docs(audit): complete xml linq review

Author: robertvokac

NEXT.md

@@ -26,12 +26,12 @@ Historical session detail belongs in git history and `plan.sqlite3`.
   `Socket::Socket: socket() failed`; this matches the documented requirement
   for local-network permission. The tests remain enabled and need a
   network-permitted final-gate rerun.
-- The first 1,368 audit reports confirm three hundred thirty-two findings. The newly complete
-  50-file `Security.Cryptography` shard passed 80/80 focused tests and adds SR-AUD-331 through
-  SR-AUD-332: `Rfc2898DeriveBytes` inherits a no-op `Dispose` and continues PBKDF2 derivation;
-  HMAC clears direct key storage but retains invertible inner/outer pads. The preceding 43-file
-  `Text.Json` shard passed 147/147 and adds SR-AUD-324 through SR-AUD-330, including an
-  ASan-confirmed dangling JsonNode parent pointer. Earlier work
+- The first 1,406 audit reports confirm three hundred thirty-six findings. The newly complete
+  38-file `Xml.Linq` shard passed 92/92 focused tests and adds SR-AUD-333 through SR-AUD-336:
+  retained children dereference an ASan-confirmed dangling raw parent; namespaces are lost in
+  parse/save; special XML lexical delimiters corrupt output; and registered XObject events never
+  notify. The preceding 50-file `Security.Cryptography` shard passed 80/80 and adds
+  SR-AUD-331 through SR-AUD-332. Earlier work
   confirms that tracked CI omits the
   direct `Collections.Blocking` selective fixture; the boundary validator has
   narrow negative-fixture coverage; `BlockingCollection<T>` has a

audit/AUDIT_FINDINGS_INDEX.md

@@ -338,6 +338,10 @@ identifier (`SR-AUD-###`), severity, status, and concise remediation target.
 | [SR-AUD-330](modules/text-json/include/System/Text/Json/JsonSerializer.hpp.audit.md#sr-aud-330--medium--jsonserializer-deserialize-ignores-its-jsonserializeroptions-argument) | medium | confirmed | `JsonSerializer.hpp`, `JsonSerializerOptions.hpp`, `JsonSerializationTests.cpp` | Both Deserialize overloads discard options, so configured parse controls such as trailing commas, comments, depth, and duplicate policy have no effect. |
 | [SR-AUD-331](modules/security-cryptography/include/System/Security/Cryptography/Rfc2898DeriveBytes.hpp.audit.md#sr-aud-331--high--rfc2898derivebytesdispose-is-inherited-as-a-no-op-and-permits-post-disposal-derivation) | high | confirmed | `DeriveBytes.hpp`, `Rfc2898DeriveBytes.hpp`, `Rfc2898DeriveBytes.cpp`, `HashAlgorithmTests.cpp` | Rfc2898DeriveBytes inherits an empty Dispose, retains password/salt/buffer state, and continues real PBKDF2 derivation after disposal; current .NET disposes its HMAC and clears sensitive state. |
 | [SR-AUD-332](modules/security-cryptography/include/System/Security/Cryptography/HMAC.hpp.audit.md#sr-aud-332--high--hmac-disposal-leaves-invertible-key-derived-pads-resident) | high | confirmed | `HMAC.hpp`, `HMAC.cpp`, `KeyedHashAlgorithm.hpp`, `HashAlgorithmTests.cpp` | Dispose clears direct key storage but leaves inner/outer pads sized and invertible; the audit probe reconstructs the original HMAC key after disposal. |
+| [SR-AUD-333](modules/xml-linq/include/System/Xml/Linq/XObject.hpp.audit.md#sr-aud-333--high--retained-xmllinq-children-dereference-a-destroyed-raw-parent) | high | confirmed | `XObject.hpp`, `XObject.cpp`, `XNode.cpp`, `XContainer.cpp`, `Extensions.hpp`, `XLinqNodeTests.cpp` | A public shared_ptr child outlives its shared_ptr-owned parent while retaining a raw parent pointer; ASan confirms heap-use-after-free at getParentProperty. |
+| [SR-AUD-334](modules/xml-linq/include/System/Xml/Linq/XElement.hpp.audit.md#sr-aud-334--medium--namespace-uri-semantics-are-discarded-by-xmllinq-parse-and-serialization) | medium | confirmed | `XName.hpp`, `XNamespace.hpp`, `XElement.hpp/.cpp`, `XDocument.cpp`, `XLinqSupportTests.cpp` | Parsed prefix text never resolves to an XName URI and writer paths emit only local names; a namespaced programmatic tree serializes/reparses as unqualified XML. |
+| [SR-AUD-335](modules/xml-linq/include/System/Xml/Linq/XCData.hpp.audit.md#sr-aud-335--medium--direct-serializers-emit-or-corrupt-xml-special-lexical-content) | medium | confirmed | `XCData`, `XComment`, `XProcessingInstruction` headers/sources, `XLinqNodeTests.cpp` | CDATA ]]>, comment --, and PI ?> lexical delimiters are emitted without splitting, escaping, or diagnostics; a CDATA round trip loses data. |
+| [SR-AUD-336](modules/xml-linq/include/System/Xml/Linq/XObject.hpp.audit.md#sr-aud-336--medium--changed-and-changing-accept-handlers-but-never-notify-mutations) | medium | confirmed | `XObject.hpp`, `XObjectChange*`, mutation APIs, `XLinqNodeTests.cpp` | Event registration discards handlers; direct mutation leaves a registered Changed callback uninvoked and tests only assert no throw. |
 
 Severity is assessed by reachable impact: **critical** (data loss, security,
 or systemic integrity), **high** (crash, corruption, major contract break),

audit/AUDIT_MANIFEST.md

@@ -14,8 +14,8 @@ mirrored report exists and contains evidence rather than a boilerplate verdict.
 | Consumer fixtures and validator tests | 16 | 16 | AUDITED |
 | Integration tests | 7 | 7 | AUDITED |
 | Benchmarks | 1 | 1 | AUDITED |
-| 41 runtime modules (source, headers, tests, module docs/CMake) | 1,699 | 1,319 | IN PROGRESS |
-| **Total** | **1,748** | **1,368** | **IN PROGRESS** |
+| 41 runtime modules (source, headers, tests, module docs/CMake) | 1,699 | 1,357 | IN PROGRESS |
+| **Total** | **1,748** | **1,406** | **IN PROGRESS** |
 
 The module shard is processed in dependency/risk order rather than directory
 order: component boundaries and `Core.Base` first, then collections, IO/text,

audit/AUDIT_PROGRESS.md

@@ -6,8 +6,8 @@
 - Scope frozen from a clean `feature/work` source checkout; audit artifacts
   are the only expected working-tree changes.
 - Eligible files: 1,748.  Excluded tracked files: 33.
-- Completed per-file reports: 1,368 (78.3% of eligible scope; 1,319/1,699 runtime-module files).
-- Confirmed findings: 332 (eighty-three high, two hundred thirty-eight medium, eleven low).  Open risks: 2 documented-adaptation questions.  Blocked reviews: 2 environment-limited validation runs.
+- Completed per-file reports: 1,406 (80.4% of eligible scope; 1,357/1,699 runtime-module files).
+- Confirmed findings: 336 (eighty-four high, two hundred forty-one medium, eleven low).  Open risks: 2 documented-adaptation questions.  Blocked reviews: 2 environment-limited validation runs.
 
 ## Initial validation evidence
 
@@ -40,12 +40,12 @@ the full gate during final audit reconciliation.
 
 ## Latest checkpoint
 
-The complete 50-file `Security.Cryptography` shard is mirrored. Its focused
-target passed 80/80. Direct probes confirm SR-AUD-331 and SR-AUD-332: PBKDF2
-inherits a no-op `Dispose`, continuing to derive bytes and retain state, while
-HMAC disposal clears only its direct key and leaves invertible inner/outer pads
-resident. The preceding 43-file `Text.Json` target passed 147/147. Audit-only:
-no production or test source was changed.
+The complete 38-file `Xml.Linq` shard is mirrored. Its focused target passed
+92/92. Direct probes confirm SR-AUD-333 through SR-AUD-336: retained children
+use an ASan-confirmed dangling raw parent; namespace URI identity is lost in
+parse/save; lexical CDATA/comment/PI delimiters corrupt or emit invalid XML;
+and XObject events accept handlers but never notify. Audit-only: no production
+or test source was changed.
 
 ## Resume point
 

audit/modules/xml-linq/CMakeLists.txt.audit.md

@@ -0,0 +1,20 @@
+# Audit: `modules/xml-linq/CMakeLists.txt`
+
+## Metadata
+
+- Audit status: AUDITED.
+- Component: `Xml.Linq`.
+- Validation: `SharpRuntimeTests_Xml_Linq` built and passed 92/92 on 2026-07-27.
+- Direct evidence: `/tmp/sharp-runtime-xml-linq-audit/xml_linq_probe`; SR-AUD-333 was rebuilt with ASan/UBSan against Xml.Linq sources.
+
+## Assessment
+
+The static module declares the documented Core.Base and Xml public dependencies; no dependency-boundary divergence was found.
+
+## Missing assertions and diagnostics
+
+Keep a selective consumer closure build for Xml.Linq in CI.
+
+## Final assessment
+
+AUDITED; component-scoped evidence and confirmed findings are recorded in the audit index.

audit/modules/xml-linq/README.md.audit.md

@@ -0,0 +1,20 @@
+# Audit: `modules/xml-linq/README.md`
+
+## Metadata
+
+- Audit status: AUDITED.
+- Component: `Xml.Linq`.
+- Validation: `SharpRuntimeTests_Xml_Linq` built and passed 92/92 on 2026-07-27.
+- Direct evidence: `/tmp/sharp-runtime-xml-linq-audit/xml_linq_probe`; SR-AUD-333 was rebuilt with ASan/UBSan against Xml.Linq sources.
+
+## Assessment
+
+The README correctly describes the compiled Xml.Linq component and its dependencies.
+
+## Missing assertions and diagnostics
+
+Document the confirmed raw-parent lifetime, namespace, lexical-serialization, and event limitations when remediation is planned.
+
+## Final assessment
+
+AUDITED; component-scoped evidence and confirmed findings are recorded in the audit index.

audit/modules/xml-linq/include/System/Xml/Linq/Extensions.hpp.audit.md

@@ -0,0 +1,25 @@
+# Audit: `modules/xml-linq/include/System/Xml/Linq/Extensions.hpp`
+
+## Metadata
+
+- Audit status: AUDITED.
+- Component: `Xml.Linq`.
+- Validation: `SharpRuntimeTests_Xml_Linq` built and passed 92/92 on 2026-07-27.
+- Direct evidence: `/tmp/sharp-runtime-xml-linq-audit/xml_linq_probe`; SR-AUD-333 was rebuilt with ASan/UBSan against Xml.Linq sources.
+
+## Assessment
+
+This hierarchy path follows the raw parent pointer declared by XObject.
+Retained children can outlive their shared_ptr-owned parent; ASan confirms
+SR-AUD-333 at the first parent query. Sibling navigation, mutation,
+document-order comparison, and extension ancestor traversal share the same
+unsafe ownership assumption.
+
+## Missing assertions and diagnostics
+
+Add post-parent-destruction ASan regressions for this operation, not only
+normal attached-tree behavior.
+
+## Final assessment
+
+AUDITED; SR-AUD-333 applies to this raw-parent traversal path.

audit/modules/xml-linq/include/System/Xml/Linq/LoadOptions.hpp.audit.md

@@ -0,0 +1,20 @@
+# Audit: `modules/xml-linq/include/System/Xml/Linq/LoadOptions.hpp`
+
+## Metadata
+
+- Audit status: AUDITED.
+- Component: `Xml.Linq`.
+- Validation: `SharpRuntimeTests_Xml_Linq` built and passed 92/92 on 2026-07-27.
+- Direct evidence: `/tmp/sharp-runtime-xml-linq-audit/xml_linq_probe`; SR-AUD-333 was rebuilt with ASan/UBSan against Xml.Linq sources.
+
+## Assessment
+
+The option enum values and bitwise operators match their documented values; several corresponding consumers are intentionally absent or no-op.
+
+## Missing assertions and diagnostics
+
+Add behavior tests for every accepted option, especially namespace output and load metadata, not only integer flag values.
+
+## Final assessment
+
+AUDITED; component-scoped evidence and confirmed findings are recorded in the audit index.

audit/modules/xml-linq/include/System/Xml/Linq/ReaderOptions.hpp.audit.md

@@ -0,0 +1,20 @@
+# Audit: `modules/xml-linq/include/System/Xml/Linq/ReaderOptions.hpp`
+
+## Metadata
+
+- Audit status: AUDITED.
+- Component: `Xml.Linq`.
+- Validation: `SharpRuntimeTests_Xml_Linq` built and passed 92/92 on 2026-07-27.
+- Direct evidence: `/tmp/sharp-runtime-xml-linq-audit/xml_linq_probe`; SR-AUD-333 was rebuilt with ASan/UBSan against Xml.Linq sources.
+
+## Assessment
+
+The option enum values and bitwise operators match their documented values; several corresponding consumers are intentionally absent or no-op.
+
+## Missing assertions and diagnostics
+
+Add behavior tests for every accepted option, especially namespace output and load metadata, not only integer flag values.
+
+## Final assessment
+
+AUDITED; component-scoped evidence and confirmed findings are recorded in the audit index.

audit/modules/xml-linq/include/System/Xml/Linq/SaveOptions.hpp.audit.md

@@ -0,0 +1,20 @@
+# Audit: `modules/xml-linq/include/System/Xml/Linq/SaveOptions.hpp`
+
+## Metadata
+
+- Audit status: AUDITED.
+- Component: `Xml.Linq`.
+- Validation: `SharpRuntimeTests_Xml_Linq` built and passed 92/92 on 2026-07-27.
+- Direct evidence: `/tmp/sharp-runtime-xml-linq-audit/xml_linq_probe`; SR-AUD-333 was rebuilt with ASan/UBSan against Xml.Linq sources.
+
+## Assessment
+
+The option enum values and bitwise operators match their documented values; several corresponding consumers are intentionally absent or no-op.
+
+## Missing assertions and diagnostics
+
+Add behavior tests for every accepted option, especially namespace output and load metadata, not only integer flag values.
+
+## Final assessment
+
+AUDITED; component-scoped evidence and confirmed findings are recorded in the audit index.