@codacy/verity-cli 0.33.3-experimental.86b5b6f → 0.33.3-experimental.b6d47c6

package/bin/verity.js

@@ -22639,7 +22639,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.33.3-experimental.86b5b6f" : "dev";
+    return true ? "0.33.3-experimental.b6d47c6" : "dev";
   } catch {
     return "dev";
   }
@@ -26825,7 +26825,7 @@ async function buildAgentDiffs(ctx, paths, limits = { perFileChars: 24e3, totalC
 
 // src/lib/prove/auto.ts
 var import_node_path41 = require("node:path");
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 
 // src/lib/prove/signals.ts
 var DEFAULT_SINCE = "180 days ago";
@@ -26836,7 +26836,7 @@ var RISK_PATTERNS = [
   ["retry", /\b(retry|retries|retried|backoff|attempt\w*|reconnect\w*)\b/i],
   ["cache_or_idempotency", /\b(cache\w*|dedup\w*|idempoten\w*|memoiz\w*|debounce\w*|throttl\w*)\b/i],
   ["state_machine", /\b(status|transition\w*|phase|lifecycle|state\s*machine)\b/i],
-  ["money", /\b(amount|balance|price|payment\w*|charge\w*|invoice\w*|refund\w*|currency|cost_usd)\b/i],
+  ["money", /\b(amount|balance|price|payment\w*|payout\w*|charge\w*|invoice\w*|refund\w*|currency|cents|ledger\w*|wallet\w*|fee|fees|discount\w*|cost_usd)\b/i],
   ["auth", /\b(auth\w*|bearer|token\w*|session\w*|permission\w*|grant\w*|role\w*)\b/i],
   ["transaction", /\b(transaction\w*|rollback|commit\(|BEGIN|savepoint)\b/i]
 ];
@@ -26886,6 +26886,12 @@ function trackedSourceFiles(root, opts = {}) {
   const files = res.stdout.split("\0").filter((f) => f && isCandidateSource(f));
   return files.slice(0, opts.maxFiles ?? 5e3);
 }
+var EFFECT_LINE = /\bawait\b|\basync\s+with\b|\.then\(|\bsetTimeout\(|\bsetInterval\(|\bwith\s+\w[\w.]*\.(?:lock|acquire)\b|\bLock\(\)/;
+function countEffects(text) {
+  let n = 0;
+  for (const line of text.split("\n")) if (EFFECT_LINE.test(line)) n++;
+  return n;
+}
 function scanRisk(text) {
   const counts = Object.fromEntries(RISK_PATTERNS.map(([c]) => [c, 0]));
   for (const line of text.split("\n")) {
@@ -26934,6 +26940,7 @@ function collectRiskSignals(root, opts = {}) {
     let bytes = 0;
     let lines = 0;
     let risk = scanRisk("");
+    let effects = 0;
     const st = statRegularInRoot(root, file);
     if (!st.ok) continue;
     bytes = st.size;
@@ -26942,6 +26949,7 @@ function collectRiskSignals(root, opts = {}) {
       if (read.ok) {
         lines = read.content.split("\n").length;
         risk = scanRisk(read.content);
+        effects = countEffects(read.content);
       }
     }
     const base = {
@@ -26952,7 +26960,8 @@ function collectRiskSignals(root, opts = {}) {
       lastTouched: h?.lastTouched ?? null,
       bytes,
       lines,
-      risk
+      risk,
+      effects
     };
     const { score, reasons } = scoreSignals(base);
     if (score <= 0) continue;
@@ -27036,10 +27045,14 @@ var LUNA_SCHEMA = {
   },
   required: ["items"]
 };
-var LUNA_INSTRUCTIONS = `You select SMALL pieces of code worth building a formal model of (a Lean 4 transition system with bounded exploration). The goal is to find bugs, not to model the codebase.
-For each file you are given its git-history signals and an excerpt. Score each 0-1 for "a model of one function here would likely expose a real bug": high for check-then-act guards, retries, caches, dedup keys, locks/leases, status transitions, money, concurrent writes; low for glue, rendering, configuration, or code whose correctness is obvious from reading.
-Name the single symbol (function) most worth modelling, and the applicable properties from the catalogue only. Reasons: at most 3, each a short concrete sentence about THIS code. Return every file you were given, exactly once.
-When a file lists \`changed\` lines, this is a review of a push: the excerpt is numbered around the changes (changed lines starred). Name the function that CONTAINS a changed line, and score THAT FUNCTION'S CURRENT CODE as a whole \u2014 how likely a model of it exposes a real bug \u2014 never the edit itself. A one-line change (a log line, a rename, a comment) to a function that checks then acts, retries, dedups, moves money, grants access or changes a status still scores high: the push touched risky code, and a latent bug in it is exactly what this is for. Score low only when the changed function is itself glue, wiring, command registration, rendering, configuration or plainly correct.`;
+var LUNA_INSTRUCTIONS = `You decide whether a push deserves a FORMAL MODEL: a Lean 4 transition system explored over every interleaving, retry, failure and crash, then replayed on the real code. It costs the developer about a minute of their push, and blocks it only on a bug reproduced on the real code. It is a scalpel: most pushes deserve NO model.
+For each file you get its git-history signals (commits, fix commits), risk keyword counts and an excerpt. Score each 0-1 for "a model of ONE function here is worth that minute, because it would likely expose a real, costly bug". A high score needs ALL THREE:
+  - CRITICAL: a mistake costs money, data, access or a stuck workflow (payments, balances, stock, ledgers, auth and permissions, jobs and queues, sync, status machines, anything that must happen exactly once);
+  - A HAZARD a model can explore: two or more effects that can interleave (read then write, check then act), a retry or a redelivery, an external call whose failure path matters, a lock, a lease, a cache, a cursor, a crash window between writes \u2014 or pure arithmetic on money or counts;
+  - ERROR-PRONE or COMPLEX: fix commits in its history, high churn, several branches or error paths, a concurrency primitive \u2014 a hazard nobody sees by reading the function once.
+Score LOW (below 0.5) when any is missing: rendering, formatting, configuration, command registration, wiring, types, a single read, a single write with nothing before it, logging, or a function whose correctness is plain from reading it. A crash window alone (an external call, then a local write, where a re-run repairs the state and nothing is lost for good) is not enough for a high score. A model of a function longer than about 150 lines abstracts too much to find anything: name the smaller function inside it that holds the hazard, or score lower.
+Name the single symbol (function) most worth modelling, and the applicable properties from the catalogue only. Reasons: at most 3, each a short concrete sentence about THIS code that names the hazard. Return every file you were given, exactly once.
+When a file lists \`changed\` lines, this is a review of a push: the excerpt is numbered around the changes (changed lines starred). Name the function that CONTAINS a changed line, and score THAT FUNCTION'S CURRENT CODE as a whole, never the edit itself. A one-line change (a log line, a rename) to a function that meets all three still scores high: a latent bug in it is exactly what this is for. A large change to a function that misses one still scores low.`;
 var lunaRanker = {
   name: "luna",
   async rank(candidates2, ctx) {
@@ -27462,6 +27475,7 @@ function braceDelta(code) {
 }
 
 // src/lib/prove/generate.ts
+var MAX_NUMBERED_BYTES = 64 * 1024;
 var LIBRARY_API = `The Verity Lean 4 library (already built; \`import Verity\` is the ONLY import allowed):
 
   structure Verity.System (\u03C3 \u03B1 : Type) where
@@ -27480,7 +27494,8 @@ var LIBRARY_API = `The Verity Lean 4 library (already built; \`import Verity\` i
   Verity.checkData [ToString \u03B2] (m : Model) (p : Property) (inputs : List \u03B2) (prop : \u03B2 \u2192 Bool) : IO Unit
   Verity.proved    (m : Model) (p : Property) (theoremName : String) : IO Unit   -- only beside a real theorem
 
-\`Verity.check\` explores every interleaving of enabled actions breadth-first to \`bound\` and reports the SHORTEST action sequence reaching a state where \`inv\` is false.`;
+\`Verity.check\` explores every interleaving of enabled actions breadth-first to \`bound\` and reports the SHORTEST action sequence reaching a state where \`inv\` is false.
+\`Verity.checkData\` evaluates \`prop\` on each concrete input and reports the first that fails \u2014 for a PURE computation (exemplar 3).`;
 var EXEMPLAR = `import Verity
 
 namespace Models.SeedRunner
@@ -27524,51 +27539,272 @@ def P1 : Property := { id := "P1", kind := .structural, desc := "seeding runs at
 #eval Verity.check model P1 sys (fun s => s.posts \u2264 1) { bound := 4 }
 
 end Models.SeedRunner`;
-var RULES = `Write ONE Lean 4 model of the code below, in the style of the exemplar, that could expose a real bug. Rules:
+var EXEMPLAR_CONCURRENT = `import Verity
+
+namespace Models.Withdraw
+open Verity
+
+-- withdraw(account, 7) called twice at once on a balance of 10. Each call has
+-- its own program counter: 0 not started, 1 read the balance, 2 debited, 3 done.
+structure S where
+  balance : Nat
+  pcA : Nat
+  seenA : Nat
+  pcB : Nat
+  seenB : Nat
+  paidOut : Nat
+  deriving BEq, Hashable, Repr
+
+instance : ToString S where
+  toString s := s!"balance={s.balance} pcA={s.pcA} pcB={s.pcB} paidOut={s.paidOut}"
+
+inductive A where
+  | readA | debitA | recordA | readB | debitB | recordB
+  deriving Repr
+
+instance : ToString A where
+  toString
+    | .readA => "call A: db.getAccount (L7)"
+    | .debitA => "call A: balance check + db.setBalance (L8-9)"
+    | .recordA => "call A: db.recordTransaction (L10)"
+    | .readB => "call B: db.getAccount (L7)"
+    | .debitB => "call B: balance check + db.setBalance (L8-9)"
+    | .recordB => "call B: db.recordTransaction (L10)"
+
+def amount : Nat := 7
+
+def step (s : S) : A \u2192 S
+  | .readA => { s with pcA := 1, seenA := s.balance }
+  | .debitA => if s.seenA < amount then { s with pcA := 3 } else { s with balance := s.seenA - amount, pcA := 2 }
+  | .recordA => { s with paidOut := s.paidOut + amount, pcA := 3 }
+  | .readB => { s with pcB := 1, seenB := s.balance }
+  | .debitB => if s.seenB < amount then { s with pcB := 3 } else { s with balance := s.seenB - amount, pcB := 2 }
+  | .recordB => { s with paidOut := s.paidOut + amount, pcB := 3 }
+
+def next (pc : Nat) (read debit record : A) : List A :=
+  if pc == 0 then [read] else if pc == 1 then [debit] else if pc == 2 then [record] else []
+
+def sys : System S A :=
+  { init := { balance := 10, pcA := 0, seenA := 0, pcB := 0, seenB := 0, paidOut := 0 }
+    actions := fun s => next s.pcA A.readA A.debitA A.recordA ++ next s.pcB A.readB A.debitB A.recordB
+    step := step }
+
+def model : Model :=
+  { name := "Withdraw"
+    abstracts := [ { file := "src/accounts/withdraw.ts", symbol := "withdraw", sha256 := "<sha256>", lines := "5-12" } ] }
+
+def P1 : Property := { id := "no_overdraft_under_concurrent_withdrawals", kind := .structural, desc := "two concurrent withdrawals never pay out more than the balance held: the balance check and the debit act as one step" }
+def P2 : Property := { id := "balance_matches_payouts", kind := .structural, desc := "once both calls are done, the balance plus everything paid out equals the starting balance (no lost update)" }
+
+#eval Verity.model model
+#eval Verity.check model P1 sys (fun s => s.paidOut \u2264 10) { bound := 6 }
+#eval Verity.check model P2 sys (fun s => !(s.pcA == 3 && s.pcB == 3) || s.balance + s.paidOut == 10) { bound := 6 }
+
+end Models.Withdraw`;
+var EXEMPLAR_DATA = `import Verity
+
+namespace Models.Split
+open Verity
+
+-- splitPayout(total, shares): each part rounded on its own (lines 4-6).
+def roundDiv (n d : Nat) : Nat := (2 * n + d) / (2 * d)
+
+def split (total : Nat) (shares : List Nat) : List Nat :=
+  let sum := shares.foldl (fun a b => a + b) 0
+  shares.map (fun s => roundDiv (total * s) sum)
+
+def model : Model :=
+  { name := "Split"
+    abstracts := [ { file := "src/payouts/split.ts", symbol := "splitPayout", sha256 := "<sha256>", lines := "4-8" } ] }
+
+def P1 : Property := { id := "parts_sum_to_total", kind := .structural, desc := "the parts of a payout always add up to the total paid out" }
+
+#eval Verity.model model
+#eval Verity.checkData model P1 [(100, [1, 1, 1]), (2, [1, 1, 1]), (10, [1, 2]), (7, [3, 4])] (fun (x : Nat \xD7 List Nat) => (split x.1 x.2).foldl (fun a b => a + b) 0 == x.1)
+
+end Models.Split`;
+var RULES = `Write ONE Lean 4 model of the code below that could expose a real bug in it. Work in three steps.
+
+STEP 1 \u2014 Effects. The input lists the target's EFFECT SITES: awaits, calls on its dependencies, loops, try/catch, locks. Those are the only points where the real world can interleave, fail or crash. Each one that reads or writes shared state becomes an action, named after the real call and its line \u2014 "db.setBalance (L14)" \u2014 so a trace reads as a scenario someone can replay.
+
+STEP 2 \u2014 The environment's moves that exist in reality for THIS code, and only those:
+  \u2022 a SECOND INVOCATION running concurrently (request handlers, jobs, webhooks, workers \u2014 anything a server calls). Give each invocation its own program counter so their effects interleave (exemplar 2);
+  \u2022 a REDELIVERY or RETRY of the same input \u2014 when the input carries an id or key, or a caller, a job or a loop retries;
+  \u2022 an external call that TAKES EFFECT AND THEN FAILS or times out \u2014 for every external call inside a try or a retry loop: the caller sees an error although the effect happened;
+  \u2022 TIME passing \u2014 when the code reads a clock, a lease, a TTL or an expiry;
+  \u2022 a LOCK held across an await \u2014 acquire and release as separate actions, so two invocations can wait on each other;
+  \u2022 a CRASH between two writes that are not one transaction, followed by the RECOVERY the code relies on (the redelivery, the job's next run, the client's retry).
+  Keep it small: at most 2 invocations, 1 redelivery, 1 failure, 1 crash, a clock of 3 ticks.
+
+STEP 3 \u2014 Properties: 2 to 4, in this order of priority:
+  1. what the code's own comments, names or messages promise ("at most once", "dedup", "only", "must", "never", "every");
+  2. no double effect, no lost update, check-then-act is atomic \u2014 under the second invocation or the redelivery;
+  3. never fails open \u2014 an error, a missing row or a failed lookup never grants access, marks work done or reports success;
+  4. conservation \u2014 money, stock and counts add up: parts sum to the total, nothing credited twice or lost, no row skipped;
+  5. progress \u2014 no deadlock, nothing stuck forever, retries end;
+  6. crash consistency \u2014 AT MOST ONE, listed LAST: "after a crash between X and Y and the recovery the code relies on, \u2026", or, where nothing recovers, only when the crash loses money or records for good.
+  A property must be something the code PROMISES. An operation whose job is to apply an effect on every call (a withdrawal, a charge, a send) promises "no double effect" only where the code dedups it (an idempotency key, a unique insert, a conditional update). When a comment says duplicates are by design (consumers dedupe on an id), do not claim "no double effect". An upsert, a set-to-value or a delete applied twice is not a double effect.
+  A counterexample must run the real function: a trace made only of environment moves (another writer, a clock) says nothing about this code. A promise about the END result (nothing lost, nothing charged twice, totals add up) is checked on states where every invocation has finished or crashed \u2014 guard the \`inv\` with the program counters, as exemplar 2's second property does; a violation that exists only while work is still pending is not a bug.
+  A property is about an OUTCOME someone would call a bug \u2014 money, stock or records wrong, access granted, work lost or done twice, a job stuck forever \u2014 never about the mechanism's internals (a key's format, two timestamps being distinct, a lease's exact boundary tick). A comment that says HOW the code works ("make each attempt's key unique") is not the promise; the promise is what that mechanism is for.
+  A comment that states a SAFE design choice ("a spent token presented again ends every session", "consumers dedupe, so publishing twice is harmless") is the design: never claim the opposite. A comment never makes an UNSAFE outcome safe: granting access on an error, losing or double-counting money, stock or records is a bug whatever the comment says ("don't block people when the permission service is flaky" describes a fail-open bug).
+  Property ids name the promise in snake_case (refund_total_within_capture) \u2014 never P1. \`desc\` states the promise in the code's own terms and names the move the trace needs ("two concurrent calls \u2026", "after the charge succeeded and the call timed out \u2026").
+  A PURE computation (no effect sites) is checked with \`Verity.checkData\` on small concrete inputs, including the edge cases (exemplar 3).
+
+Lean rules \u2014 the linter and the compiler refuse anything else:
 - The file starts with \`import Verity\` (the only import), then \`namespace Models.<Name>\`, \`open Verity\`, and ends with \`end Models.<Name>\`.
-- State: a structure with at most 6 fields, only what the properties read; \`deriving BEq, Hashable, Repr\` and a \`ToString\` instance. Keep every counter bounded through \`actions\` so the reachable state space is finite (a few hundred states at most).
-- Actions: an inductive with a \`ToString\` instance naming the REAL operation (the function or event), so a trace reads like a scenario. Include the actions that can interleave in reality: a retry, a second call, a concurrent writer, a redelivered event, a crash between two writes.
-- \`step\` must do what the code DOES (read the source), not what it should do.
-- 2 to 4 properties from this catalogue, all \`kind := .structural\`: idempotence, no lost update, status only moves forward, retries terminate, never fails open, bounded size, check-then-act is atomic, no double effect. Each \`inv\` must be a real claim the explorer can refute; no tautologies. Add an \`intent\` property ONLY if a comment in the source states the expectation, and cite its line in \`source\`.
+- State: a structure with at most 8 fields, only what the properties read; \`deriving BEq, Hashable, Repr\` and a \`ToString\` instance. Keep every counter bounded through \`actions\` so the reachable state space stays finite (a few hundred states).
+- \`step\` does what the code DOES, line by line \u2014 not what it should do. An \`inv\` must be a real claim the explorer can refute; no tautologies. Add an \`intent\` property only when a comment states the expectation, and cite its line in \`source\`.
 - The header: \`abstracts := [{ file, symbol, sha256, lines }]\` with the exact values given below (lines "" when none).
-- Exactly one \`#eval Verity.model\` and one \`#eval Verity.check\` per property, \`{ bound := 6 }\` or less. No other \`#eval\`, no \`IO\`, no \`sorry\`, no attributes, no macros, no \`partial\`. Under 120 lines.
+- Exactly one \`#eval Verity.model\` and one \`#eval Verity.check\` (or \`Verity.checkData\`) per property, \`{ bound := 8 }\` or less. No other \`#eval\`, no \`IO\`, no \`sorry\`, no attributes, no macros, no \`partial\`, no \`open\` other than \`open Verity\`, no name from \`System\`, \`Lean\` or \`Std\`. Under 150 lines.
 - Write every structure literal on ONE line: the \`abstracts\` entry, each \`{ s with \u2026 }\` update, each \`{ field := \u2026 }\` value. Lean reads a literal split across lines by its indentation and refuses it.
-- A property must be something the function PROMISES. Do not claim idempotence or no double effect for an operation whose job is to apply an effect on every call (a withdrawal, a charge, a send) unless the code dedups it (an idempotency key, a unique insert, an explicit check). When a trace needs a crash between two writes, say so in \`desc\` ("after a crash between X and Y, \u2026").
-- Imports beyond \`Verity\` are refused by a linter; a file that does not elaborate gets ONE more attempt with the compiler's message.
+- A file that does not elaborate gets ONE more attempt with the compiler's message.
 Answer with JSON only: {"name": "<PascalCase>", "lean_source": "<the whole file>", "summary": "<one sentence: what the model abstracts and which property is most likely to fail>"}.`;
-var SCHEMA = {
-  type: "object",
-  additionalProperties: false,
-  properties: {
-    name: { type: "string" },
-    lean_source: { type: "string" },
-    summary: { type: "string" }
-  },
-  required: ["name", "lean_source", "summary"]
-};
+var EFFECT_LINE2 = /\bawait\b|\basync\s+with\b|\bwith\s+\w[\w.]*\.(?:lock|acquire)\b|\.then\(|\bsetTimeout\(|\bsetInterval\(|\bqueueMicrotask\(/;
+var CONTROL_LINE = /^\s*(?:\}\s*)?(?:for|while|try|catch|except|finally|do)\b|^\s*(?:async\s+)?for\b/;
+var NUMBERED_LINE = /^\s*(\d+)\| ?(.*)$/;
+var PARAM_NAME = /(?:^|[(,])\s*(?:self\s*,\s*)?([A-Za-z_$][\w$]*)\s*(?=[?:=,)])/g;
+var MAX_EFFECT_SITES = 40;
+var IDENT_CHAR = /[\w$.]/;
+var CALL_AFTER_DOT = /^([A-Za-z_$][\w$]*)\s*\(/;
+var PURE_METHODS = /* @__PURE__ */ new Set([
+  "map",
+  "filter",
+  "reduce",
+  "forEach",
+  "flatMap",
+  "slice",
+  "join",
+  "split",
+  "includes",
+  "indexOf",
+  "some",
+  "every",
+  "find",
+  "findIndex",
+  "concat",
+  "sort",
+  "toFixed",
+  "toString",
+  "trim",
+  "toLowerCase",
+  "toUpperCase",
+  "replace",
+  "startsWith",
+  "endsWith",
+  "at",
+  "keys",
+  "values",
+  "entries",
+  "items",
+  "copy",
+  "format",
+  "strip",
+  "lower",
+  "upper",
+  "append",
+  "extend",
+  "push",
+  "pop",
+  "has",
+  "size",
+  "length",
+  "isArray",
+  "padStart",
+  "padEnd",
+  "repeat",
+  "test",
+  "match"
+]);
+function callsOn(text, name) {
+  const needle = `${name}.`;
+  for (let i = text.indexOf(needle); i >= 0; i = text.indexOf(needle, i + 1)) {
+    if (i > 0 && IDENT_CHAR.test(text[i - 1])) continue;
+    const call = CALL_AFTER_DOT.exec(text.slice(i + needle.length));
+    if (call && !PURE_METHODS.has(call[1])) return true;
+  }
+  return false;
+}
+function callsDirect(text, name) {
+  const needle = `${name}(`;
+  for (let i = text.indexOf(needle); i >= 0; i = text.indexOf(needle, i + 1)) {
+    if (i > 0 && IDENT_CHAR.test(text[i - 1])) continue;
+    return true;
+  }
+  return false;
+}
+function effectSites(numbered) {
+  const rows = [];
+  for (const raw of numbered.split("\n")) {
+    const m = NUMBERED_LINE.exec(raw);
+    if (m) rows.push({ n: Number(m[1]), text: m[2] });
+  }
+  if (rows.length === 0) return [];
+  const head = rows.slice(0, 6).map((r) => r.text).join(" ");
+  const open = head.indexOf("(");
+  const close = open >= 0 ? head.indexOf(")", open) : -1;
+  const params = /* @__PURE__ */ new Set();
+  if (open >= 0 && close > open) {
+    for (const m of `(${head.slice(open + 1, close)})`.matchAll(PARAM_NAME)) if (m[1] !== "self") params.add(m[1]);
+  }
+  const out = [];
+  for (const [i, r] of rows.entries()) {
+    if (i === 0) continue;
+    const t = r.text.trim();
+    if (!t || t.startsWith("//") || t.startsWith("#") || t.startsWith("*")) continue;
+    const onParam = [...params].some((p) => callsOn(t, p) || callsDirect(t, p));
+    const kind = EFFECT_LINE2.test(t) || onParam ? "effect" : CONTROL_LINE.test(t) ? "control" : null;
+    if (!kind) continue;
+    out.push(`L${r.n} [${kind}] ${t.length > 160 ? t.slice(0, 157) + "\u2026" : t}`);
+    if (out.length >= MAX_EFFECT_SITES) break;
+  }
+  return out;
+}
 function renderGenerateInput(t, previous) {
   const parts = [];
   parts.push(`# Target: ${t.file} \u2014 \`${t.symbol}\`${t.lines ? ` (lines ${t.lines.from}\u2013${t.lines.to})` : ""}`);
   parts.push(`Header values: file := "${t.file}", symbol := "${t.symbol}", sha256 := "${t.sha256}", lines := "${t.lines ? `${t.lines.from}-${t.lines.to}` : ""}"`);
   if (t.reasons.length) parts.push(`Why it was selected: ${t.reasons.join(" \xB7 ")}`);
   if (t.properties.length) parts.push(`Suggested properties: ${t.properties.join(", ")}`);
-  parts.push("");
-  parts.push("```");
-  parts.push(t.numbered);
-  parts.push("```");
+  const numbered = t.numbered.slice(0, MAX_NUMBERED_BYTES);
+  const sites = effectSites(numbered);
+  parts.push("", sites.length ? `Effect sites (STEP 1 \u2014 where the real world can interleave, fail or crash):
+${sites.map((s) => `  ${s}`).join("\n")}` : "Effect sites: none \u2014 a pure computation (STEP 3: Verity.checkData on concrete inputs).");
+  parts.push("", "```", numbered, "```");
   if (previous) {
-    parts.push("");
-    parts.push("# Your previous attempt was not accepted \u2014 the diagnostics say why. Fix it (same model, same properties):");
-    parts.push("```lean");
-    parts.push(previous.source);
-    parts.push("```");
-    parts.push("Diagnostics:");
-    parts.push("```");
-    parts.push(previous.error.slice(0, 4e3));
-    parts.push("```");
+    parts.push("", "# Your previous attempt was not accepted \u2014 the diagnostics say why. Fix it (same model, same properties):", "```lean", previous.source.slice(0, 32 * 1024), "```", "Diagnostics:", "```", previous.error.slice(0, 4e3), "```");
   }
   return parts.join("\n");
 }
+function generateSystemPrompt() {
+  return `${RULES}
+
+${LIBRARY_API}
+
+# Exemplar 1 \u2014 one call repeated (a real model that found a real bug)
+\`\`\`lean
+${EXEMPLAR}
+\`\`\`
+
+# Exemplar 2 \u2014 two concurrent invocations, each with its own program counter
+\`\`\`lean
+${EXEMPLAR_CONCURRENT}
+\`\`\`
+
+# Exemplar 3 \u2014 a pure computation checked on concrete inputs
+\`\`\`lean
+${EXEMPLAR_DATA}
+\`\`\``;
+}
+var SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    name: { type: "string" },
+    lean_source: { type: "string" },
+    summary: { type: "string" }
+  },
+  required: ["name", "lean_source", "summary"]
+};
 function acceptAnswer(parsed, usage, costUsd = null) {
   const name = typeof parsed.name === "string" && /^[A-Z][A-Za-z0-9]{1,40}$/.test(parsed.name) ? parsed.name : null;
   const source = typeof parsed.lean_source === "string" ? joinBrokenLiterals(parsed.lean_source.replace(/\r\n/g, "\n")) : null;
@@ -27603,14 +27839,7 @@ async function generateModel(target, opts) {
   const baseUrl = opts.baseUrl ?? "https://api.openai.com/v1";
   const body = {
     model: opts.model ?? (opts.tier === "fast" ? "gpt-6-luna" : "gpt-5.6-terra"),
-    instructions: `${RULES}
-
-${LIBRARY_API}
-
-# Exemplar (a real model that found a real bug)
-\`\`\`lean
-${EXEMPLAR}
-\`\`\``,
+    instructions: generateSystemPrompt(),
     input: [{ role: "user", content: renderGenerateInput(target, opts.previous) }],
     reasoning: { effort: opts.tier === "fast" ? "low" : "medium" },
     max_output_tokens: 12e3,
@@ -27660,6 +27889,23 @@ function declaresSymbol(line, symbol, py) {
   if (py) return PY_DECL.exec(line)?.[1] === symbol;
   return TS_DECLS.some((re) => re.exec(line)?.[1] === symbol);
 }
+function harnessInvokes(texts, symbol, py) {
+  if (!/^[A-Za-z_$][\w$]*$/.test(symbol)) return null;
+  let declared = false;
+  for (const t of texts) {
+    for (const line of t.split("\n")) {
+      if (declaresSymbol(line, symbol, py)) {
+        declared = true;
+        continue;
+      }
+      for (let i = line.indexOf(`${symbol}(`); i >= 0; i = line.indexOf(`${symbol}(`, i + 1)) {
+        if (i === 0 || !/[\w$]/.test(line[i - 1])) return true;
+      }
+    }
+  }
+  return declared ? false : null;
+}
+var NOT_INVOKED = "the harness never calls the function under test \u2014 the trace was replayed on the stubs, not on the code";
 function extractSymbolBody(source, symbol, file, range) {
   const lines = source.split("\n");
   if (range) {
@@ -27735,13 +27981,22 @@ function buildReplayBrief(root, report, property, modelSource, readSource) {
 var REPLAY_INSTRUCTIONS = `You replay a formal-model counterexample on the REAL code, inside a disposable container with no network. Your job is to find out whether the real code does what the model says \u2014 not to fix it, not to judge whether it matters.
 
 Rules:
-1. Copy the real function(s) into the container VERBATIM from the numbered source you are given (write files with heredocs). Do not retype, simplify or "clean up" the function under test. Copying the whole file is fine. When the source is given as a LINE RANGE (a region inside a larger handler), copy EVERY line of that range verbatim as the body of a function you declare around it, and satisfy the helpers, imports and variables it uses by defining stubs OUTSIDE the copied region. Extracting only the statements you believe matter is not acceptable: the acceptance check counts the region's lines in your harness, and a partial copy fails it.
-2. Stub ONLY I/O boundaries: database/network clients, filesystem, clock, randomness, environment. Stubs must be faithful to the semantics the trace depends on (e.g. a unique index, an updated_at check, a file that exists or not). If you must stub something the trace depends on, say so in the reason.
-3. Drive the actions in the trace's order, controlling interleavings by hand (resolve promises in the order the trace says). Print the observable state after each action and a final line: REPLAY_RESULT=reproduced or REPLAY_RESULT=diverged.
-4. Detect runtimes first (node --version, python3 --version, deno --version). For TypeScript with no TypeScript runner available, prefer "node --experimental-strip-types"; if that is unavailable, remove type annotations ONLY on lines that are not part of the function under test's logic, and say so.
-5. Nothing you run can reach the network. Do not try.
-6. Keep it under about a dozen shell calls. Output tokens are time.
-7. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters).
+1. Copy the real function(s) into the container VERBATIM from the numbered source you are given. Do not retype, simplify or "clean up" the function under test. Copying the whole file is fine. When the source is given as a LINE RANGE (a region inside a larger handler), copy EVERY line of that range verbatim as the body of a function you declare around it, and satisfy the helpers, imports and variables it uses by defining stubs OUTSIDE the copied region. Extracting only the statements you believe matter is not acceptable: the acceptance check counts the region's lines in your harness, and a partial copy fails it.
+2. Stub ONLY I/O boundaries: database/network clients, filesystem, clock, randomness, environment, imported helpers. Stubs must be faithful to the semantics the trace depends on and to what the source's comments say the real call does (a unique index, a conditional UPDATE, a WHERE clause, an ordering) \u2014 and to what the code PASSES them: a payment or message stub given an idempotency key returns the first result for a repeated key and applies nothing twice; a unique key refuses a duplicate. A stub that ignores what the real service guarantees makes the reproduction worthless. If you must stub something the trace depends on in a way the source does not describe, say so in the reason.
+3. Drive the trace's actions in order. The model's action names cite the real calls and their lines. Environment moves, and how to reproduce them:
+   - Two concurrent invocations: start both calls of the real function; make the stub methods they await pause on gates the driver opens, so their effects happen in the trace's order. Node: const gate = () => { let open; const p = new Promise((r) => (open = r)); return { p, open } }. Python asyncio: asyncio.Event. Python threads: threading.Event.
+   - A redelivery or a retry: call the real function again with the same input, on the same stub state.
+   - A call that takes effect and then fails: the stub applies the effect, then throws the error the code handles (a timeout).
+   - Time passing: the stub clock or the injected now() returns the trace's times.
+   - A crash between X and Y: the stub for Y throws a crash error once; treat that invocation as dead, then run the recovery the trace names (the redelivery, the job's next run).
+   - A pure computation: call the real function on the counterexample's input.
+   - A deadlock or a hang: run under a timeout (asyncio.wait_for, Promise.race with a timer) and treat the timeout as the observation.
+   The harness must CALL the real function: a trace replayed on the stubs alone is not a reproduction \u2014 answer unreplayable.
+4. COMPUTE the verdict in the harness: print the observable state after each action; let every timer, promise and retry the trace did not crash or cancel run to completion; then evaluate the property's condition on the final real state and print exactly one line, REPLAY_RESULT=reproduced when the condition is violated or REPLAY_RESULT=diverged when it holds \u2014 chosen by an if/else or a conditional expression in the harness, never a fixed string.
+5. Write the harness as ONE file and run it in the SAME shell call that writes it (a heredoc followed by the run). TypeScript: node --experimental-strip-types harness.ts (detect runtimes only if that fails: node --version, python3 --version); if strip-types is unavailable, remove type annotations ONLY on lines that are not part of the function under test's logic, and say so. Python: python3 harness.py.
+6. Nothing you run can reach the network. Do not try.
+7. Keep it under about eight shell calls. Output tokens are time.
+8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters).
 
 "reproduced" means the real code, driven by the trace, reached the property violation the model describes. "diverged" means it did not \u2014 the model is wrong about the code, which is a useful answer. "unreplayable" means you could not run the real function faithfully; say why.`;
 var REPLAY_SCHEMA = {
@@ -27844,6 +28099,8 @@ function printedResult(outputTexts) {
   return last;
 }
 var RESULT_MISSING = "the harness never printed REPLAY_RESULT=reproduced on its own stdout \u2014 the verdict was the model's word, not the run's";
+var FIXED_VERDICT = 'the harness printed a fixed verdict \u2014 it never contains the "diverged" outcome, so the result line was not computed from the real run';
+var CONTAINER_RETRY_BACKOFF_MS = [1e3, 3e3];
 function judgeReplay(brief, parsed) {
   const texts = parsed.shellTexts;
   const primary = brief.sources[0];
@@ -27878,6 +28135,12 @@ function judgeReplay(brief, parsed) {
   if (claimed === "reproduced" && printedResult(parsed.outputTexts) !== "reproduced") {
     return { claimed, verdict: "unverified", reason: parsed.claim.reason, downgrade: RESULT_MISSING, verbatim };
   }
+  if (claimed === "reproduced" && !texts.some((t) => t.includes("diverged"))) {
+    return { claimed, verdict: "unverified", reason: parsed.claim.reason, downgrade: FIXED_VERDICT, verbatim };
+  }
+  if (claimed === "reproduced" && primary && harnessInvokes(texts, primary.symbol, /\.py$/.test(primary.file)) === false) {
+    return { claimed, verdict: "unverified", reason: parsed.claim.reason, downgrade: NOT_INVOKED, verbatim };
+  }
   return { claimed, verdict: claimed, reason: parsed.claim.reason, downgrade: null, verbatim };
 }
 async function runReplayInContainer(brief, opts) {
@@ -27902,24 +28165,36 @@ async function runReplayInContainer(brief, opts) {
     error
   });
   let containerId = null;
-  try {
-    const res = await fetchImpl(`${baseUrl}/containers`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        name: `verity-prove-replay-${brief.model}-${brief.property.id}`.slice(0, 64),
-        memory_limit: "1g",
-        network_policy: { type: "disabled" },
-        expires_after: { anchor: "last_active_at", minutes: 1 }
-      }),
-      signal: AbortSignal.timeout(3e4)
-    });
-    if (!res.ok) return empty(`container create failed: HTTP ${res.status} ${(await res.text().catch(() => "")).slice(0, 200)}`, null);
-    const data = await res.json();
-    if (typeof data.id !== "string" || !data.id.startsWith("cntr_")) return empty("container create returned no id", null);
-    containerId = data.id;
-  } catch (err) {
-    return empty(`container create failed: ${err.message}`, null);
+  for (let attempt = 1; ; attempt++) {
+    let failure;
+    let retryable = false;
+    try {
+      const res = await fetchImpl(`${baseUrl}/containers`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          name: `verity-prove-replay-${brief.model}-${brief.property.id}`.slice(0, 64),
+          memory_limit: "1g",
+          network_policy: { type: "disabled" },
+          expires_after: { anchor: "last_active_at", minutes: 1 }
+        }),
+        signal: AbortSignal.timeout(3e4)
+      });
+      if (res.ok) {
+        const data = await res.json();
+        if (typeof data.id !== "string" || !data.id.startsWith("cntr_")) return empty("container create returned no id", null);
+        containerId = data.id;
+        break;
+      }
+      failure = `container create failed: HTTP ${res.status} ${(await res.text().catch(() => "")).slice(0, 200)}`;
+      retryable = res.status === 429 || res.status >= 500;
+    } catch (err) {
+      failure = `container create failed: ${err.message}`;
+      retryable = true;
+    }
+    const backoffMs = (opts.containerRetryBackoffMs ?? CONTAINER_RETRY_BACKOFF_MS)[attempt - 1];
+    if (!retryable || backoffMs === void 0) return empty(failure, null);
+    await new Promise((r) => setTimeout(r, backoffMs));
   }
   try {
     const tools = [{ type: "shell", environment: { type: "container_reference", container_id: containerId } }];
@@ -27983,11 +28258,17 @@ async function runReplayInContainer(brief, opts) {
       last = { parsed: merged, judged: judged2, status: r.data.status, incomplete: r.data.incomplete_details?.reason };
       if (judged2.verdict !== "unverified" || !judged2.downgrade) break;
       const v = judged2.verbatim;
-      const resultMissing = judged2.downgrade === RESULT_MISSING;
+      const fixedVerdict = judged2.downgrade === FIXED_VERDICT;
+      const notInvoked = judged2.downgrade === NOT_INVOKED;
+      const resultMissing = judged2.downgrade === RESULT_MISSING || fixedVerdict || notInvoked;
       if (!resultMissing && (v.total === 0 || v.ratio >= (v.basis === "symbol" ? VERBATIM_THRESHOLD_SYMBOL : VERBATIM_THRESHOLD_FILE))) break;
       const region = brief.sources[0];
       const what = region ? `\`${region.symbol}\`${region.lines ? ` (lines ${region.lines.from}\u2013${region.lines.to})` : ""} of ${region.file}` : "the function under test";
-      userContent = resultMissing ? `Your previous attempt in this same container was NOT accepted: you answered "reproduced" but no shell output contained the line REPLAY_RESULT=reproduced. The files you created are still present. Run the harness again so that it prints REPLAY_RESULT=reproduced or REPLAY_RESULT=diverged as the last line of its own stdout, then answer with what it printed.
+      userContent = notInvoked ? `Your previous attempt in this same container was NOT accepted: the harness never calls the function under test \u2014 the trace was replayed on the stubs, not on the code. The files you created are still present. Drive the trace by CALLING the real function (its environment moves come from the stubs and the driver), run it, and answer with what it printed.
+
+` + renderBriefInput(brief) : fixedVerdict ? `Your previous attempt in this same container was NOT accepted: the harness prints a FIXED verdict \u2014 it never contains the "diverged" outcome, so the result line was not computed from the run. The files you created are still present. Make the harness evaluate the property's condition on the final real state and print REPLAY_RESULT=reproduced or REPLAY_RESULT=diverged from an if/else, run it, and answer with what it printed.
+
+` + renderBriefInput(brief) : resultMissing ? `Your previous attempt in this same container was NOT accepted: you answered "reproduced" but no shell output contained the line REPLAY_RESULT=reproduced. The files you created are still present. Run the harness again so that it prints REPLAY_RESULT=reproduced or REPLAY_RESULT=diverged as the last line of its own stdout, then answer with what it printed.
 
 ` + renderBriefInput(brief) : `Your previous attempt in this same container was NOT accepted: only ${v.covered} of the ${v.total} significant lines of the real ${v.basis} appeared verbatim in what you wrote` + (last.parsed.claim ? ` (you answered "${last.parsed.claim.verdict}")` : "") + `. The files you created are still present. Rewrite the harness so that ${what} is copied in FULL, line for line from the numbered source below, with helpers, imports and variables it needs stubbed OUTSIDE the copied lines. Then run it again and answer.
 
@@ -29011,9 +29292,96 @@ function writeResult(root, report) {
   return rel;
 }
 
+// src/lib/prove/merge.ts
+function isCrashTrace(trace) {
+  return trace.some((s) => /\b(crash\w*|kill\w*|restart\w*|interrupt\w*|power|abort\w*|process (dies|exit\w*)|lost (reply|response))\b/i.test(s));
+}
+function mergeFormalFindings(response, outcome, pushedFiles) {
+  if (!outcome) return { blocking: 0 };
+  const norm = (p) => p.replace(/\\/g, "/");
+  const pushed = new Set(pushedFiles.map(norm));
+  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm(f.file)));
+  if (blocking.length === 0) return { blocking: 0 };
+  const existing = Array.isArray(response.findings) ? response.findings : [];
+  response.findings = [
+    ...existing,
+    ...blocking.map((f) => ({
+      pattern_id: "formal-counterexample",
+      severity: "high",
+      scope: "change",
+      file: f.file,
+      line: outcome.target?.lines?.from ?? null,
+      // Worded as the VIOLATION: the property text is what should hold, and
+      // as a title it read backwards (e2e, 2026-09-26). A trace that needs a
+      // crash between two writes is labelled: reproducing it means injecting
+      // the crash, so it is a crash-consistency finding, not a race.
+      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code`,
+      description: terminalText(f.reason ?? "", 2e3),
+      fix: { description: `Trace: ${terminalText(f.trace.join(" \u2192 ") || "(initial state)", 2e3)}. Replay: ${terminalText(f.reason ?? "reproduced in the container", 2e3)}` },
+      source: "formal"
+    }))
+  ];
+  if (response.gate_decision !== "FAIL") response.gate_decision = "FAIL";
+  return { blocking: blocking.length };
+}
+
+// src/lib/prove/scalpel.ts
+var import_node_crypto15 = require("node:crypto");
+var ARITHMETIC = /Math\.(?:round|floor|ceil|trunc)\(|\bround\(|\bdivmod\(|[\w)\]]\s*(?:\*|\/(?!\/)|%)\s*[\w(]/;
+function functionHazard(numbered) {
+  const sites = effectSites(numbered);
+  const body = numbered.split("\n").map((l) => l.replace(/^\s*\d+\| ?/, "")).filter((l) => !/^\s*(\/\/|#|\*|\/\*)/.test(l)).join("\n");
+  return {
+    effects: sites.filter((s) => s.includes("[effect]")).length,
+    control: sites.filter((s) => s.includes("[control]")).length,
+    arithmetic: ARITHMETIC.test(body)
+  };
+}
+function hasHazard(h) {
+  if (h.effects >= 2) return { ok: true, why: `${h.effects} effects that can interleave` };
+  if (h.effects === 1 && h.control >= 1) return { ok: true, why: "an effect inside a loop or a try" };
+  if (h.effects === 0 && h.arithmetic) return { ok: true, why: "pure arithmetic" };
+  if (h.effects === 1) return { ok: false, why: "one effect and no loop or error path: nothing to interleave" };
+  return { ok: false, why: "no effects and no arithmetic" };
+}
+var VERIFIED_FILE = `${PROOFS_DIR}/.results/.verified.json`;
+var VERIFIED_TTL_DAYS = 30;
+var LOG_LINE = /^\s*(?:console\.\w+|logger\.\w+|log\.\w+|logging\.\w+|print|debug|trace)\s*\(/;
+function semanticFingerprint(numbered) {
+  const kept = [];
+  for (const raw of numbered.split("\n")) {
+    const line = raw.replace(/^\s*\d+\| ?/, "");
+    const t = line.trim();
+    if (!t || t.startsWith("//") || t.startsWith("#") || t.startsWith("*") || t.startsWith("/*")) continue;
+    if (LOG_LINE.test(t)) continue;
+    kept.push(t.replace(/\s+/g, " "));
+  }
+  return (0, import_node_crypto15.createHash)("sha256").update(kept.join("\n")).digest("hex");
+}
+function readVerified(root, now = Date.now()) {
+  const read = readRegularFileInRoot(root, VERIFIED_FILE, 256 * 1024);
+  if (!read.ok) return [];
+  try {
+    const all = JSON.parse(read.content);
+    if (!Array.isArray(all)) return [];
+    const cutoff = now - VERIFIED_TTL_DAYS * 864e5;
+    return all.filter((r) => !!r && typeof r === "object" && typeof r.file === "string" && typeof r.symbol === "string" && typeof r.fingerprint === "string" && typeof r.at === "string" && Date.parse(r.at) >= cutoff);
+  } catch {
+    return [];
+  }
+}
+function findVerified(root, file, symbol, fingerprint, now = Date.now()) {
+  return readVerified(root, now).find((r) => r.file === file && r.symbol === symbol && r.fingerprint === fingerprint) ?? null;
+}
+function recordVerified(root, rec, now = Date.now()) {
+  const others = readVerified(root, now).filter((r) => !(r.file === rec.file && r.symbol === rec.symbol));
+  writeFileInRootNoFollow(root, VERIFIED_FILE, JSON.stringify([...others, rec].slice(-500)) + "\n");
+}
+
 // src/lib/prove/auto.ts
 var AUTO_MODELS_DIR = `${MODELS_DIR}/.auto`;
-var DEFAULT_MIN_SCORE = 0.75;
+var DEFAULT_MIN_SCORE = 0.7;
+var MAX_MODEL_FUNCTION_LINES = 300;
 var LARGE_PUSH_FILES = 25;
 var DAILY_MODEL_CAP = 5;
 var PUSH_COST_CAP_USD = 1;
@@ -29021,14 +29389,14 @@ var DAILY_COST_CAP_USD = 5;
 var AUTO_LEDGER = `${PROOFS_DIR}/.results/.auto-ledger.json`;
 function isEligible(s, largePush) {
   const r = s.risk;
+  const effects = s.effects ?? 0;
   const critical = r.money >= 1 || r.transaction >= 1 || r.auth >= 3;
-  const shapes = r.check_then_act >= 2 || r.concurrency >= 2 || r.cache_or_idempotency >= 2 || r.retry >= 2;
-  const thorny = s.fixCommits >= 2 || s.commits >= 6;
-  if (largePush) return critical ? { ok: true, why: "domain-critical in a large push" } : { ok: false, why: "large push: only domain-critical code qualifies" };
+  const shapes = r.check_then_act + r.concurrency + r.cache_or_idempotency + r.retry >= 2;
+  if (largePush) return critical && effects >= 2 ? { ok: true, why: "domain-critical effects in a large push" } : { ok: false, why: "large push: only domain-critical code with effects qualifies" };
+  if (effects >= 2) return { ok: true, why: `${effects} effect lines` };
+  if (shapes) return { ok: true, why: "risky shape (check-then-act, concurrency, cache, retry)" };
   if (critical) return { ok: true, why: "domain-critical" };
-  if (shapes && thorny) return { ok: true, why: "risky shape and thorny history" };
-  if (!shapes) return { ok: false, why: "no risky shape (check-then-act, concurrency, cache, retry)" };
-  return { ok: false, why: "not thorny enough (needs 2 fix commits or 6 commits)" };
+  return { ok: false, why: "no effects, no risky shape, not domain-critical" };
 }
 function intersects(a, ranges) {
   return ranges.some((b) => a.from <= b.to && b.from <= a.to);
@@ -29104,7 +29472,7 @@ function workingTreeReader(root) {
   };
 }
 function sha256Of(content) {
-  return (0, import_node_crypto15.createHash)("sha256").update(content).digest("hex");
+  return (0, import_node_crypto16.createHash)("sha256").update(content).digest("hex");
 }
 function defaultDeps(opts) {
   const env = opts.env ?? process.env;
@@ -29233,6 +29601,23 @@ async function runFormalPhase(input) {
         continue;
       }
     }
+    if (d.lines) {
+      const size = d.lines.to - d.lines.from + 1;
+      if (size > MAX_MODEL_FUNCTION_LINES) {
+        note("too-large", `${c.ai.symbol}: ${size} lines (at most ${MAX_MODEL_FUNCTION_LINES} are modelled)`);
+        continue;
+      }
+      const hazard = hasHazard(functionHazard(d.numbered));
+      if (!hazard.ok) {
+        note("no-hazard", `${c.ai.symbol}: ${hazard.why}`);
+        continue;
+      }
+      const seen = findVerified(root, c.file, c.ai.symbol, semanticFingerprint(d.numbered));
+      if (seen) {
+        note("verified", `${c.ai.symbol}: model ${seen.model} held on ${seen.at.slice(0, 10)} (${seen.properties.join(", ")}); this push changed only logging, comments or whitespace in it`);
+        continue;
+      }
+    }
     chosen = { top: c, content: read.content, lines: d.lines, numbered: d.numbered };
     break;
   }
@@ -29299,7 +29684,8 @@ async function runFormalPhase(input) {
     writeResult(root, report);
   } catch {
   }
-  const cexes = report.properties.filter((p) => p.result === "counterexample");
+  const isCrash = (p) => isCrashTrace(p.trace ?? []) || /\bcrash/i.test(p.desc);
+  const cexes = report.properties.filter((p) => p.result === "counterexample").map((p, i) => ({ p, i })).sort((a, b) => Number(isCrash(a.p)) - Number(isCrash(b.p)) || a.i - b.i).map(({ p }) => p);
   const baseOf = (p) => ({ property: p.id, desc: p.desc, kind: p.kind, trace: p.trace ?? [], file: top.file, symbol: top.ai.symbol });
   const maxReplays = input.maxReplays ?? MAX_REPLAYS;
   let skipWhy = null;
@@ -29325,7 +29711,7 @@ async function runFormalPhase(input) {
         const r = await deps.replay(root, report, p, modelSource.ok ? modelSource.content : "", budget);
         spend(r);
         if (!stoppedEarly) byId.set(p.id, r);
-        if (r.verdict === "reproduced" && !stoppedEarly) {
+        if (r.verdict === "reproduced" && !stoppedEarly && !isCrash(p)) {
           stoppedEarly = true;
           resolve8();
         }
@@ -29354,6 +29740,20 @@ async function runFormalPhase(input) {
       ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...lines ? { lines } : {}, at: now }))
     ]);
   }
+  const clean2 = findings.every((f) => f.verdict === "diverged");
+  if (clean2 && lines && !cancelled()) {
+    try {
+      recordVerified(root, {
+        file: top.file,
+        symbol: top.ai.symbol,
+        fingerprint: semanticFingerprint(numbered),
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        model: modelName,
+        properties: report.properties.map((p) => `${p.id} ${p.result === "counterexample" ? "diverged" : p.result}`)
+      });
+    } catch {
+    }
+  }
   return done({
     status: "checked",
     target,
@@ -29478,39 +29878,6 @@ function describeFormalOutcome(o) {
   return `formal: ${o.model?.name ?? "?"} on ${o.target?.file ?? "?"}#${o.target?.symbol ?? "?"} (${o.model?.rounds ?? 1} round${o.model?.rounds === 1 ? "" : "s"}) \xB7 ${parts.join(" \xB7 ")} \xB7 ${Math.round(o.durationMs / 1e3)} s${cost}${cut}`;
 }
 
-// src/lib/prove/merge.ts
-function isCrashTrace(trace) {
-  return trace.some((s) => /\b(crash\w*|kill\w*|restart\w*|interrupt\w*|power|abort\w*|process (dies|exit\w*)|lost (reply|response))\b/i.test(s));
-}
-function mergeFormalFindings(response, outcome, pushedFiles) {
-  if (!outcome) return { blocking: 0 };
-  const norm = (p) => p.replace(/\\/g, "/");
-  const pushed = new Set(pushedFiles.map(norm));
-  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm(f.file)));
-  if (blocking.length === 0) return { blocking: 0 };
-  const existing = Array.isArray(response.findings) ? response.findings : [];
-  response.findings = [
-    ...existing,
-    ...blocking.map((f) => ({
-      pattern_id: "formal-counterexample",
-      severity: "high",
-      scope: "change",
-      file: f.file,
-      line: outcome.target?.lines?.from ?? null,
-      // Worded as the VIOLATION: the property text is what should hold, and
-      // as a title it read backwards (e2e, 2026-09-26). A trace that needs a
-      // crash between two writes is labelled: reproducing it means injecting
-      // the crash, so it is a crash-consistency finding, not a race.
-      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code`,
-      description: terminalText(f.reason ?? "", 2e3),
-      fix: { description: `Trace: ${terminalText(f.trace.join(" \u2192 ") || "(initial state)", 2e3)}. Replay: ${terminalText(f.reason ?? "reproduced in the container", 2e3)}` },
-      source: "formal"
-    }))
-  ];
-  if (response.gate_decision !== "FAIL") response.gate_decision = "FAIL";
-  return { blocking: blocking.length };
-}
-
 // src/commands/guard.ts
 var EXCERPT_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
 var GUARD_BLOCK_CAP = 2;
@@ -30232,7 +30599,7 @@ function registerIgnoreCommand(program2) {
 }
 
 // src/commands/waive.ts
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var import_node_fs57 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
@@ -30262,7 +30629,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body.file = opts.file;
       try {
-        body.file_sha256 = (0, import_node_crypto16.createHash)("sha256").update((0, import_node_fs57.readFileSync)(opts.file)).digest("hex");
+        body.file_sha256 = (0, import_node_crypto17.createHash)("sha256").update((0, import_node_fs57.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -31280,7 +31647,7 @@ async function promptMultiSelect(question, choices, fallback) {
 
 // src/lib/prove/lean-install.ts
 var import_node_fs60 = require("node:fs");
-var import_node_crypto17 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 var import_node_child_process18 = require("node:child_process");
 var import_node_os10 = require("node:os");
 var import_node_path44 = require("node:path");
@@ -31302,7 +31669,7 @@ function expectedSha256(asset, version = pinnedVersion()) {
 }
 function sha256File(path) {
   return new Promise((resolve8, reject) => {
-    const hash = (0, import_node_crypto17.createHash)("sha256");
+    const hash = (0, import_node_crypto18.createHash)("sha256");
     (0, import_node_fs60.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve8(hash.digest("hex"))).on("error", reject);
   });
 }
@@ -32346,7 +32713,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.33.3-experimental.86b5b6f" : "dev"
+          cli_version: true ? "0.33.3-experimental.b6d47c6" : "dev"
         }
       });
     } catch (err) {
@@ -33808,8 +34175,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.86b5b6f").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.86b5b6f");
+program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.b6d47c6").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.b6d47c6");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.33.3-experimental.86b5b6f",
+  "version": "0.33.3-experimental.b6d47c6",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",