@orangepro/orangepro-mcp 0.2.45 → 0.2.47

package/dist/local/analyze/analyzer.js

@@ -982,7 +982,11 @@ export function analyzeRepo(root, opts = {}) {
                             ...(notEntryPointAdjacent ? { denominator_reason_code: "not_entry_point_adjacent" } : {}),
                             ...(pythonRankingExclusion
                                 ? {
-                                    ranking_exclusion_code: pythonRankingExclusion.code === "python_trivial_thread_local_initializer" ? "trivial_constructor" : "enum_declaration",
+                                    ranking_exclusion_code: pythonRankingExclusion.code === "python_trivial_constructor" || pythonRankingExclusion.code === "python_trivial_thread_local_initializer"
+                                        ? "trivial_constructor"
+                                        : pythonRankingExclusion.code === "python_data_shape_declaration"
+                                            ? "data_shape_declaration"
+                                            : "enum_declaration",
                                     ranking_exclusion_reason_code: pythonRankingExclusion.code,
                                     ranking_exclusion_reason: pythonRankingExclusion.reason
                                 }

package/dist/local/analyze/treeSitter/engine.js

@@ -2687,17 +2687,18 @@ function pythonImportsBefore(root, stopAt) {
     return bindings;
 }
 function pythonBaseIsStdlib(base, bindings, module, allowed) {
+    const modules = typeof module === "string" ? [module] : module;
     const dotted = pythonDottedName(base);
     if (!dotted)
         return false;
     const parts = dotted.split(".");
     if (parts.length === 1) {
         const binding = bindings.get(parts[0]);
-        return Boolean(binding?.kind === "named" && binding.module === module && binding.imported && allowed.has(binding.imported));
+        return Boolean(binding?.kind === "named" && modules.includes(binding.module) && binding.imported && allowed.has(binding.imported));
     }
     if (parts.length === 2 && allowed.has(parts[1])) {
         const binding = bindings.get(parts[0]);
-        return Boolean(binding?.kind === "module" && binding.module === module);
+        return Boolean(binding?.kind === "module" && modules.includes(binding.module));
     }
     return false;
 }
@@ -2741,6 +2742,9 @@ function pythonLiteralOrParameter(node, params) {
         return false;
     if (node.type === "identifier")
         return params.has(node.text);
+    // An f-string with {interpolation} computes a value; only plain literals qualify.
+    if ((node.type === "string" || node.type === "concatenated_string") && node.descendantsOfType("interpolation").length > 0)
+        return false;
     return new Set(["none", "true", "false", "integer", "float", "string", "concatenated_string"]).has(node.type);
 }
 function pythonDocstringStatement(statement) {
@@ -2749,11 +2753,18 @@ function pythonDocstringStatement(statement) {
     const expression = namedChildren(statement)[0];
     return expression?.type === "string" || expression?.type === "concatenated_string";
 }
-function pythonSuperInitStatement(statement) {
+function pythonSuperInitStatement(statement, params = new Set()) {
     if (statement.type !== "expression_statement")
         return false;
     const call = namedChildren(statement)[0];
-    if (call?.type !== "call" || pythonCallArguments(call).length !== 0)
+    if (call?.type !== "call")
+        return false;
+    // super().__init__(...) may only FORWARD this constructor's own parameters or
+    // literals (positionally or by keyword). Any computed argument is behavior.
+    const forwardsOnly = pythonCallArguments(call).every((arg) => arg.type === "keyword_argument"
+        ? pythonLiteralOrParameter(arg.childForFieldName("value"), params)
+        : pythonLiteralOrParameter(arg, params));
+    if (!forwardsOnly)
         return false;
     const fn = call.childForFieldName("function");
     if (fn?.type !== "attribute" || fn.childForFieldName("attribute")?.text !== "__init__")
@@ -2774,7 +2785,7 @@ function pythonTrivialSelfAssignment(statement, params) {
         return false;
     return pythonLiteralOrParameter(assignment.childForFieldName("right"), params);
 }
-function pythonTrivialThreadLocalInitializer(classNode) {
+function pythonTrivialInitializer(classNode) {
     const body = classNode.childForFieldName("body");
     if (!body)
         return null;
@@ -2800,40 +2811,97 @@ function pythonTrivialThreadLocalInitializer(classNode) {
         const statement = statements[i];
         if (i === 0 && pythonDocstringStatement(statement))
             continue;
-        if (statement.type === "pass_statement" || pythonSuperInitStatement(statement) || pythonTrivialSelfAssignment(statement, params))
+        if (statement.type === "pass_statement" || pythonSuperInitStatement(statement, params) || pythonTrivialSelfAssignment(statement, params))
             continue;
         return null;
     }
     return pythonQualifiedFunctionName(fn) ?? null;
 }
+const PYTHON_TYPING_SHAPES = new Set(["TypedDict", "NamedTuple", "Protocol"]);
+const PYTHON_TYPING_MODULES = ["typing", "typing_extensions"];
+const PYTHON_PYDANTIC_SHAPES = new Set(["BaseModel"]);
+const PYTHON_PYDANTIC_MODULES = ["pydantic", "pydantic.main", "pydantic.v1"];
+const PYTHON_DATACLASS_MODULES = ["dataclasses", "pydantic.dataclasses"];
+/** `@dataclass`, `@dataclass(...)`, `@dataclasses.dataclass(...)` (stdlib or pydantic's drop-in). */
+function pythonIsStdlibDataclassDecorator(decorator, bindings) {
+    let expression = namedChildren(decorator)[0] ?? null;
+    if (expression?.type === "call")
+        expression = expression.childForFieldName("function");
+    return Boolean(expression && pythonBaseIsStdlib(expression, bindings, PYTHON_DATACLASS_MODULES, new Set(["dataclass"])));
+}
+/** Class body holds only field declarations: annotations (with or without a default),
+ *  plain attribute assignments, a docstring, or `pass`. No methods, no nested classes,
+ *  no statements that run logic. */
+function pythonFieldOnlyBody(classNode) {
+    const body = classNode.childForFieldName("body");
+    if (!body)
+        return false;
+    const statements = blockStatements(body);
+    if (statements.length === 0)
+        return false;
+    return statements.every((statement, index) => {
+        if (statement.type === "pass_statement")
+            return true;
+        if (index === 0 && pythonDocstringStatement(statement))
+            return true;
+        if (statement.type !== "expression_statement")
+            return false;
+        const inner = namedChildren(statement);
+        // A lambda in a field value (e.g. custom JSON encoders) is behavior, not data.
+        return inner.length === 1 && inner[0].type === "assignment" && inner[0].childForFieldName("left")?.type === "identifier"
+            && inner[0].descendantsOfType("lambda").length === 0;
+    });
+}
 function extractPythonDeclarationRankingExclusions(root) {
     const out = [];
     for (const classNode of root.descendantsOfType("class_definition")) {
-        if (!classNode || hasPythonFunctionAncestor(classNode) || classNode.parent?.type !== "module")
+        if (!classNode || hasPythonFunctionAncestor(classNode))
+            continue;
+        // Module-level classes only (decorated or not): nested-class symbol names are
+        // not guaranteed to line up with the analyzer's symbol table.
+        const decorated = classNode.parent?.type === "decorated_definition" ? classNode.parent : null;
+        if ((decorated ?? classNode).parent?.type !== "module")
             continue;
         const name = classNode.childForFieldName("name")?.text;
-        const bases = classNode.childForFieldName("superclasses");
-        if (!name || !bases)
+        if (!name)
             continue;
-        const bindings = pythonImportsBefore(root, classNode.startIndex);
-        const baseNodes = namedChildren(bases);
-        if (baseNodes.some((base) => pythonBaseIsStdlib(base, bindings, "enum", PYTHON_ENUM_TYPES)) && !pythonClassHasMethod(classNode)) {
+        const bases = classNode.childForFieldName("superclasses");
+        const bindings = pythonImportsBefore(root, (decorated ?? classNode).startIndex);
+        const baseNodes = bases ? namedChildren(bases) : [];
+        const hasMethod = pythonClassHasMethod(classNode);
+        if (baseNodes.some((base) => pythonBaseIsStdlib(base, bindings, "enum", PYTHON_ENUM_TYPES)) && !hasMethod) {
             out.push({
                 symbol: name,
                 code: "python_stdlib_enum_declaration",
                 reason: "Standard-library enum declaration without methods — retained in the graph but excluded from priority ranking."
             });
+            continue;
         }
-        if (baseNodes.some((base) => pythonBaseIsStdlib(base, bindings, "threading", new Set(["local"])))) {
-            const initializer = pythonTrivialThreadLocalInitializer(classNode);
-            if (initializer) {
+        // Data-shape declarations: a TypedDict/NamedTuple/Protocol, a pydantic model, or a
+        // stdlib @dataclass whose body only declares fields. No method ⇒ no behavior to test.
+        if (!hasMethod && pythonFieldOnlyBody(classNode)) {
+            const typedShape = baseNodes.some((base) => pythonBaseIsStdlib(base, bindings, PYTHON_TYPING_MODULES, PYTHON_TYPING_SHAPES) ||
+                pythonBaseIsStdlib(base, bindings, PYTHON_PYDANTIC_MODULES, PYTHON_PYDANTIC_SHAPES));
+            const dataclassShape = Boolean(decorated) && namedChildren(decorated).some((child) => child.type === "decorator" && pythonIsStdlibDataclassDecorator(child, bindings));
+            if (typedShape || dataclassShape) {
                 out.push({
-                    symbol: initializer,
-                    code: "python_trivial_thread_local_initializer",
-                    reason: "Trivial threading.local initializer — retained in the graph but excluded from priority ranking."
+                    symbol: name,
+                    code: "python_data_shape_declaration",
+                    reason: "Data-shape declaration (fields only, no methods) — retained in the graph but excluded from priority ranking."
                 });
+                continue;
             }
         }
+        // Trivial constructor on ANY class: the body only stores parameters/literals on
+        // self, forwards parameters/literals to super().__init__, or passes.
+        const initializer = pythonTrivialInitializer(classNode);
+        if (initializer) {
+            out.push({
+                symbol: initializer,
+                code: "python_trivial_constructor",
+                reason: "Trivial constructor (stores or forwards its parameters only) — retained in the graph but excluded from priority ranking."
+            });
+        }
     }
     return out;
 }

package/dist/local/autoProve.js

@@ -17,6 +17,7 @@ import { basename, dirname, join, posix, relative, resolve, sep } from "node:pat
 import { generateTests, readDeclaredDeps, unresolvedLocalImports } from "./generate/generator.js";
 import { GENERATED_DIR, runHintsFor } from "./generate/runHints.js";
 import { rankRiskGaps } from "./score/risk.js";
+import { globToRegExp, loadRiskConfig } from "./score/riskConfig.js";
 import { resolveProviderConfig } from "./localConfig.js";
 import { buildProvider, DeterministicProvider } from "./generate/providers.js";
 import { resolveContained } from "./reprove/paths.js";
@@ -371,6 +372,14 @@ const GEN_WINDOW = 5;
 // file (every eligible symbol × every importing test) cannot starve the shared budget before
 // a provable hard-edge symbol is tried. Small K; promote to a flag if a repo needs a wider sweep.
 const EXISTING_LANE_MAX_WEAK_PER_SYMBOL = 3;
+// A runner that crashes without returning a result (no JSON) fails for the whole
+// project root, not for one test: test-specific problems come back as a classified
+// result. Three crashes in a row in one root stop further calls there instead of
+// walking every remaining linked target (litellm-scale repos queue 1,000+).
+const RUNNER_CRASH_LIMIT = 3;
+const RUNNER_CRASH_RE = /did not return JSON/;
+// Out of disk space is machine-wide: every later sandbox copy fails the same way.
+const DISK_FULL_RE = /\bENOSPC\b|no space left on device/i;
 const RUNNER_ROOT_MARKERS = {
     typescript: ["package.json"],
     javascript: ["package.json"],
@@ -867,6 +876,13 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
     let nonPythonCountedAttempts = 0;
     const pythonPreflightGreen = new Set();
     const pythonBlockedCounts = new Map();
+    // classification.rank_exclude_paths removes paths from ranking; proof follows the
+    // same scope so excluded areas never cost runner calls or sandbox copies.
+    const proofExcludeRe = loadRiskConfig(sourceRoot).config.classification.rank_exclude_paths.map(globToRegExp);
+    const excludedTargets = new Set();
+    const runnerCrashes = new Map();
+    const crashBlocked = new Map();
+    let diskFull;
     const changed = opts.changedFiles && opts.changedFiles.length > 0 ? new Set(opts.changedFiles) : null;
     const reader = fileReaderFor(sourceRoot); // R-2: source scan for the node:sqlite env profile
     // Fix 3: hard TESTED_BY/COVERS pairs first, weak MAY_* pairs after and capped per symbol.
@@ -884,6 +900,12 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
             continue;
         if (changed && !changed.has(symbolFileOf(node)))
             continue;
+        if (diskFull)
+            break;
+        if (proofExcludeRe.length > 0 && proofExcludeRe.some((re) => re.test(symbolFileOf(node)))) {
+            excludedTargets.add(symId);
+            continue;
+        }
         // Fix 1: already Proven for the CURRENT code (fingerprint match under #162) → skip. Re-closing
         // it would overstate newly-proven and append a redundant closed cert every run.
         if (alreadyProven.has(symId))
@@ -894,6 +916,12 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
         const targetFileRel = symbolFileOf(node);
         const targetLanguageName = language ?? targetLanguage(symId);
         const runnerRoot = projectRoot ?? proofRunnerRoot(sourceRoot, targetFileRel, testRel);
+        const crashKey = `${targetLanguageName}\u0000${runnerRoot}`;
+        const crashBlock = crashBlocked.get(crashKey);
+        if (crashBlock) {
+            crashBlock.skipped++;
+            continue;
+        }
         // A prior candidate in this exact runner project hit a classified project-wide
         // toolchain/environment failure. Preserve the budget and explain the skip.
         const isPython = isPythonFile(targetFileRel);
@@ -980,9 +1008,22 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
             attempted--;
             if (!isPython)
                 nonPythonCountedAttempts--;
-            reportProgress(`proof skipped: ${symId}: ${redactSecrets(errMsg(e))}`);
+            const message = redactSecrets(errMsg(e));
+            reportProgress(`proof skipped: ${symId}: ${message}`);
+            if (DISK_FULL_RE.test(message)) {
+                diskFull = message;
+                break;
+            }
+            if (RUNNER_CRASH_RE.test(message)) {
+                const crashes = (runnerCrashes.get(crashKey) ?? 0) + 1;
+                runnerCrashes.set(crashKey, crashes);
+                if (crashes >= RUNNER_CRASH_LIMIT) {
+                    crashBlocked.set(crashKey, { language: targetLanguageName, root: runnerRoot, skipped: 0, lastError: message.slice(0, 200) });
+                }
+            }
             continue;
         }
+        runnerCrashes.delete(crashKey);
         const { classification, reason, category } = classifyProof(result, { sourceRoot, targetFileRel });
         const baselineGreen = baselineGreenOf(result);
         if (isPython) {
@@ -1036,7 +1077,28 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
         project_root: root,
         blocked_by: block.blockedBy
     }));
-    return { attempts, needsSetup, skipped, proven, attempted, nonPythonAttempted: nonPythonCountedAttempts, provenSymbols };
+    for (const block of crashBlocked.values()) {
+        skipped.push({
+            title: `${block.language} project ${block.root}`,
+            reason: `the proof runner crashed ${RUNNER_CRASH_LIMIT} times in a row without returning a result; ${block.skipped} remaining linked target${block.skipped === 1 ? " was" : "s were"} not attempted in this root. Last error: ${block.lastError}`,
+            language: block.language,
+            project_root: block.root
+        });
+    }
+    if (excludedTargets.size > 0) {
+        const n = excludedTargets.size;
+        skipped.push({
+            title: "Excluded paths",
+            reason: `${n} linked target${n === 1 ? " is" : "s are"} under classification.rank_exclude_paths and ${n === 1 ? "was" : "were"} not attempted.`
+        });
+    }
+    if (diskFull) {
+        skipped.push({
+            title: "Disk full",
+            reason: `the disk ran out of space while preparing a proof sandbox; all remaining proof attempts were stopped. Free disk space and rerun. (${diskFull.slice(0, 200)})`
+        });
+    }
+    return { attempts, needsSetup, skipped, proven, attempted, nonPythonAttempted: nonPythonCountedAttempts, provenSymbols, ...(diskFull ? { diskFull } : {}) };
 }
 /**
  * Drive prove for the top provable TS/JS targets. Two lanes: (1) prove the repo's OWN
@@ -1083,12 +1145,14 @@ export async function autoProve(root, opts, deps) {
     const genLimit = Math.max(1, Math.min(MAX_AUTO_LIMIT, Math.floor(opts.proof_gen_limit ?? DEFAULT_PROOF_GEN_LIMIT)));
     // ── Lane 1: existing associated tests — NO key required, runs FIRST (PR 1.5). ──
     const ex = proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, proveLoop, proveDeps, alreadyProven, projectBlocked, existingLimit, genLimit, autoLimit);
-    if (opts.existingOnly) {
+    if (opts.existingOnly || ex.diskFull) {
         const status = ex.proven > 0 ? "proven-run" : ex.attempted > 0 ? "ran-no-proof" : "no-targets";
         return {
             ran: ex.attempted > 0,
             status,
-            reason: "existing-tests-only: generation disabled.",
+            reason: ex.diskFull
+                ? "Proof stopped: the disk ran out of space while preparing a proof sandbox. Free disk space and rerun."
+                : "existing-tests-only: generation disabled.",
             attempted: ex.attempted,
             proven: ex.proven,
             needs_setup: ex.needsSetup,

package/dist/local/generate/generator.js

@@ -26,7 +26,7 @@ const MAX_RELATED_FILES = 4;
 const SYMBOL_EXCERPT_CONTEXT_LINES = 3;
 const MAX_EXCERPT_CHARS = 8000;
 const MAX_TARGET_TYPE_EXCERPT_CHARS = 5000;
-const STATIC_CHECK_TIMEOUT_MS = 3000;
+const STATIC_CHECK_TIMEOUT_MS = 10000;
 // Large Go monorepos can spend tens of seconds populating a cold module cache
 // before the target package is compiled. Keep the check authoritative instead
 // of downgrading valid generated tests while dependencies are still downloading.
@@ -71,6 +71,11 @@ function testFilesForSourceFile(graph, sourceFile) {
     }
     return [...out];
 }
+/** `Model provider HTTP 429: {...body...}` → `Model provider HTTP 429 (response body omitted)`. */
+export function persistedProviderError(message) {
+    const match = /^(Model provider HTTP \d+):/.exec(message);
+    return match ? `${match[1]} (response body omitted)` : message;
+}
 /**
  * Strip a Markdown code fence (and any prose around it) from a model body. Real
  * BYOK models frequently wrap the test in ```ts … ``` with a prose preamble/suffix;
@@ -2389,14 +2394,18 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
             }
             catch (callErr) {
                 const msg = redactSecrets(callErr instanceof Error ? callErr.message : String(callErr));
+                // The terminal warning keeps the provider's response for diagnosis. Persisted
+                // drafts and missing-evidence rows end up in shareable reports, so they carry
+                // only the status line, never the provider's response body (account/billing text).
+                const persisted = persistedProviderError(msg);
                 warnings.push(`V5 planning call failed for "${gc.ctx.behavior_title}": ${msg} — no test emitted.`);
                 missing.push({
                     external_id: behavior.external_id,
                     title: gc.ctx.behavior_title,
-                    reason: `V5 planning call failed: ${msg}`,
+                    reason: `V5 planning call failed: ${persisted}`,
                     needed: ["a reachable model provider"]
                 });
-                emitManualPlanningFallback(`V5 planning call failed: ${msg}.`);
+                emitManualPlanningFallback(`V5 planning call failed: ${persisted}.`);
                 continue;
             }
             try {

package/dist/local/operations.js

@@ -1687,10 +1687,13 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     // Proof is minted only by opProveLoop's UNCHANGED oracle; no key ⇒ no files, no proof.
     reportProgress(opts.noAuto
         ? "auto-prove: disabled (--no-auto)"
-        : "auto-prove: driving generate → prove on the top provable targets", { current: 6, total: 8 });
+        : opts.ai === false
+            ? "auto-prove: proving with existing tests only (--no-ai: no test generation)"
+            : "auto-prove: driving generate → prove on the top provable targets", { current: 6, total: 8 });
     let autoProveResult;
     try {
-        autoProveResult = await autoProve(root, {
+        const scopedFiles = autoProveChangedScope(loadGraph(workspacePaths(root).graphPath), changed, opts.baseRef);
+        const runAutoProve = (changedFiles) => autoProve(root, {
             autoLimit: opts.proofLimit ?? opts.autoLimit,
             proof_existing_limit: opts.proofLimit ?? opts.autoLimit ?? loadedRiskConfig.config.proof.attempt_limit,
             proof_gen_limit: loadedRiskConfig.config.proof.baseline_green_target,
@@ -1698,8 +1701,24 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
             provider: providerOpts.provider,
             model: providerOpts.model,
             prompt_version: opts.promptVersion,
-            changedFiles: autoProveChangedScope(loadGraph(workspacePaths(root).graphPath), changed, opts.baseRef)
+            changedFiles,
+            // --no-ai means no model calls anywhere in the run. The generation lane is gated
+            // only by a key in the environment, so with a real provider configured it must
+            // honor the flag explicitly. Without a key (or with the offline deterministic
+            // provider) no model is called anyway and the released no-key path is unchanged.
+            existingOnly: opts.ai === false && generationProviderConfigured && !deterministicGeneration
         }, { ...providerDeps, proveLoop: opProveLoop });
+        autoProveResult = await runAutoProve(scopedFiles);
+        if (scopedFiles && autoProveResult.attempted === 0 && !opts.baseRef && !opts.noAuto) {
+            // An uncommitted working tree implicitly scoped the pass, but nothing in that
+            // scope was provable. Fall back to the global top targets instead of reporting
+            // "not attempted" for a reason the user cannot see. --base keeps strict scoping.
+            warnings.push(`auto-prove: none of the ${scopedFiles.length} uncommitted changed file(s) had a provable target with a linked test; ran the global top targets instead.`);
+            autoProveResult = await runAutoProve(undefined);
+        }
+        else if (scopedFiles) {
+            autoProveResult = { ...autoProveResult, scoped_changed_files: scopedFiles.length };
+        }
         for (const skip of autoProveResult.skipped)
             warnings.push(`auto-prove skipped ${skip.target_symbol ?? skip.title}: ${skip.reason}`);
     }
@@ -1944,6 +1963,9 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
         const dynForReport = {
             attempted: autoProveResult.attempted,
             proven: autoProveResult.proven,
+            status: autoProveResult.status,
+            reason: autoProveResult.reason,
+            ...(autoProveResult.scoped_changed_files !== undefined ? { scopedChangedFiles: autoProveResult.scoped_changed_files } : {}),
             needsSetup: autoProveResult.needs_setup
                 .filter((a) => !a.deduped)
                 .map((a) => ({ category: a.category, reason: a.reason }))

package/dist/local/proofDoctor.js

@@ -107,6 +107,9 @@ export function distillProofAttempts(auto, meta) {
         artifact_identity: meta.graph.artifact_identity,
         attempted: auto.attempted,
         proven: auto.proven,
+        ...(auto.status ? { status: auto.status } : {}),
+        ...(auto.reason ? { reason: redactSecrets(auto.reason) } : {}),
+        ...(auto.scoped_changed_files !== undefined ? { scoped_changed_files: auto.scoped_changed_files } : {}),
         attempts: auto.attempts.filter((a) => !a.deduped).map((a) => ({
             target_symbol: a.target_symbol,
             test_path: a.test_path || undefined,

package/dist/local/provenance.js

@@ -3,7 +3,7 @@ import { ORS_VERSION } from "./score/risk.js";
 import { ORANGEPRO_VERSION } from "./version.js";
 import { hashString } from "./util/hash.js";
 export const ARTIFACT_IDENTITY_VERSION = "orangepro.artifact_identity.v1";
-export const ANALYZER_VERSION = "orangepro.analyzer.v5";
+export const ANALYZER_VERSION = "orangepro.analyzer.v6";
 export const PROOF_ORACLE_VERSION = "orangepro.targeted_mutation_oracle.v3";
 function stable(value) {
     if (value === null || typeof value !== "object")

package/dist/local/score/risk.js

@@ -78,15 +78,18 @@ function confirmedBehaviorIds(graph, provenIds) {
     }
     return ids;
 }
-/** Bounded repository-wide history acquisition. Deliberately constants, not hidden timeouts. */
-export const GIT_CHURN_MAX_COMMITS = 5_000;
-export const GIT_CHURN_TIMEOUT_MS = 60_000;
+/** Default bounds for repository-wide history acquisition (overridable via
+ *  tuning.churn_max_commits / tuning.churn_timeout_seconds, always disclosed).
+ *  Sized so an active monorepo's full 180-day window completes (a 5,000-commit /
+ *  60 s bound truncated windows that 0.2.44 scanned completely). */
+export const GIT_CHURN_MAX_COMMITS = 20_000;
+export const GIT_CHURN_TIMEOUT_MS = 300_000;
 const GIT_FIRST_COMMIT_BATCH = 200;
 /**
  * This worker intentionally uses spawn, not execFileSync: stdout is parsed as it
- * arrives, so a 60s bound returns the values already observed instead of erasing
- * completed chunks. It retains only requested paths, bounding the worker map and
- * handoff payload by ranking input rather than repository history. The scoring API
+ * arrives, so a time bound returns the values already observed instead of erasing
+ * completed chunks. It keeps one counter per path the window touched (bounded by
+ * the window, not by total history) so a single scan serves every caller. The scoring API
  * is synchronous, therefore the worker signals only after writing its result file.
  */
 const GIT_CHURN_WORKER_SOURCE = String.raw `
@@ -95,7 +98,7 @@ const { writeFileSync } = require("node:fs");
 const { workerData } = require("node:worker_threads");
 const state = new Int32Array(workerData.signal);
 const values = new Map();
-const trackedFiles = new Set(workerData.files);
+const trackedFiles = Array.isArray(workerData.files) ? new Set(workerData.files) : null;
 let commitsScanned = 0;
 let commitLimitReached = false;
 let expectingTimestamp = false;
@@ -110,7 +113,7 @@ let child;
 let childClosed = false;
 const firstLine = (text) => String(text || "").split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "";
 const add = (path, adds, dels) => {
-  if (!path || commitLimitReached || !trackedFiles.has(path)) return;
+  if (!path || commitLimitReached || (trackedFiles && !trackedFiles.has(path))) return;
   values.set(path, (values.get(path) || 0) + adds + dels);
 };
 const consume = (token) => {
@@ -260,12 +263,17 @@ function gitChurn(root, files, window, health = inspectRiskInputHealth(root, win
     // Values are retained only for the requested paths, so that set and clone
     // state are part of cache identity. A checkout can be marked partial at an
     // unchanged HEAD and must then remain truthfully provisional.
-    const requestedFiles = [...new Set(files)].sort();
-    const requested = new Set(requestedFiles);
-    const key = `${health.gitRoot ?? root}\0${health.commit ?? ""}\0${health.history}\0${window}\0${hashString(JSON.stringify(requestedFiles))}`;
+    const requested = new Set(files);
+    const tuning = loadRiskConfig(root).config.tuning;
+    const maxCommits = tuning.churn_max_commits ?? GIT_CHURN_MAX_COMMITS;
+    const timeoutMs = (tuning.churn_timeout_seconds ?? GIT_CHURN_TIMEOUT_MS / 1000) * 1000;
+    // ONE bounded scan per repository state: values are kept for every path the
+    // window touched and filtered per caller, so the ranking, the report header and
+    // the static snapshot never each pay for (and each time out on) the same scan.
+    const key = `${health.gitRoot ?? root}\0${health.commit ?? ""}\0${health.history}\0${window}\0${maxCommits}\0${timeoutMs}`;
     const cached = historyCache.get(key);
     if (cached)
-        return { ...cached, values: new Map(cached.values) };
+        return { ...cached, values: new Map([...cached.values].filter(([file]) => requested.has(file))) };
     const dir = mkdtempSync(join(tmpdir(), "orangepro-churn-"));
     const resultPath = join(dir, "result.json");
     const signal = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
@@ -277,9 +285,9 @@ function gitChurn(root, files, window, health = inspectRiskInputHealth(root, win
             workerData: {
                 root,
                 window,
-                files: requestedFiles,
-                maxCommits: GIT_CHURN_MAX_COMMITS,
-                timeoutMs: GIT_CHURN_TIMEOUT_MS,
+                files: null,
+                maxCommits,
+                timeoutMs,
                 cloneState: health.history,
                 resultPath,
                 signal
@@ -287,7 +295,7 @@ function gitChurn(root, files, window, health = inspectRiskInputHealth(root, win
         });
         // The worker publishes a partial result 100ms after its child timeout; leave
         // explicit scheduling room before the synchronous API forces it down.
-        Atomics.wait(state, 0, 0, GIT_CHURN_TIMEOUT_MS + 2_000);
+        Atomics.wait(state, 0, 0, timeoutMs + 2_000);
         if (Atomics.load(state, 0) === 1)
             parsed = JSON.parse(readFileSync(resultPath, "utf8"));
         void worker.terminate().catch(() => undefined);
@@ -519,6 +527,10 @@ const IMPORTED_REPLACEMENT_CALL_RE = /^replace[A-Za-z0-9_]*$/i;
 // removals (`pollers.Remove`, `RemoveSpeculativeWorkflowTaskTimeout`) are not.
 const REMOVE_CALL_RE = /^remove(?![A-Za-z0-9_]*(?:listener|handler|observer|callback|attribute|attr|class|child|style|hook|timeout|timer)$)[A-Za-z0-9_]*$/i;
 const PERSISTENCE_FIELD_RE = /(store|client|db|repo|repository|persistence|manager|queue|bucket|index|table|storage|dao)/i;
+// The browser Web Storage API (`sessionStorage` / `localStorage`, optionally via
+// `window.`) is a per-tab/per-device client cache, not a durable data store. Its
+// `removeItem` matches the persistence vocabulary ("storage") by name only.
+const BROWSER_WEB_STORAGE_FIELD_RE = /(^|\.)(sessionStorage|localStorage)$/;
 const SCHEDULED_ENTRY_NAME_RE = /(^|\.)(run|execute|handle|process|tick|scan)$/i;
 const SCHEDULED_ENTRY_PATH_RE = /(^|\/)(jobs?|workers?|scanners?|scavengers?|cron|schedulers?|processors?|consumers?|reconcil\w*)(\/|$)/i;
 /** A time- or queue-triggered entry: nothing calls it synchronously, nobody waits
@@ -646,28 +658,48 @@ export function rankRiskGaps(graph, opts = {}) {
     // attributed; CALLS already has an exact symbol target. Older graphs without
     // these metadata facts fail closed instead of redistributing imports.
     const incoming = new Map();
+    // Display-only breakdown of the same total, so a reader can reconcile the
+    // number against the graph: CALLS edges + named imports + module.attr references.
+    const incomingParts = new Map();
+    const addIncoming = (id, kind, n) => {
+        incoming.set(id, (incoming.get(id) ?? 0) + n);
+        const parts = incomingParts.get(id) ?? { calls: 0, named: 0, attrs: 0 };
+        parts[kind] += n;
+        incomingParts.set(id, parts);
+    };
     for (const e of graph.edges) {
         if (e.relationship_type === "CALLS" && symbolIds.has(e.to_external_id)) {
-            incoming.set(e.to_external_id, (incoming.get(e.to_external_id) ?? 0) + 1);
+            addIncoming(e.to_external_id, "calls", 1);
         }
         else if (e.relationship_type === "IMPORTS") {
             const named = e.properties?.symbol_imports;
             if (Array.isArray(named))
                 for (const id of new Set(named)) {
                     if (typeof id === "string" && symbolIds.has(id) && fileBySymbolId.get(id) === e.to_external_id) {
-                        incoming.set(id, (incoming.get(id) ?? 0) + 1);
+                        addIncoming(id, "named", 1);
                     }
                 }
             const refs = e.properties?.symbol_references;
             if (refs && typeof refs === "object" && !Array.isArray(refs)) {
                 for (const [id, count] of Object.entries(refs)) {
                     if (symbolIds.has(id) && typeof count === "number" && Number.isSafeInteger(count) && count > 0 && fileBySymbolId.get(id) === e.to_external_id) {
-                        incoming.set(id, (incoming.get(id) ?? 0) + count);
+                        addIncoming(id, "attrs", count);
                     }
                 }
             }
         }
     }
+    const incomingBreakdown = (id) => {
+        const parts = incomingParts.get(id);
+        if (!parts || (parts.named === 0 && parts.attrs === 0))
+            return "";
+        const bits = [`${parts.calls} call${parts.calls === 1 ? "" : "s"}`];
+        if (parts.named > 0)
+            bits.push(`${parts.named} named import${parts.named === 1 ? "" : "s"}`);
+        if (parts.attrs > 0)
+            bits.push(`${parts.attrs} module.attribute reference${parts.attrs === 1 ? "" : "s"}`);
+        return ` (${bits.join(" + ")})`;
+    };
     // Per-symbol churn share: file churn weighted by the symbol's line span so one
     // hot file no longer awards its full churn to every method it contains.
     const fileComplexityTotals = new Map();
@@ -726,20 +758,21 @@ export function rankRiskGaps(graph, opts = {}) {
         // segment. `q.Clock().Now().Truncate` is a chain of return values, not a surface.
         const viaField = (c) => !c.slice(0, c.lastIndexOf(".")).includes("(");
         const fieldOf = (c) => c.slice(0, c.lastIndexOf("."));
+        const persistentRemove = (c) => REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c)) && !BROWSER_WEB_STORAGE_FIELD_RE.test(fieldOf(c));
         const destructive = ext.find((c) => viaField(c) && (isDestructiveTerminal(lastSeg(c)) ||
-            (REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c))) ||
+            persistentRemove(c) ||
             extraSinks.some((re) => re.test(lastSeg(c)))));
         if (destructive)
             return destructive;
         return importedStatic.find((c) => viaField(c) && (isDestructiveTerminal(lastSeg(c)) ||
             IMPORTED_REPLACEMENT_CALL_RE.test(lastSeg(c)) ||
-            (REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c))) ||
+            persistentRemove(c) ||
             extraSinks.some((re) => re.test(lastSeg(c)))));
     };
     const reachedSinkFrom = (id, depth, seen) => {
         const own = sinkCallee(id);
         if (own)
-            return own;
+            return { callee: own, owner: id };
         if (depth === 0)
             return undefined;
         for (const t of fanOutTargets.get(id) ?? []) {
@@ -752,7 +785,12 @@ export function rankRiskGaps(graph, opts = {}) {
         }
         return undefined;
     };
-    const sinkReached = new Map(normalizationSymbols.map((s) => [s.external_id, reachedSinkFrom(s.external_id, 2, new Set([s.external_id]))]));
+    const endpointHandlers = new Set(graph.edges
+        .filter((e) => e.relationship_type === "IMPLEMENTED_IN" && nodeById.get(e.from_external_id)?.kind === "Endpoint")
+        .map((e) => e.to_external_id));
+    const frameworkInvoked = (node) => node.properties.cli_entrypoint === true || endpointHandlers.has(node.external_id);
+    const sinkHits = new Map(normalizationSymbols.map((s) => [s.external_id, reachedSinkFrom(s.external_id, 2, new Set([s.external_id]))]));
+    const sinkReached = new Map([...sinkHits].map(([k, v]) => [k, v?.callee]));
     const reachesSink = new Map([...sinkReached].map(([k, v]) => [k, v !== undefined]));
     const depthCtx = buildFlowDepthContext(graph);
     const staticLinked = staticTestLinkedIds(graph, symbolIds);
@@ -766,7 +804,13 @@ export function rankRiskGaps(graph, opts = {}) {
         if (node.properties.ranking_exclusion_code === "python_class_with_methods" || node.properties.ranking_exclusion_code === "python_structural_container" || node.properties.ranking_exclusion_reason === "python_structural_container")
             return true;
         const code = node.properties.ranking_exclusion_reason_code;
-        if (node.properties.ranking_exclusion_code === "trivial_constructor" || node.properties.ranking_exclusion_code === "enum_declaration" || code === "python_trivial_thread_local_initializer" || code === "python_stdlib_enum_declaration")
+        if (node.properties.ranking_exclusion_code === "trivial_constructor" ||
+            node.properties.ranking_exclusion_code === "enum_declaration" ||
+            node.properties.ranking_exclusion_code === "data_shape_declaration" ||
+            code === "python_trivial_thread_local_initializer" ||
+            code === "python_trivial_constructor" ||
+            code === "python_stdlib_enum_declaration" ||
+            code === "python_data_shape_declaration")
             return true;
         return (node.properties.ranking_exclusion_code === "thin_external_delegate" || code === "python_thin_external_delegate")
             && deriveDataSensitivity(node) <= 1
@@ -848,12 +892,16 @@ export function rankRiskGaps(graph, opts = {}) {
         const d = raw.d;
         const detectionTier = detectionFor(s.external_id);
         let score = Math.round(pExact * iExact * d * 10) / 10;
-        const disconnected = incoming_refs === 0 && fan_out === 0;
+        // A framework-invoked entry (a registered CLI command, or a handler bound to an
+        // Endpoint) has no static caller BY CONSTRUCTION; "disconnected" means dead-code
+        // shaped, which an entry the framework calls is not. Before per-symbol fan-in,
+        // such entries escaped this dampener only through file-split import counts.
+        const disconnected = incoming_refs === 0 && fan_out === 0 && !frameworkInvoked(s);
         if (disconnected)
             score = Math.round(score * 0.25 * 10) / 10;
         const reasons = [
             `ORS ${score} ≈ P${p} × I${i} × D${d}`,
-            `${incoming_refs} incoming symbol-specific structural reference${incoming_refs === 1 ? "" : "s"}`,
+            `${incoming_refs} incoming symbol-specific structural reference${incoming_refs === 1 ? "" : "s"}${incomingBreakdown(s.external_id)}`,
             churnAvailable
                 ? `${git_churn} git churn line${git_churn === 1 ? "" : "s"} attributed to this symbol in recent history`
                 : churnResult.state === "partial"
@@ -880,7 +928,7 @@ export function rankRiskGaps(graph, opts = {}) {
             reasons.push(`config override (${override.action}): ${override.reason}`);
         return {
             ...(override && override.action !== "suppress" ? { override: { action: override.action, reason: override.reason } } : {}),
-            ...(sinkReached.get(s.external_id) ? { sink_callee: sinkReached.get(s.external_id) } : {}),
+            ...(sinkHits.get(s.external_id) ? { sink_callee: sinkHits.get(s.external_id).callee, sink_owner: sinkHits.get(s.external_id).owner } : {}),
             ...(raw.scheduledEntry ? { scheduled_entry: true } : {}),
             detection_tier: detectionTier,
             id: s.external_id,
@@ -1000,7 +1048,7 @@ export function configDisclosureFor(graph, repoRoot) {
         rankExcludePaths: cfg.classification.rank_exclude_paths,
         floor: cfg.tuning.irreversibility_floor,
         silence: cfg.tuning.silence_multiplier,
-        tuning: { churn_window_days: cfg.tuning.churn_window_days },
+        tuning: { churn_window_days: cfg.tuning.churn_window_days, churn_max_commits: cfg.tuning.churn_max_commits, churn_timeout_seconds: cfg.tuning.churn_timeout_seconds },
         proof: cfg.proof,
         classification: {
             test_support_paths: cfg.classification.test_support_paths,

package/dist/local/score/riskConfig.js

@@ -11,7 +11,7 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 export const DEFAULT_RISK_CONFIG = {
     classification: { test_support_paths: [], scheduled_entry_paths: [], destructive_sinks: [], sensitivity_ignore: [], rank_exclude_paths: [] },
-    tuning: { irreversibility_floor: true, silence_multiplier: true, churn_window_days: 180 },
+    tuning: { irreversibility_floor: true, silence_multiplier: true, churn_window_days: 180, churn_max_commits: 20_000, churn_timeout_seconds: 300 },
     proof: { python_runner: "auto", attempt_limit: 20, baseline_green_target: 5 },
     overrides: []
 };
@@ -51,6 +51,10 @@ function applyFile(cfg, file, warnings, label) {
             cfg.tuning.silence_multiplier = tun.silence_multiplier;
         if (tun.churn_window_days !== undefined)
             cfg.tuning.churn_window_days = boundedInt(tun.churn_window_days, cfg.tuning.churn_window_days, 1, 3_650);
+        if (tun.churn_max_commits !== undefined)
+            cfg.tuning.churn_max_commits = boundedInt(tun.churn_max_commits, cfg.tuning.churn_max_commits, 100, 200_000);
+        if (tun.churn_timeout_seconds !== undefined)
+            cfg.tuning.churn_timeout_seconds = boundedInt(tun.churn_timeout_seconds, cfg.tuning.churn_timeout_seconds, 10, 1_800);
         const proof = (raw.proof ?? {});
         if (typeof proof.python_runner === "string" && proof.python_runner.trim() !== "") {
             cfg.proof.python_runner = proof.python_runner.trim();

package/dist/local/viz/behaviorReportData.js

@@ -178,10 +178,19 @@ function proofGuidance(ledger, summary, dyn) {
     // — behaviors, flows, Statically Linked signals — is unaffected; only the dynamic pass is small.
     if (dyn) {
         if (dyn.attempted === 0) {
+            const why = dyn.status === "disabled"
+                ? " Auto-prove was disabled for this run (--no-auto)."
+                : dyn.scopedChangedFiles !== undefined
+                    ? ` The pass was scoped to ${dyn.scopedChangedFiles.toLocaleString()} changed file${dyn.scopedChangedFiles === 1 ? "" : "s"} in the working tree, and none had a provable target with a linked test.`
+                    : dyn.status === "no-targets"
+                        ? " No provable target with a linked existing test was found."
+                        : dyn.reason
+                            ? ` ${dyn.reason}`
+                            : "";
             return {
                 state: "not_started",
                 title: "0 Dynamically Proven — dynamic proof was not attempted",
-                body: "Dynamic proof was not attempted in this run. Static behavior mapping and Statically Linked signals are still available.",
+                body: `Dynamic proof was not attempted in this run.${why} Static behavior mapping and Statically Linked signals are still available.`,
                 action: HANDOFF_ACTION
             };
         }
@@ -486,7 +495,7 @@ function displayTitle(title, file) {
 }
 /** Deterministic 1–2 line behavior context from graph facts only — no LLM.
  *  Sensitivity label mirrors deriveDataSensitivity's tiers. */
-export function riskContext(risk, churnWindowDays, churnMeta) {
+export function riskContext(risk, churnWindowDays, churnMeta, sameSinkAs) {
     const sens = (risk.data_sensitivity ?? 1) >= 10 ? "payment/billing-sensitive"
         : (risk.data_sensitivity ?? 1) >= 9 ? "auth/session-sensitive"
             : (risk.data_sensitivity ?? 1) >= 7 ? "order/transaction"
@@ -507,7 +516,10 @@ export function riskContext(risk, churnWindowDays, churnMeta) {
             : "change history unavailable";
     const tier = risk.detection_tier ?? "";
     const evidence = tier === "candidate"
-        ? "no test links here (a similarly-named test exists but never calls it)"
+        // Candidate = a name-level signal only. The analyzer did not credit an asserted
+        // call; it cannot claim the test never calls the code (stored-result asserts and
+        // pytest.raises are not yet credited for Python).
+        ? "no confirmed test link (a similarly-named test exists, but no asserted call to it was recognized)"
         : tier === "associated" ? "a test calls it but nothing proves it fails when broken" : "no test links here";
     const sinkShort = sink ? sink.split(".").pop() ?? sink : "";
     // Line 1 — the consequence, in plain English, from the signals only.
@@ -524,6 +536,7 @@ export function riskContext(risk, churnWindowDays, churnMeta) {
     const seen = [
         pos + (sens ? ` on ${sens} paths` : ""),
         ...(sink ? [`reaches \`${sink}\` within two calls`] : []),
+        ...(sink && sameSinkAs ? [`same delete call as \`${sameSinkAs}\` (ranked higher)`] : []),
         ...(scheduled ? ["scheduled / queue-triggered"] : []),
         `${risk.fan_out ?? 0} downstream call${(risk.fan_out ?? 0) === 1 ? "" : "s"}`,
         churn,
@@ -941,6 +954,12 @@ function riskRows(risks, graph, churnWindowDays, churnMeta) {
     for (const r of risks)
         if (!firstRowForFile.has(r.file))
             firstRowForFile.set(r.file, r.id);
+    // R8.10 (display only): rows that reach the SAME destructive call site through
+    // forwarding wrappers name the higher-ranked row. Order and membership unchanged.
+    const firstRowForSink = new Map();
+    for (const r of risks)
+        if (r.sink_owner && !firstRowForSink.has(r.sink_owner))
+            firstRowForSink.set(r.sink_owner, { id: r.id, title: r.title });
     // Ambiguity-qualified display: identical titles from DIFFERENT files
     // (multi-program repos: 76 x main) get their top-level dir as a prefix.
     // Purely display; single-file titles render unchanged everywhere else.
@@ -990,7 +1009,9 @@ function riskRows(risks, graph, churnWindowDays, churnMeta) {
                     todo: riskTodo(risk, verb, path, generatedTests)
                 };
             })(),
-            context: riskContext(risk, churnWindowDays, churnMeta),
+            context: riskContext(risk, churnWindowDays, churnMeta, risk.sink_owner && firstRowForSink.get(risk.sink_owner) && firstRowForSink.get(risk.sink_owner).id !== risk.id
+                ? firstRowForSink.get(risk.sink_owner).title
+                : undefined),
             desc: risk.reasons.join(" · "),
             tags
         };
@@ -1040,7 +1061,16 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         provenIds,
         includeAssociated: true
     }).filter((r) => r.sink_callee).slice(0, 20)
-        .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, sink: r.sink_callee ?? "" }));
+        .map((r, _index, rows) => {
+        const first = rows.find((x) => x.sink_owner && x.sink_owner === r.sink_owner);
+        return {
+            path: r.title,
+            file: r.file,
+            score: r.risk_score,
+            sink: r.sink_callee ?? "",
+            ...(first && first.id !== r.id ? { sameSinkAs: first.title } : {})
+        };
+    });
     const riskHealth = inspectRiskInputHealth(repoRoot);
     const codeFiles = Object.entries(graph.manifest.files).filter(([, file]) => file.kind === "code").map(([file]) => file);
     const churnMeta = inspectRiskChurn(repoRoot, codeFiles, riskHealth.churnWindow);

package/dist/local/viz/behaviorReportHtml.js

@@ -1060,13 +1060,13 @@ renderRisks();
   const P=C.proof||{};
   const T=C.tuning||{};
   const clsSet=["test_support_paths","scheduled_entry_paths","destructive_sinks","sensitivity_ignore"].filter(k=>(K[k]||[]).length>0);
-  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0||(T.churn_window_days??180)!==180||P.python_runner!=="auto"||P.attempt_limit!==20||P.baseline_green_target!==5;
+  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0||(T.churn_window_days??180)!==180||(T.churn_max_commits??20000)!==20000||(T.churn_timeout_seconds??300)!==300||P.python_runner!=="auto"||P.attempt_limit!==20||P.baseline_green_target!==5;
   const bits=["config <b>"+esc(C.hash)+"</b>","overrides active <b>"+C.overridesActive+"</b>","suppressed <b>"+(C.suppressed||[]).length+"</b>"];
   if((C.rankExcludePaths||[]).length)bits.push("ranking excludes <b>"+esc(C.rankExcludePaths.join(", "))+"</b>");
   if(!C.floor)bits.push("<b>irreversibility floor OFF</b>");
   if(!C.silence)bits.push("<b>silence multiplier OFF</b>");
   let html="<div>"+bits.join(" · ")+"</div>";
-  html+='<span class="cfg-row">Churn window: <b>'+esc(String(T.churn_window_days??180))+' days</b></span>';
+  html+='<span class="cfg-row">Churn window: <b>'+esc(String(T.churn_window_days??180))+' days</b> · history bound <b>'+esc(String(T.churn_max_commits??20000))+' commits / '+esc(String(T.churn_timeout_seconds??300))+' s</b></span>';
   html+='<span class="cfg-row">Python proof: runner <b>'+esc(P.python_runner||"auto")+'</b> · attempt limit <b>'+esc(String(P.attempt_limit??20))+'</b> · green baseline target <b>'+esc(String(P.baseline_green_target??5))+'</b></span>';
   clsSet.forEach(k=>{html+='<span class="cfg-row">'+esc(k)+': <b>'+esc(K[k].join(", "))+'</b></span>';});
   if((C.sensitivityIgnored||[]).length)html+='<span class="cfg-row">sensitivity ignored by config (score changed): <b>'+esc(C.sensitivityIgnored.join(", "))+'</b></span>';
@@ -1086,7 +1086,7 @@ renderRisks();
     return \`<div class="wl-row" data-path="\${esc(path).replace(/"/g,'&quot;')}" title="\${inTop?'in the ranked list below — click to jump':'ranked, but below the top-20 cut'}"><span class="wl-path">\${esc(path)}</span><span class="wl-meta">\${esc(meta)}</span></div>\`;
   };
   const cf=(W.changeFrontier||[]).map(r=>row(r.path,"changes "+(r.probability>=7?"a lot":r.probability>=4?"often":"some"))).join("")||'<div class="wl-empty">nothing changing fast and unproven</div>';
-  const ir=(W.irreversible||[]).map(r=>row(r.path,"→ "+(r.sink||"").split(".").pop())).join("")||'<div class="wl-empty">no unproven path reaches a delete</div>';
+  const ir=(W.irreversible||[]).map(r=>row(r.path,"→ "+(r.sink||"").split(".").pop()+(r.sameSinkAs?" · same delete as "+r.sameSinkAs:""))).join("")||'<div class="wl-empty">no unproven path reaches a delete</div>';
   host.innerHTML=\`<div class="wl-grid">
     <div class="wl-card"><p class="wl-title wl-change">Changing fast · unproven</p><p class="wl-sub">Where the code moves most with nothing proving it. The place a bug is most likely to have just arrived.</p>\${cf}</div>
     <div class="wl-card"><p class="wl-title wl-irrev">Can destroy data · unproven</p><p class="wl-sub">Paths that reach a delete or purge with nothing proving they do the right thing. Rarely changing — which is why nobody looks.</p>\${ir}</div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.45",
+  "version": "0.2.47",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",

package/scripts/spikes/dynamic-proof-spike.mjs

@@ -646,8 +646,33 @@ function copyRuntimeAliasTarget(absTarget, dest, isFile) {
   });
 }
 
-function copyFixtureRoot(root, label, { linkNodeModules, workspaceRoot }) {
+// A failed copy (e.g. ENOSPC) must not leave a partial multi-GB sandbox behind:
+// remove this copy's temp dir before rethrowing.
+function copyFixtureRoot(root, label, options) {
   const tmpRoot = mkdtempSync(path.join(tmpdir(), `opro-dynamic-proof-${label}-`));
+  try {
+    return populateFixtureRoot(tmpRoot, root, options);
+  } catch (error) {
+    rmSync(tmpRoot, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+// Directories that are never JS test inputs but can be very large when the analyzed
+// root is a polyglot repo: Python environments and caches, and Rust build output
+// (`target/` next to a Cargo.toml). Copying them made each sandbox several GB.
+const NON_JS_HEAVY_DIRS = new Set([".venv", "venv", "__pycache__", ".pytest_cache", ".mypy_cache", ".ruff_cache", ".tox"]);
+function isNonJsHeavyDir(source, name) {
+  if (!NON_JS_HEAVY_DIRS.has(name) && name !== "target") {
+    return false;
+  }
+  if (!lstatSync(source).isDirectory()) {
+    return false;
+  }
+  return name !== "target" || existsSync(path.join(path.dirname(source), "Cargo.toml"));
+}
+
+function populateFixtureRoot(tmpRoot, root, { linkNodeModules, workspaceRoot }) {
   const monoRoot = path.join(tmpRoot, "mono");
   // On any policy violation, mirror nothing → package lands alone at tmpRoot/mono with its
   // dangling extends / unresolved alias → baseline fails to transform/resolve → honest
@@ -730,6 +755,9 @@ function copyFixtureRoot(root, label, { linkNodeModules, workspaceRoot }) {
       if (source !== root && lstatSync(source).isSymbolicLink()) {
         return false;
       }
+      if (source !== root && isNonJsHeavyDir(source, name)) {
+        return false;
+      }
       return name !== "node_modules" && name !== ".git" && name !== ".orangepro";
     }
   });
@@ -2283,7 +2311,13 @@ function main() {
   const mochaBin = args.mochaBin ? path.resolve(args.mochaBin) : defaultMochaBin(root, workspaceRoot);
 
   const baselineCopy = copyFixtureRoot(root, "baseline", { linkNodeModules: args.linkNodeModules, workspaceRoot });
-  const mutantCopy = copyFixtureRoot(root, "mutant", { linkNodeModules: args.linkNodeModules, workspaceRoot });
+  let mutantCopy;
+  try {
+    mutantCopy = copyFixtureRoot(root, "mutant", { linkNodeModules: args.linkNodeModules, workspaceRoot });
+  } catch (error) {
+    rmSync(baselineCopy.tmpRoot, { recursive: true, force: true });
+    throw error;
+  }
   try {
     const baseline = runTest({ runner, repoRoot: baselineCopy.repoRoot, monoRoot: baselineCopy.monoRoot, testRel, vitestBin, jestBin, mochaBin, vitestConfigRel, jestConfigRel, timeoutMs, testEnv, aliases: baselineCopy.aliases });
     mutateMethod(path.join(mutantCopy.repoRoot, targetRel), args.method, replacementBody);

package/scripts/spikes/go-dynamic-proof-spike.mjs

@@ -126,16 +126,22 @@ function resolveInside(root, relOrAbs) {
 function copyModuleRoot(root, label) {
   const tmpRoot = mkdtempSync(path.join(tmpdir(), `opro-go-proof-${label}-`));
   const repoRoot = path.join(tmpRoot, "module");
-  cpSync(root, repoRoot, {
-    recursive: true,
-    filter(source) {
-      const name = path.basename(source);
-      if (source !== root && lstatSync(source).isSymbolicLink()) {
-        return false;
+  try {
+    cpSync(root, repoRoot, {
+      recursive: true,
+      filter(source) {
+        const name = path.basename(source);
+        if (source !== root && lstatSync(source).isSymbolicLink()) {
+          return false;
+        }
+        return name !== "node_modules" && name !== ".git" && name !== ".orangepro";
       }
-      return name !== "node_modules" && name !== ".git" && name !== ".orangepro";
-    }
-  });
+    });
+  } catch (error) {
+    // A failed copy (e.g. ENOSPC) must not leave a partial sandbox behind.
+    rmSync(tmpRoot, { recursive: true, force: true });
+    throw error;
+  }
   return { tmpRoot, repoRoot };
 }
 
@@ -558,7 +564,13 @@ function main() {
   const pkgPath = pkgDirRel === "." ? "./" : `./${pkgDirRel.split(path.sep).join("/")}`;
 
   const baselineCopy = copyModuleRoot(root, "baseline");
-  const mutantCopy = copyModuleRoot(root, "mutant");
+  let mutantCopy;
+  try {
+    mutantCopy = copyModuleRoot(root, "mutant");
+  } catch (error) {
+    rmSync(baselineCopy.tmpRoot, { recursive: true, force: true });
+    throw error;
+  }
   // The mutant sandbox's package directory: Go prints failure-frame files as
   // basenames relative to it, so FIX 2 resolves the test source there.
   const pkgDirAbs = path.join(mutantCopy.repoRoot, path.dirname(targetRel));

package/scripts/spikes/java-dynamic-proof-spike.mjs

@@ -106,16 +106,22 @@ function resolveInside(root, relOrAbs) {
 function copyModuleRoot(root, label) {
   const tmpRoot = mkdtempSync(path.join(tmpdir(), `opro-java-proof-${label}-`));
   const repoRoot = path.join(tmpRoot, "module");
-  cpSync(root, repoRoot, {
-    recursive: true,
-    filter(source) {
-      const name = path.basename(source);
-      if (source !== root && lstatSync(source).isSymbolicLink()) {
-        return false;
+  try {
+    cpSync(root, repoRoot, {
+      recursive: true,
+      filter(source) {
+        const name = path.basename(source);
+        if (source !== root && lstatSync(source).isSymbolicLink()) {
+          return false;
+        }
+        return name !== "node_modules" && name !== ".git" && name !== ".orangepro" && name !== "target";
       }
-      return name !== "node_modules" && name !== ".git" && name !== ".orangepro" && name !== "target";
-    }
-  });
+    });
+  } catch (error) {
+    // A failed copy (e.g. ENOSPC) must not leave a partial sandbox behind.
+    rmSync(tmpRoot, { recursive: true, force: true });
+    throw error;
+  }
   return { tmpRoot, repoRoot };
 }
 
@@ -506,7 +512,13 @@ function main() {
   const timeoutMs = parseTimeoutMs(args.timeoutMs);
 
   const baselineCopy = copyModuleRoot(root, "baseline");
-  const mutantCopy = copyModuleRoot(root, "mutant");
+  let mutantCopy;
+  try {
+    mutantCopy = copyModuleRoot(root, "mutant");
+  } catch (error) {
+    rmSync(baselineCopy.tmpRoot, { recursive: true, force: true });
+    throw error;
+  }
   try {
     const baseline = runSurefire({
       repoRoot: baselineCopy.repoRoot,