diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ea7301eb..d77bf577 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1122,6 +1122,26 @@ jobs:
           # the listener is released, so no false-positive leak
           [ "$(echo "$expr" | grep -cE '\[(OWN|EFF|DI)[0-9]{3}\]')" -eq 0 ] \
             || { echo "FAIL: a properly-released listener must not be reported"; exit 1; }
+      - name: Real-world cleanup patterns (OSS-benchmark FP fixes) are silent
+        run: |
+          python frontend/ownts/ownts.py frontend/ownts/examples/EffectRealWorld.tsx \
+            -o "$RUNNER_TEMP/rw.facts.json"
+          rw=$(python -m ownlang ownir "$RUNNER_TEMP/rw.facts.json")
+          echo "$rw"
+          # AbortController signal, ref/pre-declared timer handles, nested-block
+          # cleanup, observer.subscribe/unsubscribe — all released, zero findings.
+          [ "$(echo "$rw" | grep -cE '\[(OWN|EFF|DI)[0-9]{3}\]')" -eq 0 ] \
+            || { echo "FAIL: real-world cleanup patterns must not be reported"; exit 1; }
+      - name: False-negative controls (wrong controller / args / conditional cleanup) still leak
+        run: |
+          python frontend/ownts/ownts.py frontend/ownts/examples/EffectLeakControl.tsx \
+            -o "$RUNNER_TEMP/leak.facts.json"
+          leak=$(python -m ownlang ownir "$RUNNER_TEMP/leak.facts.json" || true)
+          echo "$leak"
+          # a release-shaped cleanup that does not release THIS resource must not be
+          # over-suppressed — all three controls stay OWN001
+          [ "$(echo "$leak" | grep -c 'OWN001')" -eq 3 ] \
+            || { echo "FAIL: broadened matchers must not over-suppress real leaks"; exit 1; }
       - name: The clean fixture (cleanups + useMemo'd dep) is silent
         run: |
           python frontend/ownts/ownts.py frontend/ownts/examples/DashboardClean.tsx \
diff --git a/docs/notes/ownts-oss-benchmark.md b/docs/notes/ownts-oss-benchmark.md
new file mode 100644
index 00000000..e60627b1
--- /dev/null
+++ b/docs/notes/ownts-oss-benchmark.md
@@ -0,0 +1,146 @@
+# OwnTS real-world benchmark — the false-positive reckoning
+
+A field note answering the gating question P-020 set for the OwnTS spike: *does it
+find real `useEffect` leaks in real OSS with low false positives?* Short answer for
+the first run: **no — 28/28 findings were false positives.** This note records the
+corpus, the result, and the prioritized false-positive (FP) catalog the run
+produced, plus what was done about it.
+
+## Method
+
+- **Corpus.** Real, published React hook libraries pulled from **npm** (the
+  session's egress policy blocks `github.com`, so a raw-source clone was not
+  possible; npm registry is allowed). Limited to packages whose published build is
+  **modern arrow-function ESM**, which the source-tuned spike parses as-is:
+  - `@mantine/hooks` 9.4.0
+  - `@react-hookz/web` 25.2.0
+  - `@uidotdev/usehooks` 2.4.1
+  - `usehooks-ts` 3.1.1
+- **Caveat.** `ahooks` and `react-use` were pulled too but ship **ES5
+  (`function(){}`) output**, which the spike (tuned for arrow `() =>` callbacks and
+  `return () =>` cleanups) does not parse — a separate parser-coverage gap, excluded
+  from the FP analysis rather than counted as analyzer FPs.
+- **Scale.** ~108 `useEffect` calls across 81 files.
+- **Run.** Each file → `ownts.extract` + `ownts.extract_effects` → `check_facts`;
+  findings collected and then **triaged by reading the actual source** around each.
+
+## Result (baseline — before this PR's fixes)
+
+| Code | Findings | True positive | False positive |
+|------|---------:|--------------:|---------------:|
+| `OWN001` | 28 | 0 | **28** |
+| `EFF001` | 0 | — | — |
+| **Total** | **28** | **0** | **28 (100%)** |
+
+Zero real leaks, zero effect storms, 28 false positives. These are well-maintained
+libraries that *do* clean up — just with patterns the synthetic-fixture-tuned spike
+did not model.
+
+## The FP catalog (what real code does that the spike missed)
+
+Ordered by frequency; each is a frontend (not core) limitation.
+
+1. **AbortController `{ signal }`** — listeners added with a `signal` option and torn
+   down by `controller.abort()` in cleanup (abort removes every signal-bound
+   listener at once). The spike had no model for it. *(mantine `use-floating-window`,
+   7 findings.)*
+2. **Handle stored in a ref / pre-declared `let`** — `timeoutRef.current =
+   setTimeout(...)`, `let i; … i = setInterval(...)`. `_lhs_token` only recognized a
+   same-statement `const/let/var NAME =`, so the handle was "uncapturable" and the
+   matching `clearTimeout(ref.current)` never matched. *(debounced-value, use-idle,
+   uidotdev, useVibrate.)*
+3. **Cleanup `return` from a nested block** — the `return () => …` lives inside an
+   `if` / `try` / `.then()` within the effect. `_cleanup_span` only accepted a return
+   at the effect body's own brace depth (1), so a depth-2 cleanup was invisible and
+   every resource read as un-released. *(use-media-query, use-scroller, useVibrate.)*
+4. **Aliased receiver** — `b.addEventListener(...)` in a `.then(b => …)` callback,
+   torn down by `battery.removeEventListener(...)` (same object, different
+   identifier). The full-key match compares the receiver string, so `b ≠ battery`.
+   *(uidotdev `useBattery`, 4 findings.)*
+5. **Cleanup via a named function or a method** — `return cancel`, `ro.unsubscribe`,
+   `resizeObserver.disconnect()`. The matcher could not follow a function reference
+   or a bare-statement subscribe. *(react-hookz `useResizeObserver`, debounced-value.)*
+6. **One-shot `setTimeout`** with no captured handle — fires once and is gone, not a
+   retained resource, but flagged like an un-cleared `setInterval`. *(use-focus-trap.)*
+
+## Verdict
+
+The spike was **not alpha-ready** on idiomatic modern hook code: ~100% FP. This is
+the honest "value, not form" check the consolidation note asked for. The catalog is
+the payoff — a concrete, prioritized list of what to model next, every item a small
+frontend extension.
+
+## What this PR changed (after)
+
+This PR teaches the **frontend** (not the core) to recognize the *provable* cleanup
+patterns — those where the teardown is visible in the effect — and leaves the
+genuinely-hard ones documented rather than guessed. Implemented:
+
+- **AbortController `{ signal }`** (#1): a signal-bound listener is released by a
+  `controller.abort()` in cleanup.
+- **Ref / pre-declared handle** (#2): `_lhs_token` now also recognizes
+  `ref.current = setTimeout(...)` and `let i; i = setInterval(...)`, so the matching
+  `clearTimeout(ref.current)` / `clearInterval(i)` lands.
+- **Nested-block cleanup** (#3): `_cleanup_span` switched from brace-depth to
+  **function-depth**, so a `return () => …` inside an `if`/`try`/`.then()` is the
+  effect's cleanup, while a `return` inside a nested callback still is not.
+- **Observer subscribe/unsubscribe** (part of #5): a bare `recv.subscribe(...)` is
+  released by `recv.unsubscribe(...)` / `recv.disconnect()` on the same receiver.
+
+Pinned by `frontend/ownts/examples/EffectRealWorld.tsx` (distilled from the OSS
+cases) + a CI step; `Dashboard`/`EffectEdges` still flag real leaks, proving the
+fixes do not over-suppress.
+
+### Result (after)
+
+| | Findings | Confirmed leaks | False positives |
+|---|---:|---:|---:|
+| **Baseline** | 28 | 0 | 28 |
+| **After** | **11** | 0 | 9 FP + 2 borderline |
+
+**17 false positives eliminated** (61%); correctly-silent effects rose from
+**80/108 → 97/108** specificity. Still zero confirmed leaks — these are
+well-maintained libraries, so that is the *expected* honest outcome, not a miss.
+
+### Residual (deliberately not fixed — they would require guessing)
+
+- **Aliased receiver** (#4): `b.addEventListener(...)` torn down by
+  `battery.removeEventListener(...)` (same object, different identifier). Needs alias
+  analysis. *(uidotdev `useBattery`, 4.)*
+- **Cross-effect / named-helper cleanup** (#5): the teardown is a `cancel()` /
+  `removeEventListeners()` helper, often called from a *different* effect. Following
+  it is interprocedural — out of scope for a narrow frontend. *(mantine
+  `use-debounced-value` 2, uidotdev `useScript` 2.)*
+- **One-shot `setTimeout`** (#6): an uncaptured `setTimeout` fires once and frees
+  itself; flagging it like a repeating `setInterval` is the conservative-but-noisy
+  call. Left as-is rather than silently suppressed (which could hide a real
+  re-render pileup). *(mantine `use-focus-trap`, 1.)*
+- **Borderline**: a listener intentionally left on a *cached* shared `<script>` node
+  (`usehooks-ts` `useScript`, 2) — defensible either way; the spike correctly
+  observes "never removed."
+
+The honest takeaway: OwnTS is now quiet on idiomatic cleanup, with its remaining
+false alarms confined to four named, understood patterns — a real step toward the
+"low false positives" bar P-020 set, without a single guessed release.
+
+### Reproduce
+
+```bash
+# (egress to npm only; github.com is blocked in this environment)
+# versions pinned to the exact builds benchmarked above, so reruns are reproducible
+npm pack @mantine/hooks@9.4.0 @react-hookz/web@25.2.0 \
+         @uidotdev/usehooks@2.4.1 usehooks-ts@3.1.1
+# extract each tarball, then run ownts.extract + extract_effects + check_facts
+# over every *.js/*.mjs (skip *.d.ts); triage each finding against the source.
+```
+
+### Soundness of the new matchers
+
+The broadened release matchers stay **fail-closed** — a release-shaped cleanup that
+does not actually release *this* resource still reports the leak, pinned by
+`EffectLeakControl.tsx`: a listener bound to `c1.signal` torn down by `c2.abort()`,
+a `ro.subscribe(a, h)` "released" by `ro.unsubscribe(b, h)`, and a cleanup returned
+only under `if (enabled)` over an unconditional `setInterval` — all three remain
+`OWN001`. The signal is tied to its controller, the observer to its argument list,
+and a conditional cleanup only releases acquires it dominates (co-guarded in the
+same block).
diff --git a/frontend/ownts/examples/EffectLeakControl.tsx b/frontend/ownts/examples/EffectLeakControl.tsx
new file mode 100644
index 00000000..d75e08b6
--- /dev/null
+++ b/frontend/ownts/examples/EffectLeakControl.tsx
@@ -0,0 +1,33 @@
+// False-negative controls for the broadened release matchers (Codex/CodeRabbit):
+// each uses a release-shaped cleanup that does NOT actually release THIS resource,
+// so it must STILL report a leak. Run:
+//   python frontend/ownts/ownts.py frontend/ownts/examples/EffectLeakControl.tsx --check
+// Expect exactly three OWN001 findings.
+import { useEffect } from "react";
+
+export function LeakControl({ enabled }: { enabled: boolean }) {
+  // (1) wrong controller: the listener is bound to c1's signal, but cleanup aborts
+  // c2 — the original listener stays live.
+  useEffect(() => {
+    const c1 = new AbortController();
+    const c2 = new AbortController();
+    window.addEventListener("scroll", onScroll, { signal: c1.signal });
+    return () => c2.abort();
+  }, []);
+
+  // (2) mismatched unsubscribe args: subscribed with (a, h), torn down with (b, h)
+  // — the (a, h) subscription leaks.
+  useEffect(() => {
+    ro.subscribe(a, h);
+    return () => ro.unsubscribe(b, h);
+  }, []);
+
+  // (3) conditional cleanup: the timer is created unconditionally, but the cleanup
+  // is only returned when `enabled` — the !enabled path leaks.
+  useEffect(() => {
+    const id = setInterval(tick, 1000);
+    if (enabled) return () => clearInterval(id);
+  }, [enabled]);
+
+  return <div>leak control</div>;
+}
diff --git a/frontend/ownts/examples/EffectRealWorld.tsx b/frontend/ownts/examples/EffectRealWorld.tsx
new file mode 100644
index 00000000..15ebf082
--- /dev/null
+++ b/frontend/ownts/examples/EffectRealWorld.tsx
@@ -0,0 +1,51 @@
+// Real-world cleanup patterns the OSS benchmark (docs/notes/ownts-oss-benchmark.md)
+// found the spike was missing — each distilled to a minimal release that the
+// frontend must now recognise. Run:
+//   python frontend/ownts/ownts.py frontend/ownts/examples/EffectRealWorld.tsx --check
+// Expect ZERO findings — every resource here is properly released.
+// (The "still leaks" control lives in Dashboard.tsx / EffectEdges.tsx, so this
+// fixture also proves the fixes did not over-suppress real leaks.)
+import { useEffect, useRef } from "react";
+
+export function RealWorld({ src }: { src: string }) {
+  // AbortController: listeners bound to a signal, torn down by controller.abort().
+  useEffect(() => {
+    const controller = new AbortController();
+    const { signal } = controller;
+    window.addEventListener("mousemove", onMove, { signal });
+    window.addEventListener("mouseup", onEnd, { signal });
+    return () => controller.abort();
+  }, []);
+
+  // Timer handle stored in a ref, cleared inline in cleanup.
+  const timeoutRef = useRef(-1);
+  useEffect(() => {
+    timeoutRef.current = window.setTimeout(() => onReady(), 200);
+    return () => window.clearTimeout(timeoutRef.current);
+  }, []);
+
+  // Pre-declared `let` handle, assigned then cleared.
+  useEffect(() => {
+    let interval;
+    interval = setInterval(tick, 1000);
+    return () => clearInterval(interval);
+  }, []);
+
+  // Cleanup returned from a NESTED block (inside `if`) — still the effect's cleanup.
+  useEffect(() => {
+    if ("matchMedia" in window) {
+      const mq = window.matchMedia(src);
+      const cb = (e) => onMatch(e.matches);
+      mq.addEventListener("change", cb);
+      return () => mq.removeEventListener("change", cb);
+    }
+  }, [src]);
+
+  // Bare observer.subscribe(...) released by observer.unsubscribe(...) on the same receiver.
+  useEffect(() => {
+    ro.subscribe(target, handler);
+    return () => ro.unsubscribe(target, handler);
+  }, []);
+
+  return <div>real world</div>;
+}
diff --git a/frontend/ownts/ownts.py b/frontend/ownts/ownts.py
index 7ebb7313..2494a6b6 100644
--- a/frontend/ownts/ownts.py
+++ b/frontend/ownts/ownts.py
@@ -67,12 +67,19 @@ class Acquire:
 
 
 def _lhs_token(setup: str, pos: int) -> str | None:
-    """The variable an acquire's result is bound to, e.g. `id` in
-    `const id = setInterval(...)` or `sub` in `const sub = obs.subscribe(...)`.
-    Scoped to the current statement so an earlier `const` does not bleed in."""
+    """The handle an acquire's result is bound to, so a matching `clearTimeout(handle)`
+    / `handle.unsubscribe()` in cleanup can be found. Covers a declaration
+    (`const id = setInterval(...)`), a plain reassignment of a pre-declared variable
+    (`let i; … i = setInterval(...)`), and a ref/member store
+    (`timeoutRef.current = setTimeout(...)`). Scoped to the current statement; takes
+    the LAST assignment target before the call."""
     head = re.split(r"[;\n{}]", setup[:pos])[-1]
-    m = re.search(r"(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=", head)
-    return m.group(1) if m else None
+    tok = None
+    for m in re.finditer(
+            r"(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*=(?!=)",
+            head):
+        tok = m.group(1)
+    return tok
 
 
 def _capture_flag(opts: str) -> str:
@@ -114,6 +121,36 @@ def _receiver(text: str, end: int) -> str:
     return m.group(1) if m else ""
 
 
+def _call_args(s: str) -> str | None:
+    """The normalized (whitespace-stripped) argument text of the first call in `s`,
+    e.g. `target,handler` for `.subscribe(target, handler)`. None if no `(`."""
+    i = s.find("(")
+    if i == -1:
+        return None
+    close = _match_pair(s, i, "(", ")")
+    return re.sub(r"\s+", "", s[i + 1:close - 1])
+
+
+def _signal_controller(setup: str, opts: str) -> str | None:
+    """The AbortController whose `signal` an addEventListener options arg uses, so a
+    cleanup is only credited when THAT controller is aborted. `{ signal: c.signal }`
+    → `c`; the shorthand `{ signal }` is resolved back through `const signal =
+    c.signal` / `const { signal } = c` in setup. None when it can't be tied."""
+    m = re.search(r"\bsignal\s*:\s*([A-Za-z_$][\w$.]*)", opts)
+    if m:
+        return re.sub(r"\.signal$", "", m.group(1))
+    if re.search(r"\bsignal\b", opts):  # shorthand `{ signal }`
+        m = re.search(r"(?:const|let|var)\s+signal\s*=\s*([A-Za-z_$][\w$]*)\s*\.\s*signal\b",
+                      setup)
+        if m:
+            return m.group(1)
+        m = re.search(r"(?:const|let|var)\s*\{\s*signal\b[^}]*\}\s*=\s*([A-Za-z_$][\w$]*)",
+                      setup)
+        if m:
+            return m.group(1)
+    return None
+
+
 def _is_released(acq: Acquire, setup: str, pos: int, cleanup: str) -> bool:
     """Whether THIS acquire (at `pos` in `setup`) is released by the effect's cleanup
     — matched to its own handle, so two `setInterval`s with one `clearInterval` leave
@@ -125,17 +162,41 @@ def _is_released(acq: Acquire, setup: str, pos: int, cleanup: str) -> bool:
             rf"\bclear(?:Interval|Timeout)\s*\(\s*{re.escape(tok)}\b", cleanup))
     if acq.resource == "subscribe":
         tok = _lhs_token(setup, pos)
-        return bool(tok and re.search(
-            rf"\b{re.escape(tok)}\s*\.\s*(?:unsubscribe|remove)\s*\(", cleanup))
+        if tok and re.search(
+                rf"\b{re.escape(tok)}\s*\.\s*(?:unsubscribe|remove)\s*\(", cleanup):
+            return True
+        # a bare `recv.subscribe(args)` (no token) is released only by a cleanup
+        # `recv.unsubscribe(args)` on the SAME receiver AND the same argument list
+        # (a `disconnect()` with no args tears down everything). Iterating + comparing
+        # in Python gives an exact receiver match (no `otherro` substring) and no
+        # interpolated regex.
+        recv = _receiver(setup, pos)
+        if not recv:
+            return False
+        sub_args = _call_args(setup[pos:])
+        for um in re.finditer(
+                r"([A-Za-z_$][\w$.\[\]]*)\s*\.\s*(?:unsubscribe|disconnect)\s*\(", cleanup):
+            if um.group(1) == recv and _call_args(cleanup[um.end() - 1:]) in ("", sub_args):
+                return True
+        return False
     if acq.resource == "subscription":  # target.addEventListener(event, handler[, opts])
-        # The full listener key is (receiver, event, handler, capture). A listener is
-        # released ONLY by a removeEventListener whose whole key matches — a different
-        # event name, target, or capture flag is a different listener that still
-        # leaks. Fail closed: if the acquire's own target can't be identified, or no
-        # cleanup call matches every field, treat it as a leak.
         a = _listener_call(setup[pos:])
         if a is None:
             return False
+        # AbortController: a signal-bound listener is released only when THE controller
+        # backing that signal is aborted in cleanup — tie `{ signal }` back to its
+        # controller and require `<that controller>.abort()`, not any `.abort()`.
+        am = _LISTENER.match(setup[pos:].lstrip())
+        opts = (am.group(3) or "") if am else ""
+        ctrl = _signal_controller(setup, opts)
+        if ctrl and any(
+                ab.group(1) == ctrl for ab in
+                re.finditer(r"([A-Za-z_$][\w$.\[\]]*)\s*\.\s*abort\s*\(", cleanup)):
+            return True
+        # Otherwise the full listener key is (receiver, event, handler, capture): a
+        # listener is released ONLY by a removeEventListener whose whole key matches —
+        # a different event name, target, or capture flag is a different listener that
+        # still leaks. Fail closed if the target can't be identified.
         a_recv = _receiver(setup, pos)
         if not a_recv:
             return False
@@ -380,40 +441,73 @@ def _effect_callback(masked: str, after_open: int) -> tuple[str, int, list[str]
     return body, i, deps, end
 
 
-def _cleanup_span(mbody: str) -> tuple[int, int] | None:
-    """The (start, end) span of the effect's OWN top-level cleanup within `mbody`
-    (the masked body), or None. A `return ... =>` nested inside a callback
-    (brace-depth > 1) is NOT the effect cleanup and must not suppress a leak. The
-    span is returned (not slices) so the caller can cut it out of BOTH the masked
-    body (for acquire scanning) and the original body (for event/string comparison)."""
-    for m in re.finditer(r"return\s*(?:\(\s*\)|\w+)\s*=>", mbody):
-        prefix = mbody[:m.start()]
-        if prefix.count("{") - prefix.count("}") != 1:  # 1 == the effect body's own brace
+def _cleanup_span(mbody: str) -> tuple[int, int, int] | None:
+    """`(start, end, cov_start)` for the effect's OWN cleanup within `mbody` (masked),
+    or None. The cleanup is the `return () => …` directly in the effect callback —
+    possibly inside an `if`/`try`/`.then()` BLOCK, but NOT inside a nested CALLBACK. So
+    the test is FUNCTION depth, not brace depth: a block `{` keeps us in the effect; an
+    arrow/`function` body `{` is a new function. A return at function-depth 1 is the
+    cleanup; deeper is some inner callback's return.
+
+    `cov_start` bounds which acquires the cleanup may credit: only acquires at body
+    position `cov_start < p < start` are co-guarded with the cleanup. For a top-level
+    cleanup that is the whole effect body (`cov_start == 0`); for a cleanup inside a
+    block it is that block's `{` (so an acquire OUTSIDE the branch is NOT released by a
+    conditional cleanup); for a *braceless* guard (`if (x) return …`) it is `start`
+    (empty), so a conditionally-returned cleanup releases nothing it does not dominate."""
+    # function-body braces: the effect body's own `{` (index 0), plus every `=> {`
+    # and `function (...) {`. Every other `{` is a plain block (if/try/for/object).
+    fn_braces = {0}
+    for fm in re.finditer(r"=>\s*\{", mbody):
+        fn_braces.add(fm.end() - 1)
+    for fm in re.finditer(r"\bfunction\b[^{;]*?\)\s*\{", mbody):
+        fn_braces.add(fm.end() - 1)
+    ret_re = re.compile(r"return\s*(?:\(\s*\)|\w+)\s*=>")
+    stack: list[tuple[bool, int]] = []  # (is_function_body, open_index) per open brace
+    fdepth = 0
+    i, n = 0, len(mbody)
+    while i < n:
+        c = mbody[i]
+        if c == "{":
+            is_fn = i in fn_braces
+            stack.append((is_fn, i))
+            fdepth += 1 if is_fn else 0
+            i += 1
             continue
-        rest = mbody[m.end():]
-        stripped = rest.lstrip()
-        if stripped.startswith("{"):  # block-bodied cleanup: `=> { ... }`
-            brace = m.end() + (len(rest) - len(stripped))
-            return (m.start(), _match_block(mbody, brace))
-        # single-expression cleanup. Consume the WHOLE expression across line breaks
-        # — stopping at a top-level `;` or the effect body's own closing brace, NOT
-        # the first newline (which truncates a multi-line call) and NOT a `find("{")`
-        # (which would mistake an options object like `{capture: true}` inside the
-        # call for the cleanup block). Both truncations drop the closing `)` and turn
-        # a released listener into a false leak.
-        i, depth = m.end(), 0
-        while i < len(mbody):
-            c = mbody[i]
-            if c in "([{":
-                depth += 1
-            elif c in ")]}":
-                if depth == 0:  # the effect body's closing brace — expression ends
-                    break
-                depth -= 1
-            elif c == ";" and depth == 0:
-                break
+        if c == "}":
+            if stack and stack.pop()[0]:
+                fdepth -= 1
             i += 1
-        return (m.start(), i)
+            continue
+        if c == "r" and fdepth == 1:
+            m = ret_re.match(mbody, i)
+            if m:
+                cov_start = stack[-1][1] if stack else 0  # innermost enclosing block
+                b = max(mbody.rfind(";", 0, i), mbody.rfind("{", 0, i),
+                        mbody.rfind("}", 0, i))
+                if re.search(r"\b(?:if|else|for|while)\b", mbody[b + 1:i]):
+                    cov_start = m.start()  # braceless conditional guard -> covers nothing
+                rest = mbody[m.end():]
+                stripped = rest.lstrip()
+                if stripped.startswith("{"):  # block-bodied cleanup: `=> { ... }`
+                    brace = m.end() + (len(rest) - len(stripped))
+                    return (m.start(), _match_block(mbody, brace), cov_start)
+                # single-expression cleanup — consume the WHOLE expression across line
+                # breaks, stopping at a top-level `;` or the effect body's own close.
+                j, depth = m.end(), 0
+                while j < n:
+                    cj = mbody[j]
+                    if cj in "([{":
+                        depth += 1
+                    elif cj in ")]}":
+                        if depth == 0:
+                            break
+                        depth -= 1
+                    elif cj == ";" and depth == 0:
+                        break
+                    j += 1
+                return (m.start(), j, cov_start)
+        i += 1
     return None
 
 
@@ -426,11 +520,12 @@ def extract(path: str) -> list[Component]:
         body_o = text[body_start:end]  # original (unmasked) body — same positions
         span = _cleanup_span(body_m)
         if span:
-            cs, ce = span
+            cs, ce, cov_start = span
             setup_m = body_m[:cs] + body_m[ce:]
             setup_o = body_o[:cs] + body_o[ce:]
             cleanup_o = body_o[cs:ce]
         else:
+            cs = ce = cov_start = -1
             setup_m, setup_o, cleanup_o = body_m, body_o, ""
         cname = _component_at(masked, eff.start())
         comp = comps.setdefault(cname, Component(cname, path))
@@ -439,9 +534,16 @@ def extract(path: str) -> list[Component]:
             # decide release on the ORIGINAL setup/cleanup (so event-name strings and
             # handles are intact for the full-key comparison).
             for hit in acq.pattern.finditer(setup_m):
-                abs_pos = body_start + hit.start()
+                # map the setup position back to the body (the cleanup span was cut out)
+                sp = hit.start()
+                bp = sp if (cs < 0 or sp < cs) else sp + (ce - cs)
+                abs_pos = body_start + bp
                 line = masked.count("\n", 0, abs_pos) + 1
-                released = _is_released(acq, setup_o, hit.start(), cleanup_o)
+                # a conditional cleanup only releases acquires it dominates (co-guarded
+                # in the same block); an acquire outside that block keeps its own cleanup
+                # empty, so a `return` guarded by a branch cannot silence it.
+                covered = cs < 0 or cov_start < bp < cs
+                released = _is_released(acq, setup_o, sp, cleanup_o if covered else "")
                 # the acquire expression for the tag — from the ORIGINAL text, so the
                 # message shows the real call (string args intact), trimmed to one line.
                 snippet = text[abs_pos:].splitlines()[0].strip().rstrip("{").strip()
diff --git a/frontend/ownts/test_ownts.py b/frontend/ownts/test_ownts.py
index d04d806f..63a32df2 100644
--- a/frontend/ownts/test_ownts.py
+++ b/frontend/ownts/test_ownts.py
@@ -57,6 +57,19 @@ def main() -> int:
     hardening = codes("EffectHardening.tsx")
     assert hardening == ["OWN001", "EFF001"], f"EffectHardening -> {hardening}"
 
+    # Real-world cleanup patterns from the OSS benchmark (AbortController signal,
+    # ref/pre-declared timer handles, cleanup returned from a nested block,
+    # observer.subscribe released by observer.unsubscribe) must all read as released.
+    real = codes("EffectRealWorld.tsx")
+    assert real == [], f"EffectRealWorld should be silent -> {real}"
+
+    # False-negative controls: a release-shaped cleanup that does NOT release THIS
+    # resource (wrong AbortController, mismatched unsubscribe args, a conditionally
+    # returned cleanup over an unconditional acquire) must STILL report the leak —
+    # the broadened matchers must not over-suppress.
+    leaks = codes("EffectLeakControl.tsx")
+    assert leaks == ["OWN001", "OWN001", "OWN001"], f"EffectLeakControl -> {leaks}"
+
     # an expression-bodied cleanup whose removeEventListener carries an options
     # object must parse (the `{` belongs to the call, not the cleanup block) — the
     # listener is released, so no false-positive leak.