[KSemenenko]

Disposing an internal membership, manifest or directory update feed creates a faulted terminal task that no reader can reach. Shutdown itself succeeds, but later GC raises an unobserved ObjectDisposedException, even when the feed has never been enumerated.

Cause and resource impact

Readers reach the disposed element through the previous element's successfully completed next-link task. MoveNextAsync then sees the disposed sentinel and returns false, so the terminal element's own faulted _next task is never awaited.

That path allocates an exception and fault-handling state and later performs unobserved-fault reporting/finalization work for a failure which is not part of the reader contract. The terminal element, completion source and task remain part of the representation after this change; exact allocated bytes, CPU savings and throughput gains have not been measured. The demonstrated cost is per helper disposal, rather than per successful request or enumeration step.

Correction and preserved behavior

Complete the terminal element's next link successfully with the terminal element itself. The disposed sentinel still ends enumeration, and the existing guards keep readers from following that link. The collectible self-reference does not keep the source alive.

The focused tests preserve pending and future reader completion, buffered values for slow readers, idempotent disposal, Current throwing after disposal, post-disposal publication refusal for both direct and functional updates, and independent reader cancellation. Disposed functional updates do not execute user callbacks. The collectible self-reference does not keep the source alive.

Evidence

The new resource regression fails before this change on both net8.0 and net10.0; the reader-completion and cancellation controls already pass before the change. Separate native checks using the released 10.4.2 package and original main DLL produce 100 unobserved notifications for 100 disposals. The corrected DLL produces zero with the same operation and GC sequence.

Afterward, all 143 focused membership, manifest and update-feed cases pass on each target, net8.0 and net10.0. The branch includes current main 625b2baf761fa3cbfc35d1125c6b0d3244fdd847. The canonical full-solution build passes with warnings treated as errors: zero warnings and zero errors. Whitespace verification also passes.

Build validation also marks the message-only benchmark protobuf input with GrpcServices="None", matching the serialization test project. Protobuf C# model generation still runs; the benchmark no longer invokes a gRPC service plugin for an input without services. The native ARM64 validation uses official protoc 33.5 through the supported PROTOBUF_PROTOC setting.

Closes #11660

Microsoft Reviewers: Open in CodeFlow

[github-actions]

Code coverage

Metric	Pull request
Lines	84.14% (121,361 / 144,231)
Branches	74.51% (36,812 / 49,405)

Report-only conclusion: current-main baseline stale.

The newest successful coverage run tested 9a0c764, not current main 625b2ba.

Coverage combines every CI test matrix job, including providers, CodeGen, .NET 8/10, Linux, Windows, and macOS, using canonical physical source and branch identities.

The comparison remains report-only while normal line and branch variance is calibrated.

Coverage details

• Pull request commit: b8af70d898
• View the pull request test run and coverage artifacts
• View the trusted coverage reporting run