refactor(test): apply the ADR-1138 nullptr bracket across 39 C test TUs

[lusoris]

Summary

Epic #1237 (whole-tree clang-tidy debt) is one of the three real walls left before the retrain: 6,432 warnings across the four lanes, 2,950 of them on cpu. I measured where the debt actually sits rather than guessing, and it is overwhelmingly one check in one file class.

Of the top 40 C files by baseline count — 1,746 warnings between them — 1,351 (77%) are modernize-use-nullptr.

That check asks a C translation unit to use a keyword MSVC will not compile. The fork builds C as C23, but MSVC's documented /std:clatest C23 set excludes nullptr, while the required Windows build compiles these TUs with cl.exe. Writing nullptr to satisfy clang-tidy breaks Windows — that exact standoff blocked #1338 for four merge-train rounds, first failing MSVC with C2065: 'nullptr': undeclared identifier, then failing the ratchet when it was changed back.

ADR-1138 already settles it: a C TU keeps NULL and suppresses the check with one file-scoped NOLINTBEGIN/NOLINTEND bracket citing the ADR. This applies that existing decision mechanically to the 39 C test TUs carrying the check, copying the wording already in core/test/test_output.c and core/test/test_model_feature_overload_ownership.c.

Measured effect

	warnings
those 39 files, before	1,746
those 39 files, after	386
reduction	1,360

That takes the cpu lane from 2,950 to roughly 1,590.

17 nullptr findings remain and are deliberately left alone rather than papered over — they sit outside the bracketed span and want individual attention.

Type

• refactor — no behavior change

Checklist

• Commits follow Conventional Commits.
• make format && make lint green locally — pre-commit run --files clean on all 39 files (clang-format included).
• Unit tests pass: meson test --suite=fast → 115 ok, 0 failed.
• SIMD/GPU code path — none touched. The diff adds comment lines and nothing else, verified mechanically: every added line is a comment or blank, so no code, behaviour or score can change.
• Feature extractor twins — none touched.
• New .c / .cpp / .cu / .h — none added.
• Breaking change — no.
• ADR — none needed: this applies ADR-1138, it does not decide anything new.

Bug-status hygiene (ADR-0165)

• docs/state.md updated — no state delta: lint hygiene against epic Whole-tree clang-tidy debt down #1237; no tracked bug id opens or closes.

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: trivial. The finding is one measurement (77% of the top-40 debt is a single check), recorded in the commit message and this body.
• Decision matrix — no alternatives: only-one-way fix. ADR-1138 already weighed the options; the alternative (write nullptr in C) is the thing that breaks the Windows build.
• AGENTS.md invariant note — no rebase-sensitive invariants: the bracket carries its own inline justification citing the ADR in every file, which is where a maintainer editing the file will see it.
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — no changelog needed: internal lint hygiene, no user-discoverable surface changes.
• Rebase note — no rebase impact: these are fork-added test TUs, and the bracket is self-documenting where it sits.

Reproducer

meson setup build core -Denable_cuda=false -Denable_sycl=false -Db_lto=false
ninja -C build

# Before/after on any bracketed file:
clang-tidy -p build core/test/dnn/test_dnn_session_api.c 2>/dev/null \
  | grep -c modernize-use-nullptr      # 178 on master, 0 here

meson test -C build --suite=fast       # 115 ok, 0 failed

# And the diff really is comment-only:
git diff -U0 origin/master...HEAD | grep -E '^\+' | grep -vE '^\+\+\+' \
  | grep -vE '^\+\s*(/\*|\*|$)'        # no output

Known follow-ups

• The tidy baseline is deliberately not regenerated in this commit. This host has gcc 16.2.1 while the lane builds with gcc-14, and the lane installs no ONNX Runtime so its enable_dnn=auto resolves differently — a local --write would not reproduce the lane's TU set. It is taken from CI's own tidy-ratchet-cpu artifact in a follow-up commit, which is exactly what the workflow step that uploads it instructs ("commit it as the new baseline when the ratchet asks"). The ratchet will fail this PR once with an exit-3 "tighten the baseline" until that lands.
• The remaining cpu debt after this is ~1,590, and the next largest cluster is cert-err33-c (unchecked return values) — e.g. core/test/test_pelorus_interop.c is 121 of its 161. That is a real code fix, not a suppression, and wants its own pass.

[lusoris]

Extended with a second cluster — the total is now larger than the PR body says.

cert-err33-c. core/test/test_pelorus_interop.c carried 161 warnings, 121 of them cert-err33-c. They are not 121 defects; they are one line — the CHECK macro's fprintf(stderr, …) whose return is dropped, reported once per call site. Adding the explicit (void) discard the fork's own standard already requires (docs/principles.md §1.2 r30) takes that file 161 → 9. The same shape appears in nine other test TUs.

Verified none had its return assigned or used, so the casts change only the diagnostic.

Combined across the 48 touched files:

	warnings
before	1,754
after	341
reduction	1,413

That takes the cpu lane from 2,950 to roughly 1,537 — a 48% cut — from two mechanical changes that both apply standards the repo had already written down.

meson test --suite=fast: 115 ok, 0 failed. The diff is still comment-and-cast only; no behaviour or score can change.

[lusoris]

Converting to draft to unblock the merge queue — this is not a rejection of the change.

Tidy Changed and Tidy Ratchet are red for a real reason, not a mechanical one. The diff adds a NOLINTBEGIN/END(modernize-use-nullptr) bracket around roughly lines 906–1210 of core/src/dnn/model_loader.c, which makes the file touched — and per CLAUDE.md rule 12 / ADR-0141 a touched file must be lint-clean as a whole. Lines 1–905 carry pre-existing violations the bracket does not cover: several modernize-use-nullptr, four readability-function-size, and two concurrency-mt-unsafe (getenv).

Three ways forward, all needing a judgement call rather than a rebase:

1. Drop model_loader.c from this PR's scope and land the other 38 TUs.
2. Extend the bracket to the whole file with an inline citation, and split the oversized functions.
3. Do the model_loader.c cleanup properly in its own PR first, then rebase this on top.

Option 1 is the smallest and keeps the 38 clean TUs moving. Undrafting once that is decided.