feat(core,numerics,buffers): the virtual lifetime service, plus three declarations (#2374, #2392, #2058, #2381)

#2374 -- MarshalByRefObject gains the VIRTUAL InitializeLifetimeService() .NET
has (MarshalByRefObject.cs:22-26). Its absence turned an observable runtime
diagnostic into a compile error at an unrelated place. The class already has a
vtable, so this inserts a SLOT here and in both derived classes, AppDomain and
ContextBoundObject -- a silent binary break, granted per action on the
measurement that all three types have zero sites in both consumers.

`virtual` is the point rather than a detail: a non-virtual member of the same
name satisfies a presence check, compiles at every call site, and silently
defeats the override the .NET member exists for. That is why #2297 left it
ABSENT rather than add it that way, and why the new case calls through a BASE
REFERENCE and asserts DISPATCH. #2297's absence pin is inverted and renamed, and
its detection idiom is KEPT, because that is what makes presence and absence
expressible in the same form. Three mutations, all caught; a first run of the
set was invalid (the restore step copied a pre-change backup) and is recorded
rather than counted.

#2392, #2058 and #2381 change no production statement.

#2392 declares that TotalOrderIeee754Comparer::GetHashCode hashes the bit
pattern where .NET hashes the value. The contract holds either way -- equality
here IS bit-pattern identity -- so the choice is about distribution, not
correctness. The pin also records that Double::GetHashCode ALREADY matches .NET,
so a future reader does not fix the wrong one.

#2058 declares ReadOnlySequence<T> single-segment only, citing .NET's segment
constructor and its computed IsSingleSegment. Its premise was partly stale: the
false class comment had already been removed. The single-segment case was
widened from two constructors to all five.

#2381 is the one instruction that was granted and could not be carried out.
Measured: cna builds against develop, which has no DateTimeKind at all. This is
#2366's trap without #2366's escape -- no expression means "preserve the kind"
in a version that has no kind. Editing anyway would leave cna unbuildable, so
the ticket records the exact merge-time diff and is blocked on the merge rather
than on a decision.

Gate: 17,561 run, 17,561 passed, 0 failed, 0 skipped across 38 executables (+2).
Module graph 41/93. Build directory: build/ only, --parallel 2 throughout.

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,70 @@
+<!-- SPDX-License-Identifier: MIT -->
+# Migration — `MarshalByRefObject::InitializeLifetimeService()` (#2374)
+
+Ticket **#2374**, landed 2026-08-19 on an explicit per-action approval
+(`docs/StandingApprovals.md` SA-13 batch). **Decided against the recommendation on the record.**
+
+## What changed
+
+```cpp
+[[noreturn]] virtual void* InitializeLifetimeService();   // throws PlatformNotSupportedException
+```
+
+matching .NET's `public virtual object InitializeLifetimeService()`
+(`MarshalByRefObject.cs:22-26`), which throws
+`PlatformNotSupportedException(SR.PlatformNotSupported_Remoting)`.
+
+Its absence turned an **observable runtime diagnostic** into a **compile error at an unrelated
+place** for anyone writing the .NET call.
+
+## Why it needed an ask, and why it had to be `virtual`
+
+`System::MarshalByRefObject` already has a vtable (the virtual destructor), so adding a virtual
+**inserts a slot** — here and in **both** derived classes, `System::AppDomain` and
+`System::ContextBoundObject`. SA-3 authorises private data members and **excludes vtable changes
+explicitly**; SA-10 covers signatures and does not reach a vtable. Silent binary break: nothing
+fails to compile and **every consumer must rebuild**.
+
+Measured at the time of the grant — **zero** sites for all three types in `cna` and **zero** in
+`mobile-eggbert`.
+
+**It must not be added non-virtually as a shortcut.** A non-virtual member of the same name would
+compile, satisfy any presence check, look correct at every call site, and **silently defeat the one
+thing the .NET member exists for**: letting a derived type override the lease policy. #2297 left it
+*absent* rather than add it that way, and that judgement stands — the approval bought the slot, not
+a workaround.
+
+## The return type is `void*`, deliberately
+
+.NET returns `object`. This port's `System::Object` is an abstract class a lease object would have
+to derive from, which is surface this port does not have and #2374 does not invent. It matches the
+shape `GetLifetimeService()` already uses, and since the body never returns, **no caller can observe
+the difference**.
+
+## Tests
+
+`Fix2297_…TheVirtualOneIsStillAbsent` is **inverted** — it had said *"this assertion is what makes
+its arrival visible rather than silent"* — and renamed to
+`Fix2297_GetLifetimeServiceThrows_And2374_AddedTheVirtualOne`. The **detection idiom is kept**
+rather than replaced by a direct call, because it is what makes presence and absence expressible in
+the same form.
+
+`Fix2374_ADerivedTypeCanOverrideTheLeasePolicy` is the case that matters: it calls through a **base
+reference**, so what is asserted is *dynamic dispatch*, not a same-name member found by static
+lookup. A non-virtual member runs the base body there and throws. It also asserts that a plain
+derived type **still throws**, so the override is a real replacement rather than the base having
+gone quiet.
+
+## Mutation testing
+
+Three mutations, all caught:
+
+| # | Mutation | Caught by |
+|---|---|---|
+| M1 | make the member non-virtual | compile error — the `override` in the test's derived type |
+| M2 | remove the member again | compile error — the presence `static_assert` |
+| M3 | the base body stops throwing | two cases |
+
+A first run of this set was **invalid and is recorded rather than counted**: the restore step
+copied a *pre-change* backup, so M2 and M3 reported ANCHOR MISSING against a file that no longer
+had the member. The baseline was re-taken and the set re-run.

docs/Migration-MarshalByRefObjectLifetimeService.md

@@ -20,14 +20,28 @@ namespace System::Buffers {
  * `getIsSingleSegmentProperty()` is a hard-coded `true`. Linking nodes therefore builds a
  * list nothing consumes (SR-AUD-087).
  *
- * The node shape is retained so that ported C# code declaring segment types still
- * compiles. Implementing the segment-chain constructor is blocked ticket **#2058**: it
- * needs new public members on `ReadOnlySequence<T>` (an object-layout change) plus
- * multi-segment rewrites of `First`, all six `Slice` overloads, both `GetPosition`
- * overloads, `TryGet`, `ToArray`, `CopyTo` and the enumerator, and of
- * `SequenceReader<T>`'s single-segment snapshot. See
- * docs/BuffersNamespaceReviewPlan.md §4.8. The current limitation is pinned by a
- * permanent test.
+ * @note **DECLARED LIMITATION (SR-AUD-087, ticket #2058, decided 2026-08-19).** This is not a
+ * pending repair: **this port models single-segment sequences only**, and multi-segment support
+ * was offered and declined.
+ *
+ * .NET's contract is the opposite and is worth stating exactly, so the gap is explicit rather than
+ * inferred: `ReadOnlySequence<T>` has
+ * `ReadOnlySequence(ReadOnlySequenceSegment<T> startSegment, int startIndex,
+ * ReadOnlySequenceSegment<T> endSegment, int endIndex)`
+ * (`ReadOnlySequence.cs:94`), and its `IsSingleSegment` is `_startObject == _endObject`
+ * (`ReadOnlySequence.cs:41-45`) — a real question with a real answer. Here it is a hard-coded
+ * `true`.
+ *
+ * **What it would have cost, measured**: new public members on `ReadOnlySequence<T>` — a public
+ * object-layout change on a type consumers hold by value — plus multi-segment rewrites of `First`,
+ * all six `Slice` overloads, both `GetPosition` overloads, `TryGet`, `ToArray`, `CopyTo` and the
+ * enumerator, and of `SequenceReader<T>`'s single-segment snapshot. See
+ * docs/BuffersNamespaceReviewPlan.md §4.8.
+ *
+ * **The node shape is retained deliberately**, so that ported C# code declaring segment types
+ * still compiles: a chain can be built and walked through `Next`/`RunningIndex`/`Memory`, it
+ * simply cannot be handed to a `ReadOnlySequence<T>`. Pinned by
+ * `ReadOnlySequenceSegmentPinTests`, written to fail the moment such a constructor appears.
  *
  * @tparam T The element type.
  */

modules/buffers/include/System/Buffers/ReadOnlySequenceSegment.hpp

@@ -201,7 +201,7 @@ TEST(Fix2057_EveryBufferBackedConstructionYieldsASegment, IncludingTheDegenerate
 }
 
 // ===========================================================================
-// SR-AUD-087 — the segment chain builds nothing (blocked #2058)
+// SR-AUD-087 — the segment chain builds nothing (#2058: DECLARED, not blocked)
 // ===========================================================================
 
 namespace {
@@ -229,21 +229,36 @@ TEST(ReadOnlySequenceSegmentPinTests, ANodeChainCanBeBuiltButNotConsumed) {
     EXPECT_EQ(first.getMemoryProperty().getLengthProperty(), 2);
 
     // ...and there is nothing that turns it into a sequence. ReadOnlySequence<int> has
-    // exactly three constructors -- default, std::vector and raw pointer/length -- and
-    // none of them accepts a segment. #2058 would add one; until then this static_assert
-    // is the pin, and it fails the moment such a constructor appears.
+    // exactly three constructors -- default, std::vector and raw pointer/length -- and none of
+    // them accepts a segment.
+    //
+    // #2058 DECIDED on 2026-08-19: this is a DECLARED LIMITATION, not a pending repair. .NET has
+    // ReadOnlySequence(startSegment, startIndex, endSegment, endIndex) (ReadOnlySequence.cs:94);
+    // adding it here would be a public object-layout change on a type consumers hold by value,
+    // plus multi-segment rewrites of First, six Slice overloads, two GetPosition overloads,
+    // TryGet, ToArray, CopyTo, the enumerator and SequenceReader's snapshot. That was offered and
+    // declined. These static_asserts are the declaration and they fail the moment it is withdrawn.
     static_assert(!std::is_constructible_v<ReadOnlySequence<int>,
                                            ReadOnlySequenceSegment<int>*, intcs,
                                            ReadOnlySequenceSegment<int>*, intcs>,
-                  "a segment-chain constructor now exists -- #2058 has landed");
+                  "a segment-chain constructor now exists -- #2058's declared limitation "
+                  "has been withdrawn and the header note must be rewritten");
     static_assert(!std::is_constructible_v<ReadOnlySequence<int>,
                                            ReadOnlySequenceSegment<int>*>,
-                  "a segment constructor now exists -- #2058 has landed");
+                  "a segment constructor now exists -- see above");
 }
 
 TEST(ReadOnlySequenceSegmentPinTests, EverySequenceReportsASingleSegment) {
+    // In .NET this is a real question -- IsSingleSegment is `_startObject == _endObject`
+    // (ReadOnlySequence.cs:41-45) -- and here it is a hard-coded true. #2058 declares that, so the
+    // pin asserts it holds for EVERY constructor this port offers rather than for a sample: an
+    // answer that is constant is only demonstrably constant if every door is tried.
+    std::vector<int> raw{1, 2, 3};
     EXPECT_TRUE(ReadOnlySequence<int>().getIsSingleSegmentProperty());
     EXPECT_TRUE(ReadOnlySequence<int>(std::vector<int>{1, 2, 3}).getIsSingleSegmentProperty());
+    EXPECT_TRUE(ReadOnlySequence<int>(std::vector<int>{}).getIsSingleSegmentProperty());
+    EXPECT_TRUE(ReadOnlySequence<int>(raw.data(), 3).getIsSingleSegmentProperty());
+    EXPECT_TRUE(ReadOnlySequence<int>(raw.data(), 0).getIsSingleSegmentProperty());
 }
 
 // ===========================================================================

modules/buffers/tests/System/Buffers/BuffersContractPinTests.cpp

@@ -24,14 +24,16 @@ namespace System {
      * - **`GetLifetimeService()` is present and throws**, as .NET's does. Its absence turned an
      *   observable runtime diagnostic into a compile error at an unrelated place.
      *
-     * @par What ticket #2297 deliberately did NOT change, and why
-     * - **`InitializeLifetimeService()` is still absent.** .NET's is `virtual`, and this class
-     *   already has a vtable (the destructor), so adding it inserts a **slot** — a vtable change
-     *   in this class and in both derived ones, `AppDomain` and `ContextBoundObject`.
-     *   `docs/StandingApprovals.md` SA-3 excludes vtable changes explicitly, so this needs its own
-     *   approval and is ticket **#2374**. It is left absent rather than added non-virtually,
+     * @par What ticket #2374 added afterwards
+     * - **`InitializeLifetimeService()` is present and `virtual`**, matching .NET
+     *   (`MarshalByRefObject.cs:22-26`). #2297 left it absent because a virtual inserts a vtable
+     *   **slot** in this class and in both derived ones, `AppDomain` and `ContextBoundObject`,
+     *   which SA-3 excludes; the approval was granted per action on 2026-08-19 on the measurement
+     *   that both downstream consumers have **zero** sites. It is `virtual` rather than plain
      *   because a non-virtual member of that name would silently break the one thing the .NET
      *   member is for: letting a derived type override the lease policy.
+     *
+     * @par What ticket #2297 deliberately did NOT change, and why
      * - **`MemberwiseClone(bool)` is still absent.** .NET's calls `Object.MemberwiseClone()`, and
      *   `System::Object` in this port declares no such member — measured. Adding it would be an
      *   invention rather than a port, which SA-5 forbids.
@@ -78,6 +80,41 @@ namespace System {
         [[noreturn]] void* GetLifetimeService() const {
             throw PlatformNotSupportedException("Remoting is not supported on this platform.");
         }
+
+        /**
+         * @brief Obtains a lifetime service object to control the lifetime policy for this
+         * instance.
+         *
+         * C++ counterpart of .NET `MarshalByRefObject.InitializeLifetimeService()`
+         * (`MarshalByRefObject.cs:22-26`), which throws
+         * `PlatformNotSupportedException(SR.PlatformNotSupported_Remoting)`.
+         *
+         * @note **`virtual`, and that is the whole point of the member** — ticket **#2374**,
+         * approved per action on 2026-08-19. .NET declares it `public virtual` so a derived type
+         * can override the lease policy; a **non-virtual** member of the same name would compile,
+         * look correct at every call site, and silently defeat the one thing the member exists
+         * for. Ticket #2297 left it **absent** rather than add it non-virtually, for exactly that
+         * reason, and pinned the absence with a detection idiom.
+         *
+         * The cost, accepted with the approval: this class already has a vtable (the destructor),
+         * so adding a virtual inserts a **slot** here **and in both derived classes**,
+         * `System::AppDomain` and `System::ContextBoundObject`. That is a silent binary break —
+         * nothing fails to compile and every consumer must rebuild. Measured at the time of the
+         * grant: **zero** `MarshalByRefObject`, `AppDomain` and `ContextBoundObject` sites in
+         * `cna` and **zero** in `mobile-eggbert`.
+         *
+         * @note The return type is `void*` rather than `System::Object*`, matching the shape
+         * `GetLifetimeService()` already uses here: .NET returns `object`, and this port's
+         * `System::Object` is an abstract class that a lease object would have to derive from —
+         * which is surface this port does not have and #2374 does not invent. Since the body
+         * never returns, no caller can observe the difference.
+         *
+         * @return Never returns.
+         * @throws System::PlatformNotSupportedException always.
+         */
+        [[noreturn]] virtual void* InitializeLifetimeService() {
+            throw PlatformNotSupportedException("Remoting is not supported on this platform.");
+        }
     };
 
 } // namespace System

modules/core/include/System/MarshalByRefObject.hpp

@@ -108,7 +108,7 @@ TEST(MarshalByRefObjectNewTests, Fix2297_TheBaseIsNoLongerDirectlyConstructible)
     EXPECT_NO_THROW(Derived obj; (void)obj);
 }
 
-TEST(MarshalByRefObjectNewTests, Fix2297_GetLifetimeServiceThrowsAndTheVirtualOneIsStillAbsent) {
+TEST(MarshalByRefObjectNewTests, Fix2297_GetLifetimeServiceThrows_And2374_AddedTheVirtualOne) {
     // GetLifetimeService() is added: .NET keeps it precisely so a caller receives
     // PlatformNotSupportedException (`MarshalByRefObject.cs:17-21`), and its absence here turned
     // that observable diagnostic into a compile error at an unrelated place. It is NOT virtual in
@@ -123,16 +123,58 @@ TEST(MarshalByRefObjectNewTests, Fix2297_GetLifetimeServiceThrowsAndTheVirtualOn
         EXPECT_STREQ(e.what(), "Remoting is not supported on this platform.");
     }
 
-    // InitializeLifetimeService() is DELIBERATELY still absent: .NET's is virtual, and this class
-    // already has a vtable, so adding it inserts a SLOT -- a vtable change here and in both
-    // derived classes. SA-3 excludes those explicitly. Ticket #2374 carries the approval request,
-    // and this assertion is what makes its arrival visible rather than silent.
-    // The `requires` form needs the name to be findable at all, so it is written as a
-    // detection idiom over a dependent type instead -- an absent member must be expressible as
+    // INVERTED BY #2374 (2026-08-19). Its predecessor asserted that InitializeLifetimeService()
+    // was ABSENT and said "this assertion is what makes its arrival visible rather than silent" --
+    // the approval was granted per action, so it now records the arrival.
+    //
+    // The detection idiom is KEPT rather than replaced by a direct call, because it is what makes
+    // presence and absence expressible in the same form: an absent member must be expressible as
     // absent, not as a hard error.
-    static_assert(!detail2297::HasInitializeLifetimeService<Derived>,
-                  "#2374 landed: InitializeLifetimeService() is present, so re-derive the vtable "
-                  "pins in AppDomain and ContextBoundObject");
+    static_assert(detail2297::HasInitializeLifetimeService<Derived>,
+                  "#2374: InitializeLifetimeService() is present");
+
+    // VIRTUAL, and that is the whole point -- a non-virtual member of the same name would satisfy
+    // the detection idiom above, compile at every call site, and silently defeat the one thing
+    // .NET's member exists for: letting a derived type override the lease policy. So presence is
+    // not enough to assert; overridability is.
+    static_assert(std::is_polymorphic_v<System::MarshalByRefObject>);
+    EXPECT_THROW((void)obj.InitializeLifetimeService(), System::PlatformNotSupportedException);
+    try {
+        (void)obj.InitializeLifetimeService();
+        ADD_FAILURE() << "expected PlatformNotSupportedException";
+    } catch (const System::PlatformNotSupportedException& e) {
+        EXPECT_STREQ(e.what(), "Remoting is not supported on this platform.");
+    }
+}
+
+namespace detail2374 {
+    /// A derived type that OVERRIDES the lease policy -- the capability #2374 bought, and the one
+    /// a non-virtual member would have silently withheld.
+    struct LeaseOverriding : System::MarshalByRefObject {
+        mutable bool called = false;
+        void* InitializeLifetimeService() override {
+            called = true;
+            return nullptr;   // deliberately does NOT throw
+        }
+    };
+}
+
+TEST(MarshalByRefObjectTests, Fix2374_ADerivedTypeCanOverrideTheLeasePolicy) {
+    // This is what the vtable slot was paid for. Called through a BASE reference, so it is
+    // dynamic dispatch that is asserted rather than a same-name member found by static lookup --
+    // a non-virtual member would run the BASE body here and throw.
+    detail2374::LeaseOverriding derived;
+    System::MarshalByRefObject& asBase = derived;
+    EXPECT_NO_THROW((void)asBase.InitializeLifetimeService());
+    EXPECT_TRUE(derived.called) << "#2374: the override must be dispatched through the base";
+
+    // And the base's own body still throws, so the override is a real replacement rather than the
+    // base having stopped throwing.
+    struct Plain : System::MarshalByRefObject {};
+    Plain plain;
+    System::MarshalByRefObject& plainAsBase = plain;
+    EXPECT_THROW((void)plainAsBase.InitializeLifetimeService(),
+                 System::PlatformNotSupportedException);
 }
 
 // ---------------------------------------------------------------------------