sourcecode 4.17.0__py3-none-any.whl → 5.0.0__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.17.0"
+__version__ = "5.0.0"

sourcecode/cache_model.py

@@ -74,11 +74,11 @@ class CommandCache:
     cold_seconds: "Optional[float]" = None
     warm_seconds: "Optional[float]" = None
     #: The other measured point: this command on the field repository
-    #: (3 342 Java files, Windows 11 / PowerShell 5.1 / pipx, cold), from field
-    #: evaluations #13, #14 and #16. Seconds where a run finished; `field_blocked`
-    #: where it did not — the harness promoted the process and the session died,
-    #: which is a measurement of a different kind and is never written as a
-    #: duration. Rows with neither were not attempted there.
+    #: (3 342 Java files, Windows 11 / PowerShell 5.1 / pipx, warm), from the
+    #: field evaluations. Seconds where a run finished; `field_blocked` where it
+    #: did not — the harness promoted the process and the session died, which is a
+    #: measurement of a different kind and is never written as a duration. Rows
+    #: with neither were not attempted there.
     #:
     #: C3-72: where two evaluations of the same command at this size disagree, the
     #: figure here is the **most recent** one, because it describes the build a
@@ -88,6 +88,17 @@ class CommandCache:
     #: measurement C3-76 exists for.
     field_seconds: "Optional[float]" = None
     field_blocked: bool = False
+    #: **C3-97.** The build the field figure was taken on. An anchor without one is
+    #: a measurement that can outlive its build and keep deciding: 4.18.0 deleted
+    #: two catastrophic-backtracking patterns (C3-95, C3-96) and every figure taken
+    #: before it describes a cost that no longer exists — `spring-audit` at 2 351 s
+    #: where the same command on the same commit of the same repository now takes
+    #: 8,4 s. Anchors older than the running build are still published, because a
+    #: measurement is worth more than silence; what changes is that they are
+    #: **labelled** with the build they belong to, so a reader can see the figure is
+    #: not this one's. `field_anchor_note()` renders that label and
+    #: `execution_plan` appends it to the `here:` line.
+    field_measured_version: "Optional[str]" = None
 
 
 #: Where every `measured` figure comes from.
@@ -109,26 +120,38 @@ REFERENCE_JAVA_FILES = 2000
 REFERENCE_MEASURED_VERSION = "3.2.2"
 
 #: The other end of the measured range, and the reason this module publishes a
-#: *class* rather than a projected duration (C4-19). Field evaluation #16, on
+#: *class* rather than a projected duration (C4-19). Field evaluation #22, on
 #: Windows 11 / PowerShell 5.1 / pipx / Python 3.10: `spring-audit` on a
-#: 3 342-file repository ran **2 351 s** — 267× the 8.8 s the same command takes
-#: on the 2 000-file reference, for a repository 1,7× the size. Cost does not
-#: scale with file count in any way this product has measured, so a projected
-#: "~15 s on your repository" would be a confident falsehood of exactly the kind
-#: the ledger exists to prevent. What can be said honestly is the class, the two
-#: measured anchors, and how to run it.
+#: 3 342-file repository ran **8,4 s** — the same command takes 8.8 s on the
+#: 2 000-file reference, for a repository 1,7× the size.
 #:
-#: C3-72 replaced evaluation #13's 408 s with #16's 2 351 s here: the same command
-#: on the same repository at the same commit, measured three releases later
-#: (2 557 s in 4.10.6, 2 398 s in 4.10.7, 2 351 s in 4.11.0). The older figure was
-#: the one a budget message quoted as "~600s" for three releases while the
-#: measurement stood four times higher.
+#: **The refusal to project stands, and this evaluation strengthened it** (C3-97).
+#: For eight releases the pair of anchors said *cost does not track file count*;
+#: what the series actually shows is that **cost tracks the build**. The identical
+#: command on the identical commit of the identical repository measured 2 557 s
+#: (4.10.6), 2 398 s (4.10.7), 2 351 s (4.11.0), 2 377 s (4.12.0), 1 371 s
+#: (4.16.0) and 8,4 s (4.18.0) — a 280× move produced by deleting two
+#: catastrophic-backtracking patterns (C3-95, C3-96), with every payload
+#: byte-identical throughout. A projection would therefore have to predict our own
+#: next release, which is the confident falsehood the ledger exists to prevent.
+#: What can be said honestly is the class, the two measured anchors, **the build
+#: each was measured on**, and how to run it.
+#:
+#: History of this constant, kept because it is the measurement C3-76 exists for:
+#: 408 s (#13) → 2 351 s (#16, C3-72) → 8,4 s (#22, C3-97). The middle figure was
+#: quoted as an operational anchor for four releases after the build that produced
+#: it, and told operators to detach commands that finish in seconds.
 FIELD_ANCHOR = (
-    "field evaluation #16: spring-audit on 3 342 Java files took 2 351 s "
+    "field evaluation #22: spring-audit on 3 342 Java files took 8.4 s "
     "(Windows, pipx, warm cache) against 8.8 s on the 2 000-file reference"
 )
 FIELD_ANCHOR_JAVA_FILES = 3342
-FIELD_ANCHOR_SECONDS = 2351.4
+FIELD_ANCHOR_SECONDS = 8.4
+
+#: The build the field anchors above were taken on. Rows carrying a different
+#: `field_measured_version` are published with that build's name attached rather
+#: than as figures for this one (C3-97).
+FIELD_ANCHOR_MEASURED_VERSION = "4.18.0"
 
 
 #: Every layer keys on `cache.worktree_signature` — the exact tree state (C1-9).
@@ -196,12 +219,12 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "`--env-map`, `--depth N` and `--exclude` change the *analysis*, so they miss the "
                  "warmed core and rescan — this is the 171 s the field measured after a 103 s warm.",
                  "--compact 13.3 s cold → 0.3 s warm (cold re-measured on 3.7.0: was 19.3 s, C3-6); "
-                 "--agent --full --env-map --depth 20 34.7 s → 33.9 s (no gain)", analysis_class="repo-wide", cold_seconds=13.3, warm_seconds=0.3, field_seconds=115.0),
+                 "--agent --full --env-map --depth 20 34.7 s → 33.9 s (no gain)", analysis_class="repo-wide", cold_seconds=13.3, warm_seconds=0.3, field_seconds=115.0, field_measured_version="4.10.4"),
     CommandCache("posture", ("cir", "parse"), "shared", False,
                  "Resolves the conditional bean graph on every run, over the shared CIR a warm "
                  "builds — the parse it used to repeat for itself. `--diff` compares two profile "
                  "sets over that one IR, so the second side costs the resolution only.",
-                 "10.1 s → 1.6 s", analysis_class="repo-wide", cold_seconds=10.1, warm_seconds=1.6, field_seconds=38.0),
+                 "10.1 s → 1.6 s", analysis_class="repo-wide", cold_seconds=10.1, warm_seconds=1.6, field_seconds=8.0, field_measured_version="4.18.0"),
     CommandCache("risk", ("cir", "parse"), "shared", False,
                  "Composes what the audit, impact-chain and the posture already answer, so it "
                  "pays each of their costs once over the shared CIR a warm builds — one parse "
@@ -209,7 +232,7 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "within the run.",
                  "not measured on the battery yet — the composition is bounded by the "
                  "`spring-audit` + `impact-chain` costs listed here, not by new analysis",
-                 analysis_class="deep", field_seconds=3232.2),
+                 analysis_class="deep", field_seconds=73.3, field_measured_version="4.18.0"),
     CommandCache("enrich", ("cir", "parse"), "shared", False,
                  "Runs the same composition as `risk` over the repository, then joins a SARIF "
                  "log to it. Reading the log is negligible; everything a warm helps with is the "
@@ -239,25 +262,31 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "Recomputes the endpoint surface on every run, over a parse a warm has already "
                  "paid for. Until 3.7.0 the extractor parsed every file itself instead of reading "
                  "the shared parse cache, and a warm measurably bought it nothing (C3-6).",
-                 "3.3 s → 1.4 s (re-measured on 3.7.0; was 2.8 s → 2.9 s)", analysis_class="repo-wide", cold_seconds=3.3, warm_seconds=1.4, field_seconds=5.0),
+                 "3.3 s → 1.4 s (re-measured on 3.7.0; was 2.8 s → 2.9 s)", analysis_class="repo-wide", cold_seconds=3.3, warm_seconds=1.4, field_seconds=3.8, field_measured_version="4.18.0"),
     CommandCache("spring-audit", ("ris", "parse"), "shared", False,
                  "Recomputes every run, but over a parse a warm has already paid for.",
-                 "8.8 s → 3.7 s", analysis_class="repo-wide", cold_seconds=8.8, warm_seconds=3.7, field_seconds=2351.4),
+                 "8.8 s → 3.7 s", analysis_class="repo-wide", cold_seconds=8.8, warm_seconds=3.7, field_seconds=8.4, field_measured_version="4.18.0"),
     CommandCache("migrate-check", ("cir",), "none", False,
                  "Computes its own inventory and shares nothing a warm builds. Only `--blast-radius` "
                  "reuses the shared CIR.",
-                 "4.8 s → 4.8 s", analysis_class="repo-wide", cold_seconds=4.8, warm_seconds=4.8, field_seconds=26.7),
+                 "4.8 s → 4.8 s", analysis_class="repo-wide", cold_seconds=4.8, warm_seconds=4.8, field_seconds=10.2, field_measured_version="4.18.0"),
     CommandCache("impact-chain", ("cir", "parse"), "shared", False,
                  "The CIR is the expensive half — this is where a warm pays most.",
-                 "9.9 s → 1.7 s", analysis_class="core", cold_seconds=9.9, warm_seconds=1.7),
-    CommandCache("impact", ("parse",), "shared", False, "", "4.9 s → 2.8 s", analysis_class="core", cold_seconds=4.9, warm_seconds=2.8),
+                 "9.9 s → 1.7 s", analysis_class="core", cold_seconds=9.9, warm_seconds=1.7,
+                 field_seconds=5.5, field_measured_version="4.18.0"),
+    CommandCache("impact", ("parse",), "shared", False, "", "4.9 s → 2.8 s", analysis_class="core", cold_seconds=4.9, warm_seconds=2.8,
+                 field_seconds=7.7, field_measured_version="4.18.0"),
     CommandCache("pr-impact", ("parse",), "shared", False,
-                 "Diff-dependent: the answer itself is never stored.", analysis_class="core"),
+                 "Diff-dependent: the answer itself is never stored. What it costs follows the "
+                 "diff, not the repository: 12,5 s on an ordinary one and 11,8 s on a diff of "
+                 "security configuration, measured at field scale.", analysis_class="core",
+                 field_seconds=12.5, field_measured_version="4.18.0"),
     CommandCache("verify", (), "none", False, "Runs the contracts against a fresh reading.", analysis_class="core"),
     CommandCache("verify-edit", ("parse",), "shared", True,
                  "Built for the edit loop: the parse cache is what keeps an unchanged file out of the "
                  "next run. Its own second run is faster again.",
-                 "14.6 s → 9.6 s → 5.6 s on repeat", analysis_class="repo-wide", cold_seconds=14.6, warm_seconds=9.6, field_blocked=True),
+                 "14.6 s → 9.6 s → 5.6 s on repeat", analysis_class="repo-wide", cold_seconds=14.6, warm_seconds=9.6,
+                 field_blocked=True, field_measured_version="4.10.4"),
     CommandCache("review-pr", ("cir",), "none", False,
                  "Diff-dependent, and it reuses the CIR only if one exists. On a small diff, loading "
                  "the warmed CIR costs more than the work it saves.",
@@ -286,11 +315,18 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "WITHOUT a warm, a second identical run: 10.2 s → 9.4 s (5 486 files) — "
                  "no answer hit", analysis_class="repo-wide", cold_seconds=6.5, warm_seconds=0.3),
     CommandCache("explain", ("cir",), "shared", False, "Serves from the shared CIR a warm builds.",
-                 "9.8 s → 1.6 s", analysis_class="core", cold_seconds=9.8, warm_seconds=1.6),
+                 "9.8 s → 1.6 s", analysis_class="core", cold_seconds=9.8, warm_seconds=1.6,
+                 field_seconds=4.4, field_measured_version="4.18.0"),
     CommandCache("export", ("parse",), "shared", False, "", "8.8 s → 3.7 s", analysis_class="repo-wide", cold_seconds=8.8, warm_seconds=3.7),
-    CommandCache("repo-ir", ("parse",), "shared", False, "", "5.1 s → 2.9 s", analysis_class="repo-wide", cold_seconds=5.1, warm_seconds=2.9, field_blocked=True),
-    CommandCache("validation", ("parse",), "shared", False, "", "11.6 s → 6.4 s", analysis_class="repo-wide", cold_seconds=11.6, warm_seconds=6.4),
-    CommandCache("modernize", ("parse",), "shared", False, "", "5.2 s → 3.0 s", analysis_class="repo-wide", cold_seconds=5.2, warm_seconds=3.0, field_blocked=True),
+    CommandCache("repo-ir", ("parse",), "shared", False, "", "5.1 s → 2.9 s", analysis_class="repo-wide", cold_seconds=5.1, warm_seconds=2.9,
+                 field_blocked=True, field_measured_version="4.10.4"),
+    CommandCache("validation", ("parse",), "shared", False, "", "11.6 s → 6.4 s", analysis_class="repo-wide", cold_seconds=11.6, warm_seconds=6.4,
+                 field_seconds=17.4, field_measured_version="4.18.0"),
+    CommandCache("modernize", ("parse",), "shared", False,
+                 "Blocked in the session that recorded C3-53 and measured since: a run that did "
+                 "not finish once is not a command that cannot finish.",
+                 "5.2 s → 3.0 s", analysis_class="repo-wide", cold_seconds=5.2, warm_seconds=3.0,
+                 field_seconds=9.1, field_measured_version="4.18.0"),
     CommandCache("chunk-file", (), "none", False, "Reads one file; nothing to cache.", analysis_class="core"),
     CommandCache("cold-start", ("ris",), "answer", True,
                  "Reads the RIS a warm rebuilds — that is all it does. Without one it answers "
@@ -298,7 +334,7 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "0.2 s either way", analysis_class="core", cold_seconds=0.2, warm_seconds=0.2),
     CommandCache("trend", (), "none", False, "Reads stored baseline artifacts from disk; analyses no source, so no cache layer applies. Same command as `baseline trend`.", analysis_class="none"),
     CommandCache("baseline", ("parse",), "shared", False, "`capture`/`diff`/`trend` over architectural metrics.",
-                 "capture 8.7 s → 3.6 s", analysis_class="repo-wide", cold_seconds=8.7, warm_seconds=3.6, field_seconds=11.0),
+                 "capture 8.7 s → 3.6 s", analysis_class="repo-wide", cold_seconds=8.7, warm_seconds=3.6, field_seconds=11.0, field_measured_version="4.10.4"),
     CommandCache("retrieve", ("cir", "parse"), "shared", False,
                  "Every query builds or reuses the shared CIR a warm builds.", analysis_class="core"),
     CommandCache("archetype", ("parse",), "shared", False, "", "9.3 s → 5.6 s", analysis_class="repo-wide", cold_seconds=9.3, warm_seconds=5.6),
@@ -363,12 +399,102 @@ class Conditioning:
         return (
             f"This repository ({self.scope}) is larger than the repository the "
             f"figures below were measured on ({REFERENCE_JAVA_FILES} Java files), "
-            f"and cost has not been observed to scale with file count: "
+            f"and what cost tracks here is the build rather than the file count: "
             f"{FIELD_ANCHOR}. Read each figure as the reference's, not as yours; "
             f"the `here:` lines say how each command can be run on this one."
         )
 
 
+def field_anchor_note(row: "Optional[CommandCache]") -> "Optional[str]":
+    """The build a row's field figure belongs to, when it is not this one (C3-97).
+
+    ``None`` when there is nothing to qualify — no field figure, or one measured on
+    the running build. Otherwise a short parenthetical naming the build, because a
+    figure carrying another release's name is a measurement and a figure carrying
+    none is a claim about this one.
+
+    The figure is never suppressed. A measurement from four releases ago still
+    beats silence for a reader deciding how to run a command; what it must not do
+    is arrive undated, which is how `spring-audit`'s 2 351 s went on recommending
+    a nightly job for a command that had come to take 8,4 s.
+    """
+    if row is None or (row.field_seconds is None and not row.field_blocked):
+        return None
+    from sourcecode import __version__
+
+    measured_on = row.field_measured_version
+    if measured_on is None:
+        return "build not recorded"
+    if measured_on == __version__:
+        return None
+    # Short on purpose: this rides along every `here:` line and every row of
+    # `cache model`, and the build is the whole fact. The sentence that explains
+    # what an older build means is `field_currency()['statement']`, printed once.
+    return f"on {measured_on}"
+
+
+def cost_sentence() -> str:
+    """The one paragraph the front page says about cost, derived here (CL-21).
+
+    `--help` and the README used to carry their own hand-written version of it —
+    *"repo-wide/deep compositions can take minutes … use deep jobs nightly"* —
+    which stayed true for as long as the anchors behind it did and then went on
+    being printed for two more releases, recommending a nightly job for commands
+    that had come to finish in seconds. A sentence maintained beside the table it
+    describes is the second copy of a fact, which is the rule this module opens
+    with. It is generated from the anchors instead, so refreshing them refreshes
+    the prose.
+    """
+    audit = next((r for r in COMMANDS if r.command == "spring-audit"), None)
+    seconds = FIELD_ANCHOR_SECONDS if audit is None or audit.field_seconds is None else audit.field_seconds
+    return (
+        f"Cost tracks the command class and the build, not the file count: "
+        f"per-symbol queries are the fast path, inventory commands scale with "
+        f"files, and a repository-wide audit measured {seconds:g} s on a "
+        f"{_thousands(FIELD_ANCHOR_JAVA_FILES)}-file repository "
+        f"({FIELD_ANCHOR_MEASURED_VERSION}). `ask cache model` prints the figure "
+        f"and the build behind it for every command; "
+        f"ASK_MAX_ANALYSIS_SECONDS/ASK_PROGRESS bound and narrate a run where CI "
+        f"wants an explicit budget."
+    )
+
+
+def _thousands(n: int) -> str:
+    return f"{n:,}".replace(",", " ")
+
+
+def field_currency() -> dict:
+    """The same statement as `reference_currency`, for the field anchors (C3-97).
+
+    Published so a consumer can see which side of the pair is current without
+    parsing prose, and so the gap is visible the day it opens rather than the day
+    an evaluation points at it.
+    """
+    from sourcecode import __version__
+
+    current = __version__
+    stale = sorted(
+        row.command
+        for row in COMMANDS
+        if (row.field_seconds is not None or row.field_blocked)
+        and row.field_measured_version not in (None, current)
+    )
+    return {
+        "anchor": FIELD_ANCHOR,
+        "measured_on_version": FIELD_ANCHOR_MEASURED_VERSION,
+        "running_version": current,
+        "current": FIELD_ANCHOR_MEASURED_VERSION == current,
+        "rows_measured_on_an_earlier_build": stale,
+        "statement": (
+            f"The field anchors were taken on {FIELD_ANCHOR_MEASURED_VERSION}; you "
+            f"are running {current}. Each row states the build its field figure "
+            f"belongs to, and no figure is projected onto this one."
+            if FIELD_ANCHOR_MEASURED_VERSION != current
+            else f"The field anchors were taken on {current}, the build you are running."
+        ),
+    }
+
+
 def reference_currency() -> dict:
     """How old the reference figures are, in releases the reader can name (F-AP).
 
@@ -429,9 +555,10 @@ def as_dict(here: "Optional[Conditioning]" = None) -> dict:
         # table nine releases old cannot read as this build's measurement.
         "reference_currency": reference_currency(),
         # Published beside the reference so no consumer reads the figures as a
-        # law: the same command has been measured 46× slower on a repository 1.7×
-        # the size, on a different platform (C4-19).
+        # law: the same command on the same commit of the same repository has
+        # measured 2 351 s and 8,4 s on two of our own builds (C4-19, C3-97).
         "field_anchor": FIELD_ANCHOR,
+        "field_currency": field_currency(),
         "commands": [
             {
                 "command": cmd.command,
@@ -453,6 +580,20 @@ def as_dict(here: "Optional[Conditioning]" = None) -> dict:
                     if cmd.cold_seconds is None
                     else {"cold": cmd.cold_seconds, "warm": cmd.warm_seconds}
                 ),
+                # C3-97: the field figure and the build it belongs to travel
+                # together, or not at all. A consumer that reads the seconds
+                # without the build is the defect this key exists to prevent.
+                "field_measurement": (
+                    None
+                    if cmd.field_seconds is None and not cmd.field_blocked
+                    else {
+                        "seconds": cmd.field_seconds,
+                        "did_not_finish": cmd.field_blocked,
+                        "java_files": FIELD_ANCHOR_JAVA_FILES,
+                        "measured_on_version": cmd.field_measured_version,
+                        "note": field_anchor_note(cmd),
+                    }
+                ),
             }
             for cmd in COMMANDS
         ],
@@ -478,6 +619,13 @@ def render_markdown() -> str:
         f"performance gate (`docs/perf/REGRESSION-GATE.md`) is what re-measures them."
     )
     out.append("")
+    out.append(
+        f"The second anchor is the field one, and it carries its own build for the "
+        f"same reason (C3-97): {FIELD_ANCHOR}. Where a command was measured on an "
+        f"earlier release than the one you are running, `ask cache model` says so "
+        f"on that row rather than presenting the figure as this build's."
+    )
+    out.append("")
     out.append("| Command | A warm gives it | Measured (nothing cached → after a warm) | Repeat run cached | Layers | Notes |")
     out.append("|---|---|---|---|---|---|")
     for cmd in COMMANDS:
@@ -556,12 +704,26 @@ def render_text(here: "Optional[Conditioning]" = None) -> str:
     lines.append("What a warm gives each command")
     lines.append(f"  Timings: {REFERENCE_REPOSITORY}, each command measured in isolation.")
     lines.append(f"  {reference_currency()['statement']}")
+    lines.append(f"  {field_currency()['statement']}")
     width = max(len(c.command) for c in COMMANDS)
     for cmd in COMMANDS:
         repeat = "repeat cached" if cmd.repeat else "recomputes"
         lines.append(f"  {cmd.command.ljust(width)}  {_WARM_LABEL[cmd.warm]:<16} ({repeat})")
         if cmd.measured:
             lines.append(f"  {' ' * width}    measured: {cmd.measured}")
+        if cmd.field_seconds is not None or cmd.field_blocked:
+            # C3-97: never the seconds without the build they were taken on.
+            note = field_anchor_note(cmd)
+            shown = (
+                "did not finish in an interactive session"
+                if cmd.field_seconds is None
+                else f"{cmd.field_seconds:g} s"
+            )
+            suffix = f" ({note})" if note else ""
+            lines.append(
+                f"  {' ' * width}    field:    {shown} at "
+                f"{_thousands(FIELD_ANCHOR_JAVA_FILES)} Java files{suffix}"
+            )
         if cmd.note:
             lines.append(f"  {' ' * width}    {cmd.note}")
         if here is not None and cmd.command in here.per_command:

sourcecode/cli.py

@@ -467,6 +467,25 @@ def _help_scope() -> "Optional[Any]":
         return None
 
 
+def _cost_sentence() -> str:
+    """What the front page says about cost, from the module that measured it.
+
+    CL-21: this paragraph used to be written here, went stale with the anchors it
+    paraphrased, and kept telling operators to schedule a nightly job for commands
+    that finish in seconds. It is `cache_model`'s sentence now, so it cannot drift
+    from the table `ask cache model` prints.
+    """
+    try:
+        from sourcecode.cache_model import cost_sentence
+
+        return cost_sentence()
+    except Exception:
+        return (
+            "Cost tracks the command class and the build: `ask cache model` prints "
+            "what each command measured, and on which build."
+        )
+
+
 def _build_help_text(scope: "Optional[Any]" = None) -> str:
     """Build --help text dynamically based on current license state."""
     try:
@@ -485,10 +504,7 @@ def _build_help_text(scope: "Optional[Any]" = None) -> str:
 Deterministic Java/Spring semantics and reusable structural context for AI coding agents.
 
 Cache warms on first scan; later calls reuse pre-built context instead of rescanning.
-Performance depends on command class and repo size: per-symbol queries are the fast path,
-inventory commands scale with files, and repo-wide/deep compositions can take
-minutes on multi-thousand-endpoint repositories. Use deep jobs nightly or with
-ASK_MAX_ANALYSIS_SECONDS/ASK_PROGRESS when CI needs an explicit budget.
+{_cost_sentence()}
 
 {_start_here_block(scope)}
 
@@ -8285,14 +8301,20 @@ def spring_audit_cmd(
     )
     _stopped_early: Optional[str] = None
 
+    from sourcecode import context_cache as _ctxcache
+
     phase = f"auditing {len(file_list)} Java files"
     with _expensive_analysis_scope("spring-audit", target, phase):
         _prog = Progress()
         _prog.start(phase)
         try:
-            cir = ContextGraph.build(
-                file_list, target, progress=_work_sink(_prog)
-            ).cir
+            # The parse is ~89 % of this command's wall clock (measured: 8,54 s of
+            # 9,53 s on a 1 303-file repository) and it is the same parse the other
+            # knowledge commands share, so it is fetched rather than rebuilt — which
+            # is what makes a warm worth anything here (cold == warm before C3-94).
+            cir = _ctxcache.shared_cir(
+                target, file_list, progress=_work_sink(_prog)
+            )
             # C3-85: the stretch between the last `linking` tick and the first rule
             # tick reports nothing, and what stays on the line is `n/n` — a counter
             # that finished, reading as a stage still running. Measured on keycloak
@@ -9966,7 +9988,7 @@ def _migration_blast_radius(
         from sourcecode.spring_model import SpringSemanticModel
 
         try:
-            cir, _ = _ctxcache.get_or_build_cir(_resolve_repo_root(target), target, file_list)
+            cir = _ctxcache.shared_cir(target, file_list)
         except Exception:
             cir = ContextGraph.build(file_list, target).cir
         model = SpringSemanticModel.build(cir)
@@ -10520,10 +10542,7 @@ def impact_chain_cmd(
     # a fresh build, exactly as explain does, so impact-chain never breaks.
     from sourcecode import context_cache as _ctxcache
     try:
-        cir, _ = _ctxcache.get_or_build_cir(
-            _resolve_repo_root(target), target, file_list,
-            progress=_work_sink(_prog),
-        )
+        cir = _ctxcache.shared_cir(target, file_list, progress=_work_sink(_prog))
     except Exception:
         cir = ContextGraph.build(file_list, target, progress=_work_sink(_prog)).cir
     _model = SpringSemanticModel.build(cir)
@@ -10849,11 +10868,13 @@ def explain_cmd(
         )
         raise typer.Exit(code=1)
 
-    # AI Context Cache — operates at the *knowledge* level: it caches the
-    # reusable Canonical IR (the expensive Java parse), keyed only by knowledge
-    # state, not by command. explain then derives its answer cheaply from that
-    # shared CIR. The same cached CIR is reused for free by any other command.
-    # Provider-agnostic and best-effort: any fault degrades to a fresh build.
+    # AI Context Cache — operates at the *knowledge* level: it caches the reusable
+    # Canonical IR (the expensive Java parse), keyed by knowledge state and by the
+    # analysed set, not by command. explain then derives its answer cheaply from
+    # that shared CIR, and any other command over the same files reuses it for
+    # free. Provider-agnostic and best-effort: any fault degrades to a fresh build.
+    # This call site keeps the lower-level entry point because it reports the
+    # lookup (`_cc_look`); `shared_cir` is the same door without the receipt.
     _prog = Progress()
     _prog.start(f"explaining {class_name} ({len(file_list)} files)")
     _cc_look = None

sourcecode/context_cache.py

@@ -651,6 +651,33 @@ class KnowledgeLookup:
         return f"Context cache: MISS  (build {self.build_ms:.0f}ms)"
 
 
+def analysed_set_signature(root: Path, file_list: list[str]) -> str:
+    """Fingerprint of *what was analysed*: the scope root and the exact file set.
+
+    The shared CIR is keyed on knowledge state, and until C3-94 "knowledge state"
+    was read as the worktree alone — which is only half of it. A run bounded to a
+    subdirectory parses a *subset* of the same worktree, and the resulting CIR is
+    a different artifact answering a different question. Keyed on the worktree
+    alone, both artifacts collided on one entry: measured on a 861-file repository,
+    ``explain WebUtil <repo>/web`` stored a 42-file / 382-symbol CIR under the
+    repo-wide key, and the next repo-wide command read it and answered about 3 % of
+    the repository — silently, because the reader passes its own ``file_paths`` to
+    ``ir_dict_to_canonical`` and the reconstructed CIR then reports 861 files
+    beside 382 symbols.
+
+    So the analysed set is stated, not hoped for. The scope path and the file list
+    are both in it: two roots can yield the same file count, and a caller that
+    filters its list (tests in or out) is asking about a different population than
+    one that does not.
+    """
+    payload = "".join([
+        str(root.resolve()),
+        str(len(file_list)),
+        hashlib.sha256("\n".join(sorted(file_list)).encode("utf-8")).hexdigest(),
+    ])
+    return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:16]
+
+
 def get_or_build_cir(
     repo_root: Path,
     root: Path,
@@ -662,11 +689,19 @@ def get_or_build_cir(
     """Return ``(CanonicalRepositoryIR, KnowledgeLookup)``, caching the CIR.
 
     This is the knowledge-level entry point. It caches the **reusable** raw IR
-    (the expensive Java parse) keyed only by knowledge state — not by command —
-    so every command that needs a CIR shares one cache entry. On a hit the full
-    CIR is rebuilt cheaply from the cached raw IR via ``ir_dict_to_canonical``,
-    skipping the parse entirely. Best-effort: any cache fault falls back to a
-    fresh build.
+    (the expensive Java parse) keyed by knowledge state and by the analysed set —
+    not by command — so every command that parses the same files shares one cache
+    entry. On a hit the full CIR is rebuilt cheaply from the cached raw IR via
+    ``ir_dict_to_canonical``, skipping the parse entirely. Best-effort: any cache
+    fault falls back to a fresh build.
+
+    A **repo-wide** run (``root`` is ``repo_root``) owns the scope-free entry —
+    the one :func:`peek_cir` reads without knowing any file list, which is why
+    that key must stay free of one. Every **bounded** run keys on its own analysed
+    set instead, so it can neither read nor overwrite the repo-wide answer. Either
+    way the entry carries the analysed signature it was built from and a reader
+    whose set does not match rebuilds: the key prevents the collision, the check
+    makes the prevention verifiable rather than assumed (C3-94).
 
     `progress` is the (done, total, stage) sink the caller's heartbeat reads
     (C3-56). It reaches only the *building* paths, which is the honest place for
@@ -684,14 +719,23 @@ def get_or_build_cir(
         cir = build_canonical_ir(file_list, root, since=since, progress=progress)
         return cir, KnowledgeLookup(hit=False, enabled=False)
 
-    key = cache.knowledge_key(SCOPE_JAVA_CIR, options={"since": since} if since else None)
+    analysed = analysed_set_signature(root, file_list)
+    options: dict[str, Any] = {"since": since} if since else None
+    if root.resolve() != repo_root.resolve():
+        # A bounded run: its own entry, never the repo-wide one.
+        options = dict(options or {})
+        options["analysed"] = analysed
+    key = cache.knowledge_key(SCOPE_JAVA_CIR, options=options)
 
     t0 = time.perf_counter()
     cached = cache.get(key)
     lookup_ms = (time.perf_counter() - t0) * 1000
     if cached is not None:
         raw = cached.payload.get("raw_ir")
-        if isinstance(raw, dict):
+        stored = (cached.metadata or {}).get("analysed_set")
+        # An entry written before C3-94 carries no signature; it cannot be shown to
+        # describe this analysed set, so it is not served as if it did.
+        if isinstance(raw, dict) and stored == analysed:
             try:
                 cir = ir_dict_to_canonical(raw, file_paths=file_list)
                 if not validate_canonical_ir(cir):
@@ -708,6 +752,8 @@ def get_or_build_cir(
                 "scope": SCOPE_JAVA_CIR,
                 "cir_hash": cir.cir_hash,
                 "schema_version": cir.schema_version,
+                "analysed_set": analysed,
+                "analysed_root": str(root.resolve()),
                 "file_count": len(cir.files),
                 "symbol_count": len(cir.symbols),
             },
@@ -725,6 +771,41 @@ def get_or_build_cir(
     return cir, KnowledgeLookup(hit=False, enabled=True, build_ms=build_ms)
 
 
+def repo_root_of(root: Path) -> Path:
+    """The enclosing git root, or *root* itself outside a repository."""
+    candidate = root.resolve()
+    while True:
+        if (candidate / ".git").exists():
+            return candidate
+        if candidate.parent == candidate:
+            return root.resolve()
+        candidate = candidate.parent
+
+
+def shared_cir(
+    root: Path,
+    file_list: list[str],
+    *,
+    since: Optional[str] = None,
+    progress: "Optional[Callable[[int, int, str], None]]" = None,
+) -> Any:
+    """The Java CIR for *root*, from the shared knowledge cache.
+
+    The one door for a command that needs the repository parse and does not care
+    where it comes from: it resolves the enclosing repository itself, so a caller
+    holds no opinion about cache scope — the reason each call-site that built its
+    own CIR was one more place for the scope rule to be got wrong (C3-94).
+
+    Best-effort by construction: `get_or_build_cir` degrades to a fresh build on
+    any cache fault, so the answer never depends on the cache being there.
+    """
+    cir, _lookup = get_or_build_cir(
+        repo_root_of(root), Path(root).resolve(), file_list,
+        since=since, progress=progress,
+    )
+    return cir
+
+
 def peek_cir(
     repo_root: Path,
     *,
@@ -755,6 +836,12 @@ def peek_cir(
     raw = cached.payload.get("raw_ir")
     if not isinstance(raw, dict):
         return None
+    # The caller is promised the *repo-wide* CIR, so the entry has to say it is one.
+    # C3-94 makes the key unreachable to bounded runs; this re-reads the fact from
+    # the entry rather than inferring it from the key, and treats an entry written
+    # before that guarantee (no recorded root) as a miss.
+    if (cached.metadata or {}).get("analysed_root") != str(repo_root.resolve()):
+        return None
     try:
         cir = ir_dict_to_canonical(raw, file_paths=None)
         # validate_canonical_ir returns a LIST of problems — empty means valid.

sourcecode/detach.py

@@ -1,8 +1,12 @@
 """detach.py — run a repository-wide analysis so it outlives the shell that started it.
 
-C3-53, three reproductions on the field repository: `spring-audit` runs 408 s of
-analysis, the agent harness promotes the foreground process to background at
-~600 s, and the session dies. **Backgrounding it did not help, and neither did
+C3-53, three reproductions on the field repository: `spring-audit` ran 408 s of
+analysis **on the build measured then** (4.7.0-class; the same command on the same
+repository measures 8,4 s on 4.18.0 — C3-97), the agent harness promoted the
+foreground process to background at ~600 s, and the session died. The cost that
+provoked this module has since collapsed; what the module answers — *a run that
+must outlive the shell that started it* — has not, because a nightly composition
+or a `risk` on a large tree still crosses that boundary. **Backgrounding it did not help, and neither did
 `Start-Process -NoNewWindow -PassThru`** — all six detached processes died at
 the same second the session did.
 

sourcecode/execution_plan.py

@@ -14,13 +14,15 @@ answer lives: `ask --help` orders its front page from it, and `remedies` checks
 every command it suggests against it.
 
 **What this module will not do is invent a number.** The natural design is to
-project seconds by scaling the reference measurement with the file count, and it
-would be wrong in the direction that costs a session: `spring-audit` takes 8.8 s
-on the 2 000-file reference and the field measured **408 s** on 3 342 files —
-46× for 1.7× the size. Cost is dominated by what the repository contains and by
-the platform, neither of which a file count predicts. So what is published is a
-*class* and the measured anchors behind it, never a projected duration for the
-repository in hand.
+project seconds by scaling the reference measurement with the file count, and the
+series refutes it from both ends: `spring-audit` takes 8.8 s on the 2 000-file
+reference, and on one 3 342-file repository at one commit the field measured
+408 s (#13), 2 351 s (#16) and **8,4 s** (#22) — three builds of ours, one of them
+280× apart from another, with byte-identical payloads. Cost is dominated by what
+the repository contains, by the platform, and above all by the build; a file count
+predicts none of the three. So what is published is a *class*, the measured
+anchors behind it and **the release each was taken on** (C3-97), never a projected
+duration for the repository in hand.
 """
 
 from __future__ import annotations
@@ -36,6 +38,7 @@ from sourcecode.cache_model import (
     FIELD_ANCHOR_JAVA_FILES,
     REFERENCE_JAVA_FILES,
     REFERENCE_REPOSITORY,
+    field_anchor_note,
 )
 
 #: How a command can be run on the scope in hand.
@@ -45,11 +48,13 @@ DETACH = "detach"              # `--output` + `--detach`, or a nightly job
 UNKNOWN = "unknown"            # not measured on this axis; never guessed
 
 #: Above this many Java files a repository-wide pass is in the regime the field
-#: measured in minutes rather than seconds. The number is the midpoint of the two
-#: anchors this product has actually measured (2 000 files → 8.8 s, 3 342 files →
-#: 408 s), not a preference: below the reference we have a measurement, above the
-#: field anchor we have a measurement, and the boundary between them is the
-#: honest place to change the advice.
+#: measures in, rather than the one the reference was taken in. The number is the
+#: midpoint of the two sizes this product has actually measured (2 000 files and
+#: 3 342 files), not a preference: below the reference we have a measurement,
+#: above the field anchor we have a measurement, and the boundary between them is
+#: the honest place to change the advice. What changes there is which anchor a
+#: verdict rests on — not an assumption that the larger one is slow, which is the
+#: half C3-97 had to correct.
 LARGE_SCOPE_JAVA_FILES = (REFERENCE_JAVA_FILES + FIELD_ANCHOR_JAVA_FILES) // 2
 
 #: Stop walking after this many directory entries. A front page must not pay for
@@ -253,12 +258,17 @@ def _reference(row) -> Optional[str]:
         parts.append(
             f"{row.cold_seconds:g} s cold{warm} at {REFERENCE_JAVA_FILES} files"
         )
+    note = field_anchor_note(row)
+    dated = f", {note}" if note else ""
     if row.field_seconds is not None:
-        parts.append(f"{row.field_seconds:g} s at {_files(FIELD_ANCHOR_JAVA_FILES)} files (field)")
+        parts.append(
+            f"{row.field_seconds:g} s at {_files(FIELD_ANCHOR_JAVA_FILES)} files "
+            f"(field{dated})"
+        )
     elif row.field_blocked:
         parts.append(
             f"did not finish in an interactive session at "
-            f"{_files(FIELD_ANCHOR_JAVA_FILES)} files (field)"
+            f"{_files(FIELD_ANCHOR_JAVA_FILES)} files (field{dated})"
         )
     return " · ".join(parts) or None
 
@@ -310,16 +320,22 @@ def verdict(command: str, scope: Scope) -> Verdict:
                 cls, reference,
             )
         if row is not None and row.field_seconds is not None:
+            # C3-97: the figure decides, and the build it was taken on travels with
+            # it. An anchor from an earlier release still outranks the class — it is
+            # a measurement at this size and the class is not — but it is never
+            # printed as though it described the build in hand.
+            note = field_anchor_note(row)
+            dated = f" ({note})" if note else ""
             if row.field_seconds <= FOREGROUND_SECONDS:
                 return Verdict(
                     command, RUNS_NOW,
-                    f"measured at {row.field_seconds:g} s on a repository this size",
+                    f"measured at {row.field_seconds:g} s on a repository this size{dated}",
                     cls, reference,
                 )
             return Verdict(
                 command, DETACH,
                 (
-                    f"measured at {row.field_seconds:g} s on a repository this size — "
+                    f"measured at {row.field_seconds:g} s on a repository this size{dated} — "
                     f"run it with `--output` and `--detach`, or nightly"
                 ),
                 cls, reference,
@@ -328,9 +344,10 @@ def verdict(command: str, scope: Scope) -> Verdict:
             return Verdict(
                 command, DETACH,
                 (
-                    f"not measured on a repository this size; its class was — a "
-                    f"{cls} pass in this regime ran into minutes ({FIELD_ANCHOR}). "
-                    f"Offered detached rather than assumed cheap"
+                    f"not measured on a repository this size, and its class is the "
+                    f"only thing left to go on — a {cls} pass here has ranged from "
+                    f"seconds to tens of minutes across our own releases "
+                    f"({FIELD_ANCHOR}). Offered detached rather than assumed cheap"
                 ),
                 cls, reference,
             )

sourcecode/identity_fallback.py

@@ -81,11 +81,6 @@ _METHOD_RE = re.compile(
     re.MULTILINE,
 )
 
-_TYPE_RE = re.compile(
-    r"^[ \t]*(?:public|final|abstract|static|\s)*\s*(?:class|interface|enum)\s+(?P<name>\w+)",
-    re.MULTILINE,
-)
-
 #: Returns that are not an identity even inside an absence branch: re-dispatch,
 #: constants and the empty-optional answers, which are refusals in disguise.
 _NON_IDENTITY_RETURNS = re.compile(
@@ -126,13 +121,12 @@ class IdentityFallback:
 
 def _enclosing_type(source: str, offset: int) -> str:
     """The type declared closest above `offset`. Nested types resolve to the nearest
-    enclosing declaration, which is the one a reader would name."""
-    name = ""
-    for m in _TYPE_RE.finditer(source):
-        if m.start() > offset:
-            break
-        name = m.group("name")
-    return name
+    enclosing declaration, which is the one a reader would name.
+
+    Thin alias of the one authority (C3-95) — see `source_text.enclosing_type`."""
+    from sourcecode.source_text import enclosing_type
+
+    return enclosing_type(source, offset, "")
 
 
 def _method_body(source: str, brace_index: int) -> str:

sourcecode/perf.py

@@ -440,8 +440,10 @@ RELEASE_GATE_COMMANDS: tuple[str, ...] = (
 #: What the gate does **not** cover, and why — published rather than omitted, so
 #: "the gate is green" is never read as "every command was measured".
 RELEASE_GATE_EXCLUSIONS: tuple[tuple[str, str], ...] = (
-    ("risk", "54 minutes on the gate repository (F-AQ); a nightly cannot hold it, "
-             "and the cost is structural rather than a regression to detect"),
+    ("risk", "68 s on the gate repository since C3-96 deleted the catastrophic "
+             "backtracking that made it 54 minutes (F-AQ) — no longer excluded for "
+             "cost, only until a baseline cell exists for it; the first capture "
+             "that includes it makes it gated (C3-99)"),
     ("impact-chain", "takes a symbol, not a repository — its cost is the audit "
                      "`risk` and `spring-audit` already gate"),
     ("verify-edit", "measures an edit loop, which needs a working-tree mutation "

sourcecode/phased_run.py

@@ -300,14 +300,16 @@ def budget_warning(
     service from a 3 342-file monolith.
 
     What replaces it is what this product actually has: the **measured anchors for
-    this command** (`cache_model`, both ends of the range) and the **size of the
-    repository in hand** (`execution_plan.measure_scope`). What deliberately does
-    *not* replace it is a projection: the cost model's own docstring records that
-    cost does not scale with file count in any way this product has measured —
-    8,8 s at 2 000 files against 2 351 s at 3 342 for the same command — so
-    "~15 s on your repository" would be a confident falsehood of the exact kind
-    this ledger exists to prevent. The anchors and the size are the honest claim,
-    and the class floor is named as a class floor when there is nothing better.
+    this command** (`cache_model`, both ends of the range, each carrying the build
+    it was taken on) and the **size of the repository in hand**
+    (`execution_plan.measure_scope`). What deliberately does *not* replace it is a
+    projection, and C3-97 made that case stronger rather than weaker: the same
+    command on the same commit of the same 3 342-file repository measured 2 351 s
+    on 4.11.0 and 8,4 s on 4.18.0, against 8,8 s at 2 000 files throughout. Cost
+    tracks the build at least as much as the tree, so "~15 s on your repository"
+    would be a confident falsehood of the exact kind this ledger exists to
+    prevent. The anchors and the size are the honest claim, and the class floor is
+    named as a class floor when there is nothing better.
     """
     lines = [
         f"[ask] budget: {command} is a {cls} analysis and the configured budget "

sourcecode/posture.py

@@ -1109,27 +1109,22 @@ def _repo_root_of(root: Path) -> Path:
 
 
 def shared_cir(root: Path, files: "list[str]"):
-    """The Java CIR for *root*, from the shared knowledge cache when it is safe.
+    """The Java CIR for *root*, from the shared knowledge cache.
 
     `posture` built its own CIR on every run — the same parse `explain`,
     `impact-chain` and `cache warm` already share — so the one command the
     product differentiates on was the one a warm could not help (C3-25).
 
-    Poison-safe by the same rule `peek_cir` documents: the shared knowledge key
-    is repo-wide and carries no scope, so a run bounded to a subdirectory
-    neither reads it (it describes more than this run's scope) nor writes it (it
-    would store a truncated CIR under the repo-wide key). Those runs keep their
-    own unshared build.
+    Poison-safety used to live here: the shared key was repo-wide and carried no
+    scope, so a run bounded to a subdirectory had to keep its own unshared build
+    or it would store a truncated CIR under the repo-wide key. C3-94 moved that
+    rule into the cache itself — a bounded run now keys on its own analysed set —
+    so the bounded case is cached too instead of paying for the parse every time,
+    and this function is the thin alias of the one authority it left behind.
     """
-    from sourcecode.context_graph import ContextGraph
+    from sourcecode.context_cache import shared_cir as _shared_cir
 
-    repo_root = _repo_root_of(root)
-    if repo_root != root:
-        return ContextGraph.build(files, root).cir
-    from sourcecode.context_cache import get_or_build_cir
-
-    cir, _lookup = get_or_build_cir(repo_root, root, files)
-    return cir
+    return _shared_cir(root, files)
 
 
 def _posture(

sourcecode/release_info.py

@@ -27,7 +27,7 @@ from typing import Any, Optional
 #: The date `__version__` was released, from that version's CHANGELOG entry.
 #: `tests/test_release_info.py` fails the build if the two disagree, so this is
 #: a copy of a fact rather than a second authority for it.
-RELEASE_DATE = "2026-08-10"
+RELEASE_DATE = "2026-08-11"
 
 #: Releases per day, measured over the 30 releases before this one (the same
 #: computation the test re-runs against the CHANGELOG). Stable across window

sourcecode/risk.py

@@ -150,10 +150,30 @@ _URL_PATTERN_RE = re.compile(
     re.IGNORECASE,
 )
 _HTTP_INPUT_ANNOTATION_RE = re.compile(r"@(RequestParam|PathVariable|RequestBody)\b")
+#: C3-96. Three of this pattern's groups used to let the same whitespace be
+#: consumed in more than one place — `(?:\s*@…\s*)*`, `\s*(?:public|…)?\s*`, and
+#: `[\w<>\[\].?,\s]+\s+`, whose character class contains the `\s` the following
+#: `\s+` also matches. Each run of whitespace can then be split between the two in
+#: many ways, and on text that never completes a signature the engine tries them
+#: all: `_java_methods` runs this over **every** source, and a repository-wide
+#: `risk` on a 2 985-file repository did not finish in 20 minutes — inside the C
+#: regex engine, where no signal, budget or Ctrl-C can reach it (C3-87's deadline
+#: is checked between stages, and this never returns to one).
+#:
+#: Rewritten so every separator is consumed once: each modifier takes its own
+#: trailing whitespace, and the return type is tokens joined by explicit
+#: separators instead of one class that contains the separator too.
+#:
+#: The **same** language, deliberately, including the part that reads like a bug:
+#: the old class matched whitespace alone, so a bare `if (cond) {` was admitted as
+#: a method named `if`. Those pseudo-methods carry propagation through control-flow
+#: blocks in the walk below, so dropping them is a change to what `risk` finds, not
+#: a speed-up — which is why the type stays optional here and the question of
+#: whether it should is left to its own increment, with its own field measurement.
 _JAVA_METHOD_RE = re.compile(
-    r"(?P<ann>(?:\s*@[\w.]+(?:\([^;{}]*?\))?\s*)*)"
-    r"(?P<sig>\s*(?:public|protected|private)?\s*(?:static\s+)?"
-    r"[\w<>\[\].?,\s]+\s+(?P<name>[A-Za-z_$][\w$]*)\s*"
+    r"(?P<ann>(?:@[\w.]+(?:\([^;{}]*?\))?\s*)*)"
+    r"(?P<sig>(?:(?:public|protected|private)\s+)?(?:static\s+)?"
+    r"(?:[\w<>\[\].?,]+(?:\s+[\w<>\[\].?,]+)*\s+|\s{2,})(?P<name>[A-Za-z_$][\w$]*)\s*"
     r"\((?P<params>[^)]*)\)\s*)\{",
     re.MULTILINE,
 )
@@ -797,7 +817,7 @@ class RiskComposer:
         profiles: "Optional[set[str]]" = None,
         progress: "Optional[Callable[..., Any]]" = None,
     ) -> None:
-        from sourcecode.canonical_ir import build_canonical_ir
+        from sourcecode.context_cache import shared_cir
         from sourcecode.repository_ir import extract_java_endpoints, find_java_files
         from sourcecode.security_posture import (
             endpoint_security_surface,
@@ -808,8 +828,11 @@ class RiskComposer:
         from sourcecode.spring_tx_analyzer import run_tx_audit
 
         self.root = Path(root).resolve()
-        self.cir = cir if cir is not None else build_canonical_ir(
-            find_java_files(self.root), self.root
+        # The parse is ~80 % of this command's wall clock (measured: 12,45 s of
+        # 15,64 s on a 1 303-file repository) and it is the same parse `posture`,
+        # `explain` and `cache warm` already share — so it is fetched, not rebuilt.
+        self.cir = cir if cir is not None else shared_cir(
+            self.root, find_java_files(self.root)
         )
         self.model = SpringSemanticModel.build(self.cir)
 

sourcecode/security_config_scan.py

@@ -249,14 +249,10 @@ def _line_of(source: str, index: int) -> int:
 
 
 def _enclosing_type(source: str, offset: int, fallback: str) -> str:
-    name = fallback
-    for m in re.finditer(
-        r"^[ \t]*(?:public|final|abstract|static|\s)*\s*(?:class|interface|enum)\s+(?P<n>\w+)",
-        source[:offset],
-        re.MULTILINE,
-    ):
-        name = m.group("n")
-    return name
+    """Thin alias of the one authority (C3-95) — see `source_text.enclosing_type`."""
+    from sourcecode.source_text import enclosing_type
+
+    return enclosing_type(source, offset, fallback)
 
 
 def _scan_java(source: str, rel: str) -> "list[SecurityConfigObservation]":

sourcecode/source_text.py

@@ -30,6 +30,7 @@ other.
 from __future__ import annotations
 
 import re
+from typing import Optional
 
 #: Java/C-family lexical tokens, in precedence order. String and character
 #: literals are matched **first** so that a `//` or `/*` living inside one — as in
@@ -84,6 +85,70 @@ def blank_hash_comments(source: str) -> str:
     return _HASH_COMMENT_LINE.sub(lambda m: _blank(m.group(0)), source)
 
 
+#: The one authority for "a type is declared here", used by every scanner that has
+#: to name the type enclosing a match it found in raw text.
+#:
+#: C3-95. Two modules kept their own copy, and both were written as
+#: ``(?:public|final|abstract|static|\s)*\s*`` — a whitespace branch inside a
+#: starred group followed by another starred whitespace group. Every run of spaces
+#: can then be split between the two in exponentially many ways, and on a line that
+#: never reaches `class` the engine tries them all before failing: measured at
+#: 13 ms for 200 leading spaces, 1,17 s for 800 and **10,1 s for 1 600** — one line,
+#: one file. A generated or reformatted source is enough to hang a scan that is
+#: supposed to take seconds, and `spring-audit` and `risk` both run this scan.
+#:
+#: Written so each modifier must consume its own trailing whitespace, the group is
+#: unambiguous and the match is linear. It accepts the same declarations: the
+#: modifier list is wider than the original (which silently rejected
+#: `private`/`protected`/`sealed`), and the separator is still any whitespace, so a
+#: modifier on its own line still binds to the declaration below it.
+JAVA_TYPE_DECLARATION = re.compile(
+    r"^[ \t]*"
+    r"(?:(?:public|protected|private|final|abstract|static|sealed|non-sealed)\s+)*"
+    r"(?:class|interface|enum|record)\s+(?P<name>\w+)",
+    re.MULTILINE,
+)
+
+
+def type_declarations(source: str) -> "list[tuple[int, str]]":
+    """``(offset, name)`` of every type declared in *source*, in source order."""
+    return [(m.start(), m.group("name")) for m in JAVA_TYPE_DECLARATION.finditer(source)]
+
+
+def enclosing_type(source: str, offset: int, fallback: str = "") -> str:
+    """Name of the type declared closest above *offset*, else *fallback*.
+
+    Nested types resolve to the nearest enclosing declaration, which is the one a
+    reader would name. Callers ask this once per observation and a file can carry
+    many, so the scan of a given source is memoised: the previous shape sliced
+    ``source[:offset]`` and re-scanned it per call, which is a copy and a walk of
+    the whole prefix for every finding in the file.
+
+    At the boundary the two prior copies disagreed, and this one keeps
+    ``identity_fallback``'s rule: the nearest declaration **at or above** the
+    offset. Slicing the prefix dropped a declaration that straddled the offset, so
+    a match on the declaration's own line was attributed to the type above it or to
+    the fallback. Every real observation sits strictly after its declaration, which
+    is why the field results are unchanged either way.
+    """
+    global _DECL_MEMO
+    memo_key = (len(source), hash(source))
+    if _DECL_MEMO is None or _DECL_MEMO[0] != memo_key:
+        _DECL_MEMO = (memo_key, type_declarations(source))
+    name = fallback
+    for start, declared in _DECL_MEMO[1]:
+        if start > offset:
+            break
+        name = declared
+    return name
+
+
+#: One entry: callers sweep a file's findings together, so the next question is
+#: almost always about the same source. Holding one keeps the memo from becoming a
+#: second copy of every file the process ever read.
+_DECL_MEMO: "Optional[tuple[tuple[int, int], list[tuple[int, str]]]]" = None
+
+
 def commented_spans(source: str, *, xml: bool) -> "list[tuple[int, int]]":
     """`(start, end)` offsets of every comment — what was switched off, not what runs.
 

{sourcecode-4.17.0.dist-info → sourcecode-5.0.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.17.0
+Version: 5.0.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.17.0-blue)
+![Version](https://img.shields.io/badge/version-5.0.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -54,7 +54,7 @@ Description-Content-Type: text/markdown
 
 ## The problem
 
-Every time an AI coding agent starts a new session, it has to re-parse the repository from scratch. On small and mid-sized repos that cost is seconds; on large Java/Spring monoliths, repo-wide semantic composition can be minutes. Multiply that by dozens of agent turns per hour, and repo context acquisition becomes a real bottleneck — not just latency, but tokens, compute, and iteration velocity.
+Every time an AI coding agent starts a new session, it has to re-parse the repository from scratch. On a large Java/Spring monolith that is thousands of files of parsing per turn, repeated for every question asked about the same unchanged tree. Multiply it by dozens of agent turns per hour, and repo context acquisition becomes a real bottleneck — not just latency, but tokens, compute, and iteration velocity.
 
 ASK Engine solves this with a persistent structural cache keyed on file content hashes. After the first scan, later invocations reuse pre-built context whenever their command can consume the warmed layers. The repo doesn't change? The cache doesn't expire.
 
@@ -69,7 +69,7 @@ ASK Engine solves this with a persistent structural cache keyed on file content
 | Keycloak | 7,885 Java files | 10.5s | 0.6s | **~17x** |
 | BroadleafCommerce | 2,985 Java files | 2.7s | 0.3s | **~9x** |
 
-These numbers are cache-layer benchmarks, not a promise for every command. Per-symbol queries and compact context benefit most. Inventory commands scale with file count. Repo-wide/deep compositions such as `risk`, `audit-report` and large `spring-audit` runs can take minutes on multi-thousand-endpoint repositories and belong in a supervised or nightly job unless CI sets an explicit budget.
+These numbers are cache-layer benchmarks, not a promise for every command. Per-symbol queries and compact context benefit most, and inventory commands scale with file count. What a repository-wide analysis costs tracks the build more than the file count: on one 3,342-file monolith, at one commit, `spring-audit` measured 2,351s on 4.11.0 and **8.4s on 4.18.0** with a byte-identical payload — so ASK publishes measured anchors and the release each was taken on, and never projects a duration for your repository. `ask cache model` prints both anchors per command, and `risk` — the one composition still measured in the tens of seconds at that size — is the one to give a budget or a detached run.
 
 With the right command class, ASK Engine becomes **constant infrastructure** inside agent loops — call the fast/context surfaces before edits and reserve deep compositions for the points where their evidence is worth the runtime.
 
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.17.0 — and, on a build that has aged,
+ask version                    # ask 5.0.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.17.0.dist-info → sourcecode-5.0.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=oSpIjlJUp7yJ6x7QLvX2_MNZMIRyxWZlgQM8hLXJ4tQ,309
+sourcecode/__init__.py,sha256=Y22bv5DzCS9Djs9Ql4VI3jyeczhm8uAgC4Nl9LjiXm0,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=CZvRLpkHot_D8D3JFQVorr-EHDJyh0BbS7RnSTqBigM,40499
 sourcecode/architectural_baseline.py,sha256=4GiMVBLJVHvRKSWQGf2ZVurI1-R0qk5pmaevgvGSgVA,26325
@@ -9,7 +9,7 @@ sourcecode/ast_extractor.py,sha256=aXJjZ7XjAdxa99hWNm4SyzPqx4gNWiTbUYjNWGNl-Vc,5
 sourcecode/audit_report.py,sha256=CLvvlQH2oA6Qj4UADUWhNwSsp1OcyzwXXey5DN_IiWI,8660
 sourcecode/baseline_autocapture.py,sha256=tmMLexQSeaQRRbqxAd7walvGQqnF0mdpxQmkL40rlhI,15623
 sourcecode/cache.py,sha256=CK_J8NqyaTNZ57KQT-R4puqI8yYlzG5WL7uLFRbzods,41727
-sourcecode/cache_model.py,sha256=JCoC0nBchtv1j6UAgPepyJU_RFafxmch6oCLNO1QPFI,32666
+sourcecode/cache_model.py,sha256=jQcXAIpfBl2rXrf8xitNKXy8M0RSIn4F4hQYV-tKGm8,41285
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=--sFGDnIog_YGu9xZHMcB91F5xZakfaAKvy15xU54hg,7904
 sourcecode/caller_reach.py,sha256=RRF49tv4-QswraJ2vsZ89VAMOj7BmYXlAdXr-tLP_CA,9483
@@ -18,14 +18,14 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=aX1mp2XnlDN-8R2BcTiu8HlkDwQ_4fN1ZLckj0VMXHM,9945
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=FokyiwVRSX7OyKNixcXObqJouSFxG5gxj2OSFoJLcsw,604054
+sourcecode/cli.py,sha256=5sTk3jJ1Xh-JlnLiwN9bH0y3puiYejENXfl5iN0efrU,604917
 sourcecode/client_calls.py,sha256=daRTgbXNUOfkzGXJpVb6A737R_Thhka8vw1_YgxCaLg,13548
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=2GdDy0qkDSgmkkpgvoCHitoLj3mt30EeFgJ8PGEXJng,14712
 sourcecode/confidence_analyzer.py,sha256=5li0NyOdS3Ie-f2ZY1gBmnjtkuRvI50l4OnGaKkXAOU,22358
 sourcecode/constraint_diff.py,sha256=hWIO5vsxvHjsgQx23K3r_JMy1W6wQ2Ca4DqB9R_iMnY,5831
 sourcecode/container_wiring.py,sha256=-jAOOgDR0VcZN3ph9kpZVU6iPyN1EK8H5DGAQzxGQKY,14394
-sourcecode/context_cache.py,sha256=kzwARIQrq8lUCXzV1iKLXCe95k71eS25FTyV7LPM6RU,31334
+sourcecode/context_cache.py,sha256=xfS0GpWG8MpHwqgw61tp3IR7jZ2IdG1j-v_HoIiSx7o,35608
 sourcecode/context_graph.py,sha256=a6v2lgl2DxDnPAWE59K3yg6L5YFDak0LIUff3pi9p0c,47327
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
 sourcecode/context_summarizer.py,sha256=cI2TZMvEhl0BEma12VtPaX6z03ZVBAetVzuK5GaCOvg,6852
@@ -41,7 +41,7 @@ sourcecode/defect_identity.py,sha256=XS2VFDImg9NLaRImybKTeyk-CoDSsXmchldg0dwvM7c
 sourcecode/degradation.py,sha256=BtuGUKFgkzI3Z6fwmUdxEUEaLFAcPQ_bHhU2w9ItDxw,18376
 sourcecode/dependency_analyzer.py,sha256=fQCaWQ7_BNcVgZv8gweJCwJ1CGlXsz8nw_tqN3aHJNE,63952
 sourcecode/deployment_prefix.py,sha256=g0_4bE_m9svjhnapRpOp8BJkj6Ul94Ij_iVezygMZ0I,11956
-sourcecode/detach.py,sha256=zF5qY4DF1JN3CEjbq3eKf0PnSmywQlTcN6aLEAMPdjU,7650
+sourcecode/detach.py,sha256=PvkCcbIuTaDKKt5TGqtQLahmsmCkflui33jLnMEWkvg,8006
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/dynamic_argument_surface.py,sha256=u6zJoY-zChYVw1-SrgiyAq-rUwqMZ5ZqBwLfbPJ_8ng,2960
 sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOaXc,3263
@@ -52,7 +52,7 @@ sourcecode/envelope.py,sha256=fpF_8znvPqGXKZb0UPYcCYjm27yO7Pr-WsdXNE-tEoY,8911
 sourcecode/environment_resolution.py,sha256=bfhkM0RGSyLwzFvfi-YhHjU1cy2ufA_WIkXBVeHs9y8,22130
 sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,1683
 sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
-sourcecode/execution_plan.py,sha256=40OWXopf5q0rKkG2F_b282lsQ3Tkq-zIfWdMURUiLis,17120
+sourcecode/execution_plan.py,sha256=KRI_bFiBbmxOu0aF4bGwgVK9RdH8eB6g9Xhj1fkS2Zk,18120
 sourcecode/explain.py,sha256=yqxvKiLF0XMMg11PdgqMFrsim5SXuEKM1U2cLvCLspM,29935
 sourcecode/file_chunker.py,sha256=3vkM3mDQ5eE_yTPvUgjyjpGFBIjkW6_mrBmIbrylnA8,16444
 sourcecode/file_classifier.py,sha256=pJCeN9KqWpAwKMCgGP4KDsBjuWMeo4zlbj5fv3hk9dA,15587
@@ -64,7 +64,7 @@ sourcecode/git_checkout.py,sha256=gCnkMwHpU6yLyc10FoGzE8W9-tI8KyYxKTgpbWPjayo,60
 sourcecode/graph_analyzer.py,sha256=lp0eB1PWC20BYF-GpPhAyegRpKrUKgOmXZIcZSIX_Ks,65777
 sourcecode/graph_evidence.py,sha256=rENNsYRZeNstX_ExNCLlbHJAruFQwxo5d00x6wO3xwI,15030
 sourcecode/hibernate_strat.py,sha256=jYMV2mD-_DEjAwjTExA1Yuw4uEPHe9B8VvLKpG0A3oo,65808
-sourcecode/identity_fallback.py,sha256=I2MAeec51ljXf7oLEop0D52Q-usovOFT-t4huQLB5pw,9295
+sourcecode/identity_fallback.py,sha256=uRC_j_80uaI4Ue4tf-OhKX4h472dmufYcjEFGSxY2jk,9190
 sourcecode/integration_coordinates.py,sha256=7vGFxN4tCn_KTisYFJuixa8XkyHBoasEFB3fqM62OBI,7407
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=vvgE1vBUWh8ozWI7USYuteh6noxntnjuzDQIPF-l4rA,27795
@@ -82,10 +82,10 @@ sourcecode/parse_cache.py,sha256=fhXnoaOgVWwp_8q0ngJ76UZ09qJ6uxDd0jaX8jdezvo,208
 sourcecode/partial_contract.py,sha256=x_N_0bF3mpNNjXd7JFB1zr6LSIroo2zN5GCz14GXvXQ,3510
 sourcecode/path_admission.py,sha256=OGNSoluhVh8YYOBZBnACUrkmH4Tp_yxjGLifkcsxQpo,5838
 sourcecode/path_filters.py,sha256=LmTYq735orssKTIuxTX1mE1FHAXF7dVEJEse35xE1RA,12371
-sourcecode/perf.py,sha256=vZDEj1wS905peXmREdOniZrWCikElOyPTw-E32zVZAQ,25847
-sourcecode/phased_run.py,sha256=WiQhsSJyFZcRsqrsiHzQhzgSlRtOuSDe-Bd-g4BypYk,16420
+sourcecode/perf.py,sha256=ZCPxDIg6ww6PXfLwcqNTH99lc1UgkYUZI3MywFgRO90,25991
+sourcecode/phased_run.py,sha256=cFd0Lxfc8XL-XkCVCCzcjd9bZbtgkJkGZAHfmJ6dBJ4,16542
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
-sourcecode/posture.py,sha256=20mPdF9FNZK3FDxIK5qkd3qZhARJJboMGoRmGEmm0Nw,76810
+sourcecode/posture.py,sha256=TGzSwa413NJyVvBgGWyCyaFqJXX-fnctq7vdxVs9z9A,76744
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
 sourcecode/pr_impact.py,sha256=KyVBvHCCbgByKA_wqTbO1dSkfi05GEudIAuH4CyDPK4,27395
 sourcecode/prepare_context.py,sha256=ntB2MSScHtYRKRm9SansA0FrklMnXZmE9_yRXqXk0qc,239264
@@ -97,14 +97,14 @@ sourcecode/readonly.py,sha256=dqGiNVvpfi4Ww8VzwUs6E3SdbqcHL1LFHItIK7IjrM0,5830
 sourcecode/reconciliation.py,sha256=GU-1PTcVr8zcbtC7BASfpHcZndP9AdboXPNQiBc0fzo,34251
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/reference_facts.py,sha256=Ns495c6eTmq2SrqPkcUrJUJru4_wj_yRWm4YDeJwves,13440
-sourcecode/release_info.py,sha256=4Jfym0xPvJpauhXDWLY2An8yIzae5OlAYZeUr24URsc,5378
+sourcecode/release_info.py,sha256=Y3PXhq7U_6Ewu2irpSWvlOzcSHs1cQlemvDXGtC1RnQ,5378
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/remedies.py,sha256=9eAuP9ndw78YvuUtOi2VvoeNnVCMh1q0uxfnPIkvx7c,7838
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
 sourcecode/repository_ir.py,sha256=x0u0m-Dlgtcfr7VsggnKRw_mCobe6B7lZMw3U2H1rd8,368709
 sourcecode/ris.py,sha256=nc0d6boOiREFqXO4eLHHaYcnqZj4pT_AG43-Xz9ejkc,24862
-sourcecode/risk.py,sha256=Umc8agAoqBrFxRDi3I3um3EhLrf9G1m2GPz2Gg0Ox1U,71504
+sourcecode/risk.py,sha256=QSm_F-3tGncQNMcdKGgr5bVONM8614J8n8qmP9x4FDU,73200
 sourcecode/rule_catalog.py,sha256=pTkgkQZ1u7atB3fkQJ9BPWo8lNiamvEuRN7MtRgle0c,5263
 sourcecode/rule_pass.py,sha256=DTNxD-nAecMJhIzI1LCd9FyRumInQSZjitacNh4Zoc8,14671
 sourcecode/runs.py,sha256=zIxEPz9DBVVCrX958bZR6bODyfH56A6srAyc8LFMs8I,5303
@@ -113,7 +113,7 @@ sourcecode/sarif.py,sha256=3hQEegUxIZbojFdY59oB-yKsK-rnafHdTNmYsEP2--A,25984
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=_tdyI939NeOlgwQWNCXPfsqaB1fTyNROizYqTOdvWGQ,3718
-sourcecode/security_config_scan.py,sha256=vpAglQkh7QxUhY_eR6aOOE5d-aU2tsEd-bE8pMoFz8g,30021
+sourcecode/security_config_scan.py,sha256=7DD0ou6xsOPhdUbBbEKLDM07PREeEHNISQltboHPnRU,29976
 sourcecode/security_posture.py,sha256=FiEGood01y5gKhuYyL6NK4VT-WtCUMJwHOSR5xTfnPI,54063
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
@@ -121,7 +121,7 @@ sourcecode/semantic_integration_engine.py,sha256=7a0WqAInOv39f0Yr_94TYo_JP_8QpeI
 sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_pd4,10782
 sourcecode/serializer.py,sha256=KiUUHMQNWOOJye95bZQKsRKFkVeVK0Vb2Y7IocQjVbk,140262
 sourcecode/servlet_surface.py,sha256=aOeRne07man8DwHsbog4FTOyF3sYV-oP_N1e4gt3Uvk,9115
-sourcecode/source_text.py,sha256=5ZOqD04Vpdc6Jl6tUlkpeXtM3wXYC297hczZ71iksVk,4819
+sourcecode/source_text.py,sha256=uir8uBoOnxuH2R-eDJp7mqkDSQRgipxpFdjddLycj-E,8081
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=-0EZMFpZxPRmK2FiR4d7Mk4O73c4wkga-Dqs1-fBSUA,22895
 sourcecode/spring_impact.py,sha256=GW77k7KMn13QmzP5520BbVcXSCYlTFeD1bFibhbmzJM,83907
@@ -205,8 +205,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.17.0.dist-info/METADATA,sha256=kWkJB10gFORG-sJiK6IEvaNZB2g2gvq05IbiIU1X7JA,42089
-sourcecode-4.17.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.17.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.17.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.17.0.dist-info/RECORD,,
+sourcecode-5.0.0.dist-info/METADATA,sha256=mW6-jtrJZ6KxEAqRhncgpItWR93mFkL5sHDq0NjTd1Y,42410
+sourcecode-5.0.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.0.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.0.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-5.0.0.dist-info/RECORD,,