@orangepro/orangepro-mcp 0.2.3 → 0.2.5

package/dist/local/viz/behaviorReportData.js

@@ -102,15 +102,16 @@ function flowSymbolIds(graph) {
     return ids;
 }
 function isNoneTier(tier) {
-    return tier !== "proven" && tier !== "associated" && tier !== "runtime";
+    return tier !== "proven" && tier !== "associated" && tier !== "runtime" && tier !== "candidate";
 }
 function summaryFromRows(rows, flowIds) {
     const proven = rows.filter((r) => r.evidence_tier === "proven").length;
     const associated = rows.filter((r) => r.evidence_tier === "associated" || r.evidence_tier === "runtime").length;
+    const candidate = rows.filter((r) => r.evidence_tier === "candidate").length;
     const noneRows = rows.filter((r) => isNoneTier(r.evidence_tier));
     // DISPLAY-ONLY split of `none`: a none-tier symbol that shows up in a static flow is "Reachable Untested".
     const reachableUntested = noneRows.filter((r) => flowIds.has(r.behavior_id)).length;
-    return { total: rows.length, proven, associated, none: noneRows.length, reachableUntested, noSignal: noneRows.length - reachableUntested };
+    return { total: rows.length, proven, associated, candidate, none: noneRows.length, reachableUntested, noSignal: noneRows.length - reachableUntested };
 }
 /** Verbatim 0-dynamic-proof explainer copy. Rendered only when summary.proven === 0. */
 const ZERO_PROOF_EXPLAINER = {
@@ -231,7 +232,13 @@ function behaviorLists(rows, flowIds) {
     const behaviors = rows.map((row) => {
         const group = groupOf(row.file);
         groups.set(group, (groups.get(group) ?? 0) + 1);
-        const tier = row.evidence_tier === "proven" ? "proven" : row.evidence_tier === "associated" || row.evidence_tier === "runtime" ? "assoc" : "none";
+        const tier = row.evidence_tier === "proven"
+            ? "proven"
+            : row.evidence_tier === "associated" || row.evidence_tier === "runtime"
+                ? "assoc"
+                : row.evidence_tier === "candidate"
+                    ? "candidate"
+                    : "none";
         return {
             sig: row.behavior || row.code_symbol,
             group,
@@ -247,14 +254,25 @@ function behaviorLists(rows, flowIds) {
         behaviors
     };
 }
-function riskBucket(score) {
-    if (score >= 500)
+/**
+ * Severity is RELATIVE to this repo's own score distribution, mirroring the
+ * blast-radius tier table (>=0.75 of max -> Tier 0/critical, >=0.50 -> high,
+ * >=0.25 -> medium). Absolute cutoffs (old: 500/200) were calibrated to the
+ * pre-normalization scale and could never fire after ORS de-saturation — every
+ * risk rendered "medium". Relative bucketing also matches the methodology:
+ * ORS is a structural risk *indicator*, never an absolute risk claim.
+ */
+function riskBucket(score, maxScore) {
+    if (score <= 0 || maxScore <= 0)
+        return null;
+    const rel = score / maxScore;
+    if (rel >= 0.75)
         return "critical";
-    if (score >= 200)
+    if (rel >= 0.5)
         return "high";
-    if (score > 0)
+    if (rel >= 0.25)
         return "medium";
-    return null;
+    return "medium";
 }
 function flowWhy(flow, proof) {
     const tier = flow.flow_tier === "framework-derived: reachable" ? "framework-derived reachable" : "hard reachable";
@@ -262,6 +280,7 @@ function flowWhy(flow, proof) {
     return `This chain is ${tier}; ${proofText}. Reachability is static and is not an execution claim.`;
 }
 function flows(graph, rows, risks) {
+    const maxRiskScore = risks.reduce((m, r) => Math.max(m, r.risk_score), 0);
     const nodesById = new Map(graph.nodes.map((n) => [n.external_id, n]));
     const proven = new Set(rows.filter((r) => r.evidence_tier === "proven").map((r) => r.behavior_id));
     const riskById = new Map(risks.map((r) => [r.id, r]));
@@ -287,7 +306,7 @@ function flows(graph, rows, risks) {
         return {
             title: flow.entry_point.title || flow.entry_point.external_id,
             trigger,
-            risk: risk ? riskBucket(risk.risk_score) : null,
+            risk: risk ? riskBucket(risk.risk_score, maxRiskScore) : null,
             proof,
             services,
             flow_tier: flow.flow_tier,
@@ -358,16 +377,346 @@ function riskGeneratedTests(graph, gap, riskIds, isFirstRowForFile) {
             return [];
         return fileOf(t.target_symbol_external_id) === gap.file ? [{ t, sameFile: true }] : [];
     });
-    return linked.slice(0, 2).map(({ t, sameFile }) => ({
+    // Mutually exclusive display: when ANY runnable generated test exists for
+    // this target, English intents are suppressed — intents are strictly the
+    // fallback for environments where runnable code was withheld. Never mix.
+    const runnableLinked = linked.filter(({ t }) => t.runnable !== false);
+    const shown = runnableLinked.length > 0 ? runnableLinked : linked;
+    return shown.slice(0, 2).map(({ t, sameFile }) => ({
         name: t.title,
         concern: t.test_type && t.test_type !== "unknown" ? t.test_type : undefined,
-        assertion: [sameFile ? "same-file target" : "", t.framework_hint, t.weak_evidence_used ? "weak evidence disclosed" : ""]
+        bucket: t.bucket,
+        // The "English intent" marker renders ONCE, as the badge next to the name —
+        // the assertion line stays pure metadata (framework, same-file, disclosure).
+        assertion: [
+            sameFile ? "same-file target" : "",
+            t.framework_hint,
+            t.weak_evidence_used ? "weak evidence disclosed" : ""
+        ]
             .filter(Boolean)
             .join(" · "),
-        code: t.body
+        code: t.body,
+        runnable: t.runnable !== false
     }));
 }
+/** Incoming refs are method-attributed and can be fractional (a file-level
+ *  reference split across its symbols). Display rounds; sub-1 shows "<1". */
+function fmtRefs(n) {
+    if (n > 0 && n < 1)
+        return "<1";
+    return String(Math.round(n));
+}
+/** Deterministic 1–2 line behavior context from graph facts only — no LLM.
+ *  Sensitivity label mirrors deriveDataSensitivity's tiers. */
+function riskContext(risk) {
+    const sens = (risk.data_sensitivity ?? 1) >= 10 ? "payment/billing-sensitive"
+        : (risk.data_sensitivity ?? 1) >= 9 ? "auth/session-sensitive"
+            : (risk.data_sensitivity ?? 1) >= 7 ? "order/transaction"
+                : (risk.data_sensitivity ?? 1) >= 6 ? "customer/user-data"
+                    : (risk.data_sensitivity ?? 1) >= 3 ? "notification/webhook"
+                        : "";
+    const pos = (risk.flow_position ?? 0) >= 5
+        ? "an entry point"
+        : (risk.flow_position ?? 0) >= 3
+            ? `${5 - (risk.flow_position ?? 0)} call${5 - (risk.flow_position ?? 0) === 1 ? "" : "s"} from the nearest entry point`
+            : "deep in the call graph";
+    const refs = fmtRefs(risk.incoming_refs);
+    const parts = [
+        `Sits at ${pos}${sens ? ` on ${sens} paths` : ""}.`,
+        `${refs} caller${refs === "1" ? "" : "s"}, ${risk.fan_out ?? 0} downstream call${(risk.fan_out ?? 0) === 1 ? "" : "s"}, ${risk.git_churn} line${risk.git_churn === 1 ? "" : "s"} changed in 180 days — and no test proves its behavior.`
+    ];
+    return parts.join(" ");
+}
+/** Pure delta between a persisted baseline and the current report data.
+ *  Deterministic: same inputs, same delta. */
+export function computeReportDelta(prev, cur) {
+    const curPaths = cur.risks.map((r) => r.path);
+    const prevSet = new Set(prev.riskPaths);
+    const curSet = new Set(curPaths);
+    const newRisks = curPaths.filter((p) => !prevSet.has(p));
+    const droppedRisks = prev.riskPaths.filter((p) => !curSet.has(p));
+    const d = {
+        baselineTs: prev.ts,
+        changed: false,
+        totalDelta: cur.summary.total - prev.summary.total,
+        provenDelta: cur.summary.proven - prev.summary.proven,
+        associatedDelta: cur.summary.associated - prev.summary.associated,
+        candidateDelta: cur.summary.candidate - prev.summary.candidate,
+        noneDelta: cur.summary.none - prev.summary.none,
+        newRisks,
+        droppedRisks,
+        generatedDelta: cur.generatedTotal - prev.generatedTotal
+    };
+    d.changed =
+        d.totalDelta !== 0 || d.provenDelta !== 0 || d.associatedDelta !== 0 || d.candidateDelta !== 0 ||
+            d.noneDelta !== 0 || d.generatedDelta !== 0 || newRisks.length > 0 || droppedRisks.length > 0;
+    return d;
+}
+export function reportBaselineOf(cur, ts) {
+    return { ts, summary: cur.summary, riskPaths: cur.risks.map((r) => r.path), generatedTotal: cur.generatedTotal };
+}
+const LANE_OF = {
+    MUTATION: { id: "graphql", label: "GraphQL" },
+    QUERY: { id: "graphql", label: "GraphQL" },
+    SUBSCRIPTION: { id: "graphql", label: "GraphQL" },
+    GET: { id: "http", label: "HTTP" },
+    POST: { id: "http", label: "HTTP" },
+    PUT: { id: "http", label: "HTTP" },
+    PATCH: { id: "http", label: "HTTP" },
+    DELETE: { id: "http", label: "HTTP" },
+    JOB: { id: "job", label: "Jobs" }
+};
+function ownerOfSig(sig) {
+    const base = sig.includes("#") ? sig.slice(sig.indexOf("#") + 1) : sig;
+    return base.includes(".") ? base.slice(0, base.indexOf(".")) : base;
+}
+export function buildSystemMapModel(data, maxServices = 12) {
+    // Pass 1: how many trigger flows does each owner appear in? Shared
+    // infrastructure (config drivers, exception handlers, caches) appears in
+    // nearly all of them — the LAST-step heuristic crowned exactly that plumbing
+    // on a full-scale repo. A flow's representative service is its most
+    // DISTINCTIVE owner: lowest global frequency, deepest step on ties, with
+    // near-ubiquitous owners eligible only when a flow touches nothing else.
+    const triggerFlows = data.flows.filter((f) => f.trigger && LANE_OF[(f.trigger.verb || "").toUpperCase()]);
+    const ownerFreq = new Map();
+    for (const f of triggerFlows) {
+        const seen = new Set();
+        for (const st of f.steps ?? []) {
+            const o = ownerOfSig(st.sig);
+            if (o && !seen.has(o)) {
+                seen.add(o);
+                ownerFreq.set(o, (ownerFreq.get(o) ?? 0) + 1);
+            }
+        }
+    }
+    const infraCutoff = Math.max(3, Math.floor(triggerFlows.length * 0.4));
+    const isSharedInfra = (o) => (ownerFreq.get(o) ?? 0) >= infraCutoff;
+    const laneFlows = new Map();
+    const svcFlows = new Map();
+    const edgeFlows = new Map();
+    const svcLaneFlows = new Map();
+    for (const f of triggerFlows) {
+        const lane = LANE_OF[(f.trigger.verb || "").toUpperCase()];
+        const steps = f.steps ?? [];
+        let svc = "";
+        let bestFreq = Infinity;
+        let bestDepth = -1;
+        for (let i = 0; i < steps.length; i++) {
+            const o = ownerOfSig(steps[i].sig);
+            if (!o || isSharedInfra(o))
+                continue;
+            const freq = ownerFreq.get(o) ?? 0;
+            if (freq < bestFreq || (freq === bestFreq && i > bestDepth)) {
+                svc = o;
+                bestFreq = freq;
+                bestDepth = i;
+            }
+        }
+        if (!svc) {
+            // Flow touches only shared infra — fall back to its deepest step.
+            const last = steps.length ? steps[steps.length - 1] : undefined;
+            svc = last ? ownerOfSig(last.sig) : "";
+        }
+        if (!svc)
+            continue;
+        laneFlows.set(lane.id, (laneFlows.get(lane.id) ?? 0) + 1);
+        svcFlows.set(svc, (svcFlows.get(svc) ?? 0) + 1);
+        const key = lane.id + "\u0000" + svc;
+        edgeFlows.set(key, (edgeFlows.get(key) ?? 0) + 1);
+        const perLane = svcLaneFlows.get(svc) ?? new Map();
+        perLane.set(lane.id, (perLane.get(lane.id) ?? 0) + 1);
+        svcLaneFlows.set(svc, perLane);
+    }
+    const laneRank = (svc) => {
+        const perLane = svcLaneFlows.get(svc);
+        if (!perLane)
+            return 99;
+        let best = "";
+        let bestN = -1;
+        for (const [l, n] of perLane)
+            if (n > bestN) {
+                best = l;
+                bestN = n;
+            }
+        return ["graphql", "http", "job"].indexOf(best);
+    };
+    const byTraffic = [...svcFlows.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+    const chosen = new Set();
+    // 1) Every lane is guaranteed its top 2 services — a lane with 56 flows must
+    //    never render edge-less just because its traffic is spread thin.
+    for (const laneId of ["graphql", "http", "job"]) {
+        let taken = 0;
+        for (const [svc] of byTraffic) {
+            if (taken >= 2)
+                break;
+            if (laneRank(svc) === ["graphql", "http", "job"].indexOf(laneId) && !chosen.has(svc)) {
+                chosen.add(svc);
+                taken++;
+            }
+        }
+    }
+    // 2) Top-risk owners with real flow traffic join the map (up to 3) so the
+    //    red rings — the whole point of the overlay — survive full scale.
+    let riskAdds = 0;
+    for (const r of data.risks) {
+        if (riskAdds >= 3)
+            break;
+        const owner = ownerOfSig(r.path);
+        if ((svcFlows.get(owner) ?? 0) > 0 && !chosen.has(owner)) {
+            chosen.add(owner);
+            riskAdds++;
+        }
+    }
+    // 3) Fill remaining slots by global traffic.
+    for (const [svc] of byTraffic) {
+        if (chosen.size >= maxServices + riskAdds)
+            break;
+        chosen.add(svc);
+    }
+    const top = byTraffic
+        .filter(([svc]) => chosen.has(svc))
+        // Group vertically under each service's dominant lane so edges flow in
+        // bands instead of crossing the whole canvas.
+        .sort((a, b) => laneRank(a[0]) - laneRank(b[0]) || b[1] - a[1] || a[0].localeCompare(b[0]));
+    const topSet = new Set(top.map(([k]) => k));
+    const tiersBySvc = new Map();
+    for (const b of data.behaviors) {
+        const svc = ownerOfSig(b.sig);
+        if (!topSet.has(svc))
+            continue;
+        const t = tiersBySvc.get(svc) ?? { proven: 0, assoc: 0, candidate: 0, none: 0 };
+        if (b.tier === "proven")
+            t.proven++;
+        else if (b.tier === "assoc")
+            t.assoc++;
+        else if (b.tier === "candidate")
+            t.candidate++;
+        else
+            t.none++;
+        tiersBySvc.set(svc, t);
+    }
+    const riskBySvc = new Map();
+    for (const r of data.risks) {
+        const svc = ownerOfSig(r.path);
+        if (!topSet.has(svc))
+            continue;
+        const e = riskBySvc.get(svc) ?? { ranks: [], critical: false };
+        e.ranks.push(r.rank);
+        if (r.tags.some(([label, kind]) => kind === "risk" && label.startsWith("critical")))
+            e.critical = true;
+        riskBySvc.set(svc, e);
+    }
+    const laneOrder = ["graphql", "http", "job"];
+    // Conservation: edges drawn per lane must sum to the lane's stated count.
+    // Everything below the cut aggregates into one dashed "+N more services"
+    // node per lane — 51 job flows must never silently vanish.
+    const shownEdges = [...edgeFlows.entries()]
+        .map(([k, flows]) => ({ lane: k.split("\u0000")[0], service: k.split("\u0000")[1], flows }))
+        .filter((e) => topSet.has(e.service));
+    const shownPerLane = new Map();
+    for (const e of shownEdges)
+        shownPerLane.set(e.lane, (shownPerLane.get(e.lane) ?? 0) + e.flows);
+    const restNodes = [];
+    const restEdges = [];
+    for (const laneId of laneOrder) {
+        const total = laneFlows.get(laneId) ?? 0;
+        const shown = shownPerLane.get(laneId) ?? 0;
+        if (total - shown <= 0)
+            continue;
+        const hiddenSvcs = new Set();
+        for (const [k, n] of edgeFlows) {
+            const [l, svc] = k.split("\u0000");
+            if (l === laneId && !topSet.has(svc) && n > 0)
+                hiddenSvcs.add(svc);
+        }
+        const restId = "rest:" + laneId;
+        restNodes.push({
+            id: restId,
+            label: "+" + hiddenSvcs.size + " more services",
+            flows: total - shown,
+            tiers: { proven: 0, assoc: 0, candidate: 0, none: 0 },
+            riskRanks: [],
+            critical: false,
+            rest: { services: hiddenSvcs.size }
+        });
+        restEdges.push({ lane: laneId, service: restId, flows: total - shown });
+    }
+    return {
+        lanes: laneOrder
+            .filter((id) => laneFlows.has(id))
+            .map((id) => ({ id, label: id === "graphql" ? "GraphQL" : id === "http" ? "HTTP" : "Jobs", flows: laneFlows.get(id) ?? 0 })),
+        services: [
+            ...top.map(([label, flows]) => ({
+                id: label,
+                label,
+                flows,
+                tiers: tiersBySvc.get(label) ?? { proven: 0, assoc: 0, candidate: 0, none: 0 },
+                riskRanks: (riskBySvc.get(label)?.ranks ?? []).sort((a, b) => a - b),
+                critical: riskBySvc.get(label)?.critical ?? false
+            })),
+            ...restNodes
+        ],
+        edges: [...shownEdges, ...restEdges].sort((a, b) => a.lane.localeCompare(b.lane) || b.flows - a.flows || a.service.localeCompare(b.service))
+    };
+}
+/** Deterministic per-risk APPLICABLE concern categories — derived from graph
+ *  facts, never from whether tests exist. Covered = what attached tests
+ *  address (via bucket). Locked pills = applicable − covered: the platform
+ *  generates those categories; nothing pretends hidden tests already exist. */
+const CONCERN_ORDER = ["contract", "authorization_safety", "boundary_limits", "integration_flow", "state_lifecycle", "failure_recovery", "data_integrity", "concurrency_ordering"];
+function riskApplicableConcerns(risk, verb) {
+    const out = new Set(["contract"]); // an observable behavior always has a contract to verify
+    const sens = risk.data_sensitivity ?? 1;
+    if (sens >= 9)
+        out.add("authorization_safety");
+    if (sens >= 6)
+        out.add("data_integrity");
+    if (risk.entry_point || verb !== "BEHAVIOR")
+        out.add("boundary_limits"); // external inputs cross here
+    if ((risk.flow_position ?? 0) >= 3 || (risk.fan_out ?? 0) >= 1)
+        out.add("integration_flow");
+    if ((risk.fan_out ?? 0) >= 1 && risk.git_churn > 0)
+        out.add("state_lifecycle");
+    if ((risk.fan_out ?? 0) >= 2)
+        out.add("failure_recovery"); // downstream dependencies can fail
+    if (/job|queue|cron|stream|lock|worker/i.test(risk.title + " " + risk.file))
+        out.add("concurrency_ordering");
+    return CONCERN_ORDER.filter((c) => out.has(c));
+}
+const BUCKET_TO_CONCERN = {
+    happy_path: "contract",
+    validation_error: "contract",
+    edge_case: "boundary_limits",
+    regression: "failure_recovery",
+    security_privacy: "authorization_safety",
+    integration_flow: "integration_flow"
+};
+/** State-aware next step — varies by attached tests, trigger kind, signal, and
+ *  sensitivity, so no two cards read identically for different reasons. */
+function riskTodo(risk, verb, path, generatedTests) {
+    if (generatedTests.length && generatedTests.every((t) => t.runnable !== false)) {
+        return "Run the generated test below in your repo; follow its prove handoff so a mutation failure can mint Dynamically Proven.";
+    }
+    if (generatedTests.length) {
+        return "Install this repo's dependencies / set up the test runner, then re-run `opro start` to turn the English intents below into runnable tests.";
+    }
+    const call = verb !== "BEHAVIOR"
+        ? `issues ${verb} ${path}`
+        : risk.entry_point
+            ? `invokes ${risk.title} through its entry point`
+            : `calls ${risk.title} directly`;
+    const sens = (risk.data_sensitivity ?? 1) >= 9
+        ? " Include a negative case: invalid or expired credentials must fail closed."
+        : (risk.data_sensitivity ?? 1) >= 7
+            ? " Include a failure case: a rejected transaction must leave no partial state."
+            : "";
+    if (risk.integration_signal === "candidate") {
+        return `A similarly named test exists but nothing links it. Write a test that imports and ${call}, asserting the observable outcome — that upgrades this from unconfirmed candidate to a hard link.${sens}`;
+    }
+    return `No test signal exists. Start with one integration test that ${call} and asserts the observable outcome.${sens}`;
+}
 function riskRows(risks, graph) {
+    const maxRiskScore = risks.reduce((m, r) => Math.max(m, r.risk_score), 0);
     const riskIds = new Set(risks.map((r) => r.id));
     const firstRowForFile = new Map();
     for (const r of risks)
@@ -376,28 +725,36 @@ function riskRows(risks, graph) {
     return risks.map((risk, idx) => {
         const methodMatch = risk.title.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(.+)$/i);
         const tags = [];
-        const bucket = riskBucket(risk.risk_score);
+        const bucket = riskBucket(risk.risk_score, maxRiskScore);
         if (bucket)
             tags.push([`${bucket} risk`, "risk"]);
-        tags.push([`${risk.incoming_refs} incoming refs`, "info"]);
+        tags.push([`${fmtRefs(risk.incoming_refs)} incoming refs`, "info"]);
         if (risk.entry_point)
             tags.push(["Entry point", "entry"]);
         return {
             rank: idx + 1,
             ...(() => {
                 const generatedTests = riskGeneratedTests(graph, risk, riskIds, firstRowForFile.get(risk.file) === risk.id);
+                const verb = methodMatch?.[1]?.toUpperCase() ?? "BEHAVIOR";
+                const path = methodMatch?.[2] ?? risk.title;
+                const coveredCategories = [...new Set([
+                        ...generatedTests.map((t) => (t.bucket ? BUCKET_TO_CONCERN[t.bucket] : undefined)),
+                        // An integration/api/e2e-layer test covers the integration_flow
+                        // category by construction — the chip and the pill must agree.
+                        ...generatedTests.map((t) => (t.concern === "integration" || t.concern === "api" || t.concern === "e2e" ? "integration_flow" : undefined))
+                    ].filter((c) => Boolean(c)))];
                 return {
                     generatedTests,
-                    // Honest category strip: only the concerns of REAL attached tests —
-                    // every pill renders as shown ("n of n"), none fabricated as locked.
-                    applicableCategories: [...new Set(generatedTests.map((t) => t.concern).filter((c) => Boolean(c)))]
+                    applicableCategories: riskApplicableConcerns(risk, verb),
+                    coveredCategories,
+                    verb,
+                    path,
+                    todo: riskTodo(risk, verb, path, generatedTests)
                 };
             })(),
-            verb: methodMatch?.[1]?.toUpperCase() ?? "BEHAVIOR",
-            path: methodMatch?.[2] ?? risk.title,
+            context: riskContext(risk),
             desc: risk.reasons.join(" · "),
-            tags,
-            todo: "Write an integration or behavior test that calls this behavior and asserts the observable outcome."
+            tags
         };
     });
 }
@@ -416,6 +773,8 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
     const riskGaps = rankRiskGaps(graph, { repoRoot, limit: opts.riskLimit ?? 20 });
     const lists = behaviorLists(rows, flowIds);
     const risks = riskRows(riskGaps, graph);
+    const sortedBehaviors = [...lists.behaviors].sort((a, b) => tierRank(a) - tierRank(b));
+    const flowRows = flows(graph, rows, riskGaps);
     return {
         repo: path.basename(repoRoot || graph.workspace.name || "repo"),
         scanned: (graph.updated_at || graph.created_at || new Date(0).toISOString()).slice(0, 10),
@@ -427,11 +786,22 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         scan: scanBlock(graph, rows),
         behaviorGroups: lists.behaviorGroups,
         // Proven first so the strongest evidence leads the grid (stable within tiers).
-        behaviors: [...lists.behaviors].sort((a, b) => tierRank(a) - tierRank(b)),
-        flows: flows(graph, rows, riskGaps),
+        behaviors: sortedBehaviors,
+        flows: flowRows,
         candidateFlows: candidateFlows(graph),
         risks,
         zeroProofExplainer: summary.proven === 0 ? { title: ZERO_PROOF_EXPLAINER.title, body: [...ZERO_PROOF_EXPLAINER.body] } : null,
+        mapModel: buildSystemMapModel({ flows: flowRows, risks, behaviors: sortedBehaviors }),
+        viewMeta: {
+            // Every denominator behavior is scored; the risks tab surfaces the top N.
+            risks: { shown: risks.length, scored: summary.total },
+            flows: {
+                shown: graph.analysis?.flows?.total_flows ?? 0,
+                prunedByCaps: (graph.analysis?.flows?.dropped?.max_depth ?? 0) +
+                    (graph.analysis?.flows?.dropped?.max_flows_per_entry ?? 0) +
+                    (graph.analysis?.flows?.dropped?.global_cap ?? 0)
+            }
+        },
         generatedTotal: graph.generated_tests?.length ?? 0,
         shownCount: risks.reduce((acc, r) => acc + r.generatedTests.length, 0)
     };