All three are heuristics that need human triage: they surface re-entrant callouts and flag the ones with no WeakPtr liveness check in the same function. Start from the callout, then read up/down for a captured weak_this.

# Candidate re-entrant callouts in UI/window code, minus the ones already guarded.
# Then, for each hit's enclosing function, confirm there is NO AsWeakPtr()/
# GetWeakPtr()/weak_this liveness check after the call.
rg -n --pcre2 \
  '(delegate\(\)->On|->OnStateUpdate\(|RequestStateFromServer\(|DispatchEvent\(|->Run\()' \
  ui/ozone ui/platform_window components/ \
  | rg -v 'weak'

# Structural: a call on $obj followed by a later deref of $obj in the same
# block, with no weak_this/AsWeakPtr captured in that block.
weggli --cpp '{
  not: weak_this;
  not: AsWeakPtr();
  $obj->$callout($a);
  $obj->$member;
}'

rules:
  - id: reentrant-callout-frees-this-no-weakptr
    languages: [cpp]
    severity: WARNING
    message: >
      Method dispatches to a delegate/observer/callback that may synchronously
      destroy `this`, then accesses members without an AsWeakPtr()/GetWeakPtr()
      liveness check (WP-ASYNC-LIFETIME-UAF; e.g. CVE-2026-15112).
    patterns:
      - pattern-either:
          - pattern: $D->On$EV(...);
          - pattern: delegate()->$CB(...);
      - pattern-not-inside: |
          { ... $W = AsWeakPtr(); ... }
      - pattern-not-inside: |
          { ... $W = ...GetWeakPtr(); ... }

• MiraclePtr / BackupRefPtr (raw_ptr) — turns these into safe crashes; several were found by the rewrite
• WeakPtr liveness checks after every re-entrant callout (the canonical fix)
• Prefer posting a task over synchronous delegate callouts where feasible