[wakemeup0]

Summary

Add missing excess-parameter supporting locations for Go S107 in the ordinary named parameter shapes measured against a real SonarQube 26.9.0.129388 instance with Go analyzer 1.43.0.7704. Each excess parameter receives one singleton flow, in parameter order. A grouped declaration uses the name span for a nonfinal name and includes the shared type for its final name.

The existing finding count, message, primary range and ordering are preserved. In the frozen default controls, the seven existing native findings now have ten supporting locations per output format. The original grouped-eight fixture gains its measured h int support at line 3, columns 24-29.

Change type and scope

Bug fix for go:S107, with changes limited to:

• crates/hoonarqube-go/src/lib.rs: private optional syntax-derived support helpers and S107 flow attachment.
• crates/hoonarqube-go/src/s107_supporting_location_tests.rs: 16 committed native controls.
• crates/hoonarqube-cli/tests/go_s107_supporting_locations.rs: eight real CLI tests covering exact issues, complete documents, cache reuse and malformed input.

The measured support policy is limited to ordinary named parameter_declaration nodes with a type_identifier. Unsupported, unnamed, blank, function-typed, generic, missing or erroneous shapes keep their existing primary and receive no guessed supports. The existing parameter_count function is byte-identical to the base. Public APIs, exporters, schema, catalog, options, dependencies and quickfix behavior are unchanged.

Related issues

Directly implements a bounded repair identified by the user's multi-agent open-source smoke and real SonarQube parity campaign. No separate issue is auto-closed.

Depends on #945, intended base commit 9e0d440e6ce12e82f118ee1c313fd5d6e4ea772b. The actual reference scans, unchanged native baselines and complete prospective reports were independently qualified before implementation.

Verification

Independent source and frozen-evidence review approved this exact signed head without actionable findings. The review verified signed source inventories, unchanged committed regression bytes, executed behavioral red/green evidence, complete ordered report comparisons and fresh CLI witnesses. Independent review receipt SHA256: 936b6a46380f821c9eac893992bd33174da7a90489f8a7ffc4abcf7b36e75c94. All 21 exact-head hosted checks and dependency-base restoration remain publication gates.

All final local verification is bound to signed head efa8ab261014600e794dc428555072070ecf4135, tree 0e0a88acf098317b79d638db218693201dafd976, with a clean worktree and immutable compiler-bound executable SHA-256 ed3f76712235765c1a1fb0767027e40c2a1a6dfed57d3b9fa7d010a795f92974.

Committed regression mapping and genuine failure/pass evidence

The signed tests-only checkpoint 5b49e096b544804aa5cd69aa8e3609e3cb74e644 (tree 86f303d9837e8547a6013aaf8f7e06734f90083c) retains production identical to #945. It contains the exact final bytes of both new test files. Native tests failed 10 / passed 6; CLI tests failed 4 / passed 4. The failures expose missing supports. At the final implementation head, all 16 native and all eight CLI tests pass.

• Original defect: native s107_original_grouped8_excess_span; CLI s107_original_native_exact_issue and s107_original_generic_exact_issue.
• Measured default shapes: native s107_default_01_separated_eight, s107_default_02_separated_nine, s107_default_03_grouped_nine, s107_default_04_mixed_group, s107_default_05_method_boundary, s107_default_06_literal_existing_primary_preserved, s107_default_08_negative_and_position; CLI s107_default_native_full_document_cold_and_warm and s107_default_generic_full_document_cold_and_warm.
• Actual custom Max=2 library inputs: native s107_custom_max2_01_custom_grouped and s107_custom_max2_02_custom_separated. The corresponding two *_native_max7_remains_clean controls and CLI s107_custom_sources_native_max7_full_document_cold_and_warm / s107_custom_sources_generic_max7_full_document_cold_and_warm preserve the separate native Max=7 behavior.
• Boundaries and retained limitations: native s107_original_boundary7_clean, s107_default_07_variadic_existing_variadic_omission_preserved, s107_unprobed_parameter_shapes_refuse_supports_without_removing_primary and s107_malformed_parameters_keep_parsing_failure_and_refuse_supports; CLI s107_malformed_native_full_document_remains_incomplete_exit2 and s107_malformed_generic_full_document_remains_incomplete_exit2.

The evidence package includes the exact 24-symbol mapping, final source/test hashes, both signed checkpoints, the red executable, raw CLI streams and cold/warm cache bytes.

Executed gates

• Final native: cargo test --locked -p hoonarqube-go --lib s107_ -- --nocapture --test-threads=1 — 16 passed.
• Final CLI: cargo test --locked -p hoonarqube-cli --test go_s107_supporting_locations -- --nocapture --test-threads=1 — eight passed.
• Full Go: cargo test --locked -p hoonarqube-go --all-targets --all-features -- --test-threads=1 — 155 passed at the final signed implementation.
• Inherited CLI S134/S3776/S1110 suites — 13 passed at the final signed implementation.
• The full Go and inherited CLI suites were rerun after the private support-attachment extraction. Final focused native/CLI checks also pass at the final head. Both new test files retain their exact signed-red bytes.
• Final strict Clippy: cargo clippy --locked -p hoonarqube-go -p hoonarqube-cli --all-targets --all-features -- -D warnings — passed, with no new lint allowances.
• Final cargo fmt --all --check, git diff --check against fix(go): add S1110 closing supporting locations #945, SSH commit signature verification and locked cargo build --message-format json-render-diagnostics compiler-artifact binding — passed.
• Released 0.3.1 implicit-default dogfood: pinned official binary inside the retained pinned Ubuntu image, network disabled, repository read-only, hoonarqube analyze --format sonar -- crates xtask — exit 0 and zero rust:S3776, without a baseline or waiver.

Complete report replays

All 19 retained commands were replayed with the final bound executable and fresh output caches. Every complete stdout equals the independently frozen expected bytes; all stderr and exit codes are preserved. Source files and the original cache bytes are unchanged.

• Original 15: only the original S107 native and Generic reports each gain one support; the other 13 stdout documents remain byte-identical.
• Supplemental four: default reports each gain ten supports; both custom-source reports remain fully byte-identical under native CLI Max=7.
• Across all 19: four stdout documents change, 15 remain byte-identical, and malformed reports retain exit 2 and incomplete status.
• Existing real open-source chi and mux reports remain byte-identical. This repair adds no new positive S107 open-source reference finding.

Initial CLI expectation setup failure, both strict Clippy failures and the first released dogfood complexity failure are retained. The dogfood gate found check_function complexity 20 after the added nesting; the support attachment was extracted to a private helper, preserving all test bytes and restoring the released dogfood gate. Validator-only parent receipt path and registration-pin bookkeeping errors are also retained and were corrected against the frozen receipts without rescanning. No failure was suppressed. Local evidence is under go-s107-supporting-locations, including the complete manifest, receipts, source inventories, binary binding, red/green proof and report replays. Independent review completed before publication; all 21 exact-head hosted checks remain publication gates.

The PR initially targeted main to obtain all 21 successful checks from the repository’s GitHub default CodeQL setup. The intended dependency base is now restored to fix/smoke-go-s1110-supporting-locations-20261015. Publication verifies the unchanged signed head, full body and exact-head hosted check rollup against that base.

Compatibility and risks

The support change is additive for existing S107 findings in the qualified ordinary parameter shapes. Each support is derived from actual syntax nodes and source coordinates. Unsupported shapes retain their existing finding without support. Receiver parameters are excluded from the measured ordinary parameter list.

Raw SonarQube supporting objects omit msg; the existing native IR and Generic representation retain empty strings. The reference measurements qualify grouping, order, multiplicity and the measured ranges; exact raw object parity is not claimed. Embedded catalog provenance remains unchanged and is distinct from the live 26.9 reference used for this repair.

Limitations

• The existing variadic counter omits a variadic parameter; the measured reference finding remains absent natively. Parameter counting is a separate repair.
• Function literal primary stays line 2, columns 18-39; the reference primary spans columns 14-68. Only its support is addressed here.
• The measured astral primary stays native/raw line 3, columns 13-26 and Generic UTF-16 columns 14-27.
• Custom reference Max=2 differs from native CLI embedded Max=7. Direct-library tests exercise Max=2; CLI transport of that option is outside this package.
• Header-rule S1451 configuration observations remain separate.
• The unprobed forms have native conservative-refusal controls only. Broader S107 behavior, other languages and global SonarQube parity are not established by this package.
• No merge, tag or release is performed by this implementation package.