fix(extractor): scope the AppDomain-event exemption to NON-CAPTURING handlers (Codex P1)

Codex: the first cut keyed only off the EVENT (the AppDomain source), ignoring the handler —
so it also dropped a real region escape, e.g. `AppDomain.CurrentDomain.ProcessExit += (_,_) =>
_field++` or an instance-method handler, whose delegate target is the subscriber and is pinned
to the process until shutdown. The Npgsql case is safe only because its lambda is non-capturing
(a static `ClearAll()` call).

HandlerRetainsNoInstance now gates the exemption: a static method group (null target) or a
lambda that captures neither `this` (explicit, or implicit via an instance member) nor an
enclosing local/parameter. A capturing handler stays OWN014.

Sample: ShutdownCleanup gains the 4th event (FirstChanceException, CodeRabbit) and a new
CapturingShutdownSubscriber (`(_,_) => _count++`) that must STILL warn. CI: assert no OWN014
anywhere in the sample file (format-insensitive, CodeRabbit) for the exempt cases, and OWN014
for both the non-AppDomain and the capturing controls.

(Rebased onto current main — #86/#87 landed; resolved the ci.yml sample-list conflict.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED

Author: claude

.github/workflows/ci.yml

@@ -319,14 +319,19 @@ jobs:
           echo "$out" | grep -q "region escape" \
             || { echo "FAIL: expected the region-escape wording on the static-event capture"; exit 1; }
           # P-004 process-lifetime AppDomain-event exemption (mined: Npgsql PoolManager): a
-          # subscription to a process-host AppDomain event (ProcessExit/DomainUnload/Unhandled-
-          # Exception) is a shutdown/diagnostics hook meant to live for the process -> NOT a
-          # region escape -> silent. A non-AppDomain static event with a lambda still escapes.
-          if echo "$out" | grep -q "ShutdownCleanup"; then
-            echo "FAIL: an AppDomain process-lifetime event subscription was wrongly reported as a region escape"; exit 1
+          # NON-CAPTURING handler on a process-host AppDomain event (ProcessExit/DomainUnload/
+          # UnhandledException/FirstChanceException) is a shutdown/diagnostics hook meant to live
+          # for the process -> NOT a region escape -> silent. (Assert no OWN014 anywhere in the
+          # sample file, not just the class name, so a format change can't slip through.)
+          if echo "$out" | grep -qE "AppDomainShutdownSample\.cs:[0-9]+:.*\[OWN014\]"; then
+            echo "FAIL: a non-capturing AppDomain process-lifetime event subscription was wrongly reported as OWN014"; exit 1
           fi
-          echo "$out" | grep -qE "NonAppDomainSubscriber.*OWN014|OWN014.*NonAppDomainSubscriber" \
+          # scope guards: a lambda on a NON-AppDomain static event still escapes; and an AppDomain
+          # handler that CAPTURES instance state is still pinned to the process -> still OWN014 (Codex).
+          echo "$out" | grep -qE "OWN014.*NonAppDomainSubscriber" \
             || { echo "FAIL: a lambda on a non-AppDomain static event must still raise OWN014 (exemption stays scoped)"; exit 1; }
+          echo "$out" | grep -qE "OWN014.*CapturingShutdownSubscriber" \
+            || { echo "FAIL: an instance-capturing AppDomain handler must still raise OWN014 (exemption is non-capturing only)"; exit 1; }
           # the unsubscribed variant (a matching `-=`, released capture) is mitigated
           # -> silent. Must NOT be reported.
           if echo "$out" | grep -q "CleanStaticEventViewModel"; then

frontend/roslyn/OwnSharp.Extractor/Program.cs

@@ -216,6 +216,48 @@ ev.Name is "ProcessExit" or "DomainUnload" or "UnhandledException" or "FirstChan
     && ev.ContainingType is { Name: "AppDomain" } ct
     && IsInNamespace(ct, "System");
 
+// Does this handler retain NO subscriber instance? A static method group has a null delegate
+// target; a lambda / anonymous method retains nothing only when it captures neither `this`
+// (explicit, or implicit via an instance member) nor an enclosing local/parameter. Keeps the
+// AppDomain process-lifetime exemption sound — a CAPTURING handler is still pinned to the
+// process until shutdown and stays OWN014 (Codex); only a non-capturing one (Npgsql's
+// `(_,_) => ClearAll()`, a static call) is safe to drop.
+static bool HandlerRetainsNoInstance(ExpressionSyntax right, SemanticModel model)
+{
+    if (IsStaticHandler(right, model))
+        return true;
+    if (right is not AnonymousFunctionExpressionSyntax lambda)
+        return false;   // a delegate-typed value is opaque -> conservatively assume it captures
+    foreach (var node in lambda.DescendantNodes())
+    {
+        if (node is ThisExpressionSyntax or BaseExpressionSyntax)
+            return false;
+        if (node is not IdentifierNameSyntax id
+            || (id.Parent is MemberAccessExpressionSyntax m && m.Name == id))   // `x.Member`: name resolved via x
+            continue;
+        var sym = model.GetSymbolInfo(id).Symbol;
+        if (sym is IFieldSymbol { IsStatic: false } or IPropertySymbol { IsStatic: false }
+                or IEventSymbol { IsStatic: false }
+                or IMethodSymbol { IsStatic: false, MethodKind: MethodKind.Ordinary })
+            return false;   // an instance member by SIMPLE name -> implicit `this` capture
+        if (sym is ILocalSymbol or IParameterSymbol && !DeclaredWithin(sym, lambda))
+            return false;   // an enclosing local / parameter -> captured
+    }
+    return true;
+}
+
+// Is EVERY declaration of `sym` inside `scope`? A lambda's own parameters/locals are; an
+// enclosing local/parameter is not — so a reference to the latter is a capture.
+static bool DeclaredWithin(ISymbol sym, SyntaxNode scope)
+{
+    if (sym.DeclaringSyntaxReferences.Length == 0)
+        return false;
+    foreach (var r in sym.DeclaringSyntaxReferences)
+        if (!scope.FullSpan.Contains(r.Span))
+            return false;
+    return true;
+}
+
 // P-004 process-lived-subscriber exemption: the WPF application object (`App`) is a
 // process-lived singleton — exactly one instance, created at startup, alive until
 // the process exits. Subscribing it to a process-lived static event
@@ -2092,12 +2134,15 @@ or ImplicitObjectCreationExpressionSyntax
                 //  - static handler — a static method has a null delegate target,
                 //    so no instance is retained and nothing can leak.
                 //  - a process-host AppDomain event (ProcessExit/DomainUnload/Unhandled-
-                //    Exception/FirstChanceException) — the handler is meant to live for the
-                //    whole process, so the "escape" is the intent, not a leak (mined: Npgsql
-                //    PoolManager's `AppDomain.CurrentDomain.ProcessExit += …` shutdown hook).
+                //    Exception/FirstChanceException) whose handler retains NO instance — the
+                //    handler is meant to live for the whole process, so the "escape" is the
+                //    intent, not a leak (mined: Npgsql PoolManager's `AppDomain.CurrentDomain.
+                //    ProcessExit += (_,_) => ClearAll()` shutdown hook). A handler that captures
+                //    instance state still pins it to the process, so it stays OWN014 (Codex).
                 if (!isTimer && (IsSelfOwnedSource(a.Left, ev, model, selfOwned)
                                  || IsStaticHandler(a.Right, model)
-                                 || IsProcessLifetimeAppDomainEvent(ev)))
+                                 || (IsProcessLifetimeAppDomainEvent(ev)
+                                     && HandlerRetainsNoInstance(a.Right, model))))
                     continue;
                 // P-004 tiering: a local-variable source is method-bounded — it
                 // cannot outlive `this`, so it is not a heap leak; drop it (the same

frontend/roslyn/samples/AppDomainShutdownSample.cs

@@ -13,14 +13,28 @@ public sealed class ShutdownCleanup
 {
     public ShutdownCleanup()
     {
-        AppDomain.CurrentDomain.ProcessExit += (_, _) => Cleanup();        // shutdown hook -> SILENT
-        AppDomain.CurrentDomain.DomainUnload += (_, _) => Cleanup();       // shutdown hook -> SILENT
-        AppDomain.CurrentDomain.UnhandledException += (_, _) => Cleanup(); // process diagnostics -> SILENT
+        AppDomain.CurrentDomain.ProcessExit += (_, _) => Cleanup();          // shutdown hook -> SILENT
+        AppDomain.CurrentDomain.DomainUnload += (_, _) => Cleanup();         // shutdown hook -> SILENT
+        AppDomain.CurrentDomain.UnhandledException += (_, _) => Cleanup();   // process diagnostics -> SILENT
+        AppDomain.CurrentDomain.FirstChanceException += (_, _) => Cleanup(); // process diagnostics -> SILENT
     }
 
     private static void Cleanup() { }
 }
 
+// Codex control: a process-host AppDomain event is exempt only when the handler retains NO
+// instance. A lambda that CAPTURES instance state (here `_count`) pins this subscriber to the
+// process until shutdown — a real region escape that must STILL raise OWN014.
+public sealed class CapturingShutdownSubscriber
+{
+    private int _count;
+
+    public CapturingShutdownSubscriber()
+    {
+        AppDomain.CurrentDomain.ProcessExit += (_, _) => _count++;   // captures `this` -> OWN014
+    }
+}
+
 public static class SomeBus
 {
     public static event EventHandler? Pinged;