@orangepro/orangepro-mcp 0.2.45 → 0.2.46

package/dist/local/analyze/analyzer.js

@@ -982,7 +982,11 @@ export function analyzeRepo(root, opts = {}) {
                             ...(notEntryPointAdjacent ? { denominator_reason_code: "not_entry_point_adjacent" } : {}),
                             ...(pythonRankingExclusion
                                 ? {
-                                    ranking_exclusion_code: pythonRankingExclusion.code === "python_trivial_thread_local_initializer" ? "trivial_constructor" : "enum_declaration",
+                                    ranking_exclusion_code: pythonRankingExclusion.code === "python_trivial_constructor" || pythonRankingExclusion.code === "python_trivial_thread_local_initializer"
+                                        ? "trivial_constructor"
+                                        : pythonRankingExclusion.code === "python_data_shape_declaration"
+                                            ? "data_shape_declaration"
+                                            : "enum_declaration",
                                     ranking_exclusion_reason_code: pythonRankingExclusion.code,
                                     ranking_exclusion_reason: pythonRankingExclusion.reason
                                 }

package/dist/local/analyze/treeSitter/engine.js

@@ -2687,17 +2687,18 @@ function pythonImportsBefore(root, stopAt) {
     return bindings;
 }
 function pythonBaseIsStdlib(base, bindings, module, allowed) {
+    const modules = typeof module === "string" ? [module] : module;
     const dotted = pythonDottedName(base);
     if (!dotted)
         return false;
     const parts = dotted.split(".");
     if (parts.length === 1) {
         const binding = bindings.get(parts[0]);
-        return Boolean(binding?.kind === "named" && binding.module === module && binding.imported && allowed.has(binding.imported));
+        return Boolean(binding?.kind === "named" && modules.includes(binding.module) && binding.imported && allowed.has(binding.imported));
     }
     if (parts.length === 2 && allowed.has(parts[1])) {
         const binding = bindings.get(parts[0]);
-        return Boolean(binding?.kind === "module" && binding.module === module);
+        return Boolean(binding?.kind === "module" && modules.includes(binding.module));
     }
     return false;
 }
@@ -2741,6 +2742,9 @@ function pythonLiteralOrParameter(node, params) {
         return false;
     if (node.type === "identifier")
         return params.has(node.text);
+    // An f-string with {interpolation} computes a value; only plain literals qualify.
+    if ((node.type === "string" || node.type === "concatenated_string") && node.descendantsOfType("interpolation").length > 0)
+        return false;
     return new Set(["none", "true", "false", "integer", "float", "string", "concatenated_string"]).has(node.type);
 }
 function pythonDocstringStatement(statement) {
@@ -2749,11 +2753,18 @@ function pythonDocstringStatement(statement) {
     const expression = namedChildren(statement)[0];
     return expression?.type === "string" || expression?.type === "concatenated_string";
 }
-function pythonSuperInitStatement(statement) {
+function pythonSuperInitStatement(statement, params = new Set()) {
     if (statement.type !== "expression_statement")
         return false;
     const call = namedChildren(statement)[0];
-    if (call?.type !== "call" || pythonCallArguments(call).length !== 0)
+    if (call?.type !== "call")
+        return false;
+    // super().__init__(...) may only FORWARD this constructor's own parameters or
+    // literals (positionally or by keyword). Any computed argument is behavior.
+    const forwardsOnly = pythonCallArguments(call).every((arg) => arg.type === "keyword_argument"
+        ? pythonLiteralOrParameter(arg.childForFieldName("value"), params)
+        : pythonLiteralOrParameter(arg, params));
+    if (!forwardsOnly)
         return false;
     const fn = call.childForFieldName("function");
     if (fn?.type !== "attribute" || fn.childForFieldName("attribute")?.text !== "__init__")
@@ -2774,7 +2785,7 @@ function pythonTrivialSelfAssignment(statement, params) {
         return false;
     return pythonLiteralOrParameter(assignment.childForFieldName("right"), params);
 }
-function pythonTrivialThreadLocalInitializer(classNode) {
+function pythonTrivialInitializer(classNode) {
     const body = classNode.childForFieldName("body");
     if (!body)
         return null;
@@ -2800,40 +2811,97 @@ function pythonTrivialThreadLocalInitializer(classNode) {
         const statement = statements[i];
         if (i === 0 && pythonDocstringStatement(statement))
             continue;
-        if (statement.type === "pass_statement" || pythonSuperInitStatement(statement) || pythonTrivialSelfAssignment(statement, params))
+        if (statement.type === "pass_statement" || pythonSuperInitStatement(statement, params) || pythonTrivialSelfAssignment(statement, params))
             continue;
         return null;
     }
     return pythonQualifiedFunctionName(fn) ?? null;
 }
+const PYTHON_TYPING_SHAPES = new Set(["TypedDict", "NamedTuple", "Protocol"]);
+const PYTHON_TYPING_MODULES = ["typing", "typing_extensions"];
+const PYTHON_PYDANTIC_SHAPES = new Set(["BaseModel"]);
+const PYTHON_PYDANTIC_MODULES = ["pydantic", "pydantic.main", "pydantic.v1"];
+const PYTHON_DATACLASS_MODULES = ["dataclasses", "pydantic.dataclasses"];
+/** `@dataclass`, `@dataclass(...)`, `@dataclasses.dataclass(...)` (stdlib or pydantic's drop-in). */
+function pythonIsStdlibDataclassDecorator(decorator, bindings) {
+    let expression = namedChildren(decorator)[0] ?? null;
+    if (expression?.type === "call")
+        expression = expression.childForFieldName("function");
+    return Boolean(expression && pythonBaseIsStdlib(expression, bindings, PYTHON_DATACLASS_MODULES, new Set(["dataclass"])));
+}
+/** Class body holds only field declarations: annotations (with or without a default),
+ *  plain attribute assignments, a docstring, or `pass`. No methods, no nested classes,
+ *  no statements that run logic. */
+function pythonFieldOnlyBody(classNode) {
+    const body = classNode.childForFieldName("body");
+    if (!body)
+        return false;
+    const statements = blockStatements(body);
+    if (statements.length === 0)
+        return false;
+    return statements.every((statement, index) => {
+        if (statement.type === "pass_statement")
+            return true;
+        if (index === 0 && pythonDocstringStatement(statement))
+            return true;
+        if (statement.type !== "expression_statement")
+            return false;
+        const inner = namedChildren(statement);
+        // A lambda in a field value (e.g. custom JSON encoders) is behavior, not data.
+        return inner.length === 1 && inner[0].type === "assignment" && inner[0].childForFieldName("left")?.type === "identifier"
+            && inner[0].descendantsOfType("lambda").length === 0;
+    });
+}
 function extractPythonDeclarationRankingExclusions(root) {
     const out = [];
     for (const classNode of root.descendantsOfType("class_definition")) {
-        if (!classNode || hasPythonFunctionAncestor(classNode) || classNode.parent?.type !== "module")
+        if (!classNode || hasPythonFunctionAncestor(classNode))
+            continue;
+        // Module-level classes only (decorated or not): nested-class symbol names are
+        // not guaranteed to line up with the analyzer's symbol table.
+        const decorated = classNode.parent?.type === "decorated_definition" ? classNode.parent : null;
+        if ((decorated ?? classNode).parent?.type !== "module")
             continue;
         const name = classNode.childForFieldName("name")?.text;
-        const bases = classNode.childForFieldName("superclasses");
-        if (!name || !bases)
+        if (!name)
             continue;
-        const bindings = pythonImportsBefore(root, classNode.startIndex);
-        const baseNodes = namedChildren(bases);
-        if (baseNodes.some((base) => pythonBaseIsStdlib(base, bindings, "enum", PYTHON_ENUM_TYPES)) && !pythonClassHasMethod(classNode)) {
+        const bases = classNode.childForFieldName("superclasses");
+        const bindings = pythonImportsBefore(root, (decorated ?? classNode).startIndex);
+        const baseNodes = bases ? namedChildren(bases) : [];
+        const hasMethod = pythonClassHasMethod(classNode);
+        if (baseNodes.some((base) => pythonBaseIsStdlib(base, bindings, "enum", PYTHON_ENUM_TYPES)) && !hasMethod) {
             out.push({
                 symbol: name,
                 code: "python_stdlib_enum_declaration",
                 reason: "Standard-library enum declaration without methods — retained in the graph but excluded from priority ranking."
             });
+            continue;
         }
-        if (baseNodes.some((base) => pythonBaseIsStdlib(base, bindings, "threading", new Set(["local"])))) {
-            const initializer = pythonTrivialThreadLocalInitializer(classNode);
-            if (initializer) {
+        // Data-shape declarations: a TypedDict/NamedTuple/Protocol, a pydantic model, or a
+        // stdlib @dataclass whose body only declares fields. No method ⇒ no behavior to test.
+        if (!hasMethod && pythonFieldOnlyBody(classNode)) {
+            const typedShape = baseNodes.some((base) => pythonBaseIsStdlib(base, bindings, PYTHON_TYPING_MODULES, PYTHON_TYPING_SHAPES) ||
+                pythonBaseIsStdlib(base, bindings, PYTHON_PYDANTIC_MODULES, PYTHON_PYDANTIC_SHAPES));
+            const dataclassShape = Boolean(decorated) && namedChildren(decorated).some((child) => child.type === "decorator" && pythonIsStdlibDataclassDecorator(child, bindings));
+            if (typedShape || dataclassShape) {
                 out.push({
-                    symbol: initializer,
-                    code: "python_trivial_thread_local_initializer",
-                    reason: "Trivial threading.local initializer — retained in the graph but excluded from priority ranking."
+                    symbol: name,
+                    code: "python_data_shape_declaration",
+                    reason: "Data-shape declaration (fields only, no methods) — retained in the graph but excluded from priority ranking."
                 });
+                continue;
             }
         }
+        // Trivial constructor on ANY class: the body only stores parameters/literals on
+        // self, forwards parameters/literals to super().__init__, or passes.
+        const initializer = pythonTrivialInitializer(classNode);
+        if (initializer) {
+            out.push({
+                symbol: initializer,
+                code: "python_trivial_constructor",
+                reason: "Trivial constructor (stores or forwards its parameters only) — retained in the graph but excluded from priority ranking."
+            });
+        }
     }
     return out;
 }

package/dist/local/operations.js

@@ -1690,7 +1690,8 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
         : "auto-prove: driving generate → prove on the top provable targets", { current: 6, total: 8 });
     let autoProveResult;
     try {
-        autoProveResult = await autoProve(root, {
+        const scopedFiles = autoProveChangedScope(loadGraph(workspacePaths(root).graphPath), changed, opts.baseRef);
+        const runAutoProve = (changedFiles) => autoProve(root, {
             autoLimit: opts.proofLimit ?? opts.autoLimit,
             proof_existing_limit: opts.proofLimit ?? opts.autoLimit ?? loadedRiskConfig.config.proof.attempt_limit,
             proof_gen_limit: loadedRiskConfig.config.proof.baseline_green_target,
@@ -1698,8 +1699,19 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
             provider: providerOpts.provider,
             model: providerOpts.model,
             prompt_version: opts.promptVersion,
-            changedFiles: autoProveChangedScope(loadGraph(workspacePaths(root).graphPath), changed, opts.baseRef)
+            changedFiles
         }, { ...providerDeps, proveLoop: opProveLoop });
+        autoProveResult = await runAutoProve(scopedFiles);
+        if (scopedFiles && autoProveResult.attempted === 0 && !opts.baseRef && !opts.noAuto) {
+            // An uncommitted working tree implicitly scoped the pass, but nothing in that
+            // scope was provable. Fall back to the global top targets instead of reporting
+            // "not attempted" for a reason the user cannot see. --base keeps strict scoping.
+            warnings.push(`auto-prove: none of the ${scopedFiles.length} uncommitted changed file(s) had a provable target with a linked test; ran the global top targets instead.`);
+            autoProveResult = await runAutoProve(undefined);
+        }
+        else if (scopedFiles) {
+            autoProveResult = { ...autoProveResult, scoped_changed_files: scopedFiles.length };
+        }
         for (const skip of autoProveResult.skipped)
             warnings.push(`auto-prove skipped ${skip.target_symbol ?? skip.title}: ${skip.reason}`);
     }
@@ -1944,6 +1956,9 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
         const dynForReport = {
             attempted: autoProveResult.attempted,
             proven: autoProveResult.proven,
+            status: autoProveResult.status,
+            reason: autoProveResult.reason,
+            ...(autoProveResult.scoped_changed_files !== undefined ? { scopedChangedFiles: autoProveResult.scoped_changed_files } : {}),
             needsSetup: autoProveResult.needs_setup
                 .filter((a) => !a.deduped)
                 .map((a) => ({ category: a.category, reason: a.reason }))

package/dist/local/proofDoctor.js

@@ -107,6 +107,9 @@ export function distillProofAttempts(auto, meta) {
         artifact_identity: meta.graph.artifact_identity,
         attempted: auto.attempted,
         proven: auto.proven,
+        ...(auto.status ? { status: auto.status } : {}),
+        ...(auto.reason ? { reason: redactSecrets(auto.reason) } : {}),
+        ...(auto.scoped_changed_files !== undefined ? { scoped_changed_files: auto.scoped_changed_files } : {}),
         attempts: auto.attempts.filter((a) => !a.deduped).map((a) => ({
             target_symbol: a.target_symbol,
             test_path: a.test_path || undefined,

package/dist/local/provenance.js

@@ -3,7 +3,7 @@ import { ORS_VERSION } from "./score/risk.js";
 import { ORANGEPRO_VERSION } from "./version.js";
 import { hashString } from "./util/hash.js";
 export const ARTIFACT_IDENTITY_VERSION = "orangepro.artifact_identity.v1";
-export const ANALYZER_VERSION = "orangepro.analyzer.v5";
+export const ANALYZER_VERSION = "orangepro.analyzer.v6";
 export const PROOF_ORACLE_VERSION = "orangepro.targeted_mutation_oracle.v3";
 function stable(value) {
     if (value === null || typeof value !== "object")

package/dist/local/score/risk.js

@@ -78,15 +78,18 @@ function confirmedBehaviorIds(graph, provenIds) {
     }
     return ids;
 }
-/** Bounded repository-wide history acquisition. Deliberately constants, not hidden timeouts. */
-export const GIT_CHURN_MAX_COMMITS = 5_000;
-export const GIT_CHURN_TIMEOUT_MS = 60_000;
+/** Default bounds for repository-wide history acquisition (overridable via
+ *  tuning.churn_max_commits / tuning.churn_timeout_seconds, always disclosed).
+ *  Sized so an active monorepo's full 180-day window completes (a 5,000-commit /
+ *  60 s bound truncated windows that 0.2.44 scanned completely). */
+export const GIT_CHURN_MAX_COMMITS = 20_000;
+export const GIT_CHURN_TIMEOUT_MS = 300_000;
 const GIT_FIRST_COMMIT_BATCH = 200;
 /**
  * This worker intentionally uses spawn, not execFileSync: stdout is parsed as it
- * arrives, so a 60s bound returns the values already observed instead of erasing
- * completed chunks. It retains only requested paths, bounding the worker map and
- * handoff payload by ranking input rather than repository history. The scoring API
+ * arrives, so a time bound returns the values already observed instead of erasing
+ * completed chunks. It keeps one counter per path the window touched (bounded by
+ * the window, not by total history) so a single scan serves every caller. The scoring API
  * is synchronous, therefore the worker signals only after writing its result file.
  */
 const GIT_CHURN_WORKER_SOURCE = String.raw `
@@ -95,7 +98,7 @@ const { writeFileSync } = require("node:fs");
 const { workerData } = require("node:worker_threads");
 const state = new Int32Array(workerData.signal);
 const values = new Map();
-const trackedFiles = new Set(workerData.files);
+const trackedFiles = Array.isArray(workerData.files) ? new Set(workerData.files) : null;
 let commitsScanned = 0;
 let commitLimitReached = false;
 let expectingTimestamp = false;
@@ -110,7 +113,7 @@ let child;
 let childClosed = false;
 const firstLine = (text) => String(text || "").split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "";
 const add = (path, adds, dels) => {
-  if (!path || commitLimitReached || !trackedFiles.has(path)) return;
+  if (!path || commitLimitReached || (trackedFiles && !trackedFiles.has(path))) return;
   values.set(path, (values.get(path) || 0) + adds + dels);
 };
 const consume = (token) => {
@@ -260,12 +263,17 @@ function gitChurn(root, files, window, health = inspectRiskInputHealth(root, win
     // Values are retained only for the requested paths, so that set and clone
     // state are part of cache identity. A checkout can be marked partial at an
     // unchanged HEAD and must then remain truthfully provisional.
-    const requestedFiles = [...new Set(files)].sort();
-    const requested = new Set(requestedFiles);
-    const key = `${health.gitRoot ?? root}\0${health.commit ?? ""}\0${health.history}\0${window}\0${hashString(JSON.stringify(requestedFiles))}`;
+    const requested = new Set(files);
+    const tuning = loadRiskConfig(root).config.tuning;
+    const maxCommits = tuning.churn_max_commits ?? GIT_CHURN_MAX_COMMITS;
+    const timeoutMs = (tuning.churn_timeout_seconds ?? GIT_CHURN_TIMEOUT_MS / 1000) * 1000;
+    // ONE bounded scan per repository state: values are kept for every path the
+    // window touched and filtered per caller, so the ranking, the report header and
+    // the static snapshot never each pay for (and each time out on) the same scan.
+    const key = `${health.gitRoot ?? root}\0${health.commit ?? ""}\0${health.history}\0${window}\0${maxCommits}\0${timeoutMs}`;
     const cached = historyCache.get(key);
     if (cached)
-        return { ...cached, values: new Map(cached.values) };
+        return { ...cached, values: new Map([...cached.values].filter(([file]) => requested.has(file))) };
     const dir = mkdtempSync(join(tmpdir(), "orangepro-churn-"));
     const resultPath = join(dir, "result.json");
     const signal = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
@@ -277,9 +285,9 @@ function gitChurn(root, files, window, health = inspectRiskInputHealth(root, win
             workerData: {
                 root,
                 window,
-                files: requestedFiles,
-                maxCommits: GIT_CHURN_MAX_COMMITS,
-                timeoutMs: GIT_CHURN_TIMEOUT_MS,
+                files: null,
+                maxCommits,
+                timeoutMs,
                 cloneState: health.history,
                 resultPath,
                 signal
@@ -287,7 +295,7 @@ function gitChurn(root, files, window, health = inspectRiskInputHealth(root, win
         });
         // The worker publishes a partial result 100ms after its child timeout; leave
         // explicit scheduling room before the synchronous API forces it down.
-        Atomics.wait(state, 0, 0, GIT_CHURN_TIMEOUT_MS + 2_000);
+        Atomics.wait(state, 0, 0, timeoutMs + 2_000);
         if (Atomics.load(state, 0) === 1)
             parsed = JSON.parse(readFileSync(resultPath, "utf8"));
         void worker.terminate().catch(() => undefined);
@@ -519,6 +527,10 @@ const IMPORTED_REPLACEMENT_CALL_RE = /^replace[A-Za-z0-9_]*$/i;
 // removals (`pollers.Remove`, `RemoveSpeculativeWorkflowTaskTimeout`) are not.
 const REMOVE_CALL_RE = /^remove(?![A-Za-z0-9_]*(?:listener|handler|observer|callback|attribute|attr|class|child|style|hook|timeout|timer)$)[A-Za-z0-9_]*$/i;
 const PERSISTENCE_FIELD_RE = /(store|client|db|repo|repository|persistence|manager|queue|bucket|index|table|storage|dao)/i;
+// The browser Web Storage API (`sessionStorage` / `localStorage`, optionally via
+// `window.`) is a per-tab/per-device client cache, not a durable data store. Its
+// `removeItem` matches the persistence vocabulary ("storage") by name only.
+const BROWSER_WEB_STORAGE_FIELD_RE = /(^|\.)(sessionStorage|localStorage)$/;
 const SCHEDULED_ENTRY_NAME_RE = /(^|\.)(run|execute|handle|process|tick|scan)$/i;
 const SCHEDULED_ENTRY_PATH_RE = /(^|\/)(jobs?|workers?|scanners?|scavengers?|cron|schedulers?|processors?|consumers?|reconcil\w*)(\/|$)/i;
 /** A time- or queue-triggered entry: nothing calls it synchronously, nobody waits
@@ -646,28 +658,48 @@ export function rankRiskGaps(graph, opts = {}) {
     // attributed; CALLS already has an exact symbol target. Older graphs without
     // these metadata facts fail closed instead of redistributing imports.
     const incoming = new Map();
+    // Display-only breakdown of the same total, so a reader can reconcile the
+    // number against the graph: CALLS edges + named imports + module.attr references.
+    const incomingParts = new Map();
+    const addIncoming = (id, kind, n) => {
+        incoming.set(id, (incoming.get(id) ?? 0) + n);
+        const parts = incomingParts.get(id) ?? { calls: 0, named: 0, attrs: 0 };
+        parts[kind] += n;
+        incomingParts.set(id, parts);
+    };
     for (const e of graph.edges) {
         if (e.relationship_type === "CALLS" && symbolIds.has(e.to_external_id)) {
-            incoming.set(e.to_external_id, (incoming.get(e.to_external_id) ?? 0) + 1);
+            addIncoming(e.to_external_id, "calls", 1);
         }
         else if (e.relationship_type === "IMPORTS") {
             const named = e.properties?.symbol_imports;
             if (Array.isArray(named))
                 for (const id of new Set(named)) {
                     if (typeof id === "string" && symbolIds.has(id) && fileBySymbolId.get(id) === e.to_external_id) {
-                        incoming.set(id, (incoming.get(id) ?? 0) + 1);
+                        addIncoming(id, "named", 1);
                     }
                 }
             const refs = e.properties?.symbol_references;
             if (refs && typeof refs === "object" && !Array.isArray(refs)) {
                 for (const [id, count] of Object.entries(refs)) {
                     if (symbolIds.has(id) && typeof count === "number" && Number.isSafeInteger(count) && count > 0 && fileBySymbolId.get(id) === e.to_external_id) {
-                        incoming.set(id, (incoming.get(id) ?? 0) + count);
+                        addIncoming(id, "attrs", count);
                     }
                 }
             }
         }
     }
+    const incomingBreakdown = (id) => {
+        const parts = incomingParts.get(id);
+        if (!parts || (parts.named === 0 && parts.attrs === 0))
+            return "";
+        const bits = [`${parts.calls} call${parts.calls === 1 ? "" : "s"}`];
+        if (parts.named > 0)
+            bits.push(`${parts.named} named import${parts.named === 1 ? "" : "s"}`);
+        if (parts.attrs > 0)
+            bits.push(`${parts.attrs} module.attribute reference${parts.attrs === 1 ? "" : "s"}`);
+        return ` (${bits.join(" + ")})`;
+    };
     // Per-symbol churn share: file churn weighted by the symbol's line span so one
     // hot file no longer awards its full churn to every method it contains.
     const fileComplexityTotals = new Map();
@@ -726,20 +758,21 @@ export function rankRiskGaps(graph, opts = {}) {
         // segment. `q.Clock().Now().Truncate` is a chain of return values, not a surface.
         const viaField = (c) => !c.slice(0, c.lastIndexOf(".")).includes("(");
         const fieldOf = (c) => c.slice(0, c.lastIndexOf("."));
+        const persistentRemove = (c) => REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c)) && !BROWSER_WEB_STORAGE_FIELD_RE.test(fieldOf(c));
         const destructive = ext.find((c) => viaField(c) && (isDestructiveTerminal(lastSeg(c)) ||
-            (REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c))) ||
+            persistentRemove(c) ||
             extraSinks.some((re) => re.test(lastSeg(c)))));
         if (destructive)
             return destructive;
         return importedStatic.find((c) => viaField(c) && (isDestructiveTerminal(lastSeg(c)) ||
             IMPORTED_REPLACEMENT_CALL_RE.test(lastSeg(c)) ||
-            (REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c))) ||
+            persistentRemove(c) ||
             extraSinks.some((re) => re.test(lastSeg(c)))));
     };
     const reachedSinkFrom = (id, depth, seen) => {
         const own = sinkCallee(id);
         if (own)
-            return own;
+            return { callee: own, owner: id };
         if (depth === 0)
             return undefined;
         for (const t of fanOutTargets.get(id) ?? []) {
@@ -752,7 +785,12 @@ export function rankRiskGaps(graph, opts = {}) {
         }
         return undefined;
     };
-    const sinkReached = new Map(normalizationSymbols.map((s) => [s.external_id, reachedSinkFrom(s.external_id, 2, new Set([s.external_id]))]));
+    const endpointHandlers = new Set(graph.edges
+        .filter((e) => e.relationship_type === "IMPLEMENTED_IN" && nodeById.get(e.from_external_id)?.kind === "Endpoint")
+        .map((e) => e.to_external_id));
+    const frameworkInvoked = (node) => node.properties.cli_entrypoint === true || endpointHandlers.has(node.external_id);
+    const sinkHits = new Map(normalizationSymbols.map((s) => [s.external_id, reachedSinkFrom(s.external_id, 2, new Set([s.external_id]))]));
+    const sinkReached = new Map([...sinkHits].map(([k, v]) => [k, v?.callee]));
     const reachesSink = new Map([...sinkReached].map(([k, v]) => [k, v !== undefined]));
     const depthCtx = buildFlowDepthContext(graph);
     const staticLinked = staticTestLinkedIds(graph, symbolIds);
@@ -766,7 +804,13 @@ export function rankRiskGaps(graph, opts = {}) {
         if (node.properties.ranking_exclusion_code === "python_class_with_methods" || node.properties.ranking_exclusion_code === "python_structural_container" || node.properties.ranking_exclusion_reason === "python_structural_container")
             return true;
         const code = node.properties.ranking_exclusion_reason_code;
-        if (node.properties.ranking_exclusion_code === "trivial_constructor" || node.properties.ranking_exclusion_code === "enum_declaration" || code === "python_trivial_thread_local_initializer" || code === "python_stdlib_enum_declaration")
+        if (node.properties.ranking_exclusion_code === "trivial_constructor" ||
+            node.properties.ranking_exclusion_code === "enum_declaration" ||
+            node.properties.ranking_exclusion_code === "data_shape_declaration" ||
+            code === "python_trivial_thread_local_initializer" ||
+            code === "python_trivial_constructor" ||
+            code === "python_stdlib_enum_declaration" ||
+            code === "python_data_shape_declaration")
             return true;
         return (node.properties.ranking_exclusion_code === "thin_external_delegate" || code === "python_thin_external_delegate")
             && deriveDataSensitivity(node) <= 1
@@ -848,12 +892,16 @@ export function rankRiskGaps(graph, opts = {}) {
         const d = raw.d;
         const detectionTier = detectionFor(s.external_id);
         let score = Math.round(pExact * iExact * d * 10) / 10;
-        const disconnected = incoming_refs === 0 && fan_out === 0;
+        // A framework-invoked entry (a registered CLI command, or a handler bound to an
+        // Endpoint) has no static caller BY CONSTRUCTION; "disconnected" means dead-code
+        // shaped, which an entry the framework calls is not. Before per-symbol fan-in,
+        // such entries escaped this dampener only through file-split import counts.
+        const disconnected = incoming_refs === 0 && fan_out === 0 && !frameworkInvoked(s);
         if (disconnected)
             score = Math.round(score * 0.25 * 10) / 10;
         const reasons = [
             `ORS ${score} ≈ P${p} × I${i} × D${d}`,
-            `${incoming_refs} incoming symbol-specific structural reference${incoming_refs === 1 ? "" : "s"}`,
+            `${incoming_refs} incoming symbol-specific structural reference${incoming_refs === 1 ? "" : "s"}${incomingBreakdown(s.external_id)}`,
             churnAvailable
                 ? `${git_churn} git churn line${git_churn === 1 ? "" : "s"} attributed to this symbol in recent history`
                 : churnResult.state === "partial"
@@ -880,7 +928,7 @@ export function rankRiskGaps(graph, opts = {}) {
             reasons.push(`config override (${override.action}): ${override.reason}`);
         return {
             ...(override && override.action !== "suppress" ? { override: { action: override.action, reason: override.reason } } : {}),
-            ...(sinkReached.get(s.external_id) ? { sink_callee: sinkReached.get(s.external_id) } : {}),
+            ...(sinkHits.get(s.external_id) ? { sink_callee: sinkHits.get(s.external_id).callee, sink_owner: sinkHits.get(s.external_id).owner } : {}),
             ...(raw.scheduledEntry ? { scheduled_entry: true } : {}),
             detection_tier: detectionTier,
             id: s.external_id,
@@ -1000,7 +1048,7 @@ export function configDisclosureFor(graph, repoRoot) {
         rankExcludePaths: cfg.classification.rank_exclude_paths,
         floor: cfg.tuning.irreversibility_floor,
         silence: cfg.tuning.silence_multiplier,
-        tuning: { churn_window_days: cfg.tuning.churn_window_days },
+        tuning: { churn_window_days: cfg.tuning.churn_window_days, churn_max_commits: cfg.tuning.churn_max_commits, churn_timeout_seconds: cfg.tuning.churn_timeout_seconds },
         proof: cfg.proof,
         classification: {
             test_support_paths: cfg.classification.test_support_paths,

package/dist/local/score/riskConfig.js

@@ -11,7 +11,7 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 export const DEFAULT_RISK_CONFIG = {
     classification: { test_support_paths: [], scheduled_entry_paths: [], destructive_sinks: [], sensitivity_ignore: [], rank_exclude_paths: [] },
-    tuning: { irreversibility_floor: true, silence_multiplier: true, churn_window_days: 180 },
+    tuning: { irreversibility_floor: true, silence_multiplier: true, churn_window_days: 180, churn_max_commits: 20_000, churn_timeout_seconds: 300 },
     proof: { python_runner: "auto", attempt_limit: 20, baseline_green_target: 5 },
     overrides: []
 };
@@ -51,6 +51,10 @@ function applyFile(cfg, file, warnings, label) {
             cfg.tuning.silence_multiplier = tun.silence_multiplier;
         if (tun.churn_window_days !== undefined)
             cfg.tuning.churn_window_days = boundedInt(tun.churn_window_days, cfg.tuning.churn_window_days, 1, 3_650);
+        if (tun.churn_max_commits !== undefined)
+            cfg.tuning.churn_max_commits = boundedInt(tun.churn_max_commits, cfg.tuning.churn_max_commits, 100, 200_000);
+        if (tun.churn_timeout_seconds !== undefined)
+            cfg.tuning.churn_timeout_seconds = boundedInt(tun.churn_timeout_seconds, cfg.tuning.churn_timeout_seconds, 10, 1_800);
         const proof = (raw.proof ?? {});
         if (typeof proof.python_runner === "string" && proof.python_runner.trim() !== "") {
             cfg.proof.python_runner = proof.python_runner.trim();

package/dist/local/viz/behaviorReportData.js

@@ -178,10 +178,19 @@ function proofGuidance(ledger, summary, dyn) {
     // — behaviors, flows, Statically Linked signals — is unaffected; only the dynamic pass is small.
     if (dyn) {
         if (dyn.attempted === 0) {
+            const why = dyn.status === "disabled"
+                ? " Auto-prove was disabled for this run (--no-auto)."
+                : dyn.scopedChangedFiles !== undefined
+                    ? ` The pass was scoped to ${dyn.scopedChangedFiles.toLocaleString()} changed file${dyn.scopedChangedFiles === 1 ? "" : "s"} in the working tree, and none had a provable target with a linked test.`
+                    : dyn.status === "no-targets"
+                        ? " No provable target with a linked existing test was found."
+                        : dyn.reason
+                            ? ` ${dyn.reason}`
+                            : "";
             return {
                 state: "not_started",
                 title: "0 Dynamically Proven — dynamic proof was not attempted",
-                body: "Dynamic proof was not attempted in this run. Static behavior mapping and Statically Linked signals are still available.",
+                body: `Dynamic proof was not attempted in this run.${why} Static behavior mapping and Statically Linked signals are still available.`,
                 action: HANDOFF_ACTION
             };
         }
@@ -486,7 +495,7 @@ function displayTitle(title, file) {
 }
 /** Deterministic 1–2 line behavior context from graph facts only — no LLM.
  *  Sensitivity label mirrors deriveDataSensitivity's tiers. */
-export function riskContext(risk, churnWindowDays, churnMeta) {
+export function riskContext(risk, churnWindowDays, churnMeta, sameSinkAs) {
     const sens = (risk.data_sensitivity ?? 1) >= 10 ? "payment/billing-sensitive"
         : (risk.data_sensitivity ?? 1) >= 9 ? "auth/session-sensitive"
             : (risk.data_sensitivity ?? 1) >= 7 ? "order/transaction"
@@ -524,6 +533,7 @@ export function riskContext(risk, churnWindowDays, churnMeta) {
     const seen = [
         pos + (sens ? ` on ${sens} paths` : ""),
         ...(sink ? [`reaches \`${sink}\` within two calls`] : []),
+        ...(sink && sameSinkAs ? [`same delete call as \`${sameSinkAs}\` (ranked higher)`] : []),
         ...(scheduled ? ["scheduled / queue-triggered"] : []),
         `${risk.fan_out ?? 0} downstream call${(risk.fan_out ?? 0) === 1 ? "" : "s"}`,
         churn,
@@ -941,6 +951,12 @@ function riskRows(risks, graph, churnWindowDays, churnMeta) {
     for (const r of risks)
         if (!firstRowForFile.has(r.file))
             firstRowForFile.set(r.file, r.id);
+    // R8.10 (display only): rows that reach the SAME destructive call site through
+    // forwarding wrappers name the higher-ranked row. Order and membership unchanged.
+    const firstRowForSink = new Map();
+    for (const r of risks)
+        if (r.sink_owner && !firstRowForSink.has(r.sink_owner))
+            firstRowForSink.set(r.sink_owner, { id: r.id, title: r.title });
     // Ambiguity-qualified display: identical titles from DIFFERENT files
     // (multi-program repos: 76 x main) get their top-level dir as a prefix.
     // Purely display; single-file titles render unchanged everywhere else.
@@ -990,7 +1006,9 @@ function riskRows(risks, graph, churnWindowDays, churnMeta) {
                     todo: riskTodo(risk, verb, path, generatedTests)
                 };
             })(),
-            context: riskContext(risk, churnWindowDays, churnMeta),
+            context: riskContext(risk, churnWindowDays, churnMeta, risk.sink_owner && firstRowForSink.get(risk.sink_owner) && firstRowForSink.get(risk.sink_owner).id !== risk.id
+                ? firstRowForSink.get(risk.sink_owner).title
+                : undefined),
             desc: risk.reasons.join(" · "),
             tags
         };
@@ -1040,7 +1058,16 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         provenIds,
         includeAssociated: true
     }).filter((r) => r.sink_callee).slice(0, 20)
-        .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, sink: r.sink_callee ?? "" }));
+        .map((r, _index, rows) => {
+        const first = rows.find((x) => x.sink_owner && x.sink_owner === r.sink_owner);
+        return {
+            path: r.title,
+            file: r.file,
+            score: r.risk_score,
+            sink: r.sink_callee ?? "",
+            ...(first && first.id !== r.id ? { sameSinkAs: first.title } : {})
+        };
+    });
     const riskHealth = inspectRiskInputHealth(repoRoot);
     const codeFiles = Object.entries(graph.manifest.files).filter(([, file]) => file.kind === "code").map(([file]) => file);
     const churnMeta = inspectRiskChurn(repoRoot, codeFiles, riskHealth.churnWindow);

package/dist/local/viz/behaviorReportHtml.js

@@ -1060,13 +1060,13 @@ renderRisks();
   const P=C.proof||{};
   const T=C.tuning||{};
   const clsSet=["test_support_paths","scheduled_entry_paths","destructive_sinks","sensitivity_ignore"].filter(k=>(K[k]||[]).length>0);
-  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0||(T.churn_window_days??180)!==180||P.python_runner!=="auto"||P.attempt_limit!==20||P.baseline_green_target!==5;
+  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0||(T.churn_window_days??180)!==180||(T.churn_max_commits??20000)!==20000||(T.churn_timeout_seconds??300)!==300||P.python_runner!=="auto"||P.attempt_limit!==20||P.baseline_green_target!==5;
   const bits=["config <b>"+esc(C.hash)+"</b>","overrides active <b>"+C.overridesActive+"</b>","suppressed <b>"+(C.suppressed||[]).length+"</b>"];
   if((C.rankExcludePaths||[]).length)bits.push("ranking excludes <b>"+esc(C.rankExcludePaths.join(", "))+"</b>");
   if(!C.floor)bits.push("<b>irreversibility floor OFF</b>");
   if(!C.silence)bits.push("<b>silence multiplier OFF</b>");
   let html="<div>"+bits.join(" · ")+"</div>";
-  html+='<span class="cfg-row">Churn window: <b>'+esc(String(T.churn_window_days??180))+' days</b></span>';
+  html+='<span class="cfg-row">Churn window: <b>'+esc(String(T.churn_window_days??180))+' days</b> · history bound <b>'+esc(String(T.churn_max_commits??20000))+' commits / '+esc(String(T.churn_timeout_seconds??300))+' s</b></span>';
   html+='<span class="cfg-row">Python proof: runner <b>'+esc(P.python_runner||"auto")+'</b> · attempt limit <b>'+esc(String(P.attempt_limit??20))+'</b> · green baseline target <b>'+esc(String(P.baseline_green_target??5))+'</b></span>';
   clsSet.forEach(k=>{html+='<span class="cfg-row">'+esc(k)+': <b>'+esc(K[k].join(", "))+'</b></span>';});
   if((C.sensitivityIgnored||[]).length)html+='<span class="cfg-row">sensitivity ignored by config (score changed): <b>'+esc(C.sensitivityIgnored.join(", "))+'</b></span>';
@@ -1086,7 +1086,7 @@ renderRisks();
     return \`<div class="wl-row" data-path="\${esc(path).replace(/"/g,'&quot;')}" title="\${inTop?'in the ranked list below — click to jump':'ranked, but below the top-20 cut'}"><span class="wl-path">\${esc(path)}</span><span class="wl-meta">\${esc(meta)}</span></div>\`;
   };
   const cf=(W.changeFrontier||[]).map(r=>row(r.path,"changes "+(r.probability>=7?"a lot":r.probability>=4?"often":"some"))).join("")||'<div class="wl-empty">nothing changing fast and unproven</div>';
-  const ir=(W.irreversible||[]).map(r=>row(r.path,"→ "+(r.sink||"").split(".").pop())).join("")||'<div class="wl-empty">no unproven path reaches a delete</div>';
+  const ir=(W.irreversible||[]).map(r=>row(r.path,"→ "+(r.sink||"").split(".").pop()+(r.sameSinkAs?" · same delete as "+r.sameSinkAs:""))).join("")||'<div class="wl-empty">no unproven path reaches a delete</div>';
   host.innerHTML=\`<div class="wl-grid">
     <div class="wl-card"><p class="wl-title wl-change">Changing fast · unproven</p><p class="wl-sub">Where the code moves most with nothing proving it. The place a bug is most likely to have just arrived.</p>\${cf}</div>
     <div class="wl-card"><p class="wl-title wl-irrev">Can destroy data · unproven</p><p class="wl-sub">Paths that reach a delete or purge with nothing proving they do the right thing. Rarely changing — which is why nobody looks.</p>\${ir}</div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.45",
+  "version": "0.2.46",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",