patch: sonarqube fixes.

docs/ci-cd-guide.md

@@ -17,6 +17,10 @@ The repository uses GitHub Actions workflows split by branch intent, with one or
 - `master-ci.yml`: single workflow run on merged PRs to `master`; computes semver, invokes Windows reusable build, then tags/publishes release assets.
 - `master-windows.yml`: reusable Windows build/test/package workflow invoked by `master-ci.yml`.
 
+### SonarQube Cloud (coverage quality gate)
+
+Both `feature-ci.yml` and `master-ci.yml` include a Linux job that configures with GCC coverage flags, builds, runs `ctest`, generates `build/sonarqube-coverage.xml` via `gcovr`, and runs the SonarCloud scan. **`sonar.coverage.exclusions`** omit `ui_wx/` and `app/` from the coverage denominator because only `ccm_core` is exercised by automated tests; Sonar still analyzes those directories for bugs, vulnerabilities, and duplications. See [Testing Guide And Test Code Of Conduct](testing-and-test-code-of-conduct.md).
+
 ## Version Flow
 
 Feature branches and `master` use different version modes because they solve different problems: feature builds need traceability to a commit, while `master` builds need stable semantic releases.

docs/testing-and-test-code-of-conduct.md

@@ -30,6 +30,8 @@ Windows and Linux use the same logical flow; only generator and compiler setup d
 
 ## Coverage Surface
 
+**SonarCloud:** The CI Sonar scan reports coverage against `core/` paths that `ccm_core_tests` can execute. `ui_wx/` and the `app/` composition root are excluded from Sonar’s **coverage** calculation (`sonar.coverage.exclusions`) because they are not run under the doctest suite; UI behavior is covered by manual validation below. Other Sonar metrics still include those directories.
+
 Current automated tests cover non-UI behavior, including:
 
 - filesystem naming and parsing behavior