feat(extractor): self-owned subscription exemption now covers ref/out-built fields and template parts

The WPF mining run (docs/notes/real-world-mining.md) showed that loading the WPF
reference pack jumps OWN001 from 8 to 123, dominated by FALSE positives on
self-owned controls: a class subscribing to a control it owns is a collectable
cycle, not a leak. The existing exemption only recognised fields built by a direct
`field = new ...`, so two real ownership shapes slipped through:

  * indirect construction — `BuildCorner(ref _thumb, ...)`: a helper the class
    calls populates the field (the adorner pattern);
  * template parts — `_part = GetTemplateChild("PART_x") as T` / FindName: a
    control owns the parts of its own template.

Fold both into a separate `selfOwned` set used by the subscription exemption only.
It is deliberately kept OUT of `constructed`, so the WPF003 disposal detector keeps
demanding disposal of `new`'d fields only (you do not dispose a borrowed-by-ref
value or a template part). Detection is AST-based — the ref/out argument keyword,
and a GetTemplateChild/FindName call name behind an optional cast / `as` — in the
spirit of the rest of the extractor.

Verification: new sample SelfOwnedControlParts.cs exercises both shapes; the ci.yml
wpf-extractor job asserts it produces no finding, alongside the existing self-owned
silence checks.

Author: claude

.github/workflows/ci.yml

@@ -124,6 +124,7 @@ jobs:
             frontend/roslyn/samples/PooledBufferSample.cs \
             frontend/roslyn/samples/LocalDisposableSample.cs \
             frontend/roslyn/samples/SelfOwnedViewModel.cs \
+            frontend/roslyn/samples/SelfOwnedControlParts.cs \
             frontend/roslyn/samples/StaticHandlerViewModel.cs \
             frontend/roslyn/samples/SampleTypes.cs \
             -o "$RUNNER_TEMP/facts.json"
@@ -215,6 +216,13 @@ jobs:
           if echo "$out" | grep -q "SelfOwnedViewModel.cs"; then
             echo "FAIL: a self-owned subscription was wrongly reported"; exit 1
           fi
+          # P-004 self-owned (extended): a field built indirectly via a `ref`/`out`
+          # helper, or fetched as one of the control's own template parts
+          # (GetTemplateChild), is owned just like a `new`'d field — both
+          # subscriptions in SelfOwnedControlParts are collectable cycles -> silent.
+          if echo "$out" | grep -q "SelfOwnedControlParts.cs"; then
+            echo "FAIL: a self-owned (ref-built / template-part) subscription was wrongly reported"; exit 1
+          fi
           # P-004 static-handler exemption: a static-method handler has a null
           # delegate target — no instance retained, so not a leak — silent.
           if echo "$out" | grep -q "StaticHandlerViewModel.cs"; then

frontend/roslyn/OwnSharp.Extractor/Program.cs

@@ -140,21 +140,44 @@ left is MemberAccessExpressionSyntax m
 
 // P-004 self-owned exemption: is the event SOURCE owned by (and so never longer-
 // lived than) the subscriber? True for a bare instance event on `this`, or a
-// receiver that resolves to a field/local the class constructs (`new`s). Such a
-// `source <-> this` reference cycle is GC-collectable, so the subscription is not
-// a leak. The receiver is resolved to a SYMBOL (not matched by text), and the
-// `constructed` set is AST-based (ObjectCreationExpressionSyntax) — not a regex.
-// NOTE: callers must exclude timers — a *running* timer is rooted by the
-// dispatcher regardless of who owns the field.
+// receiver that resolves to a field/local the class OWNS. "Owns" is the `owned`
+// set the caller computes: fields the class constructs directly (`new`), builds
+// indirectly through a `ref`/`out` helper, or fetches as one of its own template
+// parts. Such a `source <-> this` reference cycle is GC-collectable, so the
+// subscription is not a leak. The receiver is resolved to a SYMBOL (not matched by
+// text), and `owned` is AST-based — not a regex. NOTE: callers must exclude timers
+// — a *running* timer is rooted by the dispatcher regardless of who owns the field.
 static bool IsSelfOwnedSource(ExpressionSyntax left, IEventSymbol ev,
-                              SemanticModel model, HashSet<string> constructed)
+                              SemanticModel model, HashSet<string> owned)
 {
     if (left is not MemberAccessExpressionSyntax m)
         return !ev.IsStatic;   // bare event => an instance event on `this`
     if (m.Expression is ThisExpressionSyntax)
         return true;
     var recv = model.GetSymbolInfo(m.Expression).Symbol;
-    return (recv is IFieldSymbol or ILocalSymbol) && constructed.Contains(recv.Name);
+    return (recv is IFieldSymbol or ILocalSymbol) && owned.Contains(recv.Name);
+}
+
+// P-004 (ext): a control fetching one of its OWN template parts —
+// `GetTemplateChild("PART_x")` or `[Template.]FindName(...)`, optionally behind a
+// cast or `as` — owns the result (it lives inside the control's own template /
+// visual tree). AST-only (matched by call name), in the spirit of the rest of the
+// file; used to fold template-part fields into the self-owned exemption.
+static bool IsTemplatePartFetch(ExpressionSyntax? expr)
+{
+    expr = expr switch
+    {
+        CastExpressionSyntax c => c.Expression,
+        BinaryExpressionSyntax b when b.IsKind(SyntaxKind.AsExpression) => b.Left,
+        _ => expr,
+    };
+    return expr is InvocationExpressionSyntax inv
+        && (inv.Expression switch
+           {
+               MemberAccessExpressionSyntax ma => ma.Name.Identifier.Text,
+               IdentifierNameSyntax id => id.Identifier.Text,
+               _ => null,
+           }) is "GetTemplateChild" or "FindName";
 }
 
 // P-004 static-handler exemption: a `+= StaticMethod` stores a delegate whose
@@ -486,6 +509,27 @@ or ImplicitObjectCreationExpressionSyntax
                 && FieldName(a.Left) is { } fn)
                 constructed.Add(fn);
 
+        // P-004 (extended) self-owned set for the SUBSCRIPTION exemption ONLY. A
+        // field can be owned without a direct `_f = new ...`; fold in two more
+        // shapes the WPF mining run surfaced. Kept OUT of `constructed` so the
+        // WPF003 disposal detector keeps demanding disposal of `new`'d fields only
+        // (you don't dispose a borrowed-by-ref value or a template part):
+        //   * ref/out construction — `BuildCorner(ref _thumb, ...)`: a helper this
+        //     class calls populates the field, so the class owns it;
+        //   * template parts — `_part = GetTemplateChild("PART_x") as T`: a control
+        //     owns the parts of its own template (collectable part<->control cycle).
+        var selfOwned = new HashSet<string>(constructed);
+        foreach (var arg in cls.DescendantNodes().OfType<ArgumentSyntax>())
+            if ((arg.RefKindKeyword.IsKind(SyntaxKind.RefKeyword)
+                 || arg.RefKindKeyword.IsKind(SyntaxKind.OutKeyword))
+                && FieldName(arg.Expression) is { } rf)
+                selfOwned.Add(rf);
+        foreach (var a in assigns)
+            if (a.IsKind(SyntaxKind.SimpleAssignmentExpression)
+                && FieldName(a.Left) is { } tf
+                && IsTemplatePartFetch(a.Right))
+                selfOwned.Add(tf);
+
         var subs = new List<object>();
         foreach (var a in assigns)
         {
@@ -507,7 +551,7 @@ or ImplicitObjectCreationExpressionSyntax
                 //    constructs) — the source<->this cycle is GC-collectable;
                 //  - static handler — a static method has a null delegate target,
                 //    so no instance is retained and nothing can leak.
-                if (!isTimer && (IsSelfOwnedSource(a.Left, ev, model, constructed)
+                if (!isTimer && (IsSelfOwnedSource(a.Left, ev, model, selfOwned)
                                  || IsStaticHandler(a.Right, model)))
                     continue;
                 // P-004 tiering: a local-variable source is method-bounded — it

frontend/roslyn/samples/SelfOwnedControlParts.cs

@@ -0,0 +1,51 @@
+using System;
+
+// P-004 self-owned exemption (EXTENDED) — both subscriptions below must stay
+// SILENT. A class can OWN its event source without a direct `_f = new ...`; these
+// are the two shapes the WPF mining run on ScreenToGif surfaced, each a
+// GC-collectable source<->this cycle rather than a leak:
+//   * `_thumb` is constructed INDIRECTLY — handed by `ref` to a helper that `new`s
+//     it (the adorner `BuildCorner(ref _thumb, ...)` shape);
+//   * `_upButton` is one of this control's OWN template parts, fetched with
+//     `GetTemplateChild(...)` (the templated-control shape).
+// Contrast CustomerViewModel, whose source is an injected bus (a warning). Timers
+// remain the exception (a running timer is dispatcher-rooted) — see TimerViewModel.
+//
+// Stand-in types (Tier A: no WPF reference set) mirror the real surface: a Thumb
+// with DragDelta, a RepeatButton with Click, and a control with the protected
+// GetTemplateChild(string) lookup. Namespaced so they cannot collide with the
+// other samples compiled alongside this file.
+namespace OwnSamples.SelfOwnedParts
+{
+    public sealed class SelfOwnedControlParts : TemplatedControlStub
+    {
+        private Thumb _thumb = null!;     // built indirectly, through a `ref` helper
+        private RepeatButton? _upButton;  // fetched as one of our own template parts
+
+        public SelfOwnedControlParts()
+        {
+            BuildCorner(ref _thumb);
+            _thumb.DragDelta += OnDrag;   // self-owned (ref-constructed) -> not a leak
+        }
+
+        public override void OnApplyTemplate()
+        {
+            _upButton = GetTemplateChild("PART_Up") as RepeatButton;
+            _upButton!.Click += OnUp;     // self-owned (template part) -> not a leak
+        }
+
+        private static void BuildCorner(ref Thumb t) => t = new Thumb();
+
+        private void OnDrag(object? sender, EventArgs e) { }
+        private void OnUp(object? sender, EventArgs e) { }
+    }
+
+    public sealed class Thumb { public event EventHandler? DragDelta; }
+    public sealed class RepeatButton { public event EventHandler? Click; }
+
+    public abstract class TemplatedControlStub
+    {
+        protected object? GetTemplateChild(string name) => null;
+        public virtual void OnApplyTemplate() { }
+    }
+}