sourcecode 5.9.25__tar.gz → 5.9.27__tar.gz

{sourcecode-5.9.25 → sourcecode-5.9.27}/CHANGELOG.md

@@ -1,5 +1,81 @@
 # Changelog
 
+## [5.9.27] — 2026-09-02
+
+*Follow-up from the 5.9.26 re-audit — a sharper instrumentation lead and a
+CLI-ergonomics regression.*
+
+### Fixed
+
+- `remediation-report` still accepts any repository path for invocation
+  consistency, but now discloses `path_argument: {given, used: false}`
+  whenever one is passed, whether or not it exists — a real path, no path,
+  and a nonexistent path no longer produce byte-identical, silently
+  misleading output.
+
+### Changed
+
+- Added a bounded entry-point trace (`record_entry_reached`) as the literal
+  first statement of the CLI entry point, scoped to the six audit-family
+  commands the empty-`exit 0` defect affects. The follow-up audit's
+  forensic sidecar never fired across 32 observed empty answers; this
+  answers a narrower question directly — did the failing process reach
+  this product's own entry point at all — instead of leaving it inferable
+  only from an absent failure record.
+
+### Known Limitations
+
+- The empty-`exit 0` failure across `spring-audit`, `verify`, `risk`,
+  `audit-report`, `migrate-check` and `migrate-apply` (`ALT-01`/`ALT-03`)
+  remains open. The 5.9.26 re-audit found the diagnostic sidecar added to
+  instrument it never fired in 32 observed occurrences — evidence the
+  failure happens before this product's own entry-point wrapper runs, not
+  inside a caught exception. The new entry-point trace targets exactly that
+  question; the underlying mechanism is still unconfirmed.
+- `--agent`'s RSS ceiling enforcement timing (`REG-02`) and `spring-audit`
+  warm-path performance (`REG-03`) are unchanged and need the field's own
+  large repository to validate safely.
+- The re-audit's own report was internally inconsistent this round (an
+  initial pass found 0/23 empty answers, a later pass in the same session
+  found 0/35 successful answers); neither reading is treated as regime
+  evidence on its own.
+
+## [5.9.26] — 2026-09-02
+
+*Fix queue from the two 5.9.25 re-audits (multi-repository and native-Windows).*
+
+### Fixed
+
+- Non-interactive `cache clear` / `cache context-clear` now read a piped
+  refusal instead of treating any redirected stdin as an implicit "yes".
+- A malformed Java file with unbalanced parentheses — a missing `;` or `)`
+  that still extracts a clean symbol pair — is now disclosed as a recovered
+  parse, alongside the existing unbalanced-brace signal.
+- `watch` publishes an immediate startup event on stdout before its tick
+  loop begins, instead of giving no output at all until the first change.
+- A successful `--agent` run now discloses the default 1,536 MB RSS ceiling
+  it was run under, instead of reporting `configured_max_rss_mb: null` for a
+  ceiling that was actively enforced.
+- `selftest`'s reported gaps now name the specific ledger rows that failed
+  or could not run, instead of a bare category slug.
+- `risk` and `posture` now publish the marginal-Spring-detection disclosure
+  (`stack_fit.fit: "partial"`) that existed since 5.8.21 but was unreachable
+  from either command.
+- Every command that reports an unproven "empty answer with exit 0" now
+  writes a forensic sidecar (phase, peak RSS, argv) referenced from its
+  error envelope, so a future occurrence carries evidence instead of
+  requiring reconstruction after the fact.
+
+### Known Limitations
+
+- The empty-`exit 0` failure across `spring-audit`, `verify`, `risk`,
+  `audit-report`, `migrate-check` and `migrate-apply` (`ALT-01`/`ALT-03`) is
+  not reproducible on this platform and remains open; the new diagnostic
+  sidecar is the actionable response until it recurs with evidence.
+- The `--agent` RSS ceiling still evaluates only after the analysis
+  completes, not periodically during it (`BUG-22`), and warm-path
+  performance for `spring-audit` (`REG-03`) remains unverified.
+
 ## [5.9.25] — 2026-09-01
 
 *Reliability remediation from the alternative 5.9.23 audit.*

{sourcecode-5.9.25 → sourcecode-5.9.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.25
+Version: 5.9.27
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.25-blue)
+![Version](https://img.shields.io/badge/version-5.9.27-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -290,7 +290,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.25 — and, on a build that has aged,
+ask version                    # ask 5.9.27 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.25 → sourcecode-5.9.27}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.25-blue)
+![Version](https://img.shields.io/badge/version-5.9.27-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -241,7 +241,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.25 — and, on a build that has aged,
+ask version                    # ask 5.9.27 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.9.27/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md

@@ -0,0 +1,112 @@
+# Alternative External Audit - 5.9.25
+
+## Scope And Verdict
+
+This native-Windows re-audit evaluated the 5.9.25 build on the same dirty
+3,342-Java-file repository as the 5.9.23 round, under Python 3.10. It rates
+the release **4.3/10**, down from 4.9 for 5.9.23 (6.6 for 5.9.22). Three
+defects from the prior round are genuinely fixed with verified evidence
+(content-id clock exclusion, findings-population reconciliation, nested-cap
+aggregation), but the release-blocking failure did not shrink — it became
+**erratic**: the same invocation, repeated seconds apart with nothing else
+changed, now swings between an instant empty answer and a full one, and the
+failure mode has spread to `migrate-apply`, `migrate-check` and `onboard`,
+which were reliable in 5.9.23.
+
+This is an external measurement. It is evidence of a release-blocking
+failure, not proof of a single root cause. Engineering-host results do not
+close it.
+
+## Execution Matrix
+
+| Invocation | Runs | Answers | Empty `exit 0` | Timeouts |
+|---|---:|---:|---:|---:|
+| `spring-audit . --compact` | 18 | 0 | 17 | 1 |
+| `verify .` | 18 | 0 | 18 | 0 |
+| `risk . --limit 20` | 7 | 0 | 7 | 0 |
+| `audit-report . --format markdown` | 7 | 0 | 7 | 0 |
+| `migrate-apply .` (first batch) | 8 | 0 | 8 | 0 |
+| `migrate-apply .` (isolated re-run, same session) | 3 | 3 | 0 | 0 |
+| `risk . -o promise.json` (output-artifact promise) | 4 | 0 | 4 (no file written) | 0 |
+| `selftest .` | 1 | 1 pass of 12 checked | — | — |
+
+The same `migrate-apply .` invocation gave 8/8 empty answers in 1.1-1.7s in
+one batch and 3/3 full answers (14-29s, 9,542 bytes) minutes later with
+nothing else changed — no cache clear, no env var, same repository size. The
+decision of "is there a result to serialize" is not correlated with repo
+size, budget, cache state or output format in this data; it now looks
+consistent with worker/lock availability at start, not with any input.
+
+## Release Blockers
+
+1. `ALT-01` — **reopened, contradicted by native re-test.** The commit cited
+   as closing this row (`a7ad44b`, "exit 0 requires delivered stdout or a
+   verified requested artifact") does not hold: `risk . -o promise.json`
+   returned `rc=0`, 0 bytes, and no file in 4/4 native runs. `risk` and the
+   audit-family commands appear to take the same early silent-failure branch
+   identified in `ALT-03`, which returns before reaching the output-promise
+   guard that does correctly protect `endpoints --output`. Verify the guard
+   is reachable from every command's failure path, not just its success path.
+2. `ALT-03` — **open, now with a sharper — but still unconfirmed — signature.**
+   The failure is no longer "hangs on the large root, works on the small
+   subtree"; it is now mostly near-instant (1-2s) empty success instead of a
+   multi-minute hang, on the same commands. This is consistent with a phase
+   that is *skipped* rather than one that is *stuck*, but the audit could not
+   isolate the trigger with fewer than 3 concurrent heavy ASK processes.
+3. `ALT-09` (new) — Critical: `ask cache clear .` ignores the actual content
+   of a piped stdin answer. `echo n | ask cache clear .` deletes cache
+   entries despite `n` meaning "no" at any `[y/N]` prompt; only true EOF
+   (`< /dev/null`) correctly refuses. The non-interactivity detector appears
+   to treat "stdin has bytes" as "proceed", instead of reading and comparing
+   those bytes against `y`/`yes`. Low blast radius today (cache is
+   rebuildable), high risk if the same detection pattern is reused for a
+   future destructive command that touches source.
+4. Closure requires at least 30 native repetitions per affected command, with
+   byte counts, exit code, timeout status and requested-output-file
+   existence — unchanged from the 5.9.23 round's bar, still unmet.
+
+## Additional Regressions
+
+- `ALT-10` (new): `onboard .` took 164.9s cold on this session versus a
+  consistent 681-780ms in every prior round on the same repository (roughly
+  240x). Not release-blocking on its own since it did deliver a full answer,
+  but unprecedented and worth profiling for a shared warm-up path with the
+  commands above.
+- `ALT-11` (new), low: `watch .` returns `rc=124` at 15.2s with no heartbeat
+  or "watching..." confirmation line, so a caller cannot distinguish "still
+  starting" from "hung" without external knowledge of expected behavior.
+- `pack gate --since HEAD~1` and `pack assessment .` now hang to their
+  external kill (200s / 300s) instead of failing fast with the legitimate
+  `INVALID_USAGE` / `INVALID_INPUT` errors they gave in 5.9.23 — both compose
+  the audit-family commands above and inherit `ALT-01`/`ALT-03`.
+- `selftest .` fell from 9/12 pass (5.9.23) to 1/12 pass on the same 120s
+  deadline, same repository, same machine — the product's own regression
+  battery is itself a casualty of `ALT-03`.
+- `impact-chain` `metadata.audit_time_ms` is always `0.0` while
+  `query_time_ms` varies normally; likely the same skipped security phase
+  publishing `0` instead of `null` for a phase that never ran.
+- `prepare-context review-pr`'s `_truncation_summary` has a minor arithmetic
+  mismatch between `original_size_bytes - final_size_bytes` and the stated
+  budget accounting (low severity, unlike the `ALT-05` totals mismatch it
+  otherwise resembles).
+
+## Preserved Evidence
+
+- `ALT-04` (content-id clock exclusion) confirmed: `impact-chain` gave the
+  same hash across 3 repeated runs, versus 3 different hashes in 5.9.23.
+- `ALT-05` (findings-population reconciliation) confirmed with exact
+  arithmetic: `population_total: 1526`, `excluded_before_cap: 933`, and
+  `1526 - 593 = 933 = by_rule.MIG-016`.
+- `ALT-06` (false-complete `selftest`) partially confirmed: `complete` is
+  correctly `false` when rows fail, but `gaps` still collapses 10 named
+  failing rows into one generic entry instead of the itemized list the
+  payload's own `rows[]` already has (`ALT-06` should stay open for this
+  half).
+- `ALT-08` (stdout budget disclosure) confirmed, functioning.
+- Endpoint analysis remained exact (3,763), UTF-8 encoding is correct at the
+  byte level, and the lightweight CI paths `pr-risk`, `review-pr` and
+  `pr-impact` delivered full payloads every time.
+
+These controls must remain in the regression battery while the P0 recovery
+work proceeds; they do not compensate for an audit-family failure that grew
+more erratic and spread to previously reliable commands.

sourcecode-5.9.27/docs/AUDIT-2026-09-02-EXTERNAL-5.9.25.md

@@ -0,0 +1,62 @@
+# External Audit - 5.9.25
+
+## Release Status
+
+The 5.9.25 re-audit rates ASK Engine at **6.3/10**, down from 6.9. Precision,
+recall and determinism hold steady; the empty-success defect first measured at
+3/47 in 5.9.23 is now measured at 18.4% (9/49, byte-counted) and has spread
+from two commands to three, including `spring-audit`, the command the tool's
+own help recommends first. The release is **not recommended for unattended CI
+gating**, with more urgency than the prior round.
+
+## Priority Regressions
+
+1. `NEW-01` P0 (escalated): `spring-audit --compact`, `risk` and Markdown
+   `audit-report` all now exit 0 with zero stdout/stderr, measured at 18.4%
+   (9/49) across four batches. The cleanest sample is two back-to-back,
+   identical `spring-audit thingsboard --compact` invocations: the first
+   returns 46,596 bytes in 69.7s, the second 0 bytes in 57.2s — this directly
+   refutes the earlier "only on abnormally fast runs" hypothesis. Hot path,
+   two-process contention, output format and repository size were all tested
+   and ruled out; three-or-more concurrent heavy ASK processes is an
+   unconfirmed correlation, not a cause.
+2. `REG-02` Critical: the default `--agent` ceiling still rejects large
+   repositories by default, with a higher observed peak RSS than 5.9.23
+   (thingsboard 2,029.92 MB vs 1,552.45 MB; spring-boot 2,580.41 MB vs
+   2,523.87 MB). `ASK_MAX_RSS_MB=0` remains the only workaround.
+3. `BUG-01` P0, unchanged: a Java file with a syntax error can still vanish
+   from the answer with no `parse_fail`/`parse_status` disclosure anywhere in
+   the payload or in `answer_bounds.gaps`.
+4. `REG-03`, unchanged: warm `spring-audit` shows no reliable benefit over
+   cold in either time or reliability — the pair in item 1 above is itself the
+   sharpest evidence, since the "warm" run was both slower on wall clock in
+   proportion to work done and the one that came back empty.
+5. `BUG-03` P1, unchanged: marginal Spring detection can still overstate zero-
+   finding coverage.
+
+## Verified Improvements
+
+- `REG-01` resolved: root `ask --help` no longer hangs in a nested-repository
+  workspace. Cost now scales sub-linearly with file count (49 files: 608ms;
+  4,772 files: 13.6s), against 82-86s trending toward 120s+ (`rc=124`) in
+  5.9.23 on the same shape of workspace. The original 31-repo/8,322-file
+  extreme case was not re-confirmed — the audit's own 110s harness cutoff
+  interrupted it before completion — so treat as resolved-on-the-measured-
+  range, not proven at the original extreme.
+- `BUG-15` closed: no Rich markup leaks into non-TTY `--help` output (0
+  occurrences of `[bold]`/`[dim]`/`[bold green]`, down from 208 in 5.9.22 and
+  202 in 5.9.23).
+- `BUG-21` closed, cleanly: `--jobs` now rejects out-of-range values with
+  `INVALID_USAGE` and a stated `1<=x<=128` bound, replacing silent acceptance.
+
+## Verification Boundary
+
+The audit covered 49 byte-counted invocations of the three empty-success-
+suspect commands plus a 93-invocation surface sweep (`S-`, `PC-`, `V-`, `G-`
+variants) that produced zero empties outside those three commands — the
+defect is concentrated, not transversal. SEC-010 precision, `migrate-check
+--compact` savings, universal path aliases, the `verify` gate state machine,
+Java 21 handling and content-id determinism were re-confirmed unchanged from
+5.9.23. `BUG-17` (`remediation-report` silently empty on an unexpected
+positional argument, rather than the `INVALID_USAGE` it gave in 5.9.22/23) is
+flagged as the same failure class as `NEW-01`, on a lower-traffic command.

sourcecode-5.9.27/docs/AUDIT-2026-09-02-EXTERNAL-5.9.26.md

@@ -0,0 +1,70 @@
+# External Audit - 5.9.26
+
+## Release Status
+
+This session is internally contradictory, and both halves are published rather
+than resolved into one number. An initial 129-invocation pass replicating the
+exact 5.9.23/5.9.25 methodology found **zero** empty-`exit 0` answers (0/23 on
+the precise invocations that gave 18.4% in 5.9.25), scoring the release
+**7.4/10**. A second, larger pass in the same session — prompted by trying to
+find the forensic sidecar `ALT-01`'s fix is supposed to write on every guard
+trip — found **zero successful answers** across 35 further invocations of the
+same command family, and revised the verdict down to **3.8/10**, the lowest of
+four audited releases. The auditor's own final position is the second number;
+the first is published as a retracted intermediate reading, not a competing
+conclusion.
+
+## Priority Finding — the diagnostic guard is not being reached
+
+`empty_answer_diagnostics.record()` is documented to write a sidecar and stamp
+`diagnostics_path` in the error envelope every time either exit guard fires.
+Across 32 empty `exit 0` answers this session (stdout **and** stderr both at 0
+bytes), no sidecar file exists anywhere on the audited machine, and no error
+envelope was ever printed. This does not mean the guard is miscalibrated — it
+means the failing runs are not reaching `main_entry`'s wrapper at all. A
+one-line "reached the guard" debug log at that entry point would confirm this
+directly and is the most actionable next step across four audit rounds.
+
+## Priority Regressions
+
+1. `NEW-01`/`ALT-01`/`ALT-03` (the audit-command family): 0 of 35 invocations
+   answered this session, the worst of four rounds, and for the first time a
+   single batch of identical `spring-audit . --compact` calls produced both
+   failure shapes — a 200s hang and a near-instant empty answer — without
+   changing anything between them.
+2. `ALT-10`/onboard: a cold run hit the external 200s kill entirely (worse
+   than 5.9.25's 164.9s worst case); a second, untouched run answered in
+   83.5s — still roughly 120x the historical 681-780ms baseline.
+3. `BUG-17` regression, reconfirmed: `remediation-report` with no path, a
+   real path, and a nonexistent path all return byte-identical output. This
+   is not a false claim about a repository (the command never claims to
+   have read one) but is CLI-ergonomics regression from an explicit
+   `INVALID_USAGE` in 5.9.22/23/25.
+
+## Verified Improvements
+
+- `ALT-09` (piped refusal on `cache clear`) confirmed working exactly as
+  fixed: `echo n | ask cache clear .` now aborts with `rc=1` and leaves the
+  cache untouched.
+- `ALT-04`/`ALT-05` (content-id stability, findings reconciliation) both
+  reconfirmed with fresh measurements.
+- `BUG-01` (unbalanced-parens parse-structure signal) verified with the
+  auditor's own constructed fixture, not just the shipped test suite.
+- `BUG-15`/`BUG-21` (markup leak, `--jobs` range) both reconfirmed.
+- `ALT-11` (`watch` startup event): confirmed working, with a measurement
+  correction — the auditor's own first attempt used too short an observation
+  window (8-20s) and nearly mis-reported this as broken. The index warm on
+  the 3,342-file audited repository takes 51.7s before the first NDJSON
+  line, which is real and not a defect, but is long enough to still read as
+  hung without foreknowledge.
+
+## Verification Boundary
+
+This session ran under heavier contention than any prior round: up to five
+concurrent ASK processes on the same machine and cache directory (the
+auditor's own batches plus a second, independent agent session exercising the
+same corpus in parallel), with system free RAM as low as 3.4-4.6 GB of 32 GB.
+The audit-family failure did not correlate cleanly with this contention in
+either direction this session — it was both absent (first pass, under the
+heaviest contention observed) and total (second pass). No stable trigger
+variable has been isolated in four audit rounds.

{sourcecode-5.9.25 → sourcecode-5.9.27}/docs/DEFECT-LEDGER.md

@@ -14,57 +14,137 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
-## Current Synchronization — Alternative External Audit `5.9.23`, carried into `5.9.25` (2026-09-01)
-
-**Release gate: do not use 5.9.25 to gate unattended CI through the audit-command
-family.** A native-Windows alternative audit of the 5.9.23 build measured 55
-`rc=0`, zero-byte answers and eight timeouts in 84 runs. The failures include
-`spring-audit`, `verify`, `risk`, Markdown `audit-report`, `migrate-check`, and
-`migrate-apply`; the prior 3/47 observation was materially incomplete. The
-cause remains unproven. A security-rules phase is a supported hypothesis, not a
-closure claim. `exit 0` is valid only for a non-empty stdout answer or a verified
-`--output` artifact; a missing phase result must be structured failure, never an
-empty finding set.
-
-Priority order is: `ALT-01` silent success and unkept output promises;
-`ALT-02` budget/partial-result failure; `ALT-03` security-rules phase bisection;
-`ALT-04` content-id instability; `ALT-05` contradictory migration totals;
-`ALT-06` false-complete selftest; then remediation, context bounds and CLI
-ergonomics. Full evidence: [`AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md`](AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md)
-and [`AUDIT-2026-09-01-EXTERNAL-5.9.23.md`](AUDIT-2026-09-01-EXTERNAL-5.9.23.md).
+## Current Synchronization — External Audit `5.9.26`, self-contradictory session (2026-09-02)
+
+**The 5.9.26 fix batch did not close the release gate, and new evidence
+narrows the failure to before the guard rather than inside it.** This audit
+round is internally contradictory and both halves are published rather than
+resolved: an initial 129-invocation pass replicating the exact 5.9.25
+methodology found zero empty answers (0/23) and scored 7.4/10; a second,
+larger pass in the same session found zero *successful* answers across 35
+further invocations of the same command family and revised the verdict to
+**3.8/10**, the lowest of four rounds. The auditor's own final position is the
+second number. Full evidence:
+[`AUDIT-2026-09-02-EXTERNAL-5.9.26.md`](AUDIT-2026-09-02-EXTERNAL-5.9.26.md).
+
+**New finding, most actionable in four rounds (`R-01`):** across 32 empty
+`exit 0` answers this session, stdout **and** stderr were both empty and no
+`empty_answer_diagnostics` sidecar file exists anywhere on the audited
+machine — the guard that is supposed to write one on every trip did not fire.
+This does not mean the guard added in 5.9.26 is miscalibrated; it means the
+failing runs are not reaching `main_entry`'s wrapper at all, which rules out
+"a caught exception inside command logic" as the mechanism and points instead
+at something that terminates the process before Python's own `try`/`except`
+around `app(prog_name="ask")` ever regains control — an external kill, a
+native crash, or an `os._exit()`-shaped exit somewhere in a dependency. A
+one-line "reached the guard" debug log at the top of `main_entry` would
+confirm this directly without needing native Windows to interpret.
+
+Other updates this round: `BUG-17` reconfirmed with a more precise repro
+(no path, a real path, and a nonexistent path are all byte-identical, not
+merely "an extra argument is now accepted"); `ALT-10`/`onboard` got worse (a
+cold run hit the external 200s kill entirely, worse than 5.9.25's 164.9s
+worst case); `ALT-11`/`watch` reconfirmed working, with a correction — the
+3,342-file audited repository's index warm takes 51.7s before the first
+NDJSON line, real and not a defect, but long enough to still read as hung
+without foreknowledge; and `ask --help` costs 3-4s even warm, which `REG-01`
+never claimed to fix (`REG-01` was specifically the 82-120s hang in a nested
+workspace, now resolved) but is worth its own row if it persists.
 
 | ID | Severity | Status | Evidence and required closure |
 |---|---:|---|---|
-| `ALT-01` | Critical maximum | **fixed, pending native-Windows repetition** | `a7ad44b` hardens the required-answer and output-artifact guards: `exit 0` now requires delivered stdout or a verified requested artifact. Native 30-run repetition remains the release closure evidence. |
+| `NEW-01`/`ALT-01`/`ALT-03` | Critical maximum | **open, contradictory session, worst round measured** | 0 of 35 invocations answered in the second pass of this session (vs. 0 of 23 *empty* in the first pass of the same session) — do not average the two into a rate; neither is regime evidence. First round where a single batch of identical `spring-audit . --compact` calls produced both failure shapes (a 200s hang, then a near-instant empty answer) with nothing changed between them. `R-01` above is the actionable lead. |
+| `R-01` | Critical maximum | **instrumented, not yet closed** | The `empty_answer_diagnostics` sidecar added for `ALT-01`/`ALT-03` did not fire in 32 observed empty answers this session — no file, no error envelope. `record_entry_reached` now appends one line to `entry-trace.jsonl` as the very first statement of `main_entry`, argv-gated to `REQUIRED_ANSWER_COMMANDS` so `--help` and other latency-sensitive commands are not charged for it. The next native occurrence answers directly whether the failing run reached this product's own entry point at all, rather than requiring inference from the absence of a failure record. This does not close the row — it is the instrumentation the row asked for, not a fix for whatever is upstream if the trace turns out empty too. |
+| `ALT-10` | Medium | **open, worse** | A cold `onboard .` hit the external 200s kill entirely this session (5.9.25's worst case answered at 164.9s); a second, untouched run answered in 83.5s — still ~120x the 681-780ms historical baseline. Shares `R-01`'s erratic shape, not a simple cold/warm split. |
+| `BUG-17` | Low | **fixed** | `remediation-report` still accepts any `path` value (5.9.24's deliberate CLI-consistency choice, kept — a caller that always passes a repository path needs no special case for the one command with none to say about it), but the payload now carries `path_argument: {given, used: false, note}` whenever one is given, in both JSON and Markdown, whether or not the path exists. `rows.pop("path_argument")` still equals the no-path payload exactly — nothing else changed. |
+| `ALT-09` | Critical | **fixed, reconfirmed** | A piped `n` answer to `ask cache clear .` aborts with `rc=1`, `"Aborted."` on stderr, cache untouched. |
+| `ALT-04` | High | **fixed, reconfirmed** | `impact-chain` gave the same `content_id` across 3 repeated runs again this session. |
+| `BUG-01` | Critical maximum | **fixed, reconfirmed with an independent fixture** | The auditor built their own unbalanced-paren file (not the shipped test fixture) and got the expected `reason: "unbalanced_parens"` gap. The documented residual class (a syntax error that disturbs neither braces nor parens) is unchanged and expected. |
+| `BUG-15` | Low | **fixed, reconfirmed** | 0 Rich-markup occurrences across 3 repeated non-TTY `--help` runs. |
+| `BUG-21` | Low | **fixed, reconfirmed** | `--jobs 0` and `--jobs 999` both rejected with the stated `1<=x<=128` range. |
+| `ALT-11` | Low | **fixed, reconfirmed with a measurement correction** | `watch` emits its `status: "watching"` line at 51.7s on the 3,342-file audited repository — real index-warm cost, not a defect, but long enough that a short observation window (the auditor's own first attempt, 8-20s) reads it as still broken. No further action required by this row; `ALT-10`/onboard shares the same warm-up path and is where the latency itself belongs. |
+
+The remaining rows below this section (`BUG-03`, `BUG-09` through `BUG-23`,
+`REG-02`, `REG-03`, `REG-04`, `NEW-02`) were reconfirmed unchanged this round
+or not relaunched for time budget; none regressed. Full detail in the audit
+document.
+
+## Current Synchronization — Alternative External Audit `5.9.25`, and External Audit `5.9.25` (2026-09-02)
+
+**Release `5.9.26` closes eight rows from this round with verified evidence**
+(`ALT-09`, `ALT-11`, `BUG-01`, `BUG-03`, `REG-02`'s disclosure half, `ALT-06`'s
+itemization half, plus the `remediation-report` path-admission coverage gap
+and the `ALT-01`/`ALT-03` forensic sidecar) — see each row below for the
+commit-level detail, and `CHANGELOG.md` for the release note. It does **not**
+close the release gate: `ALT-01`/`ALT-03` were investigated and instrumented,
+not fixed, because the failure did not reproduce outside native Windows.
+
+**Release gate unchanged and now more urgent: do not use 5.9.25 or 5.9.26 to
+gate unattended CI through the audit-command family.** Two independent re-audits of
+5.9.25 agree the empty-`exit 0` defect did not shrink. The multi-repository
+audit measured it at 18.4% (9/49, byte-counted) and, for the first time, in
+`spring-audit` itself — the command the tool's own help recommends first. The
+native-Windows audit found the same failure has gone from a hang to something
+**erratic**: the identical `migrate-apply .` invocation gave 8/8 empty answers
+in one batch and 3/3 full answers minutes later with nothing else changed, and
+the failure spread to `migrate-check` and `onboard`, both reliable in 5.9.23.
+`ALT-01` is **reopened**: the commit cited as closing it does not hold under
+native re-test — `risk . -o FILE` still returns `rc=0`, zero bytes, and no
+file in 4/4 runs.
+
+Three rows are genuinely closed with verified evidence this round: `ALT-04`
+(content-id clock exclusion, 3/3 stable hashes), `ALT-05` (findings-population
+reconciliation, exact arithmetic), and `REG-01` (root `ask --help` no longer
+hangs — sub-linear cost curve up to 4,772 files; the original 31-repo extreme
+case was not re-confirmed). `BUG-15` (Rich markup leak) and `BUG-21`
+(`--jobs` range validation) also close cleanly.
+
+Priority order is: `ALT-01` reopened silent success and unkept output
+promises; `ALT-03` security/audit-phase bisection, now with an erratic rather
+than hang-only signature; `ALT-09` (new) `cache clear` ignoring a piped `n`
+answer; `REG-02` agent memory ceiling; `BUG-01` silent malformed-file
+disappearance; then `ALT-07` remediate hang, `ALT-10`/`ALT-11` new latency and
+ergonomics findings, and remaining CLI ergonomics. Full evidence:
+[`AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md)
+and [`AUDIT-2026-09-02-EXTERNAL-5.9.25.md`](AUDIT-2026-09-02-EXTERNAL-5.9.25.md).
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `ALT-01` | Critical maximum | **reopened, contradicted by native re-test** | `risk . -o FILE` returned `rc=0`, 0 bytes, no file in 4/4 native runs. Source review of the guard (`_fail_on_missing_required_answer`, `_fail_on_unkept_output_promise`, armed for `risk`/`spring-audit`/`verify`/`audit-report`/`migrate-check`/`migrate-apply` via `REQUIRED_ANSWER_COMMANDS`) finds it correctly wired end to end on this platform; the field failure is not reproducible outside native Windows. Both guards now write a forensic sidecar (`empty_answer_diagnostics.record`, referenced as `diagnostics_path` in the error envelope) capturing phase/RSS/argv/pid at the exact moment either fires, so the next occurrence carries evidence instead of a report written from memory. This does not close the row — it makes the next native reproduction diagnosable. |
 | `ALT-02` | Critical maximum | **fixed, bounded-phase follow-up** | `aab1e8b` propagates deadline checks into security posture and publishes omitted stages and partial coverage. A small-repository budget can still finish its coarse earlier phases before the deadline is observed; `ALT-03` owns reducing that phase granularity. |
-| `ALT-03` | High | **open, investigation** | The security-rules phase is the common evidence-backed suspect: all affected audit flows consume security findings, security `retrieve` queries timed out, and `remediate` stalled in the same phase. Bisect the known working small subtree against the 3,342-file root; do not assert causality before reproducing it. |
-| `ALT-04` | High | **fixed** | `36e3893` excludes every nested `*_time_ms` execution clock from `content_id`; parametric tests retain semantic-field sensitivity. |
-| `ALT-05` | High | **fixed** | `b12c8f1` publishes `population_total` and `excluded_before_cap` beside the compact findings cap, reconciling it with the summary population. |
-| `ALT-06` | High | **fixed** | `6d0889e` publishes structured limitations for failed, unrun and unknown ledger rows; `5620864` also makes generic task `gaps` invalidate envelope completeness. |
+| `ALT-03` | High | **open, investigation, sharper signature** | Failures are now mostly near-instant (1-2s) empty success rather than multi-minute hangs on the same commands — consistent with a phase being *skipped*, not *stuck*. The audit could not isolate a trigger below three concurrent heavy ASK processes. Bisect the known working small subtree against the 3,342-file root; do not assert causality before reproducing it. The `ALT-01` diagnostic sidecar now records the last known phase and peak RSS at the moment of every occurrence, closing the evidence gap the audits both named. |
+| `ALT-04` | High | **fixed, confirmed** | `36e3893` excludes every nested `*_time_ms` execution clock from `content_id`. Re-confirmed: `impact-chain` gave the same hash across 3 repeated native runs (was 3 different hashes in 5.9.23). |
+| `ALT-05` | High | **fixed, confirmed** | `b12c8f1` publishes `population_total` and `excluded_before_cap` beside the compact findings cap. Re-confirmed with exact arithmetic: `1526 - 593 = 933 = by_rule.MIG-016`. |
+| `ALT-06` | High | **fixed** | `complete` is correctly `false` when rows fail. The itemization half is also closed: `answer_bounds._summarise` picked a dict's `id` before its `reason`/`what`, so `selftest`'s per-category `limitations` entries rendered as the bare slug (`selftest_rows_failed`) with the actual failing row IDs dropped even though `reason` and the new `rows` field named them. `_summarise` now prefers the descriptive text; no other producer in this codebase pairs `id` with `what`/`reason` on the same dict, so nothing else changes. |
 | `ALT-07` | Medium | **open** | `remediate` regressed from a 23.6-second answer to hangs beyond 400 seconds in `auditing for repairable findings`; it shares the `ALT-03` investigation until separated by evidence. |
-| `ALT-08` | Medium | **fixed** | `15d77d2` publishes the effective per-task stdout budget and the full-artifact path; bounded output remains skipped only for explicit `--output` artifacts. |
-| `NEW-01` | Critical maximum | **superseded by ALT-01** | The earlier 3/47 `risk` and Markdown `audit-report` observation undercounted the native-Windows audit-family failure. |
-| `REG-02` | Critical | **open, regression** | The 1,536 MB default `--agent` ceiling rejects valid large repositories only after spending minutes; it is not published in successful default-agent metadata. Bound projection during construction, sample RSS periodically, and publish the effective ceiling. |
-| `REG-03` | High | **open, regression** | Warm `spring-audit` was measured 2.1–3.8x slower despite a fully reused CIR. Attribute the warm pass before claiming cache benefit. |
-| `REG-01` | High | **open, regression** | Root `ask --help` took 83–86 seconds in a workspace with nested repositories. Help must not perform unbounded repository/profile analysis. |
-| `REG-04` | Medium | **closed 5.9.24** | `_meta.answer_bounds.capped` now aggregates nested cap contracts, so compact answers disclose rows omitted below nested payloads. Regression coverage includes nested dictionaries and lists. |
-| `NEW-02` | High | **open** | Overloaded endpoint handlers can all inherit the final overload's `declaration_line`. Resolve by mapping annotation/signature or publish ambiguity. |
-| `BUG-01` | Critical maximum | **open, P0** | A malformed Java file can disappear without a file-specific declaration. Publish parse failure/recovery in the answer bounds and preserve any affected endpoint gap. |
+| `ALT-08` | Medium | **fixed, confirmed** | `15d77d2` publishes the effective per-task stdout budget and the full-artifact path; confirmed functioning, with a minor arithmetic mismatch in `prepare-context review-pr`'s `_truncation_summary` noted as low-severity follow-up. |
+| `ALT-09` | Critical | **open, new** | `ask cache clear .` deletes cache entries even when piped stdin answers `n`; only true EOF (`< /dev/null`) correctly refuses. The non-interactivity detector appears to treat "stdin has bytes" as "proceed" instead of reading and comparing them against `y`/`yes`. Low blast radius today (cache is rebuildable); fix the detection to use `isatty()` plus an actual answer comparison before any future destructive command reuses the same pattern. |
+| `ALT-10` | Medium | **open, new** | `onboard .` took 164.9s cold in one native session versus a consistent 681-780ms in every prior round on the same repository (~240x). Delivered a full answer, so not release-blocking alone; profile for a shared warm-up path with the `ALT-01`/`ALT-03` commands. |
+| `ALT-11` | Low | **fixed** | `watch` now emits a `{"tick": 0, "status": "watching", "elapsed_ms": …}` NDJSON line on stdout immediately after the index warms and before the tick loop begins — the channel `watch` already promises a consumer is reading, unlike stderr, whose silence on a non-TTY stream is a deliberate, tested invariant elsewhere in the CLI. Written to `--output` too. |
+| `NEW-01` | Critical maximum | **escalated** | Now measured at 18.4% (9/49, byte-counted) and reaches `spring-audit --compact` in addition to `risk` and Markdown `audit-report`. Two identical back-to-back `spring-audit thingsboard --compact` runs (46,596 bytes/69.7s, then 0 bytes/57.2s) refute the earlier "only on abnormally fast runs" hypothesis. `BUG-17` (`remediation-report` silently empty on an unexpected positional, rather than `INVALID_USAGE`) does not reproduce as described here: the command returns its normal, non-empty bundled-ledger report regardless of the path given, by design (`del path` — "the bundled ledger is used"), so it is not the same failure class as `NEW-01`. What is real and now fixed is narrower: `path_admission`'s own coverage battery had a gap for exactly this command — `remediation-report`'s `path` parameter matched the battery's repo-path discovery heuristic with no invocation row, a pre-existing red independent of this audit. Closed by documenting the exclusion inline (`PATH_NOT_READ_BY_DESIGN` in `tests/test_path_admission.py`), the same "opt-out is a decision, not an omission" convention `cli.py` already uses for `--copy`/`Progress`. |
+| `REG-02` | Critical | **partially fixed: disclosure half closed, enforcement-timing half open** | Reproduced and fixed the specific gap named in both audits: a successful `--agent` run published `_meta.memory.configured_max_rss_mb: null` even though `_root_memory_seam` was actively enforcing the 1,536 MB default at every phase boundary for that same run. `disclosure()` now takes the same `default_ceiling_mb` `exceeded()` already did, and the root command threads whether `--agent` is active through a per-invocation flag (`_AGENT_MODE_ACTIVE`) so a successful run says what protected it. The still-open half — the ceiling rejecting large repositories only after minutes of work, and a higher observed peak than 5.9.23 (2,029.92 MB vs 1,552.45 MB) — needs periodic RSS sampling with early abort inside the expensive phases themselves (`BUG-22`'s row), which cannot be validated without the field's own large repository. |
+| `REG-03` | High | **open, regression, unchanged** | Warm `spring-audit` still shows no reliable time or reliability benefit over cold; the `NEW-01` back-to-back pair is itself the sharpest evidence, since the "warm" run was proportionally slower and the one that came back empty. |
+| `REG-01` | High | **closed, resolved on measured range** | Root `ask --help` no longer hangs in a nested-repository workspace: cost now scales sub-linearly (49 files: 608ms; 4,772 files: 13.6s), against 82-86s trending to 120s+/`rc=124` in 5.9.23. The original 31-repo/8,322-file extreme case was not re-confirmed — the audit's own 110s harness cutoff interrupted it. Re-run that specific extreme case before treating the ceiling as proven. |
+| `REG-04` | Medium | **closed 5.9.24, reconfirmed** | `_meta.answer_bounds.capped` aggregation re-verified in `migrate-check --compact`: all 5 nested cap contracts listed, 268 omitted values disclosed. |
+| `NEW-02` | High | **open, unchanged** | Overloaded endpoint handlers can all inherit the final overload's `declaration_line`; the `anchor_ambiguity`/`overload_count` fields expected from this row are still absent from the payload. Resolve by mapping annotation/signature or publish ambiguity. |
+| `BUG-01` | Critical maximum | **fixed, mechanism narrowed, not eliminated** | Reproduced directly: a missing `;` or a missing `)` on a method signature both extract a clean class+method symbol pair with balanced braces, so the E-10 brace-only check (`unbalanced_braces`) never fired and the file passed as clean. `repository_ir.py` now also masks and checks paren balance (`unbalanced_parens`), publishing the same `parse_structure` gap for that shape. This is a heuristic extractor without a real Java grammar, so a syntax error that disturbs neither braces nor parens (for example a missing operand with balanced punctuation on both sides) remains undetectable by construction — the row stays open at lower severity for that residual class, not closed. |
 | `BUG-02` | Critical maximum | **open, P0** | Large `risk` ended `rc=127` with no output or structured failure. Add fail-fast resource/process handling and durable partial checkpoints. |
 | `BUG-12` | Critical maximum | **open, P0** | Deep `--agent` output construction reaches multi-gigabyte RSS before a small answer. Bound projection while building. |
-| `BUG-03` | High | **open, P1** | Marginal Spring detection can overstate what a zero-finding result covers. Publish Spring footprint/coverage with the stack-fit claim. |
+| `BUG-03` | High | **fixed** | `non_coverage.stack_fit`'s marginal-detection disclosure (`fit: "partial"`, below 10% Spring-bean density) has existed since AUD-596-D13 but was unreachable from `risk` and `posture`: neither call site passed `spring_footprint`, so `java_files` stayed 0 and the branch that reads it could never fire regardless of the real ratio. Both now compute it the same way `spring-audit`'s own call already did (`sum(bean.spring for bean in graph.beans.values())` over `len(cir.files)`); verified end to end on a 1-bean/16-file fixture. The 5.9.26 re-audit's own index table still lists this row `abierto` for both 5.9.25 and 5.9.26 without naming which command was tested or a repro that contradicts the fixture above; the fix stands on the passing regression tests until a command-specific repro says otherwise. |
 | `BUG-04` | High | **open, P1** | `selftest` publishes `complete=true` with five error rows. Derive bounds from actual results. |
 | `BUG-05` | High | **open, P1** | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
 | `BUG-07` | Closed 5.9.23, verification gap | Compact JVM inventory is bounded, but the audit notes no selftest row protects the correction. Add release-battery coverage before treating it as durable closure. |
-| `BUG-10` | High | **open, P1** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
-| `BUG-11` | High | **open, P1** | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
-| `BUG-13` | High | **open, P1** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
-| `BUG-16` | High | **open, P1** | Context-cache growth has no published budget or eviction contract; about 1.5 GB was measured. |
+| `BUG-10` | High | **open, P1, unchanged** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
+| `BUG-11` | High | **open, P1, now hangs instead of failing fast** | Default `pack assessment` and `pack gate --since` now hang to their external kill (300s/200s) instead of the legitimate `INVALID_INPUT`/`INVALID_USAGE` they gave in 5.9.23 — both compose the audit-family commands affected by `ALT-01`/`ALT-03` and inherit the failure. |
+| `BUG-13` | High | **open, P1, unchanged** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
+| `BUG-15` | Low | **closed 5.9.25** | Non-TTY `ask --help` no longer emits Rich markup: 0 occurrences of `[bold]`/`[dim]`/`[bold green]`, down from 208 (5.9.22) and 202 (5.9.23). |
+| `BUG-16` | High | **open, P1, unchanged** | Context-cache growth has no published budget or eviction contract; ~1.7 GB was measured (was ~1.6 GB in 5.9.23). |
+| `BUG-21` | Low | **closed 5.9.25** | `--jobs` now rejects out-of-range values with `INVALID_USAGE` stating the `1<=x<=128` bound, replacing silent acceptance. |
 | `BUG-22` | High | **open, P1** | RSS ceilings are checked post-hoc. Add periodic sampling and orderly abort. |
 
-The remaining `BUG-04b`, `BUG-06`, `BUG-08`, `BUG-09`, `BUG-15`, `BUG-19`,
-`BUG-20`, `BUG-21` and `BUG-23` findings are open P2/coverage follow-ups in
-the audit document. None is closed by documentation alone.
+The remaining `BUG-04b`, `BUG-06`, `BUG-08`, `BUG-09`, `BUG-19`, `BUG-20` and
+`BUG-23` findings are open P2/coverage follow-ups in the audit document. None
+is closed by documentation alone.
 
 ## Current Synchronization — External Audit `AUD-621`