slopbrick 0.25.0 → 0.25.1

package/dist/engine/worker.cjs

@@ -37840,19 +37840,24 @@ var DEFAULT_CONFIG3 = {
    *   - `tests/rules/**` — rule test files contain expected-issue
    *     assertions, also meta-code.
    *
-   * Three patterns, ~70 issues removed per self-scan. Combined with
-   * the v0.25.0 graded security cap, this restores the v9 plan's
-   * "security ≥ 80" criterion (unachievable in v0.24.0 due to 90
-   * self-scan FPs collapsing the score to 0).
+   * Three patterns (broadened in v0.25.1 from the v0.25.0 narrow
+   * set, which missed `tests/engine/**`, `tests/cli/**`, and
+   * `snippet/**`), ~80 issues removed per self-scan. Combined
+   * with the v0.25.0 graded security cap, this restores the
+   * v9 plan's "security ≥ 80" criterion (unachievable in
+   * v0.24.0 due to 90 self-scan FPs collapsing the score to 0).
    *
    * Set `selfScan: { excludePaths: [] }` in `slopbrick.config.mjs`
    * to opt out and scan every file (legacy behavior).
    */
   selfScan: {
     excludePaths: [
-      "src/rules/**",
-      "tests/fixtures/**",
-      "tests/rules/**"
+      "**/src/rules/**",
+      // rule definitions are meta-code
+      "**/snippet/**",
+      // RULE_HINTS examples are intentional bad code
+      "**/tests/**"
+      // all test files (fixtures + unit + integration)
     ]
   }
 };
@@ -43856,13 +43861,13 @@ var signal_strength_default = {
     defaultOff: true
   },
   "java/arraylist-vs-linkedlist": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 35e-4,
+    fpRate: 94e-4,
+    ratio: 0.37,
+    precision: 0.0446,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (new LinkedList<>() \u2014 use ArrayList (Effective Java Item 28)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files = 92196 total. v9 TP=36, FP=771, P=4.46%, FPR=0.94%, recall=0.35%, ratio=0.37, lift=P/FPR=4.74. Rule fires more on legacy enterprise Java (neg) than on AI/ML-integration Java (pos) because modern Java idiom defaults to ArrayList. v0.20: new rule (new LinkedList<>() \u2014 use ArrayList, Effective Java Item 28).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43871,16 +43876,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 4.74,
+    _v9Recall: 35e-4,
+    _v9FpRate: 94e-4,
+    _v9Precision: 0.0446,
     defaultOff: true
   },
   "java/empty-catch-block": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 8e-3,
+    fpRate: 0.1118,
+    ratio: 0.07,
+    precision: 89e-4,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Empty catch block \u2014 silently swallows exceptions). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=82, FP=9159, P=0.89%, FPR=11.18%, recall=0.80%, ratio=0.07, lift=P/FPR=0.08. Strongly INVERTED: empty catch blocks are 14x more common in legacy enterprise Java than in AI/Java-modern pos repos. Heuristic likely needs to be tightened (e.g., require at least a comment) before it can serve as a meaningful discriminator. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43889,16 +43899,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.08,
+    _v9Recall: 8e-3,
+    _v9FpRate: 0.1118,
+    _v9Precision: 89e-4,
     defaultOff: true
   },
   "java/legacy-date-api": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.0285,
+    fpRate: 0.0511,
+    ratio: 0.56,
+    precision: 0.0657,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Legacy java.util.Date / Calendar \u2014 use java.time (JSR-310)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=294, FP=4181, P=6.57%, FPR=5.11%, recall=2.85%, ratio=0.56, lift=P/FPR=1.29. INVERTED-to-NOISY: legacy date API is more common in older enterprise Java (neg) than in modern AI/Java repos (pos). The heuristic correctly flags the legacy pattern, but the legacy pattern is over-represented in the neg baseline (older codebases). v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43907,16 +43922,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 1.29,
+    _v9Recall: 0.0285,
+    _v9FpRate: 0.0511,
+    _v9Precision: 0.0657,
     defaultOff: true
   },
   "java/raw-type-overuse": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.1093,
+    fpRate: 0.2041,
+    ratio: 0.54,
+    precision: 0.0632,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Raw type usage \u2014 use generics). DORMANT until v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1126, FP=16712, P=6.32%, FPR=20.41%, recall=10.93%, ratio=0.54, lift=P/FPR=0.31. Strongly INVERTED: raw types (no generics) are 2x more common in legacy enterprise Java (neg) than in modern Java repos (pos). Heuristic is correctly identifying the legacy anti-pattern, but it's an age marker more than an AI-fingerprint. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43925,16 +43945,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.31,
+    _v9Recall: 0.1093,
+    _v9FpRate: 0.2041,
+    _v9Precision: 0.0632,
     defaultOff: true
   },
   "java/string-concat-loop": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 46e-4,
+    fpRate: 0.0358,
+    ratio: 0.13,
+    precision: 0.0158,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (String concat in loop \u2014 use StringBuilder). DORMANT until v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=47, FP=2933, P=1.58%, FPR=3.58%, recall=0.46%, ratio=0.13, lift=P/FPR=0.44. Strongly INVERTED: string concatenation in a loop is 8x more common in legacy enterprise Java (neg) than in AI/ML/Java-modern pos repos. Modern Java training data and modern IDE warnings discourage the pattern. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43943,16 +43968,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.44,
+    _v9Recall: 46e-4,
+    _v9FpRate: 0.0358,
+    _v9Precision: 0.0158,
     defaultOff: true
   },
   "java/system-out-println": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.1503,
+    fpRate: 0.2533,
+    ratio: 0.59,
+    precision: 0.0695,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (System.out.println in production code \u2014 use a logger). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1549, FP=20737, P=6.95%, FPR=25.32%, recall=15.03%, ratio=0.59, lift=P/FPR=0.27. INVERTED: System.out.println is more common in legacy enterprise Java (neg) than in modern AI/Java repos (pos). Modern Java defaults to SLF4J/Log4j, AI-generated Java starts with a logger import. The pattern is the opposite of the v0.20 design intent (which assumed println was the AI-fingerprint signal). v0.25.x: consider gating this rule by Java era (recent file mtime) or making it an age-fingerprint rather than AI-fingerprint. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43961,6 +43991,11 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.27,
+    _v9Recall: 0.1503,
+    _v9FpRate: 0.2533,
+    _v9Precision: 0.0695,
     defaultOff: true
   },
   "layout/forced-layout": {

package/dist/engine/worker.js

@@ -37811,19 +37811,24 @@ var DEFAULT_CONFIG3 = {
    *   - `tests/rules/**` — rule test files contain expected-issue
    *     assertions, also meta-code.
    *
-   * Three patterns, ~70 issues removed per self-scan. Combined with
-   * the v0.25.0 graded security cap, this restores the v9 plan's
-   * "security ≥ 80" criterion (unachievable in v0.24.0 due to 90
-   * self-scan FPs collapsing the score to 0).
+   * Three patterns (broadened in v0.25.1 from the v0.25.0 narrow
+   * set, which missed `tests/engine/**`, `tests/cli/**`, and
+   * `snippet/**`), ~80 issues removed per self-scan. Combined
+   * with the v0.25.0 graded security cap, this restores the
+   * v9 plan's "security ≥ 80" criterion (unachievable in
+   * v0.24.0 due to 90 self-scan FPs collapsing the score to 0).
    *
    * Set `selfScan: { excludePaths: [] }` in `slopbrick.config.mjs`
    * to opt out and scan every file (legacy behavior).
    */
   selfScan: {
     excludePaths: [
-      "src/rules/**",
-      "tests/fixtures/**",
-      "tests/rules/**"
+      "**/src/rules/**",
+      // rule definitions are meta-code
+      "**/snippet/**",
+      // RULE_HINTS examples are intentional bad code
+      "**/tests/**"
+      // all test files (fixtures + unit + integration)
     ]
   }
 };
@@ -43827,13 +43832,13 @@ var signal_strength_default = {
     defaultOff: true
   },
   "java/arraylist-vs-linkedlist": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 35e-4,
+    fpRate: 94e-4,
+    ratio: 0.37,
+    precision: 0.0446,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (new LinkedList<>() \u2014 use ArrayList (Effective Java Item 28)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files = 92196 total. v9 TP=36, FP=771, P=4.46%, FPR=0.94%, recall=0.35%, ratio=0.37, lift=P/FPR=4.74. Rule fires more on legacy enterprise Java (neg) than on AI/ML-integration Java (pos) because modern Java idiom defaults to ArrayList. v0.20: new rule (new LinkedList<>() \u2014 use ArrayList, Effective Java Item 28).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43842,16 +43847,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 4.74,
+    _v9Recall: 35e-4,
+    _v9FpRate: 94e-4,
+    _v9Precision: 0.0446,
     defaultOff: true
   },
   "java/empty-catch-block": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 8e-3,
+    fpRate: 0.1118,
+    ratio: 0.07,
+    precision: 89e-4,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Empty catch block \u2014 silently swallows exceptions). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=82, FP=9159, P=0.89%, FPR=11.18%, recall=0.80%, ratio=0.07, lift=P/FPR=0.08. Strongly INVERTED: empty catch blocks are 14x more common in legacy enterprise Java than in AI/Java-modern pos repos. Heuristic likely needs to be tightened (e.g., require at least a comment) before it can serve as a meaningful discriminator. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43860,16 +43870,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.08,
+    _v9Recall: 8e-3,
+    _v9FpRate: 0.1118,
+    _v9Precision: 89e-4,
     defaultOff: true
   },
   "java/legacy-date-api": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.0285,
+    fpRate: 0.0511,
+    ratio: 0.56,
+    precision: 0.0657,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Legacy java.util.Date / Calendar \u2014 use java.time (JSR-310)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=294, FP=4181, P=6.57%, FPR=5.11%, recall=2.85%, ratio=0.56, lift=P/FPR=1.29. INVERTED-to-NOISY: legacy date API is more common in older enterprise Java (neg) than in modern AI/Java repos (pos). The heuristic correctly flags the legacy pattern, but the legacy pattern is over-represented in the neg baseline (older codebases). v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43878,16 +43893,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 1.29,
+    _v9Recall: 0.0285,
+    _v9FpRate: 0.0511,
+    _v9Precision: 0.0657,
     defaultOff: true
   },
   "java/raw-type-overuse": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.1093,
+    fpRate: 0.2041,
+    ratio: 0.54,
+    precision: 0.0632,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (Raw type usage \u2014 use generics). DORMANT until v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1126, FP=16712, P=6.32%, FPR=20.41%, recall=10.93%, ratio=0.54, lift=P/FPR=0.31. Strongly INVERTED: raw types (no generics) are 2x more common in legacy enterprise Java (neg) than in modern Java repos (pos). Heuristic is correctly identifying the legacy anti-pattern, but it's an age marker more than an AI-fingerprint. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43896,16 +43916,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.31,
+    _v9Recall: 0.1093,
+    _v9FpRate: 0.2041,
+    _v9Precision: 0.0632,
     defaultOff: true
   },
   "java/string-concat-loop": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 46e-4,
+    fpRate: 0.0358,
+    ratio: 0.13,
+    precision: 0.0158,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (String concat in loop \u2014 use StringBuilder). DORMANT until v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=47, FP=2933, P=1.58%, FPR=3.58%, recall=0.46%, ratio=0.13, lift=P/FPR=0.44. Strongly INVERTED: string concatenation in a loop is 8x more common in legacy enterprise Java (neg) than in AI/ML/Java-modern pos repos. Modern Java training data and modern IDE warnings discourage the pattern. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43914,16 +43939,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.44,
+    _v9Recall: 46e-4,
+    _v9FpRate: 0.0358,
+    _v9Precision: 0.0158,
     defaultOff: true
   },
   "java/system-out-println": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-01T00:00:00Z",
+    recall: 0.1503,
+    fpRate: 0.2533,
+    ratio: 0.59,
+    precision: 0.0695,
+    lastCalibratedAt: "2026-07-02T19:34:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.20: new rule (System.out.println in production code \u2014 use a logger). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+    _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1549, FP=20737, P=6.95%, FPR=25.32%, recall=15.03%, ratio=0.59, lift=P/FPR=0.27. INVERTED: System.out.println is more common in legacy enterprise Java (neg) than in modern AI/Java repos (pos). Modern Java defaults to SLF4J/Log4j, AI-generated Java starts with a logger import. The pattern is the opposite of the v0.20 design intent (which assumed println was the AI-fingerprint signal). v0.25.x: consider gating this rule by Java era (recent file mtime) or making it an age-fingerprint rather than AI-fingerprint. v0.20: new rule.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -43932,6 +43962,11 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.27,
+    _v9Recall: 0.1503,
+    _v9FpRate: 0.2533,
+    _v9Precision: 0.0695,
     defaultOff: true
   },
   "layout/forced-layout": {

package/dist/index.cjs

@@ -36,7 +36,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.25.0";
+    VERSION = "0.25.1";
   }
 });
 
@@ -344,19 +344,24 @@ var init_defaults = __esm({
        *   - `tests/rules/**` — rule test files contain expected-issue
        *     assertions, also meta-code.
        *
-       * Three patterns, ~70 issues removed per self-scan. Combined with
-       * the v0.25.0 graded security cap, this restores the v9 plan's
-       * "security ≥ 80" criterion (unachievable in v0.24.0 due to 90
-       * self-scan FPs collapsing the score to 0).
+       * Three patterns (broadened in v0.25.1 from the v0.25.0 narrow
+       * set, which missed `tests/engine/**`, `tests/cli/**`, and
+       * `snippet/**`), ~80 issues removed per self-scan. Combined
+       * with the v0.25.0 graded security cap, this restores the
+       * v9 plan's "security ≥ 80" criterion (unachievable in
+       * v0.24.0 due to 90 self-scan FPs collapsing the score to 0).
        *
        * Set `selfScan: { excludePaths: [] }` in `slopbrick.config.mjs`
        * to opt out and scan every file (legacy behavior).
        */
       selfScan: {
         excludePaths: [
-          "src/rules/**",
-          "tests/fixtures/**",
-          "tests/rules/**"
+          "**/src/rules/**",
+          // rule definitions are meta-code
+          "**/snippet/**",
+          // RULE_HINTS examples are intentional bad code
+          "**/tests/**"
+          // all test files (fixtures + unit + integration)
         ]
       }
     };
@@ -49911,13 +49916,13 @@ var init_signal_strength = __esm({
         defaultOff: true
       },
       "java/arraylist-vs-linkedlist": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 35e-4,
+        fpRate: 94e-4,
+        ratio: 0.37,
+        precision: 0.0446,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (new LinkedList<>() \u2014 use ArrayList (Effective Java Item 28)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files = 92196 total. v9 TP=36, FP=771, P=4.46%, FPR=0.94%, recall=0.35%, ratio=0.37, lift=P/FPR=4.74. Rule fires more on legacy enterprise Java (neg) than on AI/ML-integration Java (pos) because modern Java idiom defaults to ArrayList. v0.20: new rule (new LinkedList<>() \u2014 use ArrayList, Effective Java Item 28).",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49926,16 +49931,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 4.74,
+        _v9Recall: 35e-4,
+        _v9FpRate: 94e-4,
+        _v9Precision: 0.0446,
         defaultOff: true
       },
       "java/empty-catch-block": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 8e-3,
+        fpRate: 0.1118,
+        ratio: 0.07,
+        precision: 89e-4,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (Empty catch block \u2014 silently swallows exceptions). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=82, FP=9159, P=0.89%, FPR=11.18%, recall=0.80%, ratio=0.07, lift=P/FPR=0.08. Strongly INVERTED: empty catch blocks are 14x more common in legacy enterprise Java than in AI/Java-modern pos repos. Heuristic likely needs to be tightened (e.g., require at least a comment) before it can serve as a meaningful discriminator. v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49944,16 +49954,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.08,
+        _v9Recall: 8e-3,
+        _v9FpRate: 0.1118,
+        _v9Precision: 89e-4,
         defaultOff: true
       },
       "java/legacy-date-api": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 0.0285,
+        fpRate: 0.0511,
+        ratio: 0.56,
+        precision: 0.0657,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (Legacy java.util.Date / Calendar \u2014 use java.time (JSR-310)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=294, FP=4181, P=6.57%, FPR=5.11%, recall=2.85%, ratio=0.56, lift=P/FPR=1.29. INVERTED-to-NOISY: legacy date API is more common in older enterprise Java (neg) than in modern AI/Java repos (pos). The heuristic correctly flags the legacy pattern, but the legacy pattern is over-represented in the neg baseline (older codebases). v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49962,16 +49977,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 1.29,
+        _v9Recall: 0.0285,
+        _v9FpRate: 0.0511,
+        _v9Precision: 0.0657,
         defaultOff: true
       },
       "java/raw-type-overuse": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 0.1093,
+        fpRate: 0.2041,
+        ratio: 0.54,
+        precision: 0.0632,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (Raw type usage \u2014 use generics). DORMANT until v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1126, FP=16712, P=6.32%, FPR=20.41%, recall=10.93%, ratio=0.54, lift=P/FPR=0.31. Strongly INVERTED: raw types (no generics) are 2x more common in legacy enterprise Java (neg) than in modern Java repos (pos). Heuristic is correctly identifying the legacy anti-pattern, but it's an age marker more than an AI-fingerprint. v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49980,16 +50000,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.31,
+        _v9Recall: 0.1093,
+        _v9FpRate: 0.2041,
+        _v9Precision: 0.0632,
         defaultOff: true
       },
       "java/string-concat-loop": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 46e-4,
+        fpRate: 0.0358,
+        ratio: 0.13,
+        precision: 0.0158,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (String concat in loop \u2014 use StringBuilder). DORMANT until v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=47, FP=2933, P=1.58%, FPR=3.58%, recall=0.46%, ratio=0.13, lift=P/FPR=0.44. Strongly INVERTED: string concatenation in a loop is 8x more common in legacy enterprise Java (neg) than in AI/ML/Java-modern pos repos. Modern Java training data and modern IDE warnings discourage the pattern. v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49998,16 +50023,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.44,
+        _v9Recall: 46e-4,
+        _v9FpRate: 0.0358,
+        _v9Precision: 0.0158,
         defaultOff: true
       },
       "java/system-out-println": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 0.1503,
+        fpRate: 0.2533,
+        ratio: 0.59,
+        precision: 0.0695,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (System.out.println in production code \u2014 use a logger). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1549, FP=20737, P=6.95%, FPR=25.32%, recall=15.03%, ratio=0.59, lift=P/FPR=0.27. INVERTED: System.out.println is more common in legacy enterprise Java (neg) than in modern AI/Java repos (pos). Modern Java defaults to SLF4J/Log4j, AI-generated Java starts with a logger import. The pattern is the opposite of the v0.20 design intent (which assumed println was the AI-fingerprint signal). v0.25.x: consider gating this rule by Java era (recent file mtime) or making it an age-fingerprint rather than AI-fingerprint. v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -50016,6 +50046,11 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.27,
+        _v9Recall: 0.1503,
+        _v9FpRate: 0.2533,
+        _v9Precision: 0.0695,
         defaultOff: true
       },
       "layout/forced-layout": {

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.25.0";
+    VERSION = "0.25.1";
   }
 });
 
@@ -327,19 +327,24 @@ var init_defaults = __esm({
        *   - `tests/rules/**` — rule test files contain expected-issue
        *     assertions, also meta-code.
        *
-       * Three patterns, ~70 issues removed per self-scan. Combined with
-       * the v0.25.0 graded security cap, this restores the v9 plan's
-       * "security ≥ 80" criterion (unachievable in v0.24.0 due to 90
-       * self-scan FPs collapsing the score to 0).
+       * Three patterns (broadened in v0.25.1 from the v0.25.0 narrow
+       * set, which missed `tests/engine/**`, `tests/cli/**`, and
+       * `snippet/**`), ~80 issues removed per self-scan. Combined
+       * with the v0.25.0 graded security cap, this restores the
+       * v9 plan's "security ≥ 80" criterion (unachievable in
+       * v0.24.0 due to 90 self-scan FPs collapsing the score to 0).
        *
        * Set `selfScan: { excludePaths: [] }` in `slopbrick.config.mjs`
        * to opt out and scan every file (legacy behavior).
        */
       selfScan: {
         excludePaths: [
-          "src/rules/**",
-          "tests/fixtures/**",
-          "tests/rules/**"
+          "**/src/rules/**",
+          // rule definitions are meta-code
+          "**/snippet/**",
+          // RULE_HINTS examples are intentional bad code
+          "**/tests/**"
+          // all test files (fixtures + unit + integration)
         ]
       }
     };
@@ -49889,13 +49894,13 @@ var init_signal_strength = __esm({
         defaultOff: true
       },
       "java/arraylist-vs-linkedlist": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 35e-4,
+        fpRate: 94e-4,
+        ratio: 0.37,
+        precision: 0.0446,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (new LinkedList<>() \u2014 use ArrayList (Effective Java Item 28)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files = 92196 total. v9 TP=36, FP=771, P=4.46%, FPR=0.94%, recall=0.35%, ratio=0.37, lift=P/FPR=4.74. Rule fires more on legacy enterprise Java (neg) than on AI/ML-integration Java (pos) because modern Java idiom defaults to ArrayList. v0.20: new rule (new LinkedList<>() \u2014 use ArrayList, Effective Java Item 28).",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49904,16 +49909,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 4.74,
+        _v9Recall: 35e-4,
+        _v9FpRate: 94e-4,
+        _v9Precision: 0.0446,
         defaultOff: true
       },
       "java/empty-catch-block": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 8e-3,
+        fpRate: 0.1118,
+        ratio: 0.07,
+        precision: 89e-4,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (Empty catch block \u2014 silently swallows exceptions). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=82, FP=9159, P=0.89%, FPR=11.18%, recall=0.80%, ratio=0.07, lift=P/FPR=0.08. Strongly INVERTED: empty catch blocks are 14x more common in legacy enterprise Java than in AI/Java-modern pos repos. Heuristic likely needs to be tightened (e.g., require at least a comment) before it can serve as a meaningful discriminator. v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49922,16 +49932,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.08,
+        _v9Recall: 8e-3,
+        _v9FpRate: 0.1118,
+        _v9Precision: 89e-4,
         defaultOff: true
       },
       "java/legacy-date-api": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 0.0285,
+        fpRate: 0.0511,
+        ratio: 0.56,
+        precision: 0.0657,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (Legacy java.util.Date / Calendar \u2014 use java.time (JSR-310)). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=294, FP=4181, P=6.57%, FPR=5.11%, recall=2.85%, ratio=0.56, lift=P/FPR=1.29. INVERTED-to-NOISY: legacy date API is more common in older enterprise Java (neg) than in modern AI/Java repos (pos). The heuristic correctly flags the legacy pattern, but the legacy pattern is over-represented in the neg baseline (older codebases). v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49940,16 +49955,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 1.29,
+        _v9Recall: 0.0285,
+        _v9FpRate: 0.0511,
+        _v9Precision: 0.0657,
         defaultOff: true
       },
       "java/raw-type-overuse": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 0.1093,
+        fpRate: 0.2041,
+        ratio: 0.54,
+        precision: 0.0632,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (Raw type usage \u2014 use generics). DORMANT until v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1126, FP=16712, P=6.32%, FPR=20.41%, recall=10.93%, ratio=0.54, lift=P/FPR=0.31. Strongly INVERTED: raw types (no generics) are 2x more common in legacy enterprise Java (neg) than in modern Java repos (pos). Heuristic is correctly identifying the legacy anti-pattern, but it's an age marker more than an AI-fingerprint. v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49958,16 +49978,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.31,
+        _v9Recall: 0.1093,
+        _v9FpRate: 0.2041,
+        _v9Precision: 0.0632,
         defaultOff: true
       },
       "java/string-concat-loop": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 46e-4,
+        fpRate: 0.0358,
+        ratio: 0.13,
+        precision: 0.0158,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (String concat in loop \u2014 use StringBuilder). DORMANT until v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=47, FP=2933, P=1.58%, FPR=3.58%, recall=0.46%, ratio=0.13, lift=P/FPR=0.44. Strongly INVERTED: string concatenation in a loop is 8x more common in legacy enterprise Java (neg) than in AI/ML/Java-modern pos repos. Modern Java training data and modern IDE warnings discourage the pattern. v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49976,16 +50001,21 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.44,
+        _v9Recall: 46e-4,
+        _v9FpRate: 0.0358,
+        _v9Precision: 0.0158,
         defaultOff: true
       },
       "java/system-out-println": {
-        recall: 0,
-        fpRate: 0,
-        ratio: 1,
-        precision: 0,
-        lastCalibratedAt: "2026-07-01T00:00:00Z",
+        recall: 0.1503,
+        fpRate: 0.2533,
+        ratio: 0.59,
+        precision: 0.0695,
+        lastCalibratedAt: "2026-07-02T19:34:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.20: new rule (System.out.println in production code \u2014 use a logger). Not yet calibrated. Scheduled for v9 Java corpus calibration.",
+        _calibrationNote: "v9 Java corpus calibration (v0.25.0, 2026-07-02): 81891 neg + 10305 pos Java files. v9 TP=1549, FP=20737, P=6.95%, FPR=25.32%, recall=15.03%, ratio=0.59, lift=P/FPR=0.27. INVERTED: System.out.println is more common in legacy enterprise Java (neg) than in modern AI/Java repos (pos). Modern Java defaults to SLF4J/Log4j, AI-generated Java starts with a logger import. The pattern is the opposite of the v0.20 design intent (which assumed println was the AI-fingerprint signal). v0.25.x: consider gating this rule by Java era (recent file mtime) or making it an age-fingerprint rather than AI-fingerprint. v0.20: new rule.",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -49994,6 +50024,11 @@ var init_signal_strength = __esm({
         _v7Precision: 0,
         _v8Verdict: "DORMANT",
         _v8Lift: 1,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.27,
+        _v9Recall: 0.1503,
+        _v9FpRate: 0.2533,
+        _v9Precision: 0.0695,
         defaultOff: true
       },
       "layout/forced-layout": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slopbrick",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "description": "Discovered, modeled, and governed repository structure. SlopBrick scans source code, classifies it against 95+ rules in 15 categories, computes 4 scores (aiSlopScore: lower=cleaner, engineeringHygiene, security, repositoryHealth composite), and persists the structure for AI agents and CI.",
   "type": "module",
   "bin": {