feat(numerics,uri,text-json,time-zone,xml-linq,threading): six needs_user tickets answered and landed (#2170, #2390, #2391, #2118, #2185, #1899)

All six were `needs_user`; all six were answered on 2026-08-19 and are written up as
SA-12 and SA-13 in docs/StandingApprovals.md. Two were decided AGAINST the
recommendation on the record -- that is the user's call, and the reasoning is
preserved so the trade stays visible rather than relitigated.

#2170 -- TotalOrderIeee754Comparer gains the IEqualityComparer<T> base, buying
polymorphic binding and nothing else; before it, passing one where the interface
is required was a COMPILE ERROR, so no call site can have depended on the old
behaviour. sizeof 8 -> 16, subobject at offset 8, pinned as an OFFSET because a
bare sizeof does not discriminate a single base that merely grew. The growth has
no .NET counterpart -- .NET's comparer is a readonly struct and a C# struct pays
nothing to implement an interface. IEquatable<> deliberately not reproduced.
Module graph unchanged at 41/93. Five mutations, all caught. A divergence the
ticket did not name was found and deliberately NOT bundled: GetHashCode hashes
the bit pattern where .NET hashes the value, filed as #2392.

#2390 -- SA-12, a GENERAL RULE rather than a decision about one type: where this
port has a real creator, `internal` members become private with that creator a
friend; where it has none, they stay public and the divergence is recorded in the
header. Both mechanical alternatives declined for stated reasons.

#2391 -- UriBuilder::Equals/GetHashCode delegate to the built Uri. #2004's
non-throwing guarantee is WITHDRAWN knowingly. It is a convergence rather than a
reversal: #2004's own justification had already become false when #1995 made
Uri::GetHashCode hash a canonical identity key. Five mutations, all caught -- M1
only after the test meant to catch it was rewritten, and probing the premise
instead of trusting it uncovered #2393.

#2118, #2185, #1899 change no production statement -- decisions and their
evidence, the shape of #2202/#2015/#2324. #2118 declares GetRawText's re-rendering
(nlohmann retains no source spans). #2185 makes SR-AUD-228 a PERMANENT deviation
on two measurements. #1899 closes carrying its own impossibility proof, with both
premises pinned.

Gate: 17,543 run, 17,543 passed, 0 failed, 0 skipped across 38 executables (+10).
Build directory: build/ only, --parallel 2 throughout. No script needed special
handling.

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,49 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Declaration — `JsonElement::GetRawText()` re-renders and will not preserve source text (#2118)
+
+Ticket **#2118** (SR-AUD-325, cause TJ-D), decided 2026-08-19. **It changes no production
+statement**: it is a decision and its evidence, the shape of #2202, #2015 and #2324.
+
+## The contract, and what this port does instead
+
+.NET's `JsonElement.GetRawText()` is `_parent.GetRawValueAsString(_idx)`
+(`JsonElement.cs:1196-1201`), which slices the **original document bytes** and transcodes them
+(`JsonDocument.cs:700-704`). Nothing is re-rendered.
+
+This port holds a *parsed* `nlohmann` tree. **`nlohmann`'s DOM retains no source spans at all**, so
+`dump()` can only re-render from the parsed value:
+
+| source | .NET returns | this port returns |
+|---|---|---|
+| `1e+01` | `1e+01` | `10.0` |
+| `1.10` | `1.10` | `1.1` |
+| `"a"` | `"a"` | `"a"` |
+| `{ "a" : 1 }` | `{ "a" : 1 }` | `{"a":1}` |
+
+## Why declared rather than repaired
+
+Honouring the contract means `JsonDocument` retaining the original text **and every `JsonElement`
+carrying an offset and length into it** — an object-layout change to *both* types, and a parse-time
+and memory cost paid by **every** caller whether or not `GetRawText` is ever called. That was
+offered and **declined**; #2117 had already grown `JsonElement` 48 → 56 in the same session, and
+this would have grown it again to buy a member most callers never touch.
+
+Note what the gate was *not*: the `/rv RE-VERIFIED ABSENT` line in the ticket's notes was stale, and
+the reference **confirms** the divergence rather than resolving it. `/rv` was never this ticket's
+gate; the substrate was.
+
+## What is lost, precisely
+
+The **representation**, never the **value**. `GetRawText` always returns valid JSON that parses back
+to an equal element, and re-rendering is **idempotent** — a second pass changes nothing. A document
+already in the renderer's canonical form round-trips byte for byte. A caller using `GetRawText` as a
+value carrier is unaffected; only one reading it as *source text* is.
+
+## Pins
+
+`JsonGatedBehaviourPins.PIN2118GetRawTextReRendersRatherThanReturningSourceText` was **renamed and
+re-roled** as `Decl2118_GetRawTextReRendersRatherThanReturningSourceText`: it was a *gated* pin ("a
+defect knowingly still present") and is now a *declaration*. Each row additionally records what .NET
+would have returned, so the gap is explicit rather than implied, and the test fails the moment the
+limitation lifts. `Decl2118_TheValueSurvivesEvenThoughTheRepresentationDoesNot` pins the half that
+makes the limitation tolerable.

docs/Migration-JsonGetRawTextIsRerendered.md

@@ -0,0 +1,94 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Migration — `TotalOrderIeee754Comparer<T>` implements `IEqualityComparer<T>` (#2170)
+
+Ticket **#2170** (SR-AUD-042 remainder), landed 2026-08-19 under a per-action approval.
+
+## What changed
+
+`System::Numerics::TotalOrderIeee754Comparer<T>` — all three specializations (`float`, `double`,
+`System::Half`) — now derives from `System::Collections::Generic::IEqualityComparer<T>` in addition
+to `IComparer<T>`. `Equals` and `GetHashCode` became `override`s of that interface.
+
+## Why it needed an ask, and what it costs
+
+`sizeof` grows **8 → 16** on every specialization, with the `IEqualityComparer<T>` subobject at
+**offset 8** — a second vptr. `alignof` stays 8.
+
+This is a **silent binary break**: nothing fails to compile, but a consumer that was built against
+the 8-byte type and links against the 16-byte one has a layout mismatch. **Every consumer must
+rebuild.** `docs/StandingApprovals.md` SA-3 and SA-8 both say in terms that a vtable or base-class
+change still asks per action; SA-10 covers signature changes and does not reach a base class. The
+approval was granted on 2026-08-19 on this measurement:
+
+* header-only and stateless;
+* **zero** users in this repository outside its own test file;
+* **zero** sites in `cna` and **zero** in `mobile-eggbert`;
+* precedent: #1788 (`LinkedList<T>` 40 → 48) and #1789 (`BitArray::Enumerator` 32 → 40) were each
+  granted the same way.
+
+## What a caller gains
+
+Exactly one thing, and it is the thing #2169 could not deliver: **polymorphic binding.** A
+specialization can now be passed where `const IEqualityComparer<T>&` is required. Before this
+change that was a *compile error*, not a wrong answer — so no existing call site can have depended
+on the old behaviour.
+
+`Compare`, `Equals` and `GetHashCode` all return exactly what they returned before. No answer moved.
+
+## Three things the reference settles, recorded because they are easy to get wrong
+
+1. **The growth has no .NET counterpart.** .NET's comparer is a `readonly struct`
+   (`TotalOrderIeee754Comparer.cs:16`), and implementing an interface costs a C# struct no storage
+   at all. .NET pays nothing for the same surface. In C++ polymorphic binding requires a base class
+   and a base class with virtual members requires a vtable pointer. The 8 → 16 is a C++ artifact.
+
+2. **`IEquatable<TotalOrderIeee754Comparer<T>>` is deliberately not reproduced.** .NET implements it
+   as `Equals(TotalOrderIeee754Comparer<T> other) => true` (`:204`) — every instance of a stateless
+   comparer equals every other, which a defaulted `operator==` on an empty C++ type already says.
+   A third base would cost a third vptr to express nothing new. Pinned absent by
+   `Decl2170_IEquatableIsNotReproduced`.
+
+3. **`GetHashCode` diverges from .NET, and #2170 deliberately does not close it.** See below.
+
+## Known divergence carried forward, not introduced
+
+.NET's `GetHashCode(T obj)` is `obj.GetHashCode()` (`TotalOrderIeee754Comparer.cs:198-202`) — the
+*value's own* hash. `Double.GetHashCode` normalizes so that, in its own comment, "all NaNs and both
+zeros have the same hash code", and **this port's `Double::GetHashCode` already matches .NET exactly**,
+normalization included. This port's comparer instead hashes the **bit pattern**, so:
+
+| | .NET | this port |
+|---|---|---|
+| `GetHashCode(-0.0) == GetHashCode(+0.0)` | `true` | `false` |
+| two distinct NaN payloads hash equal | `true` | `false` |
+
+Both satisfy the hash contract — equality here *is* bit-pattern identity, so equal always implies
+equal hash — and .NET's is simply coarser. But the difference is **directly observable** through a
+public member. It is filed as its own ticket rather than folded into #2170 because closing it would
+invert **five shipped pins** (`Float_SignedZerosAreDistinct`, `Float_NaNPayloadsAreDistinguished`,
+`Double_EqualityAndHash`, `Double_HashFoldsBothHalvesRatherThanTruncating`, `Half_EqualityAndHash`),
+which is a behaviour decision of its own and not a consequence of adding a base class.
+
+Mutation **M4** — adopting .NET's value hash — is caught by `Float_SignedZerosAreDistinct`, which is
+the evidence that those pins are load-bearing rather than incidental.
+
+## Module graph
+
+**Unchanged at 41 modules / 93 edges.** `IEqualityComparer<T>` lives in
+`modules/core/include/System/Collections/Generic/`, i.e. `Core.Base`, which `Numerics` already
+listed in `PUBLIC_DEPENDENCIES`. No new public component edge was needed.
+
+## Mutation testing
+
+Five mutations, **all caught**:
+
+| # | Mutation | Caught by |
+|---|---|---|
+| M1 | drop the `IEqualityComparer` base from the `double` specialization | compile error (the polymorphic-binding test cannot bind) |
+| M2 | swap the two bases' order | `Fix2170_TheSecondBaseCostsExactlyOneVptr` — the offset-8 assertion |
+| M3 | give `Equals` a by-value signature, making it an overload rather than an override | compile error — the class stays abstract |
+| M4 | adopt .NET's value hash | `Float_SignedZerosAreDistinct` |
+| M5 | invert `Equals` | `Fix2170_BindsPolymorphicallyAsIEqualityComparer` + two pre-existing cases |
+
+M2 is the one worth keeping: a bare `sizeof == 16` passes against it, because a single base that
+merely grew would give the same number. Only the subobject offset discriminates.

docs/Migration-TotalOrderComparerEqualityInterface.md

@@ -0,0 +1,110 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Migration — `UriBuilder::Equals`/`GetHashCode` delegate to the built `Uri` (#2391)
+
+Ticket **#2391**, landed 2026-08-19 on an explicit user decision (`docs/StandingApprovals.md` SA-13).
+
+## What changed
+
+```cpp
+// before (#2004)
+bool Equals(const UriBuilder& other) const { return ToString() == other.ToString(); }
+intcs GetHashCode() const { return std::hash<std::string>{}(ToString()); }
+
+// after (#2391) — .NET's UriBuilder.cs:277-279
+bool Equals(const UriBuilder& other) const;   // via the built Uri, comparand parsed as a string
+intcs GetHashCode() const;                    // getUriProperty().GetHashCode()
+```
+
+## Two behaviour changes, in opposite directions
+
+**1. Identity became canonical (a widening of equality).** `UriBuilder` now compares through
+`Uri`, which has had canonical identity since #1995 — folded scheme, folded host, resolved default
+port, path and query, with fragment and user-info excluded. So these pairs, formerly **unequal**,
+are now **equal**:
+
+| | |
+|---|---|
+| `Host = "example.com"` vs `Host = "EXAMPLE.COM"` | host case is folded |
+| `Host = "example.com"` vs the same with `Port = 80` | an explicit default port resolves away |
+
+Identity is canonical, not blind: a different host, or a non-default port, is still unequal.
+
+**2. `Equals` and `GetHashCode` can throw again (a narrowing of totality).** **This is the cost, it
+was stated before the decision was taken, and it must not be quietly softened later.** For a builder
+whose rendering does not parse, both members now throw `UriFormatException` — **including
+`b.Equals(b)`**. Two measured routes survive, both ordinary setters:
+
+* `setHostProperty("[::1")` — an unterminated IP literal, which #1996 G-1 deliberately does not wrap;
+* `setHostProperty("")` — an empty host (#2000).
+
+(`setHostProperty("h:abc")` and `("h:99999")` left this set with #1996 G-1: they are bracketed now
+and parse.)
+
+### Why that is not simply re-breaking what #2004 fixed
+
+#2004 removed the delegation for a real reason: the pair disagreed at the worst possible place,
+`b.Equals(b)` returning `true` while `b.GetHashCode()` **threw**, leaving an object that compared
+equal to itself with no obtainable hash. Its repair made *hashing* stop parsing. #2391 closes the
+same gap **from the other side**: both members now go through the built `Uri`, so they are total on
+exactly the same set of objects and `Equals ⇒ equal hash` holds across the whole of it. What changed
+is *which* set — the parseable builders rather than all of them.
+
+### And #2004's own justification had already become false
+
+#2004 argued the string hash was *value-identical* to delegating, because "`Uri::parse` assigns
+`absoluteUri_ = uriString` on every branch it accepts, and `Uri::GetHashCode` hashes exactly that".
+**#1995 made `Uri::GetHashCode` hash the canonical identity key instead**, earlier in the same
+session, which silently falsified that argument. Keeping #2004 would have meant a builder and the
+`Uri` it builds hashing **differently** — precisely the defect #2004 existed to prevent, one level
+up. So this is a convergence, not a reversal.
+
+## The asymmetry is .NET's and is deliberate
+
+`UriBuilder.Equals(object)` is `rparam is not null && Uri.Equals(rparam.ToString())`:
+
+* **this** builder goes through the `Uri` property, so an unparseable **self throws**;
+* the **other** is handed over as a **string**, and `Uri.Equals(string)` runs
+  `TryCreate(s, UriKind.RelativeOrAbsolute, out _)` and **returns false** when that fails.
+
+So an unparseable *other* is merely unequal. Reproducing only one half would be tidier and would not
+be .NET. Pinned by `Fix2391_TheComparandIsAStringSoAnUnparseableOTHERIsMerelyUnequal`.
+
+Note `RelativeOrAbsolute`, **not** `Absolute` — the opposite of what #1997 A-3 chose for the
+*creation* overloads. The two questions have different answers.
+
+## Tests
+
+Four shipped pins were **inverted, not deleted** — each had been written anticipating exactly this:
+
+| Pin | Was | Now |
+|---|---|---|
+| `HashIsObtainableWhereverEqualsSucceeds_OtherUnparseableRenderings` | both members answer | `Fix2391_AnUnparseableBuilderNowThrowsFromBothMembers` |
+| `Decl1995_BuilderHashNoLongerMatchesTheBuiltUrisHash` | the two hashes differ | `Fix2391_BuilderHashIsTheBuiltUrisHash` — they agree by construction |
+| `DeliberatelyUnequalPairsStayUnequal_PinsTheGatedIdentityChange` | the pairs are unequal | `Fix2391_TheseFormerlyUnequalPairsAreNowEqual` |
+| `EqualsImpliesEqualHashAcrossEveryEqualityClass` | included two unparseable shapes | domain shrank; the exclusion is asserted in place |
+
+`HashIsObtainableWhereverEqualsSucceeds_MalformedPort` needed no change: `"h:abc"` parses since
+#1996 G-1.
+
+## Mutation testing
+
+Five mutations, **all caught** — but M1 only after the test that was supposed to catch it was
+rewritten, and the reason is worth keeping:
+
+| # | Mutation | Caught by |
+|---|---|---|
+| M1 | comparand kind `Absolute` instead of `RelativeOrAbsolute` | `Fix2391_TheComparandKindIsRelativeOrAbsoluteAndItIsLoadBearing` |
+| M2 | build the other side too, so both throw | `Fix2391_TheComparandIsAStringSoAnUnparseableOTHERIsMerelyUnequal` |
+| M3 | revert `GetHashCode` to #2004's string hash | four cases |
+| M4 | revert `Equals` to #2004's text compare | three cases |
+| M5 | an unparseable other returns `true` | the asymmetry pin |
+
+**M1 was first recorded as an unobservable equivalence, and that record was wrong.** The reasoning
+was that `getUriProperty()` is always absolute, so a relative comparand can never be equal and both
+spellings return `false`. Probing the premise instead of trusting it produced a measurement that
+breaks it: **this port's `Uri(std::string)` constructor accepts `"://example.com/"` while its own
+`TryCreate(s, UriKind::Absolute)` rejects it.** So `self` can be a `Uri` the strict comparand parse
+would refuse, and then `emptyScheme.Equals(emptyScheme)` is `true` under the reference spelling and
+`false` under the mutation — a builder unequal to itself. That is now the discriminating assertion.
+
+The two-grammar inconsistency itself is out of scope here and is filed as **#2393**.

docs/Migration-UriBuilderDelegatesIdentityToUri.md

@@ -0,0 +1,37 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Declaration — Xml.Linq borrowed views stay a documented contract (#1899 closed)
+
+Ticket **#1899** (SR-AUD-333, CCF-019, probe cases X15/X17), closed 2026-08-19. **It changes no
+production statement.**
+
+## What #1899 wanted, and why it cannot be had
+
+#1898 made the borrowed-view contract explicit and testable. #1899 would have made violating it
+*impossible*. Its design was completed, and it **proves the original requirement impossible** — for
+two independent reasons, either of which is sufficient on its own:
+
+1. **An owning handle to an object no `shared_ptr` owns cannot be manufactured.** The topmost
+   ancestor `Ancestors()` yields has no parent, so there is nothing inside the tree holding a share
+   to hand out.
+2. **`XElement`, `XDocument` and `XContainer` are routinely automatic-storage objects** — 51 such
+   declarations in this repository's own tests alone. They have no control block, so
+   `std::enable_shared_from_this` would throw `std::bad_weak_ptr` rather than rescue the caller. It
+   would convert a latent use-after-free into a **guaranteed throw at a correct call site**.
+
+## The alternative, offered and declined
+
+Changing `Ancestors`/`AncestorsAndSelf` to return a non-owning view type that cannot outlive the
+tree — a public source break under SA-2/SA-10. Declined on 2026-08-19
+(`docs/StandingApprovals.md` SA-13). The contract stays as #1898 left it: stated as preconditions,
+postconditions, invalidation and failure behaviour, and pinned.
+
+## Where the proof lives, and why there
+
+In `modules/xml-linq/tests/System/Xml/Linq/XLinqBorrowedViewTests.cpp`, **beside the contract it
+justifies** — not only in the ticket. A future reader who sees "documented, not enforced" should not
+have to assume nobody tried.
+
+`Decl1899_AutomaticStorageNodesHaveNoControlBlockToShareFrom` and
+`Decl1899_TheTopmostAncestorHasNoParentToOwnIt` pin the two **premises**, because a proof whose
+premises silently stop being true is not a proof. They fail the day either premise does, which is
+exactly when #1899 would be worth reopening.