Question: Where are Billing and Delivery address validation failures collected and rendered in the same error container, including field-specific messages for missing or invalid address parts?


Question: Where are the checkout address mandatory, optional, and hidden field configurations loaded, and where can an optional per-field PCRE map validate identifiers such as `order.base.address.postal` and `order.base.address.telephone`?


Question: Where is the manager base class implementation of addFilter() and filter(), including storage and application of registered filter closures?


Question: Locate the order service item implementation of toArray() and fromArray(), including the taxrates field and getTaxRates()/setTaxRates() price mapping.


Question: Find the order product item price-field serialization and restoration logic that handles taxrates, to mirror it for order service items.


Question: Locate the order service item clone implementation and the price-object cloning logic that prevents cloned items from sharing mutable state.


Question: Where does the customer manager read `mshop/customer/manager/salt` and pass the value into customer item creation?


Question: Where does the customer item declare its salt state and accept the salt constructor parameter?


Question: Where does the customer item pass the salt to the password helper's `encode` method?


Question: Where are catalog properties such as config, site ID, URL, target, timestamps, editor, level, and parent ID stored and exposed by the item?


Question: Where does MShop_Catalog_Manager_Base build catalog items from search or fetch results and populate the wrapped tree node?


Question: How does MShop_Catalog_Item_Standard implement isModified() using both base item data changes and the tree node's isModified() state?


Question: Where does the main customer manager configure its public searchable fields and expose siteid?


Question: Where does the customer address manager define its public search attributes, including the siteid filter?


Question: Where does the customer manager clean up site records through its address, list, and group sub-managers?


Question: Where does ObjectReaderCreator process @JSONField-annotated constructor parameters alongside setter fields, and how can that path preserve the setter's generic List item type?


Question: Where is field-level format and JSONSchema metadata propagated from bean properties into list readers so it is honored while reading list elements?


Question: How does the setter field-reader path infer the element type from a signature such as setValues(List<Long>), and where is that type exposed through FieldReader#getItemType()?


Question: Where does BeanUtils maintain and clear concurrent reflection metadata caches for fields, methods, and constructors for one class or an entire classloader?


Question: Locate ObjectReaderProvider cleanup for a Class or ClassLoader and the reader cache paths that must create a fresh ObjectReader after cleanup.


Question: Find the ObjectWriterProvider and ObjectReaderProvider cache lookup and creation logic that interacts with BeanUtils metadata and must return new instances after cleanup.


Question: Find method- and function-based enum writer selection for FieldWriterEnumMethod and FieldWriterEnumFunc, and apply the same annotated-enum fallback consistently in the default, ASM, and Lambda object-writer creators.


Question: Find the object-writer field collection code that merges declared fields and getter-derived writers, replacing an existing same-name FieldWriter when FieldWriter.compareTo says the new writer is better instead of using putIfAbsent.


Question: Where is malformed object syntax handled when a field-name token fails to transition to a colon, so invalid structures inside arrays are consistently rejected?


Question: Where is JSON.parseArray implemented, and which production parser path reads array elements and reports malformed input as JSONException?


Question: Where is JSONPath.of(String[], Type[]) implemented, including the construction and selection of typed multi-path extractors?


Question: Where does the Kotlin deserialization path distinguish classes with default constructor parameters from classes without them while preserving reference-type defaults?


Question: Where is the bean-to-JSONObject field traversal implemented in ObjectWriterAdapter.toJSONObject, and where should @JSONField(format) alter temporal values before they are inserted?


Question: Where does FieldReader.compareTo rank competing readers for the same JSON field name, and how should setter/getter base-name matching against the annotation-resolved fieldName be applied after existing parameter-type priority?


Question: Where does FieldWriter.compareTo rank competing writers for the same JSON field name, and how should getter base-name matching against the annotation-resolved fieldName make the annotated property win deterministically?


Question: Where does fastjson2 scan bean getters and filter system types such as InputStream, and where should ClassLoader properties be excluded from serialization?


Question: Where is serialization metadata built for public fields, including the logic that skips fields typed as ClassLoader?


Question: Find the com.alibaba.fastjson2.JSONArray.getString(int index) implementation that provides the core library's compatible Date formatting and non-String value conversion behavior.


Question: Where is the JSONPath exists(...) filter expression parsed and tokenized, including handling of dotted paths such as exists(@.A.B.C)?


Question: Where are JSONPath array filter predicates such as [?exists(...)] evaluated, including returning the current matching object or null when the predicate fails?


Question: Find the property-resolution logic used by JSONPath filters to distinguish a missing final key, a missing intermediate key, and a non-Map intermediate value during nested path traversal.


Question: Where are JSONPath.remove and JSONPath.set implemented for nested paths, including deleting a Map entry instead of assigning null and assigning null to non-Map bean fields?


Question: Where does JSONPath mutation resolve and update nested properties on Java beans and collections of beans for paths such as $.a.b?


Question: Locate JSONWriter's reference-path construction for ReferenceDetection in JSONB serialization, including the EMPTY_LIST/EMPTY_SET exclusions and the ObjectWriterProvider.isNotReferenceDetect check.


Question: Where is JSONReader.Feature.DuplicateKeyValueAsArray handled during JSON object parsing, including conversion of repeated keys into a JSONArray?


Question: Locate the typed map deserialization paths that apply DuplicateKeyValueAsArray while preserving every repeated value in occurrence order.


Question: Where does JSON.parseObject(..., Object.class, ...) route a top-level JSON array into generic element parsing, and where are JSONReader features and autoTypeFilter propagated to each object element?


Question: Where are SAFE_MODE and DENY-list checks combined with JSONReader.autoTypeFilter and ErrorOnNotSupportAutoType during autoType resolution?


Question: Where is com.alibaba.fastjson.JSONObject key-based get implemented, including conversion of nested com.alibaba.fastjson2.JSONObject and com.alibaba.fastjson2.JSONArray values to v1 wrappers?


Question: Where is com.alibaba.fastjson.JSONArray index-based get implemented, including wrapping nested fastjson2 containers as com.alibaba.fastjson v1 types?


Question: Where does the bean ObjectReader construct setter-backed field readers and invoke a custom deserializeUsing ObjectReader with the declared primitive field type?


Question: Where does serialization select an ObjectWriter configured by JSONField.serializeUsing for getter-backed properties, including matching a boxed runtime value to the primitive initValueClass?


Question: Where does JSONPath evaluate filter comparisons between an object property and null, so explicit null-valued fields match?


Question: Where does JSONPath distinguish missing object properties from explicit null values while evaluating filter predicates?


Question: Where is the shared JSONPath filter application logic used by `JSONPath.extract` and `JSONPath.eval` implemented?


Question: Where is the production logic that serializes SockJS message arrays and controls JSON escaping and frame formatting?


Question: Where is the JSONPath set method signature and return handling defined so it returns the unchanged root object instead of void?


Question: Where does JSONPath remove handle wildcard selections such as $.*, $[*], and $..*, including Map or Collection results that should be cleared rather than raising UnsupportedOperationException?


Question: Where should JSONPath provide static set(String json, String path, Object value) and remove(String json, String path) overloads that parse raw JSON and serialize the modified root back to a string?


Question: Locate the UTF-8 writer's scalar float and double serialization methods and their handling of JSONWriter.Feature.WriteNonStringValueAsString.


Question: Find the generic map deserialization path for bean properties such as Map<SomeEnum, Object>, including extraction of the enum key class and construction of an empty EnumMap.


Question: Locate ObjectReaderImplMap handling for raw EnumMap.class and JSONB SupportAutoType, including runtime map selection and conversion when the serialized object has no entries.


Question: Locate ObjectReaderImplMapTyped logic that finalizes a typed map after reading entries, especially the empty EnumMap case where the known generic enum key type must be used instead of new EnumMap(map).


Question: Find the field-writer logic that reuses a cached List writer and checks whether the post-filter value is assignable to the declared List type.


Question: Where does com.alibaba.fastjson2.util.BeanUtils translate Jackson @JsonFormat pattern and shape into fastjson2 date-field formatting metadata?


Question: Where does the JSON facade expose ObjectReaderProvider and ObjectWriterProvider registration APIs, including registerIfAbsent and the changed register return values?


Question: Where does fastjson1-compatible SerializeConfig.put translate the changed registration result into a boolean indicating whether a new writer was added?


Question: Locate shared JSONPath wildcard collection-handling code that distinguishes expanding an inner array or collection from iterating the values of a contained Map for expressions like `$[*][*]` and `$[1][*]`.


Question: Where in the fastjson1-compatible layer do SerializeWriter constructors accepting SerializerFeature options initialize their JSONWriter context?


Question: Which object deserialization code populates `List<String>` properties through constructor parameters, field injection, and setter methods?


Question: Where is the production deserialization logic that maps a scalar JSON string value to a one-element `List<String>` instead of requiring an array?


Question: Where is the corresponding CSVWriterUTF16 string and byte-array field serialization logic that applies CSV quoting for commas, newlines, and carriage returns?


Question: Where does CSVWriterUTF8 handle writeString(byte[]) and decide whether CSV fields containing commas, line feeds, carriage returns, or quotes need double-quote wrapping?


Question: Where are JSON and JSONB type-specific writers and readers connected to JSON.toJSONString, JSON.parseObject, JSONB.toBytes, and JSONB.parseObject so File handling works across both codec paths?


Question: Where is JSON.parseArray(String, Class) implemented, and how does it convert JSON array items into List elements when the declared element type is an enum?


Question: Locate the production JSON serializer for java.nio.ByteBuffer values used by JSON.toJSONString, including conversion of buffer contents to the standard JSON byte-array representation.


Question: Locate the bean metadata, inherited-property, and filter handling used while building a JSONObject, including where null suppression should occur without bypassing excluded or inherited fields.


Question: Where is JSON Schema string validation implemented, including enforcement of the `const` equality constraint?


Question: Where is the object deserialization wiring for setter-based versus direct field injection, so deserializeUsing is not skipped for read-only fields?


Question: Where is com.alibaba.fastjson2.adapter.gson.Gson's existing fromJson(String, Class<T>) implementation that creates a JSONReader, uses the reader provider, handles resolve tasks, and returns the parsed object?


Question: Where does the JSONPath segment or parser logic represent recursive descent and distinguish it from non-recursive expressions whose result semantics must remain unchanged?


Question: Which production JSONPath code evaluates filter conditions such as `$..[?(@.dictId == '101')]` while collecting matching nodes during recursive traversal?


Question: Where does the JSON.parseObject reader factory select collection and map readers and normalize anonymous target classes before resolving generic component types?


Question: Where are getIntLE, getLongLE, getByte, getChar, and related low-level read helpers implemented for use by digitN parsing?


Question: Where are the production IOUtils digit2 through digit8 implementations for byte[] input, including digit validation and decimal result construction?


Question: Where are the production IOUtils digit2 through digit8 implementations for char[] input, including rejection of character codes above 0x7f?


Question: Where does ObjectReaderProvider cache readers by the serialized auto-type name hash, and how is registration handled when that reader is not assignable to the expected class?


Question: Where does JSONB root-object deserialization read a WriteClassName type identifier and resolve an auto-type reader under JSONReader.Feature.SupportAutoType, including the expected-class assignability check?


Question: Locate the equivalent JSON text deserialization paths that handle embedded class names with SupportAutoType and IgnoreAutoTypeNotMatch when the resolved type is incompatible with the requested type.


Question: Where does BeanUtils.processJacksonJsonFormat translate Jackson @JsonFormat.shape, especially JsonFormat.Shape.STRING, into FieldInfo writer features?


Question: Where does browser-compatible long overflow handling interact with WriteNonStringValueAsString so values remain quoted when both conditions apply?


Question: Where is the production code that deserializes Kotlin data classes by mapping JSON properties to constructor parameters?


Question: Where is the implementation of JSONPath.of(String[] paths, Type[] types) that constructs typed multi-name JSONPath instances?


Question: Where are extract(jsonString) and eval(arrayObject) implemented for typed multi-name JSONPath results?


Question: Where does serialization handle a value declared as Serializable whose concrete subclass or anonymous runtime instance is not Serializable, including skip and informative error behavior?


Question: Where is JSONObject.to(Class) implemented, including population of Java bean fields from JSONObject values and conversion of JSONArray values into declared array types such as String[]?


Question: Where are the String.class special cases for JSONObject.to(Class) and JSONArray.to(Class) implemented so they return the same JSON text as toString()?


Question: Where does bean deserializer construction order and deduplicate field readers for normal unique names while preserving distinct readers with the same effective name?


Question: Where does bean deserialization resolve a JSON field name to field readers and setter methods, and apply one parsed value to every matching property?


Question: Where do readArray and readList implement typed-element loops, and where can they verify reader progress to prevent re-reading an illegal token indefinitely?


Question: Where is JSONReaderUTF16.skipValue() implemented for nested JSON values, including the post-value handling that sets JSONReader’s inherited comma flag when a skipped array element is followed by a comma?


Question: Where are the JSONPath.of factory overloads implemented, especially JSONPath.of(String path, Type type, Feature... features), and how are features propagated to the created path?


Question: Where is JSONPath.Feature defined, and how are feature flags such as KeepNullValue stored and checked during path evaluation?


Question: Where is JSONPath result aggregation implemented so null matches can be retained when KeepNullValue is enabled while preserving default null filtering?


Question: Where is the XSSF protection hash converted with `Integer.toHexString`, and how is it formatted as the four-digit uppercase `ST_UnsignedShortHex` value?


Question: Where is the legacy XOR password verifier computed for XSSF sheet and workbook protection?


Question: Where is the Java production implementation of the DAYS360 spreadsheet function, including the US (NASD) versus European method selection?


Question: Where is the production implementation of POI's legacy XLS XOR password processing, including CryptoFunctions.createXorKey1, createXorVerifier1, and createXorArray1?


Question: Where is the shared PercentRank implementation used by PERCENTRANK.EXC and PERCENTRANK.INC, including significance handling and boundary or error behavior?


Question: Find the poi-ooxml production path that loads VML drawing parts for XSSFWorkbook comment shapes and allows an empty or malformed VML part without aborting workbook loading.


Question: Locate the production DataFormatter code that turns Excel number format strings into DecimalFormat patterns and formats numeric values.


Question: Find where DataFormatter configures DecimalFormat locale symbols and Excel rounding behavior for custom numeric formats.


Question: Where does shape import use getXmlObject or XML-bean copying rather than only high-level POI properties for group-shape children?


Question: Locate XSSFBReader’s binary workbook sheet iterator and its override wiring so getSheetIterator() returns the concrete iterator type.


Question: Locate the XSSFReader implementation of sheet iteration, including SheetIterator construction, the new getSheetIterator() API, and getSheetsData() compatibility delegation.


Question: Find example code that consumes XSSFReader or XSSFBReader sheet InputStreams and determine where each iterator stream should be closed with appropriate resource handling.


Question: Where does DeferredSXSSFWorkbook save the workbook by iterating sheets and generating sheet XML so removed sheets are excluded and surviving row-generator data is preserved?


Question: Where does DeferredSXSSFWorkbook override sheetIterator(), and how should it enumerate only the currently active sheets after removals?


Question: Where is SXSSFWorkbook.deregisterSheetMapping implemented, and how can it safely handle a null streaming writer or wrapper when a deferred sheet has not been flushed?


Question: Where do existing evaluators reject negative numeric inputs with #NUM! and compute square-root-style results, to follow for Math.sqrt(Math.PI * argument)?


Question: Where does ZipArchiveThresholdInputStream enforce ZipSecureFile's minimum inflate ratio and maximum entry size for streamed ZIP entries?


Question: Find the encrypted OOXML ZIP processing path that propagates an IOException when zip-bomb thresholds are exceeded while honoring the existing ZipSecureFile settings.


Question: Where is the production implementation of Excel’s three-argument T.DIST left-tail Student’s t function, including evaluation of x, degrees of freedom, and cumulative?


Question: Where does XDDFErrorBars access or construct its underlying OOXML error-bar properties, and how does getErrorDirection() safely handle an unset element?


Question: Find the XDDFErrorBars getter logic that reads the underlying OOXML error-bar type and value-type elements when those elements are absent.


Question: Where do formula functions enforce argument-size mismatches and propagate #VALUE!, #N/A, #DIV/0!, and other spreadsheet evaluation errors?


Question: Where is the formula evaluator's function-mapping table that assigns Excel function indexes, including the commented-out CORREL entry at index 307, to implementations?


Question: Locate the POIXMLTypeLoader.setClassLoader API and any state used to retain or consume the externally supplied classloader.


Question: Where does XSLF read and write a text run's highlight background color, including conversion between SolidPaint and the stored OOXML color?


Question: Where is XSLFTextRun's text-run formatting mapped to the underlying OOXML properties for a getHighlightColor()/setHighlightColor() PaintStyle API, including the Color overload and null removal?


Question: Where does DrawTextParagraph build the AttributedString for each text run and apply a resolved highlight Paint through TextAttribute.BACKGROUND only when a highlight is present?


Question: Locate XSSFShapeGroup anchor logic for client and child anchors, including calculation of off, ext, chOff, and chExt.


Question: Find the production code needed for createGroup(XSSFChildAnchor) to create a child XSSFShapeGroup, retain the parent's drawing, and assign the child anchor.


Question: Where is AesZipFileZipEntrySource.createZipEntrySource(InputStream) implemented, including creation of its encrypted temporary file, entry access, and deletion during close?


Question: Where is ZipEntrySource declared and where are all of its implementations' close methods that release resources or delete temporary files?


Question: Where can the serialized XSSFWorkbook data in the custom SXSSFWorkbook write path be routed through an AES-encrypted temporary file before injectData without altering the caller's final output stream?


Question: Where is TempFile's existing temporary-file creation path implemented, including setTempFileCreationStrategy, setThreadLocalTempFileCreationStrategy, and the logic that selects the active TempFileCreationStrategy?


Question: Where can the scoped TempFile strategy API validate non-null TempFileCreationStrategy and Supplier arguments while propagating supplier exceptions and still restoring thread-local state?


Question: Where are the default and concrete TempFileCreationStrategy behaviors wired into temporary-file creation, separately from the per-thread override mechanism?


Question: Where is the existing StaxHelper newXMLInputFactory() implementation that applies secure XMLInputFactory defaults and logs warnings when unsupported properties, including AbstractMethodError, are encountered?


Question: Which existing EMF record init methods validate record lengths before allocating arrays, and where is the shared allocation-size guard used?


Question: Locate the WMF/EMF rendering code that turns the selected bounding box into content position, especially the logic that must distinguish similarly sized candidates at different coordinates.


Question: Where does the HSSFWorkbook write path select and persist the configured encryption mode so a subsequent read preserves it and the cell data?


Question: Where should binaryRC4 and xor property sets be written unencrypted instead of raising the encrypted-property-set exception?


Question: Where are XDDFChartAxis.hasNumberFormat() and the shared axis number-format state implemented for value, category, and date axes?


Question: Locate the SXSSF workbook-writing path that serializes a formula cell’s cached string value and preserves it through workbook round-tripping without treating it as a plain string cell.


Question: Find the SXSSF formula-cell state and accessor logic for getCachedFormulaResultTypeEnum() and retrieving a cached string without losing the original formula.


Question: Locate the error-handling and cleanup logic for failed OOXML package reads from an InputStream, including any permitted stream closure.


Question: Find the common InputStream construction path used by XSSFWorkbook, XSSFSlideShow, and XWPFDocument to reach the low-level OOXML package and ZIP parser.


Question: Where are XWPFTableCell paragraph accessors and collection-building logic implemented, and could getParagraphs or related lookups mutate an otherwise empty cell?


Question: Where does XWPFTableRow.addNewTableCell create a new empty cell, and what production code assumes that such a cell already contains paragraph 0?


Question: Where can callers explicitly add a paragraph to an empty XWPFTableCell, and which cell-creation paths must leave the paragraph collection initially empty?


Question: Where is CellUtil.setCellStyleProperties implemented, including the logic that finds and reuses an existing cell style by comparing property maps?


Question: Where does CellUtil handle setFillForegroundColor(Color) and setFillBackgroundColor(Color), including fallback to the short color index after IllegalArgumentException?


Question: Where is readIndex initialized and advanced in LittleEndianInputStream, and how does getReadIndex expose the count after successful reads and EOF?


Question: Where do pastDaysOfWeek and calculateNonWeekendHolidays determine the sign of the calculated count, and how should equal start and end dates use <= rather than <?


Question: Where is the protected WorkdayCalculator.isNonWorkday method declared, and how should it be marked deprecated with the project’s @Removal annotation while preserving its direct-call behavior?


Question: Where is the production implementation of WorkdayCalculator.calculateWorkdays, including inclusive date-range counting and weekend and holiday handling?


Question: Find all SAX and DOM XML parsing entry points used for OOXML parts and the shared security settings applied consistently across them.


Question: Where does XML parsing propagate an exceeded entity expansion limit as a SAXException or equivalent parse failure?


Question: Where are Excel statistical functions implemented in the formula evaluation engine, and what production implementation pattern should TREND(known_y's, known_x's, new_x's, constant) follow?


Question: Where do Apache POI statistical formula handlers validate numeric arguments, truncate degrees of freedom, apply absolute values, and return #VALUE! or #NUM! errors?


Question: Where is the shared helper that computes the one-tailed Student’s t distribution used by TDIST, so TDIST.RT can reuse the mathematical calculation?


Question: Which Analysis ToolPak registry or dispatch table maps Excel function names such as TDIST to Java formula handlers, and where should TDIST.RT be registered?


Question: Where are Analysis ToolPak functions registered so the CEILING.MATH formula name is recognized?


Question: Where is the Analysis ToolPak function registry that maps AVERAGEIF to null, and how are AVERAGEIFS, COUNTIF, and SUMIF registered beside it?


Question: Where does the formula evaluation engine dispatch Analysis ToolPak functions registered by spreadsheet function name?


Question: Locate CopyCompare.main and the comparison routine, including InputStreamSupplier, so the command-line entry point can delegate to an instance without changing the algorithm.


Question: Locate the CopyCompare example's output state and redirection API, including the ThreadLocal<PrintStream>, setOut, and constructor that control how comparison output is written.


Question: Where does LOOKUP dispatch between its two-argument array form and its three-argument lookup-vector/result-vector form?


Question: Where are LookupUtils and ValueVector used to resolve LOOKUP arrays, create lookup and result vectors, and perform approximate matching?


Question: Where is the production code that stores HMEF message attributes and should match custom MAPI properties by numeric ID rather than object identity?


Question: Where is the production logic that formats positive values as fractions but zero and negative values as plain integers for 0 ?/?;0?


Question: Locate the length-bounding logic in IOUtils.safelyClone that limits both allocation checking and copying to the remaining bytes after offset.


Question: Where is MissingArgEval handled or coerced during numeric comparisons with blank-like operands?


Question: Where are Apache POI's evaluator implementations for the relational operators <, <=, =, >=, and > located?


Question: Where does POI load and parse XLSX VML drawing streams used by cell comments and form controls?


Question: Where are parsed VML shapes exposed through the XSSF VML drawing API after a drawing part is loaded?


Question: Where are HWPF documents reopened from FileInputStream or POIFSFileSystem, including the loading path that restores paragraph text?


Question: Which production code creates or writes a POIFSFileSystem for an HWPF document so the file-writing overload can reuse the existing serialization behavior?


Question: Where is the root operation stored or propagated in the serializer context so nested embedded relations use the collection operation's groups instead of an item operation's groups?


Question: Where are item and collection operation contexts wired into normalization so single-item responses retain item groups while collection responses use only collection groups?


Question: Locate the JSON-LD/Hydra and HAL relation normalization paths that consume operation serialization groups when choosing nested objects versus IRI references.


Question: Where is the api_platform.action.not_exposed route handler wired so it remains callable and still throws NotExposedHttpException when invoked?


Question: Where does PropertyFilter generate its OpenAPI and Swagger parameter metadata, including the configured query parameter name and array-syntax example?


Question: Locate the production implementation of PropertySchemaRegexRestriction that recognizes Symfony Regex constraints and creates an OpenAPI property pattern with getHtmlPattern().


Question: Where does the Laravel metadata factory create or decorate Eloquent resource operations with policy metadata?


Question: Where does ResourceAccessChecker::isGranted call Gate::allows for a Paginator and pass the resource class rather than the paginator object for collection authorization?


Question: Where does the link-building code distinguish an `ApiProperty` with `identifier: false` from one whose identifier setting is unset before auto-assigning `id`?


Question: Where are resource and operation attributes converted into metadata and default options overlaid with precedence for overlapping array keys?


Question: Where is the Elasticsearch ItemProvider provide implementation that retrieves an item with Client::get and handles a missing document?


Question: Find production code that merges global and operation-level parameters and skips entries that already exist, including the property-list-aware rule for :property parameters.


Question: Locate the production implementation of the Parameters collection constructor and add method, including deduplication by parameter key and class for :property parameters.


Question: Locate the factory that expands :property parameter templates into per-field parameters and builds a cache key using Parameter::getProperties() or Parameter::getProperty() so different property sets are not reused.


Question: Where is the ApiProperty metadata iri field declared, and how do getIri() and withIri() read and write string-or-false values independently of the deprecated types array?


Question: Where does JSON-LD normalization generate identifiers for anonymous resources or blank nodes, and how can it use a Skolem IRI when no explicit iri is provided?


Question: Where does relation normalization propagate the property metadata iri value into the child normalization context?


Question: Which metadata path supplies the complete expanded parameter set to OpenAPI generation when an operation defines multiple `:property` parameters?


Question: Find the identifier normalization logic used for URI or IRI generation, including composite identifiers, where resolved values are converted to strings for path parameters.


Question: Where is the runtime failure "We were not able to resolve the identifier matching parameter" generated for unsupported identifier values, and how are identifier object types currently dispatched?


Question: Where is the ODM item-provider IRI-to-document resolution logic that supports custom API identifiers, and how can the IriFilter parameter path reuse it?


Question: Where does API Platform normalize exceptions into RFC 7807 problem details and set the response status and title?


Question: Where are `GetCollection` query parameter metadata and pattern expansion wired together before the resulting parameters are exposed to consumers?


Question: Where is metadata for nested or embedded API resource classes resolved to determine their streamed JSON-LD @type values?


Question: Where does the HAL ItemNormalizer serialize embedded resource objects and expand their properties, so circular-reference detection can prevent recursive embedding?


Question: Where does GraphQL determine whether a query is an item or collection and pass `item_query` versus `collection_query` into metadata and type generation?


Question: Where do GraphQL operation-name callers handle a null operation name without substituting `query` or `item_query`, while preserving a provided operation name as-is?


Question: Where is the optional context['spec_version'] value read for documentation format selection, and how can that access avoid an undefined-index notice?


Question: Where is the default serializer service identified so MetadataAwareNameConverter is applied only to serializer and not to other serializer services?


Question: Where is the Messenger DataPersister implementation whose persist method dispatches data on the bus, and how does its remove method attach a RemoveStamp?


Question: Where does the API Platform OpenAPI factory construct operation responses for each status code and generate their media-type content and resource links?


Question: Where does AttributePropertyMetadataFactory::createMetadata overlay non-null ApiProperty attribute values onto metadata returned by a decorated PropertyMetadataFactoryInterface?


Question: Where is the MongoDB ODM aggregation pipeline for pagination built, including the $facet stage and pagination_partial handling?


Question: Where is the distinction between #/definitions/... and #/components/schemas/... handled when applying Hydra properties to root and collection item definitions?


Question: Where does ExistsFilter detect inverse-side Doctrine associations and create an explicit QueryBuilder join, and what logic should SearchFilter mirror?


Question: Find the implementation of the autogenerated OpenAPI operation descriptions such as "Retrieves a Dummy resource.", "Creates a Dummy resource.", and "Replaces the Dummy resource.", where the same generated value can be used for summary without changing description behavior.


Question: Find the flat-pagination path enabled by pagination_enabled that builds _api_filters when page=N is used without bracket-style pagination parameters.


Question: Where do the VarnishPurger, VarnishXKeyPurger, SouinPurger, and SurrogateKeysPurger constructors declare the injected clients argument and its HttpClientInterface[] PHPDoc, currently using an array type?


Question: Where do VarnishXKeyPurger and SouinPurger consume the injected clients collection to issue HTTP cache purge requests?


Question: Where does VarnishPurger store the injected clients collection, and where is it iterated during Varnish cache invalidation?


Question: Which production serialization or pagination-context consumers still read collection_operation_name, and what operation_name logic surrounds those reads?


Question: Where does JSON Schema generation distinguish a direct request or response schema for an explicitly provided operation from a component schema describing an embedded resource?


Question: Where do JSON-LD, Hydra, or JSON:API resource-property schemas delegate to the JSON Schema factory so nested schemas share its deprecation behavior?


Question: Where does ResourceMetadataCollection resolve and cache HTTP versus GraphQL operations, ensuring collection and item lookups with different flag combinations do not share cached entries?


Question: Where is the Operations constructor assigning priorities from integer array keys, and how does it preserve an operation priority that was already explicitly set?


Question: Where does the production Hydra documentation normalizer build the JSON-LD response for `/docs.jsonld` and assemble its `@context` array, including the standard Hydra context as the first element?


Question: Where are Hydra operation descriptions normalized into `expects` and `returns` values, including the logic that currently emits `#Dummy` instead of `Dummy`?


Question: Where does the JSON-LD `ContextBuilder` define or expose the reusable standard Hydra context constant `http://www.w3.org/ns/hydra/context.jsonld` that documentation generation should reuse?


Question: Where is the Hydra documentation entry point constructed and its `returns` value set to `#EntryPoint`, so it can use `EntryPoint`?


Question: Where is Hydra pagination view generation implemented for hydra:next and hydra:previous links when paginationViaCursor is enabled?


Question: Locate the code that determines the JSON Schema type for a BackedEnum and maps integer backing values to "integer" while keeping string backing values as "string".


Question: Where is FilterEagerLoadingExtension::getQueryBuilderWithNewAliases implemented, and where does it remap aliases while cloning a Doctrine query builder?


Question: Locate where `stateOptions` with `entityClass` and `#[Map]` are used to map DTO input into a Doctrine entity for write operations.


Question: Where does the Symfony MainController __invoke flow initialize the operation, invoke the state provider, and extract request URI variables?


Question: Where does Doctrine ORM eager loading with fetchPartial construct partial SELECT fields from serializer groups for each joined association?


Question: Where does the eager-loading extension expand serializer_groups into explicit normalization_groups and denormalization_groups before applying per-property group contexts?


Question: Find the collection-denormalization type-checking logic that currently compares a key only with the first type in a union and should accept it when it matches any declared key type.


Question: Find the production documentation handler that serves Swagger UI HTML for requests with `Accept: text/html`, including the clear 404 response when `enable_swagger_ui` is false.


Question: Locate the Symfony API Platform configuration and container extension that reads `enable_swagger_ui` and propagates it into service registration.


Question: Where does QueryParameterValidateListener check _api_platform_disable_listeners before obtaining or invoking the query-parameter validation ProviderInterface?


Question: Where does Hydra documentation serialization build one supported class per ApiResource declaration with its own hydra:title and supported operations?


Question: Where are multiple #[ApiResource] attributes on one PHP class converted into independent resource metadata entries instead of only the first declaration being retained?


Question: Where does Hydra entrypoint serialization enumerate every ApiResource declaration’s collection operations, including CollectionOperationInterface operations and POST, to create entrypoint links?


Question: Where is the JSON-LD context for /contexts/Entrypoint generated from resource declarations, short names, and collection operations?


Question: Where is LegacyOpenApiNormalizer implemented, including the entry point that converts OpenAPI 3.1 documents to 3.0 when spec_version is 3.0.0?


Question: Where is the GraphQL item resolver that throws UnexpectedValueException with “Resolver only handles items of class %s but retrieved item is of class %s” when validating provider results?


Question: Where is the Messenger ContextStamp implemented, including how it stores and exposes the dispatch context?


Question: Where is PropertyInfoPropertyNameCollectionFactory implemented, and how does it convert Symfony PropertyInfo getProperties() results into a PropertyNameCollection for resource classes with no properties?


Question: Where are nullable and exact-class property types handled so ?\BcMath\Number preserves null and does not change handling of other custom classes?


Question: Where does the Symfony Serializer integration register an optional NumberNormalizer, guarded by \BcMath\Number availability and by the absence of an existing service?


Question: Find the metadata attribute default resolution that derives getters for Operation or ApiResource and skips unknown attribute keys instead of calling nonexistent methods.


Question: Locate OpenApiFactory path construction for operations without an explicit routeName, including prepending routePrefix to the uriTemplate used as the OpenAPI path.


Question: Find the handshake authentication code that combines negotiated cipher-suite auth methods with configured certificate and signature-scheme compatibility.


Question: Which TLS 1.3 secret-derivation routines read conn->secure or conn->secure->cipher_suite, and where are their defensive NULL checks and error returns implemented?


Question: Locate TLS 1.3 key-schedule error paths that should return S2N_ERR_NULL instead of dereferencing missing connection security state or cipher-suite state.


Question: Where is s2n_tls13_secrets_get implemented, and where should it reject a NULL conn->secure or conn->secure->cipher_suite with S2N_ERR_NULL before deriving TLS 1.3 secrets?


Question: Where does server cipher negotiation determine the configured leaf certificate type and filter RSA_SIGN versus ECDSA_SIGN cipher suites?


Question: Where is s2n_recv_quic_post_handshake_message implemented, including the state transitions used when parsing a NewSessionTicket and preparing for a subsequent post-handshake message?


Question: Where is s2n_is_grease_value defined and referenced by fingerprint generation so it can be renamed s2n_fingerprint_is_grease_value without leaving stale calls?


Question: Which production JA3 and JA4 fingerprint call sites pass raw digest buffers to s2n_fingerprint_hash_digest and need initialized s2n_blob values for MD5_DIGEST_LENGTH or SHA256_DIGEST_LENGTH output?


Question: Where is the fingerprint hash-digest wrapper that validates hash, hash->hash, and a non-null output blob, then forwards out->data and out->size to the underlying digest?


Question: Where does s2n_ktls_sendv_with_offset validate the offset against total iovec data, including zero-byte sending when offset equals the total and S2N_ERR_INVALID_ARGUMENT when it exceeds it?


Question: Where does s2n_ktls_send_cb validate NULL io_context and buf arguments and map them to S2N_ERR_NULL instead of S2N_ERR_IO?


Question: Where is the outbound TLS record header serialized, including the existing TLS 1.0 fallback, so the wire protocol version can be capped at S2N_TLS12 (33)?


Question: Find the production code that compares an incoming record version with actual_protocol_version and rejects mismatches; the expected value should use MIN(actual_protocol_version, S2N_TLS12) for TLS 1.3.


Question: Where is the production s2n_random.c definition of s2n_openssl_rand_method and its bytes, pseudorand, and status callbacks, including unused callbacks that can be removed?


Question: Where does s2n_init install s2n_openssl_rand_method with RAND_set_rand_method, and where does s2n_cleanup save or restore the original RAND method?


Question: Find the TLS 1.3 handshake path that derives the early, late, and finished secrets and can securely free server_ecc_params and client_ecc_params[] afterward.


Question: Where does the Integration V2 framework expose binary data transfer and exact peer-output matching after the handshake instead of only checking protocol-version output?


Question: Which production code calls s2n_tls13_derive_early_secrets during s2n_tls13_handle_handshake_secrets, and where is conn->psk_params.chosen_psk available?


Question: How does s2n_tls13_derive_binder_key accept and validate a struct s2n_psk, and are there existing non-empty secret checks to follow for psk->early_secret?


Question: Where should a shared active-sequence-number helper validate a non-null connection, reject an invalid `s2n_mode`, select the client or server sequence number, and call `s2n_blob_init`?


Question: Find the production key-update sending path that selects `client_sequence_number` versus `server_sequence_number` based on `s2n_mode` and passes the result to `s2n_blob_init`.


Question: Where is the connection-level getter pattern used by `s2n_connection_get_secure_cipher` implemented, and where should the active sequence-number getter declaration and implementation live?


Question: Locate the kTLS crypto-info initialization path that wraps the active client or server sequence number in an `s2n_blob`.


Question: Where does the random subsystem invoke the callbacks configured through s2n_rand_set_callbacks during normal operation?


Question: Where is the public s2n_rand_set_callbacks API implemented, including storage of the init, cleanup, seed, and mix callbacks?


Question: Where is the key-exchange callback interface and cipher-suite wiring that associates each KEX implementation with its support and configure callbacks?


Question: Where are the hybrid ECDHE-KEM callbacks implemented, including the negotiated_kem setup that should occur only during configuration?


Question: Where does the server cipher-suite selection loop check key-exchange support and configure KEX only after a cipher suite is selected?


Question: Where do s2n_config_enable_server_max_fragment_length() and s2n_config_set_max_fragment_length() store the opt-in state and configured server MFL size?


Question: Where is the server max fragment length enabled flag initialized when s2n_config_new() creates a fresh configuration, and how is the default kept disabled?


Question: Find the TLS 1.3 protected-record write logic that appends the inner content_type opaque byte and sets the outer header type to TLS_APPLICATION_DATA.


Question: Where does the client Finished-message handler perform constant-time Finished verification and reject the handshake when `rsa_failed` is set?


Question: Where are the production memory helpers for constant-time byte operations, and where should a mask-based copy-or-don't-copy routine taking source, destination, length, and `dont` be implemented without branching on `dont`?


Question: Find the production logic that negotiates a signature scheme by comparing client signature_algorithms with server preferences, TLS version, cipher-suite authentication requirements, and the configured certificate.


Question: Find the TLS 1.3 server-side ClientHello processing that parses the signature_algorithms extension and currently raises the "Empty signature scheme" error when the extension is absent.


Question: Find the definitions and production call sites for the "Empty signature scheme" and "Invalid signature scheme" errors so fallback handles missing or incompatible client input and only an unusable server configuration fails.


Question: Where is the complete set of externally visible functions accepting struct s2n_connection * defined and implemented, so every direct connection dereference can be checked for a null guard?


Question: Where are the EMS extension offer and acceptance paths implemented, including the S2N_IN_TEST gate replacing s2n_in_unit_test() and the ems_negotiated flags on each connection?


Question: Where does the EMS master-secret calculation build the TLS 1.0/1.1 MD5 and SHA-1 session-hash blobs versus the TLS 1.2 cipher-suite PRF-hash blob and NULL second argument?


Question: Where is `s2n_connection_set_early_data_state` implemented, including the comparison between `next_state` and the connection's current early-data state before transition validation?


Question: Where is the low-level production I/O routine that writes encrypted TLS bytes to an s2n connection file descriptor, including any raw write() call?


Question: Where are close_notify_received and close_notify_queued used to distinguish normal close_notify alerts from error alerts during shutdown?


Question: Where does s2n_init() depend on RAND_bytes(), and how does that initialization path interact with RAND engine cleanup and later re-initialization?


Question: Find the production code that handles peer initialization, calls managePeerF for new peers, and decides when to invoke syncHelper for already-known peers.


Question: Where is syncHelper implemented and how does it safely handle repeated calls while a synchronization is already in progress?


Question: Which production callers of buildBitcoindNodeApi create a Promise[WalletApi], pass its future, and complete it with the wallet?


Question: Where does the bitcoind node API wiring synchronize blocks, process them through WalletApi, and invoke chain callbacks?


Question: Find the production API for overloaded confirmation-subscription helpers returning Future[ConfDetails], including the variant that uses an all-zero txId to match any transaction for a ScriptPubKey.


Question: Where in LndRpcClient are existing invoice notification streams wrapped, so a chain-notifier registerConfirmationsNtfn wrapper can expose Source[ConfEvent, NotUsed]?


Question: Where are the implicit conversions between LND OutPoint and TransactionOutPoint defined in LndUtils, including mappings for vectors in both directions?


Question: Where is the LND RPC fund-PSBT wrapper implemented, including PSBT and raw inputs/outputs overloads with fee rate, spendUnconfirmed, and account propagation?


Question: Where are the initialization-timeout, query-timeout, response-timeout, reconnect, and stop callbacks invoked by P2PClient?


Question: Where does PeerManager construct and pass P2PClientCallbacks into the peer discovery or connection management flow?


Question: Find the conversion utilities used by invoice feature tags between 5-bit groups and bytes, especially handling payload lengths that are not byte-aligned without losing bits.


Question: Where do production call sites construct SegwitV0SpendingInfo, LegacySpendingInfo, or NestedSegwitV0SpendingInfo so their redundant txid argument can be removed?


Question: Where is UTXORecord defined, and which production construction or conversion paths pass a separate txid together with its outPoint?


Question: Where are SpendingInfoDb and the SegwitV0SpendingInfo, LegacySpendingInfo, and NestedSegwitV0SpendingInfo case classes defined, including the txid method and the require that checks it against outPoint.txIdBE?


Question: Where does `processTransaction` or the wallet's own outgoing-transaction path perform redundant relevant-output lookups, and how should a precomputed output set be passed into those paths?


Question: Where does DLC wallet transaction processing extend the normal wallet transaction handler, so it can accept and reuse precomputed relevant outputs?


Question: Where is the database lookup for known wallet script pub keys implemented, especially the SQL `IN (...)` query, and where should its input be chunked to stay below database parameter limits?


Question: Where does wallet block processing inspect each transaction and perform the relevant script-pub-key/output lookup, and how can it fetch the relevant outputs once for the whole block and reuse them?


Question: Where are the gRPC services such as `version` and `zipdatadir` registered, and where are server start, serve, and stop lifecycle operations coordinated?


Question: Where is the gRPC CLI option parsing and client-call setup implemented so `--password` adds Basic authorization credentials with every gRPC call?


Question: Where does the existing HTTP API read `bitcoin-s.server.password` and validate its Basic authentication credentials so gRPC can reuse the same behavior?


Question: Where are `bitcoin-s.server.password` and `rpchost` declared, defaulted, and loaded into the RPC server configuration?


Question: Locate the sync-state definitions and transitions around `DoneSyncing` where a `MisbehavingPeer` state can retain the offending peer without disconnecting or resyncing immediately.


Question: Locate compact-filter-header, filter, and block download paths that require an available sync peer or special-case `DoneSyncing`, so `MisbehavingPeer` skips or errors without sending requests.


Question: Locate header-request and filter-header timeout handlers that start syncing from a new peer when the timed-out peer is the one recorded by `MisbehavingPeer`.


Question: Locate peer-stop cleanup for a peer in `MisbehavingPeer`, ensuring the stopped peer is removed without attempting an invalid removal or raising an error.


Question: Locate payload dispatch and state guards that reject further data from the marked misbehaving peer but reset to `DoneSyncing` when a different peer sends data.


Question: Where is `BitcoindRpcBackendUtil.startBitcoindBlockPolling` implemented, including its `FiniteDuration` default and block-polling scheduler?


Question: Where is WalletCallbacks defined, including the existing onTransactionProcessed callback, registration methods, and other wallet event callbacks?


Question: Where does the wallet process a Block and update its internal state, and what code marks processing as successfully complete?


Question: Where does the wallet invoke WalletCallbacks.onTransactionProcessed after successfully processing a transaction, including its Future[Unit] failure-handling behavior?


Question: Where is `rescanNeutrinoWallet` implemented, including how it assembles the block-matching input from persisted wallet addresses and watched script public keys?


Question: Locate the production definition of FutureUtil.makeAsync and the code that submits its thunk to an executor.


Question: Where is startup configuration loading wired to reject an invalid bitcoin-s.wallet.walletName with a clear error message?


Question: Where is `LndRpcClient` defined, and where are its existing `lnrpc` and `routerrpc` clients wired into route discovery and payment operations?


Question: Where is the existing `LndRpcClient` invoice-payment flow that accepts candidate `Route` objects, orders them by `totalFeesMsat`, and tries them sequentially?


Question: Where does the client extract an optional amount and destination `NodeId` from an `LnInvoice`, including the zero-satoshi fallback when no amount is present?


Question: Where does `LndRpcClient` query routes for a `Satoshis` amount and `NodeId` and convert the LND response into bitcoin-s `Route` objects?


Question: Where does the LND client submit an HTLC or payment over a supplied `Route`, attach a fresh random payment hash, and interpret `INCORRECT_OR_UNKNOWN_PAYMENT_DETAILS`?


Question: Where is the shared keyed-collection canonicalization logic that converts -0 to +0, and where do Map.set, Map.groupBy, and Set currently use it?


Question: Where do Map.prototype methods validate that this is a Map and throw TypeError for incompatible receivers?


Question: Where are Map.prototype methods defined and registered so getOrInsert and getOrInsertComputed can be exposed on the Map prototype?


Question: Where does the Map implementation perform canonical-key lookup, insertion, and value replacement, including rechecking a key after user callback mutation?


Question: Where is ObjectData defined with the specialized Array, Map, String, and Boolean variants, and where are the matching Object predicates and borrow accessors implemented for adding a first-class RegExp variant?


Question: Where are the RegExp.prototype dotAll, flags, global, ignoreCase, multiline, source, sticky, and unicode getters defined or registered, so they can be temporarily removed with a TODO for proper ECMAScript accessor properties?


Question: Where are the RegExp built-in methods test, exec, match, match_all, and toString implemented, and where do they retrieve state through with_internal_state_ref or internal-slot lookups that must move to ObjectData?


Question: Which String prototype built-ins inspect a regexp argument using RegExpMatcher or OriginalSource, and where is that RegExp detection logic implemented so it can use the ObjectData check instead?


Question: Where does RegExp::init install the global RegExp constructor, and where is the standalone RegExp::create initialization path that must be eliminated?


Question: Where is JsArrayBuffer::from_byte_block implemented, and how do ArrayBuffer constructors initialize or expose a maximum byte length for resizable buffers?


Question: Where is the production implementation of ArrayBuffer’s internal data structure, including max_byte_len, detached-state checks, and backing-store resizing?


Question: Where does the underlying ArrayBuffer data block grow or shrink, including any existing zero-filling behavior when bytes are added?


Question: Where is the WebAPI Fetch `Response` constructor implemented, including the check that rejects a non-null body for null body statuses?


Question: Where do array iterator methods invoke callbacks through the interpreter call mechanism with element, index, array, and the optional thisArg?


Question: Where is the Array prototype built-in registration implemented, and how are map, every, forEach, and find exposed on it?


Question: Where do Boa array built-ins construct a standard new array and set indexed elements and length while preserving element order?


Question: Where does the runtime create an ordinary object with a specified internal prototype, including an object value or `null`, for `Object.create(proto)`?


Question: Where is the built-in `Object` constructor's static method wiring implemented, including registration of `Object.create` and its `length` value of 2?


Question: Where is the TimeoutJob recurring flag defined and consulted when interval jobs are dispatched and re-enqueued for their next deadline?


Question: Where is Context::run_jobs implemented, and how does it invoke the job executor that drains timers and decides when to return?


Question: Where are the Console methods that invoke Logger callbacks and pass the Console object, including the Context and ConsoleState borrows needed for the new signatures?


Question: Where is the Logger trait defined and where are its production implementations, including DefaultLogger, whose methods currently receive &Console and need &mut Context plus &ConsoleState?


Question: Where are Console's counters, timers, and group-stack fields initialized, read, and mutated so they can be encapsulated in a private-field ConsoleState with public accessors?


Question: Where do Object builtin methods coerce an argument to an object and raise a TypeError for null or undefined?


Question: Where are JavaScript property keys represented and converted so integer-index keys such as "0" and "1" remain strings while symbol keys remain symbols?


Question: Where is the Object builtin's static-method registration and production implementation of Object.keys, and where should Object.getOwnPropertyNames and Object.getOwnPropertySymbols be wired in?


Question: Where does the parser communicate that the next slash should use the RegExp lexical goal rather than division or assignment-operator tokenization?


Question: Where is the `AssignDiv` token defined and parsed, and how is genuine `a /= 2` behavior kept separate from regex literals in expression positions?


Question: Where is regular expression literal scanning implemented, including consuming a pattern beginning with `=` and any trailing flags?


Question: Where is the shared `#[boa(...)]` attribute parser and naming-convention logic used by `TryFromJs`, `TryIntoJs`, `boa_class`, and `boa_module`, including `camelCase`, `PascalCase`, and `none` conversion?


Question: Where are non-test Boa macro call sites using legacy `#[boa(name = "...")]`, container `rename`, or module `rename_class`, especially the `try_into_js_derive` example that should demonstrate the new rename attributes?


Question: Where are the built-in Map prototype methods, including `Map.prototype.entries()`, registered and exposed so `Map.prototype.keys()` and `Map.prototype.values()` can be added?


Question: Where is the implementation of `Map.prototype.entries()` and creation of the underlying Map iterator that preserves insertion order?


Question: Which existing `JsNativeError` accessors use `const` and `#[inline]`, and where should a public `kind(&self) -> &JsNativeErrorKind` getter follow those conventions?


Question: Where do non-test production paths and compileable documentation inspect `JsNativeError.kind` directly, so those reads can be migrated to `JsNativeError::kind()` after the field becomes private?


Question: Where should TryFromJs for TypedJsFunction<A, R> be implemented, including conversion of callback arguments and results?


Question: Which scope-analysis paths use contains_direct_eval for binding escape analysis and should remain separate from unconditional function-scope index assignment?


Question: Locate the shared scope-index layout code that handles nested class declarations inside class expression constructors or static blocks and can produce an empty scope-index table.


Question: Where does the scope-index optimization pass assign indices for class expression constructors, and how does it decide whether their function scope is present?


Question: Where is the boa_gc implementation of Gc<T> and its allocation ownership, cloning, tracing, finalization, and drop behavior?


Question: Where is the private addr_eq helper defined and used in production pointer comparisons that should switch to std::ptr::addr_eq?


Question: Where does the garbage collector’s existing type-erased tracing machinery retain runtime type information such as TypeId for Gc<T> values?


Question: Where are the core and plugin implementations of __(), __n(), __d(), __dn(), __x(), __xn(), __dx(), and __dxn(), and how do they obtain a translator through I18n::getTranslator()?


Question: Where are I18n::setTranslator() and I18n::getTranslator() implemented, including the loader-before-locale signature and direct access to the translator collection through static::translators()?


Question: Find the EntityTrait implementations of isEmpty() and hasValue() to verify that null-aware existence behavior is confined to has().


Question: Where does `TimeHelper` implement `fromString()`, `toAtom()`, `toRss()`, and `timeAgoInWords()` timezone conversion, including the guard that should call `setTimezone` only when `method_exists($dateTime, 'setTimezone')`?


Question: Where does `RelativeTimeFormatter` implement `timeAgoInWords()` and `dateAgoInWords()`, and how does its timezone conversion need to avoid deprecated `->timezone(...)`?


Question: Where is DateType’s `_useLocaleMarshal` locale parsing path implemented, so a dedicated date-only `marshal()` preserves locale marshalling?


Question: Where is Chronos/I18n date formatting implemented for `DateFormatTrait::i18nFormat()`, and which `->timezone(...)` conversion should use `->setTimezone(...)`?


Question: Where does Controller::paginate() resolve a Table, Query, string table name, or null through fetchTable() before pagination?


Question: Where does FormProtectionComponent initialize the FormProtector used for _Token generation, and how is the component’s unlockedFields configuration passed into it?


Question: Where does TreeBehavior configure its options and defaults, and where should an enableOrmDelete option default to false?


Question: Where can TableLocator track concrete table classes while their initialize() methods are running and reject re-entrant get() calls with a RuntimeException?


Question: Where does TableLocator clear cached tables and reset any state associated with table classes currently being initialized?


Question: Where does the createInstance() path invoke table initialization, and where should in-progress recursion state be removed after construction or failure?


Question: Where does TableLocator resolve a requested alias to its concrete table class and return an already cached instance instead of constructing it again?


Question: Where are formatter serialization options handled, including constructor-configurable JSON encoding flags with JSON_UNESCAPED_UNICODE as the default?


Question: Where is Xml::build implemented, including selection of the SimpleXMLElement versus DOMDocument return paths and the readFile option?


Question: Where does RequestHandlerComponent::convertXml parse XML request bodies into arrays, including the special data-root wrapping behavior?


Question: Where does the OAuth client build the signature base string from normalized parameters and handle flat versus nested request bodies without array-to-string conversion errors?


Question: Where is the production implementation of ConsoleIo::ask(), askChoice(), and _getInput(), including prompt defaults?


Question: Where does BaseCommand::run() handle the quiet option and configure ConsoleIo before executing a command?


Question: Find the shared persistence logic used by save, update, and delete that reads primary-key values without casting non-string objects such as DateTime to strings.


Question: Find where Type::build() values for date, json, and other complex primary-key columns are prepared and bound in row lookup, update, and delete conditions.


Question: Locate InstanceConfigTrait's existing getConfig() resolution and handling of missing, nested, or null configuration values for adding getConfigOrFail().


Question: Find Configure::readOrFail() and its InvalidArgumentException validation and message as the existing fail-fast configuration pattern.


Question: Locate StaticConfigTrait's static configuration storage and getConfig() lookup, including how missing keys and null entries are distinguished.


Question: Where does RouteBuilder expose or delegate route middleware configuration, including registerMiddleware(), applyMiddleware(), and hasMiddlewareGroup(), so middlewareGroup() can be added consistently?


Question: Where are middleware-name existence checks and RuntimeException validation performed for duplicate registrations or missing middleware, and how should those rules cover duplicate group names and middleware/group overlap?


Question: Where does ConsoleExceptionRenderer render chained exception stacktraces, and how does it compare child and parent frames to suppress duplicate file-and-line entries?


Question: Where are the callers that convert debugger backtrace frames into string stacktraces, and how do they choose the current top frame instead of looking ahead to the next frame?


Question: Where is PhpError::getTraceAsString implemented, including plain-text handling of frames without file or line information such as the final [main] frame, without emitting ?? or [internal] for an empty line?


Question: Locate the production implementation of `Cake\Utility\Filter`'s static scalar converters and the edge-case logic to preserve when the class is removed: Stringable handling, NaN/INF rejection, precision-preserving non-scientific float formatting, `FILTER_VALIDATE_INT`/`PHP_INT_MIN` overflow behavior, safe ±9007199254740991 bounds, and exact 0/1 boolean matching.


Question: Where does CakePHP translate composite-field TupleComparison expressions into SQL for the SQLite and SQL Server drivers?


Question: Locate the base Driver class that declares the complete set of FEATURE_* capability constants, documents them as CakePHP’s recognized features, and defines supports(string $feature).


Question: Find the Sqlite driver’s supports() implementation that explicitly handles every Driver::FEATURE_* constant, including FEATURE_QUOTE and FEATURE_SAVEPOINT, without parent delegation and returns false for unknown features.


Question: Where is the base Cake\Console\Command class implemented, including its run() lifecycle, initialization, option parsing, and exit-code handling?


Question: Where are ConsoleIo and command state initialized and passed through the command lifecycle, including commands invoked before a caller has set its name?


Question: Where does the PostgreSQL schema dialect reflect column metadata and handle data_type USER-DEFINED by reading udt_name, especially to report citext correctly?


Question: Where are the TableSchemaInterface column type constants declared so PostgreSQL schema support can add TYPE_CITEXT and TYPE_INTERVAL?


Question: Where is the HasMany implementation of setSaveStrategy(HasMany::SAVE_REPLACE) and append behavior, including the treatment of non-iterable falsy values as no associated records?


Question: Where is the default command collection assembled and how are built-in shells registered so the --version alias reaches the version command?


Question: Where is `SchemaCacheShell` implemented, including dispatch for `schema_cache build` and `schema_cache clear`, the `--connection` option, and the optional table argument?


Question: Where is the CLI registration or alias that keeps the legacy `schema_cache` name and its `build` and `clear` subcommands working when the internal command name is `schemacache`?


Question: Where do production CakePHP APIs emit deprecation warnings from legacy methods while delegating to replacement getX() accessors?


Question: Where are Association's getName()/setName(), bindingKey, and foreignKey accessors implemented, including setName()'s InvalidArgumentException for an already resolved target mismatch?


Question: Where does the ORM Association implementation store and initialize className from constructor options, and where is the current className() getter defined?


Question: Where does Association resolve short and fully-qualified target class names and instantiate or cache the target table when getTarget() is called?


Question: Where does PluginCollection resolve plugin classes or packages and throw MissingPluginException, so optional missing plugins can be skipped while required plugins still fail?


Question: Where are PluginCollection conditions such as onlyDebug and onlyCli evaluated so plugins that do not match the current environment are skipped?


Question: Where does the application bootstrap load configuration from the application config directory and wire an optional plugins.php array into plugin loading?


Question: Where does PluginCollection load plugins, and where should it accept an array of plain plugin names or name-to-options definitions?


Question: Where are the console exception renderer options handled so the `trace` option defaults to enabled and can suppress the stack trace?


Question: Where does Command handle --help and -h requests by rendering help without executing the command, including xml help when the first positional argument is xml?


Question: Where are Command names validated in setName, including the default cake unknown name, and where are CODE_SUCCESS and CODE_ERROR defined?


Question: Where does getOptionParser derive the parser command name from the portion after the first space and set the parser root name such as cake?


Question: Where does controller property handling emit warnings for deprecated $name and $autoRender, and how does it relate to getName()/setName() and isAutoRenderEnabled()/enableAutoRender()/disableAutoRender()?


Question: Where does controller setRequest() populate the plugin from request parameters, and where can that implicit assignment be removed so plugin state is independent of the request?


Question: Where does CsrfProtectionMiddleware validate POST, PUT, PATCH, and DELETE requests and raise InvalidCsrfTokenException when the request token is missing or does not match the cookie token?


Question: Where does CsrfProtectionMiddleware merge default configuration with user options so that user configuration takes precedence?


Question: Where does CsrfProtectionMiddleware read the CSRF cookie value as a string instead of using the boolean result of isset()?


Question: Where is the CsrfProtectionMiddleware helper currently named _setCookie that should become _setToken, including token generation and response-cookie writing for a GET without an existing token?


Question: Where are TableLocator instances created or configured so callers can supply custom table namespaces?


Question: Where does the CSRF middleware validate POST, PATCH, PUT, and DELETE tokens from request data or the X-CSRF-Token header against the cookie, remove the token field, and raise InvalidCsrfTokenException on failure?


Question: Where does CsrfProtectionMiddleware handle GET requests without a CSRF cookie by generating a token, attaching _csrfToken to the request, and configuring the secure or HTTP-only cookie before delegation?


Question: Where is the SQLite schema dialect’s _convertColumn() logic that maps declared GEOMETRY, POINT, LINESTRING, and POLYGON names to geometry, point, linestring, and polygon instead of applying text or integer fallbacks?


Question: Where does SQLite columnSql() map TYPE_GEOMETRY, TYPE_POINT, TYPE_LINESTRING, and TYPE_POLYGON to uppercase CREATE TABLE type names and append NOT NULL without converting them to TEXT?


Question: Where is the production implementation of the `plugin load` shell command that parses `--bootstrap`, `--routes`, and `--autoload` and writes `Plugin::load()` to `config/bootstrap.php`?


Question: Where does Cake\Form\Form lazily invoke _buildSchema and cache the result, including constructor initialization and the behavior when an explicitly supplied Schema replaces it?


Question: Where is Cake\Form\Form::__debugInfo implemented, and how does it currently retrieve schema internals?


Question: Where does the string UUID type generate IDs with Text::uuid(), and how is that readable value preserved on the entity while storage conversion occurs?


Question: Where are the uuid and binaryuuid database types registered and wired to their PHP-to-database and database-to-PHP conversion methods?


Question: Where is the shared console-command registration and metadata lookup used by HelpCommand and CompletionCommand, including command names and visibility?


Question: Where does HelpCommand discover registered console commands and render both text and XML help, and where should commands marked hidden be filtered?


Question: What lightweight marker or interface can command authors use to hide a command from help and completion without changing its direct execution behavior?


Question: Where does ErrorHandlerMiddleware::process() catch Throwable and choose the HTTP response path, so Cake\Http\Exception\RedirectException is intercepted before generic exception handling?


Question: Where is EncryptedCookieMiddleware implemented, including decryption of configured incoming request cookies and encryption of configured outgoing response cookies?


Question: Where are the CookieCryptTrait _encrypt call sites in EncryptedCookieMiddleware, and how do they obtain the key through _getCookieEncryptionKey() without passing a key argument?


Question: Where does HtmlHelper::image() convert its image source into the generated src attribute, including its delegation to shared asset URL generation and HTML escaping?


Question: Where do CSS and script asset helpers obtain URLs through assetUrl(), so the same data URI pass-through behavior applies to their generated href or src attributes?


Question: Where is the console runner's conditional PluginApplicationInterface support wired across application bootstrap and console command setup?


Question: Find the shared contain() and loadInto() eager-loading path for BelongsTo and HasOne, including when association result formatters run relative to hydration and parent property assignment.


Question: Find the custom finder and formatResults callback execution path for contained association queries, especially result formatting after associated entities have been hydrated.


Question: Where does the plugin-list command render its current plugin-name output with the framework's console table helper, so the table columns can be extended?


Question: Find the route-row formatting and table-rendering code for the `routes` command, including Route name, URI template, Plugin, Prefix, Controller, Action, and Method(s), while preserving the existing main-table ordering.


Question: Where does the new application addPlugin() flow construct and use PluginCollection for plugins supplied by name or as PluginInterface instances?


Question: Where does PluginCollection resolve a plugin without an explicit path by checking Configure::read('plugins.$name'), then App::path('Plugin'), and throwing MissingPluginException when no location exists?


Question: Where does the application or plugin bootstrap load the cakephp/plugin-installer-generated vendor/cakephp-plugins.php mappings before plugins are added through either API?


Question: Where is BaseApplication's addPlugin() implementation that accepts a PluginInterface instance or a fully-qualified plugin class name?


Question: Where are WindowExpression::partition() and the WindowInterface partition API implemented, including handling of expression arguments?


Question: Where is WindowExpression::order() implemented through WindowInterface, including construction and validation of OrderByExpression values?


Question: Where does the window-expression code immediately invoke Closure arguments and validate their return types, raising RuntimeException for invalid results?


Question: Where is Router::_loadRoutes() implemented, when is automatic config/routes.php loading triggered, and where should that mechanism be deprecated?


Question: Where does RoutingMiddleware configure Router, and how can it indicate that application-defined routes were loaded so automatic config/routes.php loading is skipped?


Question: Where are RouteBuilder instances created and passed through the routing setup so an application routes hook can define routes directly?


Question: Where is BaseApplication defined, and where should a routes(RouteBuilder) hook load config/routes.php from the application’s configured config directory by default?


Question: Where is fetchGlobal implemented, and how are null filters normalized to FILTER_DEFAULT for every input type?


Question: Where is Request::header() implemented, including its default filter behavior and raw header-value retrieval when the filter is null?


Question: Where are the existing Time parsing, locale, DateTime conversion, and immutable-instance behaviors implemented so the new constructors and factories preserve APIs such as parse and toDateTimeString?


Question: Where is the Language constructor and getLocale() implementation that stores and returns the locale supplied at construction, such as 'en'?


Question: Where does the language implementation load or merge matching message files so higher-priority Number.php values win while override-only keys such as bazillion remain accessible?


Question: Where does lang('Number.trillion') perform the bundle and message-key lookup that returns the selected override value instead of the system default?


Question: Where does the Entity class implement __isset and __unset for mapped properties, and how do those methods consult $datamap?


Question: Where is the production implementation of the CodeIgniter\I18n\Time class, including the relative-date comparison and formatting path where a public humanize() method belongs?


Question: Where does Time obtain its current clock value and honor Time::setTestNow(), while comparing in the instance’s timezone rather than UTC?


Question: Where is the current request’s resolved after-filter list assembled and made available to rendering code after filtering configuration is applied?


Question: Where does View::render() inject the debug toolbar collectors, and how are the existing debug flag and render-option checks applied?


Question: Where does the Filters service resolve aliases, multiple classes per alias, and except/only rules into the executed after filter class list exposed by getFiltersClass()['after']?


Question: Where are Query Builder like(), orLike(), notLike(), and orNotLike() implemented, and do they share a helper for building LIKE and NOT LIKE SQL?


Question: Where does Filters::run() instantiate configured filter classes, and where should it verify that they implement CodeIgniter\Filters\FilterInterface before invoking them?


Question: Where should UploadedFile::getDestination() compute a non-colliding path by appending or incrementing a numeric _n suffix before the extension?


Question: Where is the response route() redirect API implemented, including how it resolves a named route and constructs the redirect response?


Question: Where does the database connection layer parse the first SQL command and distinguish CTE-backed write queries from PostgreSQL RETURNING queries?


Question: Which production startup code initializes the autoloader and loads configured $files, and where should it iterate configured helpers and call helper()?


Question: Where is the production implementation of negotiateMedia that parses the Accept header and chooses among supported media types by quality and specificity?


Question: Locate the shared BasePreparedQuery::prepare() logic that converts named placeholders such as :name and :value: to ? before calling the driver-specific _prepare method.


Question: Where does the template parser process unfiltered variables such as { foo } and apply the default esc filter unless escaping is explicitly disabled?


Question: Where are ParseError exceptions from malformed conditional templates caught and converted into ViewException::forTagSyntaxError with the offending template content?


Question: Where does BaseConnection::query() handle a failed query during an active transaction, update transaction status, and use DBDebug to roll back before returning false?


Question: Where does the Postgre connection execute BEGIN, COMMIT, and ROLLBACK through pg_query for transaction support?


Question: Locate the row-fetching methods getRowArray(), getCustomRowObject(), and getPreviousRow() that index the result array and should return null for an invalid or out-of-bounds current row.


Question: Locate the BaseResult implementation of getRowObject() and its private getRow() wrapper where the requested index is compared with currentRow or customResultObject.


Question: Find MessageInterface’s declarations and return types for `header()`, `headers()`, and header mutation methods so `addHeader()` and the single-or-list header representation are part of the public contract.


Question: Locate `setHeader()`, `appendHeader()`, and `prependHeader()` in MessageTrait and the validation needed to reject an existing multiple-header state with `InvalidArgumentException`.


Question: Locate the MessageTrait header storage and accessors (`header()` and `headers()`) that distinguish one `Header` object from an indexed list of same-name `Header` objects.


Question: Where does Session::startSession() handle the testing environment and initialize $_SESSION without calling PHP session_start()?


Question: Where does the HTTP Response constructor initialize statusCode so a newly created response defaults to 200?


Question: Where is Time's __set property-assignment magic defined, and how does it dispatch assignments to immutable set* methods such as setDay()?


Question: Where is the Time age calculation implemented, including getAge() and the age property accessed through __get, with handling for current and future timestamps?


Question: Where does Time::getDst() determine daylight-saving status from timezone transitions, including safe handling when transitions or the isdst key are absent?


Question: Where is Time::toLocalizedString() declared, including the nullable $format parameter and its default handling?


Question: Where is the production implementation of the `cache:clear` Spark command, including argument parsing and current output behavior?


Question: Where do View layouts, includes, and sections propagate data set during rendering while restoring the original data when saveData is false?


Question: Where is nested View or Parser rendering state isolated so an inner render does not overwrite the outer render's temporary data?


Question: Where does Parser evaluate PHP tags such as <?= ... ?> and extract variables from the correctly scoped render data?


Question: Where are View getData(), setData(), and setVar() implemented so getData() returns temporary render data while a render is in progress?


Question: Find the reusable filter path-matching logic that treats * as zero-or-more characters, compares paths case-insensitively, and handles empty or missing patterns.


Question: Where are globals, methods, and per-route filter configurations mapped through Config\Filters::$aliases before execution, and where are $this->arguments[$alias] values passed to every filter in an alias?


Question: Where is the generic Services::inject(string $name, $obj) method defined and used to insert shared services, so that injection can be removed?


Question: Where is Services::incommingrequest(?App $config = null, bool $getShared = true) implemented to construct an IncomingRequest and optionally register it as the shared request service?


Question: Where does Services::clirequest() create or retrieve the CLIRequest used for CLI and sparked requests?


Question: Where is the production Timer class that manages named timer start/stop state and elapsed-time measurement?


Question: Where is the global timer() helper implemented, including name-only start/stop behavior, no-name Timer-instance access, and delegation of name-plus-callable calls to Timer::record?


Question: Where does Query manage original SQL and bind state, and how do setQuery() and setBinds() invalidate or rebuild the compiled query?


Question: Where is Query::swapPrefix() implemented, including prefix replacement against the original SQL and invalidation of the previously compiled result?


Question: Locate the CLI command listing and execution wiring that consumes the discovered command list and could expose unrelated classes placed in a Commands directory.


Question: Where are the PHP implementations of base_url() and site_url(), including the shared routine that builds framework URIs from App::baseURL, indexPage, and path segments?


Question: Where does current_url() distinguish string and object results so strings omit query and fragment while returned objects preserve the request query and fragment?


Question: Where does Forge process addKey() and other index definitions by column name when fields use the string shorthand?


Question: Where does Forge addForeignKey() record local columns, the referenced table and column, and the delete/update actions for later DDL generation?


Question: Where does _processForeignKeys() resolve foreign-key columns against $fields and emit the constraint name, REFERENCES clause, and cascade actions?


Question: Where does the Forge createTable() pipeline combine processed fields, keys, and foreign keys into the CREATE TABLE statement?


Question: Where are csrf_hash() and csrf_field() implemented, and how do they generate the CSRF token and arrange for the matching cookie to be sent in the response?


Question: Where is the shared CSRF hash state maintained so the token returned by csrf_hash() matches the cookie used during a later POST verification?


Question: Where is the exception error-view selection implemented, including the production view, CLI view, custom error_<code>.php lookup, and error_exception.php fallback?


Question: Find the standalone Message header storage and name-normalization implementation shared by setHeader, header, headerLine, and appendHeader, so these behaviors work independently of Request and remain case-insensitive.


Question: Locate the production implementation of CodeIgniter\HTTP\Message::headers() that reads $_SERVER directly, applies filter_var to each server header, and uses FILTER_DEFAULT when $filter is null instead of relying on fetchGlobal.


Question: Where does SiteURI initialize its path when no relative path is supplied, and how does it handle relative paths beginning with /, ?, or a normal path segment?


Question: Locate the base URL scheme, host, subfolder path, and forced-HTTPS handling used when constructing site URIs from the application configuration.


Question: Locate the URI parsing logic that derives the application route path from a relative path while retaining query strings and fragments in the correct order.


Question: Where is the command() helper's argument parsing that turns a command string into the params array sent to the command runner?


Question: Find DownloadResponse::send() and its pretend-mode branch that echoes file contents when pretend(true) is enabled instead of triggering a download.


Question: Find the production implementation of DownloadResponse::sendHeaders(), including conditional Date header generation and Content-Length calculation from the file size.


Question: Locate DownloadResponse's default HTTP reason phrase so getReason() returns 'OK'.


Question: Locate the Config\Security configuration object and how the Security class receives and uses it.


Question: Where is the production implementation of the `debugbar:clear` command and its `run()` method that clears debugbar JSON files?


Question: Where is the production implementation of the `make:cell` command that parses the cell name and generates the class and view files?


Question: Where does the base `Cell` class infer and search an implicit view, trying the clean logical name first and the legacy `_cell`-suffixed filename second?


Question: Locate Request::isAJAX() and the production request-header logic used to identify AJAX requests, including behavior for missing or empty header values.


Question: Locate the IncomingRequest constructor and the parent Request construction so the AppConfig instance is passed into Request.


Question: Locate the AppConfig definition and configuration parsing that should expose proxyIPs as either a comma-separated list or an array of trusted proxy IPs or subnets.


Question: Locate Request::validIP() and its $which parameter handling, including nullable input and validation of empty strings, zero, oversized invalid IPs, and valid IPv4 and IPv6 addresses.


Question: Where are the request’s internal $_SERVER and $_GET copies refreshed when path detection or setPath() changes QUERY_STRING?


Question: Where does IncomingRequest build the URI from the base URL and apply its host, scheme, and forceGlobalSecureRequests setting when a path is set or detected?


Question: Where does CodeIgniter determinePath() choose the request’s getPath() method versus getUri()->getPath() without relying on CLI or testing state?


Question: Where does IncomingRequest detect and cache the current relative path, expose getPath(), refresh it through detectPath(), and override it through setPath()?


Question: Where does CheckMemoryLeak recognize C++ new and new[] allocations and pair them with delete or delete[] before the pointer leaves scope?


Question: Where is the uninitialized-variable checker’s execution-path analysis implemented, including its existing handling of if and while statements?


Question: Where does the template-copy loop in `simplifyTemplates` update `indentlevel` while copying tokens, before checking member-definition patterns and deciding when to insert a closing brace?


Question: Where is the shared getNestedInScope logic used to preserve nested scope relationships in the imported token list?


Question: Where does the Clang AST dump importer dispatch declaration kinds such as RecordDecl and FieldDecl into cppcheck tokens and symbol database entries?


Question: Where is getSpelling() implemented for Clang Decl nodes, and how can it return the spelling token for every Decl kind rather than only ParmVarDecl?


Question: Which production AST traversal helpers use an explicit stack or queue, or otherwise provide a model for replacing unbounded recursion while preserving analysis results?


Question: Where is CheckLeakAutoVar::isVarUsedInTree() implemented, and how does it recursively traverse the AST to detect variable use?


Question: Where are for, while, and do statements normalized to a loop token in CheckMemoryLeak, and where are continue and break represented?


Question: Where does CheckMemoryLeak_CheckScope remove empty statements and empty blocks following else, else-if, or loop headers?


Question: Where are the call sites of getValueRangeFromValueType(data.getNewSymbolName(), vt, *data.settings) and related ValueType-to-value conversion paths that must use unified container handling?


Question: Where do executeFunctionCall and executeReturn synthesize function return values from ValueType, and how can container return values receive ArrayValue buffer state?


Question: Where is the configuration string assembled for Preprocessor::getConfigs, including the logic that omits macros already fixed by -D while preserving existing -U behavior?


Question: Where are settings.userDefines parsed and applied when evaluating preprocessor conditions for -DMACRO and -DMACRO=VALUE?


Question: Where does array-index analysis compare the computed minimum or maximum subscript against the known array size and report an out-of-bounds error?


Question: Where is the constant propagation logic that replaces constant variable names with literal values?


Question: Find the tokenizer or preprocessing logic that normalizes -> into . before constant propagation.


Question: Locate the token substitution code used during constant-variable propagation, including its handling of identifier tokens.


Question: Locate the production implementation of CheckOther::functionVariableUsage and its current per-function variable-usage state for declarations, reads, writes, and modifications.


Question: Find the code that reports “Unused variable”, “Variable is not assigned”, and “Variable is assigned a value that is never used”, including how diagnostics use the correct shadowed declaration and source line.


Question: Where is importCppcheckGuiProject implemented, and how does it populate settings.addons from a GUI project?


Question: Locate the production control-flow simplification path that uses a condition reduced to true to remove an if body, including the ordering between redundant-parenthesis and condition simplification passes.


Question: Where are matching-parenthesis token links updated when simplification deletes parentheses or tokens, so no tokens are leaked and nested ((...)) remains consistent?


Question: Where does ExprEngine track break targets so break exits the enclosing switch or loop instead of returning from the function?


Question: Locate the lib-mail implementation that builds a plain-text message snippet and enforces its maximum length.


Question: Where does i_stream_decompress_detect_more() drive i_stream_read() and compression_detect_handler(), and how are handler results 1, 0, -2, and -1 propagated through non-blocking istream semantics so an ioloop waits instead of hanging?


Question: Where is compression_detect_handler() declared and implemented with the is_compressed_* format probes, and how should those probes inspect only buffered bytes with i_stream_get_data() while distinguishing detection, EOF, and stream errors?


Question: Which production callers of compression_detect_handler(), including the mail-compress integration, need to handle its integer status return and distinguish need-more-data from EOF or not-compressed results?


Question: Find the HTTP client queue logic for a failed connection attempt when the current peer still has active connections, without asserting that cur_peer is NULL.


Question: Where does the dsync brain implement synchronization step 6, including the new-message save/copy phase and UID-conflict resolution, with comments describing the phase?


Question: Where does the dsync brain mark messages as saved or copied versus failed and feed failed messages back through the common save/copy path instead of using separate retry indexes?


Question: Where does the local dsync worker implement msg_update_uid(old_uid, new_uid) by creating a save context for the target UID, copying the existing flags and data, expunging the old UID, and reporting a failed copy?


Question: Where are HTTP client request inactivity timers armed or refreshed while a request waits for a connection slot or has a connection but no response payload yet, including the time before the first response byte?


Question: Where does the HTTP client distinguish the per-attempt timeout from the absolute request timeout when handling queued, assigned, and active requests?


Question: Where are per-request attempt timeouts reset for each retry when max_attempts allows another attempt, without changing the request’s absolute timeout?


Question: Where does the full configuration dump handle CONFIG_DUMP_FULL_DEST_STDOUT or other non-seekable destinations so the filter count is correct when written in a single pass?


Question: Where does settings_block_read() parse the filter count, preallocate block->filters with i_array_init(), read exactly that many filters, and report truncated or malformed blocks?


Question: Where is the binary config dump layout documented as base settings key-value pairs followed by a 32-bit big-endian filter count and repeated filter entries?


Question: Where is struct imap_url defined, and which production code still accesses its separate host_name and host_ip fields instead of a nested struct uri_host host?


Question: Where is the tokenizer chaining logic that forwards address subparts to the parent tokenizer and controls the resulting address-token versus domain-token order?


Question: Where is the fts-tokenizer-address implementation that parses email-like input and buffers local-part or domain candidates?


Question: Where does fts-tokenizer-address detect an overly long address candidate and hand its raw bytes to the parent tokenizer instead of extending its internal buffer?


Question: Where is the production implementation of mail_html2text and its HTML tag handling for converting blockquote elements to plain-text output?


Question: Where is the lib-index mail-cache purge logic that decides non-forced YES→TEMP and TEMP→NO from last_used versus day_stamp, including the doubled unaccessed_field_drop_secs window?


Question: Where does mail-cache field access logic distinguish a real long-term confirmation, such as fetching an older message, from ordinary access, promote TEMP to YES, and refresh last_used for YES only on confirmation?


Question: Where does smtp_command_parser read SMTP commands and AUTH continuation responses from an istream, detect incomplete lines at buffer boundaries, and resume on later i_stream_read() calls?


Question: Where does smtp_server_connection_create_from_streams() provide the custom input stream used by SMTP command parsing, including assumptions about its buffer size?