fix(serialization): enforce Arc buffer bounds and lifetimes

[ReubenBond]

Arc buffers need consistent bounds, page ownership, and borrowed-reader behavior across empty values, slicing, disposal, and reader forks. This extracts the buffer and reader correctness prerequisite from #11463, using source 9dd1a83414593ebea731a9abbb2fe44c6851c1d6 on main pin b3b76e2ab207f00e664e0167cd733800cd60379d.

The public ArcBuffer constructor validates page tokens, offsets, lengths, and linked-page coverage before creating a borrowed view. Writer and slice operations use their established bounds for internal construction. Default and Empty buffers are valid owner-free values, with explicitly nullable first-page metadata. Page-backed empty slices acquire independent pins, slices keep offsets within their referenced page, and disposed buffers are checked at reader and enumeration boundaries. Disposed writers reject mutation and can be reset.

Arc reader input skips consecutive empty pages, supports owner-free empty input, and keeps nested forks aligned with global stream offsets. XML documentation states the borrowed input lifetime. Independent lifetime tests cover constructor bounds and pin counts, nullable API metadata, final page release, retained bytes, disposal, consecutive empty pages, and raw-byte nested forks. The generated Serialization API surface accompanies the implementation.

The codec/copier and owned reader API remain in #11463, which will build on this prerequisite. Existing page-pool behavior is preserved.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

🟡 Changes recommended

Read-cursor mutations can still throw NullReferenceException after writer disposal instead of consistently rejecting the operation.

1 open finding

• Guard read-cursor mutations after disposal · New

What changed in this PR

Hardens Arc buffer bounds, ownership, disposal behavior, and reader offsets.

Changes:

• Validates buffer construction, slicing, and page lifetimes.
• Corrects empty-page reading and nested reader forks.
• Adds comprehensive lifetime tests and updates the generated API surface.

File	Description
test/​Orleans.Serialization.UnitTests/​ArcBufferLifetimeTests.cs	Tests bounds, pins, disposal, empty pages, and forks.
src/​Orleans.Serialization/​Buffers/​Reader.cs	Documents borrowing and fixes fork offsets.
src/​Orleans.Serialization/​Buffers/​ArcBufferWriter.cs	Hardens buffer ownership, slicing, and disposal.
src/​Orleans.Serialization/​Buffers/​Adaptors/​BufferSliceReaderInput.cs	Handles empty pages and validates input lifetime.
src/​api/​Orleans.Serialization/​Orleans.Serialization.cs	Updates the generated public API surface.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Code coverage

Metric	Pull request
Lines	83.40% (118,467 / 142,050)
Branches	72.97% (35,229 / 48,282)

Report-only conclusion: current-main baseline stale.

The newest successful coverage run tested d558f4c, not current main 4268237.

Coverage combines every CI test matrix job, including providers, CodeGen, .NET 8/10, Linux, Windows, and macOS, using canonical physical source and branch identities.

The comparison remains report-only while normal line and branch variance is calibrated.

Coverage details

• Pull request commit: 37bbb3a67e
• View the pull request test run and coverage artifacts
• View the trusted coverage reporting run

[Copilot]

🔵 Needs a closer look

AppendPinned still accepts empty input after the writer has been disposed.

0 open findings

1 resolved since last review

• Guard read-cursor mutations after disposal

Previously missed (1)

In code that hasn't changed since last review

AppendPinned bypasses disposal guard for empty input

src/​Orleans.Serialization/​Buffers/​ArcBufferWriter.cs:383

AppendPinned still bypasses the new disposal guard for empty input because it returns before calling ThrowIfPinnedPages. As a result, writer.Dispose(); writer.AppendPinned(ArcBuffer.Empty) succeeds even though the other zero-length mutation paths now consistently throw. Check disposal before the empty-input early return.

🧠 Review effort: Balanced

[ReubenBond]

Addressed the review-summary feedback "AppendPinned bypasses disposal guard for empty input" in 37bbb3a. The empty-input path now calls the disposal-only guard before returning, so disposed writers throw ObjectDisposedException for both owner-free and page-backed empty input. Live empty appends remain a no-op, including writers containing pinned pages, with unchanged reference counts. Regression tests also verify retained bytes and reuse after Reset. All 123 selected Arc buffer/lifetime/reader tests pass on both .NET 8 and .NET 10; normal Release Serialization package validation passes.

[Copilot]

🟢 Approval recommended

The ownership changes are consistently implemented, comprehensively tested, and show improved automated coverage.

0 open findings

🧠 Review effort: Balanced