sourcecode 5.9.27__tar.gz → 5.9.29__tar.gz

{sourcecode-5.9.27 → sourcecode-5.9.29}/CHANGELOG.md

@@ -1,5 +1,158 @@
 # Changelog
 
+## [5.9.29] — 2026-09-02
+
+*The 5.9.28 field round's two P0s and its P1, plus the suite's first green run
+in several releases. Where 5.9.28 answered a question about the worker pool,
+this release answers the one about where a run stops when it stops.*
+
+### Added
+
+- **An in-flight marker for runs that never finish (`R-01-INFLIGHT`).** The
+  field measured four `spring-audit` hangs and could say nothing about any of
+  them: every diagnostic this product had — the envelope, the forensic sidecar
+  — lives on a path a hung run never reaches. A marker is now written when a
+  hang-prone command starts, rewritten at each phase and stage change the
+  heartbeat already reports, and deleted on the way out. A run killed
+  externally leaves `inflight/<pid>.json` naming its argv, its start time, the
+  phase and the stage it stopped in. Abandoned markers are published by a
+  later run in `_meta.incomplete_runs`, because the run that stops cannot
+  report anything itself; each row states whether it is a measurement (the
+  process is gone) or an inference (no refresh, on a platform that cannot
+  probe liveness safely). Covers the audit family plus `onboard` and
+  `remediate`, the two commands the field reports hanging outside it.
+  `ASK_NO_INFLIGHT_MARKER=1` disables it.
+- **`timings.rule_families`** — wall time per rule family, highest first, with
+  a basis stating that it ranks cost and not complexity. The phase split could
+  say `security_rules: 12,617 ms` and never which of six families spent it.
+
+### Fixed
+
+- **The most expensive rule family is between 3 and 24 times faster, with a
+  byte-identical answer (P1).** `SEC-010` was 85 % of the rule phase and 35 %
+  of a whole audit; profiling found the walk under it re-reading every
+  remaining source, from disk, once per callee name it resolved — 96,399 reads
+  for 28 lookups. It indexes declarable names in the pass that already reads
+  each file once. Measured warm: `SEC-010` 10,830 → 3,246 ms on a 3,860-file
+  repository (audit 15.5 → 12.2 s) and 64,391 → 2,628 ms on an 878-file one
+  (audit 71.1 → 8.4 s), unchanged where a repository has no HTTP-input seeds.
+  `content_id` identical on all three.
+- **That family reports while it runs, and a deadline can stop it inside.** It
+  owned the longest stretch of an audit and left one heartbeat line unchanged
+  for the whole of it, which from outside is what the field calls a hang. A
+  budget cut returns what it measured instead of surfacing as an analysis
+  error.
+- **`manifest_cache` keyed its entries on a list that omitted every
+  lockfile.** Two repositories with identical manifests and different resolved
+  dependencies hashed the same, and the second was served the first's answer.
+  The key now reads the analyzer's own `INPUT_FILENAMES`, and a battery reads
+  that module's source and fails if it opens a file the set does not name.
+- **`SpringAuditResult.merge()` dropped `spring_footprint`**, which switched
+  BUG-03's marginal-detection disclosure back off on every `--scope all` run —
+  the default.
+- Machine-census leases are refreshed while a run is alive, so a killed run no
+  longer makes every later run on that machine halve its worker pool for an
+  hour; the lease directory is capped.
+
+### Changed
+
+- The suite is green: 13,748 tests, 0 failures. It had carried twenty-one
+  standing reds for several releases, which is how a real regression becomes
+  indistinguishable from the background. Two were the product defects above;
+  the rest were assertions that had fallen behind the code they pin, each
+  fixed or opted out with the reason stated.
+
+### Known Limitations
+
+- `ALT-01`/`ALT-03` remain open. The bisection the field asked for ran over two
+  corpora — 250 to 4,772 files on one, 9,195 on another — and found no size at
+  which `spring-audit` stops answering: 5.8 s to 39.6 s, sublinear, `rc=0`
+  throughout. File count alone is exonerated on this platform at up to 2.75x
+  the field repository's size. This release makes the stretch the failing runs
+  sat in several times shorter and, for the first time, visible while it
+  happens; it does not claim to have fixed the hang.
+- The next field round should send `inflight/` and `entry-trace.jsonl`
+  together after a hang. A marker still stuck in `SEC-010` says the family is
+  not the cause; a marker in another stage moves the search there; no marker
+  at all keeps it upstream of `main_entry`.
+- `BUG-02` and `BUG-12` still need the field's own large repository.
+
+## [5.9.28] — 2026-09-02
+
+*Remediation batch on the 5.9.27 audit queue: nine rows, one commit each. The
+round's own P0 — "does the shared worker pool tolerate concurrent `ask`
+processes on one machine, or assume exclusive use?" — is answered here in
+source, and the answer was exclusive use.*
+
+### Fixed
+
+- **Concurrent invocations no longer size their worker pools as if each owned
+  the machine (`R-01`).** `parallel.default_jobs()` returned `cpu_count() - 1`
+  per process, so `k` concurrent runs started `k x (N-1)` parsing workers on
+  `N` cores and nothing in any payload said the machine had been shared. A
+  best-effort census of live invocations now divides that budget, and
+  `_meta.concurrency` publishes peers at start, whether the budget was shared,
+  and that a shared run is not an isolated-machine measurement. `cache._gc`
+  defers eviction while a peer is live, so a sweep cannot delete the working
+  set a concurrent run is reading. `ASK_NO_CONCURRENCY_CENSUS=1` restores the
+  previous behaviour.
+- **The RSS ceiling stops a run where it is crossed (`BUG-22`, `REG-02`'s
+  enforcement half).** The check ran at phase boundaries only, so a phase
+  could allocate without bound and be refused after it finished — the field's
+  2,029.92 MB peak under a 1,536 MB ceiling that was genuinely in force. The
+  ceiling is now sampled inside the parse loop (throttled to one footprint
+  sample per 0.5 s) and raises a typed refusal rendered as the same
+  `MEMORY_TOO_LARGE` envelope, instead of `EXECUTION_FAILED`.
+- **A routing style this model does not read is published rather than reported
+  as an absent surface (`BUG-10`).** `unmodeled_routing_evidence` names the
+  files declaring an annotation whose argument is a path-like string literal
+  that produced no endpoint — a rule that names no framework. Measured:
+  `struts` reports 4 files under `@Action`/`@Namespace` where the answer used
+  to say nothing was found.
+- **Overloaded handlers publish their ambiguity (`NEW-02`/`BUG-05`).** The
+  symbol index is keyed `Class#method` without parameter types, so every
+  overload collapsed onto the last declaration scanned. Entries now carry
+  `overload_count`, `anchor_ambiguity` and `anchor_candidate_lines`; an
+  unambiguous anchor carries none of it.
+- **`selftest` refuses an unscoped run over nested repositories (`BUG-13`).**
+  It warned and then ran the ledger against the whole workspace. The implicit
+  `.` now refuses with `INVALID_USAGE` before any row runs; `--allow-nested`
+  is there for a caller who means it.
+- **Every cache store publishes what evicts it (`BUG-16`).** The context
+  cache's 30-day TTL and 256-entry cap lived inside `_gc`, so ~1.7 GB of
+  growth had no readable contract. `cache status` now prints each store's
+  eviction contract, read from the same authority the sweep uses.
+- **`_truncation_summary` accounts for its own bytes (`ALT-08`).**
+  `final_size_bytes` was measured before the summary and note were attached;
+  it is now measured over the assembled payload, with `content_size_bytes`
+  keeping the trimmed-content figure under a name that says which it is.
+- **`impact-chain` publishes a null audit share when no audit ran
+  (`ALT-25`).** `metadata.audit_time_ms` was always ~0.0 on the default path —
+  the elapsed time of *not* running an opt-in repository-wide audit, under a
+  name readers compare against `query_time_ms`.
+- **`retrieve security-surface --target` says why it has no anchor.** Four
+  rounds were answered "No such option: --target". The refusal now states that
+  the intent is repository-wide and names `security-chain --target`, derived
+  from `intent_router.ANCHOR_KINDS`.
+
+### Known Limitations
+
+- `ALT-01`/`ALT-03` remain open. This release removes the contention mechanism
+  the 5.9.27 round evidenced; it does not explain the one hang observed with
+  nothing else running. The next field round should re-measure with
+  `_meta.concurrency` attached — `peer_invocations_at_start: 0` beside a
+  failure separates contention from whatever remains.
+- `BUG-02` (`rc=127` with no output) and `BUG-12` (multi-gigabyte RSS while
+  building a small answer) still need the field's own large repository.
+  `BUG-22`'s in-phase sampler bounds the second one's damage without closing
+  it.
+- `ask --help` measures 0.41-0.44 s on the engineering host against
+  14.4-14.7 s in the field under confirmed contention. Not a refutation — a
+  different machine — and a reason to re-measure before profiling it as a
+  standalone defect.
+- The release gate is unchanged: do not use the audit-command family to gate
+  unattended CI until the field re-measures.
+
 ## [5.9.27] — 2026-09-02
 
 *Follow-up from the 5.9.26 re-audit — a sharper instrumentation lead and a

{sourcecode-5.9.27 → sourcecode-5.9.29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.27
+Version: 5.9.29
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.27-blue)
+![Version](https://img.shields.io/badge/version-5.9.29-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -290,7 +290,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.27 — and, on a build that has aged,
+ask version                    # ask 5.9.29 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.27 → sourcecode-5.9.29}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.27-blue)
+![Version](https://img.shields.io/badge/version-5.9.29-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -241,7 +241,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.27 — and, on a build that has aged,
+ask version                    # ask 5.9.29 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.27 → sourcecode-5.9.29}/docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md

@@ -12,7 +12,7 @@ a regression assertion exist.
 
 ## Executive Result
 
-The audit rates ASK Engine **6.6/10** on the large MSAS corpus and **7.5/10** on
+The audit rates ASK Engine **6.6/10** on the large native-Windows corpus and **7.5/10** on
 the smaller nine-axis assessment. The measurements agree on the main risk:
 source analysis is accurate and unusually explicit about uncertainty, but large
 repository execution and several output contracts are not yet reliable enough
@@ -52,7 +52,7 @@ SQL-injection recall, memory, and inconsistent CLI contracts.
 ## Performance Evidence
 
 The audit measured `--agent` on ThingsBoard at **182.6 s / 2,088 MB RSS** and
-`spring-audit` at **164.2 s cold**. On the larger MSAS corpus it reports
+`spring-audit` at **164.2 s cold**. On the larger native-Windows corpus it reports
 `ask . --agent` at **447 s**, `contract-diff` at **329 s**, `delta` at **187 s**,
 and `validation --compact` at **91 s**. Warm root compact analysis can be below
 one second; these are cold/deep-path costs.

sourcecode-5.9.29/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.27.md

@@ -0,0 +1,102 @@
+# Alternative External Audit - 5.9.27
+
+## Scope And Verdict
+
+Native-Windows re-audit on the same audited repository (3,342 Java files) used
+in every prior round. Score **4.6/10**, the first uptick in four rounds (5.9.22
+6.6, 5.9.23 4.9, 5.9.25 4.3, 5.9.26 3.8). The uptick carries a large
+qualification discovered mid-session: this audit's own machine was shared
+with a second, independent automated process, and that materially changes
+how the four-round erratic-failure pattern should be read.
+
+## Priority Finding — Confirmed Shared-Machine Contention
+
+The auditor found the shared `entry-trace.jsonl` diagnostic file (added in
+5.9.27 to answer whether audit-family commands reach `main_entry`) growing
+with invocations they never launched, against five OSS reference
+repositories (`thingsboard`, `mall`, `struts`, `spring-petclinic`,
+`jhipster-sample-app`) under the same `timeout N ask ...` harness pattern the
+auditor uses. `Get-CimInstance Win32_Process` confirmed a live process under
+the same Windows user actively running `ask.exe risk mall --limit 20` at the
+time of inspection — not background noise, a second real test harness on the
+same machine, same user, same shared `~/.sourcecode` cache and diagnostics
+directory. Two of the auditor's own `spring-audit . --compact` hangs
+overlapped a 525-second window in which 34 foreign invocations were traced.
+
+This reframes, but does not resolve, the standing question. If ASK's shared
+worker pool and cache do not isolate concurrent `ask` processes on one
+machine, contention could produce exactly the observed pattern — the same
+command sometimes hanging, sometimes returning empty near-instantly, with no
+per-process variable distinguishing the two. It does not explain everything
+(one hang occurred right after the trace went quiet for 20 seconds with
+nothing else running), so contention is documented as a real, evidenced
+contributing factor, not a proven sole cause.
+
+## Integrity Note
+
+This round's ledger entry for 5.9.26 described a two-pass, self-contradictory
+session ("an initial 129-invocation pass ... 0/23 ... 7.4/10, then a second
+pass ... 0/35 ... 3.8/10"). This auditor states plainly that the first pass
+and its 7.4/10 score do not correspond to anything they ran or reported. Given
+the newly confirmed shared-machine contention, the likely explanation is that
+5.9.26's report mixed observations from two concurrent, independent audit
+sessions on the same machine (the native-Windows lineage and a
+multi-repository "testing/" corpus lineage matching the five OSS repos found
+in the trace this round) rather than one evaluator's two passes. Recorded as
+an open provenance question, not resolved either way — see
+[`DEFECT-LEDGER.md`](DEFECT-LEDGER.md) for how this changes the 5.9.26 record.
+
+## Priority Regressions
+
+None newly introduced. The audit-command family remains the standing issue:
+`spring-audit`, `verify`, `risk`, `audit-report` stayed at 0 successful
+answers in this session's isolated (non-overlapping) invocations;
+`migrate-check` and `migrate-apply` each answered once, both immediately
+after the foreign trace activity appeared to quiet down — noted as a
+correlation worth cross-referencing against `entry-trace.jsonl`, not asserted
+as causal.
+
+## Verified Improvements
+
+- **The entry-point trace (5.9.27's response to last round's `R-01`) works as
+  designed**: the auditor's own invocations — `verify .`, `migrate-apply .`,
+  `risk . --limit 20`, `audit-report . --format markdown`, `risk . -o
+  promise.json` — now appear in `entry-trace.jsonl` even when they return
+  empty or hang. This confirms `main_entry` is reached on the failing runs,
+  closing the question the previous round's diagnostic gap left open. The
+  `empty_answer_diagnostics.record()` sidecar still never fires on any
+  observed failure, which narrows the search specifically to somewhere
+  between `main_entry` and the output-promise guard — a materially smaller
+  surface than "somewhere in the process" three rounds ago.
+- `selftest`'s itemized gaps (last round's fix) confirmed: `"10 ledger row(s)
+  could not run: ASK-16, B6, E-37, ..."` replaces the prior generic slug.
+- `ALT-09` (piped refusal on `cache clear`) reconfirmed a third consecutive
+  session.
+- `BUG-15`/`BUG-21` (markup leak, `--jobs` range) reconfirmed.
+- `migrate-check`/`migrate-apply` produced complete, reasonably sized
+  payloads (37.5 KB/41s and 9.5 KB/46s) on the runs that did answer.
+
+## Open, Unchanged
+
+- `onboard .` remains the single most erratic measurement across rounds:
+  904ms to a full 200-second external kill within the same session, same
+  invocation, same tree, no changes between runs.
+- `ask --help` measured 14.4-14.7s this session, worse than the 3-4s the
+  5.9.26 ledger entry flagged as worth its own row "if it persists" — it has
+  persisted across two rounds now. May share `R-01`'s contention signature;
+  not verified in isolation this session.
+- `watch`'s ~55s index-warm-before-first-tick is unchanged and correctly
+  understood as real cost, not a defect, per the prior round's correction.
+- `retrieve security-surface --target` still rejects `--target` as an unknown
+  option, unchanged across four rounds.
+
+## Verification Boundary
+
+Session ran on a machine independently confirmed to be shared with a second,
+concurrent `ask` test harness during at least part of the observation window.
+Reliability figures in this round should be read as measured under
+uncontrolled, real contention, not as an isolated single-process baseline.
+The auditor's own recommendation: repeat `spring-audit . --compact` x3 on
+both a reference repo and the audited repository in the same clean window, nothing else
+running, to separate "the repository" from "the shared machine" as the
+variable.

sourcecode-5.9.29/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md

@@ -0,0 +1,174 @@
+# Alternative External Audit - 5.9.28
+
+*The audited repository is referred to neutrally throughout (3,342 Java files,
+`repo_id 7fced5c877cacfc5`, dirty working tree) — it is the same subject as
+every prior round in this lineage.*
+
+## Scope And Verdict
+
+Native-Windows re-audit, sixth round in this lineage. Score **6.2/10** (5.9.22
+6.6, 5.9.23 4.9, 5.9.25 4.3, 5.9.26 3.8, 5.9.27 4.6, 5.9.28 6.2) — the first
+substantial rise in five versions, and the first with a root cause identified
+in code rather than a symptom patched. **No regression against 5.9.27 was
+found.** Windows 11 Pro 10.0.26200, Python 3.10.0, pipx, `ask.EXE`, build
+`adbbf9ca7652e2ad2dfdb2db911c12e1793dded5`.
+
+| Axis | 5.9.27 | 5.9.28 | Basis |
+|---|---:|---:|---|
+| Analysis accuracy | 9.0 | 9.5 | Overload anchoring exact and cross-checked against the real source |
+| Honesty of figures | 9.0 | 9.3 | `audit_time_ms` null instead of a false `0.0`; every cache store publishes its eviction contract |
+| Diagnostic instrumentation | partial progress | real step, known limit | `_meta.concurrency` is precise and actionable — and absent from exactly the runs that fail |
+| CLI ergonomics | 6.5 | 7.5 | Nested-workspace `selftest` refusal; `retrieve --target` explains and redirects |
+| Audit-family reliability | 2/12 | 2/8, cause bounded | `migrate-check`/`migrate-apply` clean; `spring-audit` 0/4, `verify` 0/1, `risk` 0/1, `audit-report` 0/1 |
+| Light-path performance | 6.5 | 6.5 | `impact-chain` 11.3 s, `review-pr` 29.4 s — within range under residual contention |
+
+## Priority Finding — The Hang Reproduces With Contention Ruled Down
+
+The most important measurement of this round. The auditor isolated the
+contention variable to its lowest observable level across six sessions, and
+the failure persisted at 100%:
+
+1. `entry-trace.jsonl` was monitored for 120 s with nothing launched, waiting
+   for a quiet window.
+2. 100 s of total calm confirmed — no new lines.
+3. `timeout -k 5 150 ask spring-audit . --compact` launched into that window.
+4. Result: `rc=124`, 150,176 ms, **0 bytes of stdout**.
+5. The trace grew by two lines over the whole 150 s window: the auditor's own
+   invocation, and one light foreign invocation (`risk thingsboard --limit
+   20`) — against the *dozens* of concurrent foreign invocations measured in
+   the 5.9.27 session.
+
+Session total: **4/4 hangs** of `spring-audit . --compact`, the last of them
+under the lowest contention load obtainable in six audits.
+
+The 5.9.28 release note states: *"one hang was observed with nothing else
+running, and that is unexplained."* This round supplies four repetitions of
+that case rather than one, which turns "unexplained" into "unexplained and
+reproducible" — a better-defined problem, still unsolved. Contention is a
+real, now precisely measured factor; it is **not the sole cause**. Something
+specific to this repository still breaks `spring-audit` on a near-idle
+machine.
+
+The auditor's recommendation: profile the `applying all rules over 3342 Java
+files` phase (the one the stderr heartbeat names) against a growing subset of
+the repository — 250, 500, 1,000, 2,000, 3,342 files — to find where the
+behaviour changes from "answers" to "hangs indefinitely". If the command
+exhausts memory or time deterministically on some code pattern in this tree,
+contention would be worsening a failure that already exists in isolation
+rather than causing one.
+
+## Instrumentation Gap — The Blind Spot `_meta.concurrency` Cannot Cover
+
+`_meta.concurrency` is described as the best instrumentation to appear in six
+sessions. On a successful `endpoints --output` run it read
+`{"peer_invocations_at_start": 17, "worker_budget_shared": true, "jobs": 1,
+"jobs_unshared": 4}` — exact, actionable, and enough for any consumer to tell
+a contaminated timing from an isolated one without doing process archaeology.
+
+It never appears on a hung or empty run: stderr across the four `spring-audit`
+hangs contains zero mentions of `concurrency`, because those processes die
+before assembling any payload. This is the same blind spot `R-01` identified
+in the 5.9.26 round (the process does not reach the output guard); what has
+changed is that we now know it *would* publish something useful if it got
+there.
+
+Concrete suggestion from the auditor: write an in-flight marker
+(`inflight/<pid>.json` carrying `{argv, started_at, last_phase}`, updated at
+each phase change the heartbeat already reports) when an audit-family command
+starts, and delete it on completion. A process that hangs or dies leaves that
+file orphaned — which is precisely the forensic evidence the next field
+session needs, without depending on an external observer correlating
+timestamps in a trace file shared with an unknown number of other processes.
+
+## Measured Reliability — Six Versions, Same Invocation, Same Repository
+
+| Invocation | 5.9.23 | 5.9.25 | 5.9.26 | 5.9.27 | 5.9.28 |
+|---|---:|---:|---:|---:|---|
+| `spring-audit . --compact` | 0/24 | 0/18 | 0/8 | 0/5 | 0/4 (3 under verified-minimal contention) |
+| `verify .` | 0/24 | 0/18 | 0/5 | 0/1 | 0/1 |
+| `migrate-check . --compact` | 7/12 | 4/26 | 0/5 | 1/1 | 1/1 ✓ |
+| `migrate-apply .` | 14/24 | 0/26 | 0/5 | 1/1 | 1/1 ✓ |
+| `risk . --limit 20` | 0/13 | 0/7 | 0/4 | 0/1 | 0/1 |
+| `audit-report . --format markdown` | 0/7 | 0/7 | 0/4 | 0/1 | 0/1 |
+
+`migrate-check` and `migrate-apply` have now answered reliably in two
+consecutive sessions (38–39 s, correct payloads) — a trend rather than luck.
+The other four remain at zero.
+
+## Verified Fixes — Checked With The Auditor's Own Data
+
+- **`NEW-02`/`BUG-05` (overload anchoring) — closed, cross-checked against the
+  real source.** `ask endpoints . --output`: the four endpoints of one
+  overloaded handler pair now publish `anchor_ambiguity: true`,
+  `overload_count: 2`, `anchor_candidate_lines: [134, 145]`, and those two
+  line numbers match the two real annotations the auditor had verified by hand
+  three sessions earlier. First defect tracked since the 5.9.22 round that is
+  genuinely resolved rather than "not reproduced this time".
+- **`BUG-13` (nested-workspace `selftest`) — closed, verified against a
+  purpose-built fixture.** The auditor built a workspace holding two real
+  nested Git repositories: refusal in **373 ms**, `{"code": "INVALID_USAGE",
+  ..., "nested_repositories": 2}`, with `--allow-nested` documented. Against
+  1/12 rows passing in 120 s before.
+- **`BUG-16` (cache eviction contract) — closed.** `ask cache status` now
+  prints, per store, when and how entries are evicted — information absent for
+  four versions.
+- **`ALT-25` (`impact-chain.audit_time_ms`) — closed.** `null` with
+  `findings_status: "not_computed"` and the rule stated, replacing the
+  misleading `0.0`.
+- **`retrieve security-surface --target` — closed, high quality.** The refusal
+  now says the intent is repository-wide and names
+  `ask retrieve security-chain --target <symbol>`, after four sessions of
+  "No such option: --target".
+- **`R-01`'s mechanism — confirmed real and quantified** (see above), with the
+  reservation that the disclosure cannot reach the failing runs.
+
+## Not Verified This Round
+
+- **`ALT-08` — the auditor ran the wrong command and says so.**
+  `ask review-pr . --files -` (119,979 bytes, above the declared 100,000-byte
+  ceiling) carries no `_truncation_summary` at all: that field belongs to
+  `ask prepare-context review-pr`, a different command sharing the task name.
+  Neither claimed nor refuted; pending a repeat with the correct command.
+- `BUG-22`/`REG-02` (`--agent` not relaunched), `BUG-10` (needs a repository
+  with the routing styles it detects, absent here), `ALT-07`, `ALT-10`,
+  `BUG-02`, `BUG-12`, `BUG-09`, `BUG-23`: not relaunched for time budget, no
+  regression signal against any of them.
+- `ask --help`: 12.3 s cold, 2.9 s on immediate repetition. Still high on the
+  audit machine, consistent with residual contention rather than a defect in
+  the command.
+
+## Verified And Defect-Free In 5.9.28
+
+`endpoints` (3,763, exact), `impact-chain` (37,445 bytes), `posture`,
+`verify-edit`, `explain`, `impact`, `drift`, `trend`, `chunk-file`, `intent`,
+`pr-risk`, `review-pr` (119,979 bytes, coherent), `migrate-check` (38,081
+bytes), `migrate-apply` (10,142 bytes), `selftest` with an explicit path
+(`rc=75`, 9,910 bytes) and with nesting detection (`rc=2`). `--jobs`
+out-of-range rejection confirmed for the sixth consecutive session.
+
+## Commercial Position
+
+The reliable subset grew for real this round — `migrate-check`,
+`migrate-apply`, `endpoints`, `posture`, `impact-chain`, `pr-risk`,
+`review-pr`, `selftest` with an explicit path, now with correct overload
+anchors — and is valued at **18–20 €/dev/month**, up from prior rounds. The
+central security-audit family (`spring-audit`, `verify`, `risk`,
+`audit-report`) remains unusable on this repository for the sixth consecutive
+version.
+
+**Upgrade recommendation: yes, unconditionally** — no regression against
+5.9.27, and four corrections verified with the auditor's own data rather than
+accepted on the changelog's word. For anyone who needs the audit family on
+this repository specifically: still not the moment, but for the first time the
+team has a concrete, reproducible lead instead of a diffuse symptom.
+
+## Attack Order Requested By The Auditor
+
+1. `R-01` — bisect the `applying all rules` phase over a growing file subset
+   (250 → 3,342) to find where the behaviour changes; the trigger may not be
+   purely concurrency.
+2. Extend `R-01`'s instrumentation to runs that never complete — the in-flight
+   marker above.
+3. `R-02` — repeat the `ALT-08` verification with `ask prepare-context
+   review-pr`.
+4. Remaining rows unchanged in priority from the 5.9.27 report.