csharp-sdk

Summary Fixes #1806 by keeping OAuth metadata discovery from being cancelled by the five-second probe timeout in slow in-memory CI environments. When the protected MCP endpoint returns , metadata discovery runs under the same probe cancellation token. A slow TLS/duplex-pipe handshake can therefore cancel before it finishes, producing a misleading metadata-discovery assertion failure. Changes Add a test-only helper that uses the shared 60-second test budget for . Route the ASP.NET Core OAuth tests through that helper. Apply the same probe budget to the standalone conformance client used by OAuth scenarios. Production client defaults and OAuth behavior are unchanged. Verification — 3 passed\n- — 98 passed\n- — passed\n\nThe net8.0/net9.0 variants were not runnable on this workstation because those runtimes are not installed; they remain covered by the repository CI matrix.

Describe the bug Several OAuth tests occasionally fail on the legs of Build and Test. If that occurs, the method gets a during a slow TLS handshake using the in-memory duplex pipe, wraps that into the "Failed to find .well-known/..." message, and assertion expectations about that message fail on the injected text – that is, the error manifests itself as a confusing assertion failure instead of a timeout. It appears to be similar to #1701 from the OAuth side of things. #1702 increased the probe timeout in the in-memory tests, but the OAuth metadata path has a similar timeout which was not added and is still failing after that merge. Tests affected so far: To Reproduce Intermittent, not deterministic reproduction possible. It is reproduced by running Build and Tests of leg multiple times. The following two incidents are on August 9, right after merging PR #1702, for two consecutive commits of the same branch which are identical but different in comments and tests: 1. - windows-latest, Debug - job - 2. - windows-latest, Release - [job](https:// Expected behavior Tests need to be deterministic. In case the timeout happens during fetching of the metadata, the issue should be thrown as a timeout and not as an assertion failure on an error message that’s not related to it at all. Logs From the Release run

Summary Background Tasks runners used cancellation sources independent of the owning server and discarded their Task handles. As a result, server disposal could finish before a runner was cancelled, including when the runner registered during disposal. Changes Add a general server-lifetime cancellation and registration seam for extension infrastructure, with an unregistration handle so completed work is not retained. Cancel the lifetime at the start of stateful server disposal, close registration after request handlers drain, and await the remaining runners. Let each Tasks runner state own cancellation and completion awaiting, while long-lived MRTR handlers remain linked to the server lifetime and completed registrations are removed. Keep stateless HTTP request servers non-owning so Tasks can continue across independent requests. Add deterministic coverage for cancellation, awaiting, late registration, and the stateless ownership boundary. The change does not alter protocol messages, task-store contracts, polling, or explicit tasks/cancel behavior. Verification The current lifetime-registration focus passed on net10.0, net9.0, and net8.0 (5 tests on each framework). The merged net10.0 lifecycle and Tasks execution-mode focus passed 61 tests. The full Core suite passed with 2328 passed and 5 skipped; the analyzer suite passed with 57 passed. The Release solution build completed with 0 warnings and 0 errors, package validation produced all packages, and DocFX completed with 0 warnings and 0 errors. Closes #1707