fix(csharp): recognize ordinary Unicode char overload candidates

[wakemeup0]

Summary

Repair C# S6610 for direct ordinary single-BMP-character strings. Recover the two exact original Humanizer Farsi/Romanian findings and match the independently measured direct-literal boundary contract.

The ordinary string-literal predicate counted UTF-8 source bytes, so one direct non-ASCII BMP character did not have the three-byte quoted length of an ASCII literal. Counting quoted text in UTF-16 code units admits exactly one direct BMP code unit while preserving supplementary-character, multiple-character, escape/raw/verbatim and argument-count behavior.

Change type and scope

Bug fix limited to the ordinary literal predicate in crates/hoonarqube-csharp/src/rules/declaration_contracts/single_char_overloads.rs, additive unit tests there, and new durable CLI regressions crates/hoonarqube-cli/tests/csharp_s6610_unicode_literals.rs. Required dependency is PR941 signed head cf245965bb1f456b08aec234f4472c5b2e8f7b75. Preserve existing callee/literal/one-argument/error filters, method-name ranges and messages. Shared helpers, quickfixes, profiles, catalogs, dependencies and exporters are unchanged.

Related issues

Direct user request to fix and publish findings from the multi-agent real-project SonarQube smoke campaign. Registered package csharp-s6610-unicode-literals; no GitHub issue was created for this bounded original discrepancy, so no issue-closing claim is made.

Verification

Independent source and frozen-evidence review approved this exact signed head without actionable findings. The review verified signed source inventories, unchanged committed regression bytes, executed behavioral red/green evidence, complete ordered report comparisons and fresh CLI witnesses. Independent review receipt SHA256: 1e84d41a9284773815b5311fac3ccef3e5e7e3d8b868ca7353275ad923ff378b. All 21 exact-head hosted checks and dependency-base restoration remain publication gates.

• Signed tests-only head 854a5c13bfd6ec38c62854e07be42a2608e4eb4d has byte-identical production to the admitted base. Genuine behavioral red executed nine focused units (3 passed, 6 failed) and four CLI tests (1 passed, 3 failed). Both JSON and Sonar execute before boundary assertions. Final source retains those exact signed regression bytes.
• Original witnesses map to s6610_original_farsi_direct_literals and s6610_original_romanian_direct_literals; both methods are exercised. Additional direct CJK/standalone combining-mark cases map to s6610_three_byte_bmp_direct_literals and s6610_standalone_combining_mark_direct_literals.
• s6610_all_42_literal_and_guard_boundaries_lf and s6610_all_42_literal_and_guard_boundaries_unicode_crlf, plus matching CLI csharp_s6610_cli_all_42_boundaries_lf and csharp_s6610_cli_all_42_boundaries_unicode_crlf, cover all 84 measured case instances. Exact native scalar and Generic UTF16 method ranges, messages, ordered findings and complete-document hashes are asserted. Empty/multiple/supplementary/combining sequences, char literals and comparison overloads retain measured guard behavior.
• csharp_s6610_cli_complete_cache_transition_and_restoration exercises complete clean/change/repeat/restore output in both formats. csharp_s6610_cli_preserves_malformed_and_invalid_utf8_diagnostics verifies exit2, incomplete status, warning diagnostics, no S6610 and unchanged input bytes.
• Focused green: 9 units and 4 CLI tests passed. Full C# cargo test --locked --jobs 1 -p hoonarqube-csharp --all-targets --all-features -- --test-threads=2: 1,890 passed. Dedicated new CLI target: 4 passed. Existing 94 affected CLI tests across 13 targets pass, preserving all 74 prior S122 syntax/callable cases and earlier mapped regressions.
• Strict affected C#+CLI all-target/all-feature Clippy with -D warnings, repository fmt/base diff checks, locked CLI compiler-artifact binding and pinned signed released 0.3.1 implicit-default Docker dogfood pass. Dogfood emits zero rust:S3776. Final immutable binary SHA256 89edbd8570e218e2bf9a91cc44e61b054fe27932b6bb10db5377aa098959ae9e is bound to signed clean head 68e941e42d4edaf3426fe3f897061253de10d53a.
• All 22 complete reports match frozen pre-candidate expectations: four original documents, four supplemental boundary documents, and all 18 prior S122 reports. These overlap in the original four. Only Humanizer's two streams gain the two original S6610 findings; the other 16 prior streams are byte-identical. Every unrelated ordered duplicate, metric, completeness, warning, parity field and descriptor membership is preserved.

Scope	Files	Final issues	S6610	Sonar descriptors
humanizer193	193	2321	11	86
retained-controls920	920	6410	2	452
lf	1	104	0	14
unicode-crlf	1	104	0	14
callables	1	27	0	6
callables-unicode-crlf	1	27	0	6
original-minimized	1	6	0	6
original-bad	1	4	0	4
original-good	1	3	0	3
s6610-boundary-lf	1	52	10	2
s6610-boundary-unicode-crlf	1	52	10	2

Exact issue-to-test mapping: /Users/wakemeup/.codex/artifacts/hoonarqube-repairs-20261013/csharp-s6610-unicode-literals/acceptance-to-tests.json. Raw executions, signed source snapshots, original/reference bindings and final qualification are retained under /Users/wakemeup/.codex/artifacts/hoonarqube-repairs-20261013/csharp-s6610-unicode-literals. The first signed tests-only attempt's strict-lint failure (raw delimiters and intentional non-NFC fixture), subsequent format check, expected red exits and artifact preparation errors are explicitly preserved. Hosted checks await root publication.

The PR initially targeted main to obtain all 21 successful checks from the repository’s GitHub default CodeQL setup. The intended dependency base is now restored to fix/smoke-csharp-s122-statement-lines-20261015. Publication verifies the unchanged signed head, full body and exact-head hosted check rollup against that base.

Compatibility and risks

Original source is Humanizer commit 3ebc38de585fc641a04b0e78ed69468453b0f8a1, scoped to 193 indexed files from the successful SonarQube Community 26.9.0.129388 scan with C# plugin 10.33.0.1635. Original S6610 count increases 9→11 and total issues 2319→2321; descriptors stay 86. Retained 920 controls remain 6410 total/S6610=2/descriptors452.

Supplemental boundaries were actually executed using the installed SonarAnalyzer.CSharp.Rules.UseCharOverloadOfStringMethods analyzer, assembly SHA256 461b82be21a9e8f57c1312ff877f8276789eeec5e64678344e961a0a3edfd957. One harness compile and two analyzer calls succeeded with zero compilation errors; both retained CS1701 reference warnings remain disclosed. This supplemental evidence is an installed-analyzer witness, not a fresh full-server scan. Actual 84 cases yield 44 reference diagnostics with exact messages/ranges, Warning severity and empty additional locations.

The predicate counts UTF16 units, preserving negative supplementary-character cases that scalar counting would wrongly admit. Existing quickfix safety remains unchanged, including its refusal to rewrite these non-ASCII literals.

Limitations

The installed oracle also reports 12 escaped/raw/verbatim positives per variant (24 total). Their current native silence remains an explicit coverage gap and is preserved by this bounded repair. No escape decoding, raw/verbatim expansion or global/full-rule/all-project parity is claimed. C# semantic-context absence remains truthfully represented.

PR941 is the required dependency. Root owns independent review, publication, all 21 hosted checks and intended dependency-base restoration with exact head/body/signature/check readback. This package authorizes no merge, tag or release.