slopbrick 0.24.0 → 0.25.1

package/dist/engine/worker.cjs

@@ -37,6 +37,7 @@ module.exports = __toCommonJS(worker_exports);
 var import_node_worker_threads = require("worker_threads");
 var import_node_path9 = require("path");
 var import_node_path10 = require("path");
+var import_minimatch = require("minimatch");
 
 // ../engine/dist/index.js
 var import_promises = require("fs/promises");
@@ -4364,6 +4365,7 @@ function parseSource(source, filePath) {
     case "py":
     case "go":
     case "rs":
+    case "java":
       return parseBlankModule(source);
     default:
       return parseWithSwc(source, filePath);
@@ -37820,6 +37822,43 @@ var DEFAULT_CONFIG3 = {
    */
   testIntelligence: {
     missingEdgeCase: false
+  },
+  /**
+   * v0.25.0: self-scan exclude paths. Defaults cover the three paths
+   * that are always false positives when scanning the slopbrick repo
+   * itself:
+   *
+   *   - `src/rules/**` — rule definitions contain example patterns
+   *     the rules themselves detect (self-fire). E.g. a
+   *     `security/sql-construction` rule's source file has a SQL
+   *     concat string literal that fires its own regex.
+   *   - `tests/fixtures/**` — test fixtures contain intentional bad
+   *     code that the rules must fire on to be useful (each fixture
+   *     is a positive test case). Scanning them in a self-scan
+   *     produces ~70 false-positive "issues" that are really just
+   *     test data.
+   *   - `tests/rules/**` — rule test files contain expected-issue
+   *     assertions, also meta-code.
+   *
+   * Three patterns (broadened in v0.25.1 from the v0.25.0 narrow
+   * set, which missed `tests/engine/**`, `tests/cli/**`, and
+   * `snippet/**`), ~80 issues removed per self-scan. Combined
+   * with the v0.25.0 graded security cap, this restores the
+   * v9 plan's "security ≥ 80" criterion (unachievable in
+   * v0.24.0 due to 90 self-scan FPs collapsing the score to 0).
+   *
+   * Set `selfScan: { excludePaths: [] }` in `slopbrick.config.mjs`
+   * to opt out and scan every file (legacy behavior).
+   */
+  selfScan: {
+    excludePaths: [
+      "**/src/rules/**",
+      // rule definitions are meta-code
+      "**/snippet/**",
+      // RULE_HINTS examples are intentional bad code
+      "**/tests/**"
+      // all test files (fixtures + unit + integration)
+    ]
   }
 };
 
@@ -43822,13 +43861,13 @@ var signal_strength_default = {
     defaultOff: true
   },
   "java/arraylist-vs-linkedlist": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 35e-4,
+    fpRate: 94e-4,
+    ratio: 0.37,
+    precision: 0.0446,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (new LinkedList<>() \u2014 use ArrayList (Effective Java Item 28)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files = 92196 total. v9 TP=36, FP=771, P=4.46%, FPR=0.94%, recall=0.35%, ratio=0.37, lift=P/FPR=4.74. Rule fires more on legacy enterprise Java (neg) than on AI/ML-integration Java (pos) because modern Java idiom defaults to ArrayList. v0.20: new rule (new LinkedList<>() \u2014 use ArrayList, Effective Java Item 28).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43837,16 +43876,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 4.74,
+    _v9Recall: 35e-4,
+    _v9FpRate: 94e-4,
+    _v9Precision: 0.0446,
     defaultOff: true
   },
   "java/empty-catch-block": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 8e-3,
+    fpRate: 0.1118,
+    ratio: 0.07,
+    precision: 89e-4,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Empty catch block \u2014 silently swallows exceptions). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=82, FP=9159, P=0.89%, FPR=11.18%, recall=0.80%, ratio=0.07, lift=P/FPR=0.08. Strongly INVERTED: empty catch blocks are 14x more common in legacy enterprise Java than in AI/Java-modern pos repos. Heuristic likely needs to be tightened (e.g., require at least a comment) before it can serve as a meaningful discriminator. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43855,16 +43899,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.08,
+    _v9Recall: 8e-3,
+    _v9FpRate: 0.1118,
+    _v9Precision: 89e-4,
     defaultOff: true
   },
   "java/legacy-date-api": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.0285,
+    fpRate: 0.0511,
+    ratio: 0.56,
+    precision: 0.0657,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Legacy java.util.Date / Calendar \u2014 use java.time (JSR-310)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=294, FP=4181, P=6.57%, FPR=5.11%, recall=2.85%, ratio=0.56, lift=P/FPR=1.29. INVERTED-to-NOISY: legacy date API is more common in older enterprise Java (neg) than in modern AI/Java repos (pos). The heuristic correctly flags the legacy pattern, but the legacy pattern is over-represented in the neg baseline (older codebases). v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43873,16 +43922,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 1.29,
+    _v9Recall: 0.0285,
+    _v9FpRate: 0.0511,
+    _v9Precision: 0.0657,
     defaultOff: true
   },
   "java/raw-type-overuse": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.1093,
+    fpRate: 0.2041,
+    ratio: 0.54,
+    precision: 0.0632,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Raw type usage \u2014 use generics). DORMANT until v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1126, FP=16712, P=6.32%, FPR=20.41%, recall=10.93%, ratio=0.54, lift=P/FPR=0.31. Strongly INVERTED: raw types (no generics) are 2x more common in legacy enterprise Java (neg) than in modern Java repos (pos). Heuristic is correctly identifying the legacy anti-pattern, but it's an age marker more than an AI-fingerprint. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43891,16 +43945,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.31,
+    _v9Recall: 0.1093,
+    _v9FpRate: 0.2041,
+    _v9Precision: 0.0632,
     defaultOff: true
   },
   "java/string-concat-loop": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 46e-4,
+    fpRate: 0.0358,
+    ratio: 0.13,
+    precision: 0.0158,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (String concat in loop \u2014 use StringBuilder). DORMANT until v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=47, FP=2933, P=1.58%, FPR=3.58%, recall=0.46%, ratio=0.13, lift=P/FPR=0.44. Strongly INVERTED: string concatenation in a loop is 8x more common in legacy enterprise Java (neg) than in AI/ML/Java-modern pos repos. Modern Java training data and modern IDE warnings discourage the pattern. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43909,16 +43968,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.44,
+    _v9Recall: 46e-4,
+    _v9FpRate: 0.0358,
+    _v9Precision: 0.0158,
     defaultOff: true
   },
   "java/system-out-println": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.1503,
+    fpRate: 0.2533,
+    ratio: 0.59,
+    precision: 0.0695,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (System.out.println in production code \u2014 use a logger). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1549, FP=20737, P=6.95%, FPR=25.32%, recall=15.03%, ratio=0.59, lift=P/FPR=0.27. INVERTED: System.out.println is more common in legacy enterprise Java (neg) than in modern AI/Java repos (pos). Modern Java defaults to SLF4J/Log4j, AI-generated Java starts with a logger import. The pattern is the opposite of the v0.20 design intent (which assumed println was the AI-fingerprint signal). v0.25.x: consider gating this rule by Java era (recent file mtime) or making it an age-fingerprint rather than AI-fingerprint. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43927,6 +43991,11 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.27,
+    _v9Recall: 0.1503,
+    _v9FpRate: 0.2533,
+    _v9Precision: 0.0695,
     defaultOff: true
   },
   "layout/forced-layout": {
@@ -45471,7 +45540,23 @@ function applyRuleOverrides(issues, rules) {
   }
   return result;
 }
+function isExcludedBySelfScan(filePath, cwd, excludePaths) {
+  if (!excludePaths || excludePaths.length === 0) return false;
+  const rel = (0, import_node_path10.relative)(cwd, filePath).split(import_node_path10.sep).join("/");
+  return excludePaths.some((pattern) => (0, import_minimatch.minimatch)(rel, pattern, { dot: true }));
+}
 async function scanFile(filePath, config, registry, cwd = process.cwd()) {
+  if (isExcludedBySelfScan(filePath, cwd, config.selfScan?.excludePaths)) {
+    return {
+      filePath,
+      componentCount: 0,
+      issues: [],
+      gapValues: [],
+      styleSources: [],
+      elementTags: [],
+      unmatchedStringLiterals: []
+    };
+  }
   const cache = buildParserCacheConfig(cwd);
   const ext = (0, import_node_path9.extname)(filePath).toLowerCase();
   const UNSUPPORTED_LANGS = /* @__PURE__ */ new Set([
@@ -45486,7 +45571,6 @@ async function scanFile(filePath, config, registry, cwd = process.cwd()) {
     ".h",
     ".hpp",
     ".hxx",
-    ".java",
     ".rb",
     ".php"
   ]);

package/dist/engine/worker.js

@@ -7,7 +7,8 @@ var __export = (target, all) => {
 // src/engine/worker.ts
 import { isMainThread, parentPort, workerData } from "worker_threads";
 import { extname as extname4 } from "path";
-import { join as join11 } from "path";
+import { join as join11, relative as relative2, sep } from "path";
+import { minimatch } from "minimatch";
 
 // ../engine/dist/index.js
 import { readFile, writeFile, mkdir, access } from "fs/promises";
@@ -4335,6 +4336,7 @@ function parseSource(source, filePath) {
     case "py":
     case "go":
     case "rs":
+    case "java":
       return parseBlankModule(source);
     default:
       return parseWithSwc(source, filePath);
@@ -37791,6 +37793,43 @@ var DEFAULT_CONFIG3 = {
    */
   testIntelligence: {
     missingEdgeCase: false
+  },
+  /**
+   * v0.25.0: self-scan exclude paths. Defaults cover the three paths
+   * that are always false positives when scanning the slopbrick repo
+   * itself:
+   *
+   *   - `src/rules/**` — rule definitions contain example patterns
+   *     the rules themselves detect (self-fire). E.g. a
+   *     `security/sql-construction` rule's source file has a SQL
+   *     concat string literal that fires its own regex.
+   *   - `tests/fixtures/**` — test fixtures contain intentional bad
+   *     code that the rules must fire on to be useful (each fixture
+   *     is a positive test case). Scanning them in a self-scan
+   *     produces ~70 false-positive "issues" that are really just
+   *     test data.
+   *   - `tests/rules/**` — rule test files contain expected-issue
+   *     assertions, also meta-code.
+   *
+   * Three patterns (broadened in v0.25.1 from the v0.25.0 narrow
+   * set, which missed `tests/engine/**`, `tests/cli/**`, and
+   * `snippet/**`), ~80 issues removed per self-scan. Combined
+   * with the v0.25.0 graded security cap, this restores the
+   * v9 plan's "security ≥ 80" criterion (unachievable in
+   * v0.24.0 due to 90 self-scan FPs collapsing the score to 0).
+   *
+   * Set `selfScan: { excludePaths: [] }` in `slopbrick.config.mjs`
+   * to opt out and scan every file (legacy behavior).
+   */
+  selfScan: {
+    excludePaths: [
+      "**/src/rules/**",
+      // rule definitions are meta-code
+      "**/snippet/**",
+      // RULE_HINTS examples are intentional bad code
+      "**/tests/**"
+      // all test files (fixtures + unit + integration)
+    ]
   }
 };
 
@@ -43793,13 +43832,13 @@ var signal_strength_default = {
     defaultOff: true
   },
   "java/arraylist-vs-linkedlist": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 35e-4,
+    fpRate: 94e-4,
+    ratio: 0.37,
+    precision: 0.0446,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (new LinkedList<>() \u2014 use ArrayList (Effective Java Item 28)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files = 92196 total. v9 TP=36, FP=771, P=4.46%, FPR=0.94%, recall=0.35%, ratio=0.37, lift=P/FPR=4.74. Rule fires more on legacy enterprise Java (neg) than on AI/ML-integration Java (pos) because modern Java idiom defaults to ArrayList. v0.20: new rule (new LinkedList<>() \u2014 use ArrayList, Effective Java Item 28).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43808,16 +43847,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 4.74,
+    _v9Recall: 35e-4,
+    _v9FpRate: 94e-4,
+    _v9Precision: 0.0446,
     defaultOff: true
   },
   "java/empty-catch-block": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 8e-3,
+    fpRate: 0.1118,
+    ratio: 0.07,
+    precision: 89e-4,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Empty catch block \u2014 silently swallows exceptions). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=82, FP=9159, P=0.89%, FPR=11.18%, recall=0.80%, ratio=0.07, lift=P/FPR=0.08. Strongly INVERTED: empty catch blocks are 14x more common in legacy enterprise Java than in AI/Java-modern pos repos. Heuristic likely needs to be tightened (e.g., require at least a comment) before it can serve as a meaningful discriminator. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43826,16 +43870,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.08,
+    _v9Recall: 8e-3,
+    _v9FpRate: 0.1118,
+    _v9Precision: 89e-4,
     defaultOff: true
   },
   "java/legacy-date-api": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.0285,
+    fpRate: 0.0511,
+    ratio: 0.56,
+    precision: 0.0657,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Legacy java.util.Date / Calendar \u2014 use java.time (JSR-310)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=294, FP=4181, P=6.57%, FPR=5.11%, recall=2.85%, ratio=0.56, lift=P/FPR=1.29. INVERTED-to-NOISY: legacy date API is more common in older enterprise Java (neg) than in modern AI/Java repos (pos). The heuristic correctly flags the legacy pattern, but the legacy pattern is over-represented in the neg baseline (older codebases). v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43844,16 +43893,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 1.29,
+    _v9Recall: 0.0285,
+    _v9FpRate: 0.0511,
+    _v9Precision: 0.0657,
     defaultOff: true
   },
   "java/raw-type-overuse": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.1093,
+    fpRate: 0.2041,
+    ratio: 0.54,
+    precision: 0.0632,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Raw type usage \u2014 use generics). DORMANT until v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1126, FP=16712, P=6.32%, FPR=20.41%, recall=10.93%, ratio=0.54, lift=P/FPR=0.31. Strongly INVERTED: raw types (no generics) are 2x more common in legacy enterprise Java (neg) than in modern Java repos (pos). Heuristic is correctly identifying the legacy anti-pattern, but it's an age marker more than an AI-fingerprint. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43862,16 +43916,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.31,
+    _v9Recall: 0.1093,
+    _v9FpRate: 0.2041,
+    _v9Precision: 0.0632,
     defaultOff: true
   },
   "java/string-concat-loop": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 46e-4,
+    fpRate: 0.0358,
+    ratio: 0.13,
+    precision: 0.0158,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (String concat in loop \u2014 use StringBuilder). DORMANT until v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=47, FP=2933, P=1.58%, FPR=3.58%, recall=0.46%, ratio=0.13, lift=P/FPR=0.44. Strongly INVERTED: string concatenation in a loop is 8x more common in legacy enterprise Java (neg) than in AI/ML/Java-modern pos repos. Modern Java training data and modern IDE warnings discourage the pattern. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43880,16 +43939,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.44,
+    _v9Recall: 46e-4,
+    _v9FpRate: 0.0358,
+    _v9Precision: 0.0158,
     defaultOff: true
   },
   "java/system-out-println": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.1503,
+    fpRate: 0.2533,
+    ratio: 0.59,
+    precision: 0.0695,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (System.out.println in production code \u2014 use a logger). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1549, FP=20737, P=6.95%, FPR=25.32%, recall=15.03%, ratio=0.59, lift=P/FPR=0.27. INVERTED: System.out.println is more common in legacy enterprise Java (neg) than in modern AI/Java repos (pos). Modern Java defaults to SLF4J/Log4j, AI-generated Java starts with a logger import. The pattern is the opposite of the v0.20 design intent (which assumed println was the AI-fingerprint signal). v0.25.x: consider gating this rule by Java era (recent file mtime) or making it an age-fingerprint rather than AI-fingerprint. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43898,6 +43962,11 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.27,
+    _v9Recall: 0.1503,
+    _v9FpRate: 0.2533,
+    _v9Precision: 0.0695,
     defaultOff: true
   },
   "layout/forced-layout": {
@@ -45442,7 +45511,23 @@ function applyRuleOverrides(issues, rules) {
   }
   return result;
 }
+function isExcludedBySelfScan(filePath, cwd, excludePaths) {
+  if (!excludePaths || excludePaths.length === 0) return false;
+  const rel = relative2(cwd, filePath).split(sep).join("/");
+  return excludePaths.some((pattern) => minimatch(rel, pattern, { dot: true }));
+}
 async function scanFile(filePath, config, registry, cwd = process.cwd()) {
+  if (isExcludedBySelfScan(filePath, cwd, config.selfScan?.excludePaths)) {
+    return {
+      filePath,
+      componentCount: 0,
+      issues: [],
+      gapValues: [],
+      styleSources: [],
+      elementTags: [],
+      unmatchedStringLiterals: []
+    };
+  }
   const cache = buildParserCacheConfig(cwd);
   const ext = extname4(filePath).toLowerCase();
   const UNSUPPORTED_LANGS = /* @__PURE__ */ new Set([
@@ -45457,7 +45542,6 @@ async function scanFile(filePath, config, registry, cwd = process.cwd()) {
     ".h",
     ".hpp",
     ".hxx",
-    ".java",
     ".rb",
     ".php"
   ]);