feat(timers,xml-linq,text-json): three approval-gated tickets land, plus the two cna repairs (#2155, #2199, #1896, #2366, #2377)

#2155 -- Timers::Timer derives from System::Object so Elapsed reports the
raising timer, as .NET does (Timer.cs:313). It reported nullptr for a
STRUCTURAL reason: EventHandler<T>::Raise types its sender as Object* and Timer
had no such base, so nullptr was the only value that compiled. The obvious
alternative does not exist here -- .NET derives from Component and this port has
no ComponentModel Component at all -- so the divergence is in the BASE, not the
sender. sizeof 104 -> 112 plus a new vtable; two shipped pins inverted, and BOTH
FAILED THE BUILD, each having said "#2155 landed without updating its pin".
Four mutations, all caught.

#2199 -- XObject's Changed/Changing notification, inert since it was ported.
sizeof(XObject) 16 -> 24 and every derived type by exactly one pointer,
allocated only on first registration. Removal is a REGISTRATION TOKEN, because
std::function has no operator== and a handler cannot name its own registration
-- not a cost question but an impossibility. Semantics transcribed from the
reference, including that `notify` means "any object on the chain carries
registrations", not "a changing handler ran", which is what keeps Changed-only
subscriptions alive. Nine mutations, all caught, FOUR only after test repairs;
three share one root cause (only the Changed half's kinds and senders were
recorded, so a mutation corrupting the Changing half alone passed) and the
fourth was a vacuous assertion.

#1896 -- deep tree construction goes quadratic to linear: 100,000 levels
42.583s -> 0.045s (JSON) and 120.028s -> 0.051s (XML). THE APPROVED LAYOUT
GROWTH WAS NOT NEEDED AND WAS NOT TAKEN: the node being attached is parentless,
so it can only be an ancestor if it HAS a subtree. There were TWO quadratic
sources and only one was in the ticket -- the second is #2199's own ancestor
walk, which .NET shares, fixed by an exact process-wide registration count.
Eight mutations, all caught, but M7 and M8 were first reported NOT CAUGHT
honestly: a leaked count corrupts nothing and only makes the suite slower, and a
mutation caught as a timeout is not caught by name. Both cases now time the
build.

#2366 and #2377 -- the two cna repairs, in that repository's WORKING TREE under
a per-action instruction, with no commit authorised. Both carry a premise
correction: cna builds against the sibling checkout on develop, which lacks
#2313, so `std::nullopt` does not compile there and the repair uses `{}`, which
means remove under both versions; and #2377 named five types where there are
seven. CnaTests 68/68.

Gate: 17,558 run, 17,558 passed, 0 failed, 0 skipped across 38 executables
(+15). Module graph 41/93. Negative fixtures 45/231. Build directory: build/
only, --parallel 2 throughout.

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,112 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Migration — deep tree construction is linear (#1896)
+
+Ticket **#1896** (CCF-019, probes J19d / X27d), landed 2026-08-19 on a per-action approval
+(`docs/StandingApprovals.md` SA-13), which **withdrew** the refusal recorded on 2026-07-31.
+
+**No public signature, layout, vtable or behaviour changed.** Every input accepted before is
+accepted now, every input rejected before is rejected now, with the same exception type and text.
+The only difference is how long it takes.
+
+## The measurement
+
+Same binary, same flags (`-O2`), before and after
+(`build-probe/1896_probe1_before.log`, `..._after.log`):
+
+| depth | JSON before | JSON after | XML before | XML after |
+|---|---|---|---|---|
+| 20,000 | 0.994 s | **0.009 s** | 4.668 s | **0.015 s** |
+| 50,000 | 7.884 s | **0.023 s** | 34.547 s | **0.029 s** |
+| 100,000 | 42.583 s | **0.045 s** | 120.028 s | **0.051 s** |
+
+Quadratic → linear. **946×** at 100,000 levels for JSON, **2,353×** for XML.
+
+## The approved layout growth was NOT taken, and that is the ticket's own premise corrected
+
+#1896 was blocked on an object-layout approval — the plan was for `JsonNode` and `XContainer` to
+cache a root or a depth. **The approval was granted and then turned out not to be needed.**
+`sizeof` is unchanged on every type this ticket touches, no member was added, and no virtual was
+added either (a virtual would have been a vtable change, a heavier approval than this needs).
+
+The guards ask *"is `this` an ancestor-or-self of `parent`?"*, and two facts answer that in O(1)
+whenever the answer is no:
+
+* the node being attached is **parentless** — the existing already-has-a-parent check has thrown
+  otherwise — so it is the root of its own subtree;
+* it can therefore only be an ancestor of `parent` if it **has** a subtree.
+
+So a direct `parent == this` comparison catches self-attachment, and a **childless** node cannot
+contain anything, so the walk is skipped. Both container counts are O(1) vector sizes, and both
+container headers were already included at both sites.
+
+**The guard is faster, not weaker.** It rejects exactly what it rejected before — the `shared_ptr`
+reference cycle it exists to prevent stays prevented — and every rejection path is asserted:
+already-parented, self-attach on an *empty* container, self-attach on a non-empty one, an ancestor
+under its own descendant, the same 64 levels deep, and (for JSON) an *object* ancestor rather than
+an array.
+
+**The trap, and it is the one mutation most likely to be written by accident:** an empty container
+short-circuits the walk, so `n == this` must be tested **outside** the emptiness guard. Moving it
+inside makes self-attachment legal again. That is mutations M1 and M4, and both are caught.
+
+## There were TWO quadratic sources, and only one was in the ticket
+
+Fixing the guard took XML from 120.0 s to **89.3 s** — a real improvement and still quadratic. A
+test asserting only "faster" would have called that a success.
+
+The second source is **#2199's own ancestor walk**, added earlier the same day: `NotifyChanging`
+visits every ancestor on every mutation *even when nothing is subscribed*. **.NET has exactly that
+shape** — `XObject.cs:424-427` skips annotation-less ancestors cheaply but still visits each one —
+so .NET's XLinq is quadratic here too.
+
+The fix is a **process-wide count of live registrations**. If it is zero, no walk can find anything,
+so `NotifyChanging` returns `false` immediately. This is **exact, not approximate**: no handler is
+ever skipped, because none exists. When registrations do exist the walk runs in full and behaviour
+is identical to .NET's; only the nobody-is-listening case is faster.
+
+The count is decremented by `remove_*` **and by the registration block's destructor**. Without the
+latter, destroying an observed object would leave the count permanently non-zero and every tree in
+the process would pay the full walk for ever — a silent, permanent regression of the very defect
+this ticket fixes. That is mutation M7, and it is caught by a case built for it.
+
+## Tests
+
+`Pin2119_TheProgrammaticHalfOfTheResidualSURVIVESAndHasAnOwner` is **inverted**, as it said it must
+be: it recorded the last surviving row of `OwnedTreeLifetimeContractPlan.md`'s deep-nesting group
+and said *"#1896 landing is a visible change here rather than a silent one."*
+
+Five cases added across the two modules. The timing cases use 40,000 levels with a generous bound
+rather than a benchmark threshold — a quadratic implementation misses it by three orders of
+magnitude, so it discriminates without flaking under gate load.
+
+## Mutation testing
+
+Eight mutations, **all caught — but two only after the tests that were supposed to catch them were
+strengthened, and the reason is the most useful thing in this ticket.**
+
+| # | Mutation | Caught by |
+|---|---|---|
+| M1 | JSON: move the `parent == this` check *inside* the emptiness guard | the cycle-guard case + a pre-existing `JsonArrayTests.Add_Self_Throws` |
+| M2 | JSON: `hasChildren()` always false | the cycle-guard case + `JsonNodeMutationConsistencyTests` |
+| M3 | JSON: `hasChildren()` ignores objects | the cycle-guard case, whose fifth arm exists for it |
+| M4 | XML: move the self-check inside the guard | the self-insertion case + `XLinqMutationConsistencyTests` |
+| M5 | XML: invert the guard | the self-insertion case + `XLinqLifetimeTests.SelfInsert…` |
+| M6 | the notification short-circuit always skips | ~20 `Fix2199_*` cases |
+| M7 | the registration count is never decremented on destroy | the destroy case, **after strengthening** |
+| M8 | the count is not decremented on `remove_*` | the same, **after strengthening** |
+
+**M7 and M8 were first reported NOT CAUGHT, and that was the honest result.** A leaked count does
+not corrupt anything — the tree still builds correctly and every assertion still passes. It only
+makes every tree in the process pay the full ancestor walk **for ever**, which is a silent,
+permanent regression of the exact defect this ticket fixes. The suite merely got slower, and one run
+hit the 240-second mutation timeout — and *a mutation caught only as a timeout is not caught by
+name*.
+
+The fix was to make the two cases **time** the build rather than merely run it. The bound is
+2 seconds, and both margins are measured rather than guessed: 40,000 levels costs **~40 ms** linear
+(50× of headroom under the bound) and **13,870 ms** under M7 (7× over it). So it discriminates
+without being a benchmark that flakes under gate load — the same reasoning #2326 applied when
+rescaling its resolution tests.
+
+One mutation (M2, first spelling) was **invalid as written** — it left an orphaned function and
+failed to compile — and was reformulated rather than counted.

docs/Migration-DeepTreeConstructionIsLinear.md

@@ -0,0 +1,89 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Migration — `System::Timers::Timer` derives from `System::Object` (#2155)
+
+Ticket **#2155** (SR-AUD-239, cause TM-B), landed 2026-08-19 on an explicit per-action approval
+(`docs/StandingApprovals.md` SA-13). **Decided against the recommendation on the record**; the
+reasoning is preserved below so the trade stays visible rather than relitigated.
+
+## What changed
+
+```cpp
+class Timer : public System::Object { ... };   // was: class Timer { ... };
+Elapsed.Raise(this, args);                     // was: Elapsed.Raise(nullptr, args);
+```
+
+`Elapsed` now reports **the raising timer** as its sender, matching .NET's
+`intervalElapsed(this, elapsedEventArgs)` (`Timer.cs:313`).
+
+## Why it was `nullptr`, and why the fix had to be a base class
+
+Nothing was wrong with the *intent*. `EventHandler<T>::Raise` types its sender as
+`System::Object*`, `Timer` had no such base, and `std::is_convertible_v<Timer*, Object*>` was `0` —
+so **`nullptr` was the only value that compiled**. The defect was structural, not a mistake at the
+call site.
+
+**The obvious alternative does not exist here.** .NET's `Timer` derives from `Component`
+(`Timer.cs:15`), **not** from `Object` directly. This port has **no `ComponentModel` `Component`
+class at all** — measured: no `Component.hpp` anywhere under `modules/`. So the `Object` base is the
+only available route. The divergence from .NET is therefore in the **base**, not in the observable
+sender, which now matches exactly. Pinned by `Decl2155_TheDivergenceIsInTheBaseNotTheSender`, so a
+future `Component` would be a deliberate re-basing rather than a silent one.
+
+## The cost — a silent binary break
+
+| | before | after |
+|---|---|---|
+| `sizeof(Timer)` | 104 | **112** |
+| `alignof(Timer)` | 8 | 8 |
+| polymorphic | no | **yes** — new vtable |
+
+Nothing fails to compile. **Every consumer must rebuild completely.** `docs/StandingApprovals.md`
+SA-3 authorises private data members and **explicitly excludes** vtable and base-class changes,
+which still ask per action; SA-8 does not reach it either. The approval was granted on this
+measurement:
+
+* **zero** `System::Timers` sites in `cna`;
+* **zero** in `mobile-eggbert`;
+* one first-party site outside `modules/timers` itself.
+
+The recommendation was to decline — a new vtable on a public type is the most expensive break
+available, and `Timer` is not polymorphic for any other reason. It was granted anyway. Recorded, not
+reopened.
+
+## Consequences a subscriber and a subclasser should know
+
+* `Timer` now inherits `ToString()`, `Equals(const Object*)` and `GetHashCode()` from
+  `System::Object`, and implements the base's pure virtual `GetTypeName()` as
+  `"System.Timers.Timer"`.
+* `Timer` is **still non-copyable** — asserted by a pin written *before* this change precisely
+  because a base-class edit is the kind that quietly reintroduces a copy constructor.
+* The `Object` subobject is at **offset 0**, so an `Object*` obtained from a `Timer*` compares equal
+  to it. Pinned, because that is the half `sizeof` cannot express.
+
+## Tests
+
+Two shipped pins were **inverted**, and both had said in terms *"#2155 landed without updating its
+pin"* — **both failed the build**, at compile time, which is the evidence they were load-bearing
+rather than decorative:
+
+| Pin | Now |
+|---|---|
+| `ElapsedStillReportsANullSender_SeeBlockedTicket2155` | `Fix2155_ElapsedReportsTheRaisingTimerAsItsSender` |
+| `TimerRemainsANonPolymorphicNonObjectType_SeeBlockedTicket2155` | `Fix2155_TimerIsNowAPolymorphicObjectType` |
+
+Two pins added: `Fix2155_TheLayoutCostIsExactlyOneVptr` (the price, asserted as a relationship as
+well as a literal, plus the offset-0 check) and `Decl2155_TheDivergenceIsInTheBaseNotTheSender`.
+
+The sender assertion is `EXPECT_EQ(seen, static_cast<Object*>(&timer))`, **not** merely non-null: a
+mutation passing some other `Object*` satisfies a null check and fails this one. That is M2.
+
+## Mutation testing
+
+Four mutations, **all caught**:
+
+| # | Mutation | Caught by |
+|---|---|---|
+| M1 | revert the sender to `nullptr` | `Fix2155_ElapsedReportsTheRaisingTimerAsItsSender` |
+| M2 | pass some other `Object*` | the same case — which is why it asserts identity, not non-nullness |
+| M3 | `GetTypeName()` returns `"System.Object"` | `Fix2155_TheLayoutCostIsExactlyOneVptr` |
+| M4 | drop the base | compile error |

docs/Migration-TimersTimerDerivesFromObject.md

@@ -0,0 +1,133 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Migration — `XObject` Changed/Changing notification is implemented (#2199)
+
+Ticket **#2199** (SR-AUD-336), landed 2026-08-19. Both of its gates were opened the same day
+(`docs/StandingApprovals.md` SA-13).
+
+## What changed
+
+Until now the four accessors **accepted a handler and discarded it**, and no mutation anywhere in
+the hierarchy raised anything. `XLinqChangeNotificationTests.cpp` pinned that inert surface at
+every door, deliberately, so a partial implementation could not land silently and so the eventual
+repair would have failing tests to turn green. This is that repair.
+
+```cpp
+// before                                   // after
+void add_Changed(const Handler&);           [[nodiscard]] XObjectChangeRegistration add_Changed(const Handler&);
+void remove_Changed(const Handler&);        bool remove_Changed(const XObjectChangeRegistration&) noexcept;
+void add_Changing(const Handler&);          [[nodiscard]] XObjectChangeRegistration add_Changing(const Handler&);
+void remove_Changing(const Handler&);       bool remove_Changing(const XObjectChangeRegistration&) noexcept;
+```
+
+## Gate 1 — the layout growth
+
+`sizeof(XObject)` **16 → 24**, and every derived type with it. One pointer: a `unique_ptr` to the
+registration block, allocated **only on first registration**, so an unobserved tree pays a null
+pointer and no allocation — the closest analogue of .NET's annotation slot, which is likewise
+absent until something is annotated.
+
+| type | before | after |
+|---|---|---|
+| `XObject`, `XNode` | 16 | 24 |
+| `XContainer` | 40 | 48 |
+| `XElement` | 128 | 136 |
+| `XAttribute` | 120 | 128 |
+| `XText`, `XCData`, `XComment` | 48 | 56 |
+| `XProcessingInstruction` | 80 | 88 |
+| `XDocument` | 56 | 64 |
+
+Silent binary break; **every consumer must rebuild**. Measured: **zero** `Xml::Linq` sites in `cna`
+and **zero** in `mobile-eggbert`. **Three** shipped layout pins had to be updated — two `sizeof`
+pins and one `static_assert` block from #1890 — and all three failed the build, which is the
+evidence they were load-bearing.
+
+## Gate 2 — the removal design, and the one deliberate divergence
+
+.NET removes a registration by passing the **delegate** back, because a C# delegate is
+equality-comparable. `XObjectChangeEventHandler` is a `std::function`, and `std::function` has **no
+`operator==` against another `std::function`** — proved at compile time, not assumed. A
+handler-taking `remove_*` therefore cannot identify which registration a caller means. **This was
+never a cost question**; it is not implementable as declared, at any layout cost.
+
+The decision was a **registration token**, chosen so the divergence is visible *in the type* rather
+than hidden in the behaviour. Two alternatives were offered and declined:
+
+* keep .NET's signature and remove **all** registrations — silently drops a third party's subscription;
+* keep it and **throw** from `remove_*` — a subscriber could then never unsubscribe.
+
+```cpp
+auto token = element.add_Changed(handler);   // was: element.add_Changed(handler);
+element.remove_Changed(token);               // was: element.remove_Changed(handler);
+```
+
+`add_*` is `[[nodiscard]]` deliberately: a discarded token is a registration that can never be
+removed. Ids come from a **process-wide** atomic counter, so a token issued by one `XObject` can
+never match a registration on another; a foreign or default-constructed token removes nothing and
+returns `false`.
+
+## Semantics, all transcribed from the reference
+
+* **Notifications bubble.** Every object from the changed one up to the root is notified,
+  **innermost first** (`XObject.cs:418-460`).
+* **The sender is the object *changed*, not the object *observed*.** For `Add` and `Remove` .NET
+  walks the **parent's** chain with the **child** as sender (`XLinq.cs:156,177`) — an asymmetry
+  reproduced rather than tidied.
+* **`Changing` runs before the mutation, `Changed` after**, and `Changed` is guarded on what
+  `Changing` returned, as every .NET call site does.
+* **`notify` means "any object on the chain carries registrations at all", not "a changing handler
+  ran".** .NET tests `Annotation<XObjectChangeAnnotation>() != null` and only then invokes the
+  possibly-null delegate. Reading it the other way would **silently disable every `Changed`-only
+  subscription** — the case `Fix2199_AChangedOnlySubscriptionStillReceivesChanged` exists for that.
+* **Handlers are invoked from a snapshot**, so a handler may register or unregister during a
+  notification; the change takes effect on the next one.
+
+### Two places where raising nothing is the correct answer
+
+* **`XElement::setValueProperty` raises no `Value`.** .NET's setter is `RemoveNodes(); Add(value);`,
+  so a subscriber sees a `Remove` pair per existing child then an `Add` pair. Raising `Value` would
+  invent an event .NET does not raise.
+* **`Add(std::string)` raises `Add` or `Value` depending on merging**, because it merges into a
+  trailing `XText` rather than creating a sibling; an empty string is a genuine no-op and raises
+  nothing.
+
+## Mutation testing
+
+Nine mutations, **all caught — but four only after a test was repaired, and the repairs are the
+interesting part.**
+
+| # | Mutation | Caught by |
+|---|---|---|
+| M1 | `notify` means "a changing handler ran" | two ancestor-walk cases |
+| M2 | the walk stops at the first registration | two bubbling cases |
+| M3 | iterate the live vector instead of a snapshot | the reentrancy case, **after repair** |
+| M4 | ids `thread_local` instead of process-wide | the threaded token case, **added for it** |
+| M4b | ids per-object | the foreign-token case, **after repair** |
+| M5 | `Add`'s *Changing* sender is the parent | the add case, **after repair** |
+| M6 | `RemoveNodes` raises once, not per child | the per-child case |
+| M7 | `Changed` raised before the mutation | the before/after state case |
+| M8 | attribute `Add` raises nothing | the attribute add case |
+| M9 | `RemoveAttribute`'s *Changing* kind is `Value` | the attribute remove case, **after repair** |
+
+**Three of the four repairs share one root cause and it is worth stating plainly.** The recorder
+captured only the **`Changed`** half's kinds and senders, so any mutation that corrupted the
+**`Changing`** half alone (M5, M9) passed. Half a pair is still a wrong notification, so the
+recorder now records both and every case asserts they agree.
+
+The fourth (M4b) was a **vacuous assertion**: the foreign-token case removed A's registration
+*before* trying B's token, leaving A's list empty — so it returned `false` for the wrong reason and
+a per-object counter went undetected. The foreign attempt now comes first, while A's registration
+is still present.
+
+M3's repair is the same shape: the reentrancy case removed the running handler as well as adding
+one, which ended the live-vector iteration early and hid the difference. It now only adds, and adds
+enough to force a reallocation.
+
+## SA-2 conditions
+
+1. This note. ✔
+2. `test/consumer/xml_linq_change_registration_token_negative.cpp` — **5 sites**, the third being
+   the spelling most likely to survive a careless migration: keeping the old `add_Changed(h);` line
+   and discarding the token. Fixture set grows to **45 fixtures / 231 sites**. ✔
+3. Downstream ticket: **#2394**. ✔
+4. Full gate. ✔
+5. Measured consumer impact: **zero sites** in both. ✔

docs/Migration-XObjectChangeNotification.md

@@ -64,6 +64,14 @@ namespace System::Text::Json::Nodes {
          */
         void AssignParent(JsonNode* parent);
 
+    private:
+        /** @return true if this node currently contains other nodes. #1896's cycle-guard
+         *  short-circuit; see AssignParent. Non-virtual by design -- a virtual would be a vtable
+         *  change this repair does not need. */
+        [[nodiscard]] bool hasChildren() const;
+
+    public:
+
         /** @brief Internal: clears the parent container pointer. Not part of .NET's public surface (mirrors JsonNode.cs's internal DetachParent). */
         void DetachParent() { parent_ = nullptr; }