Why this post is different from the last one
The last write-up in this series announced four tools. This one is about what happened when I stopped writing tests for my own tools and started checking one of them against reality — and about the fix I built, tested, shipped, and then took back out, because it was wrong in a way that only showed up once I looked past the headline number.
The setup: inlet, and the claim it hadn't actually tested
inlet is a static scanner: point it at a Python codebase, it finds every call site that looks like SQL execution — raw DB API calls, Django's .raw()/.extra(), SQLAlchemy's text() — and classifies each as parameterized, concatenated, or uncertain. Every claim in its original README was backed by 7 hand-written fixtures, each proving one specific classification rule.
That's real, but it's not evidence of anything beyond "the mechanism works on cases designed to exercise it." So I built a real-world evaluation: 15 PyPI packages, split into two groups.
