sourcecode 5.9.12__tar.gz → 5.9.14__tar.gz

sourcecode-5.9.14/.github/workflows/windows-regression.yml

@@ -0,0 +1,66 @@
+name: Windows CLI regressions
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+# S-10 / AUD-591-A10: the product declares Windows support, but Linux CI cannot
+# observe Git Bash rewriting a route argument such as `/owners` to an absolute
+# Windows path.  Keep both the normal Python regression suite and the actual
+# Git Bash invocation on a Windows runner.
+jobs:
+  windows-cli:
+    runs-on: windows-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install test dependencies
+        shell: pwsh
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      - name: Run Windows encoding and route-prefix regressions
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pytest -q -n 0 \
+            tests/test_encoding_regression.py \
+            tests/test_output_encoding.py \
+            tests/test_path_prefix_selection.py
+
+      - name: Prove Git Bash cannot turn a route filter into a clean zero
+        shell: bash
+        run: |
+          set -euo pipefail
+          fixture="$RUNNER_TEMP/ask-prefix-fixture"
+          mkdir -p "$fixture/src/main/java/com/acme"
+          cat > "$fixture/src/main/java/com/acme/OwnerController.java" <<'EOF'
+          package com.acme;
+          import org.springframework.web.bind.annotation.*;
+          @RestController
+          @RequestMapping("/owners")
+          public class OwnerController {
+            @GetMapping("/list") public String list() { return "ok"; }
+          }
+          EOF
+
+          # Do not set MSYS_NO_PATHCONV here: this is the shell transformation
+          # the guard must diagnose.  A successful empty result is a false
+          # negative; reject it and require the actionable Git Bash hint.
+          set +e
+          python run_cli.py endpoints "$fixture" --path-prefix /owners --format json \
+            > "$RUNNER_TEMP/ask-prefix.stdout" \
+            2> "$RUNNER_TEMP/ask-prefix.stderr"
+          status=$?
+          set -e
+          test "$status" -ne 0
+          grep -F "Git Bash" "$RUNNER_TEMP/ask-prefix.stderr"

{sourcecode-5.9.12 → sourcecode-5.9.14}/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## [5.9.14] — 2026-08-30
+
+*AUD-619 intake, Windows reliability follow-up and release alignment.*
+
+**Changed**
+
+- Integrated the latest `master` fixes for Windows Git Bash routing, response
+  metadata preservation and nonbinding analysis-budget disclosure.
+- Preserved the audit boundary: native Windows repetition, cache-write lifecycle,
+  review-pr normalization and process teardown remain verification work.
+
+## [5.9.13] — 2026-08-28
+
+*AUD-618 remediation and release-alignment patch.*
+
+**Fixed**
+
+- Windows now selects the existing sequential parse path instead of creating a
+  `ProcessPoolExecutor` whose spawned workers can fail to duplicate IPC handles.
+  The fallback preserves the same IR and prevents the observed silent/hanging
+  worker-start path.
+- A missing bare token now explains when ASK interpreted it as an implicit
+  repository path, while close command spellings retain nearest-command hints.
+- Spanish user documentation no longer states a false fixed token size for
+  compact context.
+
+**Verification boundary**
+
+- TeaVM validations cover risk delivery, migration planning and non-mutation.
+  Native Windows/pipx re-audit remains required for the worker, scale and
+  process-lifetime findings; this release does not claim that external evidence.
+
 ## [5.9.12] — 2026-08-28
 
 *Release-alignment patch release after the `AUD-617` regression battery.*

{sourcecode-5.9.12 → sourcecode-5.9.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.12
+Version: 5.9.14
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.12-blue)
+![Version](https://img.shields.io/badge/version-5.9.14-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.12 retains the shared Canonical IR
+**Current performance status.** Release 5.9.14 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -233,7 +233,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.12 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.14 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -266,7 +266,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.12 — and, on a build that has aged,
+ask version                    # ask 5.9.14 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.12 → sourcecode-5.9.14}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.12-blue)
+![Version](https://img.shields.io/badge/version-5.9.14-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.12 retains the shared Canonical IR
+**Current performance status.** Release 5.9.14 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -184,7 +184,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.12 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.14 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -217,7 +217,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.12 — and, on a build that has aged,
+ask version                    # ask 5.9.14 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.12 → sourcecode-5.9.14}/docs/DEFECT-LEDGER.md

@@ -14,6 +14,54 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — External Audit `AUD-619`
+
+**Re-audit of release `5.9.13`, received 2026-08-28.** The previous apparent
+closure of Bug R is withdrawn: identical Windows invocations failed five times and
+then succeeded once, exposing a high-frequency race rather than a binary version
+state. The score is 6.0/10. The decision remains **patch forward**, with a minimum
+30-run per-command closure bar.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `AUD-619-R` | Critical maximum | **open, P0** | `migrate-check` failed 5/6 identical runs; `risk`, `verify`, `audit-report` and `migrate-apply` also remain silent or hang. The known mechanism is Windows `spawn`/`DuplicateHandle` followed by an unbounded wait. Implement deterministic fallback or fail-fast bounded worker handling, then run >=30 Windows/pipx repetitions per affected command. |
+| `AUD-619-CACHE-WRITE` | High | **open, P1** | `tutorials` produced complete 21.7 KB output before a further minute in `building cache entry`. Profile serialization, filesystem and lock costs and separate answer delivery from post-delivery cache work. |
+| `AUD-619-REVIEW-PR` | High | **open, P1** | One of seven runs on a valid Git repository returned lowercase `no_git_repo`; six returned canonical `NO_DIFF_SOURCE`. Find and normalize the nondeterministic fallback. |
+| `AUD-619-WIN-PROC` | Medium | **open, platform-blocked** | Root `--agent` wrote valid 41,336-byte JSON but stayed alive to an external timeout; three descendants remained. Validate native Windows teardown and Job Object lifetime. |
+| `AUD-619-I` | High | **re-opened for comparable measurement** | Compact sizes differed with RIS state: 3,496 bytes cold and 31,260 bytes after partial warm. Publish a reproducible priming sequence before deciding the contract. |
+| `AUD-619-7` | Medium | **partially fixed** | Ambiguity is explained; suggestions remain correctly conditional on a close command candidate. |
+| `AUD-619-WATCH` | Low | **closed/no-repro** | Clean small-repository run completed in 0.526s. |
+
+`audit-report --from-risk` produced a valid 156 KB report, confirming that report
+rendering is healthy when the risk computation is bypassed. Preserve the prior Q/E/F/P
+and command-family closures. Commercial positioning remains bounded pilots only at
+the provisional `$25-35/developer/month` hypothesis.
+
+## Current Synchronization — External Audit `AUD-618`
+
+**Re-audit of release `5.9.12`, received 2026-08-28.** The score improved modestly
+from 6.0/10 to 6.3/10. Two of six Bug-R commands recovered, but `risk`, `verify`,
+`audit-report` and `migrate-apply` remain unusable on the auditor's Windows corpus;
+`risk` now waits indefinitely rather than failing quickly. The decision is **patch
+forward, not rollback**: the release contains verified fixes and the failure is
+localised to the shared Windows worker/composer path.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `AUD-618-R` | Critical maximum | **open, P0** | `verify` captured 12 identical `PermissionError: [WinError 5]` failures in `multiprocessing/reduction.py:131` during `_winapi.DuplicateHandle` worker startup. `spring-audit` 3/3 and `migrate-check` 7/7 recovered; `verify` 6/6, `audit-report` in three formats, and `migrate-apply` 4/4 remain silent. `risk --limit 5/20` hangs in `composing risk factors / reading HTTP-input query sinks`; `risk --limit 0` is healthy. Add pool fallback or structured `WORKER_POOL_START_FAILED`, bounded joins and a matrix covering output, detach and formats. |
+| `AUD-618-TUTORIALS` | Critical | **open, P1** | Native Windows root compact was observed at 6m20.1s/exit 124, but a later flush produced valid 21.7 KB JSON. Treat as extreme latency pending reproduction, publish the size envelope and remeasure on Windows. |
+| `AUD-618-MIGRATE-APPLY` | High | **open, P1** | Plan mode remains exit 0 with zero bytes and no output file, 4/4. The `risk -o` to `audit-report --from-risk` mitigation is blocked by the producer failure. Emit a plan or `nothing_to_do`; prove non-mutation. |
+| `AUD-618-I` | High | **open, P1** | `cold-start --compact` emits 88,265-89,139 bytes, about 22K estimated tokens, despite the `~10K` help promise. Enforce a ceiling or correct the contract, then add a size regression. |
+| `AUD-618-7` | Medium | **open, P2** | Unknown command tokens are indistinguishable from missing implicit paths and receive no nearest-command suggestion. Add command admission before path fallback. |
+| `AUD-618-WIN-PROC` | Medium | **open, platform-blocked** | Windows timeout can leave `ask.exe` descendants alive. Requires native Windows/Git Bash process-tree evidence and safe Job Object/equivalent teardown. |
+| `AUD-618-WATCH` | Low | **open, unconfirmed** | One 42.8s `watch --once` sample after heavy work; clean-session reproduction required. |
+
+The audit reconfirms Q and E as fixed, the root pipeline as unaffected, and the prior
+F/P/C/#14/D/#9/G/M and other command closures. Commercially, retain bounded pilots and
+a provisional `$25-35/developer/month` hypothesis; do not market annual reliability,
+production CI gating or enterprise scale above roughly 3,000 files while the P0/P1 rows
+remain open.
+
 ## Current Synchronization — External Audit `AUD-617`
 
 **Re-audit of release `5.9.11`, received 2026-08-28.** The external battery covered only

{sourcecode-5.9.12 → sourcecode-5.9.14}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,5 +1,80 @@
 # ASK — Development Roadmap
 
+### External Audit Intake — `AUD-619` re-audit, release 5.9.13
+
+The follow-up received 2026-08-28 materially revises the apparent closure of
+`AUD-618-R`. Across repeated Windows runs, the same invocation can fail silently
+five times and succeed on the sixth; the observed failure rate is approximately
+50-90% depending on command. Small 3-10 run samples are therefore insufficient
+to label the defect fixed. The score was 6.0/10, down from 6.3/10, not because a
+code regression is proven between releases but because the reliability risk is
+now better measured.
+
+**Engineering decision: patch forward from 5.9.13; do not roll back.** The audit
+confirms that the regression is a high-frequency race, not a stable version flag,
+and that `audit-report --from-risk` can produce a valid 156 KB report. Rollback
+would not remove the race and would discard verified fixes. The closure bar is now
+at least 30 consecutive invocations per affected command, with output, exit status,
+timeout and error-channel evidence captured.
+
+| ID | Severity | Status | Finding, evidence and required closure |
+|---|---:|---|---|
+| AUD-619-R | Critical maximum / race regression | **Open, P0** | `migrate-check` failed 5/6 identical runs and then succeeded with 28,249 bytes; `risk --limit 5/20`, `spring-audit --compact`, `verify`, `audit-report` and `migrate-apply` remain intermittently silent or hanging. The two symptoms are fast exit 0/zero bytes and an indefinite wait in `composing risk factors`, consistent with Windows `spawn`/`DuplicateHandle` failure followed by an unbounded future/join wait. The current Darwin fallback is not sufficient evidence for the auditor's Windows artefact. Add a deterministic single-process/thread fallback or fail-fast bounded pool startup, bound every join/get, and run >=30 consecutive Windows/pipx tests per command and output mode. |
+| AUD-619-CACHE-WRITE | High / performance and lifecycle | **Open, P1** | On `tutorials` (24,073 files), root compact produced the complete 21.7 KB JSON before spending another minute in `building cache entry (the answer above is complete)`. Profile core size, serialization, filesystem writes and cache locking; publish phase timings and ensure the answer process exits after delivery or reports post-delivery work separately. |
+| AUD-619-REVIEW-PR | High / nondeterministic error | **Open, P1** | `review-pr` returned a false `no_git_repo` error once in 7 runs on a confirmed Git repository; six runs correctly returned `NO_DIFF_SOURCE`. Trace the fallback that emits lowercase `no_git_repo`, normalize it to the canonical error authority, and repeat under clean/concurrent cache conditions. |
+| AUD-619-WIN-PROC | Medium / lifecycle | **Open, platform-blocked** | `ask --agent` wrote valid 41,336-byte JSON but remained alive until an external 300s timeout; three `ask.exe` descendants remained after termination. Measure post-serialization teardown and enforce parent/child lifetime cleanup with native Windows Job Objects or equivalent. |
+| AUD-619-I | High / contract evidence | **Re-opened for comparable measurement** | The auditor saw 3,496 bytes with no RIS and 31,260 bytes after partial warm, not the prior 88-89 KB. Publish the exact priming sequence and classify only after comparing the same snapshot state. |
+| AUD-619-7 | Medium / UX | **Partially fixed** | The ambiguity is now explained and no suggestion is emitted where edit distance yields no valid command. Keep nearest-command suggestions for close spellings and test both branches. |
+| AUD-619-WATCH | Low | **Closed as not reproduced** | `watch --once` completed in 0.526s on a clean small-repository run; retain a clean-session performance probe. |
+
+**Confirmed healthy scope.** `audit-report --from-risk` produced valid output,
+the root pipeline remained healthy, Q/E/F/P/C and the prior command families stayed
+stable, and `risk --limit 0` continued to bypass the affected composer. The problem
+is therefore concentrated in the shared heavy computation and its lifecycle, not
+in general serialization or every CLI command.
+
+**Commercial decision.** Retain only bounded pilots and the provisional
+`$25-35/developer/month` hypothesis. Do not promise production CI gating, annual
+reliability or enterprise scale above roughly 3,000 files until the 30-run Windows
+matrix, cache-write lifecycle and review-pr error normalization are closed.
+
+### External Audit Intake — `AUD-618` re-audit, release 5.9.12
+
+The external re-audit received 2026-08-28 covers only `Documents/workspace/testing/`.
+All five scopes completed after two delivery retries; the seven forks remained clean,
+with no target Java-file changes, commits or out-of-scope artefacts. The score moved
+from 6.0/10 to 6.3/10: real progress exists, but the central reliability regression
+is only partially repaired.
+
+**Engineering decision: patch forward from 5.9.12; do not roll back.** The audit
+confirms that `spring-audit` and `migrate-check` recovered (10/10 combined repros),
+Q is fixed byte-for-byte and E is fully closed. Rolling back would restore known
+defects and discard these verified corrections. The release remains blocked for
+reliability-led commitments and production CI-gating claims until the remaining
+P0/P1 rows have independent cross-platform evidence.
+
+| ID | Severity | Status | Finding, evidence and required closure |
+|---|---:|---|---|
+| AUD-618-R | Critical maximum / regression | **Implemented; native Windows verification pending** | `cee27de` disables the Windows `ProcessPoolExecutor` before `spawn` duplicates IPC handles, falling back to the existing byte-identical sequential parse. Focused regressions and a TeaVM `risk --limit 5 --output` run pass. The remaining closure evidence is the auditor's native Windows/pipx matrix for `risk`, `verify`, `audit-report`, `spring-audit` and `migrate-check`. |
+| AUD-618-TUTORIALS | Critical / scale | **Open, P1** | Native Windows root `--compact` took 6m20.1s and was observed as exit 124, but the later flush produced a valid 21.7 KB JSON result. Reclassify this as extreme latency, not a confirmed hang: parsing manifests is the dominant stall. Publish a repository-size envelope and measure on the auditor's platform; do not market enterprise scale until then. |
+| AUD-618-MIGRATE-APPLY | High / silent-success | **Implemented; native Windows verification pending** | Existing plan mode plus the pool fallback now produce a valid TeaVM `migrate-apply-v1` file and retain non-mutation. Re-run the auditor's Windows/pipx output matrix before full closure. |
+| AUD-618-I | High / contract | **Closed** | The current CLI help already states that compact output is snapshot-dependent; `5b9f2dc` removes the stale `~10K` Spanish manual claim and protects both user guides. |
+| AUD-618-7 | Medium / CLI admission | **Closed** | `167cdda` preserves valid implicit paths but identifies a missing bare token as an implicit-path interpretation and points to `ask --help`; close spellings still receive nearest-command suggestions. |
+| AUD-618-WIN-PROC | Medium / platform-specific | **Open, platform-blocked** | After a Windows timeout, `ask.exe` descendants can survive for minutes. Validate native Windows and Git Bash process-tree cleanup, preferably with Job Objects or an equivalent parent/child lifetime boundary. Do not ship a Darwin-only assumption. |
+| AUD-618-WATCH | Low / observation | **Open, unconfirmed** | One isolated `ask watch . --once` run took 42.8s after heavy commands; historical behaviour is instant. Re-measure from a clean session before classifying it as a regression. |
+
+**Preserved healthy scope.** The audit re-confirmed the root command, `risk --limit 0`,
+the impact family, endpoints, posture, PR commands, drift, remediation, CVE, verify-edit,
+explain, intent, baseline, data exposure, rename-class dry-run, migrate-recipe, retrieve,
+pack gate/list and the prior Q/E/F/P/C/#14/D/#9/G/M closures. This narrows remediation to
+the heavy shared composer and the explicitly listed contracts.
+
+**Commercial decision.** Progress supports a provisional `$25-35/developer/month`
+hypothesis, not validated pricing. Continue only bounded pilots with explicit timeouts,
+captured output and a non-empty-answer assertion. Do not promise annual reliability,
+production CI gating or enterprise-scale support above roughly 3,000 files until R,
+MIGRATE-APPLY, the Windows scale evidence and process cleanup close independently.
+
 ### External Audit Intake — `AUD-617` re-audit, release 5.9.11
 
 The 2026-08-28 external re-audit is the first report to identify a release-level

{sourcecode-5.9.12 → sourcecode-5.9.14}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.12`, following the external `5.9.3` reconciliation.**
+> **CURRENT UPDATE — release `5.9.14`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -19,6 +19,31 @@
 > non-reproduction did not cover the payload shape now identified. Details are
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
+> **AUD-619 RE-AUDIT — Bug R remains a critical race.** Identical Windows runs
+> failed five times and succeeded once, so earlier small samples cannot support a
+> fixed verdict. `migrate-check`, `risk`, `verify`, `audit-report` and
+> `migrate-apply` remain exposed to silent exit or unbounded wait. `tutorials` can
+> finish its answer before spending another minute building the cache entry.
+> A valid `audit-report --from-risk` proves the renderer itself is healthy. Patch
+> forward from `5.9.13`, retain bounded pilots, and require at least 30 consecutive
+> Windows/pipx runs per affected command before closure. Review-pr fallback
+> normalization, cache-write lifecycle, Windows process cleanup and comparable
+> compact priming remain open. The commercial hypothesis stays
+> `$25-35/developer/month`; no production CI-gating or enterprise-scale promise
+> is authorized above roughly 3,000 files.
+
+> **AUD-618 RE-AUDIT — the 5.9.12 reliability gate remains active.** The score
+> improved only to **6.3/10**. `spring-audit` and `migrate-check` recovered, but
+> `risk`, `verify`, `audit-report` and `migrate-apply` remain affected; `risk` now
+> waits indefinitely in the shared composer on Windows. The captured cause is
+> `PermissionError: [WinError 5]` at `_winapi.DuplicateHandle` during `spawn_main`.
+> This is a partial repair, not a release clearance. Patch forward, do not roll
+> back: preserve the verified fixes while blocking reliability-led sales and
+> production CI-gating claims. The price hypothesis is `$25-35/developer/month`,
+> not validated pricing. Windows scale, orphan process cleanup, cold-start output
+> sizing and command admission remain open. Full triage is in the `AUD-618` sections
+> of the development roadmap and defect ledger.
+
 > **CRITICAL REGRESSION — re-audit of `5.9.11`, received 2026-08-28.** The external
 > battery lowered the score to **6.0/10**: `risk`, `audit-report`, `verify`,
 > `spring-audit` and intermittently `migrate-check` can exit `0` with no stdout,

{sourcecode-5.9.12 → sourcecode-5.9.14}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.9.12**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.14**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,7 +8,7 @@
 
 ## 1. ¿Qué es ASK Engine?
 
-### Contratos de fiabilidad de la versión 5.9.12
+### Contratos de fiabilidad de la versión 5.9.14
 
 **Un plazo que el análisis raíz sí respeta.** `ASK_MAX_ANALYSIS_SECONDS=<segundos>`
 ahora detiene `ask <repo>` en una frontera de fase medida. Una ejecución que agota
@@ -292,7 +292,7 @@ lea una persona. Proyectan el mismo modelo semántico en contexto listo para un
 | `ask prepare-context <tarea>` | Paquete de contexto según la tarea (`onboard`, `review-pr`, `fix-bug`, `refactor`, `generate-tests`) dimensionado para un prompt de LLM. |
 | `ask repo-ir` | El propio IR de símbolos a bajo nivel — la representación semántica en crudo, para herramientas que quieren el grafo, no un informe. |
 | `ask --agent` | Envoltorio de salida optimizado para agentes en cualquier comando. |
-| `ask --compact` | Un subconjunto de ~10K tokens (estado, stacks, entry points, dependencias clave) para orientación barata. |
+| `ask --compact` | Un subconjunto de orientación (estado, stacks, entry points y dependencias clave). Su tamaño depende del repositorio y de la vista; comprueba el tamaño publicado antes de inyectarlo directamente en un agente. |
 | `ask mcp` | Ejecuta ASK como servidor MCP para que un agente (Claude Desktop / Cursor) lo llame como herramienta. |
 
 Regla práctica: los comandos **para desarrollador** (`impact`, `spring-audit`, `endpoints`,

{sourcecode-5.9.12 → sourcecode-5.9.14}/docs/PRODUCT-ROUTE.md

@@ -33,15 +33,18 @@ The public trust layer, if activated, must be a generated and redacted
 projection, never the raw defect ledger. Its acceptance rules must exclude
 maintainer paths, third-party evaluation subjects and unsupported claims.
 
-**5.9.11 commercial gate.** The 2026-08-28 re-audit found a critical regression:
-several core commands can return exit `0` with no evidence. This invalidates a
-reliability-led annual commitment and production CI-gating positioning until the
-shared error boundary is fixed and independently tested. The route therefore
-continues with bounded pilots only, retains a provisional `$20-30/developer/month`
-working hypothesis, and does not claim enterprise-scale support above roughly
-3,000 files. The correct engineering response is a forward patch, not a rollback,
-because 5.9.11 also contains valid fixes that must be preserved. See the detailed
-`AUD-617` intake in [`DEVELOPMENT-ROADMAP.md`](DEVELOPMENT-ROADMAP.md) and
+**5.9.14 commercial gate.** The 2026-08-28 re-audit found that the critical
+reliability regression is only partially repaired: `spring-audit` and `migrate-check`
+recovered, while `risk`, `verify`, `audit-report` and `migrate-apply` remain affected;
+the follow-up shows that the failure is a high-frequency race rather than a binary
+version state.
+This invalidates a reliability-led annual commitment and production CI-gating
+positioning until the shared worker/composer boundary is fixed and independently
+tested. The route therefore continues with bounded pilots only, retains a
+provisional `$25-35/developer/month` working hypothesis, and does not claim
+enterprise-scale support above roughly 3,000 files. The correct engineering response
+is a forward patch, not a rollback, because 5.9.14 contains valid fixes that must be
+preserved. See the detailed `AUD-618` intake in [`DEVELOPMENT-ROADMAP.md`](DEVELOPMENT-ROADMAP.md) and
 [`DEFECT-LEDGER.md`](DEFECT-LEDGER.md).
 
 ### Evidence and commercial validation boundary

{sourcecode-5.9.12 → sourcecode-5.9.14}/docs/USER_GUIDE.md

@@ -46,16 +46,16 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.12, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.14, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.12, with release-artifact verification
+the two pack fixes are included in release 5.9.14, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.12
+### Reliability contracts in 5.9.14
 
 **A deadline the root analysis honours.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>` now
 stops `ask <repo>` at a measured phase boundary. A run that spends its budget
@@ -260,7 +260,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.12
+# ask 5.9.14
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.12 → sourcecode-5.9.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.12"
+version = "5.9.14"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.12 → sourcecode-5.9.14}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.12"
+__version__ = "5.9.14"

{sourcecode-5.9.12 → sourcecode-5.9.14}/src/sourcecode/cli.py

@@ -1855,6 +1855,21 @@ def _admit_path(
             pass
         return admission.resolved
     hint = rejection_hint(admission, usage=usage)
+    raw_token = str(raw)
+    if (
+        admission.reason == "missing"
+        and raw_token
+        and "/" not in raw_token
+        and "\\" not in raw_token
+    ):
+        # A bare first token belongs to the documented `ask <path>` grammar.
+        # Do not guess that it is a command and make a legitimate not-yet-created
+        # repository impossible to name; instead make the interpretation visible
+        # and point an operator who meant a command at the authoritative list.
+        hint = (
+            f"{hint} `{raw_token}` was interpreted as an implicit repository path. "
+            "If you intended a command, run `ask --help` and retry its exact name."
+        )
     if extra_hint:
         hint = f"{hint} {extra_hint}"
     _emit_error_json(
@@ -2202,12 +2217,11 @@ def _active_command_context() -> "tuple[str, Optional[Path]]":
         ctx = click.get_current_context(silent=True)
     except Exception:
         ctx = None
-
     if ctx is None:
-        # Console scripts and embedded entry points can emit after Click has
-        # released its context. Derive the command from argv rather than
-        # publishing `unknown` for an otherwise valid answer.
-        argv = list(sys.argv[1:])
+        # Click may have unwound before the unified emitter runs. Prefer the
+        # invocation captured per thread, then fall back to argv for console
+        # scripts and embedded entry points.
+        argv = list(_tls.__dict__.get("invocation_args", ()) or sys.argv[1:])
         known: set[str] = set()
         try:
             known.update(
@@ -2222,14 +2236,31 @@ def _active_command_context() -> "tuple[str, Optional[Path]]":
             pass
         command = ""
         for index, token in enumerate(argv):
-            if token.startswith("-") or token not in known:
+            if token.startswith("-") or (token not in known and token not in _SUBCOMMANDS):
                 continue
             command = token
             if token in {"retrieve", "cache", "auth", "mcp", "telemetry", "baseline", "pack"}:
                 if index + 1 < len(argv) and argv[index + 1] in known:
                     command = f"{token} {argv[index + 1]}"
             break
-        target = Path(_get_detected_path() or Path.cwd())
+        if not command:
+            command = _ROOT_COMMAND_NAME
+        target: "Optional[Path]" = None
+        if command == _ROOT_COMMAND_NAME:
+            detected = _get_detected_path()
+            if detected:
+                target = Path(detected)
+        else:
+            for token in argv:
+                try:
+                    candidate = Path(token)
+                    if candidate.is_dir():
+                        target = candidate
+                        break
+                except (OSError, ValueError):
+                    continue
+        if target is None:
+            target = Path(_get_detected_path() or Path.cwd())
         return command or _ROOT_COMMAND_NAME, target
 
     names: list[str] = []
@@ -2280,6 +2311,11 @@ _EXPENSIVE_ANALYSIS_TTL_SECONDS = 6 * 60 * 60
 #: `cache_model.analysis_class` records.
 _CLASS_FLOOR_SECONDS = {"core": 60, "repo-wide": 600, "deep": 1200}
 
+# AUD-598-B04. A valid duration is not necessarily a useful limit. This is a
+# disclosure threshold, never a new input restriction: a caller may choose a
+# very large budget, but must not be led to believe it will bind.
+_NON_BINDING_BUDGET_MULTIPLE = 10.0
+
 #: What to do instead when the budget will not cover the run. Per command where
 #: there is something specific to say, per class otherwise.
 _CLASS_FALLBACK = {
@@ -2420,12 +2456,40 @@ def _analysis_budget(command: str) -> dict[str, Any]:
     configured, source, invalid_reason = _parse_analysis_budget_env()
     from sourcecode.phased_run import budget_scope, budget_scope_reason
 
+    advisory: Optional[str] = None
+    if configured is not None:
+        try:
+            from sourcecode.execution_plan import cost_row
+
+            row = cost_row(command)
+            anchors = [
+                float(value)
+                for value in (
+                    getattr(row, "cold_seconds", None),
+                    getattr(row, "warm_seconds", None),
+                    getattr(row, "field_seconds", None),
+                )
+                if isinstance(value, (int, float)) and float(value) > 0
+            ]
+            if anchors:
+                anchor = max(anchors)
+                if float(configured) >= anchor * _NON_BINDING_BUDGET_MULTIPLE:
+                    advisory = (
+                        f"{_BUDGET_ENV_VAR}={configured:g}s is {float(configured) / anchor:.0f}x "
+                        f"the published {command} cost anchor ({anchor:g}s); it is "
+                        "unlikely to bind this run. The value remains valid and is "
+                        "recorded with the result."
+                    )
+        except Exception:
+            pass
+
     scope = budget_scope(command)
     return {
         "class": cls,
         "recommended_min_seconds": recommended,
         "configured_max_seconds": configured,
         "configured_source": source,
+        "configured_nonbinding_advisory": advisory,
         # AUD-596-B03: an unreadable value is not an absent one. Carried beside
         # the budget so `_enforce_analysis_budget` can refuse it by name, and
         # `None` whenever the variable is unset or usable.
@@ -2470,6 +2534,7 @@ def _budget_disclosure(command: str) -> "dict[str, Any]":
         "budget_binds": binding["binds"],
         "budget_binds_basis": binding["basis"],
         "measured_anchor_seconds": binding["anchor_seconds"],
+        "configured_nonbinding_advisory": budget["configured_nonbinding_advisory"],
     }
 
 
@@ -2549,6 +2614,13 @@ def _enforce_analysis_budget(
         return
     source = budget.get("configured_source")
     from sourcecode.phased_run import budget_provenance, budget_warning
+    advisory = budget.get("configured_nonbinding_advisory")
+    if advisory and getattr(sys.stderr, "isatty", lambda: False)():
+        try:
+            sys.stderr.write(f"[ask] budget: {advisory}\n")
+            sys.stderr.flush()
+        except Exception:
+            pass
     if not getattr(sys.stderr, "isatty", lambda: False)() and float(configured) >= recommended:
         return
 
@@ -4437,6 +4509,11 @@ def _get_command_with_preprocessing(typer_instance: Any) -> Any:
             # CliRunner / programmatic call: preprocess the explicit args list.
             _set_detected_path(".")
             args = _preprocess_args(list(args))
+        # The output seam is reached after Click may already have released its
+        # context. Preserve this invocation per thread so its envelope cannot
+        # silently lose command and repository provenance (AUD-598-B01).
+        _previous_invocation = _tls.__dict__.get("invocation_args")
+        _tls.invocation_args = tuple(args if args is not None else sys.argv[1:])
         # args=None → Click reads sys.argv; _preprocess_argv() in main_entry handled it.
         started = time.monotonic()
         command = _telemetry_command(args)
@@ -4459,6 +4536,10 @@ def _get_command_with_preprocessing(typer_instance: Any) -> Any:
                 )
             except Exception:
                 pass
+            if _previous_invocation is None:
+                _tls.__dict__.pop("invocation_args", None)
+            else:
+                _tls.invocation_args = _previous_invocation
 
     cmd.main = _cmd_main
     return cmd