sourcecode 5.8.13__py3-none-any.whl → 5.8.14__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.13"
+__version__ = "5.8.14"

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,24 +16,49 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-20, release `5.8.13` and the external `5.8.11` re-audit:** this is the current status of
-the 5.8.8/5.8.9 audit queue. The subject remained `saint-server` at `3dde0376`, with a
-byte-identical CIR and the same 53/61 invocables exercised. The score is **78/100**
-(75 in 5.8.8, 80 in 5.8.9). The observations below remain historical evidence; only
-this table declares present state.
+**As of 2026-08-20, release `5.8.14` and the fourth external re-audit:** the audited
+snapshot remains `3dde0376`; the report compares the four audit rounds and scores this one
+**90/100** (75, 80, 78, 90). It exercised 53/61 invocables (87%), ran no application and
+left the repository unchanged. Its 40+ longitudinal functional anchors are unchanged, so
+there is no reported product regression. The `5.8.14` release ships the implementations
+recorded below; they remain distinguished from facts verified on the `5.8.13` subject.
+Only this table declares present state.
+
+**Release status:** entries marked “pending `5.8.14`” in their historical wording are
+shipped in `5.8.14`; a re-audit is still required wherever the row says so.
 
 | Rows | Current status | Evidence |
 |---|---|---|
-| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **implemented in 5.8.12** | `9884488` requires `risk` and `audit-report` to deliver stdout or their requested artifact before exit 0; the remaining closure evidence is a field-scale subprocess reproduction. |
+| `AUD-588-B01` / `AUD-589-B01`, `C3-122` | **open, P0 for `risk`; `audit-report` corrected** | `9884488` corrected `audit-report` to refuse with typed `OUTPUT_TOO_LARGE` and produce its requested artifact. `risk` nevertheless exited 0 twice on the first shared-cache invocations with 0 bytes and no `-o` file, then succeeded seven times. `5cfa9ba` now publishes the source, audit-finding, candidate-defect and composed-defect working set, including partial answers. Repeat the real entry-point protocol before closure. |
 | `AUD-511-R01` / `AUD-588-B03` | **implemented in 5.8.12** | `13362ec` makes SEC-009 read comment-blanked Java, so a Javadoc profile cannot override the live `@Profile("!m3")` declaration. |
 | `AUD-588-B04` | **retracted audit premise** | `data-exposure` correctly preserves `chain_decision`; the reported `coverage_unknown` routes were custom-gate annotations whose application was not configured. `fd34eb1` remains a valid additive disclosure, but no further B04 fix is due. |
 | `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
-| `AUD-511-R03` / `AUD-588-B07` | **implemented in 5.8.12** | `47aee1e` gives the published `OUTPUT_TOO_LARGE` envelope precedence over an inconsistent process status and preserves the excerpt in every branch. |
+| `AUD-511-R03` / `AUD-588-B07` | **implemented, pending 5.8.14 re-audit** | `f613df9` makes ASK-09 parse the typed document from stdout or stderr, including a progress-prefixed stderr stream, and removes the four inherited variables that change its precondition. The regression exercises the real typed refusal shape. The prior claim that the payload premise was false remains retracted as an environment-contamination artifact. |
 | `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
 | `MCP-001` | **closed 5.8.13** | Deep corpus testing reproduced concurrent `CliRunner` stream capture leaking a tool response to the host stdout. `b2c9660` serializes the narrow process-global capture seam; concurrent real MCP calls and a regression test verify response isolation. |
-| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.12** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `impact` naming, source population units, risk tiers and plan narrative remain open. |
-| `AUD-511-R02` / `AUD-589-B02` | **partially mitigated in 5.8.12, still under investigation** | `b93f230` reuses one `SpringSemanticModel` across every declared `data-exposure` seed; `473f47a` routes `validation` through the shared CIR cache, and `91bd0c0` retains subcommand `--no-cache` compatibility. On the local BroadleafCommerce corpus at the final analyzer fingerprint, a first shared-CIR fill took 10.46 s and its warm `validation --compact` hit took 4.01 s with byte-identical output. This is a same-host cache-state observation, not the 5.8.9/5.8.11 external A/B: the six-run C3-120 comparison and the configured `saint-server` reproduction remain required. |
-| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **partially open in 5.8.12** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. B11 parity and controlled cost calibration remain required. |
+| `AUD-513-N01` (`N-1`) | **closed in 5.8.14** | `rename-class` rewrote three Petclinic files under both `ASK_READONLY=1` and `--no-write`, then exited 0. The audit restored the tree; this is a write-policy breach, not an artifact-directory exception. `readonly.guard_mutation()` now refuses before any planned source write or physical rename; help names the command as mutating and regressions cover both readonly controls plus `--dry-run`. |
+| `AUD-513-N02` / `B-4` / `N-5` | **N02/B-4 implemented in 5.8.14; N-5 open** | `posture.summary.unconditional` counted 1,697 on a non-Spring Struts tree and 1,573 on Mall, and `security` was `0/0/0` with no population. The posture projection now uses the canonical Spring IoC bean population, publishes its population/unit and separates unconditional security beans. Regressions cover non-Spring, mixed-bean and conditional/unconditional security fixtures. Progress/advice still use incompatible “Java files” scopes (`N-5`), so the `AUD-588-F02` family remains open. |
+| `AUD-513-B01` / `B-3` / `B-5` | **B01/B-5 implemented in 5.8.14; B-3 closed as revalidated** | A MyBatis XML paired with a `*Mapper.java` interface now takes precedence over an absent `@Mapper` annotation, preserving XML-backed/`@MapperScan` interfaces in `mapper_interfaces` rather than misclassifying them as DTO mappers. `imports_found` now contains only actual Java imports; code, XML and build matches are emitted as `evidence`, including in compact output. `B-3` was stale against the current source: both views consume `JAVA_SPRING_SECTIONS`; a real MyBatis Mapper/XML regression proves the section is retained by `--agent`. |
+| `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, `D-09` | **N03/N04/N07/N08/N09 implemented in 5.8.14; remainder open** | `impact` now always publishes the `candidates` field its not-found message names, including `[]` when no close symbol exists. Budget advice no longer calls partial snapshot/RIS evidence a warm cache: it identifies that presence and says context/parse are unknown before analysis, whose payload then reports all four actual layers. README operational sections (`clone`, install, build, getting started, troubleshooting and related headings) are never promoted into a project summary; with no descriptive prose compact output publishes `project_summary: null` and `summary_basis`. `security_posture.limitations` is now cache-state invariant; dynamic execution advice travels in `security_posture.operational_hints`. Every numeric output bound rejects negative values at parse time with a structured `INVALID_INPUT` envelope (`flag`, `value`, `expected`); `--limit 0` still means no cap wherever that behavior was published. Budgets overrun, timing coverage is inconsistent, compact hides unresolved identities and cost anchors remain stale. |
+| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.14** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `e53507d` separates direct impact matches from analysis seeds and implementation classes; `8386744` carries the established container-wiring fact into plan checklists and compare cost dimensions. Source population units and risk-tier wording remain open. |
+| `AUD-511-R02` / `AUD-589-B02` / `AUD-513-N06` | **partially corrected; `data-exposure` open, P1** | Nine of ten measured commands recovered, many to their best historical timings. `data-exposure --config` did not: 42.7 s versus 16.2 s in 5.8.8 and a 28.9 s model, with byte-equivalent output. Measure it with the idle-host, isolated-cache, interleaved-control protocol before changing code, then compare its reuse path with `validation`. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **B02/B06 closed; B11/B12 open, P2** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. The re-audit verifies both and the payload reduction; `cf57457` makes aggregate wording name only applicable dimensions. Complete B11 consumer parity and calibrate B12 only from provenance-bearing controlled samples. |
+
+### Fourth Re-audit: 5.8.13
+
+The fourth pass verifies the current facts that supersede the prior intake. There is no
+crash/traceback and no regression in the published anchors. `B-2/D-05` remains a retracted
+servlet premise, and the audit additionally verifies EclipseLink applicability/non-coverage,
+typed `audit-report` refusal, nested Maven discovery and the `unaffected_basis` correction.
+It leaves the following concrete queue rather than reopening closed facts.
+
+| Recommendation | Status and direction |
+|---|---|
+| `AUD-588-F02` shared answer contracts | **Partial.** Reuse the existing authorities for exact target versus implementation cone, named source populations and container reach in plan/compare; do not add a parallel detector. |
+| `AUD-588-F03` versioned cost calibration | **Open.** Capture repository, cache state, sample count and host provenance. The immediately actionable measurement is `data-exposure --config`; clean data is required before recalibration. |
+| Risk cache observability | **Recommended hardening.** Publish working-set unit counts under progress or in the envelope to distinguish an empty compositor from a present-but-incomplete cache. |
+| `AUD-588-F05` coverage expansion | **Locally verified only.** Dirty-tree `verify-edit` and the eight mutating/denied invocables remain unexercised in all four external rounds. |
+| EclipseLink migration automation | **Deferred product feature.** The current applicability and non-coverage facts are verified; provider-specific migration automation is not a corrective fix. |
 
 ### Re-audit Intake: 5.8.11
 

sourcecode/_docs/USER_GUIDE.md

@@ -138,7 +138,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.13
+# ask 5.8.14
 ```
 
 Requires Python 3.9+.

sourcecode/change_plan.py

@@ -139,7 +139,9 @@ def build_change_plan(
             ),
         }
 
-    seeds = list(blast["matched_fqns"])
+    # The user-facing match names the requested target; planning must retain the
+    # subtype-expanded seeds that the blast-radius authority actually analysed.
+    seeds = list(blast.get("analysis_seed_fqns") or blast["matched_fqns"])
     container_wired = [w.to_dict() for w in detect_classes(cir, seeds)]
     meta = _node_meta(cir)
     affected = _dependents_closure(cir.reverse_graph or {}, seeds, max_depth, _NODE_CAP)
@@ -210,6 +212,11 @@ def build_change_plan(
         checklist.append(
             f"{len(sec)} secured endpoint(s) in scope — re-check authorization."
         )
+    if container_wired:
+        checklist.append(
+            f"{len(container_wired)} container-wired component(s) are in scope — "
+            "review their declared framework wiring because fan-in does not measure it."
+        )
     txn = blast.get("transactional_boundaries_touched") or []
     if txn:
         checklist.append(f"{len(txn)} transactional boundary/boundaries in scope.")

sourcecode/cli.py

@@ -6,6 +6,7 @@ import hashlib
 import json
 import difflib
 import os
+import re
 import sys
 import tempfile
 import threading
@@ -287,6 +288,7 @@ COMMANDS_THAT_WRITE: "tuple[tuple[str, str], ...]" = (
     ("migrate-check", "`<repo>/.ask/readiness-history/` — only with `--history`"),
     ("verify", "`<repo>/.ask/contracts-baseline.json` — only with `--update-baseline`"),
     ("verify-edit", "the repository's git hooks directory — only with `--install-hook`"),
+    ("rename-class", "`<repo>/**/*.java` — only without `--dry-run`; existing sources change and the declaring file is renamed"),
     ("*", "`<repo>/.ask/runs/` — only when `ASK_RUNS_IN_REPO=1` is set"),
 )
 
@@ -294,7 +296,7 @@ COMMANDS_THAT_WRITE: "tuple[tuple[str, str], ...]" = (
 def _writes_help_block() -> str:
     """The `--no-write` table as `--help` prints it — generated, never typed."""
     lines = [
-        "Commands that create files inside the repository (everything else reads only):",
+        "Commands that modify files inside the repository (everything else reads only):",
         "",
     ]
     width = max(len(name) for name, _ in COMMANDS_THAT_WRITE)
@@ -1625,7 +1627,10 @@ def _budget_evidence(command: str, path: "Optional[Path]") -> "tuple[Optional[st
         if path is not None:
             measured = _plan.scope_for(Path(path))
             if measured is not None and measured.measured:
-                scope = measured.describe()
+                # The scope probe can cheaply see only the snapshot/RIS store.
+                # Do not turn that partial observation into "cache warm" while
+                # a command's actual context/parse state is still unknown.
+                scope = measured.describe_for_budget()
     except Exception:
         pass  # a message about cost must never be the reason a run fails
     return anchors, scope
@@ -2325,6 +2330,32 @@ def _root_flag_usage(flag: str) -> str:
         return f"`ask {flag} <path>`"
 
 
+def _numeric_range_error_context(message: str) -> dict[str, object]:
+    """Extract structured facts from Click's lower-bound validation message.
+
+    Click owns parser-time validation, so commands never start work for an
+    invalid value. Its stock message contains the useful facts but leaves
+    automation to parse prose; expose those facts in the shared error envelope.
+    """
+    prefix, separator, remainder = message.partition(": ")
+    if not separator or not prefix.startswith("Invalid value for "):
+        return {}
+    minimum = re.search(
+        r"is not in (?:the )?range (?:x>=(\d+)|(\d+)<=x(?:<=\d+)?)",
+        remainder,
+    )
+    value = re.match(r"(-?\d+)\s+is not in", remainder)
+    flags = re.findall(r"'(--[^']+)'", prefix)
+    if minimum is None or value is None or not flags:
+        return {}
+    lower_bound = minimum.group(1) or minimum.group(2)
+    return {
+        "flag": flags[0],
+        "value": int(value.group(1)),
+        "expected": f"an integer >= {lower_bound}",
+    }
+
+
 try:
     import click.exceptions as _click_exc
 
@@ -2386,7 +2417,11 @@ try:
 
     def _json_click_usage_error_show(self: Any, file: Any = None) -> None:  # type: ignore[override]
         import json as _je
+        _message = self.format_message()
+        _numeric_context = _numeric_range_error_context(_message)
         _flag, _hint = _misplaced_global_flag_hint(self)
+        if _numeric_context:
+            _flag = str(_numeric_context["flag"])
         if not _hint:
             _nearby = _nearby_command_flag_hint(self)
             if _nearby:
@@ -2396,10 +2431,13 @@ try:
             _context["flag"] = _flag
         if _hint:
             _context["scope"] = "root"
+        if _numeric_context:
+            _context["value"] = _numeric_context["value"]
         payload = build_error_envelope(
             INVALID_INPUT_CODE,
-            self.format_message(),
+            _message,
             hint=_hint,
+            expected=(str(_numeric_context["expected"]) if _numeric_context else None),
             **_context,
         )
         sys.stderr.write(_je.dumps(payload, ensure_ascii=_json_ensure_ascii()) + "\n")
@@ -5086,7 +5124,9 @@ def main(
         sm.key_dependencies = _deduped_deps  # no cap — all direct deps included
 
     # LQN-02: deterministic NL summary
-    sm.project_summary = ProjectSummarizer(target).generate(sm)
+    _summarizer = ProjectSummarizer(target)
+    sm.project_summary = _summarizer.generate(sm)
+    sm.summary_basis = _summarizer.summary_basis
     sm.architecture_summary = ArchitectureSummarizer(target).generate(sm)
 
     # Phase 13 Plan 04: Architectural Inference (--architecture flag)
@@ -6593,11 +6633,13 @@ def repo_ir_cmd(
         None,
         "--max-nodes",
         help="Limit graph.nodes to top N by impact score (reduces output size)",
+        min=0,
     ),
     max_edges: Optional[int] = typer.Option(
         None,
         "--max-edges",
         help="Limit graph.edges to N (priority: edges between kept nodes)",
+        min=0,
     ),
     summary_only: bool = typer.Option(
         False,
@@ -7188,6 +7230,7 @@ def endpoints_cmd(
     limit: Optional[int] = typer.Option(
         None, "--limit", "-n",
         help="Maximum number of endpoints to return.",
+        min=0,
     ),
     compact: bool = typer.Option(
         False, "--compact",
@@ -7946,6 +7989,7 @@ def validation_cmd(
         None, "--limit",
         help="Keep at most N rows per list (endpoints, gaps, validators); the "
              "summary stays whole and each cut list declares what it omitted.",
+        min=0,
     ),
     compact: bool = typer.Option(
         False, "--compact",
@@ -10630,7 +10674,7 @@ def risk_cmd(
         help="Repository path (default: current directory).",
     ),
     limit: int = typer.Option(
-        50, "--limit", help="How many composed risks to publish (highest first)."
+        50, "--limit", help="How many composed risks to publish (highest first).", min=0,
     ),
     table: bool = typer.Option(
         False,
@@ -10841,7 +10885,7 @@ def enrich_cmd(
         ),
     ),
     limit: int = typer.Option(
-        50, "--limit", help="How many enriched findings to publish (highest first)."
+        50, "--limit", help="How many enriched findings to publish (highest first).", min=0,
     ),
     table: bool = typer.Option(
         False,
@@ -11501,6 +11545,7 @@ def posture_cmd(
         "--limit",
         help="Keep at most N beans per list (active/inactive/unresolved); the "
              "counts stay whole and each cut list declares what it omitted.",
+        min=0,
     ),
     compact: bool = typer.Option(
         False,
@@ -11988,6 +12033,8 @@ def migrate_check_cmd(
     depth: int = typer.Option(
         4, "--depth",
         help="Caller BFS depth for --blast-radius (1-8, default: 4).",
+        min=1,
+        max=8,
     ),
     detach: bool = _detach_option(),
     progress_mode: Optional[str] = _progress_option(),
@@ -12313,6 +12360,7 @@ def impact_chain_cmd(
         help="Maximum items per list section (callers, endpoints, security "
              "surfaces). Totals stay exact in metadata/truncated_lists. "
              "0 disables the cap.",
+        min=0,
     ),
     with_findings: bool = typer.Option(
         False, "--with-findings",
@@ -12636,7 +12684,8 @@ def explain_cmd(
     limit: int = typer.Option(
         50, "--limit",
         help="Maximum items per list section (callers, methods, deps). "
-             "0 disables the cap. Truncation is always reported in warnings.",
+        "0 disables the cap. Truncation is always reported in warnings.",
+        min=0,
     ),
     copy: bool = _copy_option(),
     progress_mode: Optional[str] = _progress_option(),
@@ -13502,10 +13551,12 @@ def chunk_file_cmd(
     max_lines: int = typer.Option(
         500, "--max-lines", "-n",
         help="Target max lines per chunk (default: 500). Methods > max_lines emit size_warning.",
+        min=1,
     ),
     chunk_id: Optional[int] = typer.Option(
         None, "--chunk", "-c",
         help="Return only this chunk by ID (1-based). Omit to return all chunks.",
+        min=1,
     ),
     metadata_only: bool = typer.Option(
         False, "--metadata-only",
@@ -16476,7 +16527,7 @@ def main_entry() -> None:
             INVALID_INPUT_CODE,
             str(_refused),
             hint=(
-                "The run was asked to create something inside the repository while "
+                "The run was asked to modify something inside the repository while "
                 "--no-write (ASK_READONLY=1) was in force. Drop the flag that "
                 "persists — or point its directory option outside the repository — "
                 "and the same answer is produced with the artefact."

sourcecode/compare.py

@@ -40,7 +40,7 @@ COMPARE_SCHEMA: str = "candidate-comparison-v1"
 _COST_FIELDS: tuple[str, ...] = (
     "blast_radius", "affected_endpoints", "modules_spanned",
     "secured_endpoints", "transactional_boundaries", "tests_at_risk",
-    "rollback_files",
+    "rollback_files", "container_wired_components",
 )
 
 # Resolutions on which D3's build_change_plan returns a bare resolution notice
@@ -108,6 +108,7 @@ def _cost_vector(plan: dict, blast: dict) -> dict[str, int]:
         "modules_spanned": modules,
         "secured_endpoints": secured,
         "transactional_boundaries": txn,
+        "container_wired_components": len(plan.get("container_wired") or []),
     }
 
 
@@ -151,6 +152,7 @@ def _rank_key(cand: dict) -> tuple:
         -c["transactional_boundaries"],
         -c["tests_at_risk"],
         -c["rollback_files"],
+        -c["container_wired_components"],
         cand["target"],
     )
 
@@ -299,6 +301,10 @@ def build_comparison(
             ),
             "tests_at_risk": "covering test symbols that reach the change",
             "rollback_files": "files the change would touch on revert",
+            "container_wired_components": (
+                "components reached by declared framework/container wiring; this is "
+                "separate from reverse-call fan-in"
+            ),
         },
         "candidates": candidates,
         "provenance": (

sourcecode/execution_plan.py

@@ -145,6 +145,25 @@ class Scope:
         )
         return f"at least {count} Java files{cap}, {state}"
 
+    def describe_for_budget(self) -> str:
+        """Describe scope without turning partial cache evidence into "warm".
+
+        The fast scope probe intentionally checks only the per-repository
+        snapshot/RIS store; probing the exact shared CIR and parse entries would
+        require the same analysed file set and cache key as the command about to
+        run. Budget advice therefore names what it did inspect and leaves the
+        other two layers undecided. The command payload publishes their actual
+        post-lookup state as ``cache_layers``.
+        """
+        if self.java_files is None:
+            return self.describe()
+        prefix = self.describe().rsplit(", ", 1)[0]
+        snapshot_ris = "present" if self.warm else "absent"
+        return (
+            f"{prefix}, cache layers: snapshot/RIS {snapshot_ris}; "
+            "context/parse unknown before analysis"
+        )
+
 
 def count_java_files(root: Path, *, cap: int = _SCAN_ENTRY_CAP) -> "tuple[Optional[int], bool]":
     """(count, exact) for the Java files under *root*. Never raises.

sourcecode/migrate_check.py

@@ -1363,7 +1363,7 @@ def _scan_xml_file(text: str, rel_path: str) -> list["MigrationFinding"]:
                 title=rule.title,
                 source_file=rel_path,
                 first_line=first_line,
-                imports_found=snippets,
+                evidence=snippets,
                 explanation=explanation,
                 fix_hint=rule.fix_hint,
                 migration_target=rule.migration_target,
@@ -1557,7 +1557,7 @@ def _scan_dep_file(text: str, rel_path: str) -> list["MigrationFinding"]:
                 title=rule.title,
                 source_file=rel_path,
                 first_line=first_line,
-                imports_found=[m.group(0)[:120].strip()],
+                evidence=[m.group(0)[:120].strip()],
                 explanation=rule.explanation,
                 fix_hint=rule.fix_hint,
                 migration_target=rule.migration_target,
@@ -1580,6 +1580,11 @@ class MigrationFinding:
     source_file: str
     first_line: int
     imports_found: list[str] = field(default_factory=list)
+    # `imports_found` is an evidence field with a strict meaning: every entry is
+    # a Java import declaration. Code, XML and build-file matches travel here
+    # instead, so a consumer never has to verify a field named "imports" against
+    # a class declaration or arbitrary source snippet.
+    evidence: list[str] = field(default_factory=list)
     explanation: str = ""
     fix_hint: str = ""
     migration_target: str = ""
@@ -1620,6 +1625,8 @@ class MigrationFinding:
         }
         if self.imports_found:
             d["imports_found"] = self.imports_found
+        if self.evidence:
+            d["evidence"] = self.evidence
         if self.openrewrite_recipe:
             d["openrewrite_recipe"] = self.openrewrite_recipe
         else:
@@ -2049,13 +2056,14 @@ class MigrationReport:
         # javax.*, no Hibernate 5), readiness is N/A (None) — NOT a manufactured 100.
         # Absence of a migration target is "not applicable", never "100% ready".
         self.readiness_score = min(agg_inputs.values()) if agg_inputs else None
+        applicable_names = " / ".join(agg_inputs)
         self.readiness_aggregate = {
             "method": "min",
             "inputs": agg_inputs,
             "excluded": ["jdk_modernization"],
             "applicable": bool(agg_inputs),
             "note": ("readiness_score = min over applicable migration dimensions "
-                     "(jakarta / boot3 / hibernate). jdk_modernization is an orthogonal "
+                     f"({applicable_names}). jdk_modernization is an orthogonal "
                      "upkeep axis and is intentionally excluded."
                      if agg_inputs else
                      "N/A — no migration target detected (no migratable javax.*, no "
@@ -2357,8 +2365,8 @@ class MigrationReport:
             "readiness_aggregate": self.readiness_aggregate,
             "readiness_note": (
                 "readiness_score = min over applicable MIGRATION dimensions "
-                "(jakarta / boot3 / hibernate); see readiness_aggregate for the exact "
-                "inputs. N/A dimensions are excluded (never counted as 0); "
+                "listed in readiness_aggregate.inputs. N/A dimensions are excluded "
+                "(never counted as 0); "
                 "jdk_modernization is orthogonal upkeep and is NOT in the aggregate. "
                 "For decisions read the per-dimension breakdown + "
                 "migration_blocking_count."
@@ -2450,7 +2458,7 @@ class MigrationReport:
                 key: _finding[key]
                 for key in (
                     "id", "rule_id", "severity", "source_file", "first_line",
-                    "migration_target", "imports_found", "code_context",
+                    "migration_target", "imports_found", "evidence", "code_context",
                 ) if key in _finding
             })
         compact["rule_catalog"] = _rule_catalog
@@ -2782,7 +2790,8 @@ def _scan_file(
                 title=rule.title,
                 source_file=rel_path,
                 first_line=first_line,
-                imports_found=all_matches,
+                imports_found=matched_imports,
+                evidence=all_matches,
                 explanation=explanation,
                 fix_hint=rule.fix_hint,
                 migration_target=rule.migration_target,

sourcecode/posture.py

@@ -187,16 +187,34 @@ class BeanResolution:
     inactive: tuple[dict, ...] = ()
     unresolved: tuple[dict, ...] = ()
     unconditional_count: int = 0
+    bean_definitions: tuple[tuple[str, str], ...] = ()
 
     def to_dict(self) -> dict:
+        conditional_count = len(self.active) + len(self.inactive) + len(self.unresolved)
+        population_total = conditional_count + self.unconditional_count
         return {
             "profiles": list(self.profiles),
             "summary": {
-                "conditional_beans": len(self.active) + len(self.inactive) + len(self.unresolved),
+                "population": (
+                    "Spring IoC bean definitions in analysed source; plain Java types, "
+                    "JPA-only types, and annotations resolved outside Spring are excluded"
+                ),
+                "population_unit": "Spring IoC bean definitions",
+                "population_total": population_total,
+                "spring_container_detected": population_total > 0,
+                "conditional_beans": conditional_count,
+                "conditional_beans_unit": (
+                    "Spring IoC bean definitions with a registration condition "
+                    "resolved against the requested profile/property set"
+                ),
                 "active": len(self.active),
                 "inactive": len(self.inactive),
                 "unresolved": len(self.unresolved),
                 "unconditional": self.unconditional_count,
+                "unconditional_unit": (
+                    "Spring IoC bean definitions without a registration condition; "
+                    "they are not profile-resolved"
+                ),
             },
             "active": list(self.active),
             "inactive": list(self.inactive),
@@ -446,12 +464,14 @@ def resolve_beans(
 ) -> BeanResolution:
     """Resolve the conditional bean graph against an active profile set."""
     from sourcecode.security_posture import _graph_nodes
+    from sourcecode.spring_model import BeanGraph
     from sourcecode.spring_profiles import profile_conditional_beans
     from sourcecode.spring_properties import EffectiveProperties as _Effective
 
     active_profiles = set(profiles or set())
     resolved_properties = properties if properties is not None else _Effective()
     conditional = {b.symbol: b for b in profile_conditional_beans(cir)}
+    spring_beans = BeanGraph.build(cir).spring_beans()
 
     active: list[dict] = []
     inactive: list[dict] = []
@@ -463,14 +483,7 @@ def resolve_beans(
 
     for node in _nodes:
         fqn = str(node.get("fqn") or "")
-        if not fqn or "#" in fqn:
-            continue  # members follow their declaring type
-        # F-2: an annotation type is not a bean. `@interface FooCondition` carries
-        # `@Conditional(...)` because it DEFINES the condition — counting it as a
-        # conditionally-registered component made the census 77 where the compiler
-        # sees 76, and put the definition in `unresolved` beside the beans that use
-        # it. Spring registers components, not annotation declarations.
-        if str(node.get("symbol_kind") or "") == "annotation":
+        if fqn not in spring_beans:
             continue
         verdicts = _condition_verdicts(
             node, conditional.get(fqn), active_profiles, resolved_properties,
@@ -522,6 +535,9 @@ def resolve_beans(
         inactive=tuple(sorted(inactive, key=key)),
         unresolved=tuple(sorted(unresolved, key=key)),
         unconditional_count=unconditional,
+        bean_definitions=tuple(
+            sorted((fqn, bean.source_file) for fqn, bean in spring_beans.items())
+        ),
     )
 
 
@@ -711,12 +727,39 @@ def security_projection(cir: "CanonicalRepositoryIR", resolution: BeanResolution
     active = _slice(resolution.active)
     inactive = _slice(resolution.inactive)
     unresolved = _slice(resolution.unresolved)
+    conditional_symbols = {
+        entry["symbol"]
+        for entry in (*resolution.active, *resolution.inactive, *resolution.unresolved)
+    }
+    unconditional = [
+        {
+            "symbol": fqn,
+            "source_file": source_file,
+        }
+        for fqn, source_file in resolution.bean_definitions
+        if fqn not in conditional_symbols
+        and (node := by_fqn.get(fqn)) is not None
+        and _is_security_relevant(node, cir)
+    ]
+    unconditional.sort(key=lambda entry: entry["symbol"])
     return {
+        "population": (
+            "Spring IoC bean definitions that configure request security; "
+            "conditional entries are profile/property-resolved and unconditional "
+            "entries are reported separately"
+        ),
+        "population_unit": "Spring security bean definitions",
         "active": active,
         "inactive": inactive,
         "unresolved": unresolved,
+        "unconditional": unconditional,
         "summary": {
             "active": len(active), "inactive": len(inactive), "unresolved": len(unresolved),
+            "unconditional": len(unconditional),
+            "unconditional_unit": (
+                "Spring security bean definitions without a registration condition; "
+                "they are not profile-resolved"
+            ),
         },
     }