slopbrick 0.34.6 → 0.34.8

package/dist/engine/worker.cjs

@@ -34575,6 +34575,7 @@ var PRINTF_FAMILY_REGEX = /\b(?:printf|fprintf|sprintf|snprintf)\s*\(/g;
 var COUT_LITERAL_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*"[^"]*"/g;
 var STD_COUT_BARE_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*'[^']*'/g;
 var THRESHOLD_DEFAULT = 1;
+var TEST_FILE_REGEX = /(?:\/tests?\/|_test\.cc|_test\.cpp|Test\.cc|Test\.cpp|Tests\.cc|Tests\.cpp|_unittest\.cc|_unittest\.cpp)/;
 var cppPrintfDebugRule = createRule({
   id: "cpp/printf-debug",
   category: "typo",
@@ -34589,6 +34590,7 @@ var cppPrintfDebugRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
     const printfCount = (source.match(PRINTF_FAMILY_REGEX) ?? []).length;
     let viaPrintf = false;
     if (printfCount > context.threshold) {
@@ -34605,7 +34607,7 @@ var cppPrintfDebugRule = createRule({
       message: viaPrintf ? `${printfCount} printf-family calls \u2014 use spdlog / glog / AbslLog` : "std::cout/cerr/clog with a string literal \u2014 use spdlog / glog / AbslLog",
       line: 1,
       column: 1,
-      advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.24."
+      advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.34.7 (refined to skip test files for higher precision)."
     });
     return issues;
   }
@@ -37583,7 +37585,7 @@ var kotlinObjectSingletonMisuseRule = createRule({
 // src/rules/kotlin/println-as-log.ts
 var PRINTLN_REGEX = /\bprintln\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX2 = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
-var TEST_FILE_REGEX = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
+var TEST_FILE_REGEX2 = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
 var kotlinPrintlnAsLogRule = createRule({
   id: "kotlin/println-as-log",
   category: "logic",
@@ -37598,7 +37600,7 @@ var kotlinPrintlnAsLogRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.kts?$/i.test(facts.filePath)) return issues;
-    if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
     if (REAL_LOGGING_IMPORT_REGEX2.test(source)) return issues;
     let m;
     PRINTLN_REGEX.lastIndex = 0;
@@ -37699,9 +37701,9 @@ var kotlinRunBlockingMisuseRule = createRule({
 });
 
 // src/rules/kotlin/sql-string-concat.ts
-var SQL_KEYWORD_REGEX2 = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
+var SQL_KEYWORD_REGEX2 = /\b(SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
 var UNSAFE_REGEX2 = /(?:\+|\$\{)/;
-var SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\\?\\?|\?\\s*,)/;
+var SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\?|\?)/;
 var kotlinSqlStringConcatRule = createRule({
   id: "kotlin/sql-string-concat",
   category: "security",
@@ -37719,7 +37721,14 @@ var kotlinSqlStringConcatRule = createRule({
     const lines = source.split("\n");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
-      if (!SQL_KEYWORD_REGEX2.test(line)) continue;
+      const keywordMatch = SQL_KEYWORD_REGEX2.exec(line);
+      if (!keywordMatch) continue;
+      const keywordIdx = keywordMatch.index;
+      let j = keywordIdx - 1;
+      while (j >= 0 && /\s/.test(line[j])) j--;
+      if (j < 0) continue;
+      const prevChar = line[j];
+      if (prevChar !== '"' && prevChar !== "'" && prevChar !== "=") continue;
       if (!UNSAFE_REGEX2.test(line)) continue;
       if (SAFE_REGEX2.test(line)) continue;
       issues.push({
@@ -37730,7 +37739,7 @@ var kotlinSqlStringConcatRule = createRule({
         message: `SQL query built via string concat/template at line ${i + 1}`,
         line: i + 1,
         column: 1,
-        advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.29 (OWASP A03:2021).'
+        advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.34.8 (refined: require SQL keyword to start a string literal; fixed SAFE_REGEX bug).'
       });
     }
     return issues;
@@ -40635,7 +40644,7 @@ var swiftImplicitlyUnwrappedOptionalRule = createRule({
 // src/rules/swift/print-debug.ts
 var PRINT_REGEX = /\bprint\s*\(/g;
 var DEFAULT_THRESHOLD2 = 1;
-var TEST_FILE_REGEX2 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
+var TEST_FILE_REGEX3 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
 var swiftPrintDebugRule = createRule({
   id: "swift/print-debug",
   category: "typo",
@@ -40650,7 +40659,7 @@ var swiftPrintDebugRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.swift$/i.test(facts.filePath)) return issues;
-    if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX3.test(facts.filePath)) return issues;
     const matches = [];
     let m;
     PRINT_REGEX.lastIndex = 0;
@@ -45538,7 +45547,7 @@ var signal_strength_default = {
     precision: 0.0556,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.75 (DORMANT). 18 fires total \u2014 modern Kotlin mostly uses ORMs (Room/Exposed) so SQL string concat is rare in both arms. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: rule is loadable but invisible by default until v0.30 re-calibration with a larger pos arm.",
+    _calibrationNote: 'v0.34.8: REFINED \u2014 rule now requires the SQL keyword to be the start of a string literal (preceded by `"`, `\'`, or `=`), and fixed a bug in the SAFE_REGEX (the `:??` was malformed, should be `:?`). Per-file unique v9 Kotlin calibration (2698 neg, 213 pos): 1 TP file, 17 FP files, ratio=0.75 (DORMANT). 18 total fires. The refinement is expected to push precision from 5.6% to 25%+ by removing lines where SELECT/INSERT appears in string values (e.g. `val msg = "Selected 1 row: \\$count"`). Also fixed the bug where `:??` in SAFE_REGEX didn\'t match Java/Kotlin named parameters (`:id`). The full v9 re-calibration is part of the broader v0.34.8/v0.34.9 pipeline. INSUFFICIENT_DATA: pos arm 213 files (below 10k floor).',
     aiSpecific: false,
     _v9Verdict: "DORMANT",
     _v9Lift: 0.75,
@@ -45882,7 +45891,7 @@ var signal_strength_default = {
     precision: 0.4407,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "OK",
-    _calibrationNote: "v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 156 TP files, 198 FP files, ratio=2.43 (\u22651.5) \u2014 fourth positive-signal rule in v9 history (and the strongest ratio so far). precision=44.07% (just below 50% USEFUL threshold); verdict=OK. Total fires: 182 TP, 198 FP. The signal is real: post-2024 C++ (mostly AI-generated demos in llama.cpp, whisper.cpp, openai-cpp) uses printf/cout for output; pre-2022 production C++ (folly, protobuf, abseil) uses spdlog / glog / AbslLog. Same direction as kotlin/println-as-log (1.84), java/system-out-println (1.73 refined), swift/print-debug (1.13). INSUFFICIENT_DATA: pos arm 1655 files (below 10k floor).",
+    _calibrationNote: "v0.34.7: REFINED \u2014 rule now skips test files (gtest, catch2, doctest conventions: *_test.cpp, *_test.cc, /tests/ dir, *Test.cpp, *Test.cc, *_unittest.cpp). Per-file unique v9 C++ calibration (5107 neg, 1655 pos): 156 TP files, 198 FP files, ratio=2.43 (OK, fourth positive-signal in v9 history). precision=44.07% (below 50% USEFUL threshold); verdict=OK. The refinement is expected to push precision from 44% to 50%+ by removing gtest test output fires (which were a significant portion of FPs in the v0.33.0 measurement). The full v9 re-calibration is part of the broader v0.34.5/v0.34.7 pipeline; see v0.34.1's Four-language validation section. Same direction as kotlin/println-as-log (1.84), java/system-out-println (1.73 refined, 3.29 unrefined), swift/print-debug (1.13). INSUFFICIENT_DATA: pos arm 1655 files (below 10k floor).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,

package/dist/engine/worker.js

@@ -34546,6 +34546,7 @@ var PRINTF_FAMILY_REGEX = /\b(?:printf|fprintf|sprintf|snprintf)\s*\(/g;
 var COUT_LITERAL_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*"[^"]*"/g;
 var STD_COUT_BARE_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*'[^']*'/g;
 var THRESHOLD_DEFAULT = 1;
+var TEST_FILE_REGEX = /(?:\/tests?\/|_test\.cc|_test\.cpp|Test\.cc|Test\.cpp|Tests\.cc|Tests\.cpp|_unittest\.cc|_unittest\.cpp)/;
 var cppPrintfDebugRule = createRule({
   id: "cpp/printf-debug",
   category: "typo",
@@ -34560,6 +34561,7 @@ var cppPrintfDebugRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
     const printfCount = (source.match(PRINTF_FAMILY_REGEX) ?? []).length;
     let viaPrintf = false;
     if (printfCount > context.threshold) {
@@ -34576,7 +34578,7 @@ var cppPrintfDebugRule = createRule({
       message: viaPrintf ? `${printfCount} printf-family calls \u2014 use spdlog / glog / AbslLog` : "std::cout/cerr/clog with a string literal \u2014 use spdlog / glog / AbslLog",
       line: 1,
       column: 1,
-      advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.24."
+      advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.34.7 (refined to skip test files for higher precision)."
     });
     return issues;
   }
@@ -37554,7 +37556,7 @@ var kotlinObjectSingletonMisuseRule = createRule({
 // src/rules/kotlin/println-as-log.ts
 var PRINTLN_REGEX = /\bprintln\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX2 = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
-var TEST_FILE_REGEX = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
+var TEST_FILE_REGEX2 = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
 var kotlinPrintlnAsLogRule = createRule({
   id: "kotlin/println-as-log",
   category: "logic",
@@ -37569,7 +37571,7 @@ var kotlinPrintlnAsLogRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.kts?$/i.test(facts.filePath)) return issues;
-    if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
     if (REAL_LOGGING_IMPORT_REGEX2.test(source)) return issues;
     let m;
     PRINTLN_REGEX.lastIndex = 0;
@@ -37670,9 +37672,9 @@ var kotlinRunBlockingMisuseRule = createRule({
 });
 
 // src/rules/kotlin/sql-string-concat.ts
-var SQL_KEYWORD_REGEX2 = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
+var SQL_KEYWORD_REGEX2 = /\b(SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
 var UNSAFE_REGEX2 = /(?:\+|\$\{)/;
-var SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\\?\\?|\?\\s*,)/;
+var SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\?|\?)/;
 var kotlinSqlStringConcatRule = createRule({
   id: "kotlin/sql-string-concat",
   category: "security",
@@ -37690,7 +37692,14 @@ var kotlinSqlStringConcatRule = createRule({
     const lines = source.split("\n");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
-      if (!SQL_KEYWORD_REGEX2.test(line)) continue;
+      const keywordMatch = SQL_KEYWORD_REGEX2.exec(line);
+      if (!keywordMatch) continue;
+      const keywordIdx = keywordMatch.index;
+      let j = keywordIdx - 1;
+      while (j >= 0 && /\s/.test(line[j])) j--;
+      if (j < 0) continue;
+      const prevChar = line[j];
+      if (prevChar !== '"' && prevChar !== "'" && prevChar !== "=") continue;
       if (!UNSAFE_REGEX2.test(line)) continue;
       if (SAFE_REGEX2.test(line)) continue;
       issues.push({
@@ -37701,7 +37710,7 @@ var kotlinSqlStringConcatRule = createRule({
         message: `SQL query built via string concat/template at line ${i + 1}`,
         line: i + 1,
         column: 1,
-        advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.29 (OWASP A03:2021).'
+        advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.34.8 (refined: require SQL keyword to start a string literal; fixed SAFE_REGEX bug).'
       });
     }
     return issues;
@@ -40606,7 +40615,7 @@ var swiftImplicitlyUnwrappedOptionalRule = createRule({
 // src/rules/swift/print-debug.ts
 var PRINT_REGEX = /\bprint\s*\(/g;
 var DEFAULT_THRESHOLD2 = 1;
-var TEST_FILE_REGEX2 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
+var TEST_FILE_REGEX3 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
 var swiftPrintDebugRule = createRule({
   id: "swift/print-debug",
   category: "typo",
@@ -40621,7 +40630,7 @@ var swiftPrintDebugRule = createRule({
     const source = facts.v2?._source;
     if (!source) return issues;
     if (!/\.swift$/i.test(facts.filePath)) return issues;
-    if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
+    if (TEST_FILE_REGEX3.test(facts.filePath)) return issues;
     const matches = [];
     let m;
     PRINT_REGEX.lastIndex = 0;
@@ -45509,7 +45518,7 @@ var signal_strength_default = {
     precision: 0.0556,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.75 (DORMANT). 18 fires total \u2014 modern Kotlin mostly uses ORMs (Room/Exposed) so SQL string concat is rare in both arms. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: rule is loadable but invisible by default until v0.30 re-calibration with a larger pos arm.",
+    _calibrationNote: 'v0.34.8: REFINED \u2014 rule now requires the SQL keyword to be the start of a string literal (preceded by `"`, `\'`, or `=`), and fixed a bug in the SAFE_REGEX (the `:??` was malformed, should be `:?`). Per-file unique v9 Kotlin calibration (2698 neg, 213 pos): 1 TP file, 17 FP files, ratio=0.75 (DORMANT). 18 total fires. The refinement is expected to push precision from 5.6% to 25%+ by removing lines where SELECT/INSERT appears in string values (e.g. `val msg = "Selected 1 row: \\$count"`). Also fixed the bug where `:??` in SAFE_REGEX didn\'t match Java/Kotlin named parameters (`:id`). The full v9 re-calibration is part of the broader v0.34.8/v0.34.9 pipeline. INSUFFICIENT_DATA: pos arm 213 files (below 10k floor).',
     aiSpecific: false,
     _v9Verdict: "DORMANT",
     _v9Lift: 0.75,
@@ -45853,7 +45862,7 @@ var signal_strength_default = {
     precision: 0.4407,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "OK",
-    _calibrationNote: "v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 156 TP files, 198 FP files, ratio=2.43 (\u22651.5) \u2014 fourth positive-signal rule in v9 history (and the strongest ratio so far). precision=44.07% (just below 50% USEFUL threshold); verdict=OK. Total fires: 182 TP, 198 FP. The signal is real: post-2024 C++ (mostly AI-generated demos in llama.cpp, whisper.cpp, openai-cpp) uses printf/cout for output; pre-2022 production C++ (folly, protobuf, abseil) uses spdlog / glog / AbslLog. Same direction as kotlin/println-as-log (1.84), java/system-out-println (1.73 refined), swift/print-debug (1.13). INSUFFICIENT_DATA: pos arm 1655 files (below 10k floor).",
+    _calibrationNote: "v0.34.7: REFINED \u2014 rule now skips test files (gtest, catch2, doctest conventions: *_test.cpp, *_test.cc, /tests/ dir, *Test.cpp, *Test.cc, *_unittest.cpp). Per-file unique v9 C++ calibration (5107 neg, 1655 pos): 156 TP files, 198 FP files, ratio=2.43 (OK, fourth positive-signal in v9 history). precision=44.07% (below 50% USEFUL threshold); verdict=OK. The refinement is expected to push precision from 44% to 50%+ by removing gtest test output fires (which were a significant portion of FPs in the v0.33.0 measurement). The full v9 re-calibration is part of the broader v0.34.5/v0.34.7 pipeline; see v0.34.1's Four-language validation section. Same direction as kotlin/println-as-log (1.84), java/system-out-println (1.73 refined, 3.29 unrefined), swift/print-debug (1.13). INSUFFICIENT_DATA: pos arm 1655 files (below 10k floor).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,

package/dist/index.cjs

@@ -36,7 +36,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.6";
+    VERSION = "0.34.8";
   }
 });
 
@@ -27810,7 +27810,7 @@ var init_magic_numbers = __esm({
 });
 
 // src/rules/cpp/printf-debug.ts
-var PRINTF_FAMILY_REGEX, COUT_LITERAL_REGEX, STD_COUT_BARE_REGEX, THRESHOLD_DEFAULT, cppPrintfDebugRule;
+var PRINTF_FAMILY_REGEX, COUT_LITERAL_REGEX, STD_COUT_BARE_REGEX, THRESHOLD_DEFAULT, TEST_FILE_REGEX, cppPrintfDebugRule;
 var init_printf_debug = __esm({
   "src/rules/cpp/printf-debug.ts"() {
     "use strict";
@@ -27819,6 +27819,7 @@ var init_printf_debug = __esm({
     COUT_LITERAL_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*"[^"]*"/g;
     STD_COUT_BARE_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*'[^']*'/g;
     THRESHOLD_DEFAULT = 1;
+    TEST_FILE_REGEX = /(?:\/tests?\/|_test\.cc|_test\.cpp|Test\.cc|Test\.cpp|Tests\.cc|Tests\.cpp|_unittest\.cc|_unittest\.cpp)/;
     cppPrintfDebugRule = createRule({
       id: "cpp/printf-debug",
       category: "typo",
@@ -27833,6 +27834,7 @@ var init_printf_debug = __esm({
         const source = facts.v2?._source;
         if (!source) return issues;
         if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+        if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
         const printfCount = (source.match(PRINTF_FAMILY_REGEX) ?? []).length;
         let viaPrintf = false;
         if (printfCount > context.threshold) {
@@ -27849,7 +27851,7 @@ var init_printf_debug = __esm({
           message: viaPrintf ? `${printfCount} printf-family calls \u2014 use spdlog / glog / AbslLog` : "std::cout/cerr/clog with a string literal \u2014 use spdlog / glog / AbslLog",
           line: 1,
           column: 1,
-          advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.24."
+          advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.34.7 (refined to skip test files for higher precision)."
         });
         return issues;
       }
@@ -31295,14 +31297,14 @@ var init_object_singleton_misuse = __esm({
 });
 
 // src/rules/kotlin/println-as-log.ts
-var PRINTLN_REGEX, REAL_LOGGING_IMPORT_REGEX2, TEST_FILE_REGEX, kotlinPrintlnAsLogRule;
+var PRINTLN_REGEX, REAL_LOGGING_IMPORT_REGEX2, TEST_FILE_REGEX2, kotlinPrintlnAsLogRule;
 var init_println_as_log = __esm({
   "src/rules/kotlin/println-as-log.ts"() {
     "use strict";
     init_rule();
     PRINTLN_REGEX = /\bprintln\s*\(/g;
     REAL_LOGGING_IMPORT_REGEX2 = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
-    TEST_FILE_REGEX = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
+    TEST_FILE_REGEX2 = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
     kotlinPrintlnAsLogRule = createRule({
       id: "kotlin/println-as-log",
       category: "logic",
@@ -31317,7 +31319,7 @@ var init_println_as_log = __esm({
         const source = facts.v2?._source;
         if (!source) return issues;
         if (!/\.kts?$/i.test(facts.filePath)) return issues;
-        if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
+        if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
         if (REAL_LOGGING_IMPORT_REGEX2.test(source)) return issues;
         let m;
         PRINTLN_REGEX.lastIndex = 0;
@@ -31439,9 +31441,9 @@ var init_sql_string_concat2 = __esm({
   "src/rules/kotlin/sql-string-concat.ts"() {
     "use strict";
     init_rule();
-    SQL_KEYWORD_REGEX2 = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
+    SQL_KEYWORD_REGEX2 = /\b(SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
     UNSAFE_REGEX2 = /(?:\+|\$\{)/;
-    SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\\?\\?|\?\\s*,)/;
+    SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\?|\?)/;
     kotlinSqlStringConcatRule = createRule({
       id: "kotlin/sql-string-concat",
       category: "security",
@@ -31459,7 +31461,14 @@ var init_sql_string_concat2 = __esm({
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           const line = lines[i];
-          if (!SQL_KEYWORD_REGEX2.test(line)) continue;
+          const keywordMatch = SQL_KEYWORD_REGEX2.exec(line);
+          if (!keywordMatch) continue;
+          const keywordIdx = keywordMatch.index;
+          let j = keywordIdx - 1;
+          while (j >= 0 && /\s/.test(line[j])) j--;
+          if (j < 0) continue;
+          const prevChar = line[j];
+          if (prevChar !== '"' && prevChar !== "'" && prevChar !== "=") continue;
           if (!UNSAFE_REGEX2.test(line)) continue;
           if (SAFE_REGEX2.test(line)) continue;
           issues.push({
@@ -31470,7 +31479,7 @@ var init_sql_string_concat2 = __esm({
             message: `SQL query built via string concat/template at line ${i + 1}`,
             line: i + 1,
             column: 1,
-            advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.29 (OWASP A03:2021).'
+            advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.34.8 (refined: require SQL keyword to start a string literal; fixed SAFE_REGEX bug).'
           });
         }
         return issues;
@@ -41176,14 +41185,14 @@ var init_implicitly_unwrapped_optional = __esm({
 });
 
 // src/rules/swift/print-debug.ts
-var PRINT_REGEX, DEFAULT_THRESHOLD2, TEST_FILE_REGEX2, swiftPrintDebugRule;
+var PRINT_REGEX, DEFAULT_THRESHOLD2, TEST_FILE_REGEX3, swiftPrintDebugRule;
 var init_print_debug = __esm({
   "src/rules/swift/print-debug.ts"() {
     "use strict";
     init_rule();
     PRINT_REGEX = /\bprint\s*\(/g;
     DEFAULT_THRESHOLD2 = 1;
-    TEST_FILE_REGEX2 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
+    TEST_FILE_REGEX3 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
     swiftPrintDebugRule = createRule({
       id: "swift/print-debug",
       category: "typo",
@@ -41198,7 +41207,7 @@ var init_print_debug = __esm({
         const source = facts.v2?._source;
         if (!source) return issues;
         if (!/\.swift$/i.test(facts.filePath)) return issues;
-        if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
+        if (TEST_FILE_REGEX3.test(facts.filePath)) return issues;
         const matches = [];
         let m;
         PRINT_REGEX.lastIndex = 0;
@@ -51625,7 +51634,7 @@ var init_signal_strength = __esm({
         precision: 0.0556,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.75 (DORMANT). 18 fires total \u2014 modern Kotlin mostly uses ORMs (Room/Exposed) so SQL string concat is rare in both arms. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: rule is loadable but invisible by default until v0.30 re-calibration with a larger pos arm.",
+        _calibrationNote: 'v0.34.8: REFINED \u2014 rule now requires the SQL keyword to be the start of a string literal (preceded by `"`, `\'`, or `=`), and fixed a bug in the SAFE_REGEX (the `:??` was malformed, should be `:?`). Per-file unique v9 Kotlin calibration (2698 neg, 213 pos): 1 TP file, 17 FP files, ratio=0.75 (DORMANT). 18 total fires. The refinement is expected to push precision from 5.6% to 25%+ by removing lines where SELECT/INSERT appears in string values (e.g. `val msg = "Selected 1 row: \\$count"`). Also fixed the bug where `:??` in SAFE_REGEX didn\'t match Java/Kotlin named parameters (`:id`). The full v9 re-calibration is part of the broader v0.34.8/v0.34.9 pipeline. INSUFFICIENT_DATA: pos arm 213 files (below 10k floor).',
         aiSpecific: false,
         _v9Verdict: "DORMANT",
         _v9Lift: 0.75,
@@ -51969,7 +51978,7 @@ var init_signal_strength = __esm({
         precision: 0.4407,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "OK",
-        _calibrationNote: "v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 156 TP files, 198 FP files, ratio=2.43 (\u22651.5) \u2014 fourth positive-signal rule in v9 history (and the strongest ratio so far). precision=44.07% (just below 50% USEFUL threshold); verdict=OK. Total fires: 182 TP, 198 FP. The signal is real: post-2024 C++ (mostly AI-generated demos in llama.cpp, whisper.cpp, openai-cpp) uses printf/cout for output; pre-2022 production C++ (folly, protobuf, abseil) uses spdlog / glog / AbslLog. Same direction as kotlin/println-as-log (1.84), java/system-out-println (1.73 refined), swift/print-debug (1.13). INSUFFICIENT_DATA: pos arm 1655 files (below 10k floor).",
+        _calibrationNote: "v0.34.7: REFINED \u2014 rule now skips test files (gtest, catch2, doctest conventions: *_test.cpp, *_test.cc, /tests/ dir, *Test.cpp, *Test.cc, *_unittest.cpp). Per-file unique v9 C++ calibration (5107 neg, 1655 pos): 156 TP files, 198 FP files, ratio=2.43 (OK, fourth positive-signal in v9 history). precision=44.07% (below 50% USEFUL threshold); verdict=OK. The refinement is expected to push precision from 44% to 50%+ by removing gtest test output fires (which were a significant portion of FPs in the v0.33.0 measurement). The full v9 re-calibration is part of the broader v0.34.5/v0.34.7 pipeline; see v0.34.1's Four-language validation section. Same direction as kotlin/println-as-log (1.84), java/system-out-println (1.73 refined, 3.29 unrefined), swift/print-debug (1.13). INSUFFICIENT_DATA: pos arm 1655 files (below 10k floor).",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.6";
+    VERSION = "0.34.8";
   }
 });
 
@@ -27792,7 +27792,7 @@ var init_magic_numbers = __esm({
 });
 
 // src/rules/cpp/printf-debug.ts
-var PRINTF_FAMILY_REGEX, COUT_LITERAL_REGEX, STD_COUT_BARE_REGEX, THRESHOLD_DEFAULT, cppPrintfDebugRule;
+var PRINTF_FAMILY_REGEX, COUT_LITERAL_REGEX, STD_COUT_BARE_REGEX, THRESHOLD_DEFAULT, TEST_FILE_REGEX, cppPrintfDebugRule;
 var init_printf_debug = __esm({
   "src/rules/cpp/printf-debug.ts"() {
     "use strict";
@@ -27801,6 +27801,7 @@ var init_printf_debug = __esm({
     COUT_LITERAL_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*"[^"]*"/g;
     STD_COUT_BARE_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*'[^']*'/g;
     THRESHOLD_DEFAULT = 1;
+    TEST_FILE_REGEX = /(?:\/tests?\/|_test\.cc|_test\.cpp|Test\.cc|Test\.cpp|Tests\.cc|Tests\.cpp|_unittest\.cc|_unittest\.cpp)/;
     cppPrintfDebugRule = createRule({
       id: "cpp/printf-debug",
       category: "typo",
@@ -27815,6 +27816,7 @@ var init_printf_debug = __esm({
         const source = facts.v2?._source;
         if (!source) return issues;
         if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+        if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
         const printfCount = (source.match(PRINTF_FAMILY_REGEX) ?? []).length;
         let viaPrintf = false;
         if (printfCount > context.threshold) {
@@ -27831,7 +27833,7 @@ var init_printf_debug = __esm({
           message: viaPrintf ? `${printfCount} printf-family calls \u2014 use spdlog / glog / AbslLog` : "std::cout/cerr/clog with a string literal \u2014 use spdlog / glog / AbslLog",
           line: 1,
           column: 1,
-          advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.24."
+          advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.34.7 (refined to skip test files for higher precision)."
         });
         return issues;
       }
@@ -31276,14 +31278,14 @@ var init_object_singleton_misuse = __esm({
 });
 
 // src/rules/kotlin/println-as-log.ts
-var PRINTLN_REGEX, REAL_LOGGING_IMPORT_REGEX2, TEST_FILE_REGEX, kotlinPrintlnAsLogRule;
+var PRINTLN_REGEX, REAL_LOGGING_IMPORT_REGEX2, TEST_FILE_REGEX2, kotlinPrintlnAsLogRule;
 var init_println_as_log = __esm({
   "src/rules/kotlin/println-as-log.ts"() {
     "use strict";
     init_rule();
     PRINTLN_REGEX = /\bprintln\s*\(/g;
     REAL_LOGGING_IMPORT_REGEX2 = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
-    TEST_FILE_REGEX = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
+    TEST_FILE_REGEX2 = /(?:\/src\/test\/|\/test\/|\/Tests\/|\/Test\.kt|\/Tests\.kt|Tests\.kt$|Test\.kt$)/;
     kotlinPrintlnAsLogRule = createRule({
       id: "kotlin/println-as-log",
       category: "logic",
@@ -31298,7 +31300,7 @@ var init_println_as_log = __esm({
         const source = facts.v2?._source;
         if (!source) return issues;
         if (!/\.kts?$/i.test(facts.filePath)) return issues;
-        if (TEST_FILE_REGEX.test(facts.filePath)) return issues;
+        if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
         if (REAL_LOGGING_IMPORT_REGEX2.test(source)) return issues;
         let m;
         PRINTLN_REGEX.lastIndex = 0;
@@ -31420,9 +31422,9 @@ var init_sql_string_concat2 = __esm({
   "src/rules/kotlin/sql-string-concat.ts"() {
     "use strict";
     init_rule();
-    SQL_KEYWORD_REGEX2 = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
+    SQL_KEYWORD_REGEX2 = /\b(SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
     UNSAFE_REGEX2 = /(?:\+|\$\{)/;
-    SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\\?\\?|\?\\s*,)/;
+    SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\?|\?)/;
     kotlinSqlStringConcatRule = createRule({
       id: "kotlin/sql-string-concat",
       category: "security",
@@ -31440,7 +31442,14 @@ var init_sql_string_concat2 = __esm({
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           const line = lines[i];
-          if (!SQL_KEYWORD_REGEX2.test(line)) continue;
+          const keywordMatch = SQL_KEYWORD_REGEX2.exec(line);
+          if (!keywordMatch) continue;
+          const keywordIdx = keywordMatch.index;
+          let j = keywordIdx - 1;
+          while (j >= 0 && /\s/.test(line[j])) j--;
+          if (j < 0) continue;
+          const prevChar = line[j];
+          if (prevChar !== '"' && prevChar !== "'" && prevChar !== "=") continue;
           if (!UNSAFE_REGEX2.test(line)) continue;
           if (SAFE_REGEX2.test(line)) continue;
           issues.push({
@@ -31451,7 +31460,7 @@ var init_sql_string_concat2 = __esm({
             message: `SQL query built via string concat/template at line ${i + 1}`,
             line: i + 1,
             column: 1,
-            advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.29 (OWASP A03:2021).'
+            advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.34.8 (refined: require SQL keyword to start a string literal; fixed SAFE_REGEX bug).'
           });
         }
         return issues;
@@ -41157,14 +41166,14 @@ var init_implicitly_unwrapped_optional = __esm({
 });
 
 // src/rules/swift/print-debug.ts
-var PRINT_REGEX, DEFAULT_THRESHOLD2, TEST_FILE_REGEX2, swiftPrintDebugRule;
+var PRINT_REGEX, DEFAULT_THRESHOLD2, TEST_FILE_REGEX3, swiftPrintDebugRule;
 var init_print_debug = __esm({
   "src/rules/swift/print-debug.ts"() {
     "use strict";
     init_rule();
     PRINT_REGEX = /\bprint\s*\(/g;
     DEFAULT_THRESHOLD2 = 1;
-    TEST_FILE_REGEX2 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
+    TEST_FILE_REGEX3 = /(?:\/Tests\/|\/Tests\.swift|\/Test\.swift|Tests\.swift$|Test\.swift$)/;
     swiftPrintDebugRule = createRule({
       id: "swift/print-debug",
       category: "typo",
@@ -41179,7 +41188,7 @@ var init_print_debug = __esm({
         const source = facts.v2?._source;
         if (!source) return issues;
         if (!/\.swift$/i.test(facts.filePath)) return issues;
-        if (TEST_FILE_REGEX2.test(facts.filePath)) return issues;
+        if (TEST_FILE_REGEX3.test(facts.filePath)) return issues;
         const matches = [];
         let m;
         PRINT_REGEX.lastIndex = 0;
@@ -51603,7 +51612,7 @@ var init_signal_strength = __esm({
         precision: 0.0556,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.75 (DORMANT). 18 fires total \u2014 modern Kotlin mostly uses ORMs (Room/Exposed) so SQL string concat is rare in both arms. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: rule is loadable but invisible by default until v0.30 re-calibration with a larger pos arm.",
+        _calibrationNote: 'v0.34.8: REFINED \u2014 rule now requires the SQL keyword to be the start of a string literal (preceded by `"`, `\'`, or `=`), and fixed a bug in the SAFE_REGEX (the `:??` was malformed, should be `:?`). Per-file unique v9 Kotlin calibration (2698 neg, 213 pos): 1 TP file, 17 FP files, ratio=0.75 (DORMANT). 18 total fires. The refinement is expected to push precision from 5.6% to 25%+ by removing lines where SELECT/INSERT appears in string values (e.g. `val msg = "Selected 1 row: \\$count"`). Also fixed the bug where `:??` in SAFE_REGEX didn\'t match Java/Kotlin named parameters (`:id`). The full v9 re-calibration is part of the broader v0.34.8/v0.34.9 pipeline. INSUFFICIENT_DATA: pos arm 213 files (below 10k floor).',
         aiSpecific: false,
         _v9Verdict: "DORMANT",
         _v9Lift: 0.75,
@@ -51947,7 +51956,7 @@ var init_signal_strength = __esm({
         precision: 0.4407,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "OK",
-        _calibrationNote: "v0.33: v9 C++ calibration (5107 neg, 1655 pos). Per-file unique: 156 TP files, 198 FP files, ratio=2.43 (\u22651.5) \u2014 fourth positive-signal rule in v9 history (and the strongest ratio so far). precision=44.07% (just below 50% USEFUL threshold); verdict=OK. Total fires: 182 TP, 198 FP. The signal is real: post-2024 C++ (mostly AI-generated demos in llama.cpp, whisper.cpp, openai-cpp) uses printf/cout for output; pre-2022 production C++ (folly, protobuf, abseil) uses spdlog / glog / AbslLog. Same direction as kotlin/println-as-log (1.84), java/system-out-println (1.73 refined), swift/print-debug (1.13). INSUFFICIENT_DATA: pos arm 1655 files (below 10k floor).",
+        _calibrationNote: "v0.34.7: REFINED \u2014 rule now skips test files (gtest, catch2, doctest conventions: *_test.cpp, *_test.cc, /tests/ dir, *Test.cpp, *Test.cc, *_unittest.cpp). Per-file unique v9 C++ calibration (5107 neg, 1655 pos): 156 TP files, 198 FP files, ratio=2.43 (OK, fourth positive-signal in v9 history). precision=44.07% (below 50% USEFUL threshold); verdict=OK. The refinement is expected to push precision from 44% to 50%+ by removing gtest test output fires (which were a significant portion of FPs in the v0.33.0 measurement). The full v9 re-calibration is part of the broader v0.34.5/v0.34.7 pipeline; see v0.34.1's Four-language validation section. Same direction as kotlin/println-as-log (1.84), java/system-out-println (1.73 refined, 3.29 unrefined), swift/print-debug (1.13). INSUFFICIENT_DATA: pos arm 1655 files (below 10k floor).",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slopbrick",
-  "version": "0.34.6",
+  "version": "0.34.8",
   "description": "Discovered, modeled, and governed repository structure. SlopBrick scans source code, classifies it against 95+ rules in 15 categories, computes 4 scores (aiSlopScore: lower=cleaner, engineeringHygiene, security, repositoryHealth composite), and persists the structure for AI agents and CI.",
   "type": "module",
   "bin": {