audit(xaml): join — anchor XAML203 on code-behind to dedup with OWN001

[PhysShell]

A correctness/triage fix for the Phase-2 join shipped in #117.

The bug: XAML203 double-reports an own-check leak

XAML203 anchored its finding on the .xaml, while own-check's OWN001 for the same unreleased subscription anchors on the .xaml.cs. The aggregator clusters by basename, so CustomerView.xaml and CustomerView.xaml.cs never merged — the one leak surfaced as two P1 findings.

Confirmed via the aggregator:

TOTALS: {'clusters': 2, 'high_confidence': 0, 'candidates': 2}
  [P1 candidate] xaml-subscription-leak  @ Views/CustomerView.xaml      tools=['xaml-join']
  [P1 candidate] subscription-leak       @ Views/CustomerView.xaml.cs   tools=['own-check']

The fix: anchor on the code-behind → cluster, don't duplicate

XAML203 always derives from the same OwnIR released=false record that own-check turns into OWN001 (no own-check facts → no join), so its honest value is cross-source confirmation, not a second report. Anchoring XAML203 at the code-behind subscription site (component.file : subscription.line) — where the matching -= goes anyway — lands it at the same file+line as OWN001, so they cluster into one high-confidence finding; the XAML view + the lifecycle handler that wired it ride in the message.

After:

AGGREGATED: {'clusters': 1, 'high_confidence': 1, 'candidates': 0}
  [P1 high] subscription-leak @ Views/CustomerView.xaml.cs:21  tools=['own-check', 'xaml-join']

So the join now does what the taxonomy comment originally (wrongly) claimed: it upgrades the own-check subscription finding to high-confidence and tags it as a view-lifecycle (closed-view-retained) leak, instead of a duplicate of it.

Changes

• xaml_join.py — one finding per leaking subscription, anchored at component.file : subscription.line; reshaped message (names the view, its .xaml, the Loaded= handler, the event); docstring corrected (it does cluster now). A component with no file metadata falls back to the markup anchor.
• taxonomy — XAML203 comment corrected (clusters with OWN001 → high confidence).
• run_static.py selftest — the stubbed own-check now emits the matching OWN001; asserts XAML203 + OWN001 collapse to exactly one high-confidence cluster (regression guard against the double-report).
• xaml_join.py selftest — code-behind anchoring (path/line/message) across all cases.
• README + design note — corrected the anchoring claim and stated the join's honest value (confidence upgrade + view-lifecycle framing, not new detection; new detection — binding→List<T> getter, hot-binding converter — is the deferred XAML200/204 increment).

Validation

Full audit selftest suite green (179 checks: normalize/score/report/xaml_check/xaml_facts/xaml_join/run_static/ingest), ruff check . clean. End-to-end aggregation confirms one high-confidence cluster, no double-report.

🤖 Generated with Claude Code

---

Generated by Claude Code

Summary by CodeRabbit

• Bug Fixes

  • XAML leak findings now point to the code-behind subscription site, making results more accurate and reducing duplicate reports when they overlap with existing leak findings.
  • Related findings are now merged into a single high-confidence result instead of appearing as separate entries.

• Documentation

  • Updated guidance and examples to reflect the new XAML finding location and merge behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 11a7a277-f62a-4a4c-ba32-750c230d1b84

📥 Commits

Reviewing files that changed from the base of the PR and between f4fc42d and 571d7ce.

📒 Files selected for processing (5)

• audit/README.md
• audit/static/run_static.py
• audit/static/taxonomy/categories.yml
• audit/static/tools/xaml_join.py
• docs/notes/xaml-analyzer-design.md

---

📝 Walkthrough

Walkthrough

XAML203 now anchors findings at the code-behind subscription site, clusters with OWN001 as one high-confidence result, and updates the selftests plus related status and design notes to match that behavior.

Changes

XAML203 anchoring and clustering

Layer / File(s)	Summary
Join anchoring and output shape audit/static/tools/xaml_join.py	XAML203 now emits one finding per unreleased subscription, anchors at component.file:subscription.line when available, and updates the message text and fallback location handling.
Selftest and synthetic OWN001 input audit/static/run_static.py, audit/static/tools/xaml_join.py	The selftest now fabricates an OWN001 SARIF finding at Views/CustomerView.xaml.cs:21 and asserts that XAML203 plus OWN001 produces exactly one cluster and one high-confidence result.
Status and design notes audit/README.md, audit/static/taxonomy/categories.yml, docs/notes/xaml-analyzer-design.md	The README, taxonomy comment, and design note text now describe XAML203 as anchored at the code-behind subscription site and clustered with OWN001 instead of separately reporting the XAML line.

Sequence Diagram(s)

sequenceDiagram
  participant run_static.py
  participant own-check
  participant xaml_join.py

  run_static.py->>own-check: run with --emit-facts
  own-check-->>run_static.py: own-check.facts.json + own-check.sarif with OWN001
  run_static.py->>xaml_join.py: run join when both fact sources exist
  xaml_join.py-->>run_static.py: XAML203 anchored at Views/CustomerView.xaml.cs:21
  run_static.py-->>run_static.py: totals["clusters"] = 1, totals["high_confidence"] = 1

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• PhysShell/Own.NET#117: Builds on the same XAML203 join path and selftest flow, including code-behind anchoring and OWN001 clustering.

Poem

I hopped through XAML by moonlit code,
and found one leak along the road.
OWN001 nestled close and neat,
while one bright cluster kept the beat.
A rabbit grin, a tidy trace,
one burrowed finding in its place.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the core change: re-anchoring XAML203 on code-behind to deduplicate with OWN001.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/oun-net-html-analyzer-drff2t

---

_{Comment @coderabbitai help to get the list of available commands.}