fix(core): System::ValueType is no longer directly constructible (#2322, SR-AUD-068)

'System::ValueType v;' compiled, where .NET declares 'public abstract class
ValueType'. Landed under SA-8, option B of the review's three, and the same
shape as #2339.

PROTECTED, NOT ABSTRACT, AND DELIBERATELY SO. A C++ class becomes abstract only
by having a pure virtual, and .NET's ValueType.ToString() has a real body -- so
making one pure here would invent surface the reference does not have. The
protected constructor gets the property that matters: base yes, object no. A
static_assert records that is_abstract_v<ValueType> is intentionally false, so a
later reader does not 'finish the job'. The copy and move members are protected
too, closing the slicing route the review did not enumerate.

A PREMISE THE REVIEW GOT WRONG, corrected here: it recorded that 'the only
derived types anywhere are SimpleValueType and ConcreteValueType in
ValueTypeTests.cpp'. That was true of DERIVATIONS and missed five direct
INSTANTIATIONS in Batch15TypesTests.cpp, which the compiler found immediately.

WHAT IS NOT REPAIRED AND CANNOT BE, now declared rather than left to be
rediscovered as bugs: .NET's Equals and GetHashCode compare FIELDS and its
ToString returns the RUNTIME TYPE NAME, where this port returns identity, an
address-derived hash and the literal 'System.ValueType'. All three are
reflection, and a C++ base class can neither enumerate a derived class's fields
nor learn its name. A test pins all three.

Fixture set: 23 fixtures / 155 sites. Downstream #2370: zero occurrences in
either consumer. Gate 17,299 run, 0 failed.

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,71 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Copyright (c) Robert Vokac and contributors -->
+
+# Migration — `System::ValueType` is no longer directly constructible (ticket #2322)
+
+*2026-08-18.* `System::ValueType v;` compiled. .NET declares `public abstract class ValueType`,
+so C# rejects the equivalent.
+
+Landed under `docs/StandingApprovals.md` **SA-8** with SA-2's five conditions. Same shape as
+#2339 (`Attribute`). No layout, vtable or `noexcept` change.
+
+---
+
+## 1. What changed
+
+| Spelling | Was | Is |
+|---|---|---|
+| `System::ValueType v;` | compiled | **rejected** |
+| `new System::ValueType()` | compiled | **rejected** |
+| `ValueType sliced = derived;` | compiled | **rejected** — the copy member went protected too |
+| `std::is_default_constructible_v<ValueType>` | `true` | **`false`** |
+| `class MyValue : public ValueType {};` | — | **unchanged**, and the only intended use |
+
+## 2. Protected, not abstract — deliberately
+
+.NET's class is `abstract`. A C++ class becomes abstract only by having a **pure virtual**, and
+.NET's `ValueType.ToString()` has a real body — so making one pure here would invent surface the
+reference does not have. The protected constructor gets the property that actually matters: the
+type can still be a base, and can no longer be an object. A `static_assert` records that
+`is_abstract_v<ValueType>` is deliberately `false`.
+
+## 3. What was NOT repaired, and cannot be
+
+.NET's `Equals` and `GetHashCode` compare **fields**, and its `ToString()` returns
+`this.GetType().ToString()` — the **runtime type name**. This port returns identity, an
+address-derived hash, and the literal `"System.ValueType"`.
+
+All three are **reflection**, permanently out of scope per `CLAUDE.md`, and a C++ base class can
+neither enumerate a derived class's fields nor learn its name. A test pins all three as
+declarations rather than leaving them to be rediscovered as bugs.
+
+A derived type that needs value semantics must override `Equals` **and** `GetHashCode` together —
+both are already `virtual`, so #2322 invented no hook for it — and `ToString` if it wants its own
+name.
+
+## 4. A premise the review got wrong
+
+The #2322 review recorded that *"the only derived types anywhere are `SimpleValueType` and
+`ConcreteValueType` in `ValueTypeTests.cpp`"*. That was true of **derivations** and missed five
+direct **instantiations** in `Batch15TypesTests.cpp`, which the compiler found immediately. They
+now go through a local probe, which is what a caller has to do too.
+
+## 5. To migrate
+
+Derive:
+
+```cpp
+// before
+System::ValueType v;
+
+// after
+class MyValue : public System::ValueType {};
+MyValue v;
+```
+
+A reference or pointer to the base is unaffected.
+
+## 6. Downstream, measured
+
+Neither `cna` nor `mobile-eggbert` mentions `System::ValueType` — **zero occurrences in both**.
+Neither repository was modified. The downstream ticket is **#2370**.

audit/AUDIT_FINDINGS_INDEX.md

@@ -14,13 +14,42 @@ namespace System {
 /**
  * @brief Provides the base class for value types.
  *
- * C++ counterpart of .NET System.ValueType. In .NET, ValueType is the implicit
- * base of all struct types; it overrides Equals and GetHashCode to perform
- * field-by-field comparison via reflection. In C++ there is no reflection, so
- * the defaults here fall back to object identity. Concrete value-type structs
- * should override Equals() and GetHashCode() to match .NET field-equality semantics.
+ * C++ counterpart of .NET System.ValueType, which is `public abstract class ValueType`. In .NET
+ * it is the implicit base of every struct type and overrides Equals/GetHashCode to compare
+ * field-by-field through reflection.
+ *
+ * @par The constructor is protected, since ticket #2322
+ * `System::ValueType v;` used to compile. .NET's class is **abstract**, so C# rejects the
+ * equivalent. A C++ class becomes abstract only by having a pure virtual, and .NET's
+ * `ValueType.ToString()` has a real body — so making one pure here would be inventing surface
+ * the reference does not have. The protected constructor is the faithful move instead, and it
+ * gets the property that matters: the type can still be a base, and can no longer be an object.
+ * The copy and move members are protected with it, so the base cannot be reached by a slice.
+ *
+ * @par The identity defaults are a PERMANENT DEVIATION, not a TODO
+ * .NET's Equals and GetHashCode compare fields, and its ToString returns the **runtime type
+ * name** (`this.GetType().ToString()`); this port returns the literal `"System.ValueType"`. All
+ * three are **reflection**, which `CLAUDE.md` lists as permanently out of scope, and a C++ base
+ * class cannot enumerate a derived class's fields or learn its name. The gap is therefore not
+ * closable rather than merely unclosed.
+ *
+ * A derived type that needs value semantics must override `Equals` **and** `GetHashCode`
+ * together — both are already `virtual`, so no new hook was invented for it — and `ToString` if
+ * it wants its own name. Overriding only one of the first two breaks the equals/hash contract
+ * silently.
  */
 class ValueType {
+protected:
+    /**
+     * @brief Protected default constructor. See the class doc-comment for why this, and not an
+     *        abstract class, is the faithful counterpart of .NET's `public abstract`.
+     */
+    ValueType() = default;
+    ValueType(const ValueType&) = default;
+    ValueType(ValueType&&) = default;
+    ValueType& operator=(const ValueType&) = default;
+    ValueType& operator=(ValueType&&) = default;
+
 public:
     virtual ~ValueType() = default;
 
@@ -45,7 +74,9 @@ class ValueType {
     /**
      * @brief Returns a string representation of this instance.
      *
-     * C++ counterpart of .NET ValueType.ToString().
+     * C++ counterpart of .NET ValueType.ToString(), which returns `this.GetType().ToString()` —
+     * the RUNTIME TYPE NAME. This literal is a permanent deviation: naming the runtime type is
+     * reflection. A derived type that wants its own name must override this.
      */
     virtual std::string ToString() const { return "System.ValueType"; }
 };

docs/Migration-ValueTypeProtectedConstructor.md

@@ -165,28 +165,40 @@ TEST(BadImageFormatExceptionExtraTests, DefaultCtor_EmptyFileName) {
 // ===========================================================================
 // ValueType
 // ===========================================================================
+//
+// #2322 made System::ValueType's constructor protected, matching .NET's `public abstract class
+// ValueType`. These five tests were direct instantiations of the base -- and the #2322 review
+// did NOT find them: it recorded that "the only derived types anywhere are SimpleValueType and
+// ConcreteValueType in ValueTypeTests.cpp", which was true of DERIVATIONS and missed these
+// INSTANTIATIONS in a different file. They now go through a local probe, which is what a caller
+// has to do too.
+
+namespace {
+/// The minimal legal way to reach the base after #2322.
+class ProbeValueType : public System::ValueType {};
+}  // namespace
 
 TEST(ValueTypeTests, DefaultCtor_Works) {
-    System::ValueType vt;
+    ProbeValueType vt;
     (void)vt;
     SUCCEED();
 }
 TEST(ValueTypeTests, GetHashCode_ReturnsInt) {
-    System::ValueType vt;
+    ProbeValueType vt;
     int h = vt.GetHashCode();
     (void)h;
     SUCCEED();
 }
 TEST(ValueTypeTests, ToString_NonEmpty) {
-    System::ValueType vt;
+    ProbeValueType vt;
     EXPECT_FALSE(vt.ToString().empty());
 }
 TEST(ValueTypeTests, Equals_SameObject) {
-    System::ValueType vt;
+    ProbeValueType vt;
     EXPECT_TRUE(vt.Equals(vt));
 }
 TEST(ValueTypeTests, Equals_DifferentObjects_False) {
-    System::ValueType a, b;
+    ProbeValueType a, b;
     EXPECT_FALSE(a.Equals(b));
 }
 

modules/core/include/System/ValueType.hpp

@@ -2,6 +2,7 @@
 // Copyright (c) Robert Vokac and contributors
 // Portions based on .NET runtime API (MIT License, Copyright .NET Foundation and Contributors)
 #include <gtest/gtest.h>
+#include <type_traits>
 #include "System/ValueType.hpp"
 
 using System::ValueType;
@@ -55,3 +56,42 @@ TEST(ValueTypeTest, BaseToString) {
     EXPECT_EQ(p->ToString(), "3");
     delete p;
 }
+
+// ---------------------------------------------------------------------------
+// #2322 / SR-AUD-068 — the base is no longer directly constructible
+// ---------------------------------------------------------------------------
+
+TEST(ValueTypeContractTests, Fix2322_TheBaseIsNoLongerDirectlyConstructible) {
+    // .NET declares `public abstract class ValueType`, so C# rejects the equivalent of
+    // `System::ValueType v;`. This port compiled it until #2322.
+    static_assert(!std::is_default_constructible_v<ValueType>,
+                  "#2322: the constructor is protected");
+    static_assert(!std::is_copy_constructible_v<ValueType>,
+                  "#2322: and the copy member went with it, so the base cannot be sliced out");
+    static_assert(std::is_default_constructible_v<SimpleValueType>,
+                  "a derived type must still be constructible -- that is the point");
+
+    // NOT abstract, and the distinction is deliberate rather than an oversight: a C++ class is
+    // abstract only by having a pure virtual, and .NET's ValueType.ToString() has a real body, so
+    // making one pure here would invent surface the reference does not have. The protected
+    // constructor gets the property that matters -- base yes, object no.
+    static_assert(!std::is_abstract_v<ValueType>,
+                  "#2322 deliberately did NOT invent a pure virtual to force abstractness");
+}
+
+TEST(ValueTypeContractTests, Decl2322_TheIdentityDefaultsArePermanentDeviations) {
+    // NOT A REPAIR -- A DECLARATION. .NET's Equals and GetHashCode compare fields and its
+    // ToString returns the runtime type name. All three are reflection, permanently out of scope
+    // per CLAUDE.md, and a C++ base class can neither enumerate a derived class's fields nor
+    // learn its name.
+    SimpleValueType a, b;
+    EXPECT_FALSE(a.Equals(b)) << "identity, not value -- .NET would compare fields";
+    EXPECT_TRUE(a.Equals(a));
+
+    // The ToString literal is the third of the three, and the one most easily mistaken for a bug.
+    EXPECT_EQ("System.ValueType", a.ToString())
+        << "the runtime type name is reflection; a derived type must override this itself";
+
+    // Both hooks a derived type needs are already virtual, which is why #2322 invented none.
+    static_assert(std::is_polymorphic_v<ValueType>, "Equals/GetHashCode/ToString are virtual");
+}

modules/core/tests/System/Batch15TypesTests.cpp

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) Robert Vokac and contributors
+//
+// Negative compile fixture for ticket #2322 (SR-AUD-068).
+//
+// #2322 made System::ValueType's constructor protected. .NET declares
+// `public abstract class ValueType`, so C# rejects the equivalent of
+// `System::ValueType v;`; this port compiled it.
+//
+// It is protected rather than abstract on purpose: a C++ class becomes
+// abstract only by having a pure virtual, and .NET's ValueType.ToString() has a
+// real body, so making one pure here would invent surface the reference does
+// not have. The protected constructor gets the property that matters -- the
+// type can still be a base, and can no longer be an object -- and the copy and
+// move members went protected with it, so the base cannot be sliced out either.
+//
+// Each spelling is compiled on its own below; the #else branches are the
+// migrated ones. Migration: derive.
+//
+// Records: docs/Migration-ValueTypeProtectedConstructor.md,
+// docs/NegativeConsumerFixtureValidation.md.
+//
+// NEGATIVE-FIXTURE: component=Core.Base
+#include <type_traits>
+
+#include "System/ValueType.hpp"
+
+#ifndef SHARP_RUNTIME_NEGATIVE_SITE
+#define SHARP_RUNTIME_NEGATIVE_SITE 0
+#endif
+
+using System::ValueType;
+
+namespace {
+/// The migrated shape: derive from the base rather than instantiating it.
+class MyValue : public ValueType {};
+}  // namespace
+
+int main() {
+#if SHARP_RUNTIME_NEGATIVE_SITE == 1
+    // NEGATIVE(valuetype-direct-instantiation): is protected within this context
+    //     | protected
+    ValueType direct;
+    (void)direct;
+#else
+    MyValue direct;
+    (void)direct;
+#endif
+
+#if SHARP_RUNTIME_NEGATIVE_SITE == 2
+    // NEGATIVE(valuetype-heap-instantiation): is protected within this context
+    //     | protected
+    ValueType* heap = new ValueType();
+    delete heap;
+#else
+    ValueType* heap = new MyValue();
+    delete heap;
+#endif
+
+#if SHARP_RUNTIME_NEGATIVE_SITE == 3
+    // NEGATIVE(valuetype-copy-slice): is protected within this context
+    //     | protected
+    //     | use of deleted function
+    MyValue derived;
+    ValueType sliced = derived;
+    (void)sliced;
+#else
+    MyValue derived;
+    const ValueType& notSliced = derived;
+    (void)notSliced;
+#endif
+
+#if SHARP_RUNTIME_NEGATIVE_SITE == 4
+    // NEGATIVE(valuetype-still-default-constructible): static assertion failed
+    //     | static_assert
+    // The shape that breaks a consumer SILENTLY: a trait query, or a template constrained on one.
+    static_assert(std::is_default_constructible_v<ValueType>,
+                  "ValueType is expected to be default-constructible");
+#else
+    static_assert(!std::is_default_constructible_v<ValueType>,
+                  "#2322: the constructor is protected");
+    static_assert(std::is_default_constructible_v<MyValue>,
+                  "#2322: a derived type is still constructible -- that is the point");
+    static_assert(!std::is_abstract_v<ValueType>,
+                  "#2322 deliberately did NOT invent a pure virtual to force abstractness");
+#endif
+
+    return 0;
+}