Saxon

On the "load from file" path, where we pass through resolveSource() on Configuration, we find

                @Override
                public void deliver(Receiver receiver, ParseOptions options) throws XPathException {
                    options = options.merge(((AugmentedSource) source).getParseOptions());
                    resolveSource(((AugmentedSource) source).getContainedSource(), config)
                            .deliver(receiver, options);
                }

On the "load from URI path" we don't get an AugmentedSource and we pass through deliver on ActiveSAXSource:

    @Override
    public void deliver(Receiver receiver, ParseOptions options) throws XPathException {
        try {
            Logger logger = receiver.getPipelineConfiguration().getConfiguration().getLogger();
            XMLReader parser = getXMLReader();
            //System.err.println("Using parser " + parser.getClass());

            configureParser(parser);  // Bug 5276

which doesn't call options.merge() and so doesn't get a bunch of defaulted settings. If I change deliver() in ActiveSAXSource by adding

            options = options.merge(options);

just before configureParser(parser); // Bug 5276, then the HTTP case passes.

But is that safe? And are there other places where we should do this?

It's not completely safe because it causes TestXMLParserOptions.testSettingOfProperty to fail. :-(

The way options.merge() is written, options.merge(options) is destructive so my "fix" only works because it accidentally removes some validatin properties. :-(