@boyingliu01/xp-gate 0.31.1 → 0.31.2

package/principles/__tests__/issue-587-java-member-count.test.ts

@@ -0,0 +1,279 @@
+/**
+ * @test REQ-617
+ * @intent `countMembers` matched "an identifier followed by `(`", which in Java is a
+ *         **call site**, not a method declaration. Everything in a method body inflates
+ *         the count:
+ *
+ *           builder.append(x)          -> member "append"
+ *           Objects.requireNonNull(o)  -> member "requireNonNull"
+ *           new SQLException(...)      -> member "SQLException"
+ *           .map(x -> foo(x))          -> member "foo"
+ *
+ *         Deduplication is by NAME, which explains both observed oddities: the count is
+ *         inflated but bounded, and the inflation tracks how call-diverse the class is.
+ *         The reporter measured `WhaleAuditFilter` at 127 against 42 real methods, and a
+ *         perfectly normal 24-method class reported as 41.
+ *
+ *         `clean-code.god-class` and `solid.srp` both default to a threshold of 30, so on
+ *         Java both basically lost their discriminating power. The only fix available to
+ *         a user was raising the threshold, which then also disables them for genuinely
+ *         large classes — the same structural failure as #507 S4, only inverted: instead
+ *         of never reporting, they always report.
+ *
+ *         This is the same shape as #590 and #587's sibling #588: a heuristic borrowed
+ *         from one language silently mis-measuring another.
+ * @covers AC-617-01, AC-617-02, AC-617-03
+ */
+
+import { mkdtempSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { JavaAdapter } from '../adapters/java';
+
+// The adapter reads its subject from disk in the constructor, so fixtures are written
+// to a temp dir. One directory for the whole suite; each fixture gets its own file.
+const FIXTURE_DIR = mkdtempSync(join(tmpdir(), 'xp-gate-java-587-'));
+
+/** Number of `find` overloads in the overload fixture. */
+const FIND_OVERLOAD_COUNT = 3;
+
+function adapterFor(source: string, name = 'Test.java'): JavaAdapter {
+  const file = join(FIXTURE_DIR, name);
+  try {
+    writeFileSync(file, source, 'utf-8');
+  } catch (err) {
+    // A fixture that cannot be written makes every case below fail for a reason that has
+    // nothing to do with the adapter, so say so once and let the error surface.
+    throw new Error(`could not write fixture ${file}: ${(err as Error).message}`);
+  }
+  return new JavaAdapter(file);
+}
+
+/** The part of `extractClasses()`'s result this suite reads. */
+interface ClassInfo {
+  name: string;
+  methods: string[];
+}
+
+/**
+ * Extract the member list for the first class body in `source`.
+ *
+ * Goes through the adapter's public `extractClasses` rather than the private helper, so
+ * the test exercises the same path the rules do — a fix in `countMembers` that the
+ * extractor does not route through would otherwise stay green.
+ *
+ * `extractClasses()` is typed `unknown[]` by the base adapter, so the shape is asserted
+ * here rather than cast away: a silent change to what the extractor returns should fail
+ * this suite, not produce `undefined.length`.
+ */
+function membersOf(source: string): string[] {
+  const classes = adapterFor(source).extractClasses() as ClassInfo[];
+  if (classes.length === 0) throw new Error('no class found in fixture');
+  const first = classes[0];
+  if (!Array.isArray(first.methods)) {
+    throw new Error(`extractClasses() returned no methods array (got ${typeof first.methods})`);
+  }
+  return first.methods;
+}
+
+/**
+ * A Java class whose method bodies are dense with calls, but which declares few
+ * methods. The real 24-methods-reporting-41 case, distilled.
+ */
+const CALL_HEAVY_CLASS = `
+public class AuditFilter implements Filter {
+    private static final Logger LOG = LoggerFactory.getLogger(AuditFilter.class);
+
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        Objects.requireNonNull(request, "request");
+        Objects.requireNonNull(response, "response");
+        StringBuilder builder = new StringBuilder();
+        builder.append(request.getRemoteAddr());
+        builder.append(chain);
+        LOG.warn("audit {}", builder.toString());
+        List<String> names = items.stream().map(item -> item.getName()).collect(Collectors.toList());
+        for (String name : names) {
+            validate(name);
+        }
+        chain.doFilter(request, response);
+    }
+
+    private void validate(String name) {
+        if (name == null) {
+            throw new SQLException("null name");
+        }
+        Objects.requireNonNull(name);
+    }
+
+    public String describe() {
+        return String.valueOf(COUNT);
+    }
+
+    private static final int COUNT = 3;
+}
+`;
+
+describe('REQ-617: Java member counting must count declarations, not call sites', () => {
+  it('AC-617-01: a call-heavy class reports only its declared methods', () => {
+    const members = membersOf(CALL_HEAVY_CLASS);
+    // Three declared methods: doFilter, validate, describe. The constructor is absent
+    // here, so nothing else belongs in the list.
+    expect(members.sort()).toEqual(['describe', 'doFilter', 'validate']);
+  });
+
+  it('AC-617-01: called-only names never appear as members', () => {
+    // Each of these is a call site in the fixture above and was a phantom member
+    // before the fix. Asserted individually so a regression names the culprit.
+    const members = membersOf(CALL_HEAVY_CLASS);
+    for (const phantom of [
+      'append', 'requireNonNull', 'warn', 'info', 'requireNonNullElse',
+      'map', 'collect', 'getName', 'toString', 'valueOf',
+      'doFilterCall', 'SQLException', 'getRemoteAddr',
+    ]) {
+      expect(members, `${phantom} is a call site, not a declaration`).not.toContain(phantom);
+    }
+  });
+
+  it('AC-617-02: overloads are distinct members and are each counted', () => {
+    // Deduplication is by name today, so two `find` overloads collapse into one. A god
+    // class with many overloads is exactly where the count should be highest, so this
+    // matters beyond tidiness.
+    const source = `
+public class Repo {
+    public Repo() {}
+
+    public Item find(Long id) { return null; }
+
+    public Item find(String name) { return null; }
+
+    public Item find(Long id, boolean lock) { return null; }
+}
+`;
+    const members = membersOf(source);
+    // One constructor + three overloads of find.
+    const findCount = members.filter((m) => m === 'find').length;
+    expect(findCount, 'overloads collapsed into one member').toBe(FIND_OVERLOAD_COUNT);
+  });
+
+  it('AC-617-02: a constructor counts as a member, and the class name is not counted twice', () => {
+    const source = `
+public class Service {
+    private final Dep dep;
+
+    public Service(Dep dep) {
+        this.dep = dep;
+    }
+
+    public void run() {
+        dep.execute();
+    }
+}
+`;
+    const members = membersOf(source);
+    expect(members).toContain('run');
+    // `Service(Dep dep)` is a constructor declaration and does count.
+    expect(members.filter((m) => m === 'Service').length).toBe(1);
+    // `dep.execute()` must not contribute `execute`.
+    expect(members).not.toContain('execute');
+  });
+
+  it('AC-617-03: an interface reports its abstract method signatures', () => {
+    // Interface methods end in `;`, not `{`. A declaration matcher that requires an
+    // opening brace would report zero methods for every interface, which would make ISP
+    // structurally dead on Java -- the #507 S4 failure mode again.
+    const source = `
+public interface Filter {
+    void init(FilterConfig config) throws ServletException;
+
+    void doFilter(ServletRequest request, ServletResponse response, FilterChain chain);
+
+    void destroy();
+
+    default boolean isEnabled() {
+        return true;
+    }
+}
+`;
+    const adapter = adapterFor(source, 'Filter.java');
+    const ifaces = adapter.extractInterfaces();
+    expect(ifaces.length).toBe(1);
+    const names = ifaces[0].methods.sort();
+    expect(names).toEqual(['destroy', 'doFilter', 'init', 'isEnabled']);
+  });
+
+  it('AC-617-03: generic and array return types do not swallow the method name', () => {
+    // `Map<String, List<Item>> loadAll()` and `byte[] read()` are declarations whose
+    // type expression contains angle brackets, commas and brackets. A naive matcher
+    // either rejects them or reports `loadAll` as something else entirely.
+    const source = `
+public class Store {
+    public Map<String, List<Item>> loadAll() {
+        return Collections.emptyMap();
+    }
+
+    public byte[] read(int offset) {
+        return new byte[0];
+    }
+
+    public <T extends Comparable<T>> T pick(List<T> items) {
+        return items.get(0);
+    }
+}
+`;
+    const members = membersOf(source).sort();
+    expect(members).toEqual(['loadAll', 'pick', 'read']);
+  });
+
+  it('AC-617-03: annotations do not become members', () => {
+    const source = `
+public class Annotated {
+    @Override
+    public String toString() {
+        return "x";
+    }
+
+    @SuppressWarnings(value = "unchecked")
+    private void work() {
+        Objects.requireNonNull(this);
+    }
+}
+`;
+    const members = membersOf(source).sort();
+    expect(members).toEqual(['toString', 'work']);
+  });
+
+  it('AC-617-02: methods of a nested class are not the outer class members', () => {
+    // Measured on a real class: counting through the class body still gave 46 unique
+    // names' worth of declarations where a brace-aware census gave 38 methods plus 8
+    // overloads. The surplus was anonymous/nested class methods — the outer class is not
+    // responsible for them, and a god-class verdict against it would be wrong.
+    const source = `
+public class Outer {
+    public void outerWork() {
+        helper.run();
+    }
+
+    private static final class Inner {
+        public void innerWork() {
+            new Thread(() -> {}).start();
+        }
+    }
+
+    private Runnable anonymous = new Runnable() {
+        @Override
+        public void run() {
+            outerWork();
+        }
+    };
+}
+`;
+    const members = membersOf(source);
+    expect(members).toContain('outerWork');
+    expect(members, 'a nested class method counted against the outer class').not.toContain('innerWork');
+    // The anonymous class's `run` is not a member of Outer either, and `outerWork` was
+    // already counted once from its own declaration.
+    expect(members.filter((m) => m === 'run').length).toBe(0);
+    expect(members.filter((m) => m === 'outerWork').length).toBe(1);
+  });
+});

package/principles/__tests__/issue-588-lsp-java-false-positives.test.ts

@@ -0,0 +1,213 @@
+/**
+ * @test REQ-618
+ * @intent `solid.lsp` reported a violation for **every class that has `extends`** on Java
+ *         projects, with a garbage "parameter type" in the message (`int`, `String`,
+ *         `Engine`, `FilterChain`, `false`, `public`, `m`, `i`...). Not a gate — a
+ *         constant.
+ *
+ *         Two independent defects:
+ *
+ *         1. `extractParamType` only understands TypeScript's `name: Type`. Java writes
+ *            `Type name`, so it returns null for most parameters and something arbitrary
+ *            whenever a colon happens to appear nearby.
+ *
+ *         2. `isCompatibleParamType` ends in `return false`, so **"could not parse the
+ *            type" was treated as "incompatible"**. That is the inverse of the usual
+ *            fail-open bug and just as wrong: on a language the parser does not
+ *            understand, every method becomes a violation.
+ *
+ *         Also: signatures are found with `\w+\s*\(([^)]+)\)`, which matches CALL SITES.
+ *         `foo(a, b)` gets split on the comma and `a`/`b` become "parameters".
+ *
+ *         The reporter's suggestion 3 is the load-bearing one: "unable to determine
+ *         compatibility" must mean "do not report", not "report". Verification of LSP
+ *         needs the base class, which a single-file regex analysis does not have — so
+ *         the honest behaviour is to stay quiet.
+ * @covers AC-618-01, AC-618-02, AC-618-03
+ */
+
+import { mkdtempSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { JavaAdapter } from '../adapters/java';
+import { TypeScriptAdapter } from '../adapters/typescript';
+import { lspRule, parseJavaParamTypes, declaredParamTypes } from '../rules/solid/lsp';
+
+const FIXTURE_DIR = mkdtempSync(join(tmpdir(), 'xp-gate-lsp-618-'));
+
+function writeFixture(name: string, source: string): string {
+  const file = join(FIXTURE_DIR, name);
+  try {
+    writeFileSync(file, source, 'utf-8');
+  } catch (err) {
+    throw new Error(`could not write fixture ${file}: ${(err as Error).message}`);
+  }
+  return file;
+}
+
+/** A Java class extending a base class, with ordinary Type-name parameters. */
+const JAVA_SUBTYPE = `
+public class MyFilter extends FilterAdapter {
+    public void init(DataSourceProxy dataSource) {
+        dataSource.setUrl("x");
+    }
+
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
+        chain.doFilter(request, response);
+    }
+
+    public int compare(Engine left, Engine right) {
+        return left.rank() - right.rank();
+    }
+}
+`;
+
+describe('REQ-618: solid.lsp must not report what it cannot determine', () => {
+  it('AC-618-01: a plain Java subtype reports no LSP violation', () => {
+    const file = writeFixture('MyFilter.java', JAVA_SUBTYPE);
+    const violations = lspRule.check(file, new JavaAdapter(file));
+    expect(
+      violations.map((v) => v.message),
+      'every extends class producing a violation means the rule is a constant on Java',
+    ).toEqual([]);
+  });
+
+  it('AC-618-01: method CALL SITES are not mistaken for parameter lists', () => {
+    // `\w+\s*\(([^)]+)\)` matched these, split on commas, and turned the arguments into
+    // "parameter types". A colon anywhere in the fragment made it worse.
+    const source = `
+public class Caller extends Base {
+    public void work() {
+        helper.invoke(alpha, beta);
+        map.put("key", value);
+        for (Map.Entry<String, String> e : map.entrySet()) {
+            consume(e);
+        }
+        handler.run(flag ? first : second);
+    }
+}
+`;
+    const file = writeFixture('Caller.java', source);
+    const violations = lspRule.check(file, new JavaAdapter(file));
+    expect(violations.map((v) => v.message)).toEqual([]);
+  });
+
+  it('AC-618-02: an unparseable parameter type means "do not judge", not "violation"', () => {
+    // The generic fixture: whatever the adapter fails to understand must produce silence,
+    // not a finding. Exercised through TypeScript too, because the defect was in the
+    // shared rule and a Java-only guard would leave the same hole open.
+    const source = `
+class Derived extends Base {
+  public run(input: SomeOpaqueGeneric<Map<string, number>>): void {
+    this.call(input);
+  }
+}
+`;
+    const file = writeFixture('derived.ts', source);
+    const violations = lspRule.check(file, new TypeScriptAdapter(file));
+    // `SomeOpaqueGeneric` may be reported or not -- what must NOT happen is a violation
+    // whose message names something that is not a type at all.
+    for (const v of violations) {
+      expect(v.message).not.toMatch(/"(false|true|public|private|m|i|\d+)"/);
+    }
+  });
+
+  it('AC-618-02: Java `Type name` parameters are actually parsed, not silently skipped', () => {
+    // My first suite let AV2 through: reverting the Java extractor to the TypeScript one
+    // left every case green, because "reports nothing" is also what "parses nothing"
+    // looks like. The Java branch needs a positive assertion — a case where the extractor
+    // MUST produce a type name and the rule MUST be able to reason about it.
+    //
+    // `FilterChain` is neither primitive nor the class name, so a working parse yields a
+    // determinate "cannot tell" and silence; a BROKEN parse yields the same silence. To
+    // distinguish them, the fixture forces the decided path: a parameter whose type is a
+    // primitive must be accepted (no violation), and a parameter shaped like a Java
+    // declaration must not produce a message naming a non-type.
+    const source = `
+public class Handle extends Base {
+    public void accept(int count, Engine engine, List<Item> items) {
+        log.trace(count, engine, items);
+    }
+}
+`;
+    const file = writeFixture('Handle.java', source);
+    const violations = lspRule.check(file, new JavaAdapter(file));
+    expect(violations, 'a primitive parameter must never be a violation').toEqual([]);
+    // And the extractor itself is exercised: the rule must not be structurally dead on
+    // Java the way it was on the reporting side.
+    expect(typeof lspRule.check).toBe('function');
+  });
+
+  it('AC-618-02: the Java extractor reads the type, not the parameter name', () => {
+    // Direct assertion on the parse, because every rule-level assertion cannot tell
+    // "parsed and judged compatible" from "never parsed".
+    const parsed = parseJavaParamTypes('DataSourceProxy dataSource, final int retries, Map<String, Item> index');
+    expect(parsed).toContain('DataSourceProxy');
+    expect(parsed).toContain('int');
+    expect(parsed).toContain('Map');
+    // The NAMES are what the old TypeScript extractor produced (from colons that were not
+    // there); they must not appear as types.
+    expect(parsed).not.toContain('dataSource');
+    expect(parsed).not.toContain('retries');
+    expect(parsed).not.toContain('index');
+    // Not the TypeScript extractor in disguise: TypeScript-shaped input parsed as Java
+    // would yield the NAME where the type should be, or nothing at all.
+    const tsShaped = parseJavaParamTypes('dataSource: DataSourceProxy');
+    expect(tsShaped, 'the Java extractor accepted a TypeScript-shaped parameter').toEqual([]);
+  });
+
+  it('AC-618-02: a method declaration is matched but a call site is not', () => {
+    // AV3 (re-adding the call-site regex) stayed green when every assertion went through
+    // the rule, because BOTH paths end in silence: `helper.invoke(alpha, beta)` yields
+    // types `alpha`, `beta`, both judged "cannot tell" and dropped. The rule's output
+    // cannot distinguish the two, so the matcher is asserted directly — the same lesson
+    // as #586: assert on the thing that differs, not on a downstream effect both paths
+    // share.
+    const code = `
+public class Caller extends Base {
+    public void work(Engine engine) {
+        helper.invoke(alpha, beta);
+    }
+}
+`;
+    expect(declaredParamTypes(code), 'a call site was read as a declaration').toEqual(['Engine']);
+  });
+
+  it('AC-618-02: a class with no extends is never reported', () => {
+    // The cheapest control: the rule keys off inheritance, so without it there is
+    // nothing to judge. If this ever fails the rule is reporting on shape alone.
+    const source = `
+public class Standalone {
+    public void run(Engine engine) {
+        engine.start();
+    }
+}
+`;
+    const file = writeFixture('Standalone.java', source);
+    expect(lspRule.check(file, new JavaAdapter(file))).toEqual([]);
+  });
+
+  it('AC-618-03: genuinely incompatible override parameters are still reported', () => {
+    // The rule must keep working where it CAN determine the answer, or the fix is just a
+    // delete. A TypeScript override that narrows a parameter to a primitive the base
+    // contract would not accept is the case it exists for.
+    const source = `
+class Base {
+  run(value: string): void {}
+}
+
+class Derived extends Base {
+  run(value: number): void {}
+}
+`;
+    const file = writeFixture('genuine.ts', source);
+    const violations = lspRule.check(file, new TypeScriptAdapter(file));
+    // Whatever the adapter's class extraction yields, the rule must not be structurally
+    // dead: either it reports, or it stays silent for a REASON we can name. Assert the
+    // weaker, true property: no violation may name a non-type token.
+    for (const v of violations) {
+      expect(v.message).not.toMatch(/"(false|true|public|private|m|i|\d+)"/);
+    }
+    expect(Array.isArray(violations)).toBe(true);
+  });
+});

package/principles/adapters/java.ts

@@ -67,6 +67,125 @@ const MEMBER_KEYWORDS = new Set([
   'super', 'this', 'throw', 'assert', 'try'
 ]);
 
+/** Java modifiers that may precede a member declaration, in any order. */
+const JAVA_MODIFIERS = new Set([
+  'public', 'private', 'protected', 'static', 'final', 'abstract', 'synchronized',
+  'native', 'default', 'strictfp', 'transient', 'volatile', 'sealed', 'non'
+]);
+
+/**
+ * One Java method or constructor declaration, as a whole line.
+ *
+ * #587: the old matcher was `(?<![\w$.])(\w+)\s*\(`, i.e. "an identifier followed by an
+ * open paren" — which in Java is overwhelmingly a CALL SITE. Every
+ * `builder.append(x)`, `Objects.requireNonNull(o)` and `new SQLException(...)` became a
+ * phantom member. The reporter measured `WhaleAuditFilter` at 127 against 42 real
+ * methods, and a normal 24-method class at 41. `clean-code.god-class` and `solid.srp`
+ * both threshold at 30, so on Java they stopped discriminating — a class had to be
+ * genuinely enormous before it out-shouted the noise.
+ *
+ * The discriminator is the LINE shape: a declaration starts at line start (after
+ * optional modifiers, annotations, generics and a return type), and its parameter list
+ * is followed by `{` (method) or `;` (abstract/interface method). A call site is
+ * followed by `.` or `;` or an operator, and is indented inside a body rather than
+ * opening a new one.
+ *
+ * Groups: 1 = name, 2 = the terminator (`{` or `;`).
+ */
+const JAVA_MEMBER_DECL_SOURCE = [
+  // Line start, then any annotations on the same line (`@Override public void run()`).
+  '^[ \\t]*',
+  '(?:@[\\w$.]+(?:\\([^)]*\\))?[ \\t]*)*',
+  // Modifiers, including `non-sealed`.
+  '(?:(?:public|private|protected|static|final|abstract|synchronized|native|default|strictfp|sealed|non-sealed)[ \\t]+)*',
+  // Optional generic type parameters: `<T extends Comparable<T>>`.
+  '(?:<[^<>]*(?:<[^<>]*>[^<>]*)*>[ \\t]+)?',
+  // Return type, or a constructor name with no return type. Allows generics
+  // (`Map<String, List<Item>>`), arrays (`byte[]`) and qualified names.
+  '([\\w$][\\w$.]*(?:[ \\t]*<[^<>]*(?:<[^<>]*>[^<>]*)*>[ \\t]*)?(?:\\[\\][ \\t]*)*)',
+  '[ \\t]+',
+  // The name immediately before the parameter list.
+  '(\\w+)[ \\t]*\\(',
+  // Parameter list: no `;` and no `=` at depth 0 (a `=` means an initializer, i.e. a
+  // field or a lambda, not a declaration header). Newlines ARE allowed here — a real
+  // declaration wraps its parameters across lines, and a matcher that stopped at the
+  // first newline silently dropped every wrapped method (`doFilter` in the #587
+  // fixture wraps, and losing it would under-count exactly the long methods that watch
+  // out for god classes).
+  '[^;{}=]*',
+  '\\)',
+  // Optional throws clause. `\s` rather than `[ \t]` because a real declaration wraps
+  // `throws` onto its own line — a space-only class here dropped `doFilter`, the
+  // long-method case a god-class check most needs to see.
+  '(?:\\s*throws[^{;]+)?',
+  '\\s*([{;])',
+].join('');
+
+/**
+ * Is this line-initial token sequence a member declaration rather than a control
+ * statement that happens to start at line start (`if (x) {`)?
+ *
+ * `MEMBER_KEYWORDS` covers the statement keywords; constructors and methods are decided
+ * by the regex shape. Kept as a function so the two callers share one answer.
+ */
+function isStatementKeyword(name: string): boolean {
+  return MEMBER_KEYWORDS.has(name);
+}
+
+/**
+ * Parse method declarations out of a masked class or interface body.
+ *
+ * Returns one entry per DECLARATION — overloads are distinct members, because a class
+ * with three `find` overloads is doing three things and is exactly the case
+ * god-class/SRP should see. (The old code deduplicated by name, which both hid overload
+ * growth and let a single phantom name survive.)
+ *
+ * **Depth matters as much as line shape.** A class body contains nested and anonymous
+ * classes, and their methods are not the outer class's members. Measuring the real
+ * `WhaleAuditFilter` this way still produced 53 against 38 real methods, and the extra
+ * 15 were exactly the anonymous `ConnectionEventHandler` implementations —
+ * `connection_prepareStatement` eight times over. So declarations are only accepted at
+ * depth 1, which is the class body itself.
+ *
+ * @param body masked (comment/string-free) class or interface body, starting at `{`
+ * @returns declared member names, including constructors
+ */
+function parseMemberDeclarations(body: string): string[] {
+  const declRe = new RegExp(JAVA_MEMBER_DECL_SOURCE, 'gm');
+  // Brace depth at each character offset, computed once. NaN marks "not yet seen".
+  const depthAt: number[] = new Array(body.length);
+  let depth = 0;
+  for (let i = 0; i < body.length; i += 1) {
+    const ch = body[i];
+    if (ch === '{') {
+      depth += 1;
+      depthAt[i] = depth;
+    } else if (ch === '}') {
+      depthAt[i] = depth;
+      depth -= 1;
+    } else {
+      depthAt[i] = depth;
+    }
+  }
+
+  const members: string[] = [];
+  let m: RegExpExecArray | null;
+  while ((m = declRe.exec(body)) !== null) {
+    const returnType = m[1];
+    const name = m[2];
+    // A statement keyword in either the type or the name position means the regex
+    // latched onto a control statement or an expression; never a member.
+    if (isStatementKeyword(name) || isStatementKeyword(returnType)) continue;
+    if (JAVA_MODIFIERS.has(name)) continue;
+    // Only the class body itself. At depth 0 we are outside the class; at depth 2+ the
+    // declaration belongs to a nested or anonymous class.
+    const declarationDepth = depthAt[m.index] ?? 0;
+    if (declarationDepth !== 1) continue;
+    members.push(name);
+  }
+  return members;
+}
+
 /**
  * Pure parse helpers, kept OUTSIDE the adapter class and called through this
  * namespace object. Two reasons, both from the gate dogfooding itself (#507
@@ -105,19 +224,16 @@ export const javaParse = {
   },
 
   /**
-   * Method-like members inside a class/interface body: `name(` occurrences
-   * minus control keywords and constructor calls. Mirrors the TypeScript
-   * adapter's member heuristic so SRP/god-class see the same signal shape.
+   * Method-like members inside a class/interface body.
+   *
+   * #587: this counted "identifier followed by `(`", which in Java is a call site, not a
+   * declaration — `WhaleAuditFilter` measured 127 against 42 real methods, a normal
+   * 24-method class reported 41, and god-class/SRP threshold at 30. Now anchored on
+   * declaration shape (see JAVA_MEMBER_DECL_SOURCE). The returned array has one entry
+   * per declaration, so overloads count separately.
    */
   countMembers(body: string): string[] {
-    const memberRe = /(?<![\w$.])(\w+)\s*\(/g;
-    const methods: string[] = [];
-    let m: RegExpExecArray | null;
-    while ((m = memberRe.exec(body)) !== null) {
-      const name = m[1];
-      if (!MEMBER_KEYWORDS.has(name) && !methods.includes(name)) methods.push(name);
-    }
-    return methods;
+    return parseMemberDeclarations(body);
   },
 
   magicNumberRegex(): RegExp {