diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f9c1f50..2c11fe9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,11 +16,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '21'
           cache: maven
 
       - name: Set up Node.js (JS/TS analyzer tests need a Node runtime)
diff --git a/.github/workflows/parity.yml b/.github/workflows/parity.yml
index 94ce447..cc73b57 100644
--- a/.github/workflows/parity.yml
+++ b/.github/workflows/parity.yml
@@ -49,11 +49,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '21'
 
       - name: Set up Node.js 20
         uses: actions/setup-node@v4
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bf15ccc..2f2adbd 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -50,11 +50,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 17 + GPG
+      - name: Set up JDK 21 + GPG
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '21'
           server-id: central
           server-username: OSS_NEXUS_USER
           server-password: OSS_NEXUS_PASS
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index 06e092a..e521b74 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -39,12 +39,13 @@ jobs:
         with:
           fetch-depth: 0
 
-      # JDK 17 is the project's build/runtime target. Temurin is the safe default.
-      - name: Set up JDK 17
+      # JDK 21 is the project's build/runtime target (required by
+      # sonarlint-analysis-engine 11.x / LTA 2026.1). Temurin is the safe default.
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '21'
 
       # The JS/TS analyzer plugin spawns Node at runtime to lint JS/TS sources,
       # so Node must be on PATH when the scan runs (not just at build time).
diff --git a/README.md b/README.md
index d2093c6..0ee2f35 100644
--- a/README.md
+++ b/README.md
@@ -98,7 +98,7 @@ The JSON output carries both fields on every issue.
 
 | Requirement | For |
 |---|---|
-| **Java 17+** (JDK or JRE) | running the CLI and daemon — auto-discovered (`JAVA_HOME` → `PATH` → common install locations) |
+| **Java 21+** (JDK or JRE) | running the CLI and daemon — auto-discovered (`JAVA_HOME` → `PATH` → common install locations) |
 | **Linux or macOS** | the daemon uses Unix domain sockets (Windows support is on the roadmap) |
 | **`git`** | the `check --diff` workflow |
 | **Node.js 18.17+** | JavaScript / TypeScript analysis |
diff --git a/pom.xml b/pom.xml
index 02d7bcc..135a623 100644
--- a/pom.xml
+++ b/pom.xml
@@ -54,32 +54,51 @@
     </issueManagement>
 
     <properties>
-        <maven.compiler.release>17</maven.compiler.release>
-        <maven.compiler.source>17</maven.compiler.source>
-        <maven.compiler.target>17</maven.compiler.target>
+        <!--
+          Java 21 minimum: sonarlint-analysis-engine 11.3.0.85510 (LTA 2026.1)
+          ships class files at major version 65 (Java 21). Compiling against
+          it requires a JDK 21+ toolchain. CI's setup-java step is pinned to
+          21 in .github/workflows/*.yml to match.
+        -->
+        <maven.compiler.release>21</maven.compiler.release>
+        <maven.compiler.source>21</maven.compiler.source>
+        <maven.compiler.target>21</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
         <jackson.version>2.17.2</jackson.version>
         <junit.version>5.10.2</junit.version>
-        <sonarlint.engine.version>10.24.0.81415</sonarlint.engine.version>
+        <!--
+          These versions track SonarQube Server 2026.1 LTA (released 2025-12-11).
+
+          To upgrade to a future LTA:
+            1. Look up the new LTA's bundled analyzer versions in the release
+               notes at https://docs.sonarsource.com/sonarqube-server/&lt;v&gt;/setup-and-upgrade/release-upgrade-notes/
+            2. Bump all 11 version properties below.
+            3. Run `mvn clean test` — the daemon test suite is the canary.
+            4. If a NEW required host bean appears (NoSuchBeanDefinitionException
+               on a type other than AnalysisWarnings), add an @SonarLintSide no-op
+               class in src/main/java/.../hostplugin/ and one context.addExtension(...)
+               line in SonarPredictHostPlugin.define(). See spec §7.2 for details.
+        -->
+        <sonarlint.engine.version>11.3.0.85510</sonarlint.engine.version>
         <picocli.version>4.7.7</picocli.version>
 
         <!--
           The 10 SonarSource analyzer plugins — the runtime assets the daemon
           loads. Single source of truth for the maven-dependency-plugin copy
           executions below, which fetch them through Maven (so settings.xml
-          mirrors / Nexus / proxy apply). Versions match engine 10.24.0.81415.
+          mirrors / Nexus / proxy apply). Versions match engine 11.3.0.85510 (LTA 2026.1).
         -->
-        <sonar.plugin.java.version>8.15.0.39343</sonar.plugin.java.version>
-        <sonar.plugin.python.version>5.5.0.23291</sonar.plugin.python.version>
-        <sonar.plugin.javascript.version>10.24.0.33043</sonar.plugin.javascript.version>
-        <sonar.plugin.php.version>3.46.0.13151</sonar.plugin.php.version>
-        <sonar.plugin.kotlin.version>3.2.0.7239</sonar.plugin.kotlin.version>
+        <sonar.plugin.java.version>8.29.0.43460</sonar.plugin.java.version>
+        <sonar.plugin.python.version>5.22.0.33216</sonar.plugin.python.version>
+        <sonar.plugin.javascript.version>12.5.0.41048</sonar.plugin.javascript.version>
+        <sonar.plugin.php.version>3.57.0.15976</sonar.plugin.php.version>
+        <sonar.plugin.kotlin.version>3.6.0.9326</sonar.plugin.kotlin.version>
         <sonar.plugin.go.version>1.18.1.827</sonar.plugin.go.version>
-        <sonar.plugin.ruby.version>1.19.0.471</sonar.plugin.ruby.version>
-        <sonar.plugin.scala.version>1.19.0.484</sonar.plugin.scala.version>
-        <sonar.plugin.html.version>3.19.0.5695</sonar.plugin.html.version>
-        <sonar.plugin.xml.version>2.13.0.5938</sonar.plugin.xml.version>
+        <sonar.plugin.ruby.version>1.22.0.1992</sonar.plugin.ruby.version>
+        <sonar.plugin.scala.version>1.23.0.2394</sonar.plugin.scala.version>
+        <sonar.plugin.html.version>3.27.0.7699</sonar.plugin.html.version>
+        <sonar.plugin.xml.version>2.17.0.7895</sonar.plugin.xml.version>
     </properties>
 
     <dependencyManagement>
@@ -129,6 +148,18 @@
             <artifactId>junit-jupiter</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.assertj</groupId>
+            <artifactId>assertj-core</artifactId>
+            <version>3.27.7</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-core</artifactId>
+            <version>5.15.2</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
@@ -178,6 +209,27 @@
                         <phase>process-classes</phase>
                         <goals><goal>jar</goal></goals>
                     </execution>
+                    <execution>
+                        <id>host-plugin-jar</id>
+                        <phase>process-test-classes</phase>
+                        <goals><goal>jar</goal></goals>
+                        <configuration>
+                            <classifier>host</classifier>
+                            <includes>
+                                <include>io/github/randomcodespace/sonarpredict/hostplugin/**</include>
+                            </includes>
+                            <archive>
+                                <manifestEntries>
+                                    <Plugin-Class>io.github.randomcodespace.sonarpredict.hostplugin.SonarPredictHostPlugin</Plugin-Class>
+                                    <Plugin-Key>sonarpredict-host</Plugin-Key>
+                                    <Plugin-Name>Sonar Predictor Host</Plugin-Name>
+                                    <Plugin-Version>${project.version}</Plugin-Version>
+                                    <Sonar-Version>9.9</Sonar-Version>
+                                    <SonarLint-Supported>true</SonarLint-Supported>
+                                </manifestEntries>
+                            </archive>
+                        </configuration>
+                    </execution>
                 </executions>
             </plugin>
 
@@ -348,6 +400,42 @@
                 </executions>
             </plugin>
 
+            <!--
+              Copy the host plugin jar into the dev plugins/ directory so
+              that AnalysisService (no-arg constructor → plugins/) and
+              PluginRuntime.loadAll pick it up during mvn test.
+
+              The host-plugin-jar jar-plugin execution (process-test-classes)
+              produces target/sonar-predictor-${project.version}-host.jar.
+              This antrun execution binds to the SAME phase so it runs
+              immediately after the jar is written.
+
+              The file is gitignored (plugins/*.jar). In production the host
+              jar ships inside the dist zip's plugins/ directory via the
+              assembly descriptor, so no separate production step is needed.
+            -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <version>3.1.0</version>
+                <executions>
+                    <execution>
+                        <id>copy-host-plugin-for-tests</id>
+                        <phase>process-test-classes</phase>
+                        <goals><goal>run</goal></goals>
+                        <configuration>
+                            <target>
+                                <copy todir="${project.basedir}/plugins" overwrite="true">
+                                    <fileset dir="${project.build.directory}">
+                                        <include name="${project.artifactId}-${project.version}-host.jar"/>
+                                    </fileset>
+                                </copy>
+                            </target>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
             <!-- Assemble the dist bundle: bin/ launchers + lib/ fat jars +
                  plugins/ analyzer jars, zipped. Output:
                  target/sonar-predictor-dist-${project.version}.zip. -->
diff --git a/src/main/assembly/dist.xml b/src/main/assembly/dist.xml
index b156c27..9b1960f 100644
--- a/src/main/assembly/dist.xml
+++ b/src/main/assembly/dist.xml
@@ -50,6 +50,17 @@
             </includes>
         </fileSet>
 
+        <!-- The host plugin JAR produced by the host-plugin-jar maven-jar-plugin
+             execution. Ships alongside the 10 analyzer JARs in plugins/ so the
+             daemon's PluginRuntime.loadAll picks it up via the *.jar glob. -->
+        <fileSet>
+            <directory>${project.build.directory}</directory>
+            <outputDirectory>plugins</outputDirectory>
+            <includes>
+                <include>sonar-predictor-*-host.jar</include>
+            </includes>
+        </fileSet>
+
         <!-- The two shaded fat jars produced by maven-shade-plugin's
              shade-cli + shade-daemon executions. Their on-disk names are
              sonar-predictor-{cli,daemon}-<version>.jar; the launcher
diff --git a/src/main/java/io/github/randomcodespace/sonarpredict/daemon/AnalysisService.java b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/AnalysisService.java
index b196227..9717370 100644
--- a/src/main/java/io/github/randomcodespace/sonarpredict/daemon/AnalysisService.java
+++ b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/AnalysisService.java
@@ -20,7 +20,7 @@
 import java.util.stream.Stream;
 
 import org.sonarsource.sonarlint.core.analysis.AnalysisScheduler;
-import org.sonarsource.sonarlint.core.analysis.api.ActiveRule;
+import org.sonar.api.batch.rule.ActiveRule;
 import org.sonarsource.sonarlint.core.analysis.api.AnalysisConfiguration;
 import org.sonarsource.sonarlint.core.analysis.api.AnalysisResults;
 import org.sonarsource.sonarlint.core.analysis.api.AnalysisSchedulerConfiguration;
@@ -510,12 +510,8 @@ static List<ActiveRule> resolveActiveRules(
             }
             String languageKey = language.getSonarLanguageKey();
             for (String ruleKey : ruleKeys) {
-                ActiveRule activeRule = new ActiveRule(ruleKey, languageKey);
                 Map<String, String> params = paramDefaults.paramsFor(ruleKey);
-                if (!params.isEmpty()) {
-                    activeRule.setParams(params);
-                }
-                rules.add(activeRule);
+                rules.add(SimpleActiveRule.of(ruleKey, languageKey, params));
             }
         }
         return rules;
@@ -622,14 +618,10 @@ private List<ActiveRule> profileRulesFrom(String profileRef) {
             }
             // The analyzer-registered parameter defaults are the baseline; the
             // profile's own <parameters> override them where it sets a value.
-            ActiveRule active = new ActiveRule(rule.ruleKey(), languageKey);
             Map<String, String> params =
                     new java.util.HashMap<>(ruleParameterDefaults.paramsFor(rule.ruleKey()));
             params.putAll(rule.parameters());
-            if (!params.isEmpty()) {
-                active.setParams(Map.copyOf(params));
-            }
-            rules.add(active);
+            rules.add(SimpleActiveRule.of(rule.ruleKey(), languageKey, params));
         }
         return rules;
     }
diff --git a/src/main/java/io/github/randomcodespace/sonarpredict/daemon/EngineLog.java b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/EngineLog.java
index 32cb249..ae154eb 100644
--- a/src/main/java/io/github/randomcodespace/sonarpredict/daemon/EngineLog.java
+++ b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/EngineLog.java
@@ -2,6 +2,7 @@
 
 import java.util.List;
 import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.atomic.AtomicReference;
 
 import org.sonarsource.sonarlint.core.commons.log.LogOutput;
 import org.sonarsource.sonarlint.core.commons.log.SonarLintLogger;
@@ -21,6 +22,8 @@
  */
 public final class EngineLog implements LogOutput {
 
+    private static final AtomicReference<EngineLog> CURRENT = new AtomicReference<>();
+
     private final List<String> messages = new CopyOnWriteArrayList<>();
 
     /**
@@ -47,9 +50,21 @@ public static void install() {
     public static EngineLog installAndCapture() {
         EngineLog target = new EngineLog();
         SonarLintLogger.get().setTarget(target);
+        CURRENT.set(target);
         return target;
     }
 
+    /**
+     * Returns the most recently {@link #install installed} {@code EngineLog},
+     * or {@code null} if none has been installed yet. Tests use this to assert
+     * on engine messages emitted by code paths (such as
+     * {@code PluginRuntime.loadAll}) that install their own {@code EngineLog}
+     * internally without exposing the reference.
+     */
+    public static EngineLog current() {
+        return CURRENT.get();
+    }
+
     @Override
     public void log(String formattedMessage, Level level) {
         if (formattedMessage != null) {
diff --git a/src/main/java/io/github/randomcodespace/sonarpredict/daemon/IssueMapper.java b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/IssueMapper.java
index 53bd4c5..5ca3042 100644
--- a/src/main/java/io/github/randomcodespace/sonarpredict/daemon/IssueMapper.java
+++ b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/IssueMapper.java
@@ -41,7 +41,7 @@ private IssueMapper() {
     public static io.github.randomcodespace.sonarpredict.protocol.dto.Issue toDto(
             Issue engineIssue, Path baseDir, RuleCatalog catalog) {
         return map(
-                engineIssue.getRuleKey(),
+                engineIssue.getRuleKey().toString(),
                 resolveFilePath(engineIssue.getInputFile(), baseDir),
                 engineIssue.getTextRange(),
                 engineIssue.getMessage(),
diff --git a/src/main/java/io/github/randomcodespace/sonarpredict/daemon/PluginRuntime.java b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/PluginRuntime.java
index cc0885f..c3ba972 100644
--- a/src/main/java/io/github/randomcodespace/sonarpredict/daemon/PluginRuntime.java
+++ b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/PluginRuntime.java
@@ -105,6 +105,12 @@ public static LoadedPlugins loadFrom(Set<Path> jars) {
                 V1_LANGUAGES,
                 false,
                 detectNodeVersion());
+        // Second argument is disabledPluginsForAnalysis — keys in this set are excluded
+        // from getAnalysisPluginInstancesByKeys() and therefore never installed into any
+        // Spring analysis container. Pass an empty set so the host plugin's extensions
+        // (NoOpAnalysisWarnings) are visible to sensors such as HtmlSensor that autowire
+        // AnalysisWarnings. The engine's own "additionalAllowedPlugins" list (textdeveloper,
+        // textenterprise, etc.) is built internally by PluginsLoader and is separate.
         PluginsLoadResult result = new PluginsLoader().load(config, Set.of());
         return result.getLoadedPlugins();
     }
@@ -126,7 +132,7 @@ public static LoadedPlugins loadFrom(Set<Path> jars) {
     public static Set<SonarLanguage> loadedLanguagesFor(Set<String> loadedPluginKeys) {
         Set<SonarLanguage> loaded = EnumSet.noneOf(SonarLanguage.class);
         for (SonarLanguage language : V1_LANGUAGES) {
-            if (loadedPluginKeys.contains(language.getPluginKey())) {
+            if (loadedPluginKeys.contains(language.getPlugin().getKey())) {
                 loaded.add(language);
             }
         }
diff --git a/src/main/java/io/github/randomcodespace/sonarpredict/daemon/SimpleActiveRule.java b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/SimpleActiveRule.java
new file mode 100644
index 0000000..792aca0
--- /dev/null
+++ b/src/main/java/io/github/randomcodespace/sonarpredict/daemon/SimpleActiveRule.java
@@ -0,0 +1,37 @@
+package io.github.randomcodespace.sonarpredict.daemon;
+
+import java.util.Map;
+import org.sonar.api.batch.rule.ActiveRule;
+import org.sonar.api.rule.RuleKey;
+
+/**
+ * Adapter for engine 11.x: {@code AnalysisConfiguration.Builder.addActiveRules} now takes
+ * the public {@link ActiveRule} interface; 10.x's internal {@code ActiveRule} class is gone
+ * and no public concrete ships. This record is the minimal implementation that satisfies
+ * the interface for our analyses (no severity / template / qProfile metadata needed offline).
+ */
+public record SimpleActiveRule(
+        RuleKey ruleKey,
+        String language,
+        String severity,
+        String internalKey,
+        String templateRuleKey,
+        Map<String, String> params,
+        String qpKey) implements ActiveRule {
+
+    @Override
+    public String param(String key) {
+        return params.get(key);
+    }
+
+    public static SimpleActiveRule of(String ruleKey, String language, Map<String, String> params) {
+        return new SimpleActiveRule(
+                RuleKey.parse(ruleKey),
+                language,
+                null,
+                null,
+                null,
+                params == null ? Map.of() : Map.copyOf(params),
+                null);
+    }
+}
diff --git a/src/main/java/io/github/randomcodespace/sonarpredict/hostplugin/NoOpAnalysisWarnings.java b/src/main/java/io/github/randomcodespace/sonarpredict/hostplugin/NoOpAnalysisWarnings.java
new file mode 100644
index 0000000..6732a9a
--- /dev/null
+++ b/src/main/java/io/github/randomcodespace/sonarpredict/hostplugin/NoOpAnalysisWarnings.java
@@ -0,0 +1,43 @@
+package io.github.randomcodespace.sonarpredict.hostplugin;
+
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.sonar.api.notifications.AnalysisWarnings;
+import org.sonarsource.api.sonarlint.SonarLintSide;
+
+/**
+ * Host-side implementation of {@link AnalysisWarnings} that the bundled analyzer sensors
+ * Spring-autowire. Engine 11.3 ships zero references to {@code AnalysisWarnings}, so the
+ * host plugin provides this bean.
+ *
+ * <p>Lifespan is {@code SINGLE_ANALYSIS} — maps to {@code ContainerLifespan.ANALYSIS}
+ * in the engine. The per-analysis {@code AnalysisContainer} calls
+ * {@code install(ContainerLifespan.ANALYSIS)}, so this bean is registered into the
+ * same Spring container that wires sensors such as {@code HtmlSensor} which declare
+ * {@code AnalysisWarnings} as a constructor parameter.
+ */
+@SonarLintSide(lifespan = SonarLintSide.SINGLE_ANALYSIS)
+public final class NoOpAnalysisWarnings implements AnalysisWarnings {
+
+    private static final Logger DEFAULT_LOG = LoggerFactory.getLogger(NoOpAnalysisWarnings.class);
+
+    /**
+     * The logger this instance writes through. Package-private and non-final
+     * so tests can substitute a Mockito-mocked {@link Logger} without
+     * pulling logback onto the test classpath (Socket Security flags
+     * logback's class files as {@code obfuscatedFile}; we keep our
+     * dependency surface clean by mocking the slf4j API directly).
+     */
+    Logger log = DEFAULT_LOG;
+
+    private final Set<String> seen = ConcurrentHashMap.newKeySet();
+
+    @Override
+    public void addUnique(String message) {
+        if (seen.add(message)) {
+            log.warn("[sonar] {}", message);
+        }
+    }
+}
diff --git a/src/main/java/io/github/randomcodespace/sonarpredict/hostplugin/SonarPredictHostPlugin.java b/src/main/java/io/github/randomcodespace/sonarpredict/hostplugin/SonarPredictHostPlugin.java
new file mode 100644
index 0000000..81072dd
--- /dev/null
+++ b/src/main/java/io/github/randomcodespace/sonarpredict/hostplugin/SonarPredictHostPlugin.java
@@ -0,0 +1,20 @@
+package io.github.randomcodespace.sonarpredict.hostplugin;
+
+import org.sonar.api.Plugin;
+
+/**
+ * The host plugin shipped as {@code sonar-predictor-host-${version}.jar} alongside the
+ * 10 SonarSource analyzer plugins in the bundle. Registers host-side beans that
+ * {@code sonarlint-analysis-engine} 11.x and later expect to find in the analysis
+ * container but no longer provide.
+ *
+ * <p>This class uses only the public {@code org.sonar.api.Plugin} SPI and does not
+ * depend on any {@code org.sonarsource.sonarlint.core.*} internal class.
+ */
+public final class SonarPredictHostPlugin implements Plugin {
+
+    @Override
+    public void define(Context context) {
+        context.addExtension(NoOpAnalysisWarnings.class);
+    }
+}
diff --git a/src/main/staging/bin/sonar b/src/main/staging/bin/sonar
index 63d5c7b..133df6c 100644
--- a/src/main/staging/bin/sonar
+++ b/src/main/staging/bin/sonar
@@ -1,11 +1,11 @@
 #!/bin/sh
 # sonar-predictor launcher — self-contained distribution entry point.
 #
-# Auto-discovers a Java 17+ runtime so neither the agent nor the user has to
+# Auto-discovers a Java 21+ runtime so neither the agent nor the user has to
 # set JAVA_HOME or put a compatible java on PATH. Then runs the bundled CLI,
 # passing it the discovered java and the bundle's jar/plugin locations:
 #
-#   -Dsonar.java.exe     the Java 17+ executable (used to spawn the daemon)
+#   -Dsonar.java.exe     the Java 21+ executable (used to spawn the daemon)
 #   -Dsonar.daemon.jar   lib/sonar-predictor-daemon.jar
 #   -Dsonar.plugins.dir  plugins/  (the 10 SonarSource analyzer jars)
 #
@@ -41,9 +41,10 @@ if [ -z "$CLI_JAR" ] || [ ! -f "$CLI_JAR" ]; then
     exit 2
 fi
 
-# --- Java 17+ discovery -----------------------------------------------------
-# Returns 0 and prints nothing if the given java is >= 17; non-zero otherwise.
-MIN_MAJOR=17
+# --- Java 21+ discovery -----------------------------------------------------
+# Returns 0 and prints nothing if the given java is >= 21; non-zero otherwise.
+# (sonarlint-analysis-engine 11.x / LTA 2026.1 ships Java 21 class files.)
+MIN_MAJOR=21
 
 java_major() {
     # Print the major version of the java executable in $1, or nothing.
@@ -60,7 +61,7 @@ java_major() {
     esac
 }
 
-is_java_17_plus() {
+is_java_min_plus() {
     _m=$(java_major "$1" 2>/dev/null) || return 1
     [ -n "$_m" ] || return 1
     [ "$_m" -ge "$MIN_MAJOR" ] 2>/dev/null || return 1
@@ -70,14 +71,14 @@ is_java_17_plus() {
 JAVA=""
 
 # 1. $JAVA_HOME/bin/java
-if [ -n "${JAVA_HOME:-}" ] && is_java_17_plus "$JAVA_HOME/bin/java"; then
+if [ -n "${JAVA_HOME:-}" ] && is_java_min_plus "$JAVA_HOME/bin/java"; then
     JAVA="$JAVA_HOME/bin/java"
 fi
 
 # 2. java on PATH
 if [ -z "$JAVA" ]; then
     _path_java=$(command -v java 2>/dev/null || true)
-    if [ -n "$_path_java" ] && is_java_17_plus "$_path_java"; then
+    if [ -n "$_path_java" ] && is_java_min_plus "$_path_java"; then
         JAVA="$_path_java"
     fi
 fi
@@ -93,7 +94,7 @@ if [ -z "$JAVA" ]; then
         /opt/*/bin/java
     do
         [ -x "$_cand" ] || continue
-        if is_java_17_plus "$_cand"; then
+        if is_java_min_plus "$_cand"; then
             JAVA="$_cand"
             break
         fi
@@ -101,9 +102,9 @@ if [ -z "$JAVA" ]; then
 fi
 
 if [ -z "$JAVA" ]; then
-    echo "sonar-predictor needs Java 17+; none found." >&2
+    echo "sonar-predictor needs Java 21+; none found." >&2
     echo "Checked: \$JAVA_HOME, PATH, and common install locations." >&2
-    echo "Install a JDK/JRE 17 or newer, or set JAVA_HOME to one." >&2
+    echo "Install a JDK/JRE 21 or newer, or set JAVA_HOME to one." >&2
     exit 2
 fi
 
diff --git a/src/main/staging/bin/sonar.bat b/src/main/staging/bin/sonar.bat
index 7b804c4..c5ae03b 100644
--- a/src/main/staging/bin/sonar.bat
+++ b/src/main/staging/bin/sonar.bat
@@ -2,7 +2,7 @@
 setlocal EnableDelayedExpansion
 rem sonar-predictor launcher (Windows) — self-contained distribution entry point.
 rem
-rem Auto-discovers a Java 17+ runtime so no JAVA_HOME / PATH setup is required,
+rem Auto-discovers a Java 21+ runtime so no JAVA_HOME / PATH setup is required,
 rem then runs the bundled CLI with the bundle's jar/plugin locations passed in.
 rem
 rem TODO(windows): the daemon's IPC uses a Unix domain socket path; full
@@ -76,16 +76,16 @@ if not defined JAVA (
 )
 
 if not defined JAVA (
-    echo sonar-predictor needs Java 17+; none found. 1>&2
+    echo sonar-predictor needs Java 21+; none found. 1>&2
     echo Checked: %%JAVA_HOME%%, PATH, and common install locations. 1>&2
-    echo Install a JDK/JRE 17 or newer, or set JAVA_HOME to one. 1>&2
+    echo Install a JDK/JRE 21 or newer, or set JAVA_HOME to one. 1>&2
     exit /b 2
 )
 
 "%JAVA%" "-Dsonar.java.exe=%JAVA%" "-Dsonar.daemon.jar=%DAEMON_JAR%" "-Dsonar.plugins.dir=%PLUGINS_DIR%" -jar "%CLI_JAR%" %*
 exit /b %ERRORLEVEL%
 
-rem --- :checkJava <java.exe>  -> errorlevel 0 if major version >= 17 ----------
+rem --- :checkJava <java.exe>  -> errorlevel 0 if major version >= 21 ----------
 :checkJava
 set "_JV="
 for /f "tokens=3" %%v in ('"%~1" -version 2^>^&1 ^| findstr /i "version"') do (
@@ -97,4 +97,4 @@ for /f "tokens=1,2 delims=." %%a in ("%_JV%") do (
     if "%%a"=="1" ( set "_MAJOR=%%b" ) else ( set "_MAJOR=%%a" )
 )
 if not defined _MAJOR exit /b 1
-if %_MAJOR% GEQ 17 ( exit /b 0 ) else ( exit /b 1 )
+if %_MAJOR% GEQ 21 ( exit /b 0 ) else ( exit /b 1 )
diff --git a/src/test/java/io/github/randomcodespace/sonarpredict/daemon/AnalysisServiceTest.java b/src/test/java/io/github/randomcodespace/sonarpredict/daemon/AnalysisServiceTest.java
index e2eb7ef..bc94f55 100644
--- a/src/test/java/io/github/randomcodespace/sonarpredict/daemon/AnalysisServiceTest.java
+++ b/src/test/java/io/github/randomcodespace/sonarpredict/daemon/AnalysisServiceTest.java
@@ -562,7 +562,7 @@ void loadedLanguages_reflectsActuallyLoadedPlugins() {
             for (String key : languages) {
                 var lang = org.sonarsource.sonarlint.core.commons.api.SonarLanguage
                         .forKey(key).orElseThrow();
-                assertTrue(loadedKeys.contains(lang.getPluginKey()),
+                assertTrue(loadedKeys.contains(lang.getPlugin().getKey()),
                         "reported language '" + key + "' must have a loaded plugin");
             }
         }
diff --git a/src/test/java/io/github/randomcodespace/sonarpredict/daemon/SimpleActiveRuleTest.java b/src/test/java/io/github/randomcodespace/sonarpredict/daemon/SimpleActiveRuleTest.java
new file mode 100644
index 0000000..a4714b6
--- /dev/null
+++ b/src/test/java/io/github/randomcodespace/sonarpredict/daemon/SimpleActiveRuleTest.java
@@ -0,0 +1,35 @@
+package io.github.randomcodespace.sonarpredict.daemon;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.util.Map;
+import org.junit.jupiter.api.Test;
+import org.sonar.api.batch.rule.ActiveRule;
+import org.sonar.api.rule.RuleKey;
+
+class SimpleActiveRuleTest {
+
+    @Test
+    void of_buildsActiveRuleWithRuleKeyAndLanguage() {
+        SimpleActiveRule rule = SimpleActiveRule.of("java:S1234", "java", Map.of("foo", "bar"));
+
+        assertThat(rule).isInstanceOf(ActiveRule.class);
+        assertThat(rule.ruleKey()).isEqualTo(RuleKey.parse("java:S1234"));
+        assertThat(rule.language()).isEqualTo("java");
+        assertThat(rule.params()).containsExactlyEntriesOf(Map.of("foo", "bar"));
+    }
+
+    @Test
+    void of_nullParams_givesEmptyMap() {
+        SimpleActiveRule rule = SimpleActiveRule.of("java:S1234", "java", null);
+        assertThat(rule.params()).isEmpty();
+    }
+
+    @Test
+    void of_paramsAreDefensivelyCopied() {
+        java.util.HashMap<String, String> mutable = new java.util.HashMap<>(Map.of("a", "1"));
+        SimpleActiveRule rule = SimpleActiveRule.of("java:S1234", "java", mutable);
+        mutable.put("b", "2");
+        assertThat(rule.params()).containsOnlyKeys("a");
+    }
+}
diff --git a/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/HostJarManifestTest.java b/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/HostJarManifestTest.java
new file mode 100644
index 0000000..c9f34f2
--- /dev/null
+++ b/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/HostJarManifestTest.java
@@ -0,0 +1,65 @@
+package io.github.randomcodespace.sonarpredict.hostplugin;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.Manifest;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.Test;
+
+class HostJarManifestTest {
+
+    @Test
+    void hostJarHasRequiredPluginManifestEntries() throws IOException {
+        Path hostJar = findHostJar();
+
+        try (JarFile jar = new JarFile(hostJar.toFile())) {
+            Manifest mf = jar.getManifest();
+            var attrs = mf.getMainAttributes();
+
+            assertThat(attrs.getValue("Plugin-Class"))
+                    .isEqualTo("io.github.randomcodespace.sonarpredict.hostplugin.SonarPredictHostPlugin");
+            assertThat(attrs.getValue("Plugin-Key")).isEqualTo("sonarpredict-host");
+            assertThat(attrs.getValue("Plugin-Name")).isEqualTo("Sonar Predictor Host");
+            assertThat(attrs.getValue("Plugin-Version")).isNotBlank();
+            assertThat(attrs.getValue("Sonar-Version")).isEqualTo("9.9");
+            assertThat(attrs.getValue("SonarLint-Supported")).isEqualTo("true");
+        }
+    }
+
+    @Test
+    void hostJarContainsOnlyHostPluginClasses() throws IOException {
+        Path hostJar = findHostJar();
+
+        try (JarFile jar = new JarFile(hostJar.toFile())) {
+            List<String> classEntries = jar.stream()
+                    .map(JarEntry::getName)
+                    .filter(n -> n.endsWith(".class"))
+                    .sorted()
+                    .toList();
+
+            assertThat(classEntries).containsExactly(
+                    "io/github/randomcodespace/sonarpredict/hostplugin/NoOpAnalysisWarnings.class",
+                    "io/github/randomcodespace/sonarpredict/hostplugin/SonarPredictHostPlugin.class");
+        }
+    }
+
+    private static Path findHostJar() throws IOException {
+        Path targetDir = Path.of("target");
+        try (Stream<Path> entries = Files.list(targetDir)) {
+            return entries
+                    .filter(p -> {
+                        String n = p.getFileName().toString();
+                        return n.startsWith("sonar-predictor-") && n.endsWith("-host.jar");
+                    })
+                    .findFirst()
+                    .orElseThrow(() -> new IllegalStateException(
+                            "host jar not found in target/; run `mvn package -DskipTests` first"));
+        }
+    }
+}
diff --git a/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/HostPluginIntegrationTest.java b/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/HostPluginIntegrationTest.java
new file mode 100644
index 0000000..54c8588
--- /dev/null
+++ b/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/HostPluginIntegrationTest.java
@@ -0,0 +1,84 @@
+package io.github.randomcodespace.sonarpredict.hostplugin;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import io.github.randomcodespace.sonarpredict.daemon.EngineLog;
+import io.github.randomcodespace.sonarpredict.daemon.PluginRuntime;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.sonarsource.sonarlint.core.plugin.commons.LoadedPlugins;
+
+class HostPluginIntegrationTest {
+
+    @TempDir
+    Path tempPluginsDir;
+
+    @Test
+    void loadAll_includesHostPluginAndNoMissingBeanErrors() throws IOException {
+        populateTempPluginsDir(tempPluginsDir);
+
+        LoadedPlugins loaded = PluginRuntime.loadAll(tempPluginsDir);
+
+        assertThat(loaded.getAllPluginInstancesByKeys()).containsKey("sonarpredict-host");
+
+        // PluginRuntime.loadAll installed a fresh EngineLog as the global
+        // SonarLint log target before loading; inspect its captured messages
+        // for the missing-bean error that signaled the original wall.
+        EngineLog engineLog = EngineLog.current();
+        assertThat(engineLog).isNotNull();
+        assertThat(engineLog.messages()).noneMatch(m -> m.contains("NoSuchBeanDefinitionException"));
+    }
+
+    /**
+     * Assembles a temporary plugins directory by hard-linking all JARs from the
+     * vendored {@code plugins/} directory (populated at process-test-resources)
+     * and the host plugin JAR produced at process-test-classes.
+     *
+     * <p>Hard-links are used where supported (same filesystem); Files.copy falls
+     * back transparently when the link target is on a different device.
+     */
+    private static void populateTempPluginsDir(Path tempDir) throws IOException {
+        // Vendor analyzer JARs — present at process-test-resources phase.
+        // Exclude the host JAR (sonar-predictor-*-host.jar) from this glob:
+        // antrun copies it into plugins/ at process-test-classes, but findHostJar()
+        // below adds it explicitly to avoid a duplicate / FileAlreadyExistsException.
+        Path vendorPluginsDir = Path.of("plugins");
+        try (Stream<Path> entries = Files.list(vendorPluginsDir)) {
+            for (Path jar : (Iterable<Path>) entries
+                    .filter(p -> p.getFileName().toString().endsWith(".jar"))
+                    .filter(p -> !p.getFileName().toString().contains("-host.jar"))::iterator) {
+                linkOrCopy(jar, tempDir.resolve(jar.getFileName()));
+            }
+        }
+
+        // Host plugin JAR — produced at process-test-classes phase
+        Path hostJar = findHostJar();
+        linkOrCopy(hostJar, tempDir.resolve(hostJar.getFileName()));
+    }
+
+    private static void linkOrCopy(Path source, Path target) throws IOException {
+        try {
+            Files.createLink(target, source.toAbsolutePath());
+        } catch (UnsupportedOperationException | IOException e) {
+            Files.copy(source.toAbsolutePath(), target);
+        }
+    }
+
+    private static Path findHostJar() throws IOException {
+        Path targetDir = Path.of("target");
+        try (Stream<Path> entries = Files.list(targetDir)) {
+            return entries
+                    .filter(p -> {
+                        String n = p.getFileName().toString();
+                        return n.startsWith("sonar-predictor-") && n.endsWith("-host.jar");
+                    })
+                    .findFirst()
+                    .orElseThrow(() -> new IllegalStateException(
+                            "host jar not found in target/; run `mvn package -DskipTests` first"));
+        }
+    }
+}
diff --git a/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/NoOpAnalysisWarningsTest.java b/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/NoOpAnalysisWarningsTest.java
new file mode 100644
index 0000000..62cdfba
--- /dev/null
+++ b/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/NoOpAnalysisWarningsTest.java
@@ -0,0 +1,78 @@
+package io.github.randomcodespace.sonarpredict.hostplugin;
+
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+
+class NoOpAnalysisWarningsTest {
+
+    private Logger logger;
+    private NoOpAnalysisWarnings warnings;
+
+    @BeforeEach
+    void setUp() {
+        logger = mock(Logger.class);
+        warnings = new NoOpAnalysisWarnings();
+        warnings.log = logger;
+    }
+
+    @Test
+    void addUnique_logsAtWarnWithSonarPrefix() {
+        warnings.addUnique("memory limit reached");
+
+        verify(logger).warn(eq("[sonar] {}"), eq("memory limit reached"));
+        verifyNoMoreInteractions(logger);
+    }
+
+    @Test
+    void addUnique_dedupsIdenticalMessages() {
+        warnings.addUnique("same");
+        warnings.addUnique("same");
+        warnings.addUnique("same");
+
+        verify(logger, times(1)).warn(eq("[sonar] {}"), eq("same"));
+        verifyNoMoreInteractions(logger);
+    }
+
+    @Test
+    void addUnique_distinctMessagesAllLog() {
+        warnings.addUnique("first");
+        warnings.addUnique("second");
+
+        verify(logger).warn(eq("[sonar] {}"), eq("first"));
+        verify(logger).warn(eq("[sonar] {}"), eq("second"));
+        verifyNoMoreInteractions(logger);
+    }
+
+    @Test
+    void freshInstance_doesNotShareDedupeSet() {
+        warnings.addUnique("X");
+
+        Logger second = mock(Logger.class);
+        NoOpAnalysisWarnings fresh = new NoOpAnalysisWarnings();
+        fresh.log = second;
+        fresh.addUnique("X");
+
+        verify(logger).warn(eq("[sonar] {}"), eq("X"));
+        verify(second).warn(eq("[sonar] {}"), eq("X"));
+    }
+
+    @Test
+    void addUnique_nullMessageStillRoutesThroughLogger() {
+        // Sensors may pass null in pathological cases; our implementation
+        // simply delegates to ConcurrentHashMap which rejects null with NPE.
+        // This test pins the current behavior so a future change is intentional.
+        org.assertj.core.api.Assertions
+                .assertThatThrownBy(() -> warnings.addUnique(null))
+                .isInstanceOf(NullPointerException.class);
+        verify(logger, never()).warn(org.mockito.ArgumentMatchers.anyString(),
+                org.mockito.ArgumentMatchers.<Object>any());
+    }
+}
diff --git a/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/SonarPredictHostPluginTest.java b/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/SonarPredictHostPluginTest.java
new file mode 100644
index 0000000..9ef7711
--- /dev/null
+++ b/src/test/java/io/github/randomcodespace/sonarpredict/hostplugin/SonarPredictHostPluginTest.java
@@ -0,0 +1,26 @@
+package io.github.randomcodespace.sonarpredict.hostplugin;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+import org.junit.jupiter.api.Test;
+import org.sonar.api.Plugin;
+
+class SonarPredictHostPluginTest {
+
+    @Test
+    void define_addsNoOpAnalysisWarningsExtension() {
+        SonarPredictHostPlugin plugin = new SonarPredictHostPlugin();
+        Plugin.Context context = mock(Plugin.Context.class);
+
+        plugin.define(context);
+
+        verify(context).addExtension(NoOpAnalysisWarnings.class);
+    }
+
+    @Test
+    void implementsPluginSpi() {
+        assertThat(new SonarPredictHostPlugin()).isInstanceOf(Plugin.class);
+    }
+}