@orangepro/orangepro-mcp 0.2.44 → 0.2.46

package/dist/local/score/risk.js

@@ -1,5 +1,9 @@
 import { loadRiskConfig, globToRegExp } from "./riskConfig.js";
 import { execFileSync } from "node:child_process";
+import { readFileSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Worker } from "node:worker_threads";
 import { hashString } from "../util/hash.js";
 import { builtInRankExclusion } from "./rankEligibility.js";
 /** Explicit scorer identity. Formula changes require a new value. */
@@ -74,13 +78,150 @@ function confirmedBehaviorIds(graph, provenIds) {
     }
     return ids;
 }
-const GIT_CHURN_BATCH = 200;
+/** Default bounds for repository-wide history acquisition (overridable via
+ *  tuning.churn_max_commits / tuning.churn_timeout_seconds, always disclosed).
+ *  Sized so an active monorepo's full 180-day window completes (a 5,000-commit /
+ *  60 s bound truncated windows that 0.2.44 scanned completely). */
+export const GIT_CHURN_MAX_COMMITS = 20_000;
+export const GIT_CHURN_TIMEOUT_MS = 300_000;
+const GIT_FIRST_COMMIT_BATCH = 200;
+/**
+ * This worker intentionally uses spawn, not execFileSync: stdout is parsed as it
+ * arrives, so a time bound returns the values already observed instead of erasing
+ * completed chunks. It keeps one counter per path the window touched (bounded by
+ * the window, not by total history) so a single scan serves every caller. The scoring API
+ * is synchronous, therefore the worker signals only after writing its result file.
+ */
+const GIT_CHURN_WORKER_SOURCE = String.raw `
+const { spawn } = require("node:child_process");
+const { writeFileSync } = require("node:fs");
+const { workerData } = require("node:worker_threads");
+const state = new Int32Array(workerData.signal);
+const values = new Map();
+const trackedFiles = Array.isArray(workerData.files) ? new Set(workerData.files) : null;
+let commitsScanned = 0;
+let commitLimitReached = false;
+let expectingTimestamp = false;
+let renameRecord = null;
+let renameOldPath = null;
+let remainder = "";
+let stderr = "";
+let done = false;
+let timedOut = false;
+let timer;
+let child;
+let childClosed = false;
+const firstLine = (text) => String(text || "").split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "";
+const add = (path, adds, dels) => {
+  if (!path || commitLimitReached || (trackedFiles && !trackedFiles.has(path))) return;
+  values.set(path, (values.get(path) || 0) + adds + dels);
+};
+const consume = (token) => {
+  if (renameRecord) {
+    // Git numstat -z represents a rename as an empty-path record followed by
+    // the old path and then the new path. Attribute churn to the current path.
+    if (renameOldPath === null) {
+      renameOldPath = token;
+      return;
+    }
+    add(token, renameRecord.adds, renameRecord.dels);
+    renameRecord = null;
+    renameOldPath = null;
+    return;
+  }
+  if (/^[0-9a-f]{40}$/i.test(token)) { expectingTimestamp = true; return; }
+  if (expectingTimestamp && /^\d+$/.test(token)) {
+    expectingTimestamp = false;
+    if (commitsScanned >= workerData.maxCommits) {
+      commitLimitReached = true;
+      if (child) child.kill("SIGTERM");
+      return;
+    }
+    commitsScanned++;
+    return;
+  }
+  const match = token.replace(/^\n/, "").match(/^(-|\d+)\t(-|\d+)\t([\s\S]*)$/);
+  if (!match) return;
+  const adds = match[1] === "-" ? 0 : Number(match[1]);
+  const dels = match[2] === "-" ? 0 : Number(match[2]);
+  if (match[3] === "") { renameRecord = { adds, dels }; renameOldPath = null; return; }
+  add(match[3], adds, dels);
+};
+const finish = (stateName, reason) => {
+  if (done) return;
+  done = true;
+  if (timer) clearTimeout(timer);
+  try {
+    writeFileSync(workerData.resultPath, JSON.stringify({ state: stateName, reason, commitsScanned, values: [...values].sort(([a], [b]) => a.localeCompare(b)) }));
+  } finally {
+    Atomics.store(state, 0, 1);
+    Atomics.notify(state, 0);
+  }
+};
+const stopChild = (signal) => {
+  if (!child || childClosed) return;
+  try { child.kill(signal); } catch {}
+};
+// The parent terminates this worker after consuming the bounded handoff. Make
+// sure an unresponsive git child cannot survive that termination.
+process.on("exit", () => stopChild("SIGKILL"));
+try {
+  child = spawn("git", ["log", "--no-merges", "--numstat", "--format=%H%x00%ct", "-z", "--since=" + workerData.window, "--max-count=" + (workerData.maxCommits + 1)], {
+    cwd: workerData.root,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+} catch (error) {
+  finish("unavailable", error && error.code === "ENOENT" ? "git_missing" : "error:" + firstLine(error && error.message));
+}
+timer = setTimeout(() => {
+  timedOut = true;
+  stopChild("SIGTERM");
+  setTimeout(() => finish("partial", "timeout"), 100).unref();
+}, workerData.timeoutMs);
+if (child) {
+  child.stdout.on("data", (chunk) => {
+    remainder += chunk.toString("utf8");
+    let nul;
+    while ((nul = remainder.indexOf("\0")) >= 0) {
+      consume(remainder.slice(0, nul));
+      remainder = remainder.slice(nul + 1);
+    }
+  });
+  child.stderr.on("data", (chunk) => { if (stderr.length < 4096) stderr += chunk.toString("utf8"); });
+  child.on("error", (error) => finish("unavailable", error && error.code === "ENOENT" ? "git_missing" : "error:" + firstLine(error && error.message)));
+  child.on("close", (code) => {
+    childClosed = true;
+    if (remainder) consume(remainder);
+    if (timedOut) return finish("partial", "timeout");
+    if (commitLimitReached) return finish("partial", "commit_limit");
+    if (code === 0) return finish(workerData.cloneState === "full" ? "complete" : "partial", workerData.cloneState === "shallow" ? "shallow clone: churn based on " + commitsScanned + " commits" : workerData.cloneState === "partial" ? "partial clone: churn based on " + commitsScanned + " commits" : undefined);
+    finish(commitsScanned > 0 ? "partial" : "unavailable", "error:" + (firstLine(stderr) || "git log exited " + code));
+  });
+}
+`;
+const historyCache = new Map();
+function firstErrorLine(error) {
+    const e = error;
+    const raw = e.stderr ? String(e.stderr) : e.message;
+    return raw.split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "unknown Git error";
+}
+function unavailableHealth(root, churnWindow, error) {
+    const e = error;
+    const line = firstErrorLine(error);
+    const reason = e.code === "ENOENT"
+        ? "git_missing"
+        : /not a git repository/i.test(line)
+            ? "not_a_git_repo"
+            : `error:${line}`;
+    return { sourceRoot: root ?? null, gitRoot: null, commit: null, commitDate: null, history: "unavailable", churnWindow, churnState: "unavailable", churnAvailable: false, reason };
+}
 export function inspectRiskInputHealth(root, churnWindow) {
-    const unavailableWindow = churnWindow ?? "180 days before HEAD";
+    const configuredDays = loadRiskConfig(root ?? "").config.tuning.churn_window_days;
+    const unavailableWindow = churnWindow ?? `${configuredDays} days before HEAD`;
     if (!root)
-        return { sourceRoot: null, gitRoot: null, commit: null, commitDate: null, history: "unavailable", churnWindow: unavailableWindow, churnAvailable: false, reason: "source root unavailable" };
+        return { sourceRoot: null, gitRoot: null, commit: null, commitDate: null, history: "unavailable", churnWindow: unavailableWindow, churnState: "unavailable", churnAvailable: false, reason: "not_a_git_repo" };
     try {
-        const gitRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim();
+        const gitRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 4000 }).trim();
         const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim();
         const commitDate = execFileSync("git", ["show", "-s", "--format=%cI", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim();
         const shallow = execFileSync("git", ["rev-parse", "--is-shallow-repository"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim() === "true";
@@ -94,7 +235,7 @@ export function inspectRiskInputHealth(root, churnWindow) {
             // A normal full clone has no promisor-remote configuration.
         }
         const commitMs = Date.parse(commitDate);
-        const resolvedWindow = churnWindow ?? (Number.isFinite(commitMs) ? new Date(commitMs - 180 * 24 * 60 * 60 * 1000).toISOString() : unavailableWindow);
+        const resolvedWindow = churnWindow ?? (Number.isFinite(commitMs) ? new Date(commitMs - configuredDays * 24 * 60 * 60 * 1000).toISOString() : unavailableWindow);
         return {
             sourceRoot: root,
             gitRoot,
@@ -102,59 +243,90 @@ export function inspectRiskInputHealth(root, churnWindow) {
             commitDate,
             history: shallow ? "shallow" : partial ? "partial" : "full",
             churnWindow: resolvedWindow,
+            churnState: shallow || partial ? "partial" : "complete",
             churnAvailable: !shallow && !partial,
             reason: shallow
-                ? "shallow Git history cannot support a complete churn window"
+                ? "shallow clone: churn based on available history"
                 : partial
-                    ? "partial-clone Git objects cannot guarantee a complete offline churn window"
+                    ? "partial clone: churn based on available history"
                     : undefined
         };
     }
-    catch {
-        return { sourceRoot: root, gitRoot: null, commit: null, commitDate: null, history: "unavailable", churnWindow: unavailableWindow, churnAvailable: false, reason: "Git history could not be read from the analyzed source root" };
+    catch (error) {
+        return unavailableHealth(root, unavailableWindow, error);
     }
 }
-function gitChurn(root, files, window) {
-    const out = new Map();
-    if (!root || files.length === 0)
-        return { values: out, complete: Boolean(root) };
-    for (let i = 0; i < files.length; i += GIT_CHURN_BATCH) {
-        const batch = files.slice(i, i + GIT_CHURN_BATCH);
-        try {
-            const stdout = execFileSync("git", ["log", `--since=${window}`, "--numstat", "--", ...batch], {
-                cwd: root,
-                encoding: "utf8",
-                stdio: ["ignore", "pipe", "ignore"],
-                timeout: 4000,
-                maxBuffer: 2_000_000
-            });
-            for (const line of stdout.split("\n")) {
-                const m = line.match(/^(\d+|-)\s+(\d+|-)\s+(.+)$/);
-                if (!m)
-                    continue;
-                const adds = m[1] === "-" ? 0 : Number(m[1]);
-                const dels = m[2] === "-" ? 0 : Number(m[2]);
-                out.set(m[3], (out.get(m[3]) ?? 0) + adds + dels);
+function gitChurn(root, files, window, health = inspectRiskInputHealth(root, window)) {
+    const empty = { values: new Map(), state: "unavailable", commitsScanned: 0, reason: health.reason };
+    if (!root || health.churnState === "unavailable")
+        return empty;
+    // Values are retained only for the requested paths, so that set and clone
+    // state are part of cache identity. A checkout can be marked partial at an
+    // unchanged HEAD and must then remain truthfully provisional.
+    const requested = new Set(files);
+    const tuning = loadRiskConfig(root).config.tuning;
+    const maxCommits = tuning.churn_max_commits ?? GIT_CHURN_MAX_COMMITS;
+    const timeoutMs = (tuning.churn_timeout_seconds ?? GIT_CHURN_TIMEOUT_MS / 1000) * 1000;
+    // ONE bounded scan per repository state: values are kept for every path the
+    // window touched and filtered per caller, so the ranking, the report header and
+    // the static snapshot never each pay for (and each time out on) the same scan.
+    const key = `${health.gitRoot ?? root}\0${health.commit ?? ""}\0${health.history}\0${window}\0${maxCommits}\0${timeoutMs}`;
+    const cached = historyCache.get(key);
+    if (cached)
+        return { ...cached, values: new Map([...cached.values].filter(([file]) => requested.has(file))) };
+    const dir = mkdtempSync(join(tmpdir(), "orangepro-churn-"));
+    const resultPath = join(dir, "result.json");
+    const signal = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
+    const state = new Int32Array(signal);
+    let parsed;
+    try {
+        const worker = new Worker(GIT_CHURN_WORKER_SOURCE, {
+            eval: true,
+            workerData: {
+                root,
+                window,
+                files: null,
+                maxCommits,
+                timeoutMs,
+                cloneState: health.history,
+                resultPath,
+                signal
             }
-        }
-        catch {
-            return { values: new Map(), complete: false };
-        }
+        });
+        // The worker publishes a partial result 100ms after its child timeout; leave
+        // explicit scheduling room before the synchronous API forces it down.
+        Atomics.wait(state, 0, 0, timeoutMs + 2_000);
+        if (Atomics.load(state, 0) === 1)
+            parsed = JSON.parse(readFileSync(resultPath, "utf8"));
+        void worker.terminate().catch(() => undefined);
+    }
+    catch (error) {
+        parsed = { state: "unavailable", reason: `error:${firstErrorLine(error)}`, commitsScanned: 0, values: [] };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
     }
-    return { values: out, complete: true };
+    const full = parsed
+        ? { state: parsed.state, reason: parsed.reason, commitsScanned: parsed.commitsScanned, values: new Map(parsed.values) }
+        : { state: "partial", reason: "timeout", commitsScanned: 0, values: new Map() };
+    historyCache.set(key, full);
+    // Defense in depth: a malformed worker payload may never score an unrequested path.
+    return { ...full, values: new Map([...full.values].filter(([file]) => requested.has(file))) };
 }
+/** Preserve the released ORS `is_new_code` input. This is separate from the
+ * recent-churn window because a file's first add may predate that window. */
 function gitFirstCommitBatch(root, files) {
     const out = new Map();
     if (!root || files.length === 0)
         return out;
-    for (let i = 0; i < files.length; i += GIT_CHURN_BATCH) {
-        const batch = files.slice(i, i + GIT_CHURN_BATCH);
+    for (let i = 0; i < files.length; i += GIT_FIRST_COMMIT_BATCH) {
+        const batch = files.slice(i, i + GIT_FIRST_COMMIT_BATCH);
         try {
             const stdout = execFileSync("git", ["log", "--diff-filter=A", "--reverse", "--format=format:%ct", "--name-only", "--", ...batch], {
                 cwd: root,
                 encoding: "utf8",
                 stdio: ["ignore", "pipe", "ignore"],
-                timeout: 4000,
+                timeout: 4_000,
                 maxBuffer: 2_000_000
             });
             let currentTs = 0;
@@ -169,30 +341,33 @@ function gitFirstCommitBatch(root, files) {
                     currentTs = ts;
                     continue;
                 }
-                if (currentTs > 0 && !out.has(trimmed)) {
+                if (currentTs > 0 && !out.has(trimmed))
                     out.set(trimmed, currentTs);
-                }
             }
         }
         catch {
-            continue;
+            // Preserve the released fail-closed behavior for this optional ORS signal.
         }
     }
     return out;
 }
+/** Repository-level acquisition metadata for report/provenance callers. */
+export function inspectRiskChurn(root, files, churnWindow) {
+    const health = inspectRiskInputHealth(root, churnWindow);
+    const result = gitChurn(root, files, health.churnWindow, health);
+    return { state: result.state, reason: result.reason, commitsScanned: result.commitsScanned };
+}
 /** Exact deterministic identity of the Git-derived inputs consumed by ORS. */
 export function riskHistoryFingerprint(root, files, churnWindow) {
     const health = inspectRiskInputHealth(root, churnWindow);
     const sortedFiles = [...new Set(files)].sort();
-    if (!health.churnAvailable) {
-        return hashString(JSON.stringify({ state: health.history, window: health.churnWindow, available: false }));
-    }
-    const churn = gitChurn(root, sortedFiles, health.churnWindow);
-    const first = churn.complete ? gitFirstCommitBatch(root, sortedFiles) : new Map();
+    const churn = gitChurn(root, sortedFiles, health.churnWindow, health);
+    const first = churn.state === "complete" ? gitFirstCommitBatch(root, sortedFiles) : new Map();
     return hashString(JSON.stringify({
-        state: health.history,
+        state: churn.state,
         window: health.churnWindow,
-        available: churn.complete,
+        reason: churn.reason,
+        commits_scanned: churn.commitsScanned,
         churn: sortedFiles.map((file) => [file, churn.values.get(file) ?? 0]),
         first_commit: sortedFiles.map((file) => [file, first.get(file) ?? 0])
     }));
@@ -352,6 +527,10 @@ const IMPORTED_REPLACEMENT_CALL_RE = /^replace[A-Za-z0-9_]*$/i;
 // removals (`pollers.Remove`, `RemoveSpeculativeWorkflowTaskTimeout`) are not.
 const REMOVE_CALL_RE = /^remove(?![A-Za-z0-9_]*(?:listener|handler|observer|callback|attribute|attr|class|child|style|hook|timeout|timer)$)[A-Za-z0-9_]*$/i;
 const PERSISTENCE_FIELD_RE = /(store|client|db|repo|repository|persistence|manager|queue|bucket|index|table|storage|dao)/i;
+// The browser Web Storage API (`sessionStorage` / `localStorage`, optionally via
+// `window.`) is a per-tab/per-device client cache, not a durable data store. Its
+// `removeItem` matches the persistence vocabulary ("storage") by name only.
+const BROWSER_WEB_STORAGE_FIELD_RE = /(^|\.)(sessionStorage|localStorage)$/;
 const SCHEDULED_ENTRY_NAME_RE = /(^|\.)(run|execute|handle|process|tick|scan)$/i;
 const SCHEDULED_ENTRY_PATH_RE = /(^|\/)(jobs?|workers?|scanners?|scavengers?|cron|schedulers?|processors?|consumers?|reconcil\w*)(\/|$)/i;
 /** A time- or queue-triggered entry: nothing calls it synchronously, nobody waits
@@ -446,8 +625,8 @@ export function rankRiskGaps(graph, opts = {}) {
     // worklist but do not rescale an unchanged peer.
     const normalizationSymbols = graph.nodes.filter((n) => n.kind === "CodeSymbol" && n.denominator_eligible === true && !n.stale && rankEligible(n) && !isSuppressed(n.external_id));
     const symbols = normalizationSymbols.filter((n) => !confirmed.has(n.external_id));
-    const worklistSymbols = symbols.filter((n) => n.properties.ranking_exclusion_reason !== "python_structural_container");
     const symbolIds = new Set(normalizationSymbols.map((s) => s.external_id));
+    const fileBySymbolId = new Map(normalizationSymbols.map((s) => [s.external_id, symbolFile(s)]));
     const symbolsByFile = new Map();
     for (const s of normalizationSymbols) {
         const file = symbolFile(s);
@@ -467,36 +646,60 @@ export function rankRiskGaps(graph, opts = {}) {
     const sensitivityIgnore = cfg.classification.sensitivity_ignore.map(globToRegExp);
     const inputHealth = inspectRiskInputHealth(repoRoot, opts.churnWindow);
     const churnWindow = inputHealth.churnWindow;
-    const churnResult = inputHealth.churnAvailable ? gitChurn(repoRoot, files, churnWindow) : { values: new Map(), complete: false };
+    const churnResult = gitChurn(repoRoot, files, churnWindow, inputHealth);
     const churn = churnResult.values;
-    const churnAvailable = inputHealth.churnAvailable && churnResult.complete;
+    const churnAvailable = churnResult.state === "complete";
     const firstCommitTs = churnAvailable ? gitFirstCommitBatch(repoRoot, files) : new Map();
     const commitMs = Date.parse(inputHealth.commitDate ?? "");
     const graphMs = Date.parse(graph.updated_at || graph.created_at || "");
     const nowSec = Math.floor((Number.isFinite(commitMs) ? commitMs : Number.isFinite(graphMs) ? graphMs : 0) / 1000);
-    // Method-level attribution. CALLS edges are already symbol-granular and count
-    // at full weight. IMPORTS edges are file-granular: previously every symbol in
-    // an imported file inherited the file's full import count, which made all 17
-    // methods of a hot service tie at the same "incoming refs" and saturated the
-    // ranking. Split the file's import count across its eligible symbols instead.
+    // A file-level IMPORTS edge does not reference any particular symbol. Only its
+    // AST-resolved named imports and non-call module.attribute references may be
+    // attributed; CALLS already has an exact symbol target. Older graphs without
+    // these metadata facts fail closed instead of redistributing imports.
     const incoming = new Map();
-    const fileImports = new Map();
+    // Display-only breakdown of the same total, so a reader can reconcile the
+    // number against the graph: CALLS edges + named imports + module.attr references.
+    const incomingParts = new Map();
+    const addIncoming = (id, kind, n) => {
+        incoming.set(id, (incoming.get(id) ?? 0) + n);
+        const parts = incomingParts.get(id) ?? { calls: 0, named: 0, attrs: 0 };
+        parts[kind] += n;
+        incomingParts.set(id, parts);
+    };
     for (const e of graph.edges) {
         if (e.relationship_type === "CALLS" && symbolIds.has(e.to_external_id)) {
-            incoming.set(e.to_external_id, (incoming.get(e.to_external_id) ?? 0) + 1);
+            addIncoming(e.to_external_id, "calls", 1);
         }
-        else if (e.relationship_type === "IMPORTS" && symbolsByFile.has(e.to_external_id)) {
-            fileImports.set(e.to_external_id, (fileImports.get(e.to_external_id) ?? 0) + 1);
+        else if (e.relationship_type === "IMPORTS") {
+            const named = e.properties?.symbol_imports;
+            if (Array.isArray(named))
+                for (const id of new Set(named)) {
+                    if (typeof id === "string" && symbolIds.has(id) && fileBySymbolId.get(id) === e.to_external_id) {
+                        addIncoming(id, "named", 1);
+                    }
+                }
+            const refs = e.properties?.symbol_references;
+            if (refs && typeof refs === "object" && !Array.isArray(refs)) {
+                for (const [id, count] of Object.entries(refs)) {
+                    if (symbolIds.has(id) && typeof count === "number" && Number.isSafeInteger(count) && count > 0 && fileBySymbolId.get(id) === e.to_external_id) {
+                        addIncoming(id, "attrs", count);
+                    }
+                }
+            }
         }
     }
-    for (const [file, count] of fileImports) {
-        const syms = symbolsByFile.get(file) ?? [];
-        if (syms.length === 0)
-            continue;
-        const share = count / syms.length;
-        for (const s of syms)
-            incoming.set(s.external_id, (incoming.get(s.external_id) ?? 0) + share);
-    }
+    const incomingBreakdown = (id) => {
+        const parts = incomingParts.get(id);
+        if (!parts || (parts.named === 0 && parts.attrs === 0))
+            return "";
+        const bits = [`${parts.calls} call${parts.calls === 1 ? "" : "s"}`];
+        if (parts.named > 0)
+            bits.push(`${parts.named} named import${parts.named === 1 ? "" : "s"}`);
+        if (parts.attrs > 0)
+            bits.push(`${parts.attrs} module.attribute reference${parts.attrs === 1 ? "" : "s"}`);
+        return ` (${bits.join(" + ")})`;
+    };
     // Per-symbol churn share: file churn weighted by the symbol's line span so one
     // hot file no longer awards its full churn to every method it contains.
     const fileComplexityTotals = new Map();
@@ -526,6 +729,7 @@ export function rankRiskGaps(graph, opts = {}) {
     // whose own name, or a retained external callee, is a destructive call.
     const nodeById = new Map(graph.nodes.map((n) => [n.external_id, n]));
     const lastSeg = (name) => name.split(".").pop() ?? name;
+    const isDestructiveTerminal = (name) => DESTRUCTIVE_CALL_RE.test(name) && !/^(?:deleted|purged|dropped|destroyed)[A-Za-z0-9_]*$/i.test(name);
     // A sink is a destructive call on an EXTERNAL surface — a persistence store, an
     // admin/service client, a database handle. In-repo methods named `delete` are
     // not sinks by name alone (CHASM's `Node.delete` is a tree op, not a data loss).
@@ -539,25 +743,36 @@ export function rankRiskGaps(graph, opts = {}) {
             return undefined;
         const ext = n.properties?.external_callees ?? [];
         const importedStatic = n.properties?.imported_static_callees ?? [];
+        const constructorChains = n.properties?.constructor_chain_sinks;
+        if (Array.isArray(constructorChains)) {
+            const retained = constructorChains.find((entry) => {
+                if (!entry || typeof entry !== "object")
+                    return false;
+                const fact = entry;
+                return typeof fact.callee === "string" && typeof fact.constructor_symbol === "string" && nodeById.has(fact.constructor_symbol);
+            });
+            if (retained)
+                return retained.callee;
+        }
         // A receiver FIELD path is `x.field.Method` — no call parentheses before the last
         // segment. `q.Clock().Now().Truncate` is a chain of return values, not a surface.
         const viaField = (c) => !c.slice(0, c.lastIndexOf(".")).includes("(");
         const fieldOf = (c) => c.slice(0, c.lastIndexOf("."));
-        const destructive = ext.find((c) => viaField(c) && (DESTRUCTIVE_CALL_RE.test(lastSeg(c)) ||
-            (REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c))) ||
+        const persistentRemove = (c) => REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c)) && !BROWSER_WEB_STORAGE_FIELD_RE.test(fieldOf(c));
+        const destructive = ext.find((c) => viaField(c) && (isDestructiveTerminal(lastSeg(c)) ||
+            persistentRemove(c) ||
             extraSinks.some((re) => re.test(lastSeg(c)))));
         if (destructive)
             return destructive;
-        return importedStatic.find((c) => viaField(c) && (DESTRUCTIVE_CALL_RE.test(lastSeg(c)) ||
+        return importedStatic.find((c) => viaField(c) && (isDestructiveTerminal(lastSeg(c)) ||
             IMPORTED_REPLACEMENT_CALL_RE.test(lastSeg(c)) ||
-            (REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c))) ||
+            persistentRemove(c) ||
             extraSinks.some((re) => re.test(lastSeg(c)))));
     };
-    const isSink = (id) => sinkCallee(id) !== undefined;
     const reachedSinkFrom = (id, depth, seen) => {
         const own = sinkCallee(id);
         if (own)
-            return own;
+            return { callee: own, owner: id };
         if (depth === 0)
             return undefined;
         for (const t of fanOutTargets.get(id) ?? []) {
@@ -570,44 +785,44 @@ export function rankRiskGaps(graph, opts = {}) {
         }
         return undefined;
     };
-    const sinkReached = new Map(normalizationSymbols.map((s) => [s.external_id, reachedSinkFrom(s.external_id, 2, new Set([s.external_id]))]));
+    const endpointHandlers = new Set(graph.edges
+        .filter((e) => e.relationship_type === "IMPLEMENTED_IN" && nodeById.get(e.from_external_id)?.kind === "Endpoint")
+        .map((e) => e.to_external_id));
+    const frameworkInvoked = (node) => node.properties.cli_entrypoint === true || endpointHandlers.has(node.external_id);
+    const sinkHits = new Map(normalizationSymbols.map((s) => [s.external_id, reachedSinkFrom(s.external_id, 2, new Set([s.external_id]))]));
+    const sinkReached = new Map([...sinkHits].map(([k, v]) => [k, v?.callee]));
     const reachesSink = new Map([...sinkReached].map(([k, v]) => [k, v !== undefined]));
     const depthCtx = buildFlowDepthContext(graph);
     const staticLinked = staticTestLinkedIds(graph, symbolIds);
     const candidateLinked = candidateSignalIds(graph, symbolIds);
     const detectionFor = (id) => staticLinked.has(id) ? "associated" : candidateLinked.has(id) ? "candidate" : "none";
+    // R7 ranking-only hygiene happens AFTER the stable ORS normalization population is
+    // chosen. These declaration/delegate exclusions therefore remove only worklist
+    // slots: they never change graph facts, denominator membership, evidence, or a
+    // peer's P/I normalization.
+    const postNormalizationExcluded = (node) => {
+        if (node.properties.ranking_exclusion_code === "python_class_with_methods" || node.properties.ranking_exclusion_code === "python_structural_container" || node.properties.ranking_exclusion_reason === "python_structural_container")
+            return true;
+        const code = node.properties.ranking_exclusion_reason_code;
+        if (node.properties.ranking_exclusion_code === "trivial_constructor" ||
+            node.properties.ranking_exclusion_code === "enum_declaration" ||
+            node.properties.ranking_exclusion_code === "data_shape_declaration" ||
+            code === "python_trivial_thread_local_initializer" ||
+            code === "python_trivial_constructor" ||
+            code === "python_stdlib_enum_declaration" ||
+            code === "python_data_shape_declaration")
+            return true;
+        return (node.properties.ranking_exclusion_code === "thin_external_delegate" || code === "python_thin_external_delegate")
+            && deriveDataSensitivity(node) <= 1
+            && sinkCallee(node.external_id) === undefined;
+    };
+    const worklistSymbols = symbols.filter((node) => !postNormalizationExcluded(node));
     if (opts.legacy) {
-        // Preserve the legacy option's historical evidence-filtered attribution.
-        const legacyIds = new Set(symbols.map((s) => s.external_id));
-        const legacyByFile = new Map();
-        for (const s of symbols) {
-            const file = symbolFile(s);
-            const list = legacyByFile.get(file);
-            if (list)
-                list.push(s);
-            else
-                legacyByFile.set(file, [s]);
-        }
-        const legacyIncoming = new Map();
-        const legacyFileImports = new Map();
-        for (const e of graph.edges) {
-            if (e.relationship_type === "CALLS" && legacyIds.has(e.to_external_id)) {
-                legacyIncoming.set(e.to_external_id, (legacyIncoming.get(e.to_external_id) ?? 0) + 1);
-            }
-            else if (e.relationship_type === "IMPORTS" && legacyByFile.has(e.to_external_id)) {
-                legacyFileImports.set(e.to_external_id, (legacyFileImports.get(e.to_external_id) ?? 0) + 1);
-            }
-        }
-        for (const [file, count] of legacyFileImports) {
-            const syms = legacyByFile.get(file) ?? [];
-            const share = syms.length > 0 ? count / syms.length : 0;
-            for (const s of syms)
-                legacyIncoming.set(s.external_id, (legacyIncoming.get(s.external_id) ?? 0) + share);
-        }
+        // The formula remains available; neither lane may invent sibling references.
         return worklistSymbols
             .map((s) => {
             const file = symbolFile(s);
-            const incoming_refs = legacyIncoming.get(s.external_id) ?? 0;
+            const incoming_refs = incoming.get(s.external_id) ?? 0;
             const git_churn = churn.get(file) ?? 0;
             const isEntry = entryPoint.get(s.external_id) ?? false;
             const churnForScore = Math.min(git_churn, 500);
@@ -615,12 +830,14 @@ export function rankRiskGaps(graph, opts = {}) {
             const reasons = [
                 `${incoming_refs} incoming structural reference${incoming_refs === 1 ? "" : "s"}`,
                 churnAvailable
-                    ? `${git_churn} git churn line${git_churn === 1 ? "" : "s"} in 180 days${git_churn > 500 ? " (score capped at 500)" : ""}`
-                    : "Git churn unavailable — provisional static-only ranking"
+                    ? `${git_churn} git churn line${git_churn === 1 ? "" : "s"} in recent history${git_churn > 500 ? " (score capped at 500)" : ""}`
+                    : churnResult.state === "partial"
+                        ? `${git_churn} partial git churn line${git_churn === 1 ? "" : "s"} retained from ${churnResult.commitsScanned} commit${churnResult.commitsScanned === 1 ? "" : "s"} — ${churnResult.reason ?? "bounded acquisition incomplete"}`
+                        : "Git churn unavailable — provisional static-only ranking"
             ];
             if (isEntry)
                 reasons.push("near an API/route/handler entry point");
-            return { id: s.external_id, title: s.title || s.external_id, file, risk_score: score, incoming_refs, git_churn, churn_available: churnAvailable, entry_point: isEntry, reasons };
+            return { id: s.external_id, title: s.title || s.external_id, file, risk_score: score, incoming_refs, git_churn, churn_available: churnAvailable, churn_state: churnResult.state, ...(churnResult.reason ? { churn_reason: churnResult.reason } : {}), commits_scanned: churnResult.commitsScanned, entry_point: isEntry, reasons };
         })
             .sort((a, b) => b.risk_score - a.risk_score || b.incoming_refs - a.incoming_refs || b.git_churn - a.git_churn || a.id.localeCompare(b.id))
             .slice(0, limit);
@@ -675,15 +892,21 @@ export function rankRiskGaps(graph, opts = {}) {
         const d = raw.d;
         const detectionTier = detectionFor(s.external_id);
         let score = Math.round(pExact * iExact * d * 10) / 10;
-        const disconnected = incoming_refs === 0 && fan_out === 0;
+        // A framework-invoked entry (a registered CLI command, or a handler bound to an
+        // Endpoint) has no static caller BY CONSTRUCTION; "disconnected" means dead-code
+        // shaped, which an entry the framework calls is not. Before per-symbol fan-in,
+        // such entries escaped this dampener only through file-split import counts.
+        const disconnected = incoming_refs === 0 && fan_out === 0 && !frameworkInvoked(s);
         if (disconnected)
             score = Math.round(score * 0.25 * 10) / 10;
         const reasons = [
             `ORS ${score} ≈ P${p} × I${i} × D${d}`,
-            `${incoming_refs} incoming structural reference${incoming_refs === 1 ? "" : "s"} (method-attributed)`,
+            `${incoming_refs} incoming symbol-specific structural reference${incoming_refs === 1 ? "" : "s"}${incomingBreakdown(s.external_id)}`,
             churnAvailable
-                ? `${git_churn} git churn line${git_churn === 1 ? "" : "s"} attributed to this symbol in 180 days`
-                : "Git churn unavailable — provisional static-only ranking",
+                ? `${git_churn} git churn line${git_churn === 1 ? "" : "s"} attributed to this symbol in recent history`
+                : churnResult.state === "partial"
+                    ? `${git_churn} partial git churn line${git_churn === 1 ? "" : "s"} retained from ${churnResult.commitsScanned} commit${churnResult.commitsScanned === 1 ? "" : "s"} — ${churnResult.reason ?? "bounded acquisition incomplete"}`
+                    : "Git churn unavailable — provisional static-only ranking",
             `route weight ${route_weight}, data sensitivity ${data_sensitivity}, flow position ${flow_position}, complexity ${complexity_proxy}, fan-out ${fan_out}`
         ];
         if (isEntry)
@@ -705,7 +928,7 @@ export function rankRiskGaps(graph, opts = {}) {
             reasons.push(`config override (${override.action}): ${override.reason}`);
         return {
             ...(override && override.action !== "suppress" ? { override: { action: override.action, reason: override.reason } } : {}),
-            ...(sinkReached.get(s.external_id) ? { sink_callee: sinkReached.get(s.external_id) } : {}),
+            ...(sinkHits.get(s.external_id) ? { sink_callee: sinkHits.get(s.external_id).callee, sink_owner: sinkHits.get(s.external_id).owner } : {}),
             ...(raw.scheduledEntry ? { scheduled_entry: true } : {}),
             detection_tier: detectionTier,
             id: s.external_id,
@@ -715,6 +938,9 @@ export function rankRiskGaps(graph, opts = {}) {
             incoming_refs,
             git_churn,
             churn_available: churnAvailable,
+            churn_state: churnResult.state,
+            ...(churnResult.reason ? { churn_reason: churnResult.reason } : {}),
+            commits_scanned: churnResult.commitsScanned,
             entry_point: isEntry,
             reasons,
             probability: p,
@@ -822,6 +1048,8 @@ export function configDisclosureFor(graph, repoRoot) {
         rankExcludePaths: cfg.classification.rank_exclude_paths,
         floor: cfg.tuning.irreversibility_floor,
         silence: cfg.tuning.silence_multiplier,
+        tuning: { churn_window_days: cfg.tuning.churn_window_days, churn_max_commits: cfg.tuning.churn_max_commits, churn_timeout_seconds: cfg.tuning.churn_timeout_seconds },
+        proof: cfg.proof,
         classification: {
             test_support_paths: cfg.classification.test_support_paths,
             scheduled_entry_paths: cfg.classification.scheduled_entry_paths,