sourcecode 5.9.14__tar.gz → 5.9.16__tar.gz

{sourcecode-5.9.14 → sourcecode-5.9.16}/.github/workflows/windows-regression.yml

@@ -35,7 +35,8 @@ jobs:
           python -m pytest -q -n 0 \
             tests/test_encoding_regression.py \
             tests/test_output_encoding.py \
-            tests/test_path_prefix_selection.py
+            tests/test_path_prefix_selection.py \
+            tests/test_parallel_jobs.py
 
       - name: Prove Git Bash cannot turn a route filter into a clean zero
         shell: bash

{sourcecode-5.9.14 → sourcecode-5.9.16}/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [5.9.16] — 2026-08-31
+
+*Audit candidate following the 5.9.15 release recovery.*
+
+### Release Process
+
+- Run a fresh external audit against the wheel built from this commit. Record
+  the wheel hash and stamped commit under `docs/RELEASE-VERIFICATION.md` before
+  uploading it to PyPI.
+
+## [5.9.15] — 2026-08-31
+
+*Release recovery: restore the 5.9.14 implementation line before publishing a
+corrected artefact.*
+
+### Fixed
+
+- Restored `audit-verify`, `cve`, `drift`, `intent`, `pr-risk`, `remediate`,
+  `remediation-report`, `self-audit` and `watch`, with their implementations
+  and regression contracts.
+- Restored the related Windows, output-delivery and input-admission hardening
+  from the recovery branch.
+
+### Release Process
+
+- Publication is blocked until the wheel's stamped commit, installed command
+  surface and PyPI hashes pass `docs/RELEASE-VERIFICATION.md`.
+
 ## [5.9.14] — 2026-08-30
 
 *AUD-619 intake, Windows reliability follow-up and release alignment.*

{sourcecode-5.9.14 → sourcecode-5.9.16}/CODE_OF_CONDUCT.md

@@ -24,4 +24,3 @@ other conduct that would be inappropriate in a professional setting is not accep
 Report unacceptable behaviour privately to the project maintainers. Maintainers will review
 reports promptly and may remove, edit, or reject contributions, or take other action needed to
 protect participants.
-

{sourcecode-5.9.14 → sourcecode-5.9.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.14
+Version: 5.9.16
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.14-blue)
+![Version](https://img.shields.io/badge/version-5.9.16-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.14 retains the shared Canonical IR
+**Current performance status.** Release 5.9.16 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -233,7 +233,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.14 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.16 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -266,7 +266,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.14 — and, on a build that has aged,
+ask version                    # ask 5.9.16 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.14 → sourcecode-5.9.16}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.14-blue)
+![Version](https://img.shields.io/badge/version-5.9.16-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.14 retains the shared Canonical IR
+**Current performance status.** Release 5.9.16 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -184,7 +184,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.14 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.16 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -217,7 +217,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.14 — and, on a build that has aged,
+ask version                    # ask 5.9.16 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-23-CORPUS-AMPLIADO.md

@@ -1,8 +1,8 @@
 # Intake de hallazgos — corpus ampliado ASK 5.8.25
 
-**Fecha:** 2026-08-23  
-**Build externo:** `5.8.25`, `b6e0e0f`  
-**Fuente:** [`/Users/user/Documents/workspace/testing/ASK-FINDINGS-CORPUS-AMPLIADO-2026-08-23.md`](/Users/user/Documents/workspace/testing/ASK-FINDINGS-CORPUS-AMPLIADO-2026-08-23.md)  
+**Fecha:** 2026-08-23
+**Build externo:** `5.8.25`, `b6e0e0f`
+**Fuente:** [`/Users/user/Documents/workspace/testing/ASK-FINDINGS-CORPUS-AMPLIADO-2026-08-23.md`](/Users/user/Documents/workspace/testing/ASK-FINDINGS-CORPUS-AMPLIADO-2026-08-23.md)
 **Estado:** intake incorporado; sin correcciones de código en esta tarea.
 
 ## Criterio de triage

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-23-EXTERNAL-5.8.25.md

@@ -1,7 +1,7 @@
 # Auditoría externa de regresión — ASK Engine 5.8.25
 
-**Fecha de recepción:** 2026-08-23  
-**Artefacto auditado:** ASK Engine `5.8.25`, build `b6e0e0f157687a962ce66627afe2e9b388fb2f06`  
+**Fecha de recepción:** 2026-08-23
+**Artefacto auditado:** ASK Engine `5.8.25`, build `b6e0e0f157687a962ce66627afe2e9b388fb2f06`
 **Entornos:** Windows 11 Pro y reference corpus (`3dde0376`)
 **Alcance:** aproximadamente 180 invocaciones, 0 tracebacks, 0 escrituras observadas.
 

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-23-EXTERNAL-5.8.26.md

@@ -1,7 +1,7 @@
 # ASK Engine 5.8.26 - External Regression Audit Intake
 
-**Received:** 2026-08-23  
-**Audited artefact:** `5.8.26`, build `e2da5d84a30bc2e8c60325e1e2d48a8d736b8ad7`  
+**Received:** 2026-08-23
+**Audited artefact:** `5.8.26`, build `e2da5d84a30bc2e8c60325e1e2d48a8d736b8ad7`
 **Subject:** reference corpus, commit `3dde0376`, 3,342 Java files
 **Scope:** 35 read-only invocations, explicit output ceiling, no writes and no tracebacks.
 

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-23-THINGSBOARD-FINDINGS.md

@@ -1,8 +1,8 @@
 # ThingsBoard field audit findings — commercial value and product gaps
 
-**Date:** 2026-08-23  
-**ASK:** 5.8.25 (`b6e0e0f157687a962ce66627afe2e9b388fb2f06`)  
-**Subject:** ThingsBoard, `181ac1392b9728d3e2aed9cd698a246bf1de3de7`  
+**Date:** 2026-08-23
+**ASK:** 5.8.25 (`b6e0e0f157687a962ce66627afe2e9b388fb2f06`)
+**Subject:** ThingsBoard, `181ac1392b9728d3e2aed9cd698a246bf1de3de7`
 **Status:** five corrections implemented in the working tree; release/commit pending
 
 ## Implementation status
@@ -36,7 +36,7 @@ hours of manual work.
 
 ### AUD-THB-001 — Impact output has no explicit negative scope
 
-**Severity:** P1 product gap  
+**Severity:** P1 product gap
 **Observed:** `impact` and `impact-chain` produced large positive cones (528–556 related
 endpoints for several targets) but no explicit, evidence-backed `negative_scope` section.
 `UserController` provided a useful control case with 0 direct callers and 31 endpoints, but
@@ -62,7 +62,7 @@ branch in `in_scope`, the other in `out_of_scope`, and an unresolved reflective
 
 ### AUD-THB-002 — TX-006 overstates equivalent self-invocation cases
 
-**Severity:** P1 precision defect  
+**Severity:** P1 precision defect
 **Observed:** the Spring audit reported 18 defects, including many TX-006 findings where an
 annotated method calls another annotated method internally but both use the default transaction
 semantics. Manual review of `AssetProfileServiceImpl`, `DeviceServiceImpl` and
@@ -89,7 +89,7 @@ the same severity to semantically equivalent and materially different cases.
 
 ### AUD-THB-003 — `none_detected` is too easy to read as public exposure
 
-**Severity:** P1 communication/contract defect  
+**Severity:** P1 communication/contract defect
 **Observed:** the endpoint inventory reported 28 mappings as `none_detected`. Manual review
 showed static resources, redirects, no-auth routes, device-token routes, readiness and error
 handlers among the examples.
@@ -108,7 +108,7 @@ distinct states.
 
 ### AUD-THB-004 — Audit report does not carry evidence bounds consistently
 
-**Severity:** P1 evidence-contract gap  
+**Severity:** P1 evidence-contract gap
 **Observed:** component outputs exposed coverage gaps, while the generated `audit-report`
 section declared evidence completeness without explicit bounds. The report therefore looks
 more exhaustive than the underlying evidence supports.
@@ -133,7 +133,7 @@ verdict.
 
 ### AUD-THB-005 — Baseline summary mixes incompatible migration signals
 
-**Severity:** P2 presentation defect  
+**Severity:** P2 presentation defect
 **Observed:** the assessment combined `readiness 94`, `headline blocker jakarta_migration`
 and `migration blockers 0`.
 

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-26-EXTERNAL-5.8.26.md

@@ -1,7 +1,7 @@
 # ASK Engine 5.8.26 - External Audit Intake
 
-**Received:** 2026-08-26  
-**Audited artefact:** `5.8.26`, Windows 11 / Git Bash (MSYS), Python 3.14  
+**Received:** 2026-08-26
+**Audited artefact:** `5.8.26`, Windows 11 / Git Bash (MSYS), Python 3.14
 **Scope:** reference and multi-stack repositories; the report's second round tested 44/46 subcommands across Spring, Quarkus, Micronaut and Jakarta EE.
 
 This record separates the first round's initial diagnosis from the controlled retest. The

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md

@@ -1,7 +1,7 @@
 # ASK Engine 5.8.27 - External Audit Intake
 
-**Received:** 2026-08-26  
-**Audited artefact:** `5.8.27`, Windows 11, Git Bash/MSYS and native PowerShell  
+**Received:** 2026-08-26
+**Audited artefact:** `5.8.27`, Windows 11, Git Bash/MSYS and native PowerShell
 **Comparison:** the prior `5.8.26` audit and the current release artefact
 
 This audit contains two assessments. The first confirms the semantic fixes; the

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md

@@ -1,8 +1,8 @@
 # ASK Engine 5.8.28 - External Pack Audit Intake
 
-**Received:** 2026-08-26  
+**Received:** 2026-08-26
 **Audited surface:** `pack list`, `pack assessment` and `pack gate` on
-`spring-petclinic`  
+`spring-petclinic`
 **Related release:** `5.8.28` (remediation release: `5.8.30`)
 
 ## Findings

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-26-EXTERNAL-5.8.28.md

@@ -1,7 +1,7 @@
 # ASK Engine 5.8.28 - External Audit Intake
 
-**Received:** 2026-08-26  
-**Audited artefact:** `5.8.28`, Windows 11, Git Bash/MSYS and native PowerShell  
+**Received:** 2026-08-26
+**Audited artefact:** `5.8.28`, Windows 11, Git Bash/MSYS and native PowerShell
 **Comparison:** `5.8.27`
 
 ## Executive Summary

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md

@@ -1,7 +1,7 @@
 # External Audit - 5.9.0
 
-**Received:** 2026-08-26  
-**Audited revision:** `b4c3691c4110d863fedcd54a61a08fd2997e400c` (`5.9.0`)  
+**Received:** 2026-08-26
+**Audited revision:** `b4c3691c4110d863fedcd54a61a08fd2997e400c` (`5.9.0`)
 **Method:** external findings reconciled against the released source tree
 
 ## Result
@@ -13,7 +13,7 @@ the result of source-level reconciliation and the action justified by it.
 
 ### AUD-608-C01 - `cve` does not disclose inventory coverage
 
-**Priority:** P1  
+**Priority:** P1
 **Status:** closed in `fe1f624`
 
 `ask cve` builds its inventory from static dependency analysis; it does not
@@ -28,7 +28,7 @@ resolved-graph mode; add manifest-versus-resolved fixtures.
 
 ### AUD-608-P01 - `pr-risk --since` hides an execution error as non-coverage
 
-**Priority:** P1  
+**Priority:** P1
 **Status:** closed in `b479465`
 
 The `--since` path uses `ContextGraph` without importing it. A broad exception
@@ -43,7 +43,7 @@ base-materialisation failures as structured errors; keep
 
 ### AUD-608-O01 - effective-access branches bypass `posture --diff --limit`
 
-**Priority:** P2  
+**Priority:** P2
 **Status:** closed in `5f8a50b`
 
 `POSTURE_BOUNDED_LISTS` omits `permit_all`, while the shared helper bounds only
@@ -59,7 +59,7 @@ the public CLI; verify emitted bytes and estimated size fall under `--limit`.
 
 ### AUD-607-U01 - new command help does not state budget-policy applicability
 
-**Priority:** P3  
+**Priority:** P3
 **Status:** closed in `19811ac`
 
 The helpers for `cve`, `drift`, `intent`, `pr-risk`, `remediate`,

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-27-EXTERNAL-5.9.2.md

@@ -1,7 +1,7 @@
 # External Audit Intake — ASK 5.9.2
 
-**Received:** 2026-08-27  
-**Scope:** regression battery and commercial-positioning review against 5.9.1  
+**Received:** 2026-08-27
+**Scope:** regression battery and commercial-positioning review against 5.9.1
 **Source:** external audit supplied in the Codex task attachment
 
 ## Executive disposition

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/AUDIT-2026-08-27-EXTERNAL-5.9.3.md

@@ -1,7 +1,7 @@
 # External Audit Intake — ASK 5.9.3
 
-**Received:** 2026-08-27  
-**Scope:** reliability, semantic consistency, agent ergonomics and commercial fit  
+**Received:** 2026-08-27
+**Scope:** reliability, semantic consistency, agent ergonomics and commercial fit
 **Evidence base:** two external reports covering five parallel batches, eight-plus
 real Java repositories and approximately 180 CLI invocations
 
@@ -93,4 +93,3 @@ The external price bands ($25-40 and $35-50 per developer/month in the two repor
 are hypotheses, not pricing evidence. No price change, compliance claim or ENS/CRA
 certification claim follows from this audit. The next commercial proof remains a named
 customer reference, signed historical evidence and validated control mapping.
-

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/DOCUMENTATION-HYGIENE-2026-08-23.md

@@ -35,4 +35,3 @@ not silently rewritten.
 The live product set has one repaired missing link (`CONTRIBUTING.md` ->
 `CODE_OF_CONDUCT.md`). The remaining automated findings are one parser false positive
 (`CHANGELOG.md`'s literal `url`) and workflow-template placeholders under `.claude/`.
-

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/RELEASE-CHECKLIST.md

@@ -4,6 +4,13 @@ Executable by any team member. Runs the commercial pipeline from an empty projec
 verified first sale, ending by turning the paywall on. **Do the steps in order; do not
 flip the paywall (step 10) until steps 6–9 pass.**
 
+## Release artifact gate
+
+Before tagging or uploading any release, complete
+[RELEASE-VERIFICATION.md](RELEASE-VERIFICATION.md). It verifies the wheel's
+stamped commit, installed command surface and PyPI artefact hashes; passing
+checkout tests alone is insufficient evidence for a published build.
+
 Prerequisites: Supabase project + CLI (`supabase`), a Lemon Squeezy store, and the repo.
 
 ---

sourcecode-5.9.16/docs/RELEASE-VERIFICATION.md

@@ -0,0 +1,102 @@
+# Release Artifact Verification
+
+## Status
+
+**Publishing is blocked until this procedure passes on the exact commit that
+will be tagged.** A version number is not evidence that PyPI, the checkout and
+the command surface describe the same build.
+
+## Incident: 5.9.15 provenance divergence
+
+The external re-audit labelled its subject `5.9.15` and reported a missing CLI
+surface, Windows failures and argument-validation regressions. The original
+`5.9.15` commit (`5eb36f1`) changed release metadata and documentation only;
+the named commands were absent from the pre-recovery `master` but existed on
+`fix/aud600-queue`. This recovery integrates that implementation before a new
+artefact is built. The original reported artefact still cannot be attributed to
+its source checkout from its version number alone.
+
+This does **not** dismiss the report. It makes its first corrective action
+mandatory: identify the built wheel, the commit stamped inside it, the branch
+that supplied it and its registered command manifest before making a behaviour
+claim or publishing a replacement.
+
+## Release Candidate Procedure
+
+Run every command from a clean checkout at the intended release commit.
+
+1. Record the source identity.
+
+   ```sh
+   git status --short
+   git rev-parse HEAD
+   git branch --show-current
+   ```
+
+   The worktree must be clean. Record the commit and branch in the release
+   issue; do not infer either from the version string.
+
+2. Build a fresh, isolated artefact.
+
+   ```sh
+   rm -rf /tmp/ask-release-dist
+   python -m build --outdir /tmp/ask-release-dist
+   twine check /tmp/ask-release-dist/*
+   ```
+
+3. Inspect the wheel before installing it.
+
+   ```sh
+   unzip -p /tmp/ask-release-dist/sourcecode-*.whl \
+     sourcecode/_build_commit.py
+   unzip -l /tmp/ask-release-dist/sourcecode-*.whl | \
+     rg 'sourcecode/_docs/(USER_GUIDE|DEFECT-LEDGER)\\.md'
+   ```
+
+   The stamped commit must equal `git rev-parse HEAD`. A missing or
+   `unrecorded` stamp blocks the release.
+
+4. Install only that wheel in a fresh environment and collect the runtime
+   evidence.
+
+   ```sh
+   python -m venv /tmp/ask-release-venv
+   /tmp/ask-release-venv/bin/pip install --no-deps /tmp/ask-release-dist/sourcecode-*.whl
+   /tmp/ask-release-venv/bin/ask version
+   /tmp/ask-release-venv/bin/ask --help > /tmp/ask-help.txt
+   ```
+
+   Archive `ask version` and `/tmp/ask-help.txt` with the release record. The
+   first must report the stamped commit; the second is the command-surface
+   manifest for the installed artefact.
+
+5. Run the release contracts against the checkout and the wheel.
+
+   ```sh
+   pytest -q \
+     tests/test_published_version_claims.py \
+     tests/test_user_guide_coverage.py \
+     tests/test_the_wheel_carries_its_commit_x01.py \
+     tests/test_bundled_docs.py
+   ```
+
+6. Only then upload the exact checked artefacts. After upload, download the
+   PyPI wheel by its published hash and repeat steps 3 and 4. PyPI releases are
+   immutable: a wrong wheel requires a new version, never an overwrite.
+
+## Required Release Evidence
+
+- Commit SHA and branch/ref used to build.
+- SHA-256 of wheel and source distribution.
+- Extracted `BUILD_COMMIT` value.
+- Installed-wheel `ask version` output.
+- Installed-wheel `ask --help` output and command count.
+- Test command and result.
+- PyPI file hashes after publication.
+
+## Compatibility Rule
+
+Removing or renaming a top-level command is a breaking change. It requires a
+declared replacement or removal rationale, migration guidance, a major-version
+decision, and a release-note entry before publication. An absent command must
+fail as an unknown command; it must never fall back to root help with exit 0.

{sourcecode-5.9.14 → sourcecode-5.9.16}/docs/USER_GUIDE.md

@@ -46,16 +46,16 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.14, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.16, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.14, with release-artifact verification
+the two pack fixes are included in release 5.9.16, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.14
+### Reliability contracts in 5.9.16
 
 **A deadline the root analysis honours.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>` now
 stops `ask <repo>` at a measured phase boundary. A run that spends its budget
@@ -260,7 +260,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.14
+# ask 5.9.16
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.14 → sourcecode-5.9.16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.14"
+version = "5.9.16"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.14 → sourcecode-5.9.16}/scripts/perf_gate.py

@@ -42,6 +42,15 @@ from sourcecode import perf  # noqa: E402
 from perf_harness import FLEET  # noqa: E402
 
 
+def _configure_utf8_stdio() -> None:
+    """Keep Unicode gate tables printable on Windows legacy code pages."""
+    for stream in (sys.stdout, sys.stderr):
+        try:
+            stream.reconfigure(encoding="utf-8", errors="replace")
+        except (AttributeError, OSError):
+            pass
+
+
 def load_cells(directory: Path) -> dict[str, dict]:
     """Every `perf-baseline-v1` cell in *directory*, keyed by `<repo>__<cmd>__<mode>`.
 
@@ -291,4 +300,5 @@ def main() -> int:
 
 
 if __name__ == "__main__":
+    _configure_utf8_stdio()
     raise SystemExit(main())

{sourcecode-5.9.14 → sourcecode-5.9.16}/scripts/perf_harness.py

@@ -65,10 +65,18 @@ DEFAULT_COMMANDS = [""]
 
 ASK_BIN = os.environ.get("ASK_BIN", "ask")
 BYTES_PER_KB = 1024
-# darwin ru_maxrss is bytes; linux reports kilobytes.
+# darwin ru_maxrss is bytes; Linux reports kilobytes. Windows reports zero
+# below because the stdlib exposes no equivalent child-process peak counter.
 RSS_UNIT = 1 if sys.platform == "darwin" else BYTES_PER_KB
 
 
+def _children_peak_rss() -> float:
+    """Return the POSIX child peak, or an honest unmeasured zero on Windows."""
+    if resource is None:
+        return 0.0
+    return float(resource.getrusage(resource.RUSAGE_CHILDREN).ru_maxrss)
+
+
 def git_commit(repo_path: Path) -> str:
     try:
         out = subprocess.run(

{sourcecode-5.9.14 → sourcecode-5.9.16}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.14"
+__version__ = "5.9.16"

{sourcecode-5.9.14 → sourcecode-5.9.16}/src/sourcecode/cache.py

@@ -58,6 +58,7 @@ import json
 import os
 import re
 import subprocess
+import threading
 import time
 import uuid
 from datetime import datetime, timezone
@@ -156,6 +157,12 @@ _DEFAULT_MAX_SIZE_MB: int = 50
 _REPLACE_RETRIES: int = 5
 _REPLACE_BACKOFF_S: float = 0.05
 
+# Some Windows filesystems expose timestamps too coarsely to order consecutive
+# atomic writes. Persist a process-monotonic stamp in each cache envelope so GC
+# never falls back to directory enumeration order when file timestamps tie.
+_WRITE_CLOCK_LOCK = threading.Lock()
+_LAST_WRITE_NS: int = 0
+
 # Matches "snapshot-<hex_commit>-<hex_flags>.json.gz"
 _SNAPSHOT_RE = re.compile(r"^snapshot-([0-9a-f]+)-[0-9a-f]+\.json\.gz$")
 
@@ -777,6 +784,7 @@ def write_core(repo_root: Path, core_key: str, core_data: dict[str, Any]) -> str
             "key": core_key,
             "hash": core_hash,
             "ts": _now_iso(),
+            "written_ns": _next_write_ns(),
             "data": core_data,
         }
         payload = gzip.compress(
@@ -848,6 +856,14 @@ def _now_iso() -> str:
     return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
 
+def _next_write_ns() -> int:
+    """Return a wall-clock nanosecond stamp that increases in this process."""
+    global _LAST_WRITE_NS
+    with _WRITE_CLOCK_LOCK:
+        _LAST_WRITE_NS = max(time.time_ns(), _LAST_WRITE_NS + 1)
+        return _LAST_WRITE_NS
+
+
 def _build_envelope(
     cache_key: str,
     content: str,
@@ -860,6 +876,7 @@ def _build_envelope(
         "sv": SCHEMA_VERSION,
         "key": cache_key,
         "ts": _now_iso(),
+        "written_ns": _next_write_ns(),
         "fmt": fmt,
         "layers": layers,
     }
@@ -1034,6 +1051,25 @@ def _cas_restore(
 # Eviction / GC
 # ---------------------------------------------------------------------------
 
+def _cache_recency(path: Path) -> tuple[int, int, int, str]:
+    """Stable newest-first key for a cache envelope.
+
+    New envelopes carry ``written_ns`` because filesystem timestamps can tie on
+    Windows. Older envelopes remain orderable through their native timestamps.
+    The remaining fields make a genuine cross-process tie deterministic.
+    """
+    stat_result = path.stat()
+    stamp = stat_result.st_mtime_ns
+    try:
+        envelope = json.loads(gzip.decompress(path.read_bytes()).decode("utf-8"))
+        stored = envelope.get("written_ns") if isinstance(envelope, dict) else None
+        if isinstance(stored, int) and stored > 0:
+            stamp = stored
+    except Exception:
+        pass
+    return stamp, stat_result.st_mtime_ns, stat_result.st_ctime_ns, path.name
+
+
 def _gc(cache_d: Path) -> None:
     """Evict old snapshots/cores/views and sweep orphaned CAS blobs.
 
@@ -1072,8 +1108,8 @@ def _gc(cache_d: Path) -> None:
         if keep <= 0 or len(groups) <= keep:
             surviving = all_snapshots + all_cores
         else:
-            def _newest_mtime(commit: str) -> float:
-                return max(p.stat().st_mtime for p in groups[commit])
+            def _newest_mtime(commit: str) -> tuple[int, int, int, str]:
+                return max(_cache_recency(p) for p in groups[commit])
 
             sorted_commits = sorted(groups, key=_newest_mtime, reverse=True)
             surviving = []
@@ -1088,7 +1124,7 @@ def _gc(cache_d: Path) -> None:
         if max_cores > 0:
             surviving_cores = [p for p in surviving if p.name.startswith("core-") and p.exists()]
             if len(surviving_cores) > max_cores:
-                surviving_cores.sort(key=lambda p: p.stat().st_mtime, reverse=True)
+                surviving_cores.sort(key=_cache_recency, reverse=True)
                 for evict in surviving_cores[max_cores:]:
                     _safe_unlink(evict)
                     surviving = [p for p in surviving if p != evict]