From 7bb7912e4e504f0fa49d0b3880638dcd7c8fe7fe Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 26 Jun 2026 11:53:27 +0000
Subject: [PATCH 1/3] =?UTF-8?q?audit(xaml):=20Phase-2=20join=20=E2=80=94?=
 =?UTF-8?q?=20XAML203=20view-subscription=20leak=20(build-free)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

First slice of the XAML<->C# Phase-2 join from the design note. Links the two
fact sources by the deterministic XAML naming convention — NOT the .g.cs build
artifact — so it stays build-free (Linux CI, non-compiling solutions).

- xaml_join.py: join(xaml-facts, OwnIR) -> XAML203. A view whose x:Class
  component has an OwnIR subscription flagged released=false, wired from a
  load-lifecycle handler (Loaded/Initialized/DataContextChanged), is the
  closed-view-retained leak; anchored at the XAML site, names the C# subscription.
  released=false is authoritative (the engine already checked for -= across the
  class), so no XAML Unloaded heuristic. SARIF emit + CLI + 8-check selftest.
- xaml_facts.py: also capture x:Name (named_elements) — the join's element->field link.
- own-check.sh: add --emit-facts to persist the OwnIR facts; owncheck.py writes
  own-check.facts.json so the join has a real input in an SDK run.
- run_static.py: run the join when xaml-facts.json + own-check.facts.json are both
  present; fold xaml-join.sarif into the pipeline (+ integration selftest).
- taxonomy: XAML203 -> category 2 (subscription leak, P1).
- design note + README: document the convention-as-link decision, the first rule,
  and .g.cs/BAML as deferred build-tier ground-truth (not the mechanism).

Binding-path-hotness (XAML200/204, needs the DataContext type) is the next
increment, deliberately not guessed here.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015zoG4YNCUf7RA5r8GAXMmb
---
 .github/workflows/ci.yml             |   1 +
 audit/README.md                      |  16 +-
 audit/static/run_static.py           |  43 +++++
 audit/static/taxonomy/categories.yml |   6 +
 audit/static/tools/owncheck.py       |   8 +-
 audit/static/tools/xaml_facts.py     |  15 +-
 audit/static/tools/xaml_join.py      | 271 +++++++++++++++++++++++++++
 docs/notes/xaml-analyzer-design.md   |  20 ++
 scripts/own-check.sh                 |  16 +-
 9 files changed, 389 insertions(+), 7 deletions(-)
 create mode 100644 audit/static/tools/xaml_join.py

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d2320f3e..4db59c4e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -63,6 +63,7 @@ jobs:
           python audit/aggregate/report.py --selftest
           python audit/static/tools/xaml_check.py --selftest
           python audit/static/tools/xaml_facts.py --selftest
+          python audit/static/tools/xaml_join.py --selftest
           python audit/static/run_static.py --selftest
           python audit/runtime/ingest.py --selftest
 
diff --git a/audit/README.md b/audit/README.md
index 60b1b503..13b42600 100644
--- a/audit/README.md
+++ b/audit/README.md
@@ -49,6 +49,7 @@ audit/
       codeql.sh      # build-free runner: CodeQL build-mode=none, security-and-quality
       xaml_check.py  # build-free runner: markup-only XAML perf/lifetime pass (stdlib XML, no SDK)
       xaml_facts.py  # XAML facts extractor (resource graph + binding facts) -> xaml-facts.json (Phase-2 seam)
+      xaml_join.py   # XAML<->C# Phase-2 join: xaml-facts.json + OwnIR -> XAML203 link findings (build-free)
       roslyn_pack.ps1 # build-required runner (local Windows): NetAnalyzers/Roslynator/... 
       infersharp.sh  # build-required runner: Infer# over built binaries
     inject/          # OwnAudit.Directory.Build.props/.targets (analyzer injection, gated)
@@ -112,6 +113,7 @@ python audit/aggregate/score.py --selftest
 python audit/aggregate/report.py --selftest
 python audit/static/tools/xaml_check.py --selftest   # XAML rules + line preservation + SARIF round-trip
 python audit/static/tools/xaml_facts.py --selftest   # XAML facts: binding parser + resource graph
+python audit/static/tools/xaml_join.py --selftest    # XAML<->C# join: XAML203 view-subscription leak
 python audit/static/run_static.py --selftest   # full pipeline end-to-end on fixtures
 ```
 
@@ -136,10 +138,16 @@ python audit/static/run_static.py --selftest   # full pipeline end-to-end on fix
   covered, not NO-TOOL. Design + the full rule catalogue, phasing, and the Phase-2
   binding-path join: [`../docs/notes/xaml-analyzer-design.md`](../docs/notes/xaml-analyzer-design.md).
 - **XAML Phase-2 seam — done:** `static/tools/xaml_facts.py` emits `xaml-facts.json` (resource graph
-  + binding facts: parsed binding paths / converters / handlers + the file's `x:Class`) from the same
-  parsed tree, in an OwnIR-parallel envelope. This is the structured input the binding-path join reads
-  next to the `OwnSharp.Extractor` OwnIR facts. The join itself (Roslyn-linked XAML2xx) and Phase 3
-  (runtime correlation) remain deferred.
+  + binding facts: parsed binding paths / converters / handlers + `x:Class` + `x:Name`) from the same
+  parsed tree, in an OwnIR-parallel envelope.
+- **XAML Phase-2 join (first slice) — done:** `static/tools/xaml_join.py` links `xaml-facts.json` to the
+  OwnIR facts own-check now persists (`--emit-facts` → `own-check.facts.json`) by the deterministic XAML
+  naming convention (`x:Class`→type, handler→method) — **build-free, no `.g.cs`/build needed**. First
+  rule **XAML203** (view subscribes from a load-lifecycle handler but the OwnIR verdict is
+  `released=false` → closed view retained), anchored at the XAML site and naming the C# subscription.
+  `run_static.py` runs the join whenever both fact sources are present and folds its SARIF into the
+  pipeline. Binding-path-hotness rules (XAML200/204, need the DataContext type) and an optional `.g.cs`
+  ground-truth cross-check are documented build-tier follow-ups. Phase 3 (runtime correlation) deferred.
 - **Runtime (Phase 2) — started:** the runtime→pipeline bridge (`runtime/ingest.py`,
   CI-gated), the leak-harness scenario schema + one scenario, runtime rule mappings
   in the taxonomy (categories 2/3/4/11), and the C# leak-harness skeleton. See
diff --git a/audit/static/run_static.py b/audit/static/run_static.py
index ed3bfada..658a2fc7 100755
--- a/audit/static/run_static.py
+++ b/audit/static/run_static.py
@@ -37,6 +37,7 @@
 from report import render_html, render_json, render_markdown, render_sarif  # noqa: E402
 from score import score  # noqa: E402
 from xaml_check import run_xaml_check  # noqa: E402
+from xaml_join import run_join  # noqa: E402
 
 try:
     from oracle_compare import parse_sarif
@@ -133,6 +134,19 @@ def run(target: str, profile: dict[str, Any], out_dir: Path, target_name: str =
         if st["available"] and st["sarif"]:
             sarif_inputs.append(("xaml", st["sarif"]))
 
+    # XAML Phase-2 join (docs/notes/xaml-analyzer-design.md → "Phase 2 mechanics"):
+    # link xaml-facts.json to the OwnIR facts own-check emitted (--emit-facts) and
+    # fold the XAML2xx link findings into the same pipeline. Build-free convention
+    # join; runs only when both fact sources are present (so it no-ops without an SDK
+    # for own-check, exactly like the other opportunistic pickups below).
+    xaml_facts = out_dir / "xaml-facts.json"
+    ownir_facts = out_dir / "own-check.facts.json"
+    if xaml_facts.exists() and ownir_facts.exists():
+        st = run_join(xaml_facts, ownir_facts, out_dir)
+        tiers.append(st)
+        if st["available"] and st["sarif"]:
+            sarif_inputs.append(("xaml-join", st["sarif"]))
+
     # Pick up any build-required SARIFs already dropped here by the Windows runners.
     # Roslyn writes ONE SARIF PER PROJECT under roslyn/ (see the injected props's
     # $(MSBuildProjectName).sarif), so glob the directory; Infer# writes a single file.
@@ -335,6 +349,35 @@ def check(ok: bool, msg: str) -> None:  # total derives from the call count
         check(res3["totals"]["candidates"] >= 1,
               "a XAML107 markup finding must flow through to a scored cluster")
 
+    # The XAML Phase-2 join must wire in when both fact sources are present: a view
+    # with a Loaded handler + an OwnIR component with an unreleased subscription ->
+    # a XAML203 cluster, on Linux with no SDK (own-check's facts are pre-placed here
+    # the way the Windows/SDK run would drop them).
+    with tempfile.TemporaryDirectory() as td4:
+        out4 = Path(td4) / "out"
+        out4.mkdir(parents=True)
+        src4 = Path(td4) / "src" / "Views"
+        src4.mkdir(parents=True)
+        (src4 / "CustomerView.xaml").write_text(
+            '<UserControl xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"\n'
+            '             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"\n'
+            '             x:Class="App.Views.CustomerView" Loaded="OnLoaded" />\n',
+            encoding="utf-8")
+        # own-check's OwnIR facts (what --emit-facts would drop): CustomerView has an
+        # unreleased subscription.
+        (out4 / "own-check.facts.json").write_text(json.dumps({
+            "ownir_version": 0, "module": "App", "components": [
+                {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs",
+                 "subscriptions": [{"event": "_bus.Changed", "handler": "OnChanged",
+                                    "line": 21, "released": False}]}]}), encoding="utf-8")
+        profile4 = {"name": "t", "severity_floor": "warning",
+                    "tiers": {"build_free": ["xaml"]}}
+        res4 = run(str(Path(td4) / "src"), profile4, out4, target_name="t/p")
+        check(any(t["tool"] == "xaml-join" and t["available"] for t in res4["tiers"]),
+              "xaml-join tier must run when xaml-facts.json + own-check.facts.json exist")
+        check(res4["totals"]["clusters"] >= 1,
+              "a XAML203 join finding must flow through to a scored cluster")
+
     fails = [c for c in checks if c]
     for f in fails:
         print(f"RUN_STATIC SELFTEST FAIL: {f}")
diff --git a/audit/static/taxonomy/categories.yml b/audit/static/taxonomy/categories.yml
index 878a7d21..514da3aa 100644
--- a/audit/static/taxonomy/categories.yml
+++ b/audit/static/taxonomy/categories.yml
@@ -36,6 +36,12 @@ rules:
   OWN014: {category: 2, name: region-escape}     # escape to a longer-lived region
                                                  # (vm->App, SystemEvents) — NOT a
                                                  # generic subscription-leak
+  # XAML Phase-2 join: a view (x:Class) that subscribes from a load-lifecycle handler
+  # but never releases (OwnIR released=false). Categorized as a subscription leak so
+  # it scores as the P1 leak it is; the join already stitches the markup site to the
+  # C# subscription it names (the leak lives in the .xaml.cs, a different basename, so
+  # it does not spatially cluster with the own-check OWN001 on that file).
+  "XAML203": {category: 2, name: xaml-subscription-leak}
 
   # ── Category 5: INPC correctness ─────────────────────────────────────────────
   "INPC0*": {category: 5, name: inpc-correctness}   # PropertyChangedAnalyzers
diff --git a/audit/static/tools/owncheck.py b/audit/static/tools/owncheck.py
index 8836b547..637f91b5 100755
--- a/audit/static/tools/owncheck.py
+++ b/audit/static/tools/owncheck.py
@@ -39,6 +39,7 @@ def run_own_check(target: str, out_dir: Path, severity: str = "warning",
     unavailable toolchain."""
     out_dir.mkdir(parents=True, exist_ok=True)
     sarif_path = out_dir / "own-check.sarif"
+    facts_path = out_dir / "own-check.facts.json"
     status: dict[str, Any] = {"tool": "own-check", "tier": "build-free",
                               "available": False, "sarif": None, "reason": ""}
 
@@ -49,7 +50,10 @@ def run_own_check(target: str, out_dir: Path, severity: str = "warning",
         status["reason"] = "dotnet SDK not on PATH (needed by the C# fact extractor)"
         return status
 
-    cmd = [str(OWN_CHECK_SH), "--format", "sarif", "--severity", severity, "--", target]
+    # Persist the OwnIR facts too (--emit-facts): the XAML Phase-2 join consumes them
+    # alongside xaml-facts.json. Harmless if unused.
+    cmd = [str(OWN_CHECK_SH), "--format", "sarif", "--severity", severity,
+           "--emit-facts", str(facts_path), "--", target]
     if root is not None:
         cmd[1:1] = ["--root", str(root)]
     try:
@@ -70,6 +74,8 @@ def run_own_check(target: str, out_dir: Path, severity: str = "warning",
     except json.JSONDecodeError:
         n = 0
     status.update(available=True, sarif=str(sarif_path), findings=n)
+    if facts_path.exists():
+        status["facts"] = str(facts_path)
     return status
 
 
diff --git a/audit/static/tools/xaml_facts.py b/audit/static/tools/xaml_facts.py
index 6c31aaf0..770ebcc5 100644
--- a/audit/static/tools/xaml_facts.py
+++ b/audit/static/tools/xaml_facts.py
@@ -205,9 +205,17 @@ def document_facts(root: Node, rel_path: str) -> dict[str, Any]:
     merged: list[dict[str, Any]] = []
     bindings: list[dict[str, Any]] = []
     handlers: list[dict[str, Any]] = []
+    named: list[dict[str, Any]] = []
     converters: set[str] = set()
 
     for n in root.walk():
+        # x:Name / Name -> a generated field in the code-behind partial: a named
+        # element the code-behind can reference / subscribe / retain. The Phase-2
+        # join uses these to link XAML elements to code-behind symbols.
+        if not n.is_property_element() and n.type_name() not in ("Binding", "TemplateBinding"):
+            nm = n.attr("Name")
+            if nm:
+                named.append({"name": nm.strip(), "type": n.type_name(), "line": n.line})
         if n.local() == "MergedDictionaries" and n.is_property_element():
             for c in n.children:
                 src = c.attr("Source")
@@ -249,6 +257,7 @@ def document_facts(root: Node, rel_path: str) -> dict[str, Any]:
         "merged_dictionaries": merged,
         "bindings": bindings,
         "event_handlers": handlers,
+        "named_elements": named,
         "converters_used": sorted(converters),
     }
 
@@ -268,6 +277,7 @@ def total(field: str) -> int:
             "merged_dictionaries": total("merged_dictionaries"),
             "bindings": total("bindings"),
             "event_handlers": total("event_handlers"),
+            "named_elements": total("named_elements"),
         },
     }
 
@@ -357,7 +367,7 @@ def check(ok: bool, msg: str) -> None:
                 '    <TextBox Text="{Binding Name, Mode=TwoWay, '
                 'UpdateSourceTrigger=PropertyChanged}" />\n'
                 '    <TextBlock Text="{Binding Total, Converter={StaticResource money}}" />\n'
-                '    <Button Click="OnSave" Content="Save" />\n'
+                '    <Button x:Name="SaveButton" Click="OnSave" Content="Save" />\n'
                 '  </StackPanel>\n'
                 '</UserControl>\n')
     root = parse_xaml(doc_xaml)
@@ -379,6 +389,9 @@ def check(ok: bool, msg: str) -> None:
     check(any(h["event"] == "Click" and h["handler"] == "OnSave"
               and h["element"] == "Button" for h in d["event_handlers"]),
           f"event handler not captured: {d['event_handlers']}")
+    check(any(nm["name"] == "SaveButton" and nm["type"] == "Button"
+              for nm in d["named_elements"]),
+          f"x:Name not captured: {d['named_elements']}")
 
     # Explicit-wrapper resource block must keep its view-local scope, not "root".
     explicit = (f'<UserControl {_WPF_NS}>\n'
diff --git a/audit/static/tools/xaml_join.py b/audit/static/tools/xaml_join.py
new file mode 100644
index 00000000..12923229
--- /dev/null
+++ b/audit/static/tools/xaml_join.py
@@ -0,0 +1,271 @@
+#!/usr/bin/env python3
+"""
+Own.NET Audit — XAML ↔ C# Phase-2 join (build-free, convention-based).
+
+Phase 1 emits two fact sources independently: ``xaml-facts.json`` (this repo's XAML
+extractor) and OwnIR ``*.facts.json`` (the ``OwnSharp.Extractor`` → core pipeline,
+which already computes the acquire/release verdict per subscription). Phase 2 is the
+*join*: link a XAML pointer to its C# symbol and let the interprocedural engine's
+existing facts speak — markup and code stitched into one finding instead of two
+disconnected alerts (``docs/notes/xaml-analyzer-design.md`` → "Phase 2 mechanics").
+
+**The link is the deterministic XAML naming convention, not the build artifact.** A
+``.g.cs`` (InitializeComponent / IComponentConnector glue) would only exist after a
+successful markup-compile, which would drag the join into the build-required tier;
+but the wiring it encodes is a fixed contract we can synthesize without building:
+
+  * ``x:Class="App.Views.CustomerView"``  → the code-behind partial type
+    ``CustomerView`` (OwnIR ``components[].name``, matched on the unqualified name).
+  * ``Loaded="OnLoaded"`` / ``Click="OnSave"`` → a method on that type.
+  * ``x:Name="btn"``  → a generated field of that type.
+  * ``{Binding Qty}``  → a property on the DataContext type.
+
+So this stays build-free (Linux CI, broken solutions) like the rest of the static
+layer. A ``.g.cs`` ground-truth cross-check is a documented build-tier follow-up,
+not the mechanism.
+
+Rule implemented (first slice):
+
+  **XAML203 ViewSubscribesWithoutRelease** (cat 2 — subscription leak / region
+  escape, P1). A view whose ``x:Class`` component has a subscription the engine
+  flagged ``released: false`` AND which wires a *load-lifecycle* handler
+  (``Loaded`` / ``Initialized`` / ``DataContextChanged``) in markup: the view is the
+  lifetime owner that subscribed but never releases, so a closed view is retained.
+  ``released: false`` is authoritative — the engine already checked for a matching
+  ``-=`` anywhere in the class (code-behind included) — so no XAML ``Unloaded``
+  heuristic is needed. The finding is anchored at the XAML lifecycle attribute (where
+  a developer adds the cleanup) and names the C# subscription site, stitching markup
+  and code into one finding. It is mapped to category 2 (subscription leak) so it is
+  classified and scored as the P1 leak it is. (It does not auto-cluster with the
+  own-check ``OWN001`` on the ``.xaml.cs``: clustering keys on basename and the leak
+  lives in a different file — the join *is* the cross-source link here, carried in
+  the message rather than by spatial agreement.) Phase 3 promotes it to a measured
+  retention path via the heap walker.
+
+Binding-path-hotness rules (XAML200/204) need the DataContext type, which markup
+rarely declares statically; they are a later increment, deliberately not guessed
+here.
+
+Usage:
+  xaml_join.py --xaml-facts xaml-facts.json --ownir own-check.facts.json --out DIR
+  xaml_join.py --selftest
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+# Lifecycle events whose handler runs as the view comes up: a subscription wired from
+# here is owned by the view's lifetime, so an unreleased one leaks the closed view.
+LOAD_LIFECYCLE_EVENTS = {"Loaded", "Initialized", "DataContextChanged"}
+
+
+def _component_index(ownir: dict[str, Any]) -> dict[str, list[dict[str, Any]]]:
+    """Index OwnIR components by their unqualified type name (``CustomerView``), so a
+    fully-qualified ``x:Class`` (``App.Views.CustomerView``) links by its last
+    segment — the same basename-keyed robustness the rest of the audit uses for
+    cross-tool matching."""
+    idx: dict[str, list[dict[str, Any]]] = {}
+    for c in ownir.get("components") or []:
+        name = str(c.get("name", ""))
+        if name:
+            idx.setdefault(name.rsplit(".", 1)[-1], []).append(c)
+    return idx
+
+
+def _unreleased(component: dict[str, Any]) -> list[dict[str, Any]]:
+    """Subscriptions the engine flagged as never released (the authoritative leak
+    verdict — it already looked for a matching ``-=`` across the whole class)."""
+    return [s for s in (component.get("subscriptions") or []) if s.get("released") is False]
+
+
+def join(xaml_facts: dict[str, Any], ownir: dict[str, Any]) -> list[dict[str, Any]]:
+    """Produce XAML203 link findings from the two fact sources. Each finding is a
+    plain dict ``{rule, path, line, message, resource}`` ready for SARIF."""
+    by_name = _component_index(ownir)
+    out: list[dict[str, Any]] = []
+
+    for doc in xaml_facts.get("documents") or []:
+        x_class = doc.get("x_class")
+        if not x_class:
+            continue  # no code-behind type to link against
+        components = by_name.get(str(x_class).rsplit(".", 1)[-1])
+        if not components:
+            continue  # x:Class resolves to no OwnIR component (not analysed / no leak)
+
+        # All unreleased subscriptions across the matched component(s).
+        leaks = [s for c in components for s in _unreleased(c)]
+        if not leaks:
+            continue
+
+        load_handlers = [h for h in (doc.get("event_handlers") or [])
+                         if h.get("event") in LOAD_LIFECYCLE_EVENTS]
+        if not load_handlers:
+            continue  # the leak exists but is not wired from a view-lifecycle handler
+
+        # Anchor at the first load-lifecycle handler (where the dev adds cleanup).
+        anchor = min(load_handlers, key=lambda h: h.get("line") or 0)
+        site = ", ".join(
+            f"{s.get('event', '?')} ({c.get('file', '?')}:{s.get('line', '?')})"
+            for c in components for s in _unreleased(c))
+        out.append({
+            "rule": "XAML203",
+            "path": doc.get("file", "?"),
+            "line": anchor.get("line") or 0,
+            "message": (
+                f"view {str(x_class).rsplit('.', 1)[-1]} wires {anchor['event']}="
+                f"{anchor.get('handler', '?')} and subscribes without releasing "
+                f"[{site}]; a closed view is retained — add the matching unsubscribe "
+                "[resource: subscription token]"),
+            "resource": "subscription token",
+        })
+    return out
+
+
+def to_sarif(findings: list[dict[str, Any]]) -> dict[str, Any]:
+    """Canonical SARIF 2.1.0 (the shape parse_sarif reads), tool ``xaml-join``."""
+    results: list[dict[str, Any]] = []
+    for f in findings:
+        phys: dict[str, Any] = {"artifactLocation": {"uri": f["path"]}}
+        if f.get("line", 0) >= 1:
+            phys["region"] = {"startLine": f["line"]}
+        results.append({
+            "ruleId": f["rule"], "level": "warning",
+            "message": {"text": f["message"]},
+            "locations": [{"physicalLocation": phys}],
+        })
+    return {"version": "2.1.0",
+            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+            "runs": [{"tool": {"driver": {"name": "xaml-join",
+                                          "informationUri": "https://github.com/physshell/own.net",
+                                          "rules": []}},
+                      "results": results}]}
+
+
+def run_join(xaml_facts_path: Path, ownir_path: Path, out_dir: Path) -> dict[str, Any]:
+    """Join ``xaml-facts.json`` with an OwnIR facts file, writing
+    ``out_dir/xaml-join.sarif``. Best-effort: a missing/garbled input yields
+    ``available=False`` with a reason, never a crash."""
+    out_dir.mkdir(parents=True, exist_ok=True)
+    sarif_path = out_dir / "xaml-join.sarif"
+    status: dict[str, Any] = {"tool": "xaml-join", "tier": "build-free",
+                              "available": False, "sarif": None, "reason": ""}
+    try:
+        xaml_facts = json.loads(xaml_facts_path.read_text(encoding="utf-8"))
+        ownir = json.loads(ownir_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        status["reason"] = f"could not read join inputs: {exc}"
+        return status
+
+    findings = join(xaml_facts, ownir)
+    try:
+        sarif_path.write_text(json.dumps(to_sarif(findings), indent=2), encoding="utf-8")
+    except OSError as exc:
+        status["reason"] = f"failed to write xaml-join.sarif: {exc}"
+        return status
+    status.update(available=True, sarif=str(sarif_path), findings=len(findings))
+    return status
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description="Join XAML facts with OwnIR -> XAML2xx SARIF.")
+    ap.add_argument("--xaml-facts", help="path to xaml-facts.json")
+    ap.add_argument("--ownir", help="path to an OwnIR *.facts.json")
+    ap.add_argument("--out", default="artifacts/own-audit", help="SARIF output directory")
+    ap.add_argument("--selftest", action="store_true", help="run built-in checks and exit")
+    args = ap.parse_args(argv)
+
+    if args.selftest:
+        return _selftest()
+    if not (args.xaml_facts and args.ownir):
+        ap.error("--xaml-facts and --ownir are required (or use --selftest)")
+
+    status = run_join(Path(args.xaml_facts), Path(args.ownir), Path(args.out))
+    print(json.dumps(status, indent=2))
+    return 0 if status["available"] else 1
+
+
+# --------------------------------------------------------------------------- #
+# Selftest — embedded fact fixtures; gates on Linux CI, no .NET / no files.      #
+# --------------------------------------------------------------------------- #
+
+def _selftest() -> int:
+    checks: list[str] = []
+
+    def check(ok: bool, msg: str) -> None:
+        checks.append("" if ok else msg)
+
+    # A view that wires Loaded and whose component has an unreleased subscription.
+    xaml_facts = {"documents": [
+        {"file": "Views/CustomerView.xaml", "x_class": "App.Views.CustomerView",
+         "event_handlers": [{"element": "UserControl", "event": "Loaded",
+                             "handler": "OnLoaded", "line": 4}],
+         "bindings": [], "named_elements": []},
+        # a view with a load handler but NO matching unreleased subscription -> clean
+        {"file": "Views/CleanView.xaml", "x_class": "App.Views.CleanView",
+         "event_handlers": [{"element": "UserControl", "event": "Loaded",
+                             "handler": "OnLoaded", "line": 4}],
+         "bindings": [], "named_elements": []},
+        # a leaking component but the view wires no lifecycle handler -> not XAML203
+        {"file": "Views/NoLifecycle.xaml", "x_class": "App.Views.NoLifecycle",
+         "event_handlers": [{"element": "Button", "event": "Click",
+                             "handler": "OnClick", "line": 7}],
+         "bindings": [], "named_elements": []},
+    ]}
+    ownir = {"ownir_version": 0, "module": "App", "components": [
+        {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs", "subscriptions": [
+            {"event": "_bus.Changed", "handler": "OnChanged", "line": 21, "released": False}]},
+        {"name": "CleanView", "file": "Views/CleanView.xaml.cs", "subscriptions": [
+            {"event": "_bus.Changed", "handler": "OnChanged", "line": 21, "released": True}]},
+        {"name": "NoLifecycle", "file": "Views/NoLifecycle.xaml.cs", "subscriptions": [
+            {"event": "_bus.Changed", "handler": "OnChanged", "line": 30, "released": False}]},
+    ]}
+
+    findings = join(xaml_facts, ownir)
+    by_path = {f["path"]: f for f in findings}
+
+    check(len(findings) == 1, f"expected exactly 1 XAML203, got {len(findings)}: {findings}")
+    f = by_path.get("Views/CustomerView.xaml")
+    check(f is not None and f["rule"] == "XAML203" and f["line"] == 4,
+          f"XAML203 must anchor at the Loaded handler line (4): {f}")
+    check(f is not None and "_bus.Changed" in f["message"]
+          and "CustomerView.xaml.cs:21" in f["message"],
+          f"XAML203 message must name the C# subscription site: {f}")
+    check(f is not None and f["resource"] == "subscription token",
+          "XAML203 must carry the subscription-token resource tag (cat-2 mapping)")
+    check("Views/CleanView.xaml" not in by_path,
+          "a released subscription must NOT produce a finding")
+    check("Views/NoLifecycle.xaml" not in by_path,
+          "a leak with no view-lifecycle handler must NOT be XAML203 (own-check covers it)")
+
+    # x:Class that resolves to no component -> nothing (not analysed / no leak).
+    unknown_doc = {"documents": [{"file": "x.xaml", "x_class": "App.Unknown",
+                   "event_handlers": [{"event": "Loaded", "handler": "H", "line": 1}]}]}
+    check(join(unknown_doc, ownir) == [],
+          "an x:Class with no matching OwnIR component must yield nothing")
+
+    # SARIF round-trips through the shared parse_sarif with the anchor line intact.
+    sarif = to_sarif(findings)
+    here = Path(__file__).resolve()
+    sys.path.insert(0, str(here.parents[3] / "scripts"))
+    try:
+        from oracle_compare import parse_sarif
+        parsed = parse_sarif(json.dumps(sarif), "xaml-join", [])
+        check(len(parsed) == 1 and parsed[0].rule == "XAML203" and parsed[0].line == 4,
+              "SARIF round-trip must preserve XAML203 at line 4")
+    except ImportError:
+        check(False, "could not import scripts/oracle_compare.parse_sarif for round-trip")
+
+    fails = [c for c in checks if c]
+    for c in fails:
+        print(f"XAML_JOIN SELFTEST FAIL: {c}")
+    print(f"xaml_join selftest: {len(checks) - len(fails)}/{len(checks)} checks passed")
+    return 1 if fails else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/docs/notes/xaml-analyzer-design.md b/docs/notes/xaml-analyzer-design.md
index 2002802d..45055f8b 100644
--- a/docs/notes/xaml-analyzer-design.md
+++ b/docs/notes/xaml-analyzer-design.md
@@ -206,6 +206,26 @@ The link-fact record stays the canonical shape (so it rides the existing pipelin
 /`line` point at the **XAML** site (where a developer fixes it) and the message names the resolved C#
 symbol chain — markup and code stitched into one finding, not two disconnected alerts.
 
+**The link is the naming convention, not the `.g.cs` build artifact.** WPF's markup compiler emits a
+`.g.cs` (InitializeComponent / IComponentConnector glue, `x:Name` fields, `event += handler` wiring)
+into `obj/` — but only after a successful markup-compile, which would drag the join into the
+build-required tier, and a freshly-cloned legacy target (the kind own-check exists for) has no current
+`.g.cs`. We don't need it: the wiring it encodes is a **fixed contract** we synthesize without
+building — `x:Class`→code-behind type, `Click="OnSave"`→method, `x:Name="btn"`→field,
+`{Binding Qty}`→DataContext property. So the join stays **build-free** (Linux CI, broken solutions),
+and `.g.cs` is reserved as an *optional build-tier ground-truth cross-check* (confirm the
+convention-derived wiring, catch compiler-only edge cases like attached events / EventSetter
+connection-ids), folded in later like the other build-required tiers — never the mechanism. (BAML is
+even further down: a post-build binary, only for source-less audits — not on this roadmap.)
+
+**First slice built.** `audit/static/tools/xaml_join.py` implements **XAML203**: a view whose
+`x:Class` component has an OwnIR subscription the engine flagged `released=false`, wired from a
+load-lifecycle handler (`Loaded`/`Initialized`/`DataContextChanged`) — the closed-view-retained leak,
+anchored at the XAML site and naming the C# subscription. own-check persists its OwnIR facts via a new
+`--emit-facts`, and `run_static.py` runs the join whenever `xaml-facts.json` + `own-check.facts.json`
+are both present, folding the result into the pipeline. Binding-path-hotness (XAML200/204) needs the
+DataContext type — rarely static in markup — so it is the next increment, deliberately not guessed.
+
 **The Phase-1 → Phase-2 seam is built.** The markup pass now emits a structured fact document
 alongside its SARIF — `audit/static/tools/xaml_facts.py` writes `xaml-facts.json` from the *same*
 parsed tree (no second parser), in an envelope that mirrors OwnIR's `*.facts.json`
diff --git a/scripts/own-check.sh b/scripts/own-check.sh
index 44875089..d92191e4 100755
--- a/scripts/own-check.sh
+++ b/scripts/own-check.sh
@@ -13,7 +13,10 @@
 # Usage:
 #   scripts/own-check.sh [--format human|github|msbuild|sarif] [--severity error|warning]
 #                        [--fail-on-finding] [--legacy] [--stats] [--body-throw-edges]
-#                        [--root <own.net checkout>] [--] <path|file> [more ...]
+#                        [--emit-facts <path>] [--root <own.net checkout>] [--] <path|file> [more ...]
+#
+# --emit-facts copies the OwnIR facts the extractor produced to <path> (the audit's
+# XAML Phase-2 join consumes them alongside xaml-facts.json); the verdict is unchanged.
 #
 # Defaults: --format human, --severity error, scans ".", does not fail the shell
 # on findings, --root is the repo this script lives in. --severity picks how a
@@ -38,6 +41,7 @@ fail_on_finding=0
 legacy=0
 stats=0
 body_throw_edges=0
+emit_facts=""
 paths=()
 
 while [[ $# -gt 0 ]]; do
@@ -51,6 +55,9 @@ while [[ $# -gt 0 ]]; do
     --severity)
       [[ $# -ge 2 ]] || { echo "own-check: --severity requires a value" >&2; exit 2; }
       severity="$2"; shift 2 ;;
+    --emit-facts)
+      [[ $# -ge 2 ]] || { echo "own-check: --emit-facts requires a value" >&2; exit 2; }
+      emit_facts="$2"; shift 2 ;;
     --fail-on-finding) fail_on_finding=1; shift ;;
     --legacy)          legacy=1; shift ;;
     --stats)           stats=1; shift ;;
@@ -85,6 +92,13 @@ extractor_args=("${paths[@]}" -o "$facts")
 [[ "$body_throw_edges" -eq 1 ]] && extractor_args+=(--body-throw-edges)
 dotnet run --project "$extractor" -- "${extractor_args[@]}" 1>&2
 
+# Optional: persist the OwnIR facts (the audit's XAML Phase-2 join consumes them
+# alongside xaml-facts.json). The verdict still comes from stage 2; this is just a
+# copy of the intermediate the extractor already produced.
+if [[ -n "$emit_facts" ]]; then
+  cp "$facts" "$emit_facts"
+fi
+
 # Stage 2: the one checker produces the verdict at the C# location.
 set +e
 PYTHONPATH="$root" python -m ownlang ownir "$facts" --format "$format" --severity "$severity"

From a9403261017d00f4cd76d008c3c4a260b888ec9d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 26 Jun 2026 12:01:05 +0000
Subject: [PATCH 2/3] =?UTF-8?q?audit(xaml):=20join=20=E2=80=94=20filter=20?=
 =?UTF-8?q?to=20event=20subscriptions=20+=20disambiguate=20same-name=20vie?=
 =?UTF-8?q?ws=20(Codex)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two correctness fixes from the Codex review on PR #117:

- XAML203 now fires only on event-subscription records. OwnIR's
  components[].subscriptions is an umbrella list that also carries timer /
  IDisposable / pool leaks tagged via `resource`; _unreleased previously treated
  all released=false entries as event subscriptions, mislabeling e.g. an
  unreleased DispatcherTimer as a cat-2 [resource: subscription token] leak.
  Restricted to subscription-family resources (untagged += or subscribe/
  subscription token); timer/disposable/pool stay own-check's cat-3/1.
- Same-simple-name views are disambiguated by code-behind path. The component
  index keys on the unqualified type name, so Admin.CustomerView and
  Sales.CustomerView collided and a leak in one could land XAML203 on the other's
  XAML. _linked_components now requires code-behind-path correspondence
  (segment-aware suffix match of the .xaml stem vs the .xaml.cs/.cs stem) when the
  simple name is ambiguous, and links nothing rather than cross-link.

Selftest grows to 11 checks (timer-not-XAML203; Sales leak lands on Sales XAML,
never Admin's).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015zoG4YNCUf7RA5r8GAXMmb
---
 audit/static/tools/xaml_join.py | 98 ++++++++++++++++++++++++++++++---
 1 file changed, 89 insertions(+), 9 deletions(-)

diff --git a/audit/static/tools/xaml_join.py b/audit/static/tools/xaml_join.py
index 12923229..044ca85d 100644
--- a/audit/static/tools/xaml_join.py
+++ b/audit/static/tools/xaml_join.py
@@ -63,12 +63,20 @@
 # here is owned by the view's lifetime, so an unreleased one leaks the closed view.
 LOAD_LIFECYCLE_EVENTS = {"Loaded", "Initialized", "DataContextChanged"}
 
+# OwnIR's components[].subscriptions is an UMBRELLA list: an untagged entry is a plain
+# event `+=` subscription, but the same list also carries timer / IDisposable / pool
+# leaks tagged via `resource`. XAML203 is specifically a category-2 *event subscription*
+# leak, so it must only fire on subscription-family records — a tagged timer/disposable
+# leak is a different category (3 / 1) already covered by own-check on the .cs.
+SUBSCRIPTION_RESOURCES = {None, "", "subscribe", "subscription", "subscription token", "event"}
+
 
 def _component_index(ownir: dict[str, Any]) -> dict[str, list[dict[str, Any]]]:
     """Index OwnIR components by their unqualified type name (``CustomerView``), so a
     fully-qualified ``x:Class`` (``App.Views.CustomerView``) links by its last
     segment — the same basename-keyed robustness the rest of the audit uses for
-    cross-tool matching."""
+    cross-tool matching. Same-name collisions are disambiguated by code-behind path
+    in ``_linked_components`` (a name index can hold several entries)."""
     idx: dict[str, list[dict[str, Any]]] = {}
     for c in ownir.get("components") or []:
         name = str(c.get("name", ""))
@@ -77,10 +85,51 @@ def _component_index(ownir: dict[str, Any]) -> dict[str, list[dict[str, Any]]]:
     return idx
 
 
+def _stem(path: str, suffixes: tuple[str, ...]) -> str:
+    """``path`` with the first matching suffix stripped, forward-slashed."""
+    p = str(path).replace("\\", "/")
+    for suf in suffixes:
+        if p.endswith(suf):
+            return p[: -len(suf)]
+    return p
+
+
+def _path_corresponds(xaml_file: str, component_file: str) -> bool:
+    """True if an OwnIR component's source file is the code-behind of this XAML — its
+    path stem (``Views/Admin/CustomerView`` after stripping ``.xaml.cs``/``.cs``)
+    matches the XAML's stem on a path-segment boundary. Suffix match tolerates the
+    prefix differences between how the two tools report paths."""
+    xs = _stem(xaml_file, (".axaml", ".xaml"))
+    cs = _stem(component_file, (".xaml.cs", ".axaml.cs", ".g.cs", ".g.i.cs", ".cs"))
+    if not xs or not cs:
+        return False
+    longer, shorter = (xs, cs) if len(xs) >= len(cs) else (cs, xs)
+    return longer == shorter or longer.endswith("/" + shorter)
+
+
+def _linked_components(doc: dict[str, Any],
+                       by_name: dict[str, list[dict[str, Any]]]) -> list[dict[str, Any]]:
+    """The OwnIR component(s) that are this view's code-behind. A unique simple-name
+    match links directly; when several types share the simple name (``Admin.CustomerView``
+    vs ``Sales.CustomerView``), require code-behind-path correspondence so a leak in
+    one view never lands on the other's XAML. If none correspond, link nothing rather
+    than cross-link."""
+    x_class = doc.get("x_class")
+    if not x_class:
+        return []
+    cands = by_name.get(str(x_class).rsplit(".", 1)[-1], [])
+    if len(cands) <= 1:
+        return cands
+    return [c for c in cands if _path_corresponds(str(doc.get("file", "")), str(c.get("file", "")))]
+
+
 def _unreleased(component: dict[str, Any]) -> list[dict[str, Any]]:
-    """Subscriptions the engine flagged as never released (the authoritative leak
-    verdict — it already looked for a matching ``-=`` across the whole class)."""
-    return [s for s in (component.get("subscriptions") or []) if s.get("released") is False]
+    """Event subscriptions the engine flagged as never released (the authoritative
+    leak verdict — it already looked for a matching ``-=`` across the whole class),
+    excluding the non-subscription resource leaks (timer / disposable / pool) that
+    share the OwnIR subscriptions list."""
+    return [s for s in (component.get("subscriptions") or [])
+            if s.get("released") is False and s.get("resource") in SUBSCRIPTION_RESOURCES]
 
 
 def join(xaml_facts: dict[str, Any], ownir: dict[str, Any]) -> list[dict[str, Any]]:
@@ -93,9 +142,9 @@ def join(xaml_facts: dict[str, Any], ownir: dict[str, Any]) -> list[dict[str, An
         x_class = doc.get("x_class")
         if not x_class:
             continue  # no code-behind type to link against
-        components = by_name.get(str(x_class).rsplit(".", 1)[-1])
+        components = _linked_components(doc, by_name)
         if not components:
-            continue  # x:Class resolves to no OwnIR component (not analysed / no leak)
+            continue  # x:Class resolves to no (unambiguous) OwnIR component
 
         # All unreleased subscriptions across the matched component(s).
         leaks = [s for c in components for s in _unreleased(c)]
@@ -215,6 +264,20 @@ def check(ok: bool, msg: str) -> None:
          "event_handlers": [{"element": "Button", "event": "Click",
                              "handler": "OnClick", "line": 7}],
          "bindings": [], "named_elements": []},
+        # a view whose component's unreleased record is a TIMER, not an event
+        # subscription -> NOT XAML203 (own-check covers timer leaks at cat 3).
+        {"file": "Views/TimerView.xaml", "x_class": "App.Views.TimerView",
+         "event_handlers": [{"element": "UserControl", "event": "Loaded",
+                             "handler": "OnLoaded", "line": 4}],
+         "bindings": [], "named_elements": []},
+        # two views share the simple name OrderView in different namespaces/folders;
+        # the leak is in Sales, so it must land on Sales's XAML, never Admin's.
+        {"file": "Views/Admin/OrderView.xaml", "x_class": "Admin.OrderView",
+         "event_handlers": [{"event": "Loaded", "handler": "OnLoaded", "line": 4}],
+         "bindings": [], "named_elements": []},
+        {"file": "Views/Sales/OrderView.xaml", "x_class": "Sales.OrderView",
+         "event_handlers": [{"event": "Loaded", "handler": "OnLoaded", "line": 4}],
+         "bindings": [], "named_elements": []},
     ]}
     ownir = {"ownir_version": 0, "module": "App", "components": [
         {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs", "subscriptions": [
@@ -223,12 +286,19 @@ def check(ok: bool, msg: str) -> None:
             {"event": "_bus.Changed", "handler": "OnChanged", "line": 21, "released": True}]},
         {"name": "NoLifecycle", "file": "Views/NoLifecycle.xaml.cs", "subscriptions": [
             {"event": "_bus.Changed", "handler": "OnChanged", "line": 30, "released": False}]},
+        {"name": "TimerView", "file": "Views/TimerView.xaml.cs", "subscriptions": [
+            {"event": "_timer.Tick", "handler": "OnTick", "line": 18,
+             "released": False, "resource": "timer"}]},
+        {"name": "OrderView", "file": "Views/Admin/OrderView.xaml.cs", "subscriptions": [
+            {"event": "_bus.Changed", "handler": "OnChanged", "line": 21, "released": True}]},
+        {"name": "OrderView", "file": "Views/Sales/OrderView.xaml.cs", "subscriptions": [
+            {"event": "_bus.Changed", "handler": "OnChanged", "line": 21, "released": False}]},
     ]}
 
     findings = join(xaml_facts, ownir)
     by_path = {f["path"]: f for f in findings}
 
-    check(len(findings) == 1, f"expected exactly 1 XAML203, got {len(findings)}: {findings}")
+    check(len(findings) == 2, f"expected exactly 2 XAML203, got {len(findings)}: {findings}")
     f = by_path.get("Views/CustomerView.xaml")
     check(f is not None and f["rule"] == "XAML203" and f["line"] == 4,
           f"XAML203 must anchor at the Loaded handler line (4): {f}")
@@ -241,6 +311,14 @@ def check(ok: bool, msg: str) -> None:
           "a released subscription must NOT produce a finding")
     check("Views/NoLifecycle.xaml" not in by_path,
           "a leak with no view-lifecycle handler must NOT be XAML203 (own-check covers it)")
+    check("Views/TimerView.xaml" not in by_path,
+          "an unreleased TIMER (not an event subscription) must NOT be a cat-2 XAML203")
+    # same-name disambiguation: the Sales leak lands on Sales's XAML, not Admin's.
+    check("Views/Admin/OrderView.xaml" not in by_path,
+          "a leak in Sales.OrderView must NOT cross-link to Admin.OrderView's XAML")
+    so = by_path.get("Views/Sales/OrderView.xaml")
+    check(so is not None and "Sales/OrderView.xaml.cs:21" in so["message"],
+          f"XAML203 must land on Sales's XAML and name Sales's code-behind: {so}")
 
     # x:Class that resolves to no component -> nothing (not analysed / no leak).
     unknown_doc = {"documents": [{"file": "x.xaml", "x_class": "App.Unknown",
@@ -255,8 +333,10 @@ def check(ok: bool, msg: str) -> None:
     try:
         from oracle_compare import parse_sarif
         parsed = parse_sarif(json.dumps(sarif), "xaml-join", [])
-        check(len(parsed) == 1 and parsed[0].rule == "XAML203" and parsed[0].line == 4,
-              "SARIF round-trip must preserve XAML203 at line 4")
+        cust = next((p for p in parsed if p.path.endswith("CustomerView.xaml")), None)
+        check(len(parsed) == len(findings) and cust is not None
+              and cust.rule == "XAML203" and cust.line == 4,
+              "SARIF round-trip must preserve every XAML203 with its anchor line (4)")
     except ImportError:
         check(False, "could not import scripts/oracle_compare.parse_sarif for round-trip")
 

From d41fc655b809d7db01d035da8fe36002e4b793fa Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 26 Jun 2026 12:40:30 +0000
Subject: [PATCH 3/3] =?UTF-8?q?audit(xaml):=20join=20robustness=20?=
 =?UTF-8?q?=E2=80=94=20capture=20leaks,=20freshness=20gate,=20path-check,?=
 =?UTF-8?q?=20stale=20cleanup?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round-two review fixes (Codex + CodeRabbit) on the Phase-2 join:

- xaml_join: include `resource: "capture"` in the XAML203 filter. capture is a
  static/process-lived event subscription that retains the subscriber (the OWN014
  region-escape case) — exactly the closed-view-retained leak XAML203 targets —
  so the prior allow-list wrongly excluded it. (Codex)
- xaml_join: path-check the unique simple-name match too. The name index drops the
  namespace, so a lone basename hit could cross-link App.Views.CustomerView.xaml to
  an unrelated Legacy.CustomerView.cs. _linked_components now path-checks every
  candidate and only falls back to a lone match with no file metadata. (CodeRabbit)
- run_static: gate the join on the fact files THIS run produced (the statuses'
  `facts` paths), not bare existence — a re-run into an existing --out, or a profile
  without xaml/own-check (or no SDK), must not join a previous target's stale facts.
  + selftest: join runs only when both producers ran this invocation; a stale
  own-check.facts.json on disk is NOT joined. (Codex)
- owncheck: clear own-check.facts.json up front so a failed/unavailable run leaves
  no stale facts behind (own-check.sh writes it only on success). (CodeRabbit)

Selftests: xaml_join 13, run_static 22.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015zoG4YNCUf7RA5r8GAXMmb
---
 audit/static/run_static.py      | 83 ++++++++++++++++++++++++---------
 audit/static/tools/owncheck.py  |  4 ++
 audit/static/tools/xaml_join.py | 55 ++++++++++++++++------
 3 files changed, 107 insertions(+), 35 deletions(-)

diff --git a/audit/static/run_static.py b/audit/static/run_static.py
index 658a2fc7..be956c6c 100755
--- a/audit/static/run_static.py
+++ b/audit/static/run_static.py
@@ -115,11 +115,14 @@ def run(target: str, profile: dict[str, Any], out_dir: Path, target_name: str =
 
     tiers: list[dict[str, Any]] = []
     sarif_inputs: list[tuple[str, str]] = []
+    ownir_facts: str | None = None   # OwnIR facts produced by own-check THIS run
+    xaml_facts: str | None = None    # xaml-facts.json produced by the xaml pass THIS run
     if "own-check" in build_free:
         st = run_own_check(target, out_dir, severity)
         tiers.append(st)
         if st["available"] and st["sarif"]:
             sarif_inputs.append(("own-check", st["sarif"]))
+        ownir_facts = st.get("facts")
     if "codeql" in build_free:
         st = _run_codeql(target, out_dir)
         tiers.append(st)
@@ -133,16 +136,17 @@ def run(target: str, profile: dict[str, Any], out_dir: Path, target_name: str =
         tiers.append(st)
         if st["available"] and st["sarif"]:
             sarif_inputs.append(("xaml", st["sarif"]))
+        xaml_facts = st.get("facts")
 
     # XAML Phase-2 join (docs/notes/xaml-analyzer-design.md → "Phase 2 mechanics"):
     # link xaml-facts.json to the OwnIR facts own-check emitted (--emit-facts) and
-    # fold the XAML2xx link findings into the same pipeline. Build-free convention
-    # join; runs only when both fact sources are present (so it no-ops without an SDK
-    # for own-check, exactly like the other opportunistic pickups below).
-    xaml_facts = out_dir / "xaml-facts.json"
-    ownir_facts = out_dir / "own-check.facts.json"
-    if xaml_facts.exists() and ownir_facts.exists():
-        st = run_join(xaml_facts, ownir_facts, out_dir)
+    # fold the XAML2xx link findings into the same pipeline. Gate on the fact files
+    # THIS run produced (the statuses' `facts` paths), never on bare existence — a
+    # re-run into an existing --out, or a profile without xaml/own-check (or no SDK),
+    # must not join a previous target's stale facts.
+    if (xaml_facts and Path(xaml_facts).exists()
+            and ownir_facts and Path(ownir_facts).exists()):
+        st = run_join(Path(xaml_facts), Path(ownir_facts), out_dir)
         tiers.append(st)
         if st["available"] and st["sarif"]:
             sarif_inputs.append(("xaml-join", st["sarif"]))
@@ -349,13 +353,27 @@ def check(ok: bool, msg: str) -> None:  # total derives from the call count
         check(res3["totals"]["candidates"] >= 1,
               "a XAML107 markup finding must flow through to a scored cluster")
 
-    # The XAML Phase-2 join must wire in when both fact sources are present: a view
-    # with a Loaded handler + an OwnIR component with an unreleased subscription ->
-    # a XAML203 cluster, on Linux with no SDK (own-check's facts are pre-placed here
-    # the way the Windows/SDK run would drop them).
+    # The XAML Phase-2 join must wire in when BOTH fact sources are produced THIS run:
+    # a view with a Loaded handler + an OwnIR component with an unreleased subscription
+    # -> a XAML203 cluster. own-check needs an SDK we don't have on Linux CI, so stub it
+    # to drop fresh OwnIR facts the way an --emit-facts run would (this also exercises
+    # the freshness gate: the join keys off the status's `facts` path, not bare
+    # existence).
+    _self = sys.modules[__name__]  # the running module (own-check is a module global)
+
+    def _fake_own_check(target_, out_dir_, severity_, root=None):
+        facts = Path(out_dir_) / "own-check.facts.json"
+        facts.write_text(json.dumps({"ownir_version": 0, "module": "App", "components": [
+            {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs", "subscriptions": [
+                {"event": "_bus.Changed", "handler": "OnChanged", "line": 21,
+                 "released": False}]}]}), encoding="utf-8")
+        sarif = Path(out_dir_) / "own-check.sarif"
+        sarif.write_text('{"version":"2.1.0","runs":[{"results":[]}]}', encoding="utf-8")
+        return {"tool": "own-check", "tier": "build-free", "available": True,
+                "sarif": str(sarif), "facts": str(facts), "findings": 0, "reason": ""}
+
     with tempfile.TemporaryDirectory() as td4:
         out4 = Path(td4) / "out"
-        out4.mkdir(parents=True)
         src4 = Path(td4) / "src" / "Views"
         src4.mkdir(parents=True)
         (src4 / "CustomerView.xaml").write_text(
@@ -363,21 +381,42 @@ def check(ok: bool, msg: str) -> None:  # total derives from the call count
             '             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"\n'
             '             x:Class="App.Views.CustomerView" Loaded="OnLoaded" />\n',
             encoding="utf-8")
-        # own-check's OwnIR facts (what --emit-facts would drop): CustomerView has an
-        # unreleased subscription.
-        (out4 / "own-check.facts.json").write_text(json.dumps({
-            "ownir_version": 0, "module": "App", "components": [
-                {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs",
-                 "subscriptions": [{"event": "_bus.Changed", "handler": "OnChanged",
-                                    "line": 21, "released": False}]}]}), encoding="utf-8")
         profile4 = {"name": "t", "severity_floor": "warning",
-                    "tiers": {"build_free": ["xaml"]}}
-        res4 = run(str(Path(td4) / "src"), profile4, out4, target_name="t/p")
+                    "tiers": {"build_free": ["own-check", "xaml"]}}
+        real_own_check = _self.run_own_check
+        _self.run_own_check = _fake_own_check
+        try:
+            res4 = run(str(Path(td4) / "src"), profile4, out4, target_name="t/p")
+        finally:
+            _self.run_own_check = real_own_check
         check(any(t["tool"] == "xaml-join" and t["available"] for t in res4["tiers"]),
-              "xaml-join tier must run when xaml-facts.json + own-check.facts.json exist")
+              "xaml-join tier must run when this run produced both fact sources")
         check(res4["totals"]["clusters"] >= 1,
               "a XAML203 join finding must flow through to a scored cluster")
 
+    # The join must NOT run on stale facts: a re-run with own-check NOT a producer this
+    # time (and no SDK) must skip the join even though own-check.facts.json is on disk.
+    with tempfile.TemporaryDirectory() as td5:
+        out5 = Path(td5) / "out"
+        out5.mkdir(parents=True)
+        src5 = Path(td5) / "src" / "Views"
+        src5.mkdir(parents=True)
+        (src5 / "CustomerView.xaml").write_text(
+            '<UserControl xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"\n'
+            '             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"\n'
+            '             x:Class="App.Views.CustomerView" Loaded="OnLoaded" />\n',
+            encoding="utf-8")
+        (out5 / "own-check.facts.json").write_text(json.dumps({
+            "ownir_version": 0, "module": "Stale", "components": [
+                {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs",
+                 "subscriptions": [{"event": "_bus.Changed", "handler": "OnChanged",
+                                    "line": 21, "released": False}]}]}), encoding="utf-8")
+        res5 = run(str(Path(td5) / "src"),
+                   {"name": "t", "severity_floor": "warning", "tiers": {"build_free": ["xaml"]}},
+                   out5, target_name="t/p")
+        check(not any(t["tool"] == "xaml-join" for t in res5["tiers"]),
+              "xaml-join must NOT run on a stale own-check.facts.json this run did not produce")
+
     fails = [c for c in checks if c]
     for f in fails:
         print(f"RUN_STATIC SELFTEST FAIL: {f}")
diff --git a/audit/static/tools/owncheck.py b/audit/static/tools/owncheck.py
index 637f91b5..c8b80199 100755
--- a/audit/static/tools/owncheck.py
+++ b/audit/static/tools/owncheck.py
@@ -40,6 +40,10 @@ def run_own_check(target: str, out_dir: Path, severity: str = "warning",
     out_dir.mkdir(parents=True, exist_ok=True)
     sarif_path = out_dir / "own-check.sarif"
     facts_path = out_dir / "own-check.facts.json"
+    # Clear any prior run's facts up front: own-check.sh writes this fixed path only on
+    # a successful extraction, so after a failed/unavailable run the file is simply
+    # absent — the XAML join can never pick up stale facts from another target/commit.
+    facts_path.unlink(missing_ok=True)
     status: dict[str, Any] = {"tool": "own-check", "tier": "build-free",
                               "available": False, "sarif": None, "reason": ""}
 
diff --git a/audit/static/tools/xaml_join.py b/audit/static/tools/xaml_join.py
index 044ca85d..d3e26ed8 100644
--- a/audit/static/tools/xaml_join.py
+++ b/audit/static/tools/xaml_join.py
@@ -65,10 +65,14 @@
 
 # OwnIR's components[].subscriptions is an UMBRELLA list: an untagged entry is a plain
 # event `+=` subscription, but the same list also carries timer / IDisposable / pool
-# leaks tagged via `resource`. XAML203 is specifically a category-2 *event subscription*
-# leak, so it must only fire on subscription-family records — a tagged timer/disposable
-# leak is a different category (3 / 1) already covered by own-check on the .cs.
-SUBSCRIPTION_RESOURCES = {None, "", "subscribe", "subscription", "subscription token", "event"}
+# leaks tagged via `resource`. XAML203 is specifically the category-2 *event
+# subscription leak / region escape* lane, so it fires on subscription-family records
+# — including `capture` (a static/process-lived event subscription that retains the
+# subscriber, the OWN014 region-escape case, which is exactly a closed-view-retained
+# leak) — but NOT timer/disposable/pool, which are other categories (3 / 1) already
+# covered by own-check on the .cs.
+SUBSCRIPTION_RESOURCES = {None, "", "subscribe", "subscription", "subscription token",
+                          "event", "capture"}
 
 
 def _component_index(ownir: dict[str, Any]) -> dict[str, list[dict[str, Any]]]:
@@ -109,18 +113,22 @@ def _path_corresponds(xaml_file: str, component_file: str) -> bool:
 
 def _linked_components(doc: dict[str, Any],
                        by_name: dict[str, list[dict[str, Any]]]) -> list[dict[str, Any]]:
-    """The OwnIR component(s) that are this view's code-behind. A unique simple-name
-    match links directly; when several types share the simple name (``Admin.CustomerView``
-    vs ``Sales.CustomerView``), require code-behind-path correspondence so a leak in
-    one view never lands on the other's XAML. If none correspond, link nothing rather
-    than cross-link."""
+    """The OwnIR component(s) that are this view's code-behind, matched by
+    code-behind-path correspondence. The simple-name index drops the namespace, so a
+    *unique* basename hit can still be the wrong type (``App.Views.CustomerView`` vs an
+    unrelated ``Legacy.CustomerView``); every candidate — single or not — is therefore
+    path-checked against the XAML's file, and a non-corresponding match links nothing
+    rather than cross-link. The only fallback is a lone candidate with no file metadata
+    to check against (best effort)."""
     x_class = doc.get("x_class")
     if not x_class:
         return []
     cands = by_name.get(str(x_class).rsplit(".", 1)[-1], [])
-    if len(cands) <= 1:
-        return cands
-    return [c for c in cands if _path_corresponds(str(doc.get("file", "")), str(c.get("file", "")))]
+    matches = [c for c in cands
+               if _path_corresponds(str(doc.get("file", "")), str(c.get("file", "")))]
+    if matches:
+        return matches
+    return cands if len(cands) == 1 and not cands[0].get("file") else []
 
 
 def _unreleased(component: dict[str, Any]) -> list[dict[str, Any]]:
@@ -278,6 +286,11 @@ def check(ok: bool, msg: str) -> None:
         {"file": "Views/Sales/OrderView.xaml", "x_class": "Sales.OrderView",
          "event_handlers": [{"event": "Loaded", "handler": "OnLoaded", "line": 4}],
          "bindings": [], "named_elements": []},
+        # a view that subscribes to a static/process-lived event (resource: capture,
+        # the OWN014 region-escape case) without release -> IS a XAML203.
+        {"file": "Views/CaptureView.xaml", "x_class": "App.Views.CaptureView",
+         "event_handlers": [{"event": "Loaded", "handler": "OnLoaded", "line": 4}],
+         "bindings": [], "named_elements": []},
     ]}
     ownir = {"ownir_version": 0, "module": "App", "components": [
         {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs", "subscriptions": [
@@ -293,12 +306,17 @@ def check(ok: bool, msg: str) -> None:
             {"event": "_bus.Changed", "handler": "OnChanged", "line": 21, "released": True}]},
         {"name": "OrderView", "file": "Views/Sales/OrderView.xaml.cs", "subscriptions": [
             {"event": "_bus.Changed", "handler": "OnChanged", "line": 21, "released": False}]},
+        {"name": "CaptureView", "file": "Views/CaptureView.xaml.cs", "subscriptions": [
+            {"event": "AppDomain.UnhandledException", "handler": "OnErr", "line": 14,
+             "released": False, "resource": "capture"}]},
     ]}
 
     findings = join(xaml_facts, ownir)
     by_path = {f["path"]: f for f in findings}
 
-    check(len(findings) == 2, f"expected exactly 2 XAML203, got {len(findings)}: {findings}")
+    check(len(findings) == 3, f"expected exactly 3 XAML203, got {len(findings)}: {findings}")
+    check("Views/CaptureView.xaml" in by_path,
+          "a 'capture' (region-escape) subscription must be a XAML203")
     f = by_path.get("Views/CustomerView.xaml")
     check(f is not None and f["rule"] == "XAML203" and f["line"] == 4,
           f"XAML203 must anchor at the Loaded handler line (4): {f}")
@@ -326,6 +344,17 @@ def check(ok: bool, msg: str) -> None:
     check(join(unknown_doc, ownir) == [],
           "an x:Class with no matching OwnIR component must yield nothing")
 
+    # a UNIQUE basename match whose code-behind path does not correspond is the wrong
+    # namespace's class -> must NOT cross-link (path-checked even when unique).
+    wrong_ns = {"documents": [{"file": "Features/Billing/CustomerView.xaml",
+                "x_class": "Billing.CustomerView",
+                "event_handlers": [{"event": "Loaded", "handler": "OnLoaded", "line": 4}]}]}
+    other = {"ownir_version": 0, "components": [
+        {"name": "CustomerView", "file": "Legacy/CustomerView.cs", "subscriptions": [
+            {"event": "_bus.Changed", "handler": "OnChanged", "line": 9, "released": False}]}]}
+    check(join(wrong_ns, other) == [],
+          "a unique basename match with a non-corresponding code-behind path must not cross-link")
+
     # SARIF round-trips through the shared parse_sarif with the anchor line intact.
     sarif = to_sarif(findings)
     here = Path(__file__).resolve()