[SunSi12138]

Problem

A generated server stream can call IRpcSizedCodec.ReleaseSnapshot twice when the first release throws. The same cleanup failure can skip returning an unpublished writer. If serialization already failed, snapshot cleanup can replace the original exception.

Change

Transfer snapshot ownership before calling the codec's release callback. During exception cleanup, retain the operation's original exception if snapshot release also fails, and always attempt writer return in a nested finally. Flow windows, SendPump, public APIs and the wire protocol are unchanged.

Evidence and current status

• Fixed baseline: f8ba89121c87a6410a0139c44d7db30eab877f41, including fix(runtime): conserve connection credit on excess WindowUpdate #840 and perf(runtime): lazily allocate named stream routes for default-only requests #841.
• The same two permanent tests reproduce both exact old failures. The regression runner copies only the fixture; it cannot patch production code.
• First run: old 2/2 expected red; first correction failed compilation because the local error-tracking declaration was placed in the wrong method. That failed commit and artifact remain intact.
• Corrected run: old 2/2 expected red; current build passed, four focused 2/2 runs passed, and two full 2,084/2,084 runs passed. The third full run failed the existing ReadOwnershipPipeReaderLifetimeTests.SuccessfulSuspensionsShouldNotAllocateAfterWarmup check (24,624 B instead of 0). The fourth full run was not run. This is not recorded as full-suite acceptance.
• The new fixed old/current control workflow predeclares eight full-suite processes in AB/BA order and sixteen allocation-test A/B pairs. No test, warmup, timeout or allocation threshold is relaxed. All planned samples and failures remain evidence; any failed sample leaves the workflow red.

Latest fixed controls and original CI

The latest head 15c9f30d44142995e957fd0cbb9f7a9eddc92782 adds only the predeclared control collector; production code is byte-identical to 9b6951536d6d1451c694fcf49a1fc73b4994d9d8.

• Fixed control matrix 38170670903: all 40 predeclared processes executed, with no retries: four old/full 2,082-case and four current/full 2,084-case runs, plus 16 old/current allocation-test pairs. All passed. Original HTML embedded test data, JSON cases, unique report generations and source/binary inventories were independently checked.
• Latest push regression and PR regression: each retains the same two required old failures, then four focused and four full 2,084-case current passes.
• Original PR Fast, Package Smoke and CodeQL all passed.

These subsequent results do not explain or erase the earlier 24,624 B failure. Its root cause remains unassigned: no allocation stack was obtained, and the fixed control did not reproduce it. No assertion, warmup, timeout, concurrency or allocation threshold was relaxed.

Raw artifacts: 11713043932, 11713477637, 11713659187. All ZIP digests and internal manifests were independently verified.

This independent correctness PR remains Draft for review; the prior full-suite failure remains visible. It is not B2/B3 performance evidence. #742, #800 and #803 are untouched. No automatic merge is requested.