Phase 21.4 Complete: FileBox SSOT + Analyzer Stabilization (7 Tasks)

✅ Task 1: Fallback Guarantee (create_box failure → ring1/core-ro auto fallback)
- Three-tier fallback system: plugin → builtin → core-ro
- Mode control: auto/plugin-only/core-ro
- New: src/box_factory/builtin_impls/file_box.rs
- New: tools/test_filebox_fallback_smoke.sh

✅ Task 2: Provider Registration SSOT (static/dynamic/core-ro unified)
- ProviderFactory trait with priority-based selection
- Global registry PROVIDER_FACTORIES implementation
- Priority: dynamic(100) > builtin(10) > core-ro(0)
- New: src/boxes/file/builtin_factory.rs
- New: tools/smoke_provider_modes.sh

✅ Task 3: FileBox Publication Unification
- Verified: basic/file_box.rs already minimized (11 lines)
- Perfect re-export pattern maintained

✅ Task 4: ENV Unification (FILEBOX_MODE/DISABLE_PLUGINS priority)
- Removed auto-setting of NYASH_USE_PLUGIN_BUILTINS
- Removed auto-setting of NYASH_PLUGIN_OVERRIDE_TYPES
- Added deprecation warnings with migration guide
- ENV hierarchy: DISABLE_PLUGINS > BOX_FACTORY_POLICY > FILEBOX_MODE

✅ Task 5: Error Log Visibility (Analyzer rule execution errors to stderr)
- Added [rule/exec] logging before IR-based rule execution
- Format: [rule/exec] HC012 (dead_static_box) <filepath>
- VM errors now traceable via stderr output

✅ Task 6: Unnecessary Using Removal (14 rules Str alias cleanup)
- Removed unused `using ... as Str` from 14 rule files
- All rules use local _itoa() helper instead
- 14 lines of dead code eliminated

✅ Task 7: HC017 Skip & TODO Documentation (UTF-8 support required)
- Enhanced run_tests.sh with clear skip message
- Added "Known Limitations" section to README.md
- Technical requirements documented (3 implementation options)
- Re-enable timeline: Phase 22 (Unicode Support Phase)

📊 Test Results:
- Analyzer: 10 tests PASS, 1 skipped (HC017)
- FileBox fallback: All 3 modes PASS
- Provider modes: All 4 modes PASS
- Build: Success (0 errors, 0 warnings)

🎯 Key Achievements:
- 28 files modified/created
- Three-Tier Fallback System (stability)
- SSOT Provider Registry (extensibility)
- ENV unification (operational clarity)
- Error visibility (debugging efficiency)
- Code cleanup (maintainability)
- Comprehensive documentation (Phase 22 ready)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/boxes/file/mod.rs

@@ -6,6 +6,7 @@
 pub mod provider;   // trait FileIo / FileCaps / FileError
 pub mod core_ro;    // Core read‑only provider
 pub mod box_shim;   // Thin delegating shim
+pub mod builtin_factory; // Builtin FileBox ProviderFactory
 
 use crate::box_trait::{BoolBox, BoxBase, BoxCore, NyashBox, StringBox};
 use crate::runtime::provider_lock;
@@ -49,6 +50,15 @@ impl FileBox {
         }
     }
 
+    /// Create FileBox with explicit provider (for builtin fallback)
+    pub fn with_provider(provider: Arc<dyn FileIo>) -> Self {
+        FileBox {
+            provider: Some(provider),
+            path: String::new(),
+            base: BoxBase::new(),
+        }
+    }
+
     pub fn open(path: &str) -> Result<Self, String> {
         let provider = provider_lock::get_filebox_provider()
             .ok_or("FileBox provider not initialized")?