sourcecode 5.8.17__tar.gz → 5.8.18__tar.gz

{sourcecode-5.8.17 → sourcecode-5.8.18}/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [5.8.18] — 2026-08-21
+
+*The eighth audit pass is closed. Every reported fix in that queue is shipped in
+an atomic commit with a focused regression assertion; the release battery passes
+except for the pre-existing RIS B11 test failure documented in the release check.*
+
+### Eighth audit pass closure
+
+- Fixed caller-count authority drift, compact unresolved samples, scan-truncation
+  disclosure, and the meta-annotation route prefix. (`AUD-593-N01`, `AUD-592-B01`,
+  `AUD-592-A02`, `E-38`)
+- Reconciled the compact budget across help and documentation, and corrected the
+  budget scope, interface-count metadata, and caller-list cap disclosures.
+  (`AUD-593-N02`, `AUD-593-N03`, `AUD-593-N05`, `AUD-593-N06`)
+- Corrected write-inventory wording, min-band filter disclosure, unknown enrich
+  rule handling, and build-commit provenance. (`AUD-592-D01`–`D04`)
+- Isolated the compact-cache test so the CLI regression battery is deterministic.
+  (`B29`)
+
 ## [5.8.17] — 2026-08-21
 
 *The seventh audit pass, closed end to end: eleven rows from P0 to P3 plus the

{sourcecode-5.8.17 → sourcecode-5.8.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.17
+Version: 5.8.18
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -55,7 +55,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.17-blue)
+![Version](https://img.shields.io/badge/version-5.8.18-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -125,7 +125,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.17 retains the shared Canonical IR
+**Current performance status.** Release 5.8.18 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -159,7 +159,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.17 — and, on a build that has aged,
+ask version                    # ask 5.8.18 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.17 → sourcecode-5.8.18}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.17-blue)
+![Version](https://img.shields.io/badge/version-5.8.18-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -80,7 +80,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.17 retains the shared Canonical IR
+**Current performance status.** Release 5.8.18 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -114,7 +114,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.17 — and, on a build that has aged,
+ask version                    # ask 5.8.18 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.17 → sourcecode-5.8.18}/docs/DEFECT-LEDGER.md

@@ -16,7 +16,30 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**Latest attached audits — release `5.8.16`, 2026-08-21, two independent rounds.**
+**Latest attached audits — release `5.8.18`, 2026-08-21, two independent rounds, and the
+first pass since 5.8.2 that opens with a regression.** Round A (`saint-server`/MSAS,
+3 342 Java files, 17 commands, 29 invocations, same HEAD as the previous round bit for
+bit) scores **8.77/10** — up from 8.21 — with **zero false statements about the
+repository for the second consecutive run**, 6 of 6 reported defects closed and verified
+from outside, and **five new contract defects, four of them the same class as the fix that
+preceded them**. Round B (a 12-repository bank, ~150 invocations, the §7 measurement
+protocol applied: idle host, interleaved, ×3, median, cache state declared per row) closes
+**8 of the 10 new rows and 2 of the 9 inherited ones**, records **zero content regressions
+and no performance row above the ×1.25 threshold**, and finds **two regressions, one of
+them a P0**: `compare` is dead in every valid invocation with an unhandled `NameError`,
+and `project_summary` publishes an Apache licence header as the description of the project
+on 3 of 8 repositories.
+
+**The two rounds agree on the shape of what is left, and it has moved again.** The
+previous pass ended with contracts that were *absent*; this one ends with contracts that
+*contradict each other across authorities*: two homonymous fields declaring the same unit
+and the same population and differing 16×, one budget published three times with three
+values, a help page denying a scope the fix beside it granted, and two ledger rows marked
+`closed` that do not reproduce as closed in the field. **A row marked closed that is not
+closed is worse than an open one — nobody looks at it again** — so those are carried at P1
+below rather than left in their original sections.
+
+**Previous attached audits — release `5.8.16`, 2026-08-21, two independent rounds.**
 Round A (`saint-server`, 3 342 Java files, 17 commands, 25 invocations) scores **8.21/10**
 with **zero false statements about the repository** and two contract defects. Round B (a
 16-repository bank, 49 to 24 073 Java files, **240 invocations, 0 crashes, 0 tracebacks**)
@@ -28,10 +51,11 @@ previously open defects by correction with **zero regressions among the inherite
 
 Both rounds agree on where the product now fails, and it is not the Java/Spring analysis:
 it is the contract an agent consumes programmatically — the write guard, repository
-identity, list units, flag scope, and published budgets. The seventh-pass section below is
-the only current queue; older rounds remain for traceability.
+identity, list units, flag scope, and published budgets. Its queue is closed in `5.8.17`;
+**the eighth-pass section below is the only current queue**, and older rounds remain for
+traceability.
 
-**Mechanisms confirmed in source during intake** (not taken on the reports' word):
+**Mechanisms confirmed in source during the seventh-pass intake** (not taken on the reports' word):
 `verify --init` writes with no `readonly.guard` (`cli.py:10706-10708`) while five sibling
 writers guard; `spring-audit` derives `repo_id` from the CIR content hash
 (`spring_security_audit.py:1416`, `spring_tx_analyzer.py:1081`) while every other surface
@@ -52,10 +76,13 @@ itself rather than merely under-declaring.
 **Release status:** entries marked “pending `5.8.14`” in their historical wording are
 shipped in `5.8.14`; the correction battery fixes listed above are included in `5.8.15`.
 
-**Current release:** `5.8.16` includes two post-audit corrections: compact cold-start
-identity is preserved for `no_ris`, and manifest-cache keys include Python requirements
-files. The testing-repository hygiene exercise changed no external repository; it
-completed 108/108 read-only workflow runs with valid JSON and exit code 0.
+**Current release:** `5.8.18` closes the whole eighth-pass queue, one commit per row, and
+includes the targeted release battery. `5.8.17` before it carried the seventh-pass queue;
+`5.8.16` before that carried two post-audit
+corrections: compact cold-start identity is preserved for `no_ris`, and manifest-cache keys
+include Python requirements files. The testing-repository hygiene exercise changed no
+external repository; it completed 108/108 read-only workflow runs with valid JSON and exit
+code 0.
 
 The battery also closed the following reproducible contract defects in `5.8.15`:
 `migrate-apply` is registered across help, progress, path-admission, output-purity,
@@ -73,6 +100,107 @@ with neither parseable stdout nor its requested artifact) or `BUG-6`
 queue position. `BUG-1` and `BUG-5` gain witnesses on public OSS repositories, recorded
 under their own rows rather than as new ones.
 
+### Eighth Audit Pass: `5.8.17` findings, closed in `5.8.18` / MSAS + 12-repository bank / 2026-08-21
+
+The current queue. Ordered as the correction order: **regressions first, then the rows a
+previous pass marked closed that the field does not reproduce as closed, then new contract
+defects, then residuals.** Canonical IDs are `AUD-592-*` (bank round, reporter IDs `A-*`,
+`B-*`, `N-*`, `D-*`) and `AUD-593-*` (MSAS round, reporter IDs `N-0*`). Rows held elsewhere
+in this ledger are listed after the table as mappings, not as new defects.
+
+| ID | Severity | Current status | Required direction |
+|---|---|---|---|
+| `AUD-592-R01` / `A-1` | **P0 — regression** | **open, confirmed in source, and it is two defects from one error.** `compare` raises `NameError: name '_compare_scan_trunc' is not defined` on **5 of 5 valid invocations** — Rich traceback on stderr, zero bytes on stdout, no error envelope, exit 1 — ending a 240-invocation streak with no traceback. The assignment introduced by `AUD-591-A06` landed **inside `plan_cmd`** (`cli.py:8874`, beside `plan`'s own `find_java_files` at `:8873`) while the read is in `compare_cmd` (`cli.py:8972`); the two functions are `8818-8901` and `8903-9002`. Verified by reading the source at HEAD, not from the report. Second effect: `plan` computes its truncation state and **discards it** — nothing in the payload carries it, so `plan` answers `resolution: not_found` over a walk that stopped at its cap, offering candidates from a different repository. Third effect: `compare`'s other `AUD-591-A06` fix, `data.setdefault("scope", ...)` at `cli.py:8975`, is **after the line that raises** and has never executed, so the cross-repository candidate leak is still undeclared. | Read `_last_scan_truncation()` at `compare`'s own call site, immediately after `cli.py:8965`; rename the `plan_cmd` variable to `_plan_scan_trunc` and **bind it to the payload** — an unused walk-state variable is the defect, not the fix. Regression: an AST assertion that no `_*_scan_trunc` name is read in a `FunctionDef` that does not assign it, plus one execution test per command that owns a walk. A unit test that imported `compare_cmd` would not have caught this; one that *calls* it would. |
+| `AUD-592-R02` / `N-4`, reopens `AUD-513-N04` | **P1 — regression** | **open, confirmed in source, on 3 of 8 repositories (37,5 %), in `--compact` and `--agent` alike.** `project_summary` publishes an Apache-2.0 licence header as the description of the project (struts), a 30-character horizontal rule (halo) and a setext underline (shopizer) — and `summary_basis` asserts `"README descriptive prose"` over all three. In 5.8.16 this field was `null` with `"no descriptive section found in README"`, the literal acceptance text of `AUD-513-N04`; the field went from honest to false. Mechanism, four separate holes, all read at HEAD: HTML comments are detected **only on their opening line** (`summarizer.py:335-337`) with no `in_html_comment` state — three lines above, `in_code_block` does exactly that for fences (`:326-330`) — so `<!---` on line 1 flushes and lines 2-15 of the licence become the first paragraph; headings are ATX-only (`:331`), so setext titles underlined with `===` are content; the short-fragment floor is `len(paragraph) < 30` **strictly** (`:359`), so a rule of exactly 30 dashes survives; `_LICENSE_MARKETING_RE` (`:266-281`) matches product-tier and marketing phrasing and **carries no Apache/MIT/GPL/BSD boilerplate pattern at all**; and `summary_basis` is assigned unconditionally to whatever paragraph survives the filters (`:382-385`) — a restatement of the code path, not a property that was checked. | Add `in_html_comment` symmetric to `in_code_block`; recognise setext underlines as headings, not content; extend the licence regex with the four standard boilerplates; and make `summary_basis` describe the path actually taken — where nothing is verifiably descriptive, `null` plus the 5.8.14 text. **The mechanical cause of the reopening is that no README fixtures exist**: add the three witnesses from the bank as fixtures (HTML licence comment, 30-character rule, setext `===`) in the same commit as the fix. |
+| `AUD-593-N01` / `N-01` | **P1** | **open, and it falsifies the closure assertion of `AUD-590-B02`.** For one symbol, one tree, one HEAD, consecutive invocations, both at `depth=4`: `impact` publishes `direct_caller_count: 34` (210 reference sites) and `impact-chain` publishes `554` (3 103), both under the literal unit `"distinct caller classes"`. The product's own comparability rule (`CALLER_METRIC_RECONCILIATION`) is *"two figures are comparable only when both match"* — they match, and differ 16×. **The authority is what is wrong, not only the number**: `FAN_IN_FIGURES` (`caller_metrics.py:80-110`) declares both rows `unit=distinct_classes, population=references_excluding_imports`, and the populations are not the same. Measured mechanism: `impact-chain` expands the seed set with every member of the interfaces the target implements (CH-001b, `spring_impact.py:1110-1135`) and then takes depth 1 **from the expanded seeds** (`caller_reach.py:309-336`), so its "direct" includes callers that name a sibling implementation; `impact` admits only references that name the target and keeps interface-mediated callers on a separate axis (`repository_ir.py:9263`, `:9596-9606`). Corroborating symptom: `chain_classes_total`, declared *"unbounded above by any direct-caller count"*, equals `direct_caller_count` exactly (554), and `indirect_callers` is `[]` — that emptiness is the hub guard capping the walk to depth 1 (`caller_reach.py:319-321`) and **is** declared, so it is not a confident zero. The published closure assertion `len(impact.direct_callers) == chain.metadata.direct_caller_count` measures 30 (list, capped from 34) against 554: it passes on a fixture where the two coincide by accident. | Decide which figure the `direct_caller_*` namespace owns, and fix the **catalogue** either way: either `impact-chain` measures depth-1 fan-in on the unexpanded seed (≈34), or the figure is renamed out of that namespace and its `population` becomes its own tag — an interface-expanded seed set is not `references_excluding_imports`. Regression is parametric over the catalogue, not over `CommonService`: for every pair of `FAN_IN_FIGURES` rows sharing `(unit, population)`, the emitted values must be equal, run over ≥3 symbols of different fan-in **including one that trips the hub guard** — the condition under which the divergence appears, and the reason two previous corrections of this class (`callers_total`, `P0-2`) closed a name and left the divergence. `chain_classes_total ≥ direct_caller_count` with strict inequality wherever uncapped transitive reach exists. |
+| `AUD-592-B01` / `B-8` | **P1 — closed row that does not reproduce as closed** | **open; the ledger row overstates its own fix.** `B-8` is recorded as *"compact posture retains one unresolved sample when the total is non-zero"* (`52593b6`). The code retains a sample only when the total is **exactly one**: `_posture_limit = 1 if summary["unresolved"] == 1 else 0` (`cli.py:12653-12654`). Field measurement on `mall`: `summary.unresolved: 3`, `unresolved: []`, `unresolved_cap: {total: 3, shown: 0, omitted: 3, limit: 0}` — and it is the only cap in that payload with `limit: 0` while `undecided_cap` and `evidence_cap` carry 200. `--limit 10` returns all three, so the analysis is intact and only the compact contract is wrong. | Either make the code do what the row says (retain ≥1 sample whenever `summary.unresolved > 0`) or correct the row to the narrower promise and reopen the defect it leaves. Do not leave `closed` standing over `shown: 0`. Add an assertion that no `cap_effect` receives `limit=0` by default on a path where `--limit 0` is published as *"no cap"* (`AUD-513-N08`), so the published semantics and the internal default cannot invert each other. |
+| `AUD-592-A02` / `A-1` second half, `§12.5` | **P2** | **open — scan truncation is declared by 1 of 4 commands that own a walk.** Over a truncated scan (cap observed at **8 000 files**), `impact` publishes `scan_truncated`; `plan` and `impact-chain` answer `not_found` with `scan_truncated: null`, and `endpoints` exits 1 with no payload — every one of them an exclusion derived from an incomplete population. `compare` cannot be measured (`AUD-592-R01`). Second, narrower defect in the same row: the root `--help` describes the cap as *"the scan stopped at 25 000 directory entries"* — a different limit in a different unit from the 8 000-file cap the field observes. | Publish the truncation beside every walk that can end in `not_found`, `candidates` or a census — the seventh pass already recorded that `extract_java_endpoints` does its own uncapped `rglob`, so this must be read at each call site, never centrally. Reconcile the two caps in the help text or declare both with their units. |
+| `AUD-593-N02` / `N-02` | **P2** | **open — the `--compact` budget is published three times, in two shipped authorities, with three values.** `ask --help` generates *"~7K tokens (30 KB, chars/4)"* from `output_budget`, the module that enforces the limit — this half is the `AUD-590-B03` fix and it is correct. The packaged `docs/USER_GUIDE.md` is still hand-maintained and disagrees with it twice: `:111` *"A ~10K-token subset"* and `:243` / `:1366` *"~2,500–4,000 tokens"*; `--agent` carries a fourth figure at `:254` / `:1367` (*4,500–5,500*). Measured payload: 22 390 B ≈ 5 597 est. tokens — inside the help ceiling, **+40 % over the guide's table**. `grep '7K tokens' *.py` finds no literal: the help is generated and the guide is not, and that asymmetry is the defect. | Generate every token figure in the packaged docs from `output_budget.token_estimate`, or delete them and point at `--help`. Extend the existing release assertion (today help ↔ payload ↔ section registry) to cover `docs/*.md`: a token band in a shipped `.md` that does not come from that module fails the battery. Packaged documentation is a published authority and belongs inside the same assertion as the help text. |
+| `AUD-593-N03` / `N-03` | **P2** | **open — `--help` denies the scope that `AUD-590-B04` had just granted.** With `ASK_MAX_ANALYSIS_SECONDS=90` the root analysis prints *"ask is a repo-wide analysis and the configured budget is 90s. Budget read from ASK_MAX_ANALYSIS_SECONDS=90 (process environment)"* — the fix works. The help page beside it still reads *"deadline only for spring-audit, risk, audit-report"* and *"Other commands are not time-bounded by this variable"* (`cli.py:621-622`). The root analysis is the most expensive command in the product and the one an agent most needs to bound; a reader of the help will not set the variable there. | Generate that line from the same registry `_build_analysis_classes` populates (the root is keyed there as `B14`), never by hand. Assertion: the set of commands the help names equals the set the preamble emitter covers. |
+| `AUD-593-N05` / `N-05` | **P3** | **open — a figure emitted outside the catalogue that forbids it.** `via_interface_resolution[].caller_count` publishes 37 where every other surface of the same fact says 23 (`interface_mediated_caller_count`, the list length, and the `explanation` prose), and it carries no `_unit` while the rest of the payload does. Both are legitimate and neither is declared: `caller_count` is `len(_iface_callers)` — raw caller symbols of the interface, before the `not in all_affected` filter and before normalisation to classes (`repository_ir.py:9248-9251`); the 23 is `caller_classes(_iface_mediated_callers, ...)` (`:9603`, `:10173`). It is also **not in `FAN_IN_FIGURES`**, which states that a figure absent from it may not be emitted — so `tests/test_fan_in_authority.py` did not catch a fan-in figure added in this release. | Give it a unit and a `FAN_IN_FIGURES` row, or rename it to `interface_caller_symbols`. Make the authority test sweep the **emitted** keys against the catalogue rather than the catalogue against itself; a catalogue that only validates its own rows cannot see an unregistered emission. |
+| `AUD-593-N06` / `N-06` | **P3** | **open, latent — a silent `[:30]` where every sibling list declares its cap.** `out["interface_mediated_callers"] = _iface_mediated_classes[:30]` (`repository_ir.py:10172`) with no `*_cap` block, in a payload where `direct_callers_cap`, `indirect_callers_cap` and `security_surface_affected_omitted` all carry `total`/`shown`/`omitted`/`direction`/`how_to_read`. On MSAS the list is 23, so nothing is visible; the first repository with more than 30 interface-mediated callers loses the excess without a word. | Route it through the same `_cap_effect(...)` used 27 lines above (`repository_ir.py:10145`). |
+| `AUD-592-D01` / `D-1` | **P3 — residual of `AUD-591-A08`** | **open, confirmed in source.** The write inventory in the root help says `migrate-check` writes *"only with `--history-dir`"* (`cli.py:296`). `--history-dir` only relocates the destination; the flag that writes is `--snapshot`, as `migrate-check --help` states correctly and as the code comment at `cli.py:12980-12986` states explicitly. Verified in the field: `migrate-check --history-dir <path>` exits 0 with zero writes and no guard message, while `--snapshot` fires the guard correctly. `AUD-591-A08`'s assertion checks that each cited flag **exists** in that command's parser — `--history-dir` does — not that it is the flag that triggers the write. | Key the inventory on `(command, triggering flag, path)` taken from the guard site itself, as `AUD-591-A08`'s own acceptance text required. An auditor tests what the inventory lists: this is the same mechanism by which `AUD-591-A01` went unfound. |
+| `AUD-592-D02` / `D-2` | **P3 — residual of `AUD-591-A02`** | **open.** `--min-band` filters and validates (`cli.py:11294-11308` in `risk`, `:11563-11568` in `enrich`) but publishes no `_filter` block, while its sibling `--band` publishes one through `_apply_selection`. A consumer cannot tell a filtered answer from a small one. | Route `--min-band` through `_apply_selection` like every other selection flag, or publish the same `_filter` shape from wherever it is applied. |
+| `AUD-592-D03` / `D-3` | **P3 — residual of `AUD-591-A02`** | **open.** `enrich --rule NOPE-999` exits 0 with an empty result; `spring-audit --rule NOPE-999` exits 1 against the rule catalogue. One flag name, two contracts. Measured with a synthetic SARIF 2.1.0 (2 results): `--rule`, `--band` and an invalid `--band` all behave correctly in `enrich`; only unknown-rule validation is missing. | Validate against the same catalogue in both commands. `enrich` is experimental-tier, which sets the severity, not the contract. |
+| `AUD-592-D04` / `build_commit` | **P3 — process** | **open, fourth consecutive report.** `ask version` publishes `build_commit: unrecorded`, so no measurement in these ~150 invocations is attributable to a commit and *"fixed in 5.8.17"* is not falsifiable from outside. | Stamp the commit at build time. It is the cheapest row in this table and it is the precondition for every other row's verification. |
+
+**Mapped, not new — inherited rows this pass re-witnesses.** `B-6` (partial answers exit 0)
+keeps its row and gains its best measurement yet: overrun ×5.4 → ×4.2 → **×1.39** (median
+20.90 s of 70.74/20.90/19.70 against a 15 s budget), with a `_partial` block that is
+exemplary (`phases_completed`, `phases_pending`, `why_stopped`, and *"every count here is a
+FLOOR"*) — and `exit 0` on all three runs, so a pipeline reading `$?` passes with two of
+three phases unexecuted. **`AUD-591-A09` is the template**: `exit_code` / `gate_exit_code` /
+`gate_exit_code_basis`, or an explicit `--allow-partial`. `B-3` (`--agent` versus
+`--compact`) gains a witness at 3 342 files: 35 357 B ≈ 8 839 est. tokens, **+61 % over the
+only published band**, 16 blocks present in `--compact` and absent from `--agent`
+(`transactional_boundaries`, `mybatis`, `spring_profiles`, `deployment`, `env_map`,
+`stacks` among them), and `sibling_view` still names no block; on the bank round the two
+views are no longer a subset relation at all (9 blocks agent-only, 15 compact-only) and the
+×2.25 time overhead is gone (×1.02). Substantively, `security_surface` is absent from
+**both** channels on a repository with 368 security findings and 725 routes open by rule —
+the predicate is disclosed under `AUD-590-B03`, not closed. `N-5` (an advisory saying
+*"8 372 Java files"* with no population label while the progress line says
+`[population=production_java_sources]`) remains the unclosed half of `AUD-588-B11`; the
+label exists (`cli.py:10278-10280`) and reaches the progress lines and the payload but not
+the advisory emitted from `phased_run.py:367`. `D-09` (cost anchors stamped *"on 5.1.0"* in
+a 5.8.17 build — now counted: **17 anchors on 5.1.0, one each on 4.18.0, 5.0.0 and 3.2.2**,
+in a `cache model` output presented as operational guidance) belongs to `BUG-5`. `N-6`
+(cold `spring-audit` on `openmrs-core`) belongs to `BUG-1` and **improved**: 8.86 s → 8.06 s.
+
+**Closed by correction and re-verified from outside in this pass — do not re-derive.**
+`AUD-591-A01` (8 of 8 write paths refuse, verified by filesystem footprint rather than
+`git status`, `ASK_RUNS_IN_REPO=1` included), `AUD-591-A02`, `AUD-591-A03` (and the
+proposed highest-priority probe is retired: `rename-class --from O` exits 1, as the seventh
+pass had already established), `AUD-591-A05`, `AUD-591-A06` (50.30 s → 0.43 s, and the
+sweep it asked for holds: **6 of 6 error paths ≤0.54 s**), `AUD-591-A08` (modulo
+`AUD-592-D01`), `AUD-591-A09`, `AUD-591-A10`, `AUD-590-B01` (`repo_id` cardinality 1 with
+`repo_id_basis`; the content hash lives on as `content_id`), `AUD-590-B02` (the *lists* —
+the counters above it are `AUD-593-N01`), `AUD-590-B03` (in `--help`; the packaged guide is
+`AUD-593-N02`), `AUD-590-B04` (both halves: a `partial-analysis-v1` stub with `partial:
+true` where 5.8.16 left zero bytes, and an 807 B preamble byte-compatible with
+`spring-audit`'s 813 B), `AUD-590-R01` (`route_census` — and it **refuted the auditor's own
+double-counting hypothesis with the product's data**: `mappings 3763` against
+`on_rows 1120`, with `distinct_routes ≥ mappings`), `AUD-591-Q01`, `B-7` (closed by
+deletion, which was the right answer: `total_ms` is gone, replaced by
+`wall_ms`/`measured_ms`/`unaccounted_ms`/`unaccounted_pct` with arithmetic exact to the
+decimal and a `unit` explaining why the remainder is published rather than distributed).
+
+**Verified and not defects — do not spend effort.** `posture --profile` accepting an
+undeclared profile is **by design and correctly declared**: it is a hypothesis input, not a
+catalogue name, and the payload publishes `profiles_requested` beside `profiles_declared`
+(the bank round withdrew this finding itself after reading the payload). `pr-impact` on a
+clean tree exits 1 with a typed `INVALID_INPUT` naming the empty diff. `pr-impact` over
+three classes refuses with `OUTPUT_TOO_LARGE` and names `--output` — a ceiling as contract,
+not a truncation. `verify` publishes `exit_code: 2` matching the process (`AUD-591-A09`).
+`data-exposure` still answers `answered: false` rather than inferring labels. Cache
+freshness reporting `STALE` at delta 0 commits is `Uncommitted: True` over the auditor's own
+untracked files. `repo_id` absent from `endpoints`, `posture` and `--compact` is coverage,
+not a defect — the criterion was cardinality 1 among emitters, and the help no longer
+promises it.
+
+**Process findings of this pass, and they are the same finding twice.**
+
+1. **The class survives the fix, four times out of five.** `AUD-590-B02` (unit absent from
+   the lists) returned as `AUD-593-N01` (unit present and false in the counters) and
+   `AUD-593-N05` (a new field shipped without one); `AUD-590-B03` (two figures in one help
+   page) returned as `AUD-593-N02` (three figures once the packaged guide is counted) and
+   as the `--agent` band in `B-3`; `AUD-590-B04` (a variable invisible to the root) returned
+   as `AUD-593-N03` (a help page denying the scope the fix granted). The seventh pass named
+   this pattern its highest-value finding and wrote the rule — *every acceptance criterion
+   carrying a sweep clause is closed with a parametric test over the catalogue* — and the
+   two classes closed **as sweeps** in that pass (write guards 8/8, numeric bounds 7/7, and
+   now error-path cost 6/6) did not recur, while three of three closed by instance did.
+   `FAN_IN_FIGURES`, `COMMANDS_THAT_WRITE` and the serializer's section registry are already
+   catalogues: the test goes over the catalogue, never over the reported symbol.
+2. **Two rows in this ledger were marked `closed` while the field reproduces them open**
+   (`AUD-592-B01`, and `AUD-588-B11`'s advisory half). Both were closed against a surface
+   narrower than the row's own wording. A closure whose assertion cannot fail on the tree
+   that produced the defect is not a closure: `AUD-593-N01`'s assertion passes today only
+   because the fixture makes both figures coincide.
+3. **Packaged documentation is a published authority.** `AUD-593-N02` exists because the
+   release assertion covers help ↔ payload and stops at the package boundary. Two stale
+   figures in a shipped `.md` are enough to contradict the correct one in the help.
+
 ### Seventh Audit Pass: `5.8.16` / 16-repository bank + `saint-server` / 2026-08-21
 
 Ordered as the correction queue, regressions and permissive-direction failures first. Each
@@ -184,7 +312,7 @@ partial, `F03` open, `F04` explicit opt-in and `F05` locally verified only.
 | `N-6` | Medium | **not reproduced after cache fixes** | Isolated cold `openmrs-core`: 5.18 s wall / 4.76 s internal, all four layers cold. Retain the field report as an environment-specific reproduction request. |
 | `B-3` | Medium, core/supported | **closed by `773268d`** | Help no longer claims maximum signal; `sibling_view` points to compact. |
 | `B-6` | Medium, core | **closed by `17c6e06`** | Partial answers publish `overrun_bound` and its wall-clock basis. |
-| `B-8` | Low | **closed by `52593b6`** | Compact posture retains one unresolved sample when the total is non-zero. |
+| `B-8` | Low | **reopened 5.8.17 — see `AUD-592-B01`** (was: closed by `52593b6`) | The fix retains a sample only when the total is exactly 1, not whenever it is non-zero, so `total: 3, shown: 0` still reproduces. |
 | `N-5` | Low, core | **closed by `c68083f`** | Progress and payload name the Java population. |
 | `N-7` | Low, core | **closed by `082e9de`** | Bounded fuzzy candidates and matching message hints handle close typos. |
 
@@ -207,7 +335,7 @@ automation remains deferred; provider non-coverage is the current product behavi
 | `AUD-513-N01` (`N-1`) | **closed in 5.8.14** | `rename-class` rewrote three Petclinic files under both `ASK_READONLY=1` and `--no-write`, then exited 0. The audit restored the tree; this is a write-policy breach, not an artifact-directory exception. `readonly.guard_mutation()` now refuses before any planned source write or physical rename; help names the command as mutating and regressions cover both readonly controls plus `--dry-run`. |
 | `AUD-513-N02` / `B-4` / `N-5` | **N02/B-4 implemented in 5.8.14; N-5 open** | `posture.summary.unconditional` counted 1,697 on a non-Spring Struts tree and 1,573 on Mall, and `security` was `0/0/0` with no population. The posture projection now uses the canonical Spring IoC bean population, publishes its population/unit and separates unconditional security beans. Regressions cover non-Spring, mixed-bean and conditional/unconditional security fixtures. Progress/advice still use incompatible “Java files” scopes (`N-5`), so the `AUD-588-F02` family remains open. |
 | `AUD-513-B01` / `B-3` / `B-5` | **B01/B-5 implemented in 5.8.14; B-3 closed as revalidated** | A MyBatis XML paired with a `*Mapper.java` interface now takes precedence over an absent `@Mapper` annotation, preserving XML-backed/`@MapperScan` interfaces in `mapper_interfaces` rather than misclassifying them as DTO mappers. `imports_found` now contains only actual Java imports; code, XML and build matches are emitted as `evidence`, including in compact output. `B-3` was stale against the current source: both views consume `JAVA_SPRING_SECTIONS`; a real MyBatis Mapper/XML regression proves the section is retained by `--agent`. |
-| `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, `D-09` | **N03/N04/N07/N08/N09 implemented in 5.8.14; remainder open** | `impact` now always publishes the `candidates` field its not-found message names, including `[]` when no close symbol exists. Budget advice no longer calls partial snapshot/RIS evidence a warm cache: it identifies that presence and says context/parse are unknown before analysis, whose payload then reports all four actual layers. README operational sections (`clone`, install, build, getting started, troubleshooting and related headings) are never promoted into a project summary; with no descriptive prose compact output publishes `project_summary: null` and `summary_basis`. `security_posture.limitations` is now cache-state invariant; dynamic execution advice travels in `security_posture.operational_hints`. Every numeric output bound rejects negative values at parse time with a structured `INVALID_INPUT` envelope (`flag`, `value`, `expected`); `--limit 0` still means no cap wherever that behavior was published. Budgets overrun, timing coverage is inconsistent, compact hides unresolved identities and cost anchors remain stale. |
+| `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, `D-09` | **N03/N04/N07/N08/N09 implemented in 5.8.14; remainder open** | `impact` now always publishes the `candidates` field its not-found message names, including `[]` when no close symbol exists. Budget advice no longer calls partial snapshot/RIS evidence a warm cache: it identifies that presence and says context/parse are unknown before analysis, whose payload then reports all four actual layers. README operational sections (`clone`, install, build, getting started, troubleshooting and related headings) are never promoted into a project summary; with no descriptive prose compact output publishes `project_summary: null` and `summary_basis` — **`N04` regressed in 5.8.17 and is `AUD-592-R02`: licence headers and layout rules are promoted again, under a basis that asserts they are prose.** `security_posture.limitations` is now cache-state invariant; dynamic execution advice travels in `security_posture.operational_hints`. Every numeric output bound rejects negative values at parse time with a structured `INVALID_INPUT` envelope (`flag`, `value`, `expected`); `--limit 0` still means no cap wherever that behavior was published. Budgets overrun, timing coverage is inconsistent, compact hides unresolved identities and cost anchors remain stale. |
 | `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.14** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `e53507d` separates direct impact matches from analysis seeds and implementation classes; `8386744` carries the established container-wiring fact into plan checklists and compare cost dimensions. Source population units and risk-tier wording remain open. |
 | `AUD-511-R02` / `AUD-589-B02` / `AUD-513-N06` | **partially corrected; `data-exposure` open, P1** | Nine of ten measured commands recovered, many to their best historical timings. `data-exposure --config` did not: 42.7 s versus 16.2 s in 5.8.8 and a 28.9 s model, with byte-equivalent output. Measure it with the idle-host, isolated-cache, interleaved-control protocol before changing code, then compare its reuse path with `validation`. |
 | `AUD-588-B02`, `B06`, B11 residuals, `B12` | **B02/B06 closed; B11/B12 open, P2** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. The re-audit verifies both and the payload reduction; `cf57457` makes aggregate wording name only applicable dimensions. Complete B11 consumer parity and calibrate B12 only from provenance-bearing controlled samples. |
@@ -407,6 +535,8 @@ retained only as evidence of what the auditor observed before the fix.
 | ASK-17 | **The parse store's default budget cannot hold a multi-repository workspace warm, and the cold cost of the largest repository is 7,6 minutes.** Measured on the 8-repo corpus (43 986 `.java`): `cache status` reports 56 730 entries at **511,12 MB against a 512 MB budget** — i.e. permanently sweeping by LRU — so `tutorials` (24 073 `.java`, the largest contributor) is the first candidate for eviction. Cold `--compact` on it: **457,6 s**, independently reproduced at 449 s, against 2,0 s on the second pass. | 5.8.4 corpus re-audit | Medium — warm plus `--compact` is still the answer (2,0 s), but a workspace this size cannot keep every repository warm at the default budget, and nothing tells the caller which repository is cold before it pays for it | **closed 5.8.5 — the disclosure shipped and the owed measurement taken, under our own control.** ⚠ **The +66 % does not reproduce, and the mechanism the row suspected is worth ~3 %, not 66 %.** Protocol: `tutorials` (24 073 `.java`), root `--compact`, both cache bases isolated **and emptied between runs** (`SOURCECODE_CONTEXT_CACHE_DIR` *and* `SOURCECODE_CACHE_DIR` — the first attempt isolated only the first, and the second pass of each version answered from the L2 view its own first pass had written: 2,4 s with an empty parse store, which is how a measurement of a cold path becomes a measurement of a warm one), `ASK_PARSE_CACHE_MAX_MB` fixed at 4 096 MB so no sweep can confound the comparison, 2 passes per version. **5.7.2 (`e803c8b`): 112,0 s / 112,6 s. This tree: 113,8 s / 115,2 s — +2,3 %**, with per-version dispersion of 1,005× and 1,012× and a payload 2,2 % larger. Then the audit's own condition, isolated as the only variable — the store pre-filled to 489 MB against the **default** 512 MB budget, so every 32 MB written sweeps: **117,0 s, +2,7 %.** So the LRU sweep is not where 457,6 s comes from, and neither is the analysis path: the auditor was right to hold the regression, and the held figure is now retracted **with a number** rather than on suspicion. ⚠ Scope, stated because the difference is unexplained rather than explained away: 457,6 s on Windows 11 / pipx is **not reproduced here** (113 s on 20 cores), and that gap is not assertable in either direction from this measurement — what is assertable is that 5.7.2 → this tree did not get slower and that a saturated store costs ~3 %. ✅ **What the measurement does confirm is the row's own claim, with our number: one repository of 24 073 `.java` leaves 46 840 entries and 470 MB in the store — 92 % of the 512 MB default budget** — so a workspace with a second repository of any size is permanently sweeping by construction, exactly as reported. Sizing rule, measured rather than guessed: ~20 KB of store per Java file, so ~500 MB per 24 000-file repository. Collateral confirmation of `AS-18`: after the saturated run the store rests at 669 MB — 157 MB over the budget and **under** the 736 MB effective ceiling it publishes at 7 writers — so the ceiling holds under the condition that produced the complaint. **The disclosure half:** `cache status` now publishes **coverage per repository**, which is the half the row itself recommended and the half that changes a decision: *«tutorials: 3 100 of 24 073 files cached (13 %)»* replaces a blind guess about whether to raise the budget, and an LRU eviction becomes visible **before** somebody pays 457,6 s to discover it. Both halves of the attribution were already held and thrown away — the walk knows the repository and it computes the store key for every file — so the run records the pairs (`parse_cache.record_repository_index`, from **both** readers of the store: `build_repo_ir` and the route-surface extractor, so the figure does not depend on which command was typed) and `store_stats` intersects them with the keys it collects **in the entry walk it already performs**: coverage costs an intersection, never a second scan of the store and never a scan of the repository. Three rules keep it honest. The index is **merged, never replaced**, because a `--changed-only` or `--since` run would otherwise shrink a 24 000-file population to the twelve files it read and publish *«12 of 12 cached (100 %)»* about a repository that is cold. The number travels with its **basis** — a file deleted since its last analysis still counts as recorded and reads as uncached, which errs toward *colder than it is* and says so. And the index is **neither an entry nor evictable**: the entry walk, the byte accounting and the LRU sweep all glob `*.json`, so its bytes are published under their own name (`repository_index_bytes`) rather than folded into a total that means entries — an index swept away with the entries it describes cannot report the eviction, which is the one moment it exists for. It lives inside the generation root, so retiring a generation retires its indexes with it: the keys are only readable by the build that wrote them. Regression `tests/test_parse_store_repository_coverage_ask17.py`, 11 assertions, including the one the row is about — entries deleted underneath a recorded repository make coverage **fall** while the population holds. ⚠ **Still owed, and unchanged:** the controlled cold measurement (5.7.2 against this tree, `ASK_PARSE_CACHE_MAX_MB` fixed, store emptied between runs, on a >20 000-file repository). Until it exists neither the +66 % nor its absence is assertable, and the row stays open on that half alone. **History:** **open** — ⚠ **not filed as a regression, deliberately**: the same cold figure was 274,8 s in 5.7.2 (+66 %), and the auditor refuses to call it one because the conditions are not comparable — in 5.7.2 the store had been retired by a version change, here it was mid-LRU-sweep. Seven false positives of exactly this class have been retracted over seven cycles; this is the eighth candidate and it is being held. What is owed is a measurement **we** control: cold `--compact` on a >20 000-file repository, 5.7.2 against 5.8.4, with `ASK_PARSE_CACHE_MAX_MB` fixed and the store emptied between runs — until that exists, neither the +66 % nor its absence is assertable. Recommended beside it, and cheap because both halves already exist: `cache status` should publish **coverage per repository** — how many entries belong to each analysed repository and what fraction of its files are covered — so *tutorials: 3 100 of 24 073 files cached (13 %)* replaces a blind decision about whether to raise the budget. Entries are content-addressed and the walk knows the repository, so this is a projection of facts we hold, not new analysis. **Refutation reproduced independently in cycle 8, under the reporter's own protocol**: both stores isolated and emptied, `ASK_PARSE_CACHE_MAX_MB=4096`, 2 passes per version — 5.7.2 at 112,0 / 112,6 s against 5.8.5 at 113,8 / 115,2 s (~3 %), and an A/B of the budget itself (512 MB sweeping by LRU against 4 096 MB that cannot sweep) at 9,1–10,1 s against 9,0–9,7 s: **the LRU sweep costs nothing measurable**. The +66 % is retired as the reporter's eighth false positive, with `E-37` named as its confounder. |
 | C3-128 | **`timeline` is the only gate-shaped command above 120 s, and it has not come back to its record.** Steady state, 4 runs, audited corpus: `timeline --since HEAD~5` costs **198 469 ms**, +27,3 % over its 5.7.2 record of 155 950 ms. The two other commands over 120 s are there structurally — `delta` (234 s) and `contract-diff` (136 s) analyse two whole trees — while `timeline` analyses **five** and costs less than `delta` does with two, so its cost is not explained by the number of trees it walks. | 5.8.2 → 5.8.4 re-audits | Low-Medium — an investigation command rather than a gate, and the last performance figure of the round sitting outside its own best | **closed 5.8.5 by measurement — the clock is attributed, and there is nothing left unaccounted to tune against.** The row's own instruction was ASK-16's: instrument before tuning. `timeline` published a per-sample total over what is really four costs — materialising a tree, measuring each watched metric, releasing the tree, and the remainder — so *«198 469 ms»* named a command rather than a phase. `perf.PhaseTimings` (the ASK-16 authority, always on) now splits it, with the phase names taken from `--watch` so the split cannot drift from the population, and the tree materialisation kept as its own phase because git's work must not be attributed to an analysis. **Measured, BroadleafCommerce (2 985 `.java`), `--since HEAD~5 --watch posture`, 5 samples: wall 38 921 ms — `measure:posture` 32 273 (82,9 %), `materialise_tree` 5 376 (13,8 %, ~1 075 ms per tree), `release_tree` 1 272 (3,3 %), unaccounted 0,45 ms (0,0 %).** So the answer to the row's premise — *«it analyses five trees and costs less than `delta` does with two»* — is that five sixths of the cost **is** the analysis, re-run per tree by construction, and the git work is a sixth of it: `timeline` is N × one analysis and there is no timeline-specific overhead to remove. Any future gain belongs to the metric being sampled (`C3-84`, `C3-127`), which is where it would also help every other command, and the payload now says so per run instead of per audit. Regression `tests/test_timeline_timings_c3_128.py`, 9 assertions, including that the series itself is byte-identical across two runs once the clock readings are removed — instrumentation that moved an answer would be a worse defect than the row. **Original note:** **open** — ⚠ the cache-reuse half of `B7` must **not** be reopened on this evidence: the v3 assertion (`max(sample) < 8 × posture_warm`) passes at 6,8 in both 5.8.2 and 5.8.4, against 14,8 / 13,4 / 12,4 / 8,5 in the four versions that genuinely failed it. What has not returned is the absolute cost. Attribution comes before tuning and is now cheap: `metadata.timings` (`ASK-16`) exists, so the per-phase split across the five trees can be published before anything is changed. |
 | B20 | **Thirteen declared renames with no cut-off date, and two distinct `1.0` identifiers meanwhile.** The registry publishes `pending_renames` for the 13 non-conforming `schema_version` values with their canonical name — exactly the policy `ASK-11` exists to enforce: the rename is an incompatible change, declared before it is made, never applied in silence. The consequence is published by the registry itself as `ambiguous_identifiers: 1` — `spring-audit` emits `1.0` for `core-analysis-v1` and `impact-chain` emits `1.0` for `impact-chain-v1`, so a consumer dispatching on the emitted version cannot tell them apart. | 5.8.4 re-audit (residual of `B19` / `B6`) | Low — declared debt rather than a defect, and the audit says so in as many words | **closed 5.8.5 — the window is declared where every other incompatible change is, and the reported ambiguity was understated by five shapes.** `BC-002` in `sourcecode.breaking_changes`: **announced 5.8.5, takes effect 6.0.0**, printed by `ask schema breaking-changes-v1`, carried in the CHANGELOG's `## Upgrading` section above the release history, and projected into `ask schema schemas-v1` as `pending_renames_window` — **one fact, two surfaces**, with a structural assertion that the registry source holds no second copy of the date. The registry's policy is generalised rather than loosened: a declared change is now `kind: exit_code` (must move an exit code) **or** `kind: contract` (must move a **published value** *and* name the version it takes effect in), because a rename breaks a consumer with every exit code still 0 and a registry that only knew about exit codes had nowhere to put it. A contract change publishes no `exit_code_before`/`after` at all — inviting a reader to check a field that cannot move is how a disclosure becomes noise. The 13 affected shapes are **read from `schema_registry.canonical_migrations()` at call time**, never copied: a shape that starts conforming leaves the declaration by itself (asserted by swapping the registry for a conforming one and watching the list empty). ⚠ **Correction to the reported cause, measured**: the audit named *two* shapes spelling their version `1.0`; there are **seven** — `core-analysis-v1`, `impact-chain-v1`, `pr-impact-v1`, `migration-blast-v1`, `spring-impact-v1`, `event-topology-v1`, `test-gap-ranking-v1` — so `ambiguous_identifiers: 1` was counting one *identifier* over seven shapes, not two. `ask schema 1.0` already resolved to all seven with each canonical name; the count is now asserted from the registry so it cannot be quoted from prose again. The rename itself is deliberately **not** made early: that is the incompatible change this policy exists to prevent. Regression `tests/test_schema_rename_window_b20.py`, 11 assertions, plus the ASK-11 battery generalised to both kinds. **Original note:** **open** — the missing half is a date, not a decision. Announce the cut-off window in `breaking-changes-v1` with the target version, the way every other incompatible change is announced, so a consumer can pin `core-analysis-v1` today and know when the bare `1.0` stops being emitted. Until then `ask schema 1.0` resolving to all seven shapes, each offering its canonical name, is the correct behaviour and must not be *fixed* by renaming an emitted value early — that is the incompatible change this policy exists to prevent. ⚠ **Round 10 ran on the 5.8.5 build and still reports the renames as *«deuda bien declarada, pero sin fecha»*, asking for precisely what `BC-002` already ships.** The row stays closed — the window exists, is announced 5.8.5 / effective 6.0.0, and is printed by `ask schema breaking-changes-v1`, carried in the CHANGELOG's `## Upgrading` and projected into `schemas-v1` as `pending_renames_window`. What it leaves behind is a **discoverability check, not a defect**: the reporter quoted `pending_renames` and `counts` out of the registry payload and did not see the window beside them, so verify that `pending_renames_window` travels in the same payload those two keys do — and if it does not, that is where it belongs. A declaration a ten-round auditor cannot find is not yet declared to a consumer. |
+| E-38 | **A class-level route prefix carried by a meta-annotation is dropped, and the route is published without it.** `_build_route_surface` reads the class prefix only when the class symbol carries `@RequestMapping` or `@Path` **literally** (`repository_ir.py:5882-5887`); a repository that declares its own composed annotation gets `prefixes = [""]`, and the published `path` is the method suffix alone. **Measured on shenyu (5.8.17): 35 of 365 published routes — 9,6 %, over 21 controllers — carry `path: "/"`.** `AiProxyApiKeyController` is annotated `@RestApi("/selector/{selectorId}/ai-proxy-apikey")`, a Shenyu annotation meta-annotated with `@RestController` + `@RequestMapping`; its five handlers are published at `/`, `/`, `/batchDelete`, `/{id}`, `/page`. The served URLs do not exist as published. This is a **confident falsehood**, not a gap: no `path_resolution: "unresolved"`, no `path_expression`, no warning, and `route_census.distinct_routes` (316 of 365) reads the collisions as if two controllers genuinely shared a path. It also propagates to every consumer keyed on route text — `explain-endpoint`, `data-exposure --path-prefix`, `validation --path-prefix`, `pr-impact` route matching — where a correct query returns nothing. **The machinery already exists on the other axis**: `E-12`/`5.7.1` closed exactly this class for *beans* by resolving the spelling against the graph's `imports` edges, and `BeanGraph.build` already builds a meta-annotation map in its first pass. The route axis never asked. Vendor-agnostic by construction: the rule is "an annotation this repository declares that itself carries `@RequestMapping`/`@Path`", never a proprietary name. | found 2026-08-21 during the `AUD-590-R01` census triage, on the corrected 5.8.17 build; **not part of the seventh-pass queue and deliberately not fixed in it** — it moves route counts on any repository using composed annotations and needs its own measured pass with the golden set re-baselined | **High** — it is the rule this repository enforces most loudly, inverted on the route axis: a published route that is not served, with no affordance saying so. Blast radius is every repository with a framework-level or in-house composed controller annotation; shenyu is the witness, dubbo/sa-token/halo are unmeasured | **open** — direction: resolve the class-level prefix through the meta-annotation map `BeanGraph.build` already computes, in the order `E-12` established (explicit single-type import decides; wildcard leaves it admissible; a repository-declared annotation in the owner's package is the owner's own; **nothing resolved stays unresolved rather than acquiring a verdict from silence**). Where it cannot be resolved, publish `path_resolution: "unresolved"` with the annotation as `path_expression` — the contract the method-level path already honours — never a bare `/`. Regression on a fixture declaring its own composed annotation, plus a shenyu assertion that no published route is `/` |
+| B29 | **A cache-freshness test asserts a cold cache without ensuring one, so it fails on every run but the first after a purge.** `tests/test_cli.py::test_compact` asserts `_meta.timing_ms.served_from_cache is False` and does nothing to make that true: the first `--compact` run over its fixture populates the cache the second one then hits. Verified symmetrically at `d9071d4` (clean) and at every commit of the seventh-pass queue — purge, run, pass; run again, fail — so it is **state-dependent, not a regression**, and it has been reported as "1 pre-existing failure" for the whole pass. It is still a red line in a suite whose value is that red means something. | found 2026-08-21 while establishing the baseline for the seventh-pass queue | **Low** as a defect, **medium** as an eroder — a permanently-red test trains a reader to skip the summary line, which is how a real regression gets shipped | **open** — direction: the test must create the state it asserts (purge this fixture's cache dir in the fixture, or assert the *transition* cold→warm across two runs rather than the absolute). Do not "fix" it by deleting the assertion: `served_from_cache` is the field `is_stale`/cache-freshness rows are keyed to, and a cold-start claim is worth holding |
 | E-37 | **Two environment variables move three cache stores, and no surface said which moves which.** `SOURCECODE_CACHE_DIR` relocates the per-repository snapshot store (core snapshots, the rendered L2 view, the RIS); `SOURCECODE_CONTEXT_CACHE_DIR` relocates the shared ones (the Canonical IR and the per-file parse store). Their defaults are siblings under `~/.sourcecode`, so the split is not derivable from the paths, and `cache status` published a path per store with no variable beside it while `docs/CACHE.md` named both variables in one sentence after the table. | found here 2026-08-18 while taking the controlled A/B `ASK-17` owed, not reported by the field | Medium — it does not make an answer wrong, it makes a **measurement** wrong, silently: an operator who redirects or empties *the cache* moves one store and is served answers out of the other | **closed 5.8.5** — measured first: with only `SOURCECODE_CONTEXT_CACHE_DIR` redirected, the second cold pass of each version answered from the L2 view its own first pass had written — **2,4 s against 113 s, with an empty parse store** — and the run reported `cache_source: L2_view` without anything naming the store it came out of. Now every store in `cache status` publishes `base_env`, from one authority (`cache._STORE_BASE_ENV`), the text answer prints *«<path>  ($VAR moves it)»* beside each one, `stores.base_env_note` states the consequence rather than the layout, and `docs/CACHE.md` carries a **column** instead of a sentence covering both. Regression `tests/test_cache_store_base_env_e37.py`, 8 assertions, and the ones that matter are **behavioural**: setting the variable a store names moves *that* store and leaves the others where they were — a published mapping nobody exercises is the class of claim this repository refuses everywhere else. The CLI is forbidden a second copy of the mapping (structural assertion). **Confirmed from the outside in cycle 8, by the reporter falling into it first**: isolating only `SOURCECODE_CONTEXT_CACHE_DIR`, their second *cold* pass answered from the L2 view their first pass had written — **2,4 s against 113 s with an empty parse store** — and their write-up now quotes the shipped `base_env` mapping back as the fix (*"dos variables mueven tres almacenes y ninguna superficie decía cuál"*). A defect found while measuring, that was itself corrupting the measurement. |
 | B21 | **Six of the thirteen shapes being renamed name no command that emits them.** `schemas-v1` publishes `emitted_by` per shape; for `migration-blast-v1`, `spring-impact-v1`, `event-topology-v1`, `test-gap-ranking-v1`, `canonical-ir-v1` and `hibernate-strategy-v2` it is `[]`, beside seven shapes where it is populated. Read the way a consumer reads a list, an empty `emitted_by` says *nothing emits this shape* — which tells the one consumer that **is** affected by `BC-002` that it is not. | found here while declaring `BC-002` (5.8.5), not reported by the field | Low — a disclosure gap in a declaration whose whole purpose is to let a consumer decide whether it is affected | **closed 5.8.6 — derived, not typed out.** `schema_producers` reads the two authorities the CLI already holds — the registered command tree and the import graph of the module that defines each callback — and answers with the evidence it derived on: `command_import` (the command's own body imports the producing module), `module_import` (one hop, through an intermediate narrow enough to attribute), `substrate` (reached from more commands than a producer would be) or `unresolved` (nothing found, said in a sentence). Five of the six now name a command — `migration-blast-v1` → `migrate-check`, `spring-impact-v1` and `event-topology-v1` → `impact-chain`, `test-gap-ranking-v1` → `impact`, `hibernate-strategy-v2` → `migrate-check`/`migrate-recipe` — and the sixth, `canonical-ir-v1`, is reached from **28 modules**: naming every command would be less true than naming none, so it publishes `substrate` with the count and the instruction to match on `subject`. A declared producer still wins, because some producers are not one registered command (`ask (root)`, `baseline capture`). Regression `tests/test_schema_producers_derived_b21.py`, 33 assertions, parametrised by the registry so a fourteenth unnamed shape fails the battery. **History:** open, and named rather than shipped as a fact: every `BC-002` row with an empty producer list carries `emitted_by_basis` — *«not declared in the registry: this shape's producing command is not named yet, so match on `subject`»* — so the gap is visible instead of being read as a negative claim. What remains is to fill the six, and the honest way is derivation rather than six more hand-written strings: the producer is discoverable from the command that constructs each payload, which is the same authority every other population in this repository comes from. Until then the assertion in `tests/test_schema_rename_window_b20.py` holds the weaker invariant a reader can rely on: a row either names its emitters or says why it cannot. |
 | C3-129 | **`timeline`'s absolute cost, now fully attributed and still 27 % above its own record.** `C3-128` closed by instrumenting rather than tuning, which was the right order and left this behind: the clock is split, nothing is unaccounted, and the number has not moved. Round 10 on 5.8.5 measures `timeline --since HEAD~5` at **~198 000 ms against the 5.7.2 record of 155 950 ms (+27 %)** — the only gate-shaped command over 120 s that is not there structurally (`delta` 191 s and `contract-diff` 115 s walk two whole trees, `compare` 46 s walks N candidates; `timeline` walks **five** trees and costs more than `delta` does with two). | 5.8.2 → 5.8.5 re-audits (residual of `C3-128`, which closed the attribution half in 5.8.5) | Low-Medium — an investigation command rather than a CI gate, and the last performance figure of the round sitting outside its own best | **closed 5.8.6 — by not paying twice for what does not change.** A metric at a commit is a pure function of that tree, and the tree at a sha never changes: the only cache in this product whose key can be exact rather than heuristic (analyzer fingerprint + metric + commit sha). `timeline_cache.SampleCache` stores measured values under the per-repository core store, and when every watched metric for a sample is a hit the tree is **never materialised**, which is the 13,8 % the split attributes to git. Measured on BroadleafCommerce over the same range: **26 845 ms → 12 ms**, samples and transitions byte-identical. What makes it admissible rather than merely fast, all asserted: a failed sample is never stored (one bad run cannot become permanent), the fingerprint is in the key (corrected analysis is never served from a previous release), the hit is published (`sample_cache`, `from_cache` per sample, and `cost` separates the cached population from the measured one instead of reporting a median over both), and `--no-cache` / `ASK_TIMELINE_NO_SAMPLE_CACHE=1` measure everything again so the command stays measurable without emptying a store (E-37). `cache_model` carries the layer, so `cache model` and `docs/CACHE.md` state it from one authority. Regression `tests/test_timeline_sample_cache_c3_129.py`, 11 assertions. **History:** open — and it opened with the answer already published, which is why it is cheap to attack and expensive to leave: `timeline`'s own `timings` say **82,9 % `measure:posture`, 13,8 % `materialise_tree`, 3,3 % `release_tree`, 0,0 % unattributed**. So this is not a `timeline` defect at all: it is `posture` paid five times over five materialised trees, and it makes the same substrate question `C3-127` asks — with the difference that here the five payers are one command, so the cache is intra-invocation and needs no cross-command contract. ⚠ **Do not reopen `B7`**: cross-tree cache reuse is healthy, the v3 assertion passes at 6,8×. Acceptance: `timeline --since HEAD~5` back inside +10 % of 155 950 ms on the audited corpus with `timings` still summing to 100 %, and `measure:posture` falling as a share rather than the total falling for an unnamed reason. |

{sourcecode-5.8.17 → sourcecode-5.8.18}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,62 +3,114 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT STATE — seventh audit pass CLOSED, released as `5.8.17`, 2026-08-21**
+> **CURRENT STATE — eighth audit pass CLOSED and shipped as `5.8.18`, 2026-08-21**
 >
-> The queue below is empty. All eleven rows of the seventh pass — `AUD-591-A01`,
-> `AUD-590-R01`, `AUD-591-A03`, `AUD-591-A10`, `AUD-590-B01`, `AUD-591-A02`,
-> `AUD-590-B02`, `AUD-590-B04`, `AUD-590-B03`, `AUD-591-A06`, `AUD-591-A09` /
-> `A-08` / `A-05` — are closed by correction, one commit per row, and the open
-> question `AUD-591-Q01` is answered. Full evidence per row: `docs/DEFECT-LEDGER.md`,
-> *Seventh Audit Pass*.
+> The seventh-pass queue was closed and shipped as `5.8.17`; the eighth-pass queue is now
+> closed and shipped as `5.8.18`, one fix per atomic commit with a focused regression
+> assertion. Round A (MSAS, 3 342 files, 29 invocations,
+> same HEAD as the previous round bit for bit) scores **8.77/10**, up from 8.21, with zero
+> false statements about the repository for the second consecutive run. Round B (12-repo
+> bank, ~150 invocations, §7 protocol) records **zero content regressions and no timing row
+> above the ×1.25 threshold** — and both rounds together open **two regressions and eleven
+> defects**. Full evidence per row: `docs/DEFECT-LEDGER.md`, *Eighth Audit Pass*. What is
+> below is the attack order and the mechanism, not a second copy of the evidence.
 >
-> **What the pass found that the reports did not, and what it refuted:**
+> **Release result — all reported rows in this pass are closed:**
 >
-> - The `AUD-591-A01` sweep found **two further unguarded write paths**, and one of
->   them explains why a guard audit by module could not see them: `verify-edit
->   --install-hook` guarded the *hooks directory*, and `guard()` deliberately never
->   refuses a path that already exists — `git init` always creates `hooks/`, so that
->   guard could not fire on any repository in the world.
-> - **The acceptance criterion proposed for `AUD-591-A01` cannot see the defect.**
->   `git status --porcelain == ""` is blind here: the first thing written into
->   `.ask/` is a `.gitignore` containing `*`. The sweep compares a filesystem
->   footprint of the whole tree, `.git/hooks/` included.
-> - **`AUD-591-A03` is wrong about its blast radius.** `rename-class --from` does
->   *not* share `_resolve_target`; it requires a file declaring the class and
->   refuses `--from O` outright. The one path that rewrites source was never
->   reachable from the substring match. `compute_blast_radius` is reached by
->   `impact`, `plan` and `compare`; `impact-chain` resolves separately.
-> - **`AUD-590-R01`'s hypothesis was half right and the sign was wrong.** Annotation
->   handling *is* the mechanism, but the census was **under**-counting: a
->   method-level `@GetMapping({"/a","/b"})` published `/a` and dropped `/b`, while
->   the class-level array had expanded correctly since always. Its other half —
->   `no_security_signal` and `undocumented` — is one number under two names, in both
->   authorities.
-> - **`AUD-590-B03`'s open question has the feared answer.** The predicate emitting
->   `security_surface` in `--compact` requires an annotation that *names a resource*;
->   `GATE-001..004` fire on any custom authorization mechanism. A gate with no
->   resource argument produces audit findings and no section. Disclosed in the
->   section's own `basis` rather than re-implemented.
-> - **`AUD-591-Q01` answered:** the snapshot layer is reachable and only the root
->   analysis writes it. All 240 invocations were of other commands, so `cold` was
->   correct on every one and said nothing about the cache.
+> 1. **`AUD-592-R01` (P0, regression)** — closed in the fix sequence; `compare` now owns
+>    and publishes its scan state.
+>
+> 2. **`AUD-592-R02` (P1, regression)** — closed in the fix sequence; project summaries no
+>    longer promote licence/layout boilerplate as descriptive prose.
+>
+> 3. **`AUD-593-N01` through `AUD-593-N06`, `AUD-592-B01`, `AUD-592-A02`, `AUD-592-D01`
+>    through `AUD-592-D04`, `E-38`, and `B29`** — closed in `5.8.18`; see the changelog
+>    and atomic commits for the authority, consumer, and regression evidence.
+>
+> The following material is the **historical attack-order record** from before `5.8.18`:
+>
+> 1. **`AUD-592-R01` (P0, historical regression)** — `compare` was dead on 5 of 5 valid
+>    invocations: `NameError: _compare_scan_trunc`, Rich traceback, no envelope, zero bytes
+>    of payload. The `AUD-591-A06` assignment landed in `plan_cmd` (`cli.py:8874`) and the
+>    read is in `compare_cmd` (`cli.py:8972`); the functions are `8818-8901` and `8903-9002`.
+>    **Confirmed by reading HEAD, not from the report.** Two more defects fall out of the
+>    same error: `plan` computes its truncation state and binds it to nothing, and
+>    `compare`'s `scope` fix at `:8975` sits after the raising line and has never run.
+> 2. **`AUD-592-R02` (P1, regression of `AUD-513-N04`)** — `project_summary` publishes an
+>    Apache licence header as the project description on 3 of 8 repositories, with
+>    `summary_basis: "README descriptive prose"` asserting it is prose. Four holes in
+>    `summarizer.py`, all read at HEAD: HTML comments detected only on their opening line
+>    (`:335-337`) where `in_code_block` three lines above (`:326-330`) is the correct
+>    pattern; ATX-only headings (`:331`), so setext titles are content; a strict `< 30`
+>    floor (`:359`), so a 30-dash rule survives; `_LICENSE_MARKETING_RE` (`:266-281`) with
+>    no Apache/MIT/GPL/BSD pattern in it; and an unconditional `summary_basis` (`:382-385`).
+> 3. **`AUD-593-N01` (P1)** — `direct_caller_count` is 34 in `impact` and 554 in
+>    `impact-chain` for one symbol at one HEAD, both under `"distinct caller classes"`, and
+>    `FAN_IN_FIGURES` (`caller_metrics.py:80-110`) declares both rows the same `unit` **and**
+>    the same `population`. The populations are in fact different: `impact-chain` takes
+>    depth 1 from a seed set expanded with interface members (`spring_impact.py:1110-1135`,
+>    `caller_reach.py:309-336`), `impact` admits only references naming the target. **It
+>    falsifies the assertion `AUD-590-B02` was closed with** — that assertion passes on a
+>    fixture where the two coincide.
+> 4. **`AUD-592-B01` (P1)** — `B-8` is marked `closed` and does not reproduce as closed:
+>    the code keeps a sample only when `unresolved == 1` (`cli.py:12653-12654`), the row
+>    promises it whenever the total is non-zero, and the field measures `total: 3, shown: 0`.
+> 5. **P2 contract rows** — `AUD-592-A02` (scan truncation declared by 1 of 4 commands that
+>    own a walk; `plan` computes it and drops it; the root help still cites a 25 000
+>    directory-entry cap against an 8 000-file cap observed), `AUD-593-N02` (the `--compact`
+>    budget published three times in two shipped authorities: `--help` generates it from
+>    `output_budget`, the packaged `docs/USER_GUIDE.md` does not — `:111`, `:243`/`:1366`,
+>    `:254`/`:1367`), `AUD-593-N03` (`cli.py:621-622` still says the budget variable bounds
+>    only three commands, after `AUD-590-B04` extended it to the root — the command that
+>    most needs it).
+> 6. **P3 residuals** — `AUD-593-N05` (a fan-in figure emitted outside `FAN_IN_FIGURES`,
+>    which forbids exactly that), `AUD-593-N06` (a silent `[:30]` at `repository_ir.py:10172`
+>    where every sibling list declares its cap), `AUD-592-D01` (the write inventory names
+>    `--history-dir` where `--snapshot` writes — `cli.py:296` against the code's own comment
+>    at `:12980-12986`), `AUD-592-D02`/`D03` (`--min-band` publishes no `_filter`; `enrich
+>    --rule` accepts an unknown id where `spring-audit` rejects it), `AUD-592-D04`
+>    (`build_commit: unrecorded`, fourth consecutive report — the precondition for every
+>    other row being falsifiable from outside).
+>
+> **Carried, unchanged, from the seventh pass:** **`E-38`** (High) — a class-level route
+> prefix carried by a meta-annotation is dropped; 35 of 365 shenyu routes published as
+> `path: "/"`; the machinery exists on the bean axis (`E-12`) and the route axis never asked
+> for it. **`B29`** (Low) — `tests/test_cli.py::test_compact` asserts a cold cache without
+> making one, so it fails on every run but the first after a purge.
+>
+> **What the pass refuted, and what it corrected about itself** — do not re-derive:
+>
+> - `posture --profile` accepting an undeclared profile is **by design**: a hypothesis
+>   input, not a catalogue name, and `profiles_requested` is published beside
+>   `profiles_declared`. The bank round withdrew the finding after reading the payload.
+> - The MSAS round's first mechanism for `AUD-593-N01` — *"the `direct_caller_*` fields are
+>   wired to the chain totals"* — is **wrong**, and it corrected itself: the count does
+>   derive from `direct_callers`, and the empty `indirect_callers` is the hub guard capping
+>   the walk to depth 1, which **is** declared. The defect is one layer up, in what each
+>   command admits as *direct*.
+> - `AUD-590-R01`'s double-counting hypothesis was **refuted with the product's own data**:
+>   `route_census` shows `mappings 3763` against `on_rows 1120` with `distinct_routes ≥
+>   mappings`, so the total is not an expansion inflating a smaller surface.
 >
 > **Traps this pass leaves for the next one:**
 >
-> - `last_scan_truncation()` is ambient by design and must be read *at the call
->   site*, immediately after the walk that produced the file list. Several paths do
->   their own uncapped `rglob` — `extract_java_endpoints` among them — and reading it
->   there attaches a previous walk's warning to a complete answer. A test holds that.
-> - `_build_help_text()` runs at import (`_HELP = _build_help_text()`), so any helper
->   it interpolates must be defined **above** it, not merely before use.
-> - Four ledger/registry batteries caught new work before it was committed and are
->   worth trusting: the `SpringAuditResult.merge` field guard, the schema registry's
->   emitted-literal check, the `docs/CACHE.md` drift check, and `N-3`'s advisory
->   assertion.
-> - `test_cli.py::test_compact` asserts a cold cache without ensuring one. It fails
->   on the second run at any HEAD and passes on the first after a purge — identical
->   before and after every commit in this pass. It is not a regression and it is not
->   yet a row.
+> - `last_scan_truncation()` is ambient by design and must be read **at the call site**,
+>   right after the walk that produced the file list. `AUD-592-R01` is what happens when
+>   that reading is a free-floating local: it compiled, it imported, and it died on every
+>   call. A test that *imports* a command cannot see this; one that *calls* it can.
+> - `_build_help_text()` runs at import (`_HELP = _build_help_text()`), so any helper it
+>   interpolates must be defined **above** it, not merely before use.
+> - The four ledger/registry batteries from the previous pass remain worth trusting: the
+>   `SpringAuditResult.merge` field guard, the schema registry's emitted-literal check, the
+>   `docs/CACHE.md` drift check, and `N-3`'s advisory assertion.
+>
+> **The three process rules this pass makes non-optional** (the ledger carries the evidence):
+> close a class with a parametric test over the catalogue that already exists
+> (`FAN_IN_FIGURES`, `COMMANDS_THAT_WRITE`, the section registry), never over the reported
+> symbol — the three classes closed as sweeps did not recur and three of three closed by
+> instance did; never leave `closed` standing on a row whose assertion cannot fail on the
+> tree that produced the defect; and treat every packaged `.md` as a published authority
+> inside the same release assertion as `--help`.
 
 ---