docs(p-004): bank milestone-1 mining run — real finding as regression + write-up

Milestone 1 ("find 1-3 real subscription/timer leaks in real code") is met:
mining real OSS C# surfaced a real WPF view->view-model subscription leak in
ScreenToGif (VideoSource.xaml.cs — four inline-lambda handlers wired in
Window_Loaded, never detached). Capture it and write up the run.

- corpus/real-world/screentogif-loaded-subscription/: the finding reduced to a
  tested regression (case.own -> OWN001, before/after .cs, provenance in notes).
- docs/notes/real-world-mining.md: the run write-up — the autonomous push-miner
  loop, the 4-repo findings table + precision verdict, the flagship finding, the
  WPF reference unlock (OWN_EXTRA_REF_DIRS: OWN050 210->37), and the next gap it
  revealed (self-owned controls built via ref-params / template parts).
- docs/ROADMAP.md: mark milestone 1 progressed, link the write-up.

Full suite green (corpus 3/3).

Author: claude

corpus/real-world/screentogif-loaded-subscription/after.cs

@@ -0,0 +1,34 @@
+// Fix: subscribe with named handlers (so they have a `-=` handle) and detach them
+// in Window_Closing. The view-model no longer roots the window, and a repeated
+// Loaded no longer stacks duplicate handlers.
+using System;
+using System.Windows;
+
+public partial class VideoSource : Window
+{
+    private readonly VideoSourceViewModel _viewModel;
+
+    public VideoSource()
+    {
+        InitializeComponent();
+        _viewModel = DataContext as VideoSourceViewModel;
+    }
+
+    private void Window_Loaded(object sender, RoutedEventArgs e)
+    {
+        _viewModel.ShowErrorRequested += OnShowError;
+        _viewModel.HideErrorRequested += OnHideError;
+        _viewModel.CloseRequested += OnClose;
+    }
+
+    private void Window_Closing(object sender, System.ComponentModel.CancelEventArgs e)
+    {
+        _viewModel.ShowErrorRequested -= OnShowError;
+        _viewModel.HideErrorRequested -= OnHideError;
+        _viewModel.CloseRequested -= OnClose;
+    }
+
+    private void OnShowError(object sender, EventArgs args) => StatusBand.Error(args?.ToString());
+    private void OnHideError(object sender, EventArgs e) => StatusBand.Hide();
+    private void OnClose(object sender, EventArgs e) => DialogResult = true;
+}

corpus/real-world/screentogif-loaded-subscription/before.cs

@@ -0,0 +1,32 @@
+// Reduced from NickeManarin/ScreenToGif @ 27a49c3,
+// ScreenToGif/Windows/Other/VideoSource.xaml.cs:46-90 — found by mining (P-004).
+//
+// A Window subscribes lambdas to its view-model's events in Window_Loaded and
+// never detaches them. Two problems: (1) Loaded can fire more than once (the
+// element is re-added to the visual tree) -> duplicate handlers stack up; (2) the
+// lambdas capture `this`, so the view-model holds the window alive for as long as
+// the view-model itself is reachable. There is no `-=` anywhere in the file.
+using System;
+using System.Windows;
+
+public partial class VideoSource : Window
+{
+    private readonly VideoSourceViewModel _viewModel;
+
+    public VideoSource()
+    {
+        InitializeComponent();
+        _viewModel = DataContext as VideoSourceViewModel;
+    }
+
+    private void Window_Loaded(object sender, RoutedEventArgs e)
+    {
+        _viewModel.ShowErrorRequested += (_, args) => StatusBand.Error(args?.ToString());
+        _viewModel.HideErrorRequested += (_, _) => StatusBand.Hide();
+        _viewModel.CloseRequested += (_, _) => DialogResult = true;
+        // ...never unsubscribed -> OWN001 (handler leak)
+    }
+
+    // Present in the real file, but it does NOT detach the handlers above.
+    private void Window_Closing(object sender, System.ComponentModel.CancelEventArgs e) { }
+}

corpus/real-world/screentogif-loaded-subscription/case.own

@@ -0,0 +1,16 @@
+// OwnLang model of a real WPF view->view-model leak found by mining
+// NickeManarin/ScreenToGif (P-004 milestone 1). In VideoSource.xaml.cs the
+// Window's Loaded handler subscribes lambdas to its view-model's events and
+// never detaches them. A subscription is acquire/release (subscribe/unsubscribe);
+// the missing release is the generic OWN001 — see notes.md for the real finding,
+// its provenance, and why the C# extractor rates it a *warning* (injected source).
+module Corpus
+resource Subscription {
+  acquire Subscribe
+  release Unsubscribe
+  kind "subscription token"
+}
+fn Window_Loaded(viewModel: int) {
+  let showError = acquire Subscription(viewModel);   // _viewModel.ShowErrorRequested += (_, e) => ...
+  // no `release showError;` — Window_Closing never does `-=` -> handler leak (OWN001)
+}

corpus/real-world/screentogif-loaded-subscription/expected-diagnostics.txt

@@ -0,0 +1 @@
+OWN001

corpus/real-world/screentogif-loaded-subscription/notes.md

@@ -0,0 +1,40 @@
+# ScreenToGif — view subscribes to its view-model in `Loaded`, never detaches
+
+**Found by mining** (P-004 milestone 1, see `docs/notes/real-world-mining.md`).
+Target: `NickeManarin/ScreenToGif` @ `27a49c3`, file
+`ScreenToGif/Windows/Other/VideoSource.xaml.cs:50-83`.
+
+**Pattern.** A WPF `Window` whose `_viewModel = DataContext as VideoSourceViewModel`
+wires **four inline-lambda subscriptions** to the view-model's custom events inside
+`Window_Loaded` (`ShowErrorRequested`, `HideErrorRequested`, `ShowWarningRequested`,
+`CloseRequested`) and **never detaches them** — `Window_Closing` is present but does
+no `-=`. Each lambda captures `this`, so the view-model holds a strong reference to
+the window; and because `Loaded` can fire more than once, the handlers can stack up.
+
+**What the checker says (real extractor output, with the WPF profile off):**
+
+```text
+VideoSource.xaml.cs:50: warning: [OWN001] event '_viewModel.ShowErrorRequested' is
+  subscribed (handler '(_, args) => ...') but never unsubscribed; its source is an
+  injected dependency whose lifetime is unknown, so it may outlive and keep
+  'VideoSource' alive (possible leak — and being an inline lambda it has no '-='
+  handle, so it could never be detached) [resource: subscription token]
+```
+
+These resolve **without** the WPF reference pack because `_viewModel`'s events are
+the app's own types — exactly the differentiated view↔view-model lifetime shape
+that generic IDisposable/CA analyzers don't flag.
+
+**Why warning, not error (the honest part).** The C# extractor's source tiering
+(P-004) rates this **warning**: `_viewModel` is an injected field, so the extractor
+cannot *prove* it outlives the window. In fact, since the view-model is the window's
+own `DataContext`, the two most likely share a lifetime (a collectable cycle), so
+this may not leak memory at all — but the **duplicate-handler-on-reload** bug is
+real regardless. "Possible leak" is the correct verdict, and the lambda note flags
+the sharper problem: there is no handle to detach with.
+
+**This `case.own`** models the subscription as a generic acquire/release and so
+produces the core's domain-neutral **OWN001** (the severity tiering lives in the C#
+extractor, above the core). As with the rest of the corpus, `case.own` is a hand
+reduction of the C# pattern, not verbatim extractor output; `before.cs` / `after.cs`
+are representative of the leak and its fix.

docs/ROADMAP.md

@@ -80,6 +80,11 @@ architectural strictness, and the borrow-checker showcase):
 ### Milestones
 
 1. **WPF leak spike** — find 1–3 real subscription/timer leaks in real code (P-004).
+   ✔ *First run done* — mining real OSS C# surfaced a real view→view-model
+   subscription leak in `NickeManarin/ScreenToGif` (and the precise/clean results
+   on disciplined code). See [docs/notes/real-world-mining.md](notes/real-world-mining.md)
+   for the run, the WPF reference unlock (`OWN_EXTRA_REF_DIRS`), and the next gap
+   it revealed (self-owned controls built indirectly / as template parts).
 2. **Resource core** — generalise WPF subscriptions + `IDisposable` into one
    acquire/release/owner/release-region model (P-004 ∪ P-005), so WPF is a
    *profile*, not a one-off.

docs/notes/real-world-mining.md

@@ -0,0 +1,82 @@
+# Real-world mining run — milestone 1 (WPF leak spike)
+
+This is the write-up of the first end-to-end run of the analyser over **real,
+unmodified OSS C#**, the `ROADMAP.md` milestone 1: *"find 1–3 real
+subscription/timer leaks in real code (P-004)."* It is the honest record of what
+the tool actually surfaces on real code — signal, precision, and the next gap the
+run revealed.
+
+## How it ran (the loop)
+
+The Roslyn extractor needs a .NET SDK, which the dev sandbox does not have, and
+the supported on-demand path (`mine.yml`, `workflow_dispatch`) could not be
+triggered from the automation token. So the run used a small **push-triggered**
+miner (`.github/workflows/mine-on-push.yml`) driven by a sentinel file
+(`corpus/mine-target.txt`): bump the target, and CI clones the repo, runs
+`scripts/mine.sh` (extractor → OwnIR → core, no per-repo build), and echoes the
+report to the job log. The findings were then triaged by reading the flagged
+`file:line` in a local clone of the target.
+
+> `mine-on-push.yml` + `corpus/mine-target.txt` are **dev-loop scaffolding**
+> (dev-branch only) — they exist because the token can't dispatch `mine.yml`.
+> They should not be merged to `main`; the supported path stays `mine.yml`.
+
+## What it found
+
+| Repo (commit) | findings | triage |
+|---|---|---|
+| `DapperLib/Dapper` @72a54c4 | 1 × OWN001, 1 × OWN050 | TP: `BenchmarkBase._connection` — an undisposed `SqlConnection` field (benchmark project). |
+| `JoshClose/CsvHelper` @33970e5 | 43 × OWN001 | TP: undisposed `StreamReader/Writer/CsvDataReader` **locals in tests**; every `using`-scoped local was correctly skipped. |
+| `NickeManarin/ScreenToGif` @27a49c3 (WPF profile off) | 8 × OWN001, 210 × OWN050 | **flagship** below + a likely-benign `App`→`AppDomain.UnhandledException` (process-lived subscriber). |
+| `NickeManarin/ScreenToGif` @27a49c3 (WPF profile **on**) | 123 × OWN001, 37 × OWN050 | unlock works (OWN050 ↓), but exposes the self-owned-control precision gap below. |
+
+**Precision.** Every finding triaged by hand was a *real* undisposed/undetached
+resource — no false positives from `using` (the extractor models it as release),
+and the severity tiering behaved as designed. The findings cluster where
+disposal discipline is intentionally lax (test/benchmark code) — real, but mostly
+low-severity in practice. Disciplined shipping libraries came up clean, which is
+the *precision* result the methodology wants to see.
+
+## The flagship finding (milestone 1 ✔)
+
+`ScreenToGif/Windows/Other/VideoSource.xaml.cs:50-83` — a WPF `Window` subscribes
+**four inline lambdas to its view-model's custom events in `Window_Loaded` and
+never detaches them** (`Window_Closing` does no `-=`). This is the canonical
+view↔view-model lifetime shape that generic IDisposable/CA analyzers miss; it
+resolves **without** the WPF reference pack because the events are the app's own
+types. The extractor rates it **warning** (the source `_viewModel` is injected, so
+its lifetime can't be proven) and notes the lambdas have no `-=` handle — the
+honest verdict (it may be a collectable view↔vm cycle, but the
+duplicate-handler-on-reload bug is real). Captured as a regression:
+`corpus/real-world/screentogif-loaded-subscription/`.
+
+## The WPF reference unlock (and the gap it revealed)
+
+The flagship detectors went blind on framework events because the extractor only
+loaded the runtime's trusted-platform assemblies — `Button.Click`,
+`DispatcherTimer.Tick`, etc. fell out as OWN050. The extractor now also loads
+`*.dll` from each dir in the **`OWN_EXTRA_REF_DIRS`** env var (deduped by simple
+name against the TPA); the miner materializes the WindowsDesktop ref pack on Linux
+(a `net8.0-windows`/`UseWPF` stub restores it via `EnableWindowsTargeting` → 47 ref
+dlls) and points the var at it. On ScreenToGif this drove **OWN050 210 → 37**.
+
+The change is **off by default** (`OWN_EXTRA_REF_DIRS` unset → unchanged
+behaviour; the whole existing suite is the guard), so it is a safe, opt-in
+capability add.
+
+But unlocking framework events also jumped **OWN001 8 → 123**, and the new
+findings are dominated by **self-owned controls**: `_thumbBottomLeft.DragDelta +=`
+(a `Thumb` the adorner constructs via `BuildCorner(ref _thumb, …)`),
+`_upButton.Click +=` (a template part fetched with `GetTemplateChild`), etc. A
+class subscribing to a control it *owns* is a collectable cycle — not a leak — but
+the existing self-owned exemption only recognises fields built by a direct
+`field = new …`, so indirect construction (`ref`/`out` params) and template parts
+slip through. **Next step:** extend the self-owned exemption to those two shapes
+before the WPF profile is on by default. This is textbook bug-driven expansion —
+the real-world run defined the next unit of work.
+
+## Reproduce
+
+Point `mine.yml` (Actions → *mine (corpus)* → Run workflow) at a target; for the
+WPF profile, set `OWN_EXTRA_REF_DIRS` to a WindowsDesktop `ref/net8.0` dir (the
+miner shows how to materialize it). Read the report in the run summary / artifact.