From 5d4825b8c1415de6f0cb9619b7736d2cf31a9ea3 Mon Sep 17 00:00:00 2001 From: PhysShell <45852143+PhysShell@users.noreply.github.com> Date: Tue, 20 Oct 2026 09:25:56 +0500 Subject: [PATCH] =?UTF-8?q?docs(evidence):=20class=20miner=20Phase=200=20?= =?UTF-8?q?=E2=80=94=20GO-CANDIDATE=20N3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Owner decision GO-CLASS-MINER-PHASE-0. Reusing the direction-research fix ledger (101 confirmed product-code fixes, 81 owners) and 10 of 12 allowed deep-check PRs, one narrow class clears the pre-registered bar with margin: N3, a request-scoped object (HttpContext, scoped service, scope-provided IServiceProvider/HttpClient) escaping into detached work (`_ = ...`, Task.Run, QueueBackgroundWorkItem). 8 independent owners, production/staging ObjectDisposedExceptions, no Own.NET or competitor rule. Recommendation only: prevalence, mature-code yield and precision are unmeasured. Evidence only: report, pre-registration, filtered ledger, class membership, deep-check selection and search outputs. No third-party PR texts or diffs, no production, OwnIR, CI or golden change. Co-Authored-By: Claude Opus 5.5 --- .../00-preregistration.md | 74 ++++++++++ .../class-miner-phase0-2026-10/REPORT.md | 137 ++++++++++++++++++ .../data/classes.tsv | 31 ++++ .../data/deepcheck-selection.tsv | 11 ++ .../data/eligible.tsv | 102 +++++++++++++ .../data/search.out | 107 ++++++++++++++ .../data/search2.out | 78 ++++++++++ .../scripts/extract.py | 55 +++++++ .../scripts/search.sh | 9 ++ .../scripts/search2.sh | 6 + 10 files changed, 610 insertions(+) create mode 100644 docs/evidence/class-miner-phase0-2026-10/00-preregistration.md create mode 100644 docs/evidence/class-miner-phase0-2026-10/REPORT.md create mode 100644 docs/evidence/class-miner-phase0-2026-10/data/classes.tsv create mode 100644 docs/evidence/class-miner-phase0-2026-10/data/deepcheck-selection.tsv create mode 100644 docs/evidence/class-miner-phase0-2026-10/data/eligible.tsv create mode 100644 docs/evidence/class-miner-phase0-2026-10/data/search.out create mode 100644 docs/evidence/class-miner-phase0-2026-10/data/search2.out create mode 100644 docs/evidence/class-miner-phase0-2026-10/scripts/extract.py create mode 100644 docs/evidence/class-miner-phase0-2026-10/scripts/search.sh create mode 100644 docs/evidence/class-miner-phase0-2026-10/scripts/search2.sh diff --git a/docs/evidence/class-miner-phase0-2026-10/00-preregistration.md b/docs/evidence/class-miner-phase0-2026-10/00-preregistration.md new file mode 100644 index 00000000..1a8e4749 --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/00-preregistration.md @@ -0,0 +1,74 @@ +# Class miner Phase 0 — pre-registration + +Written 2026-10-20, before any record of the corpus was read for this purpose. Only the ledger schema +(`evidence/ledger/SCHEMA.md`) has been looked at. + +Authority: owner decision `GO-CLASS-MINER-PHASE-0`, given after the `KILL-DICTIONARY-REF-PILOT` ruling. This is +not a GO on implementing an analyzer. + +## Question + +Does a fix corpus of real, confirmed defects contain a **narrow, recurring** defect mechanism? To qualify, Own.NET +must miss it today, and it must justify the next investment. + +## Inputs (reuse only, no new miner) + +- **Corpus 1.** The 58 bug/fix pairs of the Own.NET direction research, a private repo. Its records are in + `evidence/ledger/records.jsonl` (`source_type = github_pr_fix`), and per-pair facts and Own.NET runs are in + `evidence/pairs/`. +- **Existing tools.** `scripts/` of that repo; `triage_pairs.py` and the `gh` query scripts of #412. +- **Deep check.** At most **12 new PRs** outside corpus 1. They are read through the GitHub API (diff, description, + tests). Nothing is built and no package is downloaded. +- **Budget.** 0.5 agent-day. + +## Definitions + +- **Narrow class.** One mechanism that can be stated as one rule: the same code shape plus the same failure, for + example "a pooled buffer is not returned on the exception path". A C01–C18 category is too broad to be a class. +- **Confirmed defect.** All three must hold: + 1. a merged fix; + 2. the diff establishes the mechanism (`ground_truth_level` ≥ `patch_supported`, or the same on reading a + deep-check PR); + 3. there is evidence of an observable effect: an issue report, a profiler or dump result, a regression test, or a + maintainer statement. `impact_evidence = none` does not count. +- **Product code only.** Tests, samples and benchmarks do not count. +- **Independent.** Different repository owners. Two defects in one repo count as one. + +## Excluded classes (already decided; not reopened) + +- C01: event subscription retention (R5 killed). +- C18: SemaphoreSlim. +- The D10 design. +- #382 shape A (canonical first-party calls) and #406 shape B (closure capture): NO-GO within budget. +- #400 stale dictionary ref: KILL. +- #402 CTS inversion (blocked by #407, deferred). + +The Meziantou exception-safety defect C-1b (a `default` value is inserted before the factory runs and stays when +the factory throws) **is** eligible. It already has one confirmed instance. + +## Recorded per candidate class + +- the independent repos and the defects counted; +- the observable effect and its evidence; +- whether a regression test exists; +- the current Own.NET result, taken from the ledger's `ownnet_result`/`ownnet_detail` (no new run unless the + ledger says `not_run`); +- the expected implementation cost (S/M/L), with the existing Own.NET capability it would reuse. + +## Decision rules + +- **GO-CANDIDATE.** At least **2 independent confirmed defects** of one narrow class, and Own.NET does not detect + them: `not_detected_*`, `unsupported`, or `detected_partial` where the warning does not identify the mechanism. + The output is a recommendation for the owner, not an implementation. +- A class that Own.NET already detects on all its instances is not a gap, and is reported as such. +- Two or more qualifying classes are ranked by the number of independent confirmed defects, then by evidence + strength, then by cost. Ranking does not lower the threshold. +- **STOP.** No class reaches 2 within the corpus plus the 12 deep-check PRs. The search is not widened. +- A class is defined from the fix mechanisms before its Own.NET result is looked up. Classes are not redefined + after the count to reach the threshold. Any merge or split of a class is recorded with its reason. + +## Known biases + +- Corpus 1 was assembled by queries aimed at resource-lifetime categories (design A), so it over-represents + them. +- One researcher classifies. Ledger levels marked `reviewer_verified(llm)` were set by an earlier agent. diff --git a/docs/evidence/class-miner-phase0-2026-10/REPORT.md b/docs/evidence/class-miner-phase0-2026-10/REPORT.md new file mode 100644 index 00000000..4a8bac54 --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/REPORT.md @@ -0,0 +1,137 @@ +# Class miner Phase 0 — report + +**Result: `GO-CANDIDATE` for one class, N3.** N3: a request-scoped object escapes into detached work. This is a +recommendation for the owner, not an implementation decision. + +The other classes that reached the threshold rank below N3 on count or evidence, or conflict with earlier +decisions (§3). + +Rules: [`00-preregistration.md`](00-preregistration.md), written before any record was read. + +Budget used: +- the existing corpus (the direction-research ledger) only; no new miner was written; +- 10 of the 12 allowed deep-check PRs; +- well under 0.5 agent-day. + +Nothing was built, no package was downloaded, and no production, OwnIR, CI or golden file was touched. + +## 1. Inputs + +- **Corpus.** `records.jsonl` of the direction research has 220 `github_pr_fix` records. The 58 bug/fix pairs with + base/fix trees and Own.NET runs are among them. The ledger is private research data. Its filtered output is + committed as [`data/eligible.tsv`](data/eligible.tsv), produced by [`scripts/extract.py`](scripts/extract.py). +- **Filter for "confirmed defect".** + - the fix is merged; + - ground truth is at least `patch_supported`, so `candidate`, `rejected` and `unresolved` are out; + - the impact evidence is an issue report, a profiler or dump result, a test, or a maintainer statement; + - the code is product code. + + 101 records from 81 owners pass. Records in excluded classes (C01, C18) were then set aside. +- **Classes.** Narrow classes were defined from each record's root cause and fix, before its Own.NET result was + looked up. +- **Corpus-record check.** For the top two classes, the diffs of the corpus records were re-read. This matters + because most corpus levels are `reviewer_verified(llm)`, set by an earlier agent. + +## 2. Candidate classes + +| Class | Mechanism (one rule) | Corpus: independent owners | Deep check | Total | Own.NET today | Competitors | Effect evidence | +|---|---|---:|---|---:|---|---|---| +| **N3** | An object owned by a request/DI scope (`HttpContext`, a scoped service, a scope-provided `IServiceProvider`/`HttpClient`) reaches deliberately detached work — a discarded task `_ = …`, `Task.Run`, `QueueBackgroundWorkItem` — and is used after the scope ends | 3 (mars-vista-api, GanjoorService, ChatCore.NET) | 5 of 6 confirmed | **8** | no rule: 3/3 `not_detected_no_rule` (DI001–005 cover constructor and locator capture only) | no rule in any of the 8 analyzer packages or CodeQL; runtime scope validation does not catch it | production `ObjectDisposedException`s in every instance: 39 events in about 7 months (mars-vista); an import that always failed; staging logs; failure on Azure; a live tenant; silent loss of webhook retries | +| **N1** | A disposable is acquired; a step that can throw runs before ownership is handed over (return, field or dictionary store, registration); there is no dispose on the throw path | 3 (whizbang, rockbot, NexusKit) | 1 of 4 (BareWire) | **4** | missed 3/3. The locals are returned, stored or factory-acquired, and Own.NET tracks only non-escaping `new` locals. The opt-in `--body-throw-edges` tier would not reach them (by reading the model; not run) | CA2000 needs `dispose_analysis_kind=AllPaths` and is off by default; no other rule | one resource leaked per failed attempt (test, issue #1187, maintainer statements). No crash | +| N6 | A long-lived keyed collection (singleton, static or plugin lifetime) is only ever added to | 4 (honua, chaosflix, AI-Cockpit, BB84) | not checked | 4 | no rule | no rule | memory growth: 1 profiler, 2 tests, 1 maintainer statement | +| N7 | A `CancellationTokenSource` is disposed while concurrent code still reads its token | 3 (headless-framework, frame-flow, LiteDB) | not checked | 3 | no rule | no rule | tests | +| N1b | A release placed after a call that can throw in the same teardown sequence; the throw skips the release | 1 (PattN) | daqifi-core#504 (found while checking N1) | 2 | PattN missed (factory acquisition); daqifi not run | none | daqifi: the serial port stays claimed for the life of the process, 13 tests | +| N2 | A singleton constructor-injects a scoped service | 2 missed (affiant, SIBO) + 1 detected | — | 2 | DI001 exists. The misses are model gaps: framework registrations (`AddIdentityCore`), and a `ServiceDescriptor` with a runtime lifetime | none | both fail at startup under Development scope validation, so the framework already catches them | +| N4 | A non-atomic disposed flag under concurrent `Dispose` | 2 (couchbase, AgentInfer) | — | 2 | tool failure / no rule | none | maintainer statements; AgentInfer "not reproduced" | + +Deep check, PR by PR, selected by title before reading +([`data/deepcheck-selection.tsv`](data/deepcheck-selection.tsv)). Class membership of every instance, corpus and +deep check, is in [`data/classes.tsv`](data/classes.tsv). + +| PR | Class | Verdict | Why | +|---|---|---|---| +| LLabmik/DotNetCloud#43 | N3 | confirmed | scoped `_seriesService` (DbContext) used in a fire-and-forget `Task.Run`; `ObjectDisposedException` | +| DoForYou-ZA/DFY-BE#35 | N3 | confirmed | `_ = _notificationService.NotifyAdminsAsync(…)` on a request-scoped service; `ObjectDisposedException` in staging logs | +| ASADRAJA/Vendorea.PartnerConnect#49 | N3 | confirmed | request-scoped `IServiceProvider` field used inside `Task.Run`; failed reliably on Azure | +| escalated-dev/escalated-dotnet#162 | N3 | confirmed | `_ = RetryLaterAsync(…)` on a scoped dispatcher; the retry hits a disposed DbContext and is lost silently; regression test | +| microting/eform-angular-timeplanning-plugin#1669 | N3 | confirmed | fire-and-forget sends capture a request-scoped service; live `ObjectDisposedException`; tests | +| klitztuch/LanBoard#47 | N3 | **not this class** | event-triggered loads during Blazor prerender while the scope is disposing; no detached work | +| Wizard-Software/BareWire#73 | N1 | confirmed | channel created, `basic.qos` throws before registration, channel never disposed; one leak per failure | +| reqnroll/Reqnroll.IdeSupport#1119 | N1 | **not this class** | a cached proxy field nulled without dispose on failure paths (C02 shape) | +| daqifi/daqifi-core#504 | N1 | **not this class** (→ N1b) | a throwing event handler skips the release in a teardown sequence | +| modelingevolution/micro-plumberd#20 | N1 | **not counted** | shape matches (start fails after the container was created), but it is a test-support library and the resource is external (a Docker container) | + +## 3. Ranking and recommendation + +Ranking follows the pre-registered order: independent count, then evidence strength, then cost. + +**1. N3 — `GO-CANDIDATE`.** Strongest on both count and evidence: +- 8 independent owners; +- each defect was observed failing in production or staging; +- no static tool covers it, and runtime scope validation cannot. + +It is close to what Own.NET already models: +- the DI registration graph (DI001–005) supplies scoped-ness; +- the extractor already records closure captures; +- the detached-work entry points are a small, known set of APIs. + +Forms by expected cost: +- **Intra-method, M.** A scoped field or `HttpContext` passed to a discarded call, or captured in a lambda handed to + `Task.Run` or a background queue. This covers DFY-BE, Vendorea, DotNetCloud, Ganjoor, microting and mars-vista. +- **One level into a same-class method, M.** escalated (`_ = RetryLaterAsync`). +- **Cross-class, L.** ChatCore needs interprocedural flow, which is close to the #382 territory left at NO-GO. + +Caveats, all unresolved: +- **Prevalence is not measured.** The deep check used keyword searches aimed at the class, so it shows recurrence + across owners, not a rate. +- **Mature-code yield is unknown.** 7 of the 8 repos are young or small (0–4 stars). The direction research (D11, private) recorded the same pattern + for C10, whose mature-code yield was 0. +- **The DI graph has a known false-positive problem.** It merges test and product registrations: 7/7 holdout FPs in + D11. The C10 fallback plan (product-only graph, about 1 week) would be a prerequisite. +- **Precision is unknown.** Any design must pre-register a precision gate on an independent sample, as #400 did. The + #400 PoC found its targets and still failed that gate. +- **Some deep-check PR texts are themselves AI-generated** (Vendorea, microting). The effect statements there are the + maintainers' claims and were not reproduced. + +**2. N1 — runner-up, not recommended now.** +- 4 independent owners, but the effect is a per-failure leak, with no crash. +- Own.NET would need two things it lacks: tracking of locals that are factory-acquired or later transferred, and + throw edges limited to the window before the transfer. +- The existing throw tier is documented as the "CA2000 firehose". Narrowing it to the transfer window is untested. +- Factory acquisition through third-party APIs needs type-based ownership assumptions. + +**3. N6, N7, N1b, N2, N4 — not recommended.** +- **N6.** Only corpus evidence; detection is cheap, but precision risk is high: intentional caches with bounded + keys. +- **N7, N4.** Cross-thread. The direction research's final decision (§16, private) ruled these classes need new architecture and are not worth it now. The count does + not override that decision. +- **N1b.** 2 owners, one of them found incidentally. +- **N2.** The framework already fails these at startup. It remains part of the C10 fallback, not a new class. + +The Meziantou C-1b defect (a default inserted before a throwing factory, from #412) found no second instance in this +corpus. It stays a single case. + +## 4. Limits + +- **The corpus is biased.** It was assembled by queries aimed at resource lifetime (design A), and every ledger + level was set by an earlier agent. Only the N3 and N1 records were re-read. +- **One researcher, no second labeller.** +- **Own.NET results for deep-check PRs are `NOT_RUN`.** Only the corpus records carry ledger-backed Own.NET + results. +- **Silence is not safety.** Classes that did not reach 2 are not shown to be rare; they were not found in this + corpus. + +## 5. Files + +- [`00-preregistration.md`](00-preregistration.md): the rules, written before any record was read. +- [`scripts/extract.py`](scripts/extract.py) and [`data/eligible.tsv`](data/eligible.tsv): the confirmed-defect + filter over the private ledger and its output (101 records). +- [`data/classes.tsv`](data/classes.tsv): every instance per class, with source and verdict. +- [`data/deepcheck-selection.tsv`](data/deepcheck-selection.tsv): the 10 deep-check PRs, chosen by title before + reading. +- [`scripts/search.sh`](scripts/search.sh), [`scripts/search2.sh`](scripts/search2.sh) and their outputs + [`data/search.out`](data/search.out), [`data/search2.out`](data/search2.out). GitHub search drifts, so a re-run + will not return the same lists. + +The texts and diffs of the deep-check PRs are third-party content and are not committed. Each PR is linked by +number and can be read on GitHub. diff --git a/docs/evidence/class-miner-phase0-2026-10/data/classes.tsv b/docs/evidence/class-miner-phase0-2026-10/data/classes.tsv new file mode 100644 index 00000000..7f0a5763 --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/data/classes.tsv @@ -0,0 +1,31 @@ +class source instance owner_counted verdict note +N3 corpus A-james-langridge/mars-vista-api#26 james-langridge confirmed HttpContext passed to a discarded async call; diff re-read +N3 corpus A-ganjoor/GanjoorService#508 ganjoor confirmed injected HttpClient captured by QueueBackgroundWorkItem lambda; diff re-read +N3 corpus A-CalebTek/ChatCore.NET#2 CalebTek confirmed scoped repository used from fire-and-forget Task.Run (cross-class); diff re-read +N3 deep LLabmik/DotNetCloud#43 LLabmik confirmed scoped service in fire-and-forget Task.Run +N3 deep DoForYou-ZA/DFY-BE#35 DoForYou-ZA confirmed _ = scopedService.NotifyAdminsAsync(...) +N3 deep ASADRAJA/Vendorea.PartnerConnect#49 ASADRAJA confirmed request-scoped IServiceProvider field used in Task.Run +N3 deep escalated-dev/escalated-dotnet#162 escalated-dev confirmed _ = RetryLaterAsync(...) on a scoped dispatcher +N3 deep microting/eform-angular-timeplanning-plugin#1669 microting confirmed fire-and-forget sends capture a request-scoped service +N3 deep klitztuch/LanBoard#47 - not_this_class event-triggered loads during prerender scope disposal +N1 corpus A-whizbang-lib/whizbang#1204 whizbang-lib confirmed new client, throwing verification, returned on success; diff re-read +N1 corpus A-MarimerLLC/rockbot#638-2 MarimerLLC confirmed McpClient.CreateAsync, throwing discovery, stored on success; code re-read +N1 corpus A-NexusFFXIV/NexusKit#34-2 NexusFFXIV confirmed BuildServiceProvider, throwing init, returned on success; diff re-read +N1 deep Wizard-Software/BareWire#73 Wizard-Software confirmed channel created, basic.qos throws before registration +N1 deep reqnroll/Reqnroll.IdeSupport#1119 - not_this_class cached proxy field nulled without dispose (C02 shape) +N1 deep daqifi/daqifi-core#504 - not_this_class moved to N1b +N1 deep modelingevolution/micro-plumberd#20 - not_counted test-support library, external resource (Docker container) +N1b corpus A-AmirrezaFarnamTaheri/PattN#10 AmirrezaFarnamTaheri confirmed Dispose after a throwing StopAsync in the same cleanup block +N1b deep daqifi/daqifi-core#504 daqifi confirmed throwing event handler skips the release; found while checking N1 +N6 corpus A-honua-io/honua-server#5294 honua-io ledger_only add-only key-membership index +N6 corpus A-praetorianer777/chaosflix-jellyfin#38 praetorianer777 ledger_only cache and per-key lock dictionary never evicted +N6 corpus A-raymondkrahwinkel/AI-Cockpit#583-2 raymondkrahwinkel ledger_only plugin-lifetime dictionary keyed by pane only added to +N6 corpus A-BoBoBaSs84/BB84.IPTV#36-2 BoBoBaSs84 ledger_only unbounded image cache in a long-lived service +N7 corpus A-xshaheen/headless-framework#1206 xshaheen ledger_only CTS disposed while a racing StopAsync uses it +N7 corpus A-charles8051/frame-flow#727-1 charles8051 ledger_only CTS disposed while flush/clock paths read its token +N7 corpus A-litedb-org/LiteDB#2987 litedb-org ledger_only CTS shared via a cache entry disposed by the publisher +N2 corpus A-Sakwala/affiant#20 Sakwala ledger_only missed: ServiceDescriptor runtime lifetime, TryAddSingleton factory, IEnumerable dependency +N2 corpus A-jonasmz/SIBO-AUTH-SSD#9 jonasmz ledger_only missed: framework registration (AddIdentityCore) +N2 corpus A-rrr-pi-rate/StockPriceSheetPrintService#60 rrr-pi-rate detected DI001 full match; not counted as a gap +N4 corpus A-couchbase/couchbase-net-client#193 couchbase ledger_only non-atomic disposed flag (Own.NET tool failure) +N4 corpus A-wileyc427/AgentInfer#8 wileyc427 ledger_only non-atomic disposed flag diff --git a/docs/evidence/class-miner-phase0-2026-10/data/deepcheck-selection.tsv b/docs/evidence/class-miner-phase0-2026-10/data/deepcheck-selection.tsv new file mode 100644 index 00000000..d01c226d --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/data/deepcheck-selection.tsv @@ -0,0 +1,11 @@ +class pr selected_by_title +N3 LLabmik/DotNetCloud#43 fix: series enrichment ObjectDisposedException - use IServiceScopeFactory for background enrichment +N3 escalated-dev/escalated-dotnet#162 fix(webhooks): retry failed deliveries in a scope of their own +N3 klitztuch/LanBoard#47 Stop live-update DB work from racing request scope disposal +N3 ASADRAJA/Vendorea.PartnerConnect#49 Fix FTP-ingestion disposed-scope crash + price-push UI polish +N3 DoForYou-ZA/DFY-BE#35 fix: prevent disposed DbContext during user registration +N3 microting/eform-angular-timeplanning-plugin#1669 fix: own a DI scope per fire-and-forget handover push send +N1 Wizard-Software/BareWire#73 fix(transport): release RabbitMQ consumer channels on setup failure and idle stop +N1 reqnroll/Reqnroll.IdeSupport#1119 fix(#1034): dispose the brokered service proxy in RunTestOutcomeBridge failure paths +N1 daqifi/daqifi-core#504 fix(transport): a throwing StatusChanged subscriber no longer kills auto-reconnect or leaks the port handle +N1 modelingevolution/micro-plumberd#20 EventStoreServer: a failed start removes its container; labelled owner reaper; exact name lookup diff --git a/docs/evidence/class-miner-phase0-2026-10/data/eligible.tsv b/docs/evidence/class-miner-phase0-2026-10/data/eligible.tsv new file mode 100644 index 00000000..20eccbfc --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/data/eligible.tsv @@ -0,0 +1,102 @@ +record_id category repository source_url ground_truth_level impact_evidence impact root_cause ownnet_result +A-dotnet/maui#37390 C01 dotnet/maui https://github.com/dotnet/maui/pull/37390 reviewer_verified(llm) test shared Page.PropertyChanged retains prior ShellContent instances (#37217) Transient ShellContent subscribes to a shared, longer-lived Page's PropertyChanged and is only unsubscribed if the child is removed, so the page roots every ShellContent. detected +A-dotnet/maui#37833 C01 dotnet/maui https://github.com/dotnet/maui/pull/37833 reviewer_verified(llm) test shared ResourceDictionary keeps every element it was assigned to alive (per PR, #36389) Elements subscribe to a possibly shared, long-lived ResourceDictionary's strong event and never unsubscribe on unload, so the dictionary roots them. detected_partial +A-histore/multishell#43 C01 histore/multishell https://github.com/histore/multishell/pull/43 reviewer_verified(llm) maintainer_statement memory leak in TerminalTabViewModel (closed tabs retained via Loc.PropertyChanged) Per-tab view model subscribes a lambda to the app-wide localization service's PropertyChanged and never unsubscribes, so closed tabs stay reachable from the long-lived service. unsupported +A-reqnroll/Reqnroll.IdeSupport#1071 C01 reqnroll/Reqnroll.IdeSupport https://github.com/reqnroll/Reqnroll.IdeSupport/pull/1071 reviewer_verified(llm) test singleton store's delegate list rooted every classifier and every .feature ITextBuffer opened during the VS session Short-lived classifier subscribes to an event on a process-wide singleton store and never unsubscribes, so the store's invocation list roots every classifier and its text buffer. detected +A-BoBoBaSs84/BB84.IPTV#36-1 C01-subscription-retention BoBoBaSs84/BB84.IPTV https://github.com/BoBoBaSs84/BB84.IPTV/pull/36 reviewer_verified(llm) maintainer_statement navigated-away control and its list kept alive for the rest of the session (code comment) control subscribes to an application-lifetime view model and only unsubscribes when its DataContext changes, which does not happen when navigation drops the control unsupported +A-CodeForFire/lagebuch#206 C01-subscription-retention CodeForFire/lagebuch https://github.com/CodeForFire/lagebuch/pull/206 reviewer_verified(llm) test stale Changed handlers accumulate per rebuild and fire redundantly (test: invocation list 18 -> 26) child view models subscribe to the longer-lived session's Changed event in their constructors; BuildChildren overwrote 7 of them without unsubscribing detected +A-Kryptos-FR/MarkView.Avalonia#111 C01-subscription-retention Kryptos-FR/MarkView.Avalonia https://github.com/Kryptos-FR/MarkView.Avalonia/pull/111 reviewer_verified(llm) test never-attached rendered documents kept alive by the application and re-rendered on every theme switch renderers subscribe to the app-lived Application.PropertyChanged at render time and unsubscribe only on logical-tree detach, which never fires for content that was never attached detected_with_coverage +A-dotnet/maui#36240 C01-subscription-retention dotnet/maui https://github.com/dotnet/maui/pull/36240 reviewer_verified(llm) issue_report view models stay in memory after navigation, growing ~3 MB per page visit old AdaptiveTriggers stay subscribed to the long-lived Window.SizeChanged when VisualStateGroups are replaced after attach, and each trigger strongly references its VisualElement detected_partial +A-raymondkrahwinkel/AI-Cockpit#583-1 C01-subscription-retention raymondkrahwinkel/AI-Cockpit https://github.com/raymondkrahwinkel/AI-Cockpit/pull/583 reviewer_verified(llm) profiler_or_dump RAM climbs to ~1.3 GB vs ~600-700 MB fresh after a day of opening/closing sessions per-session header badge subscribes to a plugin-lifetime tracker event and relies on a visual-detach callback that does not fire when a session closes detected_partial +A-Battle-Cattle/BCUK-Companion-ExpiredMinotaur#11 C02 Battle-Cattle/BCUK-Companion-ExpiredMinotaur https://github.com/Battle-Cattle/BCUK-Companion-ExpiredMinotaur/pull/11 reviewer_verified(llm) maintainer_statement each Disconnect->Connect cycle leaked the previous GATT service object (native GATT session handle) Teardown method nulls a field holding a WinRT GattDeviceService (native GATT session) without disposing it, on every reconnect. unsupported +A-cloudtoid/interprocess#29-1 C02 cloudtoid/interprocess https://github.com/cloudtoid/interprocess/pull/29 reviewer_verified(llm) issue_report Unix semaphore (and shared-memory) leaks when the last queue participant exits Named POSIX semaphore/shared-memory objects are closed per process but no participant takes responsibility for unlinking them, so they persist after the last user exits. not_detected_covered_auto +A-JasperFx/fisher#320 C02-idisposable-leak JasperFx/fisher https://github.com/JasperFx/fisher/pull/320 reviewer_verified(llm) test one DbContext leaked per commit on the inline projection path inline EF-backed projections register a DbContext participant on the session, but only the async-daemon batch ever drained/disposed participants not_detected_covered_auto +A-AmirrezaFarnamTaheri/PattN#10 C03 AmirrezaFarnamTaheri/PattN https://github.com/AmirrezaFarnamTaheri/PattN/pull/10 reviewer_verified(llm) maintainer_statement leaked the process handle and port; cleanup exception masked the validation result Release (Dispose) of a temporary core process sits after a throwing StopAsync in the same cleanup block, so a throw skips it. not_detected_covered +A-whizbang-lib/whizbang#1204 C03 whizbang-lib/whizbang https://github.com/whizbang-lib/whizbang/pull/1204 patch_supported test each failed connection attempt leaked a ServiceBusClient (#1187) A client acquired before a throwing verification step is only handed to the caller on success and never disposed on the failure path. not_detected_covered_auto +A-MarimerLLC/rockbot#638-2 C03-exception-path-cleanup MarimerLLC/rockbot https://github.com/MarimerLLC/rockbot/pull/638 reviewer_verified(llm) maintainer_statement connected MCP client leaked per failed discovery attempt (PR statement) newly connected MCP client not disposed when tool/prompt discovery throws before it is published not_detected_covered_auto +A-NexusFFXIV/NexusKit#34-2 C03-exception-path-cleanup NexusFFXIV/NexusKit https://github.com/NexusFFXIV/NexusKit/pull/34 reviewer_verified(llm) maintainer_statement on a failed build the DI container leaks undisposed with live background loops (PR statement) service provider created and background workers started before steps that can throw, with no cleanup on the exception path not_detected_covered_auto +A-afonsoft/open-webui#387 C04 afonsoft/open-webui https://github.com/afonsoft/open-webui/pull/387 reviewer_verified(llm) maintainer_statement NotSupportedException on every SSE client disconnect/stall (unhandled exception in Kestrel) An async enumerator is disposed while a MoveNextAsync abandoned by a WhenAny race is still in flight. not_detected_no_rule +A-charles8051/frame-flow#710 C04 charles8051/frame-flow https://github.com/charles8051/frame-flow/pull/710 reviewer_verified(llm) test native pipeline/decoder/demux state freed while still in use by the running pass (use after free) Async disposal frees native resources while the asynchronous run that uses them is still executing. not_detected_no_rule +A-ganjoor/GanjoorService#508 C04-async-resource-lifetime ganjoor/GanjoorService https://github.com/ganjoor/GanjoorService/pull/508 reviewer_verified(llm) maintainer_statement HTTP-sourced public data import always failed with ObjectDisposedException request-scoped injected HttpClient captured by a background work item that runs after the request scope disposed it not_detected_no_rule +A-james-langridge/mars-vista-api#26 C04-async-resource-lifetime james-langridge/mars-vista-api https://github.com/james-langridge/mars-vista-api/pull/26 reviewer_verified(llm) maintainer_statement unobserved ObjectDisposedException (39 production events in ~7 months); real persistence failures masked detached task outlives the request and dereferences the recycled HttpContext and its request-scoped services not_detected_no_rule +A-UBF21/Vali-Mediator#3 C05 UBF21/Vali-Mediator https://github.com/UBF21/Vali-Mediator/pull/3 reviewer_verified(llm) maintainer_statement timeout behavior could not cancel the handler (handler keeps running after TimeoutException) Timeout implemented as a WhenAny race without token propagation, so a timed-out handler keeps running (and its later fault is unobserved). not_detected_covered_auto +A-michaeljosiah/voxa#64 C05 michaeljosiah/voxa https://github.com/michaeljosiah/voxa/pull/64 reviewer_verified(llm) maintainer_statement one leaked linked CTS + registration on the external token per processor per session A linked CancellationTokenSource created per Start is never disposed, leaving its registration on the caller's longer-lived token. not_detected_covered +A-Lolle2000la/MangaIngestWithUpscaling#477-3 C06 Lolle2000la/MangaIngestWithUpscaling https://github.com/Lolle2000la/MangaIngestWithUpscaling/pull/477 reviewer_verified(llm) maintainer_statement an unobserved throw in the file-watcher handler could kill the process (per PR) Async lambda passed to Subscribe(Action) becomes async void, so its exceptions escape to the thread pool. not_detected_no_rule +A-digirati-co-uk/digital-preservation#332-1 C06 digirati-co-uk/digital-preservation https://github.com/digirati-co-uk/digital-preservation/pull/332 reviewer_verified(llm) test an ordinary Fedora failure in the keep-alive callback could crash the process (per PR/issue #250) An async void method used as a System.Threading.Timer callback lets exceptions from its awaits escape, which terminates the process. not_detected_no_rule +A-ligf/ElegantSeries.Flow#50-2 C06 ligf/ElegantSeries.Flow https://github.com/ligf/ElegantSeries.Flow/pull/50 reviewer_verified(llm) maintainer_statement abandoned guard task exceptions surface as UnobservedTaskException A navigation-guard task abandoned on the cancellation branch of a WhenAny race is never observed, so its exception is lost/raised as UnobservedTaskException. not_detected_covered +A-brenpike/Chatter#503-2 C06-task-valuetask-misuse brenpike/Chatter https://github.com/brenpike/Chatter/pull/503 patch_supported maintainer_statement failed or cancelled receiver close silently lost (orphaned sessions/renewal loops unreported) fire-and-forget CloseAsync in Dispose with no observation of its outcome not_detected_no_rule +A-CometWorks/quasar#232 C08 CometWorks/quasar https://github.com/CometWorks/quasar/pull/232 reviewer_verified(llm) test every normal stop ended in an unhandled ObjectDisposedException; Linux exit -6 with core dump The DI container owns the same instance through two registrations and disposes it twice; Dispose was not idempotent and cancelled an already-disposed CTS. not_detected_covered +A-couchbase/couchbase-net-client#193 C08 couchbase/couchbase-net-client https://github.com/couchbase/couchbase-net-client/pull/193 patch_supported maintainer_statement concurrent callers could each dispose _semaphore while a racing BucketAsync still awaits/releases it (per PR) Non-atomic check-then-set of the disposed flag lets concurrent Dispose calls each run the disposal body. tool_failure +A-crane-valley/NextUnit#181 C08 crane-valley/NextUnit https://github.com/crane-valley/NextUnit/pull/181 reviewer_verified(llm) test next run on a reused engine throws ObjectDisposedException on the assembly-setup gate A per-run cleanup method disposes a SemaphoreSlim whose owner is the long-lived, reused engine. not_detected_covered +A-ligf/ElegantSeries.Flow#50-1 C08 ligf/ElegantSeries.Flow https://github.com/ligf/ElegantSeries.Flow/pull/50 reviewer_verified(llm) test scope (and its view model) double-disposed when DisposeAsync runs during deferred disposal An IServiceScope handed to a deferred-disposal task remained registered in the service's pending-disposal set, giving it two owners that could both dispose it when the service is disposed concurrently. not_detected_covered +A-AdCodicem/AdCodicem.Pdf#248-1 C08-ownership-transfer-double-cleanup AdCodicem/AdCodicem.Pdf https://github.com/AdCodicem/AdCodicem.Pdf/pull/248 patch_supported test a reference holder could close the file of a document still in use (PR statement) the shared reader exposed to every object reference as Source was IDisposable, letting any holder close the document's file not_detected_covered +A-Surya-ux70/PharmacyManagement#11 C08-ownership-transfer-double-cleanup Surya-ux70/PharmacyManagement https://github.com/Surya-ux70/PharmacyManagement/pull/11 reviewer_verified(llm) maintainer_statement ObjectDisposedException at startup migration startup code disposes the DbContext-owned connection obtained from GetDbConnection(), which the context reuses for Migrate() not_detected_covered +A-wileyc427/AgentInfer#8 C08-ownership-transfer-double-cleanup wileyc427/AgentInfer https://github.com/wileyc427/AgentInfer/pull/8 patch_supported maintainer_statement concurrent Dispose could double-record telemetry and dispose the Activity twice (not reproduced) non-atomic one-shot dispose flag lets two concurrent Dispose calls both run teardown not_detected_no_rule +A-honua-io/honua-server#5294 C09 honua-io/honua-server https://github.com/honua-io/honua-server/pull/5294 reviewer_verified(llm) test default no-Redis cache retained expired keys in its membership index indefinitely while a key stays live A cache key-membership index only ever grows: entries are added per write, never expire, and the whole index is renewed for 30 days on each write. not_detected_covered_auto +A-praetorianer777/chaosflix-jellyfin#38 C09 praetorianer777/chaosflix-jellyfin https://github.com/praetorianer777/chaosflix-jellyfin/pull/38 reviewer_verified(llm) test cache and per-key SemaphoreSlim dictionary grew for the life of the server with user-driven keys A long-lived cache and its per-key lock dictionary add entries for user-driven keys and never evict them. not_detected_covered_auto +A-BoBoBaSs84/BB84.IPTV#36-2 C09-cache-timer-static-retention BoBoBaSs84/BB84.IPTV https://github.com/BoBoBaSs84/BB84.IPTV/pull/36 patch_supported maintainer_statement loaded logo images (unmanaged memory) kept for the rest of the session (code comment) long-lived service caches every loaded logo image without bound and drops them on refresh without releasing their unmanaged memory not_detected_no_rule +A-raymondkrahwinkel/AI-Cockpit#583-2 C09-cache-timer-static-retention raymondkrahwinkel/AI-Cockpit https://github.com/raymondkrahwinkel/AI-Cockpit/pull/583 reviewer_verified(llm) profiler_or_dump closed sessions (view models, transcript visual tree) stay rooted; RAM growth over a day of use plugin-lifetime dictionary keyed by pane is only ever added to, pinning every closed session's context not_detected_no_rule +A-CalebTek/ChatCore.NET#2 C10 CalebTek/ChatCore.NET https://github.com/CalebTek/ChatCore.NET/pull/2 reviewer_verified(llm) issue_report ObjectDisposedException: Cannot access a disposed context instance (ChatCoreDbContext) A component whose work runs after the request scope (fire-and-forget) holds a scoped repository/DbContext from that scope. not_detected_no_rule +A-Sakwala/affiant#20 C10 Sakwala/affiant https://github.com/Sakwala/affiant/pull/20 reviewer_verified(llm) issue_report captive-dependency crash at startup under Development scope validation; latent DbContext sharing across concurrent evaluations A singleton-registered evaluator consumes a scoped policy list (policies may depend on a host DbContext), capturing one scope's instances for the process lifetime. not_detected_covered +A-caiodom/essential-mediator#26 C10 caiodom/essential-mediator https://github.com/caiodom/essential-mediator/pull/26 patch_supported maintainer_statement captive/root-scope dependency risk; can fail under scope validation (per PR) The DI integration allowed registering the mediator as singleton although it resolves scoped handlers through the provider it captured. not_detected_covered +A-jonasmz/SIBO-AUTH-SSD#9 C10 jonasmz/SIBO-AUTH-SSD https://github.com/jonasmz/SIBO-AUTH-SSD/pull/9 reviewer_verified(llm) test Development host refused to start: 'Cannot consume scoped service ILookupNormalizer from singleton' A singleton rate limiter captures a scoped Identity service via its constructor. not_detected_covered +A-rrr-pi-rate/StockPriceSheetPrintService#60 C10 rrr-pi-rate/StockPriceSheetPrintService https://github.com/rrr-pi-rate/StockPriceSheetPrintService/pull/60 reviewer_verified(llm) maintainer_statement Development DI validation threw InvalidOperationException for the captive dependency; production silently shared the scoped service A singleton bot-message distributor holds a scoped report service injected at construction. detected +A-FastEndpoints/FastEndpoints#1179 C10-di-captive FastEndpoints/FastEndpoints https://github.com/FastEndpoints/FastEndpoints/pull/1179 reviewer_verified(llm) test scoped dependency (e.g. current user, DbContext) from the first request reused by every later request lazily created framework singletons (validators, mappers, event handlers) are constructed from the first request's scope and cached for the process, capturing scoped dependencies outside DI scope validation not_detected_covered +A-OlyForge3D/PrintFarmer#1681 C10-di-captive OlyForge3D/PrintFarmer https://github.com/OlyForge3D/PrintFarmer/pull/1681 reviewer_verified(llm) maintainer_statement gauges would read through a disposed scope and silently report zero capacity (dormant: meter not registered before this PR) singleton metrics object captures delegates bound to a scoped service instance and its scoped repository not_detected_covered +A-VION-IoT/dale-sdk#119 C10-di-captive VION-IoT/dale-sdk https://github.com/VION-IoT/dale-sdk/pull/119 reviewer_verified(llm) test one half-open socket stranded per same-version redeploy; block-owned clients disposed only at process exit per-block receivers resolved from the root IServiceProvider, so their transient IDisposable dependencies (Modbus/HTTP clients) are tracked and kept by the root container not_detected_covered +A-squirix/squirix#483 C11 squirix/squirix https://github.com/squirix/squirix/pull/483 reviewer_verified(llm) maintainer_statement pooled encode buffer leaked (not returned) when the codec throws A rented pool buffer is returned only by the downstream enqueue, so a throw between Rent and the hand-off skips the return. not_detected_covered +A-charles8051/frame-flow#727-1 C14 charles8051/frame-flow https://github.com/charles8051/frame-flow/pull/727 reviewer_verified(llm) test flush/clock wait after dispose threw ObjectDisposedException (#723) Teardown cancels and then disposes a CTS whose token is still read by flush/clock-wait paths that can run after (or concurrently with) disposal. not_detected_no_rule +A-couchbase/couchbase-net-client#194 C14 couchbase/couchbase-net-client https://github.com/couchbase/couchbase-net-client/pull/194 reviewer_verified(llm) test ObjectDisposedException from _semaphore.Release() replaced the bootstrap result/real error when Dispose ran during BucketAsync A semaphore field is disposed by Dispose while a concurrent async call still holds it and releases it afterwards. tool_failure +A-sytone/botnexus#311 C14 sytone/botnexus https://github.com/sytone/botnexus/pull/311 reviewer_verified(llm) maintainer_statement mobile client showed 'An error has occurred' after a successful message exchange Hub event handlers fire on thread-pool threads after the component is disposed and touch the disposed renderer. unsupported +A-xshaheen/headless-framework#1206 C14 xshaheen/headless-framework https://github.com/xshaheen/headless-framework/pull/1206 reviewer_verified(llm) test ObjectDisposedException from StopAsync on WebApplicationFactory disposal; ~178 cascading test failures in a consumer run A CancellationTokenSource disposed in the scheduler's DisposeAsync is still used by a concurrently running hosted-service StopAsync when two host shutdown sequences race. not_detected_no_rule +A-Brain2k-0005/Lumeo#542 C14-use-after-dispose-typestate Brain2k-0005/Lumeo https://github.com/Brain2k-0005/Lumeo/pull/542 reviewer_verified(llm) maintainer_statement Blazor Server circuit killed by ObjectDisposedException when navigating while a tooltip/submenu is closing component resumes after an await in OnAfterRenderAsync and uses its DotNetObjectReference that a concurrent Dispose/DisposeAsync already released not_detected_covered_auto +A-brenpike/Chatter#503-1 C14-use-after-dispose-typestate brenpike/Chatter https://github.com/brenpike/Chatter/pull/503 reviewer_verified(llm) maintainer_statement every caller received an already-disposed ServiceBusReceiver (benign by timing) registration factory opens a DI scope, resolves a scoped IDisposable from it and returns it after the using disposes the scope (and the instance) not_detected_covered_auto +A-KerckhoffsLabs/KerckhoffsLabs.Security.Cryptography.Pkcs11#60 C15 KerckhoffsLabs/KerckhoffsLabs.Security.Cryptography.Pkcs11 https://github.com/KerckhoffsLabs/KerckhoffsLabs.Security.Cryptography.Pkcs11/pull/60 reviewer_verified(llm) test use after unmap of PKCS#11 module code during concurrent dispose; abandoned session's C_CloseSession never issued A disposed-flag check does not keep a native module mapped for the duration of a concurrent call, so Dispose can finalize and unmap it under an in-flight call. not_detected_no_rule +A-Lolle2000la/MangaIngestWithUpscaling#477-1 C15 Lolle2000la/MangaIngestWithUpscaling https://github.com/Lolle2000la/MangaIngestWithUpscaling/pull/477 reviewer_verified(llm) maintainer_statement EF 'A second operation was started on this context instance' under overlapping operations (same root cause crashed /mangas, #476) Parallel integrity-check workers reach a scoped service that uses the single shared DbContext. not_detected_no_rule +A-Lolle2000la/MangaIngestWithUpscaling#477-2 C15 Lolle2000la/MangaIngestWithUpscaling https://github.com/Lolle2000la/MangaIngestWithUpscaling/pull/477 reviewer_verified(llm) test concurrent use of one DbContext from several threads (EF forbids; per code comment) A live EF async stream is enumerated while parallel loop bodies use the same DbContext. not_detected_no_rule +A-idotta/lite-doc-store#33 C15 idotta/lite-doc-store https://github.com/idotta/lite-doc-store/pull/33 reviewer_verified(llm) maintainer_statement concurrent requests interleaved on one connection; another request's writes rolled back with a foreign transaction (per PR) One non-thread-safe SqliteConnection owned by a singleton store is used concurrently by unrelated requests, including inside each other's transactions. not_detected_no_rule +A-litedb-org/LiteDB#2987 C15 litedb-org/LiteDB https://github.com/litedb-org/LiteDB/pull/2987 reviewer_verified(llm) test intermittent NullReferenceException from CancellationTokenSource.get_WaitHandle in concurrent mapper initialization (CI) A CancellationTokenSource whose token is shared with concurrent waiters via a published cache entry is disposed by the publishing caller. not_detected_no_rule +A-MarimerLLC/rockbot#638-1 C15-concurrent-ownership-handoff MarimerLLC/rockbot https://github.com/MarimerLLC/rockbot/pull/638 reviewer_verified(llm) test in-flight MCP tool calls cancelled on reconnect and reported as timeouts reconnect disposes a client that concurrent calls are still using; per-server state in eight unsynchronised dictionaries not_detected_no_rule +A-BrighterCommand/Brighter#4576 C16-duplicate-subscription-amplification BrighterCommand/Brighter https://github.com/BrighterCommand/Brighter/pull/4576 reviewer_verified(llm) maintainer_statement after N sends each ack invokes the settle handler N times; O(N^2) subscribe cost; extra confirm.select per send publisher-confirm handlers subscribed and ConfirmSelect called on every send over a long-lived channel, with no unsubscribe on reset or dispose not_detected_no_rule +A-erikdarlingdata/PerformanceMonitor#5268 C18 erikdarlingdata/PerformanceMonitor https://github.com/erikdarlingdata/PerformanceMonitor/pull/5268 patch_supported test an immediate second server add answered 429 'A server add is already running' for a slot already free; CI test flake The handler acquires a one-slot gate but delegates its release to a detached continuation that can run after the response is sent. not_detected_no_rule +A-BookBeat/knightbus#191 C18-lock-semaphore-release BookBeat/knightbus https://github.com/BookBeat/knightbus/pull/191 reviewer_verified(llm) test concurrency slots permanently lost; pump eventually deadlocks and the queue silently stops being consumed semaphore slot release (and CTS disposal) lives in the finally of a Task.Run delegate whose scheduling token can cancel before the delegate starts not_detected_no_rule +A-Flakroup/FEx#293 other:analyzer-message Flakroup/FEx https://github.com/Flakroup/FEx/pull/293 patch_supported maintainer_statement wrong advice: 'can return void' for awaited Task (per PR) Analyzer diagnostic message ignored awaitable return types. not_run +A-indice-co/Indice.Platform#1089 other:api-misuse indice-co/Indice.Platform https://github.com/indice-co/Indice.Platform/pull/1089 patch_supported test FAQ documents chunked incorrectly (title: 'fix chunking of FAQs') Overload resolution turned the second separator char into the count argument. not_run +A-thomhurst/Dekaf#1060 other:cancellation-contract thomhurst/Dekaf https://github.com/thomhurst/Dekaf/pull/1060 patch_supported test unstated (caller cannot match OCE.CancellationToken to its own token) Caller cancellation surfaced as an OperationCanceledException bound to an internal linked/timeout token instead of the caller's token. not_run +A-ConanKLOP2/PhotoReview#174 other:cancellation-reason-race ConanKLOP2/PhotoReview https://github.com/ConanKLOP2/PhotoReview/pull/174 reviewer_verified(llm) test pure timeouts surface as Canceled depending on race outcome (flaky test) cancellation outcome classified by exception type alone, so a timeout that wins the race inside the queued work is reported as caller cancellation not_run +A-NexusFFXIV/NexusKit#34-1 other:cancellation-scope NexusFFXIV/NexusKit https://github.com/NexusFFXIV/NexusKit/pull/34 reviewer_verified(llm) maintainer_statement lifetime token cancelled 60 s after load; persistence, tracking, history and DB maintenance silently disabled for the session plugin-lifetime CancellationTokenSource linked to a load-scoped timeout token, so a load timeout cancels the long-lived lifetime not_run +A-JasonBock/Rocks#436 other:codegen-invalid-doc-cref JasonBock/Rocks https://github.com/JasonBock/Rocks/pull/436 patch_supported issue_report projects with GenerateDocumentationFile + TreatWarningsAsErrors fail to build (CS1570/CS1574/CS1584/CS1658) generator emitted doc crefs that do not resolve for inherited members, ref/out/in parameters and tuples not_run +A-Flakroup/FEx#193 other:concurrency-race Flakroup/FEx https://github.com/Flakroup/FEx/pull/193 patch_supported maintainer_statement a reset could be observed in the middle of an initialization (per PR, #42) Reset cleared initialization state without the initialization lock, so a reset could be observed mid-initialization. not_run +A-microting/eform-angular-timeplanning-plugin#1705 other:concurrency-race microting/eform-angular-timeplanning-plugin https://github.com/microting/eform-angular-timeplanning-plugin/pull/1705 patch_supported test dashboard could silently return fewer workers than exist (per PR) Unsynchronised List.Add from concurrently running async lambdas. not_run +A-packet-net/pdn-qso#22 other:concurrency-race packet-net/pdn-qso https://github.com/packet-net/pdn-qso/pull/22 patch_supported profiler_or_dump test-suite hang caught with a dump: receiver parked with a frame queued and no permit to wake it Wake-up signalling via a cancellable SemaphoreSlim wait racing a timer poll could drop the permit; busy flag updated at the wrong point. not_run +A-reactivemarbles/DynamicData#1111 other:concurrency-race reactivemarbles/DynamicData https://github.com/reactivemarbles/DynamicData/pull/1111 reviewer_verified(llm) test PropertyChanged events fired during Subscribe silently dropped Concat subscribes to the PropertyChanged source only after the initial value is delivered, so events raised in that window (and during deep-chain re-walks) are lost not_run +A-OlyForge3D/PrintFarmer#2989-1 other:coordination-logic OlyForge3D/PrintFarmer https://github.com/OlyForge3D/PrintFarmer/pull/2989 reviewer_verified(llm) test host update fence never acknowledged while the dispatch channel is idle host-update pause was only checked on the trigger path, so an idle dispatcher never acknowledged quiescence not_run +A-NethermindEth/nethermind#14533 other:deadlock-registration-dispose-under-lock NethermindEth/nethermind https://github.com/NethermindEth/nethermind/pull/14533 reviewer_verified(llm) test NewHeadBlock handler deadlocks; Shutter validator node stops following the chain CancellationTokenRegistration.Dispose called while holding a lock that the registration's timeout callback also acquires not_run +A-baoduy/DKNet#366 other:di-duplicate-registration baoduy/DKNet https://github.com/baoduy/DKNet/pull/366 patch_supported maintainer_statement repeated helper calls double side effects (domain events, audit entries) or override configuration registration helpers are not idempotent, so a repeated call registers handlers/services twice; two helpers keep a process-static 'registered' flag not_run +A-quartznet/quartznet#3368 other:di-keying quartznet/quartznet https://github.com/quartznet/quartznet/pull/3368 patch_supported test one plugin instance initialized twice; second Initialize overwrites the first (per PR tests) Unkeyed DI lookup returned another scheduler's plugin registration in a multi-scheduler container. not_run +A-Systemorph/MeshWeaver#6185 other:di-wrong-provider-scope Systemorph/MeshWeaver https://github.com/Systemorph/MeshWeaver/pull/6185 reviewer_verified(llm) issue_report /health returned 500; control image acceptance failed (not ready within 300 s) module health-check registration forwarded to the root container, whose HealthCheckService activates the check with the root provider that cannot see module-owned services not_run +A-kurrent-io/kcap-cli#508 other:error-propagation kurrent-io/kcap-cli https://github.com/kurrent-io/kcap-cli/pull/508 patch_supported maintainer_statement nine reviewer launches reaped during a vendor cert surfaced as 'unknown failure'/auth hint; ~2 hours lost (per PR) Reap reasons were dropped between daemon and flow caller, which reported a generic launch/handshake failure instead. not_run +A-SharpMUSH/SharpMUSH#1373 other:error-swallowing SharpMUSH/SharpMUSH https://github.com/SharpMUSH/SharpMUSH/pull/1373 patch_supported maintainer_statement 5xx/dropped connection shown as 'scene not found' or 'no scenes'; failed re-read cleared the live log (per PR) Service wrappers swallowed transport/server failures into null or empty results. not_run +A-Chemsorly/coding-agent-automation#3415 other:exception-handling Chemsorly/coding-agent-automation https://github.com/Chemsorly/coding-agent-automation/pull/3415 patch_supported test Stop Loop during a cycle's config read stopped the whole Scheduler process Exception filter excluded the stop-requested cancellation path, so the exception escaped a BackgroundService.ExecuteAsync. not_run +A-ptr727/Utilities#456 other:file-not-truncated ptr727/Utilities https://github.com/ptr727/Utilities/pull/456 reviewer_verified(llm) maintainer_statement downloaded file corrupted with the previous file's trailing bytes while reporting success destination opened with File.OpenWrite, which does not truncate an existing longer file not_run +A-zunath/SWLOR_NWN#2464 other:game-logic zunath/SWLOR_NWN https://github.com/zunath/SWLOR_NWN/pull/2464 patch_supported maintainer_statement stamina refunds could exceed the stamina spent (refund loops) authored weapon hit refunds bypassed the actual-spend cap applied to passive refunds not_run +A-Informatievlaanderen/road-registry#2133 other:idempotency Informatievlaanderen/road-registry https://github.com/Informatievlaanderen/road-registry/pull/2133 patch_supported maintainer_statement WMS/WFS projection crashed mid-recovery on 8 Oct: duplicate key in road.GelijkgrondseKruisingen Projection handlers assumed create events are delivered once and inserted blindly. not_run +A-UnigramDev/Unigram#3455 other:index-logic UnigramDev/Unigram https://github.com/UnigramDev/Unigram/pull/3455 patch_supported issue_report ArgumentOutOfRangeException crash when unpinning the oldest gift (crash telemetry 12.10.7.0) Insertion index computed against the list before the element's own removal shifted it. not_run +A-NethermindEth/nethermind#12537 other:input-handling NethermindEth/nethermind https://github.com/NethermindEth/nethermind/pull/12537 patch_supported issue_report subsequent requests in a batch aborted by one malformed item (per PR title/issue) A malformed (non-object) batch item aborted processing of the remaining JSON-RPC batch. not_run +A-rtkelly-labs/Parquet.SourceGenerator#648 other:input-validation rtkelly-labs/Parquet.SourceGenerator https://github.com/rtkelly-labs/Parquet.SourceGenerator/pull/648 patch_supported test tail of the rented buffer holds whatever an earlier unrelated read left there (stale values returned) Reader trusted the footer's row count, leaving the tail of a pooled (uncleared) buffer unwritten and then consumed. not_run +A-dasher-project/Dasher-Windows#70 other:logic dasher-project/Dasher-Windows https://github.com/dasher-project/Dasher-Windows/pull/70 patch_supported issue_report canvas completely resets at sentence boundaries; input filter not remembered on startup Offset unit mismatch (sentence-relative vs buffer-absolute) re-rooted the model; setting not saved. not_run +A-lxsdd/rekordbox-mytag-sync#18 other:logic lxsdd/rekordbox-mytag-sync https://github.com/lxsdd/rekordbox-mytag-sync/pull/18 patch_supported maintainer_statement read-only Validate blocked on a real rekordbox 6 installation Reader treated the reserved 'root' parent sentinel as a missing row. not_run +A-open-astro/openastro-ara#1227 other:logic open-astro/openastro-ara https://github.com/open-astro/openastro-ara/pull/1227 patch_supported maintainer_statement LST/hour angle/topocentric transforms off by up to 0.9 s of UT1 (~13 arcsec hour angle) Ported code returned a constant 0 for UT1-UTC instead of looking it up. not_run +A-MrScripty/Lanternwake#24 other:null-deref MrScripty/Lanternwake https://github.com/MrScripty/Lanternwake/pull/24 patch_supported test exception at RetireReleasedPlaybacks() line 138 on next frame; null disposal on tree exit A possibly-null native playback handle is stored unconditionally and dereferenced/disposed later. not_run +A-NSTA1/Orleans.Lattice#4082 other:security NSTA1/Orleans.Lattice https://github.com/NSTA1/Orleans.Lattice/pull/4082 patch_supported maintainer_statement any peer holding an accepted mesh secret could stamp another cluster's origin id (per PR) Security options/filters failed open: credential not bound to claimed origin by default; scope kind ignored; per-tool filter skipped when operation detail absent. not_run +A-Systemorph/MeshWeaver#5939 other:security Systemorph/MeshWeaver https://github.com/Systemorph/MeshWeaver/pull/5939 patch_supported maintainer_statement a standing admin could mark a provision request as governed by an unrelated executing activity (per PR) Governed claim never checked where it was made; later reader raced on current activity state. not_run +A-daqifi/daqifi-core#758 other:security daqifi/daqifi-core https://github.com/daqifi/daqifi-core/pull/758 patch_supported maintainer_statement a filename such as 'log.bin\nSYSTem:REboot' would reach the device as two commands (per PR) Unvalidated filename embedded into a quoted SCPI argument allowed injection of a second device command. not_run +A-microsoft/winappCli#1046 other:security microsoft/winappCli https://github.com/microsoft/winappCli/pull/1046 patch_supported maintainer_statement anyone could start signed winapp.exe and make it load an arbitrary DLL (per PR) Child process trusted DLL/script paths from its arguments, so a signed winapp.exe could be pointed at an arbitrary DLL. not_run +A-thomhurst/ModularPipelines#6308 other:shutdown-signal-handling thomhurst/ModularPipelines https://github.com/thomhurst/ModularPipelines/pull/6308 patch_supported maintainer_statement AlwaysRun cleanup modules / OnPipelineEndAsync / run report could not finish before services were disposed on SIGTERM (implied by PR) On SIGTERM the process-exit handler cancelled and disposed the pipeline fire-and-forget while the run (cleanup modules, report) was still executing. not_run +A-Chemsorly/coding-agent-automation#2212 other:stale-state Chemsorly/coding-agent-automation https://github.com/Chemsorly/coding-agent-automation/pull/2212 patch_supported maintainer_statement queued items ran with outdated steering, QG and provider configs (per PR title/#2171) Configuration snapshot frozen into the queued payload instead of being resolved at dispatch. not_run +A-thomhurst/Dekaf#1410 other:timeout-logic thomhurst/Dekaf https://github.com/thomhurst/Dekaf/pull/1410 patch_supported test idle connections dropped after RequestTimeout (implied by regression tests 'staying connected past RequestTimeout') Per-read request timeout applied even when no request was outstanding, tearing down idle connections. not_run +A-jessiicamaru/e-commerce-asp-dotnet-practice#302 other:transaction-isolation jessiicamaru/e-commerce-asp-dotnet-practice https://github.com/jessiicamaru/e-commerce-asp-dotnet-practice/pull/302 patch_supported test 1,710-5,610 serialization aborts per two-minute load run on one popular product, each retried Consumer transactions ran at REPEATABLE READ while serialising on a FOR UPDATE row lock, so each waiter aborted with a serialization failure. not_run +A-charles8051/frame-flow#661 other:ui-lifecycle charles8051/frame-flow https://github.com/charles8051/frame-flow/pull/661 patch_supported test controls taken out of the visual tree and put back kept showing their old state (#643) Subscription torn down in a detach callback with no matching re-establishment in the attach callback. not_run +A-lukr-99/MicForge#2 other:ui-reentrancy lukr-99/MicForge https://github.com/lukr-99/MicForge/pull/2 patch_supported maintainer_statement a timer that keeps throwing could stack crash dialogs without end (PR statement) crash dialog shown from a handler that the dialog's nested message loop can re-enter not_run +A-pratikmistri/mixtri#32 other:ui-state pratikmistri/mixtri https://github.com/pratikmistri/mixtri/pull/32 patch_supported maintainer_statement selection state reset on Editor -> Record navigation; Escape indistinguishable from confirming the same region page constructed a fresh view model on every navigation, losing capture-mode/selection state; picker did not show the remembered region or distinguish cancel not_run +A-irihitech/Irihi.Avalonia.Shared#64 other:weak-subscription-premature-gc irihitech/Irihi.Avalonia.Shared https://github.com/irihitech/Irihi.Avalonia.Shared/pull/64 reviewer_verified(llm) test class changes on the source silently stop propagating to the target after GC inline lambda passed to Avalonia WeakSubscribe has no strong root, so the subscription is collected and source class changes stop propagating not_run diff --git a/docs/evidence/class-miner-phase0-2026-10/data/search.out b/docs/evidence/class-miner-phase0-2026-10/data/search.out new file mode 100644 index 00000000..cf5567ba --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/data/search.out @@ -0,0 +1,107 @@ +### fire-and-forget ObjectDisposedException +DoForYou-ZA/DFY-BE#35 fix: prevent disposed DbContext during user registration +xandeq/diax-crm#174 fix(security): checklists sem auth, await no DbContext, path traversal, login por IP +open-astro/openastro-ara#1410 The dew advisor's stop cancels its check and survives the host's shutdown budget +TJvL/Ready4Balfolk#363 fix(web): dispose the host after a stop that fails, and let disposal wait its turn +tomwolfgang/piper#102 Land F2 part 4 (#101: TLS, HTTP/2 and RTT scenarios) on main +OlyForge3D/PrintFarmer#3399 test(moonraker): cover zmod_ifs handling through ProcessStatusUpdateAsync +MUnique/OpenMU#961 Stop periodic tasks before disconnecting players on game server shutdown +Astrea-EIP/api-back#79 chore(docker): harden api image and document local container run +ToMeRhh/volco#54 Harden UDP and WebSocket transports (dispose safety, ordered WebSocket sends) +Systemorph/MeshWeaver#3165 fix: a hub disposed with a request outstanding is a TYPED teardown, not an anonymous failure (#3148) +damianh/dotNext#46 Release failure-detection membership lock (#17) +Runic-Artifex/runic-sdk#232 W260-005: NavigationRegion.Start for a window's root page +swigerb/AzureAIDriveThru#58 S1.5 A2 — tool-error seam, audio-free greeting unmute, browser logging gate, voice follow-ups (#36 #48 #53 #57) +Redmern/fleet-tui#28 fix: stop the remote-link test's broken pipe and the wire races behind it +crazysmile-PhD/downkyicore#445 Fix Pause All scheduler admission gate +squirix/squirix#463 fix(threading): SingleConsumerWorker stays alive on any handler exception +Astrea-EIP/api-back#81 test: set up test project and cover current api architecture +open-astro/openastro-ara#1084 cooling fan: sequencer path, fail-closed states, fan-first on cooler-on, late-connect catch-up (#1076) +sven-borden/10Lapse#82 Virtualized filmstrip with selection, removal, undo, reorder and gap markers (#20) +FNA-XNA/FNA#648 exception accuracy: Throw Exception in SoundEffect.Play when FrameworkDispatcher.Update has not been called +### IServiceScopeFactory ObjectDisposedException +haffff/NordvikManager-Backend#32 Fixes: addon install/uninstall race, chat commands, dice plus sign, card refresh +NilsLattek/modulith-template#38 Add IScopedMediator for safe message handling in Blazor +Pial-Ahmed-Shosi/Mediguard#75 Create Payments Ledger Domain Model & EF Core Migration & Create Audit Logs Domain Model, Schema Migration & Action Filter +HarshaJayaweera21/Mehewara#14 Feature report intake +LLabmik/DotNetCloud#43 fix: series enrichment ObjectDisposedException - use IServiceScopeFactory for background enrichment +jessiicamaru/events-management#20 feat(sync): bi-directional Google Calendar, with outbox, webhook and live push +escalated-dev/escalated-dotnet#162 fix(webhooks): retry failed deliveries in a scope of their own +microting/eform-angular-timeplanning-plugin#1669 fix: own a DI scope per fire-and-forget handover push send +thomhurst/ModularPipelines#6555 fix(engine): reuse module context scopes and aggregate disposal failures +bestter/photosgallaery#439 🛡️ Sentinel: Fix User Enumeration vulnerability in CreateInvitation +ironkid90/lucky5-v8#81 fix(realtime): improve session cleanup and game state synchronization +daniel3303/Equibles#4132 fix(worker): swallow scope-creation failures in best-effort activity publish +CalebTek/ChatCore.NET#2 fix: inject IServiceScopeFactory in SignalRTransportDispatcher to prevent ObjectDisposedException +brenpike/Chatter#425 Let the hosted receiver own its DI scope (#297, #314) +Advance-Technologies-Foundation/clio#1426 Fix #1421: create-app-section reported work in progress that had already stopped +jasoneisen/crawldad#27 #26: drain SyncRunSupervisor tasks on host shutdown +Vardy-Party/Client#107 fix: play MP before FB and keep Windows HLS streams open +yllibed/repl#74 fix(di): open one DI scope per session so Scoped services match the documented lifetime +james-langridge/mars-vista-api#26 Fix unobserved ObjectDisposedException in usage tracking middleware +ASADRAJA/Vendorea.PartnerConnect#49 Fix FTP-ingestion disposed-scope crash + price-push UI polish +### ObjectDisposedException HttpContext background +Pial-Ahmed-Shosi/Mediguard#75 Create Payments Ledger Domain Model & EF Core Migration & Create Audit Logs Domain Model, Schema Migration & Action Filter +spelech/model-context-gateway#196 feat(routing): downstream MCP resilience, mock harness, and admin lifecycle fixes +Astrea-EIP/api-back#81 test: set up test project and cover current api architecture +achieveai/LmDotnetTools#413 Mirror S2S transcripts, externalise oversized tool results, and close the lifecycle tenant-refusal bypass (#253, #254, #402) +ravendb/ravendb#23103 RavenDB-26913 - Fix ObjectDisposedException in offline database migration audit logging +Lolle2000la/MangaIngestWithUpscaling#432 fix: resolve .NET ThreadPool starvation and DB connection pool contention +guilhermesuzuki/origami#50 Develop +smartsolutionslab/smart-sentinel-eye#2862 fix(2659): authorize MediaMTX's control API through the existing WHEP hook +FastEndpoints/FastEndpoints#1118 Fix ObjectDisposedException from ServiceResolver root-provider fallback during requests +VirtoCommerce/vc-module-x-api#84 Memoize the per-request user-state check +soliktomasz/Ledgerra#47 Add personal API token management in settings +intervalrain/OpenClaw.Net#31 fix: cron job executor and editor improvements +forge-trust/AppSurface#654 feat(web-push): add safe delivery rail +EvilBeaver/OneScript#1725 Функция ТекущийПоток(): данные и событие завершения потока исполнения +syedhhassan/url-shortener#10 fix: resolve critical bugs, add unit tests, and harden infrastructure +microsoft/durabletask-dotnet#758 Add large-payload blob auto-purge with a persistent orchestration +sillsdev/web-xforge#3785 SF-3773 Improve onboarding request save speed to fix timeouts +VirtoCommerce/vc-module-background-jobs#2 VCST-5245: Background Jobs +forge-trust/AppSurface#362 feat: add live docs harvest observatory +gankedtv/gankedtv#112 [server][infra] Redis: hot-feed/trending cache + cluster-wide rate limiting +### QueueBackgroundWorkItem ObjectDisposedException +ganjoor/GanjoorService#508 Fix public data import failing with ObjectDisposedException +### leak dispose exception rethrow client +OpenIdentityPlatform/OpenICF#168 [#166] Close the REST, CREST and SQL clients when the release closure throws +BartoszJarocki/jarocki.me#58 fix(skyline): release the scene when its mount fails +Wizard-Software/BareWire#73 fix(transport): release RabbitMQ consumer channels on setup failure and idle stop +tomwolfgang/piper#73 S9-2: Happy Eyeballs connects and TLS handshake timeouts +NethermindEth/nethermind#14790 perf(rpc): write eth_getLogs json straight from receipts +jake-dev-99/simple-query#64 [UNFY-300] Map every Android host error to SimpleQueryError +mysunyourmoon30-creator/repair-request-system#29 test(api): add bounded diagnostics for fixture drop error 3702 +OpenIdentityPlatform/OpenICF#155 [#154] Unregister the published customizer class on release() +assistant-ui/assistant-ui#9747 fix(react): dispose a frame host when its iframe is removed +zcsizmadia/SshSharp#145 Connections and forwarding: fixes from the pre-0.5.0 review +gonace/Cronitor#48 Make the shared TickerQ test host fire a cron ticker before the tests, and log what TickerQ did +thomhurst/ModularPipelines#6208 fix(ftp): preserve cancellation during socket setup +L-K-M/Hauntware#102 Run Poltergeist's Settings window on the shared link +FocusRGB/FocusRGB#24 Slice 10: minimal plugin runtime and fake output +thomhurst/TUnit#7047 feat(aspnetcore): add PerTestWebApplicationTest with per-test CreateFactoryAsync +modelingevolution/blazor-blaze#23 fix: stop canvas view init when disposed or canvas missing +squirix/squirix#698 fix(durability): let dispose fault acks whose fsync never returns +thomhurst/Respire#1039 fix: await lifecycle cleanup and enforce CA1849 +NethermindEth/dotnet-libp2p#266 Enable QUIC transport on Windows +MapColonies/GpkgMerger#255 perf(gpkg): connection reuse + prepared bulk-insert + keyset paging (MAPCO-11320) +### dispose on failure leak connect +benyblack/ntilde#531 test(platform): fix flaky port-forward Dispose tests +klitztuch/LanBoard#47 Stop live-update DB work from racing request scope disposal +eXsoria/XauXat#177 Recover stalled Tor control channels after iOS suspension +MIA-BU-Energy-Utility/FtpServer#12 fix: snapshot connection features before disposing them on stop +eclipse-emfcloud/hydranium#309 fix: release a connection a failed readiness check leaves behind +gordonmurray/flink-connector-iggy#6 Release Iggy connections and fail loudly on a dead connection +vercel/eve#4797 fix(eve): close MCP sessions per step and single-flight inbound SSE (#4379) +tomwolfgang/piper#73 S9-2: Happy Eyeballs connects and TLS handshake timeouts +honua-io/honua-server#6255 fix(gp): integrate scoped custom-code execution and durable artifact delivery +bitworks-io/amd-inference#5 Fix two intermittent runtime-test failures (PS7 API soak, PS5.1 stop file) +agentfront/frontmcp#869 fix(sdk): a server that fails to start releases the scopes it built +matthewjameswatkins1978-cyber/Agent-X#15 C3: independent worker runtime + version-tolerant Pi RPC compatibility boundary +idm23/workbench#194 Close every database the tests open, and fail on the next leak (#83) +OpenIdentityPlatform/OpenICF#168 [#166] Close the REST, CREST and SQL clients when the release closure throws +OpenIdentityPlatform/OpenICF#155 [#154] Unregister the published customizer class on release() +remote-oss/remote#192 lib-authority: the resolver host (#138 PR 5) +fitchmultz/pi-cursor-sdk#366 feat: make the pi tool bridge url host and port configurable +microsoft/vscode-languageserver-node#1863 Close pipe/socket transport server when the language server process fails to start +ob-f/OpenBot#551 Fixed the Android Robot video feed freezing issue in the Flutter Controller. +D-sorganization/UpstreamDrift#11225 fix(motion-matching): bind matcher process events and handle failed starts (#11148) diff --git a/docs/evidence/class-miner-phase0-2026-10/data/search2.out b/docs/evidence/class-miner-phase0-2026-10/data/search2.out new file mode 100644 index 00000000..25a0b6a0 --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/data/search2.out @@ -0,0 +1,78 @@ +### DisposeAsync leak failure catch IDisposable +IgniteUI/IgniteUI.Blazor.GridLite#63 fix: event listeners, handler faults, early calls and async disposal +ktsu-dev/Essentials#22 Make the encoding providers' stream paths genuinely async +elsa-workflows/elsa-studio#992 fix(workflows): stop instance designer refresh timers when the circuit disconnects +Chemsorly/coding-agent-automation#3330 feat: Add the Claude Code CLI as a third agent tool +dborgards/CanKit.Pro#269 feat(canopen): add DisposeAsync, and let a node be disposed from its own event handler +microsoft/vs-mef#781 Support asynchronous MEF part disposal +trackdubllc/Trackdub#419 feat: Windows ML 2.4 with GenAI on its runtime, MADLAD KV-cache decoding, streamed TTS prefetch +BrighterCommand/Brighter#4282 Spec 0036: scoped lifetime per pipeline +VectorNNTP/VectorNNTPD#12 build: relocate BackFiller, enforce x64, and publish Native AOT +UltraGameCoder/BlazText#9 Always release the DotNetObjectReference when the editor is disposed +NethermindEth/nethermind#13530 test(txpool): dispose the replaced pool when a test simulates a restart +AzureCosmosDB/CassandraMigrationTool#66 Share source session across migration workers +elsa-workflows/elsa-foundation#2169 Isolate drain heartbeats and preserve completed outbox ownership +fathomise/MailFathom#490 [#447] Open a write-capable IMAP session separate from every read path +Systemorph/MeshWeaver#2259 Arm the observer BEFORE the trigger — a hot emission missed has no second chance +Vortiago/TapScribe#431 refactor(tray-bridge): declare the capture seam's failure contract and put disposal on it (#419) +elsa-workflows/elsa-core#8492 fix(persistence): refuse cross-tenant SaveManyAsync bulk upserts +microsoft/agent-framework#8164 .NET: fix: do not forward headers on redirect +Chemsorly/coding-agent-automation#2927 fix: Hub wire format +ImmediatePlatform/Immediate.Jobs#150 Improve `SingleServerJobStorage` architecture +eichler-ai/connectors#45 Execution pipeline: return-value retention, using-Dispose gate bypass, OCE misclassification +thomhurst/Kevlar#467 fix(partitioned)!: dispose owned strategies +wieslawsoltes/DisposableGenerator#1 Implement DisposableGenerator with package integration +danielPoloWork/egl-util-csharp#115 fix(infra): dispose the EventBroker dispatch scope asynchronously (#60) +thomhurst/ModularPipelines#3354 Preserve module output during provider disposal +### leaked client when exception dispose csharp +rleeson24/life-insurance-crm-api#45 Bump the nuget-minor-patch group with 27 updates +ryanbliss/neo-compose-dotnet#273 P104: the User root (SDK 0.62.0) +tzdziech/killer-mud-client#42 Add equipment monitoring toggle +jthorare/agentic-workflow#158 feat: Evidence packet — ui-evidence in C# (R2) +nassarwafik/ExamBank791381#248 Phase 17F-C1 — Professional Syntax-Highlighted Code Editor +Altinn/altinn-auth#4344 chore(deps): update nuget non-major dependencies +ARKlab/Ark.Tools#1113 chore(deps): update all non-major dependencies +thiagoluga/NeoReports#340 chore(deps): Bump Aspire.Hosting.MongoDB from 13.5.2 to 13.6.0 +thiagoluga/NeoReports#339 chore(deps): Bump Aspire.Hosting.AppHost from 13.5.2 to 13.6.0 +Keboo/PointerStar#626 Bump the nuget group with 8 updates +open-astro/openastro-ara#1095 client: USB GPS dongle on the computer running the app (time + site to the rig) +bartul/agave#90 Bump Aspire.Azure.Data.Tables and 5 others +elsa-workflows/elsa-foundation#1403 Migrate Publishing APIs to Minimal APIs +MPCoreDeveloper/SharpCoreDB#450 deps: Bump the dotnet-microsoft group with 13 updates +swigerb/AzureAIDriveThru#140 S3: C# realtime middle tier (#13) +berkanserbes/urban-community-backend#6 chore: Bump the nuget-minor-and-patch group with 42 updates +Azure-Samples/Durable-Task-Scheduler#394 Bump the nuget-all group with 19 updates +vancodocton/MoneyGroup#476 Bump the aspire group with 1 update +daqifi/daqifi-core#504 fix(transport): a throwing StatusChanged subscriber no longer kills auto-reconnect or leaks the port handle +gkinsman/AlmostServiceBus#173 Update OrderFlowDemo sample dependencies +PlagueHO/libris-maleficarum#380 deps: Bump the aspire-packages group with 11 updates +litedb-org/LiteDB#3003 Shared mode: hardening, native fsync, faster writes and an experimental coordinator +alex289/CleanArchitecture#132 chore: Bump the dependencies group with 38 updates +Particular/ServiceControl#5994 Update Aspire to 13.6.1 +Particular/ServiceControl#5958 Update dependency Aspire.Hosting.SqlServer to 13.6.1 +### dispose on failure IDisposable +benyblack/ntilde#564 chore(settings): pages leave the session's events when the window closes +SharpMUSH/SharpMUSH#2048 Preserve wiki browsing journeys and page category members +sbihaiko/MesenAI#869 Release the tooltip's source subscription when the picture is replaced (#861) +reqnroll/Reqnroll.IdeSupport#1119 fix(#1034): dispose the brokered service proxy in RunTestOutcomeBridge failure paths +Cratis/Arc#3463 Authenticate the HTTP connection resolver with bearer tokens and Entra ID +honua-io/honua-server#6255 fix(gp): integrate scoped custom-code execution and durable artifact delivery +oluciano/NexJob#533 refactor(core): execution timeout and watchdog as one scope (#523, step 3) +VRising-Modders/Progenitor#71 Camera preview hold and renewable observation lease +GaTTGeng/ComposeSharp#52 test: always clean temp directories after loader tests +afonsoft/open-webui#267 test(api): fix shared-infra root causes of flaky NUnit failures +zcsizmadia/SshSharp#325 File adapters follow a reconnecting connection (session factory, ISshConnectionProvider.OpenSftpAsync) +modelingevolution/micro-plumberd#20 EventStoreServer: a failed start removes its container; labelled owner reaper; exact name lookup; CronTests IDisposable +csmashe/typewhisper-linux#127 Bound webhook delivery and sanitize its diagnostics +IvanJosipovic/SvcSystems.UI.Terminal#81 feat!: update XTerm.NET to v2 and target net10.0 only +skulmunkie/plainkit#1078 Blazor PkLifecycle and PageBase load/cancel/dispose hooks (#1022, step 2) +yoavarad/npoi#73 Task 39: Audit IDisposable/using coverage +migus88/unity-project-template#33 Core: forward unobserved UniTask and unhandled AppDomain exceptions to Log.Exception (game #741) +SolusQuest/agentic-pr-review#378 Retry transient DeepSeek failures within shared review limits +afonsoft/open-webui#250 feat(chat): plan/build agent modes (S5) +afonsoft/open-webui#256 feat(ide): @file mentions + one-click test runs (S7) +afonsoft/open-webui#258 feat(notifications): in-app notification feed with bell + unread badge (D3) +frankvdb7/Hagalaz#532 [Raido] Add focused OpenTelemetry metrics for inbound/outbound messages and stateful reconnect +SharpMUSH/SharpMUSH#2007 Add collection-scoped wiki browsing and researched PF2e organization plan +afonsoft/open-webui#98 feat: locales do upstream + manifesto dinâmico + error_code (slice i18n-locales) +afonsoft/open-webui#263 feat(preview): /preview/{port} loopback proxy + IDE Preview tab (D4) diff --git a/docs/evidence/class-miner-phase0-2026-10/scripts/extract.py b/docs/evidence/class-miner-phase0-2026-10/scripts/extract.py new file mode 100644 index 00000000..d1dab3dc --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/scripts/extract.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python3 +"""Filter the direction-research ledger to confirmed product-code fix records (Phase 0, section 1). + +Usage: python extract.py +The ledger is private research data (PhysShell/ownnet-direction-research, +evidence/ledger/records.jsonl); its filtered output is committed as data/eligible.tsv. +Confirmed = github_pr_fix, ground truth at least patch_supported, impact evidence of an +observable effect, product code. +""" + +from __future__ import annotations + +import collections +import json +import sys + +EFFECT = ("issue_report", "profiler_or_dump", "test", "maintainer_statement") +WEAK = ("candidate", "rejected", "unresolved") +COLUMNS = ( + "record_id", + "category", + "repository", + "source_url", + "ground_truth_level", + "impact_evidence", + "impact", + "root_cause", + "ownnet_result", +) + + +def main() -> int: + with open(sys.argv[1], encoding="utf-8") as f: + recs = [json.loads(line) for line in f if line.strip()] + fixes = [r for r in recs if r["source_type"] == "github_pr_fix"] + keep = [ + r + for r in fixes + if r["ground_truth_level"] not in WEAK + and r["impact_evidence"] in EFFECT + and r["product_code"] is True + ] + keep.sort(key=lambda r: (r["category"], r["record_id"])) + with open(sys.argv[2], "w", encoding="utf-8", newline="\n") as f: + f.write("\t".join(COLUMNS) + "\n") + for r in keep: + f.write("\t".join(str(r[c]).replace("\t", " ") for c in COLUMNS) + "\n") + owners = {r["repository"].split("/")[0] for r in keep} + print(f"fix records {len(fixes)}, eligible {len(keep)}, owners {len(owners)}") + print(collections.Counter(r["category"] for r in keep).most_common(12)) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/docs/evidence/class-miner-phase0-2026-10/scripts/search.sh b/docs/evidence/class-miner-phase0-2026-10/scripts/search.sh new file mode 100644 index 00000000..730a48da --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/scripts/search.sh @@ -0,0 +1,9 @@ +#!/usr/bin/env bash +# Deep-check searches (gh search prs, words passed unquoted so gh does not phrase-quote them). Output: data/search.out +q() { echo "### $*"; gh search prs $@ --merged --limit 20 --json repository,number,title --jq '.[] | "\(.repository.nameWithOwner)#\(.number)\t\(.title)"'; sleep 7; } +q fire-and-forget ObjectDisposedException +q IServiceScopeFactory ObjectDisposedException +q ObjectDisposedException HttpContext background +q QueueBackgroundWorkItem ObjectDisposedException +q leak dispose exception rethrow client +q dispose on failure leak connect diff --git a/docs/evidence/class-miner-phase0-2026-10/scripts/search2.sh b/docs/evidence/class-miner-phase0-2026-10/scripts/search2.sh new file mode 100644 index 00000000..07324ec2 --- /dev/null +++ b/docs/evidence/class-miner-phase0-2026-10/scripts/search2.sh @@ -0,0 +1,6 @@ +#!/usr/bin/env bash +# Extra C03/N1 searches. Output: data/search2.out +q() { echo "### $*"; gh search prs $@ --merged --limit 25 --json repository,number,title --jq '.[] | "\(.repository.nameWithOwner)#\(.number)\t\(.title)"'; sleep 7; } +q DisposeAsync leak failure catch IDisposable +q leaked client when exception dispose csharp +q "dispose on failure" IDisposable