sourcecode 5.8.12__py3-none-any.whl → 5.8.14__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.12"
+__version__ = "5.8.14"

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,23 +16,49 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-19, the external `5.8.11` re-audit:** this is the current status of
-the 5.8.8/5.8.9 audit queue. The subject remained `saint-server` at `3dde0376`, with a
-byte-identical CIR and the same 53/61 invocables exercised. The score is **78/100**
-(75 in 5.8.8, 80 in 5.8.9). The observations below remain historical evidence; only
-this table declares present state.
+**As of 2026-08-20, release `5.8.14` and the fourth external re-audit:** the audited
+snapshot remains `3dde0376`; the report compares the four audit rounds and scores this one
+**90/100** (75, 80, 78, 90). It exercised 53/61 invocables (87%), ran no application and
+left the repository unchanged. Its 40+ longitudinal functional anchors are unchanged, so
+there is no reported product regression. The `5.8.14` release ships the implementations
+recorded below; they remain distinguished from facts verified on the `5.8.13` subject.
+Only this table declares present state.
+
+**Release status:** entries marked “pending `5.8.14`” in their historical wording are
+shipped in `5.8.14`; a re-audit is still required wherever the row says so.
 
 | Rows | Current status | Evidence |
 |---|---|---|
-| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **implemented in 5.8.12** | `9884488` requires `risk` and `audit-report` to deliver stdout or their requested artifact before exit 0; the remaining closure evidence is a field-scale subprocess reproduction. |
+| `AUD-588-B01` / `AUD-589-B01`, `C3-122` | **open, P0 for `risk`; `audit-report` corrected** | `9884488` corrected `audit-report` to refuse with typed `OUTPUT_TOO_LARGE` and produce its requested artifact. `risk` nevertheless exited 0 twice on the first shared-cache invocations with 0 bytes and no `-o` file, then succeeded seven times. `5cfa9ba` now publishes the source, audit-finding, candidate-defect and composed-defect working set, including partial answers. Repeat the real entry-point protocol before closure. |
 | `AUD-511-R01` / `AUD-588-B03` | **implemented in 5.8.12** | `13362ec` makes SEC-009 read comment-blanked Java, so a Javadoc profile cannot override the live `@Profile("!m3")` declaration. |
 | `AUD-588-B04` | **retracted audit premise** | `data-exposure` correctly preserves `chain_decision`; the reported `coverage_unknown` routes were custom-gate annotations whose application was not configured. `fd34eb1` remains a valid additive disclosure, but no further B04 fix is due. |
 | `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
-| `AUD-511-R03` / `AUD-588-B07` | **implemented in 5.8.12** | `47aee1e` gives the published `OUTPUT_TOO_LARGE` envelope precedence over an inconsistent process status and preserves the excerpt in every branch. |
+| `AUD-511-R03` / `AUD-588-B07` | **implemented, pending 5.8.14 re-audit** | `f613df9` makes ASK-09 parse the typed document from stdout or stderr, including a progress-prefixed stderr stream, and removes the four inherited variables that change its precondition. The regression exercises the real typed refusal shape. The prior claim that the payload premise was false remains retracted as an environment-contamination artifact. |
 | `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
-| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.12** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `impact` naming, source population units, risk tiers and plan narrative remain open. |
-| `AUD-511-R02` / `AUD-589-B02` | **partially mitigated in 5.8.12, still under investigation** | `b93f230` reuses one `SpringSemanticModel` across every declared `data-exposure` seed; `473f47a` routes `validation` through the shared CIR cache, and `91bd0c0` retains subcommand `--no-cache` compatibility. On the local BroadleafCommerce corpus at the final analyzer fingerprint, a first shared-CIR fill took 10.46 s and its warm `validation --compact` hit took 4.01 s with byte-identical output. This is a same-host cache-state observation, not the 5.8.9/5.8.11 external A/B: the six-run C3-120 comparison and the configured `saint-server` reproduction remain required. |
-| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **partially open in 5.8.12** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. B11 parity and controlled cost calibration remain required. |
+| `MCP-001` | **closed 5.8.13** | Deep corpus testing reproduced concurrent `CliRunner` stream capture leaking a tool response to the host stdout. `b2c9660` serializes the narrow process-global capture seam; concurrent real MCP calls and a regression test verify response isolation. |
+| `AUD-513-N01` (`N-1`) | **closed in 5.8.14** | `rename-class` rewrote three Petclinic files under both `ASK_READONLY=1` and `--no-write`, then exited 0. The audit restored the tree; this is a write-policy breach, not an artifact-directory exception. `readonly.guard_mutation()` now refuses before any planned source write or physical rename; help names the command as mutating and regressions cover both readonly controls plus `--dry-run`. |
+| `AUD-513-N02` / `B-4` / `N-5` | **N02/B-4 implemented in 5.8.14; N-5 open** | `posture.summary.unconditional` counted 1,697 on a non-Spring Struts tree and 1,573 on Mall, and `security` was `0/0/0` with no population. The posture projection now uses the canonical Spring IoC bean population, publishes its population/unit and separates unconditional security beans. Regressions cover non-Spring, mixed-bean and conditional/unconditional security fixtures. Progress/advice still use incompatible “Java files” scopes (`N-5`), so the `AUD-588-F02` family remains open. |
+| `AUD-513-B01` / `B-3` / `B-5` | **B01/B-5 implemented in 5.8.14; B-3 closed as revalidated** | A MyBatis XML paired with a `*Mapper.java` interface now takes precedence over an absent `@Mapper` annotation, preserving XML-backed/`@MapperScan` interfaces in `mapper_interfaces` rather than misclassifying them as DTO mappers. `imports_found` now contains only actual Java imports; code, XML and build matches are emitted as `evidence`, including in compact output. `B-3` was stale against the current source: both views consume `JAVA_SPRING_SECTIONS`; a real MyBatis Mapper/XML regression proves the section is retained by `--agent`. |
+| `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, `D-09` | **N03/N04/N07/N08/N09 implemented in 5.8.14; remainder open** | `impact` now always publishes the `candidates` field its not-found message names, including `[]` when no close symbol exists. Budget advice no longer calls partial snapshot/RIS evidence a warm cache: it identifies that presence and says context/parse are unknown before analysis, whose payload then reports all four actual layers. README operational sections (`clone`, install, build, getting started, troubleshooting and related headings) are never promoted into a project summary; with no descriptive prose compact output publishes `project_summary: null` and `summary_basis`. `security_posture.limitations` is now cache-state invariant; dynamic execution advice travels in `security_posture.operational_hints`. Every numeric output bound rejects negative values at parse time with a structured `INVALID_INPUT` envelope (`flag`, `value`, `expected`); `--limit 0` still means no cap wherever that behavior was published. Budgets overrun, timing coverage is inconsistent, compact hides unresolved identities and cost anchors remain stale. |
+| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.14** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `e53507d` separates direct impact matches from analysis seeds and implementation classes; `8386744` carries the established container-wiring fact into plan checklists and compare cost dimensions. Source population units and risk-tier wording remain open. |
+| `AUD-511-R02` / `AUD-589-B02` / `AUD-513-N06` | **partially corrected; `data-exposure` open, P1** | Nine of ten measured commands recovered, many to their best historical timings. `data-exposure --config` did not: 42.7 s versus 16.2 s in 5.8.8 and a 28.9 s model, with byte-equivalent output. Measure it with the idle-host, isolated-cache, interleaved-control protocol before changing code, then compare its reuse path with `validation`. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **B02/B06 closed; B11/B12 open, P2** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. The re-audit verifies both and the payload reduction; `cf57457` makes aggregate wording name only applicable dimensions. Complete B11 consumer parity and calibrate B12 only from provenance-bearing controlled samples. |
+
+### Fourth Re-audit: 5.8.13
+
+The fourth pass verifies the current facts that supersede the prior intake. There is no
+crash/traceback and no regression in the published anchors. `B-2/D-05` remains a retracted
+servlet premise, and the audit additionally verifies EclipseLink applicability/non-coverage,
+typed `audit-report` refusal, nested Maven discovery and the `unaffected_basis` correction.
+It leaves the following concrete queue rather than reopening closed facts.
+
+| Recommendation | Status and direction |
+|---|---|
+| `AUD-588-F02` shared answer contracts | **Partial.** Reuse the existing authorities for exact target versus implementation cone, named source populations and container reach in plan/compare; do not add a parallel detector. |
+| `AUD-588-F03` versioned cost calibration | **Open.** Capture repository, cache state, sample count and host provenance. The immediately actionable measurement is `data-exposure --config`; clean data is required before recalibration. |
+| Risk cache observability | **Recommended hardening.** Publish working-set unit counts under progress or in the envelope to distinguish an empty compositor from a present-but-incomplete cache. |
+| `AUD-588-F05` coverage expansion | **Locally verified only.** Dirty-tree `verify-edit` and the eight mutating/denied invocables remain unexercised in all four external rounds. |
+| EclipseLink migration automation | **Deferred product feature.** The current applicability and non-coverage facts are verified; provider-specific migration automation is not a corrective fix. |
 
 ### Re-audit Intake: 5.8.11
 
@@ -594,7 +620,7 @@ class's subject, not its provenance.
 
 | ID | Item | Found | Severity | Status |
 |---|---|---|---|---|
-| P-1 | Telemetry is **opt-out**. Auditing a public-sector health client's code, it must be disabled *before* the first run, not after | 3.2.0 | **High (procurement)** | **closed 3.3.0** — opt-in: with no explicit choice on record, `is_enabled()` is False everywhere, so a fresh install transmits nothing on the run that prints the notice. The CI special case is gone with the default it existed to override; CI is still detected for one purpose, skipping a notice that has no terminal to appear on. The first-run notice became an invitation that states what *would* be collected. `telemetry status` distinguishes "no choice recorded" from "you chose disabled" (`stored_choice()` returns `None`, not `False`) — a buyer auditing this needs to know which one they have. An explicit choice made before the change is honoured unchanged |
+| P-1 | Telemetry default and procurement disclosure | 3.2.0 | **High (procurement)** | **reopened and corrected 5.8.12** — telemetry is on by default by explicit product decision, with `ask telemetry disable`, `SOURCECODE_TELEMETRY=0` and `DO_NOT_TRACK=1` honored before any event is sent. The first-run notice discloses the fields and the disable path. `telemetry status` distinguishes the default from an explicit disabled choice; the privacy policy documents the endpoint, 90-day retention and bounded anonymous fields. This supersedes the historical 3.3.0 opt-in closure for the current release |
 | P-2 | Licence state is ambiguous: `auth status` → `{"status":"unauthenticated","pro":true,"pro_reason":"early-adoption unlock"}`. The buyer cannot tell what it will cost or what they lose when the door closes | 3.2.0 | Medium | **closed 3.4.0** — one authority, `license.entitlement()`: `entitlement` (what runs), `source` (why: `license_key` / `early_adoption_unlock` / `free_tier`), `authenticated` (a separate fact — today one can be entitled without a credential), `paywall_active`, and `when_it_changes`, which states what the user loses when that source stops applying, in the terms the gate uses and **never as a price**. `is_pro` — what every gate reads — is now derived from it rather than computed beside it, which is how the status page came to contradict the commands. The legacy keys stay for consumers, are derived from the authority, and are listed in `deprecated_fields` |
 
 | P-3 | **The price is not published.** With P-2 closed the entitlement is unambiguous, but a buyer still cannot see what Pro costs or what a team of 25 pays. Eval #5 lists *"precio Pro público"* among the conditions for the top of its price band, beside the robustness fixes | 3.2.1 (eval #5) | Medium (procurement) | open — packaging question, not a page: the field's own reading is that **the value is frontal** (a first audit replaces 5–15 person-days) **and the recurring half is the CI gate**, so a full seat subscription on a product whose value peaks on run one *"genera churn en el mes 4"*. Model to test: one-off assessment **3–5 k€ per repo** + **8–12 €/dev/month** for the gate. Depends on C3-22: without the gate there is nothing recurring to sell |

sourcecode/_docs/USER_GUIDE.md

@@ -138,7 +138,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.12
+# ask 5.8.14
 ```
 
 Requires Python 3.9+.
@@ -1199,7 +1199,7 @@ explaining. The rest do one thing; `ask <command> --help` is the whole story.
 | `ask retrieve` | parked | Typed knowledge queries over the model — kept working, no longer developed |
 | `ask baseline capture\|diff\|trend` | supported | Versioned architectural metrics over time; see [`ask trend`](#ask-trend-dir--how-the-architecture-moved) |
 | `ask cache status\|warm\|model\|clear\|freshness` | supported | Cache inspection; `ask cache model` states what a warm buys each command |
-| `ask config` · `ask version` · `ask activate` · `ask auth` · `ask telemetry` · `ask mcp` | supported | Configuration, version, licence, authentication, telemetry (off by default), MCP integration |
+| `ask config` · `ask version` · `ask activate` · `ask auth` · `ask telemetry` · `ask mcp` | supported | Configuration, version, licence, authentication, telemetry (on by default), MCP integration |
 
 ## Typical workflows
 
@@ -1287,7 +1287,7 @@ ask mcp serve
 ask mcp remove
 ```
 
-The MCP server exposes structural analysis tools to AI agents without requiring the agent to call the CLI directly. Claude Desktop and Cursor can query impact, endpoints, and context through the MCP protocol.
+The MCP server exposes structural analysis tools to AI agents without requiring the agent to call the CLI directly. Claude Desktop and Cursor can query impact, endpoints, and context through the MCP protocol. Concurrent requests are accepted safely: ASK serializes only the in-process CLI capture seam, because its stdout/stderr redirection is process-global, so one tool response cannot contaminate another.
 
 ---
 

sourcecode/change_plan.py

@@ -139,7 +139,9 @@ def build_change_plan(
             ),
         }
 
-    seeds = list(blast["matched_fqns"])
+    # The user-facing match names the requested target; planning must retain the
+    # subtype-expanded seeds that the blast-radius authority actually analysed.
+    seeds = list(blast.get("analysis_seed_fqns") or blast["matched_fqns"])
     container_wired = [w.to_dict() for w in detect_classes(cir, seeds)]
     meta = _node_meta(cir)
     affected = _dependents_closure(cir.reverse_graph or {}, seeds, max_depth, _NODE_CAP)
@@ -210,6 +212,11 @@ def build_change_plan(
         checklist.append(
             f"{len(sec)} secured endpoint(s) in scope — re-check authorization."
         )
+    if container_wired:
+        checklist.append(
+            f"{len(container_wired)} container-wired component(s) are in scope — "
+            "review their declared framework wiring because fan-in does not measure it."
+        )
     txn = blast.get("transactional_boundaries_touched") or []
     if txn:
         checklist.append(f"{len(txn)} transactional boundary/boundaries in scope.")

sourcecode/cli.py

@@ -6,6 +6,7 @@ import hashlib
 import json
 import difflib
 import os
+import re
 import sys
 import tempfile
 import threading
@@ -287,6 +288,7 @@ COMMANDS_THAT_WRITE: "tuple[tuple[str, str], ...]" = (
     ("migrate-check", "`<repo>/.ask/readiness-history/` — only with `--history`"),
     ("verify", "`<repo>/.ask/contracts-baseline.json` — only with `--update-baseline`"),
     ("verify-edit", "the repository's git hooks directory — only with `--install-hook`"),
+    ("rename-class", "`<repo>/**/*.java` — only without `--dry-run`; existing sources change and the declaring file is renamed"),
     ("*", "`<repo>/.ask/runs/` — only when `ASK_RUNS_IN_REPO=1` is set"),
 )
 
@@ -294,7 +296,7 @@ COMMANDS_THAT_WRITE: "tuple[tuple[str, str], ...]" = (
 def _writes_help_block() -> str:
     """The `--no-write` table as `--help` prints it — generated, never typed."""
     lines = [
-        "Commands that create files inside the repository (everything else reads only):",
+        "Commands that modify files inside the repository (everything else reads only):",
         "",
     ]
     width = max(len(name) for name, _ in COMMANDS_THAT_WRITE)
@@ -1625,7 +1627,10 @@ def _budget_evidence(command: str, path: "Optional[Path]") -> "tuple[Optional[st
         if path is not None:
             measured = _plan.scope_for(Path(path))
             if measured is not None and measured.measured:
-                scope = measured.describe()
+                # The scope probe can cheaply see only the snapshot/RIS store.
+                # Do not turn that partial observation into "cache warm" while
+                # a command's actual context/parse state is still unknown.
+                scope = measured.describe_for_budget()
     except Exception:
         pass  # a message about cost must never be the reason a run fails
     return anchors, scope
@@ -2325,6 +2330,32 @@ def _root_flag_usage(flag: str) -> str:
         return f"`ask {flag} <path>`"
 
 
+def _numeric_range_error_context(message: str) -> dict[str, object]:
+    """Extract structured facts from Click's lower-bound validation message.
+
+    Click owns parser-time validation, so commands never start work for an
+    invalid value. Its stock message contains the useful facts but leaves
+    automation to parse prose; expose those facts in the shared error envelope.
+    """
+    prefix, separator, remainder = message.partition(": ")
+    if not separator or not prefix.startswith("Invalid value for "):
+        return {}
+    minimum = re.search(
+        r"is not in (?:the )?range (?:x>=(\d+)|(\d+)<=x(?:<=\d+)?)",
+        remainder,
+    )
+    value = re.match(r"(-?\d+)\s+is not in", remainder)
+    flags = re.findall(r"'(--[^']+)'", prefix)
+    if minimum is None or value is None or not flags:
+        return {}
+    lower_bound = minimum.group(1) or minimum.group(2)
+    return {
+        "flag": flags[0],
+        "value": int(value.group(1)),
+        "expected": f"an integer >= {lower_bound}",
+    }
+
+
 try:
     import click.exceptions as _click_exc
 
@@ -2386,7 +2417,11 @@ try:
 
     def _json_click_usage_error_show(self: Any, file: Any = None) -> None:  # type: ignore[override]
         import json as _je
+        _message = self.format_message()
+        _numeric_context = _numeric_range_error_context(_message)
         _flag, _hint = _misplaced_global_flag_hint(self)
+        if _numeric_context:
+            _flag = str(_numeric_context["flag"])
         if not _hint:
             _nearby = _nearby_command_flag_hint(self)
             if _nearby:
@@ -2396,10 +2431,13 @@ try:
             _context["flag"] = _flag
         if _hint:
             _context["scope"] = "root"
+        if _numeric_context:
+            _context["value"] = _numeric_context["value"]
         payload = build_error_envelope(
             INVALID_INPUT_CODE,
-            self.format_message(),
+            _message,
             hint=_hint,
+            expected=(str(_numeric_context["expected"]) if _numeric_context else None),
             **_context,
         )
         sys.stderr.write(_je.dumps(payload, ensure_ascii=_json_ensure_ascii()) + "\n")
@@ -3033,13 +3071,59 @@ def _get_command_with_preprocessing(typer_instance: Any) -> Any:
 
     _orig_cmd_main = cmd.main
 
+    _TELEMETRY_COMMANDS = frozenset({
+        "repo-ir", "impact", "endpoints", "export", "validation", "delta", "contract-diff",
+        "plan", "compare", "trend", "timeline", "spring-audit", "verify-edit", "verify", "risk",
+        "enrich", "audit-report", "migrate-recipe", "data-exposure", "posture", "migrate-check",
+        "impact-chain", "pr-impact", "explain", "onboard", "review-pr", "fix-bug", "modernize",
+        "rename-class", "chunk-file", "activate", "selftest", "explain-endpoint", "regress", "version",
+        "schema", "config", "archetype", "cold-start", "telemetry", "mcp", "cache", "baseline",
+        "auth", "retrieve", "prepare-context",
+    })
+
+    def _telemetry_command(args_for_command: Optional[list[str]]) -> str:
+        """Extract only a registered CLI command, never a path or option value."""
+        tokens = list(args_for_command) if args_for_command is not None else sys.argv[1:]
+        for token in tokens:
+            if token in _TELEMETRY_COMMANDS:
+                return token
+        return "analyze"
+
+    def _telemetry_flags(args_for_command: Optional[list[str]]) -> list[str]:
+        tokens = list(args_for_command) if args_for_command is not None else sys.argv[1:]
+        try:
+            from sourcecode.telemetry.filters import _SAFE_FLAGS
+            return sorted({token for token in tokens if token in _SAFE_FLAGS})
+        except Exception:
+            return []
+
     def _cmd_main(args: Optional[list[str]] = None, **kwargs: Any) -> Any:
         if args is not None:
             # CliRunner / programmatic call: preprocess the explicit args list.
             _set_detected_path(".")
             args = _preprocess_args(list(args))
         # args=None → Click reads sys.argv; _preprocess_argv() in main_entry handled it.
-        return _orig_cmd_main(args=args, **kwargs)
+        started = time.monotonic()
+        command = _telemetry_command(args)
+        success = True
+        try:
+            return _orig_cmd_main(args=args, **kwargs)
+        except BaseException:
+            success = False
+            raise
+        finally:
+            try:
+                from sourcecode import telemetry as _tel
+                _tel.record(
+                    "execution_completed",
+                    cmd=("mcp" if command == "mcp" else "telemetry" if command == "telemetry" else "analyze"),
+                    command=command,
+                    flags=_telemetry_flags(args),
+                    duration_s=time.monotonic() - started,
+                    success=success,
+                )
+            except Exception:
+                pass
 
     cmd.main = _cmd_main
     return cmd
@@ -3055,7 +3139,7 @@ try:
 except Exception:
     pass
 
-telemetry_app = typer.Typer(help="Manage anonymous telemetry (off by default; opt-in).", rich_markup_mode="rich")
+telemetry_app = typer.Typer(help="Manage anonymous telemetry (on by default; disable any time).", rich_markup_mode="rich")
 app.add_typer(telemetry_app, name="telemetry")
 
 mcp_app = typer.Typer(help="MCP integration: setup, status, serve, remove.", rich_markup_mode="rich")
@@ -3083,9 +3167,8 @@ app.add_typer(retrieve_app, name="retrieve")
 def _maybe_show_telemetry_notice() -> None:
     """Show first-run telemetry notice once, on interactive TTYs only.
 
-    Telemetry is off by default (opt-in). The notice is an invitation, not a
-    disclosure: nothing has been collected when it appears. Marked as shown so it
-    appears only once.
+    Telemetry is on by default. The notice is a one-time disclosure of what is
+    collected and how to disable it.
     """
     try:
         from sourcecode.telemetry.config import has_been_asked, mark_asked
@@ -5041,7 +5124,9 @@ def main(
         sm.key_dependencies = _deduped_deps  # no cap — all direct deps included
 
     # LQN-02: deterministic NL summary
-    sm.project_summary = ProjectSummarizer(target).generate(sm)
+    _summarizer = ProjectSummarizer(target)
+    sm.project_summary = _summarizer.generate(sm)
+    sm.summary_basis = _summarizer.summary_basis
     sm.architecture_summary = ArchitectureSummarizer(target).generate(sm)
 
     # Phase 13 Plan 04: Architectural Inference (--architecture flag)
@@ -5314,26 +5399,7 @@ def main(
     perf.stop("serialize", _perf_serialize)
     perf.flush_recorder()
 
-    # 5. Telemetry (fire-and-forget, never blocks)
-    try:
-        from sourcecode import telemetry as _tel
-        _tel.record(
-            "execution_completed",
-            cmd="analyze",
-            flags=_active_flags(
-                dependencies, graph_modules, docs, full_metrics,
-                semantics, architecture, git_context, env_map,
-                code_notes, agent, compact, tree, no_redact, format,
-            ),
-            output_fmt=format,
-            file_count=len(sm.file_paths),
-            duration_s=time.monotonic() - _t0,
-            success=True,
-        )
-    except Exception:
-        pass
-
-    # 6. Write output (CLI-04)
+    # 5. Write output (CLI-04)
     _progress.finish()
     if format == "json":
         _uncommitted_fresh, _uncommitted_fresh_basis = _uncommitted_fact(
@@ -5926,17 +5992,6 @@ def prepare_context_cmd(
                 except Exception:
                     pass  # not JSON (or unreadable) → serve exactly what was stored
                 _emit_command_output(_cached_pctx, output_path, copy)
-                try:
-                    from sourcecode import telemetry as _tel
-                    _tel.record(
-                        "execution_completed",
-                        cmd="prepare-context",
-                        feature=task,
-                        output_fmt=format,
-                        duration_s=0.0,
-                    )
-                except Exception:
-                    pass
                 return
 
     _scope_files = None
@@ -6463,18 +6518,6 @@ def prepare_context_cmd(
         fmt=("yaml" if format == "yaml" else "json")
     )
 
-    try:
-        from sourcecode import telemetry as _tel
-        _tel.record(
-            "execution_completed",
-            cmd="prepare-context",
-            feature=task,
-            output_fmt=format,
-            duration_s=_time.perf_counter() - _t0,
-        )
-    except Exception:
-        pass
-
     from sourcecode.mcp_nudge import nudge_mcp_if_needed as _nudge
     _nudge()
 
@@ -6491,11 +6534,11 @@ def telemetry_status(
     enabled = is_enabled()
     choice = stored_choice()
     status = "enabled" if enabled else "disabled"
-    lines = [f"Telemetry: {status} (off by default; opt-in)"]
-    # "off because you said so" and "off because nobody asked you" are different
-    # answers, and a buyer auditing this needs to be told which one they have.
+    lines = [f"Telemetry: {status} (on by default; disable with `ask telemetry disable`)"]
+    # The default and an explicit disabled choice are different answers, and a
+    # buyer auditing this needs to be told which one they have.
     if choice is None:
-        lines.append("  No choice recorded — nothing has been collected or sent.")
+        lines.append("  No choice recorded — the on-by-default setting applies.")
     else:
         lines.append(f"  Your recorded choice: {'enabled' if choice else 'disabled'}.")
     lines.append(f"  Config: {config_file_path()}")
@@ -6508,7 +6551,7 @@ def telemetry_status(
 
 @telemetry_app.command("enable")
 def telemetry_enable() -> None:
-    """Opt in to anonymous telemetry."""
+    """Enable anonymous telemetry and remember the choice."""
     from sourcecode.telemetry.config import set_enabled
     from sourcecode import telemetry as _tel
     set_enabled(True)
@@ -6521,11 +6564,11 @@ def telemetry_enable() -> None:
 
 @telemetry_app.command("disable")
 def telemetry_disable() -> None:
-    """Opt out of anonymous telemetry."""
+    """Disable anonymous telemetry and remember the choice."""
     from sourcecode.telemetry.config import set_enabled
     set_enabled(False)
     typer.echo("Telemetry disabled. No data will be collected or sent.")
-    typer.echo("Telemetry is off by default; this choice is recorded so the notice stops asking.")
+    typer.echo("Telemetry is enabled by default; this choice is recorded so the notice stops appearing.")
     typer.echo("Re-enable at any time: ask telemetry enable")
 
 
@@ -6590,11 +6633,13 @@ def repo_ir_cmd(
         None,
         "--max-nodes",
         help="Limit graph.nodes to top N by impact score (reduces output size)",
+        min=0,
     ),
     max_edges: Optional[int] = typer.Option(
         None,
         "--max-edges",
         help="Limit graph.edges to N (priority: edges between kept nodes)",
+        min=0,
     ),
     summary_only: bool = typer.Option(
         False,
@@ -7185,6 +7230,7 @@ def endpoints_cmd(
     limit: Optional[int] = typer.Option(
         None, "--limit", "-n",
         help="Maximum number of endpoints to return.",
+        min=0,
     ),
     compact: bool = typer.Option(
         False, "--compact",
@@ -7943,6 +7989,7 @@ def validation_cmd(
         None, "--limit",
         help="Keep at most N rows per list (endpoints, gaps, validators); the "
              "summary stays whole and each cut list declares what it omitted.",
+        min=0,
     ),
     compact: bool = typer.Option(
         False, "--compact",
@@ -10627,7 +10674,7 @@ def risk_cmd(
         help="Repository path (default: current directory).",
     ),
     limit: int = typer.Option(
-        50, "--limit", help="How many composed risks to publish (highest first)."
+        50, "--limit", help="How many composed risks to publish (highest first).", min=0,
     ),
     table: bool = typer.Option(
         False,
@@ -10838,7 +10885,7 @@ def enrich_cmd(
         ),
     ),
     limit: int = typer.Option(
-        50, "--limit", help="How many enriched findings to publish (highest first)."
+        50, "--limit", help="How many enriched findings to publish (highest first).", min=0,
     ),
     table: bool = typer.Option(
         False,
@@ -11498,6 +11545,7 @@ def posture_cmd(
         "--limit",
         help="Keep at most N beans per list (active/inactive/unresolved); the "
              "counts stay whole and each cut list declares what it omitted.",
+        min=0,
     ),
     compact: bool = typer.Option(
         False,
@@ -11985,6 +12033,8 @@ def migrate_check_cmd(
     depth: int = typer.Option(
         4, "--depth",
         help="Caller BFS depth for --blast-radius (1-8, default: 4).",
+        min=1,
+        max=8,
     ),
     detach: bool = _detach_option(),
     progress_mode: Optional[str] = _progress_option(),
@@ -12310,6 +12360,7 @@ def impact_chain_cmd(
         help="Maximum items per list section (callers, endpoints, security "
              "surfaces). Totals stay exact in metadata/truncated_lists. "
              "0 disables the cap.",
+        min=0,
     ),
     with_findings: bool = typer.Option(
         False, "--with-findings",
@@ -12633,7 +12684,8 @@ def explain_cmd(
     limit: int = typer.Option(
         50, "--limit",
         help="Maximum items per list section (callers, methods, deps). "
-             "0 disables the cap. Truncation is always reported in warnings.",
+        "0 disables the cap. Truncation is always reported in warnings.",
+        min=0,
     ),
     copy: bool = _copy_option(),
     progress_mode: Optional[str] = _progress_option(),
@@ -13499,10 +13551,12 @@ def chunk_file_cmd(
     max_lines: int = typer.Option(
         500, "--max-lines", "-n",
         help="Target max lines per chunk (default: 500). Methods > max_lines emit size_warning.",
+        min=1,
     ),
     chunk_id: Optional[int] = typer.Option(
         None, "--chunk", "-c",
         help="Return only this chunk by ID (1-based). Omit to return all chunks.",
+        min=1,
     ),
     metadata_only: bool = typer.Option(
         False, "--metadata-only",
@@ -14190,7 +14244,7 @@ def config_cmd(
     _answer = _TextAnswer(output_path)
     _answer.say(f"ask {__version__}")
     _answer.say(f"Config:    {config_file_path()}")
-    _answer.say(f"Telemetry: {'enabled' if is_enabled() else 'disabled'} (off by default; opt-in)")
+    _answer.say(f"Telemetry: {'enabled' if is_enabled() else 'disabled'} (on by default; disable with `ask telemetry disable`)")
     _answer.say("")
 
     # F-AX: the declaration may sit outside the analysed tree, and *which* file
@@ -16473,7 +16527,7 @@ def main_entry() -> None:
             INVALID_INPUT_CODE,
             str(_refused),
             hint=(
-                "The run was asked to create something inside the repository while "
+                "The run was asked to modify something inside the repository while "
                 "--no-write (ASK_READONLY=1) was in force. Drop the flag that "
                 "persists — or point its directory option outside the repository — "
                 "and the same answer is produced with the artefact."

sourcecode/compare.py

@@ -40,7 +40,7 @@ COMPARE_SCHEMA: str = "candidate-comparison-v1"
 _COST_FIELDS: tuple[str, ...] = (
     "blast_radius", "affected_endpoints", "modules_spanned",
     "secured_endpoints", "transactional_boundaries", "tests_at_risk",
-    "rollback_files",
+    "rollback_files", "container_wired_components",
 )
 
 # Resolutions on which D3's build_change_plan returns a bare resolution notice
@@ -108,6 +108,7 @@ def _cost_vector(plan: dict, blast: dict) -> dict[str, int]:
         "modules_spanned": modules,
         "secured_endpoints": secured,
         "transactional_boundaries": txn,
+        "container_wired_components": len(plan.get("container_wired") or []),
     }
 
 
@@ -151,6 +152,7 @@ def _rank_key(cand: dict) -> tuple:
         -c["transactional_boundaries"],
         -c["tests_at_risk"],
         -c["rollback_files"],
+        -c["container_wired_components"],
         cand["target"],
     )
 
@@ -299,6 +301,10 @@ def build_comparison(
             ),
             "tests_at_risk": "covering test symbols that reach the change",
             "rollback_files": "files the change would touch on revert",
+            "container_wired_components": (
+                "components reached by declared framework/container wiring; this is "
+                "separate from reverse-call fan-in"
+            ),
         },
         "candidates": candidates,
         "provenance": (

sourcecode/execution_plan.py

@@ -145,6 +145,25 @@ class Scope:
         )
         return f"at least {count} Java files{cap}, {state}"
 
+    def describe_for_budget(self) -> str:
+        """Describe scope without turning partial cache evidence into "warm".
+
+        The fast scope probe intentionally checks only the per-repository
+        snapshot/RIS store; probing the exact shared CIR and parse entries would
+        require the same analysed file set and cache key as the command about to
+        run. Budget advice therefore names what it did inspect and leaves the
+        other two layers undecided. The command payload publishes their actual
+        post-lookup state as ``cache_layers``.
+        """
+        if self.java_files is None:
+            return self.describe()
+        prefix = self.describe().rsplit(", ", 1)[0]
+        snapshot_ris = "present" if self.warm else "absent"
+        return (
+            f"{prefix}, cache layers: snapshot/RIS {snapshot_ris}; "
+            "context/parse unknown before analysis"
+        )
+
 
 def count_java_files(root: Path, *, cap: int = _SCAN_ENTRY_CAP) -> "tuple[Optional[int], bool]":
     """(count, exact) for the Java files under *root*. Never raises.

sourcecode/mcp/runner.py

@@ -7,11 +7,15 @@ lookup, no process fork, no stdout encoding issues.
 from __future__ import annotations
 
 import json
+import threading
 from typing import Any
 
 from typer.testing import CliRunner
 
 _runner = CliRunner()
+# CliRunner temporarily replaces process-global stdout/stderr.  MCP dispatches
+# tools concurrently, so every in-process invocation must share this lock.
+_runner_lock = threading.RLock()
 
 
 class CommandError(RuntimeError):
@@ -44,7 +48,8 @@ def run_command(args: list[str]) -> Any:
     # Pass raw args to invoke — the _cmd_main hook inside cli.py handles path
     # extraction via _preprocess_args. Pre-processing here would strip the path
     # from args, then _cmd_main would re-process the stripped list and lose it.
-    result = _runner.invoke(app, list(args))
+    with _runner_lock:
+        result = _runner.invoke(app, list(args))
 
     if result.exit_code != 0:
         stdout_raw = getattr(result, "output", "")