\\n

ℹ️ Recent review info

\\n\\n

\\n

⚙️ Run configuration

\\n\\n**Configuration used**: Path: .coderabbit.yaml\\n\\n**Review profile**: CHILL\\n\\n**Plan**: Pro Plus\\n\\n**Run ID**: `5baa27e2-a989-4a4a-918e-5ffac32232dd`\\n\\n

\\n\\n

\\n

📥 Commits

\\n\\nReviewing files that changed from the base of the PR and between b6f3cc7790fb1925bea3fa8b3c32df2200f0b0a9 and 7f598b0043c2a8600c5a0049aadf3238f93c9575.\\n\\n

\\n\\n

\\n

📒 Files selected for processing (3)

\\n\\n* `.github/workflows/ci.yml`\\n* `frontend/roslyn/OwnSharp.Extractor/Program.cs`\\n* `frontend/roslyn/samples/FlowLocalsSample.cs`\\n\\n

\\n\\n

\\n\\n---\\n\\n\\n

\\n

📝 Walkthrough

\\n\\n## Walkthrough\\n\\n`LowerFlowStmt` in the Roslyn extractor now handles `ThrowStatementSyntax` as a modelled abnormal exit when the throw escapes the method without an enclosing try. Four sample methods are added to `FlowLocalsSample.cs` covering leak and no-leak scenarios, and CI assertions are updated accordingly.\\n\\n## Changes\\n\\n**Throw-exit flow modeling and validation**\\n\\n| Layer / File(s) | Summary |\\n|---|---|\\n| **LowerFlowStmt throw-exit implementation and samples**
`frontend/roslyn/OwnSharp.Extractor/Program.cs`, `frontend/roslyn/samples/FlowLocalsSample.cs` | Adds a `ThrowStatementSyntax` case that lowers an escaping throw (no enclosing try) to a synthetic return node so flow analysis proceeds; otherwise returns failure. Switch-section comment is updated to reflect that bare throw is now modelled. Adds four sample methods (`ValidatedThenLeaks`, `ThrowAfterAcquireLeaks`, `ThrowAfterDisposeClean`, `ValidatedThenClean`) with accompanying commentary. |\\n| **CI assertions for new throw-path cases**
`.github/workflows/ci.yml` | Adds assertions that `vtl` and `dotNoTry` produce OWN001 diagnostics with correct wording, and extends the expected-silent loop to include `tdClean` and `vtc`. |\\n\\n## Estimated code review effort\\n\\n🎯 2 (Simple) | ⏱️ ~10 minutes\\n\\n## Possibly related PRs\\n\\n- [PhysShell/Own.NET#15](https://github.com/PhysShell/Own.NET/pull/15): Introduced the flow-locals lowering and initial `FlowLocalsSample` coverage that this PR extends.\\n- [PhysShell/Own.NET#31](https://github.com/PhysShell/Own.NET/pull/31): Modified `LowerFlowStmt`'s `TryStatementSyntax` handling, directly adjacent to the throw/try modeling this PR changes.\\n- [PhysShell/Own.NET#33](https://github.com/PhysShell/Own.NET/pull/33): Extended `onThrow` and exceptional-exit threading in `LowerFlowStmt` and added corresponding `FlowLocalsSample` cases, the same code region modified here.\\n\\n## Poem\\n\\n> 🐇 A `throw` in the code, no `try` in sight,\\n> I model the exit and track the blight.\\n> If the stream isn't closed before you flee,\\n> OWN001 warns: \\\"that leak's on thee!\\\"\\n> But dispose it first and the path is clean—\\n> The tidiest flow this rabbit has seen. ✨\\n\\n

\\n\\n\\n\\n\\n

\\n

🚥 Pre-merge checks | ✅ 4

\\n\\n

\\n

✅ Passed checks (4 passed)

\\n\\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\\n\\n

\\n\\n\\n\\n\\n

\\n

✨ Finishing Touches

\\n\\n

\\n

📝 Generate docstrings

\\n\\n- [ ] Create stacked PR\\n- [ ] Commit on current branch\\n\\n

\\n

🧪 Generate unit tests (beta)

\\n\\n- [ ] Create PR with unit tests\\n- [ ] Commit unit tests in branch `claude/flow-explicit-throw`\\n\\n

\\n\\n

\\n\\n\\n\\n\\n---\\n\\n\\n\\n\\n_{Comment `@coderabbitai help` to get the list of available commands.}\\n\\n\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_380":484,"_361":362,"_382":368},{"_383":485,"_385":-5,"_42":-5,"_386":-5,"_387":-5,"_96":325,"_92":389},[486],{"_46":480,"_92":487},"input_text",{"_380":489,"_361":362,"_382":368},{"_383":490,"_385":-5,"_42":-5,"_386":-5,"_387":-5,"_96":325,"_92":389},[491],{"_46":492,"_92":487},"\n /workspace/Own.NET\n bash\n 2026-06-23\n Etc/UTC\n",{"_380":494,"_361":362,"_382":368},{"_383":495,"_385":-5,"_42":-5,"_386":-5,"_387":-5,"_96":496,"_92":389},[497,498],"developer",{"_46":500,"_92":487},{"_46":499,"_92":487},"\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; prioritize OpenAI docs MCP tools, use bundled references only as helper context, and restrict any fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new local plugin, add optional plugin structure, or generate or update repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) When `SKILL.md` references relative paths (e.g., `scripts/foo.py`), resolve them relative to the skill directory listed above first, and only consider other paths if needed.\n 3) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 4) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 5) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_361":362,"_87":503},{"_103":-5,"_42":368,"_369":504,"_371":372,"_373":505},[],"inProgress",{"_373":507,"_361":362},{"_508":509,"_92":510},"activeFlags",[],"active","thread/started",{"_513":514},"thread",{"_515":-5,"_516":-5,"_517":518,"_519":372,"_428":429,"_520":15,"_521":-5,"_522":-5,"_523":-5,"_524":525,"_42":362,"_526":527,"_181":-5,"_528":-5,"_161":529,"_530":199,"_531":-5,"_433":532,"_373":533,"_534":-5,"_77":535,"_536":372},"agentNickname","agentRole","cliVersion","0.128.0","createdAt","ephemeral","extra","forkedFromId","gitInfo","historyMode","legacy","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/06/23/rollout-2026-06-23T13-02-51-019ef493-8db3-75c0-931e-4675787138b6.jsonl","preview","recencyAt","vscode",{"_92":377},"threadSource",[],"updatedAt",[],"messages",[540],{"_42":541,"_542":543,"_544":545,"_546":545,"_383":547,"_373":548,"_385":-5,"_549":32,"_550":551,"_552":553,"_554":-5},"ba6822c8-887b-44ff-8648-cabc53ef513f","author",{"_96":325,"_181":-5,"_550":563},"create_time",1782219769.967826,"update_time",{"_559":46,"_560":561},"finished_successfully","weight","metadata",{"_555":556},"recipient","all","channel","l1239dk1",{"_557":558},"inline_comments",[],"content_type","parts",[562],"@codex yo bro\nflow: model explicit `throw` as an abnormal exit (body-level dispose-not-called-on-throw)\n\n## Why\n\nThe cross-tool oracle on **Serilog** and **Npgsql** both surfaced CodeQL's `cs/dispose-not-called-on-throw` as *oracle-only* (a recall gap). Tracing it: `dispose-not-called-on-throw` **is** already modelled — but only **inside a `try`** (`InjectThrowEdge` fires only when `onThrow != null`, which holds only in a try body). The gap is the **body-level, no-`try`** slice.\n\nWorse, an explicit `throw` statement hit the unmodelled `default` and **bailed the WHOLE method** — so any leak in a method guarded by a top-level validation throw (`if (x is null) throw …;` — everywhere in real .NET) was invisible to *every* flow detector.\n\n## What\n\nModel a `throw` statement with **no enclosing try** (`canEscape && onThrow is null`) as a bare CFG exit — the same synthetic `{op:return}` exit the injected may-throw edges already use. A resource owned there and disposed only later leaks on the throw path.\n\nTwo wins, both **sound / FP-free** (a throw with no enclosing try *definitely* exits, so an owned resource *definitely* leaks):\n\n- **No-try `dispose-not-called-on-throw`** — `acquire; if (bad) throw; dispose;` leaks on the throw path (`dotNoTry`, *\"may not be disposed on every path\"*).\n- **Un-bailing validation-throw-guarded methods** — a later undisposed local that the early `throw` used to hide is now caught (`vtl`, *\"is never disposed\"*), and so is everything else the rest of the body contains.\n\nStays **conservative inside a `try`**: an explicit throw there may run a finally or be caught (typed / catch-all), which needs the thrown-type-vs-catch match (not threaded here), so it keeps bailing — no new false escape past a catch.\n\n## Tests\n\n`FlowLocalsSample.cs` (asserted end-to-end in CI — real extractor → core):\n| sample | local | verdict |\n|---|---|---|\n| `ValidatedThenLeaks` | `vtl` | OWN001 *is never disposed* (recall: un-bail) |\n| `ThrowAfterAcquireLeaks` | `dotNoTry` | OWN001 *may not be disposed on every path* (no-try dispose-on-throw) |\n| `ThrowAfterDisposeClean` | `tdClean` | silent (release **before** the throw) |\n| `ValidatedThenClean` | `vtc` | silent (analysed + balanced — un-bail must not over-flag) |\n\nCore handling of the `{op:return}` exit is unchanged (already pinned by the existing return/leak fixtures, and re-validated against this IR shape locally); the C# lowering is the only new behaviour, covered by the CI flow step.\n\n## Scope / posture\n\nThis is the **sound default** half of a tiered plan. The broader **\"any call *may* throw\" at body level** = CodeQL's full recall, but it's the CA2000 firehose (would flag harmless `MemoryStream`/`StringWriter` dispose-on-throw, needs a fuzzy managed-only exemption) — so it'll land separately **behind an opt-in flag** (off by default), letting the oracle measure full recall without polluting the default. Default posture (lower FP than CA2000) is preserved here.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nhttps://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED\n\n---\n_Generated by [Claude Code](https://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED)_\n\n\n\n## Summary by CodeRabbit\n\n* **New Features**\n * Enhanced flow-sensitive analysis to better detect resource leaks in methods with explicit throw statements.\n * Improved handling of throw scenarios in control flow modeling.\n\n* **Tests**\n * Extended test coverage for edge cases involving explicit throws and resource disposal, including validation throws and conditional throw scenarios.\n\n\n## Own.NET / owned resource not released on all paths (possible leak)\n\nIDisposable local 'vtl' is never disposed (leak) [resource: disposable]\n\n[Show more details](https://github.com/PhysShell/Own.NET/security/code-scanning/84)\n## Own.NET / owned resource not released on all paths (possible leak)\n\nIDisposable local 'dotNoTry' may not be disposed on every path (leak) [resource: disposable]\n\n[Show more details](https://github.com/PhysShell/Own.NET/security/code-scanning/85)\n\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/PhysShell/Own.NET/pull/94?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\nNo actionable comments were generated in the recent review. 🎉\n\n

ℹ️ Recent review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Path: .coderabbit.yaml\n\n**Review profile**: CHILL\n\n**Plan**: Pro Plus\n\n**Run ID**: `5baa27e2-a989-4a4a-918e-5ffac32232dd`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between b6f3cc7790fb1925bea3fa8b3c32df2200f0b0a9 and 7f598b0043c2a8600c5a0049aadf3238f93c9575.\n\n

\n\n

📒 Files selected for processing (3)

\n\n* `.github/workflows/ci.yml`\n* `frontend/roslyn/OwnSharp.Extractor/Program.cs`\n* `frontend/roslyn/samples/FlowLocalsSample.cs`\n\n

\n\n

\n\n---\n\n\n

📝 Walkthrough

\n\n## Walkthrough\n\n`LowerFlowStmt` in the Roslyn extractor now handles `ThrowStatementSyntax` as a modelled abnormal exit when the throw escapes the method without an enclosing try. Four sample methods are added to `FlowLocalsSample.cs` covering leak and no-leak scenarios, and CI assertions are updated accordingly.\n\n## Changes\n\n**Throw-exit flow modeling and validation**\n\n| Layer / File(s) | Summary |\n|---|---|\n| **LowerFlowStmt throw-exit implementation and samples**
`frontend/roslyn/OwnSharp.Extractor/Program.cs`, `frontend/roslyn/samples/FlowLocalsSample.cs` | Adds a `ThrowStatementSyntax` case that lowers an escaping throw (no enclosing try) to a synthetic return node so flow analysis proceeds; otherwise returns failure. Switch-section comment is updated to reflect that bare throw is now modelled. Adds four sample methods (`ValidatedThenLeaks`, `ThrowAfterAcquireLeaks`, `ThrowAfterDisposeClean`, `ValidatedThenClean`) with accompanying commentary. |\n| **CI assertions for new throw-path cases**
`.github/workflows/ci.yml` | Adds assertions that `vtl` and `dotNoTry` produce OWN001 diagnostics with correct wording, and extends the expected-silent loop to include `tdClean` and `vtc`. |\n\n## Estimated code review effort\n\n🎯 2 (Simple) | ⏱️ ~10 minutes\n\n## Possibly related PRs\n\n- [PhysShell/Own.NET#15](https://github.com/PhysShell/Own.NET/pull/15): Introduced the flow-locals lowering and initial `FlowLocalsSample` coverage that this PR extends.\n- [PhysShell/Own.NET#31](https://github.com/PhysShell/Own.NET/pull/31): Modified `LowerFlowStmt`'s `TryStatementSyntax` handling, directly adjacent to the throw/try modeling this PR changes.\n- [PhysShell/Own.NET#33](https://github.com/PhysShell/Own.NET/pull/33): Extended `onThrow` and exceptional-exit threading in `LowerFlowStmt` and added corresponding `FlowLocalsSample` cases, the same code region modified here.\n\n## Poem\n\n> 🐇 A `throw` in the code, no `try` in sight,\n> I model the exit and track the blight.\n> If the stream isn't closed before you flee,\n> OWN001 warns: \"that leak's on thee!\"\n> But dispose it first and the path is clean—\n> The tidiest flow this rabbit has seen. ✨\n\n

\n\n\n\n\n

🚥 Pre-merge checks | ✅ 4

\n\n

✅ Passed checks (4 passed)

\n\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\n\n

\n\n\n\n\n

✨ Finishing Touches

\n\n

📝 Generate docstrings

\n\n- [ ] Create stacked PR\n- [ ] Commit on current branch\n\n

🧪 Generate unit tests (beta)

\n\n- [ ] Create PR with unit tests\n- [ ] Commit unit tests in branch `claude/flow-explicit-throw`\n\n

\n\n

\n\n\n\n\n---\n\n\n\n\n_{Comment `@coderabbitai help` to get the list of available commands.}\n\n",{},"created",1782219800.728183,"Completing the task","event_type","info",{"_92":389,"_96":93,"_383":574},{"_92":571,"_572":573},"partial_repo_snapshot","files",[],[575],{"_559":46,"_46":391},{"_92":325,"_42":84,"_96":325,"_578":579,"_580":581,"_582":583,"_132":-5,"_119":584},[83],"input_items",[603,604,605,606,607],"external_post_config",{"_585":586,"_262":196,"_587":304,"_273":-5,"_588":256,"_589":-5,"_590":-5,"_591":592,"_593":594,"_595":-5,"_596":-5,"_597":598,"_599":15,"_600":59,"_601":54,"_602":15},"user_model_slug","slug",1782219758.866266,"installation_id",131220309,"pr_number","repo_id","gitlab_service_account_project_id","review_trigger","comment_id",4779473737,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",373640515,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_92":389,"_96":325,"_383":622},{"_311":312,"_313":618,"_619":318,"_620":129,"_321":-5,"_92":621},{"_92":608,"_313":616,"_161":613,"_610":614,"_611":617},{"_92":608,"_313":612,"_161":613,"_610":614,"_611":615},{"_92":608,"_313":609,"_161":-5,"_610":-5,"_611":-5},"pull_request_comment","\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/PhysShell/Own.NET/pull/94?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\nNo actionable comments were generated in the recent review. 🎉\n\n

ℹ️ Recent review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Path: .coderabbit.yaml\n\n**Review profile**: CHILL\n\n**Plan**: Pro Plus\n\n**Run ID**: `5baa27e2-a989-4a4a-918e-5ffac32232dd`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between b6f3cc7790fb1925bea3fa8b3c32df2200f0b0a9 and 7f598b0043c2a8600c5a0049aadf3238f93c9575.\n\n

\n\n

📒 Files selected for processing (3)

\n\n* `.github/workflows/ci.yml`\n* `frontend/roslyn/OwnSharp.Extractor/Program.cs`\n* `frontend/roslyn/samples/FlowLocalsSample.cs`\n\n

\n\n

\n\n---\n\n\n

📝 Walkthrough

\n\n\n\n\n

🚥 Pre-merge checks | ✅ 4

\n\n

✅ Passed checks (4 passed)

\n\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\n\n

\n\n\n\n\n

✨ Finishing Touches

\n\n

📝 Generate docstrings

\n\n- [ ] Create stacked PR\n- [ ] Commit on current branch\n\n

🧪 Generate unit tests (beta)

\n\n- [ ] Create PR with unit tests\n- [ ] Commit unit tests in branch `claude/flow-explicit-throw`\n\n

\n\n

\n\n\n\n\n---\n\n\n\n\n_{Comment `@coderabbitai help` to get the list of available commands.}\n\n","side","line","## Own.NET / owned resource not released on all paths (possible leak)\n\nIDisposable local 'dotNoTry' may not be disposed on every path (leak) [resource: disposable]\n\n[Show more details](https://github.com/PhysShell/Own.NET/security/code-scanning/85)","frontend/roslyn/samples/FlowLocalsSample.cs","RIGHT",297,"## Own.NET / owned resource not released on all paths (possible leak)\n\nIDisposable local 'vtl' is never disposed (leak) [resource: disposable]\n\n[Show more details](https://github.com/PhysShell/Own.NET/security/code-scanning/84)",287,"## Why\n\nThe cross-tool oracle on **Serilog** and **Npgsql** both surfaced CodeQL's `cs/dispose-not-called-on-throw` as *oracle-only* (a recall gap). Tracing it: `dispose-not-called-on-throw` **is** already modelled — but only **inside a `try`** (`InjectThrowEdge` fires only when `onThrow != null`, which holds only in a try body). The gap is the **body-level, no-`try`** slice.\n\nWorse, an explicit `throw` statement hit the unmodelled `default` and **bailed the WHOLE method** — so any leak in a method guarded by a top-level validation throw (`if (x is null) throw …;` — everywhere in real .NET) was invisible to *every* flow detector.\n\n## What\n\nModel a `throw` statement with **no enclosing try** (`canEscape && onThrow is null`) as a bare CFG exit — the same synthetic `{op:return}` exit the injected may-throw edges already use. A resource owned there and disposed only later leaks on the throw path.\n\nTwo wins, both **sound / FP-free** (a throw with no enclosing try *definitely* exits, so an owned resource *definitely* leaks):\n\n- **No-try `dispose-not-called-on-throw`** — `acquire; if (bad) throw; dispose;` leaks on the throw path (`dotNoTry`, *\"may not be disposed on every path\"*).\n- **Un-bailing validation-throw-guarded methods** — a later undisposed local that the early `throw` used to hide is now caught (`vtl`, *\"is never disposed\"*), and so is everything else the rest of the body contains.\n\nStays **conservative inside a `try`**: an explicit throw there may run a finally or be caught (typed / catch-all), which needs the thrown-type-vs-catch match (not threaded here), so it keeps bailing — no new false escape past a catch.\n\n## Tests\n\n`FlowLocalsSample.cs` (asserted end-to-end in CI — real extractor → core):\n| sample | local | verdict |\n|---|---|---|\n| `ValidatedThenLeaks` | `vtl` | OWN001 *is never disposed* (recall: un-bail) |\n| `ThrowAfterAcquireLeaks` | `dotNoTry` | OWN001 *may not be disposed on every path* (no-try dispose-on-throw) |\n| `ThrowAfterDisposeClean` | `tdClean` | silent (release **before** the throw) |\n| `ValidatedThenClean` | `vtc` | silent (analysed + balanced — un-bail must not over-flag) |\n\nCore handling of the `{op:return}` exit is unchanged (already pinned by the existing return/leak fixtures, and re-validated against this IR shape locally); the C# lowering is the only new behaviour, covered by the CI flow step.\n\n## Scope / posture\n\nThis is the **sound default** half of a tiered plan. The broader **\"any call *may* throw\" at body level** = CodeQL's full recall, but it's the CA2000 firehose (would flag harmless `MemoryStream`/`StringWriter` dispose-on-throw, needs a fuzzy managed-only exemption) — so it'll land separately **behind an opt-in flag** (off by default), letting the oracle measure full recall without polluting the default. Default posture (lower FP than CA2000) is preserved here.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nhttps://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED\n\n---\n_Generated by [Claude Code](https://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED)_\n\n\n\n## Summary by CodeRabbit\n\n* **New Features**\n * Enhanced flow-sensitive analysis to better detect resource leaks in methods with explicit throw statements.\n * Improved handling of throw scenarios in control flow modeling.\n\n* **Tests**\n * Extended test coverage for edge cases involving explicit throws and resource disposal, including validation throws and conditional throw scenarios.\n\n","base_ref","head_ref","pull_request_info",[623],{"_559":46,"_46":624},"@codex yo bro",[763,764],[],{"_564":565,"_46":566,"_567":568},{"_538":754},{"_335":753},{"_335":660},{"_303":304,"_294":305,"_306":307,"_308":59,"_309":15,"_310":15,"_311":312,"_313":314,"_315":266,"_316":127,"_317":318,"_319":320,"_321":322,"_323":-5,"_324":-5,"_325":659,"_327":328,"_329":330,"_331":332,"_333":330},{"_42":123,"_193":194,"_195":196,"_197":15,"_198":199,"_200":201,"_202":648,"_204":-5,"_205":-5,"_206":15,"_207":649,"_209":199,"_210":199,"_211":650,"_213":651,"_215":652,"_217":-5,"_218":219,"_220":221,"_222":223,"_224":653,"_55":-5,"_119":226,"_227":654,"_229":655,"_231":232,"_233":15,"_234":15},{"_133":641},[635,636,637,638,639,640],{"_148":171,"_150":165,"_152":166,"_154":163,"_156":172,"_158":159,"_160":32,"_161":-5},{"_148":170,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":168,"_150":165,"_152":166,"_154":163,"_156":169,"_158":159,"_160":32,"_161":-5},{"_148":164,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":162,"_150":151,"_152":153,"_154":163,"_156":157,"_158":159,"_160":32,"_161":-5},{"_148":149,"_150":151,"_152":153,"_154":155,"_156":157,"_158":159,"_160":32,"_161":-5},[642,643,644],{"_177":647,"_179":190},{"_177":646,"_179":186},{"_177":645,"_179":180},{"_181":182,"_92":183,"_119":184},{"_181":187,"_92":183,"_119":188},{"_181":191,"_92":183,"_119":192},{"_296":297,"_298":-5,"_299":-5,"_300":-5,"_301":-5,"_302":-5},[256],{"_256":656},{"_238":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":251,"_252":253,"_254":255},{},[],{"_237":59},{"_235":59,"_236":199},{"_42":258,"_181":259,"_260":657,"_262":196,"_263":264,"_265":266,"_267":268,"_269":270,"_271":272,"_273":64,"_274":-5,"_275":-5,"_276":-5,"_277":-5,"_278":-5,"_279":-5,"_280":-5,"_160":281,"_282":-5,"_55":658},{"_288":289,"_42":290,"_92":291,"_292":293,"_294":295},{"_284":15,"_285":15,"_286":15,"_287":15},{"_288":289,"_181":289,"_334":-5,"_292":293,"_42":290},[661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681],{"_154":511,"_359":749},{"_154":374,"_359":746},{"_154":501,"_359":743},{"_154":378,"_359":738},{"_154":378,"_359":734},{"_154":378,"_359":730},{"_154":393,"_359":725},{"_154":393,"_359":721},{"_154":378,"_359":717},{"_154":378,"_359":715},{"_154":393,"_359":711},{"_154":378,"_359":709},{"_154":378,"_359":707},{"_154":393,"_359":703},{"_154":378,"_359":701},{"_154":393,"_359":697},{"_154":378,"_359":693},{"_154":393,"_359":691},{"_154":378,"_359":687},{"_154":374,"_359":685},{"_154":358,"_359":682},{"_361":362,"_87":683},{"_364":365,"_366":367,"_103":-5,"_42":368,"_369":684,"_371":372,"_373":113},[],{"_373":686,"_361":362},{"_92":377},{"_380":688,"_361":362,"_382":368},{"_383":689,"_385":-5,"_42":-5,"_386":-5,"_387":388,"_96":93,"_92":389},[690],{"_46":391,"_92":392},{"_380":692,"_361":362,"_382":368},{"_42":396,"_387":388,"_46":391,"_92":397},{"_380":694,"_361":362,"_382":368},{"_383":-5,"_400":401,"_42":-5,"_386":-5,"_402":695,"_92":404},[696],{"_46":406,"_92":407},{"_380":698,"_361":362,"_382":368},{"_383":699,"_42":411,"_402":700,"_92":404},[],[406],{"_380":702,"_361":362,"_382":368},{"_415":416,"_42":-5,"_386":-5,"_417":418,"_92":419},{"_380":704,"_361":362,"_382":368},{"_422":423,"_424":425,"_426":705,"_428":429,"_366":32,"_430":32,"_42":416,"_431":432,"_433":434,"_373":113,"_92":435},[706],{"_424":437,"_92":438},{"_380":708,"_361":362,"_382":368},{"_441":442,"_415":416,"_42":-5,"_386":-5,"_181":443,"_444":-5,"_92":445},{"_380":710,"_361":362,"_382":368},{"_415":448,"_42":-5,"_386":-5,"_417":449,"_92":419},{"_380":712,"_361":362,"_382":368},{"_422":452,"_424":453,"_426":713,"_428":429,"_366":455,"_430":32,"_42":448,"_431":456,"_433":434,"_373":113,"_92":435},[714],{"_424":458,"_92":438},{"_380":716,"_361":362,"_382":368},{"_441":461,"_415":448,"_42":-5,"_386":-5,"_181":443,"_444":-5,"_92":445},{"_380":718,"_361":362,"_382":368},{"_383":-5,"_400":464,"_42":-5,"_386":-5,"_402":719,"_92":404},[720],{"_46":467,"_92":407},{"_380":722,"_361":362,"_382":368},{"_383":723,"_42":471,"_402":724,"_92":404},[],[467],{"_380":726,"_361":362,"_382":368},{"_475":-5,"_383":727,"_42":477,"_92":478},[728],{"_46":480,"_481":729,"_92":46},[],{"_380":731,"_361":362,"_382":368},{"_383":732,"_385":-5,"_42":-5,"_386":-5,"_387":-5,"_96":325,"_92":389},[733],{"_46":480,"_92":487},{"_380":735,"_361":362,"_382":368},{"_383":736,"_385":-5,"_42":-5,"_386":-5,"_387":-5,"_96":325,"_92":389},[737],{"_46":492,"_92":487},{"_380":739,"_361":362,"_382":368},{"_383":740,"_385":-5,"_42":-5,"_386":-5,"_387":-5,"_96":496,"_92":389},[741,742],{"_46":500,"_92":487},{"_46":499,"_92":487},{"_361":362,"_87":744},{"_103":-5,"_42":368,"_369":745,"_371":372,"_373":505},[],{"_373":747,"_361":362},{"_508":748,"_92":510},[],{"_513":750},{"_515":-5,"_516":-5,"_517":518,"_519":372,"_428":429,"_520":15,"_521":-5,"_522":-5,"_523":-5,"_524":525,"_42":362,"_526":527,"_181":-5,"_528":-5,"_161":529,"_530":199,"_531":-5,"_433":532,"_373":751,"_534":-5,"_77":752,"_536":372},{"_92":377},[],[],[755],{"_42":541,"_542":756,"_544":545,"_546":545,"_383":757,"_373":548,"_385":-5,"_549":32,"_550":758,"_552":553,"_554":-5},{"_96":325,"_181":-5,"_550":762},{"_559":46,"_560":761},{"_555":759},{"_557":760},[],[562],{},{"_92":389,"_96":93,"_383":766},{"_92":571,"_572":765},[],[767],{"_559":46,"_46":391},[770,771,772,773,774],{"_585":586,"_262":196,"_587":304,"_273":-5,"_588":256,"_589":-5,"_590":-5,"_591":592,"_593":594,"_595":-5,"_596":-5,"_597":598,"_599":15,"_600":59,"_601":54,"_602":15},{"_92":389,"_96":325,"_383":775},{"_311":312,"_313":618,"_619":318,"_620":129,"_321":-5,"_92":621},{"_92":608,"_313":616,"_161":613,"_610":614,"_611":617},{"_92":608,"_313":612,"_161":613,"_610":614,"_611":615},{"_92":608,"_313":609,"_161":-5,"_610":-5,"_611":-5},[776],{"_559":46,"_46":624},"task_e_6a3a83e9e07883209c774c75aef80e21",1782219753.876921,"GitHub Mention: flow: model explicit `throw` as an abnormal exit (body-level dispose-not-called-on-throw)","has_generated_title","has_unread_turn","denormalized_metadata",{"_808":32,"_809":810,"_811":-5,"_812":-5,"_803":813,"_814":-5,"_815":-5,"_816":-5,"_817":-5},"task_status_display",{"_796":797,"_798":196,"_130":127,"_799":-5,"_800":801},"creator_workspace","external_pull_requests",[789],{"_42":790,"_791":83,"_792":793,"_794":129},"github-1268541171-94","assistant_turn_id","pull_request",{"_303":304,"_294":305,"_306":307,"_308":59,"_309":15,"_310":15,"_311":312,"_313":314,"_315":266,"_316":127,"_317":318,"_319":320,"_321":322,"_323":-5,"_324":-5,"_325":795,"_327":328,"_329":330,"_331":332,"_333":330},"codex_updated_sha",{"_288":289,"_181":289,"_334":-5,"_292":293,"_42":290},"latest_turn_status_display",{"_802":83,"_112":113,"_803":-5,"_94":804,"_805":-5,"_806":-5,"_807":801,"_114":-5},"environment_label","fix_task_id","initial_intent","pr","turn_id","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_818":-5,"_819":-5,"_820":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_832":833,"_834":835},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","statsigGateEvaluationsPromise",["P",831],"traceId","8042619005165061170","traceTime",1784159746376]