feat(extractor): recognise Behavior.AssociatedObject as a self-owned source (#227)

A `Behavior`-derived class subscribing to (an element reached from) its own
base-class `AssociatedObject` accessor was tiered "injected" and warned OWN001
(the MahApps TiltBehavior FP from the issue #201 sweep). A behavior is attached
to and detached from exactly one element and cannot outlive being attached, so
that element is co-lifetimed with the subscriber — the same collectable
source<->this cycle the shipped self-owned-source exemption already encodes for a
constructed field, just reached through a base-class accessor.

The exemption is deliberately narrow, within the issue's fixed guardrails:
- subscriber gate: the class must derive from `Behavior` (`IsBehaviorSubscriber`,
  direct-base simple-name match, mirroring `IsProcessLivedApplication`) — the
  attach/detach pairing is what guarantees co-lifetime;
- source gate: the `+=` receiver must resolve, same-class and assignment-chain-
  local, to `this.AssociatedObject` (`ResolvesToAssociatedObject`) — directly, via
  a `var x = ...`/`is`-pattern local (only when never reassigned), or via a field
  every assignment to which resolves to `AssociatedObject` (a single injected write
  denies the proof). No interprocedural guessing.

Unlike #228 a lambda handler is fine here: the source is co-lifetimed with the
behavior, so a capture just closes the collectable cycle rather than pinning a
process-lived source to a shorter-lived local.

Pinned by AssociatedObjectSourceSample.cs: three silent positives (is-pattern
field, direct `this.AssociatedObject.Event`, bare-identifier local) and the four
controls the guardrails require — the unrelated injected source in the same
OnAttached, a non-Behavior subscriber, a field also assigned an injected value,
and a resolver-bound local reassigned before the `+=` — wired into the
wpf-extractor CI job with assertions both ways.

Verified locally with the real extractor (.NET 8): the sample yields exactly the
four control warnings, all three positives silent; a full-sample-set diff of old
vs new extractor output is byte-identical (zero regression). Gates: run_tests
276/276, ruff, mypy, yaml all green.

Closes #227

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U2AWb9N2VUsby2XpdftBcu

Author: claude

.github/workflows/ci.yml

@@ -213,6 +213,7 @@ jobs:
             frontend/roslyn/samples/TemplatePartLocalCaptureSample.cs \
             frontend/roslyn/samples/EmptyDisposeSample.cs \
             frontend/roslyn/samples/AppScopedSourceSample.cs \
+            frontend/roslyn/samples/AssociatedObjectSourceSample.cs \
             -o "$RUNNER_TEMP/facts.json"
           cat "$RUNNER_TEMP/facts.json"
       - name: Check facts through the core
@@ -878,7 +879,37 @@ jobs:
           # curated initializer — the stale declaration binding must not exempt.
           echo "$out" | grep -qE "AppScopedSourceSample\.cs:[0-9]+: warning: \[OWN001\].*'ReassignApp'" \
             || { echo "FAIL: expected OWN001 when the resolver-bound local is reassigned before the +="; exit 1; }
-          echo "OK: real C# -> facts -> OWN001 (subscription + timer + field + Subscribe + pool + local) + OWN014 (static-event region escape) + DI001 (captive dependency) + DI002 (scoped captured weakly) + DI003 (transient IDisposable captured by a singleton) + DI004 (transient IDisposable service-located from the root provider) + DI005 (scoped service cached from a created scope) + [OwnIgnore] suppression (silent-but-counted, SARIF suppressions) + #218 DP old->new subscription rotation (silent; controls flagged) + #225 empty-Dispose local exemption (silent; controls flagged) + #228 curated app-scoped source in App (silent; controls flagged) at the C# location"
+          # issue #227 — a `Behavior`-derived subscriber whose event source is (an element
+          # reached from) its own base-class `AssociatedObject` must be SILENT: the
+          # behavior cannot outlive being attached, so the source is co-lifetimed with the
+          # subscriber (a collectable self-cycle, not a leak). Three receiver forms:
+          # an `is`-pattern local off a field assigned from AssociatedObject (TiltLikeBehavior),
+          # the direct `this.AssociatedObject.Event` (DirectAssociatedBehavior), and a
+          # bare-identifier local bound from AssociatedObject (LocalAssociatedBehavior).
+          if echo "$out" | grep -qE "AssociatedObjectSourceSample\.cs:[0-9]+:.*'panel\.Loaded'.*'TiltLikeBehavior'"; then
+            echo "FAIL: the AssociatedObject-derived subscription in the Behavior was wrongly reported (#227)"; exit 1
+          fi
+          if echo "$out" | grep -qE "AssociatedObjectSourceSample\.cs:[0-9]+:.*('DirectAssociatedBehavior'|'LocalAssociatedBehavior')"; then
+            echo "FAIL: a direct/local AssociatedObject subscription in the Behavior was wrongly reported (#227)"; exit 1
+          fi
+          # ...and the required negative control: an UNRELATED injected source subscribed
+          # in the SAME OnAttached stays flagged.
+          echo "$out" | grep -qE "AssociatedObjectSourceSample\.cs:[0-9]+: warning: \[OWN001\].*'_bus\.Changed'.*'TiltLikeBehavior'" \
+            || { echo "FAIL: expected OWN001 on the unrelated injected source in the same OnAttached (#227)"; exit 1; }
+          # ...and the exemption must NOT over-widen — three controls STAY flagged:
+          # (1) the same AssociatedObject shape from a NON-Behavior subscriber (the gate
+          # is the `Behavior` base, not the member name);
+          echo "$out" | grep -qE "AssociatedObjectSourceSample\.cs:[0-9]+: warning: \[OWN001\].*'NotABehavior'" \
+            || { echo "FAIL: expected OWN001 on the non-Behavior subscriber (AssociatedObject name alone must not exempt)"; exit 1; }
+          # (2) a field assigned from AssociatedObject AND from an injected value elsewhere
+          # — every assignment must resolve to AssociatedObject;
+          echo "$out" | grep -qE "AssociatedObjectSourceSample\.cs:[0-9]+: warning: \[OWN001\].*'MixedFieldBehavior'" \
+            || { echo "FAIL: expected OWN001 when the field is also assigned an injected value (#227)"; exit 1; }
+          # (3) the local starts as AssociatedObject but is REASSIGNED to an injected
+          # source before the `+=` — the stale declaration binding must not exempt.
+          echo "$out" | grep -qE "AssociatedObjectSourceSample\.cs:[0-9]+: warning: \[OWN001\].*'ReassignedLocalBehavior'" \
+            || { echo "FAIL: expected OWN001 when the AssociatedObject-bound local is reassigned before the +="; exit 1; }
+          echo "OK: real C# -> facts -> OWN001 (subscription + timer + field + Subscribe + pool + local) + OWN014 (static-event region escape) + DI001 (captive dependency) + DI002 (scoped captured weakly) + DI003 (transient IDisposable captured by a singleton) + DI004 (transient IDisposable service-located from the root provider) + DI005 (scoped service cached from a created scope) + [OwnIgnore] suppression (silent-but-counted, SARIF suppressions) + #218 DP old->new subscription rotation (silent; controls flagged) + #225 empty-Dispose local exemption (silent; controls flagged) + #228 curated app-scoped source in App (silent; controls flagged) + #227 self-owned Behavior.AssociatedObject source (silent; controls flagged) at the C# location"
       - name: Flow-sensitive local IDisposables (--flow-locals, P-016 B0b/B2)
         run: |
           # Path-sensitive flow analysis of local IDisposables — bugs the flat D1

docs/notes/field-notes-patterns.md

@@ -532,6 +532,13 @@ exemption's real criterion is "does this object's lifetime start and end with th
 subscriber's" — a base-class accessor to the attached object, or an item of an
 owned collection, satisfies that just as well as a constructed field.**
 
+**Status (2026-07):** shape **(a)**, the `Behavior.AssociatedObject` self-owned
+source, shipped in #227 — extractor `IsAssociatedObjectSource`, gated on the
+`Behavior` base (`IsBehaviorSubscriber`) plus a same-class assignment-chain
+resolving to `this.AssociatedObject` (`ResolvesToAssociatedObject`); pinned by
+`frontend/roslyn/samples/AssociatedObjectSourceSample.cs`. Shape **(c)**, the
+owned-collection element, is tracked separately by #229.
+
 ## 16. Template part fetched via `FindName`/`GetTemplateChild`, stored as a local
 
 **Seen in:** MahApps.Metro `src/MahApps.Metro/Controls/MetroWindow.cs:1447-1449`

frontend/roslyn/OwnSharp.Extractor/Program.cs

@@ -1009,6 +1009,132 @@ static bool IsOwnMethodGroupHandler(ExpressionSyntax right, SemanticModel model,
         && SymbolEqualityComparer.Default.Equals(sym.ContainingType, cls);
 }
 
+// P-004 / issue #227: is the subscriber a `Behavior`-derived class? A behavior is
+// attached to (and detached from) exactly one element and CANNOT outlive being
+// attached, so the element it reaches through the base-class `AssociatedObject`
+// accessor is co-lifetimed with the behavior — the same collectable source<->this
+// cycle the shipped self-owned-source exemption already encodes for a constructed
+// field. Matched SYNTACTICALLY by the direct base's simple name `Behavior`
+// (mirroring IsProcessLivedApplication): the Microsoft.Xaml.Behaviors /
+// System.Windows.Interactivity `Behavior`/`Behavior<T>` base does not resolve on the
+// Linux runner. Only the direct base is inspected — an intermediate user base
+// (`class Concrete : MyBehavior`) is not chased (precision-first: no exemption, the
+// honest warning stands), exactly as the App-partial precedent does.
+static bool IsBehaviorSubscriber(TypeDeclarationSyntax cls)
+{
+    if (cls.BaseList is not { } bl)
+        return false;
+    foreach (var bt in bl.Types)
+        if (SimpleBaseName(bt.Type) == "Behavior")
+            return true;
+    return false;
+}
+
+static string? SimpleBaseName(TypeSyntax t) => t switch
+{
+    IdentifierNameSyntax id => id.Identifier.Text,
+    GenericNameSyntax g => g.Identifier.Text,           // Behavior<T>
+    QualifiedNameSyntax q => SimpleBaseName(q.Right),    // ...Interactivity.Behavior
+    AliasQualifiedNameSyntax aq => SimpleBaseName(aq.Name),
+    _ => null,
+};
+
+// #227: a bare/`this`-qualified read of the base-class `AssociatedObject` accessor —
+// `this.AssociatedObject` or `AssociatedObject`. Matched by NAME (the property is
+// inherited from the unresolved `Behavior` base), through casts/`!`. A member access
+// qualified with anything else (`other.AssociatedObject`) reaches ANOTHER object and
+// is not this behavior's own attached element, so it is rejected.
+static bool IsAssociatedObjectAccess(ExpressionSyntax expr)
+{
+    expr = StripCasts(expr);
+    return expr switch
+    {
+        MemberAccessExpressionSyntax m => m.Name.Identifier.Text == "AssociatedObject"
+            && m.Expression is ThisExpressionSyntax,
+        IdentifierNameSyntax id => id.Identifier.Text == "AssociatedObject",
+        _ => false,
+    };
+}
+
+// #227: does `expr` provably resolve to `this.AssociatedObject` — directly, or through
+// an assignment-chain-LOCAL step (a `var x = ...` initializer, an `is`-pattern
+// designation, or a FIELD of this class assigned from it)? The provenance is
+// syntactic and same-class (never interprocedural): a local carries the binding only
+// when nothing rebinds it (IsNeverReassigned), and a field only when EVERY assignment
+// to it in the class resolves to `AssociatedObject` (a single injected/constructed
+// write anywhere denies the proof — precision-first, the worst case keeps the honest
+// warning). Depth-bounded so a self-referential field cannot spin.
+static bool ResolvesToAssociatedObject(ExpressionSyntax expr, SemanticModel model,
+                                       TypeDeclarationSyntax clsNode, int depth)
+{
+    if (depth > 4)
+        return false;
+    expr = StripCasts(expr);
+    if (IsAssociatedObjectAccess(expr))
+        return true;
+    var sym = model.GetSymbolInfo(expr).Symbol;
+    if (sym is ILocalSymbol local)
+    {
+        // The declaration-site binding proves the local's value at the use only if
+        // nothing rebinds it (same conservative whole-member scan as #228).
+        if (!IsNeverReassigned(local, model))
+            return false;
+        foreach (var r in local.DeclaringSyntaxReferences)
+            switch (r.GetSyntax())
+            {
+                // var panel = this.AssociatedObject;
+                case VariableDeclaratorSyntax { Initializer.Value: { } init }
+                    when ResolvesToAssociatedObject(init, model, clsNode, depth + 1):
+                    return true;
+                // this.AssociatedObject is Panel panel   /   ... is { } panel
+                case SingleVariableDesignationSyntax des
+                    when des.Ancestors().OfType<IsPatternExpressionSyntax>().FirstOrDefault()
+                         is { Expression: { } scrutinee }
+                         && ResolvesToAssociatedObject(scrutinee, model, clsNode, depth + 1):
+                    return true;
+            }
+        return false;
+    }
+    if (sym is IFieldSymbol field)
+        return FieldAssignedOnlyFromAssociatedObject(field, model, clsNode, depth);
+    return false;
+}
+
+// #227: a field is a valid `AssociatedObject` alias only when it is populated ONLY
+// from `AssociatedObject` — at least one such assignment, and no assignment to a
+// value we cannot prove is `AssociatedObject` (an injected/constructed write would
+// make the field's contents ambiguous at the `+=`). Class-level assignment scan, the
+// same mechanism the field-based self-owned search already uses; the field-population
+// evidence may live in the same `OnAttached` or any other member of the class.
+static bool FieldAssignedOnlyFromAssociatedObject(IFieldSymbol field, SemanticModel model,
+                                                  TypeDeclarationSyntax clsNode, int depth)
+{
+    var any = false;
+    foreach (var asg in clsNode.DescendantNodes().OfType<AssignmentExpressionSyntax>())
+    {
+        if (!asg.IsKind(SyntaxKind.SimpleAssignmentExpression))
+            continue;
+        if (!SymbolEqualityComparer.Default.Equals(model.GetSymbolInfo(asg.Left).Symbol, field))
+            continue;
+        any = true;
+        if (!ResolvesToAssociatedObject(asg.Right, model, clsNode, depth + 1))
+            return false;
+    }
+    return any;
+}
+
+// #227: the self-owned-source exemption for a `Behavior` reaching its own
+// `AssociatedObject`. The `+=` receiver must resolve to `this.AssociatedObject` (or an
+// assignment-chain-local/field/pattern-var provably drawn from it). Caller gates on
+// IsBehaviorSubscriber — attaching/detaching guarantees co-lifetime ONLY in that
+// pairing — so a lambda handler is fine here (unlike #228): capturing `this`/its
+// locals just closes the collectable source<->behavior cycle, it does not pin a
+// process-lived source to a shorter-lived capture.
+static bool IsAssociatedObjectSource(ExpressionSyntax left, SemanticModel model,
+                                     TypeDeclarationSyntax clsNode)
+    => left is MemberAccessExpressionSyntax m
+       && ResolvesToAssociatedObject(m.Expression, model, clsNode, depth: 0);
+
 // P-004 WPF MVVM ownership: a field read from `this.DataContext`, optionally through
 // an `as`/cast (`DataContext as VM`, `(VM)DataContext`). Combined with a view whose
 // own XAML CONSTRUCTS its DataContext, such a field is the view's owned view-model.
@@ -4108,6 +4234,11 @@ or ImplicitObjectCreationExpressionSyntax
         // static-source region escape (OWN014) — `App` cannot be over-promoted.
         var clsIsApp = IsProcessLivedApplication(cls);
 
+        // #227: is this a `Behavior`-derived subscriber? Then a `+=` whose source is
+        // its own `AssociatedObject` (the attached element, co-lifetimed with the
+        // behavior) is the collectable self-owned cycle, not a leak.
+        var clsIsBehavior = IsBehaviorSubscriber(cls);
+
         var subs = new List<object>();
         foreach (var a in assigns)
         {
@@ -4140,6 +4271,18 @@ or ImplicitObjectCreationExpressionSyntax
                                  || (IsProcessLifetimeAppDomainEvent(ev)
                                      && HandlerRetainsNoInstance(a.Right, model))))
                     continue;
+                // P-004 / issue #227: a `Behavior` subscribing to (an element reached
+                // from) its own `AssociatedObject`. The behavior cannot outlive being
+                // attached, so the source is co-lifetimed with the subscriber — the
+                // same self-owned source<->this cycle as a constructed field, just
+                // reached through the base-class accessor. Gated on the `Behavior`
+                // base (co-lifetime holds ONLY in the attach/detach pairing) and on a
+                // same-class assignment-chain provenance to `AssociatedObject`; a
+                // subscription to an unrelated injected/constructed source in the same
+                // method keeps today's warning (its receiver does not resolve there).
+                if (!isTimer && clsIsBehavior
+                    && IsAssociatedObjectSource(a.Left, model, cls))
+                    continue;
                 // P-004 (issue #223): the curated weak-referenced-static-event allowlist —
                 // unconditional (unlike the AppDomain exemption above, this does NOT gate on
                 // HandlerRetainsNoInstance: the whole point of a weak-referenced source is