sourcecode 5.9.25__tar.gz → 5.9.26__tar.gz

{sourcecode-5.9.25 → sourcecode-5.9.26}/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [5.9.26] — 2026-09-02
+
+*Fix queue from the two 5.9.25 re-audits (multi-repository and native-Windows).*
+
+### Fixed
+
+- Non-interactive `cache clear` / `cache context-clear` now read a piped
+  refusal instead of treating any redirected stdin as an implicit "yes".
+- A malformed Java file with unbalanced parentheses — a missing `;` or `)`
+  that still extracts a clean symbol pair — is now disclosed as a recovered
+  parse, alongside the existing unbalanced-brace signal.
+- `watch` publishes an immediate startup event on stdout before its tick
+  loop begins, instead of giving no output at all until the first change.
+- A successful `--agent` run now discloses the default 1,536 MB RSS ceiling
+  it was run under, instead of reporting `configured_max_rss_mb: null` for a
+  ceiling that was actively enforced.
+- `selftest`'s reported gaps now name the specific ledger rows that failed
+  or could not run, instead of a bare category slug.
+- `risk` and `posture` now publish the marginal-Spring-detection disclosure
+  (`stack_fit.fit: "partial"`) that existed since 5.8.21 but was unreachable
+  from either command.
+- Every command that reports an unproven "empty answer with exit 0" now
+  writes a forensic sidecar (phase, peak RSS, argv) referenced from its
+  error envelope, so a future occurrence carries evidence instead of
+  requiring reconstruction after the fact.
+
+### Known Limitations
+
+- The empty-`exit 0` failure across `spring-audit`, `verify`, `risk`,
+  `audit-report`, `migrate-check` and `migrate-apply` (`ALT-01`/`ALT-03`) is
+  not reproducible on this platform and remains open; the new diagnostic
+  sidecar is the actionable response until it recurs with evidence.
+- The `--agent` RSS ceiling still evaluates only after the analysis
+  completes, not periodically during it (`BUG-22`), and warm-path
+  performance for `spring-audit` (`REG-03`) remains unverified.
+
 ## [5.9.25] — 2026-09-01
 
 *Reliability remediation from the alternative 5.9.23 audit.*

{sourcecode-5.9.25 → sourcecode-5.9.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.25
+Version: 5.9.26
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.25-blue)
+![Version](https://img.shields.io/badge/version-5.9.26-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -290,7 +290,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.25 — and, on a build that has aged,
+ask version                    # ask 5.9.26 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.25 → sourcecode-5.9.26}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.25-blue)
+![Version](https://img.shields.io/badge/version-5.9.26-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -241,7 +241,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.25 — and, on a build that has aged,
+ask version                    # ask 5.9.26 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.9.26/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md

@@ -0,0 +1,112 @@
+# Alternative External Audit - 5.9.25
+
+## Scope And Verdict
+
+This native-Windows re-audit evaluated the 5.9.25 build on the same dirty
+3,342-Java-file repository as the 5.9.23 round, under Python 3.10. It rates
+the release **4.3/10**, down from 4.9 for 5.9.23 (6.6 for 5.9.22). Three
+defects from the prior round are genuinely fixed with verified evidence
+(content-id clock exclusion, findings-population reconciliation, nested-cap
+aggregation), but the release-blocking failure did not shrink — it became
+**erratic**: the same invocation, repeated seconds apart with nothing else
+changed, now swings between an instant empty answer and a full one, and the
+failure mode has spread to `migrate-apply`, `migrate-check` and `onboard`,
+which were reliable in 5.9.23.
+
+This is an external measurement. It is evidence of a release-blocking
+failure, not proof of a single root cause. Engineering-host results do not
+close it.
+
+## Execution Matrix
+
+| Invocation | Runs | Answers | Empty `exit 0` | Timeouts |
+|---|---:|---:|---:|---:|
+| `spring-audit . --compact` | 18 | 0 | 17 | 1 |
+| `verify .` | 18 | 0 | 18 | 0 |
+| `risk . --limit 20` | 7 | 0 | 7 | 0 |
+| `audit-report . --format markdown` | 7 | 0 | 7 | 0 |
+| `migrate-apply .` (first batch) | 8 | 0 | 8 | 0 |
+| `migrate-apply .` (isolated re-run, same session) | 3 | 3 | 0 | 0 |
+| `risk . -o promise.json` (output-artifact promise) | 4 | 0 | 4 (no file written) | 0 |
+| `selftest .` | 1 | 1 pass of 12 checked | — | — |
+
+The same `migrate-apply .` invocation gave 8/8 empty answers in 1.1-1.7s in
+one batch and 3/3 full answers (14-29s, 9,542 bytes) minutes later with
+nothing else changed — no cache clear, no env var, same repository size. The
+decision of "is there a result to serialize" is not correlated with repo
+size, budget, cache state or output format in this data; it now looks
+consistent with worker/lock availability at start, not with any input.
+
+## Release Blockers
+
+1. `ALT-01` — **reopened, contradicted by native re-test.** The commit cited
+   as closing this row (`a7ad44b`, "exit 0 requires delivered stdout or a
+   verified requested artifact") does not hold: `risk . -o promise.json`
+   returned `rc=0`, 0 bytes, and no file in 4/4 native runs. `risk` and the
+   audit-family commands appear to take the same early silent-failure branch
+   identified in `ALT-03`, which returns before reaching the output-promise
+   guard that does correctly protect `endpoints --output`. Verify the guard
+   is reachable from every command's failure path, not just its success path.
+2. `ALT-03` — **open, now with a sharper — but still unconfirmed — signature.**
+   The failure is no longer "hangs on the large root, works on the small
+   subtree"; it is now mostly near-instant (1-2s) empty success instead of a
+   multi-minute hang, on the same commands. This is consistent with a phase
+   that is *skipped* rather than one that is *stuck*, but the audit could not
+   isolate the trigger with fewer than 3 concurrent heavy ASK processes.
+3. `ALT-09` (new) — Critical: `ask cache clear .` ignores the actual content
+   of a piped stdin answer. `echo n | ask cache clear .` deletes cache
+   entries despite `n` meaning "no" at any `[y/N]` prompt; only true EOF
+   (`< /dev/null`) correctly refuses. The non-interactivity detector appears
+   to treat "stdin has bytes" as "proceed", instead of reading and comparing
+   those bytes against `y`/`yes`. Low blast radius today (cache is
+   rebuildable), high risk if the same detection pattern is reused for a
+   future destructive command that touches source.
+4. Closure requires at least 30 native repetitions per affected command, with
+   byte counts, exit code, timeout status and requested-output-file
+   existence — unchanged from the 5.9.23 round's bar, still unmet.
+
+## Additional Regressions
+
+- `ALT-10` (new): `onboard .` took 164.9s cold on this session versus a
+  consistent 681-780ms in every prior round on the same repository (roughly
+  240x). Not release-blocking on its own since it did deliver a full answer,
+  but unprecedented and worth profiling for a shared warm-up path with the
+  commands above.
+- `ALT-11` (new), low: `watch .` returns `rc=124` at 15.2s with no heartbeat
+  or "watching..." confirmation line, so a caller cannot distinguish "still
+  starting" from "hung" without external knowledge of expected behavior.
+- `pack gate --since HEAD~1` and `pack assessment .` now hang to their
+  external kill (200s / 300s) instead of failing fast with the legitimate
+  `INVALID_USAGE` / `INVALID_INPUT` errors they gave in 5.9.23 — both compose
+  the audit-family commands above and inherit `ALT-01`/`ALT-03`.
+- `selftest .` fell from 9/12 pass (5.9.23) to 1/12 pass on the same 120s
+  deadline, same repository, same machine — the product's own regression
+  battery is itself a casualty of `ALT-03`.
+- `impact-chain` `metadata.audit_time_ms` is always `0.0` while
+  `query_time_ms` varies normally; likely the same skipped security phase
+  publishing `0` instead of `null` for a phase that never ran.
+- `prepare-context review-pr`'s `_truncation_summary` has a minor arithmetic
+  mismatch between `original_size_bytes - final_size_bytes` and the stated
+  budget accounting (low severity, unlike the `ALT-05` totals mismatch it
+  otherwise resembles).
+
+## Preserved Evidence
+
+- `ALT-04` (content-id clock exclusion) confirmed: `impact-chain` gave the
+  same hash across 3 repeated runs, versus 3 different hashes in 5.9.23.
+- `ALT-05` (findings-population reconciliation) confirmed with exact
+  arithmetic: `population_total: 1526`, `excluded_before_cap: 933`, and
+  `1526 - 593 = 933 = by_rule.MIG-016`.
+- `ALT-06` (false-complete `selftest`) partially confirmed: `complete` is
+  correctly `false` when rows fail, but `gaps` still collapses 10 named
+  failing rows into one generic entry instead of the itemized list the
+  payload's own `rows[]` already has (`ALT-06` should stay open for this
+  half).
+- `ALT-08` (stdout budget disclosure) confirmed, functioning.
+- Endpoint analysis remained exact (3,763), UTF-8 encoding is correct at the
+  byte level, and the lightweight CI paths `pr-risk`, `review-pr` and
+  `pr-impact` delivered full payloads every time.
+
+These controls must remain in the regression battery while the P0 recovery
+work proceeds; they do not compensate for an audit-family failure that grew
+more erratic and spread to previously reliable commands.

sourcecode-5.9.26/docs/AUDIT-2026-09-02-EXTERNAL-5.9.25.md

@@ -0,0 +1,62 @@
+# External Audit - 5.9.25
+
+## Release Status
+
+The 5.9.25 re-audit rates ASK Engine at **6.3/10**, down from 6.9. Precision,
+recall and determinism hold steady; the empty-success defect first measured at
+3/47 in 5.9.23 is now measured at 18.4% (9/49, byte-counted) and has spread
+from two commands to three, including `spring-audit`, the command the tool's
+own help recommends first. The release is **not recommended for unattended CI
+gating**, with more urgency than the prior round.
+
+## Priority Regressions
+
+1. `NEW-01` P0 (escalated): `spring-audit --compact`, `risk` and Markdown
+   `audit-report` all now exit 0 with zero stdout/stderr, measured at 18.4%
+   (9/49) across four batches. The cleanest sample is two back-to-back,
+   identical `spring-audit thingsboard --compact` invocations: the first
+   returns 46,596 bytes in 69.7s, the second 0 bytes in 57.2s — this directly
+   refutes the earlier "only on abnormally fast runs" hypothesis. Hot path,
+   two-process contention, output format and repository size were all tested
+   and ruled out; three-or-more concurrent heavy ASK processes is an
+   unconfirmed correlation, not a cause.
+2. `REG-02` Critical: the default `--agent` ceiling still rejects large
+   repositories by default, with a higher observed peak RSS than 5.9.23
+   (thingsboard 2,029.92 MB vs 1,552.45 MB; spring-boot 2,580.41 MB vs
+   2,523.87 MB). `ASK_MAX_RSS_MB=0` remains the only workaround.
+3. `BUG-01` P0, unchanged: a Java file with a syntax error can still vanish
+   from the answer with no `parse_fail`/`parse_status` disclosure anywhere in
+   the payload or in `answer_bounds.gaps`.
+4. `REG-03`, unchanged: warm `spring-audit` shows no reliable benefit over
+   cold in either time or reliability — the pair in item 1 above is itself the
+   sharpest evidence, since the "warm" run was both slower on wall clock in
+   proportion to work done and the one that came back empty.
+5. `BUG-03` P1, unchanged: marginal Spring detection can still overstate zero-
+   finding coverage.
+
+## Verified Improvements
+
+- `REG-01` resolved: root `ask --help` no longer hangs in a nested-repository
+  workspace. Cost now scales sub-linearly with file count (49 files: 608ms;
+  4,772 files: 13.6s), against 82-86s trending toward 120s+ (`rc=124`) in
+  5.9.23 on the same shape of workspace. The original 31-repo/8,322-file
+  extreme case was not re-confirmed — the audit's own 110s harness cutoff
+  interrupted it before completion — so treat as resolved-on-the-measured-
+  range, not proven at the original extreme.
+- `BUG-15` closed: no Rich markup leaks into non-TTY `--help` output (0
+  occurrences of `[bold]`/`[dim]`/`[bold green]`, down from 208 in 5.9.22 and
+  202 in 5.9.23).
+- `BUG-21` closed, cleanly: `--jobs` now rejects out-of-range values with
+  `INVALID_USAGE` and a stated `1<=x<=128` bound, replacing silent acceptance.
+
+## Verification Boundary
+
+The audit covered 49 byte-counted invocations of the three empty-success-
+suspect commands plus a 93-invocation surface sweep (`S-`, `PC-`, `V-`, `G-`
+variants) that produced zero empties outside those three commands — the
+defect is concentrated, not transversal. SEC-010 precision, `migrate-check
+--compact` savings, universal path aliases, the `verify` gate state machine,
+Java 21 handling and content-id determinism were re-confirmed unchanged from
+5.9.23. `BUG-17` (`remediation-report` silently empty on an unexpected
+positional argument, rather than the `INVALID_USAGE` it gave in 5.9.22/23) is
+flagged as the same failure class as `NEW-01`, on a lower-traffic command.

{sourcecode-5.9.25 → sourcecode-5.9.26}/docs/DEFECT-LEDGER.md

@@ -14,57 +14,82 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
-## Current Synchronization — Alternative External Audit `5.9.23`, carried into `5.9.25` (2026-09-01)
-
-**Release gate: do not use 5.9.25 to gate unattended CI through the audit-command
-family.** A native-Windows alternative audit of the 5.9.23 build measured 55
-`rc=0`, zero-byte answers and eight timeouts in 84 runs. The failures include
-`spring-audit`, `verify`, `risk`, Markdown `audit-report`, `migrate-check`, and
-`migrate-apply`; the prior 3/47 observation was materially incomplete. The
-cause remains unproven. A security-rules phase is a supported hypothesis, not a
-closure claim. `exit 0` is valid only for a non-empty stdout answer or a verified
-`--output` artifact; a missing phase result must be structured failure, never an
-empty finding set.
-
-Priority order is: `ALT-01` silent success and unkept output promises;
-`ALT-02` budget/partial-result failure; `ALT-03` security-rules phase bisection;
-`ALT-04` content-id instability; `ALT-05` contradictory migration totals;
-`ALT-06` false-complete selftest; then remediation, context bounds and CLI
-ergonomics. Full evidence: [`AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md`](AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md)
-and [`AUDIT-2026-09-01-EXTERNAL-5.9.23.md`](AUDIT-2026-09-01-EXTERNAL-5.9.23.md).
+## Current Synchronization — Alternative External Audit `5.9.25`, and External Audit `5.9.25` (2026-09-02)
+
+**Release `5.9.26` closes eight rows from this round with verified evidence**
+(`ALT-09`, `ALT-11`, `BUG-01`, `BUG-03`, `REG-02`'s disclosure half, `ALT-06`'s
+itemization half, plus the `remediation-report` path-admission coverage gap
+and the `ALT-01`/`ALT-03` forensic sidecar) — see each row below for the
+commit-level detail, and `CHANGELOG.md` for the release note. It does **not**
+close the release gate: `ALT-01`/`ALT-03` were investigated and instrumented,
+not fixed, because the failure did not reproduce outside native Windows.
+
+**Release gate unchanged and now more urgent: do not use 5.9.25 or 5.9.26 to
+gate unattended CI through the audit-command family.** Two independent re-audits of
+5.9.25 agree the empty-`exit 0` defect did not shrink. The multi-repository
+audit measured it at 18.4% (9/49, byte-counted) and, for the first time, in
+`spring-audit` itself — the command the tool's own help recommends first. The
+native-Windows audit found the same failure has gone from a hang to something
+**erratic**: the identical `migrate-apply .` invocation gave 8/8 empty answers
+in one batch and 3/3 full answers minutes later with nothing else changed, and
+the failure spread to `migrate-check` and `onboard`, both reliable in 5.9.23.
+`ALT-01` is **reopened**: the commit cited as closing it does not hold under
+native re-test — `risk . -o FILE` still returns `rc=0`, zero bytes, and no
+file in 4/4 runs.
+
+Three rows are genuinely closed with verified evidence this round: `ALT-04`
+(content-id clock exclusion, 3/3 stable hashes), `ALT-05` (findings-population
+reconciliation, exact arithmetic), and `REG-01` (root `ask --help` no longer
+hangs — sub-linear cost curve up to 4,772 files; the original 31-repo extreme
+case was not re-confirmed). `BUG-15` (Rich markup leak) and `BUG-21`
+(`--jobs` range validation) also close cleanly.
+
+Priority order is: `ALT-01` reopened silent success and unkept output
+promises; `ALT-03` security/audit-phase bisection, now with an erratic rather
+than hang-only signature; `ALT-09` (new) `cache clear` ignoring a piped `n`
+answer; `REG-02` agent memory ceiling; `BUG-01` silent malformed-file
+disappearance; then `ALT-07` remediate hang, `ALT-10`/`ALT-11` new latency and
+ergonomics findings, and remaining CLI ergonomics. Full evidence:
+[`AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md)
+and [`AUDIT-2026-09-02-EXTERNAL-5.9.25.md`](AUDIT-2026-09-02-EXTERNAL-5.9.25.md).
 
 | ID | Severity | Status | Evidence and required closure |
 |---|---:|---|---|
-| `ALT-01` | Critical maximum | **fixed, pending native-Windows repetition** | `a7ad44b` hardens the required-answer and output-artifact guards: `exit 0` now requires delivered stdout or a verified requested artifact. Native 30-run repetition remains the release closure evidence. |
+| `ALT-01` | Critical maximum | **reopened, contradicted by native re-test** | `risk . -o FILE` returned `rc=0`, 0 bytes, no file in 4/4 native runs. Source review of the guard (`_fail_on_missing_required_answer`, `_fail_on_unkept_output_promise`, armed for `risk`/`spring-audit`/`verify`/`audit-report`/`migrate-check`/`migrate-apply` via `REQUIRED_ANSWER_COMMANDS`) finds it correctly wired end to end on this platform; the field failure is not reproducible outside native Windows. Both guards now write a forensic sidecar (`empty_answer_diagnostics.record`, referenced as `diagnostics_path` in the error envelope) capturing phase/RSS/argv/pid at the exact moment either fires, so the next occurrence carries evidence instead of a report written from memory. This does not close the row — it makes the next native reproduction diagnosable. |
 | `ALT-02` | Critical maximum | **fixed, bounded-phase follow-up** | `aab1e8b` propagates deadline checks into security posture and publishes omitted stages and partial coverage. A small-repository budget can still finish its coarse earlier phases before the deadline is observed; `ALT-03` owns reducing that phase granularity. |
-| `ALT-03` | High | **open, investigation** | The security-rules phase is the common evidence-backed suspect: all affected audit flows consume security findings, security `retrieve` queries timed out, and `remediate` stalled in the same phase. Bisect the known working small subtree against the 3,342-file root; do not assert causality before reproducing it. |
-| `ALT-04` | High | **fixed** | `36e3893` excludes every nested `*_time_ms` execution clock from `content_id`; parametric tests retain semantic-field sensitivity. |
-| `ALT-05` | High | **fixed** | `b12c8f1` publishes `population_total` and `excluded_before_cap` beside the compact findings cap, reconciling it with the summary population. |
-| `ALT-06` | High | **fixed** | `6d0889e` publishes structured limitations for failed, unrun and unknown ledger rows; `5620864` also makes generic task `gaps` invalidate envelope completeness. |
+| `ALT-03` | High | **open, investigation, sharper signature** | Failures are now mostly near-instant (1-2s) empty success rather than multi-minute hangs on the same commands — consistent with a phase being *skipped*, not *stuck*. The audit could not isolate a trigger below three concurrent heavy ASK processes. Bisect the known working small subtree against the 3,342-file root; do not assert causality before reproducing it. The `ALT-01` diagnostic sidecar now records the last known phase and peak RSS at the moment of every occurrence, closing the evidence gap the audits both named. |
+| `ALT-04` | High | **fixed, confirmed** | `36e3893` excludes every nested `*_time_ms` execution clock from `content_id`. Re-confirmed: `impact-chain` gave the same hash across 3 repeated native runs (was 3 different hashes in 5.9.23). |
+| `ALT-05` | High | **fixed, confirmed** | `b12c8f1` publishes `population_total` and `excluded_before_cap` beside the compact findings cap. Re-confirmed with exact arithmetic: `1526 - 593 = 933 = by_rule.MIG-016`. |
+| `ALT-06` | High | **fixed** | `complete` is correctly `false` when rows fail. The itemization half is also closed: `answer_bounds._summarise` picked a dict's `id` before its `reason`/`what`, so `selftest`'s per-category `limitations` entries rendered as the bare slug (`selftest_rows_failed`) with the actual failing row IDs dropped even though `reason` and the new `rows` field named them. `_summarise` now prefers the descriptive text; no other producer in this codebase pairs `id` with `what`/`reason` on the same dict, so nothing else changes. |
 | `ALT-07` | Medium | **open** | `remediate` regressed from a 23.6-second answer to hangs beyond 400 seconds in `auditing for repairable findings`; it shares the `ALT-03` investigation until separated by evidence. |
-| `ALT-08` | Medium | **fixed** | `15d77d2` publishes the effective per-task stdout budget and the full-artifact path; bounded output remains skipped only for explicit `--output` artifacts. |
-| `NEW-01` | Critical maximum | **superseded by ALT-01** | The earlier 3/47 `risk` and Markdown `audit-report` observation undercounted the native-Windows audit-family failure. |
-| `REG-02` | Critical | **open, regression** | The 1,536 MB default `--agent` ceiling rejects valid large repositories only after spending minutes; it is not published in successful default-agent metadata. Bound projection during construction, sample RSS periodically, and publish the effective ceiling. |
-| `REG-03` | High | **open, regression** | Warm `spring-audit` was measured 2.1–3.8x slower despite a fully reused CIR. Attribute the warm pass before claiming cache benefit. |
-| `REG-01` | High | **open, regression** | Root `ask --help` took 83–86 seconds in a workspace with nested repositories. Help must not perform unbounded repository/profile analysis. |
-| `REG-04` | Medium | **closed 5.9.24** | `_meta.answer_bounds.capped` now aggregates nested cap contracts, so compact answers disclose rows omitted below nested payloads. Regression coverage includes nested dictionaries and lists. |
-| `NEW-02` | High | **open** | Overloaded endpoint handlers can all inherit the final overload's `declaration_line`. Resolve by mapping annotation/signature or publish ambiguity. |
-| `BUG-01` | Critical maximum | **open, P0** | A malformed Java file can disappear without a file-specific declaration. Publish parse failure/recovery in the answer bounds and preserve any affected endpoint gap. |
+| `ALT-08` | Medium | **fixed, confirmed** | `15d77d2` publishes the effective per-task stdout budget and the full-artifact path; confirmed functioning, with a minor arithmetic mismatch in `prepare-context review-pr`'s `_truncation_summary` noted as low-severity follow-up. |
+| `ALT-09` | Critical | **open, new** | `ask cache clear .` deletes cache entries even when piped stdin answers `n`; only true EOF (`< /dev/null`) correctly refuses. The non-interactivity detector appears to treat "stdin has bytes" as "proceed" instead of reading and comparing them against `y`/`yes`. Low blast radius today (cache is rebuildable); fix the detection to use `isatty()` plus an actual answer comparison before any future destructive command reuses the same pattern. |
+| `ALT-10` | Medium | **open, new** | `onboard .` took 164.9s cold in one native session versus a consistent 681-780ms in every prior round on the same repository (~240x). Delivered a full answer, so not release-blocking alone; profile for a shared warm-up path with the `ALT-01`/`ALT-03` commands. |
+| `ALT-11` | Low | **fixed** | `watch` now emits a `{"tick": 0, "status": "watching", "elapsed_ms": …}` NDJSON line on stdout immediately after the index warms and before the tick loop begins — the channel `watch` already promises a consumer is reading, unlike stderr, whose silence on a non-TTY stream is a deliberate, tested invariant elsewhere in the CLI. Written to `--output` too. |
+| `NEW-01` | Critical maximum | **escalated** | Now measured at 18.4% (9/49, byte-counted) and reaches `spring-audit --compact` in addition to `risk` and Markdown `audit-report`. Two identical back-to-back `spring-audit thingsboard --compact` runs (46,596 bytes/69.7s, then 0 bytes/57.2s) refute the earlier "only on abnormally fast runs" hypothesis. `BUG-17` (`remediation-report` silently empty on an unexpected positional, rather than `INVALID_USAGE`) does not reproduce as described here: the command returns its normal, non-empty bundled-ledger report regardless of the path given, by design (`del path` — "the bundled ledger is used"), so it is not the same failure class as `NEW-01`. What is real and now fixed is narrower: `path_admission`'s own coverage battery had a gap for exactly this command — `remediation-report`'s `path` parameter matched the battery's repo-path discovery heuristic with no invocation row, a pre-existing red independent of this audit. Closed by documenting the exclusion inline (`PATH_NOT_READ_BY_DESIGN` in `tests/test_path_admission.py`), the same "opt-out is a decision, not an omission" convention `cli.py` already uses for `--copy`/`Progress`. |
+| `REG-02` | Critical | **partially fixed: disclosure half closed, enforcement-timing half open** | Reproduced and fixed the specific gap named in both audits: a successful `--agent` run published `_meta.memory.configured_max_rss_mb: null` even though `_root_memory_seam` was actively enforcing the 1,536 MB default at every phase boundary for that same run. `disclosure()` now takes the same `default_ceiling_mb` `exceeded()` already did, and the root command threads whether `--agent` is active through a per-invocation flag (`_AGENT_MODE_ACTIVE`) so a successful run says what protected it. The still-open half — the ceiling rejecting large repositories only after minutes of work, and a higher observed peak than 5.9.23 (2,029.92 MB vs 1,552.45 MB) — needs periodic RSS sampling with early abort inside the expensive phases themselves (`BUG-22`'s row), which cannot be validated without the field's own large repository. |
+| `REG-03` | High | **open, regression, unchanged** | Warm `spring-audit` still shows no reliable time or reliability benefit over cold; the `NEW-01` back-to-back pair is itself the sharpest evidence, since the "warm" run was proportionally slower and the one that came back empty. |
+| `REG-01` | High | **closed, resolved on measured range** | Root `ask --help` no longer hangs in a nested-repository workspace: cost now scales sub-linearly (49 files: 608ms; 4,772 files: 13.6s), against 82-86s trending to 120s+/`rc=124` in 5.9.23. The original 31-repo/8,322-file extreme case was not re-confirmed — the audit's own 110s harness cutoff interrupted it. Re-run that specific extreme case before treating the ceiling as proven. |
+| `REG-04` | Medium | **closed 5.9.24, reconfirmed** | `_meta.answer_bounds.capped` aggregation re-verified in `migrate-check --compact`: all 5 nested cap contracts listed, 268 omitted values disclosed. |
+| `NEW-02` | High | **open, unchanged** | Overloaded endpoint handlers can all inherit the final overload's `declaration_line`; the `anchor_ambiguity`/`overload_count` fields expected from this row are still absent from the payload. Resolve by mapping annotation/signature or publish ambiguity. |
+| `BUG-01` | Critical maximum | **fixed, mechanism narrowed, not eliminated** | Reproduced directly: a missing `;` or a missing `)` on a method signature both extract a clean class+method symbol pair with balanced braces, so the E-10 brace-only check (`unbalanced_braces`) never fired and the file passed as clean. `repository_ir.py` now also masks and checks paren balance (`unbalanced_parens`), publishing the same `parse_structure` gap for that shape. This is a heuristic extractor without a real Java grammar, so a syntax error that disturbs neither braces nor parens (for example a missing operand with balanced punctuation on both sides) remains undetectable by construction — the row stays open at lower severity for that residual class, not closed. |
 | `BUG-02` | Critical maximum | **open, P0** | Large `risk` ended `rc=127` with no output or structured failure. Add fail-fast resource/process handling and durable partial checkpoints. |
 | `BUG-12` | Critical maximum | **open, P0** | Deep `--agent` output construction reaches multi-gigabyte RSS before a small answer. Bound projection while building. |
-| `BUG-03` | High | **open, P1** | Marginal Spring detection can overstate what a zero-finding result covers. Publish Spring footprint/coverage with the stack-fit claim. |
+| `BUG-03` | High | **fixed** | `non_coverage.stack_fit`'s marginal-detection disclosure (`fit: "partial"`, below 10% Spring-bean density) has existed since AUD-596-D13 but was unreachable from `risk` and `posture`: neither call site passed `spring_footprint`, so `java_files` stayed 0 and the branch that reads it could never fire regardless of the real ratio. Both now compute it the same way `spring-audit`'s own call already did (`sum(bean.spring for bean in graph.beans.values())` over `len(cir.files)`); verified end to end on a 1-bean/16-file fixture. |
 | `BUG-04` | High | **open, P1** | `selftest` publishes `complete=true` with five error rows. Derive bounds from actual results. |
 | `BUG-05` | High | **open, P1** | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
 | `BUG-07` | Closed 5.9.23, verification gap | Compact JVM inventory is bounded, but the audit notes no selftest row protects the correction. Add release-battery coverage before treating it as durable closure. |
-| `BUG-10` | High | **open, P1** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
-| `BUG-11` | High | **open, P1** | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
-| `BUG-13` | High | **open, P1** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
-| `BUG-16` | High | **open, P1** | Context-cache growth has no published budget or eviction contract; about 1.5 GB was measured. |
+| `BUG-10` | High | **open, P1, unchanged** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
+| `BUG-11` | High | **open, P1, now hangs instead of failing fast** | Default `pack assessment` and `pack gate --since` now hang to their external kill (300s/200s) instead of the legitimate `INVALID_INPUT`/`INVALID_USAGE` they gave in 5.9.23 — both compose the audit-family commands affected by `ALT-01`/`ALT-03` and inherit the failure. |
+| `BUG-13` | High | **open, P1, unchanged** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
+| `BUG-15` | Low | **closed 5.9.25** | Non-TTY `ask --help` no longer emits Rich markup: 0 occurrences of `[bold]`/`[dim]`/`[bold green]`, down from 208 (5.9.22) and 202 (5.9.23). |
+| `BUG-16` | High | **open, P1, unchanged** | Context-cache growth has no published budget or eviction contract; ~1.7 GB was measured (was ~1.6 GB in 5.9.23). |
+| `BUG-21` | Low | **closed 5.9.25** | `--jobs` now rejects out-of-range values with `INVALID_USAGE` stating the `1<=x<=128` bound, replacing silent acceptance. |
 | `BUG-22` | High | **open, P1** | RSS ceilings are checked post-hoc. Add periodic sampling and orderly abort. |
 
-The remaining `BUG-04b`, `BUG-06`, `BUG-08`, `BUG-09`, `BUG-15`, `BUG-19`,
-`BUG-20`, `BUG-21` and `BUG-23` findings are open P2/coverage follow-ups in
-the audit document. None is closed by documentation alone.
+The remaining `BUG-04b`, `BUG-06`, `BUG-08`, `BUG-09`, `BUG-19`, `BUG-20` and
+`BUG-23` findings are open P2/coverage follow-ups in the audit document. None
+is closed by documentation alone.
 
 ## Current Synchronization — External Audit `AUD-621`
 

{sourcecode-5.9.25 → sourcecode-5.9.26}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,24 +1,33 @@
 # ASK — Development Roadmap
 
-### Alternative Audit Intake — release 5.9.23 reliability regression
-
-An alternative native-Windows audit found the audit-command family unreliable:
-55 zero-byte `exit 0` answers and eight timeouts in 84 executions. `spring-audit`
-and `verify` answered 0/34; `risk`, Markdown `audit-report`, `migrate-check`, and
-`migrate-apply` also failed silently. This overrides the earlier characterization
-as a rare output anomaly. No feature work should be treated as release-ready
-until the following recovery sequence has native evidence.
-
-| Priority | Required work and closure boundary |
-|---|---|
-| P0 | Enforce `exit 0 => non-empty stdout OR verified --output artifact` across the command registry. A missing auditing-phase result or worker failure must emit structured non-zero failure. Run at least 30 native repetitions per affected command. |
-| P0 | Restore the budget contract: applicable `ASK_MAX_ANALYSIS_SECONDS` deadlines publish `partial:true` and `complete:false`; non-applicable commands disclose that fact. Verify `risk`, `audit-report`, and `spring-audit` natively. |
-| P1 | Bisect the security-rules phase using the working small subtree and the 3,342-file failing root. It is a hypothesis supported by affected command overlap, not an established root cause. |
-| P1 | Restore `content_id` stability by excluding `metadata.*_time_ms` execution clocks, and make selftest completion/gaps derive from failures and errors. |
-| P1 | Reconcile `migrate-check` findings populations and bound `prepare-context review-pr`; then address remediation hangs and remaining CLI ergonomics. |
-
-The full measurement matrix and non-regression controls are in
+### Alternative Audit Intake — release 5.9.25, closed in 5.9.26 where marked
+
+The 5.9.23 recovery sequence closed three rows with verified evidence
+(content-id clocks, findings-population reconciliation, root `--help`
+latency), but the release-blocking failure did not shrink on re-audit — it
+changed shape. The same `migrate-apply .` invocation gave 8/8 empty answers
+in one batch and 3/3 full answers minutes later with nothing else changed,
+and the failure now also reaches `migrate-check` and `onboard`, both reliable
+in 5.9.23. The commit cited as closing the output-promise guard (`ALT-01`)
+does not hold under native re-test: `risk . -o FILE` still returns `rc=0`,
+zero bytes, no file, in 4/4 runs. No feature work should be treated as
+release-ready until the following recovery sequence has native evidence.
+
+| Priority | Required work and closure boundary | 5.9.26 |
+|---|---|---|
+| P0 | Make the output-promise guard reachable from every failure path, not only the success path — `risk -o FILE` must not return `rc=0` with an unwritten file. Re-verify `endpoints --output`, which does honor the guard today, as the reference implementation. | **Not reproducible on this platform.** Source review confirms the guard is wired for every affected command; the field failure needs native Windows to isolate. |
+| P0 | Instrument the point where a command decides "there is a result to serialize" vs "there is not," across `spring-audit`, `verify`, `risk`, `audit-report`, `migrate-check`, `migrate-apply` and `selftest`. The decision now appears erratic within one shell session on identical input — treat it as a shared worker/lock availability defect, not a size or budget threshold, and never let the "no result" branch exit 0. | **Done.** Both exit guards now write a forensic sidecar (phase, peak RSS, argv, pid) referenced as `diagnostics_path` in the error envelope every time either fires — the next native occurrence carries evidence instead of a report reconstructed from memory. |
+| P0 | Fix `ask cache clear .` reading a piped stdin answer: `echo n | ask cache clear .` deletes cache despite `n` meaning refuse. Use `isatty()` for non-interactivity detection and actually compare read bytes against `y`/`yes` before proceeding. | **Done.** `_read_piped_answer` reads a bounded, non-blocking line and honors an explicit `n`; a stdin left open but never closed still falls back to the prior default-confirm behavior, so this never risks the hang the non-interactive branch exists to avoid. |
+| P1 | Bisect the security/audit-rules phase using the working small subtree and the 3,342-file failing root; failures are now mostly near-instant empty success rather than hangs, consistent with a *skipped* phase rather than a *stuck* one. | Open — needs the native repository. |
+| P1 | Profile the `onboard .` 164.9s cold outlier (vs. a consistent ~700ms baseline) for a shared warm-up path with the commands above, and make `watch .` emit an immediate startup confirmation line. | **Watch half done.** `watch` now emits a `status: "watching"` NDJSON line on stdout before its tick loop. The `onboard` cold-start outlier still needs the native repository to profile. |
+
+The full measurement matrices and non-regression controls are in
+[`AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md)
+and [`AUDIT-2026-09-02-EXTERNAL-5.9.25.md`](AUDIT-2026-09-02-EXTERNAL-5.9.25.md).
+The prior round's evidence remains in
 [`AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md`](AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md).
+Full fix detail, commit by commit, is in [`DEFECT-LEDGER.md`](DEFECT-LEDGER.md)
+and [`CHANGELOG.md`](../CHANGELOG.md).
 
 ### Release 5.9.20 — JVM evidence inventory
 

{sourcecode-5.9.25 → sourcecode-5.9.26}/docs/EXECUTIVE-ROADMAP.md

@@ -5,6 +5,46 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
+> **CURRENT UPDATE — release `5.9.26`, fix queue from both 5.9.25 re-audits.**
+> Eight rows closed with verified evidence, each with a regression test:
+> `cache clear`/`context-clear` now read a piped refusal instead of treating
+> any redirected stdin as consent; a second parse-structure signal
+> (unbalanced parentheses) catches syntax errors brace-balance alone missed;
+> `watch` confirms startup on stdout instead of going silent; a successful
+> `--agent` run discloses the default RSS ceiling it ran under; `selftest`
+> names the specific failing rows instead of a bare category slug; `risk`
+> and `posture` now reach the marginal-Spring-detection disclosure that has
+> existed since 5.8.21 but was dead code at both call sites. **This does not
+> close the release gate**: the empty-`exit 0` failure across `spring-audit`,
+> `verify`, `risk`, `audit-report`, `migrate-check` and `migrate-apply`
+> (`ALT-01`/`ALT-03`) did not reproduce outside native Windows and remains
+> open — every affected command now writes a forensic sidecar (phase, peak
+> RSS, argv) when it fires, so the next native occurrence carries evidence
+> instead of requiring reconstruction after the fact. Continue to withhold
+> unattended CI gating through the audit-command family. See
+> [`DEFECT-LEDGER.md`](DEFECT-LEDGER.md) and [`CHANGELOG.md`](../CHANGELOG.md).
+
+> **CURRENT UPDATE — release `5.9.25`, two independent re-audits, empty-success
+> failure spreads and turns erratic.** Two evaluators score 5.9.25 lower than
+> 5.9.23: the multi-repository evaluator 6.3/10 (down from 6.9) and the
+> native-Windows evaluator 4.3/10 (down from 4.9). Three defects closed with
+> verified evidence — content-id clock exclusion, findings-population
+> reconciliation, and root `ask --help` no longer hanging in nested
+> workspaces — plus two smaller fixes (a Rich-markup leak in `--help`, and
+> `--jobs` range validation). But the empty-`exit 0` defect grew: it now
+> measures at 18.4% and reaches `spring-audit` itself, the command the
+> product's own help recommends first, and on native Windows the same
+> `migrate-apply .` invocation swung between 8/8 empty and 3/3 full answers
+> minutes apart with nothing else changed, with the failure spreading to
+> `migrate-check` and `onboard`. The commit that was believed to close the
+> output-artifact guard does not hold under re-test: `risk -o FILE` still
+> returns `rc=0` with no file written. **Do not use 5.9.25 to gate unattended
+> CI through the audit-command family.** Keep bounded pilots only; the
+> commercial hypothesis remains bounded by this defect until it closes with
+> native repeated evidence, not a single clean session. See
+> [`AUDIT-2026-09-02-EXTERNAL-5.9.25.md`](AUDIT-2026-09-02-EXTERNAL-5.9.25.md)
+> and [`AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md).
+
 > **CURRENT UPDATE — release `5.9.19`, remediation.** Windows parse workers are now forbidden at their construction point, `pack gate` drains UTF-8 child stderr safely, and `pack gate --since` extracts git refs compatibly on Python 3.9–3.14. Expected validation exits remain typed input errors. These are code fixes, not native-Windows closure evidence: keep bounded pilots until the required repetition and process-lifecycle measurements complete.
 
 > **CURRENT UPDATE — release `5.9.17`, external re-audit.** The restored command

{sourcecode-5.9.25 → sourcecode-5.9.26}/docs/USER_GUIDE.md

@@ -279,7 +279,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.25
+# ask 5.9.26
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.25 → sourcecode-5.9.26}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.25"
+version = "5.9.26"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.25 → sourcecode-5.9.26}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.25"
+__version__ = "5.9.26"

{sourcecode-5.9.25 → sourcecode-5.9.26}/src/sourcecode/answer_bounds.py

@@ -77,7 +77,16 @@ def _summarise(value: Any) -> Any:
     payloads would see the same fact move twice.
     """
     if isinstance(value, dict):
-        for key in ("id", "what", "reason", "not_covered", "message", "title"):
+        # R-05 (5.9.25 alternative audit): `reason`/`what` are the producer's
+        # own descriptive sentence about the gap; `id` is a stable category
+        # slug meant for a consumer that filters programmatically, not for a
+        # human reading `gaps`. `id` used to be checked first, so a producer
+        # that published both (selftest's `limitations`) had its actual
+        # itemized detail — which rows, not just how many — silently dropped
+        # in favor of the bare slug. No other producer in this codebase pairs
+        # `id` with `what`/`reason` on the same dict, so this reorder changes
+        # nothing for any of them.
+        for key in ("what", "reason", "not_covered", "message", "title", "id"):
             if key in value and isinstance(value[key], str):
                 return value[key][:200]
         return {k: v for k, v in list(value.items())[:3] if not isinstance(v, (dict, list))}