mollify 0.1.5

Calibration and portability fixes from the first real-world corpus evaluation: every engine run against pinned checkouts of requests, flask, rich, MediaCrawler, and MoneyPrinterTurbo, with every certain finding hand-audited. Fingerprints are unaffected — existing baselines survive.

Highlights

• unused-import calibration — PEP 484 redundant-alias re-exports (from x import Y as Y), # noqa/# noqa: F401, try/except availability probes, cross-module re-export consumers, and quoted cast() type args are honored. flask now has zero certain unused-imports and mollify fix proposes nothing there (was 2 destructive edits).
• Cross-platform report identity — every location.path is root-relative with / separators on all OSes; fingerprints and baselines port between Linux, macOS, and Windows, pinned in CI by a cross-OS golden fingerprint contract (new windows-latest matrix).
• unused-parameter interface-bound suppression — dunder methods, @abstractmethod/@overload/@override, overrides of in-project base methods, external-base classes, and decorated callbacks are never flagged (100 corpus hits on flask were override/callback signatures).
• untyped-function package rollup — deliberately-untyped packages (60%+ of 20+ eligible public functions) get one likely package-level finding; per-function findings demote to uncertain.
• Security noise calibration — candidates in test/docs/example trees cap at uncertain and are tagged in the reason.
• Robustness — engine panic isolation (a crashing engine degrades to a single engine-panic finding), UTF-8-aware dupes tokenizer (no more OOM on Unicode identifiers), chaos + fuzz test suites.
• Housekeeping — offline advisory sample moved to cookbook/advisories.sample.json; ureq 3 / toml 1.x migrations; docs sweep.

219 tests green on Linux + Windows. Full details in CHANGELOG.md.

Install: uvx mollify audit · pip install mollify · cargo install mollify-cli