[wakemeup0]

Summary

Compose existing signed Go repairs PR878 (S1764 operand diagnostics) and PR884 (S126 independent chains and terminal branches) onto accepted PR948. Retain both original signed histories through two automatic signed merges. Final head c130ad71f2fc9e0578726a6444186441bb941e14, tree c6b687c7be604973a7a786d7c2beabd9d62a3b07.

One signed snapshot-only update adds the independently qualified nested-chain S126 finding to the two existing S134 CLI complete-document constants. Root reviewed the exact raw reference/source and granted that test surface. Fixtures, functions and assertions remain byte-identical; no additional detector implementation is introduced.

Change type and scope

Dependency composition and regression expectation maintenance. Changes relative to PR948 are confined to crates/hoonarqube-go/src/lib.rs, inherited crates/hoonarqube-go/src/s126_tests.rs, and the two constant payloads in crates/hoonarqube-cli/tests/go_s134_supporting_locations.rs.

The imported added/removed lines exactly equal the original PR878/PR884 patches in original order, with no merge conflicts. Parser, cache, IR, exporter, profile, catalog, lockfile, dependencies and public helper contracts are unchanged.

Related issues

Related to PR878, PR884 and PR948 and the user's real OSS/SonarQube smoke campaign. This integrates already published repair histories; it does not create duplicate detector fixes or claim global acceptance/closure. No issue-closing declaration is made.

Verification

Independent source and frozen-evidence review approved this exact signed head without actionable findings. The final review performed 13,225 checks, recomputed both automatic inherited merge trees, verified signed physical source inventories and the exact two authorized test constant payloads, qualified all 21 complete ordered reports and the original regression provenance, and checked 12 fresh independent combined CLI/cache documents. Independent review receipt SHA256: 10973ee7840965194621f982194c5970ea7f28b63375b59b708c082d14348bee. All 21 exact-head hosted checks and intended dependency-base restoration remain publication gates.

At the exact clean signed final head:

• Strict affected all-target/all-feature Clippy passed: cargo clippy --locked -p hoonarqube-go -p hoonarqube-cli --all-targets --all-features -- -D warnings.
• Full Go all-target/all-feature suite: 165 passed. Actual issue-to-symbol mapping retains all 9 s126_tests/S126 regressions, 4 S1764 regressions and 16 S107 regressions.
• All inherited CLI targets passed 21 tests: go_s107_supporting_locations 8, go_s1110_supporting_locations 6, go_s134_supporting_locations 2 and go_s3776_project_context 5.
• Formatting, diff against accepted PR948, configured SSH signature and cargo build --locked -p hoonarqube-cli --bin hoonarqube --message-format json-render-diagnostics passed. Actual immutable bin/hoonarqube, SHA-256 114805230f6a746e374bc4461b78c8d6479506c294a2d4d97b1b372e6d9bf5d9.
• All 21 complete native/Generic documents exactly match independently reviewed frozen expectations, including full stdout bytes, stderr, exits, metadata/metrics/non-target findings and ordering. Six documents have authorized inherited S126/S1764 effects; 15 are byte-identical to the parent. All input sources and parent cache inventories remain unchanged. Three malformed documents retain exit 2.
• Exact full findings: S126 chi 7/7, mux 4/4, original controls 2/2 and additional retained boundary 1/1; S1764 original control 1/1 at right primary 5:27–42 with left support 5:8–23; S3776 all 18 original plus 9 retained live findings remain exact, including ordered/grouped supporting locations/messages. S1764 OSS 0/0 is explicitly unexercised.
• Pinned released 0.3.1 implicit-default dogfood: zero rust:S3776, 4,334 total findings, 1,548 inputs, exit 0, no baseline/waiver. Dedicated Cargo target/jobs=1; no whole workspace sweep.

Original red/green proof is inherited honestly. PR878 has actual retained 2-fail/2-pass red and 4-pass green logs, plus signed final test source; it has no separate signed tests-only red commit. PR884 has signed tests-only red 40bcec74c65e8a31874551fcfefcd1d150d33432 with 5 fail/4 pass and green 9. Every inherited regression executes in the composed 165-test suite.

The genuine initial composition CLI failures are retained: only the two old S134 whole-document constants lacked the measured extra S126/Generic descriptor. Their actual outputs equal the boundary expectation frozen before candidate evaluation; removing solely that issue/descriptor restores the original whole objects. Independent root review authorized the exact constants-only update, followed by green 2 at this head. The other 19 CLI tests pass in the retained initial invocations.

Frozen expected v1 is preserved. Before candidate 21 replay, separately frozen r2 corrects only adjacent Generic S1764/S1125 ordering (5:27 before 5:28); complete multiset/all object fields, 20 other stdout documents and all 21 stderr documents remain identical. Setup/verifier failures are retained separately and do not count as detector-red proof.

Evidence package: go-original-dependency-composition, including REPORT.md, qualification.json, artifact-manifest.json, receipt.json, issue-test-symbol-mapping.json, binary.json, complete-replay-results.json and complete reference/actual objects. Worker local gates/evidence are complete; hosted publication checks and intended-base restoration remain coordinator-owned and are not claimed here.

The PR initially targeted main to obtain all 21 successful checks from the repository’s GitHub default CodeQL setup. The intended dependency base is now restored to fix/smoke-go-s107-supporting-locations-20261015. Publication verifies the unchanged signed head, full body and exact-head hosted check rollup against that base.

Compatibility and risks

Only existing measured S126/S1764 behavior is imported. All S134 and unrelated boundary fields remain unchanged after stripping the single measured S126/used descriptor. The raw reference's absent supporting msg and native/Generic explicit empty support message remain distinguished.

Reference data is retained from real SonarQube Community 26.9.0.129388 with Go 1.43.0.7704, plugin JAR SHA-256 8b32b9cdf3088751cdd53f6607ba720cf10a0d1b1dce9fb1a2a6b548ece9f810. Original server 147B411E-AaE1_Y_veHHAmXIblqyU and recovered live-control server 147B411E-AaE3EAuNgNIW5ireOyxL remain separate. Exact sources/profiles and threshold 15 are retained; original strict reports preserve absent top-level parity metadata. This package performs no new reference scan.

Limitations

The evidence qualifies only the listed measured OSS/control scopes. S1764 is unexercised on the original OSS pair. There is no whole-rule or global SonarQube parity claim. Separate S107 residuals remain: variadic omission, literal primary range, non-BMP coordinate, Max2 configuration mismatch, absent-versus-empty support messages, S1451 configuration and broader unprobed shapes. Source composition and local green checks do not establish a merge/release or the coordinator's hosted endpoint.