slopbrick 0.27.0 → 0.29.0

package/dist/engine/worker.js

@@ -4337,6 +4337,15 @@ function parseSource(source, filePath) {
     case "go":
     case "rs":
     case "java":
+    // v0.28.0: Kotlin files get the same parseBlankModule path as
+    // Java (v0.24.5). All 5 `kotlin/*` rules are regex-based and
+    // gate themselves on `/\.kts?$/i.test(filePath)` inside their
+    // `analyze()`. The tree-sitter Kotlin integration is a larger
+    // lift; the v0.27.0 methodology paper confirmed era-confounding
+    // is the dominant signal anyway, so a regex-only Kotlin pass is
+    // sufficient for the v9 calibration goal.
+    case "kt":
+    case "kts":
       return parseBlankModule(source);
     default:
       return parseWithSwc(source, filePath);
@@ -36977,7 +36986,7 @@ var kotlinCoroutineGlobalScopeRule = createRule({
     const issues = [];
     const source = facts.v2?._source;
     if (!source) return issues;
-    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
     let m;
     GLOBAL_SCOPE_REGEX.lastIndex = 0;
     while ((m = GLOBAL_SCOPE_REGEX.exec(source)) !== null) {
@@ -37014,7 +37023,7 @@ var kotlinDataClassDefaultsOveruseRule = createRule({
     const issues = [];
     const source = facts.v2?._source;
     if (!source) return issues;
-    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
     let m;
     DATA_CLASS_HEAD_REGEX.lastIndex = 0;
     while ((m = DATA_CLASS_HEAD_REGEX.exec(source)) !== null) {
@@ -37054,6 +37063,101 @@ var kotlinDataClassDefaultsOveruseRule = createRule({
   }
 });
 
+// src/rules/kotlin/force-unwrap.ts
+var FORCE_UNWRAP_REGEX = /!!(?=\s*[.\)}\};,\n\[])/g;
+var kotlinForceUnwrapRule = createRule({
+  id: "kotlin/force-unwrap",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: false,
+  description: "!! force-unwrap \u2014 use ?. (safe call) or a proper null check",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
+    let m;
+    FORCE_UNWRAP_REGEX.lastIndex = 0;
+    while ((m = FORCE_UNWRAP_REGEX.exec(source)) !== null) {
+      const line = source.slice(0, m.index).split("\n").length;
+      const lineStart = source.lastIndexOf("\n", m.index) + 1;
+      const lineText = source.slice(lineStart, m.index);
+      const quoteCount = (lineText.match(/"/g) || []).length;
+      if (quoteCount % 2 === 1) continue;
+      issues.push({
+        ruleId: "kotlin/force-unwrap",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: false,
+        message: `!! force-unwrap at line ${line}`,
+        line,
+        column: m.index - lineStart + 1,
+        advice: "Use ?. (safe call) with ?: (Elvis) for a default, or a proper when/if check. !! throws NullPointerException at runtime \u2014 it bypasses Kotlin's type system. Reference: kotlin/force-unwrap v0.29."
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/kotlin/hardcoded-credential.ts
+var KEY_REGEX = /\b(api[_-]?key|apikey|secret|token|password|auth|access[_-]?key|client[_-]?secret|private[_-]?key)\b\s*[=:]/i;
+var VALUE_REGEX = /["']([A-Za-z0-9_\-+/=.@*!]{16,})["']/;
+var FALSE_POSITIVES = /* @__PURE__ */ new Set([
+  "passwordless",
+  "tokenize",
+  "tokenizer",
+  "authorizationrequired",
+  "authenticated",
+  "authenticatortoken",
+  "authtoken",
+  "placeholder",
+  // common in test fixtures
+  "changeme"
+  // placeholder, but still suspicious — kept for review
+]);
+var kotlinHardcodedCredentialRule = createRule({
+  id: "kotlin/hardcoded-credential",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "Hardcoded credential literal \u2014 use env vars or a secrets manager",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
+    const lines = source.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!KEY_REGEX.test(line)) continue;
+      const valueMatch = VALUE_REGEX.exec(line);
+      if (!valueMatch) continue;
+      const value = valueMatch[1];
+      if (FALSE_POSITIVES.has(value.toLowerCase())) continue;
+      if (!/[a-zA-Z]/.test(value) || !/[0-9]/.test(value)) continue;
+      if (value.startsWith("$")) continue;
+      if (/\/test\//i.test(facts.filePath) || /\.test\.kts?$/i.test(facts.filePath)) continue;
+      issues.push({
+        ruleId: "kotlin/hardcoded-credential",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `Hardcoded credential at line ${i + 1}`,
+        line: i + 1,
+        column: 1,
+        advice: "Move the credential to an environment variable, a .env file that is .gitignore'd, or a secrets manager (Vault, AWS Secrets Manager, GCP Secret Manager). Hardcoded credentials are the #1 source of secret leaks on GitHub. Reference: kotlin/hardcoded-credential v0.29 (OWASP A07:2021 \u2014 Identification and Authentication Failures)."
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/kotlin/object-singleton-misuse.ts
 var OBJECT_DECL_REGEX = /\bobject\s+(?!\w*Companion\b)(\w+)\s*\{/g;
 var kotlinObjectSingletonMisuseRule = createRule({
@@ -37069,7 +37173,7 @@ var kotlinObjectSingletonMisuseRule = createRule({
     const issues = [];
     const source = facts.v2?._source;
     if (!source) return issues;
-    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
     let m;
     OBJECT_DECL_REGEX.lastIndex = 0;
     while ((m = OBJECT_DECL_REGEX.exec(source)) !== null) {
@@ -37104,8 +37208,46 @@ var kotlinObjectSingletonMisuseRule = createRule({
   }
 });
 
+// src/rules/kotlin/println-as-log.ts
+var PRINTLN_REGEX = /\bprintln\s*\(/g;
+var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
+var kotlinPrintlnAsLogRule = createRule({
+  id: "kotlin/println-as-log",
+  category: "logic",
+  severity: "low",
+  aiSpecific: false,
+  description: "println() used for logging \u2014 use slf4j, kermit, or android.util.Log",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\.test\.kts?$/i.test(facts.filePath)) return issues;
+    if (REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
+    let m;
+    PRINTLN_REGEX.lastIndex = 0;
+    while ((m = PRINTLN_REGEX.exec(source)) !== null) {
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "kotlin/println-as-log",
+        category: "logic",
+        severity: "low",
+        aiSpecific: false,
+        message: `println() as logger at line ${line}`,
+        line,
+        column: 1,
+        advice: "Use a real logging library: slf4j (JVM), android.util.Log (Android), Timber (Android), kermit (multiplatform), or kotlin-logging. println() has no log level, no timestamp, no correlation ID, and cannot be filtered. Reference: kotlin/println-as-log v0.29."
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/kotlin/println-debug.ts
-var PRINTLN_REGEX = /^\s*println\s*\(/gm;
+var PRINTLN_REGEX2 = /^\s*println\s*\(/gm;
 var DEFAULT_THRESHOLD = 1;
 var kotlinPrintlnDebugRule = createRule({
   id: "kotlin/println-debug",
@@ -37120,11 +37262,11 @@ var kotlinPrintlnDebugRule = createRule({
     const issues = [];
     const source = facts.v2?._source;
     if (!source) return issues;
-    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
     const matches = [];
     let m;
-    PRINTLN_REGEX.lastIndex = 0;
-    while ((m = PRINTLN_REGEX.exec(source)) !== null) {
+    PRINTLN_REGEX2.lastIndex = 0;
+    while ((m = PRINTLN_REGEX2.exec(source)) !== null) {
       matches.push(m.index);
     }
     if (matches.length <= context.threshold) return issues;
@@ -37147,6 +37289,81 @@ var kotlinPrintlnDebugRule = createRule({
   }
 });
 
+// src/rules/kotlin/runblocking-misuse.ts
+var RUN_BLOCKING_REGEX = /\brunBlocking\s*[({]/g;
+var kotlinRunBlockingMisuseRule = createRule({
+  id: "kotlin/runblocking-misuse",
+  category: "perf",
+  severity: "medium",
+  aiSpecific: false,
+  description: "runBlocking { ... } \u2014 blocks the calling thread; use coroutineScope {} or call suspend fun directly",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
+    if (/\bfun\s+main\s*\(/.test(source)) return issues;
+    let m;
+    RUN_BLOCKING_REGEX.lastIndex = 0;
+    while ((m = RUN_BLOCKING_REGEX.exec(source)) !== null) {
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "kotlin/runblocking-misuse",
+        category: "perf",
+        severity: "medium",
+        aiSpecific: false,
+        message: `runBlocking { ... } at line ${line}`,
+        line,
+        column: 1,
+        advice: 'runBlocking blocks the calling thread, defeating the purpose of coroutines. Use coroutineScope { } for structured concurrency, or call the suspend function directly. The Kotlin coroutines docs: runBlocking "should rarely (if ever) be used outside of main()". Reference: kotlin/runblocking-misuse v0.29.'
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/kotlin/sql-string-concat.ts
+var SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
+var UNSAFE_REGEX = /(?:\+|\$\{)/;
+var SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\\?\\?|\?\\s*,)/;
+var kotlinSqlStringConcatRule = createRule({
+  id: "kotlin/sql-string-concat",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "SQL query built via string concat / template \u2014 use PreparedStatement or setParameter()",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
+    const lines = source.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!SQL_KEYWORD_REGEX.test(line)) continue;
+      if (!UNSAFE_REGEX.test(line)) continue;
+      if (SAFE_REGEX.test(line)) continue;
+      issues.push({
+        ruleId: "kotlin/sql-string-concat",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `SQL query built via string concat/template at line ${i + 1}`,
+        line: i + 1,
+        column: 1,
+        advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.29 (OWASP A03:2021).'
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/kotlin/string-concat-loop.ts
 var STRING_CONCAT_REGEX = /\b(\w+)\s*=\s*\1\s*\+\s*[^;}]+[;}\n]/g;
 var kotlinStringConcatLoopRule = createRule({
@@ -37162,7 +37379,7 @@ var kotlinStringConcatLoopRule = createRule({
     const issues = [];
     const source = facts.v2?._source;
     if (!source) return issues;
-    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    if (!/\.kts?$/i.test(facts.filePath)) return issues;
     if (!/\b(?:for|while|repeat|forEach)\b/.test(source)) return issues;
     let m;
     STRING_CONCAT_REGEX.lastIndex = 0;
@@ -42709,8 +42926,13 @@ var builtinRules = [
   goStructTagInconsistencyRule,
   kotlinCoroutineGlobalScopeRule,
   kotlinDataClassDefaultsOveruseRule,
+  kotlinForceUnwrapRule,
+  kotlinHardcodedCredentialRule,
   kotlinObjectSingletonMisuseRule,
+  kotlinPrintlnAsLogRule,
   kotlinPrintlnDebugRule,
+  kotlinRunBlockingMisuseRule,
+  kotlinSqlStringConcatRule,
   kotlinStringConcatLoopRule,
   gapMonopolyRule,
   mathElementUniformityRule,
@@ -44815,13 +45037,13 @@ var signal_strength_default = {
     defaultOff: true
   },
   "kotlin/data-class-defaults-overuse": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    recall: 469e-5,
+    fpRate: 222e-5,
+    ratio: 2.11,
+    precision: 0.1429,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.24: new rule (data class with 3+ literal defaults). DORMANT until v9 Kotlin corpus calibration.",
+    _calibrationNote: "v0.28: v9 Kotlin calibration (2698 neg, 213 pos). ratio=2.11 (\u22651.5) but precision=14.3% (<50%) \u2014 verdict DORMANT. Era-confounding: pre-2022 Kotlin is sparse; the rule fires on the rare .kt file with multiple default values regardless of authorship.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -44830,16 +45052,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 2.11,
+    _v9Recall: 469e-5,
+    _v9FpRate: 222e-5,
+    _v9Precision: 0.1429,
     defaultOff: true
   },
   "kotlin/coroutine-global-scope": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    recall: 469e-5,
+    fpRate: 0.05004,
+    ratio: 0.09,
+    precision: 735e-5,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.24: new rule (GlobalScope.launch/async/runBlocking \u2014 bypasses structured concurrency). DORMANT until v9 Kotlin corpus calibration.",
+    _calibrationNote: "v0.28: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.09 (FAR <1.0) \u2014 fires 135x more on neg than pos. Classic era-confound: pre-2022 Kotlin coroutines had GlobalScope as the default; modern Kotlin uses viewModelScope / lifecycleScope. The rule detects era, not AI authorship.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -44848,16 +45075,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.09,
+    _v9Recall: 469e-5,
+    _v9FpRate: 0.05004,
+    _v9Precision: 735e-5,
     defaultOff: true
   },
   "kotlin/println-debug": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    recall: 0.07042,
+    fpRate: 0.11379,
+    ratio: 0.62,
+    precision: 0.04659,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.24: new rule (multi-println in Kotlin source \u2014 use Timber / android.util.Log). DORMANT until v9 Kotlin corpus calibration.",
+    _calibrationNote: "v0.28: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.62 (\u226A1.0) \u2014 fires 20x more on neg than pos. Classic era-confound: pre-2022 Kotlin code uses println() for debug; modern Kotlin uses Timber / android.util.Log / kermit.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -44866,16 +45098,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.62,
+    _v9Recall: 0.07042,
+    _v9FpRate: 0.11379,
+    _v9Precision: 0.04659,
     defaultOff: true
   },
   "kotlin/object-singleton-misuse": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    recall: 469e-5,
+    fpRate: 371e-5,
+    ratio: 1.27,
+    precision: 0.09091,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.24: new rule (Kotlin `object` singleton holding `var` \u2014 hidden shared state). DORMANT until v9 Kotlin corpus calibration.",
+    _calibrationNote: "v0.28: v9 Kotlin calibration (2698 neg, 213 pos). ratio=1.27 (\u22651.0) but <1.5; precision=9.1% \u2014 verdict DORMANT. INSUFFICIENT_DATA: pos arm only 213 files (under 10k minimum).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -44884,16 +45121,21 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 1.27,
+    _v9Recall: 469e-5,
+    _v9FpRate: 371e-5,
+    _v9Precision: 0.09091,
     defaultOff: true
   },
   "kotlin/string-concat-loop": {
-    recall: 0,
-    fpRate: 0,
-    ratio: 1,
-    precision: 0,
-    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    recall: 939e-5,
+    fpRate: 519e-5,
+    ratio: 1.81,
+    precision: 0.125,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.24: new rule (string concat inside a Kotlin loop \u2014 use buildString { ... }). DORMANT until v9 Kotlin corpus calibration.",
+    _calibrationNote: "v0.28: v9 Kotlin calibration (2698 neg, 213 pos). ratio=1.81 (\u22651.5) but precision=12.5% (<50%) \u2014 verdict DORMANT. INSUFFICIENT_DATA: pos arm only 213 files.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -44902,6 +45144,91 @@ var signal_strength_default = {
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 1.81,
+    _v9Recall: 939e-5,
+    _v9FpRate: 519e-5,
+    _v9Precision: 0.125,
+    defaultOff: true
+  },
+  "kotlin/sql-string-concat": {
+    recall: 469e-5,
+    fpRate: 63e-4,
+    ratio: 0.75,
+    precision: 0.0556,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.75 (DORMANT). 18 fires total \u2014 modern Kotlin mostly uses ORMs (Room/Exposed) so SQL string concat is rare in both arms. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: rule is loadable but invisible by default until v0.30 re-calibration with a larger pos arm.",
+    aiSpecific: false,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.75,
+    _v9Recall: 469e-5,
+    _v9FpRate: 63e-4,
+    _v9Precision: 0.0556,
+    defaultOff: true
+  },
+  "kotlin/hardcoded-credential": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). 0 fires. The 16-char value threshold + letters+digit heuristic is too strict for the corpus; real-world secrets are in env vars / config files, not source. INSUFFICIENT_DATA: needs different corpus (CI configs, .env samples). defaultOff: loadable but invisible by default.",
+    aiSpecific: false,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: true
+  },
+  "kotlin/runblocking-misuse": {
+    recall: 0.10798,
+    fpRate: 0.21534,
+    ratio: 0.5,
+    precision: 0.0381,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.50 \u2014 fires 2x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Kotlin coroutines used runBlocking more; modern Kotlin uses coroutineScope. Same direction as kotlin/coroutine-global-scope (0.09). defaultOff: loadable but invisible by default until v0.30 re-calibration.",
+    aiSpecific: false,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.5,
+    _v9Recall: 0.10798,
+    _v9FpRate: 0.21534,
+    _v9Precision: 0.0381,
+    defaultOff: true
+  },
+  "kotlin/println-as-log": {
+    recall: 0.08451,
+    fpRate: 0.04596,
+    ratio: 1.84,
+    precision: 0.1268,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=1.84 (\u22651.5) \u2014 first rule in this entire session with a positive direction! Fires 1.84x more on post-2024 AI/demos than pre-2022 production. Precision=12.7% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Kotlin code (especially AI-generated examples) uses println for output; pre-2022 production code uses slf4j/kermit. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: still set to true (verdict is OK but precision is below 50% \u2014 the guardrail expects OK/USEFUL rules to be defaultOff:false only when calibrated with a meaningful pos arm).",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 1.84,
+    _v9Recall: 0.08451,
+    _v9FpRate: 0.04596,
+    _v9Precision: 0.1268,
+    defaultOff: true
+  },
+  "kotlin/force-unwrap": {
+    recall: 0.11737,
+    fpRate: 0.33284,
+    ratio: 0.35,
+    precision: 0.0271,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.35 \u2014 fires 3x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Kotlin code uses !! freely; modern Kotlin relies on ?./?: and Result<T> wrappers. Stronger era signal than runblocking-misuse. defaultOff: loadable but invisible by default.",
+    aiSpecific: false,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.35,
+    _v9Recall: 0.11737,
+    _v9FpRate: 0.33284,
+    _v9Precision: 0.0271,
     defaultOff: true
   },
   "swift/force-unwrap": {
@@ -45134,8 +45461,6 @@ async function scanFile(filePath, config, registry, cwd = process.cwd()) {
   const ext = extname4(filePath).toLowerCase();
   const UNSUPPORTED_LANGS = /* @__PURE__ */ new Set([
     ".swift",
-    ".kt",
-    ".kts",
     ".dart",
     ".cpp",
     ".cc",