@@ -853,9 +853,17 @@ jobs:
           # exact hole that sank the rejected clsIsStatic broadening;
           echo "$out" | grep -qE "AppScopedSourceSample\.cs:[0-9]+: warning: \[OWN001\].*'LambdaApp'" \
             || { echo "FAIL: expected OWN001 on the lambda-handler subscription inside the App (capture hole)"; exit 1; }
-          # (3) App + method-group handler, but a NON-curated resolver.
+          # (3) App + method-group handler, but a NON-curated resolver;
           echo "$out" | grep -qE "AppScopedSourceSample\.cs:[0-9]+: warning: \[OWN001\].*'CuratedOnlyApp'" \
             || { echo "FAIL: expected OWN001 on the non-curated resolver source inside the App"; exit 1; }
+          # (4, Codex P2) the method group is qualified with ANOTHER instance of the
+          # same App type — right ContainingType, wrong delegate target;
+          echo "$out" | grep -qE "AppScopedSourceSample\.cs:[0-9]+: warning: \[OWN001\].*'TwinApp'" \
+            || { echo "FAIL: expected OWN001 when the handler target is another instance, not this"; exit 1; }
+          # (5, Codex P2) the local is REASSIGNED to an injected publisher after the
+          # curated initializer — the stale declaration binding must not exempt.
+          echo "$out" | grep -qE "AppScopedSourceSample\.cs:[0-9]+: warning: \[OWN001\].*'ReassignApp'" \
+            || { echo "FAIL: expected OWN001 when the resolver-bound local is reassigned before the +="; exit 1; }
           echo "OK: real C# -> facts -> OWN001 (subscription + timer + field + Subscribe + pool + local) + OWN014 (static-event region escape) + DI001 (captive dependency) + DI002 (scoped captured weakly) + DI003 (transient IDisposable captured by a singleton) + DI004 (transient IDisposable service-located from the root provider) + DI005 (scoped service cached from a created scope) + [OwnIgnore] suppression (silent-but-counted, SARIF suppressions) + #218 DP old->new subscription rotation (silent; controls flagged) + #228 curated app-scoped source in App (silent; controls flagged) at the C# location"
       - name: Flow-sensitive local IDisposables (--flow-locals, P-016 B0b/B2)
         run: |
 
@@ -929,6 +929,11 @@ static bool ResolvesToAppScopedCall(ExpressionSyntax expr, SemanticModel model,
     }
     if (model.GetSymbolInfo(expr).Symbol is not ILocalSymbol local)
         return false;
+    // The binding is only trustworthy if the local still HOLDS it at the `+=`:
+    // a reassignment anywhere in the enclosing member (or a ref/out escape that
+    // could rebind it) makes the initializer stale — no exemption (Codex P2).
+    if (!IsNeverReassigned(local, model))
+        return false;
     foreach (var r in local.DeclaringSyntaxReferences)
         switch (r.GetSyntax())
         {
@@ -946,6 +951,34 @@ when des.Ancestors().OfType<IsPatternExpressionSyntax>().FirstOrDefault()
     return false;
 }
 
+// #228 (Codex P2): the declaration-site binding proves the local's value at the
+// `+=` only if nothing rebinds it. Conservative whole-member scan: ANY assignment
+// whose LHS is this local, or ANY `ref`/`out` argument passing it, kills the proof
+// (even one after the subscription — cheaper than flow order and precision-safe:
+// the worst case is keeping today's honest warning).
+static bool IsNeverReassigned(ILocalSymbol local, SemanticModel model)
+{
+    foreach (var r in local.DeclaringSyntaxReferences)
+    {
+        var scope = r.GetSyntax().Ancestors().FirstOrDefault(n =>
+            n is MethodDeclarationSyntax or ConstructorDeclarationSyntax
+              or AccessorDeclarationSyntax or LocalFunctionStatementSyntax
+              or AnonymousFunctionExpressionSyntax);
+        if (scope is null)
+            return false;
+        foreach (var asg in scope.DescendantNodes().OfType<AssignmentExpressionSyntax>())
+            if (SymbolEqualityComparer.Default.Equals(
+                    model.GetSymbolInfo(asg.Left).Symbol, local))
+                return false;
+        foreach (var arg in scope.DescendantNodes().OfType<ArgumentSyntax>())
+            if (!arg.RefOrOutKeyword.IsKind(SyntaxKind.None)
+                && SymbolEqualityComparer.Default.Equals(
+                       model.GetSymbolInfo(arg.Expression).Symbol, local))
+                return false;
+    }
+    return true;
+}
+
 // #228: the handler must be a METHOD GROUP declared on the subscribing class itself —
 // its delegate target is then the App singleton (already process-lived, nothing to
 // promote). A lambda/anonymous method is rejected outright: it may capture an
@@ -955,7 +988,19 @@ when des.Ancestors().OfType<IsPatternExpressionSyntax>().FirstOrDefault()
 static bool IsOwnMethodGroupHandler(ExpressionSyntax right, SemanticModel model,
                                     INamedTypeSymbol? cls)
 {
-    if (cls is null || right is AnonymousFunctionExpressionSyntax)
+    if (cls is null)
+        return false;
+    // The delegate TARGET must be `this` — a bare identifier (implicit this) or an
+    // explicit `this.X`. A method group qualified with ANOTHER instance of the same
+    // App-derived type (`otherApp.OnTheme`) has the right ContainingType but pins
+    // that other instance, not the process-lived singleton (Codex P2).
+    var receiverIsThis = right switch
+    {
+        IdentifierNameSyntax => true,
+        MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax } => true,
+        _ => false,
+    };
+    if (!receiverIsThis)
         return false;
     var info = model.GetSymbolInfo(right);
     var sym = info.Symbol as IMethodSymbol
 
@@ -102,4 +102,41 @@ public void OnStartup()
 
         void OnTheme(object? sender, EventArgs e) { }
     }
+
+    // CONTROL 4 (flagged, Codex P2): the method group is qualified with ANOTHER
+    // instance of the same App-derived type — right ContainingType, wrong delegate
+    // TARGET: the process-lived source pins `_twin`, not `this`.
+    public class TwinApp : Application
+    {
+        readonly TwinApp? _twin;
+
+        public TwinApp(TwinApp? twin) => _twin = twin;
+
+        public void OnStartup()
+        {
+            if (new PaletteHelper().GetThemeManager() is { } themeManager)
+                themeManager.ThemeChanged += _twin!.OnTheme;              // OWN001 warning
+        }
+
+        public void OnTheme(object? sender, EventArgs e) { }
+    }
+
+    // CONTROL 5 (flagged, Codex P2): the local STARTS as the curated resolver result
+    // but is REASSIGNED to an injected publisher before the `+=` — the declaration-site
+    // binding is stale, so the exemption must not trust it.
+    public class ReassignApp : Application
+    {
+        readonly ThemeManagerLike _injectedBus;
+
+        public ReassignApp(ThemeManagerLike bus) => _injectedBus = bus;
+
+        public void OnStartup()
+        {
+            var tm = new PaletteHelper().GetThemeManager()!;
+            tm = _injectedBus;
+            tm.ThemeChanged += OnTheme;                                   // OWN001 warning
+        }
+
+        void OnTheme(object? sender, EventArgs e) { }
+    }
 }