WIP: fix(doc_markdown): wrap rule_id in backticks in SensorFinding::code doc

.hermes/conveyor/work-3d8d9b32/adr.md

@@ -0,0 +1,60 @@
+# ADR-0013: Close Issue #289 — Severity::Info Already Maps to "info"
+
+## Status
+Accepted
+
+## Context
+
+Issue #289 reported that `checkstyle.rs` had `Severity::Info` and `Severity::Warn` both mapping to the string `"warning"`, causing a `clippy::match_same_arms` warning and making the Info arm dead code.
+
+However, prior investigation found that:
+- The bug was already fixed in PR #460 (commit b31d836)
+- The current code at `checkstyle.rs:71-75` correctly maps all three severities
+- All 28 checkstyle tests pass
+- Clippy is clean with no warnings
+
+The issue remains OPEN on GitHub despite the fix being merged.
+
+## Decision
+
+**No code changes are needed.** Issue #289 should be closed as "Already resolved" referencing PR #460.
+
+The current implementation is correct:
+```rust
+let severity_str = match f.severity {
+    Severity::Error => "error",
+    Severity::Warn => "warning",
+    Severity::Info => "info",  // ← Correct
+};
+```
+
+## Consequences
+
+### Tradeoffs
+
+| Alternative | Why Rejected |
+|-------------|--------------|
+| Create new PR with identical fix | Duplicates PR #460, wastes review time, risks new bugs |
+| Leave issue open | Misleads contributors, suggests bug still exists |
+| Modify working code | Unnecessary churn, no benefit |
+
+### Benefits
+- No risk of introducing regressions
+- Preserves existing test coverage (`info_maps_to_info` test)
+- Issue closure provides clear signal to contributors
+
+### Risks
+- Issue #289 must be closed on GitHub to prevent confusion
+- If future refactoring moves the severity mapping, regression tests must catch it
+
+## Alternatives Considered
+
+1. **Create duplicate PR** — Rejected: PR #460 already contains the correct fix
+2. **Do nothing** — Rejected: Open issue misleads contributors
+3. **Modify working code** — Rejected: No benefit, introduces risk
+
+## References
+
+- Issue #289: `checkstyle.rs:50-51: Severity::Info and Severity::Warn produce identical "warning"`
+- PR #460: `fix(checkstyle): Severity::Info maps to 'info' not 'warning'`
+- Commit `b31d836`: Merge commit that applied the fix

.hermes/conveyor/work-3d8d9b32/specs.md

@@ -0,0 +1,35 @@
+# Spec — work-3d8d9b32: Close Issue #289 (Already Resolved)
+
+## Feature/Behavior Description
+
+This work item concerns closing GitHub issue #289 which reports a bug in `checkstyle.rs` where `Severity::Info` and `Severity::Warn` produce identical `"warning"` strings. Investigation reveals the bug was already fixed in PR #460. No code changes are needed.
+
+## Acceptance Criteria
+
+1. **Issue Closure** — Issue #289 on GitHub is closed with resolution "Already resolved" and reference to PR #460 as the fix.
+
+2. **No Code Changes** — No modifications are made to `checkstyle.rs` or any other source files, since the bug was already fixed in PR #460.
+
+3. **Existing Tests Pass** — All 28 checkstyle-related tests continue to pass, ensuring no regression.
+
+## Non-Goals
+
+- No new code, tests, or functionality is being added
+- No changes to severity mapping logic (already correct)
+- No modifications to output format (already correct per checkstyle.org schema)
+
+## Dependencies
+
+- PR #460 must remain merged (contains the fix)
+- Existing `info_maps_to_info` test in `checkstyle.rs` must remain (prevents regression)
+
+## Current State Verification
+
+| Aspect | Status |
+|--------|--------|
+| `Severity::Error` → `"error"` | ✓ Correct |
+| `Severity::Warn` → `"warning"` | ✓ Correct |
+| `Severity::Info` → `"info"` | ✓ Correct |
+| Clippy `match_same_arms` | ✓ No warning |
+| Checkstyle tests | ✓ All 28 pass |
+| Module documentation | ✓ Matches implementation |

CHANGELOG.md

@@ -21,6 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Windows target triple detection for MSYS/MINGW environments
   - Concurrency control on SARIF upload to prevent race conditions across workflow runs
   - Improved error handling with user-visible warning messages for fallback installation paths
+- **`parse_unified_diff` now requires explicit Result handling** — Added `#[must_use]` to `parse_unified_diff` so the compiler warns when callers ignore the `Result`. This prevents silent parse failures where malformed diffs are silently ignored. Callers must now explicitly handle the `Result` or use `let _ = ...` to indicate intentional ignore. Closes #329.
 
 ### Changed
 
@@ -72,6 +73,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Internal
 
+- **`diffguard-types`**: Fixed `clippy::doc_markdown` lint on `SensorFinding::code` doc comment by wrapping `rule_id` in backticks for correct documentation rendering.
+
 - **Extracted duplicated `escape_xml` function** from `checkstyle.rs` and `junit.rs` into shared `xml_utils.rs` module
 
 ## [0.2.0] - 2026-04-06

adr.md

@@ -0,0 +1,60 @@
+# ADR: work-fd366614 — `#[must_use]` on `RuleOverrideMatcher::resolve()`
+
+## Title
+ADR-2026-04-27: Close as Already Resolved — `#[must_use]` on `RuleOverrideMatcher::resolve()`
+
+## Status
+**Accepted** — The fix was already delivered in PR #532 (commit `e0c2094`).
+
+## Context
+
+Issue #483 reported that `RuleOverrideMatcher::resolve()` in `crates/diffguard-domain/src/overrides.rs:108` was missing the `#[must_use]` attribute. The method returns a `ResolvedRuleOverride` whose default value is `{ enabled: true, severity: None }`. If a caller discards the return value and assumes the rule is disabled when no override matches, they get the opposite behavior — the rule runs with default enabled state.
+
+The conveyor created work item `work-fd366614` to address this issue. However, the fix was already applied in PR #532 (merged 2026-04-16) before the work item was created.
+
+## Decision
+
+**Close work item `work-fd366614` as Already Resolved.**
+
+The `#[must_use]` attribute is already present on line 108 of `crates/diffguard-domain/src/overrides.rs`:
+
+```rust
+#[must_use]
+pub fn resolve(&self, path: &str, rule_id: &str) -> ResolvedRuleOverride {
+```
+
+All callers properly handle the return value:
+- `evaluate.rs:187`: `let resolved_override = overrides.map(|m| m.resolve(path, &rule.id));` — result is bound and used
+- All test callers assign to variables and access `.enabled`
+
+No code changes are required.
+
+## Consequences
+
+### Positive
+- No new code needed — fix already in `main`
+- `#[must_use]` attribute correctly prevents silent discard of semantically important return values
+- Consistent with existing `#[must_use]` pattern in `suppression.rs` (lines 46, 70, 85)
+- Zero runtime cost — purely compile-time annotation
+- No breaking changes — all existing callers handle the return value
+
+### Negative
+- The conveyor expected branch `feat/work-fd366614/overrides.rs:108:-ruleoverridematcher::r` was never created (work item generated retroactively after fix was merged)
+- The latent semantic issue (`ResolvedRuleOverride::default()` returning `{ enabled: true }`) remains unaddressed but is out of scope for this work item
+
+## Alternatives Considered
+
+### Alternative 1: Create Confirmation Branch/PR
+Create a fresh branch and open a PR confirming the fix is in `main`.
+
+**Rejected**: The work item was generated retroactively. A no-op confirmation PR would clutter git history without adding value. The fix is verified present and correct.
+
+### Alternative 2: Change Default Semantics
+Change `ResolvedRuleOverride::default()` from `{ enabled: true }` to `{ enabled: false }` or make it `Option<ResolvedRuleOverride>`.
+
+**Rejected**: This would be a breaking change to `evaluate.rs:188`'s logic and requires a dedicated breaking-change work item with full caller audit. The current default may be intentional.
+
+## References
+- Issue #483: https://github.com/answerdotai/diffguard/issues/483
+- PR #532: https://github.com/answerdotai/diffguard/pull/532
+- Commit `e0c2094`: Already in `main` history

crates/diffguard-analytics/Cargo.toml

@@ -23,3 +23,4 @@ diffguard-types = { version = "0.2", path = "../diffguard-types" }
 
 [dev-dependencies]
 proptest.workspace = true
+insta.workspace = true