@orangepro/orangepro-mcp 0.2.43 → 0.2.45

package/dist/local/autoProve.js

@@ -13,7 +13,7 @@
  * No key ⇒ writes NO files, mints NO proof, returns explicit guidance.
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, dirname, posix, resolve, sep } from "node:path";
+import { basename, dirname, join, posix, relative, resolve, sep } from "node:path";
 import { generateTests, readDeclaredDeps, unresolvedLocalImports } from "./generate/generator.js";
 import { GENERATED_DIR, runHintsFor } from "./generate/runHints.js";
 import { rankRiskGaps } from "./score/risk.js";
@@ -21,12 +21,12 @@ import { resolveProviderConfig } from "./localConfig.js";
 import { buildProvider, DeterministicProvider } from "./generate/providers.js";
 import { resolveContained } from "./reprove/paths.js";
 import { buildRtm } from "./rtm.js";
-import { loadLedger } from "./ledger.js";
+import { loadLedger, proofEdgesFor, targetLanguage } from "./ledger.js";
 import { reportProgress } from "./util/progress.js";
 import { loadGraph, workspacePaths } from "./workspace.js";
 import { systemClock } from "./util/time.js";
 import { redactSecrets } from "./util/redact.js";
-import { classifyBaselineFailure, EXPERIMENTAL_SQLITE_TEST_ENV, IMPORT_TIME_CATEGORIES, isNeedsSetupCategory, readEnginesNode, targetNeedsExperimentalSqlite } from "./proofRunnability.js";
+import { classifyBaselineFailure, EXPERIMENTAL_SQLITE_TEST_ENV, isNeedsSetupCategory, readEnginesNode, targetNeedsExperimentalSqlite } from "./proofRunnability.js";
 /** Real dynamic proof is profile-gated; only wired runner targets are attemptable. */
 function isTsJsFile(file) {
     return /\.[cm]?[jt]sx?$/i.test(file);
@@ -82,7 +82,7 @@ function pytestNodeidsForFile(sourceRoot, testRel) {
         }
         if (currentClass && indent <= classIndent && line.trim() !== "" && !line.startsWith(" "))
             currentClass = null;
-        const fnMatch = /^(\s*)def\s+(test_[A-Za-z0-9_]*)\s*\(/.exec(line);
+        const fnMatch = /^(\s*)(?:async\s+)?def\s+(test_[A-Za-z0-9_]*)\s*\(/.exec(line);
         if (!fnMatch)
             continue;
         const fnIndent = fnMatch[1].length;
@@ -358,13 +358,12 @@ export function javaTestForTarget(nodeById, graph, symId) {
     return selectors.size === 1 ? [...selectors][0] : null;
 }
 const GENERATED_HEADER = "// Generated by OrangePro — do not edit";
-// "Static map first, dynamically prove top 5": ONE unified dynamic-proof budget spans
-// BOTH lanes (existing-tests first, then generation for the remaining eligible gaps).
-// TOTAL attempts (existing + generation) are capped at this budget; `--auto-limit N`
-// overrides it (clamped to MAX_AUTO_LIMIT) for deeper runs (`opro start --auto-limit 25`,
-// `opro prove`, `opro prove-loop`). Static breadth (behaviors/flows/associated/risk) is
-// never gated on this budget — only the dynamic verification pass is.
+// Released v0.2.44 generic dynamic-proof limit. Python's existing-test lane has its
+// own retry limit below; do not widen this generic default or TS/JS, Go, Java, and
+// generated-test scheduling changes before a caller opts in.
 const DEFAULT_AUTO_LIMIT = 5;
+const DEFAULT_PROOF_EXISTING_LIMIT = 20;
+const DEFAULT_PROOF_GEN_LIMIT = 5;
 const MAX_AUTO_LIMIT = 50;
 /** Generator caps a single call at 5 (MAX_LIMIT); page candidates in windows of that. */
 const GEN_WINDOW = 5;
@@ -372,7 +371,73 @@ const GEN_WINDOW = 5;
 // file (every eligible symbol × every importing test) cannot starve the shared budget before
 // a provable hard-edge symbol is tried. Small K; promote to a flag if a repo needs a wider sweep.
 const EXISTING_LANE_MAX_WEAK_PER_SYMBOL = 3;
+const RUNNER_ROOT_MARKERS = {
+    typescript: ["package.json"],
+    javascript: ["package.json"],
+    python: ["pyproject.toml", "setup.cfg", "setup.py", "pytest.ini", ".pytest.ini", "tox.ini"],
+    go: ["go.mod"],
+    java: ["pom.xml", "build.gradle", "build.gradle.kts"],
+    rs: ["Cargo.toml"]
+};
+/**
+ * The nearest language runner root, bounded by the analyzed source root. Python is
+ * test-owned: pytest configuration/environment follows the selected test file even when
+ * that test exercises a target elsewhere in the same repository. Other languages keep
+ * their target-owned v0.2.44 behavior.
+ */
+export function proofRunnerRoot(sourceRoot, targetRel, testRel) {
+    const stop = resolve(sourceRoot);
+    const targetAbs = resolve(stop, targetRel);
+    if (targetAbs !== stop && !targetAbs.startsWith(stop + sep))
+        return ".";
+    const language = targetLanguage(`sym:${targetRel}#target`);
+    const markers = RUNNER_ROOT_MARKERS[language] ?? [];
+    const testFile = testRel?.split("::", 1)[0] ?? testRel;
+    const testAbs = testFile ? resolve(stop, testFile) : undefined;
+    if (language === "python" && testAbs && testAbs !== stop && !testAbs.startsWith(stop + sep))
+        return ".";
+    let dir = dirname(language === "python" && testAbs ? testAbs : targetAbs);
+    let found = stop;
+    for (;;) {
+        if (markers.some((marker) => existsSync(join(dir, marker)))) {
+            found = dir;
+            break;
+        }
+        if (dir === stop)
+            break;
+        const parent = dirname(dir);
+        if (parent === dir || (parent !== stop && !parent.startsWith(stop + sep)))
+            break;
+        dir = parent;
+    }
+    const rel = relative(stop, found).split(sep).join("/");
+    return rel || ".";
+}
+/** Dominant-language order from all denominator-eligible code behaviors. */
+export function proofLanguageOrder(graph) {
+    const counts = new Map();
+    const first = new Map();
+    for (const node of graph.nodes) {
+        if (node.kind !== "CodeSymbol" || node.denominator_eligible !== true)
+            continue;
+        const language = targetLanguage(node.external_id);
+        if (!first.has(language))
+            first.set(language, first.size);
+        counts.set(language, (counts.get(language) ?? 0) + 1);
+    }
+    return [...counts.keys()].sort((a, b) => (counts.get(b) - counts.get(a)) || (first.get(a) - first.get(b)));
+}
 export const NO_KEY_MESSAGE = "No provider key; auto-prove skipped — add OPENAI_API_KEY / ANTHROPIC_API_KEY, or use the OrangePro MCP in your coding agent.";
+/** Only failures proven to apply across a runner project may quarantine its siblings. */
+const PROJECT_WIDE_BLOCKERS = new Set([
+    "engine_mismatch",
+    "tsconfig_missing",
+    "runner_missing",
+    "module_root_missing",
+    "go_package_build_failure",
+    "environment_unavailable",
+    "collection_error"
+]);
 export function isRoastSurvivor(attempt) {
     return attempt.classification === "non_killing" && attempt.mutant_status === "associated_survived";
 }
@@ -434,16 +499,38 @@ function fileReaderFor(root) {
 function classifyProof(result, ctx) {
     if ("status" in result && result.status === "unrunnable") {
         // Setup did not run (env non-event) — nothing was minted, target needs setup.
-        return { classification: "needs_setup", reason: result.reason };
+        const reason = result.reason;
+        const category = /runner binary not found|unsupported or unknown test runner/i.test(reason)
+            ? "runner_missing"
+            : /no go\.mod found|no pom\.xml|no maven or gradle|build\.gradle|no python project root/i.test(reason)
+                ? "module_root_missing"
+                : undefined;
+        return { classification: "needs_setup", reason, category };
     }
     const dyn = result;
     const record = dyn.record;
     if (record.closed)
         return { classification: "proven" };
+    // Language spikes may refuse before a baseline exists (for example, Python's
+    // collection preflight, an explicit project boundary, or a type-unsafe mutation).
+    // These are structured runner outcomes, not a raw-stderr heuristic. Never mint a
+    // proof and never mislabel a mutation refusal as a surviving test.
+    const runnerCategory = dyn.oracle.category;
+    if (runnerCategory === "environment_unavailable" || runnerCategory === "collection_error" || runnerCategory === "project_boundary" || runnerCategory === "mutation_unsupported") {
+        return { classification: "needs_setup", reason: dyn.oracle.reason, category: runnerCategory };
+    }
     const cert = record.dynamic_proof;
     if (cert && cert.baseline_green === false) {
+        const failureSummary = dyn.oracle.baseline?.failureSummary;
+        if (ctx.targetFileRel.endsWith(".go") && /^#\s+\S+/m.test(failureSummary ?? "")) {
+            return {
+                classification: "needs_setup",
+                reason: "The Go package did not compile before the selected test could run.",
+                category: "go_package_build_failure"
+            };
+        }
         const { category, reason } = classifyBaselineFailure({
-            failureSummary: dyn.oracle.baseline?.failureSummary,
+            failureSummary,
             enginesNode: readEnginesNode(ctx.sourceRoot, ctx.targetFileRel),
             runnerNode: ctx.runnerNode ?? process.version
         });
@@ -457,27 +544,53 @@ function mutantStatusOf(result) {
         return "unrunnable";
     return result.record.dynamic_proof?.mutant_status;
 }
-/**
- * R-1 sibling-dedup key: a baseline-red import-time failure is a deterministic property of
- * loading the TARGET FILE with a given runner, independent of which test runs it — so
- * same-file siblings share it. Keyed on the TARGET FILE only (every caller pins runner to
- * undefined): the sole deduped cause is engine_mismatch, a package-level fact both lanes
- * classify against the SAME process.version, so the runner must not be in the key. The old
- * {runner, target file} key split the cache across lanes (lane 1 wrote "auto <file>", the
- * generation lane read "<runner> <file>" -> never matched), silently disabling cross-lane
- * dedup. NEVER merges across different files or a different failure class.
- */
-function dedupKey(runner, targetFileRel) {
-    return `${runner ?? "auto"}\u0000${targetFileRel}`;
+/** A baseline-green target consumes the conservative generated-proof target quota. */
+function baselineGreenOf(result) {
+    if ("status" in result && result.status === "unrunnable")
+        return false;
+    return result.record.dynamic_proof?.baseline_green === true;
 }
-/** A same-file sibling deduped WITHOUT re-running: shares the first attempt's redacted reason. */
-function dedupedAttempt(targetSymbol, testPath, targetFileRel, blocked) {
+function proofDiagnosticsOf(result) {
+    if ("status" in result && result.status === "unrunnable")
+        return {};
+    const cert = result.record.dynamic_proof;
+    if (!cert?.command || !cert.cwd || cert.duration_ms === undefined)
+        return {};
+    return {
+        command: cert.command,
+        cwd: cert.cwd,
+        exit_code: cert.exit_code,
+        duration_ms: cert.duration_ms,
+        failure_class: cert.failure_class,
+        stdout_tail: cert.stdout_tail,
+        stderr_tail: cert.stderr_tail,
+        runner_fallback: cert.runner_fallback
+    };
+}
+function projectBlockKey(language, projectRoot) {
+    return `${language}\u0000${projectRoot}`;
+}
+function projectBlockKeys(language, projectRoot, targetFileRel) {
+    return [
+        projectBlockKey(language, projectRoot),
+        `${projectBlockKey(language, projectRoot)}\u0000package:${dirname(targetFileRel).split(sep).join("/")}`
+    ];
+}
+function classifiedProjectBlockKey(category, language, projectRoot, targetFileRel) {
+    return category === "go_package_build_failure"
+        ? projectBlockKeys(language, projectRoot, targetFileRel)[1]
+        : projectBlockKey(language, projectRoot);
+}
+/** A same-project candidate skipped WITHOUT re-running after a classified project-wide failure. */
+function dedupedAttempt(targetSymbol, testPath, projectRoot, blocked) {
     return {
         target_symbol: targetSymbol,
         test_path: testPath,
         classification: "needs_setup",
-        reason: `${blocked.reason} (shared root cause with a sibling in ${targetFileRel}; not re-run).`,
+        reason: `${blocked.reason} (shared project/toolchain cause in ${blocked.scopeLabel}; not re-run).`,
         category: blocked.category,
+        project_root: projectRoot,
+        blocked_by: blocked.blockedBy,
         deduped: true
     };
 }
@@ -606,17 +719,58 @@ export function existingAssociatedTests(graph, nodeById) {
                     add(symId, testRel, false);
         }
     }
+    // Python proof must have an exact hard edge carrying a test selector. A weak
+    // file relation (or an empty pre-edge set) is not a runnable assertion link.
+    for (const [symId, tests] of out) {
+        if (!isPythonFile(symId.split("#")[0].slice(4)))
+            continue;
+        const preEdges = new Set(proofEdgesFor(graph, symId));
+        const linked = tests.filter((t) => t.hard && !!t.testName && PYTHON_TEST_NODEID_SUFFIX_RE.test(t.testName) && preEdges.has(`test:${t.test}->${symId}`));
+        if (linked.length)
+            out.set(symId, linked);
+        else
+            out.delete(symId);
+    }
     return out;
 }
+function declaredPytestTestpaths(sourceRoot, projectRoot) {
+    const declared = new Set();
+    const root = resolve(sourceRoot, projectRoot);
+    for (const config of ["pyproject.toml", "pytest.ini", ".pytest.ini", "tox.ini", "setup.cfg"]) {
+        let text = "";
+        try {
+            text = readFileSync(join(root, config), "utf8");
+        }
+        catch {
+            continue;
+        }
+        const testpaths = /(?:^|\n)\s*testpaths\s*=\s*([^\n]*(?:\n(?:\s+[^\n#;][^\n]*)?)*)/im.exec(text)?.[1];
+        if (!testpaths)
+            continue;
+        for (const path of testpaths.match(/['"][^'"]+['"]|[^\s,\[\]]+/g) ?? []) {
+            const normalized = path.trim().replace(/^['"]|['"]$/g, "").replace(/^\.\//, "").replace(/\/+$/, "");
+            if (normalized)
+                declared.add(normalized);
+        }
+    }
+    return declared;
+}
+function isInDeclaredPytestTestpath(sourceRoot, projectRoot, testRel, testpaths) {
+    const file = testRel.split("::", 1)[0] ?? testRel;
+    const projectAbs = resolve(sourceRoot, projectRoot);
+    const testAbs = resolve(sourceRoot, file);
+    if (testAbs !== projectAbs && !testAbs.startsWith(projectAbs + sep))
+        return false;
+    const projectTestRel = relative(projectAbs, testAbs).split(sep).join("/");
+    return [...testpaths].some((path) => projectTestRel === path || projectTestRel.startsWith(`${path}/`));
+}
 /**
- * Fix 3 — deterministic hard-first, weak-capped attempt order. Every hard TESTED_BY/COVERS
- * pair precedes ANY weak MAY_* pair (a provable hard-edge symbol is tried before weak fan-out
- * burns the shared budget), and each symbol contributes at most `maxWeakPerSymbol` weak pairs
- * so one hot MAY_RELATE_TO file (its every eligible symbol × every importing test) can't starve
- * the budget. Order within each tier follows the Map's insertion order (graph node/edge order),
- * so the result is deterministic.
+ * Deterministic hard-first, weak-capped attempt order. Python is the sole exception to the
+ * legacy source order: its existing-test retries are ordered by the unpersisted ORS worklist
+ * (including Associated symbols), then direct hard-edge tests, declared pytest `testpaths`, and
+ * original source order. Non-Python entries retain the v0.2.44 queue exactly.
  */
-export function orderExistingAttempts(testsBySymbol, maxWeakPerSymbol = EXISTING_LANE_MAX_WEAK_PER_SYMBOL) {
+export function orderExistingAttempts(testsBySymbol, maxWeakPerSymbol = EXISTING_LANE_MAX_WEAK_PER_SYMBOL, schedule) {
     const hard = [];
     const weak = [];
     for (const [symId, tests] of testsBySymbol) {
@@ -628,7 +782,67 @@ export function orderExistingAttempts(testsBySymbol, maxWeakPerSymbol = EXISTING
                 weak.push({ symId, testRel: t.test, hard: false });
         }
     }
-    return [...hard, ...weak];
+    if (!schedule)
+        return [...hard, ...weak];
+    const rankedPython = rankRiskGaps(schedule.graph, { repoRoot: schedule.sourceRoot, limit: 500, includeAssociated: true });
+    const pythonRank = new Map(rankedPython.map((gap, index) => [gap.id, { score: gap.risk_score, rank: index }]));
+    const decorate = (attempt, index) => {
+        const node = schedule.nodeById.get(attempt.symId);
+        const targetRel = node ? symbolFileOf(node) : attempt.symId.replace(/^sym:/, "").split("#")[0];
+        const python = isPythonFile(targetRel);
+        const risk = pythonRank.get(attempt.symId);
+        const projectRoot = proofRunnerRoot(schedule.sourceRoot, targetRel, attempt.testRel);
+        const pytestTestpaths = python ? declaredPytestTestpaths(schedule.sourceRoot, projectRoot) : new Set();
+        return {
+            ...attempt,
+            language: targetLanguage(attempt.symId),
+            projectRoot,
+            index,
+            python,
+            score: risk?.score ?? Number.NEGATIVE_INFINITY,
+            rank: risk?.rank ?? Number.MAX_SAFE_INTEGER,
+            declaredTestpath: python && isInDeclaredPytestTestpath(schedule.sourceRoot, projectRoot, attempt.testRel, pytestTestpaths)
+        };
+    };
+    const pythonOrsOrder = (attempts) => {
+        const decorated = attempts.map(decorate);
+        return decorated
+            .sort((a, b) => 
+        // Python ORS is primary. Direct hard and pytest-config testpaths are strictly
+        // equal-ORS tie breakers; project grouping deliberately has no precedence.
+        (b.score - a.score)
+            || Number(b.hard) - Number(a.hard)
+            || Number(b.declaredTestpath) - Number(a.declaredTestpath)
+            || (a.index - b.index))
+            .map(({ index: _index, python: _python, score: _score, rank: _rank, declaredTestpath: _declaredTestpath, ...attempt }) => attempt);
+    };
+    const queue = [...hard, ...weak];
+    const python = pythonOrsOrder(queue.filter((attempt) => {
+        const node = schedule.nodeById.get(attempt.symId);
+        return isPythonFile(node ? symbolFileOf(node) : attempt.symId.replace(/^sym:/, "").split("#")[0]);
+    }));
+    if (python.length === 0)
+        return queue;
+    let nextPython = 0;
+    const scheduled = queue.map((attempt) => {
+        const node = schedule.nodeById.get(attempt.symId);
+        const targetRel = node ? symbolFileOf(node) : attempt.symId.replace(/^sym:/, "").split("#")[0];
+        return isPythonFile(targetRel) ? python[nextPython++] : attempt;
+    });
+    const primary = proofLanguageOrder(schedule.graph)[0];
+    return primary ? scheduled.sort((a, b) => Number(targetLanguage(b.symId) === primary) - Number(targetLanguage(a.symId) === primary)) : scheduled;
+}
+/**
+ * Stable scheduling view over the existing ORS-ranked candidate list. This changes
+ * only which runner receives a scarce proof attempt first; it never changes scores,
+ * evidence tiers, or the persisted priority-gap order.
+ */
+export function orderRankedProofCandidates(candidates, graph, sourceRoot) {
+    // Generation was v0.2.44 source-ranking order. Python retries are scheduled separately
+    // in `orderExistingAttempts`; leave this queue untouched for every language.
+    void graph;
+    void sourceRoot;
+    return candidates;
 }
 /**
  * PR 1.5 lane — prove the repo's OWN existing tests, NO provider key. For each eligible
@@ -642,19 +856,26 @@ export function orderExistingAttempts(testsBySymbol, maxWeakPerSymbol = EXISTING
  * — the generation lane gets whatever this lane leaves unspent, so TOTAL attempts
  * (existing + generation) never exceed the budget.
  */
-function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, proveLoop, proveDeps, alreadyProven, importTimeBlocked, budget) {
+function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, proveLoop, proveDeps, alreadyProven, projectBlocked, pythonAttemptLimit, pythonGreenTarget, nonPythonAttemptLimit) {
     const attempts = [];
     const needsSetup = [];
     const provenSymbols = new Set();
     let proven = 0;
     let attempted = 0;
+    let pythonCountedAttempts = 0;
+    let pythonGreenBaselines = 0;
+    let nonPythonCountedAttempts = 0;
+    const pythonPreflightGreen = new Set();
+    const pythonBlockedCounts = new Map();
     const changed = opts.changedFiles && opts.changedFiles.length > 0 ? new Set(opts.changedFiles) : null;
     const reader = fileReaderFor(sourceRoot); // R-2: source scan for the node:sqlite env profile
     // Fix 3: hard TESTED_BY/COVERS pairs first, weak MAY_* pairs after and capped per symbol.
-    const queue = orderExistingAttempts(existingAssociatedTests(graph, nodeById));
-    for (const { symId, testRel, hard, testName } of queue) {
-        if (attempted >= budget)
-            break;
+    const queue = orderExistingAttempts(existingAssociatedTests(graph, nodeById), EXISTING_LANE_MAX_WEAK_PER_SYMBOL, {
+        graph,
+        nodeById,
+        sourceRoot
+    });
+    for (const { symId, testRel, hard, testName, language, projectRoot } of queue) {
         const node = nodeById.get(symId);
         // Redundant with existingAssociatedTests' own filter, but the eligibility barrier is
         // the sole guard against handing plumbing to the guard-less prove path — assert it here too.
@@ -671,20 +892,32 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
         if (provenSymbols.has(symId))
             continue;
         const targetFileRel = symbolFileOf(node);
-        // R-1 sibling dedup: a prior same-file attempt hit a package-level env root cause
-        // (engine_mismatch: runner Node outside the declared engines range). Every sibling in this
-        // file fails baseline identically → mark it
-        // needs_setup WITHOUT re-running (and WITHOUT consuming the attempt budget).
+        const targetLanguageName = language ?? targetLanguage(symId);
+        const runnerRoot = projectRoot ?? proofRunnerRoot(sourceRoot, targetFileRel, testRel);
+        // A prior candidate in this exact runner project hit a classified project-wide
+        // toolchain/environment failure. Preserve the budget and explain the skip.
         const isPython = isPythonFile(targetFileRel);
+        if (isPython ? (pythonCountedAttempts >= pythonAttemptLimit || pythonGreenBaselines >= pythonGreenTarget) : nonPythonCountedAttempts >= nonPythonAttemptLimit)
+            continue;
         const candidateTestRels = isPython
-            ? pytestNodeidsForTarget(sourceRoot, testRel, testName).filter((candidate) => isRunnableTestForTarget(node, candidate))
+            ? (hard && testName && PYTHON_TEST_NODEID_SUFFIX_RE.test(testName) ? [`${testRel}::${testName}`] : []).filter((candidate) => isRunnableTestForTarget(node, candidate))
             : [testRel];
         if (candidateTestRels.length === 0)
             continue;
         const proofTestRel = candidateTestRels[0];
-        const blocked = importTimeBlocked.get(dedupKey(undefined, targetFileRel));
+        const blockedKey = projectBlockKeys(targetLanguageName, runnerRoot, targetFileRel).find((key) => projectBlocked.has(key));
+        const blocked = blockedKey ? projectBlocked.get(blockedKey) : undefined;
         if (blocked) {
-            const attempt = dedupedAttempt(symId, proofTestRel, targetFileRel, blocked);
+            // Python preflight is once per project root. The first classified failure
+            // is already persisted with full diagnostics; siblings are skipped without
+            // becoming fake attempts or thousands of duplicate sidecar rows.
+            if (isPython) {
+                const key = blockedKey;
+                const prior = pythonBlockedCounts.get(key);
+                pythonBlockedCounts.set(key, { count: (prior?.count ?? 0) + 1, block: blocked, root: runnerRoot });
+                continue;
+            }
+            const attempt = dedupedAttempt(symId, proofTestRel, runnerRoot, blocked);
             attempts.push(attempt);
             needsSetup.push(attempt);
             continue;
@@ -710,6 +943,8 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
                 continue;
         }
         attempted++;
+        if (!isPython)
+            nonPythonCountedAttempts++;
         // R-2: inject NODE_OPTIONS=--experimental-sqlite via the existing test_env path when the
         // target references node:sqlite. Makes the baseline runnable only; never mints Proven.
         const testEnv = isGo || isJava || isPython ? undefined : experimentalSqliteTestEnv(reader, targetFileRel);
@@ -726,7 +961,7 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
         let result;
         try {
             result = proveLoop(root, nativeTestRun
-                ? { target_symbol: symId, source: sourceRoot, test_run: nativeTestRun, ...(goAssertionLine !== undefined ? { go_assertion_line: goAssertionLine } : {}), run_id: `auto-prove-existing-${attempted}` }
+                ? { target_symbol: symId, source: sourceRoot, test_run: nativeTestRun, ...(goAssertionLine !== undefined ? { go_assertion_line: goAssertionLine } : {}), run_id: `auto-prove-${attempted}` }
                 // link_node_modules: the isolated proof copy excludes node_modules; without linking,
                 // any target/test importing a repo dependency fails baseline → needs_setup. Linking only
                 // makes real tests runnable — Proven still requires the dynamic oracle's sentinel kill.
@@ -736,29 +971,38 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
                     test_path: proofTestRel,
                     replacement: replacementForTarget(targetFileRel),
                     link_node_modules: true,
+                    ...(isPython ? { skip_preflight: pythonPreflightGreen.has(runnerRoot) } : {}),
                     ...(testEnv ? { test_env: testEnv } : {}),
-                    run_id: `auto-prove-existing-${attempted}`
+                    run_id: `auto-prove-${attempted}`
                 }, proveDeps);
         }
         catch (e) {
-            const attempt = {
-                target_symbol: symId,
-                test_path: displayTest,
-                classification: "needs_setup",
-                reason: `Proof could not run: ${redactSecrets(errMsg(e))}`
-            };
-            attempts.push(attempt);
-            needsSetup.push(attempt);
+            attempted--;
+            if (!isPython)
+                nonPythonCountedAttempts--;
+            reportProgress(`proof skipped: ${symId}: ${redactSecrets(errMsg(e))}`);
             continue;
         }
         const { classification, reason, category } = classifyProof(result, { sourceRoot, targetFileRel });
+        const baselineGreen = baselineGreenOf(result);
+        if (isPython) {
+            const preflightUnavailable = category === "environment_unavailable" || category === "collection_error";
+            if (!preflightUnavailable) {
+                pythonCountedAttempts++;
+                pythonPreflightGreen.add(runnerRoot);
+            }
+            if (baselineGreen)
+                pythonGreenBaselines++;
+        }
         const attempt = {
             target_symbol: symId,
             test_path: displayTest,
             classification,
             reason,
             category,
-            mutant_status: mutantStatusOf(result)
+            project_root: runnerRoot,
+            mutant_status: mutantStatusOf(result),
+            ...proofDiagnosticsOf(result)
         };
         attempts.push(attempt);
         if (classification === "proven") {
@@ -768,14 +1012,31 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
         }
         if (classification === "needs_setup") {
             needsSetup.push(attempt);
-            // Cache an import-time root cause so same-file siblings dedup instead of re-running.
-            if (category && IMPORT_TIME_CATEGORIES.has(category)) {
-                importTimeBlocked.set(dedupKey(undefined, targetFileRel), { category, reason: reason ?? "" });
+            // Quarantine only a classified project-wide root cause. Target/test-specific
+            // red baselines and surviving mutants never suppress siblings.
+            if (category && PROJECT_WIDE_BLOCKERS.has(category)) {
+                const scopeLabel = category === "go_package_build_failure"
+                    ? dirname(targetFileRel).split(sep).join("/") || "."
+                    : runnerRoot;
+                projectBlocked.set(classifiedProjectBlockKey(category, targetLanguageName, runnerRoot, targetFileRel), {
+                    category,
+                    reason: reason ?? "",
+                    blockedBy: symId,
+                    scopeLabel
+                });
             }
         }
         // non_killing → keep trying this symbol's other associated tests, if any.
     }
-    return { attempts, needsSetup, proven, attempted, provenSymbols };
+    const skipped = [...pythonBlockedCounts.values()].map(({ count, block, root }) => ({
+        title: `Python project ${root}`,
+        reason: `${count} remaining linked target${count === 1 ? " was" : "s were"} in a project root marked ${block.category}; no further runner calls were made in that root.`,
+        category: block.category,
+        language: "python",
+        project_root: root,
+        blocked_by: block.blockedBy
+    }));
+    return { attempts, needsSetup, skipped, proven, attempted, nonPythonAttempted: nonPythonCountedAttempts, provenSymbols };
 }
 /**
  * Drive prove for the top provable TS/JS targets. Two lanes: (1) prove the repo's OWN
@@ -810,16 +1071,18 @@ export async function autoProve(root, opts, deps) {
         .filter((r) => r.evidence_tier === "proven")
         .map((r) => r.code_symbol)
         .filter(Boolean));
-    // R-1: shared sibling-dedup cache of import-time baseline failures. Spans BOTH lanes so a
-    // node:sqlite-style root cause found once is never re-run across same-file siblings.
-    const importTimeBlocked = new Map();
-    // ONE unified dynamic-proof budget for the whole pass (existing-first → then generation).
-    // Default 5 ("dynamically prove top 5"); `--auto-limit N` overrides it, clamped to
-    // MAX_AUTO_LIMIT. The existing lane consumes from this budget and the generation lane gets
-    // only the remainder, so TOTAL attempts (existing + generation) are ≤ budget.
+    // Shared, run-local quarantine for classified project-wide toolchain failures.
+    // Keyed by language + bounded runner root; never populated by a test-specific red
+    // baseline, an unknown failure, or a surviving mutant.
+    const projectBlocked = new Map();
+    // R7.1 adds a Python-only existing-test retry lane. Generic/non-Python calls retain
+    // the released `autoLimit`; Python can inspect more existing targets to find
+    // the requested number of baseline-green tests without widening any other language.
     const autoLimit = Math.max(1, Math.min(MAX_AUTO_LIMIT, Math.floor(opts.autoLimit ?? DEFAULT_AUTO_LIMIT)));
+    const existingLimit = Math.max(1, Math.min(MAX_AUTO_LIMIT, Math.floor(opts.proof_existing_limit ?? DEFAULT_PROOF_EXISTING_LIMIT)));
+    const genLimit = Math.max(1, Math.min(MAX_AUTO_LIMIT, Math.floor(opts.proof_gen_limit ?? DEFAULT_PROOF_GEN_LIMIT)));
     // ── Lane 1: existing associated tests — NO key required, runs FIRST (PR 1.5). ──
-    const ex = proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, proveLoop, proveDeps, alreadyProven, importTimeBlocked, autoLimit);
+    const ex = proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, proveLoop, proveDeps, alreadyProven, projectBlocked, existingLimit, genLimit, autoLimit);
     if (opts.existingOnly) {
         const status = ex.proven > 0 ? "proven-run" : ex.attempted > 0 ? "ran-no-proof" : "no-targets";
         return {
@@ -829,7 +1092,7 @@ export async function autoProve(root, opts, deps) {
             attempted: ex.attempted,
             proven: ex.proven,
             needs_setup: ex.needsSetup,
-            skipped: [],
+            skipped: ex.skipped,
             generated_files: [],
             attempts: ex.attempts
         };
@@ -848,7 +1111,7 @@ export async function autoProve(root, opts, deps) {
             attempted: ex.attempted,
             proven: ex.proven,
             needs_setup: ex.needsSetup,
-            skipped: [],
+            skipped: ex.skipped,
             generated_files: [],
             attempts: ex.attempts
         };
@@ -856,9 +1119,9 @@ export async function autoProve(root, opts, deps) {
     const provider = deterministic ? new DeterministicProvider() : buildProvider(providerConfig);
     const generate = deps.generate ?? generateTests;
     const reader = fileReaderFor(sourceRoot);
-    // Generation gets only the budget the existing-tests lane left unspent, so existing +
-    // generation attempts total ≤ autoLimit. Exhausted budget ⇒ genBudget 0 ⇒ no provider call.
-    const genBudget = Math.max(0, autoLimit - ex.attempted);
+    // Generated proofs retain the released generic limit. Python's green-target cap
+    // applies only to existing-test retries above, not to non-Python generation.
+    const generationLimit = Math.max(0, autoLimit - ex.nonPythonAttempted);
     // Candidates = ORS-ranked provable CodeSymbols. rankRiskGaps ranks by OrangePro Risk
     // Score and excludes hard-confirmed symbols; we ALSO enforce the eligibility barrier
     // explicitly (isEligibleProvableTarget) at selection so an excluded infra symbol can
@@ -872,6 +1135,7 @@ export async function autoProve(root, opts, deps) {
         const changed = new Set(opts.changedFiles);
         candidates = candidates.filter((g) => changed.has(g.file));
     }
+    candidates = orderRankedProofCandidates(candidates, graph, sourceRoot);
     const attempts = [];
     const needsSetup = [];
     const skipped = [];
@@ -879,16 +1143,17 @@ export async function autoProve(root, opts, deps) {
     const declaredDeps = readDeclaredDeps(sourceRoot);
     let proven = 0;
     let attempted = 0;
-    for (let start = 0; start < candidates.length && attempted < genBudget; start += GEN_WINDOW) {
+    let baselineGreenTargets = 0;
+    for (let start = 0; start < candidates.length && attempted < autoLimit && baselineGreenTargets < generationLimit; start += GEN_WINDOW) {
         const window = candidates.slice(start, start + GEN_WINDOW);
-        const need = genBudget - attempted;
+        const need = Math.max(1, Math.min(GEN_WINDOW, generationLimit - baselineGreenTargets));
         const windowIds = window.map((g) => g.id);
         const gen = await generate(graph, { target_ids: windowIds, limit: Math.min(windowIds.length, need), ...(opts.prompt_version ? { prompt_version: opts.prompt_version } : {}) }, provider, reader, clock);
         const tests = gen.generated_tests;
         // Global start offset so filenames stay unique across windows — runHintsFor
         // otherwise resets its index to 0 per window and same-slug targets collide.
         const hints = runHintsFor(tests, sourceRoot, start);
-        for (let i = 0; i < tests.length && attempted < genBudget; i++) {
+        for (let i = 0; i < tests.length && attempted < autoLimit && baselineGreenTargets < generationLimit; i++) {
             const test = tests[i];
             const hint = hints[i];
             if (!hint.prove_run) {
@@ -917,14 +1182,24 @@ export async function autoProve(root, opts, deps) {
             }
             const { target_symbol, replacement, runner } = hint.prove_run.args;
             const targetFileRel = symbolFile(target_symbol);
-            // R-1 sibling dedup (cross-lane): a same-file target already hit an import-time env root
-            // cause → a fresh generated test importing the same module fails identically. Skip it
-            // WITHOUT generating/writing/running or consuming the attempt budget.
-            const blocked = importTimeBlocked.get(dedupKey(undefined, targetFileRel));
+            const language = targetLanguage(target_symbol);
+            const projectRoot = proofRunnerRoot(sourceRoot, targetFileRel);
+            // Cross-lane quarantine: a classified project-wide runner failure already
+            // explains why this generated candidate cannot run. Skip without spending budget.
+            const blockedKey = projectBlockKeys(language, projectRoot, targetFileRel).find((key) => projectBlocked.has(key));
+            const blocked = blockedKey ? projectBlocked.get(blockedKey) : undefined;
             if (blocked) {
-                const attempt = dedupedAttempt(target_symbol, "", targetFileRel, blocked);
+                const attempt = dedupedAttempt(target_symbol, "", projectRoot, blocked);
                 attempts.push(attempt);
                 needsSetup.push(attempt);
+                skipped.push({
+                    target_symbol,
+                    title: test.title,
+                    reason: attempt.reason ?? "Skipped after a project-wide proof failure.",
+                    language,
+                    project_root: projectRoot,
+                    blocked_by: blocked.blockedBy
+                });
                 continue;
             }
             const filename = basename(hint.prove_run.args.test_path);
@@ -976,18 +1251,12 @@ export async function autoProve(root, opts, deps) {
                     // See lane 1: link node_modules so a generated test importing a repo dep can boot.
                     link_node_modules: true,
                     ...(testEnv ? { test_env: testEnv } : {}),
-                    run_id: `auto-prove-${start + i + 1}`
+                    run_id: `auto-prove-${ex.attempted + attempted}`
                 }, proveDeps);
             }
             catch (e) {
-                const attempt = {
-                    target_symbol,
-                    test_path: writeRel,
-                    classification: "needs_setup",
-                    reason: `Proof could not run: ${redactSecrets(errMsg(e))}`
-                };
-                attempts.push(attempt);
-                needsSetup.push(attempt);
+                attempted--;
+                skipped.push({ target_symbol, title: test.title, reason: `Proof could not run: ${redactSecrets(errMsg(e))}`, language, project_root: projectRoot });
                 continue;
             }
             const { classification, reason, category } = classifyProof(result, { sourceRoot, targetFileRel });
@@ -997,16 +1266,27 @@ export async function autoProve(root, opts, deps) {
                 classification,
                 reason,
                 category,
-                mutant_status: mutantStatusOf(result)
+                project_root: projectRoot,
+                mutant_status: mutantStatusOf(result),
+                ...proofDiagnosticsOf(result)
             };
             attempts.push(attempt);
+            if (baselineGreenOf(result))
+                baselineGreenTargets++;
             if (classification === "proven")
                 proven++;
             else if (classification === "needs_setup") {
                 needsSetup.push(attempt);
-                // Cache an import-time root cause so same-file siblings dedup instead of re-running.
-                if (category && IMPORT_TIME_CATEGORIES.has(category)) {
-                    importTimeBlocked.set(dedupKey(undefined, targetFileRel), { category, reason: reason ?? "" });
+                if (category && PROJECT_WIDE_BLOCKERS.has(category)) {
+                    const scopeLabel = category === "go_package_build_failure"
+                        ? dirname(targetFileRel).split(sep).join("/") || "."
+                        : projectRoot;
+                    projectBlocked.set(classifiedProjectBlockKey(category, language, projectRoot, targetFileRel), {
+                        category,
+                        reason: reason ?? "",
+                        blockedBy: target_symbol,
+                        scopeLabel
+                    });
                 }
             }
             // non_killing stays in `attempts` only — an honest skip, never Proven.
@@ -1025,7 +1305,7 @@ export async function autoProve(root, opts, deps) {
         attempted: totalAttempted,
         proven: totalProven,
         needs_setup: [...ex.needsSetup, ...needsSetup],
-        skipped,
+        skipped: [...ex.skipped, ...skipped],
         generated_files: generatedFiles,
         attempts: [...ex.attempts, ...attempts]
     };