Add FP guard cases to test fixtures for N+1, limit-multiplier, admin-hook

- n-plus-one-optimized.php: sequential meta calls after loop closure
- limit-multiplier-from-count.php: display/comparison/assignment count() uses
- admin-no-capability.php: admin-only hook whitelist (admin_notices, admin_init, admin_menu)

All 20 fixture validations pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: noelsaw1

CHANGELOG.md

@@ -20,6 +20,12 @@ All notable changes to this project will be documented in this file.
 
 - N+1 pattern findings now include the actual source code line in the report. Previously the `code` field was empty because `find_meta_in_loop_line` only returned the line number without extracting the source text
 
+### Tests
+
+- Added false-positive guard cases to `n-plus-one-optimized.php` fixture: sequential `get_user_meta()` calls after loop closure should not be flagged
+- Expanded `limit-multiplier-from-count.php` fixture with display, comparison, and assignment uses of `count()` that should not match the multiplier pattern
+- Added admin-only hook whitelist cases to `admin-no-capability.php` fixture: `admin_notices`, `admin_init`, `admin_menu` hooks should be INFO, not HIGH
+
 ### Documentation
 
 - Added "WP Code Check Scanner — Quick Reference" section to `AGENTS.md` with CLI flags, MCP server configuration, output locations, and pattern library pointer for AI agent discoverability

dist/tests/fixtures/admin-no-capability.php

@@ -147,3 +147,37 @@ function check_user_capability( $user_id ) {
     return true;
 }
 
+// ============================================================
+// ADMIN-ONLY HOOK WHITELIST - Should be INFO, not HIGH
+// These hooks inherently require admin context
+// ============================================================
+
+// add_action with admin_notices hook - should be downgraded to INFO
+// This was the exact FP from creditconnection2-self-service credit-registry-forms.php:48
+function check_plugin_dependencies() {
+    if (!is_plugin_active('required-plugin/required-plugin.php')) {
+        add_action('admin_notices', 'show_dependency_notice');
+        deactivate_plugins(plugin_basename(__FILE__));
+        return false;
+    }
+    return true;
+}
+
+function show_dependency_notice() {
+    echo '<div class="notice notice-error"><p>Required plugin is not active.</p></div>';
+}
+
+// add_action with admin_init hook - should be downgraded to INFO
+add_action( 'admin_init', 'register_plugin_settings' );
+
+function register_plugin_settings() {
+    register_setting( 'my_plugin_options', 'my_plugin_setting' );
+}
+
+// add_action with admin_menu hook - should be downgraded to INFO
+add_action( 'admin_menu', 'add_plugin_admin_menu' );
+
+function add_plugin_admin_menu() {
+    add_options_page( 'Plugin Settings', 'Plugin Settings', 'manage_options', 'my-plugin', 'render_settings' );
+}
+

dist/tests/fixtures/limit-multiplier-from-count.php

@@ -2,7 +2,51 @@
 
 // Fixture: candidate limit multiplier derived from count()
 
+// ============================================================
+// TRUE POSITIVE — count() multiplied into a limit value
+// ============================================================
+
 function hcc_fixture_limit_multiplier_from_count( array $user_ids ) {
 	$candidate_limit = count( $user_ids ) * 10 * 5;
 	return $candidate_limit;
 }
+
+// ============================================================
+// FALSE POSITIVE GUARDS — count() used for display, comparison, or assignment
+// These should NOT be flagged by limit-multiplier-from-count
+// ============================================================
+
+// FP: count() used in echo/display context
+function display_pending_count( $pending ) {
+	echo "\nPending submissions: " . count($pending) . "\n";
+}
+
+// FP: count() used as array value for logging/display
+function build_summary_array( $person ) {
+	return [
+		'Phone_Count' => isset($person['ContactPhoneNumbers']) ? count($person['ContactPhoneNumbers']) : 0,
+		'Email_Count' => isset($person['ContactEmailAddresses']) ? count($person['ContactEmailAddresses']) : 0,
+	];
+}
+
+// FP: count() used in while-loop comparison (not a LIMIT multiplier)
+function normalize_array( $normalized, $length ) {
+	while (count($normalized) < $length) {
+		$normalized[] = '';
+	}
+	return $normalized;
+}
+
+// FP: count() used in HTML output
+function render_log_summary( $request_files, $response_files ) {
+	echo '<p><strong>Request Logs:</strong> ' . count($request_files) . ' file(s)</p>';
+	echo '<p><strong>Response Logs:</strong> ' . count($response_files) . ' file(s)</p>';
+}
+
+// FP: count() used in if-condition (not multiplied)
+function trim_submissions( $pending_submissions ) {
+	if (count($pending_submissions) > 10) {
+		$pending_submissions = array_slice($pending_submissions, 0, 10);
+	}
+	return $pending_submissions;
+}

dist/tests/fixtures/n-plus-one-optimized.php

@@ -154,6 +154,51 @@ function get_order_counts_for_customers( $user_ids ) {
     return $counts;
 }
 
+// ============================================================
+// FALSE POSITIVE GUARD: Sequential meta calls AFTER loop closure
+// These should NOT be flagged as N+1 — the meta calls are outside the loop body
+// ============================================================
+
+/**
+ * FP CASE: get_user_meta() called sequentially for a single user AFTER a loop.
+ * The loop iterates over something else; the meta read is not inside it.
+ * This was the exact pattern from creditconnection2-self-service check-user-meta.php:23
+ */
+function process_users_then_read_single_meta( $users ) {
+    // Loop over users for some unrelated work
+    foreach ( $users as $user ) {
+        echo esc_html( $user->display_name );
+    }
+
+    // Sequential meta read for a single user — NOT inside the loop
+    $current_user_id = get_current_user_id();
+    $registry_id = get_user_meta( $current_user_id, 'creditregistry_id', true );
+    if ( empty( $registry_id ) ) {
+        $registry_id = get_user_meta( $current_user_id, 'credit_registry_id', true );
+    }
+
+    return $registry_id;
+}
+
+/**
+ * FP CASE: Single get_user_meta() re-read after processing loop results.
+ * This was the exact pattern from class-cr-business-rest-api.php:245
+ */
+function fetch_data_after_loop( $submissions ) {
+    foreach ( $submissions as $key => $submission ) {
+        $status = $submission['status'] ?? 'pending';
+        if ( $status === 'success' ) {
+            break;
+        }
+    }
+
+    // Re-read meta after loop — not inside loop body
+    $user_id = get_current_user_id();
+    $updated_id = get_user_meta( $user_id, 'cr_business_subscriber_registry_id', true );
+
+    return $updated_id;
+}
+
 /**
  * Helper: Bulk load recent orders (example implementation)
  */