refactor(component-model)!: six attributes get .NET's get-only shape (#2403)

Six System::ComponentModel attributes published a BARE MUTABLE PUBLIC DATA
MEMBER where .NET publishes a get-only property, and most had no Yes/No/Default
statics and no equality members at all.

WHAT MAKES THIS MORE THAN A STYLE POINT IS THAT THE PORT WAS INCONSISTENT WITH
ITSELF INSIDE ONE FILE. CategoryAttribute, BrowsableAttribute,
DisplayNameAttribute and DescriptionAttribute -- in that very header and its
neighbour -- already had the correct shape: private member, getXxxProperty(),
the static set, and Equals/GetHashCode/getIsDefaultAttributeProperty. The other
six did not:

  ReadOnlyAttribute             public bool IsReadOnly, Yes/No, NO Default
  ImmutableObjectAttribute      public bool Immutable, no statics
  LocalizableAttribute          public bool IsLocalizable, no statics
  MergablePropertyAttribute     public bool AllowMerge, no statics
  NotifyParentPropertyAttribute public bool NotifyParent, no statics
  RefreshPropertiesAttribute    public Refresh RefreshProperties_, no statics

All six are now `final` for .NET's `sealed`, with a get-only accessor, the full
static set, and the three equality members.

REFRESHPROPERTIES BECOMES A TOP-LEVEL ENUM. .NET declares it in its own file
(RefreshProperties.cs); this port nested it as RefreshPropertiesAttribute::Refresh,
differing in BOTH the name and the scope.

THE DEFAULTS ARE NOT UNIFORM AND THAT IS .NET'S.
MergablePropertyAttribute.Default is YES (MergablePropertyAttribute.cs:12) where
the other four boolean attributes default to NO, and BrowsableAttribute.Default
is Yes too, which this port already had right. A repair that "harmonised" the
five would be wrong HERE AND NOWHERE ELSE, so the asymmetry is pinned in one
case rather than scattered as five unrelated literals.

ONE DIVERGENCE IS DELIBERATE AND IS PINNED. .NET's GetHashCode for all six is
base.GetHashCode() -- IDENTITY -- while its Equals is VALUE-based, so two equal
.NET instances can hash differently: a hash-contract violation in the reference
itself. This port does not reproduce it, and the reason is WRITTEN DOWN RATHER
THAN CHOSEN -- System/Attribute.hpp's own doc-comment states the house rule ("A
subclass that needs value equality must override BOTH Equals and GetHashCode ...
Overriding only one breaks the equals/hashCode contract") and the four
already-correct siblings use a value hash. Reproducing .NET here would
contradict the port's own stated rule and its own neighbours. MUTATION M7
ADOPTS .NET'S IDENTITY HASH AND IS CAUGHT.

THE MODULE'S WHOLE PRIOR COVERAGE FOR THESE SIX WAS CONSTRUCTOR ROUND-TRIPS
THROUGH THE PUBLIC FIELD. Nothing asserted the statics, the equality members or
the defaults, so .NET's Default values -- the actual contract of a metadata
attribute -- were unpinned. Six cases now pin them. That is the point worth
carrying: component-model HAS its own test executable, so "has tests" is not
"is covered".

Landed under SA-8 with SA-2's five conditions. NO VTABLE CHANGE: Equals,
GetHashCode and getIsDefaultAttributeProperty are already virtual on
System::Attribute, so these are overrides of existing slots, not new ones.

First-party migration: 8 sites, all in this module's own test file, every one
named by the compiler. Negative fixture with 8 sites -- a read AND A WRITE for
ReadOnlyAttribute, a read for each of the other five, and one for the enum's
scope. The WRITE earns its own site because it is the spelling a careless
migration would have kept longest: it compiled silently against the old shape
while changing the attribute's meaning. Set 49/248 -> 50/256. Downstream,
measured: zero System::ComponentModel sites in both consumers, recorded as #2404.

Seven mutations, ALL CAUGHT, three at compile time -- the only way C++ reports a
shape.

A PROCESS NOTE WORTH KEEPING. An early build of this change appeared to report
ZERO ERRORS and was nearly taken at face value. The cause: `cmake --build ... -k
200` is NOT keep-going -- `-k` must follow `--`, so CMake printed its usage
banner and exited. That is CLAUDE.md rule 2's own recorded #2395 trap in a new
form, and A MIS-PASSED -k IS WORSE THAN NONE, because it looks like success.

Gate 17,637 / 38 executables: 17,637 run, 17,637 passed, 0 failed, 0 skipped,
recounted from the per-executable logs with every executable run separately and
continuing past failures. +6 on 17,631, in SharpRuntimeTests_ComponentModel
(98 -> 104); no other executable moved. Zero build warnings at --parallel 2;
module boundaries and the generated catalogue green.

Author: robertvokac

CLAUDE.md

@@ -3,8 +3,8 @@
 
 # NEXT.md
 
-> **Test-count floor, 2026-08-19 — 17,631 / 38, AND THE GATE IS GREEN.** The complete
-> 38-executable gate reads **17,631 run: 17,631 passed, 0 failed, 0 skipped**, recounted from the
+> **Test-count floor, 2026-08-20 — 17,637 / 38, AND THE GATE IS GREEN.** The complete
+> 38-executable gate reads **17,637 run: 17,637 passed, 0 failed, 0 skipped**, recounted from the
 > per-executable logs with every executable run separately and continuing past failures, zero build
 > warnings at `--parallel 2`. Every checkpoint below this one ends with *"the gate is not green"*;
 > this one does not. Two of the three historical failure sources were environmental and are simply
@@ -51,11 +51,19 @@
 > name claimed "DiffersAcrossProcesses" while its body only checked within one. §4b has the
 > remaining candidates.
 >
-> **BOTH WORK QUEUES ARE EMPTY AGAIN.** Six tickets were filed and closed on 2026-08-19 by this
-> sweep — #2397, #2398, #2399, #2400 (downstream record), #2401 and #2402. `ticket` has **0
-> `todo`**; `task` has **0** unclassified (14,979 ignored / 1,082 ported / 140 ignore). Ticket
-> totals: **2,385 done, 9 blocked, 1 needs_user, 5 wontfix**. Graph **41 / 94** (#2401 added one
-> private edge), negative fixtures **49 / 248** (#2399 added one). What remains *blocked* needs the user or an external event,
+> **#2403 — `System::ComponentModel`, and the pattern that found it is pattern (2) below.** Six
+> attributes published a **bare mutable public data member** where .NET publishes a get-only
+> property, most with **no statics and no equality members at all** — while four siblings **in the
+> same header** already had the correct shape. The module's whole prior coverage for those six was
+> constructor round-trips through the public field, so .NET's `Default` values — the actual contract
+> of a metadata attribute — were unpinned, and `MergablePropertyAttribute::Default` is `Yes` where
+> its four siblings are `No`.
+>
+> **BOTH WORK QUEUES ARE EMPTY AGAIN.** Eight tickets were filed and closed by this sweep — #2397,
+> #2398, #2399, #2400, #2401, #2402 on 2026-08-19, then #2403 and #2404 on 2026-08-20. `ticket` has
+> **0 `todo`**; `task` has **0** unclassified (14,979 ignored / 1,082 ported / 140 ignore). Ticket
+> totals: **2,387 done, 9 blocked, 1 needs_user, 5 wontfix**. Graph **41 / 94** (#2401 added one
+> private edge), negative fixtures **50 / 256** (#2399 and #2403 added one each). What remains *blocked* needs the user or an external event,
 > and each is itemised in §2 below. **§4b says where to look next, and the method that found all
 > three of today's tickets.**
 
@@ -164,6 +172,7 @@ coverage" and the difference matters:
 | Module | Component | Where it is exercised today |
 |---|---|---|
 | `text-regular-expressions` | `Text.RegularExpressions` | a section of `tests/integration/System/Text/TextRemainingTests.cpp` — **this is the one #2397 measured, and it held four divergences** |
+| *(not in this table)* `component-model` | `ComponentModel` | **has** its own tests, and #2403 still found six attributes with a mutable public representation — so **"has tests" is not "is covered"** |
 | `io-compression-zip` | `IO.Compression.Zip` | `tests/integration/System/IO/Compression/CompressionTests.cpp` (145 cases in the file, covering the whole namespace) |
 | `security-cryptography-random` | `Security.Cryptography.Random` | **exhausted — measured by #2398 and #2399, and both found real defects.** Its three shipped cases could not fail: each asserted a buffer's size *after* filling a buffer sized before the call |
 | `storage` | `Storage` | `tests/integration/Task39RemainingTests.cpp` (78 cases in the file) — one header, `StoragePaths` |

NEXT.md

@@ -0,0 +1,114 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Copyright (c) Robert Vokac and contributors -->
+
+# Migration — six `System::ComponentModel` attributes get .NET's shape (ticket #2403)
+
+*2026-08-20.* Six attributes published a **bare mutable public data member** where .NET publishes a
+**get-only property**, and most were missing their `Yes`/`No`/`Default` statics and their equality
+members entirely.
+
+Landed under **SA-8** (*"where this port publishes a mutable or public representation and .NET's is
+private, readonly or absent, match .NET and migrate the first-party sites"*) with **SA-2**'s five
+conditions, since removing a public data member is a public source break.
+
+**No vtable change**: `Equals`, `GetHashCode` and `getIsDefaultAttributeProperty` are already
+`virtual` on `System::Attribute`, so these are overrides of existing slots, not new ones.
+
+**Downstream, measured:** **zero** sites of any kind in `cna` and in `mobile-eggbert`. Downstream
+record: **#2404**.
+
+---
+
+## 1. What made this more than a style point
+
+**The port was inconsistent with itself inside one file.** `CategoryAttribute`,
+`BrowsableAttribute`, `DisplayNameAttribute` and `DescriptionAttribute` — in that very header and
+its neighbour — already had the correct shape: private member, `getXxxProperty()`, the static set,
+and `Equals`/`GetHashCode`/`getIsDefaultAttributeProperty`. The other six did not.
+
+| Type | Was | Now (= .NET) |
+|---|---|---|
+| `ReadOnlyAttribute` | `public bool IsReadOnly`; `Yes`/`No`, **no `Default`** | `getIsReadOnlyProperty()`; `Yes`/`No`/`Default` |
+| `ImmutableObjectAttribute` | `public bool Immutable`; **no statics** | `getImmutableProperty()`; `Yes`/`No`/`Default` |
+| `LocalizableAttribute` | `public bool IsLocalizable`; no statics | `getIsLocalizableProperty()`; `Yes`/`No`/`Default` |
+| `MergablePropertyAttribute` | `public bool AllowMerge`; no statics | `getAllowMergeProperty()`; `Yes`/`No`/`Default` |
+| `NotifyParentPropertyAttribute` | `public bool NotifyParent`; no statics | `getNotifyParentProperty()`; `Yes`/`No`/`Default` |
+| `RefreshPropertiesAttribute` | `public Refresh RefreshProperties_`; no statics | `getRefreshPropertiesProperty()`; `All`/`Repaint`/`Default` |
+
+All six are now `final`, matching .NET's `public sealed class`, and all six gained
+`Equals`/`GetHashCode`/`getIsDefaultAttributeProperty`.
+
+## 2. `RefreshProperties` is a top-level enum
+
+.NET declares `public enum RefreshProperties` in its **own file** (`RefreshProperties.cs`). This
+port nested it as `RefreshPropertiesAttribute::Refresh`, differing in **both the name and the
+scope**. It is now top-level, with .NET's values (`None = 0`, `All = 1`, `Repaint = 2`).
+
+**Migration:** `RefreshPropertiesAttribute::Refresh::All` becomes `RefreshProperties::All`.
+
+## 3. The defaults are not uniform, and that is .NET's
+
+**`MergablePropertyAttribute::Default` is `Yes`** (`MergablePropertyAttribute.cs:12`), where the
+other four boolean attributes default to `No`. `BrowsableAttribute::Default` is `Yes` too
+(`BrowsableAttribute.cs:32`), and this port already had that right.
+
+A repair that "harmonised" the five would be wrong **here and nowhere else**, which is why the
+asymmetry carries a pin of its own — asserted in one case, so it reads as an asymmetry rather than
+as five unrelated literals.
+
+## 4. One divergence is deliberate: `GetHashCode`
+
+**.NET's `GetHashCode` for all six is `base.GetHashCode()` — identity — while its `Equals` is
+value-based.** Two equal .NET instances can therefore hash differently: a hash-contract violation in
+the reference itself.
+
+**This port does not reproduce it, and the reason is written down rather than chosen.**
+`System/Attribute.hpp`'s own doc-comment states the house rule in terms:
+
+> A subclass that needs value equality must override **both** `Equals` and `GetHashCode` … Overriding
+> only one breaks the equals/hashCode contract.
+
+and the four already-correct siblings in this very header use a value-based hash. Reproducing .NET
+here would contradict the port's own stated rule *and* its own neighbours. The divergence is pinned:
+mutation M7 replaces the value hash with .NET's identity hash and **is caught**.
+
+## 5. What a caller has to change
+
+| Was | Now |
+|---|---|
+| `attr.IsReadOnly` | `attr.getIsReadOnlyProperty()` |
+| `attr.Immutable` | `attr.getImmutableProperty()` |
+| `attr.IsLocalizable` | `attr.getIsLocalizableProperty()` |
+| `attr.AllowMerge` | `attr.getAllowMergeProperty()` |
+| `attr.NotifyParent` | `attr.getNotifyParentProperty()` |
+| `attr.RefreshProperties_` | `attr.getRefreshPropertiesProperty()` |
+| `RefreshPropertiesAttribute::Refresh::X` | `RefreshProperties::X` |
+
+**There is no replacement for *writing* one, deliberately.** .NET publishes no setter, and a caller
+that needs a different value constructs a different attribute — or uses the `Yes`/`No`/`Default`
+statics, which #2403 also completed. A metadata attribute a caller can retarget after construction
+is not metadata, and **the write is the spelling that would have survived a careless migration
+longest**, because it compiled silently against the old shape while changing the attribute's
+meaning. It gets its own negative-fixture site for that reason.
+
+## 6. Testing
+
+First-party migration: **8 sites**, all in this module's own test file, every one named by the
+compiler. Negative consumer fixture
+`test/consumer/component_model_attribute_representation_negative.cpp`, **8 sites** — a read and a
+**write** for `ReadOnlyAttribute`, a read for each of the other five, and one for the enum's scope.
+Fixture set **49 / 248 → 50 / 256**.
+
+**The module's whole prior coverage for these six was constructor round-trips through the public
+field.** Nothing asserted the statics, the equality members or the defaults — so .NET's `Default`
+values, which are the actual contract of a metadata attribute, were unpinned. Six cases now pin
+them.
+
+Seven mutations, **all caught**, three of them at compile time (`static_assert` for the seals, and
+the enum's scope) — which is the only way C++ reports a shape.
+
+**A process note worth keeping.** An early build of this change appeared to report **zero errors**
+and was very nearly taken at face value. The cause: `cmake --build … -k 200` is not keep-going —
+`-k` must follow `--`, and CMake was printing its usage banner and exiting. This is `CLAUDE.md` rule
+2's recorded #2395 trap in a new form: *the build stops at the first failing translation unit unless
+`-k` is passed*, and a mis-passed `-k` is worse than none, because it looks like success.