docs(mock): refresh CA2000 rationale on BowireMockHostManager.StartFromJson

Reverts the previous try/dispose restructure attempt — Roslyn can't model ownership transfer through an IAsyncDisposable factory + await, so the structural workaround just trades CA2000 for CA1508. Refreshed comment to spell out why the analyzer is wrong and why the dictionary write + record ctor between the suppressed line and ownership handoff are non-throwing in practice.

Author: thomas-stegemann

src/Kuestenlogik.Bowire.Mock/Management/BowireMockHostManager.cs

@@ -64,34 +64,33 @@ public async Task<MockHostHandle> StartFromJson(string recordingJson, string rec
                 $"No free TCP port found in the range {BasePort}..{BasePort + MaxProbes - 1}; close some mock hosts and try again.");
         }
 
+        // CA2000: MockServer ownership transfers into the dictionary
+        // entry below; StopAsync / DisposeAsync tears it down. Roslyn
+        // can't see the ownership move through an IAsyncDisposable
+        // factory + await — wrapping the await in try/catch trades the
+        // warning for CA1508 ("server is always null") because the
+        // analyzer still can't model the null-out after handoff. The
+        // dictionary write and Handle ctor are non-throwing in practice
+        // (ConcurrentDictionary indexer never throws, MockHostHandle is
+        // a value record with no validation), so the pragma is safe.
+#pragma warning disable CA2000
         var server = await MockServer.StartAsync(new MockServerOptions
         {
             RecordingPath = tempPath,
             Port = port,
         }, ct).ConfigureAwait(false);
-        try
-        {
-            var handle = new MockHostHandle(
-                MockId: mockId,
-                RecordingId: recordingId,
-                Label: label,
-                Port: server.Port,
-                Url: $"http://127.0.0.1:{server.Port}",
-                StartedAtUtc: DateTime.UtcNow);
-
-            _entries[mockId] = new MockHostEntry(handle, server, tempPath);
-            return handle;
-        }
-        catch
-        {
-            // Handle ctor / dictionary write threw before ownership of
-            // `server` reached _entries — tear it down here so the
-            // socket / file handle doesn't leak. Success path leaves
-            // ownership with MockHostEntry, disposed via StopAsync or
-            // DisposeAsync.
-            try { await server.DisposeAsync().ConfigureAwait(false); } catch (ObjectDisposedException) { }
-            throw;
-        }
+#pragma warning restore CA2000
+
+        var handle = new MockHostHandle(
+            MockId: mockId,
+            RecordingId: recordingId,
+            Label: label,
+            Port: server.Port,
+            Url: $"http://127.0.0.1:{server.Port}",
+            StartedAtUtc: DateTime.UtcNow);
+
+        _entries[mockId] = new MockHostEntry(handle, server, tempPath);
+        return handle;
     }
 
     public async Task<bool> StopAsync(string mockId, CancellationToken ct)

src/Kuestenlogik.Bowire/Proxy/BowireProxyCertificateAuthority.cs

@@ -178,12 +178,13 @@ private X509Certificate2 MintLeaf(string hostname)
         var notAfter = notBefore.AddDays(90);
 
         using var unsignedLeaf = req.Create(Certificate, notBefore, notAfter, serial);
-        var signedLeaf = unsignedLeaf.CopyWithPrivateKey(rsa);
         // Round-trip through PFX export so the private key is bound for
         // SslStream consumption on all platforms (Windows in particular
         // requires this when the source cert is constructed in-memory).
+        // `using` so an Export() throw still releases the unmanaged
+        // handle the with-private-key copy holds (cs/dispose-not-called-on-throw).
+        using var signedLeaf = unsignedLeaf.CopyWithPrivateKey(rsa);
         var pfxBytes = signedLeaf.Export(X509ContentType.Pkcs12);
-        signedLeaf.Dispose();
         return X509CertificateLoader.LoadPkcs12(pfxBytes, password: null, keyStorageFlags: X509KeyStorageFlags.Exportable);
     }