fix(extractor): restrict XAML DataContext-ownership to the ROOT element (Codex P2)

XamlDeclaresOwnedDataContext matched ANY `*.DataContext` property-element in the
sibling XAML. But the code-behind's `this.DataContext` is the ROOT element's, so a
nested `<Grid.DataContext><ChildVm/>` (a different element's DataContext) would wrongly
mark the whole `.xaml.cs` as owning — silently dropping a real OWN001 on the root's
injected/bound VM. Now: strip comments / processing-instructions, find the root element
tag, and match only `<Root.DataContext>` with a constructed (type-instantiation) child.

The InjectedDcView control XAML gains exactly this shape — a BOUND root DataContext
plus a nested `<Grid.DataContext><local:NestedChildVm/>` — so the existing "must warn"
assertion now also guards the root-restriction (without it the nested construction
would make the view look owned and the subscription would be wrongly suppressed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED

Author: claude

frontend/roslyn/OwnSharp.Extractor/Program.cs

@@ -242,17 +242,32 @@ BinaryExpressionSyntax b when b.IsKind(SyntaxKind.AsExpression) => b.Left,
 }
 
 // P-004 WPF MVVM ownership: does this XAML construct its own DataContext inline —
-// `<Owner.DataContext><vm:Foo/></Owner.DataContext>` — so the view OWNS its
-// view-model (a collectable view<->VM cycle)? True only when the property-element's
-// child is a TYPE instantiation, not a binding / resource reference (those point at
-// an external or inherited value the view does NOT own, so a subscription to it can
-// still leak). Matched textually because the extractor has no XAML parser: the
-// property-element form `.DataContext>` is what denotes inline construction (the
-// `DataContext="{Binding}"` attribute form never matches). Conservative — an
-// unrecognised shape yields false (no exemption), never a wrongly-suppressed leak.
+// `<Root.DataContext><vm:Foo/></Root.DataContext>` — so the view OWNS its view-model
+// (a collectable view<->VM cycle)? Restricted to the ROOT element's DataContext: the
+// code-behind's `this.DataContext` is the root's, so only the root's own constructed
+// DataContext proves ownership. A NESTED element's `<Grid.DataContext><ChildVm/>` sets
+// a DIFFERENT element's DataContext and must NOT exempt the view (Codex) — else a real
+// leak on the root's injected VM is silently dropped. True only when the root's
+// property-element child is a TYPE instantiation, not a binding / resource reference
+// (those point at an external or inherited value the view does NOT own). Matched
+// textually (no XAML parser): the property-element form `.DataContext>` denotes inline
+// construction; the `DataContext="{Binding}"` attribute form never matches.
+// Conservative — an unrecognised shape yields false (no exemption), never a
+// wrongly-suppressed leak.
 static bool XamlDeclaresOwnedDataContext(string xaml)
 {
-    foreach (Match m in Regex.Matches(xaml, @"\.DataContext\s*>\s*<\s*(?:[\w]+:)?([\w.]+)"))
+    // Strip comments / processing instructions so `<Foo.DataContext>` text inside a
+    // comment (or `<?xml?>`) cannot be mistaken for markup, nor skew the root search.
+    xaml = Regex.Replace(xaml, @"<!--.*?-->", " ", RegexOptions.Singleline);
+    xaml = Regex.Replace(xaml, @"<\?.*?\?>", " ", RegexOptions.Singleline);
+    // The root element is the view type (its x:Class is the code-behind). Find its tag
+    // (the first element open — not `</close>`), then match ONLY `<Root.DataContext>`.
+    var rootMatch = Regex.Match(xaml, @"<\s*([A-Za-z_][\w:]*)");
+    if (!rootMatch.Success)
+        return false;
+    var root = Regex.Escape(rootMatch.Groups[1].Value);
+    foreach (Match m in Regex.Matches(xaml,
+                 $@"<\s*{root}\s*\.\s*DataContext\s*>\s*<\s*(?:[\w]+:)?([\w.]+)"))
     {
         var name = m.Groups[1].Value;
         var local = name.Contains('.') ? name[(name.LastIndexOf('.') + 1)..] : name;

frontend/roslyn/samples/InjectedDcViewSample.xaml

@@ -1,8 +1,18 @@
 <Window x:Class="Own.Samples.Wpf.InjectedDcView"
         xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
-        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
-    <!-- The view BINDS (does not construct) its DataContext: it does NOT own the VM. -->
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        xmlns:local="clr-namespace:Own.Samples.Wpf">
+    <!-- The ROOT view BINDS (does not construct) its DataContext: it does NOT own the
+         VM that the code-behind reads via this.DataContext. -->
     <Window.DataContext>
         <Binding Path="Shared"/>
     </Window.DataContext>
+    <!-- Codex case: a NESTED element constructs its OWN child VM. This is a DIFFERENT
+         element's DataContext, not the view's this.DataContext, so it must NOT make the
+         view look owned — the subscription must still warn. -->
+    <Grid>
+        <Grid.DataContext>
+            <local:NestedChildVm/>
+        </Grid.DataContext>
+    </Grid>
 </Window>