extractor: self-owned-property is a collectable subscription source

A subscription whose event SOURCE is reached through a get-only property the class
owns — this.Child.Event += this-capturing-handler, where Child is a property over a
constructed field — is the same collectable self-cycle as subscribing on the owned
field directly, not a leak. The self-owned exemption already covered this/fields/
locals the class constructs but not the PROPERTY receiver, so protobuf-net's
CommandLineOptions (XsltOptions, a get-only property over a constructed
XsltArgumentList, with a this-capturing handler) was falsely warned as an injected
subscription leak.

PropertyReturnsOwnedMember recognises a get-only property whose value the class
owns: an auto-property '{ get; } = new T()', or a getter returning a constructed
member (=> _owned / get => _owned / get { return _owned; }). Get-only is required —
a settable property could be reassigned to an injected, longer-lived object, which
we cannot prove bounded, so it falls through to the honest 'injected' warning
(precision-first: never silently drop a real leak).

New corpus fixture subscription-self-owned-property: before.cs subscribes to an
injected bus (real OWN001 leak, caught), after.cs to a self-owned property (silent).

Newtonsoft's serializer.Error (serializer = Create() that escapes, handler is a
param's delegate) stays baselined: proving it non-leak needs real lifetime
modelling, so the 'may outlive' warning is honest, not a clear FP.

Re-pointing the oracle at protobuf to confirm the XsltOptions FP clears.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019846YSZ35c7CdkWQ1qX5gm

Author: claude

.github/workflows/oracle.yml

@@ -45,6 +45,7 @@ on:
   push:
     branches:
       - claude/zen-pasteur-76hfs1
+      - claude/mos-ownership-summary-n3q3j4
     paths:
       - corpus/oracle-target.txt
 

corpus/oracle-fp-baseline.txt

@@ -33,7 +33,11 @@
 # --- protobuf-net/protobuf-net --------------------------------------------------
 protobuf-net/protobuf-net | ProtoWriter.BufferWriter.cs | OWN001 | _nullWriter | intentional null-object kept attached for pooled reuse; Dispose() documents "don't cascade dispose to the null one"
 protobuf-net/protobuf-net | ProtoTranscoder.cs | OWN001 | 'sync' | non-product (protobuf 'assorted' sample/extension tree); NetTranscoder is a long-lived singleton holding one ReaderWriterLockSlim for app lifetime
-protobuf-net/protobuf-net | CommandLineOptions.cs | OWN001 | XsltMessageEncountered | non-product (assorted/ProtoGen) + self-subscription: publisher (xsltOptions) and the lambda subscriber are both owned by the same CommandLineOptions, co-lifetimed
+# [fix-pending experiment] CommandLineOptions XsltMessageEncountered is cleared by the
+# PropertyReturnsOwnedMember fix — the source `XsltOptions` is a get-only property over a
+# constructed field, a self-cycle. Disabled here to confirm on a live protobuf oracle run
+# that it no longer fires; if confirmed it is deleted, if it resurfaces it is restored.
+# protobuf-net/protobuf-net | CommandLineOptions.cs | OWN001 | XsltMessageEncountered | non-product (assorted/ProtoGen) + self-subscription: publisher (xsltOptions) and the lambda subscriber are both owned by the same CommandLineOptions, co-lifetimed
 protobuf-net/protobuf-net | Page.xaml.cs | OWN001 | local 'timer' | non-product (assorted/ Silverlight sample); the timer is disposed by an enclosing `using (timer) { ... }` the extractor missed
 
 # --- JamesNK/Newtonsoft.Json ----------------------------------------------------

corpus/oracle-target.txt

@@ -13,5 +13,7 @@
 # differentiation, on real cross-tool output rather than the selftest's fixtures.
 # Expect: #1 Own.NET-only (now OWN014), #2/#3/#4 dispose leaks in "Agree", 0
 # oracle-only.
-local:corpus/fixtures/systemevents-console
-build=SystemEventsLeak.csproj
+# [temporary] pointed at protobuf-net to confirm PropertyReturnsOwnedMember clears the
+# CommandLineOptions XsltMessageEncountered self-cycle FP; restored after the run.
+protobuf-net/protobuf-net
+include_tests=false

corpus/real-world/subscription-self-owned-property/after.cs

@@ -0,0 +1,20 @@
+using System;
+
+class Bus { public event EventHandler? Changed; }
+
+// FIX: the watcher now OWNS the bus — a get-only property over a field it constructs.
+// The subscription is therefore a self-cycle: the Watcher, the owned Bus, and the
+// handler form one object graph the GC collects together. Not a leak, even with no
+// `-=` (mined on protobuf-net's CommandLineOptions, where `XsltOptions` is a get-only
+// property over a constructed XsltArgumentList field and the handler captures `this`).
+sealed class Watcher
+{
+    readonly Bus _bus = new Bus();   // constructed — owned by this
+    Bus Channel => _bus;             // get-only property returning the owned field
+    int _count;
+
+    public Watcher()
+    {
+        Channel.Changed += (s, e) => _count++;   // self-owned source -> silent
+    }
+}

corpus/real-world/subscription-self-owned-property/before.cs

@@ -0,0 +1,19 @@
+using System;
+
+class Bus { public event EventHandler? Changed; }
+
+// BUG: the watcher subscribes a `this`-capturing handler to an INJECTED bus — an
+// external object of unknown, potentially longer lifetime — and never detaches it.
+// The bus's handler list keeps the Watcher alive for the bus's lifetime: a real
+// subscription leak (the source may outlive `this`).
+sealed class Watcher
+{
+    readonly Bus _bus;   // injected — lifetime owned by someone else
+    int _count;
+
+    public Watcher(Bus bus)
+    {
+        _bus = bus;
+        _bus.Changed += (s, e) => _count++;   // never -= : leak
+    }
+}

corpus/real-world/subscription-self-owned-property/case.own

@@ -0,0 +1,19 @@
+// OwnLang model of the self-owned-property subscription discrimination, mined on
+// protobuf-net's CommandLineOptions: a `this`-capturing handler is subscribed to an
+// event on a source the component OWNS (a get-only property over a constructed field),
+// which is a collectable self-cycle, NOT a leak. before.cs is the leaky counterpart —
+// the same subscription on an INJECTED bus (external lifetime), never detached — the
+// generic OWN001 subscription leak, modelled here as a Subscription acquire with no
+// release. The extractor tells the two apart by resolving the event source: an owned
+// member (this/field/get-only-owned-property) is dropped (self-cycle), an injected one
+// stays a warning. See notes.md for the recognition rule (PropertyReturnsOwnedMember).
+module Corpus
+resource Subscription {
+  acquire Subscribe
+  release Unsubscribe
+  kind "subscription token"
+}
+fn Watch(bus: int) {
+  let token = acquire Subscription(bus);   // _bus.Changed += (s, e) => _count++
+  // no `release token;` — the injected bus is never `-=`'d -> handler leak (OWN001)
+}

corpus/real-world/subscription-self-owned-property/expected-diagnostics.txt

@@ -0,0 +1 @@
+OWN001

corpus/real-world/subscription-self-owned-property/notes.md

@@ -0,0 +1,38 @@
+# subscription-self-owned-property
+
+An event subscription whose SOURCE is a member the component **owns** — accessed
+through a get-only **property** — is a collectable self-cycle, not a leak. Mined on
+protobuf-net's `CommandLineOptions`:
+
+```csharp
+private readonly XsltArgumentList xsltOptions = new XsltArgumentList();
+public  XsltArgumentList XsltOptions => xsltOptions;          // get-only, owned
+...
+XsltOptions.XsltMessageEncountered += delegate { messageCount++; };  // handler captures `this`
+```
+
+The owned `XsltArgumentList`, the `CommandLineOptions` instance, and the handler form
+one object graph the GC collects together — no `-=` needed.
+
+- **before.cs** — the same subscription on an **injected** `Bus` (external, unknown
+  lifetime), never detached → a real subscription leak (`OWN001`, warning: the source
+  may outlive `this`).
+- **after.cs** — the source is now a **get-only property over a constructed field** the
+  component owns → self-cycle → **silent**.
+
+## Recognition rule
+
+The self-owned-source exemption already drops a subscription whose source is `this`, or
+a field/local the class constructs (`owned`). This case adds the missing receiver shape:
+a `this`-instance **get-only property** whose value the class owns —
+`PropertyReturnsOwnedMember`:
+
+- an auto-property `public T X { get; } = new T();` (value constructed in place), or
+- a getter that returns a constructed member: `=> _owned`, `get => _owned`, or
+  `get { return _owned; }` where the returned field/property is in `owned`.
+
+**Get-only is required.** A settable property could be reassigned to an injected,
+longer-lived object after construction, which we cannot prove bounded — so a property
+with any setter falls through to the honest "injected" warning (precision-first: never
+silently drop a real leak). Computed getters and getters returning a parameter/injected
+field likewise fall through.

frontend/roslyn/OwnSharp.Extractor/Program.cs

@@ -486,7 +486,52 @@ static bool IsSelfOwnedSource(ExpressionSyntax left, IEventSymbol ev,
     if (m.Expression is ThisExpressionSyntax)
         return true;
     var recv = model.GetSymbolInfo(m.Expression).Symbol;
-    return (recv is IFieldSymbol or ILocalSymbol) && owned.Contains(recv.Name);
+    if ((recv is IFieldSymbol or ILocalSymbol) && owned.Contains(recv.Name))
+        return true;
+    // A `this`-instance get-only PROPERTY whose value the class owns (`this.Child.Event
+    // += h`, Child a `=> _owned` / `{ get; } = new()` property) is the SAME collectable
+    // self-cycle as the owned field directly — this, the owned child, and the handler
+    // are collected together. The property must resolve to a member the class constructs.
+    return recv is IPropertySymbol { IsStatic: false } p
+           && PropertyReturnsOwnedMember(p, owned, model);
+}
+
+// A GET-ONLY property whose value the class OWNS: an auto-property initialised to
+// `new X()`, or one whose getter returns a field/property the class constructs
+// (`=> _owned`, `get => _owned`, `get { return _owned; }`). Such a property is part of
+// `this`'s own object graph, so a subscription on its event is the same collectable
+// self-cycle as subscribing on the owned field. GET-ONLY is required: a settable
+// property could be reassigned to an INJECTED, longer-lived object after construction,
+// which we cannot prove bounded — so we decline it (precision-first: never silently
+// drop a real leak). Only the dominant owned-property shapes are recognised; anything
+// else (a computed getter, a getter returning a parameter/injected field) falls through.
+static bool PropertyReturnsOwnedMember(IPropertySymbol prop, HashSet<string> owned,
+                                       SemanticModel model)
+{
+    if (prop.SetMethod is not null)
+        return false;
+    foreach (var sref in prop.DeclaringSyntaxReferences)
+    {
+        if (sref.GetSyntax() is not PropertyDeclarationSyntax pd)
+            continue;
+        // auto-property `public T X { get; } = new T();` — the value is constructed here.
+        if (pd.Initializer?.Value is ObjectCreationExpressionSyntax
+                                  or ImplicitObjectCreationExpressionSyntax)
+            return true;
+        // `=> expr`, `get => expr`, or `get { return expr; }` returning an owned member.
+        var get = pd.AccessorList?.Accessors
+            .FirstOrDefault(ac => ac.IsKind(SyntaxKind.GetAccessorDeclaration));
+        var returned = pd.ExpressionBody?.Expression
+            ?? get?.ExpressionBody?.Expression
+            ?? get?.Body?.Statements.OfType<ReturnStatementSyntax>().FirstOrDefault()?.Expression;
+        if (returned is null)
+            continue;
+        var pm = model.Compilation.GetSemanticModel(pd.SyntaxTree);
+        var rsym = pm.GetSymbolInfo(returned).Symbol;
+        if (rsym is IFieldSymbol or IPropertySymbol && owned.Contains(rsym.Name))
+            return true;
+    }
+    return false;
 }
 
 // P-004 (ext): a control fetching one of its OWN template parts —