is never referenced again in its member, nor declared inside a
// lambda / local function, one entry goes into the ADDITIVE top-level facts list `orphaned_awaitables`, from which
// both engines mint the advisory OWN053. The scope is frozen as measured: discards (`_ = …`), bare statements and
// stored / passed / returned awaitables stay out, the family vocabulary grows only by witnesses, nothing is lowered.
static void CollectOrphanedAwaitables(BlockSyntax mbody, SemanticModel model)
{
    static bool IsAwaitable(ITypeSymbol? t) => t is INamedTypeSymbol n && ((n.ContainingNamespace?.ToString() == "System.Threading.Tasks" && n.Name is "Task" or "ValueTask") || (n.ContainingNamespace?.ToString() == "System.Runtime.CompilerServices" && n.Name is "ConfiguredTaskAwaitable" or "ConfiguredValueTaskAwaitable"));
    static ITypeSymbol? Result(ITypeSymbol? t) => t is INamedTypeSymbol { IsGenericType: true } n ? n.TypeArguments[0] : null;
    static bool Lifecycle(string n) => n is "BeginTransaction" or "BeginTransactionAsync" or "Commit" or "CommitAsync" or "Rollback" or "RollbackAsync" or "Open" or "OpenAsync" or "Close" or "CloseAsync" or "DisposeAsync" or "SaveChangesAsync" or "FlushAsync";
    static string Key(IMethodSymbol m) => $"{m.ContainingType.ToDisplayString()}.{m.Name}/{m.Parameters.Length}";
    // the invocation behind an awaitable expression: strip parentheses and a trailing .ConfigureAwait(...)
    static InvocationExpressionSyntax? Core(ExpressionSyntax e)
    {
        while (e is ParenthesizedExpressionSyntax p) e = p.Expression;
        if (e is InvocationExpressionSyntax { Expression: MemberAccessExpressionSyntax { Name.Identifier.Text: "ConfigureAwait" } cma }) { e = cma.Expression; while (e is ParenthesizedExpressionSyntax p2) e = p2.Expression; }
        return e as InvocationExpressionSyntax;
    }
    foreach (var ld in mbody.DescendantNodes().OfType<LocalDeclarationStatementSyntax>())
    {
        if (ld.UsingKeyword.RawKind > 0) continue;
        foreach (var v in ld.Declaration.Variables)
        {
            if (v.Initializer?.Value is not { } init || model.GetDeclaredSymbol(v) is not ILocalSymbol ls) continue;
            if (!IsAwaitable(model.GetTypeInfo(init).Type)) continue;
            var inv = Core(init); if (inv is null || model.GetSymbolInfo(inv).Symbol is not IMethodSymbol m) continue;
            var res = Result(m.ReturnType);
            var fam = res is not null && ImplementsIDisposable(res) && !IsDisposeOptional(res) && !HasEmptyDisposeBody(res) ? "A_owned_result" : Lifecycle(m.Name) ? "B_protocol_lifecycle" : null;
            if (fam is null) continue;
            // zero later references in the member: the strict primary of the frozen scope
            var refs = mbody.DescendantNodes().OfType<IdentifierNameSyntax>().Count(id => id.Identifier.Text == ls.Name && SymbolEqualityComparer.Default.Equals(model.GetSymbolInfo(id).Symbol, ls));
            if (refs != 0) continue;
            if (v.Ancestors().TakeWhile(a => a != mbody).Any(a => a is AnonymousFunctionExpressionSyntax or LocalFunctionStatementSyntax)) continue;
            var member = v.Ancestors().OfType<MemberDeclarationSyntax>().FirstOrDefault();
            var pos = PosOf(v);
            lock (OrphanedAwaitables.Sites) OrphanedAwaitables.Sites.Add(new { file = Rel(v.SyntaxTree.FilePath), line = pos.Line, column = pos.Column, method = member is BaseMethodDeclarationSyntax bmd ? FlowFunctionName(bmd, "?", model) : (member?.Kind().ToString() ?? "?"), local = ls.Name, callee = Key(m), family = fam, result_type = res?.ToDisplayString() });
        }
    }
}

static string Rel(string path) =>
    Path.GetRelativePath(Directory.GetCurrentDirectory(), path).Replace('\\', '/');

// Auto-derive project references (unless --no-project-refs): for a .csproj/.sln input, add its
// built bin/ output to the reference set so third-party events bind without a hand-passed --ref-dir.
// Appended to refDirs before the reference set is built; the recursive, first-name-wins --ref-dir
// loader handles it from there (a framework/TPA simple-name already loaded is never double-added).
if (!noProjectRefs)
    foreach (var bin in ProjectBinDirs(rawInputs))
    {
        refDirs.Add(bin);
        Console.Error.WriteLine($"extractor: auto-referencing project output {bin} (--no-project-refs to disable)");
    }

var inputs = Expand(rawInputs).Distinct().ToList();

// Every raw input resolved to nothing analyzable — every path either doesn't
// exist, or every .cs file under it was filtered out by IsSkipped (bin/obj,
// generated, vendor trees; review, PR #246). Distinct from the "no inputs
// GIVEN at all" usage error above (exit 2): this is "inputs were given, but
// none of them contain anything this frontend can read" — the same shape a
// caller (owen check, own-check.sh) must not read as "0 findings, clean".
// Exit 4 deliberately matches the CLI's own no-supported-input contract
// (CheckCommand.cs) so a caller never needs to special-case which layer
// caught it; own-check.sh/action.yml propagate any non-zero extractor exit
// as-is (no python-core stage 2 is reached), same as the existing exit-2 path.
if (inputs.Count == 0)
{
    Console.Error.WriteLine(
        "extractor: no supported input found — every given path either does not exist " +
        "or contains no .cs file after skipping bin/obj/generated/vendor trees.");
    return 4;
}

static bool IsHandler(ExpressionSyntax rhs) =>
    rhs is IdentifierNameSyntax || rhs is MemberAccessExpressionSyntax;

// A handler written `new SomeEventHandler(H)` (explicit delegate-creation) denotes
// the SAME subscription as the bare `H`. Unwrap a single-argument delegate creation
// to its inner handler expression so `+= new H(m)` and `-= m` — the dominant SectorTS
// idiom (BrokerDataClasses/*.cs setters: `+=` wraps, `-=` is bare) — match on the
// release key, and the P-004 static-handler exemption sees the wrapped method. Only
// event-assignment RHS is passed here, where a `new T(arg)` is always a delegate
// creation — including the C# 9 target-typed form `new(H)`; a non-method-group inner
// (a lambda / opaque value) is left for IsHandler to reject. BaseObjectCreationExpression
// covers both explicit `new T(H)` (ObjectCreation) and target-typed `new(H)`
// (ImplicitObjectCreation). Loops to peel a (rare) doubly-wrapped delegate.
static ExpressionSyntax NormalizeHandler(ExpressionSyntax e)
{
    while (e is BaseObjectCreationExpressionSyntax { ArgumentList.Arguments: { Count: 1 } args })
        e = args[0].Expression;
    return e;
}

// ---- the one source-coordinate authority (Own.NET#317) ----
//
// Every anchor-producing fact takes its `line` AND its `column` from a SINGLE
// RangeOf() on the SINGLE node the record anchors on. There is deliberately no
// parallel `ColumnOf(node)`: two independent lookups are two opportunities to pass
// two different nodes, and the result would be a well-formed coordinate pointing at
// a place that does not exist — the worst kind of wrong, because nothing downstream
// can detect it. `LineOf` is kept as the name every existing call site already uses;
// it is now a projection of the same range rather than a second computation.
//
// Roslyn's LinePosition is 0-based in both axes. The +1 happens here, once, so no
// caller ever sees a mixed convention.
static SourceRange RangeOf(SyntaxNode node)
{
    var ls = node.GetLocation().GetLineSpan();
    return new SourceRange(
        new SourcePos(ls.StartLinePosition.Line + 1, ls.StartLinePosition.Character + 1),
        new SourcePos(ls.EndLinePosition.Line + 1, ls.EndLinePosition.Character + 1));
}

static SourcePos PosOf(SyntaxNode node) => RangeOf(node).Start;

static int LineOf(SyntaxNode node) => PosOf(node).Line;

// ---- S0 fix-candidate metadata (--fix-candidates only; strictly additive) ----

// The one documented FQN format for `qualified_name` and every symbol identity the
// fix block emits: fully-qualified with namespaces + nested-type path, no `global::`,
// generic type parameters included, special types spelled (`int`, not `System.Int32`).
static SymbolDisplayFormat FixFqnFormat() => new SymbolDisplayFormat(
    globalNamespaceStyle: SymbolDisplayGlobalNamespaceStyle.Omitted,
    typeQualificationStyle: SymbolDisplayTypeQualificationStyle.NameAndContainingTypesAndNamespaces,
    genericsOptions: SymbolDisplayGenericsOptions.IncludeTypeParameters,
    memberOptions: SymbolDisplayMemberOptions.IncludeContainingType | SymbolDisplayMemberOptions.IncludeParameters,
    // IncludeParamsRefOut so `M(T)` and `M(ref T)` — legal C# overloads — get DISTINCT
    // signatures; without it the enclosing-member component of a finding identity could
    // collide across ref/value overloads.
    parameterOptions: SymbolDisplayParameterOptions.IncludeType | SymbolDisplayParameterOptions.IncludeParamsRefOut,
    miscellaneousOptions: SymbolDisplayMiscellaneousOptions.UseSpecialTypes);

// Whitespace-normalized syntax fingerprint (collapse runs of whitespace to single
// spaces, trim) — used as the identity of a lambda handler / an unresolved receiver,
// where no symbol exists to name it. Deterministic; no regex.
static string FixNormWs(string s) =>
    string.Join(" ", s.Split((char[]?)null, StringSplitOptions.RemoveEmptyEntries));

// A full Roslyn TextSpan for `node`: absolute UTF-16 (start,length) for a future
// rewriter, plus 1-based line/column for humans and diagnostics UI.
static object FixSpanOf(SyntaxNode node)
{
    var span = node.Span;
    // Routed through RangeOf so the fix block and the anchor records share ONE
    // definition of "the 1-based position of this node". The serialized shape is
    // unchanged — same six properties, same order, same values.
    var range = RangeOf(node);
    return new
    {
        start = span.Start,
        length = span.Length,
        start_line = range.Start.Line,
        start_column = range.Start.Column,
        end_line = range.End.Line,
        end_column = range.End.Column,
    };
}

// The receiver expression of an event access (`source` in `source.PropertyChanged`),
// or null when the event is named bare (`Changed += h`, an implicit `this`).
static ExpressionSyntax? FixEventReceiver(ExpressionSyntax eventAccess) =>
    eventAccess is MemberAccessExpressionSyntax m ? m.Expression : null;

// Semantic INotifyPropertyChanged classification — NEVER by the name alone. Only the
// actual `INotifyPropertyChanged.PropertyChanged` member, or a symbol that provably
// implements it, is `inotify_property_changed`; a same-named event on an unrelated
// type is `name_only`; anything else is `other`. (The `unresolved` category is for the
// unresolved-subscription lane where no event symbol binds, not reached here.)
static string FixEventContract(IEventSymbol ev, Compilation compilation)
{
    var inpc = compilation.GetTypeByMetadataName("System.ComponentModel.INotifyPropertyChanged");
    var inpcEvent = inpc?.GetMembers("PropertyChanged").OfType<IEventSymbol>().FirstOrDefault();
    if (inpcEvent is not null)
    {
        if (SymbolEqualityComparer.Default.Equals(ev.OriginalDefinition, inpcEvent))
            return "inotify_property_changed";
        var impl = ev.ContainingType?.FindImplementationForInterfaceMember(inpcEvent);
        if (impl is not null && SymbolEqualityComparer.Default.Equals(impl, ev))
            return "inotify_property_changed";
    }
    return ev.Name == "PropertyChanged" ? "name_only" : "other";
}

// Best-effort "did this file reach the extractor already generated?" — a name marker
// (`.g.cs`/`.g.i.cs`/`.designer.cs`/`.generated.cs`) or an `<auto-generated>` header.
static bool FixIsGeneratedFile(SyntaxTree tree, string file)
{
    var lower = file.Replace('\\', '/').ToLowerInvariant();
    var name = lower.Substring(lower.LastIndexOf('/') + 1);
    if (name.EndsWith(".g.cs", StringComparison.Ordinal)
        || name.EndsWith(".g.i.cs", StringComparison.Ordinal)
        || name.EndsWith(".designer.cs", StringComparison.Ordinal)
        || name.EndsWith(".generated.cs", StringComparison.Ordinal))
        return true;
    foreach (var tr in tree.GetRoot().GetFirstToken(includeZeroWidth: true).LeadingTrivia)
        if (tr.IsKind(SyntaxKind.SingleLineCommentTrivia) || tr.IsKind(SyntaxKind.MultiLineCommentTrivia))
        {
            var t = tr.ToString().ToLowerInvariant();
            if (t.Contains("<auto-generated") || t.Contains("auto-generated") || t.Contains("autogenerated"))
                return true;
        }
    return false;
}

// The signature of the member (method/ctor/accessor/property) that lexically encloses
// `node` — part of the fix finding-identity (a subscription is identified by WHERE it
// is declared, not by its line). Symbol signature when resolvable, else a syntax
// fallback.
static string FixEnclosingMemberSignature(SyntaxNode node, SemanticModel model)
{
    var member = node.Ancestors().FirstOrDefault(n =>
        n is BaseMethodDeclarationSyntax or AccessorDeclarationSyntax
          or PropertyDeclarationSyntax or EventDeclarationSyntax or IndexerDeclarationSyntax);
    if (member is null)
        return "<none>";
    var sym = model.GetDeclaredSymbol(member);
    return sym?.ToDisplayString(FixFqnFormat()) ?? FixNormWs(member.ToString());
}

// Strip enclosing parentheses so `(x)` classifies like `x`.
static ExpressionSyntax FixStripParens(ExpressionSyntax e) =>
    e is ParenthesizedExpressionSyntax p ? FixStripParens(p.Expression) : e;

// Conservative RECEIVER (event-source) identity. Only a receiver that names a
// definitely-stable instance may ground an `exact` teardown; a receiver whose runtime
// instance is computed per evaluation must not — two `GetPublisher()` calls, or a
// property getter, can return different objects even though the SYMBOL is identical.
//   "stable_symbol": `this` / local / parameter / instance field of `this` / static
//                    field — the same syntactic reference is the same instance;
//   "computed":      invocation / property / indexer / conditional access / a field of
//                    some OTHER value (`a.Publisher`) — instance identity not proven;
//   "unresolved":    no symbol bound.
static (string Kind, ISymbol? Sym) FixReceiverIdentity(
    ExpressionSyntax? recv, SemanticModel model, INamedTypeSymbol? clsSymbol)
{
    if (recv is null)
        return ("stable_symbol", clsSymbol); // bare event => implicit `this`
    recv = FixStripParens(recv);
    if (recv is ThisExpressionSyntax)
        return ("stable_symbol", clsSymbol);
    var sym = model.GetSymbolInfo(recv).Symbol;
    switch (recv)
    {
        case IdentifierNameSyntax:
            // bare identifier: local / parameter / instance-field-of-`this` / static field
            if (sym is ILocalSymbol or IParameterSymbol or IFieldSymbol)
                return ("stable_symbol", sym);
            return sym is null ? ("unresolved", null) : ("computed", sym);
        case MemberAccessExpressionSyntax ma:
            // only `this._field` or a static field is a proven-stable instance; a field
            // of another value (`a.Publisher`) or a property/method is computed.
            if (sym is IFieldSymbol f
                && (f.IsStatic || FixStripParens(ma.Expression) is ThisExpressionSyntax))
                return ("stable_symbol", sym);
            return sym is null ? ("unresolved", null) : ("computed", sym);
        default:
            return sym is null ? ("unresolved", null) : ("computed", sym);
    }
}

// Conservative HANDLER identity. A method SYMBOL is not a delegate identity, and a
// storage SYMBOL is not its (mutable) value — so `stable_symbol` is limited to the two
// forms whose delegate is provably fixed for the class WITHOUT dataflow:
//   * a STATIC method group (null target); or
//   * an INSTANCE method group on `this` — bare `OnChanged` or `this.OnChanged`.
// A method group on any OTHER receiver (`left.OnChanged`) binds to that receiver's
// instance — `left.OnChanged` and `right.OnChanged` are the same IMethodSymbol but
// different delegates. A delegate held in a local / parameter / field / property is a
// storage location that can be reassigned between the `+=` and the `-=` (same symbol,
// different value). A lambda is a fresh delegate each evaluation. All of these are
// `computed` — none may ground an `exact` (proving them stable is dataflow, out of S0).
static (string Kind, ISymbol? Sym) FixHandlerIdentity(ExpressionSyntax handler, SemanticModel model)
{
    var nh = NormalizeHandler(handler);
    if (nh is AnonymousFunctionExpressionSyntax)
        return ("computed", null);
    var info = model.GetSymbolInfo(nh);
    var sym = info.Symbol ?? info.CandidateSymbols.FirstOrDefault();
    if (sym is IMethodSymbol method)
    {
        if (method.IsStatic)
            return ("stable_symbol", sym); // static method group: null target
        if (nh is IdentifierNameSyntax)
            return ("stable_symbol", sym); // bare `OnChanged` => implicit `this`
        if (nh is MemberAccessExpressionSyntax ma
            && FixStripParens(ma.Expression) is ThisExpressionSyntax)
            return ("stable_symbol", sym); // `this.OnChanged`
        return ("computed", sym); // method group on some other receiver instance
    }
    // A local / parameter / field / property / indexer delegate: a storage location or a
    // computed value, not a proven-immutable delegate.
    return sym is null ? ("unresolved", null) : ("computed", sym);
}

// Build the namespaced `fix` block for one eligible `+=` acquire `a` (event `ev`). An
// `exact` teardown requires a single `-=` site whose event symbol, RECEIVER identity, and
// HANDLER identity all match by STABLE symbol — a computed/unresolved identity, or a
// text-only agreement, tops out at `ambiguous`. The occurrence ordinal is keyed by the
// FULL identity INCLUDING the enclosing member (so a subscription added to a different
// member never shifts an existing one's ordinal). Teardown scan is scoped to `a`'s
// IMMEDIATE containing type.
static object FixBuildSubscriptionFix(
    AssignmentExpressionSyntax a, IEventSymbol ev, SemanticModel model, Compilation compilation,
    INamedTypeSymbol? clsSymbol, ClassDeclarationSyntax cls, Dictionary<string, int> occ)
{
    var eventId = ev.OriginalDefinition.ToDisplayString(FixFqnFormat());
    var contract = FixEventContract(ev, compilation);
    var enclosing = FixEnclosingMemberSignature(a, model);

    var recv = FixEventReceiver(a.Left);
    var sourceText = recv is null ? "this" : recv.ToString();
    var (srcKind, srcSym) = FixReceiverIdentity(recv, model, clsSymbol);
    var sourceId = srcKind == "stable_symbol" && srcSym is not null
        ? srcSym.ToDisplayString(FixFqnFormat())
        : FixNormWs(sourceText);

    var handlerText = NormalizeHandler(a.Right).ToString();
    var (hKind, hSym) = FixHandlerIdentity(a.Right, model);
    var handlerId = hKind == "stable_symbol" && hSym is not null
        ? hSym.ToDisplayString(FixFqnFormat())
        : FixNormWs(handlerText);

    var acquireStable = srcKind == "stable_symbol" && hKind == "stable_symbol";

    var candidates = new List<object>();
    var anyNonStable = false;
    foreach (var t in cls.DescendantNodes().OfType<AssignmentExpressionSyntax>())
    {
        if (!t.IsKind(SyntaxKind.SubtractAssignmentExpression))
            continue;
        if (!ReferenceEquals(t.FirstAncestorOrSelf<TypeDeclarationSyntax>(), cls))
            continue; // nested-type boundary: only this immediate type's teardown sites
        if (model.GetSymbolInfo(t.Left).Symbol is not IEventSymbol tev
            || !SymbolEqualityComparer.Default.Equals(tev, ev))
            continue; // must be the same event symbol
        var tRecv = FixEventReceiver(t.Left);
        var tSourceText = tRecv is null ? "this" : tRecv.ToString();
        var (tSrcKind, tSrcSym) = FixReceiverIdentity(tRecv, model, clsSymbol);
        var tHandlerText = NormalizeHandler(t.Right).ToString();
        var (tHKind, tHSym) = FixHandlerIdentity(t.Right, model);

        var srcStableEq = srcKind == "stable_symbol" && tSrcKind == "stable_symbol"
                          && SymbolEqualityComparer.Default.Equals(srcSym, tSrcSym);
        var hStableEq = hKind == "stable_symbol" && tHKind == "stable_symbol"
                        && SymbolEqualityComparer.Default.Equals(hSym, tHSym);
        var srcAgree = srcStableEq || FixNormWs(sourceText) == FixNormWs(tSourceText);
        var hAgree = hStableEq || FixNormWs(handlerText) == FixNormWs(tHandlerText);
        if (!srcAgree || !hAgree)
            continue;

        var stableMatch = srcStableEq && hStableEq;
        if (!stableMatch)
            anyNonStable = true; // a text-only match cannot ground an `exact`
        candidates.Add(new
        {
            source = tSourceText,
            handler = tHandlerText,
            match = stableMatch ? "stable" : "text",
            span = FixSpanOf(t),
        });
    }
    var status = candidates.Count == 0 ? "none"
               : (candidates.Count == 1 && acquireStable && !anyNonStable) ? "exact"
               : "ambiguous";

    var key = $"{enclosing}\0{eventId}\0{sourceId}\0{handlerId}";
    var ordinal = occ.TryGetValue(key, out var seen) ? seen : 0;
    occ[key] = ordinal + 1;

    return new
    {
        enclosing_member = enclosing,
        event_identity = eventId,
        event_contract = contract,
        source_identity = sourceId,
        source_identity_kind = srcKind,
        handler_identity = handlerId,
        handler_identity_kind = hKind,
        occurrence_ordinal = ordinal,
        span = FixSpanOf(a),
        teardown = new { status, candidates },
    };
}

// The receiver of `target.Member` ("_timer" for `_timer.Tick`), or null when the
// left side is a bare identifier (`Changed += h`).
static string? Receiver(ExpressionSyntax expr) =>
    expr is MemberAccessExpressionSyntax m ? m.Expression.ToString() : null;

// A timer subscription is a `Tick`/`Elapsed` handler — DispatcherTimer and the
// WinForms timer expose `Tick`, System.Timers.Timer exposes `Elapsed`. A running
// timer strong-refs the handler's owner, so an undetached one leaks it.
static bool IsTimerEvent(ExpressionSyntax left) =>
    left is MemberAccessExpressionSyntax m
        && (m.Name.Identifier.Text == "Tick" || m.Name.Identifier.Text == "Elapsed");

// --- #278 soundness: a `-=` that exists is not a `-=` that runs. -----------------
//
// A matching `-=` credits the subscription's release ONLY when it sits in a
// recognised TEARDOWN CONTEXT of the subscribing class (P-001/P-004 as written:
// `Dispose`/`OnClosed`/`Unloaded`), and is not guarded away by a parameter of its
// enclosing method. A `-=` in an arbitrary method — one nothing here proves is
// ever called, or whose guard the caller can flip — keeps today's honest OWN001
// warning instead of silently swallowing the leak class (the #238 doctrine).
// Heap-proven on SectorTS GTD: ctor `+=` to a static publisher, the only `-=`
// inside `UnregisterEventHandlers(bool UnregOnlyGoodys)` behind `if (!UnregOnly-
// Goodys)`, and the leaking callers pass `true` — the old "any `-=` in the class"
// model paired them and stayed silent over a 66%-retained heap.
//
// Teardown contexts (deliberately NO whole-program call graph — intra-class only):
//   * a method the platform itself runs at end-of-life, by exact name:
//     Dispose / DisposeAsync / OnClosed / OnClosing / OnUnloaded / OnFormClosed /
//     OnFormClosing;
//   * a handler this class wires (`+=`, bare/`this.` receiver) to its own
//     lifecycle event: Closed / Closing / Unloaded / FormClosed / FormClosing /
//     Disposed — including an inline lambda handler on those events;
//   * any method or local function such a context PROVABLY calls (`Cleanup()`
//     from `Dispose()`), transitively within the class — a SYMBOL-based
//     fixpoint: only an invocation that RESOLVES to a specific own method
//     extends the set, so a call to `Cleanup()` never credits an uncalled
//     `Cleanup(bool)` overload.
//
// Explicit NON-contexts (follow-up to #278 — each was a silent-exemption hole):
//   * a FINALIZER: for a subscription leak the subscriber stays REACHABLE
//     through the publisher's delegate, so its finalizer never runs while the
//     subscription is live — a `-=` there can never break the hold;
//   * a `Window_Closing`-style NAME with no code wiring: the XAML attach never
//     reaches this extractor, so the name alone proves nothing (it may be stale
//     dead code) — a XAML-aware slice can restore it with evidence;
//   * a local function or lambda merely DECLARED inside a teardown method:
//     declaration is not execution — a local function counts only when the
//     symbol-based closure proves a teardown calls it, a lambda only when it is
//     the handler wired to a lifecycle event.

// A method name the platform (or the IDisposable contract) itself invokes at the
// end of the object's life.
static bool IsTeardownMethodName(string name) =>
    name is "Dispose" or "DisposeAsync"
         or "OnClosed" or "OnClosing" or "OnUnloaded" or "OnFormClosed" or "OnFormClosing";

// An event MEMBER name that fires at the subscriber's own end-of-life, so a handler
// attached to it is a teardown context.
static bool IsTeardownEventName(string name) =>
    name is "Closed" or "Closing" or "Unloaded" or "FormClosed" or "FormClosing" or "Disposed";

// The event-member simple name of a `+=`/`-=` left side (`Closed`, `win.Closed`),
// null when the shape names no member.
static string? EventMemberName(ExpressionSyntax left) => left switch
{
    IdentifierNameSyntax id => id.Identifier.Text,
    MemberAccessExpressionSyntax ma => ma.Name.Identifier.Text,
    _ => null,
};

// Is the `+=` receiver THIS object (bare `Closed +=` / `this.Closed +=`)? A handler
// hooked to ANOTHER object's `Closed` runs at that object's teardown, not ours, so
// it may not ground OUR release.
static bool IsSelfLifecycleReceiver(ExpressionSyntax left) =>
    left is IdentifierNameSyntax
    || (left is MemberAccessExpressionSyntax ma && ma.Expression is ThisExpressionSyntax);

// The descendant nodes of one callable's OWN body — never descending into a
// nested lambda or local function, whose bodies do not run just because the
// enclosing method does (they get their own teardown decision).
static IEnumerable<SyntaxNode> DirectBodyNodes(SyntaxNode body) =>
    body.DescendantNodes(n =>
        n is not AnonymousFunctionExpressionSyntax and not LocalFunctionStatementSyntax);

// The set of THIS class's method (and local-function) SYMBOLS that are teardown
// contexts: the named/wired roots plus everything a member of the set PROVABLY
// calls, to a fixpoint. Symbol-based on purpose (#278 follow-up): the closure
// extends only through an invocation that RESOLVES to a specific own method or
// local function, so `Dispose() => Cleanup();` credits exactly `Cleanup()` —
// never a same-named, uncalled `Cleanup(bool)` overload.
static HashSet<IMethodSymbol> TeardownContextMethods(
    ClassDeclarationSyntax cls, SemanticModel model, INamedTypeSymbol? clsSymbol)
{
    var teardown = new HashSet<IMethodSymbol>(SymbolEqualityComparer.Default);
    var work = new Queue<IMethodSymbol>();
    void Add(IMethodSymbol? m)
    {
        if (m is not null && teardown.Add(m))
            work.Enqueue(m);
    }

    // roots: exact platform teardown names among the class's own methods.
    foreach (var md in cls.Members.OfType<MethodDeclarationSyntax>())
        if (IsTeardownMethodName(md.Identifier.Text))
            Add(model.GetDeclaredSymbol(md));

    // roots: method-group handlers this class wires to its OWN lifecycle events
    // (`Closed += OnDone;` / `this.Closing += Window_Closing;`).
    foreach (var a in cls.DescendantNodes().OfType<AssignmentExpressionSyntax>())
    {
        if (!a.IsKind(SyntaxKind.AddAssignmentExpression)
            || EventMemberName(a.Left) is not { } evName || !IsTeardownEventName(evName)
            || !IsSelfLifecycleReceiver(a.Left))
            continue;
        var h = NormalizeHandler(a.Right);
        if (h is not (IdentifierNameSyntax or MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax }))
            continue;
        var info = model.GetSymbolInfo(h);
        if (info.Symbol is IMethodSymbol hm)
        {
            Add(hm); // symbol-resolved: the event delegate picked its exact target
        }
        else
        {
            // The lifecycle EVENT is unresolved (`Closing +=` on a base the runner
            // cannot reference, e.g. WPF `Window` on Linux), so the method group
            // binds no definite symbol. The runtime delegate still attaches exactly
            // ONE overload — chosen by the event's delegate signature, which is
            // precisely what is missing here — so the group's NAME may ground a
            // teardown ONLY when it is unambiguous: exactly one method with that
            // name in the immediate class. Zero or 2+ same-named methods credit
            // NOTHING — a `-=` in the wrong, never-attached overload must keep the
            // honest warning (the unresolved twin of the invocation-overload
            // conflation the closure below rules out).
            var hn = h is IdentifierNameSyntax hid
                ? hid.Identifier.Text
                : ((MemberAccessExpressionSyntax)h).Name.Identifier.Text;
            IMethodSymbol? only = null;
            var unique = true;
            foreach (var md in cls.Members.OfType<MethodDeclarationSyntax>())
                if (md.Identifier.Text == hn && model.GetDeclaredSymbol(md) is { } nds)
                {
                    if (only is not null) { unique = false; break; }
                    only = nds;
                }
            if (unique && only is not null)
                Add(only);
        }
    }

    // intra-class closure: a method/local function a teardown context provably
    // calls (bare or `this.`-qualified, RESOLVED to a symbol of this class) is
    // itself a teardown context. Unresolved calls extend nothing — the worst
    // case stays "keeps today's honest warning".
    while (work.Count > 0)
    {
        var m = work.Dequeue();
        foreach (var sref in m.DeclaringSyntaxReferences)
        {
            if (sref.SyntaxTree != model.SyntaxTree)
                continue; // a partial's other-file half: outside this model's scope
            SyntaxNode? body = sref.GetSyntax() switch
            {
                BaseMethodDeclarationSyntax bmd => (SyntaxNode?)bmd.Body ?? bmd.ExpressionBody,
                LocalFunctionStatementSyntax lf => (SyntaxNode?)lf.Body ?? lf.ExpressionBody,
                _ => null,
            };
            if (body is null)
                continue;
            foreach (var inv in DirectBodyNodes(body).OfType<InvocationExpressionSyntax>())
            {
                if (inv.Expression is not (IdentifierNameSyntax
                        or MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax }))
                    continue;
                if (model.GetSymbolInfo(inv).Symbol is not IMethodSymbol callee)
                    continue;
                if (callee.MethodKind == MethodKind.LocalFunction
                    || (clsSymbol is not null
                        && SymbolEqualityComparer.Default.Equals(callee.ContainingType, clsSymbol)))
                    Add(callee);
            }
        }
    }
    return teardown;
}

// Does this `-=` sit in a PROVEN teardown context of `cls`? Walks the lexical
// ancestors to the nearest callable and asks whether that callable provably runs
// at teardown. A ctor, an accessor (a rebinding setter is the #163 gap, not a
// proven teardown), a non-teardown method, a FINALIZER (never runs while the
// publisher's delegate keeps the subscriber reachable), an unwired lambda, or an
// uncalled local function => no.
// The release SITE is any node whose execution-at-teardown must be proven — a
// `-=` unsubscribe assignment or a timer `.Stop()` invocation. One predicate,
// one context model: the two release kinds must never disagree about what a
// teardown is.
static bool InTeardownContext(SyntaxNode site, ClassDeclarationSyntax cls,
                              HashSet<IMethodSymbol> teardownMethods, SemanticModel model)
{
    for (SyntaxNode? cur = site.Parent; cur is not null; cur = cur.Parent)
    {
        switch (cur)
        {
            case AnonymousFunctionExpressionSyntax lam:
                // teardown ONLY as the handler wired to a lifecycle event
                // (`Closed += (s, e) => { ... -= ... }`, unwrapping `new
                // EventHandler(...)` wrappers). Anything else — including a lambda
                // merely declared inside Dispose — is a deferred delegate nothing
                // here proves is invoked.
                return lam.FirstAncestorOrSelf<AssignmentExpressionSyntax>() is { } attach
                    && attach.IsKind(SyntaxKind.AddAssignmentExpression)
                    && ReferenceEquals(NormalizeHandler(attach.Right), lam)
                    && EventMemberName(attach.Left) is { } evName
                    && IsTeardownEventName(evName)
                    && IsSelfLifecycleReceiver(attach.Left);
            case LocalFunctionStatementSyntax lf:
                // declaration is not execution: only a local function the
                // symbol-based closure proved a teardown CALLS counts.
                return model.GetDeclaredSymbol(lf) is { } lfs
                    && teardownMethods.Contains(lfs);
            case DestructorDeclarationSyntax:
                return false;
            case MethodDeclarationSyntax md:
                return ReferenceEquals(md.Parent, cls)
                    && model.GetDeclaredSymbol(md) is { } ms
                    && teardownMethods.Contains(ms);
            case BaseMethodDeclarationSyntax: // ctor / operator: not a teardown
                return false;
            case AccessorDeclarationSyntax:
                return false;
            case TypeDeclarationSyntax:
                return false;
        }
    }
    return false;
}

// #278 rule 2: a `-=` under a branch whose condition depends on a PARAMETER of the
// enclosing method cannot be proven to run from the subscription site — the caller
// chooses (SectorTS: `if (!UnregOnlyGoodys)`, callers pass `true`). Field/local
// guards (`if (_handler != null)`) stay credited: they are the class's own state,
// not a caller-controlled skip. The ONE canonical exception is the positive
// `disposing` guard of the IDisposable pattern — `Dispose(bool disposing)`'s
// `if (disposing) { ... }` runs on every `Dispose()` call, so a POSITIVE use of
// that single bool parameter does not demote; `if (!disposing)` (the finalizer
// branch) still does.
//
// Two branch-shape refinements (#305, audit attacks A/B —
// docs/notes/teardown-predicate-adversarial-audit.md):
//   * the canonical exemption covers only a site on the POSITIVE side of that
//     guard — a `-=` in the ELSE of `if (disposing)` executes only on the
//     finalizer path, which never runs while the subscription keeps the
//     subscriber reachable, so it demotes like any parameter guard;
//   * an early `return` lexically PRECEDING the site, itself guarded by a
//     parameter (`if (keepAlive) return; ... -= ...`), is the same
//     caller-chosen skip spelled as a sibling instead of an ancestor — it
//     demotes too (IsParamGuardedByEarlyReturn). The one exemption is the
//     canonical pattern INVERTED: `if (!disposing) return;` fires exactly when
//     the managed path does not run, so the site after it still executes on
//     every `Dispose()` call and stays credited.
static bool IsParamGuardedRelease(SyntaxNode site, SemanticModel model)
{
    for (SyntaxNode? cur = site.Parent; cur is not null && cur is not MemberDeclarationSyntax; cur = cur.Parent)
    {
        ExpressionSyntax? cond = GuardCondition(cur);
        if (cond is null)
            continue;
        foreach (var id in cond.DescendantNodesAndSelf().OfType<IdentifierNameSyntax>())
            if (model.GetSymbolInfo(id).Symbol is IParameterSymbol p
                && !(IsCanonicalDisposingParam(p) && !IsNegatedGuardUse(id)
                     && !SiteOnNegativeBranch(cur, site)))
                return true;
    }
    return IsParamGuardedByEarlyReturn(site, model);
}

// The branch-selector condition of one control-flow ancestor shape — shared by
// the enclosing-guard walk and the early-return scan so the two demotion rules
// can never disagree about what a guard is.
static ExpressionSyntax? GuardCondition(SyntaxNode node) => node switch
{
    IfStatementSyntax ifs => ifs.Condition,
    ConditionalExpressionSyntax ce => ce.Condition,
    SwitchStatementSyntax ss => ss.Expression,
    SwitchExpressionSyntax se => se.GoverningExpression,
    WhileStatementSyntax ws => ws.Condition,
    ForStatementSyntax fs => fs.Condition,
    _ => null,
};

// Is `site` on the branch of `guard` that runs when its condition is FALSE —
// the `else` of an `if`, the when-false arm of a ternary? The canonical
// positive `disposing` exemption may cover only the TRUE side: the false side
// is the finalizer path (#305 attack B).
static bool SiteOnNegativeBranch(SyntaxNode guard, SyntaxNode site) => guard switch
{
    IfStatementSyntax { Else: { } els } => els.Span.Contains(site.Span),
    ConditionalExpressionSyntax ce => ce.WhenFalse.Span.Contains(site.Span),
    _ => false,
};

// #305 attack A: a `return` lexically BEFORE the site, guarded by a parameter
// of the enclosing callable (`if (keepAlive) return; ... -= ...`), is the
// caller-controlled skip as a preceding SIBLING — invisible to the
// ancestors-only walk above, semantically identical to the enclosing-branch
// spelling it demotes. Scans the enclosing callable's own body (never nested
// lambdas/local functions — their returns do not exit this frame). Only the
// canonical INVERTED disposing exit is exempt: `if (!disposing) return;`
// guarantees the site still runs on every `Dispose()` call; a POSITIVE
// `if (disposing) return;` leaves the site finalizer-only and demotes. An
// unguarded or field/local-guarded return stays credited — same ownership of
// class state as the enclosing-guard rule.
static bool IsParamGuardedByEarlyReturn(SyntaxNode site, SemanticModel model)
{
    SyntaxNode? body = null;
    for (SyntaxNode? cur = site.Parent; cur is not null; cur = cur.Parent)
    {
        if (cur is AnonymousFunctionExpressionSyntax af) { body = af.Body; break; }
        if (cur is LocalFunctionStatementSyntax lf) { body = (SyntaxNode?)lf.Body ?? lf.ExpressionBody; break; }
        if (cur is AccessorDeclarationSyntax acc) { body = (SyntaxNode?)acc.Body ?? acc.ExpressionBody; break; }
        if (cur is BaseMethodDeclarationSyntax bmd) { body = (SyntaxNode?)bmd.Body ?? bmd.ExpressionBody; break; }
    }
    if (body is null)
        return false;
    foreach (var ret in DirectBodyNodes(body).OfType<ReturnStatementSyntax>())
    {
        if (ret.SpanStart >= site.SpanStart)
            continue; // only an exit the flow passes before reaching the site
        for (SyntaxNode? cur = ret.Parent; cur is not null && !ReferenceEquals(cur, body); cur = cur.Parent)
        {
            var cond = GuardCondition(cur);
            if (cond is null)
                continue;
            foreach (var id in cond.DescendantNodesAndSelf().OfType<IdentifierNameSyntax>())
                if (model.GetSymbolInfo(id).Symbol is IParameterSymbol p
                    && !(IsCanonicalDisposingParam(p) && IsNegatedGuardUse(id)))
                    return true;
        }
    }
    return false;
}

// The single bool parameter of a 1-parameter `Dispose(bool)` — the subject of
// the canonical IDisposable-pattern exemptions above.
static bool IsCanonicalDisposingParam(IParameterSymbol p) =>
    p.Type.SpecialType == SpecialType.System_Boolean
    && p.ContainingSymbol is IMethodSymbol m
    && m.Name == "Dispose" && m.Parameters.Length == 1;

// Is this identifier use NEGATED in its guard (`!disposing`, `disposing == false`,
// `disposing != true`)? A negated use selects the finalizer branch; a positive
// use (also `disposing && !_disposed`) selects the managed branch.
static bool IsNegatedGuardUse(IdentifierNameSyntax id)
{
    SyntaxNode use = id;
    while (use.Parent is ParenthesizedExpressionSyntax pe)
        use = pe;
    if (use.Parent is PrefixUnaryExpressionSyntax pu && pu.IsKind(SyntaxKind.LogicalNotExpression))
        return true;
    if (use.Parent is BinaryExpressionSyntax be
        && (be.IsKind(SyntaxKind.EqualsExpression) || be.IsKind(SyntaxKind.NotEqualsExpression)))
    {
        var other = ReferenceEquals(be.Left, use) ? be.Right : be.Left;
        return be.IsKind(SyntaxKind.EqualsExpression)
            ? other.IsKind(SyntaxKind.FalseLiteralExpression)
            : other.IsKind(SyntaxKind.TrueLiteralExpression);
    }
    return false;
}

// Issue #218 — DP/property-changed old->new subscription ROTATION. A property-changed callback (a
// `PropertyChangedCallback` reading `e.OldValue`/`e.NewValue`, or a virtual `OnXChanged(T old, T new)`
// override) detaches the SAME handler from the OLD value and re-attaches it to the NEW one across a
// value change. The extractor pairs `-=`/`+=` per source VARIABLE, so the `+=` on the new half looks
// unpaired and false-flags OWN001 — yet at most one subscription is ever live. This treats the `+=`
// on the new half as RELEASED when its matching `-=` sits on the OLD half of the SAME change: same
// event member, same handler, same method. Precise by construction (see IsOldNewPair) — it never
// pairs a `-=`/`+=` on unrelated sources (two fields, differently-typed params), which stay flagged.
static bool IsRotationPairedRelease(AssignmentExpressionSyntax add, SemanticModel model)
{
    if (add.Left is not MemberAccessExpressionSyntax addLhs)
        return false;                                        // only `receiver.EventMember += H`
    var eventMember = addLhs.Name.Identifier.Text;           // e.g. CanExecuteChanged
    var newRecv = addLhs.Expression;                         // the NEW half's receiver
    var handler = NormalizeHandler(add.Right).ToString();
    if (add.FirstAncestorOrSelf<BaseMethodDeclarationSyntax>() is not { } method)
        return false;                                        // a rotation lives in one callback
    foreach (var node in method.DescendantNodes().OfType<AssignmentExpressionSyntax>())
        if (node.IsKind(SyntaxKind.SubtractAssignmentExpression)
            && node.Left is MemberAccessExpressionSyntax subLhs
            && subLhs.Name.Identifier.Text == eventMember               // same event member
            && NormalizeHandler(node.Right).ToString() == handler        // same handler
            && IsOldNewPair(subLhs.Expression, newRecv, method, model))  // old/new halves of one change
            return true;
    return false;
}

// Are (oldRecv, newRecv) — the receivers of a `-=`/`+=` on the same event+handler — the OLD/NEW
// halves of ONE property change? Two provable forms, nothing wider:
//   (1) DependencyPropertyChangedEventArgs: `e.OldValue` / `e.NewValue` — used directly, or bound to
//       a local (`e.OldValue is T old`, `(T)e.OldValue`, `var old = e.OldValue`).
//   (2) two parameters of the enclosing method of the SAME type, OLD positioned before NEW — the
//       `OnXChanged(T oldValue, T newValue)` override, matched by the param-pair shape, not by name.
// Two class fields, differently-typed parameters, or unrelated locals are NOT a pair -> stay flagged.
static bool IsOldNewPair(ExpressionSyntax oldRecv, ExpressionSyntax newRecv,
                         BaseMethodDeclarationSyntax method, SemanticModel model)
{
    // (1) direct e.OldValue / e.NewValue receivers — including the inline CAST form
    // `((ICommand)e.NewValue).CanExecuteChanged += H` (OldValue/NewValue are object-typed, so a
    // cast is mandatory to reach the event), which is the common way to write this rotation.
    if (IsDpValueAccess(StripCasts(oldRecv), "OldValue") && IsDpValueAccess(StripCasts(newRecv), "NewValue"))
        return true;
    var oldSym = model.GetSymbolInfo(oldRecv).Symbol;
    var newSym = model.GetSymbolInfo(newRecv).Symbol;
    if (oldSym is null || newSym is null
        || SymbolEqualityComparer.Default.Equals(oldSym, newSym))
        return false;   // unresolved, or the SAME source (that is the existing per-variable pairing)
    // (1') locals bound from e.OldValue / e.NewValue.
    if (BoundFromDpValue(oldSym, "OldValue", method, model)
        && BoundFromDpValue(newSym, "NewValue", method, model))
        return true;
    // (2) two SAME-TYPE parameters, old before new.
    return oldSym is IParameterSymbol op && newSym is IParameterSymbol np
        && SymbolEqualityComparer.Default.Equals(op.Type, np.Type)
        && op.Ordinal < np.Ordinal;
}

// `<recv>.OldValue` / `<recv>.NewValue` member access — the DependencyPropertyChangedEventArgs
// halves. Matched by member name (those two members ARE the canonical DP-changed shape); the
// extractor is syntactic by design, so this stays robust when the WPF ref is absent.
static bool IsDpValueAccess(ExpressionSyntax expr, string member) =>
    expr is MemberAccessExpressionSyntax ma && ma.Name.Identifier.Text == member;

// Was the local/pattern variable `sym` bound from `e.<member>` (OldValue/NewValue) inside `method`?
// Recognises a declaration pattern (`e.OldValue is T sym`) and a declarator initializer
// (`var sym = e.OldValue`, `T sym = (T)e.OldValue`) — the ways a callback names its old/new half.
static bool BoundFromDpValue(ISymbol sym, string member,
                             BaseMethodDeclarationSyntax method, SemanticModel model)
{
    foreach (var node in method.DescendantNodes())
    {
        if (node is SingleVariableDesignationSyntax svd
            && svd.Parent is DeclarationPatternSyntax { Parent: IsPatternExpressionSyntax ip }
            && IsDpValueAccess(StripCasts(ip.Expression), member)
            && SymbolEqualityComparer.Default.Equals(model.GetDeclaredSymbol(svd), sym))
            return true;
        if (node is VariableDeclaratorSyntax { Initializer: { } init } vd
            && IsDpValueAccess(StripCasts(init.Value), member)
            && SymbolEqualityComparer.Default.Equals(model.GetDeclaredSymbol(vd), sym))
            return true;
    }
    return false;
}

// Peel enclosing casts / parentheses / the null-forgiving `!` so `(ICommand)e.OldValue`,
// `(e.OldValue)` and `((ICommand)e.NewValue!)` all reach the underlying `e.OldValue`/`e.NewValue`.
static ExpressionSyntax StripCasts(ExpressionSyntax e)
{
    while (true)
        switch (e)
        {
            case CastExpressionSyntax c: e = c.Expression; continue;
            case ParenthesizedExpressionSyntax p: e = p.Expression; continue;
            case PostfixUnaryExpressionSyntax s
                when s.IsKind(SyntaxKind.SuppressNullableWarningExpression):
                e = s.Operand; continue;
            default: return e;
        }
}

// P-004 self-owned exemption: is the event SOURCE owned by (and so never longer-
// lived than) the subscriber? True for a bare instance event on `this`, or a
// receiver that resolves to a field/local the class OWNS. "Owns" is the `owned`
// set the caller computes: fields the class constructs directly (`new`), builds
// indirectly through a `ref`/`out` helper, or fetches as one of its own template
// parts. Such a `source <-> this` reference cycle is GC-collectable, so the
// subscription is not a leak. The receiver is resolved to a SYMBOL (not matched by
// text), and `owned` is AST-based — not a regex. NOTE: callers must exclude timers
// — a *running* timer is rooted by the dispatcher regardless of who owns the field.
static bool IsSelfOwnedSource(ExpressionSyntax left, IEventSymbol ev,
                              SemanticModel model, HashSet<string> owned,
                              HashSet<ISymbol> ownedLocals, ISymbol? cls)
{
    if (left is not MemberAccessExpressionSyntax m)
        return !ev.IsStatic;   // bare event => an instance event on `this`
    if (m.Expression is ThisExpressionSyntax)
        return true;
    var recv = model.GetSymbolInfo(m.Expression).Symbol;
    // FIELD names are unique per class (two same-named fields wouldn't compile), so a
    // name-based lookup is sound; a LOCAL's name is only unique within its own
    // declaration space — an unrelated method can freely reuse the same identifier for a
    // completely different (possibly injected) local. So locals are matched by SYMBOL
    // (`ownedLocals`, keyed by SymbolEqualityComparer), never by name, else a same-named
    // local aliasing an injected source in one method could wrongly borrow another
    // method's template-part local's exemption (Codex P2).
    if (recv is IFieldSymbol && owned.Contains(recv.Name))
        return true;
    if (recv is ILocalSymbol && ownedLocals.Contains(recv))
        return true;
    // A get-only PROPERTY over a member the class owns (`this.Child.Event += h`, Child a
    // `=> _owned` / `{ get; } = new()` property) is the SAME collectable self-cycle as the
    // owned field directly. GATED on a `this`/bare access (`Channel` / `this.Channel`):
    // `other.Channel.Event += h` reaches ANOTHER instance's property, which may outlive
    // this subscriber and retain the handler, so it stays flagged (Codex P2).
    return recv is IPropertySymbol { IsStatic: false } p
           && m.Expression is (IdentifierNameSyntax
                               or MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax })
           && PropertyReturnsOwnedMember(p, owned, model, cls);
}

// A GET-ONLY property whose value the class OWNS: an auto-property initialised to
// `new X()`, or one whose getter returns a field/property the class constructs
// (`=> _owned`, `get => _owned`, `get { return _owned; }`). Such a property is part of
// `this`'s own object graph, so a subscription on its event is the same collectable
// self-cycle as subscribing on the owned field. GET-ONLY is required: a settable
// property could be reassigned to an INJECTED, longer-lived object after construction,
// which we cannot prove bounded — so we decline it (precision-first: never silently
// drop a real leak). Only the dominant owned-property shapes are recognised; anything
// else (a computed getter, a getter returning a parameter/injected field) falls through.
static bool PropertyReturnsOwnedMember(IPropertySymbol prop, HashSet<string> owned,
                                       SemanticModel model, ISymbol? cls)
{
    if (prop.SetMethod is not null)
        return false;
    foreach (var sref in prop.DeclaringSyntaxReferences)
    {
        if (sref.GetSyntax() is not PropertyDeclarationSyntax pd)
            continue;
        // auto-property `public T X { get; } = new T();` — the value is constructed here.
        if (pd.Initializer?.Value is ObjectCreationExpressionSyntax
                                  or ImplicitObjectCreationExpressionSyntax)
            return true;
        // `=> expr`, `get => expr`, or `get { return expr; }` returning an owned member.
        var get = pd.AccessorList?.Accessors
            .FirstOrDefault(ac => ac.IsKind(SyntaxKind.GetAccessorDeclaration));
        var returned = pd.ExpressionBody?.Expression
            ?? get?.ExpressionBody?.Expression
            ?? get?.Body?.Statements.OfType<ReturnStatementSyntax>().FirstOrDefault()?.Expression;
        if (returned is null)
            continue;
        var pm = model.Compilation.GetSemanticModel(pd.SyntaxTree);
        var rsym = pm.GetSymbolInfo(returned).Symbol;
        // The returned member must be one the ANALYZED class declares — compare the
        // symbol's CONTAINING TYPE, not just its name, so a same-named field on another
        // type cannot satisfy ownership (CodeRabbit). `owned` holds only this class's
        // constructed-field names, so the name check + the containing-type check agree.
        if (rsym is IFieldSymbol or IPropertySymbol
            && owned.Contains(rsym.Name)
            && (cls is null || SymbolEqualityComparer.Default.Equals(rsym.ContainingType, cls)))
            return true;
    }
    return false;
}

// P-004 (ext): a control fetching one of its OWN template parts —
// `GetTemplateChild("PART_x")` or `[Template.]FindName(...)`, optionally behind a
// cast or `as` — owns the result (it lives inside the control's own template /
// visual tree). AST-only (matched by call name), in the spirit of the rest of the
// file; used to fold template-part fields into the self-owned exemption.
static bool IsTemplatePartFetch(ExpressionSyntax? expr)
{
    expr = expr switch
    {
        CastExpressionSyntax c => c.Expression,
        BinaryExpressionSyntax b when b.IsKind(SyntaxKind.AsExpression) => b.Left,
        _ => expr,
    };
    return expr is InvocationExpressionSyntax inv
        && (inv.Expression switch
           {
               MemberAccessExpressionSyntax ma => ma.Name.Identifier.Text,
               IdentifierNameSyntax id => id.Identifier.Text,
               _ => null,
           }) is "GetTemplateChild" or "FindName";
}

// P-004 static-handler exemption: a `+= StaticMethod` stores a delegate whose
// Target is null, so no instance is retained — the subscription cannot leak a
// subscriber, however long-lived the source. Only method-group handlers
// (identifier / member access) are judged; lambdas and delegate-typed values may
// capture state and are left as leak candidates. A method group's symbol can surface
// as a MEMBER GROUP (Symbol == null, CandidateSymbols populated) instead of the bound
// method, so fall back to the candidates — else a genuinely static-method handler is
// missed and a static-source subscription that retains NO instance is mis-reported as
// a region escape (mined: ImageSharp MemoryAllocatorValidator's static MemoryDiagnostics
// handlers). When falling back, require ALL candidates static so an overload set that
// mixes a static and an instance method is not wrongly exempted.
static bool IsStaticHandler(ExpressionSyntax right, SemanticModel model)
{
    right = NormalizeHandler(right);   // `new H(StaticM)` -> `StaticM`, so the exemption sees it
    if (!IsHandler(right))
        return false;
    var info = model.GetSymbolInfo(right);
    if (info.Symbol is { } s)
        return s is IMethodSymbol { IsStatic: true };
    var cands = info.CandidateSymbols;
    return cands.Length > 0 && cands.All(c => c is IMethodSymbol { IsStatic: true });
}

// P-004 process-lifetime exemption: a subscription to a PROCESS-HOST `System.AppDomain`
// event — ProcessExit / DomainUnload (shutdown cleanup hooks) or UnhandledException /
// FirstChanceException (process-wide diagnostics) — is never a region escape. The handler
// is MEANT to live for the whole process: it runs at shutdown, or on every unhandled throw,
// and the AppDomain IS the process host. Promoting the subscriber to "the AppDomain's
// lifetime" is therefore the intent, not a leak. Mined: Npgsql's PoolManager static ctor
// `AppDomain.CurrentDomain.{DomainUnload,ProcessExit} += (_,_) => ClearAll()` — a deliberate
// "close idle connectors on appdomain unload (web-app redeployment)" hook (#491).
static bool IsProcessLifetimeAppDomainEvent(IEventSymbol ev) =>
    ev.Name is "ProcessExit" or "DomainUnload" or "UnhandledException" or "FirstChanceException"
    && ev.ContainingType is { Name: "AppDomain" } ct
    && IsInNamespace(ct, "System");

// P-004 (issue #223): a curated allowlist of BCL/WPF static events KNOWN to be
// implemented internally over weak references, so a subscriber is never pinned
// alive by the subscription — unsubscribing is optional, not merely undetected.
// `System.Windows.Input.CommandManager.RequerySuggested` is the motivating (and,
// deliberately, the ONLY) entry: mined from AvalonEdit's `ImeSupport.cs`, whose own
// comment explains the field exists to keep the HANDLER alive (weak refs can collect
// it), the opposite of the usual leak concern — see
// docs/notes/field-notes-patterns.md entry 17. This is NOT a general "static sources
// are fine" relaxation (every other static-source subscription still raises OWN014
// via the `capture` lowering below) — extend this list only when another sibling
// event's weak-reference implementation is independently confirmed, never by
// widening the predicate's shape (e.g. matching on name alone, or on "any
// System.Windows.Input member").
static bool IsWeakReferencedStaticEvent(IEventSymbol ev) =>
    ev.Name == "RequerySuggested"
    && ev.ContainingType is { Name: "CommandManager" } ct
    && IsInNamespace(ct, "System", "Windows", "Input");

// P-035: does `inv` call a project-DECLARED weak-subscribe wrapper — an exact
// (containing-type simple name, method name) pair — under the MVP (source, handler)
// positional argument contract? The declaring type is taken from the resolved method
// symbol; when the wrapper lives in an external package that does not resolve on the
// runner, it falls back to the syntactic receiver name. `source`/`handler` carry the
// first two positional arguments. This is the single match definition, used both to
// emit the accepted-release subscription and to suppress the generic Rx `Subscribe`
// matcher on the same call (so a wrapper method named `Subscribe` is not double-counted).
static bool MatchesDeclaredWeakSubscribe(
    InvocationExpressionSyntax inv, SemanticModel model,
    HashSet<(string Type, string Method)> declared,
    out ExpressionSyntax? source, out ExpressionSyntax? handler)
{
    source = null;
    handler = null;
    if (declared.Count == 0 || inv.Expression is not MemberAccessExpressionSyntax ma)
        return false;   // only `Receiver.Method(...)`; a general AddHandler heuristic is out of scope
    var methodName = ma.Name.Identifier.Text;
    var info = model.GetSymbolInfo(inv);
    var sym = info.Symbol as IMethodSymbol
              ?? info.CandidateSymbols.OfType<IMethodSymbol>().FirstOrDefault();
    string? typeName = sym?.ContainingType?.Name
        ?? (ma.Expression is IdentifierNameSyntax rid ? rid.Identifier.Text
            : ma.Expression is MemberAccessExpressionSyntax rma ? rma.Name.Identifier.Text
            : null);
    if (typeName is null || !declared.Contains((typeName, methodName)))
        return false;   // exact (type, method) only -- nothing else (acceptance #3/#5/#9)
    var callArgs = inv.ArgumentList.Arguments;
    // MVP argument contract: the first two POSITIONAL args are (source, handler); a call
    // with fewer, or with either of the first two passed by name, is not recognised (#7).
    if (callArgs.Count < 2 || callArgs[0].NameColon is not null || callArgs[1].NameColon is not null)
        return false;
    // The second argument must actually be a HANDLER: a method group / delegate / `new
    // H(...)` (IsHandler, after NormalizeHandler peels the delegate-creation) OR a lambda
    // (IsLambdaHandler) -- exactly the two handler shapes the `+=` detector accepts (the
    // main path counts a lambda RHS; IsHandler gates only its unresolved fallback). A
    // declared overload whose second parameter is not a delegate at all --
    // `AddPropertyChanged(source, 42)` -- is NOT a subscription and must not be minted as a
    // released one, and (crucially) must not be suppressed from the Rx dropped-token matcher.
    var normalizedHandler = NormalizeHandler(callArgs[1].Expression);
    if (!IsHandler(normalizedHandler) && !IsLambdaHandler(normalizedHandler))
        return false;
    source = callArgs[0].Expression;
    handler = normalizedHandler;
    return true;
}

// Does this handler retain NO subscriber instance? A static method group has a null delegate
// target; a lambda / anonymous method retains nothing only when it captures neither `this`
// (explicit, or implicit via an instance member) nor an enclosing local/parameter. Keeps the
// AppDomain process-lifetime exemption sound — a CAPTURING handler is still pinned to the
// process until shutdown and stays OWN014 (Codex); only a non-capturing one (Npgsql's
// `(_,_) => ClearAll()`, a static call) is safe to drop.
static bool HandlerRetainsNoInstance(ExpressionSyntax right, SemanticModel model)
{
    if (IsStaticHandler(right, model))
        return true;
    if (right is not AnonymousFunctionExpressionSyntax lambda)
        return false;   // a delegate-typed value is opaque -> conservatively assume it captures
    foreach (var node in lambda.DescendantNodes())
    {
        if (node is ThisExpressionSyntax or BaseExpressionSyntax)
            return false;
        if (node is not IdentifierNameSyntax id
            || (id.Parent is MemberAccessExpressionSyntax m && m.Name == id))   // `x.Member`: name resolved via x
            continue;
        var sym = model.GetSymbolInfo(id).Symbol;
        if (sym is IFieldSymbol { IsStatic: false } or IPropertySymbol { IsStatic: false }
                or IEventSymbol { IsStatic: false }
                or IMethodSymbol { IsStatic: false, MethodKind: MethodKind.Ordinary })
            return false;   // an instance member by SIMPLE name -> implicit `this` capture
        if (sym is ILocalSymbol or IParameterSymbol && !DeclaredWithin(sym, lambda))
            return false;   // an enclosing local / parameter -> captured
    }
    return true;
}

// Is EVERY declaration of `sym` inside `scope`? A lambda's own parameters/locals are; an
// enclosing local/parameter is not — so a reference to the latter is a capture.
static bool DeclaredWithin(ISymbol sym, SyntaxNode scope)
{
    if (sym.DeclaringSyntaxReferences.Length == 0)
        return false;
    foreach (var r in sym.DeclaringSyntaxReferences)
        if (!scope.FullSpan.Contains(r.Span))
            return false;
    return true;
}

// Strip parens/cast/`as`/null-forgiving (`!`) wrappers down to the base expression —
// e.g. `((Popup)sender!)` -> `sender`. Shared by HandlerSelfDetaches to resolve a
// `-=`'s receiver to the underlying symbol regardless of how it is cast back.
static ExpressionSyntax UnwrapToBase(ExpressionSyntax e)
{
    while (true)
    {
        var next = e switch
        {
            ParenthesizedExpressionSyntax p => p.Expression,
            CastExpressionSyntax c => c.Expression,
            BinaryExpressionSyntax b when b.IsKind(SyntaxKind.AsExpression) => b.Left,
            PostfixUnaryExpressionSyntax u
                when u.IsKind(SyntaxKind.SuppressNullableWarningExpression) => u.Operand,
            _ => e,
        };
        if (ReferenceEquals(next, e))
            return e;
        e = next;
    }
}

// P-004 (issue #224): a subscribed handler that unsubscribes ITSELF, inside its own
// body, the first time it runs ("do this once, then stop listening") needs no
// external `-=` — by the time the event could fire again, the subscription is
// already gone. The ONLY expression inside the handler provably referring to the
// actual runtime event source is its own `sender` parameter (whatever field/local/
// property the ORIGINAL `+=` reached the source through, `sender` at invocation time
// IS that same source) — so this requires the `-=`'s receiver, once a cast/`as`/`!`/
// parens are stripped, to resolve to the handler's own first parameter. Matching only
// the event NAME and handler METHOD (without checking the receiver at all) would
// wrongly credit a self-detach that targets some OTHER, unrelated object exposing an
// event of the same name (Codex P2 on PR #231) — the original subscription's source
// would never actually be released. Scoped to a named METHOD-GROUP handler only: a
// lambda has no name to self-reference by, so it is left exactly as before (still
// gets the "no '-=' handle" note). Mined: AvalonEdit `Search/DropDownButton.cs`
// (`((Popup)sender).Closed -= DropDownContent_Closed;` inside the very handler
// subscribed as `DropDownContent.Closed += DropDownContent_Closed`).
static bool HandlerSelfDetaches(ExpressionSyntax right, IEventSymbol ev,
                                SemanticModel model, CSharpCompilation compilation)
{
    right = NormalizeHandler(right);
    var info = model.GetSymbolInfo(right);
    var handlerMethod = info.Symbol as IMethodSymbol
        ?? info.CandidateSymbols.OfType<IMethodSymbol>().FirstOrDefault();
    if (handlerMethod is null)
        return false;
    foreach (var sref in handlerMethod.DeclaringSyntaxReferences)
    {
        if (sref.GetSyntax() is not MethodDeclarationSyntax { ParameterList.Parameters: { Count: > 0 } ps } mdecl)
            continue;
        SyntaxNode? body = (SyntaxNode?)mdecl.Body ?? mdecl.ExpressionBody;
        if (body is null)
            continue;
        var bodyModel = compilation.GetSemanticModel(mdecl.SyntaxTree);
        if (bodyModel.GetDeclaredSymbol(ps[0]) is not { } senderParam)
            continue;
        foreach (var inner in body.DescendantNodes().OfType<AssignmentExpressionSyntax>())
        {
            if (!inner.IsKind(SyntaxKind.SubtractAssignmentExpression)
                || inner.Left is not MemberAccessExpressionSyntax innerLeft
                || innerLeft.Name.Identifier.Text != ev.Name)
                continue;
            // the receiver must resolve to the handler's OWN sender parameter — the
            // only provable reference to the actual firing source.
            var recvSym = bodyModel.GetSymbolInfo(UnwrapToBase(innerLeft.Expression)).Symbol;
            if (!SymbolEqualityComparer.Default.Equals(recvSym, senderParam))
                continue;
            var innerHandlerSym = bodyModel.GetSymbolInfo(NormalizeHandler(inner.Right)).Symbol;
            if (SymbolEqualityComparer.Default.Equals(innerHandlerSym, handlerMethod))
                return true;
        }
    }
    return false;
}

// P-004 process-lived-subscriber exemption: the WPF application object (`App`) is a
// process-lived singleton — exactly one instance, created at startup, alive until
// the process exits. Subscribing it to a process-lived static event
// (`AppDomain.CurrentDomain.UnhandledException`, `SystemEvents.*`) promotes nothing:
// its "leaked" lifetime already equals the process. So a static-source region escape
// (OWN014) raised from inside `App` is a false positive (found mining ScreenToGif
// and its bundled Translator tool, both flagged on the textbook unhandled-exception
// hook). Detected syntactically because WPF does not resolve on the Linux runner:
// either the class derives from `Application` / `System.Windows.Application`, or it
// is the conventional XAML-split `partial class App` (whose `: Application` lives in
// the generated `App.g.cs` partial the extractor never sees). Only the STATIC-source
// escape is suppressed; an instance-field subscription leak inside `App` still fires.
static bool IsProcessLivedApplication(TypeDeclarationSyntax cls)
{
    if (cls.BaseList is { } bl)
        foreach (var bt in bl.Types)
        {
            var n = bt.Type switch
            {
                IdentifierNameSyntax id => id.Identifier.Text,
                QualifiedNameSyntax q => q.Right.Identifier.Text,
                AliasQualifiedNameSyntax aq => aq.Name.Identifier.Text,
                _ => null,
            };
            if (n is "Application")
                return true;
        }
    return cls.Identifier.Text == "App"
        && cls.Modifiers.Any(m => m.IsKind(SyntaxKind.PartialKeyword));
}

// P-004 / issue #228: the CURATED resolver allowlist whose call RESULT is app-scoped
// (bound to Application-owned state, hence process-lived) without being a literal
// `static` member. One entry per CONFIRMED real-world sibling — same policy as the
// #223 weak-event allowlist, never an inference. Matched by (containing-type simple
// name, method name), mirroring the [OwnIgnore] simple-name precedent: the declaring
// package usually does not resolve on the Linux runner.
//   - MaterialDesign PaletteHelper.GetThemeManager(): returns the IThemeManager bound
//     to the app's own merged ResourceDictionary (PaletteHelper.cs:22-26, verified in
//     the issue #201 sweep — MahMaterialDragablzMashUp App.xaml.cs FP).
static bool IsAppScopedResolver(IMethodSymbol sym) =>
    (sym.ContainingType?.Name, sym.Name) is ("PaletteHelper", "GetThemeManager");

// #228: does this `+=` receiver resolve (directly, or through a local bound by a
// `var x = ...` initializer or an `is`-pattern designation) to the RESULT of a curated
// app-scoped resolver call? Any unprovable step returns false — the subscription then
// keeps today's honest "injected" warning, never the other way around.
static bool IsCuratedAppScopedSource(ExpressionSyntax left, SemanticModel model)
    => left is MemberAccessExpressionSyntax m
       && ResolvesToAppScopedCall(m.Expression, model, depth: 0);

static bool ResolvesToAppScopedCall(ExpressionSyntax expr, SemanticModel model, int depth)
{
    if (depth > 3)
        return false;
    expr = StripCasts(expr);
    if (expr is InvocationExpressionSyntax inv)
    {
        var info = model.GetSymbolInfo(inv);
        var sym = info.Symbol as IMethodSymbol
                  ?? info.CandidateSymbols.OfType<IMethodSymbol>().FirstOrDefault();
        return sym is not null && IsAppScopedResolver(sym);
    }
    if (model.GetSymbolInfo(expr).Symbol is not ILocalSymbol local)
        return false;
    // The binding is only trustworthy if the local still HOLDS it at the `+=`:
    // a reassignment anywhere in the enclosing member (or a ref/out escape that
    // could rebind it) makes the initializer stale — no exemption (Codex P2).
    if (!IsNeverReassigned(local, model))
        return false;
    foreach (var r in local.DeclaringSyntaxReferences)
        switch (r.GetSyntax())
        {
            // var tm = helper.GetThemeManager();
            case VariableDeclaratorSyntax { Initializer.Value: { } init }
                when ResolvesToAppScopedCall(init, model, depth + 1):
                return true;
            // helper.GetThemeManager() is { } tm   /   is ThemeManagerLike tm
            case SingleVariableDesignationSyntax des
                when des.Ancestors().OfType<IsPatternExpressionSyntax>().FirstOrDefault()
                     is { Expression: { } scrutinee }
                     && ResolvesToAppScopedCall(scrutinee, model, depth + 1):
                return true;
        }
    return false;
}

// #228 (Codex P2): the declaration-site binding proves the local's value at the
// `+=` only if nothing rebinds it. Conservative whole-member scan: ANY assignment
// whose LHS is this local, or ANY `ref`/`out` argument passing it, kills the proof
// (even one after the subscription — cheaper than flow order and precision-safe:
// the worst case is keeping today's honest warning).
static bool IsNeverReassigned(ILocalSymbol local, SemanticModel model)
{
    foreach (var r in local.DeclaringSyntaxReferences)
    {
        var scope = r.GetSyntax().Ancestors().FirstOrDefault(n =>
            n is MethodDeclarationSyntax or ConstructorDeclarationSyntax
              or AccessorDeclarationSyntax or LocalFunctionStatementSyntax
              or AnonymousFunctionExpressionSyntax);
        if (scope is null)
            return false;
        foreach (var asg in scope.DescendantNodes().OfType<AssignmentExpressionSyntax>())
            if (SymbolEqualityComparer.Default.Equals(
                    model.GetSymbolInfo(asg.Left).Symbol, local))
                return false;
        foreach (var arg in scope.DescendantNodes().OfType<ArgumentSyntax>())
            if (!arg.RefOrOutKeyword.IsKind(SyntaxKind.None)
                && SymbolEqualityComparer.Default.Equals(
                       model.GetSymbolInfo(arg.Expression).Symbol, local))
                return false;
    }
    return true;
}

// #228: the handler must be a METHOD GROUP declared on the subscribing class itself —
// its delegate target is then the App singleton (already process-lived, nothing to
// promote). A lambda/anonymous method is rejected outright: it may capture an
// enclosing LOCAL, and pinning that local to the app's lifetime is exactly the leak
// the rejected `clsIsStatic` broadening would have swallowed (oracle-known-fps.md,
// "Rejected approaches").
static bool IsOwnMethodGroupHandler(ExpressionSyntax right, SemanticModel model,
                                    INamedTypeSymbol? cls)
{
    if (cls is null)
        return false;
    // The delegate TARGET must be `this` — a bare identifier (implicit this) or an
    // explicit `this.X`. A method group qualified with ANOTHER instance of the same
    // App-derived type (`otherApp.OnTheme`) has the right ContainingType but pins
    // that other instance, not the process-lived singleton (Codex P2).
    var receiverIsThis = right switch
    {
        IdentifierNameSyntax => true,
        MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax } => true,
        _ => false,
    };
    if (!receiverIsThis)
        return false;
    var info = model.GetSymbolInfo(right);
    var sym = info.Symbol as IMethodSymbol
              ?? info.CandidateSymbols.OfType<IMethodSymbol>().FirstOrDefault();
    return sym is not null
        && SymbolEqualityComparer.Default.Equals(sym.ContainingType, cls);
}

// P-004 / issue #227: is the subscriber a `Behavior`-derived class? A behavior is
// attached to (and detached from) exactly one element and CANNOT outlive being
// attached, so the element it reaches through the base-class `AssociatedObject`
// accessor is co-lifetimed with the behavior — the same collectable source<->this
// cycle the shipped self-owned-source exemption already encodes for a constructed
// field. Matched SYNTACTICALLY by the direct base's simple name `Behavior`
// (mirroring IsProcessLivedApplication): the Microsoft.Xaml.Behaviors /
// System.Windows.Interactivity `Behavior`/`Behavior<T>` base does not resolve on the
// Linux runner. Only the direct base is inspected — an intermediate user base
// (`class Concrete : MyBehavior`) is not chased (precision-first: no exemption, the
// honest warning stands), exactly as the App-partial precedent does.
static bool IsBehaviorSubscriber(TypeDeclarationSyntax cls)
{
    if (cls.BaseList is not { } bl)
        return false;
    foreach (var bt in bl.Types)
        if (SimpleBaseName(bt.Type) == "Behavior")
            return true;
    return false;
}

static string? SimpleBaseName(TypeSyntax t) => t switch
{
    IdentifierNameSyntax id => id.Identifier.Text,
    GenericNameSyntax g => g.Identifier.Text,           // Behavior<T>
    QualifiedNameSyntax q => SimpleBaseName(q.Right),    // ...Interactivity.Behavior
    AliasQualifiedNameSyntax aq => SimpleBaseName(aq.Name),
    _ => null,
};

// #227: a bare/`this`-qualified read of the base-class `AssociatedObject` accessor —
// `this.AssociatedObject` or `AssociatedObject`. The NAME is matched syntactically (the
// property is inherited from the `Behavior` base, which does not resolve on the Linux
// runner), through casts/`!`. A member access qualified with anything else
// (`other.AssociatedObject`) reaches ANOTHER object and is rejected.
//
// But the name alone is not enough: a local, a parameter, or a hidden member DECLARED in
// this class named `AssociatedObject` can SHADOW the inherited accessor and hold an
// injected publisher (`void Wire(UiElement AssociatedObject) { AssociatedObject.Loaded +=
// H; }`) — that source is NOT co-lifetimed with the behavior (Codex P2). So the symbol is
// checked: the genuine base accessor is either UNRESOLVED (null — the Interactivity
// assembly is absent, the normal WPF case) or an INHERITED member (containing type is a
// base, not this class); a local/parameter binding, or a member declared on this class,
// is a shadow and denies the exemption.
static bool IsAssociatedObjectAccess(ExpressionSyntax expr, SemanticModel model,
                                     TypeDeclarationSyntax clsNode)
{
    expr = StripCasts(expr);
    var nameMatches = expr switch
    {
        MemberAccessExpressionSyntax m => m.Name.Identifier.Text == "AssociatedObject"
            && m.Expression is ThisExpressionSyntax,
        IdentifierNameSyntax id => id.Identifier.Text == "AssociatedObject",
        _ => false,
    };
    if (!nameMatches)
        return false;
    var sym = model.GetSymbolInfo(expr).Symbol;
    if (sym is null)
        return true;                       // unresolved inherited accessor (the WPF runner case)
    if (sym is ILocalSymbol or IParameterSymbol)
        return false;                      // a shadowing local/parameter, not the accessor
    if (sym is IFieldSymbol or IPropertySymbol
        && model.GetDeclaredSymbol(clsNode) is { } clsSym
        && SymbolEqualityComparer.Default.Equals(sym.ContainingType, clsSym))
        return false;                      // a hidden own member shadowing the accessor
    return true;                           // an inherited (or resolvable base) accessor
}

// #227: does `expr` provably resolve to `this.AssociatedObject` — directly, or through
// an assignment-chain-LOCAL step (a `var x = ...` initializer, an `is`-pattern
// designation, or a FIELD of this class assigned from it)? The provenance is
// syntactic and same-class (never interprocedural): a local carries the binding only
// when nothing rebinds it (IsNeverReassigned), and a field only when EVERY assignment
// to it in the class resolves to `AssociatedObject` (a single injected/constructed
// write anywhere denies the proof — precision-first, the worst case keeps the honest
// warning). Depth-bounded so a self-referential field cannot spin.
static bool ResolvesToAssociatedObject(ExpressionSyntax expr, SemanticModel model,
                                       TypeDeclarationSyntax clsNode, int depth)
{
    if (depth > 4)
        return false;
    expr = StripCasts(expr);
    if (IsAssociatedObjectAccess(expr, model, clsNode))
        return true;
    var sym = model.GetSymbolInfo(expr).Symbol;
    if (sym is ILocalSymbol local)
    {
        // The declaration-site binding proves the local's value at the use only if
        // nothing rebinds it (same conservative whole-member scan as #228).
        if (!IsNeverReassigned(local, model))
            return false;
        foreach (var r in local.DeclaringSyntaxReferences)
            switch (r.GetSyntax())
            {
                // var panel = this.AssociatedObject;
                case VariableDeclaratorSyntax { Initializer.Value: { } init }
                    when ResolvesToAssociatedObject(init, model, clsNode, depth + 1):
                    return true;
                // this.AssociatedObject is Panel panel   /   ... is { } panel
                case SingleVariableDesignationSyntax des
                    when des.Ancestors().OfType<IsPatternExpressionSyntax>().FirstOrDefault()
                         is { Expression: { } scrutinee }
                         && ResolvesToAssociatedObject(scrutinee, model, clsNode, depth + 1):
                    return true;
            }
        return false;
    }
    if (sym is IFieldSymbol field)
        return FieldAssignedOnlyFromAssociatedObject(field, model, depth);
    return false;
}

// #227: a field is a valid `AssociatedObject` alias only when it is populated ONLY
// from `AssociatedObject` — at least one such assignment, and no assignment to a
// value we cannot prove is `AssociatedObject` (an injected/constructed write would
// make the field's contents ambiguous at the `+=`). Scans EVERY partial declaration of
// the field's containing type (a disqualifying injected write may live in a sibling
// partial FILE — the merged compilation makes them all reachable through the symbol's
// DeclaringSyntaxReferences), each with its own tree's semantic model. The field
// population evidence may thus live in the same `OnAttached` or any other member/partial
// of the class.
static bool FieldAssignedOnlyFromAssociatedObject(IFieldSymbol field, SemanticModel model,
                                                  int depth)
{
    var any = false;
    foreach (var decl in EnumerateTypeDeclarations(field.ContainingType))
    {
        var m = model.Compilation.GetSemanticModel(decl.SyntaxTree);
        foreach (var asg in decl.DescendantNodes().OfType<AssignmentExpressionSyntax>())
        {
            if (!asg.IsKind(SyntaxKind.SimpleAssignmentExpression))
                continue;
            if (!SymbolEqualityComparer.Default.Equals(m.GetSymbolInfo(asg.Left).Symbol, field))
                continue;
            any = true;
            if (!ResolvesToAssociatedObject(asg.Right, m, decl, depth + 1))
                return false;
        }
    }
    return any;
}

// The syntax declarations of a type symbol — every `partial` piece (in the merged
// compilation, across files). Used to scan a member's assignment sites wherever they live.
static IEnumerable<TypeDeclarationSyntax> EnumerateTypeDeclarations(INamedTypeSymbol type)
{
    foreach (var r in type.DeclaringSyntaxReferences)
        if (r.GetSyntax() is TypeDeclarationSyntax td)
            yield return td;
}

// #227: the self-owned-source exemption for a `Behavior` reaching its own
// `AssociatedObject`. The `+=` receiver must resolve to `this.AssociatedObject` (or an
// assignment-chain-local/field/pattern-var provably drawn from it). Caller gates on
// IsBehaviorSubscriber — attaching/detaching guarantees co-lifetime ONLY in that
// pairing — so a lambda handler is fine here (unlike #228): capturing `this`/its
// locals just closes the collectable source<->behavior cycle, it does not pin a
// process-lived source to a shorter-lived capture.
static bool IsAssociatedObjectSource(ExpressionSyntax left, SemanticModel model,
                                     TypeDeclarationSyntax clsNode)
    => left is MemberAccessExpressionSyntax m
       && ResolvesToAssociatedObject(m.Expression, model, clsNode, depth: 0);

// P-004 / issue #229: the `+=` receiver is an element of a collection the class OWNS —
// a `foreach (var x in FieldOrProperty)` loop variable whose collection is a this-owned
// field/property the class ITSELF populates (own construction / own factory / collection
// initializer), never an injected or ctor-parameter value. The collection and its
// elements then share the constructing object's lifetime, so the subscription is a
// collectable self-cycle, not a leak. All checks are same-class and syntactic:
//   * the receiver must bind to a `foreach` variable (matched by SYMBOL);
//   * the loop's collection must be a bare/`this`-qualified member of THIS class;
//   * that member's every population site must be an own-produced value (below) — a
//     single injected/parameter assignment denies the proof (precision-first).
static bool IsOwnedCollectionElementSource(ExpressionSyntax left, SemanticModel model,
                                           INamedTypeSymbol? cls)
{
    if (cls is null || left is not MemberAccessExpressionSyntax m)
        return false;
    if (model.GetSymbolInfo(m.Expression).Symbol is not ILocalSymbol loopVar)
        return false;
    // The receiver's symbol must be the variable DECLARED by an enclosing `foreach`.
    var forEach = m.Expression.Ancestors().OfType<ForEachStatementSyntax>()
        .FirstOrDefault(f => SymbolEqualityComparer.Default.Equals(
                                 model.GetDeclaredSymbol(f), loopVar));
    if (forEach is null)
        return false;
    // The iterated collection must be a bare `Field` / `this.Field` of THIS class — a
    // `other.Items` reaches another instance's collection (unknown element lifetime).
    var collExpr = StripCasts(forEach.Expression);
    if (collExpr is not (IdentifierNameSyntax
                         or MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax }))
        return false;
    var member = model.GetSymbolInfo(collExpr).Symbol;
    if (member is not (IFieldSymbol or IPropertySymbol))
        return false;
    if (!SymbolEqualityComparer.Default.Equals(member.ContainingType, cls))
        return false;
    return MemberPopulatedByOwnFactory(member, model, cls);
}

// #229: is EVERY population of this field/property an own-produced value — and is there
// at least one? Scans EVERY partial declaration of the containing type (a disqualifying
// injected assignment may live in a sibling partial FILE — the merged compilation makes
// them all reachable through the symbol's DeclaringSyntaxReferences; CodeRabbit), each
// with its own tree's semantic model. An initializer at a declaration, or any simple
// assignment to the member in a ctor/method, is a population site. A single site we
// cannot prove is own-produced (a ctor parameter, an injected field, a service-located
// call) denies the proof, so an injected collection keeps today's honest warning.
static bool MemberPopulatedByOwnFactory(ISymbol member, SemanticModel model,
                                        INamedTypeSymbol cls)
{
    var any = false;
    bool Note(ExpressionSyntax value, SemanticModel m)
    {
        any = true;
        return IsOwnProducedValue(value, m, cls, depth: 0);
    }
    foreach (var decl in EnumerateTypeDeclarations(cls))
    {
        var m = model.Compilation.GetSemanticModel(decl.SyntaxTree);
        // Declaration-site initializer: `= CreateData()` / `= new(){ ... }` on the field
        // or auto-property.
        foreach (var v in decl.DescendantNodes().OfType<VariableDeclaratorSyntax>())
            if (v.Initializer is { } vi
                && SymbolEqualityComparer.Default.Equals(m.GetDeclaredSymbol(v), member)
                && !Note(vi.Value, m))
                return false;
        foreach (var p in decl.DescendantNodes().OfType<PropertyDeclarationSyntax>())
            if (p.Initializer is { } pi
                && SymbolEqualityComparer.Default.Equals(m.GetDeclaredSymbol(p), member)
                && !Note(pi.Value, m))
                return false;
        // Assignment sites: `Items1 = CreateData();`
        foreach (var asg in decl.DescendantNodes().OfType<AssignmentExpressionSyntax>())
            if (asg.IsKind(SyntaxKind.SimpleAssignmentExpression)
                && SymbolEqualityComparer.Default.Equals(m.GetSymbolInfo(asg.Left).Symbol, member)
                && !Note(asg.Right, m))
                return false;
    }
    return any;
}

// #229: a value the class PRODUCES itself, not one that FLOWS IN — and whose ELEMENTS are
// themselves own-produced (the subscribed events live on those elements, so a collection
// object that is freshly `new`d but SEEDED with injected elements is NOT owned). Two
// forms, checked recursively (Codex P1):
//   * an object creation whose constructor arguments AND collection-initializer elements
//     are each own-produced — `new List<Model>()`, `new() { new Model(), new Model() }`;
//     `new List<Model>(injectedSource)` and `new() { injectedModel }` are rejected;
//   * an invocation of an OWN factory (a method of THIS class with an implicit/`this`
//     receiver) whose body PROVABLY returns an own-produced value — so a wrapper
//     `List<Model> GetData() => _service.GetData()` that forwards injected elements is
//     rejected. A call through any other receiver (`_service.GetData()`) is likewise out.
// Casts/`!` are peeled first; depth-bounded so a self-referential factory cannot spin.
static bool IsOwnProducedValue(ExpressionSyntax expr, SemanticModel model,
                               INamedTypeSymbol cls, int depth)
{
    if (depth > 3)
        return false;
    expr = StripCasts(expr);
    if (expr is BaseObjectCreationExpressionSyntax oce)
    {
        // Constructor arguments may SEED the collection with external elements.
        if (oce.ArgumentList is { } al)
            foreach (var arg in al.Arguments)
                if (!IsOwnProducedValue(arg.Expression, model, cls, depth + 1))
                    return false;
        // A collection/object initializer's elements must each be own-produced.
        if (oce.Initializer is { } init)
            foreach (var e in init.Expressions)
                if (!IsOwnProducedValue(e, model, cls, depth + 1))
                    return false;
        return true;
    }
    if (expr is InvocationExpressionSyntax inv)
    {
        var callee = model.GetSymbolInfo(inv).Symbol as IMethodSymbol;
        if (callee is null
            || !SymbolEqualityComparer.Default.Equals(callee.ContainingType, cls))
            return false;
        var receiverIsOwn = inv.Expression switch
        {
            IdentifierNameSyntax => true,                                       // CreateData()
            MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax } => true, // this.CreateData()
            _ => false,
        };
        return receiverIsOwn && FactoryReturnsOwnProduced(callee, model, cls, depth);
    }
    return false;
}

// #229: does this own-class factory PROVABLY return only own-produced values? Inspects
// its body (same-class, so within the class-level scan the guardrail allows): an
// expression body `=> expr`, or every `return expr` in a block body, must be own-produced.
// No visible body, a bodiless return, or any non-own-produced return denies the proof —
// so a wrapper that forwards an injected/service-located collection keeps the warning.
// (Returns nested in lambdas/local functions only make the check MORE conservative.)
static bool FactoryReturnsOwnProduced(IMethodSymbol factory, SemanticModel model,
                                      INamedTypeSymbol cls, int depth)
{
    if (factory.DeclaringSyntaxReferences.Length == 0)
        return false;
    var any = false;
    foreach (var r in factory.DeclaringSyntaxReferences)
    {
        if (r.GetSyntax() is not MethodDeclarationSyntax md)
            return false;
        var m = model.Compilation.GetSemanticModel(md.SyntaxTree);
        if (md.ExpressionBody is { } eb)
        {
            any = true;
            if (!IsOwnProducedValue(eb.Expression, m, cls, depth + 1))
                return false;
            continue;
        }
        if (md.Body is null)
            return false;
        var returns = md.Body.DescendantNodes().OfType<ReturnStatementSyntax>().ToList();
        if (returns.Count == 0)
            return false;
        foreach (var ret in returns)
        {
            any = true;
            if (ret.Expression is null
                || !IsOwnProducedValue(ret.Expression, m, cls, depth + 1))
                return false;
        }
    }
    return any;
}

// P-004 WPF MVVM ownership: a field read from `this.DataContext`, optionally through
// an `as`/cast (`DataContext as VM`, `(VM)DataContext`). Combined with a view whose
// own XAML CONSTRUCTS its DataContext, such a field is the view's owned view-model.
static bool ReadsDataContext(ExpressionSyntax expr)
{
    expr = expr switch
    {
        BinaryExpressionSyntax b when b.IsKind(SyntaxKind.AsExpression) => b.Left,
        CastExpressionSyntax c => c.Expression,
        _ => expr,
    };
    return expr switch
    {
        IdentifierNameSyntax id => id.Identifier.Text == "DataContext",
        MemberAccessExpressionSyntax m => m.Name.Identifier.Text == "DataContext"
            && m.Expression is ThisExpressionSyntax,
        _ => false,
    };
}

// P-004 WPF MVVM ownership: does this XAML construct its own DataContext inline —
// `<Root.DataContext><vm:Foo/></Root.DataContext>` — so the view OWNS its view-model
// (a collectable view<->VM cycle)? Parsed structurally (XAML is XML), restricted to the
// ROOT element's own DataContext: the code-behind's `this.DataContext` is the root's, so
// a nested `<Grid.DataContext><ChildVm/>` (a different element's) must NOT exempt the
// view (Codex / CodeRabbit) — else a real leak on the root's injected VM is dropped.
// True only when the root's DataContext child is a constructed object that the view owns:
// NOT a binding / resource reference, and NOT an `x:`-namespace language object
// (`x:Static`, `x:Null`, `x:Reference`, ...), which name an external/shared value. A
// malformed `.xaml` yields false (conservative — no exemption, never a dropped leak).
static bool XamlDeclaresOwnedDataContext(string xaml)
{
    XDocument doc;
    try { doc = XDocument.Parse(xaml); }
    catch (System.Xml.XmlException) { return false; }
    var root = doc.Root;
    if (root is null)
        return false;
    // The root's OWN `<Root.DataContext>` property-element (a direct child of the root,
    // in the root's namespace) — not a nested element's, not another property.
    var dc = root.Element(root.Name.Namespace + (root.Name.LocalName + ".DataContext"));
    var child = dc?.Elements().FirstOrDefault();
    if (child is null)
        return false;
    if (child.Name.NamespaceName == "http://schemas.microsoft.com/winfx/2006/xaml")
        return false;   // x:Static / x:Null / x:Reference / x:Type / ...
    return child.Name.LocalName is not ("Binding" or "MultiBinding" or "PriorityBinding"
        or "StaticResource" or "DynamicResource" or "RelativeSource"
        or "TemplateBinding" or "Reference" or "Null");
}

// P-004 severity tiering: of the subscriptions that survive the self-owned and
// static-handler exemptions (and are not timers), how long-lived is the event
// SOURCE? A static event lives for the whole process, so an undetached handler is
// a provable leak -> "static". A local that is CONSTRUCTED right here (`var p =
// new Publisher(); p.X += h`) dies with the scope -> "local" (the caller drops it;
// not a heap leak). But a local that merely ALIASES something else (`var src =
// _bus; src.X += h`) has unknown provenance — it may hold a long-lived injected
// source — so it is NOT dropped. Everything else (an instance field / property /
// injected parameter, or such an aliasing local) has UNKNOWN lifetime ->
// "injected": it MIGHT outlive `this`, but we cannot prove it without ownership
// modelling, so the core renders it a warning (not a hard error) until that lands.
static string SubscriptionSourceKind(ExpressionSyntax left, IEventSymbol ev,
                                     SemanticModel model)
{
    if (ev.IsStatic)
        return "static";
    if (left is MemberAccessExpressionSyntax m)
    {
        var recv = model.GetSymbolInfo(m.Expression).Symbol;
        if (recv is ILocalSymbol local)
        {
            // Method-bounded (droppable) ONLY when the local is the publisher this
            // scope constructs (`var p = new Publisher()`), which dies with it. A
            // local initialised from anything else (a field, a parameter, a call)
            // may alias a long-lived source, so we cannot prove it bounded — fall
            // through to "injected" and warn rather than silently drop a real leak.
            var constructedHere = local.DeclaringSyntaxReferences
                .Select(r => r.GetSyntax())
                .OfType<VariableDeclaratorSyntax>()
                .Any(v => v.Initializer?.Value is ObjectCreationExpressionSyntax
                                               or ImplicitObjectCreationExpressionSyntax);
            if (constructedHere)
                return "local";
        }
        if (recv is IFieldSymbol { IsStatic: true } or IPropertySymbol { IsStatic: true })
            return "static";
    }
    return "injected";
}

// A lambda / anonymous-method handler stores no named delegate, so the
// subscription can NEVER be undone with `-=` (you would have had to cache the
// delegate in a field). A particularly sharp leak shape worth calling out.
static bool IsLambdaHandler(ExpressionSyntax right) =>
    right is AnonymousFunctionExpressionSyntax;

// --- #146: interprocedural "constructed-and-returned" publisher provenance ---
//
// A `+=` whose publisher is a PARAMETER is tiered `injected` by
// SubscriptionSourceKind — honest locally, because inside the method a DI
// singleton bus (a real leak) and a caller-owned fresh publisher (bounded) are
// syntactically identical. This pass proves the bounded case ACROSS the
// compilation — the dual of ownership transfer (D5): if EVERY visible caller
// passes a publisher it freshly constructs and lets escape only into this call
// or its own `return`, and the callee itself never lets the parameter escape,
// then the handler lives exactly as long as the object the caller now holds —
// bounded, not a leak (the bridge drops the stamped fact; ownlang/ownir.py
// `source_provenance`). Precision-first: ANY unprovable step — public/protected
// candidate, method-group reference, named/ref/omitted argument, non-local or
// non-fresh argument, any other use of the caller's local, lambda capture, zero
// visible callers — denies the proof and the honest OWN001 warning stands.
// (Mined shape: Newtonsoft JsonSerializer.Create -> ApplySerializerSettings;
// field-notes #7.)

static bool IsReturnedFreshParam(IParameterSymbol p, CSharpCompilation compilation,
                                 Dictionary<IParameterSymbol, bool> cache)
{
    if (cache.TryGetValue(p, out var hit)) return hit;
    var ok = ComputeReturnedFreshParam(p, compilation);
    cache[p] = ok;
    return ok;
}

static bool ComputeReturnedFreshParam(IParameterSymbol p, CSharpCompilation compilation)
{
    // Callee gate: only an in-compilation-callable method can have ALL its
    // callers audited. `public`/`protected` (incl. `protected internal`) may be
    // called from outside this compilation -> deny; `internal` is auditable
    // here (this scan IS the assembly view).
    if (p.RefKind != RefKind.None || p.IsParams) return false;
    if (p.ContainingSymbol is not IMethodSymbol m) return false;
    if (m.MethodKind is not (MethodKind.Ordinary or MethodKind.LocalFunction)) return false;
    if (m.DeclaredAccessibility is not (Accessibility.Private or Accessibility.Internal
                                        or Accessibility.ProtectedAndInternal)) return false;
    // The callee must never let the publisher escape: every reference to the
    // parameter must be a plain member-access RECEIVER (`p.Event += h`,
    // `p.Prop = v`, `p.Method()`), outside any lambda (a capturing lambda can
    // outlive the call). A bare `p` — as an argument, an assignment side, a
    // return value, a conditional access — denies.
    foreach (var declRef in m.DeclaringSyntaxReferences)
    {
        var mnode = declRef.GetSyntax();
        var mModel = compilation.GetSemanticModel(mnode.SyntaxTree);
        foreach (var id in mnode.DescendantNodes().OfType<IdentifierNameSyntax>())
        {
            if (id.Identifier.Text != p.Name) continue;
            if (mModel.GetSymbolInfo(id).Symbol is not IParameterSymbol rp
                || !SymbolEqualityComparer.Default.Equals(rp, p)) continue;
            if (id.Parent is not MemberAccessExpressionSyntax pma || pma.Expression != id)
                return false;
            // ANY nested function boundary between the reference and the method's
            // own declaration is a closure that can be stored and invoked from a
            // longer-lived root — a lambda OR a local function (Codex P2: a stored
            // `void Later() { p.Event += h; }` escapes exactly like a lambda).
            // Bounded at `mnode` so the method's own declaration node never
            // self-denies.
            if (id.Ancestors().TakeWhile(a => a != mnode)
                   .Any(a => a is AnonymousFunctionExpressionSyntax
                          or LocalFunctionStatementSyntax))
                return false;
        }
    }
    // Caller gate: every visible reference to the method must be a direct call
    // whose argument for THIS parameter is a bounded fresh local. A method-group
    // reference (delegate conversion) hides call paths -> deny. Zero visible
    // calls (reflection-only / dead code) -> deny. (A `nameof` reference binds
    // to no single symbol and creates no call path, so it is skipped, not
    // denied.)
    var target = m.OriginalDefinition;
    var sawCall = false;
    foreach (var tree in compilation.SyntaxTrees)
    {
        // name-prefilter: bind only trees/nodes that even mention the name.
        List<SimpleNameSyntax>? hits = null;
        foreach (var n in tree.GetRoot().DescendantNodes().OfType<SimpleNameSyntax>())
            if (n.Identifier.Text == m.Name)
                (hits ??= new List<SimpleNameSyntax>()).Add(n);
        if (hits is null) continue;
        var tModel = compilation.GetSemanticModel(tree);
        foreach (var id in hits)
        {
            if (tModel.GetSymbolInfo(id).Symbol is not IMethodSymbol called
                || !SymbolEqualityComparer.Default.Equals(called.OriginalDefinition, target))
                continue;
            var expr = id.Parent is MemberAccessExpressionSyntax ma && ma.Name == id
                ? (ExpressionSyntax)ma : (ExpressionSyntax)id;
            if (expr.Parent is not InvocationExpressionSyntax inv || inv.Expression != expr)
                return false;
            sawCall = true;
            if (!CallPassesBoundedFreshLocal(inv, p.Ordinal, target, tModel))
                return false;
        }
    }
    return sawCall;
}

static bool CallPassesBoundedFreshLocal(InvocationExpressionSyntax inv, int ordinal,
                                        IMethodSymbol target, SemanticModel model)
{
    var arg = ArgumentForOrdinal(inv, ordinal, target);
    if (arg is null || !arg.RefKindKeyword.IsKind(SyntaxKind.None)) return false;
    // the argument must be a LOCAL, freshly constructed at its declarator
    // (`var x = new T()` / `Publisher x = new()`); a field, parameter, property
    // or call result may alias a long-lived publisher -> deny.
    if (arg.Expression is not IdentifierNameSyntax lid
        || model.GetSymbolInfo(lid).Symbol is not ILocalSymbol local)
        return false;
    var decl = local.DeclaringSyntaxReferences
        .Select(r => r.GetSyntax()).OfType<VariableDeclaratorSyntax>().FirstOrDefault();
    if (decl?.Initializer?.Value is not (ObjectCreationExpressionSyntax
                                         or ImplicitObjectCreationExpressionSyntax))
        return false;
    // the local's scope: the enclosing method/accessor/local-function body.
    SyntaxNode? scope = decl;
    while (scope is not null
           && scope is not BaseMethodDeclarationSyntax
           && scope is not AccessorDeclarationSyntax
           && scope is not LocalFunctionStatementSyntax
           && scope is not AnonymousFunctionExpressionSyntax)
        scope = scope.Parent;
    if (scope is null) return false;
    // every use of the local must be an argument feeding THIS parameter of THIS
    // method, or a plain `return local;`. Anything else — a field/property
    // store, another callee, a lambda capture, a reassignment, `ref`/`out` —
    // denies. (The declarator identifier is a token, not an IdentifierName, so
    // the declaration itself is not walked.)
    foreach (var use in scope.DescendantNodes().OfType<IdentifierNameSyntax>())
    {
        if (use.Identifier.Text != local.Name) continue;
        if (model.GetSymbolInfo(use).Symbol is not ILocalSymbol us
            || !SymbolEqualityComparer.Default.Equals(us, local)) continue;
        // a use inside ANY nested function below the scope — lambda or local
        // function — is a closure capture: the closure can be stored and run
        // after the local has escaped (Codex P2: `void Wire() => Apply(p, s);`
        // stored into a delegate), so even a target-argument use there denies.
        if (use.Ancestors().TakeWhile(a => a != scope)
               .Any(a => a is AnonymousFunctionExpressionSyntax
                      or LocalFunctionStatementSyntax))
            return false;
        if (use.Parent is ReturnStatementSyntax) continue;
        if (use.Parent is ArgumentSyntax ua && ua.RefKindKeyword.IsKind(SyntaxKind.None)
            && ua.Parent?.Parent is InvocationExpressionSyntax uinv
            && model.GetSymbolInfo(uinv).Symbol is IMethodSymbol ucalled
            && SymbolEqualityComparer.Default.Equals(ucalled.OriginalDefinition, target)
            && ArgumentForOrdinal(uinv, ordinal, target) == ua)
            continue;
        return false;
    }
    return true;
}

static ArgumentSyntax? ArgumentForOrdinal(InvocationExpressionSyntax inv, int ordinal,
                                          IMethodSymbol target)
{
    var args = inv.ArgumentList.Arguments;
    for (int i = 0; i < args.Count; i++)
    {
        var a = args[i];
        if (a.NameColon is { } nc)
        {
            if (nc.Name.Identifier.Text == target.Parameters[ordinal].Name) return a;
        }
        else if (i == ordinal)
            return a;
    }
    return null;   // omitted (optional) / params-collapsed -> unprovable
}

// P-004 source-lifetime tier for an ignored `.Subscribe()` chain (WPF004). A
// self-rooted `this.WhenAnyValue(p => p.SelfProp).<self-preserving ops>.Subscribe`
// watches the component's OWN property: the observable, its handler and `this`
// form one cycle the GC collects together, so it is NOT a leak. We classify ONLY
// this unambiguous self-cycle (the bridge drops a `source: "self"` subscribe).
// Anything else stays a flagged leak (conservative). Purely syntactic.

// A single-source operator whose arguments are only funcs / schedulers / scalars,
// so it cannot mix in an EXTERNAL observable. A combinator NOT listed here
// (CombineLatest, Merge, SelectMany, WithLatestFrom, Zip, Switch, Concat, ...), an
// operator with an observable-taking overload (Throttle/Buffer/Sample/TakeUntil/
// Window), or any unknown operator is treated as possibly external -> the chain
// stays flagged. (Conservative: an unrecognised op never silences a real leak.)
static bool IsSelfPreservingOp(string name) =>
    name is "Select" or "Where" or "Do" or "Skip" or "Take" or "SkipWhile"
        or "TakeWhile" or "ObserveOn" or "SubscribeOn" or "DistinctUntilChanged"
        or "WhereNotNull" or "Cast" or "OfType" or "StartWith" or "Scan"
        or "Finally" or "AsObservable" or "Synchronize" or "Timestamp";

// One WhenAnyValue selector `p => p.Member` rooted at the lambda parameter — a
// single-hop self property. NOT `p => p.A.B` (a path through a possibly-injected
// object that can keep `this` alive — a real leak), and NOT a result-combiner
// lambda (`(a, b) => ...`). Purely syntactic.
static bool IsSelfMemberSelector(ArgumentSyntax arg) =>
    arg.Expression is SimpleLambdaExpressionSyntax lam
        && lam.Body is MemberAccessExpressionSyntax body
        && body.Expression is IdentifierNameSyntax pid
        && pid.Identifier.Text == lam.Parameter.Identifier.Text;

static bool IsSelfRootedWhenAny(ExpressionSyntax chain)
{
    // Walk the fluent chain leftwards. The HEAD must be `this.WhenAnyValue(...)`;
    // EVERY downstream operator must be self-preserving (no external observable),
    // else a later `.CombineLatest(_bus.X)` / `.SelectMany(_ => _bus.Y)` roots the
    // subscription externally and it must stay flagged (codex P1).
    var e = chain;
    while (e is InvocationExpressionSyntax iv
           && iv.Expression is MemberAccessExpressionSyntax ma)
    {
        if (ma.Expression is ThisExpressionSyntax)
        {
            // Head: `this.WhenAnyValue(p => p.Member[, q => q.Other, ...])`. A
            // self-cycle requires WhenAnyValue with one-or-more single-hop
            // self-member selectors — each roots at `this`. `p => p.A.B` (a path
            // through a possibly-injected object) and a result-combiner overload
            // (`..., (a, b) => ...`) stay flagged. Multi-arg over own properties
            // observes only `this`, the SAME self-cycle as single-arg (see
            // docs/notes/self-whenany-precision.md).
            if (ma.Name.Identifier.Text != "WhenAnyValue"
                || iv.ArgumentList.Arguments.Count < 1)
                return false;
            foreach (var arg in iv.ArgumentList.Arguments)
                if (!IsSelfMemberSelector(arg))
                    return false;
            return true;
        }
        if (!IsSelfPreservingOp(ma.Name.Identifier.Text))
            return false;          // a combinator / unknown op -> possibly external
        e = ma.Expression;
    }
    return false;                  // not a `this.WhenAnyValue(...)`-headed chain
}

// --- P-016 B0b/B2: flow lowering for local IDisposables (experimental) ---

// A type that implements System.IDisposable (semantic) — the flow lowering tracks
// locals of such types.
static bool ImplementsIDisposable(ITypeSymbol? t) =>
    t is not null
    && ((t.Name == "IDisposable" && t.ContainingNamespace?.ToString() == "System")
        || t.AllInterfaces.Any(i => i.Name == "IDisposable"
                                    && i.ContainingNamespace?.ToString() == "System"));

// --- Issue #219: WinForms disposal CHANNELS ---

// The class reaches the framework disposal root via a designer `Dispose(bool)` that calls
// `base.Dispose(disposing)` — `Control.Dispose(bool)` recursively disposes its `Controls` collection
// and the `IContainer components`. Only such a class is treated as rooted; a class with no Dispose at
// all (the ShareX HistoryItemManager true-positive) is NOT, so its owned controls stay flagged.
static bool ClassReachesDisposalRoot(ClassDeclarationSyntax cls)
{
    foreach (var m in cls.Members.OfType<MethodDeclarationSyntax>())
        if (m.Identifier.Text == "Dispose")
            foreach (var inv in m.DescendantNodes().OfType<InvocationExpressionSyntax>())
                if (inv.Expression is MemberAccessExpressionSyntax
                    { Expression: BaseExpressionSyntax, Name.Identifier.Text: "Dispose" })
                    return true;
    return false;
}

// A type that is (or implements) `IContainer` — the designer `components` sink. Matched by simple
// name (like the other WinForms type recognitions), so `System.ComponentModel.IContainer` and a
// stand-in of the same name both resolve.
static bool ImplementsIContainer(ITypeSymbol? t) =>
    t is not null
    && (t.Name == "IContainer" || t.AllInterfaces.Any(i => i.Name == "IContainer"));

// The container an `X.Controls.Add(..)` / `X.Items.Add(..)` collection belongs to, given the
// collection expression `X.Controls` / `X.Items` (or a bare inherited `Controls`/`Items`): "" (a
// sentinel) for THIS object, the FIELD name for a `this.<field>`/`<field>` container, or null when it
// is not a disposing collection, or its container is FOREIGN (a parameter / local / another
// instance). A `Controls` collection (Control.ControlCollection) disposes its children, and a
// ToolStrip's `Items` (ToolStripItemCollection) disposes its items — but a ComboBox/ListBox `Items`
// (ObjectCollection) does NOT dispose arbitrary items, so an `Items` add is a channel only when the
// collection's type is a ToolStripItemCollection (Codex). Semantic on the receiver so a parameter
// named like a field is not mistaken for one.
static string? CollectionContainerKey(ExpressionSyntax collExpr, SemanticModel model)
{
    string member;
    ExpressionSyntax? containerObj;
    switch (collExpr)
    {
        case IdentifierNameSyntax { Identifier.Text: "Controls" or "Items" } bare:
            member = bare.Identifier.Text; containerObj = null; break;   // inherited member -> this
        case MemberAccessExpressionSyntax { Name.Identifier.Text: "Controls" or "Items" } ma:
            member = ma.Name.Identifier.Text; containerObj = ma.Expression; break;
        default:
            return null;
    }
    // `Items` disposes its items only for a ToolStripItemCollection; a ComboBox/ListBox
    // ObjectCollection does not, so it is not a disposal channel.
    if (member == "Items" && model.GetTypeInfo(collExpr).Type?.Name != "ToolStripItemCollection")
        return null;
    if (containerObj is null or ThisExpressionSyntax)
        return "";
    return model.GetSymbolInfo(containerObj).Symbol is IFieldSymbol { IsStatic: false } f ? f.Name : null;
}

// The THIS-field names added by an `.Add(this.child)` / `.AddRange(new T[]{ this.a, this.b })` call —
// flattening an array-creation initializer (the designer `AddRange` form). Semantic (IFieldSymbol) so
// only real fields of this object are credited.
static IEnumerable<string> AddedFieldNames(ArgumentListSyntax args, SemanticModel model)
{
    foreach (var a in args.Arguments)
    {
        var items = a.Expression switch
        {
            ArrayCreationExpressionSyntax { Initializer: { } ai } => ai.Expressions,
            ImplicitArrayCreationExpressionSyntax { Initializer: { } ii } => ii.Expressions,
            _ => default,
        };
        if (items.Count > 0)
        {
            foreach (var e in items)
                if (model.GetSymbolInfo(e).Symbol is IFieldSymbol { IsStatic: false } af)
                    yield return af.Name;
        }
        else if (model.GetSymbolInfo(a.Expression).Symbol is IFieldSymbol { IsStatic: false } sf)
            yield return sf.Name;
    }
}

// The ignored result of a member `.Subscribe(...)` is a leakable IDisposable token (WPF004) only
// when the call RETURNS an IDisposable — the Rx `IObservable<T>.Subscribe()` shape. A RESOLVED void
// / non-IDisposable return has no token to leak: StackExchange.Redis's `ISubscriber.Subscribe(channel,
// handler, flags)` returns void, as do many event-bus `Subscribe(handler)` APIs. Only an UNRESOLVED
// return type keeps the syntactic benefit of the doubt (mirrors IsOwnedDisposableType, #83). Mined:
// StackExchange.Redis ConnectionMultiplexer.Sentinel `sub.Subscribe(channel, handler, FireAndForget)`.
static bool SubscribeResultIsDisposable(ITypeSymbol? rt) =>
    rt is null or IErrorTypeSymbol
    || rt.TypeKind == TypeKind.Dynamic   // a `dynamic` receiver -> dynamic return; can't prove non-disposable (Codex)
    || ImplementsIDisposable(rt);

// Types that implement IDisposable but whose disposal is conventionally OPTIONAL —
// the .NET guidance / Roslyn CA2000 exempt them: Task/ValueTask only hold a
// lazily-allocated wait handle, and the System.Data containers' Dispose() is a
// no-op. The flow detector must not flag an undisposed local of these (this is the
// curated exemption the flat D1 detector gets for free via IsDisposableType, which
// is exactly why D1 never flagged Task/DataTable and the semantic path did).
static bool IsDisposeOptional(ITypeSymbol t)
{
    var ns = t.ContainingNamespace?.ToString();
    return (ns == "System.Threading.Tasks" && t.Name is "Task" or "ValueTask")
        || (ns == "System.Data" && t.Name is "DataTable" or "DataSet" or "DataView")
        // System.IO string-backed reader/writer: a StringWriter wraps a StringBuilder
        // and a StringReader reads a string — neither holds an OS handle / unmanaged
        // resource, so Dispose() frees nothing real and an undisposed one is not a leak.
        // (field-notes #8, mined on Newtonsoft.Json's TraceJsonReader/TraceJsonWriter,
        // where these are owning fields the trace helpers never dispose.) MemoryStream is
        // deliberately NOT here — it can own a real buffer, so it still warns.
        || (ns == "System.IO" && t.Name is "StringWriter" or "StringReader");
}

// An in-memory, dispose-optional backing — a System.IO reader/writer/stream that holds
// only managed memory (MemoryStream's buffer, StringWriter's StringBuilder, StringReader's
// string), so its own Dispose() frees nothing real. Used to decide whether a pass-through
// wrapper built over it is itself a no-op to dispose (see IsNoOpDisposeWrapper). MemoryStream
// is included HERE (a leak-only judgement: an undisposed MemoryStream releases nothing) even
// though IsDisposeOptional deliberately keeps a bare MemoryStream FIELD visible.
static bool IsInMemoryDisposableBacking(ITypeSymbol? t) =>
    t is not null
    && t.ContainingNamespace?.ToString() == "System.IO"
    && t.Name is "MemoryStream" or "StringWriter" or "StringReader";

// A BCL READ-ONLY "pass-through" reader — StreamReader / BinaryReader — whose only
// disposable state is the stream it wraps (plus a managed read-ahead buffer that is simply
// discarded). Its Dispose() merely cascades to that backing, so when the backing is an
// in-memory dispose-optional value the whole chain frees nothing and an undisposed field of
// this shape is not a leak. WRITERS are deliberately EXCLUDED: StreamWriter / BinaryWriter
// FLUSH buffered output to the underlying stream on Dispose (documented behaviour), so a
// never-disposed writer field can leave the backing missing buffered characters / encoder
// state — a real correctness bug, not a managed-memory-only no-op, which the OWN001 still
// usefully flags (Codex P2). A CLOSED allowlist of those two readers, NOT "any BCL stream":
// GZipStream / DeflateStream / CryptoStream wrap a stream too but own their OWN extra
// resource (a native deflater, a crypto transform), so they must STAY flagged. A THIRD-PARTY
// wrapper is also excluded — e.g. Newtonsoft's `JsonTextWriter` over a StringWriter is
// structurally a no-op, but we cannot prove ITS Dispose is pass-through without modelling its
// body, so it stays a (baselined) finding, never a silent drop. The backing is the FIRST ctor
// argument: `new StreamReader(path)` (a string path opens a real FileStream) and
// `new StreamReader(fileStream)` both fail the in-memory check and so correctly keep leaking.
// See docs/notes/no-op-dispose-wrapper.md.
static bool IsNoOpDisposeWrapper(BaseObjectCreationExpressionSyntax oce, SemanticModel model)
{
    if (model.GetTypeInfo(oce).Type is not { } wt
        || wt.ContainingNamespace?.ToString() != "System.IO"
        || wt.Name is not ("StreamReader" or "BinaryReader"))
        return false;
    var arg0 = oce.ArgumentList?.Arguments.FirstOrDefault()?.Expression;
    return arg0 is not null && IsInMemoryDisposableBacking(model.GetTypeInfo(arg0).Type);
}

// Issue #225 (narrowed by #238) — a user-defined `IEnumerator<T>` whose parameterless `Dispose()`
// body is provably EMPTY holds no resource behind the interface: `IEnumerator<T>` is the one
// interface that FORCES IDisposable onto types that usually hold nothing, so never calling its
// empty Dispose() cannot leak. Recognised from SOURCE: the type declares `void Dispose()` (plain or
// explicit-interface) with a BLOCK body of ZERO statements, and no base in its chain carries a
// Dispose to cascade to, no IAsyncDisposable / bare DisposeAsync anywhere in the type or its bases,
// and no FodyWeavers.xml above it (an IL weaver could rewrite the "empty" body at build time — the
// #238 soundness lesson). A body we cannot read (metadata-only, or expression-bodied doing work) is
// NOT provably empty and stays flagged — never a guessed drop. Deliberately NOT "any type": that
// over-broad framing was the #238 regression (263 silently-swallowed ClosedXML findings). Scoped to
// LOCAL disposables (the #201-sweep
// evidence — ClosedXML's `Slice.Enumerator` locals): a FIELD keeps its own disposal contract, so an
// empty-Dispose field (the OwnIgnoreSample `Handle` stand-in) is unaffected.
static bool HasEmptyDisposeBody(ITypeSymbol? t)
{
    if (t is not INamedTypeSymbol nt)
        return false;
    // Issue #238 SOUNDNESS gate: an empty SOURCE body proves nothing about the COMPILED body —
    // IL weavers (Janitor.Fody wove the real cleanup into ClosedXML's XLWorkbook.Dispose(),
    // 263 silently-swallowed findings) rewrite Dispose at build time, and source-level analysis
    // cannot prove their absence. So the exemption is confined to the ONE shape whose empty
    // Dispose is FORCED by the language, not authored: `IEnumerator<T>` — the generic enumerator
    // interface is the only one that transitively requires IDisposable (IEnumerator<T> : IEnumerator,
    // IDisposable). The non-generic System.Collections.IEnumerator does NOT extend IDisposable, so a
    // type that pairs them coupled the two contracts itself — the motivating proof does not apply, and
    // it keeps the honest warning (review #240).
    // Matched by name/arity/namespace, not SpecialType: in the source-only extraction (no wired
    // corelib reference) the well-known-type SpecialType is often unset, so `IEnumerator<T>` would
    // slip through a SpecialType check. `System.Collections.Generic.IEnumerator`1` is the exact
    // interface that transitively forces IDisposable.
    if (!nt.AllInterfaces.Any(i => i.Name == "IEnumerator"
                                   && i.TypeArguments.Length == 1
                                   && i.ContainingNamespace?.ToString() == "System.Collections.Generic"))
        return false;
    // The base must not own a Dispose we'd be silently skipping — only `object` / a non-IDisposable base.
    for (var b = nt.BaseType; b is not null && b.SpecialType != SpecialType.System_Object; b = b.BaseType)
        if (ImplementsIDisposable(b))
            return false;
    // A non-empty DisposeAsync() can do the REAL cleanup even when the sync Dispose() is an empty
    // compatibility no-op. The flow detector treats DisposeAsync() as a release, so an undisposed
    // local of such a type is a real leak. ANY IAsyncDisposable in the interface set — declared on
    // this type OR INHERITED from a base (review #240 P1: the base's real DisposeAsync would
    // otherwise be silently skipped, exactly the #238 false-negative class) — disqualifies the
    // exemption: a type with async disposal is no longer the "simple enumerator holding nothing"
    // this narrow rule is for.
    if (nt.AllInterfaces.Any(i => i.Name == "IAsyncDisposable"
                                  && i.ContainingNamespace?.ToString() == "System"))
        return false;
    // Belt-and-braces for a bare `DisposeAsync()` method that the flow detector may treat as a
    // release without the type formally implementing IAsyncDisposable (declared or explicit-impl).
    // Walk the ENTIRE base chain (review #240 round 2): GetMembers() returns only members declared
    // on the current type, so a base with a bare DisposeAsync (no IAsyncDisposable, so AllInterfaces
    // above misses it) would otherwise slip its real async cleanup through as an exemption.
    for (var cur = nt; cur is not null && cur.SpecialType != SpecialType.System_Object; cur = cur.BaseType)
        if (cur.GetMembers().OfType<IMethodSymbol>().Any(m => m.Parameters.Length == 0
                && (m.Name == "DisposeAsync"
                    || m.ExplicitInterfaceImplementations.Any(x => x.Name == "DisposeAsync"))))
            return false;
    // #238 coverage: `void IDisposable.Dispose() { }` (explicit interface implementation — the
    // actual ClosedXML Slice.Enumerator spelling) is a Dispose too; GetMembers("Dispose") misses
    // it because its metadata name is "System.IDisposable.Dispose".
    var disposes = nt.GetMembers().OfType<IMethodSymbol>().Where(m =>
            m.Parameters.Length == 0 && m.ReturnsVoid && m.TypeParameters.Length == 0
            && (m.Name == "Dispose"
                || m.ExplicitInterfaceImplementations.Any(
                       x => x.ContainingType.SpecialType == SpecialType.System_IDisposable)))
        .ToList();
    if (disposes.Count == 0 || disposes.Any(d => d.DeclaringSyntaxReferences.Length == 0))
        return false;   // no readable source Dispose (metadata-only) -> cannot prove empty
    if (!disposes.All(d => d.DeclaringSyntaxReferences.All(
            sref => sref.GetSyntax() is MethodDeclarationSyntax { Body.Statements.Count: 0 })))
        return false;
    // #238 defense in depth: a FodyWeavers.xml anywhere above the type's source file means a
    // weaver CAN rewrite this Dispose at build time — never exempt, even an enumerator.
    return !SourceTreeHasWeaverConfig(nt);
}

// #238: walk up from the type's declaring source file looking for FodyWeavers.xml (the Fody
// weaver manifest — Janitor/Costura/etc. rewrite method bodies after compilation). A type we
// cannot locate on disk is conservatively treated as weavable (no exemption).
static bool SourceTreeHasWeaverConfig(INamedTypeSymbol nt)
{
    var path = nt.DeclaringSyntaxReferences.FirstOrDefault()?.SyntaxTree.FilePath;
    if (string.IsNullOrEmpty(path))
        return true;
    try
    {
        var full = Path.GetFullPath(path);
        // A linked source compiled by a Fody-enabled project (Codex on #240): the weaver
        // config sits next to the OWNING .csproj, not above the file — ProjectCsFiles
        // recorded such files while expanding the project's <Compile> items.
        if (WeaverOwnedFiles.Contains(full))
            return true;
        return AncestorsHaveWeaverConfig(Path.GetDirectoryName(full));
    }
    catch (Exception e) when (e is IOException or UnauthorizedAccessException or ArgumentException)
    {
        return true;   // cannot inspect the tree -> cannot rule a weaver out -> no exemption
    }
}

// #238/#240: FodyWeavers.xml in `startDir` or any ancestor. GENUINELY fail-closed on an
// unreadable ancestor (review #240 P3): `File.Exists` returns false on access-denied — swallowing
// exactly the case we must treat as "a weaver may be present" — so we probe with
// `File.GetAttributes`, which THROWS on a permission error while still reporting a plain
// not-found. Absent config -> keep walking; unreadable state -> withhold the exemption.
static bool AncestorsHaveWeaverConfig(string? startDir)
{
    try
    {
        for (var dir = startDir; !string.IsNullOrEmpty(dir); dir = Path.GetDirectoryName(dir))
        {
            var candidate = Path.Combine(dir, "FodyWeavers.xml");
            try
            {
                _ = File.GetAttributes(candidate);
                return true;   // present AND readable -> a weaver is configured here
            }
            catch (FileNotFoundException) { }        // no config in this dir — keep walking
            catch (DirectoryNotFoundException) { }    // this ancestor is gone — keep walking
        }
    }
    catch (Exception e) when (e is IOException or UnauthorizedAccessException
                              or System.Security.SecurityException or ArgumentException)
    {
        return true;   // cannot prove the config is absent -> fail closed, no exemption
    }
    return false;
}

// A type that is System.Windows.Forms.Form or derives from it (semantic, walks the
// base chain). A modeless `Form.Show()` transfers ownership to the framework, which
// disposes the form on close — EmitFlowExpr models that show as a release.
static bool DerivesFromWinFormsForm(ITypeSymbol? t)
{
    for (var b = t; b is not null; b = b.BaseType)
        if (b.Name == "Form" && b.ContainingNamespace?.ToString() == "System.Windows.Forms")
            return true;
    return false;
}

// A type that derives from System.Diagnostics.Tracing.EventSource (semantic, walks the
// base chain). An EventSource is the canonical process-lived `static readonly Log`
// diagnostics singleton; its DiagnosticCounter fields are owned by it (IsEventSourceOwnedCounter).
static bool DerivesFromEventSource(ITypeSymbol? t)
{
    for (var b = t; b is not null; b = b.BaseType)
        if (b.Name == "EventSource" && b.ContainingNamespace?.ToString() == "System.Diagnostics.Tracing")
            return true;
    return false;
}

// A type that derives from System.Diagnostics.Tracing.DiagnosticCounter — the abstract base of
// EventCounter / IncrementingEventCounter / PollingCounter / IncrementingPollingCounter.
static bool DerivesFromDiagnosticCounter(ITypeSymbol? t)
{
    for (var b = t; b is not null; b = b.BaseType)
        if (b.Name == "DiagnosticCounter" && b.ContainingNamespace?.ToString() == "System.Diagnostics.Tracing")
            return true;
    return false;
}

// P-004 EventSource-owned diagnostic counter. A DiagnosticCounter created with `this` — the
// parent EventSource — as its owner argument REGISTERS the counter with that source: the
// runtime's CounterGroup pins it to the EventSource's lifetime, and an EventSource is a
// process-lived `static readonly Log` singleton, so the counter is a process-lived diagnostic
// that is idiomatically NEVER field-disposed (every BCL EventSource — RuntimeEventSource, the
// ASP.NET / HttpConnection counters — does exactly this). Reporting such a field as an
// undisposed leak is therefore a false positive. Mined: Npgsql's NpgsqlEventSource (eight
// counters built in OnEventCommand, none field-disposed).
static bool IsEventSourceOwnedCounter(BaseObjectCreationExpressionSyntax oce, SemanticModel model) =>
    oce.ArgumentList is { } args
    && args.Arguments.Any(arg => arg.Expression is ThisExpressionSyntax)
    && DerivesFromDiagnosticCounter(model.GetTypeInfo(oce).Type);

static string MethodName(BaseMethodDeclarationSyntax m) => m switch
{
    MethodDeclarationSyntax md => md.Identifier.Text,
    ConstructorDeclarationSyntax => ".ctor",
    _ => "?",
};

// P-005 D5.2: a FIRST-PARTY method call whose result is an owned IDisposable — the
// caller side of a fresh-returning factory. Because the callee is defined in source (not
// the BCL), the core can see its body and infer whether it returns `fresh`; if so, a
// `var r = Factory()` binding is an acquire and a caller that drops `r` leaks. The emitted
// `callee` matches the `functions[]` key `{TypeName}.{MethodName}`. A null/extern symbol,
// a void/non-disposable return, or a dispose-optional return is rejected (no claim); an
// overload (non-unique name) resolves to `unknown` in the core and is silently safe.
static bool IsFirstPartyDisposableFactory(ExpressionSyntax? expr, SemanticModel model,
                                          out string callee, out string sig)
{
    callee = "";
    sig = "";
    if (expr is not InvocationExpressionSyntax inv)
        return false;
    if (model.GetSymbolInfo(inv).Symbol is not IMethodSymbol m)
        return false;
    if (m.ReturnsVoid || m.DeclaringSyntaxReferences.Length == 0)
        return false;   // void, or not first-party (no visible body to infer `fresh` from)
    if (!ImplementsIDisposable(m.ReturnType) || IsDisposeOptional(m.ReturnType))
        return false;
    // Fully-qualified key (namespace + containing-type chain) so the call resolves to the
    // RIGHT summary: two `StreamFactory.Make` in different namespaces must not alias, or a
    // call to a non-fresh one could pick up a fresh one's summary and fabricate OWN001
    // (Codex). Must match the `functions[]` name built by `FlowFunctionName`; the stage-2
    // `sig` narrows the same call to the resolved OVERLOAD's summary (spec §5.1).
    callee = $"{m.ContainingType.ToDisplayString()}.{m.Name}";
    sig = CanonicalSig(m);
    return true;
}

// The fully-qualified `functions[]` key for a method — `{Namespace.Containing.Type}.{Name}` —
// used both as the flow-function name and as a D5.2 call callee, so the two always agree (a
// simple `{Type}.{Name}` would alias same-named types across namespaces). Falls back to the
// syntactic class name only if the symbol cannot be resolved.
static string FlowFunctionName(BaseMethodDeclarationSyntax method, string fallbackType,
                               SemanticModel model) =>
    model.GetDeclaredSymbol(method) is IMethodSymbol ms
        ? $"{ms.ContainingType.ToDisplayString()}.{ms.Name}"
        : $"{fallbackType}.{MethodName(method)}";

// Interprocedural stage 2 (spec/OwnIR.md §5.1): the canonical per-overload signature key —
// the method's parameter TYPES, fully-qualified, comma-separated, no spaces, generic arity
// via backtick (type arguments erased, so two same-arity `List<T>` overloads share a sig —
// a collision merely merges those overloads' summaries, never mis-resolves), `global::`
// stripped, "" for zero parameters. Both sides of an edge (the `functions[]` record and
// the `call` op) derive it from the SAME resolved IMethodSymbol, so they agree by
// construction; the bridge falls back to the name-merged summary whenever either side
// lacks or mismatches it.
// Canonicalize through the DECLARED definition (Codex P2 on #217): a call site
// resolves the REDUCED form of an extension method (no `this` receiver in
// Parameters) and/or a CONSTRUCTED generic (type args substituted), while the
// `functions[]` record is stamped from the declaration — `ReducedFrom` restores
// the receiver parameter, `OriginalDefinition` restores the open type params, so
// both sides of the edge always produce the same string.
static string CanonicalSig(IMethodSymbol m) =>
    string.Join(",", (m.ReducedFrom ?? m).OriginalDefinition
        .Parameters.Select(p => CanonicalTypeName(p.Type)));

static string CanonicalTypeName(ITypeSymbol t) => t switch
{
    IArrayTypeSymbol a => CanonicalTypeName(a.ElementType)
        + "[" + new string(',', a.Rank - 1) + "]",
    IPointerTypeSymbol p => CanonicalTypeName(p.PointedAtType) + "*",
    ITypeParameterSymbol tp => tp.Name,   // erased: `Wrap<T>(T x)` keys as "T"
    // MetadataName carries the backtick arity (List`1) and drops nullable
    // annotations (`string?` == `string` — C# overloads cannot differ there).
    INamedTypeSymbol n when n.ContainingType is { } outer =>
        CanonicalTypeName(outer) + "+" + n.MetadataName,
    INamedTypeSymbol n => n.ContainingNamespace is { IsGlobalNamespace: false } ns
        ? $"{ns.ToDisplayString()}.{n.MetadataName}"
        : n.MetadataName,
    _ => t.ToDisplayString().Replace("global::", ""),   // dynamic / error types
};

// ---- P-037 A2.1 (#304): the guarded-fact sidecar ---------------------------------------------
//
// `functions[].guarded_facts` is the frontend's RAW record of what flows into each relevant call
// and what each `if` tests — the input the guarded summary engine (P-037) reads once phase B
// wires it. In A2 it is VALIDATED AND INERT: neither engine reads it, the legacy `body` stays
// authoritative, and a run's MOS documents and verdicts must not move when it appears
// (docs/notes/p037-formal-kernel.md §10.3; the A2 baselines under docs/evidence are the
// witness, the shape census under corpus/p037-shapes pins the per-shape facts).
//
// Two rules govern every field, both from the §10.2 freeze:
//
//  * Roslyn reports SOURCE facts, never P-037 interpretations. `bool_const true` is a fact;
//    `const-pos` is an interpretation relative to the callee's ELECTED guard and belongs to
//    the engine. `param` names the caller's own parameter by declared ordinal; whether that
//    is an `id` or a `neg` edge is the engine's reading. No `fresh_owned` is ever written: a
//    call result is `call_result{callee,sig}` and freshness is a summary conclusion.
//  * Absence is the fail-closed signal. A guard that is not eligible — G-V1: a by-value
//    boolean parameter, or the null-ness of a by-value reference parameter (the self-null
//    split included); G-V4: the parameter is never assigned, incremented, taken by `ref`,
//    or passed by ref/out anywhere in the body — gets NO entry, never `stable: false`, so an
//    old producer, an unstable parameter, an unsupported predicate and unknown syntax all
//    degrade the same way. The same stability rule decides whether an ARGUMENT that names a
//    parameter is a `param` fact or `opaque`.
//
// A call is RELEVANT when a disposable local (any candidate, escaped or not: the legacy
// escape-by-argument is the approximation a summary will refine) or an owned parameter of
// this method flows into it, as an argument or as the receiver of a reduced extension
// method (declared parameter 0).
// Arguments bind BY DECLARED PARAMETER ORDINAL: a named argument resolves to its parameter,
// a reduced extension's receiver to ordinal 0, anything bound to a `params` array collapses
// to one `opaque` fact for that slot, an omitted optional argument has no fact, a `ref`/`out`
// argument is `opaque` (the callee may write it). For an unresolved callee (`callee: null`)
// the ordinal is the SOURCE position — there is no declaration to bind against, and saying
// so beats guessing. Calls inside lambdas and local functions are not this method's calls.
//
// The call-site identity is the invocation expression's own start coordinate plus the
// enclosing statement's line (`statement_line`, the coordinate the legacy body ops carry),
// so the legacy view and this one can be joined until C+ canonicalizes them (§10.5).
//
// Self-check: every record is validated against this vocabulary as it is built, and one
// malformed record makes the producer refuse to write facts at all (exit 2) — fail-loud at
// the source, before either door is asked to notice.
static ExpressionSyntax? StripParens(ExpressionSyntax? e)
{
    while (e is ParenthesizedExpressionSyntax pe)
        e = pe.Expression;
    return e;
}

static bool IsNullLiteral(ExpressionSyntax? e) =>
    StripParens(e) is LiteralExpressionSyntax l && l.IsKind(SyntaxKind.NullLiteralExpression);

// G-V4, whole-body write exposure (deliberately coarser than flow-sensitive, per P-037 §2):
// a parameter is STABLE when nothing in the method body can change the value it entered
// with — no assignment (plain, compound, or deconstructing), no ++/--, no `ref`/`out`
// argument, no `ref` alias, no address taken. A write inside a lambda counts: the closure
// may run before the read.
static bool ParameterIsStable(IParameterSymbol p, SyntaxNode body, SemanticModel model)
{
    bool Refers(ExpressionSyntax? e) =>
        StripParens(e) is IdentifierNameSyntax id
        && SymbolEqualityComparer.Default.Equals(model.GetSymbolInfo(id).Symbol, p);
    foreach (var n in body.DescendantNodes())
    {
        switch (n)
        {
            case AssignmentExpressionSyntax a:
                if (Refers(a.Left))
                    return false;
                if (a.Left is TupleExpressionSyntax
                    && a.Left.DescendantNodes().OfType<IdentifierNameSyntax>().Any(id => Refers(id)))
                    return false;
                break;
            case PrefixUnaryExpressionSyntax u when u.IsKind(SyntaxKind.PreIncrementExpression)
                                                  || u.IsKind(SyntaxKind.PreDecrementExpression)
                                                  || u.IsKind(SyntaxKind.AddressOfExpression):
                if (Refers(u.Operand))
                    return false;
                break;
            case PostfixUnaryExpressionSyntax u when u.IsKind(SyntaxKind.PostIncrementExpression)
                                                   || u.IsKind(SyntaxKind.PostDecrementExpression):
                if (Refers(u.Operand))
                    return false;
                break;
            case ArgumentSyntax arg when arg.RefKindKeyword.IsKind(SyntaxKind.RefKeyword)
                                         || arg.RefKindKeyword.IsKind(SyntaxKind.OutKeyword):
                if (Refers(arg.Expression))
                    return false;
                break;
            case RefExpressionSyntax r:
                if (Refers(r.Expression))
                    return false;
                break;
        }
    }
    return true;
}

static object? BuildGuardedFacts(BaseMethodDeclarationSyntax method, BlockSyntax mbody,
                                 HashSet<string> handles, HashSet<string> ownedParamNames,
                                 SemanticModel model, string where)
{
    var self = model.GetDeclaredSymbol(method) as IMethodSymbol;
    var stability = new Dictionary<IParameterSymbol, bool>(SymbolEqualityComparer.Default);

    IParameterSymbol? OwnParam(ExpressionSyntax? e) =>
        StripParens(e) is IdentifierNameSyntax id
        && model.GetSymbolInfo(id).Symbol is IParameterSymbol p
        && self is not null
        && SymbolEqualityComparer.Default.Equals(p.ContainingSymbol, self)
        && p.RefKind == RefKind.None
            ? p : null;

    bool Stable(IParameterSymbol p)
    {
        if (!stability.TryGetValue(p, out var known))
            stability[p] = known = ParameterIsStable(p, mbody, model);
        return known;
    }

    // One argument expression -> one raw fact, plus whether a HANDLE of this method flowed.
    (Dictionary<string, object?> fact, bool handle) ArgFact(ExpressionSyntax? raw)
    {
        var e = StripParens(raw);
        switch (e)
        {
            case LiteralExpressionSyntax lit when lit.IsKind(SyntaxKind.TrueLiteralExpression):
                return (new() { ["kind"] = "bool_const", ["value"] = true }, false);
            case LiteralExpressionSyntax lit when lit.IsKind(SyntaxKind.FalseLiteralExpression):
                return (new() { ["kind"] = "bool_const", ["value"] = false }, false);
            case LiteralExpressionSyntax lit when lit.IsKind(SyntaxKind.NullLiteralExpression):
                return (new() { ["kind"] = "null_literal" }, false);
            case ObjectCreationExpressionSyntax or ImplicitObjectCreationExpressionSyntax:
                return (new() { ["kind"] = "object_creation" }, false);
            case PrefixUnaryExpressionSyntax u when u.IsKind(SyntaxKind.LogicalNotExpression):
                if (OwnParam(u.Operand) is { } np
                    && np.Type.SpecialType == SpecialType.System_Boolean && Stable(np))
                    return (new() { ["kind"] = "param", ["source_param"] = np.Ordinal,
                                    ["negated"] = true }, false);
                return (new() { ["kind"] = "opaque" }, false);
            case IdentifierNameSyntax id:
                if (OwnParam(id) is { } sp)
                {
                    // Relevance ("a tracked/owned handle syntactically flows here") and
                    // representability (how precisely we can encode the slot) are
                    // orthogonal: an unstable owned parameter is still owned, it is just
                    // opaque, so the handle bit must survive both branches.
                    var isOwned = ownedParamNames.Contains(sp.Name);
                    if (!Stable(sp))
                        return (new() { ["kind"] = "opaque" }, isOwned);
                    return (new() { ["kind"] = "param", ["source_param"] = sp.Ordinal },
                            isOwned);
                }
                if (model.GetSymbolInfo(id).Symbol is ILocalSymbol
                    && handles.Contains(id.Identifier.Text))
                    return (new() { ["kind"] = "var", ["name"] = id.Identifier.Text }, true);
                return (new() { ["kind"] = "opaque" }, false);
            case InvocationExpressionSyntax cinv:
                if (model.GetSymbolInfo(cinv).Symbol is IMethodSymbol cm
                    && cm.MethodKind != MethodKind.DelegateInvoke)
                    return (new() { ["kind"] = "call_result",
                                    ["callee"] = $"{cm.ContainingType.ToDisplayString()}.{cm.Name}",
                                    ["sig"] = CanonicalSig(cm) }, false);
                return (new() { ["kind"] = "opaque" }, false);
            default:
                return (new() { ["kind"] = "opaque" }, false);
        }
    }

    // Lambdas and local functions are not this method's calls (the legacy pass treats a
    // capture as an escape for the same reason), so their subtrees are not descended.
    static bool InThisMethod(SyntaxNode n) =>
        n is not (AnonymousFunctionExpressionSyntax or LocalFunctionStatementSyntax);

    var calls = new List<Dictionary<string, object?>>();
    foreach (var inv in mbody.DescendantNodes(InThisMethod).OfType<InvocationExpressionSyntax>())
    {
        if (inv.Expression is IdentifierNameSyntax { Identifier.Text: "nameof" }
            && model.GetSymbolInfo(inv).Symbol is null)
            continue;   // `nameof(s)` is not a call
        var sym = model.GetSymbolInfo(inv).Symbol as IMethodSymbol;
        var decl = sym is null ? null : (sym.ReducedFrom ?? sym);
        var reduced = sym?.ReducedFrom is not null;
        var facts = new SortedDictionary<int, Dictionary<string, object?>>();
        var relevant = false;

        void Bind(int ordinal, Dictionary<string, object?> fact, bool handle)
        {
            // Two arguments on one ordinal can only be a `params` expansion: one opaque slot.
            if (facts.ContainsKey(ordinal))
                fact = new() { ["kind"] = "opaque" };
            facts[ordinal] = fact;
            relevant |= handle;
        }

        if (reduced && inv.Expression is MemberAccessExpressionSyntax ma)
        {
            var (rf, rh) = ArgFact(ma.Expression);
            Bind(0, rf, rh);
        }
        var args = inv.ArgumentList.Arguments;
        for (var i = 0; i < args.Count; i++)
        {
            int ordinal;
            IParameterSymbol? bound = null;
            if (decl is not null)
            {
                if (args[i].NameColon is { } nc)
                    bound = decl.Parameters.FirstOrDefault(q => q.Name == nc.Name.Identifier.Text);
                else
                {
                    var pos = i + (reduced ? 1 : 0);
                    bound = pos < decl.Parameters.Length
                        ? decl.Parameters[pos]
                        : decl.Parameters.LastOrDefault(q => q.IsParams);
                }
                if (bound is null)
                    continue;   // nothing to bind against (a name Roslyn could not resolve)
                ordinal = bound.Ordinal;
            }
            else
                ordinal = i;    // unresolved callee: source position, and the record says so
            var refOrOut = args[i].RefKindKeyword.IsKind(SyntaxKind.RefKeyword)
                           || args[i].RefKindKeyword.IsKind(SyntaxKind.OutKeyword);
            // Evaluate the argument's handle-ness unconditionally: `ref`/`out`/`params`
            // make the slot unrepresentable precisely (opaque), but a tracked handle
            // passed that way still flowed into the call and must keep the call relevant.
            var (af, ah) = ArgFact(args[i].Expression);
            if (refOrOut || bound is { IsParams: true })
                Bind(ordinal, new() { ["kind"] = "opaque" }, ah);
            else
                Bind(ordinal, af, ah);
        }
        if (!relevant)
            continue;

        var target = inv.Parent is AwaitExpressionSyntax aw ? (SyntaxNode)aw : inv;
        var form = target.Parent switch
        {
            ExpressionStatementSyntax => "statement",
            EqualsValueClauseSyntax => "initializer",
            _ => "expression",
        };
        var pos0 = PosOf(inv);
        var statement = inv.FirstAncestorOrSelf<StatementSyntax>();
        var record = new Dictionary<string, object?>
        {
            ["site"] = new Dictionary<string, object?> { ["line"] = pos0.Line, ["column"] = pos0.Column },
            ["statement_line"] = statement is null ? pos0.Line : LineOf(statement),
            ["form"] = form,
            ["callee"] = sym is null ? null : $"{sym.ContainingType.ToDisplayString()}.{sym.Name}",
            ["sig"] = sym is null ? null : CanonicalSig(sym),
            ["first_party"] = decl is not null && decl.DeclaringSyntaxReferences.Length > 0,
            ["args"] = facts.Select(kv =>
            {
                var f = new Dictionary<string, object?> { ["param"] = kv.Key };
                foreach (var (k, v) in kv.Value)
                    f[k] = v;
                return f;
            }).ToList(),
        };
        calls.Add(record);
    }

    var guards = new List<Dictionary<string, object?>>();
    foreach (var ifs in mbody.DescendantNodes(InThisMethod).OfType<IfStatementSyntax>())
    {
        var cond = StripParens(ifs.Condition);
        IParameterSymbol? gp = null;
        string? predicate = null;
        var negated = false;
        switch (cond)
        {
            case IdentifierNameSyntax:
                gp = OwnParam(cond);
                predicate = "truth";
                break;
            case PrefixUnaryExpressionSyntax u when u.IsKind(SyntaxKind.LogicalNotExpression):
                gp = OwnParam(u.Operand);
                predicate = "truth";
                negated = true;
                break;
            case BinaryExpressionSyntax b when b.IsKind(SyntaxKind.EqualsExpression)
                                              || b.IsKind(SyntaxKind.NotEqualsExpression):
                var side = IsNullLiteral(b.Right) ? b.Left : IsNullLiteral(b.Left) ? b.Right : null;
                gp = OwnParam(side);
                predicate = b.IsKind(SyntaxKind.EqualsExpression) ? "is_null" : "not_null";
                break;
            case IsPatternExpressionSyntax ip:
                gp = OwnParam(ip.Expression);
                predicate = ip.Pattern switch
                {
                    ConstantPatternSyntax cp when IsNullLiteral(cp.Expression) => "is_null",
                    UnaryPatternSyntax { Pattern: ConstantPatternSyntax ncp } up
                        when up.IsKind(SyntaxKind.NotPattern) && IsNullLiteral(ncp.Expression) => "not_null",
                    _ => null,
                };
                break;
        }
        if (gp is null || predicate is null)
            continue;
        var typeFits = predicate == "truth"
            ? gp.Type.SpecialType == SpecialType.System_Boolean
            : gp.Type.IsReferenceType
              || gp.Type is INamedTypeSymbol { OriginalDefinition.SpecialType: SpecialType.System_Nullable_T };
        if (!typeFits || !Stable(gp))
            continue;   // not eligible: no entry, by design
        var gpos = PosOf(ifs);
        guards.Add(new Dictionary<string, object?>
        {
            ["site"] = new Dictionary<string, object?> { ["line"] = gpos.Line, ["column"] = gpos.Column },
            ["param"] = gp.Ordinal,
            ["predicate"] = predicate,
            ["negated"] = negated,
        });
    }

    if (calls.Count == 0 && guards.Count == 0)
        return null;
    ValidateGuardedFacts(calls, guards, where);
    return new Dictionary<string, object?> { ["version"] = 1, ["calls"] = calls, ["guards"] = guards };
}

// The producer's own conformance check of one sidecar against the vocabulary above. Records a
// message per violation; the run refuses to write facts if any was recorded.
static void ValidateGuardedFacts(List<Dictionary<string, object?>> calls,
                                 List<Dictionary<string, object?>> guards, string where)
{
    void Fail(string what) => GuardedFactsViolations.Add($"{where}: {what}");
    static bool Coord(object? site) =>
        site is Dictionary<string, object?> d
        && d.TryGetValue("line", out var l) && l is int li && li >= 1
        && d.TryGetValue("column", out var c) && c is int ci && ci >= 1;
    foreach (var call in calls)
    {
        if (!Coord(call.GetValueOrDefault("site")))
            Fail("call site without a 1-based line/column");
        if (call.GetValueOrDefault("form") is not string form || !CallForms.Contains(form))
            Fail("call with an unknown form");
        if (call.GetValueOrDefault("callee") is not (null or string))
            Fail("call with a non-string callee");
        if (call.GetValueOrDefault("args") is not List<Dictionary<string, object?>> args || args.Count == 0)
        {
            Fail("call without arguments (a relevant call binds at least one handle)");
            continue;
        }
        var last = -1;
        foreach (var arg in args)
        {
            if (arg.GetValueOrDefault("param") is not int ordinal || ordinal <= last)
                Fail("call arguments are not bound to strictly ascending declared ordinals");
            else
                last = ordinal;
            var kind = arg.GetValueOrDefault("kind") as string;
            if (kind is null || !GuardedArgKinds.Contains(kind))
                Fail($"argument of unknown kind {kind ?? "<none>"}");
            else if (kind == "bool_const" && arg.GetValueOrDefault("value") is not bool)
                Fail("bool_const without a boolean value");
            else if (kind == "param" && arg.GetValueOrDefault("source_param") is not int)
                Fail("param fact without a source_param ordinal");
            else if (kind == "var" && arg.GetValueOrDefault("name") is not string { Length: > 0 })
                Fail("var fact without a name");
            else if (kind == "call_result"
                     && (arg.GetValueOrDefault("callee") is not string { Length: > 0 }
                         || arg.GetValueOrDefault("sig") is not string))
                Fail("call_result without callee/sig");
        }
    }
    foreach (var guard in guards)
    {
        if (!Coord(guard.GetValueOrDefault("site")))
            Fail("guard site without a 1-based line/column");
        if (guard.GetValueOrDefault("param") is not int gp || gp < 0)
            Fail("guard without a parameter ordinal");
        if (guard.GetValueOrDefault("predicate") is not string pred || !GuardPredicates.Contains(pred))
            Fail("guard with an unknown predicate");
        if (guard.GetValueOrDefault("negated") is not bool)
            Fail("guard without a negated flag");
    }
}

// P-005 D5.4 (T4 wrap/adopt): the set of OWNING fields a first-party type disposes
// UNCONDITIONALLY in its `Dispose()` — i.e. a `_f.Dispose()` / `_f?.Dispose()` /
// `this._f.Dispose()` that is a TOP-LEVEL statement of the Dispose body (not nested in an
// if/try/loop), where `_f` resolves to an instance field of `w`. Conditional or nested
// disposes are excluded: if the field is only *sometimes* disposed, claiming the arg is
// adopted could fabricate a false double-dispose, so precision-first declines it (§11
// must-only). Used to verify a ctor-adopt before emitting an `alias_join`.
static HashSet<ISymbol> DisposedOwningFields(INamedTypeSymbol w, SemanticModel model)
{
    var result = new HashSet<ISymbol>(SymbolEqualityComparer.Default);
    var dispose = w.GetMembers("Dispose").OfType<IMethodSymbol>()
        .FirstOrDefault(m => m.Parameters.Length == 0 && m.ReturnsVoid
                             && m.DeclaringSyntaxReferences.Length > 0);
    if (dispose is null)
        return result;
    if (dispose.DeclaringSyntaxReferences[0].GetSyntax() is not MethodDeclarationSyntax mds
        || mds.Body is not { } body)
        return result;
    var dm = model.Compilation.GetSemanticModel(mds.SyntaxTree);
    foreach (var st in body.Statements)            // TOP-LEVEL statements only
    {
        if (st is not ExpressionStatementSyntax es)
            continue;
        // unwrap the disposed receiver from `recv.Dispose()` or `recv?.Dispose()` — the
        // latter parses as a ConditionalAccess at the statement level, not an Invocation.
        ExpressionSyntax? recv = es.Expression switch
        {
            InvocationExpressionSyntax { Expression: MemberAccessExpressionSyntax ma }
                when ma.Name.Identifier.Text is "Dispose" => ma.Expression,
            ConditionalAccessExpressionSyntax
                { WhenNotNull: InvocationExpressionSyntax
                    { Expression: MemberBindingExpressionSyntax mb } } ca
                when mb.Name.Identifier.Text is "Dispose" => ca.Expression,
            _ => null,
        };
        if (recv is null)
            continue;
        if (dm.GetSymbolInfo(recv).Symbol is IFieldSymbol f
            && !f.IsStatic                          // a static field is shared across instances,
            && SymbolEqualityComparer.Default.Equals(f.ContainingType, w))  // not per-wrapper ownership
            result.Add(f);
    }
    return result;
}

// P-005 D5.4: does `new W(args)` ADOPT one of its arguments into an owning field — i.e. is
// the constructed object a wrapper that takes responsibility for disposing that arg? True
// iff (a) the ctor is first-party, (b) its type disposes exactly ONE owning field
// unconditionally (DisposedOwningFields), and (c) that field is assigned DIRECTLY from
// exactly one constructor parameter (`_f = p;` as a top-level ctor statement). Returns that
// parameter's positional index. Single-source by construction (§11): any ambiguity — no
// visible Dispose, 0/2+ disposed fields, the field not assigned from a single param, a
// non-positional call — yields no claim (false, idx -1). This is the only gate that lets the
// extractor emit an `alias_join`, so it must never over-claim (a false adopt would fabricate
// a double-dispose), only under-claim.
static bool TryAdoptedArgIndex(BaseObjectCreationExpressionSyntax oce, SemanticModel model,
                               out int idx)
{
    idx = -1;
    if (model.GetSymbolInfo(oce).Symbol is not IMethodSymbol ctor
        || ctor.MethodKind != MethodKind.Constructor
        || ctor.DeclaringSyntaxReferences.Length == 0)
        return false;
    var w = ctor.ContainingType;
    var disposed = DisposedOwningFields(w, model);
    if (disposed.Count != 1)
        return false;
    var field = disposed.First();
    if (ctor.DeclaringSyntaxReferences[0].GetSyntax() is not ConstructorDeclarationSyntax cds
        || cds.Body is not { } cbody)
        return false;
    var cm = model.Compilation.GetSemanticModel(cds.SyntaxTree);
    // v1 accepts only a PURE single-assignment adopter ctor `{ _f = p; }`. Any sibling
    // statement could rebind the field or mutate the param (`_f = p; Rebind(other);`), which
    // would over-claim adoption — so a multi-statement ctor is DECLINED (deferred to a later
    // slice). Precision-first: under-claim, never fabricate a false double-dispose (CodeRabbit).
    if (cbody.Statements.Count != 1
        || cbody.Statements[0] is not ExpressionStatementSyntax es
        || es.Expression is not AssignmentExpressionSyntax asg
        || !asg.IsKind(SyntaxKind.SimpleAssignmentExpression))
        return false;
    if (cm.GetSymbolInfo(asg.Left).Symbol is not IFieldSymbol lf
        || lf.IsStatic                             // shared storage, not per-instance ownership
        || !SymbolEqualityComparer.Default.Equals(lf, field))
        return false;
    if (cm.GetSymbolInfo(asg.Right).Symbol is not IParameterSymbol p
        || !SymbolEqualityComparer.Default.Equals(p.ContainingSymbol, ctor))
        return false;                              // field set from a non-parameter — bail
    var matched = p.Ordinal;
    // the call must be POSITIONAL up to the adopted slot, so the arg index == the param
    // ordinal (a named/reordered call would mis-attribute). Require enough positional args.
    if (oce.ArgumentList is not { } al || al.Arguments.Count <= matched
        || al.Arguments.Take(matched + 1).Any(a => a.NameColon is not null))
        return false;
    idx = matched;
    return true;
}

// P-005 D5.4: the adopted-argument expression of `new W(x)`, or null if W does not adopt an
// argument (TryAdoptedArgIndex). Wraps the index lookup so callers work with the syntax.
// Covers both `new W(x)` and target-typed `new(x)` (BaseObjectCreationExpressionSyntax) —
// the adopt verification resolves the ctor from the symbol either way (Codex).
static ExpressionSyntax? AdoptedArg(BaseObjectCreationExpressionSyntax oce, SemanticModel model) =>
    TryAdoptedArgIndex(oce, model, out var i) ? oce.ArgumentList!.Arguments[i].Expression : null;

// P-005 D5.4: does the local `name` ESCAPE this method (returned, stored as an assignment
// RHS, passed on as an argument, or captured by a closure)? Deliberately OVER-approximates
// — any arg-pass counts, even a borrow — because it only gates the *adopt* exception below:
// over-escaping the wrapper makes us DECLINE the alias (under-claim), never fabricate one.
// `w.Dispose()` (a member access where `w` is the receiver) is a use, not an escape, so a
// disposed wrapper still qualifies. The escape test WALKS ANCESTORS through value-wrapping
// expressions (casts, `??`, parens, conditionals) so `return (IDisposable)w;` / `x = w ?? f;`
// / `Foo((object)w)` are all caught, not just a direct-parent return/arg/assignment-RHS
// (CodeRabbit).
static bool LocalEscapesSyntactically(string name, BlockSyntax mbody)
{
    foreach (var idn in mbody.DescendantNodes().OfType<IdentifierNameSyntax>())
    {
        if (idn.Identifier.Text != name)
            continue;
        // a bare receiver `name.Member(...)` / `name?.Member` is a use/release, not an escape.
        if (idn.Parent is MemberAccessExpressionSyntax ma && ma.Expression == idn)
            continue;
        // captured by a closure (lambda / local function) — outlives the method.
        var captured = false;
        for (var p = idn.Parent; p is not null && p != mbody; p = p.Parent)
            if (p is AnonymousFunctionExpressionSyntax or LocalFunctionStatementSyntax)
            {
                captured = true;
                break;
            }
        if (captured)
            return true;
        // climb the value's wrapping expressions to where it lands: a return, an argument, or
        // an assignment RHS is an escape; reaching the enclosing statement first is not.
        SyntaxNode child = idn;
        var escapes = false;
        for (var p = idn.Parent; p is not null; child = p, p = p.Parent)
        {
            if (p is ReturnStatementSyntax or ArgumentSyntax
                || (p is AssignmentExpressionSyntax asg && asg.Right == child))
            {
                escapes = true;
                break;
            }
            if (p is StatementSyntax)               // reached the enclosing statement, no escape
                break;
        }
        if (escapes)
            return true;
    }
    return false;
}

// P-005 D5.4: is `idn` the adopted argument of `new W(idn)` whose wrapper is a method-bounded
// owner — i.e. should this arg occurrence NOT count as an escape? Gated hard to preserve
// own-only-0: the wrapper must be a NON-`using` local `var w = new W(idn)`, `w` must be a
// tracked disposable candidate, and `w` must not itself escape (else keeping the arg tracked
// with nothing to discharge it would fabricate an OWN001). When all hold, the arg's
// obligation is adopted by `w` and modelled as an `alias_join`; the arg stays tracked.
static bool IsAdoptedArgOfBoundedWrapper(IdentifierNameSyntax idn, SemanticModel model,
                                         HashSet<string> candidates, BlockSyntax mbody)
{
    if (idn.Parent is not ArgumentSyntax { Parent: ArgumentListSyntax
            { Parent: BaseObjectCreationExpressionSyntax oce } })
        return false;
    if (AdoptedArg(oce, model) != idn)              // idn must BE the adopted arg
        return false;
    if (oce.Parent is not EqualsValueClauseSyntax { Parent: VariableDeclaratorSyntax wv }
        || wv.Parent is not VariableDeclarationSyntax
        || wv.Parent.Parent is not LocalDeclarationStatementSyntax wld
        || wld.UsingKeyword != default)
        return false;
    var w = wv.Identifier.Text;
    return candidates.Contains(w) && !LocalEscapesSyntactically(w, mbody);
}

// A `Dispose()`/`Close()`/`DisposeAsync()` call — through member access (`x.Dispose()`)
// or member binding (`x?.Dispose()`), and seen through a trailing `.ConfigureAwait(false)`
// (the idiomatic `await x.DisposeAsync().ConfigureAwait(false)` is the release, not a
// throwing call). Mirrors the unwrap in EmitFlowExpr so StatementMayThrow does not inject
// a false exceptional-leak edge before an async dispose.
static bool IsDisposeShaped(InvocationExpressionSyntax i)
{
    var callee = i.Expression;
    if (callee is MemberAccessExpressionSyntax cfg
        && cfg.Name.Identifier.Text == "ConfigureAwait"
        && cfg.Expression is InvocationExpressionSyntax innerInv)
        callee = innerInv.Expression;
    return (callee switch
    {
        MemberAccessExpressionSyntax ma => ma.Name.Identifier.Text,
        MemberBindingExpressionSyntax mb => mb.Name.Identifier.Text,
        _ => (string?)null,
    }) is "Dispose" or "Close" or "DisposeAsync";
}

// True when `st` is the LAST statement of a method/accessor/constructor body block — its
// block's parent is a member declaration, not a nested statement (a BlockSyntax is itself
// a StatementSyntax, so this also excludes nested blocks). Used to decide whether a
// `try`'s exceptional-exit edges are sound (see the try lowering).
static bool IsBodyTail(StatementSyntax st) =>
    st.Parent is BlockSyntax b
    && b.Statements.Count > 0 && b.Statements[^1] == st
    && b.Parent is not StatementSyntax;

// True when `node` sits lexically inside a `finally { }` block (walking up to the enclosing
// member / lambda boundary). A `throw` there is NOT a clean method exit: it propagates through
// any ENCLOSING `finally`/`try` cleanup, which a bare-return exit would skip — and `finally`
// bodies are lowered with the default (null) `onThrow`, so the body-level throw branch cannot
// tell them apart from the method body. Such a throw therefore keeps BAILING the method (sound
// honest-skip, as before this feature) rather than emit a false leak that misses the outer
// finally's release (Codex P2: `try { try {} finally { throw; } } finally { s.Dispose(); }`).
static bool IsInsideFinally(SyntaxNode node)
{
    for (var p = node.Parent; p is not null; p = p.Parent)
    {
        if (p is FinallyClauseSyntax) return true;
        if (p is AnonymousFunctionExpressionSyntax or LocalFunctionStatementSyntax
              or BaseMethodDeclarationSyntax or AccessorDeclarationSyntax) return false;
    }
    return false;
}

// Inject an exceptional-exit edge `if(*){ onThrow }` before a LEAF may-throw statement
// (an expression statement or a local declaration) inside a `try` body. `onThrow` is the
// continuation a throw here runs to leave the method — this try's `finally`, then any
// enclosing tries' finallys, then `return` (built in the try lowering). A resource owned
// at this point and not released by that continuation leaks on the throw path. Called for
// LEAF statements only; a COMPOUND statement (if/loop/block) is recursed into so the edge
// lands before the nested leaf — at the point the resource's ownership is exact (after any
// in-branch dispose), which is what makes nesting sound rather than a false leak.
static void InjectThrowEdge(StatementSyntax st, List<object> nodes, List<object>? onThrow, bool canEscape)
{
    // Inside a `try`, `onThrow` is the finally+exit continuation a throw here runs. At the
    // method-body level `onThrow` is null — by default no edge is injected (the shipped low-FP
    // posture: a body-level may-throw call is NOT treated as a leak point). The opt-in
    // --body-throw-edges tier (Program.BodyThrowEdges) lifts that: an ESCAPING body-level
    // may-throw statement (`canEscape`, so no enclosing catch-all swallows it) gets a synthetic
    // bare method exit as its continuation, matching CodeQL's cs/dispose-not-called-on-throw on
    // the no-try slice. A catch-all-suppressed region (`canEscape` false) still injects nothing.
    // `!IsInsideFinally`: a may-throw statement lexically inside a `finally` is lowered with a null
    // onThrow too, but a real exception there runs the ENCLOSING cleanup — a bare exit would skip
    // it and falsely flag a resource the outer finally/using disposes, so synthesize no edge there
    // (the symmetric guard the explicit-throw path already uses — Codex P2 on the may-throw tier).
    var cont = onThrow ?? (BodyThrowEdges && canEscape && !IsInsideFinally(st)
        ? new List<object> { new { op = "return", var = (string?)null, line = LineOf(st) } }
        : null);
    if (cont is not null && StatementMayThrow(st))
        nodes.Add(new { op = "if", line = LineOf(st),
                        then = new List<object>(cont), @else = new List<object>() });
}

// A statement that can raise an exception part-way through: it makes a call that is not
// itself a dispose, OR it creates an object (`new` — a constructor can throw, leaking a
// PRIOR owned resource whose dispose it would then skip). Creating the resource being
// acquired here is harmless: the edge lands before its `acquire`, where it is not yet owned.
// Does NOT descend into lambda / anonymous-method bodies: a `new` (or call) inside `() => …`
// runs when the delegate is INVOKED, not where it is declared, so the declaring statement is
// not a throw point — counting it would inject a phantom edge that falsely flags a prior
// resource disposed after the `try`. An immediately-invoked lambda is still caught: the outer
// invocation is itself the throw point.
static bool StatementMayThrow(StatementSyntax st) =>
    st.DescendantNodes(descendIntoChildren: n => n is not AnonymousFunctionExpressionSyntax)
      .Any(n =>
        (n is InvocationExpressionSyntax i && !IsDisposeShaped(i))
        || n is ObjectCreationExpressionSyntax or ImplicitObjectCreationExpressionSyntax);

// A catch clause that catches EVERY exception and so always continues to the post-try
// code: `catch { }` (no declaration) or `catch (Exception)` / `catch (System.Exception)` —
// with NO `when` filter (a filter may evaluate false, letting the exception propagate). A
// typed catch (`catch (IOException)`, or a qualified DOMAIN type like `catch (Foo.Exception)`
// whose rightmost name is `Exception` but is not System.Exception) or any filtered catch
// continues for only SOME exceptions; the rest propagate out, skipping the post-try dispose,
// so the resource still leaks on those paths. Match the canonical System.Exception spellings
// by full text — a rightmost-name match would misread a domain `Foo.Exception` as catch-all
// and suppress a real leak. Syntax-only (no semantic model): the inverse pathology — an
// exotic alias making a typed-looking name resolve to System.Exception — is never written.
static bool IsCatchAll(CatchClauseSyntax cc) =>
    cc.Filter is null
    && (cc.Declaration is not { } decl
        || decl.Type.ToString() is "Exception"
                               or "System.Exception"
                               or "global::System.Exception");

// Lower a method block to OwnIR flow nodes (acquire/use/release/if/return) for the
// `tracked` local IDisposables. Returns null on any UNMODELLED statement (a `goto`, labeled
// statement, local function, `lock`/`fixed`, …): the method is then honestly skipped, not
// guessed. Loops, `try`, `do` and `switch` ARE modelled below.
// spec/OwnIR.md §4.2: flow bodies nest at most 32 levels (`then` / `else` / `body`; the
// top-level list is level 0). Both doors reject a document that nests deeper.
const int OwnIrMaxNestingDepth = 32;

// #401: each nested body costs two JSON levels (an object and an array), so a document at the
// §4.2 limit is about 2 * 32 + 4 levels deep. The default MaxDepth (64) threw on 31 nested
// `else if`; 128 is the cap §4.2 itself is measured against.
const int FactsJsonMaxDepth = 128;

// The deepest `then` / `else` / `body` nesting of a lowered flow body, counted as §4.2 counts it
// (an existing list is a level, even an empty one). Flow ops are anonymous objects or
// dictionaries, so the three keys are read by name.
static int FlowNestingDepth(IReadOnlyList<object> nodes, int level = 0)
{
    var deepest = level;
    foreach (var node in nodes)
    {
        foreach (var key in new[] { "then", "else", "body" })
        {
            object? child = node is IDictionary<string, object?> d
                ? (d.TryGetValue(key, out var v) ? v : null)
                : node?.GetType().GetProperty(key)?.GetValue(node);
            if (child is IReadOnlyList<object> list)
                deepest = Math.Max(deepest, FlowNestingDepth(list, level + 1));
        }
    }
    return deepest;
}

static List<object>? LowerFlowBody(BlockSyntax block, HashSet<string> tracked, SemanticModel model)
{
    var nodes = new List<object>();
    if (!LowerFlowStatements(block.Statements, 0, tracked, model, nodes,
                             canEscape: true, onThrow: null, onReturn: null))
        return null;
    return nodes;
}

// Lower a statement LIST, desugaring a tracked `using IMemoryOwner owner = MemoryPool.Rent(...)`
// declaration into `acquire; try { rest } finally { release }` — the implicit scope-exit Dispose is
// threaded onto the rest's returns/throws (exactly like a `finally`), so a RETURNED view of the owner
// (`using owner = …; return owner.Memory;`) is a dangling borrow read by the caller after the dispose
// -> OWN002 (Codex review on #73). With no such declaration this is identical to lowering each
// statement in turn, so non-pooled `using` locals and every existing shape are unaffected.
static bool LowerFlowStatements(IReadOnlyList<StatementSyntax> stmts, int start,
                                HashSet<string> tracked, SemanticModel model, List<object> nodes,
                                bool canEscape, List<object>? onThrow, List<object>? onReturn,
                                bool onThrowDefinite = false)
{
    for (var i = start; i < stmts.Count; i++)
    {
        var st = stmts[i];
        if (st is LocalDeclarationStatementSyntax usingDecl
            && usingDecl.UsingKeyword != default
            && usingDecl.Declaration.Variables.Count == 1
            && tracked.Contains(usingDecl.Declaration.Variables[0].Identifier.Text)
            && IsMemoryPoolRent(usingDecl.Declaration.Variables[0].Initializer?.Value, model))
        {
            var uv = usingDecl.Declaration.Variables[0];
            var owner = uv.Identifier.Text;
            var exit = new List<object> { new { op = "return", var = (string?)null, line = LineOf(usingDecl) } };
            InjectThrowEdge(usingDecl, nodes, onThrow, canEscape);   // a throw DURING Rent() runs the OUTER path (owner not yet acquired)
            // #317: the acquire is the handle-minting op the bridge anchors a flow-local
            // finding on, so it carries the column of the SAME declarator its line came
            // from. The paired `release` below keeps its line alone — it is a scope-exit
            // event, not an anchor.
            var uvPos = PosOf(uv);
            nodes.Add(new { op = "acquire", var = owner, line = uvPos.Line, column = uvPos.Column });
            var release = new { op = "release", var = owner, line = LineOf(uv) };
            // The rest of THIS block is the try-body; the implicit using-dispose is its finally — run
            // before a return (so a returned view is read after release) and on normal completion.
            var restOnReturn = new List<object> { release };
            restOnReturn.AddRange(onReturn ?? exit);
            List<object>? restOnThrow = null;
            // The implicit using-dispose has no catch, so a throw running it then propagates;
            // it reaches method exit uncaught iff the enclosing path does (true at body level
            // where onThrow is null). See the `onThrowDefinite` contract on the throw case.
            bool restDefinite = onThrow is null || onThrowDefinite;
            if (canEscape)
            {
                restOnThrow = new List<object> { release };
                restOnThrow.AddRange(onThrow ?? exit);
            }
            if (!LowerFlowStatements(stmts, i + 1, tracked, model, nodes, canEscape, restOnThrow, restOnReturn,
                                     onThrowDefinite: restDefinite))
                return false;
            nodes.Add(release);   // normal completion (no return) disposes at scope exit too
            return true;
        }
        if (!LowerFlowStmt(st, tracked, model, nodes, canEscape, onThrow, onReturn, onThrowDefinite))
            return false;
    }
    return true;
}

// `canEscape`: can a throw at the current position leave the METHOD (no enclosing
// catch-all swallows it)? `onThrow`: the continuation a throw here runs to leave the
// method (finally-stack + return), or null when no exception edge should be injected
// (method level, or a region an enclosing catch-all swallows). `onReturn`: the continuation
// a `return` here runs FIRST — the enclosing `finally`(s), then the exit — so a resource a
// finally disposes is released on the return path; null = a bare return (outside any try).
// `onThrowDefinite`: when `onThrow` is non-null, does a throw that runs it DEFINITELY leave
// the method (no enclosing `catch` can intercept and resume normal flow)? True for a `using`
// or a finally-only `try` (neither has a catch); false for a `try` with any `catch` (the
// throw may be caught). An explicit `throw` routes through `onThrow` only when this holds —
// otherwise it bails (the catch-match is not modelled). Irrelevant when `onThrow` is null.
// Defaults are the method-body context: throws escape, nothing is injected, returns are bare.
static bool LowerFlowStmt(StatementSyntax st, HashSet<string> tracked, SemanticModel model, List<object> nodes,
                          bool canEscape = true, List<object>? onThrow = null,
                          List<object>? onReturn = null, bool onThrowDefinite = false)
{
    // #401: the lowering recurses once per nested statement, so a few hundred `else if`
    // overflowed the stack - an uncatchable crash that lost the whole run. Running short of
    // stack means the body is far deeper than spec/OwnIR.md section 4.2 admits (32), which is
    // skipped anyway: bail the method as unmodelled instead.
    if (!System.Runtime.CompilerServices.RuntimeHelpers.TryEnsureSufficientExecutionStack())
        return false;
    switch (st)
    {
        case BlockSyntax b:
            return LowerFlowStatements(b.Statements, 0, tracked, model, nodes, canEscape, onThrow, onReturn, onThrowDefinite);
        case LocalDeclarationStatementSyntax ld:
            InjectThrowEdge(ld, nodes, onThrow, canEscape);
            if (ld.UsingKeyword == default)
                foreach (var v in ld.Declaration.Variables)
                {
                    // P-005 D5.4 (T4 adopt): `var w = new W(x)` where W is a verified wrapper
                    // that adopts the tracked local `x` into an owning field (TryAdoptedArgIndex)
                    // — emit `alias_join` instead of an acquire, so `w` joins `x`'s obligation:
                    // disposing either discharges the one resource, disposing both is OWN003. The
                    // arg `x` is kept tracked by the matching escape exception above.
                    if (tracked.Contains(v.Identifier.Text)
                        && v.Initializer?.Value is BaseObjectCreationExpressionSyntax adoptOce
                        && AdoptedArg(adoptOce, model) is IdentifierNameSyntax adoptedId
                        && tracked.Contains(adoptedId.Identifier.Text))
                    {
                        // #317: an alias_join mints a handle, so it carries a column. Its
                        // coordinate is the ALIAS declarator's, which is what the bridge
                        // stores on the alias handle — the finding still anchors at the
                        // source acquire, because a joined obligation is reported where it
                        // was created (tests/test_ownir_column.py pins that).
                        var aliasPos = PosOf(v);
                        nodes.Add(new { op = "alias_join", var = v.Identifier.Text,
                                        src = adoptedId.Identifier.Text,
                                        line = aliasPos.Line, column = aliasPos.Column });
                    }
                    else if (tracked.Contains(v.Identifier.Text)
                        && (v.Initializer?.Value is ObjectCreationExpressionSyntax
                                                 or ImplicitObjectCreationExpressionSyntax
                            || IsPoolRent(v.Initializer?.Value, model)        // ArrayPool<T> Rent
                            || IsMemoryPoolRent(v.Initializer?.Value, model)  // MemoryPool<T> Rent (IMemoryOwner)
                            || IsOwningFactory(v.Initializer?.Value, model)))   // File / crypto Create* factory
                    {
                        // Tag an ArrayPool rent so the bridge labels a partial-path leak a
                        // "pooled buffer" (Return not on every path), not the generic "disposable"
                        // — the flow path previously mislabelled a pool buffer leaked on a throw edge.
                        // #317: the direct acquire is the flow-local OWN001 anchor — the one
                        // record that decides whether two leaks declared on one line stay two.
                        var acqPos = PosOf(v);
                        nodes.Add(new { op = "acquire", var = v.Identifier.Text,
                                        line = acqPos.Line, column = acqPos.Column,
                                        kind = IsPoolRent(v.Initializer?.Value, model) ? "pool" : "disposable" });
                    }
                    // P-005 D5.2: `var r = FirstPartyFactory()` — emit a `call` op (NOT an
                    // acquire); the core mints the acquire only if it proves the callee returns
                    // `fresh`, so a non-fresh first-party call is never falsely owned.
                    else if (tracked.Contains(v.Identifier.Text)
                             && IsFirstPartyDisposableFactory(v.Initializer?.Value, model,
                                                              out var fpCallee, out var fpSig))
                    {
                        // Preserve the call's TRACKED identifier args (CodeRabbit) so the core
                        // can apply the callee's per-argument ownership effects (consume/borrow)
                        // to a `var r = Wrap(stream)` — not just the fresh return. Untracked /
                        // non-identifier args are dropped (no local to attribute an effect to).
                        // Positional args only: the bridge applies the callee's effects by
                        // POSITION, so a NAMED argument (`Wrap(second: s2, first: s1)`) would
                        // mis-attribute if kept in syntactic order. Dropping named args
                        // under-claims (no effect on them) but never mis-aligns (CodeRabbit).
                        var fpArgs = v.Initializer?.Value is InvocationExpressionSyntax fpInv
                            ? fpInv.ArgumentList.Arguments
                                  .Where(a => a.NameColon is null)
                                  .Select(a => a.Expression)
                                  .OfType<IdentifierNameSyntax>()
                                  .Select(id => id.Identifier.Text)
                                  .Where(tracked.Contains)
                                  .ToArray()
                            : Array.Empty<string>();
                        // #317: the call's `result` becomes a handle when the core proves the
                        // callee returns `fresh`, so this record is on the anchor path too and
                        // carries the result declarator's column.
                        var callPos = PosOf(v);
                        nodes.Add(new { op = "call", callee = fpCallee, sig = fpSig,
                                        args = fpArgs,
                                        result = v.Identifier.Text,
                                        line = callPos.Line, column = callPos.Column });
                    }
                    // POOL005: a full-length view in the initializer — `var copy = buf.AsSpan().ToArray();`
                    // — over-reads the pooled tail just as `Emit(buf.AsSpan());` does. EmitFlowExpr is not
                    // called on a non-acquire initializer, so scan it here for the overspan (Codex review).
                    if (v.Initializer?.Value is { } vinit)
                        EmitOverspans(vinit, tracked, model, nodes);
                }
            return true;
        case ExpressionStatementSyntax es:
            InjectThrowEdge(es, nodes, onThrow, canEscape);
            EmitFlowExpr(es.Expression, tracked, model, nodes);
            return true;
        case IfStatementSyntax ifs:
        {
            var thenNodes = new List<object>();
            if (!LowerFlowStmt(ifs.Statement, tracked, model, thenNodes, canEscape, onThrow, onReturn, onThrowDefinite))
                return false;
            var elseNodes = new List<object>();
            if (ifs.Else is { } e && !LowerFlowStmt(e.Statement, tracked, model, elseNodes, canEscape, onThrow, onReturn, onThrowDefinite))
                return false;
            nodes.Add(new { op = "if", line = LineOf(ifs), then = thenNodes, @else = elseNodes });
            return true;
        }
        case UsingStatementSyntax us:
        {
            // using (IMemoryOwner owner = MemoryPool.Rent(...)) { body }: the STATEMENT form of the same
            // scope-exit dispose as the `using` declaration — desugar a tracked MemoryPool owner the same
            // way (acquire; thread the dispose onto the body's returns/throws; release on completion) so a
            // returned view of it dangles -> OWN002 (CodeRabbit). Other using-statements just lower the
            // body (the using local is auto-disposed, untracked).
            if (us.Declaration is { Variables.Count: 1 } ud
                && tracked.Contains(ud.Variables[0].Identifier.Text)
                && IsMemoryPoolRent(ud.Variables[0].Initializer?.Value, model))
            {
                var uv = ud.Variables[0];
                var owner = uv.Identifier.Text;
                var exit = new List<object> { new { op = "return", var = (string?)null, line = LineOf(us) } };
                // #317: same rule as the `using` DECLARATION form above — the acquire anchors,
                // so it carries the declarator's column; the release keeps its line alone.
                var uvPos = PosOf(uv);
                nodes.Add(new { op = "acquire", var = owner, line = uvPos.Line, column = uvPos.Column });
                var release = new { op = "release", var = owner, line = LineOf(uv) };
                var bodyOnReturn = new List<object> { release };
                bodyOnReturn.AddRange(onReturn ?? exit);
                List<object>? bodyOnThrow = null;
                // A using has no catch: a throw runs the release then propagates, reaching
                // method exit uncaught iff the enclosing path does (true at body level).
                bool bodyDefinite = onThrow is null || onThrowDefinite;
                if (canEscape)
                {
                    bodyOnThrow = new List<object> { release };
                    bodyOnThrow.AddRange(onThrow ?? exit);
                }
                if (us.Statement is not null
                    && !LowerFlowStmt(us.Statement, tracked, model, nodes, canEscape, bodyOnThrow, bodyOnReturn,
                                      onThrowDefinite: bodyDefinite))
                    return false;
                nodes.Add(release);   // normal completion disposes at scope exit too
                return true;
            }
            // `using (existingLocal) { body }`: the STATEMENT form whose resource is an
            // ALREADY-TRACKED local — `var r = new ...; using (r) { ... }`. The block disposes
            // `r` at every scope exit, so thread a release onto the body's returns/throws and
            // its normal completion; otherwise the tracked `r` looks live at method exit and is
            // a spurious OWN001 (mined: protobuf-net assorted/ Silverlight Page.xaml.cs `timer`,
            // acquired then wrapped in `using (timer) { ... }`). No `acquire` here — the local
            // was already acquired at its `new`; we only add the missing release. The `using
            // (var x = ...)` declaration form needs nothing: `x` is auto-disposed and never
            // tracked as a leak candidate.
            //
            // An EXPLICIT throw in the body is handled soundly: the body is lowered with
            // `onThrowDefinite` set (a using has no catch, so a throw runs the release then
            // propagates — definite iff the enclosing path is), and the `ThrowStatementSyntax`
            // case routes the throw through that release continuation instead of bailing the
            // whole method. So `var leaked = new ...; using (r) { if (bad) throw; }` still
            // reports `leaked` and releases `r` on every exit (Codex P2).
            if (us.Expression is IdentifierNameSyntax usingId
                && tracked.Contains(usingId.Identifier.Text))
            {
                var owner = usingId.Identifier.Text;
                var exit = new List<object> { new { op = "return", var = (string?)null, line = LineOf(us) } };
                var release = new { op = "release", var = owner, line = LineOf(us) };
                var bodyOnReturn = new List<object> { release };
                bodyOnReturn.AddRange(onReturn ?? exit);
                List<object>? bodyOnThrow = null;
                bool bodyDefinite = onThrow is null || onThrowDefinite;
                if (canEscape)
                {
                    bodyOnThrow = new List<object> { release };
                    bodyOnThrow.AddRange(onThrow ?? exit);
                }
                if (us.Statement is not null
                    && !LowerFlowStmt(us.Statement, tracked, model, nodes, canEscape, bodyOnThrow, bodyOnReturn,
                                      onThrowDefinite: bodyDefinite))
                    return false;
                nodes.Add(release);   // normal completion disposes at scope exit
                return true;
            }
            return us.Statement is null || LowerFlowStmt(us.Statement, tracked, model, nodes, canEscape, onThrow, onReturn, onThrowDefinite);
        }
        case ReturnStatementSyntax rs:
        {
            // A tracked local READ in the return value is a use at the return point —
            // e.g. `return BuildResult(buf)` after `pool.Return(buf)` is a use-after-
            // return. A tracked local *itself* returned is excluded upstream as an
            // escape, so lowering the return expression only adds uses, never a
            // spurious escape. Then: a `return` first runs any enclosing `finally`(s)
            // — threaded as `onReturn`, so a resource the finally releases is released
            // on the return path — then exits; outside a try it is a bare CFG exit.
            if (rs.Expression is { } rexpr)
                EmitFlowExpr(rexpr, tracked, model, nodes);
            // A returned Span/Memory VIEW (borrow) ESCAPES to the caller, who uses it AFTER this
            // method's finally cleanup runs — so `try { return view; } finally { Return(buf); }`
            // hands back a DANGLING borrow (the idiomatic pool-cleanup form). Model the escaped
            // view's use AFTER the finally release(s) by inserting it just before the exit of the
            // `onReturn` chain (which is `[finally…, exit]`), so a finally that releases the owner
            // trips OWN002 (Codex). Outside a try (onReturn null) EmitFlowExpr already placed the
            // use after any earlier release, so no insertion is needed.
            var viewEscapes = rs.Expression is { } vrx
                ? ReturnedViewOwners(vrx, tracked, model) : new List<string>();
            if (onReturn is not null)
            {
                var chain = new List<object>(onReturn);
                foreach (var owner in viewEscapes)
                    chain.Insert(chain.Count - 1, new { op = "use", var = owner, line = LineOf(rs) });
                // The BARE owner returned (`using owner = …; return owner;`) is the twin of the returned
                // view: a tracked plain-identifier return can only be a using-declared MemoryPool owner
                // (a genuine transfer is escaped/untracked upstream), and its scope-exit dispose runs as we
                // return — so thread its use after the release(s) too, exactly like a view -> OWN002.
                if (rs.Expression is IdentifierNameSyntax bareOwner
                    && tracked.Contains(bareOwner.Identifier.Text)
                    && !viewEscapes.Contains(bareOwner.Identifier.Text))
                    chain.Insert(chain.Count - 1,
                        new { op = "use", var = bareOwner.Identifier.Text, line = LineOf(rs) });
                nodes.AddRange(chain);
            }
            else
            {
                // P-005 D5.2: a tracked local returned BARE (outside any `finally`) is a
                // fresh-factory transfer — emit it as the return's `var` so the core models the
                // escape (a discharge: ownership moves to the caller) and classifies the method
                // `returnsOwned: fresh`. A non-identifier / non-tracked return is a bare CFG exit.
                //
                // P-037 A1.1-a1: "tracked LOCAL" is the rule as written above, and it held for
                // free until a1 put owned PARAMETERS into the same set. Returning a parameter is
                // not a fresh factory: the resource belongs to the caller and outlives the call.
                // Modelled as a fresh return it reads as an escaping borrow — measured, on
                // samples/OverloadSigSample.cs `Open(FileStream existing, bool flush)`:
                // `[OWN004] 'parg_59' is a borrow and cannot be returned`.
                //
                // What this return actually IS is an ALIAS of the parameter, and OwnIR has no
                // way to say that: `aliasOf`/`aliased` are reserved in the schema and the
                // production skeleton builder has never emitted them (own-bridge/src/mos.rs
                // says so in its own header). So the frontend keeps the silence it has always
                // kept here — a bare CFG exit, claiming no owned return — rather than asserting
                // a kind that is false. Closing that gap means teaching the IR alias returns,
                // which is a semantic change and not this step's business.
                //
                // The parameter test is semantic on purpose: a parameter symbol resolves from
                // source even when its TYPE does not (single-file runs see little of the BCL),
                // and a local never resolves to IParameterSymbol, so no local loses its fresh
                // return to this.
                var rvar = rs.Expression is IdentifierNameSyntax rid
                           && tracked.Contains(rid.Identifier.Text)
                           && model.GetSymbolInfo(rid).Symbol is not IParameterSymbol
                    ? rid.Identifier.Text : (string?)null;
                nodes.Add(new { op = "return", var = rvar, line = LineOf(rs) });
            }
            return true;
        }
        case WhileStatementSyntax ws:
        {
            // P-016 A1 reached the frontend: a `while` lowers to a `while` flow op
            // (a body that runs 0+ times with a back-edge); the core analyses it with
            // its worklist fixpoint (cross-iteration leak / use-after-release /
            // double-release). The condition is opaque (we model control flow, not
            // values). If the body has an unmodelled statement, bail the method.
            var bodyNodes = new List<object>();
            if (ws.Statement is null || !LowerFlowStmt(ws.Statement, tracked, model, bodyNodes, canEscape, onThrow, onReturn, onThrowDefinite))
                return false;
            nodes.Add(new { op = "while", line = LineOf(ws), body = bodyNodes });
            return true;
        }
        case ForEachStatementSyntax fes:
        {
            // `foreach` runs its body 0+ times over an (opaque) collection — the same
            // ownership shape as `while`. The loop variable is never a `new`'d
            // candidate and the hidden enumerator is auto-disposed, so modelling the
            // body as a `while` is sound. (`for` and `do` are handled below; `do` runs 1+
            // times, so it is desugared rather than modelled as a bare 0+-trip `while`.)
            var bodyNodes = new List<object>();
            if (fes.Statement is null || !LowerFlowStmt(fes.Statement, tracked, model, bodyNodes, canEscape, onThrow, onReturn, onThrowDefinite))
                return false;
            nodes.Add(new { op = "while", line = LineOf(fes), body = bodyNodes });
            return true;
        }
        case ForStatementSyntax fors:
        {
            // `for (init; cond; incr) body` runs its body 0+ times — the same
            // ownership shape as `while`/`foreach`. init/cond/incr are opaque (we
            // model control flow, not values); the tracked locals are the ones the
            // BODY declares. A resource declared in the `for` *initializer* is not a
            // method-body local, so it is never a tracked candidate — no soundness
            // concern, just a separate (rare) recall gap.
            var bodyNodes = new List<object>();
            if (fors.Statement is null || !LowerFlowStmt(fors.Statement, tracked, model, bodyNodes, canEscape, onThrow, onReturn, onThrowDefinite))
                return false;
            nodes.Add(new { op = "while", line = LineOf(fors), body = bodyNodes });
            return true;
        }
        case TryStatementSyntax trys:
        {
            // try { A } [catch { C }...] [finally { B }] with EXCEPTION EDGES. Any LEAF
            // statement in A (at any nesting depth) that can throw gets an exceptional exit
            // `if(*){ B; … ; return }` injected before it — throw here, run the finally(s),
            // leave. A resource owned at that point and NOT released by the finally leaks on
            // the exceptional path: dispose-not-called-on-throw (a dispose placed in the try,
            // not the finally). A dispose IN the finally runs on every exceptional exit, so
            // the safe pattern stays silent; `acquire; dispose;` with no throw between has no
            // live edge, so no false leak.
            //
            // Catch bodies are not lowered; to stay SOUND, bail if any catch disposes, so
            // a release that only happens in a catch is never missed. Matches `x.Dispose()`
            // and `x?.Dispose()`.
            foreach (var cc in trys.Catches)
                if (cc.Block.DescendantNodes().OfType<InvocationExpressionSyntax>().Any(IsDisposeShaped))
                    return false;
            var finallyNodes = new List<object>();
            if (trys.Finally is { } fin && !LowerFlowStmt(fin.Block, tracked, model, finallyNodes))
                return false;
            // Does a throw in THIS body escape to method exit (so the edge — leave running
            // only the finally — models a real execution)? Sound when there is no catch (it
            // propagates out past any post-try code), the try is the body's tail (nothing
            // runs after), OR no catch is a genuine catch-all — a typed/filtered catch lets
            // the uncaught exception types propagate, skipping the post-try dispose, so the
            // resource still leaks on those paths. The one shape that SUPPRESSES the edges is
            // a catch-all on a non-tail try: every throw is caught and continues to (and may
            // dispose in) the post-try code, so a return there would falsely flag a resource
            // that path disposes. `canEscape` carries the same fact down through ENCLOSING
            // tries: a catch-all higher up already swallows these throws, so they never reach
            // method exit -> no edges in the region nested under it.
            bool escapesThisTry = trys.Catches.Count == 0
                || IsBodyTail(trys)
                || !trys.Catches.Any(IsCatchAll);
            bool bodyCanEscape = canEscape && escapesThisTry;
            // The continuation an escaping throw runs: this finally, then the enclosing
            // exceptional path (its finallys, ending in the method `return`), or just a
            // `return` when this is the outermost try. Null when suppressed -> no edges.
            List<object>? bodyOnThrow = null;
            if (bodyCanEscape)
            {
                bodyOnThrow = new List<object>(finallyNodes);
                bodyOnThrow.AddRange(onThrow ?? new List<object>
                    { new { op = "return", var = (string?)null, line = LineOf(trys) } });
            }
            // Is a throw in the body DEFINITELY uncaught (so an explicit throw may route through
            // `bodyOnThrow` instead of bailing)? Only a finally-only try (no catches): the throw
            // runs the finally then propagates, reaching method exit iff the enclosing path does.
            // ANY catch makes it false — the throw might be caught, which this lowering can't
            // match against the thrown type, so an explicit throw there keeps bailing.
            bool bodyOnThrowDefinite = trys.Catches.Count == 0 && (onThrow is null || onThrowDefinite);
            // A `return` inside the body runs THIS finally, then the enclosing return path
            // (its finallys), then exits — independent of catches (a `return` is never caught,
            // unlike a throw), so it is threaded even where the throw edges are suppressed. The
            // finally release thus runs before the return: `try { …; return; } finally { d }`
            // disposes on the return path instead of being bailed.
            var bodyOnReturn = new List<object>(finallyNodes);
            bodyOnReturn.AddRange(onReturn ?? new List<object>
                { new { op = "return", var = (string?)null, line = LineOf(trys) } });
            if (!LowerFlowStatements(trys.Block.Statements, 0, tracked, model, nodes, bodyCanEscape, bodyOnThrow, bodyOnReturn,
                                     onThrowDefinite: bodyOnThrowDefinite))
                return false;
            nodes.AddRange(finallyNodes);   // normal completion runs the finally
            return true;
        }
        case DoStatementSyntax dos:
        {
            // do { B } while(c)  ≡  B; while(c) { B }  — the body runs 1+ times. Lower B once
            // unconditionally (the guaranteed first iteration), then a `while` of B (0+ more).
            // Modelling it as a plain `while` (0+ trips) would be UNSOUND: a resource released
            // only in the body but acquired before the loop would falsely leak on the phantom
            // 0-trip path. Bail (like the loops) if the body has an unmodelled statement.
            if (dos.Statement is null
                || !LowerFlowStmt(dos.Statement, tracked, model, nodes, canEscape, onThrow, onReturn, onThrowDefinite))
                return false;
            var bodyNodes = new List<object>();
            if (!LowerFlowStmt(dos.Statement, tracked, model, bodyNodes, canEscape, onThrow, onReturn, onThrowDefinite))
                return false;
            nodes.Add(new { op = "while", line = LineOf(dos), body = bodyNodes });
            return true;
        }
        case SwitchStatementSyntax sw:
        {
            // switch(e) { (case L: | default:) section … } modelled as a chain of opaque,
            // mutually-exclusive branches: `if(*){ s1 } else { if(*){ s2 } else { … } }` — one
            // per section, value-opaque (we model control flow, not the matched value). A
            // trailing `break` ends a section (stripped); a section doing anything the model
            // can't place here (a nested `break`, `goto case`) bails the method. A bare `throw`
            // in a section IS modelled now (an abnormal exit) when no enclosing try wraps it.
            List<object>? defaultNodes = null;
            var cases = new List<List<object>>();
            foreach (var section in sw.Sections)
            {
                var secNodes = new List<object>();
                if (!LowerSwitchSection(section, tracked, model, secNodes, canEscape, onThrow, onReturn, onThrowDefinite))
                    return false;
                if (section.Labels.Any(l => l is DefaultSwitchLabelSyntax))
                    defaultNodes = secNodes;
                else
                    cases.Add(secNodes);
            }
            // The chain's tail — the "no earlier case matched" branch. A `default` IS that
            // branch. With NO default we do NOT model an empty no-match path: that would falsely
            // flag a resource disposed in every case of an EXHAUSTIVE switch (e.g. over an enum)
            // as leaking on a path that cannot occur. Instead the LAST case becomes the tail
            // (assume some branch runs) — sound: a genuinely non-exhaustive no-match leak is only
            // missed when EVERY case disposes the resource (a recall gap, never a false positive).
            List<object> chain;
            if (defaultNodes is not null)
                chain = defaultNodes;
            else if (cases.Count == 0)
                return true;                         // empty switch -> no flow effect
            else
            {
                chain = cases[^1];
                cases.RemoveAt(cases.Count - 1);
            }
            for (int k = cases.Count - 1; k >= 0; k--)
                chain = new List<object>
                    { new { op = "if", line = LineOf(sw), then = cases[k], @else = chain } };
            nodes.AddRange(chain);
            return true;
        }
        case ThrowStatementSyntax thr:
            // An explicit `throw` is an abnormal method exit: control leaves the method
            // WITHOUT running the statements below it, so a resource owned here and disposed
            // only LATER leaks on the throw path — dispose-not-called-on-throw with NO
            // enclosing `try`. Modelled at the method-body level only: `onThrow is null` AND
            // the throw escapes (`canEscape`) means no enclosing try would run a `finally` or
            // catch it, so it is a bare CFG exit where a still-owned resource leaks — the same
            // synthetic exit the injected may-throw edges use. INSIDE a try an explicit throw
            // may run a finally or be caught (typed / catch-all); modelling that soundly needs
            // the thrown-type-vs-catch match, which is not threaded here, so an explicit throw
            // there keeps bailing (return false) exactly as before — no new false escape past a
            // catch. (`throw;` rethrow only appears in a catch body, never lowered, so this is
            // the `throw expr;` form.) The win is broad: a method whose only unmodelled
            // statement was a top-level validation throw (`if (x is null) throw …;`) is now
            // analysed instead of skipped, lighting up every detector on the rest of its body.
            // ...and a throw lexically inside a `finally` likewise keeps bailing (IsInsideFinally):
            // its real continuation is the OUTER finally/try cleanup, which a bare exit would skip.
            if (!IsInsideFinally(thr) && canEscape)
            {
                if (onThrow is null)
                {
                    nodes.Add(new { op = "return", var = (string?)null, line = LineOf(thr) });
                    return true;
                }
                // A non-null onThrow that DEFINITELY reaches method exit uncaught (a `using` or a
                // finally-only `try` — no catch can intercept) routes the throw through its
                // cleanup continuation (release(s) then exit), so the resource the cleanup
                // disposes is released on the throw path instead of the whole method bailing. A
                // catchable onThrow (try-with-catch) leaves onThrowDefinite false and still bails:
                // the catch-vs-thrown-type match is not modelled, so guessing would be unsound.
                if (onThrowDefinite)
                {
                    nodes.AddRange(onThrow);
                    return true;
                }
            }
            return false;
        default:
            // unmodelled (goto / labeled / local function / lock / fixed / a `throw` INSIDE a
            // try) -> bail the method, honestly skipping rather than guessing.
            return false;
    }
}

// Lower one `switch` section's statements, treating a top-level `break` as the section
// terminator (it just exits the switch, so it is stripped). Bails (false) on any statement the
// flow model doesn't handle here — including a `break` nested inside an `if`/loop, which reaches
// the unmodelled default and conservatively skips the whole method.
static bool LowerSwitchSection(SwitchSectionSyntax section, HashSet<string> tracked,
                               SemanticModel model, List<object> nodes, bool canEscape,
                               List<object>? onThrow, List<object>? onReturn,
                               bool onThrowDefinite = false)
{
    foreach (var stmt in section.Statements)
    {
        if (stmt is BreakStatementSyntax)
            break;
        if (!LowerFlowStmt(stmt, tracked, model, nodes, canEscape, onThrow, onReturn, onThrowDefinite))
            return false;
    }
    return true;
}

static void EmitFlowExpr(ExpressionSyntax expr, HashSet<string> tracked, SemanticModel model, List<object> nodes)
{
    // `await x.DisposeAsync()` is the IAsyncDisposable release — look through the
    // await to the inner call so it counts as disposal, not a bare use.
    if (expr is AwaitExpressionSyntax awaited)
        expr = awaited.Expression;
    // ... and through a trailing `.ConfigureAwait(false)` — the library-idiomatic
    // `await x.DisposeAsync().ConfigureAwait(false)` awaits the ConfigureAwait call.
    if (expr is InvocationExpressionSyntax cfg
        && cfg.Expression is MemberAccessExpressionSyntax cfgMa
        && cfgMa.Name.Identifier.Text == "ConfigureAwait"
        && cfgMa.Expression is InvocationExpressionSyntax inner)
        expr = inner;
    // x.Dispose()/x.Close()/x.DisposeAsync() on a tracked local -> release.
    if (expr is InvocationExpressionSyntax inv
        && inv.Expression is MemberAccessExpressionSyntax ma
        && ma.Name.Identifier.Text is "Dispose" or "Close" or "DisposeAsync"
        && ma.Expression is IdentifierNameSyntax rid
        && tracked.Contains(rid.Identifier.Text))
    {
        nodes.Add(new { op = "release", var = rid.Identifier.Text, line = LineOf(inv) });
        return;
    }
    // x.Show() on a tracked WinForms Form-derived local -> release: a modeless form's
    // ownership transfers to the framework, which disposes it when the user closes it.
    // Modeled as a release AT THE SHOW SITE (not a method-wide exemption), so it stays
    // path-sensitive — a form shown only on one branch still leaks on the branch that
    // never shows it (Codex review on PR #57). ShowDialog() is a *modal* show and is
    // NOT matched: the caller owns a ShowDialog'd form and must dispose it, so it stays
    // a tracked use (a real leak if never disposed). Guarded by the Form-derived type so
    // an unrelated IDisposable with a Show() method is not mistaken for an ownership
    // transfer.
    if (expr is InvocationExpressionSyntax sinv
        && sinv.Expression is MemberAccessExpressionSyntax sma
        && sma.Name.Identifier.Text == "Show"
        && sma.Expression is IdentifierNameSyntax sid
        && tracked.Contains(sid.Identifier.Text)
        && DerivesFromWinFormsForm(model.GetTypeInfo(sma.Expression).Type))
    {
        nodes.Add(new { op = "release", var = sid.Identifier.Text, line = LineOf(sinv) });
        return;
    }
    // x.Stop() on a tracked System.Net.Sockets.TcpListener -> release: TcpListener.Dispose()
    // just delegates to Stop() (which disposes the listen socket and clears it), so a
    // Stop()'d listener holds no resource and is not a leak (Codex review on PR #61). It is
    // TcpListener-specific, resolved via the method symbol — Stop() on a Timer / Process / etc.
    // does NOT dispose, so it stays a tracked use; a listener never Stop()'d (nor Disposed)
    // still leaks.
    if (expr is InvocationExpressionSyntax tlinv
        && tlinv.Expression is MemberAccessExpressionSyntax
            { Name.Identifier.Text: "Stop", Expression: IdentifierNameSyntax tlid }
        && tracked.Contains(tlid.Identifier.Text)
        && model.GetSymbolInfo(tlinv).Symbol is IMethodSymbol { ContainingType: { Name: "TcpListener" } tct }
        && IsInNamespace(tct, "System", "Net", "Sockets"))
    {
        nodes.Add(new { op = "release", var = tlid.Identifier.Text, line = LineOf(tlinv) });
        return;
    }
    // x?.Dispose()/x?.Close()/x?.DisposeAsync() (null-conditional) is the release too — the
    // call is a member BINDING under a conditional access, not a member access. Mirrors
    // IsDisposeShaped so a `?.` dispose (e.g. in a finally) is not mistaken for a bare use,
    // which would otherwise falsely flag the resource as leaked.
    if (expr is ConditionalAccessExpressionSyntax cond
        && cond.Expression is IdentifierNameSyntax cid
        && tracked.Contains(cid.Identifier.Text)
        && cond.WhenNotNull is InvocationExpressionSyntax condInv
        && condInv.Expression is MemberBindingExpressionSyntax mb
        && mb.Name.Identifier.Text is "Dispose" or "Close" or "DisposeAsync")
    {
        nodes.Add(new { op = "release", var = cid.Identifier.Text, line = LineOf(cond) });
        return;
    }
    // XPool.Return(buf) on a tracked pooled buffer -> release. The buffer is the
    // ARGUMENT (the pool is the receiver), unlike Dispose where the local is the
    // receiver; `return` early so the argument is not also counted as a use.
    if (PoolReturnBuffer(expr, model) is { } pbuf && tracked.Contains(pbuf))
    {
        nodes.Add(new { op = "release", var = pbuf, line = LineOf(expr) });
        return;
    }
    // Foo(s) where Foo consumes (disposes) a by-value IDisposable parameter -> the handoff
    // RELEASES the matching argument(s) here (the inter-procedural consume contract,
    // modelled at the call site like pool Return). A later use of an argument is then a
    // use-after-handoff (OWN002). Do NOT return — other tracked arguments of the same call
    // (`Consume(s, t)`) still need their `use` below; a consumed arg is excluded from it.
    var consumed = ConsumeReleaseArgs(expr, model);
    foreach (var c in consumed)
        if (tracked.Contains(c))
            nodes.Add(new { op = "release", var = c, line = LineOf(expr) });
    // any other reference to a tracked local -> use (once per local; a consumed arg is a
    // release above, never also a use). A Span/Memory VIEW of a tracked buffer is a BORROW: a
    // reference to the view is a use of the OWNER, so using it after the owner was Returned/Disposed
    // trips OWN002 — including RETURNING a `Memory<T>` view (which CAN escape the method) after the
    // owner was released, a dangling borrow handed to the caller
    // (`Memory<byte> v = buf.AsMemory(); Return(buf); return v;`).
    var used = new SortedSet<string>(StringComparer.Ordinal);
    foreach (var idn in expr.DescendantNodesAndSelf().OfType<IdentifierNameSyntax>())
    {
        // A pure DEF of the variable — the bare LHS of `v = …` or an `out` argument — writes it without
        // reading it, so it is NOT a use of the resource (nor of a view's owner). Skipping it removes the
        // over-count where the LHS of a view REASSIGNMENT (`v = other.AsSpan()`) was scanned as a use of
        // the OLD owner (the pooled-view reassignment FP). A `ref` argument and an element/member write
        // (`v[0] = …`, `v.X = …`) still READ `v`, so they are deliberately not skipped (Codex review on #98).
        if (IsPureWrite(idn))
            continue;
        var nm = idn.Identifier.Text;
        if (tracked.Contains(nm))
        {
            if (!consumed.Contains(nm))
                used.Add(nm);
        }
        else if (ViewOwnerOf(idn, model) is { } owner
                 && tracked.Contains(owner) && !consumed.Contains(owner))
            used.Add(owner);
    }
    foreach (var u in used)
        nodes.Add(new { op = "use", var = u, line = LineOf(expr) });
    // POOL005: a full-length view of a pooled buffer anywhere in this expression -> overspan/OWN025.
    EmitOverspans(expr, tracked, model, nodes);
}

// POOL005: emit one `overspan` op per tracked pooled buffer that `expr` takes a FULL-LENGTH VIEW of
// — the core raises OWN025. The view spans the whole oversized array (`buf.AsSpan()` with no bound,
// or `buf.AsSpan(0, buf.Length)` / `new Span<T>(buf, 0, buf.Length)` whose length is the oversized
// self-`.Length`), so reading or copying through it processes the stale `[n, Length)` tail. Walks the
// whole expression so a view nested in a call (`Sink.Write(buf.AsSpan())`), a chain
// (`buf.AsSpan().ToArray()`), or a local-declaration initializer (`var copy = buf.AsSpan()...`) is
// found; a view bounded to the real `n` (`buf.AsSpan(0, n)`) is not matched. Only the VIEW is
// flagged, not a write/wipe: `Array.Clear(buf, 0, buf.Length)` merely overwrites the pooled tail
// (a safe clear-before-Return idiom), it does not expose stale bytes (Codex review). Among `tracked`
// locals only pooled buffers are the arrays the BCL AsSpan/Span symbols bind to, so this never fires
// on a tracked IDisposable / factory result. Shared by the expression-statement and local-decl paths.
static void EmitOverspans(ExpressionSyntax expr, HashSet<string> tracked, SemanticModel model, List<object> nodes)
{
    var overspanned = new SortedSet<string>(StringComparer.Ordinal);
    foreach (var node in expr.DescendantNodesAndSelf().OfType<ExpressionSyntax>())
        if (FullViewOwner(node, model) is { } owner && tracked.Contains(owner))
            overspanned.Add(owner);
    foreach (var o in overspanned)
        nodes.Add(new { op = "overspan", var = o, line = LineOf(expr) });
}

// A pure DEF of its variable — a bare identifier that is the LHS of a SIMPLE assignment (`v = …`) or
// an `out` argument (`F(out v)`): it WRITES the variable without reading the current value, so it is
// not a use of the resource. A `ref` argument is deliberately NOT a pure write — the callee receives
// (and may read) the current value, so `ref v` is a USE as well as a possible rebind (Codex review on
// #98). Element/member writes (`v[0] = …`, `v.X = …`) read `v` to reach the target, so only a bare
// identifier on the assignment's Left (or an `out` slot) qualifies. Excludes pure defs from the use scan.
static bool IsPureWrite(IdentifierNameSyntax idn) =>
    (idn.Parent is AssignmentExpressionSyntax asg
        && asg.IsKind(SyntaxKind.SimpleAssignmentExpression)
        && asg.Left == idn)
    || (idn.Parent is ArgumentSyntax arg
        && arg.RefKindKeyword.IsKind(SyntaxKind.OutKeyword)
        && arg.Expression == idn);

// A REBINDING of its variable — a pure write (above) OR a `ref` argument (the callee may reassign it).
// The b′ reassignment check treats any of these, between a view local's declaration and a later
// reference, as dropping the declared owner. A `ref` is also a USE (it is not an IsPureWrite), so it
// still emits a use of the current owner at its own position and only suppresses LATER references.
static bool IsRebind(IdentifierNameSyntax idn) =>
    IsPureWrite(idn)
    || (idn.Parent is ArgumentSyntax arg
        && arg.RefKindKeyword.IsKind(SyntaxKind.RefKeyword)
        && arg.Expression == idn);

// The field name an expression refers to: "_f" for `_f` or `this._f`, else null.
static string? FieldName(ExpressionSyntax expr) => expr switch
{
    IdentifierNameSyntax id => id.Identifier.Text,
    MemberAccessExpressionSyntax m => m.Name.Identifier.Text,
    _ => null,
};

// The field name an expression refers to ONLY when it names a field of THIS object — a bare
// `_f` or `this._f`, NOT `other._f` (a same-named field on a DIFFERENT receiver, which plain
// text matching would conflate into a phantom release/use, CodeRabbit). Deliberately syntactic,
// not symbol-bound: the field-UAF corpus uses types that do not resolve in the project-local
// compilation, so binding on the field's TYPE is unreliable — the `this`/bare receiver shape is
// exact regardless.
static string? ThisFieldName(ExpressionSyntax expr) => expr switch
{
    IdentifierNameSyntax id => id.Identifier.Text,
    MemberAccessExpressionSyntax m when m.Expression is ThisExpressionSyntax
        => m.Name.Identifier.Text,
    _ => null,
};

// Is there a disposed-flag early-return guard (`if (_disposed) return;`, `if (IsDisposed) return;`)
// among a handler body's TOP-LEVEL statements that OPENS before source position `before`? Such a
// guard makes a later disposed-field read safe (the canonical fix), so the field-UAF pass excludes
// it. Tight on purpose (CodeRabbit/Codex): (1) the guard must PRECEDE the read — a guard only after
// the read does not protect it, so that finding still stands; (2) the THEN branch must be an
// IMMEDIATE `return` (the guard's own action), not a `return` buried in a nested/`else` branch; and
// (3) the flag identifier matches "dispos" case-INsensitively, so the PascalCase `IsDisposed` form
// is recognised as well as `_disposed`.
static bool DisposedGuardBefore(BlockSyntax body, int before) =>
    body.Statements.OfType<IfStatementSyntax>().Any(ifs =>
        ifs.SpanStart < before
        && ifs.Condition.DescendantNodesAndSelf().OfType<IdentifierNameSyntax>()
            .Any(id => id.Identifier.Text.Contains("ispos", StringComparison.OrdinalIgnoreCase))
        && (ifs.Statement is ReturnStatementSyntax
            || (ifs.Statement is BlockSyntax gb
                && gb.Statements.FirstOrDefault() is ReturnStatementSyntax)));

// The released OWNER field reached by a read of field `f`: `f` itself when it is a released owner
// (an IDisposable or `IMemoryOwner<T>` field released in Dispose), or — when `f` is a `Memory` VIEW
// field — the owner it aliases, provided that owner is released. Null when `f` reaches no released
// owner. Unifies the direct disposed-field read (#75/#76) with the pooled-view-in-a-field dangle:
// reading `_view` (a borrow of `_owner`) after `_owner`'s release is a use of `_owner` after release.
static string? ReleasedOwner(string f, Dictionary<string, int> releasedAt,
    Dictionary<string, string> viewFieldOwner) =>
    releasedAt.ContainsKey(f) ? f
    : viewFieldOwner.TryGetValue(f, out var owner) && releasedAt.ContainsKey(owner) ? owner
    : null;

// The FIRST read of a released owner — directly (`_f.Member`) or through a Memory VIEW field that
// aliases it — in `body` that is NOT protected by an opening disposed-guard. Returns the member-
// access node and the OWNER field, or null when the body has no such read (or its first such read is
// already guarded, the canonical-fix shape). Shared by the direct handler scan and the one-hop
// helper scan (an indirect use through a private helper).
static (MemberAccessExpressionSyntax Use, string Field)? FirstUnguardedDisposedRead(
    BlockSyntax body, Dictionary<string, int> releasedAt, Dictionary<string, string> viewFieldOwner)
{
    foreach (var ma in body.DescendantNodes().OfType<MemberAccessExpressionSyntax>())
    {
        if (ma.Name.Identifier.Text is "Dispose" or "DisposeAsync")
            continue;
        if (ThisFieldName(ma.Expression) is { } f && ReleasedOwner(f, releasedAt, viewFieldOwner) is { } owner)
            return DisposedGuardBefore(body, ma.SpanStart) ? null : (ma, owner);
    }
    return null;
}

// The method name of a SELF call (`Refresh()` or `this.Refresh()`), i.e. an instance method of the
// same object — NOT `other.Refresh()`. Used to chase a handler's ONE hop into a same-class helper.
static string? SelfCallName(InvocationExpressionSyntax inv) => inv.Expression switch
{
    IdentifierNameSyntax id => id.Identifier.Text,
    MemberAccessExpressionSyntax m when m.Expression is ThisExpressionSyntax
        => m.Name.Identifier.Text,
    _ => null,
};

// A private INSTANCE helper (default-private or explicit `private`, and not static/virtual/abstract/
// override or a wider accessibility) — the shape of an internal `Refresh()`-style helper a handler
// delegates to. Restricting the one-hop chase to these keeps the indirect field-UAF check low-FP
// (a public/virtual method has a broader contract than a same-class callback helper).
static bool IsPrivateInstanceHelper(MethodDeclarationSyntax m) =>
    !m.Modifiers.Any(mod => mod.IsKind(SyntaxKind.PublicKeyword)
        || mod.IsKind(SyntaxKind.ProtectedKeyword)
        || mod.IsKind(SyntaxKind.InternalKeyword)
        || mod.IsKind(SyntaxKind.StaticKeyword)
        || mod.IsKind(SyntaxKind.VirtualKeyword)
        || mod.IsKind(SyntaxKind.AbstractKeyword)
        || mod.IsKind(SyntaxKind.OverrideKeyword));

// Is `t` the System.Buffers.ArrayPool<T> type — the Return-based pool we model?
// Checked on the resolved SYMBOL, not the receiver's text, so an aliased receiver
// (`ArrayPool<int> p = ArrayPool<int>.Shared; p.Rent(n)`) binds correctly and an
// unrelated API with "pool" in its name does not false-match. ArrayPool-specific by
// design: MemoryPool<T>.Rent hands back an IMemoryOwner<T> released by Dispose (there
// is no MemoryPool.Return), so a pooled MemoryPool owner rides the IDisposable path,
// not this Return-based one.
static bool IsArrayPoolType(INamedTypeSymbol? t)
{
    if (t is null || t.Name != "ArrayPool")
        return false;
    INamespaceSymbol? ns = t.ContainingNamespace;
    if (ns is null || ns.Name != "Buffers")
        return false;
    ns = ns.ContainingNamespace;   // System.Buffers -> System
    return ns is not null && ns.Name == "System"
        && ns.ContainingNamespace is { IsGlobalNamespace: true };
}

// An ArrayPool<T> `Rent(...)` call — the acquire of a pooled buffer. Resolved via the
// SemanticModel (`model`), so the receiver may be any expression of ArrayPool<T> type.
static bool IsPoolRent(ExpressionSyntax? e, SemanticModel model) =>
    e is InvocationExpressionSyntax i
    && model.GetSymbolInfo(i).Symbol is IMethodSymbol { Name: "Rent" } sym
    && IsArrayPoolType(sym.ContainingType);

// An ArrayPool<T> `Return(buf)` call — the RELEASE of the pooled buffer `buf`. Unlike
// Dispose (where the tracked local is the receiver), the buffer is the first ARGUMENT
// and the pool is the receiver. Resolved via the SemanticModel. Returns the buffer
// name (a plain local) or null.
static string? PoolReturnBuffer(ExpressionSyntax e, SemanticModel model) =>
    e is InvocationExpressionSyntax i
        && model.GetSymbolInfo(i).Symbol is IMethodSymbol { Name: "Return" } sym
        && IsArrayPoolType(sym.ContainingType)
        && i.ArgumentList.Arguments.Count > 0
        && i.ArgumentList.Arguments[0].Expression is IdentifierNameSyntax buf
        ? buf.Identifier.Text : null;

// Is `idn` a pooled buffer passed as an argument to a CONSTRUCTOR whose result ESCAPES this method —
// `return new Wrapper(…, buf, …)` or `_field = new Wrapper(…, buf, …)`? Such a `new` hands the buffer
// to the constructed object, which becomes responsible for Return, so the buffer leaves the method
// inside the escaping object (an ownership transfer, not a borrow). One level only: the `new` must be
// the direct return value or assigned to a real FIELD — a `new` stored in a LOCAL stays a borrow (the
// local is method-scoped; a wrapper that never leaves the method and never Returns the buffer is a
// real leak, Codex), as does a `new` buried in another expression. The field check is symbol-based
// (`IFieldSymbol`) so an assignment to a same-named LOCAL is not mistaken for a field.
static bool PassedToEscapingCtor(IdentifierNameSyntax idn, SemanticModel model) =>
    idn.Parent is ArgumentSyntax { Parent: ArgumentListSyntax
            { Parent: BaseObjectCreationExpressionSyntax oce } }
    && (oce.Parent is ReturnStatementSyntax
        || (oce.Parent is AssignmentExpressionSyntax a && a.Right == oce
            && model.GetSymbolInfo(a.Left).Symbol is IFieldSymbol)
        // One extra hop: `var w = new Wrapper(…, buf, …); … return w / _field = w / Sink(…, w, …)`.
        // The buffer transfers to the wrapper, which then ESCAPES through the local. Mined FP on
        // StackExchange.Redis (Lease<T>.Create `return new Lease(arr)` via a local; RedisServer scan
        // `new ScanResult(keys)` handed to SetResult). The Codex one-level rule is PRESERVED for the
        // non-escaping case: a wrapper local that never leaves the method (and never Returns the
        // buffer) still leaks — WrapperLocalEscapes returns false there, so it stays flagged.
        || WrapperLocalEscapes(oce, model));

// The object-creation `oce` (`new Wrapper(…, buf, …)`) is bound to a LOCAL that itself provably
// leaves the enclosing method — `var w = new Wrapper(buf); … return w` / `this._f = w` / `Sink(…,
// w, …)`. Only then is the buffer an ownership TRANSFER (the wrapper carries it out); a wrapper local
// that stays method-scoped is a borrow and the buffer still leaks (Codex). Precision-first, mirroring
// the direct `return new Wrapper(buf)` rule: we cannot prove the wrapper Returns the buffer, but a
// pooled buffer handed to an escaping owner is a transfer, not a leak here.
static bool WrapperLocalEscapes(BaseObjectCreationExpressionSyntax oce, SemanticModel model)
{
    // Only the DECLARATION form `var w = new Wrapper(buf)` — a fresh local bound exactly once. The
    // assignment form (`w = new Wrapper(buf)`, w pre-declared and reused) is NOT handled: a reused
    // local makes "does *this* wrapper escape" flow-dependent (`Sink(w); … w = new Wrapper(buf)` uses
    // an earlier value; `w = new Wrapper(buf); w = other; return w` returns a different one), which
    // this syntactic scan cannot answer soundly — untracking `buf` there would MISS a real leak
    // (Codex P2). So we bind only a declarator and additionally bail if `w` is reassigned anywhere.
    if (oce.Parent is not EqualsValueClauseSyntax { Parent: VariableDeclaratorSyntax vd }
        || model.GetDeclaredSymbol(vd) is not ILocalSymbol w)
        return false;
    var method = oce.FirstAncestorOrSelf<BaseMethodDeclarationSyntax>();
    SyntaxNode? body = method?.Body ?? (SyntaxNode?)method?.ExpressionBody;
    if (body is null)
        return false;
    bool escapes = false;
    // Do NOT descend into nested lambdas / local functions: a use of `w` captured inside a
    // callable that itself never leaves the method (`Action a = () => Sink(w);`) is not an escape
    // of `w`, and counting it would untrack `buf` and hide a real leak (CodeRabbit). The `w`
    // declaration and its top-level uses stay in scope; only nested-callable bodies are pruned.
    foreach (var id in body.DescendantNodes(n =>
                 n is not (AnonymousFunctionExpressionSyntax or LocalFunctionStatementSyntax))
             .OfType<IdentifierNameSyntax>())
    {
        if (!SymbolEqualityComparer.Default.Equals(model.GetSymbolInfo(id).Symbol, w))
            continue;
        // `w` REASSIGNED (`w = …` / `w op= …`, w on the LHS): it no longer provably refers to the
        // wrapper that owns `buf`, so we cannot claim an escape. Bail — the buffer stays flagged
        // (sound: a false negative here would be a missed pool leak, worse than keeping the report).
        if (id.Parent is AssignmentExpressionSyntax reassign && reassign.Left == id)
            return false;
        // return w;  /  <field> = w;  /  Sink(…, w, …)  — the wrapper (and thus `buf`) leaves the
        // method. Recorded, not returned early, so a later reassignment can still veto it.
        if (id.Parent is ReturnStatementSyntax)
            escapes = true;
        else if (id.Parent is AssignmentExpressionSyntax fa && fa.Right == id
                 && model.GetSymbolInfo(fa.Left).Symbol is IFieldSymbol)
            escapes = true;
        else if (id.Parent is ArgumentSyntax { Parent: ArgumentListSyntax { Parent: InvocationExpressionSyntax } })
            escapes = true;
    }
    return escapes;
}

// Is `t` the System.Buffers.MemoryPool<T> type — the Dispose-based pool. Mirrors IsArrayPoolType
// (checked on the resolved symbol, so an aliased/injected `MemoryPool<T>` receiver binds and a
// look-alike does not).
static bool IsMemoryPoolType(INamedTypeSymbol? t)
{
    if (t is null || t.Name != "MemoryPool")
        return false;
    INamespaceSymbol? ns = t.ContainingNamespace;   // System.Buffers
    if (ns is null || ns.Name != "Buffers")
        return false;
    ns = ns.ContainingNamespace;                     // System.Buffers -> System
    return ns is not null && ns.Name == "System"
        && ns.ContainingNamespace is { IsGlobalNamespace: true };
}

// A MemoryPool<T>.Shared.Rent(...) call — the acquire of an IMemoryOwner<T>. There is NO
// MemoryPool.Return: the owner is released by Dispose (the IDisposable path), so unlike an ArrayPool
// buffer it is NOT a `poolBuffer`. A Rent'd owner never disposed leaks (OWN001), a second Dispose is
// a double release (OWN003), and a use of the owner after Dispose is a use-after-release (OWN002).
static bool IsMemoryPoolRent(ExpressionSyntax? e, SemanticModel model) =>
    e is InvocationExpressionSyntax i
    && model.GetSymbolInfo(i).Symbol is IMethodSymbol { Name: "Rent" } sym
    && IsMemoryPoolType(sym.ContainingType);

// The owner buffer a Span/ReadOnlySpan/Memory/ReadOnlyMemory VIEW expression borrows from:
// `owner.AsSpan(...)` / `owner.AsMemory(...)`, `new Span<T>(owner, …)` / `new Memory<T>(owner)`
// (and the ReadOnly* forms), or `owner.Memory` / `owner.Memory.Span` of a `System.Buffers.
// IMemoryOwner<T>` (a MemoryPool rental), where the source is a local identifier. Returns the owner local name,
// else null. The BORROW is recognised by the RESOLVED BCL symbols — `System.MemoryExtensions`
// `AsSpan`/`AsMemory` (which alias the receiver array) and the `System.Span<T>` / `ReadOnlySpan<T>`
// / `Memory<T>` / `ReadOnlyMemory<T>` constructor (which wraps the array argument) — NOT by name, so
// a project's own `AsSpan`/`AsMemory`, or a non-`System` look-alike type, is not mistaken for a
// borrow of `owner` (Codex). `Span` is a ref-struct borrow that cannot escape the method; `Memory`
// CAN escape (return / field), so a `Memory` view returned after the owner is released is a dangling
// borrow that leaves the method — in both cases a use of the view after the owner's release is a use
// of the owner after its release.
static string? ViewOwner(ExpressionSyntax? e, SemanticModel model)
{
    if (e is InvocationExpressionSyntax inv
        && inv.Expression is MemberAccessExpressionSyntax m
        && m.Name.Identifier.Text is "AsSpan" or "AsMemory"
        && m.Expression is IdentifierNameSyntax recv
        && model.GetSymbolInfo(inv).Symbol is IMethodSymbol { ContainingType: { Name: "MemoryExtensions" } mct }
        && IsInNamespace(mct, "System"))
        return recv.Identifier.Text;
    if (e is BaseObjectCreationExpressionSyntax oc          // explicit OR target-typed `new(buf, …)`
        && oc.ArgumentList is { Arguments.Count: > 0 }
        && oc.ArgumentList.Arguments[0].Expression is IdentifierNameSyntax arg
        && model.GetSymbolInfo(oc).Symbol is IMethodSymbol
            { ContainingType: { Name: "Span" or "ReadOnlySpan" or "Memory" or "ReadOnlyMemory" } sct }
        && IsInNamespace(sct, "System"))
        return arg.Identifier.Text;
    // owner.Memory — a Memory<T> view of a System.Buffers.IMemoryOwner<T> (e.g. a MemoryPool rental).
    // Like array.AsMemory(), the Memory CAN escape (return / field); a use of the view after the
    // owner's Dispose is a use of the owner after release (OWN002), and a returned Memory after
    // Dispose is a dangling borrow. Recognised by the resolved `IMemoryOwner<T>.Memory` property.
    if (e is MemberAccessExpressionSyntax mem
        && mem.Name.Identifier.Text == "Memory"
        && mem.Expression is IdentifierNameSyntax mo
        && model.GetSymbolInfo(mem).Symbol is IPropertySymbol { ContainingType: { Name: "IMemoryOwner" } ict }
        && IsInNamespace(ict, "System", "Buffers"))
        return mo.Identifier.Text;
    // owner.Memory.Span — the Span<T> of that Memory view (a ref-struct borrow that cannot escape).
    if (e is MemberAccessExpressionSyntax { Name.Identifier.Text: "Span" } spanAcc
        && spanAcc.Expression is MemberAccessExpressionSyntax
            { Name.Identifier.Text: "Memory", Expression: IdentifierNameSyntax mo2 } innerMem
        && model.GetSymbolInfo(innerMem).Symbol is IPropertySymbol { ContainingType: { Name: "IMemoryOwner" } ict2 }
        && IsInNamespace(ict2, "System", "Buffers"))
        return mo2.Identifier.Text;
    return null;
}

// Is `t` System.Buffers.IMemoryOwner<T> — the interface itself, or a concrete type that implements
// it? Resolved on the SYMBOL, so a fully-qualified `System.Buffers.IMemoryOwner<T>`, a type alias, or
// a concrete owner type is recognised — not only the bare `IMemoryOwner` spelling (CodeRabbit/Codex).
static bool IsMemoryOwnerType(ITypeSymbol? t) =>
    t is INamedTypeSymbol nt
    && ((nt.Name == "IMemoryOwner" && IsInNamespace(nt, "System", "Buffers"))
        || nt.AllInterfaces.Any(i => i.Name == "IMemoryOwner" && IsInNamespace(i, "System", "Buffers")));

// The owner FIELD a `Memory` view assignment aliases — `_owner.Memory` / `this._owner.Memory` of an
// IMemoryOwner<T> field. Uses the this/bare receiver restriction (ThisFieldName), so `other._owner.
// Memory` (another instance's owner) is NOT recorded and the this-qualified spelling IS (Codex). The
// borrow is recognised by the resolved `IMemoryOwner<T>.Memory` property symbol, not by name.
static string? FieldViewOwner(ExpressionSyntax e, SemanticModel model) =>
    e is MemberAccessExpressionSyntax { Name.Identifier.Text: "Memory" } mem
    && model.GetSymbolInfo(mem).Symbol is IPropertySymbol { ContainingType: { Name: "IMemoryOwner" } ict }
    && IsInNamespace(ict, "System", "Buffers")
        ? ThisFieldName(mem.Expression)
        : null;

// The tracked owner buffer a FULL-LENGTH view spans, else null. POOL005: `buf.AsSpan()` /
// `buf.AsMemory()` with NO arguments span `[0, Length)` — the WHOLE backing array — and so does
// `buf.AsSpan(0, buf.Length)` / `new Span<T>(buf, 0, buf.Length)`, whose length argument is the
// buffer's OWN oversized `.Length` (the `.Length` spelling); `new Span<T>(buf)` (only the array) too.
// A pooled array is oversized (`ArrayPool.Rent(n)` returns `Length >= n`), so such a view reaches
// past the logical length `n` into the stale `[n, Length)` tail (a previous renter's bytes): reading
// or copying through it processes that stale data — a correctness bug and a potential disclosure. A
// view bounded to the REAL rented length (`buf.AsSpan(0, n)`, `new Span<T>(buf, 0, n)`) returns null
// — it does not over-read. Recognised by the SAME resolved BCL symbols as `ViewOwner`, so a
// project's own `AsSpan`/`Span` look-alike is not mistaken for the over-read.
static string? FullViewOwner(ExpressionSyntax? e, SemanticModel model)
{
    if (e is InvocationExpressionSyntax inv
        && inv.Expression is MemberAccessExpressionSyntax m
        && m.Name.Identifier.Text is "AsSpan" or "AsMemory"
        && m.Expression is IdentifierNameSyntax recv
        && model.GetSymbolInfo(inv).Symbol is IMethodSymbol { ContainingType: { Name: "MemoryExtensions" } mct }
        && IsInNamespace(mct, "System"))
    {
        var args = inv.ArgumentList.Arguments;
        // `buf.AsSpan()` (no bound) spans the whole array; so does `buf.AsSpan(0, buf.Length)`,
        // whose length argument is the buffer's OWN oversized `.Length` (the `.Length` spelling). The
        // start must be 0 — `buf.AsSpan(k, buf.Length)` for k != 0 is out of range, not this pattern.
        if (args.Count == 0
            || (args.Count == 2 && IsZeroInt(args[0].Expression, model)
                && IsLengthOf(args[1].Expression, recv.Identifier.Text)))
            return recv.Identifier.Text;
    }
    if (e is BaseObjectCreationExpressionSyntax oc
        && oc.ArgumentList is { Arguments.Count: > 0 } al
        && al.Arguments[0].Expression is IdentifierNameSyntax arg
        && model.GetSymbolInfo(oc).Symbol is IMethodSymbol
            { ContainingType: { Name: "Span" or "ReadOnlySpan" or "Memory" or "ReadOnlyMemory" } sct }
        && IsInNamespace(sct, "System"))
    {
        // `new Span<T>(buf)` (whole array) or `new Span<T>(buf, 0, buf.Length)` (start 0, length the
        // oversized self-length).
        if (al.Arguments.Count == 1
            || (al.Arguments.Count == 3 && IsZeroInt(al.Arguments[1].Expression, model)
                && IsLengthOf(al.Arguments[2].Expression, arg.Identifier.Text)))
            return arg.Identifier.Text;
    }
    return null;
}

// `arg` is the buffer's own `.Length` (`buf.Length`) — the POOL005 `.Length` spelling, where the
// oversized backing length is passed as the operative length/count instead of the rented `n`.
static bool IsLengthOf(ExpressionSyntax arg, string owner) =>
    arg is MemberAccessExpressionSyntax { Name.Identifier.Text: "Length",
                                          Expression: IdentifierNameSyntax id }
    && id.Identifier.Text == owner;

// `arg` is the constant `0` — the start/index of a `.Length`-spelled view (`buf.AsSpan(0, buf.Length)`)
// so the view spans the WHOLE array, not an interior slice. Resolved via the constant value, so a
// `const`, `0x0`, etc. all count.
static bool IsZeroInt(ExpressionSyntax arg, SemanticModel model) =>
    model.GetConstantValue(arg) is { HasValue: true, Value: int v } && v == 0;

// The this/bare FIELD a FULL-LENGTH view spans, else null. The POOL005 FIELD twin of FullViewOwner:
// `_buf.AsSpan()` / `this._buf.AsMemory()` (no bound), `_buf.AsSpan(0, _buf.Length)` (the `.Length`
// spelling), `new Span<T>(_buf)` / `new Span<T>(_buf, 0, _buf.Length)` over a buffer the class held
// in a FIELD. The receiver is resolved through `ThisFieldName` (a bare `_buf` or `this._buf`, never
// `other._buf`), so a full-length view of a pooled FIELD — whose over-read the LOCAL-only flow pass
// never reaches — is found; the caller gates on the field actually being a pooled rent. Recognised by
// the SAME resolved BCL symbols as FullViewOwner (`System.MemoryExtensions` AsSpan/AsMemory, the
// `System.Span<T>`/… constructor), so a project's own look-alike is not mistaken for the over-read. A
// view bounded to the real rented `n` (`_buf.AsSpan(0, n)`) returns null — it does not over-read.
static string? FullViewFieldOwner(ExpressionSyntax? e, SemanticModel model)
{
    if (e is InvocationExpressionSyntax inv
        && inv.Expression is MemberAccessExpressionSyntax m
        && m.Name.Identifier.Text is "AsSpan" or "AsMemory"
        && ThisFieldName(m.Expression) is { } recv
        && model.GetSymbolInfo(inv).Symbol is IMethodSymbol { ContainingType: { Name: "MemoryExtensions" } mct }
        && IsInNamespace(mct, "System"))
    {
        var args = inv.ArgumentList.Arguments;
        if (args.Count == 0
            || (args.Count == 2 && IsZeroInt(args[0].Expression, model)
                && IsFieldLengthOf(args[1].Expression, recv)))
            return recv;
    }
    if (e is BaseObjectCreationExpressionSyntax oc
        && oc.ArgumentList is { Arguments.Count: > 0 } al
        && ThisFieldName(al.Arguments[0].Expression) is { } arg
        && model.GetSymbolInfo(oc).Symbol is IMethodSymbol
            { ContainingType: { Name: "Span" or "ReadOnlySpan" or "Memory" or "ReadOnlyMemory" } sct }
        && IsInNamespace(sct, "System"))
    {
        if (al.Arguments.Count == 1
            || (al.Arguments.Count == 3 && IsZeroInt(al.Arguments[1].Expression, model)
                && IsFieldLengthOf(al.Arguments[2].Expression, arg)))
            return arg;
    }
    return null;
}

// `arg` is the pooled FIELD's own `.Length` (`_buf.Length` / `this._buf.Length`) — the FIELD twin of
// IsLengthOf, resolving the `.Length` receiver through `ThisFieldName` so the this-qualified spelling
// counts and `other._buf.Length` does not.
static bool IsFieldLengthOf(ExpressionSyntax arg, string field) =>
    arg is MemberAccessExpressionSyntax { Name.Identifier.Text: "Length" } ma
    && ThisFieldName(ma.Expression) == field;

// If `idn` references a Span/ReadOnlySpan/Memory/ReadOnlyMemory VIEW local declared from an owner
// buffer (`Memory<T> view = owner.AsMemory(…)`), the owner buffer's local name — so a use of the
// view (including RETURNING it, an escape) lowers to a use of the owner (the borrow). Resolved
// through the view local's own declaration, so it is inert for any identifier that is not such a
// view (returns null -> ordinary handling).
static string? ViewOwnerOf(IdentifierNameSyntax idn, SemanticModel model)
{
    if (model.GetSymbolInfo(idn).Symbol is not ILocalSymbol sym)
        return null;
    foreach (var r in sym.DeclaringSyntaxReferences)
        if (r.GetSyntax() is VariableDeclaratorSyntax { Initializer.Value: { } init } decl)
        {
            // b′ (pooled-view reassignment FP): the declaration's owner holds only until `view` is
            // REASSIGNED. If a `view = …` (or a `ref`/`out` rebinding) of this same local sits between
            // the declaration and THIS reference (source order), the reference no longer borrows the
            // declared owner — its current owner is unknown, so go silent rather than attribute it to a
            // possibly-released buffer. This only ever REMOVES a use (errs to a false negative, never a
            // false positive). Matched on the resolved symbol, so a same-named local elsewhere is not
            // mistaken for a rebinding. (Full flow-sensitive per-path provenance is left for later.)
            if (ReassignedBetween(sym, decl, idn, model))
                return null;
            return ViewOwner(init, model);
        }
    return null;
}

// Is the local `sym` REBOUND (IsRebind: a direct `=` target, an `out`, or a `ref` argument) at a
// source position strictly after its declaration `decl` and strictly before the reference `use`,
// within the declaring member? Source-order and intraprocedural: straight-line code is exact; a
// reassignment on a non-taken branch suppresses conservatively (a possible miss, never a false
// positive). The b′ predicate behind ViewOwnerOf's reassignment suppression. Four writes do NOT
// count, because their effect is not yet visible to the use (all Codex/CodeRabbit review on #98):
// one in the SAME assignment as the use (`v = v.Slice(1)` — the RHS reads the still-current view);
// one that is a `ref`/`out` ARGUMENT of the same call as the use (`Reinit(out v, v[0])` — arguments
// evaluate before the callee writes the parameter); one in a `for` INCREMENTOR enclosing the use
// (`for (;;v=default) { v[0]=…; }` — the incrementor runs after the body, not at its header position);
// and one nested in a deferred body (a lambda / local function runs on invoke, not at its textual position).
static bool ReassignedBetween(ILocalSymbol sym, VariableDeclaratorSyntax decl,
                              IdentifierNameSyntax use, SemanticModel model)
{
    var scope = decl.Ancestors().FirstOrDefault(n =>
        n is BaseMethodDeclarationSyntax or AccessorDeclarationSyntax or LocalFunctionStatementSyntax);
    if (scope is null)
        return false;
    var useAssign = use.FirstAncestorOrSelf<AssignmentExpressionSyntax>();
    int lo = decl.SpanStart, hi = use.SpanStart;
    foreach (var id in scope.DescendantNodes().OfType<IdentifierNameSyntax>())
    {
        if (id.SpanStart <= lo || id.SpanStart >= hi || !IsRebind(id))
            continue;
        if (useAssign is not null && id.FirstAncestorOrSelf<AssignmentExpressionSyntax>() == useAssign)
            continue;                                   // the use's OWN assignment, not a prior rebind
        if (id.Parent is ArgumentSyntax { Parent: ArgumentListSyntax args } && args.Span.Contains(use.Span))
            continue;                                   // ref/out rebind in the SAME call: args evaluate before the callee writes
        if (id.Ancestors().OfType<ForStatementSyntax>()
               .FirstOrDefault(f => f.Incrementors.Any(i => i.Span.Contains(id.Span))) is { } forInc
            && forInc.Span.Contains(use.Span))
            continue;                                   // for-incrementor rebind runs AFTER the body, not at its header position
        if (InDeferredBody(id, scope))
            continue;                                   // a write inside a lambda/local fn does not run here
        if (SymbolEqualityComparer.Default.Equals(model.GetSymbolInfo(id).Symbol, sym))
            return true;
    }
    return false;
}

// Is `node` nested inside a lambda or local function that lies between it and `scope`? Such a body is
// DEFERRED — its statements run when it is invoked, not at their textual position — so the source-
// order reassignment scan must not treat a write inside one as a straight-line rebind (CodeRabbit #98).
static bool InDeferredBody(SyntaxNode node, SyntaxNode scope)
{
    for (var p = node.Parent; p is not null && p != scope; p = p.Parent)
        if (p is AnonymousFunctionExpressionSyntax or LocalFunctionStatementSyntax)
            return true;
    return false;
}

// The tracked owner buffers whose Span/Memory VIEW LOCALS are returned by `expr` (an escaping
// borrow — `return view` where `view` is `buf.AsMemory(…)`). The caller uses each such view AFTER
// this method's finally cleanup, so the return lowering re-emits the owner's use after the finally
// release(s). Distinct from a plain returned tracked local (excluded upstream as an escape) — here
// the borrow, not the owner, leaves the method, and the owner stays tracked.
static List<string> ReturnedViewOwners(ExpressionSyntax expr, HashSet<string> tracked, SemanticModel model)
{
    var owners = new List<string>();
    void AddOwner(string? owner)
    {
        if (owner is not null && tracked.Contains(owner) && !owners.Contains(owner))
            owners.Add(owner);
    }
    // Follow only the RETURNED VALUE's own structure — a view LOCAL (`return view`), an inline view
    // expression (`return buf.AsMemory(…)`), through casts / parentheses / `?:`. A member or call
    // RESULT of a view (`return view.Length`, an int) does NOT escape the view, so it is not visited
    // — scanning every descendant identifier would wrongly flag it (CodeRabbit).
    void Visit(ExpressionSyntax e)
    {
        AddOwner(ViewOwner(e, model));
        switch (e)
        {
            case IdentifierNameSyntax idn when !tracked.Contains(idn.Identifier.Text):
                AddOwner(ViewOwnerOf(idn, model));
                break;
            case ParenthesizedExpressionSyntax p:
                Visit(p.Expression);
                break;
            case CastExpressionSyntax c:
                Visit(c.Expression);
                break;
            case ConditionalExpressionSyntax q:
                Visit(q.WhenTrue);
                Visit(q.WhenFalse);
                break;
        }
    }
    Visit(expr);
    return owners;
}

// A factory call that CREATES and hands back a fresh owned IDisposable the caller must
// release — recognised via the resolved symbol (curated, the same spirit as
// IsDisposableType is for `new`). Two families:
//   * System.IO.File.Open*/Create*/*Text -> a NEW FileStream / StreamReader / StreamWriter
//     the caller owns exactly as if it had `new`'d one.
//   * System.Security.Cryptography static `Create*` factories -> a NEW owned IDisposable:
//     RandomNumberGenerator.Create(), Aes.Create(), SHA256.Create(), RSA.Create(),
//     IncrementalHash.CreateHash(), ... (guarded by static + Create-prefixed + the RESULT
//     implementing IDisposable + the crypto namespace, so an instance `CreateEncryptor()` or
//     a non-IDisposable `CreateFromName()` is never mistaken for one).
//   * P1a stdlib pack: System.Xml `XmlReader.Create`/`XmlWriter.Create` -> a fresh owned
//     reader/writer; System.Text.Json `JsonDocument.Parse` -> a JsonDocument that pools memory
//     and must be disposed. Gated on the RESULT implementing IDisposable, so a Task-returning
//     `JsonDocument.ParseAsync` is excluded.
// Curated + symbol-resolved, so a borrowed/cached disposable handed back by some other API is
// never mistaken for an owned acquire (precision over recall — the set grows only as
// ownership is certain).
//
// Relationship to the bridge table `_BCL_FRESH_BY_NS` (ownlang/ownir.py) — NOT a mirror. This
// function is the emission AUTHORITY: a match makes the extractor emit the local as an `acquire`
// fact. So this list is the SUPERSET — it also covers ADO.NET and network `Accept*`, which the
// bridge table omits. The bridge table is consulted only on the OTHER path — a `call` op whose
// result the bridge decides is `fresh` — and since owning factories are emitted as `acquire` (not
// `call`), it need only cover the shared File/crypto/Xml/Json seam, never the ADO.NET/network
// entries. If a factory here is ever emitted as a `call` instead, add it to the bridge table too.
static bool IsOwningFactory(ExpressionSyntax? e, SemanticModel model)
{
    if (e is not InvocationExpressionSyntax i
        || model.GetSymbolInfo(i).Symbol is not IMethodSymbol sym)
        return false;
    if (sym.Name is "OpenRead" or "OpenWrite" or "Open" or "Create"
                 or "OpenText" or "CreateText" or "AppendText"
        && sym.ContainingType is { Name: "File" } ft
        && IsInNamespace(ft, "System", "IO"))
        return true;
    if (sym.IsStatic
        && sym.Name.StartsWith("Create", StringComparison.Ordinal)
        && ImplementsIDisposable(sym.ReturnType)
        && IsInNamespace(sym.ContainingType, "System", "Security", "Cryptography"))
        return true;
    if (sym.IsStatic && ImplementsIDisposable(sym.ReturnType)
        && ((sym.Name == "Create"
             && sym.ContainingType is { Name: "XmlReader" or "XmlWriter" } xt
             && IsInNamespace(xt, "System", "Xml"))
            || (sym.Name == "Parse"
                && sym.ContainingType is { Name: "JsonDocument" } jt
                && IsInNamespace(jt, "System", "Text", "Json")))
        // ...but ONLY the overloads that take no disposable input. The Stream/TextReader/
        // TextWriter overloads do NOT own that input (XmlReaderSettings.CloseInput /
        // XmlWriterSettings.CloseOutput default false, JsonDocument.Parse never closes its
        // stream), so claiming a pure factory there would let the escape pass drop the
        // caller-owned input and suppress its leak (Codex). The common string/URI/path
        // overloads have no disposable arg and still resolve. (precision over recall.)
        && !AnyDisposableArgument(i, model))
        return true;
    // ADO.NET owned-returning members — the canonical real-world disposable leak. These are
    // INSTANCE methods on a connection/command, but the acquire path (op="acquire") does not care
    // static-vs-instance, and the receiver is not an argument so it is never dropped. Provider
    // types vary (SqlCommand / NpgsqlCommand / SqliteCommand / ...), so match by method name + the
    // RESOLVED types implementing the System.Data contract interfaces, which covers every provider,
    // the abstract base (DbDataReader/DbCommand/DbTransaction), and the interface itself. BOTH the
    // RECEIVER and the RETURN are pinned (like every other factory branch verifies its declaring
    // type), so a non-ADO helper that merely exposes an `ExecuteReader` returning a borrowed/cached
    // IDataReader is NOT mistaken for an owned factory (Codex):
    //   * IDbCommand.ExecuteReader()    -> a DbDataReader the caller must dispose (frees the cursor)
    //   * IDbConnection.CreateCommand() -> a DbCommand the caller must dispose
    //   * IDbConnection.BeginTransaction() -> a DbTransaction the caller must dispose
    // Arguments are non-disposable (CommandBehavior / IsolationLevel enums); the guard keeps any
    // odd overload from dropping a disposable input.
    if (!AnyDisposableArgument(i, model)
        && ((sym.Name == "ExecuteReader"
             && ImplementsSystemDataInterface(sym.ContainingType, "IDbCommand")
             && ImplementsSystemDataInterface(sym.ReturnType, "IDataReader"))
            || (sym.Name == "CreateCommand"
                && ImplementsSystemDataInterface(sym.ContainingType, "IDbConnection")
                && ImplementsSystemDataInterface(sym.ReturnType, "IDbCommand"))
            || (sym.Name == "BeginTransaction"
                && ImplementsSystemDataInterface(sym.ContainingType, "IDbConnection")
                && ImplementsSystemDataInterface(sym.ReturnType, "IDbTransaction"))))
        return true;
    // Network "accept" owned factories — a server that accepts a connection OWNS the returned
    // client/socket and must dispose it; dropping it leaks the accepted connection (the handle is
    // held until finalization), a classic accept-loop server leak. INSTANCE methods, matched by the
    // concrete BCL receiver type + method name (Socket / TcpListener are not subclassed in practice,
    // like the File branch) with the result's IDisposable pinned, so the async variants
    // (AcceptAsync / AcceptTcpClientAsync -> Task/ValueTask, not IDisposable) are excluded:
    //   * Socket.Accept()               -> a new connected Socket the caller must dispose
    //   * TcpListener.AcceptSocket()    -> a new connected Socket the caller must dispose
    //   * TcpListener.AcceptTcpClient() -> a new TcpClient the caller must dispose
    if (!AnyDisposableArgument(i, model)
        && ImplementsIDisposable(sym.ReturnType)
        && ((sym.Name == "Accept" && sym.ContainingType is { Name: "Socket" })
            || (sym.Name is "AcceptSocket" or "AcceptTcpClient"
                && sym.ContainingType is { Name: "TcpListener" }))
        && IsInNamespace(sym.ContainingType, "System", "Net", "Sockets"))
        return true;
    return false;
}

// True if `t` IS, or implements, the named `System.Data` interface (e.g. IDataReader). Covers a
// provider's concrete type (SqlDataReader), the abstract base (DbDataReader), and the interface.
static bool ImplementsSystemDataInterface(ITypeSymbol? t, string iface) =>
    t is not null
    && ((t.Name == iface && IsInNamespace(t as INamedTypeSymbol, "System", "Data"))
        || t.AllInterfaces.Any(i => i.Name == iface && IsInNamespace(i, "System", "Data")));

// True if any argument to the call resolves to a type implementing IDisposable — a disposable
// the callee might NOT take ownership of, so an enclosing owned-factory claim must be declined
// rather than silently drop that argument from leak tracking.
static bool AnyDisposableArgument(InvocationExpressionSyntax inv, SemanticModel model)
{
    foreach (var arg in inv.ArgumentList.Arguments)
    {
        var t = model.GetTypeInfo(arg.Expression).Type;
        if (t is not null && ImplementsIDisposable(t))
            return true;
    }
    return false;
}

// Is the type `t` declared in the namespace named by `parts` (outermost-first), e.g.
// IsInNamespace(t, "System", "IO") for System.IO? Walks the containing-namespace chain
// and requires it to bottom out at the global namespace (so `System.IO` matches but a
// nested `Foo.System.IO` would not).
static bool IsInNamespace(INamedTypeSymbol? t, params string[] parts)
{
    var ns = t?.ContainingNamespace;
    for (var k = parts.Length - 1; k >= 0; k--, ns = ns?.ContainingNamespace)
        if (ns is null || ns.Name != parts[k])
            return false;
    return ns is { IsGlobalNamespace: true };
}

// The local names of arguments handed to a first-party CONSUMER at this call — a method
// that takes ownership of the by-value IDisposable parameter the argument binds to and
// discharges it: either by disposing it directly, or by forwarding it to another first-party
// consumer (the transitive case, `ConsumesParam`). Such an argument's ownership moves into
// the callee and is discharged there, so the handoff is modelled as a RELEASE of the argument
// at the call site (the same shape as pool `Return(buf)`); a later use is then a
// use-after-handoff (OWN002). Inspecting each callee's OWN body means no cross-call signature
// table and no dangling-callee crash — a callee with no body (interface / abstract / extern)
// or that does not consume the param contributes nothing, and the argument stays an ordinary
// escape. Arguments resolve to parameters by NAME when `name:` is used, else by position.
static List<string> ConsumeReleaseArgs(ExpressionSyntax e, SemanticModel model)
{
    var consumed = new List<string>();
    if (e is not InvocationExpressionSyntax inv
        || model.GetSymbolInfo(inv).Symbol is not IMethodSymbol sym)
        return consumed;
    var args = inv.ArgumentList.Arguments;
    for (int i = 0; i < args.Count; i++)
    {
        // map argument -> parameter: by name for `name: value`, else by position.
        var p = args[i].NameColon is { } nc
            ? sym.Parameters.FirstOrDefault(q => q.Name == nc.Name.Identifier.Text)
            : (i < sym.Parameters.Length ? sym.Parameters[i] : null);
        if (p is not null
            && args[i].Expression is IdentifierNameSyntax aid
            && ConsumesParam(sym, p, model,
                             new HashSet<ISymbol>(SymbolEqualityComparer.Default)))
            consumed.Add(aid.Identifier.Text);
    }
    return consumed;
}

// The body of a first-party method or LOCAL FUNCTION (block or expression-bodied), scanning
// partial declarations; null for an interface/abstract/extern method (no body to inspect). A
// directly-called local function runs synchronously, so a forwarding chain through one must be
// followed too (CodeRabbit) — `LocalFunctionStatementSyntax` carries the same Body/ExpressionBody.
static SyntaxNode? ConsumerBody(IMethodSymbol sym)
{
    foreach (var r in sym.DeclaringSyntaxReferences)
        switch (r.GetSyntax())
        {
            case BaseMethodDeclarationSyntax d when ((SyntaxNode?)d.Body ?? d.ExpressionBody) is { } b:
                return b;
            case LocalFunctionStatementSyntax l when ((SyntaxNode?)l.Body ?? l.ExpressionBody) is { } lb:
                return lb;
        }
    return null;
}

// The invocations that run IMMEDIATELY when `body` executes — excluding those inside a nested
// lambda / local-function body, which run deferred (when the delegate is later invoked), not at
// this method's call boundary. The same deferred-body rule the flow lowering already uses, so a
// dispose/forward stored in a callback is not mistaken for an immediate discharge (Codex/CodeRabbit).
static IEnumerable<InvocationExpressionSyntax> ImmediateInvocations(SyntaxNode body) =>
    body.DescendantNodes(n => n is not (AnonymousFunctionExpressionSyntax
                                        or LocalFunctionStatementSyntax))
        .OfType<InvocationExpressionSyntax>();

// Does `method` CONSUME (take ownership of and discharge) its by-value IDisposable
// parameter `param`? Either (a) the body disposes it directly (`param.Dispose()`), or
// (b) — the transitive step — the body hands it to ANOTHER first-party consumer that
// consumes it (`Inner(param)` where `Inner` consumes its matching parameter). So a
// forwarding chain `Consume(sink) => Inner(sink) => sink.Dispose()` is recognised, and a
// caller's `Consume(s)` is still a handoff (a call-site release). Inspecting each callee's
// own body keeps it inter-procedural without a signature table; `visited` (keyed on the
// parameter) guards recursion on cyclic call graphs. Conservative: a param handed to an
// unknown/borrowing callee yields false (no release, no false OWN002).
static bool ConsumesParam(IMethodSymbol method, IParameterSymbol param,
                          SemanticModel model, HashSet<ISymbol> visited)
{
    if (param.RefKind != RefKind.None || !ImplementsIDisposable(param.Type))
        return false;
    if (!visited.Add(param.OriginalDefinition))
        return false;                          // cycle guard (per parameter)
    if (ConsumerBody(method) is not { } body)
        return false;                          // no body -> contributes nothing
    var name = param.Name;
    if (DisposesLocal(body, name))             // (a) disposes the parameter directly
        return true;
    // (b) transitive: the parameter is handed to another first-party consumer at an IMMEDIATE
    // call (not one deferred in a nested lambda/local function). The body may live in another
    // file, so bind its calls with that tree's OWN model (a SemanticModel only resolves nodes in
    // its own tree); the Compilation is shared across all parsed inputs.
    var bodyModel = model.Compilation.GetSemanticModel(body.SyntaxTree);
    foreach (var inv in ImmediateInvocations(body))
    {
        // INF-S2 (#380): only a DEFINITE forward transfers — a hand-off behind a guard is the
        // same partial release as a guarded `Dispose`, one call further away.
        if (!IsDefiniteInBody(inv, body))
            continue;
        if (bodyModel.GetSymbolInfo(inv).Symbol is not IMethodSymbol callee)
            continue;
        var cargs = inv.ArgumentList.Arguments;
        for (int i = 0; i < cargs.Count; i++)
        {
            if (cargs[i].Expression is not IdentifierNameSyntax aid || aid.Identifier.Text != name)
                continue;
            var cp = cargs[i].NameColon is { } nc
                ? callee.Parameters.FirstOrDefault(q => q.Name == nc.Name.Identifier.Text)
                : (i < callee.Parameters.Length ? callee.Parameters[i] : null);
            if (cp is not null && ConsumesParam(callee, cp, model, visited))
                return true;
        }
    }
    return false;
}

// Does `body` dispose the local/parameter named `name` — a `name.Dispose()` / `.Close()` /
// `.DisposeAsync()` call (the consume signal)? Only IMMEDIATE calls count (`ImmediateInvocations`
// excludes nested lambda / local-function bodies): a `name.Dispose()` inside a stored callback
// runs deferred, not at this call site, so it is not a discharge here. Only a DEFINITE release
// counts (INF-S2, #380): see IsDefiniteInBody.
static bool DisposesLocal(SyntaxNode body, string name)
{
    foreach (var i in ImmediateInvocations(body))
        if (i.Expression is MemberAccessExpressionSyntax m
            && m.Name.Identifier.Text is "Dispose" or "Close" or "DisposeAsync"
            && m.Expression is IdentifierNameSyntax id && id.Identifier.Text == name
            && IsDefiniteInBody(i, body))
            return true;
    return false;
}

// INF-S2 (#380): does `site` run on EVERY normal-return path of `body`? The call-site handoff
// models a consumer's release as a `release` of the caller's argument — an unconditional
// `must`. That is only true when the callee's release is definite. A release under a
// condition, inside a loop or a `catch`, or behind an earlier `return` is PARTIAL: the core
// derives `may` for it (INF-S2), and flattening it to a call-site release is the fabricated
// `must` the precision floor forbids — a false OWN002/OWN003/OWN009 at a caller that keeps the
// resource (`Close(s, dispose: false)`), and a false `must` summary on a wrapper that forwards
// its own parameter that way.
//
// Declining here avoids fabricating an unconditional `must`; it does NOT produce INF-S2's
// `may`. For an owned LOCAL the declined argument is an ordinary escape: the local goes
// untracked and the caller stays silent. For a forwarded PARAMETER the remaining `use` lets the
// existing inference derive `no` — right when the guard is false, not when it is true or
// forwarded (GuardedConsumeSample.ForwardDynamic pins that as a known limitation). A partial
// forward is only representable as `may` through a canonical call fact, which is outside #380.
// Purely syntactic and deliberately conservative: the guard's value is never read, and an
// unrecognised shape is treated as not definite (for a local that costs a use-after-handoff
// finding, never a false one).
static bool IsDefiniteInBody(SyntaxNode site, SyntaxNode body)
{
    for (var n = site.Parent; n is not null && n != body; n = n.Parent)
        if (n is IfStatementSyntax or ElseClauseSyntax or SwitchStatementSyntax
                or SwitchExpressionSyntax or ConditionalExpressionSyntax
                or ConditionalAccessExpressionSyntax
                or WhileStatementSyntax or DoStatementSyntax or ForStatementSyntax
                or ForEachStatementSyntax or CatchClauseSyntax
            || n is BinaryExpressionSyntax b
               && (b.IsKind(SyntaxKind.LogicalAndExpression)
                   || b.IsKind(SyntaxKind.LogicalOrExpression)
                   || b.IsKind(SyntaxKind.CoalesceExpression)))
            return false;
    // An earlier exit leaves without reaching `site` — unless `site` sits in a `finally` the
    // exit runs through. Exits inside nested lambdas / local functions leave THEM, not `body`.
    foreach (var exit in body.DescendantNodes(n => n is not (AnonymousFunctionExpressionSyntax
                                                             or LocalFunctionStatementSyntax)))
    {
        if (exit is not (ReturnStatementSyntax or YieldStatementSyntax { RawKind: (int)SyntaxKind.YieldBreakStatement })
            || exit.SpanStart >= site.SpanStart)
            continue;
        var coveredByFinally = site.Ancestors().OfType<FinallyClauseSyntax>().Any(f =>
            f.Parent is TryStatementSyntax t
            && (t.Block.Span.Contains(exit.Span) || t.Catches.Any(c => c.Span.Contains(exit.Span))));
        if (!coveredByFinally)
            return false;
    }
    return true;
}

// Does the call `recv.M(...)` RELEASE its receiver — i.e. is `M` a first-party
// EXTENSION method whose body disposes the value it is invoked on? The dispose is
// then laundered through a custom "drain and dispose" sink (e.g. NLog's
// `timer.WaitForDispose(timeout)`, which calls `timer.Change(...)` then disposes
// it) rather than a literal `recv.Dispose()`, so the disposal scan that only keys
// on `Dispose`/`Close`/`DisposeAsync` misses it and reports a false leak. We reuse
// `ConsumesParam` on the reduced extension method's RECEIVER parameter (the
// `this T` at index 0): that inspects M's real body, follows first-party
// forwarding, is cycle-guarded, and demands an IDisposable param — so we only ever
// credit a release we can SEE happen, never an unknown/borrowing callee. Scope is
// deliberately narrow (extension methods only): an instance method disposing its
// own `this` is not a real dispose-delegation shape, and widening to it would also
// have to reason about virtual dispatch — left out to keep the surface minimal.
static bool CallReleasesReceiver(IMethodSymbol? sym, SemanticModel model)
{
    if (sym?.ReducedFrom is not { } def || def.Parameters.Length == 0)
        return false;
    return ConsumesParam(def, def.Parameters[0], model,
                         new HashSet<ISymbol>(SymbolEqualityComparer.Default));
}

// `Interlocked.Exchange(ref _field, null)` — the atomic "detach and hand back"
// teardown idiom — atomically nulls the field and RETURNS the object it used to
// own, so a local bound to that result aliases the field's just-detached owned
// object: disposing the local releases the field's resource (mined on NLog's
// TimeoutContinuation.StopTimer, `Interlocked.Exchange(ref _timeoutTimer, null)
// ?.WaitForDispose(...)`). Returns that field's name so the alias map can bind it
// like a plain `var x = _field;` alias. Restricted to a `null`/`default` replacement
// — the unambiguous teardown: an Exchange that installs a NEW non-null value re-arms
// the field with a fresh object whose fate the syntactic scan cannot follow, so
// crediting the field there could hide a real leak (precision-first: decline).
static string? RefExchangeNulledField(ExpressionSyntax init, SemanticModel model)
{
    if (init is not InvocationExpressionSyntax inv
        || model.GetSymbolInfo(inv).Symbol is not IMethodSymbol m
        || m.Name != "Exchange"
        || m.ContainingType is not { Name: "Interlocked" } ct
        || ct.ContainingNamespace?.ToString() != "System.Threading")
        return null;
    var args = inv.ArgumentList.Arguments;
    if (args.Count != 2
        || !args[0].RefKindKeyword.IsKind(SyntaxKind.RefKeyword)
        || !(args[1].Expression.IsKind(SyntaxKind.NullLiteralExpression)
             || args[1].Expression.IsKind(SyntaxKind.DefaultLiteralExpression)
             || args[1].Expression is DefaultExpressionSyntax))   // default(T) for a ref type is null too
        return null;
    return ThisFieldName(args[0].Expression) is { } f
           && model.GetSymbolInfo(args[0].Expression).Symbol is IFieldSymbol
        ? f : null;
}

// A field/local type treated as owned-disposable (syntax-only heuristic — no
// semantic model): a curated set plus a few suffixes. Gated on the class `new`ing
// the value, so injected/borrowed disposables are not flagged. Timer types are
// deliberately excluded: a `Tick`/`Elapsed` timer is the WPF002 pattern's job
// (released by Stop()/detach), and DispatcherTimer is not even IDisposable, so
// matching `*Timer` here would double-report and false-positive a stopped timer.
static bool IsDisposableType(string t) =>
    t is "IDisposable" or "IAsyncDisposable" or "CancellationTokenSource"
       or "HttpClient" or "SerialPort" or "SqlConnection"
    || ((t.EndsWith("Stream") || t.EndsWith("Reader") || t.EndsWith("Writer")
            || t.EndsWith("Subscription"))
        && !IsNonDisposableReaderWriter(t));

// BCL `…Reader`/`…Writer` types that the EndsWith name heuristic above matches but that are NOT
// IDisposable: System.IO.Pipelines `PipeReader`/`PipeWriter` finish via `Complete()`, not `Dispose()`.
// Excluding them stops the field-disposable detector flagging an undisposed PipeReader/PipeWriter
// field as a leak — a FALSE POSITIVE mined on Pipelines.Sockets.Unofficial (SocketConnection's
// `_input`/`_output`). Matched on the exact bare or `System.IO.Pipelines`-qualified spelling — NOT
// any simple-name match, so a project's own disposable `MyLib.PipeReader` is still flagged (Codex).
static bool IsNonDisposableReaderWriter(string t) =>
    t is "PipeReader" or "PipeWriter"
      or "System.IO.Pipelines.PipeReader" or "System.IO.Pipelines.PipeWriter";

// Is this field/local type an OWNED disposable? Prefer the RESOLVED type's real
// IDisposable/IAsyncDisposable interface: an in-project `…Writer`/`…Reader`/`…Stream`
// that is NOT actually IDisposable (ImageSharp's `Vp8BitWriter : BitWriterBase`, the
// `JpegBitReader` struct) must not be flagged by name alone. Generalises the #79
// PipeReader/PipeWriter exclusion — any resolved non-IDisposable type is excluded, no
// curated list needed. Only when the type does NOT resolve (an unreferenced external
// assembly — WPF/DevExpress on the Linux runner) do we fall back to the syntactic name
// heuristic, which is the whole reason that heuristic exists.
static bool IsOwnedDisposableType(TypeSyntax type, SemanticModel model)
{
    var sym = model.GetTypeInfo(type).Type;
    if (sym is null or IErrorTypeSymbol)
        return IsDisposableType(type.ToString());
    // Resolved: demand a REAL IDisposable, but keep the optional-dispose exemption
    // (Task/ValueTask/DataTable/DataSet/DataView) that the flat name path got for free —
    // their Dispose is a no-op / they hold only a lazy wait handle, so an undisposed field
    // of these is not a leak and must stay silent (Codex). Both helpers already exist and
    // are shared with the flow detector.
    return ImplementsIDisposable(sym) && !IsDisposeOptional(sym);
}

// --- P-006: DI registration + constructor graph (DI001 captive dependency) ---
// A syntactic pass over the same trees, independent of the event/disposable
// detectors: collect each class's constructor parameter types (the dependency
// graph), then each conventional IServiceCollection registration
// (Add{Singleton,Scoped,Transient}, the generic `<TService[, TImpl]>` form or the
// `typeof(...)` form) and emit `services` facts {name, lifetime, deps, file, line}
// that ownlang/di.py checks for captive dependencies. The registration's `name`
// is the SERVICE type others inject; `deps` are the IMPLEMENTATION's constructor
// parameter types. Factory/reflection/open-generic shapes we cannot read are
// recorded as unknown-dep nodes (deps: []) — silent, never guessed (P-006 scope).
static List<object> ExtractServices(List<(string file, SyntaxTree tree)> parsed)
{
    // 1. class name -> its widest constructor's parameter type names (the DI ctor).
    var ctorDeps = new Dictionary<string, List<string>>();
    // class name -> services injected via `WeakReference<T>` (held weakly). Kept apart
    // from ctorDeps so the strong DI001 graph never sees a weak edge; a weakly-held
    // scoped service is DI002 (the weak ref hides the GC symptom, not the lifetime bug).
    var ctorWeakDeps = new Dictionary<string, List<string>>();
    // class name -> does it implement IDisposable/IAsyncDisposable (so the container
    // owns its disposal)? Syntactic — its OWN base list names it; an inherited
    // disposable (`: Stream`) is not seen, so DI003 fires only on an explicitly
    // disposable impl, never a guessed one (precision over recall).
    var ctorDisposable = new Dictionary<string, bool>();
    // class name -> service types it resolves BY HAND off an injected IServiceProvider
    // (`provider.GetService<T>()` / `GetRequiredService<T>()`). For a SINGLETON that
    // provider is the root container, so a transient IDisposable resolved this way is
    // tracked to app shutdown: DI004 (the service-locator anti-pattern). A resolution
    // through a scope (`scope.ServiceProvider.GetRequiredService<T>()`) has a different
    // receiver and is deliberately NOT recorded — that pattern is correct.
    var classRootResolves = new Dictionary<string, List<string>>();
    // class name -> the resolution CALL SITE of each root-resolved type ({type, file, line}).
    // DI004's consumer is the GetRequiredService call site (not a ctor), so a finding anchors
    // at it; emitted as `root_resolve_sites` alongside `root_resolves`.
    var classRootResolveSites = new Dictionary<string, List<object>>();
    // class name -> service types it resolves from a scope it CREATES (`factory.CreateScope()` /
    // an injected provider's `.CreateScope()`) and then CACHES into a FIELD (DI005 — the
    // scope-per-operation fix done wrong), with the field-STORE call site of each. A scope-resolved
    // value USED in the scope and discarded (the correct shape) is not assigned to a field, so it
    // never enters here.
    var classScopeCached = new Dictionary<string, List<string>>();
    var classScopeCacheSites = new Dictionary<string, List<object>>();
    // class name -> its CONSUMING CONSTRUCTOR location (file, 1-based line): the widest
    // public ctor (or the class/primary-ctor declaration), where a captive dependency is
    // injected. A captive finding anchors at the registration site but names this too, so
    // the developer is pointed at the code, not just the wiring (P-006 open question #1).
    var classCtorLoc = new Dictionary<string, (string file, int line)>();
    foreach (var (ctorFile, tree) in parsed)
        foreach (var node in tree.GetRoot().DescendantNodes())
        {
            if (node is not ClassDeclarationSyntax cls)
                continue;
            // Candidate parameter lists: the C# 12 primary constructor (on the
            // class declaration itself) plus the PUBLIC explicit constructors —
            // take the widest. Primary-constructor injection (`class Foo(Dep d)`)
            // has no ConstructorDeclarationSyntax member, so it must be read off
            // the declaration or DI001 misses modern .NET 8 services; and the
            // default IServiceProvider only uses public constructors, so a wider
            // non-public ctor's parameters must not count as real deps (Codex).
            ParameterListSyntax? widest = cls.ParameterList;
            foreach (var m in cls.Members)
                if (m is ConstructorDeclarationSyntax ctor
                    && IsPublicCtor(ctor.Modifiers)
                    && (widest is null
                        || ctor.ParameterList.Parameters.Count > widest.Parameters.Count))
                    widest = ctor.ParameterList;
            var deps = new List<string>();
            var weakDeps = new List<string>();
            if (widest is not null)
                foreach (var p in widest.Parameters)
                {
                    if (p.Type is null)
                        continue;
                    // a `WeakReference<X>` parameter is a WEAK dep on X (not a strong dep):
                    // it keeps X off the DI001 graph, but a weakly-held scoped X is DI002.
                    if (WeakRefInner(p.Type) is { } weakInner)
                        weakDeps.Add(weakInner);
                    else if (DiTypeName(p.Type) is { } tn)
                        deps.Add(tn);
                }
            ctorDeps[cls.Identifier.Text] = deps;        // last decl wins (core dedups by name)
            ctorWeakDeps[cls.Identifier.Text] = weakDeps;
            // the consuming-constructor anchor: the widest public ctor's declaration (its
            // Parent), or the class declaration for a primary/implicit ctor. Points at the
            // code that injects the captive, surfaced as a finding's related location.
            var ctorNode = widest?.Parent ?? cls;
            classCtorLoc[cls.Identifier.Text] = (ctorFile,
                ctorNode.GetLocation().GetLineSpan().StartLinePosition.Line + 1);
            // OR across partial declarations: any part that names IDisposable makes the
            // type disposable, so a later `partial class C { }` (no base list, e.g. a
            // generated/designer file) cannot clear an earlier `partial class C : IDisposable`.
            ctorDisposable[cls.Identifier.Text] = ctorDisposable.GetValueOrDefault(cls.Identifier.Text)
                || (cls.BaseList is { } bl
                    && bl.Types.Any(bt => DiTypeName(bt.Type) is "IDisposable" or "IAsyncDisposable"));
            // DI004 — the names that refer to an injected IServiceProvider (the ROOT provider
            // for a singleton): the ctor parameters of type IServiceProvider (usable directly
            // in a primary-ctor class), plus any real class field assigned one of them. A
            // `name.GetService<T>()` / `GetRequiredService<T>()` call on such a name is then a
            // hand resolution off the root; a `scope.ServiceProvider.Get...` call has a
            // member-access receiver that is NOT one of these names, so it stays silent.
            var providerNames = new HashSet<string>();
            // the real class fields, so a ctor LOCAL alias can never enter providerNames: a
            // bare-identifier assignment LHS that is not a field would otherwise false-match a
            // same-named receiver in another scope and mint a DI004 false positive (CodeRabbit).
            var classFieldNames = new HashSet<string>(
                cls.Members.OfType<FieldDeclarationSyntax>()
                   .SelectMany(f => f.Declaration.Variables)
                   .Select(v => v.Identifier.Text));
            if (widest is not null)
                foreach (var p in widest.Parameters)
                    if (p.Type is not null && DiTypeName(p.Type) == "IServiceProvider")
                        providerNames.Add(p.Identifier.Text);
            // `_field = sp;` in any ctor — BLOCK- or EXPRESSION-bodied (an expression-bodied
            // ctor has a null Body, so scan the whole ctor's descendants, not just Body; Codex),
            // restricted to a real field so a local alias never matches.
            foreach (var mem in cls.Members)
                if (mem is ConstructorDeclarationSyntax ctorDecl)
                    foreach (var asg in ctorDecl.DescendantNodes().OfType<AssignmentExpressionSyntax>())
                        if (asg.Right is IdentifierNameSyntax rhs
                            && providerNames.Contains(rhs.Identifier.Text)
                            && AssignedFieldName(asg.Left) is { } fld
                            && classFieldNames.Contains(fld))
                            providerNames.Add(fld);
            // field initializers that capture an injected provider param (the primary-ctor
            // shape, e.g. `private readonly IServiceProvider _sp = sp;`).
            foreach (var fdecl in cls.Members.OfType<FieldDeclarationSyntax>())
                foreach (var v in fdecl.Declaration.Variables)
                    if (v.Initializer?.Value is IdentifierNameSyntax fInit
                        && providerNames.Contains(fInit.Identifier.Text))
                        providerNames.Add(v.Identifier.Text);
            var rootResolves = new List<string>();
            var rootResolveSites = new List<object>();
            if (providerNames.Count > 0)
            {
                var seenResolve = new HashSet<string>();
                foreach (var (resolved, line) in RootResolvedTypes(cls, providerNames))
                    if (seenResolve.Add(resolved))   // first call site per type wins
                    {
                        rootResolves.Add(resolved);
                        rootResolveSites.Add(new { type = resolved, file = ctorFile, line });
                    }
            }
            classRootResolves[cls.Identifier.Text] = rootResolves;
            classRootResolveSites[cls.Identifier.Text] = rootResolveSites;

            // DI005 — names whose `.CreateScope()` creates a child scope: an injected
            // `IServiceScopeFactory`, plus the injected provider itself (an injected provider's
            // `.CreateScope()` is equally a scope). A scoped service resolved off such a scope and
            // CACHED into a field (rather than used within the scope) is the scope-per-operation fix
            // done wrong. Collected with the SAME this-field discipline as providerNames so a local
            // alias never enters (no false store-match).
            var scopeCreatorNames = new HashSet<string>(providerNames);
            if (widest is not null)
                foreach (var p in widest.Parameters)
                    if (p.Type is not null && DiTypeName(p.Type) == "IServiceScopeFactory")
                        scopeCreatorNames.Add(p.Identifier.Text);
            foreach (var mem in cls.Members)
                if (mem is ConstructorDeclarationSyntax scfCtor)
                    foreach (var asg in scfCtor.DescendantNodes().OfType<AssignmentExpressionSyntax>())
                        if (asg.Right is IdentifierNameSyntax scfRhs
                            && scopeCreatorNames.Contains(scfRhs.Identifier.Text)
                            && AssignedFieldName(asg.Left) is { } scfFld
                            && classFieldNames.Contains(scfFld))
                            scopeCreatorNames.Add(scfFld);
            foreach (var fdecl in cls.Members.OfType<FieldDeclarationSyntax>())
                foreach (var v in fdecl.Declaration.Variables)
                    if (v.Initializer?.Value is IdentifierNameSyntax scfInit
                        && scopeCreatorNames.Contains(scfInit.Identifier.Text))
                        scopeCreatorNames.Add(v.Identifier.Text);
            var scopeCached = new List<string>();
            var scopeCacheSites = new List<object>();
            if (scopeCreatorNames.Count > 0)
            {
                var seenCached = new HashSet<string>();
                foreach (var (cachedType, cacheFile, line) in ScopeCachedTypes(cls, scopeCreatorNames, classFieldNames))
                    if (seenCached.Add(cachedType))   // first store per type wins
                    {
                        scopeCached.Add(cachedType);
                        scopeCacheSites.Add(new { type = cachedType, file = cacheFile, line });
                    }
            }
            classScopeCached[cls.Identifier.Text] = scopeCached;
            classScopeCacheSites[cls.Identifier.Text] = scopeCacheSites;
        }

    // 2. registrations -> service facts at the registration site.
    var services = new List<object>();
    foreach (var (file, tree) in parsed)
        foreach (var node in tree.GetRoot().DescendantNodes())
        {
            if (node is not InvocationExpressionSyntax inv
                || inv.Expression is not MemberAccessExpressionSyntax ma)
                continue;
            var lifetime = RegistrationLifetime(ma.Name.Identifier.Text);
            if (lifetime is null)
                continue;
            ResolveRegistration(ma.Name, inv.ArgumentList, out var service, out var impl);
            if (service is null)        // not a conventional typed registration -> skip
                continue;
            var deps = impl is not null && ctorDeps.TryGetValue(impl, out var d)
                ? d : new List<string>();
            var weakDeps = impl is not null && ctorWeakDeps.TryGetValue(impl, out var wd)
                ? wd : new List<string>();
            var rootResolves = impl is not null && classRootResolves.TryGetValue(impl, out var rr)
                ? rr : new List<string>();
            var rootResolveSites = impl is not null
                && classRootResolveSites.TryGetValue(impl, out var rrs) ? rrs : new List<object>();
            var scopeCached = impl is not null && classScopeCached.TryGetValue(impl, out var sca)
                ? sca : new List<string>();
            var scopeCacheSites = impl is not null
                && classScopeCacheSites.TryGetValue(impl, out var scas) ? scas : new List<object>();
            var (ctorFile, ctorLine) = impl is not null && classCtorLoc.TryGetValue(impl, out var cl)
                ? cl : ("?", 0);
            services.Add(new
            {
                name = service,
                lifetime,
                deps,
                weak_deps = weakDeps,
                // the IMPLEMENTATION's disposability — the container constructs and
                // disposes the impl, so a transient-disposable impl captured by a
                // singleton is held to app exit (DI003).
                disposable = impl is not null && ctorDisposable.TryGetValue(impl, out var disp) && disp,
                // the IMPLEMENTATION's scope-cached scoped services (DI005): a scoped service
                // resolved off a scope it creates and cached into a field — the captive the scope
                // was meant to avoid, plus the field-store site each finding anchors at.
                scope_cached = scopeCached,
                scope_cache_sites = scopeCacheSites,
                // the IMPLEMENTATION's by-hand resolutions off its injected provider — for a
                // singleton, the root; a transient IDisposable resolved this way is DI004.
                root_resolves = rootResolves,
                // the resolution CALL SITE of each — DI004 anchors at it (its real consumer).
                root_resolve_sites = rootResolveSites,
                file,
                line = node.GetLocation().GetLineSpan().StartLinePosition.Line + 1,
                // the IMPLEMENTATION's consuming-constructor location (P-006 Q#1): where the
                // captive is injected, a finding's second anchor beside the registration site.
                ctor_file = ctorFile,
                ctor_line = ctorLine,
                // the IMPLEMENTATION type that owns that ctor — named in the finding instead of
                // the (possibly interface) service `name`, which has no constructor (Codex).
                ctor_type = impl ?? service,
            });
        }
    return services;
}

// The DI lifetime for an IServiceCollection registration method, or null when the
// method name is not one of the three conventional registrations.
static string? RegistrationLifetime(string method) => method switch
{
    "AddSingleton" => "singleton",
    "AddScoped" => "scoped",
    "AddTransient" => "transient",
    _ => null,
};

// Service + implementation type for a registration, from the generic type
// arguments (`Add*<TService[, TImpl]>`) or the `typeof(...)` arguments
// (`Add*(typeof(TService)[, typeof(TImpl)])`). A null service means it is not a
// typed registration we can read (a bare instance / factory) -> the caller skips.
static void ResolveRegistration(SimpleNameSyntax name, ArgumentListSyntax args,
                                out string? service, out string? impl)
{
    service = null;
    impl = null;
    if (name is GenericNameSyntax gen)
    {
        var targs = gen.TypeArgumentList.Arguments;
        if (targs.Count >= 1)
            service = DiTypeName(targs[0]);
        impl = targs.Count >= 2 ? DiTypeName(targs[1]) : service;
        return;
    }
    string? first = null, second = null;
    var seen = 0;
    foreach (var a in args.Arguments)
        if (a.Expression is TypeOfExpressionSyntax tof)
        {
            if (seen == 0) first = DiTypeName(tof.Type);
            else if (seen == 1) second = DiTypeName(tof.Type);
            seen++;
        }
    if (first is not null)
    {
        service = first;
        impl = second ?? first;
    }
}

// The simple (rightmost) name of a type, for matching a registration's service
// type to a constructor parameter's type. A generic name drops its arguments
// (`ILogger<T>` -> `ILogger`); a predefined type (`int`) yields null.
static string? DiTypeName(TypeSyntax t) => t switch
{
    IdentifierNameSyntax id => id.Identifier.Text,
    GenericNameSyntax g => g.Identifier.Text,
    QualifiedNameSyntax q => DiTypeName(q.Right),
    AliasQualifiedNameSyntax aq => DiTypeName(aq.Name),
    // a nullable annotation (`AppDbContext?`) does not change the injected service type —
    // unwrap it so a nullable ctor param is still a real dep (CodeRabbit review on #63).
    NullableTypeSyntax n => DiTypeName(n.ElementType),
    _ => null,
};

// If `t` is a `WeakReference<X>` (or `System.WeakReference<X>`, or a nullable
// `WeakReference<X>?`), the simple name of its single type argument X; else null.
// Syntactic, single-arg — matches how a singleton holds a captive dependency weakly.
// (`System.WeakReference` non-generic has no element type and is not a DI dep.)
static string? WeakRefInner(TypeSyntax t)
{
    if (t is NullableTypeSyntax nt)   // `WeakReference<X>?` -> unwrap the nullable annotation
        t = nt.ElementType;
    var g = t switch
    {
        GenericNameSyntax gen => gen,
        QualifiedNameSyntax { Right: GenericNameSyntax gen } => gen,
        AliasQualifiedNameSyntax { Name: GenericNameSyntax gen } => gen,
        _ => null,
    };
    // the inner `X` (or a nullable `X?`) is resolved by DiTypeName, which unwraps `?`.
    return g is { Identifier.Text: "WeakReference" }
           && g.TypeArgumentList.Arguments.Count == 1
        ? DiTypeName(g.TypeArgumentList.Arguments[0]) : null;
}

// The field a ctor assignment targets — `_field = ...` or `this._field = ...` — so a
// `_provider = provider;` copy of an injected IServiceProvider is tracked as a provider
// reference. A more complex LHS (indexer, nested member) is not a simple field -> null.
static string? AssignedFieldName(ExpressionSyntax lhs) => lhs switch
{
    IdentifierNameSyntax id => id.Identifier.Text,
    MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax, Name: IdentifierNameSyntax n }
        => n.Identifier.Text,
    _ => null,
};

// The service types a class resolves BY HAND off an injected IServiceProvider, with the
// 1-based line of each `recv.GetService<T>()` / `recv.GetRequiredService<T>()` call whose
// receiver is one of the injected-provider names (DI004). The line is the resolution call
// site — DI004's actual consumer. Single type argument only (the generic resolve form); a
// `scope.ServiceProvider.Get...` receiver is excluded by ReceiverIsProvider, so the correct
// scope-resolution pattern is never recorded.
static IEnumerable<(string type, int line)> RootResolvedTypes(
    ClassDeclarationSyntax cls, HashSet<string> providerNames)
{
    foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
    {
        if (inv.Expression is not MemberAccessExpressionSyntax ma
            || ma.Name is not GenericNameSyntax gen
            || gen.TypeArgumentList.Arguments.Count != 1
            || gen.Identifier.Text is not ("GetService" or "GetRequiredService")
            || !ReceiverIsProvider(ma.Expression, providerNames))
            continue;
        if (DiTypeName(gen.TypeArgumentList.Arguments[0]) is { } t)
            yield return (t, inv.GetLocation().GetLineSpan().StartLinePosition.Line + 1);
    }
}

// Is the call receiver one of the injected-provider names — `provider` / `_provider`
// (identifier) or `this._provider` (this-qualified field)? A `scope.ServiceProvider`
// receiver is a member access NOT qualified by `this`, so it returns false: only the
// injected ROOT provider, never a scope's provider, is treated as a root resolution.
// Reused by DI005 to test a `<creator>.CreateScope()` receiver against the scope-creator names.
static bool ReceiverIsProvider(ExpressionSyntax recv, HashSet<string> providerNames) => recv switch
{
    IdentifierNameSyntax id => providerNames.Contains(id.Identifier.Text),
    MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax, Name: IdentifierNameSyntax n }
        => providerNames.Contains(n.Identifier.Text),
    _ => false,
};

// Is `inv` a `<creator>.CreateScope()` call whose receiver is one of the scope-creator names (an
// injected IServiceScopeFactory or provider)? The `IServiceScopeFactory.CreateScope()` /
// `IServiceProvider.CreateScope()` that opens a child scope (DI005).
static bool IsCreateScopeOff(InvocationExpressionSyntax inv, HashSet<string> creators) =>
    inv.Expression is MemberAccessExpressionSyntax { Name.Identifier.Text: "CreateScope" } m
    && ReceiverIsProvider(m.Expression, creators);

// The type `T` of a `<scope>.ServiceProvider.GetService<T>()` / `GetRequiredService<T>()`
// expression, where `<scope>` is a scope-local declared from `CreateScope()` OR an inline
// `<creator>.CreateScope()` chain — else null (DI005). Single type argument only (the generic
// resolve form). The `.ServiceProvider` receiver is what distinguishes a scope resolution from a
// root one (DI004, off the injected provider directly).
static string? ScopeResolvedType(
    ExpressionSyntax expr, HashSet<string> scopeLocals, HashSet<string> creators)
{
    if (expr is not InvocationExpressionSyntax inv
        || inv.Expression is not MemberAccessExpressionSyntax ma
        || ma.Name is not GenericNameSyntax gen
        || gen.TypeArgumentList.Arguments.Count != 1
        || gen.Identifier.Text is not ("GetService" or "GetRequiredService")
        || ma.Expression is not MemberAccessExpressionSyntax { Name.Identifier.Text: "ServiceProvider" } sp)
        return null;
    var fromScope = sp.Expression switch
    {
        IdentifierNameSyntax id => scopeLocals.Contains(id.Identifier.Text),
        InvocationExpressionSyntax cs => IsCreateScopeOff(cs, creators),   // inline CreateScope().ServiceProvider
        _ => false,
    };
    return fromScope ? DiTypeName(gen.TypeArgumentList.Arguments[0]) : null;
}

// The service types a class resolves off a scope it CREATES and CACHES into a FIELD, with the
// 1-based line of the field store (DI005). Recognises a field assignment
// `_f = scope.ServiceProvider.Get(Required)Service<T>()` where `scope` is a local declared from
// `<creator>.CreateScope()`, and the inline `_f = <creator>.CreateScope().ServiceProvider.
// Get(Required)Service<T>()`. The LHS must be a real field (AssignedFieldName + classFieldNames) —
// a scope-resolved value used within the scope and discarded (the CORRECT pattern) is a local, not
// a field store, so it is never recorded.
static IEnumerable<(string type, string file, int line)> ScopeCachedTypes(
    ClassDeclarationSyntax cls, HashSet<string> creators, HashSet<string> classFieldNames)
{
    var scopeLocals = new HashSet<string>(StringComparer.Ordinal);
    foreach (var v in cls.DescendantNodes().OfType<VariableDeclaratorSyntax>())
        if (v.Initializer?.Value is InvocationExpressionSyntax cs && IsCreateScopeOff(cs, creators))
            scopeLocals.Add(v.Identifier.Text);
    foreach (var asg in cls.DescendantNodes().OfType<AssignmentExpressionSyntax>())
        if (AssignedFieldName(asg.Left) is { } fld && classFieldNames.Contains(fld)
            && ScopeResolvedType(asg.Right, scopeLocals, creators) is { } t)
        {
            // the store site's file comes from the assignment's OWN location, not the per-class
            // `ctorFile` — correct even if the cache write lives in another partial-class file
            // (CodeRabbit). DI005 anchors at this store, so the file must be the store's file.
            var span = asg.GetLocation().GetLineSpan();
            yield return (t, span.Path, span.StartLinePosition.Line + 1);
        }
}

// DI's default IServiceProvider resolves through PUBLIC constructors only — an
// explicit ctor with no access modifier defaults to private and DI never uses it.
static bool IsPublicCtor(SyntaxTokenList modifiers)
{
    foreach (var m in modifiers)
        if (m.IsKind(SyntaxKind.PublicKeyword))
            return true;
    return false;
}

// [OwnIgnore("reason")] per-site suppression (P-004 / issue #209). The reason string is
// MANDATORY by design — a suppression is a documented decision, not a silent one — so this
// returns the reason ONLY when the attribute carries a constant, non-empty string first
// argument; it returns null when the attribute is absent, reason-less (`[OwnIgnore]`), or
// carries an empty/non-constant reason. A null therefore never suppresses (the finding fires),
// which is exactly P-004's "never a silent accept" posture. Matched by SIMPLE name
// (`OwnIgnore` / `OwnIgnoreAttribute`), namespace-agnostic, like the BCL `[SuppressMessage]`
// convention — so a user may declare their own attribute type; the core (not this frontend) is
// the sole authority on the resulting verdict (P-013 "one checker"). Uses the SemanticModel's
// constant folding so a `const`/`nameof` reason resolves, not only a bare string literal.
static string? OwnIgnoreReason(SyntaxList<AttributeListSyntax> attrLists, SemanticModel model)
{
    foreach (var al in attrLists)
        foreach (var a in al.Attributes)
        {
            var simple = a.Name switch
            {
                QualifiedNameSyntax q => q.Right.Identifier.Text,
                SimpleNameSyntax s => s.Identifier.Text,
                _ => a.Name.ToString(),
            };
            if (simple is not ("OwnIgnore" or "OwnIgnoreAttribute"))
                continue;
            var arg = a.ArgumentList?.Arguments.FirstOrDefault();
            if (arg is null)
                return null;   // reason-less [OwnIgnore] -> does not suppress
            if (model.GetConstantValue(arg.Expression).Value is string r && r.Length > 0)
                return r;
            return null;       // empty / non-constant reason -> does not suppress
        }
    return null;
}

var components = new List<object>();
// P-016 B0b/B2: per-method flow bodies (only when --flow-locals).
var flowFunctions = new List<object>();
// The names the IDisposable flow pass emitted a record for. The protocol lowering
// (ProtocolLowering.cs) reads it so that a method with BOTH readings keeps both under
// distinct names: the two are not merged, and two records under one name would read
// as an overload.
var flowRecordNames = new HashSet<string>(StringComparer.Ordinal);

// Parse every input into a syntax tree first (keeping the file path we report
// it under), then build ONE compilation over all of them so the SemanticModel
// resolves cross-file and cross-project symbols (P-014 Tier A).
var parsed = new List<(string file, SyntaxTree tree)>();
// P-004 WPF MVVM: source-file paths (`Foo.xaml.cs`) whose sibling `Foo.xaml` constructs
// its own DataContext (`<Foo.DataContext><VM/></...>`) — the view OWNS that VM. The
// extractor only parses `.cs`, so XAML-declared ownership is invisible from the C#
// alone; we read the sibling `.xaml` here and the subscription detector then treats a
// field assigned from `this.DataContext` as self-owned. Keyed by the tree's FilePath.
var viewsOwningDataContext = new HashSet<string>(StringComparer.Ordinal);
foreach (var path in inputs)
{
    // Defensive: an explicit input that is not a readable file (a directory
    // passed by mistake, a deleted path) is skipped with a note, never an
    // unhandled exception that aborts the whole scan.
    if (!File.Exists(path))
    {
        Console.Error.WriteLine($"ownsharp-extract: skipping (not a file): {path}");
        continue;
    }
    string text;
    try
    {
        text = File.ReadAllText(path);
    }
    catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
    {
        // A locked/unreadable file is skipped with a note, not an abort.
        Console.Error.WriteLine($"ownsharp-extract: skipping unreadable file: {path} ({ex.Message})");
        continue;
    }
    parsed.Add((Rel(path), CSharpSyntaxTree.ParseText(text, path: path)));
    if (path.EndsWith(".xaml.cs", StringComparison.OrdinalIgnoreCase))
    {
        var xamlPath = path[..^3];   // strip ".cs" -> "....xaml"
        try
        {
            if (File.Exists(xamlPath) && XamlDeclaresOwnedDataContext(File.ReadAllText(xamlPath)))
                viewsOwningDataContext.Add(path);
        }
        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
        {
            // An unreadable sibling `.xaml` just means "ownership unknown" — no exemption.
        }
    }
}

// Project-local compilation (P-014 Tier A): the framework reference set is this
// runtime's trusted platform assemblies — zero-config, on disk wherever `dotnet`
// runs; no third-party / MSBuild references. Enough to resolve primitives,
// in-project types and BCL events; external types (WPF/DevExpress) stay
// unresolved and are surfaced as OWN050 "unchecked", never guessed as leaks.
// Error-tolerant: compile diagnostics are irrelevant — we only read symbols.
var tpa = ((AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES") as string) ?? "")
    .Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries)
    .Where(p => p.EndsWith(".dll", StringComparison.OrdinalIgnoreCase))
    .ToList();
var refNames = new HashSet<string>(tpa.Select(Path.GetFileName), StringComparer.OrdinalIgnoreCase);
var references = tpa.Select(p => (MetadataReference)MetadataReference.CreateFromFile(p)).ToList();
// P-004 WPF profile: widen the reference set with assemblies named by the
// OWN_EXTRA_REF_DIRS env var (colon-separated dirs) — e.g. the WindowsDesktop ref
// pack — so framework events/timers (Button.Click, DispatcherTimer.Tick) resolve to
// real symbols instead of surfacing as OWN050 on a WPF app. Additive and best-
// effort: unset => unchanged behaviour; a DLL whose simple name a TPA reference
// already provides is skipped so System.* is not double-referenced from two packs.
foreach (var dir in (Environment.GetEnvironmentVariable("OWN_EXTRA_REF_DIRS") ?? "")
             .Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries))
{
    if (!Directory.Exists(dir)) continue;
    var added = 0;
    foreach (var dll in Directory.EnumerateFiles(dir, "*.dll"))
        if (refNames.Add(Path.GetFileName(dll)))
        { references.Add(MetadataReference.CreateFromFile(dll)); added++; }
    Console.Error.WriteLine($"extractor: +{added} extra references from {dir}");
}
// P-014 Tier B: --ref-dir <dir> widens the reference set RECURSIVELY (a project's built `bin/`,
// a restored package's `lib/`), so events on third-party types resolve to real symbols. First
// simple-name wins (a TPA/framework or OWN_EXTRA_REF_DIRS reference already loaded is skipped),
// so a `bin/` carrying multiple target-framework copies of the same assembly references one. A
// reference that fails to load (a native DLL, a corrupt file) is skipped, not fatal — we only read
// metadata, and a missing reference degrades to OWN050, never a crash.
foreach (var dir in refDirs)
{
    if (!Directory.Exists(dir)) { Console.Error.WriteLine($"extractor: --ref-dir not found: {dir}"); continue; }
    var added = 0;
    // Ordinal sort makes "first simple-name wins" deterministic across platforms/filesystems
    // (EnumerateFiles order is unspecified), so a `bin/` with multiple TFM copies picks the same one.
    foreach (var dll in Directory.EnumerateFiles(dir, "*.dll", SearchOption.AllDirectories)
                                 .OrderBy(p => p, StringComparer.Ordinal))
    {
        var name = Path.GetFileName(dll);
        if (!refNames.Contains(name))
            // Record the name only on a successful load, so a failed DLL here doesn't burn the
            // name and silently skip a loadable same-named assembly elsewhere in the tree.
            try { references.Add(MetadataReference.CreateFromFile(dll)); refNames.Add(name); added++; }
            catch (Exception ex) { Console.Error.WriteLine($"extractor: skipped {name}: {ex.GetType().Name}"); }
    }
    Console.Error.WriteLine($"extractor: +{added} references from --ref-dir {dir} (recursive)");
}
var compilation = CSharpCompilation.Create(
    "own", parsed.Select(p => p.tree), references,
    new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary));

// #146 — memo for the interprocedural "constructed-and-returned" publisher
// provenance (computed lazily, only for param-publisher subscriptions; the
// compilation-wide caller walk is name-prefiltered, so a repo with no such
// subscriptions pays nothing).
var returnedFreshCache = new Dictionary<IParameterSymbol, bool>(SymbolEqualityComparer.Default);

// --flow-locals coverage counters (--stats). A method "with a local" here is one
// that has a non-escaping `new` IDisposable worth tracking; of those we either
// flow-analyse it or honestly skip it (an unmodelled for/do/try/switch/async made
// LowerFlowBody bail). methods_with_local == analysed + skipped.
int statMethodsWithLocal = 0, statMethodsAnalysed = 0, statMethodsSkipped = 0;

foreach (var (file, tree) in parsed)
{
    var model = compilation.GetSemanticModel(tree);
    var root = tree.GetRoot();

    foreach (var cls in root.DescendantNodes().OfType<ClassDeclarationSyntax>())
    {
        var assigns = cls.DescendantNodes().OfType<AssignmentExpressionSyntax>().ToList();

        // every `target -= handler` in this class that is PROVEN to run at teardown,
        // keyed by "left|right". #278 soundness: a `-=` in an arbitrary method (or
        // behind a caller-controlled parameter guard) is not a release — it kept
        // pairing SectorTS GTD's ctor `+=` with a flag-skipped `-=` and silently
        // swallowed a heap-proven leak. Only a teardown-context, unguarded `-=`
        // credits release now; everything else keeps the honest OWN001/OWN014.
        // (Self-detaching handlers and old->new rotation have their own
        // dedicated checks below; a timer `.Stop()` shares THIS teardown/guard
        // model — see the `stopped` collection just below.)
        var clsSymbol = model.GetDeclaredSymbol(cls);
        var teardownMethods = TeardownContextMethods(cls, model, clsSymbol);
        var unsub = new HashSet<string>();
        foreach (var a in assigns)
            if (a.IsKind(SyntaxKind.SubtractAssignmentExpression)
                && IsHandler(NormalizeHandler(a.Right))
                && InTeardownContext(a, cls, teardownMethods, model)
                && !IsParamGuardedRelease(a, model))
                unsub.Add($"{a.Left}|{NormalizeHandler(a.Right)}");

        // every receiver whose `.Stop()` is PROVEN to run at teardown: a timer
        // detached this way counts as released even without an explicit
        // `Tick -=` (e.g. Stop() in Dispose). WPF002 soundness: the same
        // doctrine as the `-=` above — a Stop() in an arbitrary method, a
        // finalizer, an unwired lifecycle-looking handler, an uncalled
        // helper/lambda, or behind a caller-parameter guard is EXISTENCE, not
        // execution, and credits nothing (the honest OWN001 stands).
        var stopped = new HashSet<string>();
        foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
            if (inv.Expression is MemberAccessExpressionSyntax m
                && m.Name.Identifier.Text == "Stop"
                && InTeardownContext(inv, cls, teardownMethods, model)
                && !IsParamGuardedRelease(inv, model))
                stopped.Add(m.Expression.ToString());

        // Fields/locals this class constructs (`new`) — it OWNS them, so their
        // lifetime cannot exceed the class's. Used by the self-owned-subscription
        // exemption (P-004) just below and by the disposable detector (WPF003).
        var constructed = new HashSet<string>();
        // field name -> every `new ...` it is constructed from (initializer + assignments),
        // so the disposal scan can inspect the construction shape (e.g. a no-op-dispose
        // pass-through wrapper over an in-memory backing). A field with NO construction here
        // is not in `constructed` and never reaches that check.
        var constructions = new Dictionary<string, List<BaseObjectCreationExpressionSyntax>>(StringComparer.Ordinal);
        void NoteConstruction(string name, BaseObjectCreationExpressionSyntax oce)
        {
            constructed.Add(name);
            if (!constructions.TryGetValue(name, out var list))
                constructions[name] = list = new List<BaseObjectCreationExpressionSyntax>();
            list.Add(oce);
        }
        foreach (var fd in cls.Members.OfType<FieldDeclarationSyntax>())
            foreach (var v in fd.Declaration.Variables)
                if (v.Initializer?.Value is ObjectCreationExpressionSyntax
                                          or ImplicitObjectCreationExpressionSyntax)
                    NoteConstruction(v.Identifier.Text, (BaseObjectCreationExpressionSyntax)v.Initializer.Value);
        foreach (var a in assigns)
            if (a.IsKind(SyntaxKind.SimpleAssignmentExpression)
                && a.Right is ObjectCreationExpressionSyntax
                           or ImplicitObjectCreationExpressionSyntax
                && FieldName(a.Left) is { } fn)
                NoteConstruction(fn, (BaseObjectCreationExpressionSyntax)a.Right);

        // P-004 (extended) self-owned set for the SUBSCRIPTION exemption ONLY. A
        // field can be owned without a direct `_f = new ...`; fold in two more
        // shapes the WPF mining run surfaced. Kept OUT of `constructed` so the
        // WPF003 disposal detector keeps demanding disposal of `new`'d fields only
        // (you don't dispose a borrowed-by-ref value or a template part). Both paths
        // require an actual FIELD (a `ref`/`out` local or parameter is not owned):
        //   * ref/out construction by one of THIS class's OWN helpers —
        //     `BuildCorner(ref _thumb, ...)`: the class populates the field itself,
        //     so it owns it. A `ref`/`out` to an EXTERNAL method
        //     (`container.TryResolve(out _bus)`, `Interlocked.Exchange(ref _bus, ..)`)
        //     only proves the callee CAN assign it — it may be an injected, longer-
        //     lived publisher — so it is NOT exempted, else a real leak is suppressed.
        //   * template parts — `_part = GetTemplateChild("PART_x") as T`: a control
        //     owns the parts of its own template (collectable part<->control cycle).
        var selfOwned = new HashSet<string>(constructed);
        foreach (var arg in cls.DescendantNodes().OfType<ArgumentSyntax>())
            if ((arg.RefKindKeyword.IsKind(SyntaxKind.RefKeyword)
                 || arg.RefKindKeyword.IsKind(SyntaxKind.OutKeyword))
                && model.GetSymbolInfo(arg.Expression).Symbol is IFieldSymbol rf
                && arg.Parent?.Parent is InvocationExpressionSyntax callInv
                && model.GetSymbolInfo(callInv).Symbol is IMethodSymbol callee
                && clsSymbol is not null
                && SymbolEqualityComparer.Default.Equals(callee.ContainingType, clsSymbol))
                selfOwned.Add(rf.Name);
        foreach (var a in assigns)
            if (a.IsKind(SyntaxKind.SimpleAssignmentExpression)
                && model.GetSymbolInfo(a.Left).Symbol is IFieldSymbol tf
                && IsTemplatePartFetch(a.Right))
                selfOwned.Add(tf.Name);
        // P-004 (issue #222): a template part is EQUALLY self-owned when it is captured
        // as a plain LOCAL variable (`Button upButton = (Button)this.Template.FindName(
        // "PART_UP", this);`) or an `is T x` PATTERN variable (`if (this.GetTemplateChild(
        // ...) is T x)`), not only a field — same fetch, same template-owned lifetime,
        // just not stored in a field. Tracked by SYMBOL (`selfOwnedLocals`), not name — a
        // local's identifier is scoped to its own method, so two unrelated methods can
        // reuse the same variable name for two entirely different locals (Codex P2).
        // Mined: MahApps.Metro `Controls/MetroWindow.cs` (pattern-variable form),
        // AvalonEdit `CodeCompletion/OverloadViewer.cs` (plain local-variable form).
        var selfOwnedLocals = new HashSet<ISymbol>(SymbolEqualityComparer.Default);
        foreach (var declr in cls.DescendantNodes().OfType<VariableDeclaratorSyntax>())
            if (declr.Initializer?.Value is { } declInit
                && IsTemplatePartFetch(declInit)
                && model.GetDeclaredSymbol(declr) is ILocalSymbol declLocal)
                selfOwnedLocals.Add(declLocal);
        foreach (var isPat in cls.DescendantNodes().OfType<IsPatternExpressionSyntax>())
            if (IsTemplatePartFetch(isPat.Expression)
                && isPat.Pattern is DeclarationPatternSyntax
                   { Designation: SingleVariableDesignationSyntax svd }
                && model.GetDeclaredSymbol(svd) is ILocalSymbol patLocal)
                selfOwnedLocals.Add(patLocal);
        //   * WPF MVVM view-model — `_vm = DataContext as VM`: when THIS view's own
        //     XAML constructs its DataContext (recorded in viewsOwningDataContext from
        //     the sibling `.xaml`), the view owns that VM, so the view<->VM cycle is
        //     collectable and subscribing to its events is not a leak. (Mined from
        //     ScreenToGif's VideoSource: 4 FP subscriptions to its own declared VM.)
        if (viewsOwningDataContext.Contains(tree.FilePath))
            foreach (var a in assigns)
                if (a.IsKind(SyntaxKind.SimpleAssignmentExpression)
                    && model.GetSymbolInfo(a.Left).Symbol is IFieldSymbol dcf
                    && ReadsDataContext(a.Right))
                    selfOwned.Add(dcf.Name);

        // Is this class the process-lived WPF application object? Used to drop the
        // static-source region escape (OWN014) — `App` cannot be over-promoted.
        var clsIsApp = IsProcessLivedApplication(cls);

        // #227: is this a `Behavior`-derived subscriber? Then a `+=` whose source is
        // its own `AssociatedObject` (the attached element, co-lifetimed with the
        // behavior) is the collectable self-owned cycle, not a leak.
        var clsIsBehavior = IsBehaviorSubscriber(cls);

        var subs = new List<object>();
        // S0 (--fix-candidates): per-identity occurrence counter, scoped to THIS type,
        // so two otherwise-identical acquires get distinct finding identities.
        var fixOcc = new Dictionary<string, int>(StringComparer.Ordinal);
        foreach (var a in assigns)
        {
            if (!emitEvents || !a.IsKind(SyntaxKind.AddAssignmentExpression))
                continue;
            // P-014 Tier A: a `+=` is an event subscription only when the LHS binds
            // to an event symbol. `sum += value` (a local/field/property) resolves
            // to a non-event and is skipped — arithmetic, not a leak. When the LHS
            // cannot be resolved (its declaring type is an unreferenced external
            // assembly) we do NOT guess a leak: a handler-shaped RHS becomes an
            // OWN050 "unchecked" marker that the core surfaces as an advisory note.
            var leftSymbol = model.GetSymbolInfo(a.Left).Symbol;
            if (leftSymbol is IEventSymbol ev)
            {
                var isTimer = IsTimerEvent(a.Left);
                // P-004 lifetime exemptions — skip, not a leak (timers excluded: a
                // running timer is dispatcher-rooted regardless):
                //  - self-owned source (`this`, or a field/local the class
                //    constructs) — the source<->this cycle is GC-collectable;
                //  - static handler — a static method has a null delegate target,
                //    so no instance is retained and nothing can leak.
                //  - a process-host AppDomain event (ProcessExit/DomainUnload/Unhandled-
                //    Exception/FirstChanceException) whose handler retains NO instance — the
                //    handler is meant to live for the whole process, so the "escape" is the
                //    intent, not a leak (mined: Npgsql PoolManager's `AppDomain.CurrentDomain.
                //    ProcessExit += (_,_) => ClearAll()` shutdown hook). A handler that captures
                //    instance state still pins it to the process, so it stays OWN014 (Codex).
                if (!isTimer && (IsSelfOwnedSource(a.Left, ev, model, selfOwned, selfOwnedLocals, clsSymbol)
                                 || IsStaticHandler(a.Right, model)
                                 || (IsProcessLifetimeAppDomainEvent(ev)
                                     && HandlerRetainsNoInstance(a.Right, model))))
                    continue;
                // P-004 / issue #227: a `Behavior` subscribing to (an element reached
                // from) its own `AssociatedObject`. The behavior cannot outlive being
                // attached, so the source is co-lifetimed with the subscriber — the
                // same self-owned source<->this cycle as a constructed field, just
                // reached through the base-class accessor. Gated on the `Behavior`
                // base (co-lifetime holds ONLY in the attach/detach pairing) and on a
                // same-class assignment-chain provenance to `AssociatedObject`; a
                // subscription to an unrelated injected/constructed source in the same
                // method keeps today's warning (its receiver does not resolve there).
                if (!isTimer && clsIsBehavior
                    && IsAssociatedObjectSource(a.Left, model, cls))
                    continue;
                // P-004 / issue #229: the `+=` receiver is an element of a collection the
                // class itself populated — a `foreach (var x in OwnField)` loop variable
                // whose collection is a this-owned field/property assigned from the class's
                // OWN construction/factory (not a ctor parameter, not an injected value).
                // The collection and its elements share the constructing object's lifetime,
                // so the subscription is the same collectable self-cycle as a constructed
                // field; a `foreach` over an injected/parameter collection keeps today's
                // warning (its population sites are not own-produced).
                if (!isTimer && IsOwnedCollectionElementSource(a.Left, model, clsSymbol))
                    continue;
                // P-004 (issue #223): the curated weak-referenced-static-event allowlist —
                // unconditional (unlike the AppDomain exemption above, this does NOT gate on
                // HandlerRetainsNoInstance: the whole point of a weak-referenced source is
                // that even a normally-retaining handler cannot be pinned by it).
                if (IsWeakReferencedStaticEvent(ev))
                    continue;
                // P-004 tiering: a local-variable source is method-bounded — it
                // cannot outlive `this`, so it is not a heap leak; drop it (the same
                // spirit as the self-owned drop above). "static"/"injected" ride
                // along as a `source` hint so the core can grade the severity.
                var source = isTimer ? "static"
                                     : SubscriptionSourceKind(a.Left, ev, model);
                if (source == "local")
                    continue;
                // Process-lived subscriber (the WPF `App` singleton): a static-source
                // subscription promotes nothing — `App` already lives for the whole
                // process — so the region escape (OWN014) is a false positive. Scoped
                // to NON-timers: a timer is forced to source "static" above, but a
                // never-stopped timer in `App` is still a real leak (CodeRabbit).
                //
                // ANTI-PATTERN — do NOT broaden this to `|| clsIsStatic` (subscriber is
                // a static class). It looks symmetric with `clsIsApp` but is UNSOUND: a
                // static class only rules out an instance `this` being pinned; it does
                // NOTHING about a lambda handler that captures a *local*. A static-source
                // (process-lived) event then pins that captured local for the whole
                // process — a genuine leak this exemption would silently swallow, e.g.
                //   static class Foo {
                //     void Attach(VM vm) =>
                //       SystemEvents.UserPreferenceChanged += (_,_) => vm.Refresh(); // pins vm forever
                //   }
                // This was tried in PR #157 and caught pre-merge by Codex (P2) + CodeRabbit
                // (Major); reverted in 488d505. A capture-gated narrowing was considered but
                // would NOT clear the motivating case (CsvHelper ConsoleHost captures cts/
                // resetEvent), so it stays in corpus/oracle-fp-baseline.txt instead. Full
                // write-up: docs/notes/oracle-known-fps.md → "Rejected approaches".
                if (!isTimer && source == "static" && clsIsApp)
                    continue;
                // P-004 / issue #228: the same `clsIsApp` subscriber, but the source is an
                // APP-SCOPED RESOLVER RESULT (curated: PaletteHelper.GetThemeManager) rather
                // than a literal static member — genuinely process-lived, just reached through
                // a call, so SubscriptionSourceKind honestly says "injected". This loosens
                // ONLY the source check; the subscriber gate stays byte-for-byte `clsIsApp`,
                // and the handler must be a METHOD GROUP of the App class itself — a lambda
                // is rejected because it may capture an enclosing local, the exact hole that
                // sank the `clsIsStatic` broadening above (see that comment + the "Rejected
                // approaches" write-up; this narrowing is documented alongside it).
                if (!isTimer && source == "injected" && clsIsApp
                    && IsOwnMethodGroupHandler(a.Right, model, clsSymbol)
                    && IsCuratedAppScopedSource(a.Left, model))
                    continue;
                // P-004 / issue #199: a NON-RETAINING handler on a static (process-lived)
                // source promotes nothing, so OWN014's premise ("the subscriber is pinned
                // for the source's life") does not hold -> silent. A static METHOD handler
                // is already dropped above (IsStaticHandler: null delegate target); a
                // NON-CAPTURING lambda is its closure analog — it captures neither `this`
                // nor an enclosing local, so no subscriber instance is retained. Gated
                // STRICTLY through HandlerRetainsNoInstance, which is CONSERVATIVE: a lambda
                // that captures `this` OR any enclosing local (the CsvHelper cts/resetEvent
                // shape), or any delegate-typed value it cannot prove, is treated as
                // RETAINING and STILL raises OWN014. This never widens the exemption
                // syntactically (no `clsIsStatic`, no "all lambdas"): only what is provably
                // non-retaining is dropped, exactly like the static-method exemption. Policy:
                // docs/notes/subscription-leaks-and-profiles.md ("static + non-retaining
                // handler (static method / non-capturing lambda) -> silent; static +
                // retaining -> OWN014").
                if (!isTimer && source == "static" && HandlerRetainsNoInstance(a.Right, model))
                    continue;
                var released = unsub.Contains($"{a.Left}|{NormalizeHandler(a.Right)}")
                    || (isTimer && Receiver(a.Left) is { } recv && stopped.Contains(recv))
                    // P-004 (issue #224): the handler unsubscribes ITSELF inside its own body
                    // (a self-detaching one-shot handler) — bounded, so no external `-=` is
                    // needed. Timers already have their own Stop()-based release check above.
                    || (!isTimer && HandlerSelfDetaches(a.Right, ev, model, compilation))
                    // #218: the `+=` on the NEW half of a property-changed old->new rotation whose
                    // `-=` is on the OLD half (same event member, same handler, same method) — a
                    // single paired lifecycle, not an unpaired leak.
                    || IsRotationPairedRelease(a, model);
                // #146 — interprocedural publisher provenance: a `+=` on a PARAMETER
                // publisher stays `injected` (locally honest — param→param syntax is
                // identical for a DI singleton bus, a real leak, and for the
                // Newtonsoft Create→ApplySerializerSettings shape, which is bounded).
                // The compilation-wide check can prove the LATTER: every visible
                // caller passes a freshly-constructed local that escapes only into
                // this call / its own `return`, and the callee never lets the param
                // escape — then the subscription dies with the returned publisher
                // and the bridge drops it (ownlang/ownir.py `source_provenance`).
                // Any uncertainty leaves the fact unstamped and the OWN001 warning
                // stands.
                var returnedFresh = !isTimer && source == "injected"
                    && a.Left is MemberAccessExpressionSyntax provRecv
                    && model.GetSymbolInfo(provRecv.Expression).Symbol is IParameterSymbol provParam
                    && IsReturnedFreshParam(provParam, compilation, returnedFreshCache);
                // A static-source subscription (a process-lived event, or a
                // static-field/property receiver) is a region escape, not a
                // token leak: route it through the lifetime engine as a
                // `capture` -> OWN014 (the WPF "escape to App"). The bridge
                // skips a released capture (a `-=` on close), so a correctly
                // unsubscribed static subscription stays silent. An injected/
                // unknown source stays a token `subscription` (OWN001,
                // severity-tiered); timers are their own kind. (P-004 WPF005;
                // see ownlang/ownir.py `capture`.)
                // S0: attach a `fix` block only for a non-timer `+=` whose IMMEDIATE
                // containing type is THIS class (a nested-class acquire is fixed by that
                // nested class's own iteration, never the outer's). Purely additive; the
                // no-fix shapes below are byte-for-byte the pre-S0 facts.
                var ownAcquire = ReferenceEquals(a.FirstAncestorOrSelf<TypeDeclarationSyntax>(), cls);
                var wantFix = emitFixCandidates && !isTimer && ownAcquire;
                // #317: ONE position for all four shapes below. Every one of them anchors on
                // `a.Left` - the event access, the same node `line` has always come from - so
                // resolving it once here is both the cheapest and the only way the four records
                // are guaranteed to agree.
                var eventPos = PosOf(a.Left);
                if (returnedFresh)
                {
                    if (wantFix)
                        subs.Add(new
                        {
                            @event = a.Left.ToString(),
                            handler = a.Right.ToString(),
                            line = eventPos.Line,
                            column = eventPos.Column,
                            released,
                            resource = "subscription",
                            source,
                            lambda = IsLambdaHandler(a.Right),
                            source_provenance = "returned_fresh",
                            fix = FixBuildSubscriptionFix(a, ev, model, compilation, clsSymbol, cls, fixOcc),
                        });
                    else
                        subs.Add(new
                        {
                            @event = a.Left.ToString(),
                            handler = a.Right.ToString(),
                            line = eventPos.Line,
                            column = eventPos.Column,
                            released,
                            resource = "subscription",
                            source,
                            lambda = IsLambdaHandler(a.Right),
                            source_provenance = "returned_fresh",
                        });
                }
                else if (wantFix)
                    subs.Add(new
                    {
                        @event = a.Left.ToString(),
                        handler = a.Right.ToString(),
                        line = eventPos.Line,
                        column = eventPos.Column,
                        released,
                        resource = source == "static" ? "capture" : "subscription",
                        source,
                        lambda = IsLambdaHandler(a.Right),
                        fix = FixBuildSubscriptionFix(a, ev, model, compilation, clsSymbol, cls, fixOcc),
                    });
                else
                    subs.Add(new
                    {
                        @event = a.Left.ToString(),
                        handler = a.Right.ToString(),
                        line = eventPos.Line,
                        column = eventPos.Column,
                        released,
                        resource = isTimer ? "timer"
                                 : source == "static" ? "capture"
                                 : "subscription",
                        source,
                        lambda = !isTimer && IsLambdaHandler(a.Right),
                    });
            }
            else if (leftSymbol is null && IsHandler(a.Right))
            {
                // #317: a separate branch, so a separate lookup - on the SAME node.
                var unresolvedPos = PosOf(a.Left);
                subs.Add(new
                {
                    @event = a.Left.ToString(),
                    handler = a.Right.ToString(),
                    line = unresolvedPos.Line,
                    column = unresolvedPos.Column,
                    resource = "unresolved-subscription",
                });
            }
        }

        // P-035: a call to a project-DECLARED weak-subscribe wrapper (exact simple
        // containing-type + method name) is a first-class, ALREADY-RELEASED
        // subscription -- the wrapper holds the listener weakly, so it can never pin
        // the subscriber. Only declared pairs match; an empty allowlist makes this
        // loop inert (facts byte-for-byte unchanged). This is the subscriber-side
        // sibling of the #223 weak-referenced-static-event allowlist, but declared in
        // config rather than curated, because a project's own wrapper cannot be
        // "independently confirmed" in this tree. Gated on `emitEvents`, exactly like the
        // `+=` detector above: `--no-event-leaks` turns OFF event-subscription analysis,
        // so it must silence this pass too.
        if (emitEvents && weakSubscribe.Count > 0)
            foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
                if (MatchesDeclaredWeakSubscribe(inv, model, weakSubscribe, out var wsSource, out var wsHandler))
                {
                    // #317: the wrapper CALL is the record's node, not the source expression
                    // it names - the same node `line` already used.
                    var wsPos = PosOf(inv);
                    subs.Add(new
                    {
                        @event = wsSource!.ToString(),
                        handler = wsHandler!.ToString(),
                        line = wsPos.Line,
                        column = wsPos.Column,
                        released = true,          // accepted release: weak, cannot leak (acceptance #2)
                        resource = "subscription",
                        source = "injected",
                        lambda = IsLambdaHandler(wsHandler!),
                    });
                }

        // WPF003: an IDisposable field the class constructs (`new`) but never
        // disposes. Owned (not injected) = in `constructed` (computed above);
        // released = a `<field>.Dispose()` call somewhere in the class.
        var disposed = new HashSet<string>();
        // A local that ALIASES a field of this class — `var cts = _cts;` / `var cts = this._cts;` —
        // and is then disposed THROUGH the alias (`cts.Dispose()`) releases the field's object: the
        // alias and the field name the same instance. Map each such alias LOCAL SYMBOL -> its field
        // so the disposal scan below credits the FIELD. Mined: Npgsql's NpgsqlDataSource disposes its
        // CancellationTokenSource via `var cts = _cts; cts.Dispose();`. Sound by construction:
        //  - the initializer is a `this`/bare field reference (never `other._f`) that BINDS to a real
        //    field symbol (not a same-named local);
        //  - aliases are keyed by the LOCAL SYMBOL, not its name, so a same-named local in another
        //    method (or a second alias reusing the name) is a DISTINCT entry, never conflated (Codex);
        //  - an alias REASSIGNED anywhere — by `=`, or rebound through a `ref`/`out` argument — is
        //    excluded: a rebound local no longer tracks the field, so we decline to credit it (Codex).
        var reassignedAliases = new HashSet<ISymbol>(SymbolEqualityComparer.Default);
        foreach (var asg in assigns)
            if (model.GetSymbolInfo(asg.Left).Symbol is ILocalSymbol rls)
                reassignedAliases.Add(rls);
        foreach (var arg in cls.DescendantNodes().OfType<ArgumentSyntax>())
            if ((arg.RefKindKeyword.IsKind(SyntaxKind.RefKeyword) || arg.RefKindKeyword.IsKind(SyntaxKind.OutKeyword))
                && model.GetSymbolInfo(arg.Expression).Symbol is ILocalSymbol als)
                reassignedAliases.Add(als);
        var aliasToField = new Dictionary<ISymbol, string>(SymbolEqualityComparer.Default);
        foreach (var decl in cls.DescendantNodes().OfType<VariableDeclaratorSyntax>())
        {
            if (decl.Initializer?.Value is not { } init
                || model.GetDeclaredSymbol(decl) is not ILocalSymbol aliasSym
                || reassignedAliases.Contains(aliasSym))
                continue;
            // a plain `var x = _field;` / `var x = this._field;` alias, OR the
            // `Interlocked.Exchange(ref _field, null)` teardown whose result IS the
            // field's just-detached owned object — both make `x` an alias of the field.
            string? af = ThisFieldName(init) is { } direct
                         && model.GetSymbolInfo(init).Symbol is IFieldSymbol
                ? direct
                : RefExchangeNulledField(init, model);
            if (af is not null)
                aliasToField[aliasSym] = af;
        }
        // a `.Dispose()`/`.DisposeAsync()`/`.Close()` on a field — directly (`_f.Dispose()` / `this._f.…`)
        // or through an alias local (translated by SYMBOL via aliasToField) — releases that field.
        // `Close()` counts as a release here exactly as it already does for LOCAL disposables (DisposesLocal
        // and the flow detector both accept Dispose/Close/DisposeAsync); a Stream / DbConnection-style field
        // released by Close is not a leak. Mined: Npgsql ReplicationConnection disposes its NpgsqlConnection
        // field via `await _npgsqlConnection.Close(async: true)`. ThisFieldName (not FieldName) scopes the
        // credit to THIS instance's field / a validated alias: `other._f.Close()` on ANOTHER instance of
        // the same class must NOT mark this object's `_f` released (Codex/CodeRabbit) — and a field-symbol
        // ContainingType check would NOT catch that (same class -> same ContainingType), so key on the
        // `this`/bare receiver syntactically.
        foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
            if (inv.Expression is MemberAccessExpressionSyntax m
                && ThisFieldName(m.Expression) is { } df
                // a literal `.Dispose()/.Close()/.DisposeAsync()`, OR a first-party
                // extension method that disposes its receiver (`timer.WaitForDispose()`):
                // both release the field. The name check is first (cheap) — the symbol
                // resolution behind CallReleasesReceiver only runs for the rarer custom call.
                && (m.Name.Identifier.Text is "Dispose" or "DisposeAsync" or "Close"
                    || CallReleasesReceiver(model.GetSymbolInfo(inv).Symbol as IMethodSymbol, model)))
                disposed.Add(model.GetSymbolInfo(m.Expression).Symbol is ILocalSymbol ls
                             && aliasToField.TryGetValue(ls, out var fa) ? fa : df);
        // Also the NULL-CONDITIONAL form `field?.Dispose()` (a ConditionalAccess whose
        // WhenNotNull is the `.Dispose()` invocation, NOT a plain MemberAccess) — the
        // dominant disposal shape the match above misses. Mined as an FP across ImageSharp:
        // `this.memoryStream?.Dispose()` (ZipExrCompressor/DeflateCompressor/IccDataWriter)
        // and the BufferedStreams benchmark's `[GlobalCleanup]` `field?.Dispose()` calls.
        // (The same alias-by-symbol translation applies — `cts?.Dispose()` on an aliasing local.)
        foreach (var cae in cls.DescendantNodes().OfType<ConditionalAccessExpressionSyntax>())
            if (ThisFieldName(cae.Expression) is { } cdf   // this-instance field / alias only (not `other._f?.Close()`)
                && cae.WhenNotNull is InvocationExpressionSyntax { Expression: MemberBindingExpressionSyntax mb } cinv
                && (mb.Name.Identifier.Text is "Dispose" or "DisposeAsync" or "Close"
                    || CallReleasesReceiver(model.GetSymbolInfo(cinv).Symbol as IMethodSymbol, model)))
                disposed.Add(model.GetSymbolInfo(cae.Expression).Symbol is ILocalSymbol lc
                             && aliasToField.TryGetValue(lc, out var fc) ? fc : cdf);

        // P-004 (issue #220): `using (field = new T()) { ... }` — the STATEMENT form of
        // `using` whose parenthesized expression IS the acquisition, assigned directly to
        // a FIELD rather than a local. `using (expr) { }` disposes whatever `expr`
        // evaluates to at scope exit, regardless of whether `expr` is a bare `new T()`, an
        // already-tracked LOCAL (the `using (existingLocal)` shape the flow-locals engine
        // lowers elsewhere in this file), or, as here, a field assignment — the field is
        // disposed exactly once, deterministically, when the block exits. This-instance
        // only (`ThisFieldName`), matching every other release recognition above. Mined:
        // ShareX `HashChecker.cs`/`TaskEx.cs` (`using (cts = new CancellationTokenSource())`),
        // `IndexerJson.cs` (`using (jsonWriter = new JsonTextWriter(sw))`).
        foreach (var us in cls.DescendantNodes().OfType<UsingStatementSyntax>())
            if (us.Expression is AssignmentExpressionSyntax { } uae
                && uae.IsKind(SyntaxKind.SimpleAssignmentExpression)
                && ThisFieldName(uae.Left) is { } uf)
                disposed.Add(uf);

        // Issue #219 — WinForms disposal CHANNELS. Only when the class reaches the framework disposal
        // root (a designer `Dispose(bool)` -> `base.Dispose(disposing)`): a class with no such Dispose
        // (the HistoryItemManager true-positive shape) is never rooted, so its owned controls stay
        // flagged.
        if (ClassReachesDisposalRoot(cls))
        {
            // (b) IContainer registration. The sink is a field of type IContainer that is disposed in
            // this class (already in `disposed` via `components.Dispose()` / `components?.Dispose()`).
            // A field CONSTRUCTED with that sink (`new T(components)`) or explicitly `sink.Add(this.G)`
            // is disposed by `components.Dispose()`.
            var containerSinks = new HashSet<string>(StringComparer.Ordinal);
            foreach (var fdecl in cls.Members.OfType<FieldDeclarationSyntax>())
                foreach (var v in fdecl.Declaration.Variables)
                    if (disposed.Contains(v.Identifier.Text)
                        && model.GetDeclaredSymbol(v) is IFieldSymbol fsym
                        && ImplementsIContainer(fsym.Type))
                        containerSinks.Add(v.Identifier.Text);
            if (containerSinks.Count > 0)
            {
                bool CtorTakesSink(BaseObjectCreationExpressionSyntax oce) =>
                    oce.ArgumentList is { } al && al.Arguments.Any(
                        a => model.GetSymbolInfo(a.Expression).Symbol is IFieldSymbol af
                             && containerSinks.Contains(af.Name));
                // `G = new T(..., components, ...)` — assignment form.
                foreach (var a in assigns)
                    if (a.IsKind(SyntaxKind.SimpleAssignmentExpression)
                        && model.GetSymbolInfo(a.Left).Symbol is IFieldSymbol gf
                        && a.Right is BaseObjectCreationExpressionSyntax gnew && CtorTakesSink(gnew))
                        disposed.Add(gf.Name);
                // ...and the field-initializer form `T G = new T(..., components, ...)`.
                foreach (var fdecl in cls.Members.OfType<FieldDeclarationSyntax>())
                    foreach (var v in fdecl.Declaration.Variables)
                        if (v.Initializer?.Value is BaseObjectCreationExpressionSyntax inew
                            && CtorTakesSink(inew))
                            disposed.Add(v.Identifier.Text);
                // explicit `components.Add(this.G)` — and the named overload `Add(this.G, "name")`
                // (IContainer.Add(IComponent, string)); the FIRST argument is the registered component
                // in both, so credit it whenever the receiver is a container sink (Codex).
                foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
                    if (inv.Expression is MemberAccessExpressionSyntax { Name.Identifier.Text: "Add" } addMa
                        && inv.ArgumentList.Arguments.Count >= 1
                        && model.GetSymbolInfo(addMa.Expression).Symbol is IFieldSymbol sinkf
                        && containerSinks.Contains(sinkf.Name)
                        && model.GetSymbolInfo(inv.ArgumentList.Arguments[0].Expression).Symbol is IFieldSymbol regf)
                        disposed.Add(regf.Name);
            }

            // (a) Controls/Items membership. `Control.Dispose(bool)` disposes every child in its own
            // `Controls` collection (and a ToolStrip disposes its `Items`). Collect each add edge
            // `(containerKey, childField)`, then fixpoint from the rooted set — the child of a rooted
            // container is itself rooted, so a ToolStrip added to `this.Controls` cascades to its items.
            // An add into a FOREIGN container (param/local) yields no edge and stays flagged.
            var edges = new List<(string container, string child)>();
            foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
                if (inv.Expression is MemberAccessExpressionSyntax { Name.Identifier.Text: "Add" or "AddRange" } addColl
                    && CollectionContainerKey(addColl.Expression, model) is { } ckey)
                    foreach (var child in AddedFieldNames(inv.ArgumentList, model))
                        edges.Add((ckey, child));
            if (edges.Count > 0)
            {
                // rooted = THIS ("") plus every field already released (direct dispose / registered above),
                // any of which is a container whose Controls/Items disposal reaches the root.
                var rooted = new HashSet<string>(disposed, StringComparer.Ordinal) { "" };
                var changed = true;
                while (changed)
                {
                    changed = false;
                    foreach (var (container, child) in edges)
                        if (rooted.Contains(container) && disposed.Add(child))
                        {
                            rooted.Add(child);   // the child is now itself a rooted container
                            changed = true;
                        }
                }
            }
        }

        // P-004 EventSource counter exemption: inside an EventSource, a DiagnosticCounter field
        // constructed with `this` is registered to (and lifetime-owned by) the source — a
        // process-lived diagnostic the source never field-disposes (see IsEventSourceOwnedCounter).
        // Collect those field names so the loop below does not report them as undisposed leaks.
        // A counter is always built in a method body (OnEventCommand) — `this` is unavailable in
        // a field initializer — so only the assignment shape (matching `constructed`) can match.
        var eventSourceCounters = new HashSet<string>();
        if (DerivesFromEventSource(clsSymbol))
            foreach (var a in assigns)
                if (a.IsKind(SyntaxKind.SimpleAssignmentExpression)
                    && a.Right is BaseObjectCreationExpressionSyntax aoce
                    && IsEventSourceOwnedCounter(aoce, model)
                    && ThisFieldName(a.Left) is { } cfn)   // THIS instance's field only — `other._c` must not exempt our field (CodeRabbit)
                    eventSourceCounters.Add(cfn);

        // P-004 SemaphoreSlim field exemption (mined: Npgsql NpgsqlDataSource._setupMappingsSemaphore).
        // SemaphoreSlim.Dispose() only frees a LAZILY-allocated wait handle — allocated solely when
        // `.AvailableWaitHandle` is read — so a SemaphoreSlim field used purely for Wait/WaitAsync/Release
        // leaks nothing and is dispose-optional. GATE: if `.AvailableWaitHandle` IS read on the field,
        // that handle exists and Dispose must release it, so the field STAYS tracked (Codex). Collect the
        // field names whose AvailableWaitHandle is read (this/bare receiver) so the loop below keeps them.
        // Scoped to FIELDS only — the shared IsDisposeOptional (and the flow-locals detector / the
        // deliberate method-bounded `semLeak` control) is intentionally left untouched (CodeRabbit).
        var waitHandleSemaphores = new HashSet<string>(StringComparer.Ordinal);
        foreach (var ma in cls.DescendantNodes().OfType<MemberAccessExpressionSyntax>())
            if (ma.Name.Identifier.Text == "AvailableWaitHandle")
            {
                // credit the FIELD whose AvailableWaitHandle is read, by SYMBOL: a this/bare access bound
                // to a real field symbol (so `other._f` and a shadowing local/param are NOT conflated —
                // CodeRabbit), OR a field-ALIAS local (`var s = _sem; s.AvailableWaitHandle` -> `_sem` —
                // Codex). Anything else (an unrelated local, another instance's field) is ignored.
                var recv = model.GetSymbolInfo(ma.Expression).Symbol;
                if (recv is IFieldSymbol && ThisFieldName(ma.Expression) is { } whf)
                    waitHandleSemaphores.Add(whf);
                else if (recv is ILocalSymbol ls && aliasToField.TryGetValue(ls, out var fa))
                    waitHandleSemaphores.Add(fa);
            }

        foreach (var fd in cls.Members.OfType<FieldDeclarationSyntax>())
        {
            // a `static` IDisposable field is a process-lifetime singleton (a shared
            // HttpClient, a sentinel like Dapper's DisposedReader.Instance) — it is
            // intentionally never disposed, so it is not an owned leak.
            if (fd.Modifiers.Any(m => m.IsKind(SyntaxKind.StaticKeyword)))
                continue;
            var tname = fd.Declaration.Type.ToString();
            // Resolve-aware: when the field type binds to a real symbol, demand an actual
            // IDisposable; only an UNRESOLVED type falls back to the name heuristic. (Stops
            // the #1 ImageSharp FP class: undisposed `Vp8BitWriter`/`JpegBitReader` fields
            // whose types merely end in Writer/Reader but are not IDisposable.)
            if (!IsOwnedDisposableType(fd.Declaration.Type, model))
                continue;
            foreach (var v in fd.Declaration.Variables)
            {
                if (!constructed.Contains(v.Identifier.Text))
                    continue;
                // an EventSource's own DiagnosticCounter (a field DECLARED as a DiagnosticCounter
                // AND registered to `this`) is process-lived and never field-disposed -> not an
                // owned leak (mined: Npgsql NpgsqlEventSource). The DECLARED-type guard keeps the
                // skip bound to genuine counter fields: a field declared as a plain IDisposable
                // that is merely assigned a counter once still leaks its OTHER resource (e.g. an
                // initial `new MemoryStream()`), so it must NOT be suppressed by name alone (Codex).
                if (eventSourceCounters.Contains(v.Identifier.Text)
                    && DerivesFromDiagnosticCounter(model.GetTypeInfo(fd.Declaration.Type).Type))
                    continue;
                // a SemaphoreSlim field whose `.AvailableWaitHandle` is never read leaks nothing —
                // Dispose() only frees that lazy handle — so it is dispose-optional and silent; if the
                // handle IS read (in waitHandleSemaphores) it stays tracked. FIELD-scoped (Npgsql).
                if (!waitHandleSemaphores.Contains(v.Identifier.Text)
                    && model.GetTypeInfo(fd.Declaration.Type).Type is { Name: "SemaphoreSlim" } st
                    && st.ContainingNamespace?.ToString() == "System.Threading")
                    continue;
                // no-op-dispose wrapper: a field whose EVERY construction is a BCL pass-through
                // reader/writer (StreamReader/StreamWriter/BinaryReader/BinaryWriter) over an
                // in-memory backing frees nothing on Dispose, so leaving it undisposed is not a
                // leak. ALL constructions must qualify — a field also assigned `new StreamReader(
                // path)` (a real file handle) on some path still leaks and must stay flagged.
                if (constructions.TryGetValue(v.Identifier.Text, out var fieldCtors)
                    && fieldCtors.Count > 0
                    && fieldCtors.All(c => IsNoOpDisposeWrapper(c, model)))
                    continue;
                // [OwnIgnore("reason")] on the field declaration (P-004 / #209): emit the
                // record WITH the reason marker rather than dropping it, so the core can
                // count the suppression and SARIF carries it in `suppressions` (visibility
                // over silence). Additive/optional: absent when there is no valid reason, so
                // an older core ignores it — exactly the source_provenance convention.
                var ignoreReason = OwnIgnoreReason(fd.AttributeLists, model);
                // #317: one position for both shapes - they are the same record with and
                // without the suppression marker, anchored on the same declarator.
                var fieldPos = PosOf(v);
                if (ignoreReason is not null)
                    subs.Add(new
                    {
                        @event = v.Identifier.Text,
                        line = fieldPos.Line,
                        column = fieldPos.Column,
                        released = disposed.Contains(v.Identifier.Text),
                        resource = "disposable",
                        type = tname,
                        ignore_reason = ignoreReason,
                    });
                else
                    subs.Add(new
                    {
                        @event = v.Identifier.Text,
                        line = fieldPos.Line,
                        column = fieldPos.Column,
                        released = disposed.Contains(v.Identifier.Text),
                        resource = "disposable",
                        type = tname,
                    });
            }
        }

        // P-007 / WPF: a field-mediated cross-method USE-AFTER-DISPOSE. An IDisposable
        // field disposed in this class's Dispose()/DisposeAsync() is then DIRECTLY read
        // (`_f.Member`) in an event-handler method — a callback an external event source
        // can still invoke AFTER the object is disposed (the very reason WPF handler
        // leaks matter). With no `if (_disposed) return;` guard the handler touches a
        // field already disposed: a use-after-dispose. We lower it to a synthetic
        // acquire/release/use flow so the existing OwnIR bridge raises OWN002 at the
        // field — no new diagnostic, no second checker (the synthetic-flow trick the
        // MemoryPool slices use). Precise by construction to stay low-FP: fires only when
        //   (a) the field is disposed in the dispose LIFECYCLE (not an ad-hoc `_f.Dispose()`),
        //   (b) the touching method is a LIVE subscription target — RHS of a `+=` / arg of
        //       a `.Subscribe(...)` — whose subscription is NOT torn down (`-= handler`
        //       means the callback cannot fire post-dispose, so it is safe),
        //   (c) the method has no disposed-guard (the canonical fix silences it), and
        //   (d) the use is a DIRECT field member access (an INDIRECT use via a helper is
        //       deliberately not chased — that is the harder frontier, left honest).
        // Gated on --flow-locals like the rest of the synthetic-flow emission.
        if (flowLocals)
        {
            // Owner fields -> declaration line (the synthetic `acquire`): IDisposable fields AND
            // `IMemoryOwner<T>` MemoryPool rentals, whose pooled buffer is released by Dispose() — so a
            // read after that Dispose (including through a Memory VIEW field of the owner) dangles.
            // #317: a POSITION, not a line. This dictionary is the sole coordinate source for
            // the synthetic acquire minted below, and that acquire is an anchor — so the
            // column has to travel with the line from the declarator that produced both,
            // across the whole distance between the two loops.
            var dispoFieldPos = new Dictionary<string, SourcePos>(StringComparer.Ordinal);
            foreach (var fd in cls.Members.OfType<FieldDeclarationSyntax>())
            {
                if (fd.Modifiers.Any(mm => mm.IsKind(SyntaxKind.StaticKeyword)))
                    continue;
                // IDisposable is matched syntactically (so a project's own unresolved `…Stream` etc.
                // still counts); IMemoryOwner is matched on the resolved SYMBOL so a qualified
                // `System.Buffers.IMemoryOwner<T>` / alias / concrete owner type counts too (CodeRabbit/
                // Codex). The cheap `StartsWith` short-circuits the common unqualified spelling first.
                var ftype = fd.Declaration.Type.ToString();
                if (!IsDisposableType(ftype)
                    && !ftype.StartsWith("IMemoryOwner", StringComparison.Ordinal)
                    && !IsMemoryOwnerType(model.GetTypeInfo(fd.Declaration.Type).Type))
                    continue;
                foreach (var v in fd.Declaration.Variables)
                    dispoFieldPos[v.Identifier.Text] = PosOf(v);
            }
            // field -> line of its `.Dispose()` INSIDE Dispose()/DisposeAsync() (the
            // release event). Restricted to the dispose methods so an ordinary
            // `_f.Dispose()` helper is not misread as object teardown.
            var releasedAt = new Dictionary<string, int>(StringComparer.Ordinal);
            if (dispoFieldPos.Count > 0)
                foreach (var dm in cls.Members.OfType<MethodDeclarationSyntax>())
                {
                    if (dm.Identifier.Text is not ("Dispose" or "DisposeAsync"))
                        continue;
                    foreach (var inv in dm.DescendantNodes().OfType<InvocationExpressionSyntax>())
                        if (inv.Expression is MemberAccessExpressionSyntax dmm
                            && dmm.Name.Identifier.Text is "Dispose" or "DisposeAsync"
                            && ThisFieldName(dmm.Expression) is { } df
                            && dispoFieldPos.ContainsKey(df)
                            && !releasedAt.ContainsKey(df))
                            releasedAt[df] = LineOf(inv);
                }
            if (releasedAt.Count > 0)
            {
                // a Memory/ReadOnlyMemory VIEW field that aliases an owner field — `_view = _owner.Memory`
                // (an IMemoryOwner rental) or `_view = _buf.AsMemory(...)` — mapped to its OWNER, so a read
                // of the VIEW field after the owner's release is a use of the released owner (the pooled-
                // buffer view-in-a-field dangle). `ViewOwner` returns the owner name for a bare-field
                // receiver; only owners actually released (in `releasedAt`) fire, checked at the read.
                var viewFieldOwner = new Dictionary<string, string>(StringComparer.Ordinal);
                foreach (var a in assigns)
                    if (a.IsKind(SyntaxKind.SimpleAssignmentExpression)
                        && ThisFieldName(a.Left) is { } vf
                        && FieldViewOwner(a.Right, model) is { } vo)
                        viewFieldOwner[vf] = vo;

                // handler method names that are LIVE subscription targets. `+=` subscriptions are
                // keyed by SOURCE|handler so a `-=` removes only the MATCHING one — a handler still
                // `+=`'d to another live source stays live (a name-only set would let one `-=` drop
                // it globally, CodeRabbit/Codex). A `.Subscribe(handler)` token is released by
                // disposing the token (the Rx idiom), not a `-=`, so those handlers are always live.
                var liveEventKeys = new HashSet<string>(StringComparer.Ordinal);
                foreach (var a in assigns)
                    // Normalize the handler RHS (unwrap `new H(m)` / target-typed `new(m)` -> `m`)
                    // so a wrapped subscription registers its handler here too — consistent with the
                    // release matching above, else a `+= new EventHandler(OnX)` never marks OnX a live
                    // subscription target and its disposed-field read escapes OWN002 (Codex P2).
                    if (NormalizeHandler(a.Right) is var rhs && IsHandler(rhs) && FieldName(rhs) is { } hn)
                    {
                        var key = $"{a.Left}|{hn}";
                        if (a.IsKind(SyntaxKind.AddAssignmentExpression)) liveEventKeys.Add(key);
                        else if (a.IsKind(SyntaxKind.SubtractAssignmentExpression)) liveEventKeys.Remove(key);
                    }
                var subscribed = new HashSet<string>(
                    liveEventKeys.Select(k => k[(k.LastIndexOf('|') + 1)..]), StringComparer.Ordinal);
                foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
                    if (inv.Expression is MemberAccessExpressionSyntax sm
                        && sm.Name.Identifier.Text == "Subscribe")
                        foreach (var arg in inv.ArgumentList.Arguments)
                            if (FieldName(arg.Expression) is { } hn)
                                subscribed.Add(hn);

                // one-hop indirect reach: a private same-class helper (e.g. `Refresh()`) that itself
                // UNGUARDEDLY reads a disposed field. A handler that calls such a helper with no guard
                // before the call touches the disposed field one level down — the field-mediated UAF
                // the WPF `handler-use-after-dispose` pattern hides behind a helper. One hop only; a
                // deeper chain stays an honest miss.
                // keyed by the helper's METHOD SYMBOL (not its name) so an overload — `Refresh()` vs
                // `Refresh(e)` — is matched EXACTLY: a handler calling the safe overload is not
                // attributed the unsafe overload's read (Codex). Same-class methods are in-source, so
                // their symbols resolve even when the field's TYPE does not.
                var helperReads = new Dictionary<ISymbol, (string Field, int Line)>(SymbolEqualityComparer.Default);
                foreach (var hm in cls.Members.OfType<MethodDeclarationSyntax>())
                    if (hm.Body is { } b
                        && hm.Identifier.Text is not ("Dispose" or "DisposeAsync")
                        && IsPrivateInstanceHelper(hm)
                        && model.GetDeclaredSymbol(hm) is { } hsym
                        && FirstUnguardedDisposedRead(b, releasedAt, viewFieldOwner) is { } r)
                        helperReads[hsym] = (r.Field, LineOf(r.Use));

                foreach (var hm in cls.Members.OfType<MethodDeclarationSyntax>())
                {
                    if (hm.Body is not { } hbody)
                        continue;
                    var hname = hm.Identifier.Text;
                    if (hname is "Dispose" or "DisposeAsync")
                        continue;
                    if (!subscribed.Contains(hname))
                        continue;
                    // the FIRST trigger in the handler, in source order: a DIRECT read of a disposed
                    // field of THIS class (`_f` / `this._f`), or a self-call (`Refresh()` /
                    // `this.Refresh()`) to a private helper that unguardedly reads one. `useLine` points
                    // at the actual read; `triggerPos` is where the handler reaches it (the read or the
                    // call) — the position the disposed-guard must precede to make it safe.
                    string? useField = null;
                    int useLine = 0, triggerPos = 0;
                    foreach (var node in hbody.DescendantNodes())
                    {
                        if (node is MemberAccessExpressionSyntax ma
                            && ma.Name.Identifier.Text is not ("Dispose" or "DisposeAsync")
                            && ThisFieldName(ma.Expression) is { } uf
                            && ReleasedOwner(uf, releasedAt, viewFieldOwner) is { } owner)
                        {
                            useField = owner; useLine = LineOf(ma); triggerPos = ma.SpanStart;
                            break;
                        }
                        if (node is InvocationExpressionSyntax call
                            && SelfCallName(call) is not null              // a SELF call (this/bare), not other.X
                            && model.GetSymbolInfo(call).Symbol is { } csym
                            && helperReads.TryGetValue(csym, out var hr))
                        {
                            useField = hr.Field; useLine = hr.Line; triggerPos = call.SpanStart;
                            break;
                        }
                    }
                    // no disposed-field reach, or an opening disposed-guard PRECEDES it -> not a
                    // use-after-dispose. Otherwise emit ONE synthetic acquire/release/use flow -> OWN002.
                    if (useField is null)
                        continue;
                    if (DisposedGuardBefore(hbody, triggerPos))
                        continue;
                    // #317: only the synthetic ACQUIRE carries a column. `releasedAt` and
                    // `useLine` stay lines: the release and the use are events on the path,
                    // not the record the finding anchors on, and giving them a column would
                    // mean inventing coordinates for nodes this pass never resolved as a pair.
                    var dispoPos = dispoFieldPos[useField];
                    flowFunctions.Add(new
                    {
                        name = $"{cls.Identifier.Text}.{hname}",
                        file,
                        body = new List<object>
                        {
                            new { op = "acquire", var = useField,
                                  line = dispoPos.Line, column = dispoPos.Column },
                            new { op = "release", var = useField, line = releasedAt[useField] },
                            new { op = "use", var = useField, line = useLine },
                        },
                    });
                }
            }
        }

        // POOL005 (field): a FULL-LENGTH view of a pooled FIELD — `_buf.AsSpan()` / `this._buf.AsMemory()`
        // / `new Span<T>(_buf)` / the `.Length` spelling (`_buf.AsSpan(0, _buf.Length)`) — over a buffer
        // the class `Rent`ed into a FIELD (by assignment `_buf = ArrayPool<T>.Shared.Rent(n)` OR a field
        // initializer `byte[] _buf = ArrayPool<T>.Shared.Rent(n);`). The pooled array is
        // oversized (`Length >= n`), so a member that views the field full-length reads past the logical
        // length `n` into the stale `[n, Length)` tail (a previous renter's bytes). The per-method flow
        // pass only tracks LOCAL rents, so a FIELD-backed rent's over-read is unreached there; emit a
        // synthetic acquire/overspan/release flow per such field so the existing OwnIR bridge raises
        // OWN025 at the view — the synthetic-flow trick the field-UAF / MemoryPool slices use, no new
        // diagnostic. The trailing `release` is synthetic (the real `Return` is class-wide, handled by
        // the POOL001 field pass) and only keeps this one-function flow from reading as a leak. A
        // write/wipe (`Array.Clear(_buf, 0, _buf.Length)`) is not a view, so FullViewFieldOwner returns
        // null on it — only a read-capable VIEW is the over-read. Gated on --flow-locals like the rest of
        // the synthetic-flow emission.
        if (flowLocals)
        {
            // pooled FIELD -> the line it was `Rent`ed, via the shared IsPoolRent (an aliased pool
            // receiver binds; a non-pool `.Rent` does not false-match). Two rent spellings, BOTH scoped
            // to THIS class — a nested type is analysed by its OWN `cls` pass, so its rents/views must
            // neither seed nor fire here (else an inner field could be mis-attributed to the outer class,
            // CodeRabbit):
            //   * an assignment `_buf = ArrayPool<T>.Shared.Rent(n)` (ctor/Capture), target resolved
            //     through `ThisFieldName` — a bare `_buf` / `this._buf`, NEVER `other._buf` — the SAME
            //     this-instance shape FullViewFieldOwner reads the view through, so a rent into another
            //     object's field cannot seed and then false-match this class's own same-named (non-pooled)
            //     field at the view (Codex); the `FirstAncestorOrSelf == cls` guard drops a rent nested
            //     in an inner type; and
            //   * a field-declaration INITIALIZER `byte[] _buf = ArrayPool<T>.Shared.Rent(n);` — a direct
            //     member of `cls`, so inherently this-class-scoped (CodeRabbit).
            // The first rent per field anchors the synthetic acquire, so #317 makes this a
            // POSITION rather than a line: the acquire is minted in a different loop, and a
            // carrier that dropped the column here would leave no way to recover it there
            // except by re-resolving the node - a second lookup, and a second chance to pick
            // the wrong one.
            var pooledFieldRent = new Dictionary<string, SourcePos>(StringComparer.Ordinal);
            foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
                if (IsPoolRent(inv, model)
                    && inv.FirstAncestorOrSelf<BaseTypeDeclarationSyntax>() == cls
                    && inv.Parent is AssignmentExpressionSyntax asg
                    && ThisFieldName(asg.Left) is { } pf
                    && !pooledFieldRent.ContainsKey(pf))
                    pooledFieldRent[pf] = PosOf(inv);
            foreach (var fdecl in cls.Members.OfType<FieldDeclarationSyntax>())
                foreach (var fv in fdecl.Declaration.Variables)
                    if (fv.Initializer?.Value is InvocationExpressionSyntax finv
                        && IsPoolRent(finv, model)
                        && !pooledFieldRent.ContainsKey(fv.Identifier.Text))
                        pooledFieldRent[fv.Identifier.Text] = PosOf(finv);
            if (pooledFieldRent.Count > 0)
                foreach (var member in cls.Members)
                {
                    if (member is BaseTypeDeclarationSyntax)
                        continue;   // a nested type is covered by its OWN class pass, not the outer's
                    // first full-length view of each pooled field in this member (one finding per field
                    // per member — repeated views of the same field do not multiply the diagnostic).
                    var seen = new HashSet<string>(StringComparer.Ordinal);
                    var ops = new List<object>();
                    foreach (var node in member.DescendantNodes().OfType<ExpressionSyntax>())
                        if (FullViewFieldOwner(node, model) is { } fld
                            && pooledFieldRent.TryGetValue(fld, out var rentPos)
                            && seen.Add(fld))
                        {
                            var vline = LineOf(node);
                            // #317: the acquire anchors and carries the rent's column. The
                            // overspan/release below stay on `vline` alone - `node` is the VIEW
                            // site, a different node from the rent, and mixing the rent's column
                            // into the view's line is the one error this change exists to prevent.
                            ops.Add(new { op = "acquire", var = fld,
                                          line = rentPos.Line, column = rentPos.Column,
                                          kind = "pool" });
                            ops.Add(new { op = "overspan", var = fld, line = vline });
                            ops.Add(new { op = "release", var = fld, line = vline });
                        }
                    if (ops.Count > 0)
                    {
                        var mname = member switch
                        {
                            MethodDeclarationSyntax md => md.Identifier.Text,
                            ConstructorDeclarationSyntax cd => cd.Identifier.Text,
                            PropertyDeclarationSyntax pd => pd.Identifier.Text,
                            _ => "member",
                        };
                        flowFunctions.Add(new { name = $"{cls.Identifier.Text}.{mname}", file, body = ops });
                    }
                }
        }

        // WPF004: a `X.Subscribe(...)` whose IDisposable result is ignored — the
        // call stands as a bare statement (not assigned/returned/added), so the
        // token is dropped and never disposed. Member-access only (`x.Subscribe`),
        // and RESOLVE-AWARE: the call must return an IDisposable (Rx). A resolved void /
        // non-IDisposable `Subscribe` (StackExchange.Redis's `ISubscriber.Subscribe(channel,
        // handler, flags)` is void) has no token to leak; an unresolved return still counts.
        foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
            if (inv.Expression is MemberAccessExpressionSyntax m
                && m.Name.Identifier.Text == "Subscribe"
                && inv.Parent is ExpressionStatementSyntax
                && SubscribeResultIsDisposable(model.GetTypeInfo(inv).Type)
                // P-035: a DECLARED weak-subscribe wrapper named `Subscribe` is a project
                // weak subscription, not a dropped Rx token -- so this Rx matcher must never
                // flag it. The declaration classifies the API regardless of whether event-
                // fact emission is on, so the suppression is UNCONDITIONAL: gating it on
                // `emitEvents` would make `--no-event-leaks` INVENT a finding that event
                // analysis suppresses (the OFF switch turning a check ON). The weak-fact pass
                // itself stays `emitEvents`-gated above; only this misclassification-guard is
                // always active.
                && !MatchesDeclaredWeakSubscribe(inv, model, weakSubscribe, out _, out _))
            {
                // #317: the dropped token's record anchors on the INVOCATION, which is the
                // node `line` has always been taken from - `m` is only its receiver spelling.
                var rxPos = PosOf(inv);
                subs.Add(new
                {
                    @event = m.ToString(),
                    line = rxPos.Line,
                    column = rxPos.Column,
                    released = false,
                    resource = "subscribe",
                    // A self-rooted `this.WhenAnyValue(p => p.SelfProp)` chain is a
                    // GC-collectible self-cycle: the bridge drops `source: "self"`.
                    // Any other (external) source stays a flagged leak (null source).
                    source = IsSelfRootedWhenAny(m.Expression) ? "self" : null,
                });
            }

        // POOL001: an ArrayPool<T> buffer `Rent`ed but never `Return`ed, the Rent
        // recognised via the shared semantic `IsPoolRent` (so an aliased pool receiver
        // binds and a non-pool `.Rent` does not false-match — one definition, the flow
        // pass below is the other consumer). Matched per member so a `buf` returned in
        // one method does not mask a
        // leak of a same-named `buf` in another. Under --flow-locals the
        // path-sensitive flow detector supersedes this for buffers held in LOCALS
        // (and additionally catches double-return / use-after-return) — but it only
        // tracks local declarations, so field/assignment-backed rents still need
        // this syntactic pass; the local-declaration rents are skipped below to
        // avoid double-reporting them (Codex).
        // A FIELD-backed pooled buffer is legitimately rented in one member (the ctor) and
        // Returned in another (Dispose), so for FIELDS the `pool.Return(field)` is searched
        // CLASS-WIDE (a field name is unique to the class, so this cannot cross-mask — unlike
        // same-named LOCALS in different methods, which keep the per-member scoping below).
        // Mined: ImageSharp BufferedReadStream returns this.readBuffer in Dispose(bool). (An
        // INDIRECT release via a lifetime-guard object — SharedArrayPoolBuffer — is left honest:
        // a `new X(field)` is NOT assumed to own/return the buffer, since a non-owning view like
        // `new ReadOnlyMemory<byte>(field)` would otherwise hide a real leak — Codex.)
        var fieldReleased = new HashSet<string>();
        foreach (var inv in cls.DescendantNodes().OfType<InvocationExpressionSyntax>())
            if (inv.Expression is MemberAccessExpressionSyntax rm
                && rm.Name.Identifier.Text == "Return"
                && inv.ArgumentList.Arguments.Count > 0
                && model.GetSymbolInfo(inv.ArgumentList.Arguments[0].Expression).Symbol is IFieldSymbol rfs)
                fieldReleased.Add(rfs.Name);

        foreach (var member in cls.Members)
        {
            // #317: `Pos`, not `Line` - the record built from this tuple below is a POOL001
            // anchor, and the rent invocation that fills it is resolved here, not there.
            var rented = new List<(string Name, SourcePos Pos, bool IsField)>();
            foreach (var inv in member.DescendantNodes().OfType<InvocationExpressionSyntax>())
                if (IsPoolRent(inv, model))
                {
                    (string? name, bool isField) = inv.Parent switch
                    {
                        // a local-declaration rent is the flow pass's job under
                        // --flow-locals; skip it here so it is not double-reported.
                        EqualsValueClauseSyntax { Parent: VariableDeclaratorSyntax vd }
                            => (flowLocals ? null : vd.Identifier.Text, false),
                        // a FIELD-backed rent (`_buf = pool.Rent(...)`) is NOT a flow
                        // candidate — rented in one member, Returned class-wide in another
                        // (Dispose) — so this pass keeps it in both modes. GATED on the target
                        // being a real field: `FieldName` is purely syntactic, so a bare LOCAL
                        // assignment (`keys = pool.Rent(count)`, keys pre-declared) would otherwise
                        // be mis-classified as a field rent and flagged with NO escape/transfer
                        // analysis — a false positive when the local is handed to an escaping owner
                        // (mined on StackExchange.Redis RedisServer scan: `keys = ArrayPool<RedisKey>.
                        // Shared.Rent(count); … new ScanResult(cursor, keys, count, true)` — the
                        // ScanResult owns the Return via Recycle()). A bare-local assignment rent
                        // belongs to the flow pass (which does escape analysis); it does not track
                        // the assignment form, so such a rent is honestly not tracked here rather
                        // than flagged unsoundly.
                        AssignmentExpressionSyntax asg
                            when model.GetSymbolInfo(asg.Left).Symbol is IFieldSymbol
                            => (FieldName(asg.Left), true),
                        _ => ((string?)null, false),
                    };
                    if (name != null)
                        rented.Add((name, PosOf(inv), isField));
                }
            if (rented.Count == 0)
                continue;
            var returned = new HashSet<string>();
            foreach (var inv in member.DescendantNodes().OfType<InvocationExpressionSyntax>())
                if (inv.Expression is MemberAccessExpressionSyntax m
                    && m.Name.Identifier.Text == "Return"
                    && inv.ArgumentList.Arguments.Count > 0
                    && FieldName(inv.ArgumentList.Arguments[0].Expression) is { } rn)
                    returned.Add(rn);
            foreach (var (name, pos, isField) in rented)
                subs.Add(new
                {
                    @event = name,
                    line = pos.Line,
                    column = pos.Column,
                    // locals stay per-member; a field is also released if returned/transferred
                    // anywhere in the class (cross-member ctor-rent + Dispose-return).
                    released = returned.Contains(name) || (isField && fieldReleased.Contains(name)),
                    resource = "pool",
                });
        }

        // D1 (P-005): a local IDisposable the method `new`s but never disposes,
        // not guarded by `using`, and not handed out (returned / passed as an
        // argument / assigned out) — ownership transfer is ambiguous syntactically
        // (P-005 D5), so those are conservatively excluded. Per member. Suppressed
        // under --flow-locals, where the path-sensitive flow detector supersedes it.
        if (!flowLocals)
        foreach (var member in cls.Members)
        {
            var usingGuarded = new HashSet<string>();
            foreach (var u in member.DescendantNodes().OfType<UsingStatementSyntax>())
                if (u.Declaration is { } ud)
                    foreach (var v in ud.Variables)
                        usingGuarded.Add(v.Identifier.Text);

            var escaped = new HashSet<string>();
            foreach (var id in member.DescendantNodes().OfType<IdentifierNameSyntax>())
                if (id.Parent is ReturnStatementSyntax or ArgumentSyntax
                    || (id.Parent is AssignmentExpressionSyntax asg && asg.Right == id))
                    escaped.Add(id.Identifier.Text);

            var disposedLocal = new HashSet<string>();
            foreach (var inv in member.DescendantNodes().OfType<InvocationExpressionSyntax>())
                if (inv.Expression is MemberAccessExpressionSyntax m
                    && m.Name.Identifier.Text is "Dispose" or "DisposeAsync"
                    && FieldName(m.Expression) is { } dn)
                    disposedLocal.Add(dn);

            foreach (var ld in member.DescendantNodes().OfType<LocalDeclarationStatementSyntax>())
            {
                if (ld.UsingKeyword != default)
                    continue;   // `using var x = ...` is safe
                foreach (var v in ld.Declaration.Variables)
                {
                    var name = v.Identifier.Text;
                    if (usingGuarded.Contains(name) || escaped.Contains(name))
                        continue;
                    string? ctype = v.Initializer?.Value switch
                    {
                        ObjectCreationExpressionSyntax oc => oc.Type.ToString(),
                        ImplicitObjectCreationExpressionSyntax => ld.Declaration.Type.ToString(),
                        _ => null,
                    };
                    if (ctype is null || !IsDisposableType(ctype))
                        continue;
                    // #225: a user type whose Dispose() body is provably empty holds no resource —
                    // never disposing a local of it cannot leak (mirrors the flow path's guard).
                    if (v.Initializer?.Value is { } newExpr
                        && HasEmptyDisposeBody(model.GetTypeInfo(newExpr).Type))
                        continue;
                    // #317: the D1 local-leak record anchors on the declarator, so two
                    // undisposed locals declared on one line stay two findings.
                    var localPos = PosOf(v);
                    subs.Add(new
                    {
                        @event = name,
                        line = localPos.Line,
                        column = localPos.Column,
                        released = disposedLocal.Contains(name),
                        resource = "local-disposable",
                        type = ctype,
                    });
                }
            }
        }

        // P-016 B0b/B2 (--flow-locals): per-method flow facts for non-escaping local
        // IDisposables. The core checks them path-sensitively (OWN001/002/003).
        // Methods with an unmodelled construct (loop/try/switch) are honestly skipped.
        if (flowLocals)
            foreach (var method in cls.Members.OfType<BaseMethodDeclarationSyntax>())
            {
                if (method.Body is not { } mbody)
                    continue;
                // P-037 A1.1-a1 (#304): this method's OWNERSHIP-RELEVANT parameters.
                //
                // Why this exists: `build_skeletons` (own-bridge/src/lower.rs and its Python
                // twin) reads `functions[].params` to derive each parameter's transfer, and the
                // C# frontend has never emitted that field. The MOS layer — solver, transfer
                // lattice, the whole INF rule set — has therefore had NO parameter input from
                // C#, and "does this call consume its argument?" was answered instead by
                // `ConsumesParam`: syntactically, flow-insensitively, inside the extractor.
                // Measured: fed the same shapes, the inference layer already discriminates
                // `if (g) release p` -> may, `release p` -> must, `use p` -> no, correctly and
                // without flattening. It was simply never asked.
                //
                // This step only makes the frontend SAY what a callee does with its parameters.
                // Nothing reads the new field to change a verdict yet and `ConsumesParam` is
                // untouched — the semantic cut is a later step, deliberately, so a verdict
                // movement HERE is a defect rather than a feature.
                //
                // The predicate is `IsOwnedDisposableType`, the same one locals use, and NOT
                // `ConsumesParam`'s stricter `ImplementsIDisposable`. That matters: the strict
                // form demands a resolved symbol and silently answers false for a type the
                // compilation cannot see, which on a single-file run is most of the BCL. A
                // frontend that tracks a `Stream` local but not a `Stream` parameter would be
                // inconsistent about one type for no reason a reader could defend.
                var ownedParams = new List<object>();
                var ownedParamNames = new HashSet<string>(StringComparer.Ordinal);
                foreach (var psyn in method.ParameterList.Parameters)
                {
                    // By-value only, like `ConsumesParam`: a `ref`/`out`/`in` parameter is not
                    // an ownership handoff. Read off the SYNTAX so this agrees with itself when
                    // the symbol does not resolve.
                    if (psyn.Modifiers.Any(SyntaxKind.RefKeyword)
                        || psyn.Modifiers.Any(SyntaxKind.OutKeyword)
                        || psyn.Modifiers.Any(SyntaxKind.InKeyword))
                        continue;
                    if (psyn.Type is { } ptype && IsOwnedDisposableType(ptype, model))
                    {
                        ownedParams.Add(new { name = psyn.Identifier.Text, line = LineOf(psyn) });
                        ownedParamNames.Add(psyn.Identifier.Text);
                    }
                }
                var candidates = new HashSet<string>();
                var poolBuffers = new HashSet<string>();   // candidates that are ArrayPool<T> buffers
                var usingMemoryOwners = new HashSet<string>();   // `using`-declared MemoryPool owners
                var newedDisposables = new HashSet<string>();    // candidates created via `new` (NOT a pool rental / factory)
                foreach (var ld in mbody.DescendantNodes().OfType<LocalDeclarationStatementSyntax>())
                {
                    if (ld.UsingKeyword != default)
                    {
                        // A `using` local is auto-disposed (not a leak candidate). But a `using` MemoryPool
                        // owner whose Memory VIEW is returned dangles after the implicit scope-exit dispose —
                        // track it so the flow's using-desugaring catches that escape. Others stay skipped.
                        foreach (var v in ld.Declaration.Variables)
                            if (IsMemoryPoolRent(v.Initializer?.Value, model))
                            {
                                candidates.Add(v.Identifier.Text);
                                usingMemoryOwners.Add(v.Identifier.Text);
                            }
                        continue;
                    }
                    foreach (var v in ld.Declaration.Variables)
                        if (v.Initializer is { Value: ObjectCreationExpressionSyntax
                                                   or ImplicitObjectCreationExpressionSyntax } init
                            && model.GetTypeInfo(init.Value).Type is { } dt
                            && ImplementsIDisposable(dt) && !IsDisposeOptional(dt)
                            // #225: a user type with a provably-empty Dispose() body holds no
                            // resource -> never disposing a local of it cannot leak.
                            && !HasEmptyDisposeBody(dt))
                        {
                            candidates.Add(v.Identifier.Text);
                            newedDisposables.Add(v.Identifier.Text);
                        }
                        else if (IsPoolRent(v.Initializer?.Value, model))   // an ArrayPool<T> buffer
                        {
                            candidates.Add(v.Identifier.Text);
                            poolBuffers.Add(v.Identifier.Text);
                        }
                        else if (IsOwningFactory(v.Initializer?.Value, model))   // File / crypto Create* factory
                            candidates.Add(v.Identifier.Text);
                        else if (IsMemoryPoolRent(v.Initializer?.Value, model))   // MemoryPool<T> IMemoryOwner (Dispose-released, NOT a poolBuffer)
                            candidates.Add(v.Identifier.Text);
                        else if (IsFirstPartyDisposableFactory(v.Initializer?.Value, model,
                                                               out _, out _))
                            // P-005 D5.2: `var r = FirstPartyFactory()` — a candidate acquire
                            // IFF the core proves the callee returns `fresh` (it emits a `call`
                            // op, not an `acquire`; the core decides). Checked last so `new` /
                            // pool / BCL-factory initializers keep their existing classification.
                            candidates.Add(v.Identifier.Text);
                }
                // OWN053 (promoted from ownership-semantics-lab H-29): the orphaned-awaitable sites of this body,
                // always on under --flow-locals (the own-check default); the frozen scope is the detector's own comment.
                CollectOrphanedAwaitables(mbody, model);
                // `using (IMemoryOwner owner = MemoryPool.Rent(...)) { … }` STATEMENT form: track the owner
                // too, so its returned view dangles after the scope-exit dispose (the desugar mirrors the
                // `using` DECLARATION form handled in the loop above).
                foreach (var us in mbody.DescendantNodes().OfType<UsingStatementSyntax>())
                    if (us.Declaration is { } usd)
                        foreach (var v in usd.Variables)
                            if (IsMemoryPoolRent(v.Initializer?.Value, model))
                            {
                                candidates.Add(v.Identifier.Text);
                                usingMemoryOwners.Add(v.Identifier.Text);
                            }
                // Eligibility, NOT a deleted guard. This is the gate that drops a method
                // whose only ownership-relevant thing is a PARAMETER — `Close(Stream s, bool
                // keep)` never reached the second gate below, it exited here. Removing the test
                // outright would emit every method in the compilation, most carrying nothing an
                // ownership analysis can read: a five-figure fact diff bought with one line that
                // looked suspicious. A method earns a record by having something to say —
                // tracked locals, or a parameter whose ownership a caller must reason about.
                // (The third case the design names, "required as an interprocedural summary
                // target", is subsumed: a summary is consulted for its PARAMETERS, so a method
                // with none has no summary anyone can read.)
                if (candidates.Count == 0 && ownedParamNames.Count == 0)
                    continue;
                // A local that escapes (returned / assigned out) is conservatively not
                // tracked — its release may be the caller's job. For an IDisposable,
                // passing it as an argument is an ambiguous ownership transfer too; for
                // a pooled buffer the convention is the RENTER returns it, so arg-passing
                // is a borrow (a use), not an escape — else `pool.Return(buf)` and
                // `Work(buf)` would untrack it and hide the double-return / use-after-return.
                var escapedLocals = new HashSet<string>();
                foreach (var idn in mbody.DescendantNodes().OfType<IdentifierNameSyntax>())
                {
                    var nm = idn.Identifier.Text;
                    if (!candidates.Contains(nm))
                        continue;
                    // A `nameof(x)` operand is a compile-time string, not a real reference: it
                    // neither uses, captures, nor transfers the local. Skip it so it triggers no
                    // escape rule — otherwise `nameof(s)` would look like an argument (the arg
                    // rule below) or, inside a lambda, a closure capture, and wrongly untrack a
                    // still-leaking method-bounded local (Codex review on PR #59).
                    if (idn.Parent is ArgumentSyntax { Parent: ArgumentListSyntax
                            { Parent: InvocationExpressionSyntax ninv } }
                        && ninv.Expression is IdentifierNameSyntax { Identifier.Text: "nameof" })
                        continue;
                    // Captured into a CLOSURE (lambda / anonymous method / local function):
                    // the closure can outlive the method — stored, returned, or run async —
                    // so the local is no longer method-bounded and cannot be disposed at
                    // method scope. Conservatively treat the capture as an escape (don't
                    // flag it), the same way a returned/out-passed local is untracked.
                    // Reduced from a ShareX false positive: a SemaphoreSlim throttler captured
                    // by the async lambdas of a returned `Task.WhenAll(...)` (Helpers.ForEachAsync).
                    var capturedInClosure = false;
                    for (var a = idn.Parent; a is not null && a != mbody; a = a.Parent)
                        if (a is AnonymousFunctionExpressionSyntax or LocalFunctionStatementSyntax)
                        {
                            capturedInClosure = true;
                            break;
                        }
                    if (capturedInClosure)
                    {
                        escapedLocals.Add(nm);
                        continue;
                    }
                    // ... unless it is handed to a CONSUMER (a first-party method that
                    // disposes a by-value IDisposable param) as a bare `Consume(s);`
                    // statement: that is a handoff RELEASED at the call site, not an escape
                    // (else the use-after-handoff would be hidden). Tied to the statement
                    // form the flow pass lowers, so a local is never exempted without a
                    // matching release (a `var n = Consume(s)` initializer is NOT lowered
                    // here, so it stays an escape rather than a false leak).
                    bool consumedArg = idn.Parent is ArgumentSyntax
                        && idn.Parent.Parent is ArgumentListSyntax
                        && idn.Parent.Parent.Parent is InvocationExpressionSyntax cinv
                        && cinv.Parent is ExpressionStatementSyntax
                        && ConsumeReleaseArgs(cinv, model).Contains(nm);
                    // A `using`-declared MemoryPool owner RETURNED bare (`using owner = …; return owner;`)
                    // is NOT a real ownership transfer: the implicit scope-exit dispose runs as the method
                    // returns, so the caller receives an already-disposed owner. Keep it TRACKED (do not
                    // escape it) so the using-desugar threads the release before the return and the inserted
                    // use of the returned owner trips OWN002 — the bare-owner twin of the returned-view
                    // dangle. A NON-using returned owner stays a genuine transfer (escaped → untracked →
                    // silent), so this never fires on `var o = Rent(); return o;`.
                    if (idn.Parent is ReturnStatementSyntax rsp)
                    {
                        // P-005 D5.2: a `new`'d IDisposable returned BARE outside any `try` is a
                        // fresh-returning FACTORY — keep it tracked so the flow body emits
                        // `acquire …; return <var>`. The core then classifies the method
                        // `returnsOwned: fresh` (and the `return <var>` discharges it, so the
                        // factory itself stays silent), letting a caller that drops the result
                        // leak. A return INSIDE a try threads `finally` edges the fresh path does
                        // not model yet, so keep the old transfer (escape) there; a `using` owner
                        // also stays tracked (its scope-exit dispose dangles the returned value).
                        var freshFactory = newedDisposables.Contains(nm)
                            && !rsp.Ancestors().TakeWhile(a => a != mbody)
                                   .OfType<TryStatementSyntax>().Any();
                        if (!usingMemoryOwners.Contains(nm) && !freshFactory)
                            escapedLocals.Add(nm);
                    }
                    // A pooled buffer handed as an argument is normally a BORROW (the renter Returns it),
                    // NOT an escape — so `pool.Return(buf); Work(buf)` still trips use-after-return. But a
                    // pooled buffer passed to a CONSTRUCTOR whose result ESCAPES this method (`return new
                    // Wrapper(buf)` / `_field = new Wrapper(buf)`) transfers ownership to that object, which
                    // becomes responsible for Return — so the buffer is NOT leaked here. Treat that as an
                    // escape (mined FP on Pipelines.Sockets.Unofficial: ArrayPoolBufferWriter.CreateNewSegment
                    // returns `new ArrayPoolRefCountedSegment(pool, array, prev)`).
                    else if ((idn.Parent is AssignmentExpressionSyntax asg && asg.Right == idn)
                        || (idn.Parent is ArgumentSyntax && !poolBuffers.Contains(nm) && !consumedArg
                            // P-005 D5.4: a disposable passed to an ADOPTING ctor arg of a
                            // method-bounded wrapper is not an escape — its obligation is
                            // adopted by the wrapper (modelled as an alias_join) and stays
                            // tracked. Gated to a non-using, non-escaping local wrapper so we
                            // never keep an arg tracked with nothing to discharge it (FP).
                            && !IsAdoptedArgOfBoundedWrapper(idn, model, candidates, mbody))
                        // An IMemoryOwner's `.Memory` view handed off as an ARGUMENT escapes the
                        // OWNER: the Memory keeps the owner alive (it IS the backing), so a consumer
                        // that stores it — `MemoryGroup.Wrap(owner.Memory)` -> the returned Image —
                        // takes over the lifetime; the owner is not leaked here. Scoped to
                        // IMemoryOwner.`Memory` (not any `local.Member`, so a FileStream whose
                        // `.Length` is read still leaks) and to `new`'d owners ONLY: a pool rental —
                        // ArrayPool or MemoryPool, `var` or `using` — keeps its dangling-borrow / use-
                        // after-dispose (OWN002/OWN003) tracking through `.Memory` handoffs, since the
                        // RENTER owns the Return/Dispose (Codex/CodeRabbit; benchmark memorypool-double-
                        // dispose). Mined FP on ImageSharp Image.WrapMemory; CodeQL agrees — no leak.
                        || (newedDisposables.Contains(nm)
                            && idn.Parent is MemberAccessExpressionSyntax { Name.Identifier.Text: "Memory" } projMem
                            && projMem.Expression == idn
                            && projMem.Parent is ArgumentSyntax
                            && IsMemoryOwnerType(model.GetTypeInfo(idn).Type))
                        || (poolBuffers.Contains(nm) && PassedToEscapingCtor(idn, model)))
                        escapedLocals.Add(nm);
                }
                var tracked = new HashSet<string>(candidates);
                tracked.ExceptWith(escapedLocals);
                if (tracked.Count == 0 && ownedParamNames.Count == 0)
                    continue;
                statMethodsWithLocal++;
                // Lower over locals AND owned parameters, so `param_signals` /
                // `definite_release` / `forward_targets` have a body to read. A parameter has no
                // declarator in this body and every `acquire` site is gated on a declarator
                // (checked, not assumed), so no acquire is emitted for it: it appears only as
                // the `use` / `release` / `call` ops describing its fate, which is exactly the
                // shape `params[]` is paired with.
                var flowNames = new HashSet<string>(tracked, StringComparer.Ordinal);
                flowNames.UnionWith(ownedParamNames);
                var fbody = LowerFlowBody(mbody, flowNames, model);
                if (fbody is null || fbody.Count == 0)
                {
                    statMethodsSkipped++;   // unmodelled construct -> honestly skipped
                    continue;
                }
                // #401: a body nesting deeper than spec/OwnIR.md §4.2 admits would make BOTH
                // doors reject the whole document, so it is skipped like any other unmodelled
                // shape: this method loses its flow facts, the rest of the run keeps theirs.
                if (FlowNestingDepth(fbody) > OwnIrMaxNestingDepth)
                {
                    statMethodsSkipped++;
                    continue;
                }
                statMethodsAnalysed++;
                // Stage 2 (spec §5.1): stamp the record's per-overload `sig` when the
                // symbol resolves, so an overloaded method gets its own summary beside
                // the name-merge; an unresolved symbol omits the field (the bridge then
                // keeps the merged-fallback behaviour — degraded, never mis-keyed).
                // `params` rides only when non-empty: a method with no owned parameter keeps
                // byte-for-byte the record shape it had before this change, so the fact-stream
                // diff is confined to the methods this step is actually about.
                var fname = model.GetDeclaredSymbol(method) is IMethodSymbol msym
                    ? $"{msym.ContainingType.ToDisplayString()}.{msym.Name}"
                    : FlowFunctionName(method, cls.Identifier.Text, model);
                var fsig = model.GetDeclaredSymbol(method) is IMethodSymbol sigsym
                    ? CanonicalSig(sigsym)
                    : null;
                // P-037 A2.1 (#304): the guarded-fact sidecar — raw call-argument and guard
                // facts, keyed by declared parameter ordinal, VALIDATED AND INERT in A2 (the
                // legacy `body` stays authoritative; see BuildGuardedFacts). It rides only
                // when this method has a relevant call or an eligible guard, so every other
                // record keeps the shape it had. Key order is fixed (name, file, sig, params,
                // body, guarded_facts): the two doors read by name, the fact digest by bytes.
                // Handles for the sidecar are the disposable CANDIDATES, not the post-escape
                // `tracked` set: a local the legacy pass untracked because it was handed to a
                // non-consuming callee is exactly the handle whose flow a summary refines.
                var guardedFacts = BuildGuardedFacts(method, mbody, candidates, ownedParamNames,
                                                     model, fname);
                var record = new Dictionary<string, object?> { ["name"] = fname, ["file"] = file };
                if (fsig is not null)
                    record["sig"] = fsig;
                if (ownedParams.Count > 0)
                    record["params"] = ownedParams;
                record["body"] = fbody;
                if (guardedFacts is not null)
                    record["guarded_facts"] = guardedFacts;
                flowFunctions.Add(record);
                flowRecordNames.Add(fname);
            }

        if (subs.Count > 0)
        {
            if (emitFixCandidates)
                components.Add(new
                {
                    name = cls.Identifier.Text,
                    qualified_name = clsSymbol?.ToDisplayString(FixFqnFormat()) ?? cls.Identifier.Text,
                    is_partial = clsSymbol is not null
                        ? clsSymbol.DeclaringSyntaxReferences.Length > 1
                          || cls.Modifiers.Any(SyntaxKind.PartialKeyword)
                        : cls.Modifiers.Any(SyntaxKind.PartialKeyword),
                    is_nested = clsSymbol?.ContainingType is not null,
                    declaration_count = clsSymbol?.DeclaringSyntaxReferences.Length ?? 1,
                    is_generated = FixIsGeneratedFile(tree, file),
                    file,
                    subscriptions = subs,
                });
            else
                components.Add(new { name = cls.Identifier.Text, file, subscriptions = subs });
        }
    }
}

// ownir_version stamps the fact-schema vocabulary; the Python core rejects a
// mismatch loudly (ownlang/ownir.py OWNIR_VERSION) rather than mis-reading facts.
// `stats` is additive coverage metadata — the core's load() ignores unknown keys.
// P-006: the DI registration + ctor graph (empty when the scan has no
// Add{Singleton,Scoped,Transient} calls). ownlang/di.py turns it into DI001.
// P-010 pillar 9: state-protocol regions -> `borrow_mut` / `move` / `proven_call` flow records (OwnIR v2). A
// lowering, not an analysis (see ProtocolLowering.cs). A shape it cannot lower is a
// REFUSAL of the whole run (exit 2, the same tier as the guarded-fact self-check below):
// the alternative is a region that silently drops out of the facts and reads as clean.
// OwnIR v2 `proven_call` sites (H1): non-empty only when a protocol region holds a call the
// core must prove harmless; they turn into the document's `heap_effects` section below.
List<(string Key, string File, Microsoft.CodeAnalysis.CSharp.Syntax.InvocationExpressionSyntax Call)> protocolSites = new();
if (flowLocals)
{
    var protocol = ProtocolLowering.Lower(compilation, parsed, flowRecordNames);
    if (protocol.Refusals.Count > 0)
    {
        foreach (var refusal in protocol.Refusals)
            Console.Error.WriteLine($"extractor: protocol lowering refused: {refusal}");
        return 2;
    }
    flowFunctions.AddRange(protocol.Functions);
    protocolSites = protocol.Sites;
}

var factServices = ExtractServices(parsed);
var factStats = new
{
    methods_with_local = statMethodsWithLocal,
    methods_flow_analysed = statMethodsAnalysed,
    methods_skipped_unmodelled = statMethodsSkipped,
};
// ONE envelope, built once, in the key order the facts have always been written. A section
// that is not always there is ONE conditional line here — never a second envelope. There
// used to be three, picked by a nested conditional (`--fix-candidates` ? A : orphans ? B : C),
// and each additive section had to be remembered in every one of them: the `--fix-candidates`
// envelope was written before `orphaned_awaitables` existed and never got it, so the flag
// that only ADDS fix metadata silently removed every OWN053 site from the facts.
//
// Every section is written as `facts["<key>"] = ...` and nowhere else: the S0 additivity
// check (tests/check_fix_candidates_facts.py) reads the section list off these lines, so a
// section added here is one its fixture must exercise.
//
// `ownir_version` is the core's current one (ownlang/ownir.py OWNIR_VERSION). It is spelled
// as this one literal on purpose: tests/test_ownir.py (IR2) reads every stamp in this file.
const int ownir_version = 2;
var facts = new Dictionary<string, object?>();
facts["ownir_version"] = ownir_version;
// S0: ADDITIVE metadata, present ONLY under --fix-candidates. It does not move the version
// (no new resource-kind or analysis-routing value), and removing the S0 fields from a
// flag-on document gives the flag-off document — every other section included
// (tests/check_fix_candidates_facts.py holds exactly that).
if (emitFixCandidates)
    facts["fix_candidates_version"] = 1;
facts["module"] = "Extracted";
facts["components"] = components;
facts["services"] = factServices;
facts["functions"] = flowFunctions;
facts["stats"] = factStats;
// OwnIR v2 (H1): the heap-effect FACTS a `proven_call` is judged against — the call sites
// and the methods they reach. Present exactly when a `proven_call` is: a document without one
// is the v1 document with a new stamp. The core proves or refuses; nothing here decides.
if (protocolSites.Count > 0)
    facts["heap_effects"] = HeapEffectFacts.Section(compilation, parsed, protocolSites);
// OWN053 (promoted from ownership-semantics-lab H-29): an ADDITIVE top-level list of orphaned
// awaitables from which both engines mint the advisory. Absent when there is no site, so such
// a document stays byte-identical to the pre-OWN053 shape.
if (OrphanedAwaitables.Sites.Count > 0)
    facts["orphaned_awaitables"] = OrphanedAwaitables.Sites
        .OrderBy(o => JsonSerializer.Serialize(o), StringComparer.Ordinal).ToList();
// P-037 A2.1: a sidecar record that does not satisfy its own vocabulary is a producer
// defect, and a producer defect must not become a facts file. Refuse the whole run
// (exit 2, the launcher's "extraction failed, no verdict was produced" tier) rather
// than hand either door a document one half of which is wrong.
if (GuardedFactsViolations.Count > 0)
{
    foreach (var violation in GuardedFactsViolations)
        Console.Error.WriteLine($"extractor: guarded_facts self-check failed: {violation}");
    return 2;
}
var json = JsonSerializer.Serialize(facts, new JsonSerializerOptions { WriteIndented = true, MaxDepth = FactsJsonMaxDepth });

if (reportStats)
    Console.Error.WriteLine(
        $"coverage: {statMethodsAnalysed}/{statMethodsWithLocal} methods with a "
        + $"disposable local flow-analysed; {statMethodsSkipped} skipped (unmodelled construct)");

if (outPath is null) Console.WriteLine(json);
else File.WriteAllText(outPath, json);
// H0 (docs/notes/heap-effect-summaries.md): heap-effect source facts for the core's summary
// solver. A separate file, produced after the facts are final, so no flag spelling can move a
// byte of the facts document; nothing in the core reads it for a verdict.
if (heapEffectsPath is not null)
    File.WriteAllText(heapEffectsPath, JsonSerializer.Serialize(
        HeapEffectFacts.Extract(compilation, parsed),
        new JsonSerializerOptions { WriteIndented = true, MaxDepth = FactsJsonMaxDepth }));
return 0;

// Opt-in recall knob for the flow pass, read deep in InjectThrowEdge (a static field rather than
// a bool threaded through the whole LowerFlow* recursion). Set once from --body-throw-edges; see
// that flag's note above. Default false keeps the shipped low-FP posture; the oracle flips it on
// to measure CodeQL-parity dispose-not-called-on-throw recall on the no-try slice.
partial class Program
{
    internal static bool BodyThrowEdges;

    // #240 (Codex review): full paths of files compiled by a Fody-enabled PROJECT, recorded
    // while expanding its <Compile> items — a linked source outside the project directory
    // would otherwise dodge the ancestor-walk weaver check (the FodyWeavers.xml lives next
    // to the .csproj, not above the linked file).
    internal static readonly HashSet<string> WeaverOwnedFiles = new(StringComparer.Ordinal);

    // P-037 A2.1: violations of the guarded-fact sidecar's own vocabulary, collected while
    // records are built and turned into a refusal to write facts at all (see the check
    // before serialization). A list rather than a throw so the message names every
    // offending site of a run, not only the first.
    internal static readonly List<string> GuardedFactsViolations = new();

    // The sidecar's closed vocabularies (spec/ownir.schema.json $defs/guardedArg etc. mirror
    // these; tests/test_p037_sidecar.py pins the two against each other).
    internal static readonly HashSet<string> GuardedArgKinds = new(StringComparer.Ordinal)
        { "var", "param", "bool_const", "null_literal", "object_creation", "call_result", "opaque" };
    internal static readonly HashSet<string> GuardPredicates = new(StringComparer.Ordinal)
        { "truth", "not_null", "is_null" };
    internal static readonly HashSet<string> CallForms = new(StringComparer.Ordinal)
        { "statement", "initializer", "expression" };

    // #317: a 1-based source coordinate, carried as ONE value so a line and a column can
    // never drift onto different nodes. See RangeOf/PosOf/LineOf above — those are the only
    // producers of these, and they are computed from a single GetLineSpan() per node.
    //
    // A bare `SourcePos` would be enough for the anchor records, but not for `FixSpanOf`,
    // which also serializes `end_line`/`end_column`. Two types rather than one so the fix
    // block and the anchors keep sharing one definition instead of forking a second
    // "compute the position of a node" path — which is precisely what this change removes.
    // OWN053 (promoted from ownership-semantics-lab H-29): the orphaned-awaitable sites of a run, collected by
    // CollectOrphanedAwaitables under --flow-locals and serialized as the ADDITIVE top-level facts list
    // `orphaned_awaitables` (absent when empty, so such a document is byte-identical to the pre-OWN053 shape).
    static class OrphanedAwaitables
    {
        internal static readonly List<object> Sites = new();
    }

    internal readonly record struct SourcePos(int Line, int Column);

    internal readonly record struct SourceRange(SourcePos Start, SourcePos End);
}