feat(core,io-isolated-storage,runtime): the GetFolderPath table completed, 16-bit float unit 1, and three declarations (#2364, #2384, #2387, #2207, #2338)

#2364 is the only one that changed a value a caller gets, and it changed eight
of them. #2320's recorded reason for stopping -- that the rest "has no .NET
mapping, so it would cross from parity into invention" -- was measured FALSE:
every remaining row maps onto ReadXdgDirectory or onto a static path, so these
are alignments, not widenings.

The sharpest row is Personal/MyDocuments, which returned the HOME DIRECTORY
ITSELF, so an application writing "the user's documents" wrote into $HOME.
UserProfile is asserted NOT to have moved with it. Two rows are the reverse
shape: ProgramFiles and System were INVENTED here where .NET maps them only
under TARGET_OSX, so the alignment REMOVES a mapping.

The eight rows were never covered, which is why the divergence survived -- the
full suite passed unchanged before and after. Every new case sets HOME and the
XDG variables EXPLICITLY under DoNotVerify, so what is asserted is the mapping
rather than what this machine happens to have. Six mutations, all caught.

#2384 unit 1 gives both 16-bit floats nine members, and #2340's in-step rule
worked as designed: adding them to BFloat16 alone BROKE THE BUILD. Four of the
nine are bit operations, not float round-trips, and .NET says so itself. Six
mutations, all caught -- but M6 only after a measurement corrected the test: the
case used a NaN that was already quiet, and probing all 65,536 patterns showed
the two forms differ on exactly 126, every one signalling.

#2387, #2207 and #2338 change no production statement. #2387 leaves
ExternalException::ToString() absent: unlike #2374's slot, a virtual here would
only relocate the naming problem into cna's three derived types. #2207 declares
the IsolatedStorage TOCTOU WITH ITS THREAT BOUNDARY -- it does stop a
pre-existing symlink, and does not stop an attacker who can already write inside
the root and therefore already reaches everything the race would win. #2338
keeps normalization invariant, and its premise was stale twice: /rv is present,
and #2386 measured that this port matches .NET's invariant globalization mode
rather than diverging from it.

Gate: 17,574 run, 17,574 passed, 0 failed, 0 skipped across 38 executables
(+13). Module graph 41/93. Build directory: build/ only, --parallel 2 throughout.

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,87 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Migration — POSIX `GetFolderPath` completes the .NET table (#2364)
+
+Ticket **#2364**, landed 2026-08-19 on an explicit decision. **Decided against the recommendation
+on the record.**
+
+## The premise #2320 recorded was false, and that is why this ticket exists
+
+When #2320 offered full XDG and it was declined, the reason given was that *"part of it has no .NET
+mapping, so it would cross from parity into invention"*. Measured afterwards, that is **wrong**:
+every remaining row maps onto `ReadXdgDirectory` (`GetFolderPathCore.Unix.cs:220-249`) or onto a
+static path. #2320 stopped where it did for **scope**, not for invention — so the eight rows below
+are **alignments**, not widenings.
+
+## What changed — eight rows, and some change a value callers get today
+
+| Folder | before | after | reference |
+|---|---|---|---|
+| `Personal` / `MyDocuments` | `$HOME` | `ReadXdgDirectory(XDG_DOCUMENTS_DIR, "Documents")` | `:133-134` |
+| `Desktop` / `DesktopDirectory` | `$HOME/Desktop` | `ReadXdgDirectory(XDG_DESKTOP_DIR, "Desktop")` | `:119-121` |
+| `MyMusic` | `$HOME/Music` | `ReadXdgDirectory(XDG_MUSIC_DIR, "Music")` | `:135-136` |
+| `MyPictures` | `$HOME/Pictures` | `ReadXdgDirectory(XDG_PICTURES_DIR, "Pictures")` | `:139-140` |
+| `MyVideos` | `$HOME/Videos` | `ReadXdgDirectory(XDG_VIDEOS_DIR, "Videos")` | `:137-138` |
+| `Templates` | `$HOME/Templates` | `ReadXdgDirectory(XDG_TEMPLATES_DIR, "Templates")` | `:88-89` |
+| `CommonApplicationData` | `/etc` | **`/usr/share`** | `:54` |
+| `CommonTemplates` | *unmapped* | **`/usr/share/templates`** | `:55` |
+| `Fonts` | `/usr/share/fonts` | **`$HOME/.fonts`** | `:141-142` |
+| `ProgramFiles` | `/usr` | **`""`** | not mapped on Linux |
+| `System` | `/usr/lib` | **`""`** | not mapped on Linux |
+
+**The sharpest row is `Personal`.** This port returned the **home directory itself**, so an
+application writing "the user's documents" wrote into `$HOME`. It now returns a `Documents`
+subdirectory. `UserProfile` still returns home — the two used to be the same answer, and a repair
+that moved both would look correct without the row that separates them.
+
+**`CommonApplicationData` is the second.** `/etc` is not writable by a non-root user and is not
+where shared application data belongs.
+
+**`ProgramFiles` and `System` are the reverse shape**, and worth stating separately: .NET maps them
+only under `TARGET_OSX` (`:57-60`), so on Linux no arm matches, `GetSpecialFolder` returns `null`,
+and `GetFolderPathCore` turns that into `""`. This port had **invented** a mapping where .NET has
+none, so here the alignment **removes** one.
+
+## `ReadXdgDirectory`, transcribed
+
+Three sources in .NET's order:
+
+1. the environment variable, **if set and absolute** — a relative value is **ignored, not joined**,
+   the same rule `xdgBase` already applied to the two base directories;
+2. the `XDG_DESKTOP_DIR="$HOME/Desktop"`-style lines of `user-dirs.dirs`, read out of the **XDG
+   config directory**, so it honours `XDG_CONFIG_HOME` rather than a hard-coded `~/.config`;
+3. `home/fallback`.
+
+The line grammar is transcribed rather than approximated, because each rejection is one .NET makes:
+whitespace is skipped before the key, around `=` and before the opening quote; a value must be
+either `$HOME/`-prefixed or absolute and **anything else is skipped rather than accepted**; the
+value ends at the next `"`, and an empty one is skipped. .NET eats every error reading the file, so
+an unreadable or malformed file falls through to the fallback.
+
+## Tests — and the rule they follow
+
+The eight rows **were never covered**, which is exactly why the divergence survived: the existing
+cases assert enum values and non-emptiness under `DoNotVerify`, and the full suite passed unchanged
+both before and after.
+
+Every new case uses `DoNotVerify` and sets `HOME` and the XDG variables **explicitly**, so what is
+asserted is the *mapping* rather than what this machine happens to have. That is the #2320 / SA-6
+lesson as a rule: five of its rows passed only because this container has `~/Desktop`, which SA-6
+calls a defect in the **test** rather than evidence about the code.
+
+`Decl2364_AnUnknownHomeStillFallsBackToRoot` pins the unchanged `"/"` fallback, because every new
+row builds on `home` and .NET states that fallback as a **safeguard** — `"/"` is not writable by a
+non-root user, so a row that silently produced a relative `Documents` would be somewhere an
+application could write private data.
+
+## Mutation testing
+
+Six mutations, **all caught**:
+
+| # | Mutation | Caught by |
+|---|---|---|
+| M1 | `Personal` reverts to home | the six-directory case |
+| M2 | a relative XDG variable is accepted | the absolute/relative case |
+| M3 | `user-dirs.dirs` read from a hard-coded `~/.config` | the file-grammar case |
+| M4 | a non-absolute `user-dirs.dirs` value is accepted | the file-grammar case |
+| M5 | the `ProgramFiles` mapping is restored | the static/unmapped case |
+| M6 | `CommonApplicationData` reverts to `/etc` | the static/unmapped case |

docs/Migration-GetFolderPathFullXdgTable.md

@@ -0,0 +1,81 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Migration — the 16-bit floats gain .NET's math surface (#2384), unit 1
+
+Ticket **#2384**, decided 2026-08-19: **add the surface**, per .NET. Its acceptance criterion
+requires it to land **as bounded units that move both types in step**, and this is unit 1.
+
+**Purely additive.** No existing member changed, no layout moved (`sizeof(BFloat16)` is still 2),
+and nothing that compiled before fails now.
+
+## Why both types, always
+
+#2340 established that this surface must move for `System::Half` and
+`System::Numerics::BFloat16` **together or not at all**: adding it to one leaves the port's two
+16-bit floats inconsistent with each other, which is **worse than either policy applied
+consistently**.
+
+That rule is enforced by the build, and it worked as designed: adding these members to `BFloat16`
+alone **broke the compile**, because #2382's pin asserted their absence with the message *"it must
+move System::Half too"*. The pin is now partially inverted — it asserts presence on **both** types,
+and still asserts unit 2's absence on both, so the next unit gets the same signal this one did.
+
+## Unit 1 — nine members, and four of them are not what you would guess
+
+| member | .NET | shape |
+|---|---|---|
+| `Abs` | `Half.cs:1756`, `BFloat16.cs:1396` | **bit mask** `value & ~SignMask` |
+| `CopySign` | `Half.cs:1654-1664`, `BFloat16.cs:1300-1310` | **bitwise** |
+| `BitIncrement` | `Half.cs:1478-1508`, `BFloat16.cs:1134-1164` | **bit arithmetic** |
+| `BitDecrement` | `Half.cs:1445-1475`, `BFloat16.cs:1101-1131` | **bit arithmetic** |
+| `Clamp` | `Half.cs:1641`, `BFloat16.cs:1297` | float round-trip |
+| `Max`, `Min` | `Half.cs:1667…` | float round-trip |
+| `MaxMagnitude`, `MinMagnitude` | `Half.cs:1851,1879`, `BFloat16.cs:1491,1519` | float round-trip |
+
+**A blanket "forward to `float`" would be wrong for the first four**, and .NET says so itself:
+`CopySign` carries the comment *"This method is required to work for all inputs, including NaN, so
+we operate on the raw bits."*
+
+**Three edges of `BitIncrement`/`BitDecrement` are not arithmetic** and are transcribed rather than
+derived: a NaN returns itself, `-Infinity` **increments to `MinValue`** and `+Infinity`
+**decrements to `MaxValue`**, and — the one most easily lost — **`-0.0` increments to `Epsilon`**
+while **`+0.0` decrements to `-Epsilon`**.
+
+## Every body was derived per type, not copied
+
+This is #2382's lesson applied rather than quoted. There, copying `Half::GetHashCode` into
+`BFloat16` would have **compiled, satisfied the hash contract and returned the wrong number**,
+because .NET's `BFloat16` delegates its identity trio to `float` while `Half` masks to 16 bits.
+
+For these nine the two references **do** agree — and that was *checked*, not assumed. The only
+textual difference is that `BFloat16.Clamp` calls `Math.Clamp` where `Half.Clamp` calls
+`float.Clamp`; same semantics.
+
+## Mutation testing
+
+Six mutations, all caught — **but M6 only after a measurement corrected the test**:
+
+| # | Mutation | Caught by |
+|---|---|---|
+| M1 | `Half::Abs` via a float round-trip | the bit-operations case |
+| M2 | `Half::CopySign` via `std::copysign` | the same |
+| M3 | `BitIncrement(-0.0)` returns `+0.0` | the edges case |
+| M4 | `BitIncrement` drops the negative branch | the same |
+| M5 | `MaxMagnitude` is really `Max` | the round-trip case |
+| M6 | `BFloat16::Abs` via a float round-trip | the bit-operations case, **after repair** |
+
+**M6 was first NOT CAUGHT while its `Half` twin M1 was**, and the reason was in the test, not the
+code: the case used `0x7FC1`, a NaN that is **already quiet**, so a round-trip returned it
+unchanged. Probed exhaustively over all 65,536 patterns, the two forms differ on **exactly 126** —
+every one a **signalling** NaN, which `fromFloat` quiets by OR-ing in `0x0040`. The case now uses
+`0x7F81` and asserts the exact bits.
+
+## What is still to come
+
+Unit 1 is the sign/magnitude family. **Unit 2** is the transcendental families (`Sqrt`, `Exp`,
+`Log`, the trigonometric and hyperbolic sets, `Pow`, `FusedMultiplyAdd`, `ReciprocalEstimate`) and
+**unit 3** is the conversion operators. Both remain, both must move the two types in step, and
+unit 2's absence is pinned on both types today.
+
+Out of scope permanently, and unchanged by this ticket: **generic-math conformance**
+(`INumber<T>`, `IFloatingPointIeee754<T>`, `IMinMaxValue<T>`). .NET's `BFloat16` implements 36
+interfaces and none of them is expressible here.

docs/Migration-SixteenBitFloatMathSurface.md

@@ -3,6 +3,7 @@
 // Portions based on .NET runtime API (MIT License, Copyright .NET Foundation and Contributors)
 #pragma once
 #include <cstdint>
+#include "System/MathF.hpp"
 #include <cstring>
 #include <string>
 #include <cmath>
@@ -184,6 +185,103 @@ namespace System {
         static const Half PositiveInfinity;
         /** @brief Represents negative infinity. C++ counterpart of .NET Half.NegativeInfinity. */
         static const Half NegativeInfinity;
+        // -----------------------------------------------------------------------------------
+        // #2384 unit 1: the sign/magnitude family. Every body is DERIVED PER TYPE from the
+        // reference rather than copied across, because #2382 measured what copying costs -- its
+        // GetHashCode would have compiled, satisfied the hash contract and returned the wrong
+        // number. Here the two types agree, and that was CHECKED rather than assumed.
+        //
+        // Note which of these are bit operations and which are float round-trips: .NET makes that
+        // distinction deliberately, and a blanket "forward to float" would be wrong for four of
+        // the nine.
+        // -----------------------------------------------------------------------------------
+
+        /**
+         * @brief Returns the absolute value.
+         *
+         * C++ counterpart of .NET `Half.Abs(Half)` (`Half.cs:1756`), which is a **bit mask**,
+         * `value._value & ~SignMask` -- NOT a float round-trip. That matters for NaN: masking
+         * preserves the payload and the quiet bit, where a round-trip through `float` would
+         * canonicalise them (see this type's own note on NaN payloads).
+         */
+        [[nodiscard]] static Half Abs(Half value) noexcept {
+            return Half(static_cast<uint16_t>(value.bits & 0x7FFFu));
+        }
+
+        /**
+         * @brief Copies the sign of @p sign onto the magnitude of @p value.
+         *
+         * C++ counterpart of .NET `Half.CopySign(Half, Half)` (`Half.cs:1654-1664`). .NET states
+         * why it is bitwise in a comment of its own -- *"This method is required to work for all
+         * inputs, including NaN, so we operate on the raw bits"* -- so this is transcribed rather
+         * than expressed through `std::copysign` on a converted `float`.
+         */
+        [[nodiscard]] static Half CopySign(Half value, Half sign) noexcept {
+            return Half(static_cast<uint16_t>((value.bits & 0x7FFFu) | (sign.bits & 0x8000u)));
+        }
+
+        /**
+         * @brief Returns the next representable value greater than @p x.
+         *
+         * C++ counterpart of .NET `Half.BitIncrement(Half)` (`Half.cs:1478-1508`), transcribed
+         * including its three non-obvious edges: a NaN returns itself, `-Infinity` returns
+         * `MinValue` (not `-MaxValue` by arithmetic), `+Infinity` returns itself, and **-0.0
+         * returns `Epsilon`** rather than +0.0.
+         */
+        [[nodiscard]] static Half BitIncrement(Half x) noexcept {
+            uint16_t bits = x.bits;
+            if (!IsFinite(x)) {
+                // NaN -> NaN, -Infinity -> MinValue, +Infinity -> +Infinity
+                return (bits == 0xFC00u) ? MinValue : x;
+            }
+            if (bits == 0x8000u) return Epsilon;   // -0.0 -> Epsilon
+            // Negative values are decremented, positive values incremented.
+            if (IsNegative(x)) --bits; else ++bits;
+            return Half(bits);
+        }
+
+        /**
+         * @brief Returns the next representable value less than @p x.
+         *
+         * C++ counterpart of .NET `Half.BitDecrement(Half)` (`Half.cs:1445-1475`). The mirror of
+         * BitIncrement, and its edges mirror too: `+Infinity` returns `MaxValue` and **+0.0
+         * returns `-Epsilon`**.
+         */
+        [[nodiscard]] static Half BitDecrement(Half x) noexcept {
+            uint16_t bits = x.bits;
+            if (!IsFinite(x)) {
+                // NaN -> NaN, +Infinity -> MaxValue, -Infinity -> -Infinity
+                return (bits == 0x7C00u) ? MaxValue : x;
+            }
+            if (bits == 0x0000u) {
+                // +0.0 -> -Epsilon
+                return Half(static_cast<uint16_t>(Epsilon.bits | 0x8000u));
+            }
+            if (IsNegative(x)) ++bits; else --bits;
+            return Half(bits);
+        }
+
+        /**
+         * @brief Clamps @p value to the inclusive range [@p min, @p max].
+         *
+         * C++ counterpart of .NET `Half.Clamp(Half, Half, Half)` (`Half.cs:1641`), which **is** a
+         * float round-trip -- `(Half)float.Clamp((float)value, (float)min, (float)max)`.
+         * @throws System::ArgumentException if @p min is greater than @p max, matching
+         *         `Math.Clamp`'s own contract.
+         */
+        [[nodiscard]] static Half Clamp(Half value, Half min, Half max);
+
+        /** @brief The larger of two values. .NET: `(Half)float.Max(...)` (`Half.cs:1667`). */
+        [[nodiscard]] static Half Max(Half x, Half y) noexcept;
+        /** @brief The smaller of two values. .NET's counterpart of Max. */
+        [[nodiscard]] static Half Min(Half x, Half y) noexcept;
+        /** @brief The value with the larger magnitude. .NET: `(Half)MathF.MaxMagnitude(...)`
+         *  (`Half.cs:1851`). */
+        [[nodiscard]] static Half MaxMagnitude(Half x, Half y) noexcept;
+        /** @brief The value with the smaller magnitude. .NET: `(Half)MathF.MinMagnitude(...)`
+         *  (`Half.cs:1879`). */
+        [[nodiscard]] static Half MinMagnitude(Half x, Half y) noexcept;
+
         /** @brief Represents the largest finite half-precision value (65504). C++ counterpart of .NET Half.MaxValue. */
         static const Half MaxValue;
         /** @brief Represents the most negative finite half-precision value (-65504). C++ counterpart of .NET Half.MinValue. */
@@ -427,6 +525,25 @@ namespace System {
     inline const Half Half::NaN              = Half(0xFE00);
     inline const Half Half::PositiveInfinity = Half(0x7C00);
     inline const Half Half::NegativeInfinity = Half(0xFC00);
+    // #2384 unit 1: the four float round-trip members, defined after the constants they need.
+    // Each is .NET's own expression, not a re-derivation -- Clamp is float.Clamp, Max/Min are
+    // float.Max/float.Min, and MaxMagnitude/MinMagnitude are MathF.MaxMagnitude/MinMagnitude.
+    inline Half Half::Clamp(Half value, Half min, Half max) {
+        return FromSingle(System::MathF::Clamp(value.ToSingle(), min.ToSingle(), max.ToSingle()));
+    }
+    inline Half Half::Max(Half x, Half y) noexcept {
+        return FromSingle(System::MathF::Max(x.ToSingle(), y.ToSingle()));
+    }
+    inline Half Half::Min(Half x, Half y) noexcept {
+        return FromSingle(System::MathF::Min(x.ToSingle(), y.ToSingle()));
+    }
+    inline Half Half::MaxMagnitude(Half x, Half y) noexcept {
+        return FromSingle(System::MathF::MaxMagnitude(x.ToSingle(), y.ToSingle()));
+    }
+    inline Half Half::MinMagnitude(Half x, Half y) noexcept {
+        return FromSingle(System::MathF::MinMagnitude(x.ToSingle(), y.ToSingle()));
+    }
+
     inline const Half Half::MaxValue         = Half(0x7BFF);  //  65504
     inline const Half Half::MinValue         = Half(0xFBFF);  // -65504
     inline const Half Half::Epsilon          = Half(0x0001);  //  ~5.96e-8