@@ -34,7 +34,7 @@ regenerate with `ls -d fixtures/<corpus>/*/ | wc -l` for directory-shaped corpor
 | [`fixtures/extract-conformance/`](../fixtures/extract-conformance/) | 48 | ✓ | ✓ | inherits the shared JVM engine | ✓ | ✓ |
 | [`fixtures/output-prompt-conformance/`](../fixtures/output-prompt-conformance/) | 17 | ✓ | ✓ | ✓ | ✓ | ✓ |
 | [`fixtures/persistence-conformance/`](../fixtures/persistence-conformance/) | 59 (53 query + 6 migration) | all 59; the 24 `report-*` and the `-15` decimal scenarios also on SQLite, MySQL and D1, `decimal-exact` also on MySQL (a scenario's `engines:` key is exact) | 53 query (migrations TS-only, ADR-0015); the `report-*` and `engines:` scenarios also on SQLite and MySQL | 53 query (via Exposed); the `report-*` and `engines:` scenarios also on SQLite and MySQL | 53 query; the `report-*` and `engines:` scenarios also on SQLite and MySQL | 53 query (pg8000); the `report-*` and `engines:` scenarios also on SQLite (`sqlite3`) and MySQL (PyMySQL) |
-| [`fixtures/api-contract-conformance/`](../fixtures/api-contract-conformance/) | 106 (31 core + 10 tph + 9 m2m + 4 jsonb + 2 write-through + 12 projection + 27 report + 11 decimal) | ✓ (Fastify reference + generated lane); `report/` and `decimal/` also on SQLite, MySQL and D1 | ✓ (embedded HTTP + JDBC); `report/` and `decimal/` generated controllers over OMDB on Postgres, SQLite and MySQL | ✓ (embedded HTTP + Exposed); `report/` and `decimal/` also on SQLite and MySQL | ✓ (HttpListener + Npgsql); `report/` and `decimal/` also on SQLite and MySQL | ✓ (FastAPI + pg8000); `report/` and `decimal/` also on SQLite and MySQL |
+| [`fixtures/api-contract-conformance/`](../fixtures/api-contract-conformance/) | 106 (31 core + 10 tph + 9 m2m + 4 jsonb + 2 write-through + 12 projection + 27 report + 11 decimal) | ✓ (Fastify reference + generated lane); `report/` and `decimal/` also on SQLite, MySQL and D1 | ✓ (embedded HTTP + JDBC); `report/` and `decimal/` generated controllers over OMDB on Postgres, SQLite and MySQL | ✓ (embedded HTTP + Exposed); `report/` and `decimal/` also on SQLite and MySQL | ✓ (Kestrel + Npgsql); `report/` and `decimal/` also on SQLite and MySQL | ✓ (FastAPI + pg8000); `report/` and `decimal/` also on SQLite and MySQL |
 | [`fixtures/decimal-wire/`](../fixtures/decimal-wire/) | 1 vector file (format, parse, filter operand, 15-digit read) | ✓ (`runtime-ts` and the generated helper) | ✓ (`CanonicalDecimal`) | ✓ (the generated wire file) | ✓ (`DecimalWire`) | ✓ (`decimal_wire`) |
 | [`fixtures/validation-conformance/`](../fixtures/validation-conformance/) | 42 cases | ✓ (generated Zod + run-time `runValidators`) | ✓ | ✓ | ✓ | ✓ (generated Pydantic + run-time `run_validators`) |
 | [`fixtures/registry-conformance/`](../fixtures/registry-conformance/) | 1 canonical manifest | ✓ (reference emitter) | ✓ | ✓ | ✓ | ✓ |
 
@@ -132,7 +132,7 @@ booted over HTTP) are wired and green for:
   converter refuses polymorphic bodies → HTTP 415), so the Kotlin generated lane
   wires a small Jackson `JsonElement` codec module (the consumer's serialization
   wiring).
-- **C#** — reference (hand-rolled `HttpListener` over Postgres testcontainer) +
+- **C#** — reference (hand-rolled Kestrel server over Postgres testcontainer) +
   generated (the real `MetaObjects.Codegen` `DocumentRoutes` + `AppDbContext`
   Roslyn-compiled and booted full-stack on Kestrel over Postgres testcontainer).
   The generated lane locks the #105 codegen: the `payload` property is typed
 
@@ -1,19 +1,21 @@
-// AuthorApiServer — minimal reference ASP.NET / HttpListener server implementing
+// AuthorApiServer — minimal reference ASP.NET Core (Kestrel) server implementing
 // the cross-port REST API contract for the Author entity from the
 // api-contract-conformance corpus.
 //
 // Why hand-rolled (vs the RoutesGenerator output): the generator's output is a
-// Minimal-API mapping requiring a full WebApplication host pulling EF Core +
-// Kestrel. For a 10-route contract test that's disproportionate, and the
-// pattern matches the Java/Kotlin reference runners byte-for-byte. The corpus
+// Minimal-API mapping over EF Core. This server is the independent fixed point
+// the generated lane is measured against: one catch-all handler over raw Npgsql,
+// and the pattern matches the Java/Kotlin reference runners byte-for-byte. The corpus
 // is the contract both must satisfy.
 //
 // Backend is a Postgres testcontainer (matches the persistence-conformance
 // runner — keeps a single integration backend across both corpora and proves
 // the wire shape against real autoincrement + null semantics).
 
 using System.Globalization;
-using System.Net;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
 using System.Text;
 using System.Text.Json;
 using System.Text.Json.Nodes;
@@ -77,18 +79,15 @@ private sealed record FilterResult(List<FilterPredicate> Predicates, string? Err
     private const string TimestampFmt = "yyyy-MM-ddTHH:mm:ss";
 
     private readonly PostgresContainer _pg;
-    private readonly HttpListener _listener;
-    private readonly Task _loop;
-    private readonly CancellationTokenSource _cts = new();
+    private readonly WebApplication _app;
 
     public string BaseUrl { get; }
 
-    private AuthorApiServer(PostgresContainer pg, HttpListener listener, string baseUrl)
+    private AuthorApiServer(PostgresContainer pg, WebApplication app, string baseUrl)
     {
         _pg = pg;
-        _listener = listener;
+        _app = app;
         BaseUrl = baseUrl;
-        _loop = Task.Run(AcceptLoopAsync);
     }
 
     public static async Task<AuthorApiServer> StartAsync(PostgresContainer pg)
@@ -114,20 +113,23 @@ bio VARCHAR(1000),
                 )";
             await cmd.ExecuteNonQueryAsync();
         }
-        int port = PickFreePort();
-        var listener = new HttpListener();
-        string baseUrl = $"http://127.0.0.1:{port}";
-        listener.Prefixes.Add(baseUrl + "/");
-        listener.Start();
-        return new AuthorApiServer(pg, listener, baseUrl);
+        var builder = WebApplication.CreateBuilder();
+        LoopbackKestrel.BindAnyPort(builder);
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        AuthorApiServer? server = null;
+        // The bound address exists only after StartAsync, and no client can reach the
+        // server before it is returned, so the handler is wired before the instance exists.
+        app.Run(ctx => server!.HandleAsync(ctx));
+        await app.StartAsync();
+        server = new AuthorApiServer(pg, app, LoopbackKestrel.BoundUrl(app));
+        return server;
     }
 
     public async ValueTask DisposeAsync()
     {
-        _cts.Cancel();
-        try { _listener.Stop(); _listener.Close(); } catch { /* ignored */ }
-        try { await _loop; } catch { /* ignored */ }
-        _cts.Dispose();
+        try { await _app.StopAsync(); } catch { /* ignored */ }
+        try { await _app.DisposeAsync(); } catch { /* ignored */ }
     }
 
     // ----- seed / truncate -----
@@ -183,22 +185,7 @@ public async Task ApplySeedAsync(IReadOnlyList<Dictionary<string, object?>> rows
 
     // ----- HTTP loop -----
 
-    private async Task AcceptLoopAsync()
-    {
-        while (!_cts.IsCancellationRequested)
-        {
-            HttpListenerContext ctx;
-            try
-            {
-                ctx = await _listener.GetContextAsync();
-            }
-            catch (HttpListenerException) { break; }
-            catch (ObjectDisposedException) { break; }
-            _ = Task.Run(() => HandleAsync(ctx));
-        }
-    }
-
-    private async Task HandleAsync(HttpListenerContext ctx)
+    private async Task HandleAsync(HttpContext ctx)
     {
         try
         {
@@ -213,18 +200,14 @@ private async Task HandleAsync(HttpListenerContext ctx)
             }
             catch { /* nothing we can do */ }
         }
-        finally
-        {
-            try { ctx.Response.Close(); } catch { /* ignored */ }
-        }
     }
 
-    private async Task DispatchAsync(HttpListenerContext ctx)
+    private async Task DispatchAsync(HttpContext ctx)
     {
-        string method = ctx.Request.HttpMethod.ToUpperInvariant();
-        string rawPath = ctx.Request.Url?.AbsolutePath ?? "";
-        var qs = ctx.Request.QueryString;
-        string rawQuery = ctx.Request.Url?.Query ?? "";
+        string method = ctx.Request.Method.ToUpperInvariant();
+        string rawPath = ctx.Request.Path.Value ?? "";
+        var qs = ctx.Request.Query;
+        string rawQuery = ctx.Request.QueryString.Value ?? "";
         if (rawQuery.StartsWith("?")) rawQuery = rawQuery.Substring(1);
 
         string trimmed = rawPath.StartsWith("/api/authors")
@@ -246,8 +229,8 @@ private async Task DispatchAsync(HttpListenerContext ctx)
     }
 
     private async Task ListAuthorsAsync(
-        HttpListenerContext ctx,
-        System.Collections.Specialized.NameValueCollection qs,
+        HttpContext ctx,
+        IQueryCollection qs,
         string rawQuery)
     {
         string sortField = "id";
@@ -504,7 +487,7 @@ private static void BindAll(NpgsqlCommand cmd, List<object?> values)
             cmd.Parameters.AddWithValue("@p" + i, values[i] ?? (object)DBNull.Value);
     }
 
-    private async Task GetAuthorAsync(HttpListenerContext ctx, string idStr)
+    private async Task GetAuthorAsync(HttpContext ctx, string idStr)
     {
         long? id = ParseLongOrNull(idStr);
         if (id is null) { await SendJsonAsync(ctx, 400, new Dictionary<string, object?> { ["error"] = "invalid_id" }); return; }
@@ -529,7 +512,7 @@ private static bool ExceedsAuthorMaxLength(Dictionary<string, object?> body) =>
         (body.GetValueOrDefault("name") is string n && n.Length > 100)
         || (body.GetValueOrDefault("bio") is string b && b.Length > 1000);
 
-    private async Task CreateAuthorAsync(HttpListenerContext ctx)
+    private async Task CreateAuthorAsync(HttpContext ctx)
     {
         var parsed = await ReadJsonBodyAsync(ctx);
         if (parsed is not Dictionary<string, object?> body)
@@ -579,7 +562,7 @@ private async Task CreateAuthorAsync(HttpListenerContext ctx)
         await SendJsonAsync(ctx, 201, row);
     }
 
-    private async Task UpdateAuthorAsync(HttpListenerContext ctx, string idStr)
+    private async Task UpdateAuthorAsync(HttpContext ctx, string idStr)
     {
         long? id = ParseLongOrNull(idStr);
         if (id is null) { await SendJsonAsync(ctx, 400, new Dictionary<string, object?> { ["error"] = "invalid_id" }); return; }
@@ -662,7 +645,7 @@ private async Task UpdateAuthorAsync(HttpListenerContext ctx, string idStr)
         await SendJsonAsync(ctx, 200, row);
     }
 
-    private async Task DeleteAuthorAsync(HttpListenerContext ctx, string idStr)
+    private async Task DeleteAuthorAsync(HttpContext ctx, string idStr)
     {
         long? id = ParseLongOrNull(idStr);
         if (id is null) { await SendJsonAsync(ctx, 400, new Dictionary<string, object?> { ["error"] = "invalid_id" }); return; }
@@ -708,9 +691,9 @@ private async Task DeleteAuthorAsync(HttpListenerContext ctx, string idStr)
         return rdr.IsDBNull(ord) ? null : rdr.GetDateTime(ord).ToString(TimestampFmt, CultureInfo.InvariantCulture);
     }
 
-    private static async Task<object?> ReadJsonBodyAsync(HttpListenerContext ctx)
+    private static async Task<object?> ReadJsonBodyAsync(HttpContext ctx)
     {
-        using var reader = new StreamReader(ctx.Request.InputStream, ctx.Request.ContentEncoding);
+        using var reader = new StreamReader(ctx.Request.Body, Encoding.UTF8);
         string text = await reader.ReadToEndAsync();
         if (string.IsNullOrEmpty(text)) return null;
         return JsonNodeToObject(JsonNode.Parse(text));
@@ -743,20 +726,20 @@ private async Task DeleteAuthorAsync(HttpListenerContext ctx, string idStr)
         return null;
     }
 
-    private static async Task SendJsonAsync(HttpListenerContext ctx, int status, object body)
+    private static async Task SendJsonAsync(HttpContext ctx, int status, object body)
     {
         byte[] bytes = Encoding.UTF8.GetBytes(JsonSerializer.Serialize(body, JsonOpts));
         ctx.Response.StatusCode = status;
         ctx.Response.ContentType = "application/json";
-        ctx.Response.ContentLength64 = bytes.Length;
-        await ctx.Response.OutputStream.WriteAsync(bytes);
+        ctx.Response.ContentLength = bytes.Length;
+        await ctx.Response.Body.WriteAsync(bytes);
     }
 
-    private static async Task SendNoContentAsync(HttpListenerContext ctx)
+    private static async Task SendNoContentAsync(HttpContext ctx)
     {
         ctx.Response.StatusCode = 204;
-        ctx.Response.ContentLength64 = 0;
-        await ctx.Response.OutputStream.FlushAsync();
+        ctx.Response.ContentLength = 0;
+        await ctx.Response.Body.FlushAsync();
     }
 
     private static readonly JsonSerializerOptions JsonOpts = new()
@@ -778,15 +761,4 @@ private static DateTime ParseTimestamp(string s) =>
         if (s is null) return null;
         return long.TryParse(s, NumberStyles.Integer, CultureInfo.InvariantCulture, out var n) ? n : null;
     }
-
-    private static int PickFreePort()
-    {
-        // Bind to port 0, read what the OS gave us, release. Race-free for our
-        // single-instance test usage; HttpListener will re-bind in StartAsync.
-        var l = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
-        l.Start();
-        int port = ((System.Net.IPEndPoint)l.LocalEndpoint).Port;
-        l.Stop();
-        return port;
-    }
 }
@@ -106,11 +106,8 @@ bio VARCHAR(1000),
         var routesType = generatedAssembly.GetType($"{GeneratedNamespace}.AuthorRoutes")
             ?? throw new InvalidOperationException("generated AuthorRoutes type not found");
 
-        int port = PickFreePort();
-        string baseUrl = $"http://127.0.0.1:{port}";
-
         var builder = WebApplication.CreateBuilder();
-        builder.WebHost.UseUrls(baseUrl);
+        LoopbackKestrel.BindAnyPort(builder);
         // Quiet the host (no console spew during the test run).
         builder.Logging.ClearProviders();
 
@@ -137,7 +134,7 @@ bio VARCHAR(1000),
         mapMethod.Invoke(null, new object[] { app, "/api" });
 
         await app.StartAsync();
-        return new GeneratedAuthorServerFactory(pg, app, baseUrl);
+        return new GeneratedAuthorServerFactory(pg, app, LoopbackKestrel.BoundUrl(app));
     }
 
     public async ValueTask DisposeAsync()
@@ -341,15 +338,6 @@ private static DateTime ParseTimestamp(string s) =>
             DateTime.ParseExact(s, TimestampFmt, System.Globalization.CultureInfo.InvariantCulture,
                 System.Globalization.DateTimeStyles.None),
             DateTimeKind.Utc);
-
-    private static int PickFreePort()
-    {
-        var l = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
-        l.Start();
-        int port = ((System.Net.IPEndPoint)l.LocalEndpoint).Port;
-        l.Stop();
-        return port;
-    }
 }
 
 /// <summary>
 
@@ -79,14 +79,8 @@ public static async Task<GeneratedRoutesServer> StartAsync(
         var assembly = Assembly.Load(ms.ToArray());
         var dbContextType = assembly.GetType($"{ns}.AppDbContext") ?? throw new InvalidOperationException("no AppDbContext");
 
-        var l = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
-        l.Start();
-        int port = ((System.Net.IPEndPoint)l.LocalEndpoint).Port;
-        l.Stop();
-        var baseUrl = $"http://127.0.0.1:{port}";
-
         var builder = WebApplication.CreateBuilder();
-        builder.WebHost.UseUrls(baseUrl);
+        LoopbackKestrel.BindAnyPort(builder);
         builder.Logging.ClearProviders();
         var addDbContext = typeof(EntityFrameworkServiceCollectionExtensions).GetMethods(BindingFlags.Public | BindingFlags.Static)
             .First(m => m.Name == "AddDbContext" && m.IsGenericMethodDefinition && m.GetGenericArguments().Length == 1 && m.GetParameters().Length == 4)
@@ -99,7 +93,7 @@ public static async Task<GeneratedRoutesServer> StartAsync(
             assembly.GetType($"{ns}.{name}Routes")!.GetMethod($"Map{name}Routes", BindingFlags.Public | BindingFlags.Static)!
                 .Invoke(null, [app, "/api"]);
         await app.StartAsync();
-        return new GeneratedRoutesServer(app, baseUrl);
+        return new GeneratedRoutesServer(app, LoopbackKestrel.BoundUrl(app));
     }
 
     public async ValueTask DisposeAsync()
 
@@ -55,11 +55,8 @@ public static async Task<JsonbGeneratedServerFactory> StartAsync(PostgresContain
         var dbContextType = assembly.GetType($"{GeneratedNamespace}.AppDbContext")
             ?? throw new InvalidOperationException("generated AppDbContext type not found");
 
-        int port = PickFreePort();
-        string baseUrl = $"http://127.0.0.1:{port}";
-
         var builder = WebApplication.CreateBuilder();
-        builder.WebHost.UseUrls(baseUrl);
+        LoopbackKestrel.BindAnyPort(builder);
         builder.Logging.ClearProviders();
         RegisterGeneratedDbContext(builder.Services, dbContextType, pg.ConnectionString);
         // The documented host registration: a field.timestamp crosses the wire as UTC with the Z
@@ -79,7 +76,7 @@ public static async Task<JsonbGeneratedServerFactory> StartAsync(PostgresContain
         }
 
         await app.StartAsync();
-        return new JsonbGeneratedServerFactory(pg, app, baseUrl);
+        return new JsonbGeneratedServerFactory(pg, app, LoopbackKestrel.BoundUrl(app));
     }
 
     public async Task ApplySeedAsync() =>
@@ -195,13 +192,4 @@ private static void RegisterGeneratedDbContext(
             services, configure, ServiceLifetime.Scoped, ServiceLifetime.Scoped,
         });
     }
-
-    private static int PickFreePort()
-    {
-        var l = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
-        l.Start();
-        int port = ((System.Net.IPEndPoint)l.LocalEndpoint).Port;
-        l.Stop();
-        return port;
-    }
 }