docs(uri): #2003 resolves with NO change -- the approval it asked for points away from .NET

#2003 asked for approval to "make System::Uri reject an embedded NUL anywhere in the URI string
with UriFormatException, ACCEPTING THAT THE .NET BEHAVIOUR IT MATCHES COULD NOT BE RE-MEASURED
IN THIS ENVIRONMENT". /rv/tmp/runtime is present, so it was re-measured, and it says the
opposite. The approval must not be sought. No production statement changed.

  - UriHelper.s_notSafeForUnescapeChars lists U+0000 through U+001F explicitly, so a NUL is
    never unescaped back from %00 -- it is carried, not refused.
  - Uri.TryCreateThis (UriExt.cs:30-70) has NO whole-string character precheck at all; the only
    rejection paths are the scheme, the host and the port.
  - A control character in the path, query or fragment is percent-ESCAPED during
    canonicalisation. The data survives; only its rendering differs.

THIS PORT ALREADY MATCHES. Rejection is confined to scheme, host and port in both runtimes. The
one difference -- raw rather than %00 -- is the already-declared no-percent-encoding boundary
(plan 15.1), not a second divergence.

TWO PREMISE CORRECTIONS, both measured:

  1. The title says a NUL crosses "into every component". It does not any more: #2359 gave the
     host .NET's DNS character set four days after #2003 was written, and a NUL is outside it
     exactly as a space is.
  2. "No truncation" was asserted of the STRING and never of the component ACCESSORS. It holds
     for those too, and every row now asserts a LENGTH -- a first probe of this ticket printed
     the accessors with %s and appeared to show truncation that was not there, which is exactly
     the shape a byte count catches and a rendered string does not.

THE DECISION IS ENFORCED RATHER THAN WRITTEN DOWN. Two changes were built and run before being
reverted: truncating the input at the first NUL is caught by 4 tests, and THE REPAIR THE TICKET
PROPOSED -- reject anywhere with UriFormatException -- is caught by 3. If that approval were
ever granted and implemented, the suite fails immediately and names this decision.

Gate: 17,386 run, 17,386 passed, 0 failed, 0 skipped across 38 executables (+1, in
SharpRuntimeTests_Uri, 278 -> 279). Built in build/ with --parallel 2. No behaviour changed, so
nothing to migrate downstream.

docs/Migration-UriEmbeddedNul.md

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,72 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Copyright (c) Robert Vokac and contributors -->
+
+# Decision — `System::Uri` keeps an embedded NUL, and the proposed repair was backwards (ticket #2003)
+
+*2026-08-19.* **No production statement changed.** This is a decision and its evidence, in the
+shape of #2015 and #2324: the ticket asked for approval to make `Uri` reject an embedded NUL, and
+the reference — which the ticket could not read — says .NET does not reject it.
+
+---
+
+## 1. The approval must not be sought
+
+#2003's recorded gate is a sentence to be approved:
+
+> *"Make `System::Uri` reject an embedded NUL anywhere in the URI string with
+> `UriFormatException`, **accepting that the .NET behaviour it matches could not be re-measured
+> in this environment**."*
+
+`/rv/tmp/runtime` is present, so it was re-measured, and it points the other way:
+
+* **`UriHelper.s_notSafeForUnescapeChars` lists U+0000–U+001F explicitly.** A NUL is never
+  unescaped back from `%00`; it is carried, not refused.
+* **`Uri.TryCreateThis` (`UriExt.cs:30-70`) has no whole-string character precheck at all.** The
+  only rejection paths are the scheme, the host and the port.
+* A control character in the path, query or fragment is percent-**escaped** during
+  canonicalisation. The data survives; only its rendering differs.
+
+So the proposed repair points **away** from the reference. The ticket closes with no change.
+
+## 2. This port already matches, and the one difference is an existing declared boundary
+
+| Position | .NET | this port |
+|---|---|---|
+| host | rejected — `DomainNameHelper.IsValid` excludes it | rejected (#2359) |
+| port | rejected — not a digit | rejected |
+| scheme | not a scheme char → the reference is **relative** | relative, whole text becomes the path |
+| path, query, fragment, userinfo | carried, as `%00` | carried, **raw** |
+
+The last row is the only difference, and it is the already-declared **no-percent-encoding**
+boundary (`docs/SystemUriNamespaceReviewPlan.md` §15.1), not a second divergence. Both runtimes
+preserve the byte; they render it differently.
+
+## 3. Two premise corrections, both measured
+
+1. **The ticket's title says a NUL crosses "into every component".** It does not any more.
+   **#2359** gave the host .NET's DNS character set, and a NUL is outside it exactly as a space
+   is — so the host has rejected it since that ticket landed, four days after #2003 was written.
+2. **"No truncation" was asserted of the string and never of the component accessors.** It holds
+   for those too, and every row now states a **length**, because a truncating parser and a
+   preserving one differ by a byte count that no `operator<<` would show — a first probe of this
+   ticket printed the accessors with `%s` and appeared to show truncation that was not there.
+
+## 4. Evidence: the decision is enforced, not merely written down
+
+Two changes were **built and run** before being reverted, which is what makes this a measurement
+rather than an assertion:
+
+| Change | Result |
+|---|---|
+| truncate the input at the first NUL | **caught by 4 tests** |
+| **the repair the ticket proposed** — reject anywhere with `UriFormatException` | **caught by 3 tests** |
+
+The second is the one that matters: if the approval were ever granted and implemented, the suite
+fails immediately and names this decision. That is the signal these pins exist to produce.
+
+`Decl2003_RejectionIsConfinedToTheThreePlacesDotNetRejects` states the three rejecting positions
+and seven carrying ones, each with an asserted length.
+
+## 5. Downstream
+
+No behaviour changed, so nothing to migrate.

docs/Migration-UriEmbeddedNul.md

@@ -1371,16 +1371,35 @@ TEST(UriTests, RelativeComponents_UriKindRelativeSeesTheSameSplit) {
 }
 
 // ---------------------------------------------------------------------------
-// Embedded NUL — ticket #2003, pinned rather than changed.
+// Embedded NUL — ticket #2003 RESOLVED, and the resolution is that nothing changes.
 //
-// Measured across every component position: a NUL is carried through as ordinary data. There
-// is NO prefix-only parse, NO silent truncation and no length loss — Uri("http://h/a\0b")
-// keeps all 12 bytes, round-trips, and does NOT compare equal to Uri("http://h/a"). The port
-// position already rejects it, because a NUL is not a digit. Whether .NET rejects a NUL
-// outright could not be measured here (/rv/tmp/runtime/src/libraries/ is absent), so choosing
-// rejection would be a narrowing on no surviving evidence — the line #1998 and #1963 sit on.
-// The current, self-consistent behaviour is pinned so a later change is deliberate.
-// See docs/SystemUriNamespaceReviewPlan.md §30.
+// The deferral was correct and its gate is now discharged. #2003 asked for approval to
+// "make System::Uri reject an embedded NUL anywhere in the URI string with
+// UriFormatException, accepting that the .NET behaviour it matches could not be re-measured
+// in this environment". With the reference present, that behaviour IS measurable, and it
+// says the opposite: .NET does NOT reject.
+//
+//   * `UriHelper.s_notSafeForUnescapeChars` lists U+0000 through U+001F explicitly, so a NUL
+//     is never unescaped back from `%00` — it is carried, not refused.
+//   * `Uri.TryCreateThis` (`UriExt.cs:30-70`) has no whole-string character precheck at all;
+//     the only rejection paths are the scheme, the host and the port.
+//   * A control character in the path, query or fragment is percent-ESCAPED during
+//     canonicalisation. The data survives; only its rendering differs.
+//
+// So the approval must NOT be sought: the proposed repair points away from the reference.
+// This port preserves the same data RAW rather than escaped, which is the already-declared
+// no-percent-encoding boundary (plan §15.1), not a second divergence.
+//
+// TWO PREMISE CORRECTIONS, both measured:
+//   1. The ticket's title says a NUL crosses "into every component". It does not any more —
+//      #2359 gave the host .NET's DNS character set, and a NUL is outside it exactly as a
+//      space is. The host row below is that rejection, and it agrees with .NET's own
+//      `DomainNameHelper.IsValid`.
+//   2. "No truncation" is true of the STRING and had never been asserted of the component
+//      ACCESSORS. It holds for those too, and each row states a length so a `%s`-shaped
+//      truncation cannot pass unnoticed.
+//
+// See docs/SystemUriNamespaceReviewPlan.md §30 and docs/Migration-UriEmbeddedNul.md.
 // ---------------------------------------------------------------------------
 
 TEST(UriTests, EmbeddedNul_IsCarriedThroughEveryComponentWithoutTruncation) {
@@ -1428,6 +1447,40 @@ TEST(UriTests, EmbeddedNul_InThePortPositionIsStillRejected) {
     EXPECT_THROW(Uri(std::string("http://h:8\0 0/p", 15)), System::UriFormatException);
 }
 
+// #2003's resolution, stated as assertions rather than only as prose: the three places .NET
+// rejects are the three places this port rejects, and everywhere else the byte survives.
+TEST(UriTests, Decl2003_RejectionIsConfinedToTheThreePlacesDotNetRejects) {
+    // HOST -- DomainNameHelper.IsValid tests IndexOfAnyExcept over "-0-9A-Z_a-z.", and a NUL is
+    // outside it (#2359).
+    EXPECT_THROW((void)Uri(std::string("http://h\0st/p", 13)), System::UriFormatException);
+    // PORT -- not a digit.
+    EXPECT_THROW((void)Uri(std::string("http://h:8\0 0/p", 15)), System::UriFormatException);
+    // SCHEME -- a NUL is not a scheme character, so the reference is RELATIVE rather than
+    // rejected, and the whole text becomes the path. That is .NET's fallback too, and it is
+    // why "reject anywhere" would have been wrong here as well as in the path.
+    Uri notAScheme(std::string("ht\0tp://h/p", 11));
+    EXPECT_FALSE(notAScheme.getIsAbsoluteUriProperty());
+    EXPECT_EQ(notAScheme.getAbsolutePathProperty().size(), 11u);
+
+    // Everywhere else: carried, with the LENGTH asserted, because a truncating parser and a
+    // preserving one differ only in a byte count that `operator<<` would not show.
+    struct Row { std::string text; size_t expected; };
+    const Row rows[] = {
+        {std::string("http://h/a\0b", 12),   12},
+        {std::string("http://h/p?q\0r", 14), 14},
+        {std::string("http://h/p#f\0g", 14), 14},
+        {std::string("http://u\0r@h/p", 14), 14},
+        {std::string("http://h/p\0", 11),    11},
+        {std::string("a\0b", 3),              3},
+        {std::string("mailto:a\0b", 10),     10},
+    };
+    for (const auto& row : rows) {
+        Uri u(row.text);
+        EXPECT_EQ(u.ToString().size(), row.expected) << "input of " << row.text.size() << " bytes";
+        EXPECT_EQ(u.ToString(), row.text);
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Surrounding whitespace — ticket #2005 RESOLVED.
 //