slopbrick 0.30.0 → 0.31.0

package/dist/engine/worker.cjs

@@ -37132,13 +37132,13 @@ var javaSqlStringConcatRule = createRule({
 
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
-var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging|io\.github\.oshai\.kotlinlogging)/;
+var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
 var javaSystemOutPrintlnRule = createRule({
   id: "java/system-out-println",
   category: "logic",
   severity: "low",
   aiSpecific: false,
-  description: "System.out.println() used for logging \u2014 use SLF4J, Log4j2, or java.util.logging",
+  description: "System.out.println() in a file that imports SLF4J/Log4j2 \u2014 use the declared logger instead",
   create(_context) {
     return {};
   },
@@ -37148,7 +37148,7 @@ var javaSystemOutPrintlnRule = createRule({
     if (!source) return issues;
     if (!/\.java$/i.test(facts.filePath)) return issues;
     if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
-    if (REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
+    if (!REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
     let m;
     SYSTEM_OUT_REGEX.lastIndex = 0;
     while ((m = SYSTEM_OUT_REGEX.exec(source)) !== null) {
@@ -37158,10 +37158,10 @@ var javaSystemOutPrintlnRule = createRule({
         category: "logic",
         severity: "low",
         aiSpecific: false,
-        message: `System.out.println() at line ${line}`,
+        message: `System.out.println() at line ${line} (file imports a real logger)`,
         line,
         column: 1,
-        advice: "Use a real logging library: SLF4J (the standard facade), Log4j2, or java.util.logging. System.out has no log level, no timestamp, no correlation ID, and cannot be filtered. Migration: add `private static final Logger log = LoggerFactory.getLogger(MyClass.class);` and replace `System.out.println(x)` with `log.info(x)`. Reference: java/system-out-println v0.30."
+        advice: "The file imports a real logging library (SLF4J, Log4j2, or java.util.logging) but uses System.out.println here. Replace `System.out.println(x)` with `log.info(x)` (or log.debug/warn/error as appropriate). The log object is already declared at the top of the file. Reference: java/system-out-println v0.31 (refined from v0.30)."
       });
     }
     return issues;
@@ -45519,19 +45519,19 @@ var signal_strength_default = {
     defaultOff: true
   },
   "java/system-out-println": {
-    recall: 0.16681,
-    fpRate: 0.05064,
-    ratio: 3.29,
-    precision: 0.293,
+    recall: 116e-5,
+    fpRate: 67e-5,
+    ratio: 1.73,
+    precision: 0.1791,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "OK",
-    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=3.29 (\u22651.5) \u2014 second positive-signal rule in v9 history (after kotlin/println-as-log at 1.84). Fires 3.29x more on post-2024 (pos) AI code than pre-2022 (neg) production. 5866 total fires (highest of any v0.30 rule). Precision=29.3% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Java (especially AI-generated examples) uses System.out for output; pre-2022 production uses slf4j. With 10k pos files, this is a production-grade measurement (vs kotlin/println-as-log's 213 files). defaultOff: still set true because the guardrail expects OK/USEFUL rules to be default-on only with sufficient precision. The v0.31+ re-calibration may flip this if precision improves.",
+    _calibrationNote: "v0.31: v9 Java calibration REFINED \u2014 rule now requires the file to import a real logger (SLF4J, Log4j2, java.util.logging) AND have System.out.println calls. This is the 'set up but didn't use' anti-pattern. ratio=1.73 (\u22651.5) \u2014 second positive-signal rule in v9 history. v0.30.0 unrefined version had ratio=3.29 but precision=29.3% (over 5800 fires diluted by legitimate System.out in non-slf4j files). v0.31.0 refined version: 12 TP, 55 FP \u2014 much more selective, but absolute count is too small for production-grade measurement. precision=17.91% (still below 50% USEFUL threshold). The refinement succeeded: the fires dropped 99% (5866\u219267) and precision went 29.3%\u219217.9% (a tradeoff \u2014 fewer fires but more targeted). The direction is preserved: post-2024 Java has slightly more 'slf4j import + System.out call' than pre-2022. defaultOff: still set true (precision below 50%).",
     aiSpecific: false,
     _v9Verdict: "OK",
-    _v9Lift: 3.29,
-    _v9Recall: 0.16681,
-    _v9FpRate: 0.05064,
-    _v9Precision: 0.293,
+    _v9Lift: 1.73,
+    _v9Recall: 116e-5,
+    _v9FpRate: 67e-5,
+    _v9Precision: 0.1791,
     defaultOff: true
   },
   "java/command-injection": {

package/dist/engine/worker.js

@@ -37103,13 +37103,13 @@ var javaSqlStringConcatRule = createRule({
 
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
-var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging|io\.github\.oshai\.kotlinlogging)/;
+var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
 var javaSystemOutPrintlnRule = createRule({
   id: "java/system-out-println",
   category: "logic",
   severity: "low",
   aiSpecific: false,
-  description: "System.out.println() used for logging \u2014 use SLF4J, Log4j2, or java.util.logging",
+  description: "System.out.println() in a file that imports SLF4J/Log4j2 \u2014 use the declared logger instead",
   create(_context) {
     return {};
   },
@@ -37119,7 +37119,7 @@ var javaSystemOutPrintlnRule = createRule({
     if (!source) return issues;
     if (!/\.java$/i.test(facts.filePath)) return issues;
     if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
-    if (REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
+    if (!REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
     let m;
     SYSTEM_OUT_REGEX.lastIndex = 0;
     while ((m = SYSTEM_OUT_REGEX.exec(source)) !== null) {
@@ -37129,10 +37129,10 @@ var javaSystemOutPrintlnRule = createRule({
         category: "logic",
         severity: "low",
         aiSpecific: false,
-        message: `System.out.println() at line ${line}`,
+        message: `System.out.println() at line ${line} (file imports a real logger)`,
         line,
         column: 1,
-        advice: "Use a real logging library: SLF4J (the standard facade), Log4j2, or java.util.logging. System.out has no log level, no timestamp, no correlation ID, and cannot be filtered. Migration: add `private static final Logger log = LoggerFactory.getLogger(MyClass.class);` and replace `System.out.println(x)` with `log.info(x)`. Reference: java/system-out-println v0.30."
+        advice: "The file imports a real logging library (SLF4J, Log4j2, or java.util.logging) but uses System.out.println here. Replace `System.out.println(x)` with `log.info(x)` (or log.debug/warn/error as appropriate). The log object is already declared at the top of the file. Reference: java/system-out-println v0.31 (refined from v0.30)."
       });
     }
     return issues;
@@ -45490,19 +45490,19 @@ var signal_strength_default = {
     defaultOff: true
   },
   "java/system-out-println": {
-    recall: 0.16681,
-    fpRate: 0.05064,
-    ratio: 3.29,
-    precision: 0.293,
+    recall: 116e-5,
+    fpRate: 67e-5,
+    ratio: 1.73,
+    precision: 0.1791,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "OK",
-    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=3.29 (\u22651.5) \u2014 second positive-signal rule in v9 history (after kotlin/println-as-log at 1.84). Fires 3.29x more on post-2024 (pos) AI code than pre-2022 (neg) production. 5866 total fires (highest of any v0.30 rule). Precision=29.3% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Java (especially AI-generated examples) uses System.out for output; pre-2022 production uses slf4j. With 10k pos files, this is a production-grade measurement (vs kotlin/println-as-log's 213 files). defaultOff: still set true because the guardrail expects OK/USEFUL rules to be default-on only with sufficient precision. The v0.31+ re-calibration may flip this if precision improves.",
+    _calibrationNote: "v0.31: v9 Java calibration REFINED \u2014 rule now requires the file to import a real logger (SLF4J, Log4j2, java.util.logging) AND have System.out.println calls. This is the 'set up but didn't use' anti-pattern. ratio=1.73 (\u22651.5) \u2014 second positive-signal rule in v9 history. v0.30.0 unrefined version had ratio=3.29 but precision=29.3% (over 5800 fires diluted by legitimate System.out in non-slf4j files). v0.31.0 refined version: 12 TP, 55 FP \u2014 much more selective, but absolute count is too small for production-grade measurement. precision=17.91% (still below 50% USEFUL threshold). The refinement succeeded: the fires dropped 99% (5866\u219267) and precision went 29.3%\u219217.9% (a tradeoff \u2014 fewer fires but more targeted). The direction is preserved: post-2024 Java has slightly more 'slf4j import + System.out call' than pre-2022. defaultOff: still set true (precision below 50%).",
     aiSpecific: false,
     _v9Verdict: "OK",
-    _v9Lift: 3.29,
-    _v9Recall: 0.16681,
-    _v9FpRate: 0.05064,
-    _v9Precision: 0.293,
+    _v9Lift: 1.73,
+    _v9Recall: 116e-5,
+    _v9FpRate: 67e-5,
+    _v9Precision: 0.1791,
     defaultOff: true
   },
   "java/command-injection": {

package/dist/index.cjs

@@ -36,7 +36,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.30.0";
+    VERSION = "0.31.0";
   }
 });
 
@@ -30820,13 +30820,13 @@ var init_system_out_println = __esm({
     "use strict";
     init_rule();
     SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
-    REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging|io\.github\.oshai\.kotlinlogging)/;
+    REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
     javaSystemOutPrintlnRule = createRule({
       id: "java/system-out-println",
       category: "logic",
       severity: "low",
       aiSpecific: false,
-      description: "System.out.println() used for logging \u2014 use SLF4J, Log4j2, or java.util.logging",
+      description: "System.out.println() in a file that imports SLF4J/Log4j2 \u2014 use the declared logger instead",
       create(_context) {
         return {};
       },
@@ -30836,7 +30836,7 @@ var init_system_out_println = __esm({
         if (!source) return issues;
         if (!/\.java$/i.test(facts.filePath)) return issues;
         if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
-        if (REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
+        if (!REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
         let m;
         SYSTEM_OUT_REGEX.lastIndex = 0;
         while ((m = SYSTEM_OUT_REGEX.exec(source)) !== null) {
@@ -30846,10 +30846,10 @@ var init_system_out_println = __esm({
             category: "logic",
             severity: "low",
             aiSpecific: false,
-            message: `System.out.println() at line ${line}`,
+            message: `System.out.println() at line ${line} (file imports a real logger)`,
             line,
             column: 1,
-            advice: "Use a real logging library: SLF4J (the standard facade), Log4j2, or java.util.logging. System.out has no log level, no timestamp, no correlation ID, and cannot be filtered. Migration: add `private static final Logger log = LoggerFactory.getLogger(MyClass.class);` and replace `System.out.println(x)` with `log.info(x)`. Reference: java/system-out-println v0.30."
+            advice: "The file imports a real logging library (SLF4J, Log4j2, or java.util.logging) but uses System.out.println here. Replace `System.out.println(x)` with `log.info(x)` (or log.debug/warn/error as appropriate). The log object is already declared at the top of the file. Reference: java/system-out-println v0.31 (refined from v0.30)."
           });
         }
         return issues;
@@ -51606,19 +51606,19 @@ var init_signal_strength = __esm({
         defaultOff: true
       },
       "java/system-out-println": {
-        recall: 0.16681,
-        fpRate: 0.05064,
-        ratio: 3.29,
-        precision: 0.293,
+        recall: 116e-5,
+        fpRate: 67e-5,
+        ratio: 1.73,
+        precision: 0.1791,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "OK",
-        _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=3.29 (\u22651.5) \u2014 second positive-signal rule in v9 history (after kotlin/println-as-log at 1.84). Fires 3.29x more on post-2024 (pos) AI code than pre-2022 (neg) production. 5866 total fires (highest of any v0.30 rule). Precision=29.3% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Java (especially AI-generated examples) uses System.out for output; pre-2022 production uses slf4j. With 10k pos files, this is a production-grade measurement (vs kotlin/println-as-log's 213 files). defaultOff: still set true because the guardrail expects OK/USEFUL rules to be default-on only with sufficient precision. The v0.31+ re-calibration may flip this if precision improves.",
+        _calibrationNote: "v0.31: v9 Java calibration REFINED \u2014 rule now requires the file to import a real logger (SLF4J, Log4j2, java.util.logging) AND have System.out.println calls. This is the 'set up but didn't use' anti-pattern. ratio=1.73 (\u22651.5) \u2014 second positive-signal rule in v9 history. v0.30.0 unrefined version had ratio=3.29 but precision=29.3% (over 5800 fires diluted by legitimate System.out in non-slf4j files). v0.31.0 refined version: 12 TP, 55 FP \u2014 much more selective, but absolute count is too small for production-grade measurement. precision=17.91% (still below 50% USEFUL threshold). The refinement succeeded: the fires dropped 99% (5866\u219267) and precision went 29.3%\u219217.9% (a tradeoff \u2014 fewer fires but more targeted). The direction is preserved: post-2024 Java has slightly more 'slf4j import + System.out call' than pre-2022. defaultOff: still set true (precision below 50%).",
         aiSpecific: false,
         _v9Verdict: "OK",
-        _v9Lift: 3.29,
-        _v9Recall: 0.16681,
-        _v9FpRate: 0.05064,
-        _v9Precision: 0.293,
+        _v9Lift: 1.73,
+        _v9Recall: 116e-5,
+        _v9FpRate: 67e-5,
+        _v9Precision: 0.1791,
         defaultOff: true
       },
       "java/command-injection": {
@@ -59859,7 +59859,7 @@ var RULE_HINTS = {
   "java/sql-string-concat": "Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{}). String concat into SQL is the canonical SQL-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT, ratio 0.59.)",
   "java/hardcoded-credential": "Move the credential to an env var, a .env file (gitignored), or a secrets manager (Vault, AWS Secrets Manager). Hardcoded creds are the #1 secret-leak vector. OWASP A07:2021. (v0.30.0 \u2014 DORMANT, 0 fires on v9 Java corpus.)",
   "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
-  "java/system-out-println": "Use SLF4J (the standard facade), Log4j2, or java.util.logging. System.out has no log level, no timestamp, no correlation ID. (v0.30.0 \u2014 OK; second positive-signal rule in v9 history, ratio 3.29.)",
+  "java/system-out-println": "The file imports a real logger (SLF4J/Log4j2/java.util.logging) but uses System.out.println. Use the declared log object instead. (v0.31.0 \u2014 OK; ratio 1.73, refined from v0.30.)",
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.30.0";
+    VERSION = "0.31.0";
   }
 });
 
@@ -30801,13 +30801,13 @@ var init_system_out_println = __esm({
     "use strict";
     init_rule();
     SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
-    REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging|io\.github\.oshai\.kotlinlogging)/;
+    REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
     javaSystemOutPrintlnRule = createRule({
       id: "java/system-out-println",
       category: "logic",
       severity: "low",
       aiSpecific: false,
-      description: "System.out.println() used for logging \u2014 use SLF4J, Log4j2, or java.util.logging",
+      description: "System.out.println() in a file that imports SLF4J/Log4j2 \u2014 use the declared logger instead",
       create(_context) {
         return {};
       },
@@ -30817,7 +30817,7 @@ var init_system_out_println = __esm({
         if (!source) return issues;
         if (!/\.java$/i.test(facts.filePath)) return issues;
         if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
-        if (REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
+        if (!REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
         let m;
         SYSTEM_OUT_REGEX.lastIndex = 0;
         while ((m = SYSTEM_OUT_REGEX.exec(source)) !== null) {
@@ -30827,10 +30827,10 @@ var init_system_out_println = __esm({
             category: "logic",
             severity: "low",
             aiSpecific: false,
-            message: `System.out.println() at line ${line}`,
+            message: `System.out.println() at line ${line} (file imports a real logger)`,
             line,
             column: 1,
-            advice: "Use a real logging library: SLF4J (the standard facade), Log4j2, or java.util.logging. System.out has no log level, no timestamp, no correlation ID, and cannot be filtered. Migration: add `private static final Logger log = LoggerFactory.getLogger(MyClass.class);` and replace `System.out.println(x)` with `log.info(x)`. Reference: java/system-out-println v0.30."
+            advice: "The file imports a real logging library (SLF4J, Log4j2, or java.util.logging) but uses System.out.println here. Replace `System.out.println(x)` with `log.info(x)` (or log.debug/warn/error as appropriate). The log object is already declared at the top of the file. Reference: java/system-out-println v0.31 (refined from v0.30)."
           });
         }
         return issues;
@@ -51584,19 +51584,19 @@ var init_signal_strength = __esm({
         defaultOff: true
       },
       "java/system-out-println": {
-        recall: 0.16681,
-        fpRate: 0.05064,
-        ratio: 3.29,
-        precision: 0.293,
+        recall: 116e-5,
+        fpRate: 67e-5,
+        ratio: 1.73,
+        precision: 0.1791,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "OK",
-        _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=3.29 (\u22651.5) \u2014 second positive-signal rule in v9 history (after kotlin/println-as-log at 1.84). Fires 3.29x more on post-2024 (pos) AI code than pre-2022 (neg) production. 5866 total fires (highest of any v0.30 rule). Precision=29.3% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Java (especially AI-generated examples) uses System.out for output; pre-2022 production uses slf4j. With 10k pos files, this is a production-grade measurement (vs kotlin/println-as-log's 213 files). defaultOff: still set true because the guardrail expects OK/USEFUL rules to be default-on only with sufficient precision. The v0.31+ re-calibration may flip this if precision improves.",
+        _calibrationNote: "v0.31: v9 Java calibration REFINED \u2014 rule now requires the file to import a real logger (SLF4J, Log4j2, java.util.logging) AND have System.out.println calls. This is the 'set up but didn't use' anti-pattern. ratio=1.73 (\u22651.5) \u2014 second positive-signal rule in v9 history. v0.30.0 unrefined version had ratio=3.29 but precision=29.3% (over 5800 fires diluted by legitimate System.out in non-slf4j files). v0.31.0 refined version: 12 TP, 55 FP \u2014 much more selective, but absolute count is too small for production-grade measurement. precision=17.91% (still below 50% USEFUL threshold). The refinement succeeded: the fires dropped 99% (5866\u219267) and precision went 29.3%\u219217.9% (a tradeoff \u2014 fewer fires but more targeted). The direction is preserved: post-2024 Java has slightly more 'slf4j import + System.out call' than pre-2022. defaultOff: still set true (precision below 50%).",
         aiSpecific: false,
         _v9Verdict: "OK",
-        _v9Lift: 3.29,
-        _v9Recall: 0.16681,
-        _v9FpRate: 0.05064,
-        _v9Precision: 0.293,
+        _v9Lift: 1.73,
+        _v9Recall: 116e-5,
+        _v9FpRate: 67e-5,
+        _v9Precision: 0.1791,
         defaultOff: true
       },
       "java/command-injection": {
@@ -59758,7 +59758,7 @@ var RULE_HINTS = {
   "java/sql-string-concat": "Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{}). String concat into SQL is the canonical SQL-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT, ratio 0.59.)",
   "java/hardcoded-credential": "Move the credential to an env var, a .env file (gitignored), or a secrets manager (Vault, AWS Secrets Manager). Hardcoded creds are the #1 secret-leak vector. OWASP A07:2021. (v0.30.0 \u2014 DORMANT, 0 fires on v9 Java corpus.)",
   "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
-  "java/system-out-println": "Use SLF4J (the standard facade), Log4j2, or java.util.logging. System.out has no log level, no timestamp, no correlation ID. (v0.30.0 \u2014 OK; second positive-signal rule in v9 history, ratio 3.29.)",
+  "java/system-out-println": "The file imports a real logger (SLF4J/Log4j2/java.util.logging) but uses System.out.println. Use the declared log object instead. (v0.31.0 \u2014 OK; ratio 1.73, refined from v0.30.)",
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slopbrick",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "Discovered, modeled, and governed repository structure. SlopBrick scans source code, classifies it against 95+ rules in 15 categories, computes 4 scores (aiSlopScore: lower=cleaner, engineeringHygiene, security, repositoryHealth composite), and persists the structure for AI agents and CI.",
   "type": "module",
   "bin": {