slopbrick 0.34.2 → 0.34.6

package/dist/engine/worker.cjs

@@ -34436,7 +34436,8 @@ var importPathMismatchRule = createRule({
 
 // src/rules/cpp/c-style-cast.ts
 var C_STYLE_CAST_REGEX = /\(\s*(?:int|long|short|char|float|double|bool|unsigned\s+\w+|signed\s+\w+|size_t|[A-Za-z_]\w*(?:\s*[*,&][^)]*)?)\s*\)\s*(\w+|[^a-zA-Z_])/g;
-var NAMED_CAST_PREFIX_REGEX = /\b(?:static|reinterpret|const|dynamic)_cast\s*<[^>]*>\s*\($/;
+var NAMED_CAST_PREFIX_REGEX = /\b(?:static|reinterpret|const|dynamic)_cast\s*<[^>]*>\s*$/;
+var VOID_CAST_REGEX = /^\s*void\s*$/;
 var cppCStyleCastRule = createRule({
   id: "cpp/c-style-cast",
   category: "typo",
@@ -34456,9 +34457,10 @@ var cppCStyleCastRule = createRule({
     while ((m = C_STYLE_CAST_REGEX.exec(source)) !== null) {
       const innerMatch = /\(\s*([^)]+?)\s*\)/.exec(m[0]) ?? [];
       const inner = (innerMatch[1] ?? "").trim();
+      if (VOID_CAST_REGEX.test(inner)) continue;
       const looksLikeCast = /\b(?:int|long|short|char|float|double|bool|unsigned|signed|size_t)\b/.test(inner) || /[*&]/.test(inner);
       if (!looksLikeCast) continue;
-      const before = source.slice(Math.max(0, m.index - 40), m.index);
+      const before = source.slice(Math.max(0, m.index - 60), m.index);
       if (NAMED_CAST_PREFIX_REGEX.test(before)) continue;
       const line = source.slice(0, m.index).split("\n").length;
       issues.push({
@@ -34469,7 +34471,7 @@ var cppCStyleCastRule = createRule({
         message: `C-style cast at line ${line} \u2014 use static_cast / reinterpret_cast / const_cast`,
         line,
         column: 1,
-        advice: "Use the named cast that matches the intent: `static_cast<int>(x)`, `reinterpret_cast<MyClass*>(p)`, `const_cast<...>(ref)`, or `dynamic_cast<Derived*>(base)` for runtime-checked downcasts. C-style casts silently pick whichever the compiler needs \u2014 `static_cast`, `reinterpret_cast`, OR `const_cast` \u2014 which makes them impossible to grep for and impossible to review. The C++ Core Guidelines (ES.49) call this out by name. AI agents reach for `(int)x` because of training-data C textbooks. Reference: cpp/c-style-cast v0.24."
+        advice: "Use the named cast that matches the intent: `static_cast<int>(x)`, `reinterpret_cast<MyClass*>(p)`, `const_cast<...>(ref)`, or `dynamic_cast<Derived*>(base)` for runtime-checked downcasts. C-style casts silently pick whichever the compiler needs \u2014 `static_cast`, `reinterpret_cast`, OR `const_cast` \u2014 which makes them impossible to grep for and impossible to review. The C++ Core Guidelines (ES.49) call this out by name. AI agents reach for `(int)x` because of training-data C textbooks. Reference: cpp/c-style-cast v0.34.3 (refined regex selectivity)."
       });
     }
     return issues;
@@ -34495,6 +34497,7 @@ var cppMagicNumbersRule = createRule({
     if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
     const lines = source.split("\n");
     const allowSet = /* @__PURE__ */ new Set([
+      // v0.24 originals
       "1024",
       "65535",
       "65536",
@@ -34513,17 +34516,42 @@ var cppMagicNumbersRule = createRule({
       "2",
       "3",
       "4",
-      "5"
+      "5",
+      // v0.34.4 additions
+      "-1",
+      // sentinel value for "not found" / "all bits set"
+      "100",
+      // percent literal, very common
+      "0.0",
+      "0.5",
+      "1.0",
+      "2.0",
+      // common probability / ratio
+      "4096",
+      // page size, hash bucket count
+      "2048",
+      "512",
+      // power-of-2 sizes
+      "32",
+      "64",
+      "128",
+      // bit widths, byte sizes
+      "16",
+      "8",
+      // common small constants
+      "50"
+      // percentile literal
     ]);
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i] ?? "";
       if (!COMPARE_OR_RETURN_REGEX.test(line)) continue;
+      const codeLine = line.replace(/\/\/.*$/, "").replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
       let m;
       MAGIC_NUMBER_REGEX.lastIndex = 0;
-      while ((m = MAGIC_NUMBER_REGEX.exec(line)) !== null) {
+      while ((m = MAGIC_NUMBER_REGEX.exec(codeLine)) !== null) {
         const literal = m[0] ?? "";
         if (allowSet.has(literal)) continue;
-        if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(line.slice(0, m.index).trimEnd())) continue;
+        if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(codeLine.slice(0, m.index).trimEnd())) continue;
         const prevLine = i > 0 ? lines[i - 1] ?? "" : "";
         if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(prevLine.trim())) continue;
         issues.push({
@@ -34534,7 +34562,7 @@ var cppMagicNumbersRule = createRule({
           message: `magic number ${literal} at line ${i + 1} \u2014 name it: constexpr int MAX = ${literal};`,
           line: i + 1,
           column: 1,
-          advice: 'Replace the bare literal with a named constant declared as `constexpr int MAX_SIZE = 1024;` (or `static constexpr`). The named constant lives next to its value, can be searched, and forces the reader to mean what they say. Magic numbers in comparisons hide intent ("7" against what?). AI agents produce magic-number-heavy code because their training-data examples rarely bother to name the constant. Reference: cpp/magic-numbers v0.24.'
+          advice: 'Replace the bare literal with a named constant declared as `constexpr int MAX_SIZE = 1024;` (or `static constexpr`). The named constant lives next to its value, can be searched, and forces the reader to mean what they say. Magic numbers in comparisons hide intent ("7" against what?). AI agents produce magic-number-heavy code because their training-data examples rarely bother to name the constant. Reference: cpp/magic-numbers v0.34.4 (expanded allowSet + string/comment exclusion).'
         });
       }
     }
@@ -37187,7 +37215,6 @@ var javaSystemOutPrintlnRule = createRule({
 });
 
 // src/rules/java/thread-sleep-in-loop.ts
-var THREAD_SLEEP_REGEX = /\bThread\.sleep\s*\(/g;
 var javaThreadSleepInLoopRule = createRule({
   id: "java/thread-sleep-in-loop",
   category: "perf",
@@ -37203,11 +37230,104 @@ var javaThreadSleepInLoopRule = createRule({
     if (!source) return issues;
     if (!/\.java$/i.test(facts.filePath)) return issues;
     if (!/\bThread\.sleep\s*\(/.test(source)) return issues;
-    if (!/\b(?:for|while|do)\b/.test(source)) return issues;
-    let m;
-    THREAD_SLEEP_REGEX.lastIndex = 0;
-    while ((m = THREAD_SLEEP_REGEX.exec(source)) !== null) {
-      const line = source.slice(0, m.index).split("\n").length;
+    const braceStack = [];
+    const loopSet = /* @__PURE__ */ new Set();
+    let pendingLoopKeyword = null;
+    let parenDepth = 0;
+    const sleepEvents = [];
+    let inString = false;
+    let inLineComment = false;
+    let inBlockComment = false;
+    for (let i = 0; i < source.length; i++) {
+      const c = source[i] ?? "";
+      const next = source[i + 1] ?? "";
+      const prev = source[i - 1] ?? "";
+      if (inLineComment) {
+        if (c === "\n") inLineComment = false;
+        continue;
+      }
+      if (inBlockComment) {
+        if (c === "*" && next === "/") {
+          inBlockComment = false;
+          i++;
+        }
+        continue;
+      }
+      if (inString) {
+        if (c === "\\") {
+          i++;
+          continue;
+        }
+        if (c === inString) inString = false;
+        continue;
+      }
+      if (c === "/" && next === "/") {
+        inLineComment = true;
+        i++;
+        continue;
+      }
+      if (c === "/" && next === "*") {
+        inBlockComment = true;
+        i++;
+        continue;
+      }
+      if (c === '"' || c === "'") {
+        inString = c;
+        continue;
+      }
+      if (c === "(") {
+        parenDepth++;
+        continue;
+      }
+      if (c === ")") {
+        parenDepth = Math.max(0, parenDepth - 1);
+        continue;
+      }
+      if (/[A-Za-z_]/.test(c) && !/[A-Za-z0-9_]/.test(prev)) {
+        const next3 = source.slice(i, i + 3);
+        const next5 = source.slice(i, i + 5);
+        const next2 = source.slice(i, i + 2);
+        const after3 = source[i + 3] ?? "";
+        const after5 = source[i + 5] ?? "";
+        const after2 = source[i + 2] ?? "";
+        if (next3 === "for" && !/[A-Za-z0-9_]/.test(after3)) {
+          pendingLoopKeyword = { kind: "for", idx: i };
+          i += 2;
+          continue;
+        }
+        if (next5 === "while" && !/[A-Za-z0-9_]/.test(after5)) {
+          pendingLoopKeyword = { kind: "while", idx: i };
+          i += 4;
+          continue;
+        }
+        if (next2 === "do" && !/[A-Za-z0-9_]/.test(after2)) {
+          pendingLoopKeyword = { kind: "do", idx: i };
+          i += 1;
+          continue;
+        }
+      }
+      if (c === "{") {
+        braceStack.push(i);
+        if (pendingLoopKeyword && parenDepth === 0) {
+          loopSet.add(i);
+          pendingLoopKeyword = null;
+        }
+      } else if (c === "}") {
+        const popped = braceStack.pop();
+        if (popped !== void 0 && loopSet.has(popped)) {
+          loopSet.delete(popped);
+        }
+        if (pendingLoopKeyword) {
+          pendingLoopKeyword = null;
+        }
+      } else if (c === "T" && source.slice(i, i + 13) === "Thread.sleep(") {
+        sleepEvents.push({ idx: i, loopDepth: loopSet.size });
+        i += 12;
+      }
+    }
+    for (const ev of sleepEvents) {
+      if (ev.loopDepth === 0) continue;
+      const line = source.slice(0, ev.idx).split("\n").length;
       issues.push({
         ruleId: "java/thread-sleep-in-loop",
         category: "perf",
@@ -37216,7 +37336,7 @@ var javaThreadSleepInLoopRule = createRule({
         message: `Thread.sleep() at line ${line}`,
         line,
         column: 1,
-        advice: 'Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the classic "polling with sleep" anti-pattern \u2014 the thread blocks for the sleep duration each iteration. In server contexts this ties up Tomcat/Jetty/Netty threads. Reference: java/thread-sleep-in-loop v0.30.'
+        advice: 'Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the classic "polling with sleep" anti-pattern \u2014 the thread blocks for the sleep duration each iteration. In server contexts this ties up Tomcat/Jetty/Netty threads. Reference: java/thread-sleep-in-loop v0.34.6 (refined to require Thread.sleep inside the loop block, not just in the file).'
       });
     }
     return issues;
@@ -37463,6 +37583,7 @@ var kotlinObjectSingletonMisuseRule = createRule({
 // src/rules/kotlin/println-as-log.ts
 var PRINTLN_REGEX = /\bprintln\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX2 = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
+var TEST_FILE_REGEX = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
 var kotlinPrintlnAsLogRule = createRule({
   id: "kotlin/println-as-log",
   category: "logic",
@@ -37477,7 +37598,7 @@ var kotlinPrintlnAsLogRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.kts?$/i.test(facts.filePath)) return issues;
-    if (/\/test\//i.test(facts.filePath) || /\.test\.kts?$/i.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
     if (REAL_LOGGING_IMPORT_REGEX2.test(source)) return issues;
     let m;
     PRINTLN_REGEX.lastIndex = 0;
@@ -37491,7 +37612,7 @@ var kotlinPrintlnAsLogRule = createRule({
         message: `println() as logger at line ${line}`,
         line,
         column: 1,
-        advice: "Use a real logging library: slf4j (JVM), android.util.Log (Android), Timber (Android), kermit (multiplatform), or kotlin-logging. println() has no log level, no timestamp, no correlation ID, and cannot be filtered. Reference: kotlin/println-as-log v0.29."
+        advice: "Use a real logging library: slf4j (JVM), android.util.Log (Android), Timber (Android), kermit (multiplatform), or kotlin-logging. println() has no log level, no timestamp, no correlation ID, and cannot be filtered. Reference: kotlin/println-as-log v0.34.5 (refined to skip test files for higher precision)."
       });
     }
     return issues;
@@ -40514,7 +40635,7 @@ var swiftImplicitlyUnwrappedOptionalRule = createRule({
 // src/rules/swift/print-debug.ts
 var PRINT_REGEX = /\bprint\s*\(/g;
 var DEFAULT_THRESHOLD2 = 1;
-var TEST_FILE_REGEX = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
+var TEST_FILE_REGEX2 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
 var swiftPrintDebugRule = createRule({
   id: "swift/print-debug",
   category: "typo",
@@ -40529,7 +40650,7 @@ var swiftPrintDebugRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.swift$/i.test(facts.filePath)) return issues;
-    if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
     const matches = [];
     let m;
     PRINT_REGEX.lastIndex = 0;
@@ -45465,7 +45586,7 @@ var signal_strength_default = {
     precision: 0.1268,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "OK",
-    _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=1.84 (\u22651.5) \u2014 first rule in this entire session with a positive direction! Fires 1.84x more on post-2024 AI/demos than pre-2022 production. Precision=12.7% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Kotlin code (especially AI-generated examples) uses println for output; pre-2022 production code uses slf4j/kermit. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: still set to true (verdict is OK but precision is below 50% \u2014 the guardrail expects OK/USEFUL rules to be defaultOff:false only when calibrated with a meaningful pos arm).",
+    _calibrationNote: "v0.34.5: REFINED \u2014 rule now skips test files (JUnit4/5 + Android: *Tests.kt, *Test.kt, src/test/, test/ dirs). Per-file unique v9 Kotlin calibration (2698 neg, 213 pos): ratio=1.84 (\u22651.5, OK). The refinement mirrors v0.34.2's swift/print-debug fix: the previous exclusion only matched `\\/test\\/` and `.test.kts?$`, missing JUnit5's `FooTests.kt` naming. Expected post-refinement precision: 12.7% \u2192 25%+ by removing the JUnit assertion / debug-output fires that were ~50% of the FPs. Same direction as java/system-out-println (1.73 refined) and the v0.34.2 swift/print-debug pipeline. Full v9 re-calibration is part of the v0.35.0 re-measurement. v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=1.84 (\u22651.5) \u2014 first rule in this entire session with a positive direction! Fires 1.84x more on post-2024 AI/demos than pre-2022 production. Precision=12.7% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Kotlin code (especially AI-generated examples) uses println for output; pre-2022 production code uses slf4j/kermit. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: still set to true (verdict is OK but precision is below 50% \u2014 the guardrail expects OK/USEFUL rules to be defaultOff:false only when calibrated with a meaningful pos arm).",
     aiSpecific: false,
     _v9Verdict: "OK",
     _v9Lift: 1.84,
@@ -45529,7 +45650,7 @@ var signal_strength_default = {
     precision: 0.1091,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.97 (just below 1.0) \u2014 fires equally on both arms. Borderline era-confound: pre-2022 Java had more Thread.sleep in loops (less mature concurrency APIs); modern Java uses ScheduledExecutorService. Same direction as kotlin/runblocking-misuse (0.50). 2154 total fires \u2014 high absolute count, meaningful measurement. defaultOff.",
+    _calibrationNote: "v0.34.6: REFINED \u2014 rule now requires Thread.sleep to be INSIDE the loop block (verified via brace-counting), not just in a file that happens to contain a for/while/do keyword. v0.30 baseline: 2154 total fires, ratio 0.97 (DORMANT). The refinement targets: (1) Thread.sleep in `main()` no longer fires if a different method has a `for` loop (the v0.30 heuristic fired on every Thread.sleep in the file); (2) Thread.sleep before/after a loop block (not inside it) no longer fires; (3) string literals containing `Thread.sleep(...)` are skipped via the string-state-machine. Expected post-refinement ratio: 1.5+ (positive-signal OK verdict) by removing the cross-method over-fires. Full v9 re-calibration is part of the v0.35.0 re-measurement. v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.97 (just below 1.0) \u2014 fires equally on both arms. Borderline era-confound: pre-2022 Java had more Thread.sleep in loops (less mature concurrency APIs); modern Java uses ScheduledExecutorService. Same direction as kotlin/runblocking-misuse (0.50). 2154 total fires \u2014 high absolute count, meaningful measurement. defaultOff.",
     aiSpecific: false,
     _v9Verdict: "DORMANT",
     _v9Lift: 0.97,
@@ -45738,7 +45859,7 @@ var signal_strength_default = {
     precision: 0.2325,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 874 TP, 2885 FP, ratio=0.93. Total fires were 32265 TP, 39954 FP \u2014 the regex is too broad and fires on every C-style cast including static_cast in template code. The per-file measurement (874/1655 = 53%) is more meaningful \u2014 both arms have similar proportions of files using C-style casts. INSUFFICIENT_DATA: pos arm 1655 files.",
+    _calibrationNote: "v0.34.3: REFINED \u2014 NAMED_CAST_PREFIX_REGEX tightened (the old version required the lookback slice to end with `>(`, which never matched because the slice ends with `>`). Lookback increased 40\u219260 chars. Added `(void)x` discard-idom exclusion. v0.33 baseline: 874 TP / 2885 FP per-file (ratio 0.93, DORMANT). The refinement targets: (1) static_cast/const_cast/reinterpret_cast/dynamic_cast no longer fire when followed by whitespace before `(`; (2) class-type named casts like `static_cast<MyClass*>(p)` now correctly excluded (60-char lookback reaches the long typename); (3) `(void)x` deliberate discards are no longer flagged. Expected post-refinement ratio: 1.0-1.2 (still DORMANT but better-targeted). Full v9 re-calibration is part of the v0.35.0 re-measurement. v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 874 TP, 2885 FP, ratio=0.93. Total fires were 32265 TP, 39954 FP \u2014 the regex is too broad and fires on every C-style cast including static_cast in template code. The per-file measurement (874/1655 = 53%) is more meaningful \u2014 both arms have similar proportions of files using C-style casts. INSUFFICIENT_DATA: pos arm 1655 files.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -45784,7 +45905,7 @@ var signal_strength_default = {
     precision: 0.2187,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 220 TP, 786 FP, ratio=0.86. Both arms have similar proportions of files with magic numbers \u2014 this is a general C++ anti-pattern that hasn't been eradicated. INSUFFICIENT_DATA: pos arm 1655 files.",
+    _calibrationNote: "v0.34.4: REFINED \u2014 expanded allowSet with common constants (-1 sentinel, 100 percent literal, 0.5/1.0/2.0 ratios, 4096/2048/512/128/64/32/16/8 power-of-2 sizes, 50 percentile). Added string-literal and `//` comment stripping so substrings like `\"got 42 errors\"` and `// ticket #4242` no longer fire. v0.33 baseline: 220 TP / 786 FP per-file (ratio 0.86, DORMANT). The refinement targets: (1) sentinel `-1` literals are skipped because `1` is allowlisted and the `-` doesn't match MAGIC_NUMBER_REGEX anyway; (2) hex literals (`0xFF`) are skipped because the digit-only regex requires a word-boundary after digits, and `0x...` has none; (3) literals inside string/comment contexts no longer fire. Expected post-refinement ratio: 1.0-1.2 (still DORMANT but better-targeted). Full v9 re-calibration is part of the v0.35.0 re-measurement. v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 220 TP, 786 FP, ratio=0.86. Both arms have similar proportions of files with magic numbers \u2014 this is a general C++ anti-pattern that hasn't been eradicated. INSUFFICIENT_DATA: pos arm 1655 files.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,

package/dist/engine/worker.js

@@ -34407,7 +34407,8 @@ var importPathMismatchRule = createRule({
 
 // src/rules/cpp/c-style-cast.ts
 var C_STYLE_CAST_REGEX = /\(\s*(?:int|long|short|char|float|double|bool|unsigned\s+\w+|signed\s+\w+|size_t|[A-Za-z_]\w*(?:\s*[*,&][^)]*)?)\s*\)\s*(\w+|[^a-zA-Z_])/g;
-var NAMED_CAST_PREFIX_REGEX = /\b(?:static|reinterpret|const|dynamic)_cast\s*<[^>]*>\s*\($/;
+var NAMED_CAST_PREFIX_REGEX = /\b(?:static|reinterpret|const|dynamic)_cast\s*<[^>]*>\s*$/;
+var VOID_CAST_REGEX = /^\s*void\s*$/;
 var cppCStyleCastRule = createRule({
   id: "cpp/c-style-cast",
   category: "typo",
@@ -34427,9 +34428,10 @@ var cppCStyleCastRule = createRule({
     while ((m = C_STYLE_CAST_REGEX.exec(source)) !== null) {
       const innerMatch = /\(\s*([^)]+?)\s*\)/.exec(m[0]) ?? [];
       const inner = (innerMatch[1] ?? "").trim();
+      if (VOID_CAST_REGEX.test(inner)) continue;
       const looksLikeCast = /\b(?:int|long|short|char|float|double|bool|unsigned|signed|size_t)\b/.test(inner) || /[*&]/.test(inner);
       if (!looksLikeCast) continue;
-      const before = source.slice(Math.max(0, m.index - 40), m.index);
+      const before = source.slice(Math.max(0, m.index - 60), m.index);
       if (NAMED_CAST_PREFIX_REGEX.test(before)) continue;
       const line = source.slice(0, m.index).split("\n").length;
       issues.push({
@@ -34440,7 +34442,7 @@ var cppCStyleCastRule = createRule({
         message: `C-style cast at line ${line} \u2014 use static_cast / reinterpret_cast / const_cast`,
         line,
         column: 1,
-        advice: "Use the named cast that matches the intent: `static_cast<int>(x)`, `reinterpret_cast<MyClass*>(p)`, `const_cast<...>(ref)`, or `dynamic_cast<Derived*>(base)` for runtime-checked downcasts. C-style casts silently pick whichever the compiler needs \u2014 `static_cast`, `reinterpret_cast`, OR `const_cast` \u2014 which makes them impossible to grep for and impossible to review. The C++ Core Guidelines (ES.49) call this out by name. AI agents reach for `(int)x` because of training-data C textbooks. Reference: cpp/c-style-cast v0.24."
+        advice: "Use the named cast that matches the intent: `static_cast<int>(x)`, `reinterpret_cast<MyClass*>(p)`, `const_cast<...>(ref)`, or `dynamic_cast<Derived*>(base)` for runtime-checked downcasts. C-style casts silently pick whichever the compiler needs \u2014 `static_cast`, `reinterpret_cast`, OR `const_cast` \u2014 which makes them impossible to grep for and impossible to review. The C++ Core Guidelines (ES.49) call this out by name. AI agents reach for `(int)x` because of training-data C textbooks. Reference: cpp/c-style-cast v0.34.3 (refined regex selectivity)."
       });
     }
     return issues;
@@ -34466,6 +34468,7 @@ var cppMagicNumbersRule = createRule({
     if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
     const lines = source.split("\n");
     const allowSet = /* @__PURE__ */ new Set([
+      // v0.24 originals
       "1024",
       "65535",
       "65536",
@@ -34484,17 +34487,42 @@ var cppMagicNumbersRule = createRule({
       "2",
       "3",
       "4",
-      "5"
+      "5",
+      // v0.34.4 additions
+      "-1",
+      // sentinel value for "not found" / "all bits set"
+      "100",
+      // percent literal, very common
+      "0.0",
+      "0.5",
+      "1.0",
+      "2.0",
+      // common probability / ratio
+      "4096",
+      // page size, hash bucket count
+      "2048",
+      "512",
+      // power-of-2 sizes
+      "32",
+      "64",
+      "128",
+      // bit widths, byte sizes
+      "16",
+      "8",
+      // common small constants
+      "50"
+      // percentile literal
     ]);
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i] ?? "";
       if (!COMPARE_OR_RETURN_REGEX.test(line)) continue;
+      const codeLine = line.replace(/\/\/.*$/, "").replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
       let m;
       MAGIC_NUMBER_REGEX.lastIndex = 0;
-      while ((m = MAGIC_NUMBER_REGEX.exec(line)) !== null) {
+      while ((m = MAGIC_NUMBER_REGEX.exec(codeLine)) !== null) {
         const literal = m[0] ?? "";
         if (allowSet.has(literal)) continue;
-        if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(line.slice(0, m.index).trimEnd())) continue;
+        if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(codeLine.slice(0, m.index).trimEnd())) continue;
         const prevLine = i > 0 ? lines[i - 1] ?? "" : "";
         if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(prevLine.trim())) continue;
         issues.push({
@@ -34505,7 +34533,7 @@ var cppMagicNumbersRule = createRule({
           message: `magic number ${literal} at line ${i + 1} \u2014 name it: constexpr int MAX = ${literal};`,
           line: i + 1,
           column: 1,
-          advice: 'Replace the bare literal with a named constant declared as `constexpr int MAX_SIZE = 1024;` (or `static constexpr`). The named constant lives next to its value, can be searched, and forces the reader to mean what they say. Magic numbers in comparisons hide intent ("7" against what?). AI agents produce magic-number-heavy code because their training-data examples rarely bother to name the constant. Reference: cpp/magic-numbers v0.24.'
+          advice: 'Replace the bare literal with a named constant declared as `constexpr int MAX_SIZE = 1024;` (or `static constexpr`). The named constant lives next to its value, can be searched, and forces the reader to mean what they say. Magic numbers in comparisons hide intent ("7" against what?). AI agents produce magic-number-heavy code because their training-data examples rarely bother to name the constant. Reference: cpp/magic-numbers v0.34.4 (expanded allowSet + string/comment exclusion).'
         });
       }
     }
@@ -37158,7 +37186,6 @@ var javaSystemOutPrintlnRule = createRule({
 });
 
 // src/rules/java/thread-sleep-in-loop.ts
-var THREAD_SLEEP_REGEX = /\bThread\.sleep\s*\(/g;
 var javaThreadSleepInLoopRule = createRule({
   id: "java/thread-sleep-in-loop",
   category: "perf",
@@ -37174,11 +37201,104 @@ var javaThreadSleepInLoopRule = createRule({
     if (!source) return issues;
     if (!/\.java$/i.test(facts.filePath)) return issues;
     if (!/\bThread\.sleep\s*\(/.test(source)) return issues;
-    if (!/\b(?:for|while|do)\b/.test(source)) return issues;
-    let m;
-    THREAD_SLEEP_REGEX.lastIndex = 0;
-    while ((m = THREAD_SLEEP_REGEX.exec(source)) !== null) {
-      const line = source.slice(0, m.index).split("\n").length;
+    const braceStack = [];
+    const loopSet = /* @__PURE__ */ new Set();
+    let pendingLoopKeyword = null;
+    let parenDepth = 0;
+    const sleepEvents = [];
+    let inString = false;
+    let inLineComment = false;
+    let inBlockComment = false;
+    for (let i = 0; i < source.length; i++) {
+      const c = source[i] ?? "";
+      const next = source[i + 1] ?? "";
+      const prev = source[i - 1] ?? "";
+      if (inLineComment) {
+        if (c === "\n") inLineComment = false;
+        continue;
+      }
+      if (inBlockComment) {
+        if (c === "*" && next === "/") {
+          inBlockComment = false;
+          i++;
+        }
+        continue;
+      }
+      if (inString) {
+        if (c === "\\") {
+          i++;
+          continue;
+        }
+        if (c === inString) inString = false;
+        continue;
+      }
+      if (c === "/" && next === "/") {
+        inLineComment = true;
+        i++;
+        continue;
+      }
+      if (c === "/" && next === "*") {
+        inBlockComment = true;
+        i++;
+        continue;
+      }
+      if (c === '"' || c === "'") {
+        inString = c;
+        continue;
+      }
+      if (c === "(") {
+        parenDepth++;
+        continue;
+      }
+      if (c === ")") {
+        parenDepth = Math.max(0, parenDepth - 1);
+        continue;
+      }
+      if (/[A-Za-z_]/.test(c) && !/[A-Za-z0-9_]/.test(prev)) {
+        const next3 = source.slice(i, i + 3);
+        const next5 = source.slice(i, i + 5);
+        const next2 = source.slice(i, i + 2);
+        const after3 = source[i + 3] ?? "";
+        const after5 = source[i + 5] ?? "";
+        const after2 = source[i + 2] ?? "";
+        if (next3 === "for" && !/[A-Za-z0-9_]/.test(after3)) {
+          pendingLoopKeyword = { kind: "for", idx: i };
+          i += 2;
+          continue;
+        }
+        if (next5 === "while" && !/[A-Za-z0-9_]/.test(after5)) {
+          pendingLoopKeyword = { kind: "while", idx: i };
+          i += 4;
+          continue;
+        }
+        if (next2 === "do" && !/[A-Za-z0-9_]/.test(after2)) {
+          pendingLoopKeyword = { kind: "do", idx: i };
+          i += 1;
+          continue;
+        }
+      }
+      if (c === "{") {
+        braceStack.push(i);
+        if (pendingLoopKeyword && parenDepth === 0) {
+          loopSet.add(i);
+          pendingLoopKeyword = null;
+        }
+      } else if (c === "}") {
+        const popped = braceStack.pop();
+        if (popped !== void 0 && loopSet.has(popped)) {
+          loopSet.delete(popped);
+        }
+        if (pendingLoopKeyword) {
+          pendingLoopKeyword = null;
+        }
+      } else if (c === "T" && source.slice(i, i + 13) === "Thread.sleep(") {
+        sleepEvents.push({ idx: i, loopDepth: loopSet.size });
+        i += 12;
+      }
+    }
+    for (const ev of sleepEvents) {
+      if (ev.loopDepth === 0) continue;
+      const line = source.slice(0, ev.idx).split("\n").length;
       issues.push({
         ruleId: "java/thread-sleep-in-loop",
         category: "perf",
@@ -37187,7 +37307,7 @@ var javaThreadSleepInLoopRule = createRule({
         message: `Thread.sleep() at line ${line}`,
         line,
         column: 1,
-        advice: 'Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the classic "polling with sleep" anti-pattern \u2014 the thread blocks for the sleep duration each iteration. In server contexts this ties up Tomcat/Jetty/Netty threads. Reference: java/thread-sleep-in-loop v0.30.'
+        advice: 'Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the classic "polling with sleep" anti-pattern \u2014 the thread blocks for the sleep duration each iteration. In server contexts this ties up Tomcat/Jetty/Netty threads. Reference: java/thread-sleep-in-loop v0.34.6 (refined to require Thread.sleep inside the loop block, not just in the file).'
       });
     }
     return issues;
@@ -37434,6 +37554,7 @@ var kotlinObjectSingletonMisuseRule = createRule({
 // src/rules/kotlin/println-as-log.ts
 var PRINTLN_REGEX = /\bprintln\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX2 = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
+var TEST_FILE_REGEX = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
 var kotlinPrintlnAsLogRule = createRule({
   id: "kotlin/println-as-log",
   category: "logic",
@@ -37448,7 +37569,7 @@ var kotlinPrintlnAsLogRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.kts?$/i.test(facts.filePath)) return issues;
-    if (/\/test\//i.test(facts.filePath) || /\.test\.kts?$/i.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
     if (REAL_LOGGING_IMPORT_REGEX2.test(source)) return issues;
     let m;
     PRINTLN_REGEX.lastIndex = 0;
@@ -37462,7 +37583,7 @@ var kotlinPrintlnAsLogRule = createRule({
         message: `println() as logger at line ${line}`,
         line,
         column: 1,
-        advice: "Use a real logging library: slf4j (JVM), android.util.Log (Android), Timber (Android), kermit (multiplatform), or kotlin-logging. println() has no log level, no timestamp, no correlation ID, and cannot be filtered. Reference: kotlin/println-as-log v0.29."
+        advice: "Use a real logging library: slf4j (JVM), android.util.Log (Android), Timber (Android), kermit (multiplatform), or kotlin-logging. println() has no log level, no timestamp, no correlation ID, and cannot be filtered. Reference: kotlin/println-as-log v0.34.5 (refined to skip test files for higher precision)."
       });
     }
     return issues;
@@ -40485,7 +40606,7 @@ var swiftImplicitlyUnwrappedOptionalRule = createRule({
 // src/rules/swift/print-debug.ts
 var PRINT_REGEX = /\bprint\s*\(/g;
 var DEFAULT_THRESHOLD2 = 1;
-var TEST_FILE_REGEX = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
+var TEST_FILE_REGEX2 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
 var swiftPrintDebugRule = createRule({
   id: "swift/print-debug",
   category: "typo",
@@ -40500,7 +40621,7 @@ var swiftPrintDebugRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.swift$/i.test(facts.filePath)) return issues;
-    if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
     const matches = [];
     let m;
     PRINT_REGEX.lastIndex = 0;
@@ -45436,7 +45557,7 @@ var signal_strength_default = {
     precision: 0.1268,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "OK",
-    _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=1.84 (\u22651.5) \u2014 first rule in this entire session with a positive direction! Fires 1.84x more on post-2024 AI/demos than pre-2022 production. Precision=12.7% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Kotlin code (especially AI-generated examples) uses println for output; pre-2022 production code uses slf4j/kermit. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: still set to true (verdict is OK but precision is below 50% \u2014 the guardrail expects OK/USEFUL rules to be defaultOff:false only when calibrated with a meaningful pos arm).",
+    _calibrationNote: "v0.34.5: REFINED \u2014 rule now skips test files (JUnit4/5 + Android: *Tests.kt, *Test.kt, src/test/, test/ dirs). Per-file unique v9 Kotlin calibration (2698 neg, 213 pos): ratio=1.84 (\u22651.5, OK). The refinement mirrors v0.34.2's swift/print-debug fix: the previous exclusion only matched `\\/test\\/` and `.test.kts?$`, missing JUnit5's `FooTests.kt` naming. Expected post-refinement precision: 12.7% \u2192 25%+ by removing the JUnit assertion / debug-output fires that were ~50% of the FPs. Same direction as java/system-out-println (1.73 refined) and the v0.34.2 swift/print-debug pipeline. Full v9 re-calibration is part of the v0.35.0 re-measurement. v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=1.84 (\u22651.5) \u2014 first rule in this entire session with a positive direction! Fires 1.84x more on post-2024 AI/demos than pre-2022 production. Precision=12.7% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Kotlin code (especially AI-generated examples) uses println for output; pre-2022 production code uses slf4j/kermit. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: still set to true (verdict is OK but precision is below 50% \u2014 the guardrail expects OK/USEFUL rules to be defaultOff:false only when calibrated with a meaningful pos arm).",
     aiSpecific: false,
     _v9Verdict: "OK",
     _v9Lift: 1.84,
@@ -45500,7 +45621,7 @@ var signal_strength_default = {
     precision: 0.1091,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.97 (just below 1.0) \u2014 fires equally on both arms. Borderline era-confound: pre-2022 Java had more Thread.sleep in loops (less mature concurrency APIs); modern Java uses ScheduledExecutorService. Same direction as kotlin/runblocking-misuse (0.50). 2154 total fires \u2014 high absolute count, meaningful measurement. defaultOff.",
+    _calibrationNote: "v0.34.6: REFINED \u2014 rule now requires Thread.sleep to be INSIDE the loop block (verified via brace-counting), not just in a file that happens to contain a for/while/do keyword. v0.30 baseline: 2154 total fires, ratio 0.97 (DORMANT). The refinement targets: (1) Thread.sleep in `main()` no longer fires if a different method has a `for` loop (the v0.30 heuristic fired on every Thread.sleep in the file); (2) Thread.sleep before/after a loop block (not inside it) no longer fires; (3) string literals containing `Thread.sleep(...)` are skipped via the string-state-machine. Expected post-refinement ratio: 1.5+ (positive-signal OK verdict) by removing the cross-method over-fires. Full v9 re-calibration is part of the v0.35.0 re-measurement. v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.97 (just below 1.0) \u2014 fires equally on both arms. Borderline era-confound: pre-2022 Java had more Thread.sleep in loops (less mature concurrency APIs); modern Java uses ScheduledExecutorService. Same direction as kotlin/runblocking-misuse (0.50). 2154 total fires \u2014 high absolute count, meaningful measurement. defaultOff.",
     aiSpecific: false,
     _v9Verdict: "DORMANT",
     _v9Lift: 0.97,
@@ -45709,7 +45830,7 @@ var signal_strength_default = {
     precision: 0.2325,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 874 TP, 2885 FP, ratio=0.93. Total fires were 32265 TP, 39954 FP \u2014 the regex is too broad and fires on every C-style cast including static_cast in template code. The per-file measurement (874/1655 = 53%) is more meaningful \u2014 both arms have similar proportions of files using C-style casts. INSUFFICIENT_DATA: pos arm 1655 files.",
+    _calibrationNote: "v0.34.3: REFINED \u2014 NAMED_CAST_PREFIX_REGEX tightened (the old version required the lookback slice to end with `>(`, which never matched because the slice ends with `>`). Lookback increased 40\u219260 chars. Added `(void)x` discard-idom exclusion. v0.33 baseline: 874 TP / 2885 FP per-file (ratio 0.93, DORMANT). The refinement targets: (1) static_cast/const_cast/reinterpret_cast/dynamic_cast no longer fire when followed by whitespace before `(`; (2) class-type named casts like `static_cast<MyClass*>(p)` now correctly excluded (60-char lookback reaches the long typename); (3) `(void)x` deliberate discards are no longer flagged. Expected post-refinement ratio: 1.0-1.2 (still DORMANT but better-targeted). Full v9 re-calibration is part of the v0.35.0 re-measurement. v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 874 TP, 2885 FP, ratio=0.93. Total fires were 32265 TP, 39954 FP \u2014 the regex is too broad and fires on every C-style cast including static_cast in template code. The per-file measurement (874/1655 = 53%) is more meaningful \u2014 both arms have similar proportions of files using C-style casts. INSUFFICIENT_DATA: pos arm 1655 files.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -45755,7 +45876,7 @@ var signal_strength_default = {
     precision: 0.2187,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 220 TP, 786 FP, ratio=0.86. Both arms have similar proportions of files with magic numbers \u2014 this is a general C++ anti-pattern that hasn't been eradicated. INSUFFICIENT_DATA: pos arm 1655 files.",
+    _calibrationNote: "v0.34.4: REFINED \u2014 expanded allowSet with common constants (-1 sentinel, 100 percent literal, 0.5/1.0/2.0 ratios, 4096/2048/512/128/64/32/16/8 power-of-2 sizes, 50 percentile). Added string-literal and `//` comment stripping so substrings like `\"got 42 errors\"` and `// ticket #4242` no longer fire. v0.33 baseline: 220 TP / 786 FP per-file (ratio 0.86, DORMANT). The refinement targets: (1) sentinel `-1` literals are skipped because `1` is allowlisted and the `-` doesn't match MAGIC_NUMBER_REGEX anyway; (2) hex literals (`0xFF`) are skipped because the digit-only regex requires a word-boundary after digits, and `0x...` has none; (3) literals inside string/comment contexts no longer fire. Expected post-refinement ratio: 1.0-1.2 (still DORMANT but better-targeted). Full v9 re-calibration is part of the v0.35.0 re-measurement. v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 220 TP, 786 FP, ratio=0.86. Both arms have similar proportions of files with magic numbers \u2014 this is a general C++ anti-pattern that hasn't been eradicated. INSUFFICIENT_DATA: pos arm 1655 files.",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,