Subscription precision: suppress `+=` on a publisher that escapes by return (interprocedural — the dual of ownership transfer)

[PhysShell]

Summary

The subscription-leak detector over-reports when an event is subscribed on a publisher that is itself a freshly-created object the method's caller news and returns. The subscription is bounded by the returned publisher's lifetime (it dies with it), so no -= is needed — but the extractor can't see that, because the construct-and-return happens in the caller.

This is field-notes entry #7 ("Event subscription on a freshly-created, returned publisher") promoted to a live tracker, following the oracle run on JamesNK/Newtonsoft.Json (see docs/notes/field-notes-patterns.md).

Worked example (Newtonsoft.Json Src/Newtonsoft.Json/JsonSerializer.cs:717, commit 4f73e74)

public static JsonSerializer Create(JsonSerializerSettings? settings)
{
    JsonSerializer serializer = new JsonSerializer();
    if (settings != null) ApplySerializerSettings(serializer, settings);
    return serializer;                              // publisher escapes to the caller
}
private static void ApplySerializerSettings(JsonSerializer serializer, JsonSerializerSettings settings)
{
    if (settings.Error != null)
        serializer.Error += settings.Error;         // flagged: "+= but never -="
}

The publisher (serializer) is the returned object: the handler lives exactly as long as the serializer the caller now holds, and dies with it. Not a leak. CodeQL/Infer# have no event-subscription query, so they stay silent (correctly) — this is an own-only over-report.

Why it is not a safe local fix

Inside ApplySerializerSettings, serializer is an opaque parameter, so SubscriptionSourceKind (frontend/roslyn/OwnSharp.Extractor/Program.cs) conservatively tiers it injected and emits a warning (not a hard error — P-004 severity tiering already hedges). Blanket-suppressing a parameter publisher would lose real leaks: void Wire(EventBus bus, Sub s){ bus.X += s.OnX; } is the same syntax (param→param), but if bus is a DI singleton it's a genuine subscription leak. The two are indistinguishable within the method — proving "bounded" requires interprocedural publisher provenance.

Proposed approach

This is the dual of ownership transfer: a += on a publisher that escapes by return is as bounded as a returned IDisposable. The fix should reuse the D5 escape/summary machinery (see docs/notes/d5-ownership-transfer.md):

• Compute, per first-party method, whether a parameter is the constructed-and-returned value of its callers (publisher provenance) — i.e. the publisher's lifetime is caller-owned.
• When a subscription's publisher resolves to such a "returned-fresh" provenance, lower it to the bounded/local tier (silent), not injected.
• Precision-first: any uncertainty stays injected (advisory warning), never silently dropped, and the DI-singleton real-leak case is untouched.

Current posture (acceptable interim)

The finding already surfaces only as an advisory warning under --severity warning (the oracle's setting); the default error posture is unaffected and CI does not break. So this is a recall/precision-of-warnings refinement, not a correctness blocker.

Revisit trigger

Land alongside (or after) the D5 interprocedural escape/return-skeleton work that can supply parameter→returned-publisher provenance. Until then the conservative injected warning is the honest posture.

Prior art

Checker Framework @MustCallAlias (one obligation, two handles), RLC ownership-transfer defaults; cf. issue #122 (D5.1c) for the same "defer + track an interprocedural axis" pattern.

Origin: oracle run on Newtonsoft.Json; triaged in field-notes-patterns.md #7.

[PhysShell]

Revisit trigger status + implementation design (2026-07-09)

The revisit trigger has fired. The D5 interprocedural machinery this issue deferred on is now landed and specified: SCC-fixpoint summary inference, return-skeleton chase, overload merge (spec/Inference.md INF-F1–F7, INF-M1–M3). Recording the design here so implementation can start.

One correction to the proposed approach

The issue proposed reusing the D5 escape/summary machinery directly. That machinery lives in the bridge and runs over the disposable fact stream (functions[] flow bodies) — but publishers (e.g. JsonSerializer) are not disposables, so the callers' construct-and-return of the publisher never appears in those facts. The shape of the fix is still the dual of ownership transfer, but the provenance must be computed where all call sites are visible: in the extractor, over the whole compilation — the same pattern as the DI registration graph (P-006), which is also compilation-wide and also feeds the bridge a lifetime fact it cannot derive itself.

Design

Extractor (compilation-wide pass):

1. Candidate set: methods that contain a += whose publisher is a parameter (today tiered injected).
2. For each candidate, provenance holds only if all of:
   • the method's accessibility guarantees all callers are in-compilation (private/internal); a public/protected method may have external callers → provenance denied;
   • every in-compilation call site passes an argument that is a local constructed in that caller (new T() / implicit new);
   • that caller-local's only escapes are the candidate call(s) and a return — any field/static store, any other escaping use → denied.
3. On success, stamp the subscription record with an additive optional field source_provenance: "returned_fresh" (keeps source: "injected"; additive optional ⇒ no OWNIR_VERSION bump per spec/OwnIR.md IR-rules).

Bridge (routing, mirrors the DI-source hop):

• source == "injected" and source_provenance == "returned_fresh" → the subscription is bounded by the returned publisher's lifetime → lower to the bounded/local tier (silent), same as a locally-constructed publisher.
• Field absent or any other value → today's honest injected warning, unchanged.

Precision invariants (the issue's own bar):

• The DI-singleton real leak (void Wire(EventBus bus, Sub s){ bus.X += s.OnX; }) is untouched: callers pass a field/injected service, never a fresh returned local → provenance denied → warning stays.
• Mixed call sites (one fresh-returned, one anything else) → denied.
• Any analysis uncertainty → denied. The rule only ever refutes a warning with proof; it never fabricates silence.

Acceptance tests

1. Newtonsoft reduction (JsonSerializer.Create → ApplySerializerSettings, corpus reduction to add) → silent.
2. DI-bus param case → warning stays (regression).
3. Mixed-caller case → warning stays.
4. Same shape but public candidate method → warning stays.
5. Caller stores the fresh local into a field before the call → warning stays.

Extractor side is CI-validated only; the whole-compilation invocation walk can follow the DI extractor's existing pattern (docs/notes/di-captive-extractor.md).

---

Generated by Claude Code