fix(extractor): exempt process-host AppDomain event subscriptions from OWN014 (mined Npgsql)

Mining npgsql/npgsql surfaced this: PoolManager's static ctor subscribes
`AppDomain.CurrentDomain.{DomainUnload,ProcessExit} += (_,_) => ClearAll()` — a deliberate
"close idle connectors on appdomain unload (web-app redeployment)" hook (#491) — and the
detector reported it as an OWN014 region escape. But subscribing to a process-host AppDomain
event is never a leak: ProcessExit/DomainUnload run at shutdown, UnhandledException /
FirstChanceException on every unhandled throw, and the AppDomain IS the process host — the
handler is MEANT to live for the whole process. Promoting the subscriber to "the AppDomain's
lifetime" is the intent, not a leak.

IsProcessLifetimeAppDomainEvent exempts these four System.AppDomain events from the OWN014
region escape (alongside the self-owned-source and static-handler exemptions). Scoped to the
event's resolved declaring type, so a project's own `AppDomain`-named type is not matched, and a
non-AppDomain process-lived static event still escapes.

Regression sample AppDomainShutdownSample.cs: ShutdownCleanup (ProcessExit/DomainUnload/
UnhandledException lambdas) stays silent; NonAppDomainSubscriber (a lambda on a non-AppDomain
static event) still raises OWN014.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED

Author: claude

.github/workflows/ci.yml

@@ -140,6 +140,7 @@ jobs:
             frontend/roslyn/samples/ViewOwnsVmSample.xaml.cs \
             frontend/roslyn/samples/InjectedDcViewSample.xaml.cs \
             frontend/roslyn/samples/ResolvedDisposableSample.cs \
+            frontend/roslyn/samples/AppDomainShutdownSample.cs \
             -o "$RUNNER_TEMP/facts.json"
           cat "$RUNNER_TEMP/facts.json"
       - name: Check facts through the core
@@ -301,6 +302,15 @@ jobs:
             || { echo "FAIL: expected OWN014 region escape on the static-event instance subscription"; exit 1; }
           echo "$out" | grep -q "region escape" \
             || { echo "FAIL: expected the region-escape wording on the static-event capture"; exit 1; }
+          # P-004 process-lifetime AppDomain-event exemption (mined: Npgsql PoolManager): a
+          # subscription to a process-host AppDomain event (ProcessExit/DomainUnload/Unhandled-
+          # Exception) is a shutdown/diagnostics hook meant to live for the process -> NOT a
+          # region escape -> silent. A non-AppDomain static event with a lambda still escapes.
+          if echo "$out" | grep -q "ShutdownCleanup"; then
+            echo "FAIL: an AppDomain process-lifetime event subscription was wrongly reported as a region escape"; exit 1
+          fi
+          echo "$out" | grep -qE "NonAppDomainSubscriber.*OWN014|OWN014.*NonAppDomainSubscriber" \
+            || { echo "FAIL: a lambda on a non-AppDomain static event must still raise OWN014 (exemption stays scoped)"; exit 1; }
           # the unsubscribed variant (a matching `-=`, released capture) is mitigated
           # -> silent. Must NOT be reported.
           if echo "$out" | grep -q "CleanStaticEventViewModel"; then

frontend/roslyn/OwnSharp.Extractor/Program.cs

@@ -190,6 +190,19 @@ static bool IsStaticHandler(ExpressionSyntax right, SemanticModel model) =>
     IsHandler(right)
         && model.GetSymbolInfo(right).Symbol is IMethodSymbol { IsStatic: true };
 
+// P-004 process-lifetime exemption: a subscription to a PROCESS-HOST `System.AppDomain`
+// event — ProcessExit / DomainUnload (shutdown cleanup hooks) or UnhandledException /
+// FirstChanceException (process-wide diagnostics) — is never a region escape. The handler
+// is MEANT to live for the whole process: it runs at shutdown, or on every unhandled throw,
+// and the AppDomain IS the process host. Promoting the subscriber to "the AppDomain's
+// lifetime" is therefore the intent, not a leak. Mined: Npgsql's PoolManager static ctor
+// `AppDomain.CurrentDomain.{DomainUnload,ProcessExit} += (_,_) => ClearAll()` — a deliberate
+// "close idle connectors on appdomain unload (web-app redeployment)" hook (#491).
+static bool IsProcessLifetimeAppDomainEvent(IEventSymbol ev) =>
+    ev.Name is "ProcessExit" or "DomainUnload" or "UnhandledException" or "FirstChanceException"
+    && ev.ContainingType is { Name: "AppDomain" } ct
+    && IsInNamespace(ct, "System");
+
 // P-004 process-lived-subscriber exemption: the WPF application object (`App`) is a
 // process-lived singleton — exactly one instance, created at startup, alive until
 // the process exits. Subscribing it to a process-lived static event
@@ -2065,8 +2078,13 @@ or ImplicitObjectCreationExpressionSyntax
                 //    constructs) — the source<->this cycle is GC-collectable;
                 //  - static handler — a static method has a null delegate target,
                 //    so no instance is retained and nothing can leak.
+                //  - a process-host AppDomain event (ProcessExit/DomainUnload/Unhandled-
+                //    Exception/FirstChanceException) — the handler is meant to live for the
+                //    whole process, so the "escape" is the intent, not a leak (mined: Npgsql
+                //    PoolManager's `AppDomain.CurrentDomain.ProcessExit += …` shutdown hook).
                 if (!isTimer && (IsSelfOwnedSource(a.Left, ev, model, selfOwned)
-                                 || IsStaticHandler(a.Right, model)))
+                                 || IsStaticHandler(a.Right, model)
+                                 || IsProcessLifetimeAppDomainEvent(ev)))
                     continue;
                 // P-004 tiering: a local-variable source is method-bounded — it
                 // cannot outlive `this`, so it is not a heap leak; drop it (the same

frontend/roslyn/samples/AppDomainShutdownSample.cs

@@ -0,0 +1,40 @@
+using System;
+
+namespace Own.Samples;
+
+// P-004 process-lifetime AppDomain-event exemption (mined: Npgsql PoolManager). Subscribing to
+// AppDomain's process-host events — ProcessExit / DomainUnload (shutdown cleanup hooks) and
+// UnhandledException / FirstChanceException (process-wide diagnostics) — is never a region
+// escape: the handler is meant to live for the whole process. Must be SILENT. Contrast:
+// NonAppDomainSubscriber below — a non-AppDomain static event with a lambda still raises OWN014,
+// proving the exemption keys off the AppDomain source, not any process-lived static event.
+
+public sealed class ShutdownCleanup
+{
+    public ShutdownCleanup()
+    {
+        AppDomain.CurrentDomain.ProcessExit += (_, _) => Cleanup();        // shutdown hook -> SILENT
+        AppDomain.CurrentDomain.DomainUnload += (_, _) => Cleanup();       // shutdown hook -> SILENT
+        AppDomain.CurrentDomain.UnhandledException += (_, _) => Cleanup(); // process diagnostics -> SILENT
+    }
+
+    private static void Cleanup() { }
+}
+
+public static class SomeBus
+{
+    public static event EventHandler? Pinged;
+
+    public static void Raise() => Pinged?.Invoke(null, EventArgs.Empty);
+}
+
+// Control: a lambda on a NON-AppDomain process-lived (static) event -> region escape -> must WARN.
+public sealed class NonAppDomainSubscriber
+{
+    public NonAppDomainSubscriber()
+    {
+        SomeBus.Pinged += (_, _) => Handle();   // static event, lambda, not AppDomain -> OWN014
+    }
+
+    private static void Handle() { }
+}