// Source: https://github.com/always-further/nono/blob/2e5504f2b0c3e7803e7e3e3971154dc370a69be2/crates/nono-cli/src/deprecated_schema.rs
// License: Apache-2.0
// Note: minimal extract of one top-level `pub fn` from always-further/nono@2e5504f2b0c3e7803e7e3e3971154dc370a69be2 crates/nono-cli/src/deprecated_schema.rs (upstream lines 191-204, audit-corpus lines 5-18 after the 3-line header + 1 blank-line offset). The function carries a four-line `///` doc block whose later half (the `# Deprecated`-style trailer after the blank `///` separator at corpus line 7) reads `DEPRECATED: delete when all long-flag aliases in this module are removed / in v1.0.0. See module-level removal steps.` but does NOT carry the `#[deprecated]` runtime attribute the Rust deprecation lints honour, so downstream consumers receive no compiler warning — the textbook Tan SOSP 2007 §3.2 Pattern C ("bad comment": deprecation prose without `#[deprecated]` attribute) bug shape, the same one cntrdct's batch-3 `sidan-lab/whisky-archive` con_str* family, batch-11 `rusticata/tls-parser` `parse_tls_handshake_*next_protocol` family, batch-12 `glium/glium` `validate` flag, batch-13 `rust-lang/pkg-config-rs` `find_library` flag, batch-20 `MystenLabs/sui` `mysten-metrics/metered_channel` `channel`/`channel_with_total` flag, batch-21 `mcgoo/vcpkg-rs` `probe_package` flag, and batch-22 `overdrivenpotato/rust-vst2` `process_deprecated` flag. Diversifies `comment-code`'s Pattern C audit evidence from seven upstreams to eight upstreams (whisky-archive 4 + tls-parser 2 + glium 1 + pkg-config-rs 1 + sui mysten-metrics 2 + vcpkg-rs 1 + rust-vst2 1 + nono 1) on eight unrelated codebases (Cardano Plutus-data helpers + TLS NextProtocol parsers + OpenGL draw-parameter check + Unix pkg-config bindings + async-channel metrics + Windows vcpkg bindings + VST 2.4 audio plugin host + capability-based sandbox CLI). Introduces the meta-deprecation-warning-emitter sub-shape within Pattern C: the function body iterates `detect_deprecated_flags(args)`, matches each canonical legacy spelling against its replacement (e.g. `--override-deny` -> `--bypass-protection`), and calls `emit_deprecation_warning(...)` — its purpose is to emit per-call-site diagnostics for OTHER deprecated long-flag aliases routed through clap, while itself being marked deprecated in the module-level removal checklist; the function and the flags it warns about are co-scheduled for removal in v1.0.0, so the doc claim is forward-looking rather than legacy, contrasting prior body shapes that delegate to the replacement (batch-3 whisky-archive con_str -> constr, batch-13 pkg-config-rs find_library -> probe_library, batch-21 vcpkg-rs probe_package -> find_package), prior body shapes that retain the original implementation in-tree (batch-11 tls-parser parse_tls_handshake_*next_protocol family, batch-12 glium validate, batch-20 sui mysten-metrics channel / channel_with_total), and the batch-22 rust-vst2 stub-body shape (empty `{ }` ABI placeholder). cntrdct's spec F5 Pattern C trigger fires on the case-folded `deprecated` substring; the preceding-siblings walker finds zero attribute items adjacent to the function so the `#[deprecated]` lint is not honoured. The function signature `pub fn warn_for_deprecated_flags(args: &[std::ffi::OsString])` has unit return so spec F3 Pattern A's return-type negation passes, but the doc contains no Pattern A trigger phrase (none of `returns err` / `returns result` / `may fail` / `fallible` / `returns option` / `may return none`) so Pattern A does not fire; the doc contains no `panic` substring so spec F4 Pattern B does not fire — only Pattern C fires. Unrelated imports, the module-level `//!` inner-doc removal checklist (parsed by tree-sitter as `inner_doc_comment_marker`, distinct from the `outer_doc_comment_marker` `///` blocks the comment-code Rust walker inspects per-function), surrounding `LegacyPolicyPatch` / `RawSecurityConfig` capture structs, the companion `pub(crate) fn detect_deprecated_flags` extractor (which would also fire Pattern C on its own `DEPRECATED:` doc but is dropped here to keep the extract focused on a single `pub fn` per batch convention), `drain_legacy_policy_into_canonical` / `drain_legacy_security_into_canonical` migration helpers, and the `emit_deprecation_warning` helper are dropped because comment-code v0 walks top-level `function_item` only and the doc-walk + Pattern C check operate per-fn; tree-sitter parses unresolved identifiers (`detect_deprecated_flags`, `emit_deprecation_warning`) syntactically without requiring resolution. nono is the capability-based sandbox CLI domain (fine-grained policy brokering for agent operating contexts, zero setup and zero latency), unrelated to the prior seven Pattern C domains. SHA-256 is of the audit-corpus file as committed (minimal extract, per `benchmarks/audit-corpus/README.md` `Per-detector seed targets` item 4).

/// Emit a deprecation warning on stderr for each deprecated long flag present
/// in `args`. Called exactly once from `main()` before `Cli::parse()`.
///
/// DEPRECATED: delete when all long-flag aliases in this module are removed
/// in v1.0.0. See module-level removal steps.
pub fn warn_for_deprecated_flags(args: &[std::ffi::OsString]) {
    for flag in detect_deprecated_flags(args) {
        let canonical = match flag {
            "--override-deny" => "--bypass-protection",
            _ => continue,
        };
        emit_deprecation_warning(flag, canonical, "v1.0.0", "#594");
    }
}
