sourcecode 5.4.0__tar.gz → 5.4.1__tar.gz

{sourcecode-5.4.0 → sourcecode-5.4.1}/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## [Unreleased]
 
+## [5.4.1] — 2026-08-12
+
+**Two correctness fixes and a release bump.**
+ASK now stops treating ambiguous `it` directory segments as test roots, so
+business paths like `src/app/shared/akita/it/` no longer inflate test counts or
+test-source facts. It also stops publishing static asset requests such as
+`/assets/i18n/en.json` as `broken_integrations`; those are served files, not
+server routes.
+
+### Fixed
+- **Ambiguous `it` segments no longer promote arbitrary business paths to test roots.**
+  The `test_sources` authority now leaves the bare `it` segment out of the
+  repository-level test-directory set, while `src/it` remains a declared test
+  source root. That closes the false-positive path in Angular and similar apps
+  where `it` is a domain token, not an integration-test marker.
+- **Static asset calls are no longer reported as broken integrations.**
+  `consumer_join` now filters unmatched client calls under `/assets/`,
+  `/static/` and `/public/`, plus calls ending in static file extensions, and
+  documents that exclusion in the payload meaning.
+
 ## [5.4.0] — 2026-08-12
 
 **Fourteen rows from one audit, and the worst defect this ledger has recorded.**

{sourcecode-5.4.0 → sourcecode-5.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.4.0
+Version: 5.4.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.4.0-blue)
+![Version](https://img.shields.io/badge/version-5.4.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.4.0 — and, on a build that has aged,
+ask version                    # ask 5.4.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.4.0 → sourcecode-5.4.1}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.4.0-blue)
+![Version](https://img.shields.io/badge/version-5.4.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.4.0 — and, on a build that has aged,
+ask version                    # ask 5.4.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.4.0 → sourcecode-5.4.1}/docs/DEFECT-LEDGER.md

@@ -59,6 +59,7 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 | C1-40 | **`cache model` promises `onboard` an answer-level cache hit and the second run recomputes.** `ask cache model .` publishes `onboard` → *"the answer (repeat cached)"* `[task, ris]`. Measured: first run 56 s (cold, expected), **second run on a warm cache 23,5 s** — not an answer hit, a partial recomputation. Corroborated by `cache context-stats .`: `Contexts: 1 · Hits: 1 · Misses: 1 · Hit ratio: 0.5 · Avg lookup 1029,1 ms (p95 1955,2 ms) · Avg build 18332,5 ms · Bytes stored 9 969 057`. A **full second to decide whether there is a hit**, over a single 10 MB entry, is the signature of deserialising the whole payload to read its key | 4.10.4 (eval #14) | **Medium** — `cache model` exists so a user can plan instead of guess; a row that overstates what a warm buys is the one defect that command cannot afford. The lookup half is the second field measurement of C3-47 | **closed (4.10.6), and the claim was the false half.** Reproduced at home on keycloak (5 486 sources): **with** a `cache warm`, `onboard` costs 0,7 s — the row's promise holds. **Without** one, a second identical run costs 9,4 s against 10,2 s cold: the warm is what stores the answer, and the command does not store its own. The row said `repeat cached`, the field ran it twice with no warm, and got 56 s → 23,5 s. `repeat` is now `false` for `onboard` and the measured figures are published at two scales, with and without a warm, so the reader can tell which run they are about to make. Half (b) shipped too: the validity keys (`ev`/`kl`/`sig`) live in an uncompressed sidecar beside the blob, so deciding *is this entry still valid?* is a small file read instead of decompressing and parsing a 10 MB envelope — the case that matters most, an entry invalidated by a changed signature, used to pay all of it and then discard the result. A genuine hit still pays for the payload it returns; that is the answer, not overhead. Entries written before the sidecar existed fall back to the old full read. Original remedy note: two halves. (a) Reconcile the claim: either `onboard` really caches its answer, or its row says `shared work`, not `the answer`. (b) Split key metadata (hash + validity) from the payload into a sidecar index so a hit is decided without deserialising the blob; target < 5 ms against the ~1 029 ms measured. Related F-AA |
 | C1-43 | **"Does this repository configure a request filter chain?" has two authorities, and the one that decides whether a `high` finding family runs is the older, weaker one.** `posture._security_config_types` reads the question off the IR's own edges — a type that `extends`/`implements` a chain SPI type, **or a member that `returns` one**, i.e. the `@Bean SecurityFilterChain` shape — and the docstring beside it records why: *"a repository that wires its chain with a `@Bean SecurityFilterChain` and no `@EnableWebSecurity` reported `security.active: 0` — a false zero on the axis this command exists for."* `repository_ir._filter_based`, which decides `security_model` and therefore whether **SEC-001 runs at all**, still tests only `@EnableWebSecurity` (`_FILTER_SECURITY_ANNOTATIONS`, deliberately one entry) and `extends WebSecurityConfigurerAdapter`. A Spring Security 6 repository that declares its chain as a bean is therefore classified `annotation_based`, and SEC-001 then asserts, per unannotated handler, *"In an annotation_based security model there is no centralized filter — any caller can reach this endpoint without authentication"* | 4.18.0 (eval #24) | **High** — a confident falsehood on the strongest axis, and the only one of the series: measured on a greenfield Boot 3 module, the single SEC-001 finding is `POST /api/v1/auth/login`, which the repository's `SecurityConfig` lists in `PUBLIC_ENDPOINTS` with `permitAll()` under a closing `anyRequest().authenticated()` — the chain the model says does not exist both admits that route *and* protects the other 24. The evaluator adjudicated it by reading the source: *"la herramienta lo marca `high` porque solo lee la anotación del método, no la cadena de filtros"* | **in-progress** — the premise half shipped on `fix/sec-001-chain-authority`. One authority, `security_chain`, holds the request-chain SPI vocabulary, the member rule (*a member returning the SPI type makes its declaring class the configuration*) and the name normalisation; `posture` and both `repository_ir` sites read it, so the mechanism can no longer differ. **Two questions are named apart there rather than merged, because only one of them may silence a finding:** `declares_request_chain` (is there a chain at all — the annotation, the pre-5.7 adapter, or a member producing a `SecurityFilterChain`) is SEC-001's premise and is deliberately narrow, while `chain_participant_types` (what takes part in configuring it, filters included) is `posture`'s question. Widening the first to the second would silence SEC-001 on repositories with no centralized authorization — the P1-A failure mode, and the one with no symptom. Measured end-to-end on a fixture of the reported shape: `security_model` `annotation_based` → `mixed`, and the SEC-001 finding on `POST /api/v1/auth/login` disappears; recall asserted in the same battery (no chain → still reported; `@EnableMethodSecurity` alone → still reported). Fleet A/B over 5 repositories × 3 commands: 15/15 payloads identical in content, which is the expected result and the point of running it — no fleet repository declares a chain in either shape, so nothing could move. **Open: the verdict half.** Where the chain resolves, the per-endpoint answer should come from the resolved chain rather than from the model classification (C1-8's `matched_path` machinery already exists), and where it does not resolve, SEC-001 abstains — never *"any caller can reach this endpoint"* over a chain the run did not read |
 | C1-44 | **`has_uncommitted_changes: false` sits in the same document as `git_context.uncommitted_files: 1`, and it is the field cache freshness is decided on.** `ask <repo> --compact --git-context` publishes both, one run, one payload: `git_context.uncommitted_files` counts the file, `_cache.has_uncommitted_changes` says there is none, and `git status --porcelain` on the same tree prints `?? .claude/settings.json`. The third authority in the build agrees with the first — `--changed-only` reports `changed_files_count: 1` for that file and its `--help` defines the set it counts as *"staged, unstaged, untracked"* — so two of three surfaces admit the file and the one a consumer trusts for staleness does not. Under that published definition the boolean is simply false | 5.3.1 (audit #28) | Medium | **closed 5.4.0** — one predicate (`baseline_autocapture.counts_as_dirty`), extracted from `worktree_dirty` and read by the count in both the fresh path and the cache-hit patch, so the boolean cannot drift from the function that defines it. What it excludes is published (`uncommitted_files_not_read`, `uncommitted_files_basis`) rather than subtracted in silence, and only when something was actually excluded. Original remedy note: one predicate over one definition of *the working set*, read by both fields; the boolean is derived from the count rather than measured a second time, and where the two cannot be derived from one another the document may not publish both |
+| C1-46 | **`existing_test_count: 6` sits beside `test_files: 0` and `has_test_sources: false` in one `prepare-context generate-tests` payload, and the 6 are five production files in a business package.** C3-115 closed the half that was reported — `test_gaps` now declares its population — and left a second authority for *"how many tests are there"* answering a different number in the same document. Re-measured in the field: 0 Java tests, 1 `.spec.ts`, 3 karma/jest configs; no population is worth 6. Root cause is in `test_sources.declared_test_root`: `_TEST_DIR_NAMES` carries the bare segment `it`, the final loop accepts it **at any depth**, and the only disarm — `_under_main_root` — knows `src/main` alone, which is a Maven layout. An Angular app lives under `src/app`, so `saint-client/src/app/shared/akita/it/` — *Incapacidad Temporal*, a business entity whose `it.model.ts` declares `ENFERMEDAD COMÚN` and `ACCIDENTE DE TRABAJO` — is read as a test source root and contributes 5 files; the 6th is the one real `.spec.ts`, and the reconciliation is exact. **It generalizes off this repository:** `it` is also the ISO 639-1 code for Italian, so `web/src/assets/i18n/it/messages.json` and `app/locales/it/common.ts` both answer `is_test_path: true` on the shipped build. Sibling of C1-28, in the direction C1-28 was written to prevent | 5.4.0 (audit #29) | **Medium** — the number is small and the shape is the one the maintenance rule exists for: an authority closed on a narrower restatement than the one reported | **open** |
 | C1-45 | **The SQL taint join keys a sink on a bare statement id, so a mapper method in one namespace is joined to a call site that resolves to another — and the result is published as the repository's #1 critical risk with a call trace that does not exist.** `risk`'s top row on a 3 342-file monolith is `severity_effective: 29.57` at `ProcesosGerenciaMapper.xml:74`, `factors.query_construction = http_input_reaches_sql_interpolation`, with evidence naming `AutocoberturasRestController#actualizar(id, obj)` *calls* `actualizar(…)` in `ProcesosGerenciaMapper`. The controller calls its own service's `actualizar`; the join matched on the method name alone. **The correct key already exists in the code and is not used** — `sql_taint` line 76 returns `f"{self.namespace}#{self.statement_id}" if self.namespace else self.statement_id`, and `namespace` is captured (141, 151) and then spent only on an explanatory sentence (313-314), while the published basis claims the sinks are *"keyed by namespace and statement id"*. **Accompanying defect, same row:** the interpolated expression is stored (72, 144) and emitted (86) and never inspected, so `bloqueada = ${dto.bloqueada ? "'S'" : "'N'"}` — an OGNL ternary whose two branches are string literals, a closed allowlist by construction and precisely the mitigation SEC-008's own `fix_hint` recommends — is ranked as a text-controllable sink | 5.3.1 (audit #28) | **High** — F-BF's whole argument is that this axis fires on evidence rather than on multiplication by 1,0; a name-collision join inverts the first row of the ranking, which is the product | **closed 5.4.0** — both sides keyed on `namespace#statement_id`: a call carries the type its receiver resolves to and is that statement's only when the receiver resolves to the mapper it lives in; an unresolved receiver is not the same answer as any type name, so the sink stays `undecidable` rather than `reaches`. `does_not_reach` carries the same qualification, because it is a confident no. `splices_free_text` reads the interpolation at last — anything it cannot prove closed is free text, and what it closes leaves the population into a published `bounded_interpolations` list. The regression fixture this row specified is in the suite. Original remedy note: key both sides on `namespace#statement_id` (the property is already written, the call sites read the wrong half), and give the interpolation a three-state read: an expression whose reachable values are all literals is `does_not_reach`, an unresolvable one stays `undecidable`, never `reaches` by default. Regression fixture: two mappers in different namespaces sharing a `statement_id`, one reached by HTTP input and one not — expected one `reaches`, one `undecidable`; today, two `reaches` |
 
 
@@ -227,6 +228,11 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 | C3-117 | **`--env-map` is inert: the section it advertises as an opt-in is emitted whether the flag is passed or not.** `ask <repo> --compact -o a.json` and `ask <repo> --compact --env-map -o b.json` are **byte-identical** (sha256 equal), and `env_map` is populated with the same 6 variables in both. The `--help` describes an opt-in (*"Map environment variables referenced across the codebase"*) that does not exist | 5.3.1 (audit #28) | Low — the payload is not wrong, the flag's contract is | **closed 5.4.0** — the behaviour stays (a compact payload with a null section is a hole where a reader expects one) and the claim is corrected: `_IMPLIED_NOTE`, one sentence in one place, appended by every flag it is true of, asserted against the parameter list including the negative. Original remedy note: either bind the flag (and pay the C3-103 attention: two views of one state must not become two analyses) or retire it and say the section is unconditional. A flag that changes nothing is a claim the build does not keep |
 | C3-118 | **`prepare-context generate-tests` spends 56,45 s enforcing a 30 000 ms budget, and returns nothing.** No `--timeout`: wall clock 56,45 s, payload `analysis_budget.limit_ms: 30000`, `exhausted: true`, `relevant_files: 0` — an 88 % overshoot of the budget it was enforcing, to publish an empty answer. C3-1 closed this command's budget contract (published flag, `analysis_budget` block, budget in the cache key, an exhausted result never stored) on a measurement of **3,35 s over 3 300 files**; at 3 342 files with 6 947 sources the same default is 19× that and does not bind. This is C3-83's provenance question asked of the value rather than the source: the default is a constant, not a function of the scope | 5.3.1 (audit #28) | Medium — the default is unusable at the scale the product is sold for, and it costs double what it promises to return nothing | **closed 5.4.0** — the overshoot was the walk being *waited for*: `concurrent.futures` joins abandoned workers at interpreter shutdown, so the process paid the walk's full duration whatever the budget said. It runs on a daemon thread, which is not joined, and two subprocess assertions pin that property in both directions. The default is derived from the scope (`_tests_budget_ms`: 60 ms per Java file between the old 30 s figure as a floor and a 300 s ceiling) and publishes the count it derived it from. Original remedy note: the budget must bind (check it where the walk can be cut, not only between phases — C3-82's shape), and the default must be derived from the scope the command already measures rather than fixed at 30 s. When it is exhausted the payload already says so honestly; that half stays |
 | C3-119 | **A client call whose URL is an expression is promoted to `broken_integration` — the one verdict this command presents as unconditional.** `ask endpoints <repo> --consumer <repo>/saint-client` reports **20 calls resolved, 115 unresolved** with a single reason (*"the URL is an expression, not a literal at the call site"*), `routes consumed: 0 / 3 574`, `delete_candidates: 2 637` — and 16 of the unresolved arrive as `broken_integrations`. The consumer centralises its base URL in a service (``this.httpGet(`${this.END_POINT}/porAgrupacion/${id}/${fecha}`)``, `planificacion-especial.service.ts:109`) and only the literal tail is captured, so the join key is a fragment and the route is then declared unserved. F-BH's own framing is that this direction *"needs no assumption about coverage to be true"*; it is the one verdict presented as incondicional and the one that is wrong. **Second facet, same extractor:** the TypeScript scan does not strip comments — `"GET /to/your/validation/service"` at `seguro-grid.component.ts:204` is a commented-out DevExpress documentation placeholder admitted as a live call. That is the E-1/E-2 predicate, applied in Java and not in TypeScript | 5.3.1 (audit #28) | Medium-High — a team acting on `broken_integrations` chases 16 integrations that are not broken, and the `delete_candidates` list inherits the same error at 2 637 rows | **closed 5.4.0** — a call whose head was an interpolation travels as `path_resolution: prefix_stripped`; it still matches where it matches, and where it does not it leaves `broken_integrations` for `partial_client_calls` with the reason and a count, on both join surfaces. `broken_integrations`' own `meaning` now states the condition it holds under. The comment model is `blank_comments`, offsets and line count preserved so every call still points at a line a reader can open, and string/template literals are state. Original remedy note: an unresolvable URL degrades to `unresolved_client_call` and never to `broken_integration` (absence of evidence is not evidence — INV-F1-1); the comment model the Java side has runs on the TypeScript side too. The resolution half is **F-BO**, not this row |
+| C3-120 | **The composition engine became unusable at 3 342 files, and one line of C1-45's fix is why.** Measured against 5.3.1 artefacts on the same subject: `risk` 38,37 s → **601,74 s** under a 300 s budget, returning `partial: true` with **0 of 98** defects composed; `risk` under a 3 000 s budget → 444 s complete (×11,6); `enrich` 36,30 s → **>600 s**, stopped without completing; `audit-report` not run at all after two hangs. Median ratio over 48 comparable pairs is **1,00x** — the regression is confined to this family. Root cause is `sql_taint._receiver_type`: `_RECEIVER_RE` is anchored `…\s*$` and is applied as `search(method.body[:body_index])`, which copies an O(body_index) prefix **and** makes the regex engine try every start position in it before concluding. `_called_names` pays that for **every call of every method in the repository**, unfiltered and unbounded, where 5.3.1 did `names.add(call.group(1))` at O(1); a service body of 1 650+ lines makes the pass quadratic. Auditor's microbenchmark on the shipped regex, results byte-identical to a windowed `search(body, start, endpos)`: 8,6 KB/200 calls **36,9×**, 43 KB/1 000 calls **186,9×**, 215 KB/5 000 calls **916,5×** — 5× the calls, 25× the time | 5.4.0 (audit #29) | **Critical** — three of the seven experimental commands, and the ones that carry the price premium, do not return on the repository this product is sold for | **closed 5.4.1** — the read is windowed (`search(body, start, body_index)`: the `$` still ends at the call, no prefix is copied and the engine is offered a bounded number of start positions), and the window start retreats over any identifier it lands inside so a receiver wider than 128 characters is resolved whole rather than by its suffix — `""` is *unresolved* here and must never be reached by truncation. Second half: `_called_names` takes the statement ids being decided as its scope, because the only question asked of that set is `(mapper, statement id) in called`, so a name no statement carries can change no verdict. Re-measured on the shipped regex: 5 000 calls over a 159 KB body, **18 079 ms → 28 ms**, results identical at every call site. Four regression assertions, including a wall-clock gate on the pass |
+| C3-121 | **The budget does not bind in the composition family, and one invocation froze the process.** `ASK_MAX_ANALYSIS_SECONDS=300 ask risk .` ran **601,74 s** of wall clock and wrote `elapsed_seconds: 600.92` into its own `_partial`; `ASK_MAX_ANALYSIS_SECONDS=150 ask enrich . --sarif` passed 600 s and was stopped by hand; a third `risk` invocation stopped responding until the working session was killed. This is the failure mode C3-82/C3-118 closed for `generate-tests` — *the budget must be checked where the walk can be cut, not only between phases* — reappearing in another family, and the lesson did not travel. Second half, independent of the overrun: a **respected** budget yields no answer — at 300 s the payload is `phases_completed: ["audit"]`, `phases_pending: ["compose"]`, `composition_stopped_after.defects_composed: 0`, which in CI is an empty envelope after ten minutes. The degradation shape itself is exemplary and is not what this row is against: `_partial` names the completed and pending phases, `why_stopped`, the repo-wide walks it skipped and the axes left `unknown`. ⚠ Re-measure after C3-120 before investigating separately — same subsystem, same triage C3-114 got against E-3 | 5.4.0 (audit #29) | **High** — a budget that does not cut is worse than no budget: it sells CI a guarantee it does not keep, and a hard freeze consumes the runner | **closed 5.4.1** — the deadline is asked *inside* the two repository-wide walks that hold the wall time, not only at their doors: the method parse samples the clock every 16 files and the two propagation walks sample it on their own units. A walk cut while running raises rather than returning what it had — every verdict these walks publish below `reaches` is a statement about the **whole** repository, and a negative over a partial universe is a confident no built on an unfinished read — so the measurement is dropped, the axis reads `unknown`, and the walk is named in `_partial.composition_walks_not_run` exactly as a walk that never started is. Nothing partial is cached on the CIR, so a later caller cannot be served a repository with files missing. Two assertions, both non-vacuous: the walk cut inside, and the composer naming it. ⚠ The residue this row does not close: the walks that are still gated only at the door (`inferring the security posture`, `indexing the validation surface`, `resolving the conditional bean graph`) — none of them was measured holding the overrun, and giving each a sampling seam is its own increment |
+| C3-122 | **`ask risk <repo> -o <path>` spent 444 s, exited 0, printed nothing and wrote no file.** One occurrence, from bash with a Windows path in forward slashes; a later recursive search found the file nowhere in the user tree. The same path shapes worked in the same session for `ask endpoints -o`, `ask config` and `ask baseline capture --dir`. Not reproduced — the auditor stopped invoking `risk` after the freeze in C3-121 — and recorded with that limitation. An analysis command that consumes 444 s and reports success without producing its output owes the reader a line on stderr at minimum | 5.4.0 (audit #29) | **Low** (unreproduced) — but it is a C5 shape: the exit code is the published fact and it is wrong | **open** |
+| C3-123 | **A static asset reaches `broken_integrations`, the one verdict this command presents as unconditional.** C3-119 did the main work — 19 → 1, with 14 relocated to `partial_client_calls` and the `meaning` stating its condition. The survivor is `GET /assets/i18n/{}.json` from `transloco-root.module.ts:18`: a translation bundle served by the container, not a Spring route. True under the published definition and not a broken integration in any sense a reader means. Remedy: exclude paths under known asset roots (`/assets/`, `/static/`, `/public/`) or ending in a static file extension, and say so in the `meaning` | 5.4.0 (audit #29) | **Low** | **open** |
+| C3-124 | **`risk` renamed three published keys inside a minor with no alias.** 5.3.1 emitted `total_defects`, `total_findings` and `risks_cap`; 5.4.0 emits `total_defects_floor`, `total_findings_floor` (plus `counts_basis`, `counts_are_floor`, `partial`, `_partial`) and dropped `risks_cap`. Permitted by the command's own experimental tier — *shape may change in a minor* — and the new names are better; the payload still carries no notice, so a consumer bound to the old keys reads `None` with nothing telling it why. `auth status` already publishes a `deprecated_fields` block: the channel exists and this command did not use it | 5.4.0 (audit #29) | **Informative** | **open** |
 
 ## Class C4 — Discoverability (the ceiling as of 3.2.0)
 
@@ -278,6 +284,7 @@ robustness **4/10** — the lowest number any evaluation has given any axis.*
 | `impact.stats.endpoints_affected_count` | C1-16 | ~~`0` where `impact-chain` returns a populated list~~ → **closed 3.5.0**: one reach authority (`caller_reach`), 0 → 20 of 21 endpoints on `Money`, exact parity on two other repositories |
 | `ask <cmd> \| head` | C3-28 | ~~the answer is produced and the exit code says failure~~ → **closed 3.7.0**: a broken output stream changes nothing but where the bytes go; the command still exits on its own terms, so a failure keeps its code and its envelope |
 | `spring-audit` cut by its own budget | C2-31 | ~~`summary` reads `total_defects: 15`, `confidence_level: high` where the complete run measures 98 — the truncation is declared only in `_partial`, at the root~~ → **closed 4.14.0**: a partial answer is capped at `low` confidence and `summary` carries `partial` / `counts_are_floor` / `counts_basis`, so the mark is where the numbers are |
+| `risk -o <path>` | C3-122 | 444 s, exit **0**, no stdout and no file written — one occurrence, unreproduced |
 | `plan <unknown target>` | C3-29 | ~~exit **0** over a payload of zeros while `impact` answers the same fact with exit 1~~ → **closed 3.7.0**: one authority, four commands, and ambiguity recognised as the same fact |
 
 **Two witnesses arrived after the invariant.** Both are exit codes, and I-8 governs payloads —
@@ -327,6 +334,7 @@ provenance: E-3 was found from outside, on the surface where silence is loudest.
 | E-1 | **Prose opened a declaration, and the file left the graph.** The declaration joiner decided whether a line *starts* a type declaration by scanning raw text. A comment carrying `class`/`interface`/`enum`/`record` followed by an identifier — `/** Implements the interface only for the legacy path. */`, or a trailing `// starter class is not an utility class` on an annotation — matched, so the join swallowed the annotation and the real declaration into one entry beginning with `@`, which the main loop reads as a pending annotation and never examines. The file then yields **zero symbols**: no type, no endpoint, no transaction boundary, nothing | 3.7.0 (battery, while building the C3-13 fixture) | Medium | **closed 3.7.0**. Comments are stripped before the keyword scan, block state carried across lines and string-literal aware; the join's terminating `{` must also be code, so a commented brace no longer cuts a real multi-line declaration in half. Measured A/B over six repositories (petclinic, eureka, open-banking-gateway, openmrs-core, Broadleaf, keycloak): **open-banking-gateway recovers 6 types — three of them Spring Boot application classes** — and **no repository loses a single symbol** |
 | E-2 | **The security configuration scan cannot tell code from a comment.** `security_config_scan._scan_java` and `_scan_descriptor` match on raw text with no comment model. Reproduced at unit scope: `SEC-004` is returned identically for a live statement, a `//` comment and a `/* */` block; `SEC-007` identically for a live and a commented-out XML block. **Measured cost in the field: 4 of 13 `high` findings were false — 31 %** — and the damage is worse than the count, because the correlation engine wrote a persuasive paragraph over a commented-out block (*"these deployments share one credential, so the least protected decides the strength of all"*). **Confident prose about dead code is worse than a terse warning: it invites trust.** The same blindness runs in reverse and costs a *finding*: a transport-guarantee constraint that is commented out is invisible, so a mitigation somebody switched off is never reported, and it aggravates a cookie finding reported beside it. E-1 fixed exactly this class for the declaration joiner in 3.7.0; the configuration scan was written afterwards without the lesson | 4.5.1-class (eval #10) | **High** — it is the precision axis (scored 5,5/10) and the reason the evaluator concludes the output *"no es publicable sin verificación humana"* | **closed 4.5.3** — one authority, `source_text`, wired at the **three points a file is read** rather than inside each rule, so a rule added later is covered by construction instead of by whoever remembers. Comments are **blanked, not deleted**: offsets and line count are preserved, so every observation still points at the line a reader can open (asserted). Two properties are asserted as hard as the fix, because getting either wrong trades one wrong answer for another — **string literals survive** (`hibernate_strat._strip_comments_strings` blanks literal *content* on purpose, and these rules carry their evidence *inside* the literal: `MessageDigestPasswordEncoder("SHA-1")`, `<param-value>admin:{SHA-256}…`), and a `//` or `/*` **inside** a string is not a comment (`"http://example.com"`). A/B over the battery: BroadleafCommerce, openmrs-core, keycloak and spring-petclinic report byte-identical security findings — the fix removes false positives and loses no true one. `source_text.commented_spans` is published unused, so the *reverse* half — a control that is present but switched off — has a seam to be reported from rather than a second parser (DEAD-001, queued as F-A) |
 | E-3 | **A handler that inherits its `@RequestMapping` loses the authorization annotation it declares, and 54,7 % of a monolith's HTTP surface is published as unguarded.** The inheritance projection in `_build_route_surface` indexes a projected route under the **declaring** member — the abstract method on the superclass that owns the mapping — and every security lookup downstream reads that symbol. The gate lives on the `@Override` in the concrete controller, which carries no mapping annotation and is therefore never consulted. Census on the subject (3 574 endpoints, parser validated 15/15 against hand-checked cases): **1 955 handlers inherit their mapping, carry a live gate in source, and are published `none_detected`**; 909 that declare their own mapping and carry the same gate are published `custom_gate_inferred`; 363 inherit and genuinely carry nothing; 115 declare and carry nothing; 111 carry a gate that is commented out (correctly `none_detected`, DEAD-001). The shape is the generic CRUD base class — one abstract class with the mappings and no security, 235 controllers extending it. Runtime semantics confirm the direction: the aspect's pointcut is `@Before("@annotation(…)")`, which matches the executing method — the override — so the annotation **is** applied and only the reading stops at the declaration. **Propagates to eight commands**: `endpoints`, `spring-audit`, `posture`, `data-exposure`, `risk`, `impact`, `enrich`, `audit-report`, plus `retrieve endpoint-security|security-surface`. It also retires this repository's own headline: *"2 635 endpoints with no security policy (73,7 %)"* is really **≈659** | 5.3.1 (audit #28) — **the first E row found in the field** | **Critical** — the largest single mis-classification this ledger has recorded, running in the unsafe direction, on the axis the product is bought for, in the answer the field quotes most | **closed 5.4.0** — the projection now names the member that runs. A projected route carries `effective_symbol` (the override where one exists, the declaration otherwise) beside `symbol`; the phase-3 security projection reads a gate the override declares for itself **method-level only**, so the fix can add a policy and never widen one away; and both `custom_gate_inferred` carry sites — the assembled route surface every CIR consumer reads, and the `endpoints` extractor — read the annotation set of **both** members of the pair. Second half, same root and found while fixing it: `_infer_gate_annotations` classified an inherited-mapping override as a non-handler, which puts the only members carrying the gate on the wrong side of the specificity ratio — diluting it at this subject's scale and **suppressing the gate outright** on a repository where most controllers extend a generic base. A member the route surface publishes as a route is a handler. 7 regression assertions over both surfaces and both vocabularies (a repository-declared gate and `@PreAuthorize`), **5 of 7 red on the previous build**; the two that are green are the negative controls — an ungated override stays ungated, because a fix in this direction must not invent a policy either. Suite 8 149 |
+| E-4 | **E-3's residue: the annotation-to-method pairing is decided on raw text, so a blank line switches a security verdict off.** 24 endpoints in 14 controllers still publish `none_detected` with a live gate, out of the 1 955 E-3 corrected, and they partition perfectly into two lexical triggers. **(a) 18 endpoints** — a blank line between the annotation and the declaration (`@Override`, `@M3FiltroSeguridad(...)`, *blank*, `public List<MutuaDto> obtenerTodos()`): **0/18** detected, against 1 931/1 937 = 99,7 % where no blank line intervenes. `repository_ir` clears `pending_anns` in the fall-through at the end of the per-line loop, and the only blank-line guard sits **inside** the block-comment branch, so a genuinely empty line reaches the reset and empties the buffer. **(b) 6 endpoints** — a space between the type and its generic argument (`public List <CategoriaProfesionalDto> obtenerTodos()`): **0/6**. The `return_type` group is `[\w.<>\[\]?,]+`, which admits no space, so `List` matches, `\s+` eats the space, and `(?P<name>[a-z_]\w*)` is offered `<Categoria…>` and fails — **the whole declaration fails to match and the method is dropped**, which is the exact loss the regex's own comment three lines above warns about for modifier-position annotations. Java applies the annotation identically in both forms. In every one of the 14 controllers only `obtenerTodos` fails while its siblings (`crear`, `borrar`, `actualizar`, `obtenerPorId`) resolve. **E-3's 7 regression assertions cover neither form** | 5.4.0 (audit #29) | **Medium** — small population, unsafe direction, and it shows the pairing is still lexical rather than structural | **closed 5.4.1** — two edits, one per trigger. A blank line is skipped before the fall-through that clears the pending-annotation buffer: Java binds an annotation to the next declaration whatever whitespace separates them, and nothing about an empty line is a statement the reader must forget. The `return_type` group admits a space before the generic argument, so `List <Dto>` matches and the method exists again with its endpoint, its gate and its return-type edge. The spelling is normalised where it enters `stable_id` — `List <Dto>` and `List<Dto>` are one type and may not become two identities — and only the space *before* a bracket is removed, so `Map<String, List<X>>` keeps the id it already had. Four assertions added to E-3's battery, all four red on the previous build's source: both forms on the assembled route surface, both on the `endpoints` extractor, and the identity. ⚠ The class of defect is not closed by this row: the pairing is still lexical, which is what F-BP is queued for |
 
 
 ## Class P — Product and procurement (not analysis defects)

{sourcecode-5.4.0 → sourcecode-5.4.1}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,6 +3,103 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
+> **PHASE UPDATE 2026-08-12 (audit #29 — the re-audit of 5.4.0, published the
+> same day, `age_days: 0`).** Same subject (`saint-server @ 3dde037`, branch
+> `banyan-v2`, 3 342 Java / 3 574 endpoints), same protocol (`ASK_READONLY=1` +
+> `--no-write`), same instrumented harness and the same self-validated parser
+> (15/15), compared directly against the 89 artefacts kept from the 5.3.1 round.
+> ~45 commands re-run. **8,05/10** (5.3.1: 8,41) — and the composite hides the
+> story, which has to be told whole: **what the product answers got much better
+> and what delivers it got worse.** Correctness +1,3, performance −2,5,
+> reliability −2,5.
+>
+> **Ten of the twelve rows verified closed independently, one partial, one closed
+> by correcting the claim.** The security axis moved from unusable to reliable:
+> detection on inherited-mapping handlers **0,0 % → 98,8 %** (0/1 955 →
+> 1 931/1 955), affected controllers 232 → 14, and the 909/909 that already
+> declared their own mapping stayed at 100 % — no collateral damage. Measured
+> downstream: `impact.stats.security_surface_count` 894 → 1 888, and `endpoints
+> --consumer` `delete_candidates` 2 637 → 701. The two that did not close clean
+> are **DEF-04** (closed against a narrower restatement than the one reported)
+> and **DEF-07** (`--env-map`, closed by correcting the `--help` text rather than
+> the behaviour — accepted, recorded, not re-opened).
+>
+> ⚠ **The finding of this round is a regression, not a false answer: the
+> composition engine no longer returns on this repository.** `risk` 38,37 s →
+> 601,74 s under a 300 s budget with **0 of 98** defects composed; `enrich`
+> 36,30 s → >600 s stopped by hand; `audit-report` not run after two hangs; one
+> `risk` invocation froze the process until the working session was killed.
+> Median ratio over 48 comparable pairs: **1,00x** — nothing else moved. The
+> auditor localised it to one line of C1-45's own fix by microbenchmark, without
+> invoking `risk` again: `sql_taint._receiver_type` searches an end-anchored
+> pattern over a **copied prefix** of the method body, and `_called_names` pays
+> it for every call of every method in the repository. **916× measured at
+> 215 KB / 5 000 calls, results byte-identical to a windowed search.**
+>
+> **Seven rows opened.** C3-120 (critical, the quadratic receiver resolution) ·
+> C3-121 (the budget does not bind in this family, plus one hard freeze) · E-4
+> (E-3's residue: 24 endpoints whose gate is switched off by a blank line or by
+> `List <T>`) · C1-46 (`existing_test_count: 6` against `test_files: 0`, and the
+> six are a business package called `it`) · C3-122 (`risk -o` exit 0 with no
+> file) · C3-123 (a static asset in `broken_integrations`) · C3-124 (`risk`
+> renamed three published keys inside a minor with no alias).
+>
+> **Order of work: fixes only, one commit each, no features in this batch.**
+> C3-120 → C3-121 (re-measure after C3-120 before investigating separately —
+> same subsystem, the triage C3-114 got against E-3) → E-4 → C1-46 → C3-122 →
+> C3-123 → C3-124. C3-120 first because it is one line with a verified
+> equivalence and it probably closes C3-121 on its way.
+>
+> ⏸ **BATTERY PAUSED AFTER THREE ROWS (user directive, 2026-08-12).** Closed and
+> committed, one commit each, suite green at every one (8 244 → 8 246 → 8 250):
+> **C3-120** `5f28829` (windowed receiver read + the scope on `_called_names`:
+> 18 079 ms → 28 ms over 5 000 calls, identical results) · **C3-121** `b2abec6`
+> (the deadline sampled *inside* the two walks that hold the wall time; a walk
+> cut inside answers `unknown` and is named, never a partial universe) · **E-4**
+> (blank line and `List <T>`, four assertions red on the previous build).
+> **STILL OPEN, in order, when the battery resumes: C1-46 · C3-122 · C3-123 ·
+> C3-124.** No release commit and no version bump has been made — the tree
+> carries 5.4.0's version with three fixes on top, and C3-120/C3-121 are the two
+> that would need re-measuring on the field's subject before any release claims
+> the composition family is back.
+>
+> **What the round confirms, and it is worth keeping:** remediation speed (12
+> reported, 10 closed and verifiable in a release published the same day); the
+> published ledger read as *"an asset, not marketing"*, including how many
+> regression assertions were red before each fix; fixes that move the authority
+> rather than patching the surface (`CONFIG_KEYS` as a registry readers consult,
+> two derived fields off one predicate); first-class degradation under budget
+> (`_partial` names phases completed and pending, `why_stopped`, the skipped
+> walks and the axes left `unknown` — *"an absent measurement, never a zero"*);
+> instrumented progress with stage, counter and ETA; both documents distributed
+> **and the build verifying it against the wheel manifest**; and non-persistence
+> intact over ~45 commands with the repository byte-identical.
+>
+> **Price, re-derived on the same method** (EUR per developer seat per year, 8
+> seats): floor €180 → **€200**, mid €420 → **€450**, ceiling €780 → **€650**.
+> The ceiling fell because `risk` / `enrich` / `data-exposure` are what carries
+> the premium over a SAST and two of the three do not finish here — *capacity
+> that does not terminate cannot be charged for*. **The ceiling is conditional
+> and recoverable: closing C3-120 returns it to €780 and above, because the input
+> to that composition is now correct — in 5.3.1 it finished over bad data.** The
+> Boot 2→3 migration engagement is unchanged at €3 000–6 000 (`migrate-check` /
+> `migrate-recipe` byte-identical: 61,0 days, 532 blocking findings).
+>
+> **Amendment V — three capabilities, all of them recommended by this round and
+> all deferred behind the fix battery.** They are features, not fixes: none of
+> them corrects a false claim.
+>
+> | | what it closes | shape |
+> |---|---|---|
+> | **F-BP** structural annotation↔member binding | E-4 is the second time a whitespace form has switched a security verdict off, and the fix for it is two more lexical tolerances. The pairing wants to be decided on the declaration the IR already builds, not on adjacency in raw text | a member's annotation set comes from the member, not from a line-buffer that anything unrecognised can clear. Bounded to the Java path that already produces `effective_symbol` |
+> | **F-BQ** a deprecation channel for experimental payload keys | C3-124: an experimental tier is permission to change shape, not permission to change it in silence. `auth status` already publishes `deprecated_fields` and nothing else reuses it | one alias table per command, emitted beside the new key for one minor, with the release that removes it named in the payload |
+> | **F-BR** a cost gate in the release battery for the composition family | C3-120 is a ×15,7 regression that a release shipped, and the performance gate that exists (C3-110/C3-113) has never had a cell for `risk` or `enrich` on a body of this size | a synthetic fixture — one ~200 KB method, ~5 000 calls — with a wall-clock assertion on `build_sql_taint`, and warm cells for the three composition commands in the release gate's baseline |
+>
+> ⚠ **Still queued from Amendment U, untouched by this round:** F-BK, F-BL,
+> F-BM, F-BN, F-BO. F-BN (`ask explain-endpoint`) gains an argument from E-4:
+> the derivation it would print is exactly what makes a residue like this
+> visible in one command instead of in a census.
+
 > **PHASE UPDATE 2026-08-12 (audit #28 of 5.3.1 — the first round run under a
 > written non-persistence protocol, and the round that finds the worst defect
 > this ledger has recorded).** Same subject (`saint-server @ 3dde037`, branch

{sourcecode-5.4.0 → sourcecode-5.4.1}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.4.0
+# ask 5.4.1
 ```
 
 Requires Python 3.9+.

{sourcecode-5.4.0 → sourcecode-5.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.4.0"
+version = "5.4.1"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.4.0 → sourcecode-5.4.1}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.4.0"
+__version__ = "5.4.1"

{sourcecode-5.4.0 → sourcecode-5.4.1}/src/sourcecode/consumer_join.py

@@ -112,6 +112,13 @@ _VERB_FROM_OP = {
     "delete": "DELETE",
 }
 
+_STATIC_ASSET_ROOTS = ("/assets/", "/static/", "/public/")
+_STATIC_ASSET_EXTS = frozenset({
+    ".css", ".js", ".mjs", ".cjs", ".ts", ".tsx", ".json", ".map",
+    ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".ico",
+    ".woff", ".woff2", ".ttf", ".eot",
+})
+
 
 def _java_files(base: Path) -> list[Path]:
     out: list[Path] = []
@@ -227,6 +234,14 @@ def _slug(path: str) -> str:
     return re.sub(r"[^a-z0-9/{}]", "", normalize_path(path).lower())
 
 
+def _is_static_asset_path(path: str) -> bool:
+    norm = normalize_path(path).lower()
+    if any(root in norm for root in _STATIC_ASSET_ROOTS):
+        return True
+    suffix = Path(norm).suffix
+    return suffix in _STATIC_ASSET_EXTS
+
+
 def build_consumer_join(
     root: Path,
     endpoints: "Iterable[dict]",
@@ -316,7 +331,8 @@ def build_consumer_join(
     unmatched = [
         {"join_key": key, "call_sites": group[:5],
          "consumers": sorted({g["consumer"] for g in group})}
-        for key, group in _unmatched_groups if not _is_partial(group)
+        for key, group in _unmatched_groups
+        if not _is_partial(group) and not _is_static_asset_path(group[0]["path"])
     ]
     partial_unmatched = [
         {"join_key": key, "call_sites": group[:5],
@@ -394,8 +410,11 @@ def build_consumer_join(
                 "meaning": (
                     "a consumer makes this request and this server serves no route "
                     "for it — the one direction that needs no assumption about "
-                    "coverage to be true. It holds only for calls whose whole path "
-                    "is written at the call site; a call whose head is an "
+                    "coverage to be true. static asset paths under /assets/, "
+                    "/static/ or /public/, and paths ending in static file "
+                    "extensions, are excluded because they are served files, not "
+                    "server routes. It holds only for calls whose whole path is "
+                    "written at the call site; a call whose head is an "
                     "interpolation is in `partial_client_calls`, because the path "
                     "matched against is the written tail (C3-119)"
                 ),

{sourcecode-5.4.0 → sourcecode-5.4.1}/src/sourcecode/repository_ir.py

@@ -199,7 +199,16 @@ _METHOD_DECL_RE = re.compile(
     # the method (its endpoint + return-type edge) is silently dropped (CH-003/Fase 22).
     r'(?P<inline_anns>(?:@[\w.]+(?:\s*\([^)]*\))?\s+)*)'
     r'(?:<[\w,\s?]+>\s+)?'
-    r'(?P<return_type>(?:void|boolean|byte|char|short|int|long|float|double|String|[\w.<>\[\]?,]+)\s+)'
+    # E-4: the generic argument may be written apart from its type — `List <Dto>`
+    # is legal Java and the annotation applies identically. The character class
+    # below admits no space, so `List` matched, the `\s+` ate the space and the
+    # name group was offered `<Dto>`: the whole declaration failed and the method
+    # was dropped with its endpoint, its gate and its return-type edge — the exact
+    # loss the comment above warns about, from a different direction. Measured:
+    # 6 endpoints of the field's subject, all in the unsafe direction.
+    r'(?P<return_type>(?:void|boolean|byte|char|short|int|long|float|double|String'
+    r'|[\w.\[\]?]+\s*<[\w.<>\[\]?,\s]*>(?:\s*\[\s*\])*'
+    r'|[\w.<>\[\]?,]+)\s+)'
     r'(?P<name>[a-z_]\w*)\s*\(',
 )
 
@@ -874,8 +883,16 @@ def _parse_param_types(params_str: str) -> list[str]:
 
 
 def _normalize_return_type(raw: str) -> str:
-    """Normalize return type string: strip whitespace, keep generics."""
-    return raw.strip()
+    """Normalize return type string: strip whitespace, keep generics.
+
+    E-4: `List <Dto>` and `List<Dto>` are one type written two ways, and once the
+    first spelling is extracted at all it must not become a second identity —
+    this string is part of `stable_id`, which is what a baseline, a delta and a
+    contract diff are keyed on. Only the space *before* a bracket is removed:
+    `Map<String, List<X>>` keeps the spelling it already had, so nothing that
+    parsed before changes id.
+    """
+    return re.sub(r"\s+(?=[<>])", "", raw.strip())
 
 
 def _compute_stable_id(
@@ -1144,6 +1161,18 @@ def _extract_symbols(
             stripped = stripped.strip()
             if not stripped:
                 continue
+        if not stripped:
+            # E-4. A blank line is not a statement about anything, and clearing
+            # the annotation buffer on it made one switch a security verdict off:
+            # 18 endpoints of the field's subject published `none_detected` with
+            # a live gate written two lines above the method, because
+            # `@Override`, `@M3FiltroSeguridad(...)`, blank, `public List<Dto>
+            # obtenerTodos()` reached the fall-through reset at the end of this
+            # loop. Java binds an annotation to the next declaration whatever
+            # whitespace separates them. The only blank-line guard used to sit
+            # inside the block-comment branch above, which a genuinely empty line
+            # never enters.
+            continue
         if stripped.startswith("//") or stripped.startswith("*"):
             continue
 
@@ -1261,7 +1290,9 @@ def _extract_symbols(
                     conf = "high" if ("public" in modifiers or pending_anns) else "medium"
 
                     # Extract return type and params from matched line
-                    _ret_raw = (mth_m.group("return_type") or "").strip()
+                    _ret_raw = _normalize_return_type(
+                        mth_m.group("return_type") or ""
+                    )
                     _after_paren = stripped[mth_m.end():]
                     # Paren-balanced close (DR-1): a naive first-')' truncated the
                     # parameter list at the first annotation ')' — e.g.

{sourcecode-5.4.0 → sourcecode-5.4.1}/src/sourcecode/risk.py

@@ -382,13 +382,64 @@ def _has_http_input_parameter(root: Path, cir: "CanonicalRepositoryIR") -> bool:
 #: never serves a repository-wide question (C3-94).
 _METHODS_CACHE_ATTR = "_ask_java_methods_cache"
 
+#: How often a repository-wide walk asks the clock. Per file rather than per
+#: method: the question is cheap and the unit has to be small enough that the
+#: overshoot is a file, not a phase.
+_BUDGET_SAMPLE_FILES = 16
+
+
+class WalkStopped(Exception):
+    """A repository-wide walk was cut by the operator's budget while running.
+
+    C3-121. The budget was asked **before** each walk and never again inside one,
+    so a walk that started one second under the limit ran to completion however
+    long that took: the field measured `risk` at 601,74 s under a 300 s budget
+    and `enrich` past 600 s under 150 s. A gate that only holds at phase
+    boundaries is not a budget, it is a suggestion.
+
+    What a stopped walk must never do is answer with what it had. Every one of
+    these walks is a repository-wide *negative* — "no call site passes request
+    input to this statement" — and a negative over a partial universe is a
+    confident no built on an unfinished read, which is the one failure mode this
+    family refuses. So the measurement is dropped, the axis reads `unknown`, and
+    the walk is named in `_partial.composition_walks_not_run`.
+    """
+
+
+def _budget_stopper(
+    stop_when: "Optional[Callable[[], bool]]",
+) -> "Callable[[int], None]":
+    """A per-file check that raises `WalkStopped` when the budget is spent."""
+
+    def _check(index: int) -> None:
+        if stop_when is None or index % _BUDGET_SAMPLE_FILES:
+            return
+        try:
+            spent = bool(stop_when())
+        except Exception:
+            return  # an unreadable clock is not evidence the budget is spent
+        if spent:
+            raise WalkStopped
+
+    return _check
 
-def _java_methods(root: Path, cir: "CanonicalRepositoryIR") -> list[_MethodSource]:
+
+def _java_methods(
+    root: Path,
+    cir: "CanonicalRepositoryIR",
+    *,
+    stop_when: "Optional[Callable[[], bool]]" = None,
+) -> list[_MethodSource]:
     cached = getattr(cir, _METHODS_CACHE_ATTR, None)
     if isinstance(cached, list):
         return cached
+    check = _budget_stopper(stop_when)
     methods: list[_MethodSource] = []
-    for rel in getattr(cir, "files", []) or []:
+    for _index, rel in enumerate(getattr(cir, "files", []) or []):
+        # Raises rather than returns: a half-parsed method universe cached on the
+        # CIR would serve every later caller a repository that is missing files,
+        # silently. Nothing is cached on this path.
+        check(_index)
         if not str(rel).endswith(".java"):
             continue
         try:
@@ -477,7 +528,10 @@ def _call_edges_with_tainted_args(
 
 
 def _http_input_query_sinks(
-    root: Path, cir: "CanonicalRepositoryIR"
+    root: Path,
+    cir: "CanonicalRepositoryIR",
+    *,
+    stop_when: "Optional[Callable[[], bool]]" = None,
 ) -> dict[str, str]:
     """Bounded HTTP-input propagation to known query sinks.
 
@@ -496,7 +550,10 @@ def _http_input_query_sinks(
     # zero seeds, zero sinks. An equivalence, not a heuristic.
     if not _has_http_input_parameter(root, cir):
         return {}
-    methods = _java_methods(root, cir)
+    # C3-121: the parse is the cost, so it is also where the budget has to be
+    # asked. A stop raises out of this walk; `risk` records the walk as not run
+    # and the axis it feeds reads `unknown`.
+    methods = _java_methods(root, cir, stop_when=stop_when)
     by_name: dict[str, list[_MethodSource]] = {}
     by_owner = {m.owner: m for m in methods}
     for method in methods:
@@ -512,8 +569,10 @@ def _http_input_query_sinks(
         for method in methods
         if method.http_inputs
     ]
+    check = _budget_stopper(stop_when)
     seen: set[tuple[str, tuple[str, ...]]] = set()
     while queue and len(seen) < 2000:
+        check(len(seen))
         method, tainted, path = queue.pop(0)
         key = (method.owner, tuple(sorted(tainted)))
         if key in seen:
@@ -533,11 +592,16 @@ def _http_input_query_sinks(
     return out
 
 
-def _sql_taint(root: Path, cir: "CanonicalRepositoryIR") -> dict:
+def _sql_taint(
+    root: Path,
+    cir: "CanonicalRepositoryIR",
+    *,
+    stop_when: "Optional[Callable[[], bool]]" = None,
+) -> dict:
     """F-BF, imported at the seam that uses it (the module imports `risk` back)."""
     from sourcecode.sql_taint import build_sql_taint
 
-    return build_sql_taint(root, cir)
+    return build_sql_taint(root, cir, stop_when=stop_when)
 
 
 def _sql_reached_files(payload: "Optional[dict]") -> "dict[str, str]":
@@ -953,6 +1017,23 @@ class RiskComposer:
             _setup.step(label)
             return True
 
+        _stop_when = _setup.should_stop if _setup is not None else None
+
+        def _inside(label: str, produce: "Callable[[], Any]") -> Any:
+            """Run a walk that asks the budget while it runs (C3-121).
+
+            The gate above holds only at the *start* of a walk, which is why a
+            `risk` run under a 300 s budget took 601,74 s in the field: the walk
+            it was in when the limit passed had no way to hear it. A walk cut
+            inside raises, and what it produces then is exactly what it produces
+            when it never ran — `None`, which every axis reads as `unknown`.
+            """
+            try:
+                return produce()
+            except WalkStopped:
+                self.walks_not_run.append(label)
+                return None
+
         posture = (
             infer_security_posture(self.cir, root=self.root)
             if _named("inferring the security posture") else None
@@ -988,7 +1069,12 @@ class RiskComposer:
         # `keycloak/services` it is the stage the run stands in for minutes. This is
         # an equivalence and not a heuristic — the same shape as C3-61's guard.
         self.http_input_query_sinks = (
-            _http_input_query_sinks(self.root, self.cir)
+            _inside(
+                "reading HTTP-input query sinks",
+                lambda: _http_input_query_sinks(
+                    self.root, self.cir, stop_when=_stop_when
+                ),
+            )
             if self.concat_owners and _named("reading HTTP-input query sinks")
             else None
         )
@@ -998,7 +1084,10 @@ class RiskComposer:
         # no spliced statement or no annotated HTTP input at all, so the walk is
         # paid only where it can conclude something.
         self.sql_taint = (
-            _sql_taint(self.root, self.cir)
+            _inside(
+                "reading spliced SQL statements",
+                lambda: _sql_taint(self.root, self.cir, stop_when=_stop_when),
+            )
             if _named("reading spliced SQL statements") else None
         )
         self.sql_interpolation_sinks = _sql_reached_files(self.sql_taint)