test(eval): sharpen java held-out fixtures and calibrate baseline (#68)

tests/eval/java/baseline.held-out.txt

@@ -1,6 +1,6 @@
 precision_floor=0.80
 recall_floor=0.50
-precision_baseline=0.80
-recall_baseline=0.50
+precision_baseline=1.00
+recall_baseline=1.00
 noise_band=0.10
 overfit_band=0.15

tests/eval/java/held-out/BugPathTraversal.java

@@ -1,6 +1,7 @@
 import java.io.*;
-class BugPathTraversal {
-  File open(String name) {
-    return new File("/data/" + name);   // user-controlled name -> traversal
-  }
+import java.nio.file.*;
+public class BugPathTraversal {
+    byte[] load(String name) throws IOException {
+        return Files.readAllBytes(Paths.get("/data/" + name));  // untrusted name -> realized path-traversal read
+    }
 }

tests/eval/java/held-out/BugPathTraversal.java.expected

@@ -1 +1 @@
-4:cat#3
+5:cat#3

tests/eval/java/held-out/BugSwallowedParse.java

@@ -0,0 +1,6 @@
+public class BugSwallowedParse {
+    int port(String s) {
+        try { return Integer.parseInt(s); }
+        catch (NumberFormatException e) { return 0; }   // swallowed: invalid input silently becomes 0
+    }
+}

tests/eval/java/held-out/BugSwallowedParse.java.expected

@@ -0,0 +1 @@
+4:cat#2

tests/eval/java/held-out/CleanReportedParse.java

@@ -0,0 +1,5 @@
+public class CleanReportedParse {
+    int port(String s) {
+        return Integer.parseInt(s);   // NumberFormatException propagates to caller; nothing swallowed
+    }
+}

tests/eval/java/held-out/CleanSafePath.java

@@ -0,0 +1,8 @@
+import java.io.*;
+import java.nio.file.*;
+public class CleanSafePath {
+    byte[] load(String name) throws IOException {
+        if (!name.matches("[a-z0-9]+")) throw new IllegalArgumentException("bad name");  // strict whitelist
+        return Files.readAllBytes(Paths.get("/data").resolve(name));   // no separators possible -> no traversal
+    }
+}