Skip to content

Commit d49ffa8

Browse files
authored
Merge pull request #234 from PhysShell/claude/oracle-sweep-rerun-delta
docs: verify #230/#231 precision-gap fixes against 2026-07-10 oracle sweep
2 parents b5bce52 + 5c42659 commit d49ffa8

1 file changed

Lines changed: 109 additions & 0 deletions

File tree

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Oracle sweep rerun — 2026-07-11 (verifying #230/#231 against the 2026-07-10 baseline)
2+
3+
Follow-up to [`oracle-sweep-2026-07-10.md`](oracle-sweep-2026-07-10.md) (issue
4+
#201). That sweep drafted 8 precision-gap issues (#218-#225) from real
5+
own-only findings in 5 OSS repos. Two follow-up PRs have since shipped fixes:
6+
7+
- [#230](https://github.com/PhysShell/Own.NET/pull/230) — DependencyProperty/
8+
property-changed old→new subscription-rotation recognition (issue #219).
9+
- [#231](https://github.com/PhysShell/Own.NET/pull/231) — four smaller
10+
precision gaps in one PR: `CommandManager.RequerySuggested` allowlist
11+
(#223), `using (field = new T())` release (#220), template-part
12+
local/pattern-var exemption (#222), self-detaching handler (#224).
13+
14+
This note reruns `own-check` (the real Roslyn extractor + Python core, not
15+
the CodeQL/Infer# cross-tool oracle — that side of the comparison is
16+
unaffected by these fixes) against the **same 4 repos, at the exact same
17+
pinned commits** as the 2026-07-10 sweep, on `main` at `3ca4bde` (both PRs
18+
merged), and diffs the resulting SARIF against the `own.txt` baselines kept
19+
from that sweep. Goal: confirm the fixes silence exactly the documented false
20+
positives, add no regressions, and leave every documented real bug flagged.
21+
22+
## Method
23+
24+
- Reused the exact repo clones from the 2026-07-10 run (still pinned at the
25+
same commits: MahApps.Metro `72099e3`, MaterialDesignInXamlToolkit
26+
`ef3a5ea`, AvalonEdit `ed0bd14`, ShareX `0df9ca4`) — an apples-to-apples
27+
comparison, no drift from upstream changes.
28+
- Built `OwnSharp.Extractor` fresh off `origin/main` (`3ca4bde`).
29+
- Ran the identical command the `oracle.yml` workflow uses:
30+
`scripts/own-check.sh --format sarif --severity warning -- <repo>`, with
31+
the same `OWN_EXTRA_REF_DIRS` (WindowsDesktop ref pack) materialized the
32+
same way, so framework-event resolution is on equal footing with the
33+
original run (confirmed: OWN050 unresolved-reference advisory counts are
34+
byte-for-byte identical before/after in all 4 repos — coverage didn't
35+
shift, only the fixes' targets did).
36+
- Diffed old vs new SARIF results by normalized `(file, line)` per rule ID.
37+
38+
## Headline delta
39+
40+
| repo | OWN001+OWN014 before | after | Δ | new findings introduced |
41+
|---|---:|---:|---:|---:|
42+
| MahApps.Metro | 3 | 1 | **−2** | 0 |
43+
| MaterialDesignInXamlToolkit | 23 | 19 | **−4** | 0 |
44+
| AvalonEdit | 24 (23 OWN001 + 1 OWN014) | 17 | **−7** | 0 |
45+
| ShareX | 235 | 232 | **−3** | 0 |
46+
| **total** | **285** | **269** | **−16** | **0** |
47+
48+
Zero new findings anywhere — the fixes are pure precision gains, not
49+
trade-offs. (Raw finding counts here are literal SARIF result counts, not
50+
the hand-grouped "own-only" site counts in the 2026-07-10 table, so absolute
51+
numbers differ slightly from that table; deltas are what matter.)
52+
53+
## Removed findings, mapped to the fix that closed them
54+
55+
| repo | site | issue / PR | rule |
56+
|---|---|---|---|
57+
| MahApps.Metro | `Actions/CommandTriggerAction.cs:116` | #219 / #230 (DP rotation) | OWN001 |
58+
| MahApps.Metro | `Controls/MetroWindow.cs:1448` | #222 / #231 (template-part pattern var) | OWN001 |
59+
| MaterialDesignInXamlToolkit | `SmartHint.cs:205-208` (×4) | #219 / #230 (DP rotation) | OWN001 |
60+
| AvalonEdit | `Editing/AbstractMargin.cs:99` | #219 / #230 (DP rotation) | OWN001 |
61+
| AvalonEdit | `Editing/LineNumberMargin.cs:114` | #219 / #230 (DP rotation) | OWN001 |
62+
| AvalonEdit | `Folding/FoldingMargin.cs:218` | #219 / #230 (DP rotation) | OWN001 |
63+
| AvalonEdit | `CodeCompletion/OverloadViewer.cs:58,64` | #222 / #231 (template-part local) | OWN001 |
64+
| AvalonEdit | `Search/DropDownButton.cs:78` | #224 / #231 (self-detaching handler) | OWN001 |
65+
| AvalonEdit | `Editing/ImeSupport.cs:47` (`CommandManager.RequerySuggested`) | #223 / #231 (weak-event allowlist) | **OWN014** |
66+
| ShareX | `Cryptographic/HashChecker.cs:42` | #220 / #231 (`using (field = new T())`) | OWN001 |
67+
| ShareX | `TaskEx.cs:41` | #220 / #231 | OWN001 |
68+
| ShareX | `IndexerJson.cs:35` | #220 / #231 | OWN001 |
69+
70+
By fix: rotation (#219/#230) accounts for 8 of the 16 removed findings —
71+
beating the "−6+" estimate from the original sweep note (which only
72+
individually verified 6 sites; the rerun confirms all 8 rotation sites in
73+
the baseline actually clear). The other three #231 fixes account for the
74+
remaining 8: template-part locals (3), self-detach (1), weak-event allowlist
75+
(1, on the OWN014 hard-error tier as designed — not OWN001), using-field
76+
release (3).
77+
78+
## Real bugs — confirmed still flagged
79+
80+
Every documented true positive from the 2026-07-10 triage is still present,
81+
unchanged, after the rerun:
82+
83+
- ShareX `HistoryLib/HistoryItemManager_ContextMenu.cs` cluster (48 findings
84+
— no `Dispose()` at all).
85+
- ShareX `ShapeManagerMenu.cs` cluster (the flagship `menuForm` leak,
86+
reduced to `corpus/real-world/sharex-shapemanager-menuform-leak/`).
87+
- ShareX plain `Timer`/`ImageList` fields (`ColorUserControl.cs`,
88+
`AutoCaptureForm.cs`, `UploadersConfigForm.cs`).
89+
- AvalonEdit `TextView.cs:1843,1946` (`services`, `hoverLogic` — no
90+
`Dispose()` at all).
91+
92+
## Still open (out of this fix pair's scope)
93+
94+
Findings tied to issue #221 (self-owned-source exemption too narrow —
95+
`Behavior<T>.AssociatedObject`, app-scoped subscriber, self-owned-collection-
96+
element) are untouched, as expected — #221 wasn't part of #230/#231:
97+
98+
- MahApps.Metro `Behaviors/TiltBehavior.cs:70` (the sole remaining finding).
99+
- MaterialDesignInXamlToolkit `App.xaml.cs:22`, `ListsAndGridsViewModel.cs`,
100+
`CircleWipe.cs`/`FadeWipe.cs`, and the 7 bulk-review
101+
`themeManager.ThemeChanged` sites (19 remaining findings total).
102+
103+
## Not rerun
104+
105+
ClosedXML (the clean-code control from the original sweep) wasn't included —
106+
none of its findings related to #219-#225, and it isn't part of the WPF/
107+
WinForms domain #230/#231 targeted. The CodeQL/Infer# oracle side wasn't
108+
rerun either — these fixes only change Own.NET's own emission, and the
109+
oracle comparators' output is unaffected by them.

0 commit comments

Comments
 (0)