@orangepro/orangepro-mcp 0.2.34 → 0.2.36

package/README.md

@@ -347,6 +347,7 @@ Analysis, scoring, and proof need no model key. Generation does.
 | Ollama (local, no key) | `OLLAMA_BASE_URL` (optional: `OLLAMA_MODEL`) |
 
 Auto-detect order: OpenAI → Ollama → Anthropic. Override with `--provider` and `--model`.
+The defaults are `gpt-5.3-codex` for OpenAI and `claude-sonnet-5` for Anthropic.
 
 Run `opro setup` to configure interactively. Keys stay in your environment — never written to graph, config, or artifacts.
 

package/dist/local/analyze/analyzer.js

@@ -475,6 +475,18 @@ export function analyzeRepo(root, opts = {}) {
     // Emitted CodeSymbol names per file — the call graph resolves callers/callees
     // ONLY to symbols that actually became nodes (the "known symbol" invariant).
     const symbolsByFile = new Map();
+    // Retained callee NAMES (no node, no edge) for calls the resolver cannot anchor —
+    // shared by the TS/JS loop and the tree-sitter loop; persisted as external_callees.
+    const externalCalleesByCaller = new Map();
+    const recordExternalCallee = (callerId, name) => {
+        let set = externalCalleesByCaller.get(callerId);
+        if (!set) {
+            set = new Set();
+            externalCalleesByCaller.set(callerId, set);
+        }
+        if (set.size < 32)
+            set.add(name);
+    };
     // Raw (caller, callee) call pairs per TS/JS code file, resolved after the
     // import graph is built (cross-file calls need its bindings + targets).
     const rawCallsByFile = new Map();
@@ -1312,9 +1324,19 @@ export function analyzeRepo(root, opts = {}) {
                             }
                         }
                         // A non-imported (local/param) qualifier is NOT anchored — no edge.
+                        if (!ns && !qImport)
+                            recordExternalCallee(callerId, `${c.qualifier}.${c.callee}`); // round two: retain by name
+                        // Retain the callee NAME as a fact on the caller (Fix B): `t.adminClient.
+                        // DeleteWorkflowExecution` is invisible as an edge (external interface) but
+                        // is exactly the kind of sink risk scoring must be able to see. Names only —
+                        // no node, no edge, no evidence claim.
                     }
                 }
                 else if (c.via === "injected" && c.injectedType) {
+                    // Retain `this.<field>.<callee>` by name regardless of resolution: names are
+                    // facts, not evidence, and consequence signals need the callee even when the
+                    // injected type never resolves (round two — TS parity with Go).
+                    recordExternalCallee(callerId, `this.${c.qualifier ?? c.injectedType}.${c.callee}`);
                     const typeBinding = typeImports?.get(c.injectedType) ?? imports?.get(c.injectedType);
                     if (typeBinding) {
                         const targetMember = resolveInjectedMember(typeBinding, c.callee);
@@ -1835,6 +1857,26 @@ export function analyzeRepo(root, opts = {}) {
                 addImportBinding(rel, i.local, { ...(targetRel ? { targetRel } : {}), ...(targetDir ? { targetDir } : {}) }, i.imported, i.kind);
             }
         }
+        // Go package-level method index (dir → "Recv.M" → file) for receiver calls that
+        // land in a sibling file of the same package.
+        const goPkgMethods = new Map();
+        for (const [f, syms] of symbolsByFile) {
+            if (!f.endsWith(".go") || f.endsWith("_test.go"))
+                continue;
+            const dir = f.includes("/") ? f.slice(0, f.lastIndexOf("/")) : "";
+            let m = goPkgMethods.get(dir);
+            if (!m) {
+                m = new Map();
+                goPkgMethods.set(dir, m);
+            }
+            for (const sname of syms)
+                if (sname.includes("."))
+                    m.set(sname, f);
+        }
+        const goPackageMethodFile = (rel, member) => {
+            const dir = rel.includes("/") ? rel.slice(0, rel.lastIndexOf("/")) : "";
+            return goPkgMethods.get(dir)?.get(member);
+        };
         for (const [rel, { language, structure }] of nonTsStructureByFile) {
             const localSyms = symbolsByFile.get(rel);
             if (!localSyms)
@@ -1869,7 +1911,28 @@ export function analyzeRepo(root, opts = {}) {
                     if (shadowed.has(rootQualifier))
                         continue;
                     const b = imports?.get(rootQualifier);
-                    if (language === "go" && b?.kind === "module" && b.targetDir) {
+                    if (language === "go" && c.receiverVar && c.receiverType && c.qualifier === c.receiverVar) {
+                        // Go receiver-method call: inside `func (t *task) Run()`, `t.validate()` calls
+                        // `task.validate`. The receiver's type is DECLARED in the method signature, so
+                        // this is exact resolution: same file first, then the same package (methods of
+                        // one type may span files; Go forbids duplicate method names on a type, so a
+                        // package-level hit is unambiguous).
+                        const member = `${c.receiverType}.${c.callee}`;
+                        if (localSyms.has(member))
+                            emitCall(callerId, `sym:${rel}#${member}`, rel);
+                        else {
+                            const pkgRel = goPackageMethodFile(rel, member);
+                            if (pkgRel)
+                                emitCall(callerId, `sym:${pkgRel}#${member}`, rel);
+                        }
+                    }
+                    else if (language === "go" && !b && c.receiverVar && rootQualifier === c.receiverVar) {
+                        // `t.client.Delete(...)`: a call through a receiver FIELD to an external or
+                        // interface method — no resolvable node. Retain the callee NAME on the caller
+                        // (Fix B) so scoring can see sinks like `DeleteWorkflowExecution`. Names only.
+                        recordExternalCallee(callerId, `${c.qualifier}.${c.callee}`);
+                    }
+                    else if (language === "go" && b?.kind === "module" && b.targetDir) {
                         const targetRel = uniqueGoPackageSymbol(b.targetDir, c.callee);
                         if (targetRel)
                             emitCall(callerId, `sym:${targetRel}#${c.callee}`, rel);
@@ -1898,6 +1961,16 @@ export function analyzeRepo(root, opts = {}) {
                 }
             }
         }
+        // Fix B: persist retained callee names on their caller symbols (names only).
+        if (externalCalleesByCaller.size > 0) {
+            const byId = new Map(nodes.map((n) => [n.external_id, n]));
+            for (const [callerId, names] of externalCalleesByCaller) {
+                const n = byId.get(callerId);
+                if (!n)
+                    continue;
+                n.properties = { ...(n.properties ?? {}), external_callees: [...names].sort() };
+            }
+        }
         const seenGoProof = new Set();
         const proofVerifiedAt = scanStartMs;
         for (const [testRel, structure] of goTestStructureByFile) {

package/dist/local/analyze/treeSitter/engine.js

@@ -392,6 +392,11 @@ function functionName(node, language) {
  * behavior). NOT used for test-name extraction — suite test names must stay bare
  * (`^Test` gate at extractGoProofCalls).
  */
+function goReceiverVarName(node) {
+    const param = node.childForFieldName("receiver")?.namedChild(0);
+    const name = param?.childForFieldName("name");
+    return name?.type === "identifier" ? name.text : undefined;
+}
 function goReceiverBaseName(node) {
     const param = node.childForFieldName("receiver")?.namedChild(0);
     let t = param?.childForFieldName("type") ?? undefined;
@@ -1494,6 +1499,7 @@ export function extractTreeSitterStructure(content, language) {
         return { imports: [], calls: [] };
     const root = tree.rootNode;
     const calls = [];
+    const callerReceivers = new Map();
     const isCallableNode = (node) => (language === "java" && node.type === "method_declaration") ||
         (language === "python" && node.type === "function_definition") ||
         (language === "go" && (node.type === "function_declaration" || node.type === "method_declaration")) ||
@@ -1517,8 +1523,12 @@ export function extractTreeSitterStructure(content, language) {
                 // qualified caller so Layer-1 edges keep matching the emitted symbol.
                 if (name && language === "go" && node.type === "method_declaration") {
                     const recv = goReceiverBaseName(node);
-                    if (recv)
+                    if (recv) {
                         name = `${recv}.${name}`;
+                        const rv = goReceiverVarName(node);
+                        if (rv)
+                            callerReceivers.set(name, { receiverVar: rv, receiverType: recv });
+                    }
                 }
                 if (name) {
                     nextCaller = name;
@@ -1529,7 +1539,7 @@ export function extractTreeSitterStructure(content, language) {
         }
         const parts = callParts(node, language);
         if (nextCaller && parts) {
-            calls.push({ caller: nextCaller, ...parts, shadowed: [...nextShadowed] });
+            calls.push({ caller: nextCaller, ...parts, shadowed: [...nextShadowed], ...(callerReceivers.get(nextCaller) ?? {}) });
         }
         for (const child of namedChildren(node))
             visit(child, nextCaller, nextShadowed, nextInsideFunction);

package/dist/local/cli.js

@@ -94,7 +94,7 @@ Usage:
   opro score [--json]
   opro gaps [--limit 10] [--min-priority medium] [--json]
     # also returns top_risk_gaps: unproven code symbols ranked by OrangePro Risk Score (P × I × D)
-  opro record --target-symbol sym:file#Symbol [--test path] [--agent-pass true|false] [--evidence-ids id1,id2] [--provider openai] [--model gpt-4.1] [--prompt-version v1] [--json]
+  opro record --target-symbol sym:file#Symbol [--test path] [--agent-pass true|false] [--evidence-ids id1,id2] [--provider openai] [--model gpt-5.3-codex] [--prompt-version v1] [--json]
     # record writes static reprove diagnostics only; public Proven requires \`opro prove\`
   opro prove --target-symbol sym:file#Symbol --test path --replacement 'return ...;' [--target-file path] [--method name] [--replacement-mode return-json|promise-json] [--runner auto|vitest|jest|mocha|pytest] [--link-node-modules] [--json]
     # runs the dynamic targeted-proof oracle and writes a metadata-only ledger certificate only when baseline-green → mutant assertion-fail closes
@@ -221,6 +221,8 @@ async function main() {
                 }
                 if (res.coverage_report_path)
                     out(`  coverage report: ${res.coverage_report_path}`);
+                if (res.generation_diagnostics_path)
+                    out(`  generation diagnostics: ${res.generation_diagnostics_path}`);
                 out(`  RTM:            ${res.rtm.rtm_path}${res.rtm.rows.length < res.rtm.summary.total ? ` (capped ${res.rtm.rows.length}/${res.rtm.summary.total} rows)` : ""}`);
                 out(`  Dynamically Proven:    ${res.rtm.summary.proven}/${res.rtm.summary.total} (static map covers all ${res.rtm.summary.total}; dynamic proof verifies the top ${res.auto_prove.attempted || "few"})`);
                 if (res.rtm.summary.total > 0 && res.rtm.summary.proven === 0) {

package/dist/local/generate/generator.js

@@ -2294,8 +2294,88 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
             if (existingGeneratedTitles.length) {
                 gc.ctx.existing_tests = dedupe([...gc.ctx.existing_tests, ...existingGeneratedTitles]);
             }
+            const manualDraftForScenario = (scenario, reason) => {
+                const manualBody = sanitizeGeneratedBody([
+                    `Scenario: ${scenario.title}`,
+                    ...(scenario.steps && scenario.steps.length
+                        ? ["Steps:", ...scenario.steps.map((st, n) => `  ${n + 1}. ${st}`)]
+                        : []),
+                    ...(scenario.test_data ? [`Test data: ${scenario.test_data}`] : []),
+                    ...(scenario.assertion_targets.length ? [`Expected: ${scenario.assertion_targets.join("; ")}`] : []),
+                    ...(scenario.rationale ? [`Why this test: ${scenario.rationale}`] : []),
+                    "",
+                    `Blocked by: ${reason.split(" — ")[0]}`,
+                    `Fix: ${generatedDraftRemediation(reason)}`
+                ].join("\n"), gc.ctx.source_excerpts, "//").body;
+                return {
+                    id: `${run_id}-t${generated.length + 1}`,
+                    run_id,
+                    title: `${gc.ctx.behavior_title} — ${scenario.title}`,
+                    test_type: gc.ctx.test_layer,
+                    framework_hint: framework,
+                    body: manualBody,
+                    bucket: bucketForV5Scenario(scenario),
+                    prompt_version: PROMPT_VERSION_V5,
+                    grounding: { entity_ids: gc.entityIds, source_refs: [], weak_relationships_used: [] },
+                    weak_evidence_used: false,
+                    target_symbol_external_id: behavior.external_id,
+                    ...(fingerprintOf(behavior) ? { target_fingerprint: fingerprintOf(behavior) } : {}),
+                    runnable: false,
+                    unresolved_reason: reason
+                };
+            };
+            const emitManualPlanningFallback = (planningReason) => {
+                if (!opts.manual_planning_fallback)
+                    return;
+                const normalizedExistingTitles = new Set(existingGeneratedTitles.map((title) => title.trim().toLowerCase()));
+                const candidates = [
+                    {
+                        id: 1,
+                        title: "Validate the observable contract through the nearest public entry point",
+                        concern: "contract",
+                        technique: "contract_verification",
+                        rationale: "Preserve a reviewable contract test intent when the model planner returns no accepted scenario.",
+                        assertion_targets: ["The documented result, state change, and externally visible side effects are correct"],
+                        steps: [
+                            "Arrange valid inputs and the minimum required collaborators for this flow",
+                            "Exercise the flow through its nearest public entry point",
+                            "Assert the observable result, state transition, and side effects"
+                        ],
+                        complexity: "intermediate",
+                        risk_rank: 1
+                    },
+                    {
+                        id: 2,
+                        title: "Reject invalid or boundary input without partial side effects",
+                        concern: "failure_recovery",
+                        technique: "error_guessing",
+                        rationale: "Preserve a reviewable failure-path intent for a priority flow even when model planning fails.",
+                        assertion_targets: ["The failure is explicit and no partial state or unintended side effect remains"],
+                        steps: [
+                            "Arrange an invalid, missing, or boundary input relevant to this flow",
+                            "Exercise the same public entry path",
+                            "Assert a clear failure outcome and verify that partial side effects were not retained"
+                        ],
+                        complexity: "intermediate",
+                        risk_rank: 2
+                    }
+                ];
+                const remaining = Math.max(0, limit - generated.length);
+                const selectedFallbacks = candidates.filter((scenario) => {
+                    const scenarioTitle = scenario.title.trim().toLowerCase();
+                    const fullTitle = `${gc.ctx.behavior_title} — ${scenario.title}`.trim().toLowerCase();
+                    return !normalizedExistingTitles.has(scenarioTitle) && !normalizedExistingTitles.has(fullTitle);
+                }).slice(0, remaining);
+                const reason = `${planningReason} Manual fallback retained because this was the final bounded planning attempt; it is not runnable generated code.`;
+                for (const scenario of selectedFallbacks)
+                    generated.push(manualDraftForScenario(scenario, reason));
+                if (selectedFallbacks.length) {
+                    warnings.push(`Retained ${selectedFallbacks.length} manual planning fallback(s) for "${gc.ctx.behavior_title}" after the final bounded planning attempt failed.`);
+                }
+            };
             reportProgress(`Planning "${gc.ctx.behavior_title}" [v5]…`);
             let scenarios = [];
+            let emptyScenarioReason = "V5 planning returned no missing scenarios.";
             // Transport first: a network/timeout failure is NOT malformed JSON, so it does
             // not warrant a repair pass — fail closed and emit no test.
             let rawPlan;
@@ -2316,6 +2396,7 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                     reason: `V5 planning call failed: ${msg}`,
                     needed: ["a reachable model provider"]
                 });
+                emitManualPlanningFallback(`V5 planning call failed: ${msg}.`);
                 continue;
             }
             try {
@@ -2323,6 +2404,9 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                 scenarios = result.scenarios;
                 if (result.dropped > 0) {
                     warnings.push(`Dropped ${result.dropped} invalid v5 planned scenario(s) for "${gc.ctx.behavior_title}": ${result.dropSummary.join("; ")}.`);
+                    if (result.scenarios.length === 0) {
+                        emptyScenarioReason = `V5 planning returned only invalid scenarios: ${result.dropSummary.join("; ")}.`;
+                    }
                 }
             }
             catch (parseErr) {
@@ -2341,6 +2425,7 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                         reason: `V5 planning JSON had no recoverable scenario array (repair would invent): ${parseMsg}`,
                         needed: ["valid JSON planned scenarios"]
                     });
+                    emitManualPlanningFallback(`V5 planning JSON had no recoverable scenario array: ${parseMsg}.`);
                     continue;
                 }
                 try {
@@ -2363,6 +2448,7 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                             reason: "V5 planning repair produced only invented scenarios not tied to the original output.",
                             needed: ["valid JSON planned scenarios"]
                         });
+                        emitManualPlanningFallback("V5 planning repair produced no scenario tied to the original response.");
                         continue;
                     }
                     scenarios = tiedBack;
@@ -2381,6 +2467,7 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                         reason: `V5 planning JSON was malformed and could not be repaired: ${repairMsg}`,
                         needed: ["valid JSON planned scenarios"]
                     });
+                    emitManualPlanningFallback(`V5 planning JSON was malformed and repair failed: ${repairMsg}.`);
                     continue;
                 }
             }
@@ -2395,15 +2482,19 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                 const duplicateCount = beforeDuplicateFilter - scenarios.length;
                 if (duplicateCount > 0) {
                     warnings.push(`Dropped ${duplicateCount} already-generated v5 scenario(s) for "${gc.ctx.behavior_title}" during top-up.`);
+                    if (scenarios.length === 0) {
+                        emptyScenarioReason = "V5 planning returned only scenarios already generated for this flow.";
+                    }
                 }
             }
             if (scenarios.length === 0) {
                 missing.push({
                     external_id: behavior.external_id,
                     title: gc.ctx.behavior_title,
-                    reason: "V5 planning returned no missing scenarios.",
+                    reason: emptyScenarioReason,
                     needed: ["a distinct uncovered scenario"]
                 });
+                emitManualPlanningFallback(emptyScenarioReason);
                 continue;
             }
             const remainingSlots = Math.max(1, limit - generated.length);
@@ -2413,36 +2504,6 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
             // with several scenarios, leaving later high-risk behaviors untouched.
             const targetLimit = explicitMulti ? Math.max(1, Math.floor(remainingSlots / remainingTargets)) : remainingSlots;
             const selected = scenarios.slice(0, targetLimit);
-            const manualDraftForScenario = (scenario, reason) => {
-                const manualBody = sanitizeGeneratedBody([
-                    `Scenario: ${scenario.title}`,
-                    ...(scenario.steps && scenario.steps.length
-                        ? ["Steps:", ...scenario.steps.map((st, n) => `  ${n + 1}. ${st}`)]
-                        : []),
-                    ...(scenario.test_data ? [`Test data: ${scenario.test_data}`] : []),
-                    ...(scenario.assertion_targets.length ? [`Expected: ${scenario.assertion_targets.join("; ")}`] : []),
-                    ...(scenario.rationale ? [`Why this test: ${scenario.rationale}`] : []),
-                    "",
-                    `Blocked by: ${reason.split(" — ")[0]}`,
-                    `Fix: ${generatedDraftRemediation(reason)}`
-                ].join("\n"), gc.ctx.source_excerpts, "//").body;
-                return {
-                    id: `${run_id}-t${generated.length + 1}`,
-                    run_id,
-                    title: `${gc.ctx.behavior_title} — ${scenario.title}`,
-                    test_type: gc.ctx.test_layer,
-                    framework_hint: framework,
-                    body: manualBody,
-                    bucket: bucketForV5Scenario(scenario),
-                    prompt_version: PROMPT_VERSION_V5,
-                    grounding: { entity_ids: gc.entityIds, source_refs: [], weak_relationships_used: [] },
-                    weak_evidence_used: false,
-                    target_symbol_external_id: behavior.external_id,
-                    ...(fingerprintOf(behavior) ? { target_fingerprint: fingerprintOf(behavior) } : {}),
-                    runnable: false,
-                    unresolved_reason: reason
-                };
-            };
             const completions = [];
             try {
                 reportProgress(`Generating "${gc.ctx.behavior_title}" [v5 batch: ${selected.length}]…`);

package/dist/local/generate/providers.js

@@ -22,7 +22,7 @@ async function postJson(fetchImpl, url, headers, body, timeoutMs = DEFAULT_TIMEO
         // Map the cryptic AbortError ("This operation was aborted") to an actionable
         // timeout message — the #1 cause is a reasoning model thinking past the cap.
         if (e?.name === "AbortError") {
-            throw new Error(`Model call timed out after ${Math.round(timeoutMs / 1000)}s. Reasoning models (gpt-5/o-series) can spend ` +
+            throw new Error(`Model call timed out after ${Math.round(timeoutMs / 1000)}s. Reasoning or adaptive-thinking models can spend ` +
                 `minutes on hidden reasoning before responding; retry, or try a smaller --limit or a different model.`);
         }
         throw e;
@@ -36,6 +36,8 @@ async function postJson(fetchImpl, url, headers, body, timeoutMs = DEFAULT_TIMEO
 // `temperature`. Used only to SEED the request; the adapter still self-corrects
 // from the API's own error, so this list need not be exhaustive or current.
 const REASONING_MODEL = /(?:gpt-5|^o[0-9]|[-/]o[0-9])/i;
+const RESPONSES_API_MODEL = /^gpt-5\.3-codex(?:-|$)/i;
+const ANTHROPIC_ADAPTIVE_MODEL = /^claude-(?:sonnet-[5-9](?:-|$)|opus-(?:4-(?:7|8)|[5-9])(?:-|$)|fable-[5-9](?:-|$))/i;
 /**
  * Reasoning models spend minutes on hidden reasoning before the (non-streaming)
  * response returns — the 60s default killed live gpt-5 runs mid-generation
@@ -45,7 +47,9 @@ const REASONING_MODEL = /(?:gpt-5|^o[0-9]|[-/]o[0-9])/i;
 const REASONING_TIMEOUT_MS = 600_000;
 /** Per-call timeout: generous for reasoning models, default for the rest. */
 export function providerTimeoutMs(model) {
-    return REASONING_MODEL.test(model) ? REASONING_TIMEOUT_MS : DEFAULT_TIMEOUT_MS;
+    return REASONING_MODEL.test(model) || ANTHROPIC_ADAPTIVE_MODEL.test(model)
+        ? REASONING_TIMEOUT_MS
+        : DEFAULT_TIMEOUT_MS;
 }
 /**
  * From a 400, determine which token param the model actually WANTS. OpenAI's error
@@ -89,6 +93,32 @@ export class OpenAICompatibleProvider {
         const modern = REASONING_MODEL.test(this.cfg.model);
         // Reasoning models spend tokens on hidden reasoning, so give them more room.
         let maxTokens = req.maxTokens ?? (modern ? 4000 : 900);
+        if (RESPONSES_API_MODEL.test(this.cfg.model)) {
+            let retriedLength = false;
+            for (;;) {
+                const data = (await postJson(this.fetchImpl, `${this.cfg.baseUrl}/responses`, { Authorization: `Bearer ${this.cfg.apiKey ?? ""}` }, {
+                    model: this.cfg.model,
+                    instructions: req.system,
+                    input: req.user,
+                    max_output_tokens: maxTokens,
+                    store: false
+                }, providerTimeoutMs(this.cfg.model)));
+                const truncated = data.status === "incomplete" && data.incomplete_details?.reason === "max_output_tokens";
+                if (truncated && !retriedLength) {
+                    retriedLength = true;
+                    maxTokens *= 4;
+                    continue;
+                }
+                if (truncated) {
+                    throw new Error("Model output was truncated at the token limit after one retry; no generated code was accepted.");
+                }
+                return (data.output ?? [])
+                    .flatMap((item) => item.type === "message" ? (item.content ?? []) : [])
+                    .filter((content) => content.type === "output_text")
+                    .map((content) => content.text ?? "")
+                    .join("");
+            }
+        }
         // Seed from the model name, then self-correct from the API's explicit directive.
         let tokenParam = modern ? "max_completion_tokens" : "max_tokens";
         let sendTemperature = !modern;
@@ -177,16 +207,21 @@ export class AnthropicProvider {
         return this.cfg.model;
     }
     async complete(req) {
-        let maxTokens = req.maxTokens ?? 900;
+        const adaptive = ANTHROPIC_ADAPTIVE_MODEL.test(this.cfg.model);
+        let maxTokens = req.maxTokens ?? (adaptive ? 4000 : 900);
+        if (adaptive)
+            maxTokens = Math.max(maxTokens, 4000);
         let retriedLength = false;
         for (;;) {
-            const data = (await postJson(this.fetchImpl, `${this.cfg.baseUrl}/messages`, { "x-api-key": this.cfg.apiKey ?? "", "anthropic-version": "2023-06-01" }, {
+            const body = {
                 model: this.cfg.model,
                 max_tokens: maxTokens,
-                temperature: req.temperature ?? 0.2,
                 system: req.system,
                 messages: [{ role: "user", content: req.user }]
-            }, providerTimeoutMs(this.cfg.model)));
+            };
+            if (!adaptive)
+                body.temperature = req.temperature ?? 0.2;
+            const data = (await postJson(this.fetchImpl, `${this.cfg.baseUrl}/messages`, { "x-api-key": this.cfg.apiKey ?? "", "anthropic-version": "2023-06-01" }, body, providerTimeoutMs(this.cfg.model)));
             if (data.stop_reason === "max_tokens" && !retriedLength) {
                 retriedLength = true;
                 maxTokens *= 4;

package/dist/local/interactive.js

@@ -5,13 +5,15 @@
  */
 export const SUPPORTED_MODELS = {
     openai: [
-        { model: "gpt-4.1", note: "strong general (recommended)" },
+        { model: "gpt-5.3-codex", note: "coding and test generation (recommended)" },
+        { model: "gpt-4.1", note: "strong non-reasoning model" },
         { model: "gpt-4o", note: "fast, multimodal" },
         { model: "gpt-5", note: "reasoning — uses max_completion_tokens" },
         { model: "gpt-4.1-mini", note: "cheap — smoke tests only" }
     ],
     anthropic: [
-        { model: "claude-sonnet-4-6", note: "recommended" },
+        { model: "claude-sonnet-5", note: "default and recommended" },
+        { model: "claude-sonnet-4-6", note: "previous Sonnet fallback" },
         { model: "claude-opus-4-8", note: "deepest reasoning" },
         { model: "claude-haiku-4-5", note: "fast, cheap" }
     ],

package/dist/local/localConfig.js

@@ -76,7 +76,7 @@ export function resolveProviderConfig(env = process.env, override = {}) {
             return null;
         return {
             provider: "openai",
-            model: override.model || env.OPENAI_MODEL || "gpt-4.1",
+            model: override.model || env.OPENAI_MODEL || "gpt-5.3-codex",
             baseUrl: (env.OPENAI_BASE_URL || "https://api.openai.com/v1").replace(/\/+$/, ""),
             apiKey: env.OPENAI_API_KEY
         };
@@ -86,7 +86,7 @@ export function resolveProviderConfig(env = process.env, override = {}) {
             return null;
         return {
             provider: "anthropic",
-            model: override.model || env.ANTHROPIC_MODEL || "claude-sonnet-4-6",
+            model: override.model || env.ANTHROPIC_MODEL || "claude-sonnet-5",
             baseUrl: (env.ANTHROPIC_BASE_URL || "https://api.anthropic.com/v1").replace(/\/+$/, ""),
             apiKey: env.ANTHROPIC_API_KEY
         };

package/dist/local/operations.js

@@ -1658,6 +1658,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
                     ? "Test generation budget is 0 (--generate-limit 0)."
                     : undefined
     };
+    let generationDiagnosticsPath;
     if (!opts.noAuto && opts.ai !== false && generationLimit > 0 && !generationProviderConfigured) {
         generationResult = {
             ...generationResult,
@@ -1678,11 +1679,12 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
                 tests.push(test);
                 generatedTestsByTarget.set(targetId, tests);
             }
-            const targetPlans = rankPriorityGaps(graphForGeneration, {
+            const rankedGenerationGaps = rankPriorityGaps(graphForGeneration, {
                 repoRoot: root,
                 limit: generationLimit,
                 provenIds: provenSymbolIds(graphForGeneration, loadLedger(root))
-            })
+            });
+            const targetPlans = rankedGenerationGaps
                 .map((gap) => {
                 const existingTests = generatedTestsByTarget.get(gap.id) ?? [];
                 return {
@@ -1703,9 +1705,20 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
                 reportProgress(`generate: filling test gaps for ${targetPlans.length} priority flow(s)`, { current: 6, total: 8 });
                 const generatedDrafts = [];
                 const incompleteTargets = [];
+                const diagnosticsStartedAt = deps.clock();
+                const flowDiagnostics = [];
                 for (const target of targetPlans) {
                     let remaining = target.deficit;
                     const existingTitles = target.existingTests.map((test) => test.title);
+                    const flowDiagnostic = {
+                        target_symbol_external_id: target.id,
+                        title: graphForGeneration.nodes.find((node) => node.external_id === target.id)?.title ?? target.id,
+                        existing_tests_before_run: target.existingTests.length,
+                        requested_slots: target.deficit,
+                        attempts: [],
+                        final_tests: target.existingTests.length,
+                        remaining_shortfall: target.deficit
+                    };
                     // A provider can return one accepted scenario when two were requested.
                     // Make at most one bounded follow-up for the remaining slot, carrying
                     // prior titles so the planner cannot silently duplicate the first test.
@@ -1716,20 +1729,40 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
                             limit: remaining,
                             pin_unchanged: false,
                             existing_generated_test_titles: existingTitles,
+                            manual_planning_fallback: attempt === 1,
                             // The offline deterministic stand-in emits the established v2 scaffold; v5 is
                             // a two-phase model planning protocol and must not be selected implicitly for it.
                             prompt_version: opts.promptVersion ?? (deterministicGeneration ? "v2" : "v5")
                         }, providerDeps);
                         const freshForTarget = generated.generated_tests.filter((test) => test.target_symbol_external_id === target.id && !test.pinned);
+                        const manualFallbacks = freshForTarget.filter((test) => test.runnable === false && test.unresolved_reason?.includes("Manual fallback retained")).length;
+                        flowDiagnostic.attempts.push({
+                            attempt: attempt + 1,
+                            provider: generated.model_provider,
+                            model: generated.model_name,
+                            requested_slots: remaining,
+                            persisted_test_intents: freshForTarget.length,
+                            model_planned_tests: freshForTarget.length - manualFallbacks,
+                            runnable_tests: freshForTarget.filter((test) => test.runnable !== false).length,
+                            manual_fallbacks: manualFallbacks,
+                            missing_evidence: generated.missing_evidence.map((item) => ({
+                                reason: redactSecrets(item.reason).slice(0, 2_000),
+                                needed: item.needed.map((needed) => redactSecrets(needed).slice(0, 500))
+                            })),
+                            warnings: generated.warnings.map((warning) => redactSecrets(warning).slice(0, 2_000))
+                        });
                         generatedDrafts.push(...freshForTarget);
                         warnings.push(...generated.warnings.map((w) => `generate: ${w}`));
                         if (freshForTarget.length === 0)
-                            break;
+                            continue;
                         existingTitles.push(...freshForTarget.map((test) => test.title));
                         remaining = Math.max(0, remaining - freshForTarget.length);
                     }
                     if (remaining > 0)
                         incompleteTargets.push(target.id);
+                    flowDiagnostic.final_tests = target.existingTests.length + target.deficit - remaining;
+                    flowDiagnostic.remaining_shortfall = remaining;
+                    flowDiagnostics.push(flowDiagnostic);
                 }
                 const blockers = {};
                 for (const draft of generatedDrafts.filter((test) => test.runnable === false)) {
@@ -1759,6 +1792,25 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
                 };
                 if (generationResult.reason)
                     warnings.push(`generate: ${generationResult.reason}`);
+                const diagnostics = {
+                    schema_version: 1,
+                    started_at: diagnosticsStartedAt,
+                    completed_at: deps.clock(),
+                    expected_flows: rankedGenerationGaps.length,
+                    expected_tests_per_flow: 2,
+                    persisted_test_intents_this_run: generatedDrafts.length,
+                    model_planned_tests_this_run: generatedDrafts.filter((test) => !test.unresolved_reason?.includes("Manual fallback retained")).length,
+                    manual_fallbacks_this_run: generatedDrafts.filter((test) => test.unresolved_reason?.includes("Manual fallback retained")).length,
+                    flows: flowDiagnostics
+                };
+                generationDiagnosticsPath = join(root, WORKSPACE_DIR, "generation-diagnostics.json");
+                try {
+                    writeFileAtomic(generationDiagnosticsPath, JSON.stringify(diagnostics, null, 2) + "\n");
+                }
+                catch (error) {
+                    generationDiagnosticsPath = undefined;
+                    warnings.push(`generation diagnostics not written: ${redactSecrets(error instanceof Error ? error.message : String(error))}`);
+                }
             }
         }
         catch (err) {
@@ -1917,6 +1969,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
         ai_linked: aiLinked,
         behavior_coverage_path: coverageHtml,
         coverage_report_path: coverageReport,
+        generation_diagnostics_path: generationDiagnosticsPath,
         rtm,
         changed,
         gaps,
@@ -1984,6 +2037,7 @@ export async function opGenerate(root, opts = {}, deps = defaultDeps()) {
         input_mode: opts.input_mode,
         prompt_version: opts.prompt_version,
         existing_generated_test_titles: opts.existing_generated_test_titles,
+        manual_planning_fallback: opts.manual_planning_fallback,
         // Persisting lane: a runnable draft for an unchanged target is reused as-is
         // rather than re-bought from the model on every run.
         pin_unchanged: opts.pin_unchanged ?? true

package/dist/local/score/risk.js

@@ -1,3 +1,4 @@
+import { loadRiskConfig, globToRegExp } from "./riskConfig.js";
 import { execFileSync } from "node:child_process";
 const ENTRY_PATH_RE = /(^|\/)(routes?|controllers?|handlers?|jobs?|workers?|processors?|queues?|consumers?|subscribers?|listeners?|server|cmd)\//i;
 const ENTRY_FILE_RE = /(^|\/)[^/]*(controller|handler|route|router|job|processor|worker|queue|consumer|subscriber|listener|command|gateway)\.[^.\/]+$/i;
@@ -311,17 +312,40 @@ const DETECTION_MAP = {
 };
 const NEW_CODE_DAYS = 30;
 const NEW_CODE_SECONDS = NEW_CODE_DAYS * 24 * 60 * 60;
-function computeRawORS(node, depthCtx, incomingRefs, gitChurn, fanOut, detectionTier, firstCommitTs, nowSec) {
+/** Calls that make a defect irreversible: deletes, drops, purges. Matched on the
+ *  LAST segment of a call name, so `t.adminClient.DeleteWorkflowExecution` and a
+ *  local `purgeAll` both count; `deleteButtonLabel` (no call) does not. */
+// `truncate` dropped (time.Truncate is common; DB truncation is rare in app code);
+// `remove` kept but not for listener/handler/attribute/child tails — those detach,
+// they don't destroy data.
+const DESTRUCTIVE_CALL_RE = /^(?:delete(?!d)|purge|drop|forcedelete|destroy)[A-Za-z0-9_]*$/i;
+// `remove*` is only a data sink through a persistence-shaped field; in-memory
+// removals (`pollers.Remove`, `RemoveSpeculativeWorkflowTaskTimeout`) are not.
+const REMOVE_CALL_RE = /^remove(?![A-Za-z0-9_]*(?:listener|handler|observer|callback|attribute|attr|class|child|style|hook|timeout|timer)$)[A-Za-z0-9_]*$/i;
+const PERSISTENCE_FIELD_RE = /(store|client|db|repo|repository|persistence|manager|queue|bucket|index|table|storage|dao)/i;
+const SCHEDULED_ENTRY_NAME_RE = /(^|\.)(run|execute|handle|process|tick|scan)$/i;
+const SCHEDULED_ENTRY_PATH_RE = /(^|\/)(jobs?|workers?|scanners?|scavengers?|cron|schedulers?|processors?|consumers?|reconcil\w*)(\/|$)/i;
+/** A time- or queue-triggered entry: nothing calls it synchronously, nobody waits
+ *  for a response, so a failure is far less likely to be NOTICED. Graph facts only. */
+export function isScheduledEntry(node) {
+    return SCHEDULED_ENTRY_NAME_RE.test(node.title || "") && SCHEDULED_ENTRY_PATH_RE.test(symbolFile(node));
+}
+function computeRawORS(node, depthCtx, incomingRefs, gitChurn, fanOut, detectionTier, firstCommitTs, nowSec, signals = { reachesDestructiveSink: false, scheduledEntry: false }) {
     const isNew = firstCommitTs > 0 && nowSec - firstCommitTs < NEW_CODE_SECONDS;
     const complexity = complexityProxy(node);
     const rawP = gitChurn * 0.35 + fanOut * 0.3 + (isNew ? 15 : 0) + complexity * 0.2;
     const routeWeight = deriveRouteWeight(node);
     const flowDepth = getFlowDepth(node, depthCtx);
     const flowPosition = Math.max(0, 5 - flowDepth);
-    const dataSensitivity = deriveDataSensitivity(node);
+    const dataSensitivity = signals.sensitivityIgnored ? 0 : deriveDataSensitivity(node);
+    // Irreversibility is impact: a bug on a path that reaches a delete/purge cannot be
+    // rolled back. Bounded, additive, graph-derived (Fix C, signal 1).
     const rawI = incomingRefs * 0.3 + routeWeight * 0.3 + flowPosition * 0.2 + dataSensitivity * 0.2;
-    const d = DETECTION_MAP[detectionTier];
-    return { p: rawP, i: rawI, d };
+    // Silence lowers detectability: an unproven behavior that runs on a timer or a
+    // queue fails where no request surfaces it (Fix C, signal 2). Proven stays proven.
+    const silentFactor = signals.scheduledEntry && detectionTier !== "associated" ? 1.25 : 1;
+    const d = DETECTION_MAP[detectionTier] * silentFactor;
+    return { p: rawP, i: rawI, d, reachesDestructiveSink: signals.reachesDestructiveSink, scheduledEntry: signals.scheduledEntry, sensitivityIgnored: signals.sensitivityIgnored };
 }
 function staticTestLinkedIds(graph, candidateIds) {
     const ids = new Set();
@@ -358,7 +382,35 @@ function candidateSignalIds(graph, candidateIds) {
 export function rankRiskGaps(graph, opts = {}) {
     const limit = opts.limit ?? 20;
     const confirmed = confirmedBehaviorIds(graph, opts.provenIds);
-    const symbols = graph.nodes.filter((n) => n.kind === "CodeSymbol" && n.denominator_eligible === true && !n.stale && !confirmed.has(n.external_id));
+    // Fix D: ranking hygiene. Test-support code, bare constants/variables, and trivial
+    // accessors stay in the behavior DENOMINATOR but never compete for a risk slot.
+    const TEST_SUPPORT_PATH_RE = /(^|\/)(testing|testutils?|testhelpers?|fixtures?|mocks?|fakes?)(\/|$)/i;
+    const cfgEarly = loadRiskConfig(opts.repoRoot ?? graph.workspace.root).config.classification;
+    const extraTestSupportRef = cfgEarly.test_support_paths.map(globToRegExp);
+    const rankExcludeRef = cfgEarly.rank_exclude_paths.map(globToRegExp);
+    const ACCESSOR_RE = /(^|\.)(Get|Set|Is|Has)[A-Z][A-Za-z0-9]*$/;
+    const rankEligible = (n) => {
+        const props = (n.properties ?? {});
+        if (TEST_SUPPORT_PATH_RE.test(symbolFile(n)))
+            return false;
+        if (extraTestSupportRef.some((re) => re.test(symbolFile(n))))
+            return false;
+        if (props.symbol_kind === "constant" || props.symbol_kind === "variable")
+            return false;
+        // Go `var x = ...` / `const` / `type` one-liners are minted as "class" with a
+        // 0–2 line span and no body to test: declarations, not behaviors.
+        if (props.symbol_kind === "class" && ((props.end_line ?? 0) - (props.start_line ?? 0)) <= 2)
+            return false;
+        const span = (props.end_line ?? 0) - (props.start_line ?? 0);
+        if (ACCESSOR_RE.test(n.title || "") && span <= 3)
+            return false;
+        if (rankExcludeRef.some((re) => re.test(symbolFile(n))))
+            return false;
+        return true;
+    };
+    const suppressedRef = loadRiskConfig(opts.repoRoot ?? graph.workspace.root).config.overrides.filter((o) => o.action === "suppress");
+    const isSuppressed = (id) => suppressedRef.some((o) => o.symbol === id || globToRegExp(o.symbol).test(id));
+    const symbols = graph.nodes.filter((n) => n.kind === "CodeSymbol" && n.denominator_eligible === true && !n.stale && !confirmed.has(n.external_id) && rankEligible(n) && !isSuppressed(n.external_id));
     const symbolIds = new Set(symbols.map((s) => s.external_id));
     const symbolsByFile = new Map();
     for (const s of symbols) {
@@ -371,6 +423,13 @@ export function rankRiskGaps(graph, opts = {}) {
     }
     const files = [...new Set(symbols.map(symbolFile))];
     const repoRoot = opts.repoRoot ?? graph.workspace.root;
+    const loadedCfg = loadRiskConfig(repoRoot);
+    const cfg = loadedCfg.config;
+    const overrideFor = (id) => cfg.overrides.find((o) => o.symbol === id || globToRegExp(o.symbol).test(id));
+    const extraTestSupport = cfg.classification.test_support_paths.map(globToRegExp);
+    const extraScheduled = cfg.classification.scheduled_entry_paths.map(globToRegExp);
+    const extraSinks = cfg.classification.destructive_sinks.map(globToRegExp);
+    const sensitivityIgnore = cfg.classification.sensitivity_ignore.map(globToRegExp);
     const inputHealth = inspectRiskInputHealth(repoRoot, opts.churnWindow);
     const churnWindow = inputHealth.churnWindow;
     const churnResult = inputHealth.churnAvailable ? gitChurn(repoRoot, files, churnWindow) : { values: new Map(), complete: false };
@@ -428,6 +487,49 @@ export function rankRiskGaps(graph, opts = {}) {
         fanOutTargets.set(e.from_external_id, set);
     }
     const fanOut = new Map(symbols.map((s) => [s.external_id, fanOutTargets.get(s.external_id)?.size ?? 0]));
+    // Fix C signals: destructive reach via CALLS (<=3 hops) to a sink; sinks are symbols
+    // whose own name, or a retained external callee, is a destructive call.
+    const nodeById = new Map(graph.nodes.map((n) => [n.external_id, n]));
+    const lastSeg = (name) => name.split(".").pop() ?? name;
+    // A sink is a destructive call on an EXTERNAL surface — a persistence store, an
+    // admin/service client, a database handle. In-repo methods named `delete` are
+    // not sinks by name alone (CHASM's `Node.delete` is a tree op, not a data loss).
+    // A retained callee is by construction a call through a receiver FIELD to code
+    // the graph could not resolve — i.e. an external surface. That structural fact is
+    // the test; the qualifier's NAME is not (round one's store/client/db vocabulary was
+    // Temporal-shaped and hid inngest's `w.q.DeleteOldQueueSnapshots`).
+    const sinkCallee = (id) => {
+        const n = nodeById.get(id);
+        if (!n)
+            return undefined;
+        const ext = n.properties?.external_callees ?? [];
+        // A receiver FIELD path is `x.field.Method` — no call parentheses before the last
+        // segment. `q.Clock().Now().Truncate` is a chain of return values, not a surface.
+        const viaField = (c) => !c.slice(0, c.lastIndexOf(".")).includes("(");
+        const fieldOf = (c) => c.slice(0, c.lastIndexOf("."));
+        return ext.find((c) => viaField(c) && (DESTRUCTIVE_CALL_RE.test(lastSeg(c)) ||
+            (REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c))) ||
+            extraSinks.some((re) => re.test(lastSeg(c)))));
+    };
+    const isSink = (id) => sinkCallee(id) !== undefined;
+    const reachedSinkFrom = (id, depth, seen) => {
+        const own = sinkCallee(id);
+        if (own)
+            return own;
+        if (depth === 0)
+            return undefined;
+        for (const t of fanOutTargets.get(id) ?? []) {
+            if (seen.has(t))
+                continue;
+            seen.add(t);
+            const hit = reachedSinkFrom(t, depth - 1, seen);
+            if (hit)
+                return hit;
+        }
+        return undefined;
+    };
+    const sinkReached = new Map(symbols.map((s) => [s.external_id, reachedSinkFrom(s.external_id, 2, new Set([s.external_id]))]));
+    const reachesSink = new Map([...sinkReached].map(([k, v]) => [k, v !== undefined]));
     const depthCtx = buildFlowDepthContext(graph);
     const staticLinked = staticTestLinkedIds(graph, symbolIds);
     const candidateLinked = candidateSignalIds(graph, symbolIds);
@@ -460,10 +562,19 @@ export function rankRiskGaps(graph, opts = {}) {
         const git_churn = symbolChurn(s);
         const fan_out = fanOut.get(s.external_id) ?? 0;
         const ts = firstCommitTs.get(file) ?? 0;
-        return computeRawORS(s, depthCtx, incoming_refs, git_churn, fan_out, detectionFor(s.external_id), ts, nowSec);
+        return computeRawORS(s, depthCtx, incoming_refs, git_churn, fan_out, detectionFor(s.external_id), ts, nowSec, {
+            reachesDestructiveSink: cfg.tuning.irreversibility_floor && (reachesSink.get(s.external_id) ?? false),
+            scheduledEntry: cfg.tuning.silence_multiplier && (isScheduledEntry(s) || (SCHEDULED_ENTRY_NAME_RE.test(s.title || "") && extraScheduled.some((re) => re.test(symbolFile(s))))),
+            sensitivityIgnored: sensitivityIgnore.some((re) => re.test(s.title || "") || re.test(s.external_id)) || overrideFor(s.external_id)?.action === "reclassify" && overrideFor(s.external_id)?.sensitivity === "none"
+        });
     });
+    const pinnedIds = new Set(symbols.filter((s) => overrideFor(s.external_id)?.action === "pin").map((s) => s.external_id));
     const pScores = normalizeScores(rawScores.map((r) => r.p));
-    const iScores = normalizeScores(rawScores.map((r) => r.i));
+    const iScoresRaw = normalizeScores(rawScores.map((r) => r.i));
+    // Fix C: a path that can reach a delete/purge has irreversible consequences no
+    // matter how few callers it has. Impact FLOORS at 5/10 for such paths (a floor,
+    // not an increment — an additive bump vanishes under hub-dominated normalization).
+    const iScores = iScoresRaw.map((v, idx) => (rawScores[idx].reachesDestructiveSink ? Math.max(v, 5) : v));
     const ranked = symbols
         .map((s, idx) => {
         const file = symbolFile(s);
@@ -472,7 +583,7 @@ export function rankRiskGaps(graph, opts = {}) {
         const fan_out = fanOut.get(s.external_id) ?? 0;
         const isEntry = entryPoint.get(s.external_id) ?? false;
         const route_weight = deriveRouteWeight(s);
-        const data_sensitivity = deriveDataSensitivity(s);
+        const data_sensitivity = rawScores[idx].sensitivityIgnored ? 0 : deriveDataSensitivity(s);
         const flow_position = Math.max(0, 5 - getFlowDepth(s, depthCtx));
         const complexity_proxy = complexityProxy(s);
         const firstTs = firstCommitTs.get(file) ?? 0;
@@ -507,7 +618,20 @@ export function rankRiskGaps(graph, opts = {}) {
             reasons.push("no callers and no callees — structurally disconnected, score dampened");
         if (detectionTier === "candidate")
             reasons.push("lexical candidate test match only — unconfirmed");
+        // Reason chips for the two consequence signals — a reader can disagree with the
+        // weight without doubting the fact, and the fact is what's shown.
+        if (rawScores[idx].reachesDestructiveSink)
+            reasons.push("reaches a destructive external call (delete/purge) within 2 hops — impact floored at 5");
+        if (rawScores[idx].scheduledEntry)
+            reasons.push("scheduled/queue-triggered entry with no proof — failures surface nowhere, detection ×1.25");
+        const override = overrideFor(s.external_id);
+        if (override && override.action !== "suppress")
+            reasons.push(`config override (${override.action}): ${override.reason}`);
         return {
+            ...(override && override.action !== "suppress" ? { override: { action: override.action, reason: override.reason } } : {}),
+            ...(sinkReached.get(s.external_id) ? { sink_callee: sinkReached.get(s.external_id) } : {}),
+            ...(rawScores[idx].scheduledEntry ? { scheduled_entry: true } : {}),
+            detection_tier: detectionTier,
             id: s.external_id,
             title: s.title || s.external_id,
             file,
@@ -533,8 +657,15 @@ export function rankRiskGaps(graph, opts = {}) {
     // The default API is the true global ranking because reports call this list
     // "top risks". Callers may explicitly request a diversified portfolio, but
     // that presentation policy must never silently redefine rank.
+    const withPins = (list) => {
+        if (pinnedIds.size === 0)
+            return list;
+        const have = new Set(list.map((r) => r.id));
+        const extra = ranked.filter((r) => pinnedIds.has(r.id) && !have.has(r.id));
+        return extra.length ? [...list, ...extra] : list;
+    };
     if (opts.maxPerFile === undefined)
-        return ranked.slice(0, limit);
+        return withPins(ranked.slice(0, limit));
     const maxPerFile = Math.max(1, opts.maxPerFile);
     const perFile = new Map();
     // Multi-program repos flood identical titles (76 x main) across files; the
@@ -576,9 +707,9 @@ export function rankRiskGaps(graph, opts = {}) {
     // Guarantee: the surfaced list is ALWAYS highest-risk-first, even when the
     // per-file diversity backfill re-admits overflow items (which otherwise land
     // appended after lower-scored rows).
-    return surfaced
+    return withPins(surfaced
         .sort((a, b) => b.risk_score - a.risk_score || b.incoming_refs - a.incoming_refs || b.git_churn - a.git_churn || a.id.localeCompare(b.id))
-        .slice(0, limit);
+        .slice(0, limit));
 }
 /**
  * Canonical priority-gap portfolio shown to a local user and used for automatic

package/dist/local/score/riskConfig.js

@@ -0,0 +1,63 @@
+// Per-repo risk configuration — the ONLY levers a repo can pull on scoring.
+//
+// Design rule (see docs): classification and a handful of tuning switches are
+// configurable; evidence tiers, the proof oracle, the formula shape, and raw
+// P/I/D weights are NOT. Every override requires a reason and is surfaced in
+// the report, and the config hash is part of the determinism claim:
+// same commit + same version + same config ⇒ same ranking.
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+export const DEFAULT_RISK_CONFIG = {
+    classification: { test_support_paths: [], scheduled_entry_paths: [], destructive_sinks: [], sensitivity_ignore: [], rank_exclude_paths: [] },
+    tuning: { irreversibility_floor: true, silence_multiplier: true },
+    overrides: []
+};
+function asStringArray(v) {
+    return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+}
+/** Glob → RegExp: `*` matches within a path segment, `**` matches across segments. */
+export function globToRegExp(glob) {
+    const esc = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\u0000").replace(/\*/g, "[^/]*").replace(/\u0000/g, ".*");
+    return new RegExp(`^${esc}$`);
+}
+export function loadRiskConfig(repoRoot) {
+    const warnings = [];
+    const cfg = JSON.parse(JSON.stringify(DEFAULT_RISK_CONFIG));
+    const file = join(repoRoot, ".orangepro", "config.json");
+    if (repoRoot && existsSync(file)) {
+        try {
+            const raw = JSON.parse(readFileSync(file, "utf8"));
+            const cls = (raw.classification ?? {});
+            cfg.classification.test_support_paths = asStringArray(cls.test_support_paths);
+            cfg.classification.scheduled_entry_paths = asStringArray(cls.scheduled_entry_paths);
+            cfg.classification.destructive_sinks = asStringArray(cls.destructive_sinks);
+            cfg.classification.sensitivity_ignore = asStringArray(cls.sensitivity_ignore);
+            cfg.classification.rank_exclude_paths = asStringArray(cls.rank_exclude_paths);
+            const tun = (raw.tuning ?? {});
+            if (typeof tun.irreversibility_floor === "boolean")
+                cfg.tuning.irreversibility_floor = tun.irreversibility_floor;
+            if (typeof tun.silence_multiplier === "boolean")
+                cfg.tuning.silence_multiplier = tun.silence_multiplier;
+            for (const o of Array.isArray(raw.overrides) ? raw.overrides : []) {
+                const ov = o;
+                if (typeof ov.symbol !== "string" || !["suppress", "pin", "reclassify"].includes(ov.action ?? "")) {
+                    warnings.push(`config: override ignored (needs symbol + action): ${JSON.stringify(o).slice(0, 80)}`);
+                    continue;
+                }
+                if (typeof ov.reason !== "string" || ov.reason.trim().length < 8) {
+                    warnings.push(`config: override for ${ov.symbol} ignored — a reason (≥8 chars) is required so it can be shown on the report.`);
+                    continue;
+                }
+                cfg.overrides.push({ symbol: ov.symbol, action: ov.action, sensitivity: ov.sensitivity, reason: ov.reason.trim() });
+            }
+        }
+        catch (err) {
+            warnings.push(`config: .orangepro/config.json unreadable for risk settings (${err.message}); defaults used.`);
+        }
+    }
+    const canonical = JSON.stringify(cfg, Object.keys(cfg).sort());
+    const hash = createHash("sha256").update(JSON.stringify(cfg)).digest("hex").slice(0, 12);
+    void canonical;
+    return { config: cfg, hash, warnings };
+}

package/dist/local/viz/behaviorReportData.js

@@ -1,7 +1,8 @@
+import { loadRiskConfig } from "../score/riskConfig.js";
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { buildRtm } from "../rtm.js";
-import { inspectRiskInputHealth, isEntryPoint, rankPriorityGaps } from "../score/risk.js";
+import { inspectRiskInputHealth, isEntryPoint, rankPriorityGaps, rankRiskGaps } from "../score/risk.js";
 import { ORANGEPRO_VERSION } from "../version.js";
 import { PROOF_BLOCKER_GUIDE } from "../proofDoctor.js";
 import { classifyGeneratedDraftBlocker } from "../generate/draftGuidance.js";
@@ -450,17 +451,49 @@ function riskContext(risk) {
                     : (risk.data_sensitivity ?? 1) >= 3 ? "notification/webhook"
                         : "";
     const pos = (risk.flow_position ?? 0) >= 5
-        ? "an entry point"
+        ? "entry point"
         : (risk.flow_position ?? 0) >= 3
-            ? `${5 - (risk.flow_position ?? 0)} call${5 - (risk.flow_position ?? 0) === 1 ? "" : "s"} from the nearest entry point`
+            ? `${5 - (risk.flow_position ?? 0)} call${5 - (risk.flow_position ?? 0) === 1 ? "" : "s"} from an entry point`
             : "deep in the call graph";
-    const churn = risk.churn_available !== false
-        ? `${risk.git_churn} line${risk.git_churn === 1 ? "" : "s"} changed in 180 days`
-        : "Git churn unavailable (provisional static-only ranking)";
-    const parts = [
-        `Sits at ${pos}${sens ? ` on ${sens} paths` : ""}.`,
-        `ORS ${risk.risk_score} (P${risk.probability ?? "?"} × I${risk.impact ?? "?"} × D${risk.detection_difficulty ?? "?"}) reflects flow position, change activity, complexity, impact, and test evidence; ${risk.fan_out ?? 0} downstream call${(risk.fan_out ?? 0) === 1 ? "" : "s"}, ${churn} — and no test proves this flow.`
+    const sink = risk.sink_callee;
+    const scheduled = risk.scheduled_entry === true;
+    const churnKnown = risk.churn_available !== false;
+    const churn = churnKnown
+        ? (risk.git_churn > 0 ? `${risk.git_churn} line${risk.git_churn === 1 ? "" : "s"} changed in 180 days` : "unchanged in 180 days")
+        : "change history unavailable";
+    const tier = risk.detection_tier ?? "";
+    const evidence = tier === "candidate"
+        ? "no test links here (a similarly-named test exists but never calls it)"
+        : tier === "associated" ? "a test calls it but nothing proves it fails when broken" : "no test links here";
+    const sinkShort = sink ? sink.split(".").pop() ?? sink : "";
+    // Line 1 — the consequence, in plain English, from the signals only.
+    const lead = sink && scheduled
+        ? `Runs on a schedule and can ${sinkShort.toLowerCase().startsWith("purge") ? "purge" : "delete"} data — nothing proves it does the right thing.`
+        : sink
+            ? `Can ${sinkShort.toLowerCase().startsWith("purge") ? "purge" : "delete"} data and nothing proves it works.`
+            : scheduled
+                ? "Runs on a schedule with no proof — a failure here surfaces nowhere."
+                : sens
+                    ? `Sits on ${sens} paths, changes, and nothing proves it.`
+                    : "Reachable and changing, with nothing proving it.";
+    // Line 2 — what the graph saw. Facts only: names, counts, tiers.
+    const seen = [
+        pos + (sens ? ` on ${sens} paths` : ""),
+        ...(sink ? [`reaches \`${sink}\` within two calls`] : []),
+        ...(scheduled ? ["scheduled / queue-triggered"] : []),
+        `${risk.fan_out ?? 0} downstream call${(risk.fan_out ?? 0) === 1 ? "" : "s"}`,
+        churn,
+        evidence
     ];
+    // Line 3 — what would close it: a test SHAPE, never a claim that one exists.
+    const close = sink
+        ? `one test that drives the path to \`${sinkShort}\` and fails when the guard before it is broken.`
+        : scheduled
+            ? "one test that runs this entry against a mutated dependency and fails."
+            : "one test that exercises this behavior and fails when it is mutated.";
+    const scoreWords = `ORS ${risk.risk_score} — ${(risk.probability ?? 0) >= 6 ? "changes often" : (risk.probability ?? 0) >= 3 ? "changes some" : "stable"} (${risk.probability ?? "?"}) × ${sink ? "irreversible" : (risk.impact ?? 0) >= 6 ? "high blast radius" : "moderate impact"} (${risk.impact ?? "?"}) × ${(risk.detection_difficulty ?? 0) >= 9 ? "unproven and silent" : "unproven"} (${risk.detection_difficulty ?? "?"})`;
+    const overrides = (risk.reasons ?? []).filter((r) => r.startsWith("config override"));
+    const parts = [lead, `Seen: ${seen.join(" · ")}.`, `Would close it: ${close}`, ...overrides.map((o) => `${o[0].toUpperCase()}${o.slice(1)}.`), scoreWords + "."];
     return parts.join(" ");
 }
 /** Pure delta between a persisted baseline and the current report data.
@@ -483,13 +516,14 @@ export function computeReportDelta(prev, cur) {
         droppedRisks,
         generatedDelta: cur.generatedTotal - prev.generatedTotal
     };
+    d.configChanged = Boolean(prev.configHash && cur.provenance?.configHash && prev.configHash !== cur.provenance.configHash);
     d.changed =
         d.totalDelta !== 0 || d.provenDelta !== 0 || d.associatedDelta !== 0 || d.candidateDelta !== 0 ||
-            d.noneDelta !== 0 || d.generatedDelta !== 0 || newRisks.length > 0 || droppedRisks.length > 0;
+            d.noneDelta !== 0 || d.generatedDelta !== 0 || newRisks.length > 0 || droppedRisks.length > 0 || d.configChanged;
     return d;
 }
 export function reportBaselineOf(cur, ts) {
-    return { ts, summary: cur.summary, riskPaths: cur.risks.map((r) => r.path), generatedTotal: cur.generatedTotal };
+    return { ts, summary: cur.summary, riskPaths: cur.risks.map((r) => r.path), generatedTotal: cur.generatedTotal, configHash: cur.provenance?.configHash };
 }
 const HTTP_TRIGGER_VERBS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD", "ALL"]);
 const GRAPHQL_TRIGGER_VERBS = new Set(["MUTATION", "QUERY", "SUBSCRIPTION"]);
@@ -892,6 +926,18 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         .filter((row) => row.evidence_tier === "proven" && Boolean(row.code_symbol))
         .map((row) => row.code_symbol));
     const riskGaps = rankPriorityGaps(graph, { repoRoot, limit: opts.riskLimit ?? 20, provenIds });
+    // Two worklists from ONE ranking, no new weights. A multiplicative P×I×D top-N
+    // cannot hold "changing fast, unproven" and "irreversible, stable, unproven" on
+    // the same page: with P=1 for stable code, one family always erases the other
+    // (verified three ways on Temporal). Same rows, two questions.
+    const wide = rankRiskGaps(graph, { repoRoot, limit: 200, provenIds });
+    const changeFrontier = [...wide]
+        .filter((r) => !r.sink_callee)
+        .sort((a, b) => (b.probability ?? 0) - (a.probability ?? 0) || b.risk_score - a.risk_score || a.id.localeCompare(b.id))
+        .slice(0, 20)
+        .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, probability: r.probability ?? 0 }));
+    const irreversible = wide.filter((r) => r.sink_callee).slice(0, 20)
+        .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, sink: r.sink_callee ?? "" }));
     const riskHealth = inspectRiskInputHealth(repoRoot);
     const churnAvailable = riskHealth.churnAvailable && riskGaps.every((risk) => risk.churn_available !== false);
     const provenance = {
@@ -902,6 +948,7 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         churn: churnAvailable ? "available" : "unavailable",
         churnWindow: riskHealth.churnWindow,
         toolVersion: ORANGEPRO_VERSION,
+        configHash: loadRiskConfig(repoRoot).hash,
         inputFingerprint: createHash("sha256")
             .update(JSON.stringify({ root: graph.workspace.root_hash, commit: riskHealth.commit, history: riskHealth.history, churn: churnAvailable, window: riskHealth.churnWindow, version: ORANGEPRO_VERSION }))
             .digest("hex")
@@ -928,6 +975,7 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         flows: flowRows,
         candidateFlows: candidateFlows(graph),
         risks,
+        worklists: { changeFrontier, irreversible },
         zeroProofExplainer: summary.proven === 0 ? { title: ZERO_PROOF_EXPLAINER.title, body: [...ZERO_PROOF_EXPLAINER.body] } : null,
         mapModel: buildSystemMapModel({ flows: flowRows, risks, behaviors: sortedBehaviors }),
         viewMeta: {

package/docs/local-proof-kit.md

@@ -124,6 +124,15 @@ generated test is still marked Proven only when it genuinely kills the null-sent
 via the **unchanged** dynamic-proof oracle. The default path is unchanged (no key required
 for v2/deterministic; existing behavior and CI are untouched).
 
+For v5 generation started through `opro start`, each priority flow gets two bounded
+planning attempts. If the configured model still returns no accepted distinct scenario,
+the report retains deterministic contract and failure-path **manual intents** for the
+missing slots. These are explicitly non-runnable, are never presented as model-generated
+code or proof, and include the redacted planning failure that caused the fallback.
+`.orangepro/generation-diagnostics.json` records each flow's requested slots, attempts,
+accepted model plans, manual fallbacks, and redacted rejection reasons. It never stores
+raw prompts, raw model responses, source code, or provider keys.
+
 Exercise the live v5 loop against a tiny fixture with a keyed smoke:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.34",
+  "version": "0.2.36",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",