sourcecode 5.9.11__tar.gz → 5.9.13__tar.gz

{sourcecode-5.9.11 → sourcecode-5.9.13}/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [5.9.13] — 2026-08-28
+
+*AUD-618 remediation and release-alignment patch.*
+
+**Fixed**
+
+- Windows now selects the existing sequential parse path instead of creating a
+  `ProcessPoolExecutor` whose spawned workers can fail to duplicate IPC handles.
+  The fallback preserves the same IR and prevents the observed silent/hanging
+  worker-start path.
+- A missing bare token now explains when ASK interpreted it as an implicit
+  repository path, while close command spellings retain nearest-command hints.
+- Spanish user documentation no longer states a false fixed token size for
+  compact context.
+
+**Verification boundary**
+
+- TeaVM validations cover risk delivery, migration planning and non-mutation.
+  Native Windows/pipx re-audit remains required for the worker, scale and
+  process-lifetime findings; this release does not claim that external evidence.
+
+## [5.9.12] — 2026-08-28
+
+*Release-alignment patch release after the `AUD-617` regression battery.*
+
+**Fixed and verified**
+
+- Core answer-producing commands now fail closed with structured evidence instead
+  of silently returning success when composition fails (`AUD-617-R`).
+- Root option preprocessing preserves the value of `--max-output-tokens` in both
+  space-separated and equals forms (`AUD-617-Q`).
+- `migrate-apply` plan-only output is covered as a non-silent, non-mutating path
+  (`AUD-617-MIGRATE-APPLY`).
+
+The native Windows scale and process-cleanup findings remain open because they
+require evidence from that platform. The commercial gate and conservative scale
+positioning are unchanged.
+
 ## [5.9.11] — 2026-08-28
 
 *`AUD-616` remediation: seven of nine rows closed, two partially, one carried forward.*

{sourcecode-5.9.11 → sourcecode-5.9.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.11
+Version: 5.9.13
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.11-blue)
+![Version](https://img.shields.io/badge/version-5.9.13-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.11 retains the shared Canonical IR
+**Current performance status.** Release 5.9.13 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -233,7 +233,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.11 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.13 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -266,7 +266,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.11 — and, on a build that has aged,
+ask version                    # ask 5.9.13 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.11 → sourcecode-5.9.13}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.11-blue)
+![Version](https://img.shields.io/badge/version-5.9.13-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.11 retains the shared Canonical IR
+**Current performance status.** Release 5.9.13 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -184,7 +184,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.11 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.13 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -217,7 +217,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.11 — and, on a build that has aged,
+ask version                    # ask 5.9.13 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.11 → sourcecode-5.9.13}/docs/DEFECT-LEDGER.md

@@ -14,6 +14,67 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — External Audit `AUD-618`
+
+**Re-audit of release `5.9.12`, received 2026-08-28.** The score improved modestly
+from 6.0/10 to 6.3/10. Two of six Bug-R commands recovered, but `risk`, `verify`,
+`audit-report` and `migrate-apply` remain unusable on the auditor's Windows corpus;
+`risk` now waits indefinitely rather than failing quickly. The decision is **patch
+forward, not rollback**: the release contains verified fixes and the failure is
+localised to the shared Windows worker/composer path.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `AUD-618-R` | Critical maximum | **open, P0** | `verify` captured 12 identical `PermissionError: [WinError 5]` failures in `multiprocessing/reduction.py:131` during `_winapi.DuplicateHandle` worker startup. `spring-audit` 3/3 and `migrate-check` 7/7 recovered; `verify` 6/6, `audit-report` in three formats, and `migrate-apply` 4/4 remain silent. `risk --limit 5/20` hangs in `composing risk factors / reading HTTP-input query sinks`; `risk --limit 0` is healthy. Add pool fallback or structured `WORKER_POOL_START_FAILED`, bounded joins and a matrix covering output, detach and formats. |
+| `AUD-618-TUTORIALS` | Critical | **open, P1** | Native Windows root compact was observed at 6m20.1s/exit 124, but a later flush produced valid 21.7 KB JSON. Treat as extreme latency pending reproduction, publish the size envelope and remeasure on Windows. |
+| `AUD-618-MIGRATE-APPLY` | High | **open, P1** | Plan mode remains exit 0 with zero bytes and no output file, 4/4. The `risk -o` to `audit-report --from-risk` mitigation is blocked by the producer failure. Emit a plan or `nothing_to_do`; prove non-mutation. |
+| `AUD-618-I` | High | **open, P1** | `cold-start --compact` emits 88,265-89,139 bytes, about 22K estimated tokens, despite the `~10K` help promise. Enforce a ceiling or correct the contract, then add a size regression. |
+| `AUD-618-7` | Medium | **open, P2** | Unknown command tokens are indistinguishable from missing implicit paths and receive no nearest-command suggestion. Add command admission before path fallback. |
+| `AUD-618-WIN-PROC` | Medium | **open, platform-blocked** | Windows timeout can leave `ask.exe` descendants alive. Requires native Windows/Git Bash process-tree evidence and safe Job Object/equivalent teardown. |
+| `AUD-618-WATCH` | Low | **open, unconfirmed** | One 42.8s `watch --once` sample after heavy work; clean-session reproduction required. |
+
+The audit reconfirms Q and E as fixed, the root pipeline as unaffected, and the prior
+F/P/C/#14/D/#9/G/M and other command closures. Commercially, retain bounded pilots and
+a provisional `$25-35/developer/month` hypothesis; do not market annual reliability,
+production CI gating or enterprise scale above roughly 3,000 files while the P0/P1 rows
+remain open.
+
+## Current Synchronization — External Audit `AUD-617`
+
+**Re-audit of release `5.9.11`, received 2026-08-28.** The external battery covered only
+`Documents/workspace/testing/`, used five forks and reported a clean target tree. Its score
+fell from 8.1/10 to 6.0/10 because the release introduced a critical false-success path:
+several core commands can exit 0 without an answer. The decision is to **patch forward**, not
+roll back: 5.9.11 contains valid independent fixes and the regression is localised to a
+shared composer/error boundary. Promotion and reliability-led CI claims remain blocked until
+the critical row is independently closed.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `AUD-617-R` | Critical maximum | **open, P0** | `risk`, `audit-report`, `verify`, `spring-audit` and intermittent `migrate-check` return exit 0 with empty stdout, stderr and output files, including `--detach`. Force logging of every caught exception at `composing risk factors`, return structured stderr and non-zero exit, and test every affected command, format, destination and detached path. |
+| `AUD-617-TUTORIALS` | Critical | **open, P1** | Native Windows/Git Bash still takes 6m20.1s on root `--compact`, exits 124 and emits nothing; `parsing manifests` is frozen for about 4.3 minutes. Profile Windows cache-key hits/syscalls, publish the size envelope and remeasure on the auditor's platform. |
+| `AUD-617-L` | Critical | **open, P1** | Markdown `audit-report` passed two Windows runs but remains historically contention-sensitive and shares the silent-failure risk. Retest deliberate contention and prove all failures emit bounded evidence. |
+| `AUD-617-Q` | Medium-high | **open, P2** | `--max-output-tokens 10` is parsed as a command; `--max-output-tokens=10` and the environment variable work. Fix the option parser and cover positions before/after the path. |
+| `AUD-617-MIGRATE-APPLY` | High | **open, P1** | `migrate-apply .` without `--write` exits 0 with no output and no file, unlike other plan-only commands. Emit an explicit plan or `nothing_to_do`; test stdout, pipes, `--output` and non-mutation. |
+| `AUD-617-WIN-PROC` | Medium | **open, platform-blocked** | One or two processes remain after successful Windows runs. Requires native Windows/Git Bash process-tree tests and must not receive a blind Darwin-only fix. |
+
+`AUD-617-P` is closed by the deterministic cache-GC fix; `KOTLIN`, `JUNIT4-SELF`, `E-PROV`
+and `INTENT-TIE-COV` are closed and independently confirmed. The report also confirms the
+previous `/dev/null`, cache, drift, impact, intent and timeout closures. Historical `L` and
+`O` must not be called genuinely fixed merely because the new silent path prevents their
+normal output or hint from being reached. Commercially, retain the conservative
+`$20-30/developer/month` working hypothesis and do not market enterprise-scale or production
+CI gating above roughly 3,000 files until `R`, the Windows scale case and `migrate-apply`
+close with cross-platform evidence.
+
+**Execution update.** `AUD-617-R` is **in progress**: the shared answer-delivery guard
+covers all five reported commands and the focused plus TeaVM normal-run matrix is green,
+but forced-exception and installed-artifact evidence remain. `AUD-617-Q` is **closed in
+the current fix** after correcting the space-form parser. `AUD-617-MIGRATE-APPLY` is
+**closed as not reproducible and test-covered**: plan mode emits a non-empty
+`migrate-apply-v1` answer and remains non-mutating. Windows and deliberate-contention rows
+remain open because they cannot be validated honestly from Darwin.
+
 ## Current Synchronization
 
 **Field simulation on TeaVM, 2026-08-27 — `ASK-FIELD`.** A deep, non-destructive

{sourcecode-5.9.11 → sourcecode-5.9.13}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,5 +1,94 @@
 # ASK — Development Roadmap
 
+### External Audit Intake — `AUD-618` re-audit, release 5.9.12
+
+The external re-audit received 2026-08-28 covers only `Documents/workspace/testing/`.
+All five scopes completed after two delivery retries; the seven forks remained clean,
+with no target Java-file changes, commits or out-of-scope artefacts. The score moved
+from 6.0/10 to 6.3/10: real progress exists, but the central reliability regression
+is only partially repaired.
+
+**Engineering decision: patch forward from 5.9.12; do not roll back.** The audit
+confirms that `spring-audit` and `migrate-check` recovered (10/10 combined repros),
+Q is fixed byte-for-byte and E is fully closed. Rolling back would restore known
+defects and discard these verified corrections. The release remains blocked for
+reliability-led commitments and production CI-gating claims until the remaining
+P0/P1 rows have independent cross-platform evidence.
+
+| ID | Severity | Status | Finding, evidence and required closure |
+|---|---:|---|---|
+| AUD-618-R | Critical maximum / regression | **Implemented; native Windows verification pending** | `cee27de` disables the Windows `ProcessPoolExecutor` before `spawn` duplicates IPC handles, falling back to the existing byte-identical sequential parse. Focused regressions and a TeaVM `risk --limit 5 --output` run pass. The remaining closure evidence is the auditor's native Windows/pipx matrix for `risk`, `verify`, `audit-report`, `spring-audit` and `migrate-check`. |
+| AUD-618-TUTORIALS | Critical / scale | **Open, P1** | Native Windows root `--compact` took 6m20.1s and was observed as exit 124, but the later flush produced a valid 21.7 KB JSON result. Reclassify this as extreme latency, not a confirmed hang: parsing manifests is the dominant stall. Publish a repository-size envelope and measure on the auditor's platform; do not market enterprise scale until then. |
+| AUD-618-MIGRATE-APPLY | High / silent-success | **Implemented; native Windows verification pending** | Existing plan mode plus the pool fallback now produce a valid TeaVM `migrate-apply-v1` file and retain non-mutation. Re-run the auditor's Windows/pipx output matrix before full closure. |
+| AUD-618-I | High / contract | **Closed** | The current CLI help already states that compact output is snapshot-dependent; `5b9f2dc` removes the stale `~10K` Spanish manual claim and protects both user guides. |
+| AUD-618-7 | Medium / CLI admission | **Closed** | `167cdda` preserves valid implicit paths but identifies a missing bare token as an implicit-path interpretation and points to `ask --help`; close spellings still receive nearest-command suggestions. |
+| AUD-618-WIN-PROC | Medium / platform-specific | **Open, platform-blocked** | After a Windows timeout, `ask.exe` descendants can survive for minutes. Validate native Windows and Git Bash process-tree cleanup, preferably with Job Objects or an equivalent parent/child lifetime boundary. Do not ship a Darwin-only assumption. |
+| AUD-618-WATCH | Low / observation | **Open, unconfirmed** | One isolated `ask watch . --once` run took 42.8s after heavy commands; historical behaviour is instant. Re-measure from a clean session before classifying it as a regression. |
+
+**Preserved healthy scope.** The audit re-confirmed the root command, `risk --limit 0`,
+the impact family, endpoints, posture, PR commands, drift, remediation, CVE, verify-edit,
+explain, intent, baseline, data exposure, rename-class dry-run, migrate-recipe, retrieve,
+pack gate/list and the prior Q/E/F/P/C/#14/D/#9/G/M closures. This narrows remediation to
+the heavy shared composer and the explicitly listed contracts.
+
+**Commercial decision.** Progress supports a provisional `$25-35/developer/month`
+hypothesis, not validated pricing. Continue only bounded pilots with explicit timeouts,
+captured output and a non-empty-answer assertion. Do not promise annual reliability,
+production CI gating or enterprise-scale support above roughly 3,000 files until R,
+MIGRATE-APPLY, the Windows scale evidence and process cleanup close independently.
+
+### External Audit Intake — `AUD-617` re-audit, release 5.9.11
+
+The 2026-08-28 external re-audit is the first report to identify a release-level
+regression in the core answer contract. It exercised only `Documents/workspace/testing/`
+and reported no target-repository mutation, commits or Java-file changes. The score fell
+from 8.1/10 for 5.9.10 to 6.0/10 for 5.9.11. The fall is justified: `risk`,
+`audit-report`, `verify`, `spring-audit` and intermittently `migrate-check` can terminate
+with exit 0 and zero bytes on stdout, stderr and `--output`.
+
+**Engineering decision: patch forward from 5.9.11; do not roll back.** The release also
+contains four independently confirmed corrections (Kotlin stack admission, JUnit4 library
+classification, output-format ordering and event-topology parity), the cache fix and useful
+phase-level observability. A rollback would restore the prior cache and classification
+defects and would not provide a safe long-term baseline. However, 5.9.11 is **blocked for
+promotion, CI-gating claims and reliability-led commercial commitments** until `AUD-617-R`
+is fixed and independently re-tested. The release branch must retain a fail-closed contract:
+an internal exception must produce structured stderr and a non-zero exit, never success with
+an empty answer.
+
+| ID | Severity | Status | Finding and required closure |
+|---|---:|---|---|
+| AUD-617-R | Critical maximum / release regression | **Open, P0** | Shared `composing risk factors` failure makes `risk`, `audit-report`, `verify`, `spring-audit` and sometimes `migrate-check` return exit 0 with no output, including `--output` and `--detach`. `risk --limit 0` and `pr-risk`, `impact`, `impact-chain`, `drift` and `remediate` remain healthy, localising the defect to the shared composer/error boundary. Instrument the exact phase, force logging of every caught exception, return a structured error and non-zero exit, and add a matrix over all affected commands, formats, output destinations and detached execution. |
+| AUD-617-TUTORIALS | Critical / platform regression | **Open, P1** | On native Windows/Git Bash, root `--compact` still takes 6m20.1s, exits 124 and emits zero bytes, with `parsing manifests` frozen for about 4.3 minutes. The 5.9.11 optimisation measured 54.9s on another platform, so it does not generalise. Profile `manifest_cache` and cache-key hit rates on Windows; publish a repository-size envelope and repeat the same test on the auditor's platform. |
+| AUD-617-L | Critical / historical regression | **Open, P1** | `audit-report --format markdown` was 2/2 successful on the auditor's Windows run, but remains non-deterministic across the historical series and shares the silent-failure risk. Keep the bounded `PhasedRun`/partial contract, then test deliberate contention and verify that all failure paths emit evidence. |
+| AUD-617-Q | Medium-high / CLI contract | **Open, P2** | `--max-output-tokens 10` fails as if `10` were a command; `--max-output-tokens=10` and the environment variable work. The defect is specific to this option. Fix the option declaration/parser and add positional tests before and after the repository path. |
+| AUD-617-MIGRATE-APPLY | High / silent-success contract | **Open, P1** | `migrate-apply .` without `--write` returns exit 0 with zero stdout/stderr and does not create a file, unlike other dry-run commands. It must emit an explicit plan or `nothing_to_do`, and return structured errors if planning fails. Add tests for stdout, pipe, `--output` and no-write non-mutation. |
+| AUD-617-WIN-PROC | Medium / platform-specific | **Open, not actionable on Darwin** | One or two processes remain after successful Windows runs, improved from six or seven but not zero. The issue requires native Windows/Git Bash process-tree tests and Job Objects or equivalent teardown; no blind platform-specific fix should ship from Darwin. |
+| AUD-617-P | Low-medium / investigation | **Closed in 5.9.11** | The serialized race did not reproduce; the deterministic cache-GC mechanism with the same symptom was fixed. Keep the concurrency test because independent processes share the repository cache. |
+| AUD-617-KOTLIN, JUNIT4-SELF, E-PROV, INTENT-TIE-COV | Medium to low | **Closed in 5.9.11** | The auditor independently confirmed Kotlin classification, JUnit4 library classification, three-command event parity and honest same-class intent ties. Preserve their dedicated regressions while fixing the shared core. |
+
+**Regression interpretation.** The 5.9.11 change is worse than the earlier visible timeout:
+exit 124 exposed an availability problem, whereas exit 0 with no bytes creates a false green
+for unattended agents and CI. `--detach` is not a mitigation because the child dies after
+the phase heartbeat without recording its exception. Historical `L` and `O` must not be
+marked genuinely fixed merely because the new failure prevents their normal output or hint
+from being reached.
+
+**Commercial decision.** Pause reliability-led sales and production CI-gating claims for
+repositories above roughly 3,000 files. Retain the conservative `$20-30/developer/month`
+working band from the audit, without presenting it as validated pricing. Normal-repository
+pilots may continue only with bounded timeouts, output capture and explicit verification of
+non-empty evidence. The gate can be lifted only after `AUD-617-R`, the Windows scale case and
+the `migrate-apply` silent-success path have independent, cross-platform evidence.
+
+**AUD-617 execution update.** `AUD-617-R` is **in progress**: the shared answer-delivery
+guard covers all five reported commands and the focused plus TeaVM normal-run matrix is
+green, but forced-exception and installed-artifact evidence remain before closure.
+`AUD-617-Q` is **closed in the current fix** after the space-form parser correction.
+`AUD-617-MIGRATE-APPLY` is **closed as not reproducible and test-covered**: plan mode emits
+a non-empty `migrate-apply-v1` answer and does not mutate the repository. The remaining
+Windows/contended P1 rows stay open because this Darwin checkout cannot validate them.
+
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 

{sourcecode-5.9.11 → sourcecode-5.9.13}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.11`, following the external `5.9.3` reconciliation.**
+> **CURRENT UPDATE — release `5.9.13`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -19,6 +19,38 @@
 > non-reproduction did not cover the payload shape now identified. Details are
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
+> **AUD-618 RE-AUDIT — the 5.9.12 reliability gate remains active.** The score
+> improved only to **6.3/10**. `spring-audit` and `migrate-check` recovered, but
+> `risk`, `verify`, `audit-report` and `migrate-apply` remain affected; `risk` now
+> waits indefinitely in the shared composer on Windows. The captured cause is
+> `PermissionError: [WinError 5]` at `_winapi.DuplicateHandle` during `spawn_main`.
+> This is a partial repair, not a release clearance. Patch forward, do not roll
+> back: preserve the verified fixes while blocking reliability-led sales and
+> production CI-gating claims. The price hypothesis is `$25-35/developer/month`,
+> not validated pricing. Windows scale, orphan process cleanup, cold-start output
+> sizing and command admission remain open. Full triage is in the `AUD-618` sections
+> of the development roadmap and defect ledger.
+
+> **CRITICAL REGRESSION — re-audit of `5.9.11`, received 2026-08-28.** The external
+> battery lowered the score to **6.0/10**: `risk`, `audit-report`, `verify`,
+> `spring-audit` and intermittently `migrate-check` can exit `0` with no stdout,
+> stderr or output file. This is more dangerous than a timeout because CI and an
+> agent can interpret false success as a valid answer. The release is therefore
+> blocked for reliability-led commitments and production CI-gating claims.
+>
+> The engineering decision is to **patch forward**, not roll back. The release
+> retains several independently confirmed fixes and the regression is localised
+> to the shared `composing risk factors`/error boundary. The immediate gate is
+> `AUD-617-R`: every caught exception must produce structured evidence and a
+> non-zero exit. Two additional blockers are the native Windows `tutorials`
+> scale regression (`6m20.1s`, exit `124`, zero bytes) and silent-success
+> `migrate-apply` without `--write`. `--max-output-tokens 10` is also open as a
+> CLI parser defect; Windows process cleanup remains unverified from Darwin.
+> Normal bounded pilots may continue, but retain the conservative `$20-30`
+> working hypothesis and do not market enterprise-scale reliability above about
+> 3,000 files. Full triage is recorded in `AUD-617` in the development roadmap
+> and defect ledger.
+
 > **REMEDIATION — `AUD-616` worked through, released as `5.9.11`.** Seven of the nine findings are
 > closed and two are partially closed. Closed: the Kotlin repository now reports Kotlin as
 > its primary stack and demotes the unsupported Java claim to low confidence; the

{sourcecode-5.9.11 → sourcecode-5.9.13}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.9.11**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.13**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,7 +8,7 @@
 
 ## 1. ¿Qué es ASK Engine?
 
-### Contratos de fiabilidad de la versión 5.9.11
+### Contratos de fiabilidad de la versión 5.9.13
 
 **Un plazo que el análisis raíz sí respeta.** `ASK_MAX_ANALYSIS_SECONDS=<segundos>`
 ahora detiene `ask <repo>` en una frontera de fase medida. Una ejecución que agota
@@ -292,7 +292,7 @@ lea una persona. Proyectan el mismo modelo semántico en contexto listo para un
 | `ask prepare-context <tarea>` | Paquete de contexto según la tarea (`onboard`, `review-pr`, `fix-bug`, `refactor`, `generate-tests`) dimensionado para un prompt de LLM. |
 | `ask repo-ir` | El propio IR de símbolos a bajo nivel — la representación semántica en crudo, para herramientas que quieren el grafo, no un informe. |
 | `ask --agent` | Envoltorio de salida optimizado para agentes en cualquier comando. |
-| `ask --compact` | Un subconjunto de ~10K tokens (estado, stacks, entry points, dependencias clave) para orientación barata. |
+| `ask --compact` | Un subconjunto de orientación (estado, stacks, entry points y dependencias clave). Su tamaño depende del repositorio y de la vista; comprueba el tamaño publicado antes de inyectarlo directamente en un agente. |
 | `ask mcp` | Ejecuta ASK como servidor MCP para que un agente (Claude Desktop / Cursor) lo llame como herramienta. |
 
 Regla práctica: los comandos **para desarrollador** (`impact`, `spring-audit`, `endpoints`,

{sourcecode-5.9.11 → sourcecode-5.9.13}/docs/PRODUCT-ROUTE.md

@@ -33,6 +33,18 @@ The public trust layer, if activated, must be a generated and redacted
 projection, never the raw defect ledger. Its acceptance rules must exclude
 maintainer paths, third-party evaluation subjects and unsupported claims.
 
+**5.9.12 commercial gate.** The 2026-08-28 re-audit found that the critical
+reliability regression is only partially repaired: `spring-audit` and `migrate-check`
+recovered, while `risk`, `verify`, `audit-report` and `migrate-apply` remain affected.
+This invalidates a reliability-led annual commitment and production CI-gating
+positioning until the shared worker/composer boundary is fixed and independently
+tested. The route therefore continues with bounded pilots only, retains a
+provisional `$25-35/developer/month` working hypothesis, and does not claim
+enterprise-scale support above roughly 3,000 files. The correct engineering response
+is a forward patch, not a rollback, because 5.9.12 contains valid fixes that must be
+preserved. See the detailed `AUD-618` intake in [`DEVELOPMENT-ROADMAP.md`](DEVELOPMENT-ROADMAP.md) and
+[`DEFECT-LEDGER.md`](DEFECT-LEDGER.md).
+
 ### Evidence and commercial validation boundary
 
 The 5.9.2 external review confirms that `audit-report --sign-key` and

{sourcecode-5.9.11 → sourcecode-5.9.13}/docs/USER_GUIDE.md

@@ -46,16 +46,16 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.11, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.13, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.11, with release-artifact verification
+the two pack fixes are included in release 5.9.13, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.11
+### Reliability contracts in 5.9.13
 
 **A deadline the root analysis honours.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>` now
 stops `ask <repo>` at a measured phase boundary. A run that spends its budget
@@ -260,7 +260,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.11
+# ask 5.9.13
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.11 → sourcecode-5.9.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.11"
+version = "5.9.13"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.11 → sourcecode-5.9.13}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.11"
+__version__ = "5.9.13"

{sourcecode-5.9.11 → sourcecode-5.9.13}/src/sourcecode/cli.py

@@ -1043,6 +1043,7 @@ _OPTIONS_WITH_VALUE: frozenset[str] = frozenset({
     "--max-nodes",
     "--docs-depth",
     "--depth",
+    "--max-output-tokens",
     "--git-depth",
     "--git-days",
     "--since", "--base",
@@ -1854,6 +1855,21 @@ def _admit_path(
             pass
         return admission.resolved
     hint = rejection_hint(admission, usage=usage)
+    raw_token = str(raw)
+    if (
+        admission.reason == "missing"
+        and raw_token
+        and "/" not in raw_token
+        and "\\" not in raw_token
+    ):
+        # A bare first token belongs to the documented `ask <path>` grammar.
+        # Do not guess that it is a command and make a legitimate not-yet-created
+        # repository impossible to name; instead make the interpretation visible
+        # and point an operator who meant a command at the authoritative list.
+        hint = (
+            f"{hint} `{raw_token}` was interpreted as an implicit repository path. "
+            "If you intended a command, run `ask --help` and retry its exact name."
+        )
     if extra_hint:
         hint = f"{hint} {extra_hint}"
     _emit_error_json(
@@ -12248,6 +12264,7 @@ def spring_audit_cmd(
 {{NON_COVERAGE}}
     Silence about those is not evidence that there is nothing to find.
 """
+    _require_answer_delivery("spring-audit")
     _apply_jobs(jobs)
     import json as _json
 
@@ -13128,6 +13145,7 @@ def verify_cmd(
       ask verify --fail-on any              # gate on every violation
       ask verify --fail-on never            # report without gating
     """
+    _require_answer_delivery("verify")
     from sourcecode import verify_repo as _vr
     from sourcecode import readonly as _readonly
 
@@ -15368,6 +15386,7 @@ def migrate_check_cmd(
       blockers; and explicit Oracle JDK/licensing-review signals. This is
       inventory evidence, not legal advice, and it never changes readiness_score.
     """
+    _require_answer_delivery("migrate-check")
     _apply_jobs(jobs)
     from sourcecode.repository_ir import find_java_files
     from sourcecode.migrate_check import run_migrate_check

{sourcecode-5.9.11 → sourcecode-5.9.13}/src/sourcecode/parallel.py

@@ -202,6 +202,15 @@ def prefill_parse_cache(
         # a build that forks itself on every analysis.
         receipt["reason"] = "frozen build — worker processes would re-enter the CLI"
         return receipt
+    if os.name == "nt":
+        # Windows workers use ``spawn`` and must duplicate the parent's IPC
+        # handles. A denied DuplicateHandle leaves a ProcessPoolExecutor with no
+        # usable workers; depending on which consumer waits for its cache entry,
+        # that used to become either silent success or an unbounded wait. The
+        # sequential loop below is the designed fallback and produces the same
+        # IR, so prefer a reliable answer to speculative parse parallelism.
+        receipt["reason"] = "Windows — parsing sequentially to avoid spawn worker-handle failures"
+        return receipt
 
     # Retire dead generations once, here, rather than letting N workers race to
     # do it (C3-70's purge is idempotent, but doing it once is cheaper).