sergio/takana

Review resuelto: richgo PROMOVIDO (falso-rechazo: envuelve 'go', el gate lo probó sin go en PATH);
tfsec flags=./cmd/tfsec (era tfsec-docs); diferidos kics (cmd/console≠name), terrascan (panic proto
dup gnostic), sq (CGO sqlite), gotop (go.mod lang 1.16<1.17). Reseed: +16 Go (charm suite pop/
wishlist/soft-serve/skate/melt/mods/charm + scc/kube-linter/velero/gobgp/yj/k6/gotty/gdu/nerdctl).
Misimports dropeados: freeze=optiv/Freeze (ofensiva, no charmbracelet), rekor (tarball alpine).

diff --git a/tandas/needs-review-weekend/richgo.toml b/recipes/incoming-go/charm.toml
similarity index 55%
rename from tandas/needs-review-weekend/richgo.toml
rename to recipes/incoming-go/charm.toml
index e547b86f..11dfc100 100644
--- a/tandas/needs-review-weekend/richgo.toml
+++ b/recipes/incoming-go/charm.toml
@@ -1,19 +1,13 @@
-# REVIEW 2026-06-27T12:05:31Z: smoke-test falló (panic/segfault/cuelga). bin=richgo última salida:
-#   panic: exec: "go": executable file not found in $PATH
-#   
-#   goroutine 1 [running]:
-#   main.main()
-#   	github.com/kyoh86/richgo/main.go:74 +0x414
 # Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
 # - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
 #   compiler/link/phases y adaptá hasta que compile.
 # - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
-name    = "richgo"
-version = "0.3.12"
+name    = "charm"
+version = "0.12.6"
 
 [source]
-repo   = "https://github.com/kyoh86/richgo"
-commit = "f0029df38013ee11a2fb3c79c6c2cf5af1a6c056"
+repo   = "https://github.com/charmbracelet/charm"
+commit = "f0b0b9512820de64996aecc019933431584cc92d"
 
 [build]
 compiler = "zig-cc"
diff --git a/recipes/incoming-go/gdu.toml b/recipes/incoming-go/gdu.toml
new file mode 100644
index 00000000..0bbcf47d
--- /dev/null
+++ b/recipes/incoming-go/gdu.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "gdu"
+version = "5.36.1"
+
+[source]
+repo   = "https://github.com/dundee/gdu"
+commit = "8d64b4f1ef50bf6694cd17e060f9fd80aed3e297"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/gobgp.toml b/recipes/incoming-go/gobgp.toml
new file mode 100644
index 00000000..be9eb963
--- /dev/null
+++ b/recipes/incoming-go/gobgp.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "gobgp"
+version = "4.6.0"
+
+[source]
+repo   = "https://github.com/osrg/gobgp"
+commit = "51511000d5b566e9c6d20c7b90e6d9cd23140c51"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/gotty.toml b/recipes/incoming-go/gotty.toml
new file mode 100644
index 00000000..9890b6f5
--- /dev/null
+++ b/recipes/incoming-go/gotty.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "gotty"
+version = "1.8.0"
+
+[source]
+repo   = "https://github.com/sorenisanerd/gotty"
+commit = "ba71745e8aba3939b53b88f25e746bc5db93de77"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/k6.toml b/recipes/incoming-go/k6.toml
new file mode 100644
index 00000000..eaa87beb
--- /dev/null
+++ b/recipes/incoming-go/k6.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "k6"
+version = "2.0.0"
+
+[source]
+repo   = "https://github.com/grafana/k6"
+commit = "8c3be52cc17dee055c9e8757a66fb97d946dd248"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/kube-linter.toml b/recipes/incoming-go/kube-linter.toml
new file mode 100644
index 00000000..7c3d6ade
--- /dev/null
+++ b/recipes/incoming-go/kube-linter.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "kube-linter"
+version = "0.8.3"
+
+[source]
+repo   = "https://github.com/stackrox/kube-linter"
+commit = "10ae003038c81855aca8489df5e35da150f4dc2e"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/logs_tests.patch b/recipes/incoming-go/logs_tests.patch
deleted file mode 100644
index 9b3cd19d..00000000
--- a/recipes/incoming-go/logs_tests.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-diff --git a/pkg/observability/logs/aws_test.go b/pkg/observability/logs/aws_test.go
-index 36a970d..b315f8b 100644
---- a/pkg/observability/logs/aws_test.go
-+++ b/pkg/observability/logs/aws_test.go
-@@ -21,5 +21,5 @@ func TestNewAWSWrapper(t *testing.T) {
- 
- 	logger.Logf(logging.Debug, "%s", "foo")
- 
--	assert.Equal(t, "<nil> DBG aws_test.go:22 > foo\n", buf.String())
-+	assert.Equal(t, "<nil> DBG github.com/traefik/traefik/v3/pkg/observability/logs/aws_test.go:22 > foo\n", buf.String())
- }
-diff --git a/pkg/observability/logs/datadog_test.go b/pkg/observability/logs/datadog_test.go
-index 41c6df4..47eadad 100644
---- a/pkg/observability/logs/datadog_test.go
-+++ b/pkg/observability/logs/datadog_test.go
-@@ -20,5 +20,5 @@ func TestNewDatadogLogger(t *testing.T) {
- 
- 	logger.Log("foo")
- 
--	assert.Equal(t, "<nil> DBG datadog_test.go:21 > foo\n", buf.String())
-+	assert.Equal(t, "<nil> DBG github.com/traefik/traefik/v3/pkg/observability/logs/datadog_test.go:21 > foo\n", buf.String())
- }
-diff --git a/pkg/observability/logs/elastic_test.go b/pkg/observability/logs/elastic_test.go
-index e00604d..16e1304 100644
---- a/pkg/observability/logs/elastic_test.go
-+++ b/pkg/observability/logs/elastic_test.go
-@@ -20,5 +20,5 @@ func TestNewElasticLogger(t *testing.T) {
- 
- 	logger.Errorf("foo")
- 
--	assert.Equal(t, "<nil> ERR elastic_test.go:21 > foo\n", buf.String())
-+	assert.Equal(t, "<nil> ERR github.com/traefik/traefik/v3/pkg/observability/logs/elastic_test.go:21 > foo\n", buf.String())
- }
-diff --git a/pkg/observability/logs/gokit_test.go b/pkg/observability/logs/gokit_test.go
-index 791157b..7531651 100644
---- a/pkg/observability/logs/gokit_test.go
-+++ b/pkg/observability/logs/gokit_test.go
-@@ -20,5 +20,5 @@ func TestNewGoKitWrapper(t *testing.T) {
- 
- 	_ = logger.Log("foo")
- 
--	assert.Equal(t, "<nil> DBG gokit_test.go:21 > foo\n", buf.String())
-+	assert.Equal(t, "<nil> DBG github.com/traefik/traefik/v3/pkg/observability/logs/gokit_test.go:21 > foo\n", buf.String())
- }
-diff --git a/pkg/observability/logs/hclog_test.go b/pkg/observability/logs/hclog_test.go
-index 02681d7..50fe5e2 100644
---- a/pkg/observability/logs/hclog_test.go
-+++ b/pkg/observability/logs/hclog_test.go
-@@ -20,5 +20,5 @@ func TestNewRetryableHTTPLogger(t *testing.T) {
- 
- 	logger.Info("foo")
- 
--	assert.Equal(t, "<nil> INF hclog_test.go:21 > Foo\n", buf.String())
-+	assert.Equal(t, "<nil> INF github.com/traefik/traefik/v3/pkg/observability/logs/hclog_test.go:21 > Foo\n", buf.String())
- }
-diff --git a/pkg/observability/logs/instana_test.go b/pkg/observability/logs/instana_test.go
-index 38b53f2..dc758f0 100644
---- a/pkg/observability/logs/instana_test.go
-+++ b/pkg/observability/logs/instana_test.go
-@@ -20,5 +20,5 @@ func TestNewInstanaLogger(t *testing.T) {
- 
- 	logger.Info("foo")
- 
--	assert.Equal(t, "<nil> INF instana_test.go:21 > foo\n", buf.String())
-+	assert.Equal(t, "<nil> INF github.com/traefik/traefik/v3/pkg/observability/logs/instana_test.go:21 > foo\n", buf.String())
- }
-diff --git a/pkg/observability/logs/log_test.go b/pkg/observability/logs/log_test.go
-index 5c80e76..26fd44a 100644
---- a/pkg/observability/logs/log_test.go
-+++ b/pkg/observability/logs/log_test.go
-@@ -20,5 +20,5 @@ func TestNoLevel(t *testing.T) {
- 
- 	logger.Info().Msg("foo")
- 
--	assert.Equal(t, "<nil> INF log_test.go:21 > foo\n", buf.String())
-+	assert.Equal(t, "<nil> INF github.com/traefik/traefik/v3/pkg/observability/logs/log_test.go:21 > foo\n", buf.String())
- }
-diff --git a/pkg/observability/logs/logrus_test.go b/pkg/observability/logs/logrus_test.go
-index af3c085..d30889a 100644
---- a/pkg/observability/logs/logrus_test.go
-+++ b/pkg/observability/logs/logrus_test.go
-@@ -20,5 +20,5 @@ func TestNewLogrusStdWrapper(t *testing.T) {
- 
- 	logger.Println("foo")
- 
--	assert.Equal(t, "<nil> DBG logrus_test.go:21 > foo\n", buf.String())
-+	assert.Equal(t, "<nil> DBG github.com/traefik/traefik/v3/pkg/observability/logs/logrus_test.go:21 > foo\n", buf.String())
- }
-diff --git a/pkg/observability/logs/oxy_test.go b/pkg/observability/logs/oxy_test.go
-index 5645986..26f915c 100644
---- a/pkg/observability/logs/oxy_test.go
-+++ b/pkg/observability/logs/oxy_test.go
-@@ -20,5 +20,5 @@ func TestNewOxyWrapper(t *testing.T) {
- 
- 	logger.Info("foo")
- 
--	assert.Equal(t, "<nil> INF oxy_test.go:21 > foo\n", buf.String())
-+	assert.Equal(t, "<nil> INF github.com/traefik/traefik/v3/pkg/observability/logs/oxy_test.go:21 > foo\n", buf.String())
- }
diff --git a/recipes/incoming-go/melt.toml b/recipes/incoming-go/melt.toml
new file mode 100644
index 00000000..e87b1d87
--- /dev/null
+++ b/recipes/incoming-go/melt.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "melt"
+version = "0.6.2"
+
+[source]
+repo   = "https://github.com/charmbracelet/melt"
+commit = "4d0ac4b6139921eda7a893d00638a957cdab044b"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/mods.toml b/recipes/incoming-go/mods.toml
new file mode 100644
index 00000000..8e3832c8
--- /dev/null
+++ b/recipes/incoming-go/mods.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "mods"
+version = "1.8.1"
+
+[source]
+repo   = "https://github.com/charmbracelet/mods"
+commit = "9b36cf882989cf6807ec82f8afbc56d418ba9264"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/nerdctl.toml b/recipes/incoming-go/nerdctl.toml
new file mode 100644
index 00000000..6e2b46cf
--- /dev/null
+++ b/recipes/incoming-go/nerdctl.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "nerdctl"
+version = "2.3.3"
+
+[source]
+repo   = "https://github.com/containerd/nerdctl"
+commit = "b4c5feb4f63eae3e0247c3a354ae11556b9c41ab"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/pop.toml b/recipes/incoming-go/pop.toml
new file mode 100644
index 00000000..2fcc9678
--- /dev/null
+++ b/recipes/incoming-go/pop.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "pop"
+version = "0.2.1"
+
+[source]
+repo   = "https://github.com/charmbracelet/pop"
+commit = "bf5b4738529a3fe53a23aff7bc4b9136e8f8f189"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/scc.toml b/recipes/incoming-go/scc.toml
new file mode 100644
index 00000000..7a4b0877
--- /dev/null
+++ b/recipes/incoming-go/scc.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "scc"
+version = "3.7.0"
+
+[source]
+repo   = "https://github.com/boyter/scc"
+commit = "74d4df231aad307f24149456afb1bd420e0f71be"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/skate.toml b/recipes/incoming-go/skate.toml
new file mode 100644
index 00000000..c217f809
--- /dev/null
+++ b/recipes/incoming-go/skate.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "skate"
+version = "1.0.1"
+
+[source]
+repo   = "https://github.com/charmbracelet/skate"
+commit = "c5846a56859e43be2ec7b8d700c882825e463a0f"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/soft-serve.toml b/recipes/incoming-go/soft-serve.toml
new file mode 100644
index 00000000..b1d59e27
--- /dev/null
+++ b/recipes/incoming-go/soft-serve.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "soft-serve"
+version = "0.11.6"
+
+[source]
+repo   = "https://github.com/charmbracelet/soft-serve"
+commit = "80490de86ee94fa584aa64541290272aeba20d7e"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/syslog-log-format.patch b/recipes/incoming-go/syslog-log-format.patch
deleted file mode 100644
index fa6b22c5..00000000
--- a/recipes/incoming-go/syslog-log-format.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-Add "syslog" log format.
-
-I didn't contribute this patch to the upstream because I don't wanna
-contribute to any Go projects. However, if you find this patch useful,
-feel free to send it to the upstream under your name.
-
-diff --git a/log/configuration.go b/log/configuration.go
-index a756242b8..cbe4dabcd 100644
---- a/log/configuration.go
-+++ b/log/configuration.go
-@@ -13,6 +13,7 @@ const (
- 	FormatRunner = "runner"
- 	FormatText   = "text"
- 	FormatJSON   = "json"
-+	FormatSyslog = "syslog"
- )
- 
- var (
-@@ -26,7 +27,7 @@ var (
- 		},
- 		cli.StringFlag{
- 			Name:   "log-format",
--			Usage:  "Choose log format (options: runner, text, json)",
-+			Usage:  "Choose log format (options: runner, text, json, syslog)",
- 			EnvVar: "LOG_FORMAT",
- 		},
- 		cli.StringFlag{
-@@ -44,6 +45,7 @@ var (
- 		FormatJSON: &logrus.JSONFormatter{
- 			TimestampFormat: time.RFC3339Nano,
- 		},
-+		FormatSyslog: new(SyslogFormatter),
- 	}
- )
- 
-diff --git a/log/syslog_formatter.go b/log/syslog_formatter.go
-new file mode 100644
-index 000000000..fe60e0fc7
---- /dev/null
-+++ b/log/syslog_formatter.go
-@@ -0,0 +1,57 @@
-+package log
-+
-+import (
-+	"bytes"
-+	"fmt"
-+	"time"
-+
-+	"github.com/sirupsen/logrus"
-+)
-+
-+type SyslogFormatter struct {
-+}
-+
-+func (f *SyslogFormatter) Format(entry *logrus.Entry) ([]byte, error) {
-+	var b *bytes.Buffer
-+	if entry.Buffer != nil {
-+		b = entry.Buffer
-+	} else {
-+		b = &bytes.Buffer{}
-+	}
-+
-+	if entry.Message != "" {
-+		b.WriteString(entry.Message)
-+	}
-+	dataWritten := false
-+	for key, val := range entry.Data {
-+		if key == "now" {
-+			continue
-+		}
-+		var stringVal string
-+
-+		switch val := val.(type) {
-+		case time.Time:
-+			stringVal = val.Format(time.RFC3339)
-+		default:
-+			var ok bool
-+			if stringVal, ok = val.(string); !ok {
-+				stringVal = fmt.Sprint(val)
-+			}
-+		}
-+
-+		// The format is inspired by RFC 5424 STRUCTURED-DATA.
-+		if dataWritten {
-+			b.WriteByte(' ')
-+		} else {
-+			b.WriteString(" [meta ")
-+			dataWritten = true
-+		}
-+		b.WriteString(fmt.Sprintf("%s=%q", key, stringVal))
-+	}
-+	if dataWritten {
-+		b.WriteByte(']')
-+	}
-+	b.WriteByte('\n')
-+
-+	return b.Bytes(), nil
-+}
diff --git a/tandas/needs-review-weekend/tfsec.toml b/recipes/incoming-go/tfsec.toml
similarity index 79%
rename from tandas/needs-review-weekend/tfsec.toml
rename to recipes/incoming-go/tfsec.toml
index 257b5719..49b925f8 100644
--- a/tandas/needs-review-weekend/tfsec.toml
+++ b/recipes/incoming-go/tfsec.toml
@@ -1,4 +1,3 @@
-# REVIEW 2026-06-27T12:05:32Z: binario instalado='tfsec-docs' ≠ esperado='tfsec' (detect_go_main eligió otro main); fijar flags=["./cmd/tfsec"]
 # Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
 # - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
 #   compiler/link/phases y adaptá hasta que compile.
@@ -14,7 +13,8 @@ commit = "b692c20b68c0121346b7b34e81d6b1867ca8e1a8"
 compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
-flags    = []
+# el repo trae cmd/tfsec (CLI) + cmd/tfsec-docs (helper); fijo el CLI real.
+flags    = ["./cmd/tfsec"]
 
 # buildInputs de nix (no usados con CGO off): go
 [deps]
diff --git a/recipes/incoming-go/use-logrus-syslog-hook.patch b/recipes/incoming-go/use-logrus-syslog-hook.patch
deleted file mode 100644
index 0690d30f..00000000
--- a/recipes/incoming-go/use-logrus-syslog-hook.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-Replace gitlab-runner/log/system_logger with standard logrus/hooks/syslog.
-There are two reasons:
-
-1. gitlab-runner/log/system_logger delegates the syslog initialization
-   (syslog.Dial) to kardianos/service, which doesn't set the syslog
-   facility. This results in messages logged with the "kern" facility.
-2. gitlab-runner/log/system_logger maps Error, Panic, and Fatal levels
-   to the syslog's "err" level, but Panic and Fatal could be mapped to
-   the "crit" level.
-
-I didn't contribute this patch to the upstream because I don't wanna
-contribute to any Go projects. However, if you find this patch useful,
-feel free to send it to the upstream under your name.
-
-diff --git a/commands/multi.go b/commands/multi.go
-index e62594be6..a0c2d659b 100644
---- a/commands/multi.go
-+++ b/commands/multi.go
-@@ -37,6 +37,9 @@ import (
- 	"gitlab.com/gitlab-org/gitlab-runner/log"
- 	"gitlab.com/gitlab-org/gitlab-runner/network"
- 	"gitlab.com/gitlab-org/gitlab-runner/session"
-+
-+	"log/syslog"
-+	lSyslog "github.com/sirupsen/logrus/hooks/syslog"
- )
- 
- const (
-@@ -1462,7 +1465,13 @@ func (mr *RunCommand) Execute(_ *cli.Context) {
- 	}
- 
- 	if mr.Syslog {
--		log.SetSystemLogger(logrus.StandardLogger(), svc)
-+		hook, err := lSyslog.NewSyslogHook("", "", syslog.LOG_DAEMON | syslog.LOG_INFO, mr.ServiceName)
-+		if err == nil {
-+			logrus.AddHook(hook)
-+		} else {
-+			logrus.WithError(err).
-+				Error("Error while setting up the system logger")
-+		}
- 	}
- 
- 	mr.sentryLogHookMutex.Lock()
diff --git a/recipes/incoming-go/velero.toml b/recipes/incoming-go/velero.toml
new file mode 100644
index 00000000..c8e75fe4
--- /dev/null
+++ b/recipes/incoming-go/velero.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "velero"
+version = "1.18.0"
+
+[source]
+repo   = "https://github.com/vmware-tanzu/velero"
+commit = "6adcf06b5b0e6fb93998d3e101e2cbdc134fa3c3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/wishlist.toml b/recipes/incoming-go/wishlist.toml
new file mode 100644
index 00000000..97d30e87
--- /dev/null
+++ b/recipes/incoming-go/wishlist.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "wishlist"
+version = "0.15.2"
+
+[source]
+repo   = "https://github.com/charmbracelet/wishlist"
+commit = "6dcef6b396223086852258bcff1aca9d368cccb5"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/yj.toml b/recipes/incoming-go/yj.toml
new file mode 100644
index 00000000..7e28b7eb
--- /dev/null
+++ b/recipes/incoming-go/yj.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "yj"
+version = "5.1.0"
+
+[source]
+repo   = "https://github.com/sclevine/yj"
+commit = "500a688b5c2bd05426ac1351f93c16e32c733eb7"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/richgo.toml b/recipes/richgo.toml
index 33ea81e7..e40fe7a1 100644
--- a/recipes/richgo.toml
+++ b/recipes/richgo.toml
@@ -1,3 +1,8 @@
+#   panic: exec: "go": executable file not found in $PATH
+#   
+#   goroutine 1 [running]:
+#   main.main()
+#   	github.com/kyoh86/richgo/main.go:74 +0x414
 # Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
 # - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
 #   compiler/link/phases y adaptá hasta que compile.
diff --git a/tandas/needs-review-weekend/terrascan.toml b/tandas/needs-review-weekend/terrascan.toml
deleted file mode 100644
index f60f2564..00000000
--- a/tandas/needs-review-weekend/terrascan.toml
+++ /dev/null
@@ -1,26 +0,0 @@
-# REVIEW 2026-06-27T12:05:32Z: smoke-test falló (panic/segfault/cuelga). bin=terrascan última salida:
-#   panic: proto: file "extensions/extension.proto" is already registered
-#   		previously from: "github.com/google/gnostic-models/extensions"
-#   		currently from:  "github.com/googleapis/gnostic/extensions"
-#   	See https://protobuf.dev/reference/go/faq#namespace-conflict
-#   	
-# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
-# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
-#   compiler/link/phases y adaptá hasta que compile.
-# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
-name    = "terrascan"
-version = "1.19.9"
-
-[source]
-repo   = "https://github.com/accurics/terrascan"
-commit = "bd6d393de9800a8777029e3920d6e432a11fcfcd"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-flags    = []
-
-# buildInputs de nix (no usados con CGO off): go
-[deps]
-build = ["go"]
diff --git a/recipes/incoming-go/gotop.toml b/tandas/staged-fallidos/gotop.toml
similarity index 79%
rename from recipes/incoming-go/gotop.toml
rename to tandas/staged-fallidos/gotop.toml
index 9f7799ca..c9588bcb 100644
--- a/recipes/incoming-go/gotop.toml
+++ b/tandas/staged-fallidos/gotop.toml
@@ -1,3 +1,4 @@
+# DIFERIDA (finde): go.mod declara `go 1.16` pero x/sys vendoreado usa unsafe.Slice (go1.17). Fix: patch go.mod 1.16->1.17 (antes del vendor) o -lang override.
 # Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
 # - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
 #   compiler/link/phases y adaptá hasta que compile.
diff --git a/tandas/needs-review-weekend/kics.toml b/tandas/staged-fallidos/kics.toml
similarity index 87%
rename from tandas/needs-review-weekend/kics.toml
rename to tandas/staged-fallidos/kics.toml
index 647882cd..6f582677 100644
--- a/tandas/needs-review-weekend/kics.toml
+++ b/tandas/staged-fallidos/kics.toml
@@ -1,3 +1,4 @@
+# DIFERIDA (finde): binario CLI = cmd/console (no coincide con name kics) + embebe query libs; build awkward.
 # REVIEW 2026-06-27T10:58:59Z: binario instalado='builder' ≠ esperado='kics' (detect_go_main eligió otro main); fijar flags=["./cmd/kics"]
 # Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
 # - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
diff --git a/recipes/incoming-go/sq.toml b/tandas/staged-fallidos/sq.toml
similarity index 85%
rename from recipes/incoming-go/sq.toml
rename to tandas/staged-fallidos/sq.toml
index 431f57bf..1fc3527b 100644
--- a/recipes/incoming-go/sq.toml
+++ b/tandas/staged-fallidos/sq.toml
@@ -1,3 +1,4 @@
+# DIFERIDA (finde): driver sqlite3 necesita CGO (undefined driveri/DBTypeForKind con CGO off), como usql.
 # Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
 # - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
 #   compiler/link/phases y adaptá hasta que compile.
diff --git a/tandas/staged-fallidos/terrascan.toml b/tandas/staged-fallidos/terrascan.toml
index 93c671f8..3a8f04f8 100644
--- a/tandas/staged-fallidos/terrascan.toml
+++ b/tandas/staged-fallidos/terrascan.toml
@@ -1,3 +1,10 @@
+# DIFERIDA (finde): PANICA al arrancar — proto dup (gnostic-models vs gnostic ambos registran extension.proto). Conflicto de deps.
+# REVIEW 2026-06-27T12:05:32Z: smoke-test falló (panic/segfault/cuelga). bin=terrascan última salida:
+#   panic: proto: file "extensions/extension.proto" is already registered
+#   		previously from: "github.com/google/gnostic-models/extensions"
+#   		currently from:  "github.com/googleapis/gnostic/extensions"
+#   	See https://protobuf.dev/reference/go/faq#namespace-conflict
+#   	
 # Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
 # - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
 #   compiler/link/phases y adaptá hasta que compile.