docs(evidence): N1 competitor gate pre-registration and reproductions

Four confirmed N1 fixes (whizbang#1204, rockbot#638, NexusKit#34,
BareWire#73) as buggy/fixed reproductions with stubbed third-party
types; CA2000 (default, AllPaths, ownership-transfer variants,
AllPathsOnlyNotDisposed), IDisposableAnalyzers 4.0.8 and Sonar
10.35 with every rule on. GO-CANDIDATE only if >=2 pairs are missed
by every configuration; harness control must pass first.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TFkNAFFQz9KoTzpPws8vYG

Author: PhysShell

docs/evidence/n1-competitor-gate-2026-10/00-preregistration.md

@@ -0,0 +1,102 @@
+# N1 competitor gate — pre-registration
+
+Written 2026-10-20, 21:11 +05. The four fix diffs have been read in order to build the reproductions. No analyzer
+has been run on any reproduction.
+
+Authority: owner decision `GO-N1-COMPETITOR-GATE`, given after `KILL-N3-PILOT` was accepted. This gate is not a GO
+on an N1 PoC.
+
+- **Budget.** 0.25 agent-day.
+- **Rules of the work.** No third-party project is built and no package is downloaded. The analyzers come from the
+  .NET SDK and from the local NuGet cache, the same versions as direction-research Phase 5.
+
+## Question
+
+N1: a disposable is acquired, a step that can throw runs before ownership is handed over (return, field or
+collection store, wrapping), and no dispose runs on the throw path.
+
+Do existing analyzers miss the four confirmed N1 defects of Phase 0 once they are configured to look? The question
+matters most for CA2000 with exception paths on (`dispose_analysis_kind = AllPaths`), because that is the
+documented setting for exactly this case.
+
+## Why the earlier "not detected" does not answer it
+
+Phase 5 ran the analyzers over loose source trees. Those runs had about 35,000 compile errors (whizbang: 34,859 on
+base), so the disposable types were mostly unresolved, and CA2000 ran with its default kind. Those misses therefore
+say little about what CA2000 can do.
+
+## Pairs (fixed now)
+
+| Id | Fix | Buggy method | Leaked resource and acquisition | Throwing step before hand-over | Hand-over on success |
+|---|---|---|---|---|---|
+| W | whizbang-lib/whizbang#1204 | `AzureServiceBusConnectionRetry.CreateClientWithRetryAsync` | `new ServiceBusClient(cs)` (`IAsyncDisposable`), inside a retry loop's `try` | `await VerifyNamespaceReachableAsync(…)` | `return client;` |
+| R | MarimerLLC/rockbot#638 (record 638-2) | `McpBridgeService.ConnectServerAsync` | `await McpClient.CreateAsync(transport, …)`, an async factory (`IAsyncDisposable`) | `await newClient.ListToolsAsync(…)`, prompt listing | `_clients[name] = newClient;` (dictionary field) |
+| X | NexusFFXIV/NexusKit#34 (record 34-2) | `PluginHostBuilder.BuildAsync` | `services.BuildServiceProvider(validateScopes: false)`, a factory (`ServiceProvider`, `IDisposable` + `IAsyncDisposable`) | `await DbInitializer.InitializeAsync(…)`, service resolution | `return new PluginHost(provider);` (wrapping) |
+| B | Wizard-Software/BareWire#73 | `RabbitMqTransportAdapter.ConsumeAsync` (an `async` iterator) | `await _connection.CreateChannelAsync(…)`, an async factory (`IChannel`, `IAsyncDisposable` + `IDisposable`) | `await consumerChannel.BasicQosAsync(…)` | `_activeConsumerChannels[id] = consumerChannel;` (dictionary field) |
+
+The four fixes are by different owners.
+
+## Reproductions
+
+For each pair: one file `repro/<Id>.cs` with two self-contained classes, `<Id>Buggy` and `<Id>Fixed`. The
+acquisition line carries the marker comment `// ACQ:<Id>`.
+
+- **Kept from the real code.**
+  - the acquisition expression form: `new`, factory call, or awaited async factory;
+  - the throwing step, as an awaited call that can throw;
+  - the success hand-over (return, wrap, or dictionary store);
+  - the enclosing control flow: the retry loop with `try`/`catch` in W, the `try` around the attempt in R, and the
+    `async` iterator in B;
+  - each fix's exact cleanup shape: W `try`/`catch` + `DisposeAsync` + rethrow, with acquisition through a
+    `Func<…>` seam; R a nullable local, a `published` flag and cleanup on the failure path; X `try`/`catch` + wrap +
+    `DisposeAsync` + rethrow; B early registration into the dictionary, then `try`/`catch` + release.
+- **Third-party types are stubs** with the real disposable interfaces and the members used: `ServiceBusClient`,
+  `McpClient`, `IChannel`/`IConnection`. `ServiceCollection`/`ServiceProvider` are the real types from the local
+  ASP.NET Core reference pack.
+- **Lines not on the resource's path are dropped**: logging, metrics, unrelated locals.
+- The reproductions must compile with **0 errors**. An analyzer that sees a compile error proves nothing.
+
+## Analyzers and configurations
+
+One SDK-style project, `net10.0`, with no `PackageReference`. Analyzers are referenced by path:
+
+- the .NET SDK `Microsoft.CodeAnalysis.NetAnalyzers` (CA2000);
+- `IDisposableAnalyzers` 4.0.8 (IDISP001–IDISP026);
+- `SonarAnalyzer.CSharp` 10.35.0.4138 (S2930 and others).
+
+Every rule of every analyzer is set to warning (`dotnet_analyzer_diagnostic.severity = warning`). Configurations:
+
+| K | `dispose_analysis_kind` | ownership transfer at constructor | ownership transfer at method call |
+|---|---|---|---|
+| K1 | default (`NonExceptionPaths`) | default (false) | default (false) |
+| K2 | `AllPaths` | false | false |
+| K3 | `AllPaths` | **true** | false |
+| K4 | `AllPaths` | false | **true** |
+| K5 | `AllPathsOnlyNotDisposed` | false | false |
+
+**Harness control.** A two-method file, `Control.cs`:
+
+- `new StreamReader(path)`, then a call that can throw, then `Dispose()`. CA2000 must report it under K2 and must
+  not report it under K1.
+- the same with `using`: silent in every configuration.
+
+If this control fails, the harness is invalid and the gate stops as `INVALID`, not as KILL.
+
+## Scoring (fixed now)
+
+- **Relevant diagnostic.** A diagnostic whose message is about disposal or ownership, located on the leaked
+  resource's acquisition statement or its declared variable, in the buggy method.
+- **Pair verdict.**
+  - **`CAUGHT`:** at least one configuration gives a relevant diagnostic on the buggy reproduction. This holds even
+    when the fixed reproduction also gets one: a flag on the buggy site counts against N1's novelty. Whether the
+    flag also distinguishes the fix is recorded separately.
+  - **`MISSED`:** no relevant diagnostic on the buggy reproduction in any of K1–K5, from any of the three analyzers.
+
+**Decision.**
+- **`GO-CANDIDATE-N1`** (for an owner decision, not a PoC GO) if at least **2** pairs are `MISSED`.
+- **`KILL-N1`** otherwise.
+
+Fidelity risk: a stub or a dropped line can change an analyzer's result. Every `MISSED` is therefore re-checked by
+listing the analyzer's documented limits for that shape: a factory, an `async` iterator or a dictionary store. A
+`MISSED` that is explained only by a reproduction deviation from the real code becomes `UNRESOLVED` and does not
+count toward GO.

docs/evidence/n1-competitor-gate-2026-10/repro/B.cs

@@ -0,0 +1,83 @@
+// B: Wizard-Software/BareWire#73, RabbitMqTransportAdapter.ConsumeAsync (an async iterator).
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using Stubs;
+
+namespace Repro;
+
+public sealed class BBuggy
+{
+    private IConnection? _connection;
+    private readonly ConcurrentDictionary<string, IChannel> _activeConsumerChannels = new();
+
+    public async IAsyncEnumerable<string> ConsumeAsync(string endpointName, ushort prefetch,
+        [EnumeratorCancellation] CancellationToken cancellationToken = default)
+    {
+        IChannel consumerChannel = await _connection!.CreateChannelAsync(cancellationToken).ConfigureAwait(false); // ACQ:B
+
+        await consumerChannel.BasicQosAsync(prefetchSize: 0, prefetchCount: prefetch, global: false,
+            cancellationToken: cancellationToken).ConfigureAwait(false);
+
+        string consumerChannelId = Guid.NewGuid().ToString("N");
+        _activeConsumerChannels[consumerChannelId] = consumerChannel;
+
+        string assignedTag;
+        try
+        {
+            assignedTag = await consumerChannel.BasicConsumeAsync(endpointName, autoAck: false, cancellationToken)
+                .ConfigureAwait(false);
+        }
+        catch
+        {
+            _activeConsumerChannels.TryRemove(consumerChannelId, out _);
+            throw;
+        }
+
+        yield return assignedTag;
+    }
+}
+
+public sealed class BFixed
+{
+    private IConnection? _connection;
+    private readonly ConcurrentDictionary<string, IChannel> _activeConsumerChannels = new();
+
+    public async IAsyncEnumerable<string> ConsumeAsync(string endpointName, ushort prefetch,
+        [EnumeratorCancellation] CancellationToken cancellationToken = default)
+    {
+        IChannel consumerChannel = await _connection!.CreateChannelAsync(cancellationToken).ConfigureAwait(false); // ACQ:B
+
+        string consumerChannelId = Guid.NewGuid().ToString("N");
+        _activeConsumerChannels[consumerChannelId] = consumerChannel;
+
+        string assignedTag;
+        try
+        {
+            await consumerChannel.BasicQosAsync(prefetchSize: 0, prefetchCount: prefetch, global: false,
+                cancellationToken: cancellationToken).ConfigureAwait(false);
+
+            assignedTag = await consumerChannel.BasicConsumeAsync(endpointName, autoAck: false, cancellationToken)
+                .ConfigureAwait(false);
+        }
+        catch
+        {
+            await ReleaseConsumerChannelSafeAsync(consumerChannelId).ConfigureAwait(false);
+            throw;
+        }
+
+        yield return assignedTag;
+    }
+
+    private async Task ReleaseConsumerChannelSafeAsync(string channelId)
+    {
+        if (_activeConsumerChannels.TryRemove(channelId, out IChannel? channel))
+        {
+            try { await channel.CloseAsync().ConfigureAwait(false); } catch { }
+            await channel.DisposeAsync().ConfigureAwait(false);
+        }
+    }
+}

docs/evidence/n1-competitor-gate-2026-10/repro/Control.cs

@@ -0,0 +1,24 @@
+// Harness control (00-preregistration.md): CA2000 must report ControlLeakOnThrow under AllPaths (K2)
+// and not under the default kind (K1); ControlUsing must stay silent everywhere.
+using System.IO;
+
+namespace Repro;
+
+public static class Control
+{
+    public static string ControlLeakOnThrow(string path)
+    {
+        var reader = new StreamReader(path); // ACQ:control
+        var text = MayThrow(reader.ReadLine());
+        reader.Dispose();
+        return text;
+    }
+
+    public static string ControlUsing(string path)
+    {
+        using var reader = new StreamReader(path); // ACQ:control-using
+        return MayThrow(reader.ReadLine());
+    }
+
+    private static string MayThrow(string? s) => s ?? throw new InvalidDataException();
+}

docs/evidence/n1-competitor-gate-2026-10/repro/N1Repro.csproj

@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <!-- N1 competitor gate reproductions. No PackageReference: analyzers are referenced by path
+       (pass -p:NuGetRoot=<global packages folder>). Built from a copy outside any tree with
+       corporate MSBuild settings. -->
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <OutputType>Library</OutputType>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <EnableNETAnalyzers>true</EnableNETAnalyzers>
+    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <NoWarn>$(NoWarn);CS1591</NoWarn>
+  </PropertyGroup>
+  <ItemGroup>
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+    <Analyzer Include="$(NuGetRoot)/idisposableanalyzers/4.0.8/analyzers/dotnet/cs/IDisposableAnalyzers.dll" />
+    <Analyzer Include="$(NuGetRoot)/sonaranalyzer.csharp/10.35.0.4138/analyzers/SonarAnalyzer.CSharp.dll" />
+  </ItemGroup>
+</Project>

docs/evidence/n1-competitor-gate-2026-10/repro/R.cs

@@ -0,0 +1,104 @@
+// R: MarimerLLC/rockbot#638, McpBridgeService.ConnectServerAsync.
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Stubs;
+
+namespace Repro;
+
+public sealed class RBuggy
+{
+    private readonly ConcurrentDictionary<string, McpClient> _clients = new();
+    private readonly ConcurrentDictionary<string, IList<string>> _serverTools = new();
+
+    public async Task ConnectServerAsync(string name, Uri url, int maxAttempts, CancellationToken ct)
+    {
+        for (var attempt = 1; attempt <= maxAttempts; attempt++)
+        {
+            try
+            {
+                var transport = new HttpClientTransport(url);
+                var newClient = await McpClient.CreateAsync(transport, null, cancellationToken: ct); // ACQ:R
+
+                var tools = await newClient.ListToolsAsync(cancellationToken: ct);
+                var prompts = await newClient.ListPromptsAsync(ct);
+
+                if (_clients.TryRemove(name, out var oldClient))
+                {
+                    try { await oldClient.DisposeAsync(); }
+                    catch { /* Best-effort cleanup */ }
+                }
+
+                _clients[name] = newClient;
+                _serverTools[name] = tools;
+                return;
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested)
+            {
+                throw;
+            }
+            catch (Exception)
+            {
+                if (attempt == maxAttempts) return;
+                await Task.Delay(100 * attempt, ct);
+            }
+        }
+    }
+}
+
+public sealed class RFixed
+{
+    private readonly ConcurrentDictionary<string, McpClient> _clients = new();
+    private readonly ConcurrentDictionary<string, IList<string>> _serverTools = new();
+
+    public async Task ConnectServerAsync(string name, Uri url, int maxAttempts, CancellationToken ct)
+    {
+        for (var attempt = 1; attempt <= maxAttempts; attempt++)
+        {
+            McpClient? newClient = null;
+            var published = false;
+            try
+            {
+                var transport = new HttpClientTransport(url);
+                newClient = await McpClient.CreateAsync(transport, null, cancellationToken: ct); // ACQ:R
+
+                var tools = await newClient.ListToolsAsync(cancellationToken: ct);
+                var prompts = await newClient.ListPromptsAsync(ct);
+
+                if (_clients.TryRemove(name, out var oldClient))
+                {
+                    await DisposeQuietlyAsync(oldClient);
+                }
+
+                _clients[name] = newClient;
+                published = true;
+                _serverTools[name] = tools;
+                return;
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested)
+            {
+                throw;
+            }
+            catch (Exception)
+            {
+                if (attempt == maxAttempts) return;
+                await Task.Delay(100 * attempt, ct);
+            }
+            finally
+            {
+                if (!published && newClient is not null)
+                {
+                    await DisposeQuietlyAsync(newClient);
+                }
+            }
+        }
+    }
+
+    private static async Task DisposeQuietlyAsync(IAsyncDisposable disposable)
+    {
+        try { await disposable.DisposeAsync(); }
+        catch { /* Best-effort cleanup */ }
+    }
+}

docs/evidence/n1-competitor-gate-2026-10/repro/Stubs.cs

@@ -0,0 +1,47 @@
+// Stubs for third-party types used by the N1 reproductions. Each keeps the real type's disposable
+// interfaces and the members the reproduced method calls; bodies are irrelevant to the analyzers.
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Stubs;
+
+// Azure.Messaging.ServiceBus.ServiceBusClient : IAsyncDisposable
+public class ServiceBusClient : IAsyncDisposable
+{
+    public ServiceBusClient(string connectionString) { }
+    public ValueTask DisposeAsync() => default;
+}
+
+public class ServiceBusException : Exception { }
+
+// ModelContextProtocol.Client.McpClient : IAsyncDisposable, created by an async factory
+public abstract class McpClient : IAsyncDisposable
+{
+    public static Task<McpClient> CreateAsync(IClientTransport transport, object? options = null,
+        CancellationToken cancellationToken = default) => throw new NotImplementedException();
+    public abstract Task<IList<string>> ListToolsAsync(CancellationToken cancellationToken = default);
+    public abstract Task<IList<string>> ListPromptsAsync(CancellationToken cancellationToken = default);
+    public abstract ValueTask DisposeAsync();
+}
+
+public interface IClientTransport { }
+
+public sealed class HttpClientTransport : IClientTransport
+{
+    public HttpClientTransport(Uri endpoint) { }
+}
+
+// RabbitMQ.Client 7: IChannel : IAsyncDisposable, IDisposable; created by IConnection.CreateChannelAsync
+public interface IChannel : IAsyncDisposable, IDisposable
+{
+    Task BasicQosAsync(uint prefetchSize, ushort prefetchCount, bool global, CancellationToken cancellationToken = default);
+    Task<string> BasicConsumeAsync(string queue, bool autoAck, CancellationToken cancellationToken = default);
+    Task CloseAsync(CancellationToken cancellationToken = default);
+}
+
+public interface IConnection : IAsyncDisposable, IDisposable
+{
+    Task<IChannel> CreateChannelAsync(CancellationToken cancellationToken = default);
+}