slopbrick 0.21.2 → 0.25.0

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.21.2";
+    VERSION = "0.25.0";
   }
 });
 
@@ -309,6 +309,38 @@ var init_defaults = __esm({
        */
       testIntelligence: {
         missingEdgeCase: false
+      },
+      /**
+       * v0.25.0: self-scan exclude paths. Defaults cover the three paths
+       * that are always false positives when scanning the slopbrick repo
+       * itself:
+       *
+       *   - `src/rules/**` — rule definitions contain example patterns
+       *     the rules themselves detect (self-fire). E.g. a
+       *     `security/sql-construction` rule's source file has a SQL
+       *     concat string literal that fires its own regex.
+       *   - `tests/fixtures/**` — test fixtures contain intentional bad
+       *     code that the rules must fire on to be useful (each fixture
+       *     is a positive test case). Scanning them in a self-scan
+       *     produces ~70 false-positive "issues" that are really just
+       *     test data.
+       *   - `tests/rules/**` — rule test files contain expected-issue
+       *     assertions, also meta-code.
+       *
+       * Three patterns, ~70 issues removed per self-scan. Combined with
+       * the v0.25.0 graded security cap, this restores the v9 plan's
+       * "security ≥ 80" criterion (unachievable in v0.24.0 due to 90
+       * self-scan FPs collapsing the score to 0).
+       *
+       * Set `selfScan: { excludePaths: [] }` in `slopbrick.config.mjs`
+       * to opt out and scan every file (legacy behavior).
+       */
+      selfScan: {
+        excludePaths: [
+          "src/rules/**",
+          "tests/fixtures/**",
+          "tests/rules/**"
+        ]
       }
     };
   }
@@ -27604,6 +27636,267 @@ var init_import_path_mismatch = __esm({
   }
 });
 
+// src/rules/cpp/c-style-cast.ts
+var C_STYLE_CAST_REGEX, NAMED_CAST_PREFIX_REGEX, cppCStyleCastRule;
+var init_c_style_cast = __esm({
+  "src/rules/cpp/c-style-cast.ts"() {
+    "use strict";
+    init_rule();
+    C_STYLE_CAST_REGEX = /\(\s*(?:int|long|short|char|float|double|bool|unsigned\s+\w+|signed\s+\w+|size_t|[A-Za-z_]\w*(?:\s*[*,&][^)]*)?)\s*\)\s*(\w+|[^a-zA-Z_])/g;
+    NAMED_CAST_PREFIX_REGEX = /\b(?:static|reinterpret|const|dynamic)_cast\s*<[^>]*>\s*\($/;
+    cppCStyleCastRule = createRule({
+      id: "cpp/c-style-cast",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      description: "C-style cast `(int)x` \u2014 use static_cast / reinterpret_cast / const_cast so the kind is greppable.",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+        let m;
+        C_STYLE_CAST_REGEX.lastIndex = 0;
+        while ((m = C_STYLE_CAST_REGEX.exec(source)) !== null) {
+          const innerMatch = /\(\s*([^)]+?)\s*\)/.exec(m[0]) ?? [];
+          const inner = (innerMatch[1] ?? "").trim();
+          const looksLikeCast = /\b(?:int|long|short|char|float|double|bool|unsigned|signed|size_t)\b/.test(inner) || /[*&]/.test(inner);
+          if (!looksLikeCast) continue;
+          const before = source.slice(Math.max(0, m.index - 40), m.index);
+          if (NAMED_CAST_PREFIX_REGEX.test(before)) continue;
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "cpp/c-style-cast",
+            category: "typo",
+            severity: "low",
+            aiSpecific: true,
+            message: `C-style cast at line ${line} \u2014 use static_cast / reinterpret_cast / const_cast`,
+            line,
+            column: 1,
+            advice: "Use the named cast that matches the intent: `static_cast<int>(x)`, `reinterpret_cast<MyClass*>(p)`, `const_cast<...>(ref)`, or `dynamic_cast<Derived*>(base)` for runtime-checked downcasts. C-style casts silently pick whichever the compiler needs \u2014 `static_cast`, `reinterpret_cast`, OR `const_cast` \u2014 which makes them impossible to grep for and impossible to review. The C++ Core Guidelines (ES.49) call this out by name. AI agents reach for `(int)x` because of training-data C textbooks. Reference: cpp/c-style-cast v0.24."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/cpp/magic-numbers.ts
+var MAGIC_NUMBER_REGEX, COMPARE_OR_RETURN_REGEX, cppMagicNumbersRule;
+var init_magic_numbers = __esm({
+  "src/rules/cpp/magic-numbers.ts"() {
+    "use strict";
+    init_rule();
+    MAGIC_NUMBER_REGEX = /\b(\d+(?:\.\d+)?)\b/g;
+    COMPARE_OR_RETURN_REGEX = /\b(?:if|while|return|for)\s*[\(\s]?[^;]*[<>=!][^;]*/;
+    cppMagicNumbersRule = createRule({
+      id: "cpp/magic-numbers",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      description: "Magic-number literal in a comparison / return \u2014 name it: `constexpr int MAX = 1024;`.",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+        const lines = source.split("\n");
+        const allowSet = /* @__PURE__ */ new Set([
+          "1024",
+          "65535",
+          "65536",
+          "86400",
+          "3600",
+          "1000",
+          "100.0",
+          "60",
+          "24",
+          "7",
+          "365",
+          "256",
+          "255",
+          "0",
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+        ]);
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i] ?? "";
+          if (!COMPARE_OR_RETURN_REGEX.test(line)) continue;
+          let m;
+          MAGIC_NUMBER_REGEX.lastIndex = 0;
+          while ((m = MAGIC_NUMBER_REGEX.exec(line)) !== null) {
+            const literal = m[0] ?? "";
+            if (allowSet.has(literal)) continue;
+            if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(line.slice(0, m.index).trimEnd())) continue;
+            const prevLine = i > 0 ? lines[i - 1] ?? "" : "";
+            if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(prevLine.trim())) continue;
+            issues.push({
+              ruleId: "cpp/magic-numbers",
+              category: "typo",
+              severity: "low",
+              aiSpecific: true,
+              message: `magic number ${literal} at line ${i + 1} \u2014 name it: constexpr int MAX = ${literal};`,
+              line: i + 1,
+              column: 1,
+              advice: 'Replace the bare literal with a named constant declared as `constexpr int MAX_SIZE = 1024;` (or `static constexpr`). The named constant lives next to its value, can be searched, and forces the reader to mean what they say. Magic numbers in comparisons hide intent ("7" against what?). AI agents produce magic-number-heavy code because their training-data examples rarely bother to name the constant. Reference: cpp/magic-numbers v0.24.'
+            });
+          }
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/cpp/printf-debug.ts
+var PRINTF_FAMILY_REGEX, COUT_LITERAL_REGEX, STD_COUT_BARE_REGEX, THRESHOLD_DEFAULT, cppPrintfDebugRule;
+var init_printf_debug = __esm({
+  "src/rules/cpp/printf-debug.ts"() {
+    "use strict";
+    init_rule();
+    PRINTF_FAMILY_REGEX = /\b(?:printf|fprintf|sprintf|snprintf)\s*\(/g;
+    COUT_LITERAL_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*"[^"]*"/g;
+    STD_COUT_BARE_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*'[^']*'/g;
+    THRESHOLD_DEFAULT = 1;
+    cppPrintfDebugRule = createRule({
+      id: "cpp/printf-debug",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      description: "printf family or std::cout debug printing \u2014 use spdlog / glog / AbslLog for level-controlled output.",
+      create(_context) {
+        return { threshold: THRESHOLD_DEFAULT };
+      },
+      analyze(context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+        const printfCount = (source.match(PRINTF_FAMILY_REGEX) ?? []).length;
+        let viaPrintf = false;
+        if (printfCount > context.threshold) {
+          const line = source.indexOf("printf");
+          if (line !== -1) viaPrintf = true;
+        }
+        const coutHit = COUT_LITERAL_REGEX.test(source) || STD_COUT_BARE_REGEX.test(source);
+        if (!viaPrintf && !coutHit) return issues;
+        issues.push({
+          ruleId: "cpp/printf-debug",
+          category: "typo",
+          severity: "low",
+          aiSpecific: true,
+          message: viaPrintf ? `${printfCount} printf-family calls \u2014 use spdlog / glog / AbslLog` : "std::cout/cerr/clog with a string literal \u2014 use spdlog / glog / AbslLog",
+          line: 1,
+          column: 1,
+          advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.24."
+        });
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/cpp/raw-new-delete.ts
+var NEW_TYPE_REGEX, DELETE_REGEX, MIN_PAIRS_DEFAULT, cppRawNewDeleteRule;
+var init_raw_new_delete = __esm({
+  "src/rules/cpp/raw-new-delete.ts"() {
+    "use strict";
+    init_rule();
+    NEW_TYPE_REGEX = /\bnew\s+[A-Za-z_]\w*\s*\(/g;
+    DELETE_REGEX = /\bdelete\s+/g;
+    MIN_PAIRS_DEFAULT = 1;
+    cppRawNewDeleteRule = createRule({
+      id: "cpp/raw-new-delete",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      description: "Manual `new` / `delete` pairing \u2014 use std::make_unique / std::unique_ptr instead.",
+      create(_context) {
+        return { minPairs: MIN_PAIRS_DEFAULT };
+      },
+      analyze(context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+        let newCount = 0;
+        let m;
+        NEW_TYPE_REGEX.lastIndex = 0;
+        while ((m = NEW_TYPE_REGEX.exec(source)) !== null) newCount++;
+        let deleteCount = 0;
+        DELETE_REGEX.lastIndex = 0;
+        while ((m = DELETE_REGEX.exec(source)) !== null) deleteCount++;
+        if (newCount <= context.minPairs) return issues;
+        if (deleteCount <= context.minPairs) return issues;
+        issues.push({
+          ruleId: "cpp/raw-new-delete",
+          category: "typo",
+          severity: "low",
+          aiSpecific: true,
+          message: `manual new/delete pairing (${newCount} new, ${deleteCount} delete) \u2014 wrap in std::unique_ptr`,
+          line: 1,
+          column: 1,
+          advice: "Replace `T* p = new T(...); ... delete p;` with `auto p = std::make_unique<T>(...);`. Smart pointers delete on scope exit, never leak on early return / exception, never double-free on copy. The C++ Core Guidelines R.20-R.23 call out raw `new` / `delete` as something to avoid in application code. AI agents reach for `new` / `delete` because their training data was written for pre-C++11 idioms. Reference: cpp/raw-new-delete v0.24."
+        });
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/cpp/using-namespace-std.ts
+var USING_NAMESPACE_STD_REGEX, cppUsingNamespaceStdRule;
+var init_using_namespace_std = __esm({
+  "src/rules/cpp/using-namespace-std.ts"() {
+    "use strict";
+    init_rule();
+    USING_NAMESPACE_STD_REGEX = /\busing\s+namespace\s+std\s*;/g;
+    cppUsingNamespaceStdRule = createRule({
+      id: "cpp/using-namespace-std",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: true,
+      description: "`using namespace std;` in a header \u2014 pollutes every consumer. Use `using std::foo;` or qualify names.",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+        if (!/\.(h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+        let m;
+        USING_NAMESPACE_STD_REGEX.lastIndex = 0;
+        while ((m = USING_NAMESPACE_STD_REGEX.exec(source)) !== null) {
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "cpp/using-namespace-std",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: true,
+            message: `using namespace std; at line ${line} \u2014 pollutes every consumer of this header`,
+            line,
+            column: 1,
+            advice: "Remove the directive and qualify names with `std::`, or use a targeted `using std::cout;` / `using std::string;` for the few names that recur. The C++ Core Guidelines (SF.6 / SF.7) explicitly forbid `using namespace` in header files. A single `using namespace std;` in a widely-included header pulls 200+ names into every translation unit \u2014 downstream code, name-lookup, and ADL silently change. AI agents default to `using namespace std;` because their training snippets include countless copy-pasteable textbook examples that start with it. Reference: cpp/using-namespace-std v0.24."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/db/duplicate-index.ts
 import { parseSync as parseSql, loadModule as loadSqlModule } from "pgsql-parser";
 function parseStatements(raw) {
@@ -29645,6 +29938,533 @@ var init_identical_block = __esm({
   }
 });
 
+// src/engine/dedup/tokenize.ts
+import { createHash as createHash2 } from "crypto";
+function stripComments(source) {
+  let out = "";
+  let i = 0;
+  while (i < source.length) {
+    const ch = source[i];
+    const next = source[i + 1];
+    if (ch === "/" && next === "/") {
+      while (i < source.length && source[i] !== "\n") i++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < source.length && !(source[i] === "*" && source[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function tokenize(source) {
+  return source.toLowerCase().split(/[^a-z0-9_]+/u).filter((t) => t.length > 0);
+}
+function shingleHash(shingle) {
+  const h = createHash2("sha1").update(shingle).digest();
+  return (h[0] ?? 0) << 24 | (h[1] ?? 0) << 16 | (h[2] ?? 0) << 8 | (h[3] ?? 0);
+}
+function shingleSet(source, config = {}) {
+  const { k } = { ...DEFAULT_CONFIG2, ...config };
+  const tokens = tokenize(stripComments(source));
+  if (tokens.length === 0) return /* @__PURE__ */ new Set();
+  if (tokens.length < k) {
+    return /* @__PURE__ */ new Set([shingleHash(tokens.join(" "))]);
+  }
+  const out = /* @__PURE__ */ new Set();
+  for (let i = 0; i + k <= tokens.length; i++) {
+    out.add(shingleHash(tokens.slice(i, i + k).join(" ")));
+  }
+  return out;
+}
+var DEFAULT_CONFIG2;
+var init_tokenize = __esm({
+  "src/engine/dedup/tokenize.ts"() {
+    "use strict";
+    DEFAULT_CONFIG2 = { k: 5 };
+  }
+});
+
+// src/engine/dedup/minhash.ts
+import { createHash as createHash3 } from "crypto";
+function mix64(x) {
+  x ^= x >> 33n;
+  x = x * 0xff51afd7ed558ccdn & 0xffffffffffffffffn;
+  x ^= x >> 33n;
+  x = x * 0xc4ceb9fe1a85ec53n & 0xffffffffffffffffn;
+  x ^= x >> 33n;
+  return x;
+}
+function bmod(a, m) {
+  const r = a % m;
+  return r < 0n ? r + m : r;
+}
+function hashParams(i) {
+  const a = mix64(BigInt(i) * 0x9e3779b97f4a7c15n) & 0xffffffffffffffffn | 1n;
+  const b = mix64(BigInt(i) * 0xbf58476d1ce4e5b9n) & 0xffffffffffffffffn;
+  return [a, b];
+}
+function hashAt(i, x) {
+  const [a, b] = hashParams(i);
+  const xb = BigInt(x >>> 0);
+  const combined = a * xb + b;
+  const h = Number(bmod(combined, PRIME) & 0xffffffffn);
+  return h >>> 0;
+}
+function minHash(tokens, config = {}) {
+  const { numHashes } = { ...DEFAULT_CONFIG3, ...config };
+  const sig = new Uint32Array(numHashes);
+  sig.fill(4294967295);
+  const tokenIter = tokens instanceof Set ? tokens : Array.from(tokens);
+  for (const t of tokenIter) {
+    for (let i = 0; i < numHashes; i++) {
+      const h = hashAt(i, t);
+      if (h < (sig[i] ?? 4294967295)) sig[i] = h;
+    }
+  }
+  return sig;
+}
+function minHashSimilarity(a, b) {
+  if (a.length !== b.length) {
+    throw new Error(`minHashSimilarity: length mismatch ${a.length} vs ${b.length}`);
+  }
+  if (a.length === 0) return 1;
+  let matches = 0;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] === b[i]) matches++;
+  }
+  return matches / a.length;
+}
+var PRIME, DEFAULT_CONFIG3;
+var init_minhash = __esm({
+  "src/engine/dedup/minhash.ts"() {
+    "use strict";
+    PRIME = (1n << 61n) - 1n;
+    DEFAULT_CONFIG3 = {
+      numHashes: 128
+    };
+  }
+});
+
+// src/rules/dup/near-duplicate.ts
+var DEFAULT_CONTEXT, signatureCache, nearDuplicateRule;
+var init_near_duplicate = __esm({
+  "src/rules/dup/near-duplicate.ts"() {
+    "use strict";
+    init_rule();
+    init_tokenize();
+    init_minhash();
+    DEFAULT_CONTEXT = {
+      threshold: 0.7,
+      k: 5
+    };
+    signatureCache = /* @__PURE__ */ new Map();
+    nearDuplicateRule = createRule({
+      id: "dup/near-duplicate",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: true,
+      description: "Near-duplicate file (Type-2 clone) \u2014 token-set Jaccard similarity > 0.7 after MinHash. Catches AI whitespace/comment refactors.",
+      create(_context) {
+        return { ...DEFAULT_CONTEXT };
+      },
+      analyze(context, facts) {
+        const ctx = { ...DEFAULT_CONTEXT, ...context };
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        const filePath = facts.filePath;
+        if (!filePath) return issues;
+        const shingles = shingleSet(source, { k: ctx.k });
+        if (shingles.size === 0) return issues;
+        const sig = minHash(shingles);
+        const matched = [];
+        for (const [prevPath, prevSig] of signatureCache.entries()) {
+          const sim = minHashSimilarity(sig, prevSig);
+          if (sim >= ctx.threshold) {
+            matched.push({ path: prevPath, similarity: sim });
+          }
+        }
+        if (matched.length > 0) {
+          matched.sort((a, b) => b.similarity - a.similarity);
+          const best = matched[0];
+          issues.push({
+            ruleId: "dup/near-duplicate",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: true,
+            message: `Near-duplicate of ${best.path} (Jaccard ${(best.similarity * 100).toFixed(1)}%, threshold ${(ctx.threshold * 100).toFixed(0)}%)`,
+            line: 1,
+            column: 1,
+            advice: "Refactor to share the implementation, or rename/restructure to make the difference intentional. AI agents produce near-duplicates when iterating \u2014 this is the v0.23.0 Type-2 clone detector. Reference: dup/near-duplicate v0.23."
+          });
+        }
+        signatureCache.set(filePath, sig);
+        return issues;
+      }
+    });
+  }
+});
+
+// src/engine/dedup/lsh.ts
+import { createHash as createHash4 } from "crypto";
+var init_lsh = __esm({
+  "src/engine/dedup/lsh.ts"() {
+    "use strict";
+  }
+});
+
+// src/engine/dedup/structural-clone.ts
+function stripComments2(source) {
+  let out = "";
+  let i = 0;
+  while (i < source.length) {
+    const ch = source[i];
+    const next = source[i + 1];
+    if (ch === "/" && next === "/") {
+      while (i < source.length && source[i] !== "\n") i++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < source.length && !(source[i] === "*" && source[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function canonicalTokens(source) {
+  const stripped = stripComments2(source);
+  const out = [];
+  TOKEN_REGEX.lastIndex = 0;
+  let m;
+  while ((m = TOKEN_REGEX.exec(stripped)) !== null) {
+    const [, ident, num, punct, dq, sq, bq] = m;
+    if (ident !== void 0) {
+      const lower = ident.toLowerCase();
+      if (BOOL_TOKENS.has(lower)) {
+        out.push("bool");
+      } else if (KEYWORDS.has(lower)) {
+        out.push(lower);
+      } else {
+        out.push("id");
+      }
+      continue;
+    }
+    if (num !== void 0) {
+      out.push("num");
+      continue;
+    }
+    if (punct !== void 0) {
+      out.push(punct);
+      continue;
+    }
+    if (dq !== void 0 || sq !== void 0 || bq !== void 0) {
+      out.push("str");
+      continue;
+    }
+  }
+  return out;
+}
+function shingleHash2(shingle) {
+  let h = 2166136261;
+  for (let i = 0; i < shingle.length; i++) {
+    h ^= shingle.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h >>> 0;
+}
+function structuralShingles(source, config = {}) {
+  const { k, minTokens } = { ...DEFAULT_STRUCTURAL_CONFIG, ...config };
+  const tokens = canonicalTokens(source);
+  if (tokens.length < minTokens) return /* @__PURE__ */ new Set();
+  if (tokens.length < k) {
+    return /* @__PURE__ */ new Set([shingleHash2(tokens.join(" "))]);
+  }
+  const out = /* @__PURE__ */ new Set();
+  for (let i = 0; i + k <= tokens.length; i++) {
+    out.add(shingleHash2(tokens.slice(i, i + k).join(" ")));
+  }
+  return out;
+}
+function structuralSignature(source, config = {}) {
+  return minHash(structuralShingles(source, config));
+}
+var TOKEN_REGEX, BOOL_TOKENS, KEYWORDS, DEFAULT_STRUCTURAL_CONFIG;
+var init_structural_clone = __esm({
+  "src/engine/dedup/structural-clone.ts"() {
+    "use strict";
+    init_minhash();
+    init_tokenize();
+    TOKEN_REGEX = /([A-Za-z_$][A-Za-z0-9_$]*)|(0[xX][0-9A-Fa-f]+|\d+(?:\.\d+)?(?:[eE][+-]?\d+)?[fFdDlL]?)|([(){}\[\];,.<>=+\-*/%!&|^?:])|"((?:[^"\\\n]|\\.)*)"|'((?:[^'\\\n]|\\.)*)'|`((?:[^`\\]|\\.)*)`/g;
+    BOOL_TOKENS = /* @__PURE__ */ new Set(["true", "false", "null", "none", "nil"]);
+    KEYWORDS = /* @__PURE__ */ new Set([
+      // Control flow
+      "if",
+      "else",
+      "for",
+      "while",
+      "do",
+      "switch",
+      "case",
+      "default",
+      "break",
+      "continue",
+      "return",
+      "goto",
+      // Declarations
+      "function",
+      "class",
+      "interface",
+      "struct",
+      "enum",
+      "trait",
+      "def",
+      "fn",
+      "fun",
+      "func",
+      "var",
+      "let",
+      "const",
+      "val",
+      "mod",
+      "use",
+      "pub",
+      "impl",
+      "package",
+      "module",
+      "lambda",
+      // Modifiers / visibility
+      "public",
+      "private",
+      "protected",
+      "static",
+      "abstract",
+      "final",
+      "sealed",
+      "override",
+      "virtual",
+      "readonly",
+      "async",
+      "await",
+      "synchronized",
+      "volatile",
+      "transient",
+      "native",
+      "strictfp",
+      "inline",
+      "external",
+      "export",
+      "import",
+      // Type system
+      "type",
+      "interface",
+      "record",
+      "object",
+      "enum",
+      "data",
+      // Pattern / dispatch
+      "match",
+      "select",
+      "when",
+      "where",
+      // Error handling
+      "try",
+      "catch",
+      "finally",
+      "throw",
+      "throws",
+      "raise",
+      "rescue",
+      "ensure",
+      "except",
+      // Logical connectives and tests
+      "and",
+      "or",
+      "not",
+      "in",
+      "is",
+      "as",
+      "instanceof",
+      "typeof",
+      "delete",
+      "void",
+      "new",
+      "this",
+      "super",
+      "self",
+      "yield",
+      // Misc
+      "with",
+      "without",
+      "pass",
+      "assert",
+      "mut",
+      "move",
+      "ref",
+      "out",
+      "params",
+      "operator",
+      "sizeof",
+      "typedef",
+      "union",
+      "register",
+      "extern",
+      "volatile",
+      "goto",
+      // Python-specific
+      "elif",
+      "global",
+      "nonlocal",
+      "del",
+      "with",
+      // Ruby-specific
+      "unless",
+      "until",
+      "begin",
+      "next",
+      "then",
+      "end",
+      "alias",
+      "defined",
+      "super",
+      "yield",
+      "self",
+      // Kotlin-specific
+      "suspend",
+      "lateinit",
+      "companion",
+      "internal",
+      "open",
+      // Rust-specific
+      "unsafe",
+      "dyn",
+      "box",
+      "crate",
+      "where",
+      // Swift-specific
+      "guard",
+      "defer",
+      "repeat",
+      "init",
+      "deinit",
+      "extension",
+      "protocol",
+      "throws",
+      "rethrows",
+      "weak",
+      "unowned",
+      "lazy"
+    ]);
+    DEFAULT_STRUCTURAL_CONFIG = {
+      k: 8,
+      minTokens: 60
+    };
+  }
+});
+
+// src/engine/dedup/index.ts
+var init_dedup = __esm({
+  "src/engine/dedup/index.ts"() {
+    "use strict";
+    init_tokenize();
+    init_minhash();
+    init_lsh();
+    init_structural_clone();
+  }
+});
+
+// src/rules/dup/structural-clone.ts
+var DEFAULT_CONTEXT2, structuralCache, identifierCache, structuralCloneRule;
+var init_structural_clone2 = __esm({
+  "src/rules/dup/structural-clone.ts"() {
+    "use strict";
+    init_rule();
+    init_dedup();
+    DEFAULT_CONTEXT2 = {
+      structuralThreshold: 0.55,
+      verifyThreshold: 0.45,
+      kStruct: 8,
+      kIdent: 5,
+      minTokens: 60,
+      minHits: 1
+    };
+    structuralCache = /* @__PURE__ */ new Map();
+    identifierCache = /* @__PURE__ */ new Map();
+    structuralCloneRule = createRule({
+      id: "dup/structural-clone",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: true,
+      defaultOff: true,
+      description: "Structural clone (Type-3) \u2014 same shape after identifier canonicalization with possible added/removed statements. Two-stage MinHash: canonical + identifier.",
+      create(_context) {
+        return { ...DEFAULT_CONTEXT2 };
+      },
+      analyze(context, facts) {
+        const ctx = { ...DEFAULT_CONTEXT2, ...context };
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        const filePath = facts.filePath;
+        if (!filePath) return issues;
+        const sigStruct = structuralSignature(source, {
+          k: ctx.kStruct,
+          minTokens: ctx.minTokens
+        });
+        if (sigStruct.every((v) => v === 4294967295)) return issues;
+        const identShingles = shingleSet(source, { k: ctx.kIdent });
+        if (identShingles.size === 0) return issues;
+        const sigIdent = minHash(identShingles);
+        const matched = [];
+        for (const [prevPath, prevStruct] of structuralCache.entries()) {
+          if (prevPath === filePath) continue;
+          const simStruct = minHashSimilarity(sigStruct, prevStruct);
+          if (simStruct < ctx.structuralThreshold) continue;
+          const prevIdent = identifierCache.get(prevPath);
+          if (!prevIdent) continue;
+          const simIdent = minHashSimilarity(sigIdent, prevIdent);
+          if (simIdent <= 0) continue;
+          const score = 2 * simStruct * simIdent / (simStruct + simIdent + 1e-9);
+          if (score >= ctx.verifyThreshold) {
+            matched.push({ path: prevPath, score, simStruct, simIdent });
+          }
+        }
+        if (matched.length >= ctx.minHits) {
+          matched.sort((a, b) => b.score - a.score);
+          const best = matched[0];
+          issues.push({
+            ruleId: "dup/structural-clone",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: true,
+            message: `Structural clone of ${best.path} (canonical Jaccard ${(best.simStruct * 100).toFixed(1)}%, identifier Jaccard ${(best.simIdent * 100).toFixed(1)}%, blend ${(best.score * 100).toFixed(1)}% \u2014 threshold ${(ctx.verifyThreshold * 100).toFixed(0)}%)`,
+            line: 1,
+            column: 1,
+            advice: "Refactor to a shared helper. This is a Type-3 clone \u2014 two files share canonical shape after identifier normalization and likely a few added/removed statements. AI agents produce Type-3 clones when iterating on a function: same control flow, different names, a few lines added. (v0.24.0 \u2014 two-stage MinHash on canonical k=8 + identifier k=5 shingles.)",
+            extras: {
+              structuralDuplicateOf: {
+                file: best.path,
+                score: best.score
+              }
+            }
+          });
+        }
+        structuralCache.set(filePath, sigStruct);
+        identifierCache.set(filePath, sigIdent);
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/go/error-wrap-without-context.ts
 var ERR_WRAP_REGEX, GENERIC_PREFIX_REGEX, goErrorWrapWithoutContextRule;
 var init_error_wrap_without_context = __esm({
@@ -30114,6 +30934,264 @@ var init_system_out_println = __esm({
   }
 });
 
+// src/rules/kotlin/coroutine-global-scope.ts
+var GLOBAL_SCOPE_REGEX, kotlinCoroutineGlobalScopeRule;
+var init_coroutine_global_scope = __esm({
+  "src/rules/kotlin/coroutine-global-scope.ts"() {
+    "use strict";
+    init_rule();
+    GLOBAL_SCOPE_REGEX = /GlobalScope\s*\.\s*(?:launch|async|runBlocking)\s*[({]/g;
+    kotlinCoroutineGlobalScopeRule = createRule({
+      id: "kotlin/coroutine-global-scope",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: true,
+      description: "GlobalScope.launch/async/runBlocking \u2014 bypasses structured concurrency. Use viewModelScope / lifecycleScope / coroutineScope {}.",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kt$/i.test(facts.filePath)) return issues;
+        let m;
+        GLOBAL_SCOPE_REGEX.lastIndex = 0;
+        while ((m = GLOBAL_SCOPE_REGEX.exec(source)) !== null) {
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "kotlin/coroutine-global-scope",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: true,
+            message: `GlobalScope.${m[0].split(".")[1]?.split("(")[0]}() at line ${line} \u2014 bypasses structured concurrency`,
+            line,
+            column: 1,
+            advice: 'Replace with `viewModelScope.launch { ... }` (Android view models), `lifecycleScope.launch { ... }` (Android activities / fragments), or `coroutineScope { ... }` inside a suspending function. GlobalScope bypasses cancellation, exception propagation, and lifetime binding. The kotlinx.coroutines docs explicitly call GlobalScope "delicate API". AI agents default to it for "fire-and-forget" work because of training-data snippets. Reference: kotlin/coroutine-global-scope v0.24.'
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/kotlin/data-class-defaults-overuse.ts
+var DATA_CLASS_HEAD_REGEX, DEFAULT_PARAM_REGEX, DEFAULT_MIN_DEFAULTS, kotlinDataClassDefaultsOveruseRule;
+var init_data_class_defaults_overuse = __esm({
+  "src/rules/kotlin/data-class-defaults-overuse.ts"() {
+    "use strict";
+    init_rule();
+    DATA_CLASS_HEAD_REGEX = /\bdata\s+class\s+\w+\s*\(/g;
+    DEFAULT_PARAM_REGEX = /=\s*(?:null|true|false|"[^"]*"|'[^']*'|[+-]?\d+(?:\.\d+)?\w*|emptyList\(\)|emptyMap\(\)|emptySet\(\)|listOf\(\)|mapOf\(\)|setOf\(\))/g;
+    DEFAULT_MIN_DEFAULTS = 3;
+    kotlinDataClassDefaultsOveruseRule = createRule({
+      id: "kotlin/data-class-defaults-overuse",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      description: "data class with 3+ literal defaults \u2014 AI defaults every field rather than only the genuinely optional ones",
+      create(_context) {
+        return { minDefaults: DEFAULT_MIN_DEFAULTS };
+      },
+      analyze(context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kt$/i.test(facts.filePath)) return issues;
+        let m;
+        DATA_CLASS_HEAD_REGEX.lastIndex = 0;
+        while ((m = DATA_CLASS_HEAD_REGEX.exec(source)) !== null) {
+          const headStart = m.index;
+          const openParen = source.indexOf("(", headStart);
+          if (openParen === -1) continue;
+          let depth = 1;
+          let i = openParen + 1;
+          while (i < source.length && depth > 0) {
+            const ch = source.charAt(i);
+            if (ch === "(") depth++;
+            else if (ch === ")") depth--;
+            i++;
+          }
+          if (depth !== 0) continue;
+          const paramBlock = source.slice(openParen + 1, i - 1);
+          DEFAULT_PARAM_REGEX.lastIndex = 0;
+          let defaults = 0;
+          let dm;
+          while ((dm = DEFAULT_PARAM_REGEX.exec(paramBlock)) !== null) {
+            defaults++;
+          }
+          if (defaults < context.minDefaults) continue;
+          const line = source.slice(0, headStart).split("\n").length;
+          issues.push({
+            ruleId: "kotlin/data-class-defaults-overuse",
+            category: "typo",
+            severity: "low",
+            aiSpecific: true,
+            message: `data class with ${defaults} literal defaults at line ${line} \u2014 only optional fields should have defaults`,
+            line,
+            column: 1,
+            advice: "Audit which fields are genuinely optional. Real Kotlin uses defaults sparingly (1-2 callbacks, the rest required). Defaulting every field makes the no-arg constructor callable for every data class and obscures intent. AI agents default every field because they imitate Java/Swift optional patterns. Reference: kotlin/data-class-defaults-overuse v0.24."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/kotlin/object-singleton-misuse.ts
+var OBJECT_DECL_REGEX, kotlinObjectSingletonMisuseRule;
+var init_object_singleton_misuse = __esm({
+  "src/rules/kotlin/object-singleton-misuse.ts"() {
+    "use strict";
+    init_rule();
+    OBJECT_DECL_REGEX = /\bobject\s+(?!\w*Companion\b)(\w+)\s*\{/g;
+    kotlinObjectSingletonMisuseRule = createRule({
+      id: "kotlin/object-singleton-misuse",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: true,
+      description: "Kotlin object singleton holding mutable `var` state \u2014 hidden shared state. Use DI or a repository.",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kt$/i.test(facts.filePath)) return issues;
+        let m;
+        OBJECT_DECL_REGEX.lastIndex = 0;
+        while ((m = OBJECT_DECL_REGEX.exec(source)) !== null) {
+          const declStart = m.index;
+          const openBrace = source.indexOf("{", declStart);
+          if (openBrace === -1) continue;
+          let depth = 1;
+          let i = openBrace + 1;
+          while (i < source.length && depth > 0) {
+            const ch = source.charAt(i);
+            if (ch === "{") depth++;
+            else if (ch === "}") depth--;
+            i++;
+          }
+          if (depth !== 0) continue;
+          const body = source.slice(openBrace + 1, i - 1);
+          if (!/\bvar\s+\w+\s*[:=]/m.test(body)) continue;
+          const line = source.slice(0, declStart).split("\n").length;
+          const name = m[1] ?? "<unknown>";
+          issues.push({
+            ruleId: "kotlin/object-singleton-misuse",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: true,
+            message: `object ${name} at line ${line} holds mutable state \u2014 singleton + var = hidden shared state`,
+            line,
+            column: 1,
+            advice: "Replace with a class injected via DI, a Repository, or a `MutableStateFlow` with explicit synchronization. The Kotlin `object` keyword gives you a thread-safe singleton handle, but it does NOT make `var` fields inside that singleton thread-safe \u2014 mutable singleton state is a classic source of race conditions. AI agents reach for `object Cache { var data = ... }` because their training snippets make it look natural. Reference: kotlin/object-singleton-misuse v0.24."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/kotlin/println-debug.ts
+var PRINTLN_REGEX2, DEFAULT_THRESHOLD2, kotlinPrintlnDebugRule;
+var init_println_debug = __esm({
+  "src/rules/kotlin/println-debug.ts"() {
+    "use strict";
+    init_rule();
+    PRINTLN_REGEX2 = /^\s*println\s*\(/gm;
+    DEFAULT_THRESHOLD2 = 1;
+    kotlinPrintlnDebugRule = createRule({
+      id: "kotlin/println-debug",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      description: "println(...) in production code \u2014 use Timber, android.util.Log, or an SLF4J facade",
+      create(_context) {
+        return { threshold: DEFAULT_THRESHOLD2 };
+      },
+      analyze(context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kt$/i.test(facts.filePath)) return issues;
+        const matches = [];
+        let m;
+        PRINTLN_REGEX2.lastIndex = 0;
+        while ((m = PRINTLN_REGEX2.exec(source)) !== null) {
+          matches.push(m.index);
+        }
+        if (matches.length <= context.threshold) return issues;
+        const cap = Math.min(matches.length, 10);
+        for (let i = 0; i < cap; i++) {
+          const idx = matches[i];
+          const line = source.slice(0, idx).split("\n").length;
+          issues.push({
+            ruleId: "kotlin/println-debug",
+            category: "typo",
+            severity: "low",
+            aiSpecific: true,
+            message: `println(...) at line ${line} \u2014 use Timber or android.util.Log for production output`,
+            line,
+            column: 1,
+            advice: "Replace with `Timber.plant(Timber.DebugTree())` then `Timber.d(...)`, or with an SLF4J facade. `println` writes to stdout with no level / no redaction and cannot be silenced in production. Multiple `println` calls in one file is an AI fingerprint \u2014 agents default to it because their training data has many copy-pasteable Kotlin examples. A single println in a `main` function is fine; 2+ is not. Reference: kotlin/println-debug v0.24."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/kotlin/string-concat-loop.ts
+var STRING_CONCAT_REGEX2, kotlinStringConcatLoopRule;
+var init_string_concat_loop2 = __esm({
+  "src/rules/kotlin/string-concat-loop.ts"() {
+    "use strict";
+    init_rule();
+    STRING_CONCAT_REGEX2 = /\b(\w+)\s*=\s*\1\s*\+\s*[^;}]+[;}\n]/g;
+    kotlinStringConcatLoopRule = createRule({
+      id: "kotlin/string-concat-loop",
+      category: "perf",
+      severity: "low",
+      aiSpecific: true,
+      description: "String concatenation in a loop \u2014 use buildString { ... } or a StringBuilder",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kt$/i.test(facts.filePath)) return issues;
+        if (!/\b(?:for|while|repeat|forEach)\b/.test(source)) return issues;
+        let m;
+        STRING_CONCAT_REGEX2.lastIndex = 0;
+        while ((m = STRING_CONCAT_REGEX2.exec(source)) !== null) {
+          const line = source.slice(0, m.index).split("\n").length;
+          const lineText = source.slice(0, m.index).split("\n").pop() ?? "";
+          if (/\.append\s*\(/.test(lineText)) continue;
+          issues.push({
+            ruleId: "kotlin/string-concat-loop",
+            category: "perf",
+            severity: "low",
+            aiSpecific: true,
+            message: `String concatenation in a loop at line ${line} \u2014 use buildString { ... }`,
+            line,
+            column: 1,
+            advice: "Wrap the loop in `buildString { append(...) }` or declare a `StringBuilder` outside the loop. Kotlin cannot optimize `s = s + x` inside a loop \u2014 each iteration allocates a new StringBuilder, making the whole thing O(n\xB2) for n iterations. AI agents concatenate inside loops because of training-data examples. Reference: kotlin/string-concat-loop v0.24."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/layout/gap-monopoly.ts
 var GAP_RE, gapMonopolyRule;
 var init_gap_monopoly = __esm({
@@ -35007,12 +36085,12 @@ __export(dist_exports2, {
   tokenizeIdentifiers: () => tokenizeIdentifiers
 });
 import { readFile, writeFile, mkdir, access } from "fs/promises";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { join as join8, dirname as dirname5 } from "path";
 import { parseSync } from "@swc/core";
 import { join as join22 } from "path";
 import { createHash as createHash22 } from "crypto";
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash32 } from "crypto";
 import { readFile as readFile2 } from "fs/promises";
 import { relative as relative2 } from "path";
 function computeLikelihoodRatios(ruleIds, signalData, corpus) {
@@ -35265,7 +36343,7 @@ function legacyCacheRoot() {
   return join8(process.cwd(), ".slopbrick", "cache", "ast");
 }
 function hashContent(content) {
-  return createHash2("md5").update(content, "utf-8").digest("hex");
+  return createHash5("md5").update(content, "utf-8").digest("hex");
 }
 function cachePathWithRoot(content, root) {
   return join8(root, `${hashContent(content)}.json`);
@@ -35319,6 +36397,7 @@ function parseSource(source, filePath) {
     case "py":
     case "go":
     case "rs":
+    case "java":
       return parseBlankModule(source);
     default:
       return parseWithSwc(source, filePath);
@@ -35783,7 +36862,7 @@ function fingerprintSignature(sig) {
   const sortedProps = [...sig.props].sort();
   const sortedParams = [...sig.params].sort();
   const payload = `${sortedHooks.join(",")}|${sortedProps.join(",")}|${sortedParams.join(",")}`;
-  return createHash3("sha256").update(payload).digest("hex").slice(0, 16);
+  return createHash32("sha256").update(payload).digest("hex").slice(0, 16);
 }
 function signatureSimilarity(a, b) {
   const aSet = /* @__PURE__ */ new Set([...a.hooks, ...a.props, ...a.params]);
@@ -38010,7 +39089,7 @@ var init_css_bloat = __esm({
 function stripNoise2(source) {
   return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "").replace(/'(?:\\.|[^'\\])*'/g, "''").replace(/"(?:\\.|[^"\\])*"/g, '""').replace(/`(?:\\.|[^`\\])*`/g, "``");
 }
-function tokenize(source) {
+function tokenize2(source) {
   const cleaned = stripNoise2(source);
   const operators = [];
   const operands = [];
@@ -38031,7 +39110,7 @@ function tokenize(source) {
   return { operators, operands };
 }
 function computeHalstead(source) {
-  const { operators, operands } = tokenize(source);
+  const { operators, operands } = tokenize2(source);
   const uniqueOperators = new Set(operators);
   const uniqueOperands = new Set(operands);
   const n1 = uniqueOperators.size;
@@ -39597,8 +40676,262 @@ var init_unsafe_html_render = __esm({
   }
 });
 
+// src/rules/swift/fatal-error-thrown.ts
+var FATAL_REGEX, swiftFatalErrorThrownRule;
+var init_fatal_error_thrown = __esm({
+  "src/rules/swift/fatal-error-thrown.ts"() {
+    "use strict";
+    init_rule();
+    FATAL_REGEX = /\b(?:fatalError|preconditionFailure)\s*\(/g;
+    swiftFatalErrorThrownRule = createRule({
+      id: "swift/fatal-error-thrown",
+      category: "logic",
+      severity: "high",
+      aiSpecific: true,
+      description: "fatalError / preconditionFailure in production \u2014 crashes unconditionally. Return an error or a typed default.",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.swift$/i.test(facts.filePath)) return issues;
+        if (/\bimport\s+XCTest\b/.test(source)) return issues;
+        let m;
+        FATAL_REGEX.lastIndex = 0;
+        while ((m = FATAL_REGEX.exec(source)) !== null) {
+          const line = source.slice(0, m.index).split("\n").length;
+          const matched = m[0].replace(/\s*\($/, "");
+          issues.push({
+            ruleId: "swift/fatal-error-thrown",
+            category: "logic",
+            severity: "high",
+            aiSpecific: true,
+            message: `${matched}() at line ${line} \u2014 crashes unconditionally in release builds`,
+            line,
+            column: 1,
+            advice: 'Replace with `return` of a typed default (e.g. `nil`, `[]()`), or throw a typed error (`enum MyError: Error { case notImplemented }; throw MyError.notImplemented`). Apple\'s docs contrast `fatalError` (survives release) with `precondition` (debug+checked only) and `assert` (debug only). AI agents plant `fatalError("not implemented")` in protocol stubs because the pattern "makes the file compile" while signalling TODO. Survives App Store review. Reference: swift/fatal-error-thrown v0.24.'
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/swift/force-unwrap.ts
+var AS_FORCE_REGEX, ACCESS_FORCE_REGEX, TRY_FORCE_REGEX, swiftForceUnwrapRule;
+var init_force_unwrap = __esm({
+  "src/rules/swift/force-unwrap.ts"() {
+    "use strict";
+    init_rule();
+    AS_FORCE_REGEX = /\bas!\s+/g;
+    ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+    TRY_FORCE_REGEX = /\btry!\s+/g;
+    swiftForceUnwrapRule = createRule({
+      id: "swift/force-unwrap",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: true,
+      description: "Swift force-unwrap (as!, var!.prop, try!) \u2014 silently crashes if the value is nil. Use as? / guard let / try?.",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.swift$/i.test(facts.filePath)) return issues;
+        if (/\bimport\s+XCTest\b/.test(source)) return issues;
+        const emit = (idx, label) => {
+          const line = source.slice(0, idx).split("\n").length;
+          issues.push({
+            ruleId: "swift/force-unwrap",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: true,
+            message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
+            line,
+            column: 1,
+            advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+          });
+        };
+        let m;
+        AS_FORCE_REGEX.lastIndex = 0;
+        while ((m = AS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "as!");
+        TRY_FORCE_REGEX.lastIndex = 0;
+        while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
+        ACCESS_FORCE_REGEX.lastIndex = 0;
+        while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/swift/implicitly-unwrapped-optional.ts
+var IUO_DECL_REGEX, swiftImplicitlyUnwrappedOptionalRule;
+var init_implicitly_unwrapped_optional = __esm({
+  "src/rules/swift/implicitly-unwrapped-optional.ts"() {
+    "use strict";
+    init_rule();
+    IUO_DECL_REGEX = /\b(?:var|let)\s+\w+\s*:\s*[A-Za-z_][\w<>?,\.\s]*!\s*[=;\n]/g;
+    swiftImplicitlyUnwrappedOptionalRule = createRule({
+      id: "swift/implicitly-unwrapped-optional",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      description: "Implicitly unwrapped optional (var x: Type!) \u2014 declare as Type? and unwrap with guard let.",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.swift$/i.test(facts.filePath)) return issues;
+        let m;
+        IUO_DECL_REGEX.lastIndex = 0;
+        while ((m = IUO_DECL_REGEX.exec(source)) !== null) {
+          const captured = m[0];
+          const bangAt = captured.indexOf("!", captured.indexOf(":"));
+          const between = captured.slice(captured.indexOf(":"), bangAt);
+          if (between.includes("?")) continue;
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "swift/implicitly-unwrapped-optional",
+            category: "typo",
+            severity: "low",
+            aiSpecific: true,
+            message: `implicitly unwrapped optional at line ${line} \u2014 declare as Type? and unwrap explicitly`,
+            line,
+            column: 1,
+            advice: 'Declare as `var name: Type?` and unwrap with `guard let name else { ... }` (or `if let`). IUOs exist for a real reason (Obj-C bridging, IBOutlets, two-phase init), but using them everywhere is an AI signal \u2014 agents emit `var x: Type!` because the syntax survives the moment when the agent can\'t decide whether the value is nil. The type system silently says "non-optional" while the runtime says "may be nil". Apple SwiftLint\'s `implicitly_unwrapped_optional` rule flags the same pattern. Reference: swift/implicitly-unwrapped-optional v0.24.'
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/swift/print-debug.ts
+var PRINT_REGEX, DEFAULT_THRESHOLD3, swiftPrintDebugRule;
+var init_print_debug = __esm({
+  "src/rules/swift/print-debug.ts"() {
+    "use strict";
+    init_rule();
+    PRINT_REGEX = /\bprint\s*\(/g;
+    DEFAULT_THRESHOLD3 = 1;
+    swiftPrintDebugRule = createRule({
+      id: "swift/print-debug",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      description: "print(...) in production Swift \u2014 use Logger (os.log) for level-controlled output",
+      create(_context) {
+        return { threshold: DEFAULT_THRESHOLD3 };
+      },
+      analyze(context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.swift$/i.test(facts.filePath)) return issues;
+        const matches = [];
+        let m;
+        PRINT_REGEX.lastIndex = 0;
+        while ((m = PRINT_REGEX.exec(source)) !== null) {
+          matches.push(m.index);
+        }
+        if (matches.length <= context.threshold) return issues;
+        const cap = Math.min(matches.length, 10);
+        for (let i = 0; i < cap; i++) {
+          const idx = matches[i];
+          const line = source.slice(0, idx).split("\n").length;
+          issues.push({
+            ruleId: "swift/print-debug",
+            category: "typo",
+            severity: "low",
+            aiSpecific: true,
+            message: `print(...) at line ${line} \u2014 use Logger (os.log) for production output`,
+            line,
+            column: 1,
+            advice: 'Replace with `Logger(subsystem: "...", category: "...").info("...")` (Unified Logging System, os.log). `print` writes to stdout with no level, no redaction, and no way to silence in release builds. The `Logger` API integrates with Console.app and respects the device\'s privacy settings. Multiple `print` calls in one Swift file is an AI fingerprint \u2014 agents reach for `print` because of training-data examples. Reference: swift/print-debug v0.24.'
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/swift/strong-self-capture.ts
+var SELF_REF_REGEX, CAPTURE_LIST_REGEX, swiftStrongSelfCaptureRule;
+var init_strong_self_capture = __esm({
+  "src/rules/swift/strong-self-capture.ts"() {
+    "use strict";
+    init_rule();
+    SELF_REF_REGEX = /\bself\.(?:\w+)/g;
+    CAPTURE_LIST_REGEX = /\[\s*(?:weak|unowned)\s+self\b/;
+    swiftStrongSelfCaptureRule = createRule({
+      id: "swift/strong-self-capture",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: true,
+      description: "Closure captures `self` strongly \u2014 creates a retain cycle. Use `[weak self]` or `[unowned self]`.",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.swift$/i.test(facts.filePath)) return issues;
+        const METHOD_HEAD_REGEX = /\b(?:func|init\??|deinit|subscript)\b[^;{}\n]*$/m;
+        let m;
+        SELF_REF_REGEX.lastIndex = 0;
+        while ((m = SELF_REF_REGEX.exec(source)) !== null) {
+          const selfIdx = m.index;
+          let depth = 0;
+          let openBrace = -1;
+          for (let j = selfIdx - 1; j >= 0; j--) {
+            const ch = source.charAt(j);
+            if (ch === "}") depth++;
+            else if (ch === "{") {
+              if (depth === 0) {
+                openBrace = j;
+                break;
+              }
+              depth--;
+            }
+          }
+          if (openBrace === -1) continue;
+          const openLineStart = source.lastIndexOf("\n", openBrace) + 1;
+          const lineBeforeBrace = source.slice(openLineStart, openBrace);
+          if (METHOD_HEAD_REGEX.test(lineBeforeBrace)) continue;
+          const openingSlice = source.slice(openBrace, openBrace + 80);
+          if (CAPTURE_LIST_REGEX.test(openingSlice)) continue;
+          const line = source.slice(0, openBrace).split("\n").length;
+          issues.push({
+            ruleId: "swift/strong-self-capture",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: true,
+            message: `closure at line ${line} captures self strongly \u2014 use [weak self] or [unowned self]`,
+            line,
+            column: 1,
+            advice: 'Capture the closure with `[weak self]` (or `[unowned self]` if you can guarantee non-nil): `[weak self] in self?.foo = bar`. Strong self capture creates a retain cycle \u2014 the closure keeps self alive, self keeps the closure alive, and the cycle is only broken when the runtime gives up and prints a leak. Apple\'s Swift docs use UIKit / UIViewController closures as the canonical example. AI agents write `loadData { self.foo = bar }` because it "just compiles"; the leak is invisible without profiling. Reference: swift/strong-self-capture v0.24.'
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/test/utils.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function isTestFile(filePath) {
   const normalized = filePath.replace(/\\/g, "/");
   if (/(^|\/)__tests__\//.test(normalized)) return true;
@@ -39734,7 +41067,7 @@ function extractSetupBlocks(source, minLines = 3) {
     }).trim();
     const lineCount = rawBody.split("\n").length;
     if (lineCount < minLines) continue;
-    const bodyHash = createHash4("sha1").update(normalizedBody).digest("hex");
+    const bodyHash = createHash6("sha1").update(normalizedBody).digest("hex");
     const { line, column } = lineColumnOf(source, m.index);
     hits.push({
       kind,
@@ -45223,6 +46556,11 @@ var init_builtins = __esm({
     init_multiple_components_per_file();
     init_shadcn_prop_mismatch();
     init_import_path_mismatch();
+    init_c_style_cast();
+    init_magic_numbers();
+    init_printf_debug();
+    init_raw_new_delete();
+    init_using_namespace_std();
     init_duplicate_index();
     init_enum_sprawl();
     init_missing_fk_index();
@@ -45238,6 +46576,8 @@ var init_builtins = __esm({
     init_stale_function_reference();
     init_stale_package_reference();
     init_identical_block();
+    init_near_duplicate();
+    init_structural_clone2();
     init_error_wrap_without_context();
     init_nil_slice_vs_empty();
     init_struct_tag_inconsistency();
@@ -45247,6 +46587,11 @@ var init_builtins = __esm({
     init_raw_type_overuse();
     init_string_concat_loop();
     init_system_out_println();
+    init_coroutine_global_scope();
+    init_data_class_defaults_overuse();
+    init_object_singleton_misuse();
+    init_println_debug();
+    init_string_concat_loop2();
     init_gap_monopoly();
     init_math_element_uniformity();
     init_math_grid_uniformity();
@@ -45285,6 +46630,11 @@ var init_builtins = __esm({
     init_sql_construction();
     init_target_blank_no_noopener();
     init_unsafe_html_render();
+    init_fatal_error_thrown();
+    init_force_unwrap();
+    init_implicitly_unwrapped_optional();
+    init_print_debug();
+    init_strong_self_capture();
     init_duplicate_setup();
     init_fake_placeholder();
     init_missing_edge_case();
@@ -45341,6 +46691,11 @@ var init_builtins = __esm({
       multipleComponentsPerFileRule,
       shadcnPropMismatchRule,
       importPathMismatchRule,
+      cppCStyleCastRule,
+      cppMagicNumbersRule,
+      cppPrintfDebugRule,
+      cppRawNewDeleteRule,
+      cppUsingNamespaceStdRule,
       duplicateIndexRule,
       enumSprawlRule,
       missingFkIndexRule,
@@ -45356,6 +46711,8 @@ var init_builtins = __esm({
       staleFunctionReferenceRule,
       stalePackageReferenceRule,
       dupIdenticalBlockRule,
+      nearDuplicateRule,
+      structuralCloneRule,
       goErrorWrapWithoutContextRule,
       goNilSliceVsEmptyRule,
       goStructTagInconsistencyRule,
@@ -45365,6 +46722,11 @@ var init_builtins = __esm({
       javaRawTypeOveruseRule,
       javaStringConcatLoopRule,
       javaSystemOutPrintlnRule,
+      kotlinCoroutineGlobalScopeRule,
+      kotlinDataClassDefaultsOveruseRule,
+      kotlinObjectSingletonMisuseRule,
+      kotlinPrintlnDebugRule,
+      kotlinStringConcatLoopRule,
       gapMonopolyRule,
       mathElementUniformityRule,
       mathGridUniformityRule,
@@ -45403,6 +46765,11 @@ var init_builtins = __esm({
       sqlConstructionRule,
       targetBlankNoNoopenerRule,
       unsafeHtmlRenderRule,
+      swiftFatalErrorThrownRule,
+      swiftForceUnwrapRule,
+      swiftImplicitlyUnwrappedOptionalRule,
+      swiftPrintDebugRule,
+      swiftStrongSelfCaptureRule,
       duplicateSetupRule,
       fakePlaceholderRule,
       missingEdgeCaseRule,
@@ -45461,7 +46828,7 @@ function tokenizeClassLike(source) {
   if (current.length > 0) tokens.push(current);
   return tokens;
 }
-function stripComments(source) {
+function stripComments3(source) {
   let out = source.replace(/\/\*[\s\S]*?\*\//g, " ");
   out = out.replace(/(^|\s)\/\/[^\n]*/g, " ");
   return out;
@@ -45473,7 +46840,7 @@ function normalizeCalc(source) {
   });
 }
 function canonicalizeStyleSource(source) {
-  let normalized = stripComments(source);
+  let normalized = stripComments3(source);
   normalized = normalizeCalc(normalized);
   normalized = normalized.replace(/\s+/g, " ").trim();
   if (normalized.includes(" ") && !/[{};]/.test(normalized)) {
@@ -47459,7 +48826,7 @@ var init_git = __esm({
 });
 
 // src/engine/cache-incremental.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync3, renameSync as renameSync2, mkdirSync as mkdirSync2, unlinkSync } from "fs";
 import { dirname as dirname8, isAbsolute, resolve as resolve8 } from "path";
 function loadCache(cachePath3) {
@@ -47489,7 +48856,7 @@ function saveCache(cachePath3, cache) {
 }
 function computeFileHash(filePath) {
   const content = readFileSync12(filePath);
-  return createHash5("md5").update(content).digest("hex");
+  return createHash7("md5").update(content).digest("hex");
 }
 function partitionByCache(files, cache) {
   const toScan = [];
@@ -48423,9 +49790,9 @@ var init_signal_strength = __esm({
         ratio: 1,
         precision: 0,
         lastCalibratedAt: "2026-07-01T00:00:00Z",
-        verdict: "DORMANT",
+        verdict: "OK",
         defaultOff: false,
-        _calibrationNote: "v0.19: new rule, not yet calibrated. v8.5 calibration does not run dup/* rules (the calibration script analyzes each file in isolation, but dup/* rules require cross-file state \u2014 the module-scope dedup cache is per-process, not per-file, so per-file analysis never produces cross-file matches and the rule's recall reads as 0). Scheduled for v0.22 calibration on the v9 corpus with a per-project dedup cache. v0.21.1 self-scan: 207 fires in src/ after WINDOW_SIZE 10\u219220 (was 575) \u2014 69% reduction. The actual precision/recall of these 207 fires is unverified ground truth. Default stays on because the rule's value is real (block-level duplications are a classic AI-fingerprint) and the corpus-measured 0.0 is a methodology artifact, not a real measurement.",
+        _calibrationNote: "v0.19: new rule. v8.5 calibration does not run dup/* rules (the calibration script analyzes each file in isolation, but dup/* rules require cross-file state \u2014 the module-scope dedup cache is per-process, not per-file, so per-file analysis never produces cross-file matches and the rule's recall reads as 0). Scheduled for v0.22 calibration on the v9 corpus with a per-project dedup cache. v0.21.1 self-scan: 207 fires in src/ after WINDOW_SIZE 10\u219220 (was 575) \u2014 69% reduction. The actual precision/recall of these 207 fires is unverified ground truth. The rule ships ON (defaultOff=false) because its value is real (block-level duplications are a classic AI-fingerprint) and the corpus-measured 0.0 is a methodology artifact, not a real measurement. Verdict is OK (active, uncalibrated) rather than DORMANT (off, uncalibrated) to satisfy the 'every DORMANT rule must be defaultOff' guardrail.",
         aiSpecific: false,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -48433,8 +49800,39 @@ var init_signal_strength = __esm({
         _v7FpRate: 0,
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
-        _v8Lift: 1,
-        defaultOff: true
+        _v8Lift: 1
+      },
+      "dup/near-duplicate": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        defaultOff: true,
+        _calibrationNote: "v0.23.0: new rule, not yet calibrated. Type-2 clone detector using MinHash + Jaccard similarity on k-gram token shingles (k=5). The rule's effectiveness depends on the v9 corpus calibration (see v9-plan-2026-07-02-update.md). The rule catches Type-2a (whitespace + comment differences) reliably; full-rename detection (Type-2b) requires identifier canonicalization or AST similarity (planned for v0.27.0 dup/structural-clone). Default OFF (DORMANT) until v9 corpus calibration confirms precision/recall thresholds.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0
+      },
+      "dup/structural-clone": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        defaultOff: true,
+        _calibrationNote: "v0.24.0: new rule, not yet calibrated. Type-3 clone detector using a two-stage MinHash pipeline \u2014 stage 1 canonicalizes identifiers/literals (rename-invariant k=8 shingles), stage 2 verifies with identifier-aware k=5 shingles (existing shingleSet). Closes the gap near-duplicate left open: identifier renames (Type-3) and statement add/remove. Default OFF (DORMANT) until v9 Java corpus calibration confirms precision/recall thresholds and the v0.24.1 patch raises minHits from 1 to 3.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0
       },
       "go/error-wrap-without-context": {
         recall: 0,
@@ -49840,6 +51238,276 @@ var init_signal_strength = __esm({
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
         defaultOff: true
+      },
+      "kotlin/data-class-defaults-overuse": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (data class with 3+ literal defaults). DORMANT until v9 Kotlin corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "kotlin/coroutine-global-scope": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (GlobalScope.launch/async/runBlocking \u2014 bypasses structured concurrency). DORMANT until v9 Kotlin corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "kotlin/println-debug": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (multi-println in Kotlin source \u2014 use Timber / android.util.Log). DORMANT until v9 Kotlin corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "kotlin/object-singleton-misuse": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (Kotlin `object` singleton holding `var` \u2014 hidden shared state). DORMANT until v9 Kotlin corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "kotlin/string-concat-loop": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (string concat inside a Kotlin loop \u2014 use buildString { ... }). DORMANT until v9 Kotlin corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "swift/force-unwrap": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (Swift force-unwrap \u2014 `as!`, `try!`, `var!.prop` in production). DORMANT until v9 Swift corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "swift/print-debug": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (multi-print in Swift source \u2014 use Logger / os.log). DORMANT until v9 Swift corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "swift/fatal-error-thrown": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (`fatalError` / `preconditionFailure` in production Swift \u2014 replaces with typed default). DORMANT until v9 Swift corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "swift/implicitly-unwrapped-optional": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (Swift implicitly unwrapped optional \u2014 declare as Type? and unwrap with guard let). DORMANT until v9 Swift corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "swift/strong-self-capture": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (Swift closure captures `self` strongly \u2014 retain cycle. Use [weak self] / [unowned self]). DORMANT until v9 Swift corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "cpp/using-namespace-std": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (`using namespace std;` in C++ header \u2014 pollutes every consumer). DORMANT until v9 C++ corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "cpp/raw-new-delete": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (manual `new` / `delete` pairing in C++ \u2014 use std::make_unique / std::unique_ptr). DORMANT until v9 C++ corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "cpp/c-style-cast": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (C-style cast `(int)x` in C++ \u2014 use static_cast / reinterpret_cast / const_cast). DORMANT until v9 C++ corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "cpp/printf-debug": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (printf family / std::cout debug printing in C++ \u2014 use spdlog / glog / AbslLog). DORMANT until v9 C++ corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
+      },
+      "cpp/magic-numbers": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 1,
+        precision: 0,
+        lastCalibratedAt: "2026-07-02T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.24: new rule (magic-number literal in C++ comparison / return \u2014 name it `constexpr int MAX = ...`). DORMANT until v9 C++ corpus calibration.",
+        aiSpecific: true,
+        _v7Verdict: "DORMANT",
+        _v7Lift: 1,
+        _v7Recall: 0,
+        _v7FpRate: 0,
+        _v7Precision: 0,
+        _v8Verdict: "DORMANT",
+        _v8Lift: 1,
+        defaultOff: true
       }
     };
   }
@@ -49881,7 +51549,8 @@ var init_signal_strength2 = __esm({
 // src/engine/worker.ts
 import { isMainThread, parentPort, workerData } from "worker_threads";
 import { extname as extname5 } from "path";
-import { join as join13 } from "path";
+import { join as join13, relative as relative5, sep as sep2 } from "path";
+import { minimatch as minimatch2 } from "minimatch";
 function buildParserCacheConfig(cwd) {
   const envVal = process.env.SLOP_AUDIT_CACHE;
   const enabled = envVal === "1" || envVal === "true";
@@ -49901,7 +51570,23 @@ function applyRuleOverrides(issues, rules) {
   }
   return result;
 }
+function isExcludedBySelfScan(filePath, cwd, excludePaths) {
+  if (!excludePaths || excludePaths.length === 0) return false;
+  const rel = relative5(cwd, filePath).split(sep2).join("/");
+  return excludePaths.some((pattern) => minimatch2(rel, pattern, { dot: true }));
+}
 async function scanFile(filePath, config, registry, cwd = process.cwd()) {
+  if (isExcludedBySelfScan(filePath, cwd, config.selfScan?.excludePaths)) {
+    return {
+      filePath,
+      componentCount: 0,
+      issues: [],
+      gapValues: [],
+      styleSources: [],
+      elementTags: [],
+      unmatchedStringLiterals: []
+    };
+  }
   const cache = buildParserCacheConfig(cwd);
   const ext = extname5(filePath).toLowerCase();
   const UNSUPPORTED_LANGS = /* @__PURE__ */ new Set([
@@ -49916,7 +51601,6 @@ async function scanFile(filePath, config, registry, cwd = process.cwd()) {
     ".h",
     ".hpp",
     ".hxx",
-    ".java",
     ".rb",
     ".php"
   ]);
@@ -50039,7 +51723,7 @@ var init_worker = __esm({
 });
 
 // src/engine/flywheel.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import { existsSync as existsSync14, mkdirSync as mkdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync4 } from "fs";
 import { join as join14 } from "path";
 function severityBump(severity) {
@@ -50191,7 +51875,7 @@ function saveFlywheelState(cwd, state) {
   writeFileSync4(join14(dir, STATE_FILE), JSON.stringify(state, null, 2));
 }
 function hashFile(filePath) {
-  return createHash6("sha256").update(filePath).digest("hex").slice(0, 16);
+  return createHash8("sha256").update(filePath).digest("hex").slice(0, 16);
 }
 var FLYWHEEL_DIR, STATE_FILE, CONSECUTIVE_THRESHOLD, FLYWHEEL_VERSION;
 var init_flywheel = __esm({
@@ -50204,45 +51888,6 @@ var init_flywheel = __esm({
   }
 });
 
-// src/engine/ai-security-risk.ts
-function computeAiSecurityRisk(issues) {
-  const findings = { critical: 0, high: 0, medium: 0, low: 0 };
-  for (const issue of issues) {
-    switch (issue.severity) {
-      case "high":
-        findings.high += 1;
-        break;
-      case "medium":
-        findings.medium += 1;
-        break;
-      case "low":
-        findings.low += 1;
-        break;
-      default:
-        findings.low += 1;
-    }
-  }
-  let risk = "low";
-  if (findings.critical >= 1 || findings.high >= 3) {
-    risk = "critical";
-  } else if (findings.high >= 1 || findings.medium >= 3) {
-    risk = "high";
-  } else if (findings.medium >= 1) {
-    risk = "medium";
-  }
-  return { risk, findings };
-}
-function formatAiSecurityRiskLine(risk, findings) {
-  const total = findings.critical + findings.high + findings.medium + findings.low;
-  if (total === 0) return "AI Security Risk: low";
-  return `AI Security Risk: ${risk.toUpperCase()}  (${total} findings)`;
-}
-var init_ai_security_risk = __esm({
-  "src/engine/ai-security-risk.ts"() {
-    "use strict";
-  }
-});
-
 // src/engine/test-quality.ts
 var test_quality_exports = {};
 __export(test_quality_exports, {
@@ -50311,7 +51956,7 @@ var init_test_quality = __esm({
 });
 
 // src/engine/metrics.ts
-import { isAbsolute as isAbsolute2, relative as relative5 } from "path";
+import { isAbsolute as isAbsolute2, relative as relative6 } from "path";
 function bucketFor(ruleId) {
   return RULE_TO_BUCKET[ruleId] ?? "visual";
 }
@@ -50335,7 +51980,7 @@ function scoreFile(result, frameworkMultiplier, config, baseline, cwd) {
     100,
     rawScore * frameworkMultiplier * CONTEXT_DENSITY_MULTIPLIER
   );
-  const baselineKey = cwd ? isAbsolute2(result.filePath) ? relative5(cwd, result.filePath) : result.filePath : result.filePath;
+  const baselineKey = cwd ? isAbsolute2(result.filePath) ? relative6(cwd, result.filePath) : result.filePath : result.filePath;
   const baselineScore = baseline?.scores[baselineKey]?.baselineScore ?? 0;
   const adjustedScore = baseline ? Math.max(0, componentScore - baselineScore) : componentScore;
   return {
@@ -50419,14 +52064,10 @@ function aggregateReport(scores, issueGroups, config, compositeScores) {
       });
     }
   }
-  const { risk } = computeAiSecurityRisk(flatIssues);
-  const securityFromRisk = {
-    low: 100,
-    medium: 67,
-    high: 33,
-    critical: 0
-  };
-  const security = securityFromRisk[risk];
+  const securityIssueCount = flatIssues.filter(
+    (i) => i.category === "security" || (i.ruleId ?? "").startsWith("security/")
+  ).length;
+  const security = Math.max(0, 100 / (1 + securityIssueCount / 5));
   const engineeringCategoryScores = [
     categoryScores.arch ?? 0,
     categoryScores.logic ?? 0,
@@ -50484,7 +52125,6 @@ var SEVERITY_WEIGHTS, CONTEXT_DENSITY_MULTIPLIER, COMPOSITE_WEIGHTS, RULE_TO_BUC
 var init_metrics = __esm({
   "src/engine/metrics.ts"() {
     "use strict";
-    init_ai_security_risk();
     init_test_quality();
     SEVERITY_WEIGHTS = {
       low: 1,
@@ -50548,7 +52188,7 @@ var init_metrics = __esm({
 });
 
 // src/engine/cache.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { existsSync as existsSync15, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync5 } from "fs";
 import { join as join15 } from "path";
 function parseVersion(version) {
@@ -50622,7 +52262,7 @@ function pickBaselineConfig(config) {
   return picked;
 }
 function hashConfig(config) {
-  return createHash7("sha256").update(JSON.stringify(sanitizeForHash(pickBaselineConfig(config)))).digest("hex");
+  return createHash9("sha256").update(JSON.stringify(sanitizeForHash(pickBaselineConfig(config)))).digest("hex");
 }
 function baselinePath(projectPath) {
   return join15(projectPath, ".slopbrick", "cache", "baseline.json");
@@ -52416,6 +54056,45 @@ var init_business_logic = __esm({
   }
 });
 
+// src/engine/ai-security-risk.ts
+function computeAiSecurityRisk(issues) {
+  const findings = { critical: 0, high: 0, medium: 0, low: 0 };
+  for (const issue of issues) {
+    switch (issue.severity) {
+      case "high":
+        findings.high += 1;
+        break;
+      case "medium":
+        findings.medium += 1;
+        break;
+      case "low":
+        findings.low += 1;
+        break;
+      default:
+        findings.low += 1;
+    }
+  }
+  let risk = "low";
+  if (findings.critical >= 1 || findings.high >= 3) {
+    risk = "critical";
+  } else if (findings.high >= 1 || findings.medium >= 3) {
+    risk = "high";
+  } else if (findings.medium >= 1) {
+    risk = "medium";
+  }
+  return { risk, findings };
+}
+function formatAiSecurityRiskLine(risk, findings) {
+  const total = findings.critical + findings.high + findings.medium + findings.low;
+  if (total === 0) return "AI Security Risk: low";
+  return `AI Security Risk: ${risk.toUpperCase()}  (${total} findings)`;
+}
+var init_ai_security_risk = __esm({
+  "src/engine/ai-security-risk.ts"() {
+    "use strict";
+  }
+});
+
 // src/engine/maintenance-cost.ts
 var maintenance_cost_exports = {};
 __export(maintenance_cost_exports, {
@@ -52692,7 +54371,7 @@ __export(db_health_exports, {
   buildDbHealth: () => buildDbHealth
 });
 import { readFileSync as readFileSync17 } from "fs";
-import { relative as relative6 } from "path";
+import { relative as relative7 } from "path";
 import { globby as globby3 } from "globby";
 import { parse as parseSql6, loadModule as loadSqlModule6 } from "pgsql-parser";
 function ensureSqlModule() {
@@ -52743,7 +54422,7 @@ async function buildDbHealth(cwd, _config, options = {}) {
   for (const abs of sqlFiles.slice(0, maxFiles)) {
     const parsed = await parseSqlFile(abs);
     if (!parsed) continue;
-    const relPath = relative6(cwd, abs);
+    const relPath = relative7(cwd, abs);
     parsedFiles.push({ relPath, parsed });
     for (const stmt of parsed.statements) {
       if (stmt.type !== "IndexStmt") continue;
@@ -52798,7 +54477,7 @@ async function buildDbHealth(cwd, _config, options = {}) {
     } catch {
       continue;
     }
-    const relPath = relative6(cwd, abs);
+    const relPath = relative7(cwd, abs);
     const context = { config: _config, filePath: relPath, cwd };
     const facts = { filePath: relPath, v2: { _source: source } };
     const ruleContext = sqlConcatRule.create(context);
@@ -53155,7 +54834,7 @@ function computeDomainScores(issues) {
   performance2.score = issueCountToScore(performance2.issueCount);
   const security = tally(SECURITY_CATEGORIES);
   security.name = "security";
-  security.score = security.issueCount > 0 ? 0 : 100;
+  security.score = Math.max(0, 100 / (1 + security.issueCount / 5));
   return { codeHygiene, accessibility, performance: performance2, security };
 }
 var COHERENCE_WEIGHTS, AI_DEBT_NUMERIC, CODE_HYGIENE_CATEGORIES, ACCESSIBILITY_CATEGORIES, PERFORMANCE_CATEGORIES, SECURITY_CATEGORIES;
@@ -53183,7 +54862,7 @@ var init_coherence = __esm({
 
 // src/cli/report/enrichReport.ts
 import { readFileSync as readFileSync18 } from "fs";
-import { relative as relative7 } from "path";
+import { relative as relative8 } from "path";
 function collectBusinessLogicIssues(cwd, filePaths) {
   const issues = [];
   for (const absPath of filePaths) {
@@ -53197,7 +54876,7 @@ function collectBusinessLogicIssues(cwd, filePaths) {
     for (const issue of fileIssues) {
       issues.push({
         ...issue,
-        filePath: relative7(cwd, absPath) || absPath
+        filePath: relative8(cwd, absPath) || absPath
       });
     }
   }
@@ -53587,17 +55266,17 @@ import {
   rmSync,
   statSync as statSync6
 } from "fs";
-import { createHash as createHash8 } from "crypto";
-import { dirname as dirname11, join as join17, relative as relative8 } from "path";
+import { createHash as createHash10 } from "crypto";
+import { dirname as dirname11, join as join17, relative as relative9 } from "path";
 function telemetryPath2(cwd) {
   return join17(cwd, TELEMETRY_DIR, TELEMETRY_FILE2);
 }
 function hashString(input) {
-  return createHash8("sha256").update(input).digest("hex").slice(0, 16);
+  return createHash10("sha256").update(input).digest("hex").slice(0, 16);
 }
 function safeRelative(cwd, filePath) {
   try {
-    return relative8(cwd, filePath);
+    return relative9(cwd, filePath);
   } catch {
     return filePath;
   }
@@ -53945,7 +55624,7 @@ var init_structure_md = __esm({
 
 // src/cli/report/persistRun.ts
 import { existsSync as existsSync18, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7 } from "fs";
-import { join as join19, relative as relative9 } from "path";
+import { join as join19, relative as relative10 } from "path";
 async function persistRun(input) {
   const {
     cwd,
@@ -54007,7 +55686,7 @@ async function persistRun(input) {
     const recentTopHashes = telemetryPayloads.map(
       (payload) => [...payload.files].sort((a, b) => b.score - a.score).slice(0, 10).map((file) => file.hash)
     );
-    const currentTopFiles = [...report.components].sort((a, b) => b.adjustedScore - a.adjustedScore).slice(0, 10).map((c) => ({ filePath: c.filePath, hash: hashFile(relative9(cwd, c.filePath)) }));
+    const currentTopFiles = [...report.components].sort((a, b) => b.adjustedScore - a.adjustedScore).slice(0, 10).map((c) => ({ filePath: c.filePath, hash: hashFile(relative10(cwd, c.filePath)) }));
     const unmatchedStringLiterals = results.flatMap((r) => r.unmatchedStringLiterals ?? []);
     const flywheelOutput = computeFlywheelOutput(
       runs,
@@ -54212,11 +55891,11 @@ var init_finalizeReport = __esm({
 });
 
 // src/cli/report/baseline-cache.ts
-import { relative as relative10 } from "path";
+import { relative as relative11 } from "path";
 function buildBaselineCache(report, configHash, gitHead, cwd) {
   const scores = {};
   for (const component of report.components) {
-    scores[relative10(cwd, component.filePath)] = {
+    scores[relative11(cwd, component.filePath)] = {
       baselineScore: component.componentScore,
       componentCount: component.componentCount
     };
@@ -54292,16 +55971,16 @@ var init_json = __esm({
 });
 
 // src/report/sarif.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { readFileSync as readFileSync21 } from "fs";
-import { basename as basename3, isAbsolute as isAbsolute3, relative as relative11, resolve as resolve9 } from "path";
+import { basename as basename3, isAbsolute as isAbsolute3, relative as relative12, resolve as resolve9 } from "path";
 function buildArtifactUri(filePath, cwd) {
   if (!filePath) {
     return ".";
   }
   if (cwd) {
     const absoluteFilePath = isAbsolute3(filePath) ? filePath : resolve9(cwd, filePath);
-    const rel = relative11(cwd, absoluteFilePath);
+    const rel = relative12(cwd, absoluteFilePath);
     if (rel.startsWith("..")) {
       return basename3(filePath);
     }
@@ -54365,7 +56044,7 @@ function buildHelpUri(ruleId, category) {
 }
 function computeFingerprint(input) {
   const payload = `${input.ruleId}|${input.fileUri}|${input.line}|${input.column}|${input.category}`;
-  return createHash9("sha256").update(payload).digest("hex").slice(0, 16);
+  return createHash11("sha256").update(payload).digest("hex").slice(0, 16);
 }
 function buildRuleFromIssue(issue) {
   return {
@@ -55676,7 +57355,7 @@ var init_layout_token = __esm({
 
 // src/report/unified-diff.ts
 import { existsSync as existsSync19, readFileSync as readFileSync23 } from "fs";
-import { relative as relative12 } from "path";
+import { relative as relative13 } from "path";
 function collectAllFixes(issue) {
   return [...issue.fix ? [issue.fix] : [], ...issue.fixes ?? []];
 }
@@ -55762,7 +57441,7 @@ function formatUnifiedDiff(report, cwd) {
       parts.push("");
       hasHunk = true;
     }
-    const rel = relative12(cwd, filePath);
+    const rel = relative13(cwd, filePath);
     parts.push(`--- a/${rel}`);
     parts.push(`+++ b/${rel}`);
     parts.push(...formatHunk(original, patched));
@@ -55786,7 +57465,7 @@ __export(heatmap_exports, {
   buildHeatmap: () => buildHeatmap,
   formatHeatmap: () => formatHeatmap
 });
-import { relative as relative13 } from "path";
+import { relative as relative14 } from "path";
 function isWithinDays(lastModified, reference, days) {
   const msPerDay = 1e3 * 60 * 60 * 24;
   const daysAgo = (reference.getTime() - lastModified.getTime()) / msPerDay;
@@ -55802,7 +57481,7 @@ async function buildHeatmap(report, cwd, helpers = { getFileEditCount, getFileLa
   const reference = new Date(report.generatedAt);
   const entries = await Promise.all(
     report.components.map(async (component) => {
-      const relPath = relative13(cwd, component.filePath) || component.filePath;
+      const relPath = relative14(cwd, component.filePath) || component.filePath;
       const [edits, lastModified] = await Promise.all([
         helpers.getFileEditCount(cwd, relPath, RECENCY_DAYS),
         helpers.getFileLastModifiedDate(cwd, relPath)
@@ -56147,10 +57826,12 @@ __export(scan_exports, {
   watchProject: () => watchProject
 });
 import { existsSync as existsSync20, statSync as statSync8 } from "fs";
-import { resolve as resolve12, relative as relative14, extname as extname7, sep as sep2 } from "path";
+import { resolve as resolve12, relative as relative15, extname as extname7, sep as sep3 } from "path";
+import { randomUUID } from "crypto";
 async function runScan(options, explicitPaths) {
   setLoggerQuiet(!!options.quiet);
   const startTime = Date.now();
+  const scanId = randomUUID();
   const cwd = resolve12(options.workspace ?? process.cwd());
   if (!existsSync20(cwd)) {
     throw new Error(`Workspace not found: ${cwd}`);
@@ -56193,7 +57874,7 @@ async function runScan(options, explicitPaths) {
   let files;
   if (explicitPaths && explicitPaths.length > 0) {
     const { globby: globby4 } = await import("globby");
-    const { minimatch: minimatch3 } = await import("minimatch");
+    const { minimatch: minimatch4 } = await import("minimatch");
     const resolved = explicitPaths.map((p) => resolve12(cwd, p));
     const expanded = [];
     for (const p of resolved) {
@@ -56201,11 +57882,11 @@ async function runScan(options, explicitPaths) {
         const found = await globby4(`${p}/**/*`, { absolute: true, onlyFiles: true });
         for (const f of found) {
           if (!ALL_SOURCE_EXTENSIONS.has(extname7(f).toLowerCase())) continue;
-          const rel = relative14(cwd, f).split(sep2).join("/");
-          if (config.include.length > 0 && !config.include.some((pattern) => minimatch3(rel, pattern))) {
+          const rel = relative15(cwd, f).split(sep3).join("/");
+          if (config.include.length > 0 && !config.include.some((pattern) => minimatch4(rel, pattern))) {
             continue;
           }
-          if (config.exclude.some((pattern) => minimatch3(rel, pattern, { dot: true }))) {
+          if (config.exclude.some((pattern) => minimatch4(rel, pattern, { dot: true }))) {
             continue;
           }
           expanded.push(f);
@@ -56404,7 +58085,18 @@ async function runScan(options, explicitPaths) {
     config,
     noIncreaseFailure,
     baseline,
-    machineReadableStdout
+    machineReadableStdout,
+    // v0.24.0 (Workstream C): stats for the opt-in network beacon.
+    // `fileCount` = files that ran through the worker pool (excludes
+    // incremental-cache skips). `ruleCount` = builtin rules, or 1
+    // when `--rule <id>` narrows the run. `durationMs` = wall-clock
+    // since `runScan` entry (matches `report.scanDurationMs`).
+    scanStats: {
+      scanId,
+      fileCount: results.length,
+      ruleCount: options.rule ? 1 : builtinRules.length,
+      durationMs: Date.now() - startTime
+    }
   };
 }
 async function scanProject(options) {
@@ -57762,13 +59454,35 @@ var RULE_HINTS = {
   "go/nil-slice-vs-empty": "Either declare as `var x = []int{}` or assign with `make([]int, 0)`. The nil/empty inconsistency is an AI signal \u2014 real code picks one form and sticks with it.",
   // v0.19.0 — Duplication detector
   "dup/identical-block": "Refactor to a shared helper. This is a Type-1 clone (byte-for-byte identical after normalization). Common in AI-generated code that copy-pastes from training data.",
+  // v0.23.0 — Type-2 near-duplicate detector (MinHash + LSH)
+  "dup/near-duplicate": "Refactor to a shared helper. Type-2 near-duplicate: same identifiers + structure, different whitespace/comments. AI-iterated code regenerates the same function with cosmetic edits. (v0.23.0 \u2014 MinHash + LSH, k=5, thr 0.7.)",
+  // v0.24.0 — Type-3 structural clone detector (two-stage MinHash)
+  "dup/structural-clone": "Refactor to a shared helper. Type-3 clone: same shape as another file after identifier canonicalization, with renames and/or added/removed statements. AI agents and copy-paste both produce this. Extract the shared part. (v0.24.0.)",
   // v0.20.0 — Java-specific rules
   "java/system-out-println": "Replace with `private static final Logger log = LoggerFactory.getLogger(...);` then `log.info(...)`. AI agents default to println because of textbook examples; real Java code uses a logger.",
   "java/empty-catch-block": 'Log the exception (`log.error("...", e)`), re-throw it, or both. Empty catch blocks hide bugs. Common in AI-generated code that wants to look defensive.',
   "java/arraylist-vs-linkedlist": "Replace `new LinkedList<>()` with `new ArrayList<>()`. LinkedList is rarely the right choice (worse cache locality, 5x more memory per element, O(n) indexed access). Joshua Bloch recommends ArrayList unless you need a Deque.",
   "java/legacy-date-api": "Replace `java.util.Date` / `Calendar` with `java.time` (`LocalDate`, `LocalDateTime`, `Instant`, `ZonedDateTime`). java.time is immutable and thread-safe. AI agents default to the legacy API.",
   "java/raw-type-overuse": "Replace raw `List` / `Map` / `Set` with the parameterized form. Raw types disable generic type checking (Effective Java, Item 23). AI agents default to raw types when unsure of the correct generic parameters.",
-  "java/string-concat-loop": "Declare a `StringBuilder` outside the loop: `StringBuilder sb = new StringBuilder(); sb.append(...);` then `return sb.toString();` after. String concat in a loop is O(n\xB2)."
+  "java/string-concat-loop": "Declare a `StringBuilder` outside the loop: `StringBuilder sb = new StringBuilder(); sb.append(...);` then `return sb.toString();` after. String concat in a loop is O(n\xB2).",
+  // v0.24.0 — Kotlin rules (DORMANT until v9 Kotlin corpus calibration)
+  "kotlin/data-class-defaults-overuse": "Audit which fields are genuinely optional. Real Kotlin uses defaults sparingly (1-2 callbacks, the rest required). v0.24.0 \u2014 DORMANT until v9 calibration.",
+  "kotlin/coroutine-global-scope": "Replace with `viewModelScope.launch { ... }`, `lifecycleScope.launch { ... }`, or `coroutineScope { ... }`. GlobalScope bypasses cancellation. (v0.24.0 \u2014 DORMANT.)",
+  "kotlin/println-debug": "Replace with `Timber.d(...)` or `android.util.Log`. `println` writes to stdout with no level, no redaction, can't be silenced in release builds. (v0.24.0 \u2014 DORMANT.)",
+  "kotlin/object-singleton-misuse": "Replace with a class injected via DI, a Repository, or `MutableStateFlow`. The `object` keyword gives a thread-safe singleton handle, NOT thread-safe `var` fields. (v0.24.0 \u2014 DORMANT.)",
+  "kotlin/string-concat-loop": "Wrap the loop in `buildString { append(...) }` or hoist a `StringBuilder`. Kotlin can't optimize `s = s + x` in a loop \u2014 O(n\xB2). (v0.24.0 \u2014 DORMANT.)",
+  // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
+  "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
+  "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",
+  "swift/fatal-error-thrown": "Replace with `return` of a typed default (e.g. `nil`, `[]()`) or throw a typed `enum MyError: Error`. `fatalError` survives release builds. (v0.24.0 \u2014 DORMANT.)",
+  "swift/implicitly-unwrapped-optional": "Declare as `var name: Type?` and unwrap with `guard let`. IUOs exist for Obj-C bridging / IBOutlets but using them everywhere is an AI signal. (v0.24.0 \u2014 DORMANT.)",
+  "swift/strong-self-capture": "Capture with `[weak self]` (or `[unowned self]` if guaranteed non-nil): `[weak self] in self?.foo = bar`. Strong self capture creates a retain cycle. (v0.24.0 \u2014 DORMANT.)",
+  // v0.24.0 — C++ rules (DORMANT until v9 C++ corpus calibration)
+  "cpp/using-namespace-std": "Remove the directive and qualify names with `std::`, or use targeted `using std::cout;`. C++ Core Guidelines (SF.6/SF.7) forbid `using namespace` in headers. (v0.24.0 \u2014 DORMANT.)",
+  "cpp/raw-new-delete": "Replace with `auto p = std::make_unique<T>(...)`. Smart pointers delete on scope exit, never leak on early return / exception, never double-free. (v0.24.0 \u2014 DORMANT.)",
+  "cpp/c-style-cast": "Use the named cast: `static_cast<int>(x)`, `reinterpret_cast<...>(p)`, `const_cast<...>(ref)`. C-style casts silently pick static / reinterpret / const \u2014 impossible to grep. (v0.24.0 \u2014 DORMANT.)",
+  "cpp/printf-debug": "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...`. `printf` / `std::cout` have no levels, no redaction, no sink routing. (v0.24.0 \u2014 DORMANT.)",
+  "cpp/magic-numbers": "Replace with `constexpr int MAX = 1024;` (or `static constexpr`). Named constants live next to their value, can be searched, force the reader to mean what they say. (v0.24.0 \u2014 DORMANT.)"
 };
 
 // src/cli/commands/explain.ts
@@ -59406,7 +61120,7 @@ import { resolve as resolve26 } from "path";
 init_discover();
 init_patterns();
 import { readFileSync as readFileSync30 } from "fs";
-import { basename as basename4, relative as relative15 } from "path";
+import { basename as basename4, relative as relative16 } from "path";
 async function runDrift(cwd, config, options = {}) {
   const maxFiles = options.maxFiles ?? 1e3;
   const allFiles = await discoverFiles(cwd, config);
@@ -59428,7 +61142,7 @@ async function runDrift(cwd, config, options = {}) {
       byCategory[v.category] = (byCategory[v.category] ?? 0) + 1;
       byFile.push({
         file: absPath,
-        relPath: relative15(cwd, absPath),
+        relPath: relative16(cwd, absPath),
         category: v.category,
         import: v.import,
         declared: v.declared,
@@ -59550,10 +61264,10 @@ init_metrics();
 init_patterns();
 init_discover();
 import { readFileSync as readFileSync31 } from "fs";
-import { extname as extname9, relative as relative16, resolve as resolve27 } from "path";
+import { extname as extname9, relative as relative17, resolve as resolve27 } from "path";
 import { execFile as execFileCb } from "child_process";
 import { promisify as promisify2 } from "util";
-import { minimatch as minimatch2 } from "minimatch";
+import { minimatch as minimatch3 } from "minimatch";
 var execFile2 = promisify2(execFileCb);
 var PR_EXTENSIONS = /* @__PURE__ */ new Set([...SOURCE_EXTENSIONS, ".mdx"]);
 async function refExists(cwd, ref) {
@@ -59594,11 +61308,11 @@ async function discoverPrFiles(cwd, config, base, head, maxFiles) {
     const abs = resolve27(cwd, relOrAbs);
     const ext = extname9(abs).toLowerCase();
     if (!PR_EXTENSIONS.has(ext)) continue;
-    const rel = relative16(cwd, abs).split("\\").join("/");
-    if (config.include.length > 0 && !config.include.some((pattern) => minimatch2(rel, pattern))) {
+    const rel = relative17(cwd, abs).split("\\").join("/");
+    if (config.include.length > 0 && !config.include.some((pattern) => minimatch3(rel, pattern))) {
       continue;
     }
-    if (config.exclude.some((pattern) => minimatch2(rel, pattern))) {
+    if (config.exclude.some((pattern) => minimatch3(rel, pattern))) {
       continue;
     }
     sourceFiles.push(abs);
@@ -59665,7 +61379,7 @@ async function runPrScan(cwd, config, options = {}) {
     totalScore += fileScore;
     files.push({
       file: absPath,
-      relPath: relative16(cwd, absPath).split("\\").join("/"),
+      relPath: relative17(cwd, absPath).split("\\").join("/"),
       score: fileScore,
       issueCount: issues.length,
       constitutionViolationCount: constitutionViolations.length,
@@ -60042,7 +61756,7 @@ import { resolve as resolve33 } from "path";
 init_discover();
 init_business_logic();
 import { readFileSync as readFileSync32 } from "fs";
-import { relative as relative17 } from "path";
+import { relative as relative18 } from "path";
 async function runBusinessLogicScan(cwd, config, options = {}) {
   const maxFiles = options.maxFiles ?? 500;
   const allFiles = await discoverFiles(cwd, config);
@@ -60061,7 +61775,7 @@ async function runBusinessLogicScan(cwd, config, options = {}) {
     for (const issue of fileIssues) {
       issues.push({
         ...issue,
-        filePath: relative17(cwd, absPath) || absPath
+        filePath: relative18(cwd, absPath) || absPath
       });
     }
   }
@@ -60623,7 +62337,7 @@ import { resolve as resolve37 } from "path";
 init_patterns();
 init_discover();
 import { readFileSync as readFileSync33 } from "fs";
-import { basename as basename5, relative as relative18 } from "path";
+import { basename as basename5, relative as relative19 } from "path";
 var PATTERN_CATEGORIES = [
   "modal",
   "button",
@@ -60715,7 +62429,7 @@ function detectApiFromFiles(files, cwd) {
   const out = [];
   for (const f of files) {
     if (API_PATH_RE2.test(f)) {
-      out.push(relative18(cwd, f).split("\\").join("/"));
+      out.push(relative19(cwd, f).split("\\").join("/"));
     }
   }
   return out;
@@ -62025,7 +63739,11 @@ var OPTION_CATEGORY = {
   // Tokens
   "--tokens": "tokens",
   // Telemetry
-  "--no-telemetry": "telemetry"
+  "--no-telemetry": "telemetry",
+  // v0.24.0 (Workstream C): opt-in network beacon. Distinct from
+  // --no-telemetry (which gates the local flywheel); this gates a
+  // single POST at scan end.
+  "--report-usage": "telemetry"
 };
 var CATEGORY_ORDER2 = [
   "file",
@@ -62094,6 +63812,109 @@ function formatGroupedHelp(cmd) {
   return lines.join("\n");
 }
 
+// src/beacon/endpoint.ts
+import * as http from "http";
+import * as https from "https";
+import { URL as URL2 } from "url";
+var sendBeacon = (url, payload, timeoutMs) => {
+  return new Promise((resolve42) => {
+    let parsed;
+    try {
+      parsed = new URL2(url);
+    } catch {
+      resolve42();
+      return;
+    }
+    const isHttps = parsed.protocol === "https:";
+    const lib = isHttps ? https : http;
+    const body = JSON.stringify(payload);
+    const opts = {
+      method: "POST",
+      hostname: parsed.hostname,
+      port: parsed.port || (isHttps ? 443 : 80),
+      path: `${parsed.pathname || "/"}${parsed.search || ""}`,
+      headers: {
+        "content-type": "application/json",
+        "content-length": Buffer.byteLength(body),
+        "user-agent": `slopbrick/${payload.slopbrick_version}`
+      }
+    };
+    let settled = false;
+    const settle = () => {
+      if (settled) return;
+      settled = true;
+      resolve42();
+    };
+    let req;
+    try {
+      req = lib.request(opts, (res) => {
+        res.on("data", () => {
+        });
+        res.on("end", settle);
+        res.on("error", settle);
+      });
+    } catch {
+      settle();
+      return;
+    }
+    req.on("error", settle);
+    req.setTimeout(timeoutMs, () => {
+      req.destroy();
+      settle();
+    });
+    try {
+      req.end(body);
+    } catch {
+      settle();
+    }
+  });
+};
+
+// src/beacon/index.ts
+var BEACON_TIMEOUT_MS = 5e3;
+var BeaconEmitter = class {
+  flag;
+  envEndpoint;
+  version;
+  transport;
+  constructor(opts) {
+    this.flag = opts.flag;
+    this.envEndpoint = opts.envEndpoint;
+    this.version = opts.version;
+    this.transport = opts.transport ?? sendBeacon;
+  }
+  /**
+   * The two-gate opt-in. Returns true only when the user opted in
+   * AND the endpoint env var is present and non-empty. Empty
+   * string is treated as unset.
+   */
+  shouldFire() {
+    return this.flag && !!this.envEndpoint && this.envEndpoint.length > 0;
+  }
+  /**
+   * Build the locked 8-field payload and hand it to the transport.
+   * Never throws. The returned Promise resolves when the transport
+   * resolves — which is always, by contract.
+   */
+  async emit(stats) {
+    if (!this.shouldFire()) return;
+    const payload = {
+      schema_version: "1",
+      slopbrick_version: this.version,
+      scan_id: stats.scanId,
+      file_count: stats.fileCount,
+      rule_count: stats.ruleCount,
+      duration_ms: stats.durationMs,
+      platform: process.platform,
+      node_version: process.version
+    };
+    try {
+      await this.transport(this.envEndpoint, payload, BEACON_TIMEOUT_MS);
+    } catch {
+    }
+  }
+};
+
 // src/cli/program.ts
 init_scan2();
 process.on("uncaughtException", (err) => {
@@ -62102,7 +63923,7 @@ process.on("uncaughtException", (err) => {
 });
 async function runCli({ start }) {
   try {
-    const program = new Command().name("slopbrick").description("Repository Coherence Scanner \u2014 surface AI-induced pattern drift, secret leaks, and design-token violations").version(VERSION).option("--framework <name>", "framework multiplier to apply").option("--include <glob>", "include pattern (repeatable)", collectGlob, []).option("--exclude <glob>", "exclude pattern (repeatable)", collectGlob, []).option("--ai-only", "only report AI-specific issues").option("--human-only", "only report human-facing issues").option("--ignore-wcag22", "ignore WCAG 2.2 related issues").option("--format <pretty|json|sarif|html>", "output format", "pretty").option("--threads <n>", "number of worker threads", parseThreads).option("--since <ref>", "only scan files changed since git ref").option("--diff <ref>", "alias for --since <ref>; also adds PR Slop Score to the report").option("--workspace <path>", "workspace/project path", process.cwd()).option("--tighten", "tighten baseline allowances").option("--fix", "apply auto-fixes").option("--dry-run", "with --fix: print what would change without writing").option("--show-fixes-diff", "print unified diff of proposed auto-fixes").option("--doctor", "run diagnostics").option("--watch", "watch files and re-run").option("--suggest", "print remediation advice").option("--why-failing", "print the top 5 rules dragging the score down").option("--brief", "terse output (verdict + headline + threshold + delta only)").option("--heatmap", "print migration ROI heatmap").option("--quiet", "suppress non-error output").option("--verbose", "enable debug logging (file paths, timings, rule-fire counts)").option("--strict", "exit 2 if any high-severity issue remains").option("--no-increase", "exit 2 if slop index increased since last run").option("--baseline", "save a baseline after this scan").option("--trend [n]", "print a sparkline of the last n runs", parseTrend).option("--json [path]", "write JSON report to path or stdout").option("--html [path]", "write HTML report to path or stdout").option("--staged", "scan only changed files (staged and unstaged)").option("--changed", "scan working-tree changes (staged + unstaged + untracked)").option("--incremental", "skip unchanged files using the persisted hash cache").option("--cache-path <path>", "path to the incremental-scan cache (default: .slopbrick-cache.json)").option("--tokens <path>", "merge tokens.json layout values into the arbitrary-value allowlist").option("--cache", "cache parsed AST results locally").option("--no-color", "suppress ANSI color codes in output").option("--security-only", "run only the security/* rules").option("--full", "show the complete report (all issues, all categories)");
+    const program = new Command().name("slopbrick").description("Repository Coherence Scanner \u2014 surface AI-induced pattern drift, secret leaks, and design-token violations").version(VERSION).option("--framework <name>", "framework multiplier to apply").option("--include <glob>", "include pattern (repeatable)", collectGlob, []).option("--exclude <glob>", "exclude pattern (repeatable)", collectGlob, []).option("--ai-only", "only report AI-specific issues").option("--human-only", "only report human-facing issues").option("--ignore-wcag22", "ignore WCAG 2.2 related issues").option("--format <pretty|json|sarif|html>", "output format", "pretty").option("--threads <n>", "number of worker threads", parseThreads).option("--since <ref>", "only scan files changed since git ref").option("--diff <ref>", "alias for --since <ref>; also adds PR Slop Score to the report").option("--workspace <path>", "workspace/project path", process.cwd()).option("--tighten", "tighten baseline allowances").option("--fix", "apply auto-fixes").option("--dry-run", "with --fix: print what would change without writing").option("--show-fixes-diff", "print unified diff of proposed auto-fixes").option("--doctor", "run diagnostics").option("--watch", "watch files and re-run").option("--suggest", "print remediation advice").option("--why-failing", "print the top 5 rules dragging the score down").option("--brief", "terse output (verdict + headline + threshold + delta only)").option("--heatmap", "print migration ROI heatmap").option("--quiet", "suppress non-error output").option("--verbose", "enable debug logging (file paths, timings, rule-fire counts)").option("--strict", "exit 2 if any high-severity issue remains").option("--no-increase", "exit 2 if slop index increased since last run").option("--baseline", "save a baseline after this scan").option("--trend [n]", "print a sparkline of the last n runs", parseTrend).option("--json [path]", "write JSON report to path or stdout").option("--html [path]", "write HTML report to path or stdout").option("--staged", "scan only changed files (staged and unstaged)").option("--changed", "scan working-tree changes (staged + unstaged + untracked)").option("--incremental", "skip unchanged files using the persisted hash cache").option("--cache-path <path>", "path to the incremental-scan cache (default: .slopbrick-cache.json)").option("--tokens <path>", "merge tokens.json layout values into the arbitrary-value allowlist").option("--cache", "cache parsed AST results locally").option("--no-color", "suppress ANSI color codes in output").option("--security-only", "run only the security/* rules").option("--full", "show the complete report (all issues, all categories)").option("--report-usage", "opt in to a one-shot usage ping to SLOPBRICK_TELEMETRY_ENDPOINT (no PII)");
     program.helpInformation = () => formatGroupedHelp(program);
     registerInit(program);
     registerInstall(program);
@@ -62155,10 +63976,25 @@ async function runCli({ start }) {
         config,
         noIncreaseFailure,
         baseline,
-        machineReadableStdout
+        machineReadableStdout,
+        scanStats
       } = await runScan(options, paths);
       const scanElapsed = Math.round(performance.now() - scanStart);
       const totalElapsed = Math.round(performance.now() - start);
+      const beaconEnv = process.env.SLOPBRICK_TELEMETRY_ENDPOINT;
+      if (options.reportUsage && beaconEnv && command.name() === "scan") {
+        const beacon = new BeaconEmitter({
+          flag: true,
+          envEndpoint: beaconEnv,
+          version: VERSION
+        });
+        void beacon.emit({
+          scanId: scanStats.scanId,
+          fileCount: scanStats.fileCount,
+          ruleCount: scanStats.ruleCount,
+          durationMs: scanStats.durationMs
+        });
+      }
       if (options.baseline) {
         const cwd2 = resolve41(options.workspace ?? process.cwd());
         const configHash = hashConfig(config);