@orangepro/orangepro-mcp 0.2.3 → 0.2.5

package/dist/local/cli.js

@@ -2,6 +2,7 @@
 import { parseArgs, collectSetupCommands } from "./cliArgs.js";
 import { opAnalyze, opAiFlows, opAiLinks, opChanged, opCompare, opDoctor, opProofDoctor, opDynamicProof, opExplain, opGaps, opGenerate, opBehaviorCoverageHtml, opCoverageReport, opInit, opProveLoop, opRuntimeCoverage, opScore, opRecordRun, opRtm, opStats, opStatus, opUpdate, opSetModelDefault, opStart, getModelDefault, resolveDiffTargets, resolvePrCheckout, writeCompareReport } from "./operations.js";
 import { dominantBlockReason } from "./viz/behaviorReportData.js";
+import { coverageRevealLine } from "./viz/coverageReveal.js";
 import { autoProve, isRoastSurvivor } from "./autoProve.js";
 import { opRecipeDbSqljs } from "./recipe/dbSqljs.js";
 import { runExportCli } from "./exportCli.js";
@@ -236,6 +237,11 @@ async function main() {
                         out(`    skipped:             ${skip.target_symbol ?? skip.title} — ${skip.reason}`);
                 }
                 out(`  Runtime-covered:       ${res.rtm.summary.runtime_covered}`);
+                // G6: same-denominator coverage-vs-proof reveal — renders only when runtime
+                // coverage was ingested; percentages share summary.total (never mixed scopes).
+                const reveal = coverageRevealLine(res.rtm.summary);
+                if (reveal)
+                    out(`  ${reveal}`);
                 out(`  Statically Linked:     ${res.rtm.summary.associated} (static test link, not dynamic proof)`);
                 out(`  No integration signal: ${res.rtm.summary.no_link}`);
                 out(`  AI-linked:      ${res.ai_linked.behaviors} behavior(s), ${res.ai_linked.symbols} symbol(s), ${res.ai_linked.links} weak link(s) — not coverage`);
@@ -272,7 +278,10 @@ async function main() {
                 out("  - opro agent --client claude-code");
                 out("  - opro agent --client cursor");
                 out("  - opro agent --client opencode");
-                for (const w of res.warnings)
+                // opStart aggregates warnings from ai-flows generate AND apply — the same
+                // message (e.g. the prompt entry cap) can legitimately arrive twice.
+                // Dedupe at print time; JSON output keeps the raw array.
+                for (const w of [...new Set(res.warnings)])
                     out(`  warning: ${w}`);
             }
             return 0;
@@ -462,7 +471,7 @@ async function main() {
                     }
                     if (coverageReport)
                         out(`  coverage report:         ${coverageReport}`);
-                    for (const w of [...res.warnings, ...aiFlowWarnings, ...htmlWarnings])
+                    for (const w of [...new Set([...res.warnings, ...aiFlowWarnings, ...htmlWarnings])])
                         out(`  warning: ${w}`);
                     const sugg = res.analysis.exclude_suggestions ?? [];
                     if (sugg.length) {
@@ -573,7 +582,8 @@ async function main() {
                         out(`     next: ${b.next_step}`);
                     }
                     for (const nk of res.non_killing) {
-                        out(`  mutant survived: ${nk.target_symbol}${nk.test_path ? ` (test: ${nk.test_path})` : ""}`);
+                        const nkLabel = nk.mutant_status === "associated_non_assertion_failure" ? "mutant failed (non-assertion)" : "mutant survived";
+                        out(`  ${nkLabel}: ${nk.target_symbol}${nk.test_path ? ` (test: ${nk.test_path})` : ""}`);
                         out(`     ${nk.note}`);
                     }
                 }

package/dist/local/enrich/markdown.js

@@ -4,6 +4,14 @@ import { slugify } from "../util/ids.js";
 import { redactSecrets } from "../util/redact.js";
 const DETECTOR = "markdown_docs";
 const MAX_REQUIREMENTS = 60;
+/**
+ * Repo-governance and template markdown must never mint Requirement nodes.
+ * Hint words like "should"/"must" are ubiquitous in CONTRIBUTING files and
+ * PR/issue templates — on Hono, ".github/PULL_REQUEST_TEMPLATE.md" produced
+ * REQ-md-the-author-should-do-the-following-if-applicable and surfaced as the
+ * report's top suggested next action. Product docs (README, docs/) still count.
+ */
+const GOVERNANCE_MD_RE = /(^|\/)\.github\/|(^|\/)(CONTRIBUTING|CODE_OF_CONDUCT|PULL_REQUEST_TEMPLATE|ISSUE_TEMPLATE|SECURITY|SUPPORT|CHANGELOG|LICENSE|GOVERNANCE|MAINTAINERS|CODEOWNERS|AUTHORS)[^\/]*$|(^|\/)\.changeset\/|\/templates?\/|(^|\/)(AGENTS|CLAUDE|GEMINI|COPILOT)\.md$|(^|\/)\.cursor(rules)?\//i;
 /** Words that suggest a heading describes a requirement/feature behavior. */
 const REQUIREMENT_HINTS = [
     "requirement",
@@ -53,6 +61,9 @@ function parseBullet(line) {
  * Bounded to ~60 requirements; all captured text is secret-redacted.
  */
 export function enrichFromMarkdown(relPath, content) {
+    if (GOVERNANCE_MD_RE.test(relPath)) {
+        return { nodes: [], edges: [], candidate_edges: [], sources: [], warnings: [] };
+    }
     const nodes = [];
     const edges = [];
     const warnings = [];

package/dist/local/flows/flowWalker.js

@@ -3,7 +3,7 @@ import { LOCAL_GRAPH_SCHEMA_VERSION } from "../graph/ontology.js";
 import { rankRiskGaps } from "../score/risk.js";
 import { stableId } from "../util/ids.js";
 const DEFAULT_MAX_DEPTH = 8;
-const DEFAULT_MAX_FLOWS_PER_ENTRY = 20;
+const DEFAULT_MAX_FLOWS_PER_ENTRY = 5;
 const DEFAULT_GLOBAL_CAP = 500;
 const HIGH_ROUTE_RE = /payment|refund|checkout|cart|order|auth|login|token|customer|user|tax|fulfillment|ship/i;
 const MUTATION_METHOD_RE = /^(POST|PUT|PATCH|DELETE)\b/i;
@@ -103,11 +103,16 @@ export function rankEntries(graph, entries, adjacency) {
         gap.id,
         gap.risk_score
     ]));
-    return [...entries].sort((a, b) => {
-        const aScore = Math.max(riskScores.get(a.start) ?? 0, fallbackScore(a, adjacency));
-        const bScore = Math.max(riskScores.get(b.start) ?? 0, fallbackScore(b, adjacency));
-        return bScore - aScore || a.kind.localeCompare(b.kind) || a.external_id.localeCompare(b.external_id) || a.start.localeCompare(b.start);
-    });
+    // Endpoint-anchored flows first. An Endpoint entry IS the definition of a
+    // user-triggerable behavior (June 27 agreement); orphan call-graph roots are
+    // useful but must never crowd endpoints out of the global cap — on Twenty,
+    // saturated risk ties let ~25 internal orphan methods consume all 500 flow
+    // slots while every HTTP/GraphQL entry point went unrendered.
+    const score = (e) => Math.max(riskScores.get(e.start) ?? 0, fallbackScore(e, adjacency));
+    const byScore = (a, b) => score(b) - score(a) || a.external_id.localeCompare(b.external_id) || a.start.localeCompare(b.start);
+    const endpoints = entries.filter((e) => e.kind === "Endpoint").sort(byScore);
+    const behaviors = entries.filter((e) => e.kind !== "Endpoint").sort(byScore);
+    return [...endpoints, ...behaviors];
 }
 function prunePrefixSubsumed(flows) {
     const sorted = [...flows].sort((a, b) => b.path.length - a.path.length || a.id.localeCompare(b.id));

package/dist/local/generate/generator.js

@@ -552,7 +552,7 @@ export function gatherContext(graph, behavior, framework, fileReader) {
         acceptance_criteria: acceptance,
         workflow_steps: workflow,
         framework,
-        test_layer: inferLayer(behavior, framework),
+        test_layer: inferLayer(behavior, framework, graph),
         code_context: dedupe(codeContext),
         source_excerpts: excerpts,
         weak_context: dedupe(weakContext),
@@ -602,7 +602,7 @@ function flowChainFor(graph, behavior) {
         };
     });
 }
-function inferLayer(behavior, framework) {
+function inferLayer(behavior, framework, graph) {
     const fw = framework.toLowerCase();
     if (fw.includes("playwright") || fw.includes("cypress"))
         return "e2e";
@@ -613,6 +613,21 @@ function inferLayer(behavior, framework) {
     const hint = String(behavior.properties.test_layer ?? "");
     if (hint)
         return hint;
+    // Graph-aware default (hop-count methodology): a behavior that an endpoint
+    // implements, or that participates in a multi-step call chain, is an
+    // INTEGRATION target — the code→flows→behaviors journey is the product;
+    // "unit" is only for genuinely 0-hop leaf functions. The old blanket
+    // "unit" default stamped every vitest/jest repo unit-first.
+    if (graph) {
+        const id = behavior.external_id;
+        const isEntryHandler = graph.edges.some((e) => e.relationship_type === "IMPLEMENTED_IN" && e.to_external_id === id);
+        if (isEntryHandler)
+            return "integration";
+        const inChain = graph.edges.some((e) => e.relationship_type === "CALLS" && (e.from_external_id === id || e.to_external_id === id)) ||
+            (graph.analysis?.flows?.flows ?? []).some((f) => f.entry_point.external_id === id || f.hops.some((h) => h.from === id || h.to === id));
+        if (inChain)
+            return "integration";
+    }
     return "unit";
 }
 function tooThin(ctx) {
@@ -2366,13 +2381,49 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                 const runnable = isRunnable(body, framework, import_provenance, importErrors) && !compileIssue;
                 if (!runnable) {
                     const reason = unresolved_reason ?? compileIssue ?? runnableFailureReason(body, framework, import_provenance, importErrors, declaredDeps);
-                    warnings.push(`Dropped non-runnable v5 generated test for "${gc.ctx.behavior_title}" / "${scenario.title}": ${reason}`);
+                    warnings.push(`Non-runnable v5 generated test for "${gc.ctx.behavior_title}" / "${scenario.title}" kept as an English intent (no run command): ${reason}`);
                     missing.push({
                         external_id: behavior.external_id,
                         title: gc.ctx.behavior_title,
                         reason,
                         needed: ["a compiling generated test with a real assertion and resolvable subject import"]
                     });
+                    // Preserve the grounded INTENT in English, never the rejected code.
+                    // The scenario fields were authored by a model that saw source
+                    // excerpts — scrub the composed body with the same guard as code.
+                    // The scenario plan (title / assertion targets / rationale) is the
+                    // reviewable half of the draft; withholding the body entirely also
+                    // removes any residual source-echo risk. runnable:false + the reason
+                    // keep this honestly a draft — it ships with no run command and can
+                    // never enter the proof-ready set.
+                    const manualBody = sanitizeGeneratedBody([
+                        `Scenario: ${scenario.title}`,
+                        ...(scenario.steps && scenario.steps.length
+                            ? ["Steps:", ...scenario.steps.map((st, n) => `  ${n + 1}. ${st}`)]
+                            : []),
+                        ...(scenario.test_data ? [`Test data: ${scenario.test_data}`] : []),
+                        ...(scenario.assertion_targets.length ? [`Expected: ${scenario.assertion_targets.join("; ")}`] : []),
+                        ...(scenario.rationale ? [`Why this test: ${scenario.rationale}`] : []),
+                        "",
+                        // Concise blocker: first clause only — the full remedy is one line.
+                        `Blocked by: ${reason.split(" — ")[0]}`,
+                        "Fix: install this repo's dependencies / configure the test runner, then re-run \`opro start\`."
+                    ].join("\n"), gc.ctx.source_excerpts, "//").body;
+                    generated.push({
+                        id: `${run_id}-t${generated.length + 1}`,
+                        run_id,
+                        title: `${gc.ctx.behavior_title} — ${scenario.title}`,
+                        test_type: gc.ctx.test_layer,
+                        framework_hint: framework,
+                        body: manualBody,
+                        bucket: bucketForV5Scenario(scenario),
+                        prompt_version: PROMPT_VERSION_V5,
+                        grounding: { entity_ids: gc.entityIds, source_refs: [], weak_relationships_used: [] },
+                        weak_evidence_used: false,
+                        target_symbol_external_id: behavior.external_id,
+                        runnable: false,
+                        unresolved_reason: reason
+                    });
                     continue;
                 }
                 generated.push({

package/dist/local/generate/promptV5.js

@@ -75,7 +75,7 @@ export function buildPlanningSystemPromptV5() {
         "- Return a raw JSON array only. No prose, no markdown fences, no heading, no explanation.",
         "- If no missing scenario is justified, return [] exactly.",
         "- The first character of your response must be [ and the last character must be ].",
-        '[{"id":1,"title":"...","concern":"...","technique":"...","rationale":"...","assertion_targets":["..."],"complexity":"basic|intermediate|advanced","risk_rank":1}]'
+        '[{"id":1,"title":"...","concern":"...","technique":"...","rationale":"...","assertion_targets":["..."],"steps":["Given ...","When ...","Then ..."],"test_data":"concrete example input values (synthetic, showing the edge case)","complexity":"basic|intermediate|advanced","risk_rank":1}]'
     ].join("\n");
 }
 export function buildPlanningUserPromptV5(ctx) {
@@ -303,6 +303,15 @@ function validatePlannedScenario(v) {
     const riskRank = toFinite(v.risk_rank);
     if (riskRank === null)
         return { ok: false, reason: "non-finite risk_rank" };
+    // Optional human-readable fields (tolerant: absent/malformed → omitted, never a rejection).
+    const steps = Array.isArray(v.steps)
+        ? v.steps.filter((x) => typeof x === "string" && x.trim().length > 0).slice(0, 6).map((x) => x.slice(0, 240))
+        : undefined;
+    const test_data = typeof v.test_data === "string" && v.test_data.trim()
+        ? v.test_data.slice(0, 400)
+        : v.test_data && typeof v.test_data === "object"
+            ? JSON.stringify(v.test_data).slice(0, 400)
+            : undefined;
     return {
         ok: true,
         value: {
@@ -312,6 +321,8 @@ function validatePlannedScenario(v) {
             technique: technique,
             rationale: typeof v.rationale === "string" ? v.rationale : "",
             assertion_targets: targets,
+            ...(steps && steps.length ? { steps } : {}),
+            ...(test_data ? { test_data } : {}),
             complexity,
             risk_rank: riskRank
         }

package/dist/local/graph/ontology.js

@@ -9,7 +9,9 @@
  * The graph is built directly by OrangePro; it does not depend on any
  * third-party graph product or format.
  */
-export const LOCAL_GRAPH_SCHEMA_VERSION = "orangepro.local_graph.v1";
+// v2: Go method symbol ids are receiver-qualified (`sym:file.go#Recv.M`) — old
+// graphs hold bare-name method ids and must force-rebuild (loadGraph hard-fails).
+export const LOCAL_GRAPH_SCHEMA_VERSION = "orangepro.local_graph.v2";
 /** Node kinds that map to behaviors/requirements for scoring + gaps + generation. */
 export const BEHAVIOR_KINDS = new Set([
     "Requirement",

package/dist/local/operations.js

@@ -35,7 +35,7 @@ import { changedImpact } from "./freshness/changed.js";
 import { explainTest } from "./explain/explain.js";
 import { buildVizPayload } from "./viz/payload.js";
 import { renderVizHtml } from "./viz/html.js";
-import { buildBehaviorReportData, dominantBlockReason } from "./viz/behaviorReportData.js";
+import { buildBehaviorReportData, computeReportDelta, reportBaselineOf, dominantBlockReason } from "./viz/behaviorReportData.js";
 import { renderBehaviorReport } from "./viz/behaviorReportHtml.js";
 import { renderCoverageReport } from "./pack/coverageReport.js";
 import { confirmedCoverageByLayer } from "./score/coverage.js";
@@ -273,11 +273,14 @@ function symbolTargetParts(symExtId) {
         throw new Error(`Cannot derive dynamic proof target from symbol id: ${symExtId}`);
     }
     const [, file, symbolName] = match;
-    const method = symbolName.split(".").filter(Boolean).pop();
+    const segments = symbolName.split(".").filter(Boolean);
+    const method = segments.pop();
     if (!file || !method) {
         throw new Error(`Cannot derive dynamic proof target from symbol id: ${symExtId}`);
     }
-    return { file, method };
+    // The owner qualifier of a member id (TS `Class.method`, Go `Recv.M`). The Go
+    // lane passes it as --recv so the mutator matches the exact receiver.
+    return { file, method, ...(segments.length ? { memberQualifier: segments.join(".") } : {}) };
 }
 function assertProofTargetMatchesSymbol(opts, symbolTarget) {
     if (opts.target_path !== undefined && opts.target_path !== "") {
@@ -560,8 +563,9 @@ export function opAnalyze(root, opts = {}, deps = defaultDeps()) {
         ? (!opts.suppressProgress && reportProgress("coverage: generating local runtime coverage before graph build", { current: 2, total: 4 }),
             prepareRuntimeCoverage(scanRoot, { generate: true, timeoutMs: opts.coverageTimeoutMs, runner: deps.coverageRunner }))
         : undefined;
-    if (!workspaceInitialized(root))
-        initWorkspace(root, now);
+    // Idempotent for existing workspaces and also applies conservative migrations
+    // to untouched generated workspace files (for example .orangeproignore).
+    initWorkspace(root, now);
     if (!opts.suppressProgress) {
         reportProgress("analyze: parsing source and building deterministic graph", {
             current: opts.generateCoverage ? 3 : 2,
@@ -800,8 +804,9 @@ export function opDoctor(root) {
  */
 export function opProofDoctor(root) {
     const graph = loadGraph(workspacePaths(root).graphPath);
-    const rtm = buildRtm(graph, loadLedger(root));
-    return buildProofDoctor(graph, rtm, loadProofAttempts(root));
+    const ledger = loadLedger(root);
+    const rtm = buildRtm(graph, ledger);
+    return buildProofDoctor(graph, rtm, loadProofAttempts(root), {}, ledger);
 }
 export function opGaps(root, opts = {}) {
     const graph = loadGraph(workspacePaths(root).graphPath);
@@ -1007,6 +1012,10 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
         // Slice 2: bind a runtime-named subtest's mutant failure to the exact assertion line.
         if (opts.go_assertion_line !== undefined)
             args.push("--go-assertion-line", String(opts.go_assertion_line));
+        // Receiver-qualified method target (`sym:file.go#Recv.M`) → the mutator must
+        // match the exact receiver, never a same-named decl on another type.
+        if (symbolTarget.memberQualifier)
+            args.push("--recv", symbolTarget.memberQualifier);
         const run = (deps.dynamicProofRunner ?? defaultDynamicProofRunner)(args, {
             cwd: goRoot,
             scriptPath: dynamicProofSpikePathFor("go")
@@ -1458,6 +1467,28 @@ export function autoProveChangedScope(graph, changed, baseRef) {
     });
     return hasEligibleTarget ? meaningful : undefined; // no eligible provable target in scope → global top-5
 }
+function writeStartStaticSnapshot(root, baseRef, warnings) {
+    let behaviorCoveragePath;
+    try {
+        reportProgress("artifacts: writing static behavior view (proof still running)", { current: 4, total: 8 });
+        behaviorCoveragePath = opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`, {
+            attempted: 0,
+            proven: 0,
+            needsSetup: []
+        }).behavior_coverage_path;
+    }
+    catch (error) {
+        warnings.push(`static behavior view not written: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+        reportProgress("artifacts: writing static RTM (proof still running)", { current: 4, total: 8 });
+        opRtm(root, { format: "md", baseRef, limit: START_RTM_LIMIT });
+    }
+    catch (error) {
+        warnings.push(`static RTM not written: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return behaviorCoveragePath ? { behaviorCoveragePath } : {};
+}
 export async function opStart(root, opts = {}, deps = defaultDeps()) {
     const providerOpts = startProviderOverride(root, opts);
     const scanRoot = opts.source ? resolve(opts.source) : resolve(root);
@@ -1475,6 +1506,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     }, deps);
     const warnings = [...analyze.warnings];
     reportProgress("start: deterministic graph is ready", { current: 4, total: 8 });
+    const staticSnapshot = writeStartStaticSnapshot(root, opts.baseRef, warnings);
     const providerConfigured = deps.aiProvider !== undefined || resolveProviderConfig(providerEnv, providerOpts) !== null;
     let aiLinks = { status: "skipped", reason: "AI candidate links disabled for this run." };
     if (opts.ai !== false) {
@@ -1578,7 +1610,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
                         limit: batch.length,
                         prompt_version: opts.promptVersion ?? "v5"
                     }, providerDeps);
-                    accepted += generated.generated_tests.length;
+                    accepted += generated.generated_tests.filter((t) => t.runnable !== false).length;
                     warnings.push(...generated.warnings.map((w) => `generate: ${w}`));
                 }
                 if (accepted === 0)
@@ -1611,7 +1643,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     catch (error) {
         warnings.push(`coverage report not written: ${error instanceof Error ? error.message : String(error)}`);
     }
-    let coverageHtml;
+    let coverageHtml = staticSnapshot.behaviorCoveragePath;
     try {
         reportProgress("artifacts: writing behavior coverage view", { current: 7, total: 8 });
         // Forward THIS-RUN dynamic-proof outcome so the report can name the dominant setup/runnability
@@ -1969,9 +2001,28 @@ export function opBehaviorCoverageHtml(root, outputPath = "orangepro-behavior-co
     // proof-attempts sidecar ONLY when it anchors to the current graph+commit
     // (stale evidence is dropped — fail closed; display copy only, no tier math).
     const dyn = dynamicProof ?? sidecarDynamicProof(root, graph);
-    const html = renderBehaviorReport(buildBehaviorReportData(graph, loadLedger(root), { repoRoot: root, dynamicProof: dyn }));
+    const data = buildBehaviorReportData(graph, loadLedger(root), { repoRoot: root, dynamicProof: dyn });
+    // Delta-since-last-run: best-effort read of the previous snapshot; a missing
+    // or unreadable baseline means first run (banner hidden). Display-only —
+    // the delta never touches tiers, ranks, or counts.
+    const baselinePath = resolve(root, `${WORKSPACE_DIR}/report-baseline.json`);
+    try {
+        const prev = JSON.parse(readFileSync(baselinePath, "utf8"));
+        if (prev && prev.summary && Array.isArray(prev.riskPaths))
+            data.delta = computeReportDelta(prev, data);
+    }
+    catch {
+        data.delta = null;
+    }
+    const html = renderBehaviorReport(data);
     const htmlPath = resolve(root, outputPath);
     writeFileSync(htmlPath, html, "utf8");
+    try {
+        writeFileSync(baselinePath, JSON.stringify(reportBaselineOf(data, new Date().toISOString())), "utf8");
+    }
+    catch {
+        // baseline write is advisory
+    }
     return { behavior_coverage_path: htmlPath };
 }
 /** Fresh-only sidecar view for report regens; unreadable or stale ⇒ undefined. */

package/dist/local/proofDoctor.js

@@ -77,6 +77,16 @@ export const PROOF_BLOCKER_GUIDE = {
 /** Wording is load-bearing: a survivor is a proven negative, never a user failure. */
 export const NON_KILLING_NOTE = "Not proven: the test still passed while the target was mutated (possibly an equivalent mutation). " +
     "The mutant surviving is a proven negative about assertion strength — it is never counted as Dynamically Proven.";
+/** Opposite failure mode: the mutant DID make the test fail, but via a runtime
+ *  crash rather than a trusted assertion. The test exercises the target; the
+ *  proof standard (assertion failure) was not met. Misreporting this as
+ *  "mutant survived" sends users to fix the wrong thing. */
+export const NON_ASSERTION_NOTE = "Not proven: the mutant made the test FAIL, but with a runtime error instead of a trusted assertion failure. " +
+    "The test does exercise the target; strengthen the assertion to check the target's returned value directly, or re-run — " +
+    "whether the crash or the assertion is hit first can vary between runs.";
+export function nonKillingNoteFor(mutantStatus) {
+    return mutantStatus === "associated_non_assertion_failure" ? NON_ASSERTION_NOTE : NON_KILLING_NOTE;
+}
 export function proofAttemptsPath(root) {
     return join(workspacePaths(root).dir, PROOF_ATTEMPTS_FILE);
 }
@@ -100,6 +110,7 @@ export function distillProofAttempts(auto, meta) {
             target_symbol: a.target_symbol,
             test_path: a.test_path || undefined,
             classification: a.classification,
+            mutant_status: a.mutant_status,
             category: a.category,
             reason: a.reason ? redactSecrets(a.reason) : undefined,
             deduped: a.deduped,
@@ -246,13 +257,26 @@ function groupBlockers(blocked, source) {
  * Pure assembly: graph + canonical RTM result + optional attempts sidecar →
  * deduped blocker report. Never writes; never mints; never recomputes proof.
  */
-export function buildProofDoctor(graph, rtm, attempts, opts = {}) {
+export function buildProofDoctor(graph, rtm, attempts, opts = {}, ledger) {
     const io = opts.io ?? { exists: existsSync, nodeVersion: process.version };
     const proven = rtm.summary.proven;
     const denominator = rtm.summary.total;
     // Freshness: the sidecar must anchor to the CURRENT graph generation + commit.
     const stale = Boolean(attempts && !proofAttemptsFresh(attempts, graph));
     const currentAttempts = attempts && !stale ? attempts : null;
+    // Legacy-sidecar backfill: proof-attempts files written before mutant_status
+    // was persisted carry no outcome detail, which forced every non-close into
+    // the "mutant survived" diagnosis. The ledger next to it is ground truth —
+    // recover mutant_status from the latest ledger record per target so the
+    // doctor self-heals without requiring a fresh `opro start`.
+    const ledgerStatusByTarget = new Map();
+    for (const r of ledger?.records ?? []) {
+        const ms = r.dynamic_proof?.mutant_status;
+        if (!ms)
+            continue;
+        ledgerStatusByTarget.set(r.target_symbol, ms); // records are append-ordered; last wins
+    }
+    const mutantStatusFor = (a) => a.mutant_status ?? ledgerStatusByTarget.get(a.target_symbol);
     const blocked = (currentAttempts?.attempts ?? []).filter((a) => a.classification === "needs_setup");
     const survivors = (currentAttempts?.attempts ?? []).filter((a) => a.classification === "non_killing");
     let blockers = groupBlockers(blocked, "attempt");
@@ -268,7 +292,8 @@ export function buildProofDoctor(graph, rtm, attempts, opts = {}) {
         if (seenSurvivors.has(key))
             continue;
         seenSurvivors.add(key);
-        non_killing.push({ target_symbol: a.target_symbol, test_path: a.test_path, note: NON_KILLING_NOTE });
+        const ms = mutantStatusFor(a);
+        non_killing.push({ target_symbol: a.target_symbol, test_path: a.test_path, mutant_status: ms, note: nonKillingNoteFor(ms) });
     }
     let status;
     let headline;
@@ -291,7 +316,7 @@ export function buildProofDoctor(graph, rtm, attempts, opts = {}) {
     }
     else if (non_killing.length > 0) {
         status = "blocked";
-        headline = `0 Dynamically Proven — ${non_killing.length} attempt(s) ran but the mutant survived (see non_killing).`;
+        headline = `0 Dynamically Proven — ${non_killing.length} attempt(s) ran but did not close (see non_killing for the per-target outcome).`;
     }
     else {
         status = "no_data";

package/dist/local/rtm.js

@@ -3,11 +3,12 @@ import { languageOf } from "./analyze/classify.js";
 import { targetFingerprint } from "./ledger.js";
 const STATUS_ORDER = {
     "No integration signal": 0,
-    "Associated signal": 1,
-    "Generated-unverifiable": 2,
-    "Runtime-covered": 3,
-    "Proven": 4,
-    "Reproven (this run)": 5
+    "Candidate signal (unconfirmed)": 1,
+    "Associated signal": 2,
+    "Generated-unverifiable": 3,
+    "Runtime-covered": 4,
+    "Proven": 5,
+    "Reproven (this run)": 6
 };
 const GENERIC_TEST_CATEGORIES = [
     "happy-path",
@@ -72,6 +73,7 @@ export function renderRtmMarkdown(result) {
         `| Dynamically Proven | ${provenValue} |`,
         `| Runtime-covered | ${s.runtime_covered} |`,
         `| Associated signal | ${s.associated} |`,
+        `| Candidate signal (unconfirmed) | ${s.candidate} |`,
         `| No integration signal | ${s.no_link} |`,
         `| Reproven this run | ${s.reproven_this_run} |`,
         `| Generated unverifiable | ${s.generated_unverifiable} |`,
@@ -164,8 +166,13 @@ function evidenceTierFor(indexes, node, file, dynamicProof) {
         return "proven";
     if (node.kind === "CodeSymbol" && node.properties.runtime_covered === true)
         return "runtime";
-    if (hasAssociatedSignal(indexes, node.external_id, file))
+    // Epistemic tiers (mirrors the platform's Proof/Candidate/Weak model):
+    // associated = a hard static test link (COVERS/TESTED_BY via real import) exists;
+    // candidate  = only a lexical/Jaccard candidate edge exists — a lead, not evidence.
+    if (indexes.staticSignalsById.has(node.external_id))
         return "associated";
+    if (indexes.candidateSignalsById.has(node.external_id) || (file !== "" && indexes.candidateSignalsByFile.has(file)))
+        return "candidate";
     return "none";
 }
 function statusFor(evidence, ledgerRecord, dynamicProof) {
@@ -177,6 +184,8 @@ function statusFor(evidence, ledgerRecord, dynamicProof) {
         return "Generated-unverifiable";
     if (evidence === "associated")
         return "Associated signal";
+    if (evidence === "candidate")
+        return "Candidate signal (unconfirmed)";
     return "No integration signal";
 }
 /**
@@ -196,6 +205,7 @@ function summarizeRows(rows, unionRows = []) {
         proven,
         runtime_covered: rows.filter((row) => row.evidence_tier === "runtime").length,
         associated: rows.filter((row) => row.evidence_tier === "associated").length,
+        candidate: rows.filter((row) => row.evidence_tier === "candidate").length,
         no_link: rows.filter((row) => row.evidence_tier === "none").length,
         reproven_this_run: reproven,
         generated_unverifiable: rows.filter((row) => row.status === "Generated-unverifiable").length,
@@ -252,8 +262,8 @@ function compareLedgerRecords(a, aIndex, b, bIndex) {
 function buildRtmIndexes(graph) {
     const nodeById = new Map(graph.nodes.map((n) => [n.external_id, n]));
     const staticSignalsById = new Map();
-    const associatedSignalsById = new Map();
-    const associatedSignalsByFile = new Map();
+    const candidateSignalsById = new Map();
+    const candidateSignalsByFile = new Map();
     const add = (map, key, value) => {
         const set = map.get(key);
         if (set)
@@ -261,21 +271,16 @@ function buildRtmIndexes(graph) {
         else
             map.set(key, new Set([value]));
     };
-    const importTargetsByFile = new Map();
+    // Candidate (lexical/Jaccard) signals attach ONLY to the matched file itself.
+    // They must never propagate through imports: one lexical match on a barrel file
+    // previously marked its whole import subtree as "associated" — that inflated
+    // 93% of Twenty behaviors into the test-signal tier with zero real evidence.
     const addFileAssociation = (file, value) => {
-        add(associatedSignalsByFile, file, value);
-        const imports = importTargetsByFile.get(file) ?? [];
-        if (imports.length > ASSOCIATED_IMPORT_PROPAGATION_LIMIT)
-            return;
-        for (const importedFile of imports)
-            add(associatedSignalsByFile, importedFile, value);
+        add(candidateSignalsByFile, file, value);
     };
     for (const e of graph.edges) {
         if (e.evidence_strength !== "hard")
             continue;
-        if (e.relationship_type === "IMPORTS" && isFileSignalKey(e.from_external_id) && isFileSignalKey(e.to_external_id)) {
-            importTargetsByFile.set(e.from_external_id, [...(importTargetsByFile.get(e.from_external_id) ?? []), e.to_external_id]);
-        }
         if (e.relationship_type !== "COVERS" && e.relationship_type !== "TESTED_BY")
             continue;
         const from = nodeById.get(e.from_external_id);
@@ -290,8 +295,8 @@ function buildRtmIndexes(graph) {
             continue;
         if (e.relationship_type !== "MAY_RELATE_TO" && e.relationship_type !== "MAY_BE_TESTED_BY" && e.relationship_type !== "MAY_COVER")
             continue;
-        add(associatedSignalsById, e.from_external_id, e.to_external_id);
-        add(associatedSignalsById, e.to_external_id, e.from_external_id);
+        add(candidateSignalsById, e.from_external_id, e.to_external_id);
+        add(candidateSignalsById, e.to_external_id, e.from_external_id);
         for (const [key, value] of [[e.from_external_id, e.to_external_id], [e.to_external_id, e.from_external_id]]) {
             if (isFileSignalKey(key))
                 addFileAssociation(key, value);
@@ -300,21 +305,18 @@ function buildRtmIndexes(graph) {
     const freeze = (map) => new Map([...map.entries()].map(([key, values]) => [key, [...values].sort()]));
     return {
         staticSignalsById: freeze(staticSignalsById),
-        associatedSignalsById: freeze(associatedSignalsById),
-        associatedSignalsByFile: freeze(associatedSignalsByFile)
+        candidateSignalsById: freeze(candidateSignalsById),
+        candidateSignalsByFile: freeze(candidateSignalsByFile)
     };
 }
 function isFileSignalKey(id) {
     return !id.startsWith("sym:") && !id.startsWith("test:") && !id.startsWith("flow:");
 }
-function hasAssociatedSignal(indexes, externalId, file) {
-    return indexes.staticSignalsById.has(externalId) || indexes.associatedSignalsById.has(externalId) || (file !== "" && indexes.associatedSignalsByFile.has(file));
-}
 function testSignalFor(indexes, externalId, file) {
     const staticSignals = indexes.staticSignalsById.get(externalId) ?? [];
     if (staticSignals.length > 0)
         return `static candidate: ${staticSignals.slice(0, 3).join("; ")}`;
-    const associated = [...(indexes.associatedSignalsById.get(externalId) ?? []), ...(file ? indexes.associatedSignalsByFile.get(file) ?? [] : [])]
+    const associated = [...(indexes.candidateSignalsById.get(externalId) ?? []), ...(file ? indexes.candidateSignalsByFile.get(file) ?? [] : [])]
         .filter((id) => id !== externalId && id !== file)
         .sort();
     if (associated.length > 0)
@@ -366,6 +368,8 @@ function normalizeStatusFilter(statuses) {
             out.add("Runtime-covered");
         else if (s === "associated")
             out.add("Associated signal");
+        else if (s === "candidate" || s === "candidate-signal")
+            out.add("Candidate signal (unconfirmed)");
         else if (s === "no-link" || s === "nolink" || s === "none")
             out.add("No integration signal");
         else if (s === "reproven" || s === "reproven-this-run")