[wakemeup0]

Summary

Add Python S7503's missing async-keyword supporting location. All twelve retained actual SonarPython5.31 observations have message This function is async. on the five-byte async keyword; native now emits the matching single same-file flow and Generic Sonar secondary location.

Change type and scope

Bug fix in the existing Python S7503 rule. Production adds a guarded source-range proof and attaches one flow to the already selected primary issue. Declaration start plus5 uses checked arithmetic; exact source slices, declaration/name bounds, nonempty name and ordering must prove the location. Refusal preserves the primary diagnostic. Strengthen the current complete-object unit/CLI expectations and add six public CLI regressions plus an invalid-range unit control.

Related issues

Direct authorized real-project smoke/parity repair campaign, no new issue ID. Depends on fully published PR #946. Historical generator/override repairs and the qualified primary message remain preserved. Unrelated PR #875 is outside this package.

Verification

Independent source and frozen-evidence review approved this exact signed head without actionable findings. The review verified signed source inventories, unchanged committed regression bytes, executed behavioral red/green evidence, complete ordered report comparisons and fresh CLI witnesses. Independent review receipt SHA256: 88600bed46ebece090105005e602740b5ee0c3015131ab013e82affe60814066. All 21 exact-head hosted checks and dependency-base restoration remain publication gates.

• Signed unchanged-production tests-only commit e3fa2534fc3f6cea131e6b07ceece5cb25de9889: actual compiled unit1failed/2controls passed; CLI10failed/TEST-scope1passed. Exact final unit test section and both CLI files are byte-identical to the signed red checkpoint.
• cargo test --locked -p hoonarqube-python --all-targets --all-features:1381 passed. Historical selection cargo test --locked -p hoonarqube-python s7503 -- --nocapture:3 passed. Unit symbols: s7503_flags_async_functions_without_awaits, s7503_preserves_async_generator_contracts, s7503_unproven_keyword_ranges_keep_the_original_primary.
• Both CLI targets python_s7503_message and python_s7503_supporting_locations:11 passed. New symbols: python_s7503_all_twelve_reference_supports_match_full_objects, python_s7503_supports_follow_tokens_through_nested_and_spaced_headers, python_s7503_test_scope_remains_exempt, python_s7503_indented_astral_crlf_keeps_scalar_and_utf16_coordinates, python_s7503_recovery_preserves_primary_and_incompleteness_when_support_is_unproven, python_s7503_supports_survive_same_path_positive_clean_restored_cache_stages. Existing five message regressions now include complete support objects; exact symbol/acceptance mapping is retained in the evidence package.
• Guard controls preserve the original primary for wrong/out-of-bounds/overflowing declaration starts/ends, UTF8 boundary failures and empty/mismatched/outside/overlapping names. Actual malformed missing-name CLI input preserves empty primary, ParsingError, incomplete project status, stderr and exit2. Proven declarations elsewhere in malformed input still gain support.
• Layout controls cover nested indentation, tabs, formfeed/header spacing, explicit continuation, astral names+CRLF with scalar/UTF16 ranges, MAIN/TEST, all inherited async-feature/exemption/scope controls and positive→awaited-clean→exact restored same-path cache transitions. New44 unchanged-binary baselines and44 final complete reports match exact projections/exit/stderr;36 admitted support additions. Source bytes are retained before/after each execution. These are native preservation controls.
• All188 frozen full report expectations were actually replayed against the final binary. Complete160:4changed/48supports,156byte-identical stdout streams. Supplemental28:20changed/36supports,8unchanged. All188 exits, stderr, order, completeness, metadata, metrics, primaries, counts and non-target findings match exact projected bytes. Original656 totals remain strict2327 / sonar-parity1380. Actual12 reference primary/support tuple multisets match in all four original documents.
• Exactly12 inherited cache stages and12 supplemental stages use authorized isolated cwd with immutable per-stage snapshots and immediate source hashes; other148 complete160 and16 supplemental static cwd/argv values remain original apart from executable/cache substitutions. Old evidence/source/execution heads remain retained without relabelling.
• Strict affected all-target/all-feature Clippy with -D warnings, workspace fmt and base-to-head diff pass. Pinned released0.3.1 implicit-default-profile dogfood over crates/xtask in a pinned read-only Linux runner with no network has zero Rust S3776.
• Locked compiler artifact binds executable SHA256 aaa93057962ca3295acf91df8703853de46800daaf71573ba54101818f039bcd to clean signed head 018e6d2c5feef45b2e743935de88cb23ecad989f / tree b7f659177e47277cb13ca81c836615d90a83eebb. Full receipts, executed test maps, complete reports and immutable source/binary envelopes: /Users/wakemeup/.codex/artifacts/hoonarqube-repairs-20261013/python-s7503-supporting-locations. Hosted21 exact-head checks remain pending at worker handoff.

This dependent PR is initially published against main so default-setup CodeQL can analyze the exact signed head, then its base is restored to fix/smoke-python-s7503-message-20261015 at 2c6c3d5ad4c0bbb596d94ab7211a9135b616eb6f. All 21 checks, the exact head, live body and GitHub signature are verified again after restoration.

Compatibility and risks

Native JSON gains one flow and Generic Sonar gains one secondary location for proven selected functions. The exact primary message, range, selection, order, multiplicity, completeness and existing automatic-fix fields retain their values. Source guards conservatively omit unproven support while preserving diagnostics. Existing shared flow/export support is reused; no parser, catalog, profile, dependency, cache, IR, public helper, schema or exporter changes.

Limitations

Focused actual12 primary/support tuple parity is qualified from retained SonarQube26.9/Python5.31 evidence. Newly added layout/Unicode/recovery/TEST/cache controls establish native preservation, not fresh Sonar parity. No new server/reference scan, whole-object metadata/rule/global parity or quickfix repair is claimed. Root owns independent review, all21 hosted checks and intended PR946 dependency-base restoration with final live body/head/signature/check readback. No merge, tag or release is included.