@@ -31,12 +31,11 @@ parameter. So an unknown or borrowing callee never credits a release.
 
 This clears the NLog variants where the sink is called on the field **directly** or
 through a simple `var t = _field;` alias (`AsyncTaskTarget`, `AsyncTargetWrapper`,
-`BufferingTargetWrapper`). It does **not** reach `TimeoutContinuation`, where the
-receiver is the result of `Interlocked.Exchange(ref _timer, null)` — an
-exchange-and-null-out idiom whose result is not a tracked field alias. That one
-stays in the oracle FP baseline
-([`corpus/oracle-fp-baseline.txt`](../../oracle-fp-baseline.txt),
-[`docs/notes/oracle-known-fps.md`](../../../docs/notes/oracle-known-fps.md)) until
-ref-exchange alias tracking lands. Scope is intentionally limited to **extension
-methods**: an instance method disposing its own `this` is not a real
-dispose-delegation shape and would drag in virtual-dispatch reasoning.
+`BufferingTargetWrapper`). The `TimeoutContinuation` variant — where the receiver is
+the result of `Interlocked.Exchange(ref _timer, null)`, the detach-and-dispose
+teardown — is covered separately by the sibling
+[`field-dispose-via-exchange`](../field-dispose-via-exchange/notes.md) fixture
+(`RefExchangeNulledField` binds the exchange result to the field, then this same sink
+recognition applies). Scope is intentionally limited to **extension methods**: an
+instance method disposing its own `this` is not a real dispose-delegation shape and
+would drag in virtual-dispatch reasoning.
@@ -479,7 +479,8 @@ left is MemberAccessExpressionSyntax m
 // text), and `owned` is AST-based — not a regex. NOTE: callers must exclude timers
 // — a *running* timer is rooted by the dispatcher regardless of who owns the field.
 static bool IsSelfOwnedSource(ExpressionSyntax left, IEventSymbol ev,
-                              SemanticModel model, HashSet<string> owned)
+                              SemanticModel model, HashSet<string> owned,
+                              ISymbol? cls)
 {
     if (left is not MemberAccessExpressionSyntax m)
         return !ev.IsStatic;   // bare event => an instance event on `this`
@@ -488,12 +489,15 @@ static bool IsSelfOwnedSource(ExpressionSyntax left, IEventSymbol ev,
     var recv = model.GetSymbolInfo(m.Expression).Symbol;
     if ((recv is IFieldSymbol or ILocalSymbol) && owned.Contains(recv.Name))
         return true;
-    // A `this`-instance get-only PROPERTY whose value the class owns (`this.Child.Event
-    // += h`, Child a `=> _owned` / `{ get; } = new()` property) is the SAME collectable
-    // self-cycle as the owned field directly — this, the owned child, and the handler
-    // are collected together. The property must resolve to a member the class constructs.
+    // A get-only PROPERTY over a member the class owns (`this.Child.Event += h`, Child a
+    // `=> _owned` / `{ get; } = new()` property) is the SAME collectable self-cycle as the
+    // owned field directly. GATED on a `this`/bare access (`Channel` / `this.Channel`):
+    // `other.Channel.Event += h` reaches ANOTHER instance's property, which may outlive
+    // this subscriber and retain the handler, so it stays flagged (Codex P2).
     return recv is IPropertySymbol { IsStatic: false } p
-           && PropertyReturnsOwnedMember(p, owned, model);
+           && m.Expression is (IdentifierNameSyntax
+                               or MemberAccessExpressionSyntax { Expression: ThisExpressionSyntax })
+           && PropertyReturnsOwnedMember(p, owned, model, cls);
 }
 
 // A GET-ONLY property whose value the class OWNS: an auto-property initialised to
@@ -506,7 +510,7 @@ static bool IsSelfOwnedSource(ExpressionSyntax left, IEventSymbol ev,
 // drop a real leak). Only the dominant owned-property shapes are recognised; anything
 // else (a computed getter, a getter returning a parameter/injected field) falls through.
 static bool PropertyReturnsOwnedMember(IPropertySymbol prop, HashSet<string> owned,
-                                       SemanticModel model)
+                                       SemanticModel model, ISymbol? cls)
 {
     if (prop.SetMethod is not null)
         return false;
@@ -528,7 +532,13 @@ static bool PropertyReturnsOwnedMember(IPropertySymbol prop, HashSet<string> own
             continue;
         var pm = model.Compilation.GetSemanticModel(pd.SyntaxTree);
         var rsym = pm.GetSymbolInfo(returned).Symbol;
-        if (rsym is IFieldSymbol or IPropertySymbol && owned.Contains(rsym.Name))
+        // The returned member must be one the ANALYZED class declares — compare the
+        // symbol's CONTAINING TYPE, not just its name, so a same-named field on another
+        // type cannot satisfy ownership (CodeRabbit). `owned` holds only this class's
+        // constructed-field names, so the name check + the containing-type check agree.
+        if (rsym is IFieldSymbol or IPropertySymbol
+            && owned.Contains(rsym.Name)
+            && (cls is null || SymbolEqualityComparer.Default.Equals(rsym.ContainingType, cls)))
             return true;
     }
     return false;
@@ -2582,7 +2592,8 @@ static bool CallReleasesReceiver(IMethodSymbol? sym, SemanticModel model)
     if (args.Count != 2
         || !args[0].RefKindKeyword.IsKind(SyntaxKind.RefKeyword)
         || !(args[1].Expression.IsKind(SyntaxKind.NullLiteralExpression)
-             || args[1].Expression.IsKind(SyntaxKind.DefaultLiteralExpression)))
+             || args[1].Expression.IsKind(SyntaxKind.DefaultLiteralExpression)
+             || args[1].Expression is DefaultExpressionSyntax))   // default(T) for a ref type is null too
         return null;
     return ThisFieldName(args[0].Expression) is { } f
            && model.GetSymbolInfo(args[0].Expression).Symbol is IFieldSymbol
@@ -3296,7 +3307,7 @@ or ImplicitObjectCreationExpressionSyntax
                 //    intent, not a leak (mined: Npgsql PoolManager's `AppDomain.CurrentDomain.
                 //    ProcessExit += (_,_) => ClearAll()` shutdown hook). A handler that captures
                 //    instance state still pins it to the process, so it stays OWN014 (Codex).
-                if (!isTimer && (IsSelfOwnedSource(a.Left, ev, model, selfOwned)
+                if (!isTimer && (IsSelfOwnedSource(a.Left, ev, model, selfOwned, clsSymbol)
                                  || IsStaticHandler(a.Right, model)
                                  || (IsProcessLifetimeAppDomainEvent(ev)
                                      && HandlerRetainsNoInstance(a.Right, model))))
 
@@ -261,10 +261,13 @@ def _load_baseline(path: str) -> list[BaselineRule]:
         if not s or s.startswith("#"):
             continue
         parts = [p.strip() for p in s.split("|")]
-        if len(parts) < 4:
+        # need all four key fields, and a NON-EMPTY message-substring: an empty substr
+        # would make `substr in message` always true — a wildcard that a typo could turn
+        # into a blanket suppressor for that file/rule (CodeRabbit). Reason keeps any `|`.
+        if len(parts) < 4 or not parts[3]:
             continue
         repo, basename, rule, substr = parts[:4]
-        reason = parts[4] if len(parts) > 4 else ""
+        reason = " | ".join(parts[4:]).strip() if len(parts) > 4 else ""
         rules.append(BaselineRule(repo, basename, rule, substr, reason))
     return rules
 
@@ -769,14 +772,18 @@ def _selftest() -> int:
     # the loader: comments/blank lines ignored, <4 fields skipped, reason optional.
     import tempfile
     with tempfile.NamedTemporaryFile("w", suffix=".txt", delete=False) as tf:
-        tf.write("# comment\n\no/r | B.cs | OWN001 | local 'b' | a reason\n"
-                 "too | few | fields\n")
+        tf.write("# comment\n\no/r | B.cs | OWN001 | local 'b' | a reason | with a pipe\n"
+                 "too | few | fields\n"
+                 "o/r | B.cs | OWN001 |  | empty substr is a wildcard — must be skipped\n")
         tf.flush()
         loaded = _load_baseline(tf.name)
-    if len(loaded) != 1 or loaded[0].reason != "a reason":
+    # the <4-field line and the empty-substring line are both skipped; reason keeps its `|`.
+    if len(loaded) != 1 or loaded[0].reason != "a reason | with a pipe":
         fails.append(f"baseline loader wrong: {loaded}")
+    if any(r.substr == "" for r in loaded):
+        fails.append("baseline loader must reject an empty message-substring (wildcard)")
 
-    total = 30
+    total = 31
     for f in fails:
         print(f"ORACLE SELFTEST FAIL: {f}")
     print(f"oracle_compare selftest: {total - len(fails)}/{total} checks passed")