fix(csharp): match S122 statement grouping and spans

[wakemeup0]

Summary

Repair C# S122 statement-line grouping and full displayed ranges. Recover all 13 exactly matched Humanizer findings from the retained successful SonarQube scan and installed analyzer; preserve the complete retained 920-file control reports.

S122 grouped only direct statement-list children, omitting embedded if/loop bodies, and used the last preorder child end, truncating containing spans. It also combined anonymous-body and outer statements into one count. The replacement groups every non-wrapper statement by starting row, detects repeated statements within the same anonymous-function scope, and displays the earliest statement start through the maximum statement end for that row.

Change type and scope

Bug fix limited to csharpsquid:S122 in crates/hoonarqube-csharp/src/rules/text_scans/one_statement_per_line.rs and new durable CLI regressions crates/hoonarqube-cli/tests/csharp_s122_statement_lines.rs. The owning file also contains unit regressions. No shared helper, catalog, profile, exporter, dependency, lockfile or quickfix changes. Depends on PR938 signed head 2b842e8017d1f4930e088480211a340d59d35a53.

Related issues

Direct user request to fix and publish findings from the multi-agent real-project SonarQube smoke campaign. Registered package csharp-s122-statement-lines; no GitHub issue was created for this bounded original discrepancy, so no issue-closing claim is made.

Verification

Independent source and frozen-evidence review approved this exact signed head without actionable findings. The review verified signed source inventories, unchanged committed regression bytes, executed behavioral red/green evidence, complete ordered report comparisons and fresh CLI witnesses. Independent review receipt SHA256: 36f7fad72051b333776e053ab573f25725b630d7aa6120e54c81db58248189f8. All 21 exact-head hosted checks and dependency-base restoration remain publication gates.

• Signed tests-only head f1809b6c7d52cd5355cb8375b5ee6c4a5216d84b has byte-identical production to the admitted base. Genuine behavioral red: 15 selected unit tests executed (10 passed, 5 failed), 9 CLI tests executed (3 passed, 6 failed). Both JSON and Sonar run before any CLI assertion. Final source retains the exact signed regression bytes.
• Durable unit symbols s122_installed_lf, s122_installed_unicode_crlf, s122_installed_callables, s122_installed_callables_unicode_crlf cover all 74 measured named case instances. Matching CLI symbols csharp_s122_cli_lf, csharp_s122_cli_unicode_crlf, csharp_s122_cli_callables, csharp_s122_cli_callables_unicode_crlf assert exact native scalar/Generic UTF16 objects and complete-document hashes.
• Original reduction and controls: unit/CLI s122_installed_original_minimized / csharp_s122_cli_original_minimized, s122_installed_original_bad / csharp_s122_cli_original_bad, s122_installed_original_good / csharp_s122_cli_original_good. Existing s122_flags_second_statement_on_a_line remains unchanged and passes. Detailed 74-case/13-original-object mapping: /Users/wakemeup/.codex/artifacts/hoonarqube-repairs-20261013/csharp-s122-statement-lines/acceptance-to-tests.json.
• csharp_s122_cli_cache_invalidation_and_reanalysis checks clean/change/repeat/restore complete output; s122_malformed_source_preserves_incomplete_analysis and csharp_s122_cli_preserves_malformed_and_invalid_utf8_incompleteness retain fail-closed incomplete behavior and unchanged source bytes.
• Focused green: 15 unit and 9 CLI tests pass. cargo test --locked --jobs 1 -p hoonarqube-csharp --all-targets --all-features -- --test-threads=2: 1,884 passed. Affected 13 CLI binaries: 94 passed, including S881, S1109, S1067, header/default/recursion, line-ending and quickfix safety regressions.
• Strict C#+CLI all-target/all-feature Clippy with -D warnings, repository fmt, base-to-head diff checks, locked CLI build and pinned signed released 0.3.1 implicit-default Docker dogfood pass. Dogfood reports zero rust:S3776 findings. Final binary SHA256 1f5b0747f164c831406b3d6fa9414a308da0c3eef791d447adb5856f080c020e, bound to signed clean head cf245965bb1f456b08aec234f4472c5b2e8f7b75 and actual compiler artifact.
• All 18 complete reports match the independently reviewed frozen projections across nine scopes, preserving every unrelated ordered duplicate, metric, file/project value, completeness, warning, duplication and parity field. Sonar descriptors equal exactly the sorted emitted IDs.

Scope	Files	Final issues	S122	Sonar descriptors
humanizer193	193	2319	13	86
retained-controls920	920	6410	1	452
lf	1	104	20	14
unicode-crlf	1	104	20	14
callables	1	27	5	6
callables-unicode-crlf	1	27	5	6
original-minimized	1	6	1	6
original-bad	1	4	1	4
original-good	1	3	0	3

Evidence: /Users/wakemeup/.codex/artifacts/hoonarqube-repairs-20261013/csharp-s122-statement-lines; all raw command streams and input/source/binary bindings are retained. Two expected behavioral-red subprocess failures, the preserved first strict-lint redundant-closure failure (corrected without test changes), and artifact preparation/inspection errors are explicitly preserved. Hosted checks remain pending root publication.

The PR initially targeted main to obtain all 21 successful checks from the repository’s GitHub default CodeQL setup. The intended dependency base is now restored to fix/smoke-csharp-s881-arithmetic-20261015. Publication verifies the unchanged signed head, full body and exact-head hosted check rollup against that base.

Compatibility and risks

The 13 original objects are grounded in Humanizer commit 3ebc38de585fc641a04b0e78ed69468453b0f8a1, successful SonarQube Community 26.9.0.129388 with C# plugin 10.33.0.1635, and actual installed SonarAnalyzer.CSharp 10.33.0.0 assembly SHA256 461b82be21a9e8f57c1312ff877f8276789eeec5e64678344e961a0a3edfd957. The retained compilation of 199 original files has zero compiler errors and exactly reproduces the 13 server identities. The source scope has 193 indexed files. No fresh server scan or reference mutation was performed for implementation.

Single-statement anonymous bodies remain clean; multiple inner statements and outer siblings retain their exact demonstrated findings. Embedded statements, empty blocks, separated lines, else-only headers and multiline conditions are covered. No quickfix behavior changes.

Limitations

This establishes the bounded original-project and measured-case contract, not full S122/global/all-project SonarQube parity. C# semantic-context absence remains truthfully represented in these native report scopes. The installed witness harness's preserved CS1701 warnings and the intake's failed broad-reflection/schema attempts remain disclosed in frozen intake evidence. PR938 is the required dependency. Root owns final review, publication and exact-head hosted checks; no merge, tag or release is requested by this package.