Skip to content

docs(P-036): P2 — Call/Invoke lowering is profile-driven, not domain … #1589

docs(P-036): P2 — Call/Invoke lowering is profile-driven, not domain …

docs(P-036): P2 — Call/Invoke lowering is profile-driven, not domain … #1589

Triggered via push July 25, 2026 20:13
Status Success
Total duration 7m 40s
Artifacts

ci.yml

on: push
lint (ruff + mypy --strict)
15s
lint (ruff + mypy --strict)
rust (fmt + clippy + tests)
23s
rust (fmt + clippy + tests)
audit aggregation selftests
11s
audit aggregation selftests
release-workflow environment-protection predicate (fixture-driven)
5s
release-workflow environment-protection predicate (fixture-driven)
extended codegen fuzz
35s
extended codegen fuzz
golden C# compiles & runs (.NET)
27s
golden C# compiles & runs (.NET)
C# leak extractor (Roslyn) -> OwnIR -> core
6m 32s
C# leak extractor (Roslyn) -> OwnIR -> core
OwnTS (React useEffect) -> OwnIR -> core
8s
OwnTS (React useEffect) -> OwnIR -> core
OwnTS OSS true positives -> runtime leak proof (jsdom)
7s
OwnTS OSS true positives -> runtime leak proof (jsdom)
own-check repo scan (github + msbuild) + composite action
54s
own-check repo scan (github + msbuild) + composite action
own-check SARIF -> GitHub code scanning (dog-food)
41s
own-check SARIF -> GitHub code scanning (dog-food)
P-014 Tier B — external reference resolution (--ref-dir)
34s
P-014 Tier B — external reference resolution (--ref-dir)
corpus benchmark (real C# recall + specificity)
5m 42s
corpus benchmark (real C# recall + specificity)
Matrix: owen CLI (gate A) — clean install -> check -> findings
Matrix: tests
Fit to window
Zoom out
Zoom in

Annotations

20 errors and 52 warnings
own-check repo scan (github + msbuild) + composite action
singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo)
own-check repo scan (github + msbuild) + composite action
singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/CloseReleaseSample.cs#L37
IDisposable field '_xconn' (type 'FakeConnection') is never disposed — its owner 'ClosesOtherInstanceField' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/CloseReleaseSample.cs#L26
IDisposable field '_leakedConn' (type 'FakeConnection') is never disposed — its owner 'LeaksUnclosed' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppDomainShutdownSample.cs#L54
event 'SomeBus.Pinged' is subscribed (handler '(_, _) => cts.Cancel()') to a static (process-lived) event source that outlives 'NonAppDomainSubscriber'; the strong subscription promotes 'NonAppDomainSubscriber' to the source's lifetime, so it can never be collected — a region escape (leak, no release path — and being an inline lambda it has no '-=' handle, so it could never be detached)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppDomainShutdownSample.cs#L34
event 'AppDomain.CurrentDomain.ProcessExit' is subscribed (handler '(_, _) => _count++') to a static (process-lived) event source that outlives 'CapturingShutdownSubscriber'; the strong subscription promotes 'CapturingShutdownSubscriber' to the source's lifetime, so it can never be collected — a region escape (leak, no release path — and being an inline lambda it has no '-=' handle, so it could never be detached)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasDisposeSample.cs#L75
IDisposable field '_scopedLeak' (type 'CancellationTokenSource') is never disposed — its owner 'ScopedAliasNameLeak' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasDisposeSample.cs#L57
IDisposable field '_refRebound' (type 'CancellationTokenSource') is never disposed — its owner 'RefReboundAliasLeaks' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasDisposeSample.cs#L42
IDisposable field '_rebound' (type 'CancellationTokenSource') is never disposed — its owner 'ReboundAliasLeaks' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasDisposeSample.cs#L29
IDisposable field '_neverDisposed' (type 'CancellationTokenSource') is never disposed — its owner 'AliasNeverDisposes' leaks it (leak)
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L222
[DI001] singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo) [consumed by the 'CacheService' constructor at frontend/roslyn/samples/DiCaptiveSample.cs:28] [resource: DI lifetime]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L214
[DI001] singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext) [consumed by the 'EmailSender' constructor at frontend/roslyn/samples/DiCaptiveSample.cs:25] [resource: DI lifetime]
OWN001: frontend/roslyn/samples/CloseReleaseSample.cs#L37
[OWN001] IDisposable field '_xconn' (type 'FakeConnection') is never disposed — its owner 'ClosesOtherInstanceField' leaks it (leak) [resource: disposable field]
OWN001: frontend/roslyn/samples/CloseReleaseSample.cs#L26
[OWN001] IDisposable field '_leakedConn' (type 'FakeConnection') is never disposed — its owner 'LeaksUnclosed' leaks it (leak) [resource: disposable field]
OWN014: frontend/roslyn/samples/AppDomainShutdownSample.cs#L54
[OWN014] event 'SomeBus.Pinged' is subscribed (handler '(_, _) => cts.Cancel()') to a static (process-lived) event source that outlives 'NonAppDomainSubscriber'; the strong subscription promotes 'NonAppDomainSubscriber' to the source's lifetime, so it can never be collected — a region escape (leak, no release path — and being an inline lambda it has no '-=' handle, so it could never be detached) [resource: subscription token]
OWN014: frontend/roslyn/samples/AppDomainShutdownSample.cs#L34
[OWN014] event 'AppDomain.CurrentDomain.ProcessExit' is subscribed (handler '(_, _) => _count++') to a static (process-lived) event source that outlives 'CapturingShutdownSubscriber'; the strong subscription promotes 'CapturingShutdownSubscriber' to the source's lifetime, so it can never be collected — a region escape (leak, no release path — and being an inline lambda it has no '-=' handle, so it could never be detached) [resource: subscription token]
OWN001: frontend/roslyn/samples/AliasDisposeSample.cs#L75
[OWN001] IDisposable field '_scopedLeak' (type 'CancellationTokenSource') is never disposed — its owner 'ScopedAliasNameLeak' leaks it (leak) [resource: disposable field]
OWN001: frontend/roslyn/samples/AliasDisposeSample.cs#L57
[OWN001] IDisposable field '_refRebound' (type 'CancellationTokenSource') is never disposed — its owner 'RefReboundAliasLeaks' leaks it (leak) [resource: disposable field]
OWN001: frontend/roslyn/samples/AliasDisposeSample.cs#L42
[OWN001] IDisposable field '_rebound' (type 'CancellationTokenSource') is never disposed — its owner 'ReboundAliasLeaks' leaks it (leak) [resource: disposable field]
OWN001: frontend/roslyn/samples/AliasDisposeSample.cs#L29
[OWN001] IDisposable field '_neverDisposed' (type 'CancellationTokenSource') is never disposed — its owner 'AliasNeverDisposes' leaks it (leak) [resource: disposable field]
release-workflow environment-protection predicate (fixture-driven)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
OwnTS (React useEffect) -> OwnIR -> core
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
tests (py3.13)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
tests (py3.11)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
tests (py3.12)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
lint (ruff + mypy --strict)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
golden C# compiles & runs (.NET)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
P-014 Tier B — external reference resolution (--ref-dir)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
P-014 Tier B — external reference resolution (--ref-dir): frontend/roslyn/OwnSharp.Extractor/Program.cs#L5110
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
audit aggregation selftests
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
own-check SARIF -> GitHub code scanning (dog-food)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-dotnet@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
own-check SARIF -> GitHub code scanning (dog-food): frontend/roslyn/OwnSharp.Extractor/Program.cs#L5110
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
rust (fmt + clippy + tests)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
OwnTS OSS true positives -> runtime leak proof (jsdom)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
owen CLI (gate A) — clean install -> check -> findings (windows-latest)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
owen CLI (gate A) — clean install -> check -> findings (windows-latest): frontend/roslyn/OwnSharp.Extractor/Program.cs#L5110
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
owen CLI (gate A) — clean install -> check -> findings (ubuntu-latest)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
owen CLI (gate A) — clean install -> check -> findings (ubuntu-latest): frontend/roslyn/OwnSharp.Extractor/Program.cs#L5110
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
extended codegen fuzz
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppScopedSourceSample.cs#L100
event 'service.ThemeChanged' is subscribed (handler 'OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CuratedOnlyApp' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppScopedSourceSample.cs#L89
event 'themeManager.ThemeChanged' is subscribed (handler '(s, e) => counter[0]++') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'LambdaApp' alive (possible leak — and being an inline lambda it has no '-=' handle, so it could never be detached)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppScopedSourceSample.cs#L74
event 'themeManager.ThemeChanged' is subscribed (handler 'OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'NotAnApp' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppDomainShutdownSample.cs#L54
event 'SomeBus.Pinged' is subscribed (handler '(_, _) => cts.Cancel()') to a static (process-lived) event source that outlives 'NonAppDomainSubscriber'; the strong subscription promotes 'NonAppDomainSubscriber' to the source's lifetime, so it can never be collected — a region escape (leak, no release path — and being an inline lambda it has no '-=' handle, so it could never be detached)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppDomainShutdownSample.cs#L34
event 'AppDomain.CurrentDomain.ProcessExit' is subscribed (handler '(_, _) => _count++') to a static (process-lived) event source that outlives 'CapturingShutdownSubscriber'; the strong subscription promotes 'CapturingShutdownSubscriber' to the source's lifetime, so it can never be collected — a region escape (leak, no release path — and being an inline lambda it has no '-=' handle, so it could never be detached)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasDisposeSample.cs#L75
IDisposable field '_scopedLeak' (type 'CancellationTokenSource') is never disposed — its owner 'ScopedAliasNameLeak' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasDisposeSample.cs#L57
IDisposable field '_refRebound' (type 'CancellationTokenSource') is never disposed — its owner 'RefReboundAliasLeaks' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasDisposeSample.cs#L42
IDisposable field '_rebound' (type 'CancellationTokenSource') is never disposed — its owner 'ReboundAliasLeaks' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasDisposeSample.cs#L29
IDisposable field '_neverDisposed' (type 'CancellationTokenSource') is never disposed — its owner 'AliasNeverDisposes' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AssociatedObjectSourceSample.cs#L139
event 's0.Loaded' is subscribed (handler 'OnLoaded') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ReassignedLocalBehavior' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AssociatedObjectSourceSample.cs#L118
event 'panel.Loaded' is subscribed (handler 'OnLoaded') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'MixedFieldBehavior' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AssociatedObjectSourceSample.cs#L100
event 'this.AssociatedObject.Loaded' is subscribed (handler 'OnLoaded') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'NotABehavior' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AssociatedObjectSourceSample.cs#L57
event '_bus.Changed' is subscribed (handler '(s, e) => Handle()') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'TiltLikeBehavior' alive (possible leak — and being an inline lambda it has no '-=' handle, so it could never be detached)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppScopedSourceSample.cs#L137
event 'tm.ThemeChanged' is subscribed (handler 'OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ReassignApp' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppScopedSourceSample.cs#L118
event 'themeManager.ThemeChanged' is subscribed (handler '_twin!.OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'TwinApp' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppScopedSourceSample.cs#L100
event 'service.ThemeChanged' is subscribed (handler 'OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CuratedOnlyApp' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppScopedSourceSample.cs#L89
event 'themeManager.ThemeChanged' is subscribed (handler '(s, e) => counter[0]++') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'LambdaApp' alive (possible leak — and being an inline lambda it has no '-=' handle, so it could never be detached)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AppScopedSourceSample.cs#L74
event 'themeManager.ThemeChanged' is subscribed (handler 'OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'NotAnApp' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak)
OWN001: frontend/roslyn/samples/AssociatedObjectSourceSample.cs#L118
[OWN001] event 'panel.Loaded' is subscribed (handler 'OnLoaded') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'MixedFieldBehavior' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AssociatedObjectSourceSample.cs#L100
[OWN001] event 'this.AssociatedObject.Loaded' is subscribed (handler 'OnLoaded') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'NotABehavior' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AssociatedObjectSourceSample.cs#L57
[OWN001] event '_bus.Changed' is subscribed (handler '(s, e) => Handle()') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'TiltLikeBehavior' alive (possible leak — and being an inline lambda it has no '-=' handle, so it could never be detached) [resource: subscription token]
OWN001: frontend/roslyn/samples/AppScopedSourceSample.cs#L137
[OWN001] event 'tm.ThemeChanged' is subscribed (handler 'OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ReassignApp' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AppScopedSourceSample.cs#L118
[OWN001] event 'themeManager.ThemeChanged' is subscribed (handler '_twin!.OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'TwinApp' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AppScopedSourceSample.cs#L100
[OWN001] event 'service.ThemeChanged' is subscribed (handler 'OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CuratedOnlyApp' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AppScopedSourceSample.cs#L89
[OWN001] event 'themeManager.ThemeChanged' is subscribed (handler '(s, e) => counter[0]++') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'LambdaApp' alive (possible leak — and being an inline lambda it has no '-=' handle, so it could never be detached) [resource: subscription token]
OWN001: frontend/roslyn/samples/AppScopedSourceSample.cs#L74
[OWN001] event 'themeManager.ThemeChanged' is subscribed (handler 'OnTheme') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'NotAnApp' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
[OWN001] event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak) [resource: subscription token]
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/OwnSharp.Extractor/Program.cs#L5110
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
corpus benchmark (real C# recall + specificity)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
C# leak extractor (Roslyn) -> OwnIR -> core
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9, actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
C# leak extractor (Roslyn) -> OwnIR -> core: frontend/roslyn/OwnSharp.Extractor/Program.cs#L5110
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.