v0.2.35

• Go call graph: receiver-method calls (t.method()) now resolve to the receiver type's methods, same file and same package — Temporal CALLS edges 8,075 → 13,673
• Unresolved external callees retained as names on the caller (external_callees) — no new nodes or edges
• Risk: paths reaching a destructive call on an external surface (store/client/admin/db) floor impact at 5; unproven scheduled/queue-triggered entries get detection ×1.25; reasons shown on the row
• Ranking hygiene: test-support paths, one-line declarations, and trivial accessors no longer take risk slots (denominator unchanged)
• Per-repo risk config in .orangepro/config.json: classification globs, two tuning switches, and suppress/pin/reclassify overrides that require a written reason; config hash recorded in report provenance and the run delta
• Evidence tiers, the proof oracle, and the compile gate are unchanged