Template .editorconfig contradicts CODESTYLE by relaxing all analyzers repo-wide

[ptr727]

The template's root .editorconfig carries a repo-wide analyzer relaxation that CODESTYLE.md explicitly names as forbidden. Because it ships in the template, every derived repo inherits it.

The contradiction

.editorconfig line 86:

dotnet_analyzer_diagnostic.severity = suggestion

CODESTYLE.md line 243:

Repo-wide: a dotnet_diagnostic.<RULE>.severity entry in the root .editorconfig, only when the rule is genuinely not applicable to any project. Relaxing a batch of CA* rules (or dotnet_analyzer_diagnostic.severity) to push a brownfield port through the build is exactly what this forbids.

The rule names the exact setting sitting three lines below the comment block that cites the rule. The setting also defeats much of AnalysisLevel=latest-all + AnalysisMode=All, which the template sets in Directory.Build.props -- rules are enabled, then demoted to suggestion, so they never fail a build.

Blast radius

Every C# repo checked carries the identical line, inherited from here:

ProjectTemplate, LanguageTags, PlexCleaner, PhotoCleaner, MediaTools, NxWitness, AudioCleaner

Evidence from Utilities

Utilities removed it and probed what it had been hiding (ptr727/Utilities#418). Result:

Rule	Sites	Project
xUnit1051	29	test project only

Zero findings in the library or the AOT sample project. Re-run with -p:EnforceCodeStyleInBuild=true to confirm IDE analyzers were not silently skipped -- same result. The relaxation was hiding nothing in shipping code, and the one rule it did hide was a true positive worth fixing (async test calls not passing TestContext.Current.CancellationToken, so xUnit v3 could not cancel a stalled network-bound test).

Utilities now builds clean with the line removed and TreatWarningsAsErrors intact: 0 warnings, 183/183 tests passing.

Every other suppression in Utilities was independently probed by removing it and rebuilding, and all proved load-bearing (CA1711, CA1707, CA1515, NoWarn IL3058). The blanket relaxation was the only unjustified one. IDE0055 was inert but is worth keeping as a guard since CSharpier owns formatting -- it just needed a rationale comment.

Caveat

One repo being clean is one data point, not proof the baseline is wrong everywhere. The other six may have real findings behind the line, and a template change would surface them all at once. Suggested sequence:

1. Run the probe in each derived repo -- delete the line, build with TreatWarningsAsErrors=false, tabulate by rule. Cheap and non-destructive.
2. If findings are small and genuine (as in Utilities), drop the line from the template and let each repo fix its own.
3. If some repo has a large brownfield backlog, that repo takes a scoped, commented, project-level suppression -- which is what CODESTYLE prescribes -- rather than the template keeping a blanket one for everyone.

Alternative

If the relaxation is a deliberate fleet decision rather than an oversight, then CODESTYLE.md line 243 should say so and carve out the exception, so the two stop contradicting each other. Either way the current state is inconsistent -- the template violates its own committed standard.

[ptr727]

Fleet probe complete -- all six remaining repos measured

Ran the suggested step 1 across every C# repo carrying the line. Method: a detached git worktree on each repo's origin/develop (so no working checkout was disturbed), delete dotnet_analyzer_diagnostic.severity = suggestion, then dotnet build -c Release --no-incremental -p:TreatWarningsAsErrors=false -p:EnforceCodeStyleInBuild=true.

Each repo that produced findings also got a control build with the line restored, to separate what the relaxation actually hides from what was already warning. That distinction mattered -- see the PhotoCleaner note below.

What the relaxation hides

Repo	xUnit1051	Other	Total
PlexCleaner	0	0	0
MediaTools	0	0	0
NxWitness	0	0	0
AudioCleaner	20	0	20
LanguageTags	24	0	24
Utilities	29	0	29 (already fixed, ptr727/Utilities#418)
PhotoCleaner	360	2 xUnit1030	362

Every repo built successfully in both configurations.

Reading

The line hides essentially one rule fleet-wide. Across seven repos it conceals xUnit1051 (async test calls not passing TestContext.Current.CancellationToken) plus two xUnit1030 in PhotoCleaner. No CA* or IDE* findings anywhere -- which is the striking result, because suppressing CA* batches is the scenario CODESTYLE was written to forbid, and no repo is actually relying on it for that.

Three repos are completely clean. PlexCleaner, MediaTools, and NxWitness would lose nothing by dropping the line today.

Two are trivial. AudioCleaner (20) and LanguageTags (24) are comparable to Utilities' 29, which took one focused pass.

PhotoCleaner is the one outlier at 362. Not a blocker, but it is a bulk change and deserves its own PR rather than riding along with a template bump.

Recommendation

Drop the line from the template. Six of seven repos are at zero or under 30 sites. Sequence it so PhotoCleaner is not the gate:

1. Remove from the template.
2. PlexCleaner / MediaTools / NxWitness -- pick up the change with no follow-up work at all.
3. AudioCleaner / LanguageTags -- one small PR each, mirroring Remove repo-wide analyzer relaxation and honor test cancellation Utilities#418.
4. PhotoCleaner -- dedicated PR for the 362 sites; it can lag without holding up the rest.

xUnit1051 is worth fixing rather than re-suppressing per-repo: it is what lets xUnit v3 cancel a stalled test, and it bites hardest in network-bound tests, which is exactly where Utilities found it.

Unrelated finding worth surfacing: PhotoCleaner has a vulnerable dependency

The control build showed these are pre-existing and not related to this issue -- they warn with the suppression in place:

NU1903 (x12): Package 'SQLitePCLRaw.lib.e_sqlite3' 2.1.10 has a known high severity
              vulnerability, https://github.com/advisories/GHSA-2m69-gcr7-jv3q
CS8625  (x4): Cannot convert null literal to non-nullable reference type

PhotoCleaner also does not set TreatWarningsAsErrors in Directory.Build.props, unlike the repos that do, so these warn without failing anything. The high-severity advisory is worth its own issue in that repo -- flagging it here only because the probe surfaced it.

[ptr727]

Hub side done

The blanket dotnet_analyzer_diagnostic.severity = suggestion is removed from the template .editorconfig in #400 (squash-merged to develop as 614a291). The specific dotnet_diagnostic.IDE0055.severity = none entry stays - it is a per-rule relaxation the adjacent comment governs, and outside this issue's scope. The hub has no C# build, so this corrects the canonical every C# repo carries without a local build impact.

Downstream re-vendor (sequenced from the probe above)

.editorconfig is an intent unit, not verbatim, so the audit does not mechanically flag this one line - the downstream removal is the tracked sequence below, not a catalog finding. Each repo removes the line from its own .editorconfig (re-vendor from the current hub) and fixes what the restored analyzers surface (essentially just xUnit1051):

1. PlexCleaner / MediaTools / NxWitness - already clean; re-vendor picks up the change with no follow-up.
2. AudioCleaner (20) / LanguageTags (24) - one small PR each, mirroring Remove repo-wide analyzer relaxation and honor test cancellation Utilities#418.
3. PhotoCleaner (362) - a dedicated PR, sequenced last so it does not gate the rest.

Utilities was already fixed (ptr727/Utilities#418). Leaving this open to track the downstream re-vendor.

[ptr727]

Closed: hub side done and verified, downstream sequence tracked in TODO.md

Verified against develop at 1ed0cc8: dotnet_analyzer_diagnostic.severity no longer appears anywhere in the template .editorconfig. Removed in 614a291 (#400), which is on main. The per-rule dotnet_diagnostic.IDE0055.severity = none entry stays, governed by its adjacent comment and outside this issue's scope.

The fleet probe in the comment above stands as the evidence that removing it was safe: across seven C# repos the blanket relaxation concealed essentially one rule, xUnit1051, plus two xUnit1030 in PhotoCleaner, and no CA* or IDE* findings anywhere. Three repos were completely clean.

The downstream re-vendor is what remains, and it is cross-repo work. .editorconfig is an intent unit, so the audit does not mechanically flag the single line, which means this is a sequenced sweep rather than a catalog finding. The sequence from the probe, unchanged:

1. PlexCleaner, MediaTools, NxWitness, clean, so the re-vendor picks up the change with no follow-up.
2. AudioCleaner (20 sites) and LanguageTags (24 sites), one small PR each.
3. PhotoCleaner (362 sites), a dedicated PR sequenced last so it does not gate the rest.

Utilities was already fixed in ptr727/Utilities#418.

That sweep is now tracked in the hub TODO.md under "Carried Content and Propagation", where it rides the same visit to each repo as the other outstanding re-vendors rather than being a separate errand. Closing here moves the tracking rather than ending it, so reopen if the per-repo sequence is better tracked on this issue.