[joey-huckabee]

Basemap failures now have explicit diagnostics at both existing async boundaries: rejected asset fetches are logged with their path, and a rejected renderer-loader promise is caught and logged. Success/partial/empty loading behavior, flags, constructor API, retry count and rendering are unchanged.

Base 2a6db803fd612976abbed5e8d7807ffb535f45e6; exact review head 83cd8b383ddb8c2ad422ac7fd5137227fbe10090. First of two separate bounded remediation PRs; developer-script security is a separate branch/PR. No dependency, protocol, gate/profile/credential/settings, release or deployment changes. All optional smells remain deferred.

Confirmed scope and reproduction

The current public Sonar main inventory is exactly 1 bug / 7 vulnerabilities / 23 smells. Complete keyed triage and read-only NONE investigation records every finding and disposition before source fixes.

Target bug AaHGAPkiOB7cC4l45FHJ, typescript:S9383, client/src/map.ts:92.

Two regressions failed before the fix:

• Actual BaseMap loader plus four rejected fetches emits 0 diagnostics instead of 4. Ordinary fetch rejection is already absorbed by Promise.allSettled; it is not an unhandled renderer rejection. The fix logs those contained failures without changing the successful/empty-map completion contract.
• Actual renderer source with its loader boundary rejecting produces an isolated unhandledRejection: ["loader fixture"]. The explicit catch now emits Failed to load basemap and leaves no unhandled rejection. This fixture tests the loader contract separately from the real fetch path.

Both tests use actual source, existing esbuild and Node standard facilities, no sleeps/new packages/browser. No retry/lifecycle refactor is introduced; constructor smell S7059 is deliberately deferred.

Executed checks

Once for this final local head, maximum two workers:

cargo +1.99.1 fmt --all -- --check
cargo +1.99.1 clippy --workspace --all-targets --locked -- -D warnings
cargo +1.99.1 test --workspace --locked
cargo +1.99.1 build --workspace --locked
npm --prefix client run typeprep
npm --prefix client run typecheck
PELORUS_SERVER_BIN=../target/debug/server npm --prefix client run test:ci
npm --prefix client run build
git diff --check

21 Rust tests; 44 client/proof/integration tests, all passed with zero skips. Both real-server named tests passed. Strict typing, Clippy, formatting and bundle passed. Existing warnings remain; no browser/GPU/performance or Windows claim. Hosted Linux CI and automatic Sonar are checked independently after draft creation.

NONE / credential investigation remains read-only

Public main status is NONE, but default Sonar way gate 9 is already assigned. Its conditions are new-code-only; public main new-code measures/period are absent, with three recorded analyses and a neutral automatic-app check. Missing usable New Code definition is a hypothesis, not a confirmed missing gate or broken credential. The evidence contains a proposed admin inspection / exact approval / supported baseline / normal-analysis proof sequence. No private credential, environment/secret inventory or authenticated credential validity probe was performed; no SaaS setup or manual analysis was triggered.

Independent reviewer thr_qsvwmtnn8f must assess the exact diff/head; coordinator owns ordinary merge after green checks and approval. Draft only, no merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud