sourcecode 5.8.17__py3-none-any.whl → 5.8.18__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.17"
+__version__ = "5.8.18"

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,7 +16,30 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**Latest attached audits — release `5.8.16`, 2026-08-21, two independent rounds.**
+**Latest attached audits — release `5.8.18`, 2026-08-21, two independent rounds, and the
+first pass since 5.8.2 that opens with a regression.** Round A (`saint-server`/MSAS,
+3 342 Java files, 17 commands, 29 invocations, same HEAD as the previous round bit for
+bit) scores **8.77/10** — up from 8.21 — with **zero false statements about the
+repository for the second consecutive run**, 6 of 6 reported defects closed and verified
+from outside, and **five new contract defects, four of them the same class as the fix that
+preceded them**. Round B (a 12-repository bank, ~150 invocations, the §7 measurement
+protocol applied: idle host, interleaved, ×3, median, cache state declared per row) closes
+**8 of the 10 new rows and 2 of the 9 inherited ones**, records **zero content regressions
+and no performance row above the ×1.25 threshold**, and finds **two regressions, one of
+them a P0**: `compare` is dead in every valid invocation with an unhandled `NameError`,
+and `project_summary` publishes an Apache licence header as the description of the project
+on 3 of 8 repositories.
+
+**The two rounds agree on the shape of what is left, and it has moved again.** The
+previous pass ended with contracts that were *absent*; this one ends with contracts that
+*contradict each other across authorities*: two homonymous fields declaring the same unit
+and the same population and differing 16×, one budget published three times with three
+values, a help page denying a scope the fix beside it granted, and two ledger rows marked
+`closed` that do not reproduce as closed in the field. **A row marked closed that is not
+closed is worse than an open one — nobody looks at it again** — so those are carried at P1
+below rather than left in their original sections.
+
+**Previous attached audits — release `5.8.16`, 2026-08-21, two independent rounds.**
 Round A (`saint-server`, 3 342 Java files, 17 commands, 25 invocations) scores **8.21/10**
 with **zero false statements about the repository** and two contract defects. Round B (a
 16-repository bank, 49 to 24 073 Java files, **240 invocations, 0 crashes, 0 tracebacks**)
@@ -28,10 +51,11 @@ previously open defects by correction with **zero regressions among the inherite
 
 Both rounds agree on where the product now fails, and it is not the Java/Spring analysis:
 it is the contract an agent consumes programmatically — the write guard, repository
-identity, list units, flag scope, and published budgets. The seventh-pass section below is
-the only current queue; older rounds remain for traceability.
+identity, list units, flag scope, and published budgets. Its queue is closed in `5.8.17`;
+**the eighth-pass section below is the only current queue**, and older rounds remain for
+traceability.
 
-**Mechanisms confirmed in source during intake** (not taken on the reports' word):
+**Mechanisms confirmed in source during the seventh-pass intake** (not taken on the reports' word):
 `verify --init` writes with no `readonly.guard` (`cli.py:10706-10708`) while five sibling
 writers guard; `spring-audit` derives `repo_id` from the CIR content hash
 (`spring_security_audit.py:1416`, `spring_tx_analyzer.py:1081`) while every other surface
@@ -52,10 +76,13 @@ itself rather than merely under-declaring.
 **Release status:** entries marked “pending `5.8.14`” in their historical wording are
 shipped in `5.8.14`; the correction battery fixes listed above are included in `5.8.15`.
 
-**Current release:** `5.8.16` includes two post-audit corrections: compact cold-start
-identity is preserved for `no_ris`, and manifest-cache keys include Python requirements
-files. The testing-repository hygiene exercise changed no external repository; it
-completed 108/108 read-only workflow runs with valid JSON and exit code 0.
+**Current release:** `5.8.18` closes the whole eighth-pass queue, one commit per row, and
+includes the targeted release battery. `5.8.17` before it carried the seventh-pass queue;
+`5.8.16` before that carried two post-audit
+corrections: compact cold-start identity is preserved for `no_ris`, and manifest-cache keys
+include Python requirements files. The testing-repository hygiene exercise changed no
+external repository; it completed 108/108 read-only workflow runs with valid JSON and exit
+code 0.
 
 The battery also closed the following reproducible contract defects in `5.8.15`:
 `migrate-apply` is registered across help, progress, path-admission, output-purity,
@@ -73,6 +100,107 @@ with neither parseable stdout nor its requested artifact) or `BUG-6`
 queue position. `BUG-1` and `BUG-5` gain witnesses on public OSS repositories, recorded
 under their own rows rather than as new ones.
 
+### Eighth Audit Pass: `5.8.17` findings, closed in `5.8.18` / MSAS + 12-repository bank / 2026-08-21
+
+The current queue. Ordered as the correction order: **regressions first, then the rows a
+previous pass marked closed that the field does not reproduce as closed, then new contract
+defects, then residuals.** Canonical IDs are `AUD-592-*` (bank round, reporter IDs `A-*`,
+`B-*`, `N-*`, `D-*`) and `AUD-593-*` (MSAS round, reporter IDs `N-0*`). Rows held elsewhere
+in this ledger are listed after the table as mappings, not as new defects.
+
+| ID | Severity | Current status | Required direction |
+|---|---|---|---|
+| `AUD-592-R01` / `A-1` | **P0 — regression** | **open, confirmed in source, and it is two defects from one error.** `compare` raises `NameError: name '_compare_scan_trunc' is not defined` on **5 of 5 valid invocations** — Rich traceback on stderr, zero bytes on stdout, no error envelope, exit 1 — ending a 240-invocation streak with no traceback. The assignment introduced by `AUD-591-A06` landed **inside `plan_cmd`** (`cli.py:8874`, beside `plan`'s own `find_java_files` at `:8873`) while the read is in `compare_cmd` (`cli.py:8972`); the two functions are `8818-8901` and `8903-9002`. Verified by reading the source at HEAD, not from the report. Second effect: `plan` computes its truncation state and **discards it** — nothing in the payload carries it, so `plan` answers `resolution: not_found` over a walk that stopped at its cap, offering candidates from a different repository. Third effect: `compare`'s other `AUD-591-A06` fix, `data.setdefault("scope", ...)` at `cli.py:8975`, is **after the line that raises** and has never executed, so the cross-repository candidate leak is still undeclared. | Read `_last_scan_truncation()` at `compare`'s own call site, immediately after `cli.py:8965`; rename the `plan_cmd` variable to `_plan_scan_trunc` and **bind it to the payload** — an unused walk-state variable is the defect, not the fix. Regression: an AST assertion that no `_*_scan_trunc` name is read in a `FunctionDef` that does not assign it, plus one execution test per command that owns a walk. A unit test that imported `compare_cmd` would not have caught this; one that *calls* it would. |
+| `AUD-592-R02` / `N-4`, reopens `AUD-513-N04` | **P1 — regression** | **open, confirmed in source, on 3 of 8 repositories (37,5 %), in `--compact` and `--agent` alike.** `project_summary` publishes an Apache-2.0 licence header as the description of the project (struts), a 30-character horizontal rule (halo) and a setext underline (shopizer) — and `summary_basis` asserts `"README descriptive prose"` over all three. In 5.8.16 this field was `null` with `"no descriptive section found in README"`, the literal acceptance text of `AUD-513-N04`; the field went from honest to false. Mechanism, four separate holes, all read at HEAD: HTML comments are detected **only on their opening line** (`summarizer.py:335-337`) with no `in_html_comment` state — three lines above, `in_code_block` does exactly that for fences (`:326-330`) — so `<!---` on line 1 flushes and lines 2-15 of the licence become the first paragraph; headings are ATX-only (`:331`), so setext titles underlined with `===` are content; the short-fragment floor is `len(paragraph) < 30` **strictly** (`:359`), so a rule of exactly 30 dashes survives; `_LICENSE_MARKETING_RE` (`:266-281`) matches product-tier and marketing phrasing and **carries no Apache/MIT/GPL/BSD boilerplate pattern at all**; and `summary_basis` is assigned unconditionally to whatever paragraph survives the filters (`:382-385`) — a restatement of the code path, not a property that was checked. | Add `in_html_comment` symmetric to `in_code_block`; recognise setext underlines as headings, not content; extend the licence regex with the four standard boilerplates; and make `summary_basis` describe the path actually taken — where nothing is verifiably descriptive, `null` plus the 5.8.14 text. **The mechanical cause of the reopening is that no README fixtures exist**: add the three witnesses from the bank as fixtures (HTML licence comment, 30-character rule, setext `===`) in the same commit as the fix. |
+| `AUD-593-N01` / `N-01` | **P1** | **open, and it falsifies the closure assertion of `AUD-590-B02`.** For one symbol, one tree, one HEAD, consecutive invocations, both at `depth=4`: `impact` publishes `direct_caller_count: 34` (210 reference sites) and `impact-chain` publishes `554` (3 103), both under the literal unit `"distinct caller classes"`. The product's own comparability rule (`CALLER_METRIC_RECONCILIATION`) is *"two figures are comparable only when both match"* — they match, and differ 16×. **The authority is what is wrong, not only the number**: `FAN_IN_FIGURES` (`caller_metrics.py:80-110`) declares both rows `unit=distinct_classes, population=references_excluding_imports`, and the populations are not the same. Measured mechanism: `impact-chain` expands the seed set with every member of the interfaces the target implements (CH-001b, `spring_impact.py:1110-1135`) and then takes depth 1 **from the expanded seeds** (`caller_reach.py:309-336`), so its "direct" includes callers that name a sibling implementation; `impact` admits only references that name the target and keeps interface-mediated callers on a separate axis (`repository_ir.py:9263`, `:9596-9606`). Corroborating symptom: `chain_classes_total`, declared *"unbounded above by any direct-caller count"*, equals `direct_caller_count` exactly (554), and `indirect_callers` is `[]` — that emptiness is the hub guard capping the walk to depth 1 (`caller_reach.py:319-321`) and **is** declared, so it is not a confident zero. The published closure assertion `len(impact.direct_callers) == chain.metadata.direct_caller_count` measures 30 (list, capped from 34) against 554: it passes on a fixture where the two coincide by accident. | Decide which figure the `direct_caller_*` namespace owns, and fix the **catalogue** either way: either `impact-chain` measures depth-1 fan-in on the unexpanded seed (≈34), or the figure is renamed out of that namespace and its `population` becomes its own tag — an interface-expanded seed set is not `references_excluding_imports`. Regression is parametric over the catalogue, not over `CommonService`: for every pair of `FAN_IN_FIGURES` rows sharing `(unit, population)`, the emitted values must be equal, run over ≥3 symbols of different fan-in **including one that trips the hub guard** — the condition under which the divergence appears, and the reason two previous corrections of this class (`callers_total`, `P0-2`) closed a name and left the divergence. `chain_classes_total ≥ direct_caller_count` with strict inequality wherever uncapped transitive reach exists. |
+| `AUD-592-B01` / `B-8` | **P1 — closed row that does not reproduce as closed** | **open; the ledger row overstates its own fix.** `B-8` is recorded as *"compact posture retains one unresolved sample when the total is non-zero"* (`52593b6`). The code retains a sample only when the total is **exactly one**: `_posture_limit = 1 if summary["unresolved"] == 1 else 0` (`cli.py:12653-12654`). Field measurement on `mall`: `summary.unresolved: 3`, `unresolved: []`, `unresolved_cap: {total: 3, shown: 0, omitted: 3, limit: 0}` — and it is the only cap in that payload with `limit: 0` while `undecided_cap` and `evidence_cap` carry 200. `--limit 10` returns all three, so the analysis is intact and only the compact contract is wrong. | Either make the code do what the row says (retain ≥1 sample whenever `summary.unresolved > 0`) or correct the row to the narrower promise and reopen the defect it leaves. Do not leave `closed` standing over `shown: 0`. Add an assertion that no `cap_effect` receives `limit=0` by default on a path where `--limit 0` is published as *"no cap"* (`AUD-513-N08`), so the published semantics and the internal default cannot invert each other. |
+| `AUD-592-A02` / `A-1` second half, `§12.5` | **P2** | **open — scan truncation is declared by 1 of 4 commands that own a walk.** Over a truncated scan (cap observed at **8 000 files**), `impact` publishes `scan_truncated`; `plan` and `impact-chain` answer `not_found` with `scan_truncated: null`, and `endpoints` exits 1 with no payload — every one of them an exclusion derived from an incomplete population. `compare` cannot be measured (`AUD-592-R01`). Second, narrower defect in the same row: the root `--help` describes the cap as *"the scan stopped at 25 000 directory entries"* — a different limit in a different unit from the 8 000-file cap the field observes. | Publish the truncation beside every walk that can end in `not_found`, `candidates` or a census — the seventh pass already recorded that `extract_java_endpoints` does its own uncapped `rglob`, so this must be read at each call site, never centrally. Reconcile the two caps in the help text or declare both with their units. |
+| `AUD-593-N02` / `N-02` | **P2** | **open — the `--compact` budget is published three times, in two shipped authorities, with three values.** `ask --help` generates *"~7K tokens (30 KB, chars/4)"* from `output_budget`, the module that enforces the limit — this half is the `AUD-590-B03` fix and it is correct. The packaged `docs/USER_GUIDE.md` is still hand-maintained and disagrees with it twice: `:111` *"A ~10K-token subset"* and `:243` / `:1366` *"~2,500–4,000 tokens"*; `--agent` carries a fourth figure at `:254` / `:1367` (*4,500–5,500*). Measured payload: 22 390 B ≈ 5 597 est. tokens — inside the help ceiling, **+40 % over the guide's table**. `grep '7K tokens' *.py` finds no literal: the help is generated and the guide is not, and that asymmetry is the defect. | Generate every token figure in the packaged docs from `output_budget.token_estimate`, or delete them and point at `--help`. Extend the existing release assertion (today help ↔ payload ↔ section registry) to cover `docs/*.md`: a token band in a shipped `.md` that does not come from that module fails the battery. Packaged documentation is a published authority and belongs inside the same assertion as the help text. |
+| `AUD-593-N03` / `N-03` | **P2** | **open — `--help` denies the scope that `AUD-590-B04` had just granted.** With `ASK_MAX_ANALYSIS_SECONDS=90` the root analysis prints *"ask is a repo-wide analysis and the configured budget is 90s. Budget read from ASK_MAX_ANALYSIS_SECONDS=90 (process environment)"* — the fix works. The help page beside it still reads *"deadline only for spring-audit, risk, audit-report"* and *"Other commands are not time-bounded by this variable"* (`cli.py:621-622`). The root analysis is the most expensive command in the product and the one an agent most needs to bound; a reader of the help will not set the variable there. | Generate that line from the same registry `_build_analysis_classes` populates (the root is keyed there as `B14`), never by hand. Assertion: the set of commands the help names equals the set the preamble emitter covers. |
+| `AUD-593-N05` / `N-05` | **P3** | **open — a figure emitted outside the catalogue that forbids it.** `via_interface_resolution[].caller_count` publishes 37 where every other surface of the same fact says 23 (`interface_mediated_caller_count`, the list length, and the `explanation` prose), and it carries no `_unit` while the rest of the payload does. Both are legitimate and neither is declared: `caller_count` is `len(_iface_callers)` — raw caller symbols of the interface, before the `not in all_affected` filter and before normalisation to classes (`repository_ir.py:9248-9251`); the 23 is `caller_classes(_iface_mediated_callers, ...)` (`:9603`, `:10173`). It is also **not in `FAN_IN_FIGURES`**, which states that a figure absent from it may not be emitted — so `tests/test_fan_in_authority.py` did not catch a fan-in figure added in this release. | Give it a unit and a `FAN_IN_FIGURES` row, or rename it to `interface_caller_symbols`. Make the authority test sweep the **emitted** keys against the catalogue rather than the catalogue against itself; a catalogue that only validates its own rows cannot see an unregistered emission. |
+| `AUD-593-N06` / `N-06` | **P3** | **open, latent — a silent `[:30]` where every sibling list declares its cap.** `out["interface_mediated_callers"] = _iface_mediated_classes[:30]` (`repository_ir.py:10172`) with no `*_cap` block, in a payload where `direct_callers_cap`, `indirect_callers_cap` and `security_surface_affected_omitted` all carry `total`/`shown`/`omitted`/`direction`/`how_to_read`. On MSAS the list is 23, so nothing is visible; the first repository with more than 30 interface-mediated callers loses the excess without a word. | Route it through the same `_cap_effect(...)` used 27 lines above (`repository_ir.py:10145`). |
+| `AUD-592-D01` / `D-1` | **P3 — residual of `AUD-591-A08`** | **open, confirmed in source.** The write inventory in the root help says `migrate-check` writes *"only with `--history-dir`"* (`cli.py:296`). `--history-dir` only relocates the destination; the flag that writes is `--snapshot`, as `migrate-check --help` states correctly and as the code comment at `cli.py:12980-12986` states explicitly. Verified in the field: `migrate-check --history-dir <path>` exits 0 with zero writes and no guard message, while `--snapshot` fires the guard correctly. `AUD-591-A08`'s assertion checks that each cited flag **exists** in that command's parser — `--history-dir` does — not that it is the flag that triggers the write. | Key the inventory on `(command, triggering flag, path)` taken from the guard site itself, as `AUD-591-A08`'s own acceptance text required. An auditor tests what the inventory lists: this is the same mechanism by which `AUD-591-A01` went unfound. |
+| `AUD-592-D02` / `D-2` | **P3 — residual of `AUD-591-A02`** | **open.** `--min-band` filters and validates (`cli.py:11294-11308` in `risk`, `:11563-11568` in `enrich`) but publishes no `_filter` block, while its sibling `--band` publishes one through `_apply_selection`. A consumer cannot tell a filtered answer from a small one. | Route `--min-band` through `_apply_selection` like every other selection flag, or publish the same `_filter` shape from wherever it is applied. |
+| `AUD-592-D03` / `D-3` | **P3 — residual of `AUD-591-A02`** | **open.** `enrich --rule NOPE-999` exits 0 with an empty result; `spring-audit --rule NOPE-999` exits 1 against the rule catalogue. One flag name, two contracts. Measured with a synthetic SARIF 2.1.0 (2 results): `--rule`, `--band` and an invalid `--band` all behave correctly in `enrich`; only unknown-rule validation is missing. | Validate against the same catalogue in both commands. `enrich` is experimental-tier, which sets the severity, not the contract. |
+| `AUD-592-D04` / `build_commit` | **P3 — process** | **open, fourth consecutive report.** `ask version` publishes `build_commit: unrecorded`, so no measurement in these ~150 invocations is attributable to a commit and *"fixed in 5.8.17"* is not falsifiable from outside. | Stamp the commit at build time. It is the cheapest row in this table and it is the precondition for every other row's verification. |
+
+**Mapped, not new — inherited rows this pass re-witnesses.** `B-6` (partial answers exit 0)
+keeps its row and gains its best measurement yet: overrun ×5.4 → ×4.2 → **×1.39** (median
+20.90 s of 70.74/20.90/19.70 against a 15 s budget), with a `_partial` block that is
+exemplary (`phases_completed`, `phases_pending`, `why_stopped`, and *"every count here is a
+FLOOR"*) — and `exit 0` on all three runs, so a pipeline reading `$?` passes with two of
+three phases unexecuted. **`AUD-591-A09` is the template**: `exit_code` / `gate_exit_code` /
+`gate_exit_code_basis`, or an explicit `--allow-partial`. `B-3` (`--agent` versus
+`--compact`) gains a witness at 3 342 files: 35 357 B ≈ 8 839 est. tokens, **+61 % over the
+only published band**, 16 blocks present in `--compact` and absent from `--agent`
+(`transactional_boundaries`, `mybatis`, `spring_profiles`, `deployment`, `env_map`,
+`stacks` among them), and `sibling_view` still names no block; on the bank round the two
+views are no longer a subset relation at all (9 blocks agent-only, 15 compact-only) and the
+×2.25 time overhead is gone (×1.02). Substantively, `security_surface` is absent from
+**both** channels on a repository with 368 security findings and 725 routes open by rule —
+the predicate is disclosed under `AUD-590-B03`, not closed. `N-5` (an advisory saying
+*"8 372 Java files"* with no population label while the progress line says
+`[population=production_java_sources]`) remains the unclosed half of `AUD-588-B11`; the
+label exists (`cli.py:10278-10280`) and reaches the progress lines and the payload but not
+the advisory emitted from `phased_run.py:367`. `D-09` (cost anchors stamped *"on 5.1.0"* in
+a 5.8.17 build — now counted: **17 anchors on 5.1.0, one each on 4.18.0, 5.0.0 and 3.2.2**,
+in a `cache model` output presented as operational guidance) belongs to `BUG-5`. `N-6`
+(cold `spring-audit` on `openmrs-core`) belongs to `BUG-1` and **improved**: 8.86 s → 8.06 s.
+
+**Closed by correction and re-verified from outside in this pass — do not re-derive.**
+`AUD-591-A01` (8 of 8 write paths refuse, verified by filesystem footprint rather than
+`git status`, `ASK_RUNS_IN_REPO=1` included), `AUD-591-A02`, `AUD-591-A03` (and the
+proposed highest-priority probe is retired: `rename-class --from O` exits 1, as the seventh
+pass had already established), `AUD-591-A05`, `AUD-591-A06` (50.30 s → 0.43 s, and the
+sweep it asked for holds: **6 of 6 error paths ≤0.54 s**), `AUD-591-A08` (modulo
+`AUD-592-D01`), `AUD-591-A09`, `AUD-591-A10`, `AUD-590-B01` (`repo_id` cardinality 1 with
+`repo_id_basis`; the content hash lives on as `content_id`), `AUD-590-B02` (the *lists* —
+the counters above it are `AUD-593-N01`), `AUD-590-B03` (in `--help`; the packaged guide is
+`AUD-593-N02`), `AUD-590-B04` (both halves: a `partial-analysis-v1` stub with `partial:
+true` where 5.8.16 left zero bytes, and an 807 B preamble byte-compatible with
+`spring-audit`'s 813 B), `AUD-590-R01` (`route_census` — and it **refuted the auditor's own
+double-counting hypothesis with the product's data**: `mappings 3763` against
+`on_rows 1120`, with `distinct_routes ≥ mappings`), `AUD-591-Q01`, `B-7` (closed by
+deletion, which was the right answer: `total_ms` is gone, replaced by
+`wall_ms`/`measured_ms`/`unaccounted_ms`/`unaccounted_pct` with arithmetic exact to the
+decimal and a `unit` explaining why the remainder is published rather than distributed).
+
+**Verified and not defects — do not spend effort.** `posture --profile` accepting an
+undeclared profile is **by design and correctly declared**: it is a hypothesis input, not a
+catalogue name, and the payload publishes `profiles_requested` beside `profiles_declared`
+(the bank round withdrew this finding itself after reading the payload). `pr-impact` on a
+clean tree exits 1 with a typed `INVALID_INPUT` naming the empty diff. `pr-impact` over
+three classes refuses with `OUTPUT_TOO_LARGE` and names `--output` — a ceiling as contract,
+not a truncation. `verify` publishes `exit_code: 2` matching the process (`AUD-591-A09`).
+`data-exposure` still answers `answered: false` rather than inferring labels. Cache
+freshness reporting `STALE` at delta 0 commits is `Uncommitted: True` over the auditor's own
+untracked files. `repo_id` absent from `endpoints`, `posture` and `--compact` is coverage,
+not a defect — the criterion was cardinality 1 among emitters, and the help no longer
+promises it.
+
+**Process findings of this pass, and they are the same finding twice.**
+
+1. **The class survives the fix, four times out of five.** `AUD-590-B02` (unit absent from
+   the lists) returned as `AUD-593-N01` (unit present and false in the counters) and
+   `AUD-593-N05` (a new field shipped without one); `AUD-590-B03` (two figures in one help
+   page) returned as `AUD-593-N02` (three figures once the packaged guide is counted) and
+   as the `--agent` band in `B-3`; `AUD-590-B04` (a variable invisible to the root) returned
+   as `AUD-593-N03` (a help page denying the scope the fix granted). The seventh pass named
+   this pattern its highest-value finding and wrote the rule — *every acceptance criterion
+   carrying a sweep clause is closed with a parametric test over the catalogue* — and the
+   two classes closed **as sweeps** in that pass (write guards 8/8, numeric bounds 7/7, and
+   now error-path cost 6/6) did not recur, while three of three closed by instance did.
+   `FAN_IN_FIGURES`, `COMMANDS_THAT_WRITE` and the serializer's section registry are already
+   catalogues: the test goes over the catalogue, never over the reported symbol.
+2. **Two rows in this ledger were marked `closed` while the field reproduces them open**
+   (`AUD-592-B01`, and `AUD-588-B11`'s advisory half). Both were closed against a surface
+   narrower than the row's own wording. A closure whose assertion cannot fail on the tree
+   that produced the defect is not a closure: `AUD-593-N01`'s assertion passes today only
+   because the fixture makes both figures coincide.
+3. **Packaged documentation is a published authority.** `AUD-593-N02` exists because the
+   release assertion covers help ↔ payload and stops at the package boundary. Two stale
+   figures in a shipped `.md` are enough to contradict the correct one in the help.
+
 ### Seventh Audit Pass: `5.8.16` / 16-repository bank + `saint-server` / 2026-08-21
 
 Ordered as the correction queue, regressions and permissive-direction failures first. Each
@@ -184,7 +312,7 @@ partial, `F03` open, `F04` explicit opt-in and `F05` locally verified only.
 | `N-6` | Medium | **not reproduced after cache fixes** | Isolated cold `openmrs-core`: 5.18 s wall / 4.76 s internal, all four layers cold. Retain the field report as an environment-specific reproduction request. |
 | `B-3` | Medium, core/supported | **closed by `773268d`** | Help no longer claims maximum signal; `sibling_view` points to compact. |
 | `B-6` | Medium, core | **closed by `17c6e06`** | Partial answers publish `overrun_bound` and its wall-clock basis. |
-| `B-8` | Low | **closed by `52593b6`** | Compact posture retains one unresolved sample when the total is non-zero. |
+| `B-8` | Low | **reopened 5.8.17 — see `AUD-592-B01`** (was: closed by `52593b6`) | The fix retains a sample only when the total is exactly 1, not whenever it is non-zero, so `total: 3, shown: 0` still reproduces. |
 | `N-5` | Low, core | **closed by `c68083f`** | Progress and payload name the Java population. |
 | `N-7` | Low, core | **closed by `082e9de`** | Bounded fuzzy candidates and matching message hints handle close typos. |
 
@@ -207,7 +335,7 @@ automation remains deferred; provider non-coverage is the current product behavi
 | `AUD-513-N01` (`N-1`) | **closed in 5.8.14** | `rename-class` rewrote three Petclinic files under both `ASK_READONLY=1` and `--no-write`, then exited 0. The audit restored the tree; this is a write-policy breach, not an artifact-directory exception. `readonly.guard_mutation()` now refuses before any planned source write or physical rename; help names the command as mutating and regressions cover both readonly controls plus `--dry-run`. |
 | `AUD-513-N02` / `B-4` / `N-5` | **N02/B-4 implemented in 5.8.14; N-5 open** | `posture.summary.unconditional` counted 1,697 on a non-Spring Struts tree and 1,573 on Mall, and `security` was `0/0/0` with no population. The posture projection now uses the canonical Spring IoC bean population, publishes its population/unit and separates unconditional security beans. Regressions cover non-Spring, mixed-bean and conditional/unconditional security fixtures. Progress/advice still use incompatible “Java files” scopes (`N-5`), so the `AUD-588-F02` family remains open. |
 | `AUD-513-B01` / `B-3` / `B-5` | **B01/B-5 implemented in 5.8.14; B-3 closed as revalidated** | A MyBatis XML paired with a `*Mapper.java` interface now takes precedence over an absent `@Mapper` annotation, preserving XML-backed/`@MapperScan` interfaces in `mapper_interfaces` rather than misclassifying them as DTO mappers. `imports_found` now contains only actual Java imports; code, XML and build matches are emitted as `evidence`, including in compact output. `B-3` was stale against the current source: both views consume `JAVA_SPRING_SECTIONS`; a real MyBatis Mapper/XML regression proves the section is retained by `--agent`. |
-| `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, `D-09` | **N03/N04/N07/N08/N09 implemented in 5.8.14; remainder open** | `impact` now always publishes the `candidates` field its not-found message names, including `[]` when no close symbol exists. Budget advice no longer calls partial snapshot/RIS evidence a warm cache: it identifies that presence and says context/parse are unknown before analysis, whose payload then reports all four actual layers. README operational sections (`clone`, install, build, getting started, troubleshooting and related headings) are never promoted into a project summary; with no descriptive prose compact output publishes `project_summary: null` and `summary_basis`. `security_posture.limitations` is now cache-state invariant; dynamic execution advice travels in `security_posture.operational_hints`. Every numeric output bound rejects negative values at parse time with a structured `INVALID_INPUT` envelope (`flag`, `value`, `expected`); `--limit 0` still means no cap wherever that behavior was published. Budgets overrun, timing coverage is inconsistent, compact hides unresolved identities and cost anchors remain stale. |
+| `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, `D-09` | **N03/N04/N07/N08/N09 implemented in 5.8.14; remainder open** | `impact` now always publishes the `candidates` field its not-found message names, including `[]` when no close symbol exists. Budget advice no longer calls partial snapshot/RIS evidence a warm cache: it identifies that presence and says context/parse are unknown before analysis, whose payload then reports all four actual layers. README operational sections (`clone`, install, build, getting started, troubleshooting and related headings) are never promoted into a project summary; with no descriptive prose compact output publishes `project_summary: null` and `summary_basis` — **`N04` regressed in 5.8.17 and is `AUD-592-R02`: licence headers and layout rules are promoted again, under a basis that asserts they are prose.** `security_posture.limitations` is now cache-state invariant; dynamic execution advice travels in `security_posture.operational_hints`. Every numeric output bound rejects negative values at parse time with a structured `INVALID_INPUT` envelope (`flag`, `value`, `expected`); `--limit 0` still means no cap wherever that behavior was published. Budgets overrun, timing coverage is inconsistent, compact hides unresolved identities and cost anchors remain stale. |
 | `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.14** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `e53507d` separates direct impact matches from analysis seeds and implementation classes; `8386744` carries the established container-wiring fact into plan checklists and compare cost dimensions. Source population units and risk-tier wording remain open. |
 | `AUD-511-R02` / `AUD-589-B02` / `AUD-513-N06` | **partially corrected; `data-exposure` open, P1** | Nine of ten measured commands recovered, many to their best historical timings. `data-exposure --config` did not: 42.7 s versus 16.2 s in 5.8.8 and a 28.9 s model, with byte-equivalent output. Measure it with the idle-host, isolated-cache, interleaved-control protocol before changing code, then compare its reuse path with `validation`. |
 | `AUD-588-B02`, `B06`, B11 residuals, `B12` | **B02/B06 closed; B11/B12 open, P2** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. The re-audit verifies both and the payload reduction; `cf57457` makes aggregate wording name only applicable dimensions. Complete B11 consumer parity and calibrate B12 only from provenance-bearing controlled samples. |
@@ -407,6 +535,8 @@ retained only as evidence of what the auditor observed before the fix.
 | ASK-17 | **The parse store's default budget cannot hold a multi-repository workspace warm, and the cold cost of the largest repository is 7,6 minutes.** Measured on the 8-repo corpus (43 986 `.java`): `cache status` reports 56 730 entries at **511,12 MB against a 512 MB budget** — i.e. permanently sweeping by LRU — so `tutorials` (24 073 `.java`, the largest contributor) is the first candidate for eviction. Cold `--compact` on it: **457,6 s**, independently reproduced at 449 s, against 2,0 s on the second pass. | 5.8.4 corpus re-audit | Medium — warm plus `--compact` is still the answer (2,0 s), but a workspace this size cannot keep every repository warm at the default budget, and nothing tells the caller which repository is cold before it pays for it | **closed 5.8.5 — the disclosure shipped and the owed measurement taken, under our own control.** ⚠ **The +66 % does not reproduce, and the mechanism the row suspected is worth ~3 %, not 66 %.** Protocol: `tutorials` (24 073 `.java`), root `--compact`, both cache bases isolated **and emptied between runs** (`SOURCECODE_CONTEXT_CACHE_DIR` *and* `SOURCECODE_CACHE_DIR` — the first attempt isolated only the first, and the second pass of each version answered from the L2 view its own first pass had written: 2,4 s with an empty parse store, which is how a measurement of a cold path becomes a measurement of a warm one), `ASK_PARSE_CACHE_MAX_MB` fixed at 4 096 MB so no sweep can confound the comparison, 2 passes per version. **5.7.2 (`e803c8b`): 112,0 s / 112,6 s. This tree: 113,8 s / 115,2 s — +2,3 %**, with per-version dispersion of 1,005× and 1,012× and a payload 2,2 % larger. Then the audit's own condition, isolated as the only variable — the store pre-filled to 489 MB against the **default** 512 MB budget, so every 32 MB written sweeps: **117,0 s, +2,7 %.** So the LRU sweep is not where 457,6 s comes from, and neither is the analysis path: the auditor was right to hold the regression, and the held figure is now retracted **with a number** rather than on suspicion. ⚠ Scope, stated because the difference is unexplained rather than explained away: 457,6 s on Windows 11 / pipx is **not reproduced here** (113 s on 20 cores), and that gap is not assertable in either direction from this measurement — what is assertable is that 5.7.2 → this tree did not get slower and that a saturated store costs ~3 %. ✅ **What the measurement does confirm is the row's own claim, with our number: one repository of 24 073 `.java` leaves 46 840 entries and 470 MB in the store — 92 % of the 512 MB default budget** — so a workspace with a second repository of any size is permanently sweeping by construction, exactly as reported. Sizing rule, measured rather than guessed: ~20 KB of store per Java file, so ~500 MB per 24 000-file repository. Collateral confirmation of `AS-18`: after the saturated run the store rests at 669 MB — 157 MB over the budget and **under** the 736 MB effective ceiling it publishes at 7 writers — so the ceiling holds under the condition that produced the complaint. **The disclosure half:** `cache status` now publishes **coverage per repository**, which is the half the row itself recommended and the half that changes a decision: *«tutorials: 3 100 of 24 073 files cached (13 %)»* replaces a blind guess about whether to raise the budget, and an LRU eviction becomes visible **before** somebody pays 457,6 s to discover it. Both halves of the attribution were already held and thrown away — the walk knows the repository and it computes the store key for every file — so the run records the pairs (`parse_cache.record_repository_index`, from **both** readers of the store: `build_repo_ir` and the route-surface extractor, so the figure does not depend on which command was typed) and `store_stats` intersects them with the keys it collects **in the entry walk it already performs**: coverage costs an intersection, never a second scan of the store and never a scan of the repository. Three rules keep it honest. The index is **merged, never replaced**, because a `--changed-only` or `--since` run would otherwise shrink a 24 000-file population to the twelve files it read and publish *«12 of 12 cached (100 %)»* about a repository that is cold. The number travels with its **basis** — a file deleted since its last analysis still counts as recorded and reads as uncached, which errs toward *colder than it is* and says so. And the index is **neither an entry nor evictable**: the entry walk, the byte accounting and the LRU sweep all glob `*.json`, so its bytes are published under their own name (`repository_index_bytes`) rather than folded into a total that means entries — an index swept away with the entries it describes cannot report the eviction, which is the one moment it exists for. It lives inside the generation root, so retiring a generation retires its indexes with it: the keys are only readable by the build that wrote them. Regression `tests/test_parse_store_repository_coverage_ask17.py`, 11 assertions, including the one the row is about — entries deleted underneath a recorded repository make coverage **fall** while the population holds. ⚠ **Still owed, and unchanged:** the controlled cold measurement (5.7.2 against this tree, `ASK_PARSE_CACHE_MAX_MB` fixed, store emptied between runs, on a >20 000-file repository). Until it exists neither the +66 % nor its absence is assertable, and the row stays open on that half alone. **History:** **open** — ⚠ **not filed as a regression, deliberately**: the same cold figure was 274,8 s in 5.7.2 (+66 %), and the auditor refuses to call it one because the conditions are not comparable — in 5.7.2 the store had been retired by a version change, here it was mid-LRU-sweep. Seven false positives of exactly this class have been retracted over seven cycles; this is the eighth candidate and it is being held. What is owed is a measurement **we** control: cold `--compact` on a >20 000-file repository, 5.7.2 against 5.8.4, with `ASK_PARSE_CACHE_MAX_MB` fixed and the store emptied between runs — until that exists, neither the +66 % nor its absence is assertable. Recommended beside it, and cheap because both halves already exist: `cache status` should publish **coverage per repository** — how many entries belong to each analysed repository and what fraction of its files are covered — so *tutorials: 3 100 of 24 073 files cached (13 %)* replaces a blind decision about whether to raise the budget. Entries are content-addressed and the walk knows the repository, so this is a projection of facts we hold, not new analysis. **Refutation reproduced independently in cycle 8, under the reporter's own protocol**: both stores isolated and emptied, `ASK_PARSE_CACHE_MAX_MB=4096`, 2 passes per version — 5.7.2 at 112,0 / 112,6 s against 5.8.5 at 113,8 / 115,2 s (~3 %), and an A/B of the budget itself (512 MB sweeping by LRU against 4 096 MB that cannot sweep) at 9,1–10,1 s against 9,0–9,7 s: **the LRU sweep costs nothing measurable**. The +66 % is retired as the reporter's eighth false positive, with `E-37` named as its confounder. |
 | C3-128 | **`timeline` is the only gate-shaped command above 120 s, and it has not come back to its record.** Steady state, 4 runs, audited corpus: `timeline --since HEAD~5` costs **198 469 ms**, +27,3 % over its 5.7.2 record of 155 950 ms. The two other commands over 120 s are there structurally — `delta` (234 s) and `contract-diff` (136 s) analyse two whole trees — while `timeline` analyses **five** and costs less than `delta` does with two, so its cost is not explained by the number of trees it walks. | 5.8.2 → 5.8.4 re-audits | Low-Medium — an investigation command rather than a gate, and the last performance figure of the round sitting outside its own best | **closed 5.8.5 by measurement — the clock is attributed, and there is nothing left unaccounted to tune against.** The row's own instruction was ASK-16's: instrument before tuning. `timeline` published a per-sample total over what is really four costs — materialising a tree, measuring each watched metric, releasing the tree, and the remainder — so *«198 469 ms»* named a command rather than a phase. `perf.PhaseTimings` (the ASK-16 authority, always on) now splits it, with the phase names taken from `--watch` so the split cannot drift from the population, and the tree materialisation kept as its own phase because git's work must not be attributed to an analysis. **Measured, BroadleafCommerce (2 985 `.java`), `--since HEAD~5 --watch posture`, 5 samples: wall 38 921 ms — `measure:posture` 32 273 (82,9 %), `materialise_tree` 5 376 (13,8 %, ~1 075 ms per tree), `release_tree` 1 272 (3,3 %), unaccounted 0,45 ms (0,0 %).** So the answer to the row's premise — *«it analyses five trees and costs less than `delta` does with two»* — is that five sixths of the cost **is** the analysis, re-run per tree by construction, and the git work is a sixth of it: `timeline` is N × one analysis and there is no timeline-specific overhead to remove. Any future gain belongs to the metric being sampled (`C3-84`, `C3-127`), which is where it would also help every other command, and the payload now says so per run instead of per audit. Regression `tests/test_timeline_timings_c3_128.py`, 9 assertions, including that the series itself is byte-identical across two runs once the clock readings are removed — instrumentation that moved an answer would be a worse defect than the row. **Original note:** **open** — ⚠ the cache-reuse half of `B7` must **not** be reopened on this evidence: the v3 assertion (`max(sample) < 8 × posture_warm`) passes at 6,8 in both 5.8.2 and 5.8.4, against 14,8 / 13,4 / 12,4 / 8,5 in the four versions that genuinely failed it. What has not returned is the absolute cost. Attribution comes before tuning and is now cheap: `metadata.timings` (`ASK-16`) exists, so the per-phase split across the five trees can be published before anything is changed. |
 | B20 | **Thirteen declared renames with no cut-off date, and two distinct `1.0` identifiers meanwhile.** The registry publishes `pending_renames` for the 13 non-conforming `schema_version` values with their canonical name — exactly the policy `ASK-11` exists to enforce: the rename is an incompatible change, declared before it is made, never applied in silence. The consequence is published by the registry itself as `ambiguous_identifiers: 1` — `spring-audit` emits `1.0` for `core-analysis-v1` and `impact-chain` emits `1.0` for `impact-chain-v1`, so a consumer dispatching on the emitted version cannot tell them apart. | 5.8.4 re-audit (residual of `B19` / `B6`) | Low — declared debt rather than a defect, and the audit says so in as many words | **closed 5.8.5 — the window is declared where every other incompatible change is, and the reported ambiguity was understated by five shapes.** `BC-002` in `sourcecode.breaking_changes`: **announced 5.8.5, takes effect 6.0.0**, printed by `ask schema breaking-changes-v1`, carried in the CHANGELOG's `## Upgrading` section above the release history, and projected into `ask schema schemas-v1` as `pending_renames_window` — **one fact, two surfaces**, with a structural assertion that the registry source holds no second copy of the date. The registry's policy is generalised rather than loosened: a declared change is now `kind: exit_code` (must move an exit code) **or** `kind: contract` (must move a **published value** *and* name the version it takes effect in), because a rename breaks a consumer with every exit code still 0 and a registry that only knew about exit codes had nowhere to put it. A contract change publishes no `exit_code_before`/`after` at all — inviting a reader to check a field that cannot move is how a disclosure becomes noise. The 13 affected shapes are **read from `schema_registry.canonical_migrations()` at call time**, never copied: a shape that starts conforming leaves the declaration by itself (asserted by swapping the registry for a conforming one and watching the list empty). ⚠ **Correction to the reported cause, measured**: the audit named *two* shapes spelling their version `1.0`; there are **seven** — `core-analysis-v1`, `impact-chain-v1`, `pr-impact-v1`, `migration-blast-v1`, `spring-impact-v1`, `event-topology-v1`, `test-gap-ranking-v1` — so `ambiguous_identifiers: 1` was counting one *identifier* over seven shapes, not two. `ask schema 1.0` already resolved to all seven with each canonical name; the count is now asserted from the registry so it cannot be quoted from prose again. The rename itself is deliberately **not** made early: that is the incompatible change this policy exists to prevent. Regression `tests/test_schema_rename_window_b20.py`, 11 assertions, plus the ASK-11 battery generalised to both kinds. **Original note:** **open** — the missing half is a date, not a decision. Announce the cut-off window in `breaking-changes-v1` with the target version, the way every other incompatible change is announced, so a consumer can pin `core-analysis-v1` today and know when the bare `1.0` stops being emitted. Until then `ask schema 1.0` resolving to all seven shapes, each offering its canonical name, is the correct behaviour and must not be *fixed* by renaming an emitted value early — that is the incompatible change this policy exists to prevent. ⚠ **Round 10 ran on the 5.8.5 build and still reports the renames as *«deuda bien declarada, pero sin fecha»*, asking for precisely what `BC-002` already ships.** The row stays closed — the window exists, is announced 5.8.5 / effective 6.0.0, and is printed by `ask schema breaking-changes-v1`, carried in the CHANGELOG's `## Upgrading` and projected into `schemas-v1` as `pending_renames_window`. What it leaves behind is a **discoverability check, not a defect**: the reporter quoted `pending_renames` and `counts` out of the registry payload and did not see the window beside them, so verify that `pending_renames_window` travels in the same payload those two keys do — and if it does not, that is where it belongs. A declaration a ten-round auditor cannot find is not yet declared to a consumer. |
+| E-38 | **A class-level route prefix carried by a meta-annotation is dropped, and the route is published without it.** `_build_route_surface` reads the class prefix only when the class symbol carries `@RequestMapping` or `@Path` **literally** (`repository_ir.py:5882-5887`); a repository that declares its own composed annotation gets `prefixes = [""]`, and the published `path` is the method suffix alone. **Measured on shenyu (5.8.17): 35 of 365 published routes — 9,6 %, over 21 controllers — carry `path: "/"`.** `AiProxyApiKeyController` is annotated `@RestApi("/selector/{selectorId}/ai-proxy-apikey")`, a Shenyu annotation meta-annotated with `@RestController` + `@RequestMapping`; its five handlers are published at `/`, `/`, `/batchDelete`, `/{id}`, `/page`. The served URLs do not exist as published. This is a **confident falsehood**, not a gap: no `path_resolution: "unresolved"`, no `path_expression`, no warning, and `route_census.distinct_routes` (316 of 365) reads the collisions as if two controllers genuinely shared a path. It also propagates to every consumer keyed on route text — `explain-endpoint`, `data-exposure --path-prefix`, `validation --path-prefix`, `pr-impact` route matching — where a correct query returns nothing. **The machinery already exists on the other axis**: `E-12`/`5.7.1` closed exactly this class for *beans* by resolving the spelling against the graph's `imports` edges, and `BeanGraph.build` already builds a meta-annotation map in its first pass. The route axis never asked. Vendor-agnostic by construction: the rule is "an annotation this repository declares that itself carries `@RequestMapping`/`@Path`", never a proprietary name. | found 2026-08-21 during the `AUD-590-R01` census triage, on the corrected 5.8.17 build; **not part of the seventh-pass queue and deliberately not fixed in it** — it moves route counts on any repository using composed annotations and needs its own measured pass with the golden set re-baselined | **High** — it is the rule this repository enforces most loudly, inverted on the route axis: a published route that is not served, with no affordance saying so. Blast radius is every repository with a framework-level or in-house composed controller annotation; shenyu is the witness, dubbo/sa-token/halo are unmeasured | **open** — direction: resolve the class-level prefix through the meta-annotation map `BeanGraph.build` already computes, in the order `E-12` established (explicit single-type import decides; wildcard leaves it admissible; a repository-declared annotation in the owner's package is the owner's own; **nothing resolved stays unresolved rather than acquiring a verdict from silence**). Where it cannot be resolved, publish `path_resolution: "unresolved"` with the annotation as `path_expression` — the contract the method-level path already honours — never a bare `/`. Regression on a fixture declaring its own composed annotation, plus a shenyu assertion that no published route is `/` |
+| B29 | **A cache-freshness test asserts a cold cache without ensuring one, so it fails on every run but the first after a purge.** `tests/test_cli.py::test_compact` asserts `_meta.timing_ms.served_from_cache is False` and does nothing to make that true: the first `--compact` run over its fixture populates the cache the second one then hits. Verified symmetrically at `d9071d4` (clean) and at every commit of the seventh-pass queue — purge, run, pass; run again, fail — so it is **state-dependent, not a regression**, and it has been reported as "1 pre-existing failure" for the whole pass. It is still a red line in a suite whose value is that red means something. | found 2026-08-21 while establishing the baseline for the seventh-pass queue | **Low** as a defect, **medium** as an eroder — a permanently-red test trains a reader to skip the summary line, which is how a real regression gets shipped | **open** — direction: the test must create the state it asserts (purge this fixture's cache dir in the fixture, or assert the *transition* cold→warm across two runs rather than the absolute). Do not "fix" it by deleting the assertion: `served_from_cache` is the field `is_stale`/cache-freshness rows are keyed to, and a cold-start claim is worth holding |
 | E-37 | **Two environment variables move three cache stores, and no surface said which moves which.** `SOURCECODE_CACHE_DIR` relocates the per-repository snapshot store (core snapshots, the rendered L2 view, the RIS); `SOURCECODE_CONTEXT_CACHE_DIR` relocates the shared ones (the Canonical IR and the per-file parse store). Their defaults are siblings under `~/.sourcecode`, so the split is not derivable from the paths, and `cache status` published a path per store with no variable beside it while `docs/CACHE.md` named both variables in one sentence after the table. | found here 2026-08-18 while taking the controlled A/B `ASK-17` owed, not reported by the field | Medium — it does not make an answer wrong, it makes a **measurement** wrong, silently: an operator who redirects or empties *the cache* moves one store and is served answers out of the other | **closed 5.8.5** — measured first: with only `SOURCECODE_CONTEXT_CACHE_DIR` redirected, the second cold pass of each version answered from the L2 view its own first pass had written — **2,4 s against 113 s, with an empty parse store** — and the run reported `cache_source: L2_view` without anything naming the store it came out of. Now every store in `cache status` publishes `base_env`, from one authority (`cache._STORE_BASE_ENV`), the text answer prints *«<path>  ($VAR moves it)»* beside each one, `stores.base_env_note` states the consequence rather than the layout, and `docs/CACHE.md` carries a **column** instead of a sentence covering both. Regression `tests/test_cache_store_base_env_e37.py`, 8 assertions, and the ones that matter are **behavioural**: setting the variable a store names moves *that* store and leaves the others where they were — a published mapping nobody exercises is the class of claim this repository refuses everywhere else. The CLI is forbidden a second copy of the mapping (structural assertion). **Confirmed from the outside in cycle 8, by the reporter falling into it first**: isolating only `SOURCECODE_CONTEXT_CACHE_DIR`, their second *cold* pass answered from the L2 view their first pass had written — **2,4 s against 113 s with an empty parse store** — and their write-up now quotes the shipped `base_env` mapping back as the fix (*"dos variables mueven tres almacenes y ninguna superficie decía cuál"*). A defect found while measuring, that was itself corrupting the measurement. |
 | B21 | **Six of the thirteen shapes being renamed name no command that emits them.** `schemas-v1` publishes `emitted_by` per shape; for `migration-blast-v1`, `spring-impact-v1`, `event-topology-v1`, `test-gap-ranking-v1`, `canonical-ir-v1` and `hibernate-strategy-v2` it is `[]`, beside seven shapes where it is populated. Read the way a consumer reads a list, an empty `emitted_by` says *nothing emits this shape* — which tells the one consumer that **is** affected by `BC-002` that it is not. | found here while declaring `BC-002` (5.8.5), not reported by the field | Low — a disclosure gap in a declaration whose whole purpose is to let a consumer decide whether it is affected | **closed 5.8.6 — derived, not typed out.** `schema_producers` reads the two authorities the CLI already holds — the registered command tree and the import graph of the module that defines each callback — and answers with the evidence it derived on: `command_import` (the command's own body imports the producing module), `module_import` (one hop, through an intermediate narrow enough to attribute), `substrate` (reached from more commands than a producer would be) or `unresolved` (nothing found, said in a sentence). Five of the six now name a command — `migration-blast-v1` → `migrate-check`, `spring-impact-v1` and `event-topology-v1` → `impact-chain`, `test-gap-ranking-v1` → `impact`, `hibernate-strategy-v2` → `migrate-check`/`migrate-recipe` — and the sixth, `canonical-ir-v1`, is reached from **28 modules**: naming every command would be less true than naming none, so it publishes `substrate` with the count and the instruction to match on `subject`. A declared producer still wins, because some producers are not one registered command (`ask (root)`, `baseline capture`). Regression `tests/test_schema_producers_derived_b21.py`, 33 assertions, parametrised by the registry so a fourteenth unnamed shape fails the battery. **History:** open, and named rather than shipped as a fact: every `BC-002` row with an empty producer list carries `emitted_by_basis` — *«not declared in the registry: this shape's producing command is not named yet, so match on `subject`»* — so the gap is visible instead of being read as a negative claim. What remains is to fill the six, and the honest way is derivation rather than six more hand-written strings: the producer is discoverable from the command that constructs each payload, which is the same authority every other population in this repository comes from. Until then the assertion in `tests/test_schema_rename_window_b20.py` holds the weaker invariant a reader can rely on: a row either names its emitters or says why it cannot. |
 | C3-129 | **`timeline`'s absolute cost, now fully attributed and still 27 % above its own record.** `C3-128` closed by instrumenting rather than tuning, which was the right order and left this behind: the clock is split, nothing is unaccounted, and the number has not moved. Round 10 on 5.8.5 measures `timeline --since HEAD~5` at **~198 000 ms against the 5.7.2 record of 155 950 ms (+27 %)** — the only gate-shaped command over 120 s that is not there structurally (`delta` 191 s and `contract-diff` 115 s walk two whole trees, `compare` 46 s walks N candidates; `timeline` walks **five** trees and costs more than `delta` does with two). | 5.8.2 → 5.8.5 re-audits (residual of `C3-128`, which closed the attribution half in 5.8.5) | Low-Medium — an investigation command rather than a CI gate, and the last performance figure of the round sitting outside its own best | **closed 5.8.6 — by not paying twice for what does not change.** A metric at a commit is a pure function of that tree, and the tree at a sha never changes: the only cache in this product whose key can be exact rather than heuristic (analyzer fingerprint + metric + commit sha). `timeline_cache.SampleCache` stores measured values under the per-repository core store, and when every watched metric for a sample is a hit the tree is **never materialised**, which is the 13,8 % the split attributes to git. Measured on BroadleafCommerce over the same range: **26 845 ms → 12 ms**, samples and transitions byte-identical. What makes it admissible rather than merely fast, all asserted: a failed sample is never stored (one bad run cannot become permanent), the fingerprint is in the key (corrected analysis is never served from a previous release), the hit is published (`sample_cache`, `from_cache` per sample, and `cost` separates the cached population from the measured one instead of reporting a median over both), and `--no-cache` / `ASK_TIMELINE_NO_SAMPLE_CACHE=1` measure everything again so the command stays measurable without emptying a store (E-37). `cache_model` carries the layer, so `cache model` and `docs/CACHE.md` state it from one authority. Regression `tests/test_timeline_sample_cache_c3_129.py`, 11 assertions. **History:** open — and it opened with the answer already published, which is why it is cheap to attack and expensive to leave: `timeline`'s own `timings` say **82,9 % `measure:posture`, 13,8 % `materialise_tree`, 3,3 % `release_tree`, 0,0 % unattributed**. So this is not a `timeline` defect at all: it is `posture` paid five times over five materialised trees, and it makes the same substrate question `C3-127` asks — with the difference that here the five payers are one command, so the cache is intra-invocation and needs no cross-command contract. ⚠ **Do not reopen `B7`**: cross-tree cache reuse is healthy, the v3 assertion passes at 6,8×. Acceptance: `timeline --since HEAD~5` back inside +10 % of 155 950 ms on the audited corpus with `timings` still summing to 100 %, and `measure:posture` falling as a share rather than the total falling for an unnamed reason. |

sourcecode/_docs/USER_GUIDE.md

@@ -46,7 +46,7 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.8.17, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.8.18, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
@@ -108,7 +108,7 @@ human. They project the same semantic model into agent-ready context:
 | `ask prepare-context <task>` | Task-shaped context bundle (`onboard`, `review-pr`, `fix-bug`, `refactor`, `generate-tests`) sized for an LLM prompt. |
 | `ask repo-ir` | The low-level symbol IR itself — the raw semantic representation, for tools that want the graph, not a report. |
 | `ask --agent` | Agent-optimized output envelope for any command. |
-| `ask --compact` | A ~10K-token subset (status, stacks, entry points, key dependencies) for cheap orientation. |
+| `ask --compact` | A bounded subset (status, stacks, entry points, key dependencies) for cheap orientation. See `ask --help` for the current output budget. |
 | `ask mcp` | Runs ASK as an MCP server so an agent (Claude Desktop / Cursor) calls it as a tool. |
 
 Rule of thumb: **developer-facing** commands (`impact`, `spring-audit`, `endpoints`,
@@ -142,7 +142,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.17
+# ask 5.8.18
 ```
 
 Requires Python 3.9+.
@@ -240,7 +240,7 @@ ask . --compact --git-context   # includes commit hotspots
 ask . --compact --copy          # copy to clipboard
 ```
 
-Output (~2,500–4,000 tokens): detected stacks, entry points, dependencies, transactional boundaries (Spring), env vars, confidence level, analysis gaps.
+Output: detected stacks, entry points, dependencies, transactional boundaries (Spring), env vars, confidence level, analysis gaps. The current output budget is published by `ask --help`.
 
 ### `ask --agent`
 
@@ -251,7 +251,7 @@ ask /repo --agent --output context.json
 cat context.json | claude -p "Explain the architecture"
 ```
 
-Output (~4,500–5,500 tokens): project identity, entry points, file relevance ranking, architecture classification, confidence.
+Output: project identity, entry points, file relevance ranking, architecture classification, confidence. The current output budget is published by `ask --help`.
 
 ### `ask onboard` *(supported)*
 
@@ -1363,8 +1363,8 @@ reason to warm before the first prompt (`ask cache warm <path>`).
 
 | Mode | When to use | Token size |
 |------|-------------|-----------|
-| `--compact` | AI session start, high-level overview | 2,500–4,000 |
-| `--agent` | AI agent system prompt injection | 4,500–5,500 |
+| `--compact` | AI session start, high-level overview | See `ask --help` |
+| `--agent` | AI agent system prompt injection | See `ask --help` |
 | `onboard` | Task-structured agent/developer onboarding | ~2,600 |
 | `fix-bug` (trimmed) | Bug triage with token budget | ~4,600 |
 | `--full` | Raise the display caps (boundaries and DTO mappers in full, `file_relevance` to 40) | bounded, larger |

sourcecode/caller_metrics.py

@@ -50,6 +50,11 @@ POP_REFERENCES_WITH_IMPORTS = "references_including_imports"
 POP_REFERENCES_NO_IMPORTS = "references_excluding_imports"
 POP_ALL_EDGES = "all_incoming_edges"
 POP_TRANSITIVE_CHAIN = "transitive_chain"
+#: AUD-593-N01. `impact-chain` walks from a seed set expanded with the members of
+#: every interface the target implements (CH-001b), so its depth-1 callers include
+#: classes that name a sibling implementation and never name the target. That is a
+#: different population, not a different way of counting the same one.
+POP_EXPANDED_SEED_REFERENCES = "references_to_target_or_its_declared_interfaces"
 
 
 def caller_classes(symbols: Iterable[str], *, exclude: Iterable[str] = ()) -> set[str]:
@@ -103,13 +108,38 @@ FAN_IN_FIGURES: tuple[dict[str, str], ...] = (
         "unit": UNIT_CLASSES,
         "population": POP_TRANSITIVE_CHAIN,
         "means": "every class in the call chain, direct AND transitive — a reach "
-                 "figure, not fan-in; unbounded above by any direct-caller count",
+                 "figure, not fan-in. It is >= the chain's own depth-1 figure, "
+                 "and equal to it when the hub guard caps the walk at depth 1 "
+                 "(`depth_capped_by_guard: true`), which is declared in the same "
+                 "metadata block",
+    },
+    {
+        "key": "impact-chain.metadata.expanded_seed_caller_count",
+        "unit": UNIT_CLASSES,
+        "population": POP_EXPANDED_SEED_REFERENCES,
+        "means": "distinct classes calling the target OR any member of an "
+                 "interface it declares, at depth 1 of the chain walk; callers "
+                 "that inject the interface are the reason the chain expands its "
+                 "seed, and they name a type the target implements, not the "
+                 "target — so this is a wider population than `impact` admits",
     },
     {
         "key": "impact-chain.metadata.direct_caller_count",
         "unit": UNIT_CLASSES,
-        "population": POP_REFERENCES_NO_IMPORTS,
-        "means": "distinct classes calling the target at depth 1",
+        "population": POP_EXPANDED_SEED_REFERENCES,
+        "means": "the same interface-expanded figure as "
+                 "`expanded_seed_caller_count`, under the name it shipped with. "
+                 "It reads as a peer of "
+                 "`impact.stats.direct_caller_count` and is not one: measured 554 "
+                 "against 34 for one symbol at one HEAD (AUD-593-N01). Read the "
+                 "expanded name, and read `impact` for fan-in on the target alone",
+    },
+    {
+        "key": "impact-chain.via_interface_resolution[].caller_count",
+        "unit": UNIT_SYMBOLS,
+        "population": POP_EXPANDED_SEED_REFERENCES,
+        "means": "raw caller symbols for one interface bridge before callers are "
+                 "normalised to distinct classes",
     },
     {
         "key": "modernize.in_degree",
@@ -142,6 +172,18 @@ CALLER_METRIC_RECONCILIATION: str = _render_reconciliation()
 
 #: Kept for the payload key that was `callers_total` before it was named for what
 #: it counts. Consumers reading the old key get the same number and this note.
+#: AUD-593-N01. The key stays; what it claimed about itself does not.
+DIRECT_CALLER_COUNT_DEPRECATION: str = (
+    "metadata.direct_caller_count counts classes that call the target OR any "
+    "member of an interface the target declares — the chain walks from a seed "
+    "set expanded with those interfaces (CH-001b), which is why a caller that "
+    "injects the interface is found at all. It is therefore NOT the peer of "
+    "impact.stats.direct_caller_count, which admits only references naming the "
+    "target: the two were declared the same population and measured 554 against "
+    "34 for one symbol at one commit. It is superseded by "
+    "metadata.expanded_seed_caller_count, which says which population it is."
+)
+
 CALLERS_TOTAL_DEPRECATION: str = (
     "metadata.callers_total is the size of the whole call chain (direct + "
     "transitive), not a fan-in count; it is superseded by "

sourcecode/cli.py

@@ -293,7 +293,7 @@ EXPERIMENTAL_BASIS: "dict[str, str]" = {
 #: both directions at once.
 COMMANDS_THAT_WRITE: "tuple[tuple[str, str], ...]" = (
     ("baseline capture", "`<repo>/.ask/baselines/` (or `--dir`) — one JSON per capture"),
-    ("migrate-check", "`<repo>/.ask/readiness-history/` — only with `--history-dir`"),
+    ("migrate-check", "`<repo>/.ask/readiness-history/` — only with `--snapshot` (optionally relocated by `--history-dir`)"),
     ("verify", "`<repo>/.ask/contracts.yml` — only with `--init`, and not with `--dry-run`"),
     ("verify", "`<repo>/.ask/contracts-baseline.json` — only with `--capture-baseline`"),
     ("verify-edit", "the repository's git hooks directory — only with `--install-hook`"),
@@ -585,6 +585,17 @@ def _compact_budget() -> str:
     return compact_budget_phrase()
 
 
+# Keep the help claim tied to the commands that emit the budget preamble.
+_BUDGETED_ANALYSIS_COMMANDS = (
+    "ask (root)", "spring-audit", "verify --init", "verify", "risk",
+    "audit-report", "migrate-check", "migrate-apply",
+)
+
+
+def _budgeted_analysis_commands_phrase() -> str:
+    return ", ".join(_BUDGETED_ANALYSIS_COMMANDS)
+
+
 def _build_help_text(scope: "Optional[Any]" = None) -> str:
     """Build --help text dynamically based on current license state."""
     try:
@@ -618,8 +629,8 @@ scope matches; `ask cache model` says exactly what a warm buys per command.
 [bold]Performance / CI:[/bold]
   validation . --compact       [dim]# reuses the shared CIR on a warm matching scope[/dim]
   data-exposure .              [dim]# one semantic model is shared across declared label seeds[/dim]
-  ASK_MAX_ANALYSIS_SECONDS=N   [dim]# deadline only for spring-audit, risk, audit-report[/dim]
-  [dim]Other commands are not time-bounded by this variable; use `--progress` or `--detach` where offered.[/dim]
+  ASK_MAX_ANALYSIS_SECONDS=N   [dim]# deadline for {_budgeted_analysis_commands_phrase()}[/dim]
+  [dim]Other commands do not consume this budget; use `--progress` or `--detach` where offered.[/dim]
 
 [bold]Change and risk:[/bold]
   impact-chain <Class> .       [dim]# blast radius; TX/SEC findings opt-in[/dim]
@@ -1648,7 +1659,6 @@ _COMMAND_FALLBACK = {
     "migrate-check": "run inventory in CI and deep migration checks nightly",
 }
 
-
 def _build_analysis_classes() -> "dict[str, tuple[str, int, str]]":
     """Every command's analysis class, derived from the cost model (C4-19).
 
@@ -8871,10 +8881,19 @@ def plan_cmd(
     # Test-inclusive build: covering-test discovery needs the test→production call
     # edges, which only exist when test sources are in the graph (D3).
     _files = find_java_files(target_dir, include_tests=True)
-    _compare_scan_trunc = _last_scan_truncation()
+    # AUD-591-A06 / AUD-592-R01: read beside the walk that produced this list,
+    # and bound to the answer built from it. `plan` answers `resolution:
+    # not_found` and offers candidates; both are exclusions drawn from this
+    # population, so a walk that stopped at its cap has to say so here.
+    _plan_scan_trunc = _last_scan_truncation()
     _cir = ContextGraph.build(_files, target_dir, progress=_work_sink(_prog)).cir
     _prog.update("planning change")
     data = build_change_plan(_cir, target, max_depth=depth, root=target_dir)
+    if _plan_scan_trunc:
+        data["scan_truncated"] = _plan_scan_trunc
+    # The tree these components and candidates came from: `--path` defaults to
+    # `.`, so a run from the wrong directory answers about another repository.
+    data.setdefault("scope", {"path": str(target_dir)})
     _prog.finish()
 
     output = _serialize_dict(data, format)
@@ -8964,6 +8983,10 @@ def compare_cmd(
     # Test-inclusive build: the cost vector counts covering tests (tests at risk),
     # which need test→production call edges — same opt-in the `plan` command uses.
     _files = find_java_files(target_dir, include_tests=True)
+    # AUD-592-R01: read here, at this command's own call site. The assignment
+    # this line restores had landed in `plan_cmd`, so every `compare` raised
+    # NameError and the `scope` fix below it never ran.
+    _compare_scan_trunc = _last_scan_truncation()
     _cir = ContextGraph.build(_files, target_dir, progress=_work_sink(_prog)).cir
     _prog.update("comparing candidates")
     data = build_comparison(_cir, list(targets), max_depth=depth, root=target_dir)
@@ -11439,10 +11462,8 @@ def enrich_cmd(
         help=(
             "Report only enriched findings from this external rule id. Applies "
             "to every format, not only --table; the payload carries a `_filter` "
-            "block with `total_before_filter`. Not validated against a "
-            "catalogue: the ids come from the scanner's SARIF, not from this "
-            "build, so a selection that matches nothing reports `matched: 0` "
-            "against the population it searched."
+            "block with `total_before_filter`. The id must be present in the "
+            "scanner's SARIF findings."
         ),
     ),
     band_filter: Optional[str] = typer.Option(
@@ -11610,6 +11631,16 @@ def enrich_cmd(
     finally:
         _prog.stop()
 
+    if rule_filter:
+        _available_rule_ids = {
+            str((row.get("external") or {}).get("rule_id"))
+            for row in (data.get("findings") or [])
+            if isinstance(row.get("external"), dict)
+            and row["external"].get("rule_id")
+        }
+        if rule_filter not in _available_rule_ids:
+            _reject_selection_value("--rule", rule_filter, sorted(_available_rule_ids))
+
     if table:
         output = _render_enrich_table(
             data, rule_filter=rule_filter, band_filter=band_filter, top_n=top_n
@@ -11632,6 +11663,14 @@ def enrich_cmd(
         )
         if _sel is not None:
             data["_filter"] = _sel
+        if min_band != "low":
+            data["_filter"] = {
+                **(data.get("_filter") or {}),
+                "min_band": min_band,
+                "total_before_filter": data.get("defects", 0),
+                "matched": data.get("min_band_total", 0),
+                "shown": len(data.get("findings") or []),
+            }
         output = _serialize_dict(data, format)
     _emit_command_output(
         output,
@@ -12646,12 +12685,11 @@ def posture_cmd(
     from sourcecode.output_bounds import POSTURE_BOUNDED_LISTS, bound_lists, resolve_limit
 
     _posture_limit = resolve_limit(limit, compact)
-    # Compact posture keeps the verdict counts and drops the potentially large
-    # bodies. The cap is the actionable signal; retaining a representative row
-    # would make compact output depend on repository ordering and dilute the
-    # bounded contract.
+    # B-8 / AUD-592-B01. A compact answer must retain one actionable unresolved
+    # bean whenever the analysis found any, not only when the total is exactly 1.
+    # An explicit --limit still has precedence, including --limit 0.
     if compact and limit is None:
-        _posture_limit = 1 if data.get("summary", {}).get("unresolved", 0) == 1 else 0
+        _posture_limit = 1 if data.get("summary", {}).get("unresolved", 0) else 0
     bound_lists(data, POSTURE_BOUNDED_LISTS, _posture_limit)
 
     _emit_command_output(
@@ -13313,6 +13351,7 @@ def impact_chain_cmd(
     )
 
     file_list = find_java_files(target)
+    _chain_scan_trunc = _last_scan_truncation()
     if not file_list:
         data: dict = {
             "schema_version": "1.0",
@@ -13326,6 +13365,8 @@ def impact_chain_cmd(
             "confidence": "low",
             "metadata": {},
         }
+        if _chain_scan_trunc:
+            data["scan_truncated"] = _chain_scan_trunc
         output = _serialize_dict(data, format)
         _emit_command_output(output, output_path, copy,
                              success_msg=f"Impact chain written to {output_path}")
@@ -13347,6 +13388,8 @@ def impact_chain_cmd(
         from sourcecode.spring_event_topology import run_event_topology
         evt_result = run_event_topology(cir, symbol, model=_model)
         data = evt_result.to_dict()
+        if _chain_scan_trunc:
+            data["scan_truncated"] = _chain_scan_trunc
         _prog.finish()
         output = _serialize_dict(data, format)
         _emit_command_output(
@@ -13366,6 +13409,8 @@ def impact_chain_cmd(
     )
 
     data = result.to_dict()
+    if _chain_scan_trunc:
+        data["scan_truncated"] = _chain_scan_trunc
     # Same rule as `impact`: a file is a request for the whole answer (C2-2). An
     # explicit `--limit` still wins — the user asking for a cap on a file has said
     # so, and a default is not a request.

sourcecode/product_info.py

@@ -3,6 +3,8 @@
 from __future__ import annotations
 
 import os
+import subprocess
+from pathlib import Path
 
 PRODUCT = "ASK Engine"
 TAGLINE = "Actionable Software Knowledge Engine"
@@ -11,6 +13,26 @@ PUBLISHER = "Dominique Haroun"
 LICENSE_ID = "LicenseRef-ASK-Proprietary"
 
 
+def _build_commit() -> str:
+    """Read injected build provenance, or the package checkout's own HEAD."""
+    injected = os.environ.get("ASK_BUILD_COMMIT")
+    if injected:
+        return injected
+    package_root = Path(__file__).resolve().parents[2]
+    try:
+        result = subprocess.run(
+            ["git", "-C", str(package_root), "rev-parse", "HEAD"],
+            capture_output=True,
+            text=True,
+            check=True,
+            timeout=2,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return "unrecorded"
+    commit = result.stdout.strip()
+    return commit or "unrecorded"
+
+
 def build_provenance() -> dict[str, str]:
     """Return build facts without discovering state from the user's repository."""
     return {
@@ -18,5 +40,5 @@ def build_provenance() -> dict[str, str]:
         "publisher": PUBLISHER,
         "license": LICENSE_ID,
         "distribution": os.environ.get("ASK_DISTRIBUTION", "official"),
-        "build_commit": os.environ.get("ASK_BUILD_COMMIT", "unrecorded"),
+        "build_commit": _build_commit(),
     }

sourcecode/repository_ir.py

@@ -5870,6 +5870,18 @@ def _build_route_surface(
     # Phase 1: build per-class metadata (prefixes list) and own endpoint list.
     # "prefixes" is a list to support array @RequestMapping({"/v1/foo", "/v1/bar"}).
     class_info: dict[str, dict] = {}  # simple_name → {fqn, prefixes, own_endpoints}
+    # E-38: a project-local annotation can compose a class-level route prefix
+    # (for example @ApiController carrying @RequestMapping("/api")).
+    _meta_route_prefixes: dict[str, tuple[list[str], str]] = {}
+    for sym in symbols:
+        if sym.symbol_kind != "annotation":
+            continue
+        if "@RequestMapping" in sym.annotations:
+            _meta_args = sym.annotation_values.get("@RequestMapping", "")
+            _meta_route_prefixes[sym.symbol.split(".")[-1]] = (
+                _parse_route_paths(_meta_args, constants),
+                _route_path_expression(_meta_args, constants),
+            )
     # P1 FIX: class symbol lookup for security annotation inheritance
     class_sym_by_simple: dict[str, "SymbolRecord"] = {}
     for sym in symbols:
@@ -5888,6 +5900,12 @@ def _build_route_surface(
             args = sym.annotation_values.get("@Path", "")
             prefixes = _parse_route_paths(args, constants) if args else [""]
             _prefix_expr = _route_path_expression(args, constants)
+        else:
+            for annotation in sym.annotations:
+                _composed = _meta_route_prefixes.get(annotation.lstrip("@"))
+                if _composed is not None:
+                    prefixes, _prefix_expr = _composed
+                    break
         class_info[simple] = {
             "prefix_expression": _prefix_expr,
             "fqn": sym.symbol,
@@ -9248,6 +9266,10 @@ def compute_blast_radius(
                 _iface_bridging.append({
                     "interface": _iface_fqn,
                     "caller_count": len(_iface_callers),
+                    "caller_count_unit": "caller_symbols",
+                    "caller_count_population": (
+                        "references_to_target_or_its_declared_interfaces"
+                    ),
                 })
                 for c in _iface_callers:
                     if c not in all_affected:
@@ -10171,6 +10193,14 @@ def compute_blast_radius(
         # symbol from `medium` to `critical`.
         out["interface_mediated_callers"] = _iface_mediated_classes[:30]
         out["interface_mediated_caller_count"] = len(_iface_mediated_classes)
+        if len(_iface_mediated_classes) > 30:
+            out["interface_mediated_callers_cap"] = _cap_effect(
+                "display_list",
+                limit=30,
+                total=len(_iface_mediated_classes),
+                shown=30,
+                omitted=len(_iface_mediated_classes) - 30,
+            )
         out["via_interface_note"] = (
             "Target is a concrete class injected via interface(s) in a "
             f"{_di_label} DI framework. `interface_mediated_callers` reach it "

sourcecode/sarif.py

@@ -590,6 +590,8 @@ def enrich_sarif(
             "kind each row is."
         ),
         "shown": len(shown),
+        "min_band": min_band,
+        "min_band_total": len(kept),
         "by_band": by_band,
         **({"profile_set": sorted(composer.profiles)} if composer.profiles is not None else {}),
         "findings": [

sourcecode/spring_impact.py

@@ -28,6 +28,7 @@ from typing import TYPE_CHECKING, Optional
 from sourcecode.caller_metrics import (
     CALLER_METRIC_RECONCILIATION,
     CALLERS_TOTAL_DEPRECATION,
+    DIRECT_CALLER_COUNT_DEPRECATION,
     caller_classes,
 )
 from sourcecode.caller_reach import CALLER_CAP, SKIP_EDGE_TYPES
@@ -1628,10 +1629,29 @@ class ImpactOrchestrator:
                     caller_classes(direct_callers, exclude=seed_fqns)
                     | caller_classes(indirect_callers, exclude=seed_fqns)
                 ),
+                # AUD-593-N01: this walk starts from a seed set expanded with
+                # the members of every interface the target declares (CH-001b),
+                # so "direct" here admits classes that name a sibling
+                # implementation and never name the target. Measured 554 against
+                # `impact`'s 34 for one symbol at one HEAD — under a name that
+                # reads as the peer of `impact.stats.direct_caller_count` and a
+                # population tag that claimed to be the same. The figure is
+                # right; its name and its declared population were not.
+                "expanded_seed_caller_count": len(
+                    caller_classes(direct_callers, exclude=seed_fqns)
+                ),
+                "expanded_seed_caller_count_unit": "distinct caller classes",
+                "expanded_seed_caller_count_population": (
+                    "classes calling the target OR any member of an interface it "
+                    "declares. `ask impact` admits only references naming the "
+                    "target, so its direct_caller_count is a subset of this and "
+                    "the two are not comparable"
+                ),
                 "direct_caller_count": len(
                     caller_classes(direct_callers, exclude=seed_fqns)
                 ),
                 "direct_caller_count_unit": "distinct caller classes",
+                "direct_caller_count_note": DIRECT_CALLER_COUNT_DEPRECATION,
                 "direct_caller_symbol_count": len(direct_callers),
                 "direct_caller_symbol_count_unit": "direct caller list entries",
                 "indirect_caller_symbol_count": len(indirect_callers),

sourcecode/summarizer.py

@@ -276,7 +276,23 @@ class ProjectSummarizer:
         r"|\bno need to deal with\b"
         r"|\bwith minimum effort\b"
         r"|\bsign up\b.*\bevaluation\b"
-        r"|\bcontact us\b.*\bmore information\b",
+        r"|\bcontact us\b.*\bmore information\b"
+        # AUD-592-R02: the four standard boilerplates. This regex matched product
+        # tiers and marketing and carried no Apache/MIT/GPL/BSD pattern, so an
+        # Apache-2.0 header reached `project_summary` as the project description.
+        r"|\bapache licen[sc]e\b"
+        r"|\blicensed under the apache\b"
+        r"|\bversion 2\.0, january 2004\b"
+        r"|\bwww\.apache\.org/licenses\b"
+        r"|\bmit licen[sc]e\b"
+        r"|\bgnu (?:general|lesser) public licen[sc]e\b"
+        r"|\bbsd \d-clause\b"
+        r"|\bredistribution and use in source and binary forms\b"
+        r"|\bterms and conditions for use, reproduction\b"
+        r"|\bpermission is hereby granted, free of charge\b"
+        r"|\bwithout warranties or conditions of any kind\b"
+        r"|\bcopyright \(c\)\s*\d{4}"
+        r"|\bunless required by applicable law\b",
         __import__("re").IGNORECASE,
     )
 
@@ -310,10 +326,18 @@ class ProjectSummarizer:
         _BADGE_RE = _re.compile(r"^\[?!\[")  # [![badge](...)] or ![img](...)
         _LINK_ONLY_RE = _re.compile(r"^\[.*?\]\(.*?\)$")  # pure link line
 
+        # AUD-592-R02: a horizontal rule is a separator in every width. The
+        # usefulness floor is a length test, so a rule of exactly 30 dashes was
+        # long enough to be published as the description of the project.
+        _RULE_RE = _re.compile(r"^(?:-{3,}|={3,}|\*{3,}|_{3,})$")
+        # Setext underlines: the line above them is a heading, not content.
+        _SETEXT_RE = _re.compile(r"^(?:=+|-+)$")
+
         paragraphs: list[tuple[str, str]] = []
         current_lines: list[str] = []
         current_heading = ""
         in_code_block = False
+        in_html_comment = False
 
         def _flush() -> None:
             nonlocal current_lines
@@ -323,6 +347,14 @@ class ProjectSummarizer:
 
         for raw_line in content.splitlines():
             line = raw_line.strip()
+            # An HTML comment spans lines. Detecting only its opening line —
+            # three lines below where `in_code_block` does exactly this for
+            # fences — let a `<!--` licence header on line 1 flush, and lines
+            # 2-15 of the licence become the README's first paragraph.
+            if in_html_comment:
+                if "-->" in line:
+                    in_html_comment = False
+                continue
             if line.startswith("```"):
                 in_code_block = not in_code_block
                 continue
@@ -332,7 +364,22 @@ class ProjectSummarizer:
                 _flush()
                 current_heading = line.lstrip("#").strip()
                 continue
-            if not line or line.startswith(("<!--", ">")):
+            if line.startswith("<!--"):
+                _flush()
+                if "-->" not in line:
+                    in_html_comment = True
+                continue
+            # A setext underline retitles the line above it. Without this, a
+            # README whose title is underlined with `===` has no heading at all
+            # and its title is content.
+            if current_lines and _SETEXT_RE.match(line):
+                current_heading = current_lines.pop().strip()
+                _flush()
+                continue
+            if _RULE_RE.match(line):
+                _flush()
+                continue
+            if not line or line.startswith(">"):
                 _flush()
                 continue
             # Treat HTML-markup-only lines (<img .../>, <p align=...>, <a><img></a>)
@@ -379,9 +426,16 @@ class ProjectSummarizer:
             cleaned = self._clean_inline_markup(paragraph)
             if len(cleaned) < 30:
                 continue
+            # AUD-592-R02: say which paragraph this is and what was checked,
+            # not that the result is descriptive. The unconditional
+            # "README descriptive prose" asserted a property of the text over
+            # whatever survived the filters — including an Apache header.
             self.summary_basis = (
-                f"README descriptive section: {heading}" if heading
-                else "README descriptive prose"
+                f"README section '{heading}', first paragraph passing the "
+                "licence, marketing, operations, startup and tool-output filters"
+                if heading else
+                "README lead paragraph, passing the licence, marketing, "
+                "operations, startup and tool-output filters (no heading above it)"
             )
             return cleaned
         return None

{sourcecode-5.8.17.dist-info → sourcecode-5.8.18.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.17
+Version: 5.8.18
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -55,7 +55,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.17-blue)
+![Version](https://img.shields.io/badge/version-5.8.18-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -125,7 +125,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.17 retains the shared Canonical IR
+**Current performance status.** Release 5.8.18 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -159,7 +159,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.17 — and, on a build that has aged,
+ask version                    # ask 5.8.18 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.17.dist-info → sourcecode-5.8.18.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=bczi04jMzMOQ5s5PXRmFAX_OMdjbE3ZRYlBagr1hDU4,309
+sourcecode/__init__.py,sha256=YsPRdjH3wWeYUXkz4KK3Vv0rjKRxj2E6IDH0VNm4MdU,309
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/answer_bounds.py,sha256=_51_DCuYEUmI_xwUFxDMiprSavkNakkLiIBbPjevQ3M,9793
 sourcecode/archetype.py,sha256=V_s5grgpbanrXb8qGEQb73W5Cg5iKW9FQHWKgg5KM8Y,41201
@@ -18,7 +18,7 @@ sourcecode/bundled_docs.py,sha256=hvQeUNDo9SEp_Mtf6o9bexKUmJ8YW76rXKn9spRfQQs,25
 sourcecode/cache.py,sha256=fozQb7ohE8TwwOhEcxA0lwsmvIuZNW7jxAeiget50z4,43471
 sourcecode/cache_model.py,sha256=_q6CJV4PksQRxNkCIwQ8hEj8yePiU5460rDoaoGAtgo,62032
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
-sourcecode/caller_metrics.py,sha256=--sFGDnIog_YGu9xZHMcB91F5xZakfaAKvy15xU54hg,7904
+sourcecode/caller_metrics.py,sha256=6eXgmqToa6_a-bb3jYw9NAn4hvgbYHdlUErSpiSbO2g,10464
 sourcecode/caller_reach.py,sha256=M7Ffs5CtlimihfdSy3HtC4WpDP97bRFX15QYOlOfMJw,16626
 sourcecode/canonical_ir.py,sha256=rBgl7bbj529qvzal_c9yMyGXcwyMeoJCFcOU3vtgBJY,36797
 sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,12767
@@ -26,7 +26,7 @@ sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,129
 sourcecode/ci_output.py,sha256=un1GjW0iw9hQA9g-7xpOseBxctQIrAic57WKxTbIGNA,2457
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=QfgH33kjrAN0l7mq4OOKhAA1YXYYjOe82i5OLG3xroE,773533
+sourcecode/cli.py,sha256=X1rwFmlTE8jwh27681UZZTTeuUUcg6jmhKDv9yQKV-8,775596
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=FeDsbf7VACLcc6muA9mx_3iHmlDyq7QFqGPYGme9jtY,15141
@@ -110,7 +110,7 @@ sourcecode/posture.py,sha256=6Rg4s-OUBYhXFlsVIbU_8H_bDB15zPjkhSNGzq3kUfs,85077
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
 sourcecode/pr_impact.py,sha256=taHp0X57tLHyKQ5Qvx7UM1HhX4_csw5t0bgLdN7jYm8,37010
 sourcecode/prepare_context.py,sha256=Dc31QYmhgsvLvPav4py4E0RK_QBlj5K8oJ5TFn9ATi8,240881
-sourcecode/product_info.py,sha256=0zjZEutL7iDdp9aVyIumIrNyNn9VWYFc2lIytSbjBP4,727
+sourcecode/product_info.py,sha256=SQPELTh7hI3nMOsxImJesI4_XUFwCDgb9jTUqwv0GJA,1360
 sourcecode/progress.py,sha256=naKbWFqf-eTE3vtLsi-eHYILz0p3pxCASAzMmvxUIAI,21643
 sourcecode/provenance.py,sha256=gLbsLv0gze7k7ChM4i5M3MwKfFPzs8wzM72rUd2C5sM,7342
 sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,12970
@@ -126,7 +126,7 @@ sourcecode/remediation_diff.py,sha256=fGYqPmQF7bO54L8ivztX5PgmW4fVu54gNcG6OEQ192
 sourcecode/remedies.py,sha256=V2_cD4pLq8bKRkzF-3RGFoiu1xWYZS384WDVp1MrlZw,10225
 sourcecode/rename_refactor.py,sha256=MOTsNqukDpDhAXRPx5skWzdAD-junM4H9tks8deKDVI,13447
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=zQNyWwMQeOdgOH5UB154JdETkKSBqfhq7sOF1JlpNdg,501923
+sourcecode/repository_ir.py,sha256=qLby9Kj4HqJuy6Rb7uNzo-ms7WXJVYLs27m6cED4SNc,503332
 sourcecode/ris.py,sha256=zlns4esv1tK8VDIYzOzRmw5yM6VLx7oxaPNB_kN3it4,28617
 sourcecode/risk.py,sha256=4Hu84_l8HnakAOIJcJJWAXg8IU_KZIGRvPXvEbJr0zo,90363
 sourcecode/risk_model.py,sha256=RoC-G15qZP5BLEwwmcr4eJ0APgvIbh1WTqhTVT-5YFE,10895
@@ -134,7 +134,7 @@ sourcecode/rule_catalog.py,sha256=QCx6ToFTMCtDt5uuX1uBMLuw3b9Cd92gGRsX34kud4U,53
 sourcecode/rule_pass.py,sha256=DTNxD-nAecMJhIzI1LCd9FyRumInQSZjitacNh4Zoc8,14671
 sourcecode/runs.py,sha256=o4oXkB3WFJGScbK_C10OAWzsE18B9Zc55u_IE8_yl4M,6291
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
-sourcecode/sarif.py,sha256=3hQEegUxIZbojFdY59oB-yKsK-rnafHdTNmYsEP2--A,25984
+sourcecode/sarif.py,sha256=AfsaOTwPE5KCxEEF14-W-n5Jn6Npfu_MhjFWtysMdUU,26051
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=61Ux_qRITs_orcrZM20ctV2k1ZfzauqqMgJlZJYAEbE,25087
 sourcecode/schema_producers.py,sha256=4XzW4wZXnFHOaJT7XenirXGCo0pPZhkdhb7zcDtqFnM,10390
@@ -153,7 +153,7 @@ sourcecode/servlet_surface.py,sha256=CeiebkxLXKojUQxIf7HV7tdQAwLM32ggDUwBnVQIjdo
 sourcecode/source_text.py,sha256=R52gmSljz7L6YVPbixv5W-LOZ5eKUVvSUP3S-QH_IWc,9047
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=6Obf69EevvRL1sHZaoeIMrui5HH8oFyS_OSUO0W1tCQ,26242
-sourcecode/spring_impact.py,sha256=ORAWTLGoOKU0qJkfseeI2hV53jMKjvrXKVIg7CZo6pY,91096
+sourcecode/spring_impact.py,sha256=dTmsAwsbUyxD9LAmTz5RQodeqWcW64rhF0IM-4SuZXM,92418
 sourcecode/spring_model.py,sha256=-wjfNP6XCcPgdkZr7jpj2CHRqWf8qB542ns-hs0nSEY,24713
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
@@ -161,7 +161,7 @@ sourcecode/spring_security_audit.py,sha256=Zs26iJRlLPS9pOYoNraM7I1fZteoTaJbSwCrz
 sourcecode/spring_semantic.py,sha256=zrUYWF7Gnz6hpP_3hRveHmGEntT95WpgXt6u7PzLSGg,16835
 sourcecode/spring_tx_analyzer.py,sha256=zpGea2RXWiyEdT-eg1jGrywhqRFuN5VG9MAF6rIKweI,50466
 sourcecode/sql_taint.py,sha256=As1DbEdjXMBFjCTXU5ojksOzuKkP6LmnuMVnzzmckzc,26998
-sourcecode/summarizer.py,sha256=8PoGDKjjmGNJ4fZnqsHAV_jo_99Q3_IQy6zx_47jW50,30165
+sourcecode/summarizer.py,sha256=t8m77JJhPSIZtpvGptHygeL-WMSaWLq9DcWFCXKY-SI,33061
 sourcecode/target_admission.py,sha256=wFZ4pzlxhiF6Q6s2lEAZEzcCfj1Y6xNvujjt8MdO0Qo,7154
 sourcecode/test_gap_ranking.py,sha256=hl-tTyQUXZGJycG1b6npbLeE_DaVHaOsvPwG9qqC5y8,15711
 sourcecode/test_sources.py,sha256=KM88qbMfLDmUV5X2nA83LjYz8A2ipj4A_2u2FhZx8gc,9440
@@ -243,13 +243,13 @@ sourcecode/telemetry/consent.py,sha256=-Wb8BFGXEexOs8M0Eja7F-T6ZtLNPeRoZnHcHvlP7
 sourcecode/telemetry/events.py,sha256=l3Z2SQUO4_C2D2ItXOOdVNimAmHedUHnUxqYFTxnsAE,2900
 sourcecode/telemetry/filters.py,sha256=-lqT2oorECuqEIdeHb--7AZ6BCaUx0bya720a-Z5x6w,7335
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=DPfdl22qA8QXCNpsUfTWSJnOhaDZ7y7brn2TZaY4LaQ,781688
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=253tOgQyij_eor4Kgto143F9ATSPfaqSoXomUCiZOEo,809733
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=gRQMS79BEfQNa2uFrKZp4WVkbhQ3bW73wZ4WdzAjoYg,90158
-sourcecode-5.8.17.dist-info/METADATA,sha256=vGKXjN6u3zK87j5QC4mPyz0--nGdJ1u9XPb5PV8GoNA,53019
-sourcecode-5.8.17.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.8.17.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.8.17.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.8.17.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.8.17.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=_t_OWeMLWJknKqNJ7fYowf0QKSUKwM_Pqeb92b0Ofvs,90273
+sourcecode-5.8.18.dist-info/METADATA,sha256=uXRN8oHMzTmLhr51wLtnp2evzHU_n9KhYfW5b8pZlko,53019
+sourcecode-5.8.18.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.8.18.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.8.18.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.8.18.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.8.18.dist-info/RECORD,,