fix(core): IsCompatibilitySwitchSet consults the registry (#2250, SR-AUD-103)

It returned false unconditionally, without consulting the AppContext switch
registry at all -- so a switch a caller had explicitly SET TO TRUE still
reported as unset. Transcribed from AppDomain.cs:171-174. Landed under SA-10,
which covers both changes: a return type and a noexcept are exactly what it
names.

NEITHER CHANGE COULD LAND WITHOUT THE OTHER, which is why the ticket was gated
on both.

The nullable return is not stylistic: a C++ bool cannot distinguish an
explicitly-FALSE switch from an UNSET one, which is the entire reason .NET's is
bool?. Keeping bool would have made the forward pointless -- both states would
still have collapsed to false.

The noexcept drop is not a relaxation: AppContext::TryGetSwitch raises for an
empty name and takes a mutex whose lock() can throw, so forwarding from a
noexcept member would have turned BOTH into std::terminate. The drop is the only
safe way to forward at all, and the empty-name diagnostic now reaches the caller
where the unconditional false swallowed it.

Implementation note: the body is out of line in AppDomain.cpp, for the same
reason SetData/GetData already are -- AppContext.hpp includes AppDomain.hpp for
BaseDirectory, so the include cannot run the other way. Adding it to the header
produced exactly that cycle, and the existing pattern was there to follow.

Both gated pins were written for this moment and are inverted; a third case was
added for the distinction the nullable return exists for.

Fixture set: 33 fixtures / 187 sites. Gate 17,284 run, 0 failed.

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,67 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Copyright (c) Robert Vokac and contributors -->
+
+# Migration — `IsCompatibilitySwitchSet` consults the registry (ticket #2250)
+
+*2026-08-18.* `AppDomain::IsCompatibilitySwitchSet` returned `false` unconditionally, without
+consulting the `AppContext` switch registry at all — so a switch a caller had explicitly **set to
+true** still reported as unset.
+
+Landed under `docs/StandingApprovals.md` **SA-10** with SA-2's five conditions. **Two changes had
+to land together.**
+
+---
+
+## 1. What changed
+
+| | Was | Is |
+|---|---|---|
+| the body | `return false;` | .NET's `TryGetSwitch(value, out result) ? result : default(bool?)` |
+| return type | `bool` | **`std::optional<bool>`** |
+| `noexcept` | yes | **no** |
+| an explicitly-**false** switch | `false` | `std::optional<bool>(false)` |
+| a switch **never set** | `false` — indistinguishable | **`std::nullopt`** |
+| an **empty** switch name | `false`, swallowed | **`ArgumentException`** |
+
+Transcribed from `AppDomain.cs:171-174`.
+
+## 2. Why both changes were required, together
+
+**The nullable return** is not a stylistic choice: a C++ `bool` cannot distinguish an
+explicitly-false switch from an unset one, which is the entire reason .NET's is `bool?`. Keeping
+`bool` would have made the forward pointless — both states would still have collapsed to `false`.
+
+**The `noexcept` drop** is not a relaxation either: `AppContext::TryGetSwitch` raises
+`System::ArgumentException` for an empty switch name and takes a `std::mutex` whose `lock()` can
+throw. Forwarding from a `noexcept` member would have turned **both into `std::terminate`**. The
+drop is the only safe way to forward at all.
+
+That is why neither could land without the other, and why the ticket was gated on both.
+
+## 3. To migrate
+
+```cpp
+// before
+if (domain.IsCompatibilitySwitchSet(name)) { ... }
+
+// after
+const auto set = domain.IsCompatibilitySwitchSet(name);
+if (set.has_value() && *set) { ... }          // explicitly on
+if (!set.has_value())        { ... }          // never set — a NEW state you can now see
+// or, for the old collapsed answer:
+if (domain.IsCompatibilitySwitchSet(name).value_or(false)) { ... }
+```
+
+An empty switch name now raises instead of quietly answering `false`.
+
+## 4. An implementation note
+
+The body is **out of line**, in `AppDomain.cpp`, for the same reason `SetData`/`GetData` already
+are: `System/AppContext.hpp` includes `AppDomain.hpp` for `BaseDirectory`, so the include cannot
+run the other way. Adding the include to the header produced exactly that cycle, and the existing
+pattern was already there to follow.
+
+## 5. Downstream, measured
+
+Neither `cna` nor `mobile-eggbert` calls `IsCompatibilitySwitchSet` — **zero sites in both**.
+Neither repository was modified.

audit/AUDIT_FINDINGS_INDEX.md

@@ -4,6 +4,7 @@
 #pragma once
 #include <functional>
 #include <string>
+#include <optional>
 #include "System/ArgumentException.hpp"
 #include "System/EventArgs.hpp"
 #include "System/MarshalByRefObject.hpp"
@@ -290,25 +291,39 @@ namespace System {
         /**
          * @brief Determines whether a compatibility switch is set.
          *
-         * C++ counterpart of .NET AppDomain.IsCompatibilitySwitchSet(string).
-         * Always returns false in this port: it does NOT consult the
-         * System::AppContext switch registry that SetData/GetData above now share.
+         * C++ counterpart of .NET `AppDomain.IsCompatibilitySwitchSet(string)`
+         * (`AppDomain.cs:171-174`), transcribed:
          *
-         * @warning This is a known, ticketed divergence, not an oversight. .NET
-         * forwards to AppContext.TryGetSwitch and returns @c bool? — and this port
-         * cannot follow it without two changes that need explicit approval, which
-         * ticket #2250 carries: the return type must become nullable to keep
-         * "explicitly false" distinguishable from "unset", and the @c noexcept must
-         * go, because AppContext::TryGetSwitch throws System::ArgumentException for
-         * an empty switch name (and takes a mutex, which can throw too). Forwarding
-         * while still declared @c noexcept would turn both into std::terminate.
+         * ```csharp
+         * return AppContext.TryGetSwitch(value, out bool result) ? result : default(bool?);
+         * ```
+         *
+         * @par Ticket #2250 made both approval-bound changes together
+         * It used to `return false` unconditionally, without consulting the `System::AppContext`
+         * switch registry at all — so a switch a caller had explicitly **set to true** still
+         * reported as unset. Following .NET needed two changes that had to land together, and
+         * SA-10 covers both:
+         *
+         *  - **the return type is `std::optional<bool>`**, because a C++ `bool` cannot
+         *    distinguish an explicitly-false switch from an unset one — which is precisely the
+         *    distinction `bool?` exists to carry;
+         *  - **the `noexcept` is gone**, because `AppContext::TryGetSwitch` raises
+         *    `System::ArgumentException` for an empty switch name and takes a `std::mutex` whose
+         *    `lock()` can throw. Forwarding from a `noexcept` member would have turned both into
+         *    `std::terminate`, so the drop is not a stylistic relaxation but the only safe way to
+         *    forward at all.
          *
          * @param value The name of the compatibility switch.
-         * @return Always false.
+         * @return The switch's value, or `std::nullopt` if it is not set.
+         * @throws System::ArgumentException if @p value is empty, exactly as
+         *         `AppContext::TryGetSwitch` does — the diagnostic now reaches the caller instead
+         *         of being swallowed by an unconditional `false`.
+         *
+         * @note The body is out of line for the same reason `SetData`/`GetData` above are:
+         *       `System/AppContext.hpp` includes this header for `BaseDirectory`, so the include
+         *       may not run the other way.
          */
-        [[nodiscard]] bool IsCompatibilitySwitchSet(const std::string& /*value*/) const noexcept {
-            return false;
-        }
+        [[nodiscard]] std::optional<bool> IsCompatibilitySwitchSet(const std::string& value) const;
 
         // -----------------------------------------------------------------------
         // Additional static methods

docs/Migration-AppDomainCompatibilitySwitch.md

@@ -65,6 +65,18 @@ AppDomain::AppDomain() {
 #endif
 }
 
+// #2250 / SR-AUD-103. Transcribed from .NET's AppDomain.cs:171-174:
+//     return AppContext.TryGetSwitch(value, out bool result) ? result : default(bool?);
+//
+// It used to `return false` unconditionally without consulting the switch registry at all, so a
+// switch a caller had explicitly SET TO TRUE still reported as unset. Out of line for the same
+// reason SetData/GetData below are: AppContext.hpp includes AppDomain.hpp for BaseDirectory.
+std::optional<bool> AppDomain::IsCompatibilitySwitchSet(const std::string& value) const {
+    bool result = false;
+    if (AppContext::TryGetSwitch(value, result)) return result;
+    return std::nullopt;
+}
+
 void AppDomain::SetData(const std::string& name, void* data) {
     AppContext::SetData(name, data);
 }

modules/core/include/System/AppDomain.hpp

@@ -18,6 +18,7 @@
 // that the two fixtures, which live in different executables, do not share a
 // name in filters and logs.
 #include <gtest/gtest.h>
+#include <optional>
 
 #include <string>
 
@@ -70,30 +71,58 @@ TEST(AppDomainDataPolicyTests, SetData_NullValue_IsStoredAndReadBack) {
 }
 
 // ---------------------------------------------------------------------------
-// SR-AUD-103, switch half / ticket #2250 (needs_user). This pins the CURRENT
-// divergence deliberately: IsCompatibilitySwitchSet does not consult AppContext,
-// because forwarding needs a nullable return type and a noexcept drop, both of
-// which need approval. If #2250 is approved, this is the test that must change.
+// SR-AUD-103, switch half / ticket #2250 — SHIPPED, and both pins below inverted
+//
+// IsCompatibilitySwitchSet used to `return false` unconditionally, without consulting the switch
+// registry at all -- so a switch a caller had explicitly SET TO TRUE still reported as unset.
+// .NET's is `AppContext.TryGetSwitch(value, out bool result) ? result : default(bool?)`
+// (`AppDomain.cs:171-174`).
+//
+// Following it needed two approval-bound changes TOGETHER, and SA-10 covers both: the return type
+// had to become nullable, because a C++ bool cannot distinguish an explicitly-FALSE switch from
+// an UNSET one -- which is the whole reason .NET's is `bool?` -- and the noexcept had to go,
+// because AppContext::TryGetSwitch raises for an empty name and takes a mutex whose lock() can
+// throw. Forwarding from a noexcept member would have turned both into std::terminate, so the
+// drop is the only safe way to forward at all rather than a stylistic relaxation.
 // ---------------------------------------------------------------------------
 
-TEST(AppDomainDataPolicyTests, IsCompatibilitySwitchSet_DoesNotYetConsultAppContext) {
+TEST(AppDomainDataPolicyTests, Fix2250_IsCompatibilitySwitchSetConsultsAppContext) {
     AppContext::SetSwitch("AppDomainDataPolicyTests.switchOn", true);
     ASSERT_TRUE([] {
         bool enabled = false;
         return AppContext::TryGetSwitch("AppDomainDataPolicyTests.switchOn", enabled) && enabled;
     }()) << "positive control: AppContext itself must report the switch as set";
-    EXPECT_FALSE(AppDomain::CurrentDomain().IsCompatibilitySwitchSet("AppDomainDataPolicyTests.switchOn"));
+    EXPECT_EQ(std::optional<bool>(true),
+              AppDomain::CurrentDomain().IsCompatibilitySwitchSet("AppDomainDataPolicyTests.switchOn"));
 }
 
-TEST(AppDomainDataPolicyTests, IsCompatibilitySwitchSet_IsStillNoexcept) {
-    // The reference and the argument are bound outside the noexcept operand on
-    // purpose: CurrentDomain() is not itself noexcept, and neither is the
-    // const char* -> std::string conversion, so either one inside the operand
-    // would answer a different question.
+TEST(AppDomainDataPolicyTests, Fix2250_ExplicitlyFalseIsNotUnset) {
+    // THE DISTINCTION THE NULLABLE RETURN EXISTS FOR, and the reason a bool could not have
+    // carried the repair: these two states used to be one, and both used to read as `false`.
+    AppContext::SetSwitch("AppDomainDataPolicyTests.switchOff", false);
+    AppDomain& domain = AppDomain::CurrentDomain();
+
+    EXPECT_EQ(std::optional<bool>(false),
+              domain.IsCompatibilitySwitchSet("AppDomainDataPolicyTests.switchOff"));
+    EXPECT_EQ(std::nullopt,
+              domain.IsCompatibilitySwitchSet("AppDomainDataPolicyTests.neverSet"));
+    EXPECT_NE(domain.IsCompatibilitySwitchSet("AppDomainDataPolicyTests.switchOff"),
+              domain.IsCompatibilitySwitchSet("AppDomainDataPolicyTests.neverSet"))
+        << "explicitly false and unset were indistinguishable before #2250";
+}
+
+TEST(AppDomainDataPolicyTests, Fix2250_ItIsNoLongerNoexceptAndTheDiagnosticReachesTheCaller) {
+    // The reference and the argument are bound outside the noexcept operand on purpose:
+    // CurrentDomain() is not itself noexcept, and neither is the const char* -> std::string
+    // conversion, so either one inside the operand would answer a different question.
     AppDomain& domain = AppDomain::CurrentDomain();
     const std::string name("AppDomainDataPolicyTests.switchOn");
-    EXPECT_TRUE(noexcept(domain.IsCompatibilitySwitchSet(name)));
-    EXPECT_NO_THROW((void)domain.IsCompatibilitySwitchSet(std::string()));
+    EXPECT_FALSE(noexcept(domain.IsCompatibilitySwitchSet(name)));
+
+    // An empty name used to be swallowed by the unconditional `false`. It now reaches the caller
+    // as AppContext::TryGetSwitch's own diagnostic -- which is what the noexcept drop buys, and
+    // why keeping the noexcept would have meant std::terminate instead.
+    EXPECT_THROW((void)domain.IsCompatibilitySwitchSet(std::string()), System::ArgumentException);
 }
 
 // ---------------------------------------------------------------------------

modules/core/src/System/AppDomain.cpp

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) Robert Vokac and contributors
+//
+// Negative compile fixture for ticket #2250 (SR-AUD-103, switch half).
+//
+// #2250 made AppDomain::IsCompatibilitySwitchSet consult the AppContext switch
+// registry, as .NET does (`AppDomain.cs:171-174`). It used to `return false`
+// unconditionally, so a switch a caller had explicitly SET TO TRUE still
+// reported as unset.
+//
+// Two approval-bound changes had to land together, and SA-10 covers both:
+//   * the return type is std::optional<bool>, because a C++ bool cannot
+//     distinguish an explicitly-FALSE switch from an UNSET one -- which is the
+//     whole reason .NET's is bool?;
+//   * the noexcept is gone, because AppContext::TryGetSwitch raises for an
+//     empty name and takes a mutex whose lock() can throw. Forwarding from a
+//     noexcept member would have been std::terminate, so the drop is the only
+//     safe way to forward rather than a stylistic relaxation.
+//
+// Migration: hold the result in `auto` / std::optional<bool> and ask
+// has_value(); or spell the old collapsed answer with value_or(false).
+//
+// Records: docs/Migration-AppDomainCompatibilitySwitch.md,
+// docs/NegativeConsumerFixtureValidation.md.
+//
+// NEGATIVE-FIXTURE: component=Core.Base allow=int128-extension
+#include <optional>
+#include <string>
+#include <type_traits>
+
+#include "System/AppDomain.hpp"
+
+#ifndef SHARP_RUNTIME_NEGATIVE_SITE
+#define SHARP_RUNTIME_NEGATIVE_SITE 0
+#endif
+
+using System::AppDomain;
+
+int main() {
+    AppDomain& domain = AppDomain::CurrentDomain();
+    const std::string name("consumer-fixture-switch");
+
+#if SHARP_RUNTIME_NEGATIVE_SITE == 1
+    // NEGATIVE(appdomain-switch-assigned-to-bool): conversion from
+    //     | cannot convert
+    //     | no viable conversion
+    { bool set = domain.IsCompatibilitySwitchSet(name); (void)set; }
+#else
+    { const std::optional<bool> set = domain.IsCompatibilitySwitchSet(name); (void)set; }
+#endif
+
+#if SHARP_RUNTIME_NEGATIVE_SITE == 2
+    // NEGATIVE(appdomain-switch-still-noexcept): static assertion failed
+    //     | static_assert
+    // The shape that breaks a consumer SILENTLY: a noexcept assertion, or a function whose own
+    // specification is COMPUTED from this one.
+    static_assert(noexcept(domain.IsCompatibilitySwitchSet(name)),
+                  "IsCompatibilitySwitchSet is expected to be noexcept");
+#else
+    static_assert(!noexcept(domain.IsCompatibilitySwitchSet(name)),
+                  "#2250: it forwards to a throwing, mutex-taking call");
+#endif
+
+#if SHARP_RUNTIME_NEGATIVE_SITE == 3
+    // NEGATIVE(appdomain-switch-return-still-bool): static assertion failed
+    //     | static_assert
+    static_assert(std::is_same_v<decltype(domain.IsCompatibilitySwitchSet(name)), bool>,
+                  "the switch query is expected to return bool");
+#else
+    static_assert(std::is_same_v<decltype(domain.IsCompatibilitySwitchSet(name)),
+                                 std::optional<bool>>,
+                  "#2250: explicitly-false and unset must be distinguishable");
+#endif
+
+    // UNCHANGED, and asserted so the fixture proves the change was surgical: the neighbouring
+    // stub accessors keep their types and their noexcept.
+    static_assert(noexcept(domain.getShadowCopyFilesProperty()), "neighbour untouched");
+    return 0;
+}