diff --git a/README.md b/README.md
index fbac2d30..1d053d1a 100644
--- a/README.md
+++ b/README.md
@@ -94,9 +94,9 @@ cargo build --locked -p codeguard-cli
 
 Version output includes `cli_version`, `target`, and protocol information. Discovery and init preview return observations and unknowns. Dry-run creates neither `AGENTS.md` nor a project data directory. Add Cargo `--offline` only when dependencies are cached.
 
-The workspace requires `std`. The opt-in `wasm-precheck` build feature uses a bounded Rust worker with seven pinned grammar candidates: Java, Objective-C, Python, Solidity, TypeScript, TSX, and Zig. Java and TypeScript/TSX have narrow single-file fallback paths; `lint python` can provide bounded suspected syntax positions when Ruff is unavailable or no project Ruff configuration is declared. Native Ruff results take priority. It is absent from the published npm `0.1.2` package. No `no_std`, completed project-wide WASM fallback, zero-unsafe, or fastest-runtime claim is made. Runtime OS calls require safety review; a comprehensive security audit is not claimed.
+The workspace requires `std`. The opt-in `wasm-precheck` build feature uses a bounded Rust worker with eleven pinned grammar candidates: C, Go, Java, JavaScript, Objective-C, Python, Rust, Solidity, TypeScript, TSX, and Zig. Java and TypeScript/TSX have narrow single-file fallback paths; `lint python` can provide bounded suspected syntax positions when Ruff is unavailable or no project Ruff configuration is declared. Native Ruff results take priority. It is absent from the published npm `0.1.2` package. No `no_std`, completed project-wide WASM fallback, zero-unsafe, or fastest-runtime claim is made. Runtime OS calls require safety review; a comprehensive security audit is not claimed.
 
-The current source-built CLI's `codeguard grammar status --format=json` reports the coverage gap without loading grammars or running lint: the pinned CodeGraph source has 30 vendored WASM files plus two distinct grammars resolved through its dependency; CodeGuard has seven unqualified asset candidates (Java, Objective-C, Python, Solidity, TypeScript, TSX, Zig) and zero released syntax capabilities. The two dependency grammars retain their source bytes and use a byte-pinned legacy `dylink` metadata conversion for Rust loading; they have no public lint route or release qualification. Zig uses a byte-pinned import adaptation so the corrected CodeGraph grammar can load in Rust; it has no public `lint zig` route or release qualification yet. [Zig's limited acceptance record](tests/acceptance/zig-grammar-candidate.md) distinguishes this from released syntax support. Python has a source-build-only, unqualified CLI fallback path; its report remains incomplete and cannot approve delivery. The separate [coverage inventory](grammars/codegraph-coverage.json) is not an approved asset manifest. COBOL's 16.4 MB source asset also exceeds the current Rust loader's 8 MiB limit.
+The current source-built CLI's `codeguard grammar status --format=json` reports the coverage gap without loading grammars or running lint: the pinned CodeGraph source has 30 vendored WASM files plus two distinct grammars resolved through its dependency; CodeGuard has eleven unqualified asset candidates (C, Go, Java, JavaScript, Objective-C, Python, Rust, Solidity, TypeScript, TSX, Zig) and zero released syntax capabilities. C, Go, JavaScript and Rust are byte-pinned CodeGraph assets that load in the Rust worker but have no public lint route or release qualification. The two dependency grammars retain their source bytes and use a byte-pinned legacy `dylink` metadata conversion for Rust loading; they have no public lint route or release qualification. Zig uses a byte-pinned import adaptation so the corrected CodeGraph grammar can load in Rust; it has no public `lint zig` route or release qualification yet. [Zig's limited acceptance record](tests/acceptance/zig-grammar-candidate.md) distinguishes this from released syntax support. Python has a source-build-only, unqualified CLI fallback path; its report remains incomplete and cannot approve delivery. The separate [coverage inventory](grammars/codegraph-coverage.json) is not an approved asset manifest. COBOL's 16.4 MB source asset also exceeds the current Rust loader's 8 MiB limit.
 
 ### npm installation and one-off use
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 9e174435..d7b7a778 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -96,7 +96,7 @@ cargo build --locked -p codeguard-cli
 
 工作区要求 `std`。可选 `wasm-precheck` 构建特性已用固定的 Java、Python、TypeScript、TSX grammar 候选资产与有界 Rust worker。Java 和 TypeScript/TSX 有局部单文件兜底；`lint python` 在 Ruff 不可用或项目未声明 Ruff 配置时可报告有界疑似语法位置，原生 Ruff 结果优先。公开 npm `0.1.2` 不含该路径。不声称 `no_std`、已完成项目级 WASM 兜底、零 unsafe 或性能最快。运行层系统调用需要安全审查，当前不宣称已完成整体安全审计。
 
-当前源码构建的 CLI 可用 `codeguard grammar status --format=json` 只读展示来源覆盖缺口，不加载 grammar 或运行 lint：固定 CodeGraph 来源含 30 份随仓 WASM，另有两种独立 grammar 从其依赖取得；CodeGuard 当前有 Java、Objective-C、Python、Solidity、TypeScript、TSX、Zig 七份未验收资产候选，已发行语法能力为零。Objective-C 与 Solidity 的依赖包原始字节、许可证和固定散列的 `dylink` 元数据转换已入库，可作为 Rust 隔离 worker 的候选观察，但没有公开 lint 路由或发行验收；Zig 也仍是未验收候选。Python 已有仅限源码可选构建的 CLI 候选兜底，结果保持不完整，不能批准交付。[覆盖库存](grammars/codegraph-coverage.json)不是已批准资产清单。COBOL 来源资产约 16.4 MB，还超过当前 Rust 加载器的 8 MiB 限额。
+当前源码构建的 CLI 可用 `codeguard grammar status --format=json` 只读展示来源覆盖缺口，不加载 grammar 或运行 lint：固定 CodeGraph 来源含 30 份随仓 WASM，另有两种独立 grammar 从其依赖取得；CodeGuard 当前有 C、Go、Java、JavaScript、Objective-C、Python、Rust、Solidity、TypeScript、TSX、Zig 十一份未验收资产候选，已发行语法能力为零。C、Go、JavaScript、Rust 已作为固定字节的 Rust worker 候选接入，但没有公开 lint 路由或发行验收。Objective-C 与 Solidity 的依赖包原始字节、许可证和固定散列的 `dylink` 元数据转换已入库，可作为 Rust 隔离 worker 的候选观察，但没有公开 lint 路由或发行验收；Zig 也仍是未验收候选。Python 已有仅限源码可选构建的 CLI 候选兜底，结果保持不完整，不能批准交付。[覆盖库存](grammars/codegraph-coverage.json)不是已批准资产清单。COBOL 来源资产约 16.4 MB，还超过当前 Rust 加载器的 8 MiB 限额。
 
 ### npm 安装与一次性调用
 
diff --git a/crates/codeguard-adapters/src/grammar_asset_manifest.rs b/crates/codeguard-adapters/src/grammar_asset_manifest.rs
index cb4c2444..168dc297 100644
--- a/crates/codeguard-adapters/src/grammar_asset_manifest.rs
+++ b/crates/codeguard-adapters/src/grammar_asset_manifest.rs
@@ -11,6 +11,10 @@ const JAVA_COMMIT: &str = "94703d5a6bed02b98e438d7cad1136c01a60ba2c";
 const TYPESCRIPT_COMMIT: &str = "f975a621f4e7f532fe322e13c4f79495e0a7b2e7";
 const PYTHON_COMMIT: &str = "bffb65a8cfe4e46290331dfef0dbf0ef3679de11";
 const ZIG_COMMIT: &str = "b670c8df85a1568f498aa5c8cae42f51a90473c0";
+const C_COMMIT: &str = "b780e47fc780ddc8da13afa35a3f4ed5c157823d";
+const GO_COMMIT: &str = "3c3775faa968158a8b4ac190a7fda867fd5fb748";
+const JAVASCRIPT_COMMIT: &str = "44c892e0be055ac465d5eeddae6d3e194424e7de";
+const RUST_COMMIT: &str = "77a3747266f4d621d0757825e6b11edcbf991ca5";
 
 /// 代码来源、许可和每份候选 grammar 的固定身份。
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq)]
@@ -98,6 +102,18 @@ pub fn bundled_grammar_candidates() -> Result<GrammarAssetManifest, String> {
     }
     for asset in &manifest.assets {
         let (wasm, license) = match asset.language.as_str() {
+            "c" => (
+                include_bytes!("../../../grammars/c/parser.wasm").as_slice(),
+                include_bytes!("../../../grammars/c/LICENSE").as_slice(),
+            ),
+            "go" => (
+                include_bytes!("../../../grammars/go/parser.wasm").as_slice(),
+                include_bytes!("../../../grammars/go/LICENSE").as_slice(),
+            ),
+            "javascript" => (
+                include_bytes!("../../../grammars/javascript/parser.wasm").as_slice(),
+                include_bytes!("../../../grammars/javascript/LICENSE").as_slice(),
+            ),
             "java" => (
                 include_bytes!("../../../grammars/java/parser.wasm").as_slice(),
                 include_bytes!("../../../grammars/java/LICENSE").as_slice(),
@@ -126,6 +142,10 @@ pub fn bundled_grammar_candidates() -> Result<GrammarAssetManifest, String> {
                 include_bytes!("../../../grammars/solidity/parser.wasm").as_slice(),
                 include_bytes!("../../../grammars/solidity/LICENSE").as_slice(),
             ),
+            "rust" => (
+                include_bytes!("../../../grammars/rust/parser.wasm").as_slice(),
+                include_bytes!("../../../grammars/rust/LICENSE").as_slice(),
+            ),
             _ => return Err("候选语言未知".into()),
         };
         verify_grammar_asset(asset, wasm, license)?;
@@ -172,7 +192,7 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result<GrammarAssetManifest,
         || manifest.dependency_package_license.as_deref() != Some("LICENSE.tree-sitter-wasms")
         || manifest.dependency_package_license_sha256.as_deref()
             != Some("6b0382b16279f26ff69014300541967a356a666eb0b91b422f6862f6b7dad17e")
-        || manifest.assets.len() != 7
+        || manifest.assets.len() != 11
     {
         return Err("grammar 清单版本、来源或资产数量不符".into());
     }
@@ -183,9 +203,13 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result<GrammarAssetManifest,
         .collect();
     if languages
         != BTreeSet::from([
+            "c",
+            "go",
             "java",
+            "javascript",
             "objc",
             "python",
+            "rust",
             "solidity",
             "typescript",
             "tsx",
@@ -197,6 +221,26 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result<GrammarAssetManifest,
     for asset in &manifest.assets {
         let (repo, commit, version, wasm_path, wasm_sha, wasm_bytes, license_path, license_sha) =
             match asset.language.as_str() {
+                "c" => (
+                    "https://github.com/tree-sitter/tree-sitter-c",
+                    C_COMMIT,
+                    "v0.24.2",
+                    "c/parser.wasm",
+                    "a271e584616c7c3c0ac663f01cd05dd5f1a6c2ce6d4cd23096548985a95d0ccb",
+                    625716,
+                    "c/LICENSE",
+                    "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
+                ),
+                "go" => (
+                    "https://github.com/tree-sitter/tree-sitter-go",
+                    GO_COMMIT,
+                    "v0.23.4",
+                    "go/parser.wasm",
+                    "4eda5d91c99ca981e88bc7d3d33f0db166b4bab0a84d0021a9abf39b364c78ef",
+                    210013,
+                    "go/LICENSE",
+                    "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
+                ),
                 "java" => (
                     "https://github.com/tree-sitter/tree-sitter-java",
                     JAVA_COMMIT,
@@ -217,6 +261,26 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result<GrammarAssetManifest,
                     "python/LICENSE",
                     "d724405ce238a22c0d35769c5a36b386ad5958192efe8bbb304fb2896254575f",
                 ),
+                "javascript" => (
+                    "https://github.com/tree-sitter/tree-sitter-javascript",
+                    JAVASCRIPT_COMMIT,
+                    "v0.25.0",
+                    "javascript/parser.wasm",
+                    "7978e62bcc851ab1d1f6dcd4678f9eda79df2b3b3490e75f81dd819d9bccccfa",
+                    411832,
+                    "javascript/LICENSE",
+                    "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
+                ),
+                "rust" => (
+                    "https://github.com/tree-sitter/tree-sitter-rust",
+                    RUST_COMMIT,
+                    "v0.24.2",
+                    "rust/parser.wasm",
+                    "206031e0f67fb41ecae505868ca3bb917df7375031aebafd2f97314a849713fe",
+                    1114303,
+                    "rust/LICENSE",
+                    "31d5b6f4243d5c7c6e1c4ebbbb9f6407bd1457a08bcc4f706521710341acba36",
+                ),
                 "typescript" => (
                     "https://github.com/tree-sitter/tree-sitter-typescript",
                     TYPESCRIPT_COMMIT,
@@ -295,7 +359,12 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result<GrammarAssetManifest,
             || asset.bytes != wasm_bytes
             || asset.license != license_path
             || asset.license_sha256 != license_sha
-            || asset.abi_version != if asset.language == "zig" { 15 } else { 14 }
+            || asset.abi_version
+                != if matches!(asset.language.as_str(), "zig" | "c" | "javascript" | "rust") {
+                    15
+                } else {
+                    14
+                }
             || asset.codegraph_runtime != "web-tree-sitter 0.25.3"
             || asset.codeguard_runtime_validation != "rust_loader_smoke_passed"
             || !asset.language_versions.is_empty()
diff --git a/crates/codeguard-adapters/tests/grammar_asset_manifest.rs b/crates/codeguard-adapters/tests/grammar_asset_manifest.rs
index 6bb6a02f..6ed68a2f 100644
--- a/crates/codeguard-adapters/tests/grammar_asset_manifest.rs
+++ b/crates/codeguard-adapters/tests/grammar_asset_manifest.rs
@@ -6,9 +6,21 @@ use codeguard_adapters::{
 #[test]
 fn bundled_candidates_pin_source_bytes_license_and_abi_without_claiming_support() {
     let manifest = bundled_grammar_candidates().expect("bundled manifest");
-    assert_eq!(manifest.assets.len(), 7);
+    assert_eq!(manifest.assets.len(), 11);
     for asset in &manifest.assets {
         let (wasm, license) = match asset.language.as_str() {
+            "c" => (
+                include_bytes!("../../../grammars/c/parser.wasm").as_slice(),
+                include_bytes!("../../../grammars/c/LICENSE").as_slice(),
+            ),
+            "go" => (
+                include_bytes!("../../../grammars/go/parser.wasm").as_slice(),
+                include_bytes!("../../../grammars/go/LICENSE").as_slice(),
+            ),
+            "javascript" => (
+                include_bytes!("../../../grammars/javascript/parser.wasm").as_slice(),
+                include_bytes!("../../../grammars/javascript/LICENSE").as_slice(),
+            ),
             "java" => (
                 include_bytes!("../../../grammars/java/parser.wasm").as_slice(),
                 include_bytes!("../../../grammars/java/LICENSE").as_slice(),
@@ -37,6 +49,10 @@ fn bundled_candidates_pin_source_bytes_license_and_abi_without_claiming_support(
                 include_bytes!("../../../grammars/solidity/parser.wasm").as_slice(),
                 include_bytes!("../../../grammars/solidity/LICENSE").as_slice(),
             ),
+            "rust" => (
+                include_bytes!("../../../grammars/rust/parser.wasm").as_slice(),
+                include_bytes!("../../../grammars/rust/LICENSE").as_slice(),
+            ),
             other => panic!("unexpected language {other}"),
         };
         verify_grammar_asset(asset, wasm, license).expect("pinned candidate bytes");
@@ -98,7 +114,12 @@ fn missing_provenance_duplicate_fields_and_unknown_languages_are_rejected() {
 #[test]
 fn changed_wasm_license_or_abi_never_qualifies_a_candidate() {
     let manifest = bundled_grammar_candidates().unwrap();
-    let mut asset = manifest.assets[0].clone();
+    let mut asset = manifest
+        .assets
+        .iter()
+        .find(|asset| asset.language == "java")
+        .expect("Java candidate")
+        .clone();
     let wasm = include_bytes!("../../../grammars/java/parser.wasm");
     let license = include_bytes!("../../../grammars/java/LICENSE");
     let mut changed = wasm.to_vec();
diff --git a/crates/codeguard-cli/src/syntax_worker_command.rs b/crates/codeguard-cli/src/syntax_worker_command.rs
index 405bab11..e5d1b994 100644
--- a/crates/codeguard-cli/src/syntax_worker_command.rs
+++ b/crates/codeguard-cli/src/syntax_worker_command.rs
@@ -64,6 +64,9 @@ fn observe(language: &str, source: &[u8]) -> Result<SyntaxWorkerEnvelope, String
         return Err("grammar 与当前 Rust WASM 运行时不兼容".into());
     }
     let wasm = match language {
+        "c" => include_bytes!("../../../grammars/c/parser.wasm").as_slice(),
+        "go" => include_bytes!("../../../grammars/go/parser.wasm").as_slice(),
+        "javascript" => include_bytes!("../../../grammars/javascript/parser.wasm").as_slice(),
         "java" => include_bytes!("../../../grammars/java/parser.wasm").as_slice(),
         "python" => include_bytes!("../../../grammars/python/parser.wasm").as_slice(),
         "typescript" => include_bytes!("../../../grammars/typescript/parser.wasm").as_slice(),
@@ -71,6 +74,7 @@ fn observe(language: &str, source: &[u8]) -> Result<SyntaxWorkerEnvelope, String
         "zig" => include_bytes!("../../../grammars/zig/parser.wasm").as_slice(),
         "objc" => include_bytes!("../../../grammars/objc/parser.wasm").as_slice(),
         "solidity" => include_bytes!("../../../grammars/solidity/parser.wasm").as_slice(),
+        "rust" => include_bytes!("../../../grammars/rust/parser.wasm").as_slice(),
         _ => return Err("不支持的 grammar 语种".into()),
     };
     let mut grammar = WasmGrammar::load(language, wasm, &asset.sha256, asset.abi_version as usize)?;
diff --git a/crates/codeguard-cli/tests/grammar_status_cli.rs b/crates/codeguard-cli/tests/grammar_status_cli.rs
index f6ea50f2..27bc650d 100644
--- a/crates/codeguard-cli/tests/grammar_status_cli.rs
+++ b/crates/codeguard-cli/tests/grammar_status_cli.rs
@@ -12,7 +12,7 @@ fn codegraph_coverage_is_explicit_and_never_claims_parser_or_gate_completion() {
     assert_eq!(report["report_type"], "grammar_coverage_inventory");
     assert_eq!(report["codegraph_grammar_count"], 32);
     assert_eq!(report["codegraph_vendored_count"], 30);
-    assert_eq!(report["candidate_count"], 7);
+    assert_eq!(report["candidate_count"], 11);
     assert_eq!(report["released_count"], 0);
     assert_eq!(report["authority"], "source_inventory_only");
     assert_eq!(report["parser_capability"], "unverified");
@@ -26,9 +26,13 @@ fn codegraph_coverage_is_explicit_and_never_claims_parser_or_gate_completion() {
         assert!(!asset["gap"].as_str().unwrap().is_empty());
     }
     for language in [
+        "c",
+        "go",
         "java",
+        "javascript",
         "objc",
         "python",
+        "rust",
         "solidity",
         "typescript",
         "tsx",
diff --git a/crates/codeguard-cli/tests/syntax_worker_candidate.rs b/crates/codeguard-cli/tests/syntax_worker_candidate.rs
index 87c3e867..7589dd55 100644
--- a/crates/codeguard-cli/tests/syntax_worker_candidate.rs
+++ b/crates/codeguard-cli/tests/syntax_worker_candidate.rs
@@ -98,6 +98,41 @@ fn dependency_grammars_run_in_worker_without_claiming_clean() {
     }
 }
 
+#[test]
+fn mainstream_grammars_run_in_worker_without_claiming_clean() {
+    for (language, path, source) in [
+        (
+            "c",
+            "src/main.c",
+            b"int main(void) { return 0; }".as_slice(),
+        ),
+        (
+            "go",
+            "main.go",
+            b"package main\nfunc main() {}\n".as_slice(),
+        ),
+        ("javascript", "src/main.js", b"const value = 1;".as_slice()),
+        (
+            "rust",
+            "src/main.rs",
+            b"fn main() { let x = 1; }".as_slice(),
+        ),
+    ] {
+        let result = run_syntax_worker_candidate(
+            env!("CARGO_BIN_EXE_codeguard").as_ref(),
+            language,
+            path,
+            source,
+            Instant::now() + Duration::from_secs(60),
+            &AtomicBool::new(false),
+        )
+        .expect("mainstream grammar worker candidate");
+        assert!(result.recoveries.is_empty(), "{language}");
+        assert_eq!(result.precheck.status, SyntaxPrecheckStatus::Incomplete);
+        assert!(!result.grammar_qualified);
+    }
+}
+
 #[test]
 fn invalid_input_and_cancellation_cannot_yield_observations() {
     let exe = env!("CARGO_BIN_EXE_codeguard").as_ref();
diff --git a/crates/codeguard-runtime/tests/wasm_grammar_load.rs b/crates/codeguard-runtime/tests/wasm_grammar_load.rs
index dafb5197..62006ff5 100644
--- a/crates/codeguard-runtime/tests/wasm_grammar_load.rs
+++ b/crates/codeguard-runtime/tests/wasm_grammar_load.rs
@@ -10,6 +10,59 @@ const ZIG: &[u8] = include_bytes!("../../../grammars/zig/parser.wasm");
 const ZIG_SOURCE: &[u8] = include_bytes!("../../../grammars/zig/source.wasm");
 const OBJC: &[u8] = include_bytes!("../../../grammars/objc/parser.wasm");
 const SOLIDITY: &[u8] = include_bytes!("../../../grammars/solidity/parser.wasm");
+const C: &[u8] = include_bytes!("../../../grammars/c/parser.wasm");
+const GO: &[u8] = include_bytes!("../../../grammars/go/parser.wasm");
+const JAVASCRIPT: &[u8] = include_bytes!("../../../grammars/javascript/parser.wasm");
+const RUST: &[u8] = include_bytes!("../../../grammars/rust/parser.wasm");
+
+#[test]
+fn mainstream_grammars_load_offline_and_parse_basic_fixtures() {
+    for (language, wasm, sha, abi, valid, invalid) in [
+        (
+            "c",
+            C,
+            "a271e584616c7c3c0ac663f01cd05dd5f1a6c2ce6d4cd23096548985a95d0ccb",
+            15,
+            b"int main(void) { return 0; }".as_slice(),
+            b"int main(void) {".as_slice(),
+        ),
+        (
+            "go",
+            GO,
+            "4eda5d91c99ca981e88bc7d3d33f0db166b4bab0a84d0021a9abf39b364c78ef",
+            14,
+            b"package main\nfunc main() {}\n".as_slice(),
+            b"package main\nfunc main( {\n".as_slice(),
+        ),
+        (
+            "javascript",
+            JAVASCRIPT,
+            "7978e62bcc851ab1d1f6dcd4678f9eda79df2b3b3490e75f81dd819d9bccccfa",
+            15,
+            b"const value = 1;".as_slice(),
+            b"const = ;".as_slice(),
+        ),
+        (
+            "rust",
+            RUST,
+            "206031e0f67fb41ecae505868ca3bb917df7375031aebafd2f97314a849713fe",
+            15,
+            b"fn main() { let x = 1; }".as_slice(),
+            b"fn main( {".as_slice(),
+        ),
+    ] {
+        let mut grammar = WasmGrammar::load(language, wasm, sha, abi)
+            .unwrap_or_else(|reason| panic!("{language} offline load: {reason}"));
+        assert!(
+            !grammar.parse(valid).unwrap().root_node().has_error(),
+            "{language} valid"
+        );
+        assert!(
+            grammar.parse(invalid).unwrap().root_node().has_error(),
+            "{language} invalid"
+        );
+    }
+}
 
 #[test]
 fn dependency_grammars_load_offline_and_parse_basic_fixtures() {
diff --git a/docs/Codeguard-Architecture.md b/docs/Codeguard-Architecture.md
index 7435daa2..c07bca1e 100644
--- a/docs/Codeguard-Architecture.md
+++ b/docs/Codeguard-Architecture.md
@@ -28,7 +28,7 @@ The existing [OpenSpec change](../openspec/changes/introduce-rust-codeguard-cli/
 | [Core aggregation](../crates/codeguard-core/src/aggregate.rs), [delivery gate](../crates/codeguard-core/src/delivery_gate.rs) | Pure result semantics, not trusted public gate availability |
 | [Acceptance records](../tests/acceptance) | Scoped observations, test method, and residual gaps |
 
-WASM requirements and 19 implementation tasks are recorded in the existing change. An opt-in Rust worker and narrow Java/TypeScript/TSX single-file feedback paths and a Python Ruff-unavailable candidate path now exist. All seven grammars remain unqualified; Zig, Objective-C and Solidity are pinned Rust-loadable candidates without public lint routes. Project-wide native-first routing, qualified grammar ranges, capability-matched task closure, and host integrations remain incomplete; design examples are not current command output.
+WASM requirements and 19 implementation tasks are recorded in the existing change. An opt-in Rust worker and narrow Java/TypeScript/TSX single-file feedback paths and a Python Ruff-unavailable candidate path now exist. All eleven grammars remain unqualified; C, Go, JavaScript, Rust, Zig, Objective-C and Solidity are pinned Rust-loadable candidates without public lint routes. Project-wide native-first routing, qualified grammar ranges, capability-matched task closure, and host integrations remain incomplete; design examples are not current command output.
 
 ## 2. Architectural drivers
 
diff --git a/docs/Codeguard-Architecture.zh_CN.md b/docs/Codeguard-Architecture.zh_CN.md
index 2544050e..d32eea71 100644
--- a/docs/Codeguard-Architecture.zh_CN.md
+++ b/docs/Codeguard-Architecture.zh_CN.md
@@ -28,7 +28,7 @@
 | [核心聚合](../crates/codeguard-core/src/aggregate.rs)、[交付门禁](../crates/codeguard-core/src/delivery_gate.rs) | 纯结果语义，不代表公开可信门禁已可用 |
 | [验收记录](../tests/acceptance) | 限定范围的观察、测试方法和剩余缺口 |
 
-WASM 的规范与 19 项实施任务已纳入既有 change；可选 Rust worker 与 Java/TypeScript/TSX 局部单文件反馈路径及 Python Ruff 不可用时的候选路径已存在；七份 grammar 都尚未验收；Zig、Objective-C、Solidity 仅有经固定字节适配后可加载的候选资产，尚无公开 lint 路由。项目级原生优先调度、grammar 版本范围验收、任务的能力匹配关闭及宿主接线仍未完成；设计示例不是当前命令输出。
+WASM 的规范与 19 项实施任务已纳入既有 change；可选 Rust worker 与 Java/TypeScript/TSX 局部单文件反馈路径及 Python Ruff 不可用时的候选路径已存在；十一份 grammar 都尚未验收；C、Go、JavaScript、Rust、Zig、Objective-C、Solidity 仅有固定字节的 Rust 可加载候选资产，尚无公开 lint 路由。项目级原生优先调度、grammar 版本范围验收、任务的能力匹配关闭及宿主接线仍未完成；设计示例不是当前命令输出。
 
 ## 2. 架构驱动
 
@@ -241,7 +241,7 @@ flowchart TD
 
 复用固定版本的 CodeGraph grammar WASM，以及适用的上游许可证、源码引用、补丁和语料。不能把 CodeGraph 的图提取或源码遮盖启发式直接用于语法判定。CodeGraph 的 `src/extraction/grammars.ts` 通过 `web-tree-sitter` 加载语言资产，在那里可加载不证明兼容 Codeguard 的 Rust 运行时。发行时必须固定不可变的来源与资产清单，不能把正在修改的本地目录直接当作发行输入。
 
-只读 `codeguard grammar status` 现投影[固定来源覆盖库存](../grammars/codegraph-coverage.json)：CodeGraph 随仓 30 份 WASM，依赖提供另两种独立 grammar；CodeGuard 有 Java、Objective-C、Python、Solidity、TypeScript、TSX、Zig 七份资产候选。Objective-C 与 Solidity 来自锁定的 `tree-sitter-wasms@0.1.13`，保留原始字节和许可证，并以固定散列的 `dylink` 元数据转换加载；仍未做语言验收与发行。Zig 新版来源 WASM 的导入经固定哈希适配后由 Rust 加载，但仍无公开 `lint zig` 路由，尚无已验收发行能力。Python 已有源码可选构建中的局部 `lint` 兜底，仅覆盖 Ruff 不可用或项目未声明配置的情形；原生结果优先且不能批准交付。已初始化工作区的单文件范围可同步稳定的原生确认任务；候选零恢复节点不会关闭任务。覆盖库存与[候选资产清单](../grammars/manifest.json)分开，不能凭库存行自动加载或宣称支持。尤其 COBOL 来源资产超过当前加载器 8 MiB 限额。
+只读 `codeguard grammar status` 现投影[固定来源覆盖库存](../grammars/codegraph-coverage.json)：CodeGraph 随仓 30 份 WASM，依赖提供另两种独立 grammar；CodeGuard 有 C、Go、Java、JavaScript、Objective-C、Python、Rust、Solidity、TypeScript、TSX、Zig 十一份资产候选。C、Go、JavaScript、Rust 的 CodeGraph 随仓字节及上游标签许可证已固定，可由 Rust worker 解析基础正反例，但尚未进行语言验收或公开 lint 接线。Objective-C 与 Solidity 来自锁定的 `tree-sitter-wasms@0.1.13`，保留原始字节和许可证，并以固定散列的 `dylink` 元数据转换加载；仍未做语言验收与发行。Zig 新版来源 WASM 的导入经固定哈希适配后由 Rust 加载，但仍无公开 `lint zig` 路由，尚无已验收发行能力。Python 已有源码可选构建中的局部 `lint` 兜底，仅覆盖 Ruff 不可用或项目未声明配置的情形；原生结果优先且不能批准交付。已初始化工作区的单文件范围可同步稳定的原生确认任务；候选零恢复节点不会关闭任务。覆盖库存与[候选资产清单](../grammars/manifest.json)分开，不能凭库存行自动加载或宣称支持。尤其 COBOL 来源资产超过当前加载器 8 MiB 限额。
 
 ```text
 grammars/                         # 规划中的发行资产，不是项目状态
diff --git a/docs/Codeguard-Technical-Design.md b/docs/Codeguard-Technical-Design.md
index 3290f560..6dd11377 100644
--- a/docs/Codeguard-Technical-Design.md
+++ b/docs/Codeguard-Technical-Design.md
@@ -14,7 +14,7 @@ The existing [OpenSpec change](../openspec/changes/introduce-rust-codeguard-cli/
 
 Current source is the authority for callable behavior. Target contracts are labelled as such. The product priority is configuration discovery → native results → useful repair guidance. Internal consistency checks support this experience; they are not a demand for users to manually construct execution certificates.
 
-WASM requirements and 19 implementation tasks are recorded in the existing change. Candidate Rust worker and narrow Java/TypeScript/TSX single-file reports and a Python Ruff-unavailable candidate report now exist behind an opt-in feature; all seven grammars remain unqualified; Zig, Objective-C and Solidity are only Rust-loadable candidates. Project-wide native-first routing, qualified grammar ranges, and host integrations remain incomplete. Design examples are not current command output.
+WASM requirements and 19 implementation tasks are recorded in the existing change. Candidate Rust worker and narrow Java/TypeScript/TSX single-file reports and a Python Ruff-unavailable candidate report now exist behind an opt-in feature; all eleven grammars remain unqualified; C, Go, JavaScript, Rust, Zig, Objective-C and Solidity are only Rust-loadable candidates. Project-wide native-first routing, qualified grammar ranges, and host integrations remain incomplete. Design examples are not current command output.
 
 ## 2. Technology choices and trade-offs
 
@@ -191,7 +191,7 @@ The opt-in CLI build first checks for a local ESLint 10 package and a single ord
 
 Import only pinned WASM bytes with upstream license, commit/patch provenance, SHA-256, ABI, tested runtime and language/dialect ranges, corpus reference and known gaps. Verify each copied CodeGraph artifact in the selected Rust Tree-sitter runtime; do not copy TypeScript extraction logic or assume CodeGraph support equals syntax acceptance. A release manifest belongs to distribution assets, not writable `.codeguard/` project state.
 
-Use `codeguard grammar status --format=json` to query the separate source coverage inventory. It reports 32 distinct CodeGraph grammar assets, seven CodeGuard asset candidates (Java, Objective-C, Python, Solidity, TypeScript, TSX and Zig), and zero released capabilities without running a parser. Python has a narrow source-build-only `lint` fallback for unavailable or undeclared Ruff, never a clean or delivery result. A bound, single-file result uses [feedback 0.15.0](../schemas/python-lint-feedback-v0.15.schema.json) and persists a [0.1.0 confirmation observation](../schemas/python-syntax-confirmation-observation-v0.1.schema.json) through the existing work sync. The task identity binds workspace and source scope; current-source SHA-256 and pinned grammar are checked before import. Native capability-matched closure remains open. The two dependency-provided assets now have pinned original and adapted bytes plus license references, but are still unqualified candidates without public lint routes. COBOL exceeds the current 8 MiB loader limit.
+Use `codeguard grammar status --format=json` to query the separate source coverage inventory. It reports 32 distinct CodeGraph grammar assets, eleven CodeGuard asset candidates (C, Go, Java, JavaScript, Objective-C, Python, Rust, Solidity, TypeScript, TSX and Zig), and zero released capabilities without running a parser. Python has a narrow source-build-only `lint` fallback for unavailable or undeclared Ruff, never a clean or delivery result. A bound, single-file result uses [feedback 0.15.0](../schemas/python-lint-feedback-v0.15.schema.json) and persists a [0.1.0 confirmation observation](../schemas/python-syntax-confirmation-observation-v0.1.schema.json) through the existing work sync. The task identity binds workspace and source scope; current-source SHA-256 and pinned grammar are checked before import. Native capability-matched closure remains open. C, Go, JavaScript and Rust have pinned vendored bytes and narrow Rust worker smoke tests, but no public lint route or language qualification. The two dependency-provided assets now have pinned original and adapted bytes plus license references, but are still unqualified candidates without public lint routes. COBOL exceeds the current 8 MiB loader limit.
 
 Use a parent-controlled parser worker with a total deadline, per-file input bound, memory/process limit and capped diagnostics. Lazy-load selected grammars, parse without general network/filesystem imports, and terminate a stuck worker without losing native results from other modules. Host-specific enforcement and Rust MSRV compatibility must be tested; numeric production budgets remain measurement-driven rather than invented promises.
 
diff --git a/docs/Codeguard-Technical-Design.zh_CN.md b/docs/Codeguard-Technical-Design.zh_CN.md
index f8a9c39e..dcfd2e9d 100644
--- a/docs/Codeguard-Technical-Design.zh_CN.md
+++ b/docs/Codeguard-Technical-Design.zh_CN.md
@@ -14,7 +14,7 @@
 
 可调用行为以当前源码为准，目标契约明确标注。产品优先级是配置发现 → 原生结果 → 有用的修复指引。内部一致性校验为这个体验服务，不要求用户手工构造执行证明。
 
-WASM 的规范与 19 项实施任务已纳入既有 change；可选特性下的 Rust worker 与 Java/TypeScript/TSX 局部单文件候选报告及 Python Ruff 不可用时的候选报告已存在；七份 grammar 均未验收；Zig、Objective-C、Solidity 仅有固定适配后的 Rust 可加载候选资产，尚无公开 lint 路由。项目级原生优先调度、grammar 版本范围验收与宿主接线仍未完成。设计示例不是当前命令输出。
+WASM 的规范与 19 项实施任务已纳入既有 change；可选特性下的 Rust worker 与 Java/TypeScript/TSX 局部单文件候选报告及 Python Ruff 不可用时的候选报告已存在；十一份 grammar 均未验收；C、Go、JavaScript、Rust、Zig、Objective-C、Solidity 仅有固定字节的 Rust 可加载候选资产，尚无公开 lint 路由。项目级原生优先调度、grammar 版本范围验收与宿主接线仍未完成。设计示例不是当前命令输出。
 
 ## 2. 技术选型与权衡
 
@@ -191,7 +191,7 @@ flowchart LR
 
 只引入固定 WASM 字节及上游许可证、提交/补丁来源、SHA-256、ABI、已验证运行时和语言/方言范围、语料引用与已知缺口。逐个验证 CodeGraph 资产与选定 Rust Tree-sitter 运行时兼容，不能复制 TypeScript 提取逻辑或把 CodeGraph 支持等同语法验收。发行清单属于分发资产，不属于可写的 `.codeguard/` 项目状态。
 
-可用 `codeguard grammar status --format=json` 查询独立的来源覆盖库存。它只读报告 CodeGraph 32 种独立 grammar、CodeGuard 七份资产候选（Java、Objective-C、Python、Solidity、TypeScript、TSX、Zig）和零项已发行能力，不运行解析器；Python 已有源码可选构建中的局部 `lint` 兜底，结果不能视为通过。已绑定工作区的单文件反馈使用 [0.15.0 协议](../schemas/python-lint-feedback-v0.15.schema.json)，并通过现有 work sync 保存 [0.1.0 确认观察](../schemas/python-syntax-confirmation-observation-v0.1.schema.json)。任务身份绑定工作区和源码范围；导入前核对当前源码 SHA-256 与固定 grammar。能力匹配的原生关闭仍未完成。依赖提供的 Objective-C 与 Solidity 已固定原始和适配后字节、许可证及依赖包完整性，但仍未验收语言版本或公开 lint 路由；COBOL 超过现有加载器的 8 MiB 限额。
+可用 `codeguard grammar status --format=json` 查询独立的来源覆盖库存。它只读报告 CodeGraph 32 种独立 grammar、CodeGuard 十一份资产候选（C、Go、Java、JavaScript、Objective-C、Python、Rust、Solidity、TypeScript、TSX、Zig）和零项已发行能力，不运行解析器；Python 已有源码可选构建中的局部 `lint` 兜底，结果不能视为通过。已绑定工作区的单文件反馈使用 [0.15.0 协议](../schemas/python-lint-feedback-v0.15.schema.json)，并通过现有 work sync 保存 [0.1.0 确认观察](../schemas/python-syntax-confirmation-observation-v0.1.schema.json)。任务身份绑定工作区和源码范围；导入前核对当前源码 SHA-256 与固定 grammar。能力匹配的原生关闭仍未完成。C、Go、JavaScript、Rust 的随仓字节和上游许可证已固定，完成窄范围 Rust worker 解析验证，尚无公开 lint 路由或语言验收。依赖提供的 Objective-C 与 Solidity 已固定原始和适配后字节、许可证及依赖包完整性，但仍未验收语言版本或公开 lint 路由；COBOL 超过现有加载器的 8 MiB 限额。
 
 由父进程控制解析工作进程，设置总截止时间、单文件输入上限、内存/进程限制及诊断数量上限。按需加载 grammar，不提供通用网络/文件系统导入；终止卡住的进程时保留其它模块的原生结果。宿主约束执行和 Rust MSRV 兼容性须测试，生产数值预算须经测量后确定，不编造性能承诺。
 
diff --git a/grammars/c/LICENSE b/grammars/c/LICENSE
new file mode 100644
index 00000000..4b52d191
--- /dev/null
+++ b/grammars/c/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Max Brunsfeld
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/grammars/c/parser.wasm b/grammars/c/parser.wasm
new file mode 100644
index 00000000..13c8dfc3
Binary files /dev/null and b/grammars/c/parser.wasm differ
diff --git a/grammars/go/LICENSE b/grammars/go/LICENSE
new file mode 100644
index 00000000..4b52d191
--- /dev/null
+++ b/grammars/go/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Max Brunsfeld
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/grammars/go/parser.wasm b/grammars/go/parser.wasm
new file mode 100644
index 00000000..2fcc32f8
Binary files /dev/null and b/grammars/go/parser.wasm differ
diff --git a/grammars/javascript/LICENSE b/grammars/javascript/LICENSE
new file mode 100644
index 00000000..4b52d191
--- /dev/null
+++ b/grammars/javascript/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Max Brunsfeld
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/grammars/javascript/parser.wasm b/grammars/javascript/parser.wasm
new file mode 100644
index 00000000..03e0bf19
Binary files /dev/null and b/grammars/javascript/parser.wasm differ
diff --git a/grammars/manifest.json b/grammars/manifest.json
index b8b6766b..9321e185 100644
--- a/grammars/manifest.json
+++ b/grammars/manifest.json
@@ -6,6 +6,46 @@
   "codegraph_license_sha256": "e6d98f98c666bebe065ac2492a0a19232cc318d4d67bac3ca42ffb77bacc8809",
   "build_tool": "tree-sitter-cli 0.25.10 build --wasm; Zig: tree-sitter-cli 0.27.0 generate --abi 15 + Zig 0.16.0 wasm32-wasi",
   "assets": [
+    {
+      "language": "c",
+      "dialect": "c",
+      "grammar_repository": "https://github.com/tree-sitter/tree-sitter-c",
+      "grammar_commit": "b780e47fc780ddc8da13afa35a3f4ed5c157823d",
+      "grammar_version": "v0.24.2",
+      "path": "c/parser.wasm",
+      "sha256": "a271e584616c7c3c0ac663f01cd05dd5f1a6c2ce6d4cd23096548985a95d0ccb",
+      "bytes": 625716,
+      "license": "c/LICENSE",
+      "license_sha256": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
+      "abi_version": 15,
+      "codegraph_runtime": "web-tree-sitter 0.25.3",
+      "codeguard_runtime_validation": "rust_loader_smoke_passed",
+      "language_versions": [],
+      "known_limitations": [
+        "Rust loader smoke and narrow fixtures passed; language versions, dialect corpus, native differential, resource isolation and release remain unqualified"
+      ],
+      "release_status": "candidate_unvalidated"
+    },
+    {
+      "language": "go",
+      "dialect": "go",
+      "grammar_repository": "https://github.com/tree-sitter/tree-sitter-go",
+      "grammar_commit": "3c3775faa968158a8b4ac190a7fda867fd5fb748",
+      "grammar_version": "v0.23.4",
+      "path": "go/parser.wasm",
+      "sha256": "4eda5d91c99ca981e88bc7d3d33f0db166b4bab0a84d0021a9abf39b364c78ef",
+      "bytes": 210013,
+      "license": "go/LICENSE",
+      "license_sha256": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
+      "abi_version": 14,
+      "codegraph_runtime": "web-tree-sitter 0.25.3",
+      "codeguard_runtime_validation": "rust_loader_smoke_passed",
+      "language_versions": [],
+      "known_limitations": [
+        "Rust loader smoke and narrow fixtures passed; language versions, dialect corpus, native differential, resource isolation and release remain unqualified"
+      ],
+      "release_status": "candidate_unvalidated"
+    },
     {
       "language": "java",
       "dialect": "java",
@@ -26,6 +66,26 @@
       ],
       "release_status": "candidate_unvalidated"
     },
+    {
+      "language": "javascript",
+      "dialect": "javascript",
+      "grammar_repository": "https://github.com/tree-sitter/tree-sitter-javascript",
+      "grammar_commit": "44c892e0be055ac465d5eeddae6d3e194424e7de",
+      "grammar_version": "v0.25.0",
+      "path": "javascript/parser.wasm",
+      "sha256": "7978e62bcc851ab1d1f6dcd4678f9eda79df2b3b3490e75f81dd819d9bccccfa",
+      "bytes": 411832,
+      "license": "javascript/LICENSE",
+      "license_sha256": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
+      "abi_version": 15,
+      "codegraph_runtime": "web-tree-sitter 0.25.3",
+      "codeguard_runtime_validation": "rust_loader_smoke_passed",
+      "language_versions": [],
+      "known_limitations": [
+        "Rust loader smoke and narrow fixtures passed; language versions, dialect corpus, native differential, resource isolation and release remain unqualified"
+      ],
+      "release_status": "candidate_unvalidated"
+    },
     {
       "language": "objc",
       "dialect": "objc",
@@ -68,6 +128,26 @@
       ],
       "release_status": "candidate_unvalidated"
     },
+    {
+      "language": "rust",
+      "dialect": "rust",
+      "grammar_repository": "https://github.com/tree-sitter/tree-sitter-rust",
+      "grammar_commit": "77a3747266f4d621d0757825e6b11edcbf991ca5",
+      "grammar_version": "v0.24.2",
+      "path": "rust/parser.wasm",
+      "sha256": "206031e0f67fb41ecae505868ca3bb917df7375031aebafd2f97314a849713fe",
+      "bytes": 1114303,
+      "license": "rust/LICENSE",
+      "license_sha256": "31d5b6f4243d5c7c6e1c4ebbbb9f6407bd1457a08bcc4f706521710341acba36",
+      "abi_version": 15,
+      "codegraph_runtime": "web-tree-sitter 0.25.3",
+      "codeguard_runtime_validation": "rust_loader_smoke_passed",
+      "language_versions": [],
+      "known_limitations": [
+        "Rust loader smoke and narrow fixtures passed; language versions, dialect corpus, native differential, resource isolation and release remain unqualified"
+      ],
+      "release_status": "candidate_unvalidated"
+    },
     {
       "language": "solidity",
       "dialect": "solidity",
diff --git a/grammars/rust/LICENSE b/grammars/rust/LICENSE
new file mode 100644
index 00000000..ceaf3c9a
--- /dev/null
+++ b/grammars/rust/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Maxim Sokolov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/grammars/rust/parser.wasm b/grammars/rust/parser.wasm
new file mode 100644
index 00000000..d4045891
Binary files /dev/null and b/grammars/rust/parser.wasm differ
diff --git a/openspec/changes/introduce-rust-codeguard-cli/tasks.md b/openspec/changes/introduce-rust-codeguard-cli/tasks.md
index 98593219..1e6bb333 100644
--- a/openspec/changes/introduce-rust-codeguard-cli/tasks.md
+++ b/openspec/changes/introduce-rust-codeguard-cli/tasks.md
@@ -1028,7 +1028,7 @@ TDD缺自动同步先RED。相关普通：build9、work sync15、next6，共30
 
 状态：逐项实施中，未达到整体验收。统一规格 [syntax-precheck](specs/syntax-precheck/spec.md)。依赖已有 CLI/原生调度/工作台切片，不等待整个 S13；本阶段验收进入 S12、S13。各任务须先失败样本后实现与回归；不改写原生规则。责任为模块维护职责，非已分配人员。
 
-- [ ] 14.1 资产清单与来源。责任：adapters / 发布。规格：SP04。依赖：无。验收：固定 CodeGraph 来源提交、grammar 版本、许可证、SHA-256、ABI、语言/方言；缺来源、错散列和不兼容样本拒绝加载。进行中：已从固定 CodeGraph 提交复制 Java/Python/TypeScript/TSX WASM 与 MIT 许可证，清单和 Rust 校验拒绝来源/字节/声明 ABI 漂移；四份资产已由 Rust 离线加载并实测 ABI，Python 尚无 lint 路由；见[Python 资产局部验收](../../../tests/acceptance/python-grammar-asset-candidate.md)；[局部证据](../../../tests/acceptance/grammar-asset-candidates.md)。新增与批准资产清单分离的[完整来源覆盖库存](../../../grammars/codegraph-coverage.json)及只读 `grammar status`：固定提交中的 30 份随仓 WASM 已逐字节核对，另两种依赖资产标为未固定，COBOL 的 16.4 MB 超出当前 8 MiB 加载限额；[覆盖验收](../../../tests/acceptance/codegraph-grammar-coverage.md)。其余 grammar 的上游许可证/版本、Rust 加载，以及所有候选的语言版本/方言、语料及可发行验收仍缺，不勾选。 Python 资产已接入可选源码构建的 `lint python` 局部候选路径，但版本/方言和发行验收仍缺；见[Python 兜底局部验收](../../../tests/acceptance/python-syntax-fallback-candidate.md)。 2026-09-29 增量：CodeGraph 来源更新至 `1072f82ce24db3d133258d30165cef6b74d108b2`，30/30 随仓字节与新提交一致。新增 Zig 第五份候选：保留新版原始 WASM、许可证和固定哈希；原始模块因 `__main_argc_argv` 不被 Rust `WasmStore` 接受，使用固定输入/输出散列的同签名导入适配后，可解析合法空容器及损坏样例，仍未做完整语料和原生对照；见[Zig 局部验收](../../../tests/acceptance/zig-grammar-candidate.md)。2026-09-29 后续增量：Objective-C 与 Solidity 从 CodeGraph 锁定的 `tree-sitter-wasms@0.1.13` 获取，依赖包完整性、两份原始 WASM、上游许可证及适配后字节均固定；Rust 将旧 `dylink` 元数据转为 `dylink.0`，离线加载、基本正反例及隔离 worker 候选观察通过。候选累计 7，已验收发行仍 0；完整语料、原生对照和公开 lint 路由仍缺，见[依赖 grammar 局部验收](../../../tests/acceptance/dependency-grammar-candidates.md)。本项及全量语言覆盖仍未完成。
+- [ ] 14.1 资产清单与来源。责任：adapters / 发布。规格：SP04。依赖：无。验收：固定 CodeGraph 来源提交、grammar 版本、许可证、SHA-256、ABI、语言/方言；缺来源、错散列和不兼容样本拒绝加载。进行中：已从固定 CodeGraph 提交复制 Java/Python/TypeScript/TSX WASM 与 MIT 许可证，清单和 Rust 校验拒绝来源/字节/声明 ABI 漂移；四份资产已由 Rust 离线加载并实测 ABI，Python 尚无 lint 路由；见[Python 资产局部验收](../../../tests/acceptance/python-grammar-asset-candidate.md)；[局部证据](../../../tests/acceptance/grammar-asset-candidates.md)。新增与批准资产清单分离的[完整来源覆盖库存](../../../grammars/codegraph-coverage.json)及只读 `grammar status`：固定提交中的 30 份随仓 WASM 已逐字节核对，另两种依赖资产标为未固定，COBOL 的 16.4 MB 超出当前 8 MiB 加载限额；[覆盖验收](../../../tests/acceptance/codegraph-grammar-coverage.md)。其余 grammar 的上游许可证/版本、Rust 加载，以及所有候选的语言版本/方言、语料及可发行验收仍缺，不勾选。 Python 资产已接入可选源码构建的 `lint python` 局部候选路径，但版本/方言和发行验收仍缺；见[Python 兜底局部验收](../../../tests/acceptance/python-syntax-fallback-candidate.md)。 2026-09-29 增量：CodeGraph 来源更新至 `1072f82ce24db3d133258d30165cef6b74d108b2`，30/30 随仓字节与新提交一致。新增 Zig 第五份候选：保留新版原始 WASM、许可证和固定哈希；原始模块因 `__main_argc_argv` 不被 Rust `WasmStore` 接受，使用固定输入/输出散列的同签名导入适配后，可解析合法空容器及损坏样例，仍未做完整语料和原生对照；见[Zig 局部验收](../../../tests/acceptance/zig-grammar-candidate.md)。2026-09-29 后续增量：Objective-C 与 Solidity 从 CodeGraph 锁定的 `tree-sitter-wasms@0.1.13` 获取，依赖包完整性、两份原始 WASM、上游许可证及适配后字节均固定；Rust 将旧 `dylink` 元数据转为 `dylink.0`，离线加载、基本正反例及隔离 worker 候选观察通过。候选累计 7，已验收发行仍 0；完整语料、原生对照和公开 lint 路由仍缺，见[依赖 grammar 局部验收](../../../tests/acceptance/dependency-grammar-candidates.md)。后续增量：C、Go、JavaScript、Rust 的 CodeGraph 随仓 WASM 及上游版本标签许可证已固定，实测 Rust ABI、基础正反例和隔离 worker 候选状态；累计 11 份候选、21 种仍缺资产，见[主流语言局部验收](../../../tests/acceptance/mainstream-grammar-candidates.md)。本项及全量语言覆盖仍未完成。
 - [ ] 14.2 Rust WASM 加载器。责任：runtime。规格：SP04,SP05。依赖：14.1。验收：支持固定资产离线加载；不依赖 Node 解析器、CodeGraph 或用户安装 tree-sitter-cli；通过有效/损坏/错 ABI 样本及 MSRV。进行中：可选 `wasm-precheck` 特性已通过 Java/Python/TypeScript/TSX Rust `WasmStore` 加载与反例测试，并由私有工作进程从 stdin 处理真实源码、父进程核对身份与恢复锚点，见[局部验收](../../../tests/acceptance/syntax-worker-candidate.md)；本机无 Rust 1.85，MSRV 实编及正式 `lint/check` 接线尚缺。
 - [ ] 14.3 进程资源隔离。责任：runtime。规格：SP05。依赖：14.2。验收：验证超时、内存、输出、取消与崩溃；损坏 grammar 不阻塞其他模块、不遗留进程。进行中：Unix 候选 worker 复用受控进程组内核，输入 1 MiB、输出 64 KiB，父进程有共同截止时间和取消；崩溃后代清理、输出洪泛、运行中取消及随后正常解析均增加真实子进程反例。Linux 2 GiB `RLIMIT_AS`、3 GiB 分配负例与 worker 故障隔离在 [Ubuntu CI](https://github.com/full-stack-plugins/codeguard/actions/runs/36478461118) 真实通过；Wasmtime 虚拟预留缩小。macOS 本机硬限制实测不支持，候选仍不具内存隔离权威；见[局部验收](../../../tests/acceptance/syntax-worker-candidate.md)。其它目标平台、损坏 grammar 隔离及正式调度仍缺，不勾选。
 - [ ] 14.4 语言覆盖与源码映射。责任：adapters。规格：SP06。依赖：14.2。验收：识别 ERROR/MISSING，合并恢复节点；测试 Unicode、换行、嵌入语言、新语法和未知版本，不将不支持当源码违规。进行中：Rust 已提取两类原始节点，adapters 核对 UTF-8/CRLF 字节锚点并转换 Unicode 标量列；结构祖先归组保留并列错误，预算截断保持不完整；[局部证据](../../../tests/acceptance/syntax-recovery-candidate.md)。级联归并语料、版本/嵌入语言及原生对照仍缺。
@@ -1046,4 +1046,4 @@ TDD缺自动同步先RED。相关普通：build9、work sync15、next6，共30
 - [ ] 14.16 Gemini CLI 实际对话接入。责任：plugin。规格：SP07,SP12。依赖：14.9,14.10。验收：独立验证真实 Gemini 对话反馈、去重、故障和权限边界，不借用其他宿主结果。
 - [ ] 14.17 逐语言误报与性能评测。责任：评测/adapters。规格：SP06,SP12。依赖：14.3,14.4,14.11。验收：独立合法/非法 oracle、版本/方言语料、原生对照；分别报告误报、漏报、未知覆盖及冷暖启动/包体/内存；先实测再定预算。
 - [ ] 14.18 打包兼容与分阶段发布验收。责任：发布/CLI。规格：SP04,SP11,SP12。依赖：14.12-14.17。验收：每个平台验证内置资产/许可证/散列和离线 npx；保持退出码、统一入口及旧报告读取；同步中英文示例；未验收语言/宿主仍标 gap。
-- [ ] 14.19 CodeGraph 32 种 grammar 全量接入与 Zig 误报回归。责任：adapters/runtime/CLI/发布。规格：SP01,SP04,SP06,SP11,SP12。依赖：14.1-14.18。验收：逐语言固定可再分发来源、许可证、原始和发行字节、真实 ABI、Rust worker 离线加载、合法/非法版本语料、原生工具对照、原生优先统一命令、任务与对话反馈、资源预算及发行包实装；覆盖 arkts/c/cfml/cfquery/cfscript/cobol/cpp/csharp/dart/erlang/go/java/javascript/kotlin/lua/luau/nix/objc/pascal/php/python/r/ruby/rust/scala/solidity/swift/terraform/tsx/typescript/vbnet/zig。当前七份候选（Java/Objective-C/Python/Solidity/TypeScript/TSX/Zig），已验收发行 0；COBOL 超出 8 MiB 上限，其他 25 种仍无资产清单和执行路由。不得以 `grammar status` 库存、WASM 可加载或未验收候选替代原生 lint 或语言验收。
+- [ ] 14.19 CodeGraph 32 种 grammar 全量接入与 Zig 误报回归。责任：adapters/runtime/CLI/发布。规格：SP01,SP04,SP06,SP11,SP12。依赖：14.1-14.18。验收：逐语言固定可再分发来源、许可证、原始和发行字节、真实 ABI、Rust worker 离线加载、合法/非法版本语料、原生工具对照、原生优先统一命令、任务与对话反馈、资源预算及发行包实装；覆盖 arkts/c/cfml/cfquery/cfscript/cobol/cpp/csharp/dart/erlang/go/java/javascript/kotlin/lua/luau/nix/objc/pascal/php/python/r/ruby/rust/scala/solidity/swift/terraform/tsx/typescript/vbnet/zig。当前十一份候选（C/Go/Java/JavaScript/Objective-C/Python/Rust/Solidity/TypeScript/TSX/Zig），已验收发行 0；COBOL 超出 8 MiB 上限，其他 21 种仍无资产清单和执行路由。C/Go/JavaScript/Rust 的固定来源、许可证、离线加载及基础正反例见[局部验收](../../../tests/acceptance/mainstream-grammar-candidates.md)。不得以 `grammar status` 库存、WASM 可加载或未验收候选替代原生 lint 或语言验收。
diff --git a/tests/acceptance/codegraph-grammar-coverage.md b/tests/acceptance/codegraph-grammar-coverage.md
index 2b530d30..49292f05 100644
--- a/tests/acceptance/codegraph-grammar-coverage.md
+++ b/tests/acceptance/codegraph-grammar-coverage.md
@@ -15,3 +15,5 @@
 2026-09-29 增量：来源库存更新到 CodeGraph `1072f82ce24db3d133258d30165cef6b74d108b2`，当前工作树 30/30 份随仓 WASM 的长度与 SHA-256 与新库存一致。Zig 源 WASM 已变更为修复空容器误报的构建；其原始字节与 Rust 适配后的候选资产、加载测试见 [Zig 局部验收](zig-grammar-candidate.md)。当前候选资产为 5，已验收发行仍为 0。`objc` 与 `solidity` 的精确字节可从 CodeGraph 锁定的 `tree-sitter-wasms@0.1.13` 本机 npm 缓存重现，但本增量尚未把它们写入 CodeGuard 资产清单或验收为可加载能力。历史 2/3/4 候选数仅表示各次验收快照。
 
 2026-09-29 后续增量：Objective-C 与 Solidity 的依赖包原始字节、上游许可证及可复现的 Rust `dylink` 元数据适配现已入[候选清单](../../grammars/manifest.json)；局部加载和隔离 worker 证据见[依赖 grammar 候选验收](dependency-grammar-candidates.md)。当前候选数 7，已验收发行仍为 0。上述 2/3/4/5 候选数是历史快照，旧的 `dependency_bytes_not_pinned` 状态也只适用于当时的库存。
+
+后续增量：C、Go、JavaScript、Rust 的来源与 Rust worker 基础验证见[主流语言候选验收](mainstream-grammar-candidates.md)。当前候选资产 11/32，已验收发行仍为 0；之前 7 份候选仅是历史快照。
diff --git a/tests/acceptance/mainstream-grammar-candidates.md b/tests/acceptance/mainstream-grammar-candidates.md
new file mode 100644
index 00000000..1bab364d
--- /dev/null
+++ b/tests/acceptance/mainstream-grammar-candidates.md
@@ -0,0 +1,9 @@
+# C、Go、JavaScript、Rust grammar：局部候选验收
+
+CodeGraph 固定来源提交 `1072f82ce24db3d133258d30165cef6b74d108b2` 的四份随仓 WASM 已逐字节复制，并与[来源覆盖库存](../../grammars/codegraph-coverage.json)中的长度和 SHA-256 一致。上游标签分别为 tree-sitter-c v0.24.2、tree-sitter-go v0.23.4、tree-sitter-javascript v0.25.0、tree-sitter-rust v0.24.2；[候选清单](../../grammars/manifest.json)固定完整 Git 提交、MIT 许可证原文摘要、资产摘要和实测 ABI（C/JavaScript/Rust 为 15，Go 为 14）。
+
+先将候选数断言从 7 改为 11，清单与状态测试均因实际只有 7 份而失败。接入后，Rust `WasmStore` 离线加载四份资产；每种语言的基础合法样例无恢复错误，未闭合或损坏样例有解析错误。隔离 worker 对四份合法样例均返回 `incomplete`、`grammar_qualified=false`，零恢复节点没有变成通过。清单测试同时核对原始字节、许可证及不允许宣称已发布状态。
+
+当前源码本地验收：`cargo test --locked --workspace --all-features` 退出 0，182 组、1134 通过、0 失败、106 条有条件忽略；`cargo clippy --locked --workspace --all-targets --all-features -- -D warnings` 与 `cargo fmt --all -- --check` 均退出 0；`openspec validate introduce-rust-codeguard-cli --strict` 通过。`codeguard grammar status --format=json` 实际报告 32 种来源、11 份候选、0 项已发行。忽略项不计入通过，也不证明对应原生工具已执行。
+
+此处只验收资产来源和窄范围可加载性。语言版本、方言（包括 JavaScript 嵌入式 JSX）、真实项目合法/非法语料、原生工具对照、误报率、资源预算、公开 `lint` 路由与发行包安装均未完成。原生 lint 的项目义务仍保留，不能用这些候选观察关闭任务或批准交付。