sourcecode 5.9.28__py3-none-any.whl → 5.9.29__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.28"
+__version__ = "5.9.29"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = 'adbbf9ca7652e2ad2dfdb2db911c12e1793dded5'
-CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-E': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-614-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-615-07': {'commit': '', 'status': 'uncited'}, 'AUD-615-COLD-COMPACT': {'commit': '', 'status': 'uncited'}, 'AUD-615-DRIFT': {'commit': '', 'status': 'uncited'}, 'AUD-615-E': {'commit': '', 'status': 'uncited'}, 'AUD-615-F': {'commit': '', 'status': 'uncited'}, 'AUD-615-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-615-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-615-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-615-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-616-E-PROV': {'commit': '', 'status': 'uncited'}, 'AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07': {'commit': '', 'status': 'uncited'}, 'AUD-616-INTENT-TIE-COV': {'commit': '', 'status': 'uncited'}, 'AUD-616-JUNIT4-SELF': {'commit': '', 'status': 'uncited'}, 'AUD-616-KOTLIN': {'commit': '', 'status': 'uncited'}, 'AUD-616-O': {'commit': '', 'status': 'uncited'}, 'AUD-616-P': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`AUD-619-WATCH`': {'commit': '', 'status': 'uncited'}, '`AUD-620-COMMAND-SURFACE`': {'commit': '', 'status': 'uncited'}, '`AUD-620-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`AUD-621-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-15`': {'commit': '', 'status': 'uncited'}, '`BUG-21`': {'commit': '', 'status': 'uncited'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}, '`REG-01`': {'commit': '', 'status': 'uncited'}, '`REG-04`': {'commit': '', 'status': 'uncited'}}
-CLOSURE_COVERAGE = {'closed_rows': 169, 'present': 91, 'absent': 0, 'unresolved': 0, 'uncited': 78, 'unknown': 0}
+BUILD_COMMIT = '6df1bd2436f8b562ee173fbaf7ba499ee783f0f8'
+CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-E': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-614-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-615-07': {'commit': '', 'status': 'uncited'}, 'AUD-615-COLD-COMPACT': {'commit': '', 'status': 'uncited'}, 'AUD-615-DRIFT': {'commit': '', 'status': 'uncited'}, 'AUD-615-E': {'commit': '', 'status': 'uncited'}, 'AUD-615-F': {'commit': '', 'status': 'uncited'}, 'AUD-615-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-615-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-615-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-615-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-616-E-PROV': {'commit': '', 'status': 'uncited'}, 'AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07': {'commit': '', 'status': 'uncited'}, 'AUD-616-INTENT-TIE-COV': {'commit': '', 'status': 'uncited'}, 'AUD-616-JUNIT4-SELF': {'commit': '', 'status': 'uncited'}, 'AUD-616-KOTLIN': {'commit': '', 'status': 'uncited'}, 'AUD-616-O': {'commit': '', 'status': 'uncited'}, 'AUD-616-P': {'commit': '', 'status': 'uncited'}, 'Suite hygiene': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ALT-25`': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`AUD-619-WATCH`': {'commit': '', 'status': 'uncited'}, '`AUD-620-COMMAND-SURFACE`': {'commit': '', 'status': 'uncited'}, '`AUD-620-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`AUD-621-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-13`': {'commit': '', 'status': 'uncited'}, '`BUG-15`': {'commit': '', 'status': 'uncited'}, '`BUG-16`': {'commit': '', 'status': 'uncited'}, '`BUG-21`': {'commit': '', 'status': 'uncited'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`NEW-02` / `BUG-05`': {'commit': '', 'status': 'uncited'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}, '`REG-01`': {'commit': '', 'status': 'uncited'}, '`REG-04`': {'commit': '', 'status': 'uncited'}, '`retrieve security-surface --target`': {'commit': '', 'status': 'uncited'}}
+CLOSURE_COVERAGE = {'closed_rows': 175, 'present': 91, 'absent': 0, 'unresolved': 0, 'uncited': 84, 'unknown': 0}

sourcecode/_docs/DEFECT-LEDGER.md

@@ -14,6 +14,110 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — Release `5.9.29`, hardening pass and a green suite (2026-09-02)
+
+**The suite is green — 13 748 tests, 0 failures — for the first time in
+several releases.** It had carried twenty-one standing reds, which is how a
+real regression becomes indistinguishable from the background. Two of them
+were product defects, not stale assertions.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `manifest-cache-key` (new) | High | **fixed** | `manifest_cache` keyed its entries on a hand-kept copy of the manifest names that omitted **every lockfile** — `poetry.lock`, `Cargo.lock`, `Gemfile.lock`, `pnpm-lock.yaml`, `yarn.lock`, `composer.lock`, `uv.lock`, `Pipfile.lock`. Two repositories with identical manifests and different *resolved* dependencies hashed the same, so the second was served the first's answer: a stale result with nothing in it to say so. The key now reads `dependency_analyzer.INPUT_FILENAMES`, and a battery reads that module's own source and fails if it opens a file the declared set does not name. |
+| `BUG-03` (merge half) | High | **fixed** | `SpringAuditResult.merge()` dropped `spring_footprint`, so the marginal-detection disclosure closed in 5.9.26 was switched back off on every `--scope all` run — the default. Fixing a producer and leaving a consumer unbound is the exact failure this ledger's maintenance rule exists for, found here by the battery that pins every dataclass field through the merge. |
+| `R-01` (lease liveness) | — | **hardened before shipping** | A lease outlived its process by up to an hour, and the field's harness kills runs with `timeout` constantly — on Windows, where liveness cannot be probed, every later run would have believed it was sharing the machine with a corpse and halved its pool for the whole TTL. Live runs refresh the lease at each phase change; the TTL drops to 900 s, which only has to outlast the longest single phase; the directory is capped. |
+| `R-01-INFLIGHT` (coverage) | — | **widened** | The marker covered the audit family only. `ALT-10` (`onboard`, 904 ms to a 200-second kill in one session) and `ALT-07` (`remediate`, 23,6 s to hangs past 400 s) are the field's other unexplained hangs, and a marker is the only evidence either row can leave behind. Both are covered now; `--help` and the light path still pay nothing. |
+| Suite hygiene | — | **closed** | Nineteen further rows were assertions that had fallen behind: a missing import and a missing fixture parameter, a `--jobs` bound stated twice (one `JOBS_MAX` now feeds the range and the help), a budget block that gained a field, a deadline modelled as a count of consultations rather than a state of the run, a no-context emulation importing a Typer module this version does not ship, `SEC-010` declaring neither a repair recipe nor a reason it cannot be mechanised, and the budget-authority battery holding external audit records to a rule meant for documents that instruct. |
+
+## Current Synchronization — P1 closed: the expensive family, profiled and fixed (2026-09-02)
+
+**The row asked for two things and both are done: `SEC-010` now reports while
+it runs, and the walk underneath it is between 3 and 24 times faster with a
+byte-identical answer.** Profiling `risk._http_input_query_sinks` on a
+3 860-file repository found the mechanism in one line of the profile: `get()`
+re-read every remaining source, from disk, **once per callee name it
+resolved** — 96 399 `_text_of` calls for 28 lookups, six seconds of pure I/O
+inside an 18,3-second walk, with the parse it triggers accounting for the
+rest.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `SEC-010` cost | Medium | **fixed** | `seeds()` already reads every source once, so it now indexes, per file, the names that could be *declared* there. The predicate is unchanged where it matters — a Java declaration is never preceded by a dot, so `helper.lookup(` cannot declare `lookup`, while every file that could declare a name stays a candidate — which preserves the walk's own claim that reading fewer files cannot change the answer. Measured warm, serialized, `spring-audit --compact`: `SEC-010` 10 830 → 3 246 ms and the audit 15,5 → 12,2 s on a 3 860-file repository; **64 391 → 2 628 ms** and the audit **71,1 → 8,4 s** on an 878-file one where the family had been 90 % of the clock; unchanged on a repository with no HTTP-input seeds. `content_id` byte-identical on all three. |
+| `SEC-010` silence | Medium | **fixed** | The family owned the most expensive stretch of an audit and reported nothing while it ran — one heartbeat line, unchanged, which from outside is exactly what the field calls a hang. It ticks through `FamilyBudget` now (`SEC-010: parsing callees 129/772 files`), which also makes the family that spends the most time the one a deadline can stop *inside*: a cut returns what it measured, and is recorded as a cut rather than surfacing as an analysis error. |
+| `ALT-01` / `ALT-03` | Critical maximum | **open, one contributing factor removed** | The field's failing runs sat in `SEC-010` and this release makes that stretch several times shorter and, for the first time, visible while it happens. That is not a claim the hang is fixed: an 878-file repository spending 71 s on one family is a plausible contributor to a 150-second timeout, not a proven cause of one, and the field's own repository was never available here. What the next round can do that no previous one could: read `inflight/<pid>.json` after a hang and see whether the stage is still `SEC-010`. |
+
+## Current Synchronization — The two 5.9.28 P0s, worked (2026-09-02)
+
+**The bisection ran, and its headline result is negative: there is no knee.**
+`spring-audit --compact` over deterministic subsets of a 4 772-file repository
+took 5,8 s (250 files), 6,0 s (500), 9,2 s (1 000), 10,4 s (2 000), 16,9 s
+(3 342 — the field's own file count) and 24,1 s (4 772); a second corpus of
+9 195 files finished in 39,6 s. Sublinear per file, `rc=0` everywhere, no hang
+at any size. **File count alone does not explain the field's failure on this
+platform**, and the auditor's hypothesis — a costly loop that trips at a
+certain size — is not reproducible here at up to 2,75× their repository.
+
+What the bisection did find is where the time goes, and why the heartbeat
+looks stuck: **one family dominates**. On the 4 772-file repository, `SEC-010`
+measured **10 670 ms of a 30 099 ms run — 85 % of the rule phase** — and its
+heartbeat line stops changing for the last 10,6 s of it. That is precisely the
+shape the field reports as a hang, and `timings.phases` could say
+`security_rules: 12 617 ms` while never naming which of the six families spent
+it. `SEC-010` delegates to `risk._http_input_query_sinks`, already recorded as
+the CLI's single most expensive walk on two corpora in the 5.8.5 round.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `R-01-INFLIGHT` | Critical maximum | **shipped** | `inflight/<pid>.json` is written when an audit-family command starts, rewritten at each phase and stage change the heartbeat already reports, and deleted on the way out. A run killed externally leaves it behind carrying argv, start time, the phase, the stage (the rule family) and how long it had been in each. Abandoned markers are published by a later run in `_meta.incomplete_runs` and attached to the forensic snapshot when a guard fires — the run that stops cannot report anything itself. Each row states its basis: a dead pid is a measurement, an old timestamp is an inference, and Windows offers only the second. `ASK_NO_INFLIGHT_MARKER=1` disables it. Field closure: the next hang should leave a marker naming its stage. |
+| `ALT-03` (bisection) | High | **measured, hypothesis not reproduced** | Six sizes on one corpus, three on a second, serialized on a quiet machine: no size at which the behaviour changes from *answers* to *hangs*. The remaining differences with the field are the platform (native Windows, four-worker cap), that repository's own content, and a dirty working tree. The bisection is not repeatable from outside without the repository, so the instruments below move the next attempt inside the product. |
+| `ALT-03` (attribution) | High | **instrumented** | `timings.rule_families` publishes wall time per family, highest first, with a basis stating that it ranks cost and not complexity (the families are not comparable units). Two `perf_counter` reads per family. A family the budget cut stays absent and is named in `_partial.rules_not_run`, so a missing entry is never read as a free family. |
+| `SEC-010` cost | Medium | **open, new, measured** | 85 % of the rule phase and 35 % of the whole audit on a 4 772-file repository; growth measured at roughly `n^1.2` between 1 553 and 3 860 analysed files (3,6 s → 10,6 s of unchanged heartbeat). Its own sub-progress is not reported, so a slow run and a stopped one look identical from outside for the whole stretch. Two separable pieces of work: report progress *inside* the family, and profile `risk._http_input_query_sinks`, which the 5.8.5 round already measured as this CLI's most expensive walk on two corpora. |
+
+## Current Synchronization — Alternative External Audit `5.9.28`, the hang reproduces on a near-idle machine (2026-09-02)
+
+**First substantial score rise in five rounds (4.6 → 6.2/10), with no
+regression found — and the sharpest evidence yet that contention was never the
+whole story.** The auditor isolated the contention variable to its lowest
+observable level in six sessions (120 s of monitoring, 100 s of confirmed calm
+before launch, one light foreign invocation across the whole 150 s window,
+against dozens in the 5.9.27 round) and `spring-audit . --compact` still hung
+**4 of 4 times**, `rc=124`, 0 bytes. The 5.9.28 release note said "one hang was
+observed with nothing else running, and that is unexplained"; this round turns
+that into *unexplained and reproducible*, which is a better-defined problem and
+still an open one. Full evidence:
+[`AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md).
+
+**Five rows are confirmed closed with the auditor's own data, not on the
+changelog's word:** `NEW-02`/`BUG-05` (cross-checked against the real source —
+`anchor_candidate_lines: [134, 145]` matches two annotations the auditor had
+verified by hand three sessions earlier, and it is the first defect tracked
+since 5.9.22 that is genuinely resolved rather than "not reproduced this
+time"), `BUG-13` (373 ms refusal against a purpose-built two-repository
+workspace), `BUG-16`, `ALT-25`, and the `retrieve security-surface --target`
+refusal. `_meta.concurrency` is described as the best instrumentation to appear
+in six sessions.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `R-01` (contention) | Critical maximum | **mechanism confirmed real and quantified; no longer sufficient as an explanation** | Measured on a successful run: `{"peer_invocations_at_start": 17, "worker_budget_shared": true, "jobs": 1, "jobs_unshared": 4}` — exact and actionable, and it settles from the outside what the 5.9.27 round could only infer from timestamps. But `spring-audit` hung 4/4 with third-party contention verified at its lowest in six sessions, so the division of the worker budget is a real fix for a real defect that is **not** the whole cause. Closure now needs the bisection below, not another contention measurement. |
+| `R-01-INFLIGHT` (new) | Critical maximum | **open, instrumentation gap named precisely** | `_meta.concurrency` never appears on a hung or empty run — zero mentions of `concurrency` across the four hangs' stderr — because those processes die before assembling any payload. Same blind spot as the 5.9.26 `R-01` (the run does not reach the output guard), now with the knowledge that the disclosure would be useful if it got there. The auditor's proposal, adopted as the row's required work: write `inflight/<pid>.json` with `{argv, started_at, last_phase}` when an audit-family command starts, update it at each phase change the heartbeat already reports, delete it on completion. An orphaned file is the forensic record no external observer can reconstruct by correlating a shared trace. |
+| `ALT-01` / `ALT-03` | Critical maximum | **open, now systematic and reproducible for this repository** | `spring-audit . --compact` 0/4 this round (0/5, 0/8, 0/18, 0/24 in the four before it); `verify` 0/1, `risk` 0/1, `audit-report` 0/1. The bisection the row has asked for since 5.9.25 now has a specific target: profile the `applying all rules over 3342 Java files` phase — the one the stderr heartbeat names — over a growing subset (250, 500, 1 000, 2 000, 3 342 files) and find where the behaviour changes from *answers* to *hangs indefinitely*. If it is deterministic on this tree, contention worsens a failure that already exists in isolation rather than causing one. |
+| `NEW-02` / `BUG-05` | High | **closed 5.9.28, confirmed in the field** | `anchor_ambiguity: true`, `overload_count: 2`, `anchor_candidate_lines: [134, 145]`, cross-checked against the two real annotations on the overloaded handler pair. Correct, not merely present. |
+| `BUG-13` | High | **closed 5.9.28, confirmed against an independent fixture** | Two real nested Git repositories, refusal in 373 ms with `nested_repositories: 2` and `--allow-nested` documented — against 1 of 12 rows passing in 120 s before. |
+| `BUG-16` | High | **closed 5.9.28, confirmed** | `cache status` prints each store's eviction contract; the auditor notes the information had been absent for four versions. |
+| `ALT-25` | Low | **closed 5.9.28, confirmed** | `audit_time_ms: null` with `findings_status: "not_computed"` and the rule stated beside it. |
+| `retrieve security-surface --target` | Low | **closed 5.9.28, confirmed** | The refusal states the intent is repository-wide and names `ask retrieve security-chain --target <symbol>`. |
+| `ALT-08` (arithmetic half) | Low | **fixed, field verification still owed** | Not verified this round and the auditor says so plainly: they exercised `ask review-pr`, which carries no `_truncation_summary` at all, instead of `ask prepare-context review-pr`, the command the field owns. Neither claimed nor refuted. Re-verify with the correct command before treating the field evidence as either way. |
+| `migrate-check` / `migrate-apply` | — | **reliable two sessions running** | 1/1 and 1/1 again (38–39 s, correct payloads). Two consecutive clean sessions after 0/5 in 5.9.26 — a trend rather than luck, and the shape of what a fixed audit-family command should look like. |
+| `ask --help` latency | Low | **open, still not a command-level defect** | 12.3 s cold, 2.9 s on immediate repetition on the audit machine, against 0.41–0.44 s on the engineering host. Consistent with residual contention; not reproduced as a defect of the command in either place. |
+| `BUG-22`/`REG-02`, `BUG-10`, `ALT-07`, `ALT-10`, `BUG-02`, `BUG-12`, `BUG-09`, `BUG-23` | — | **open/unchanged, not relaunched** | Time budget, and no regression signal. `BUG-10` in particular cannot be exercised on this repository — it has none of the routing styles that fix detects. |
+
+**No regression was found against 5.9.27, and the upgrade is recommended
+unconditionally** — the first round in six where the auditor reports a net,
+verified improvement with nothing new broken. The release gate is unchanged:
+the audit-command family is still not usable for unattended CI on this
+repository.
+
 ## Current Synchronization — Release `5.9.28`, nine rows closed on the 5.9.27 queue (2026-09-02)
 
 **`R-01`'s architectural question is answered in source, and the answer was

sourcecode/_docs/USER_GUIDE.md

@@ -279,7 +279,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.28
+# ask 5.9.29
 ```
 
 Requires Python 3.9+.

sourcecode/audit_recipe.py

@@ -127,6 +127,12 @@ MANUAL_BASIS: "dict[str, str]" = {
         "clause) and an injection sink for a value, and an executor cannot tell "
         "them apart without the caller's intent"
     ),
+    "SEC-010": (
+        "the repair is a parameterised query, and turning a concatenated string "
+        "into a bound statement changes both the SQL and the call that issues "
+        "it — the placeholders, their order and their types are decisions about "
+        "the query, not a rewrite an executor can derive from the concatenation"
+    ),
     "SEC-009": (
         "whether an anonymous request matcher is intentional depends on the "
         "deployment profile and authorization policy, so removing it would be "

sourcecode/cli.py

@@ -2243,6 +2243,18 @@ def _stamp_envelope(content: str) -> str:
     except Exception as _exc:
         degraded = degraded or f"concurrency disclosure unavailable: {type(_exc).__name__}"
 
+    # R-01-INFLIGHT: an earlier invocation on this machine that stopped where
+    # it could not report from. Published by this run because that one cannot
+    # publish anything — absent, never invented, when there is nothing to say.
+    try:
+        from sourcecode import inflight as _inflight
+
+        _incomplete = _inflight.disclosure()
+        if _incomplete is not None:
+            extra["incomplete_runs"] = _incomplete
+    except Exception as _exc:
+        degraded = degraded or f"inflight disclosure unavailable: {type(_exc).__name__}"
+
     # AUD-601-M01: the state a figure was taken in, from the lookups the layers
     # actually answered. Four retracted performance findings in six rounds were
     # all measured honestly against a cache state nobody could establish; a
@@ -3082,6 +3094,18 @@ REQUIRED_ANSWER_COMMANDS: "frozenset[str]" = frozenset({
     "verify",
 })
 
+#: Commands that open an in-flight marker (`R-01-INFLIGHT`). The audit family
+#: is where the empty-`exit 0` defect lives, and these two are where the field
+#: reports the *other* unexplained shape: `onboard` swung from 904 ms to a full
+#: 200-second external kill inside one session (`ALT-10`) and `remediate` went
+#: from a 23,6-second answer to hangs past 400 s (`ALT-07`). A marker costs one
+#: small write per phase change and is the only evidence either row can leave
+#: behind, so the gate covers them too. `--help` and the light path are not
+#: charged for it.
+MARKED_COMMANDS: "frozenset[str]" = REQUIRED_ANSWER_COMMANDS | {
+    "onboard", "remediate",
+}
+
 
 def _record_output_promise(argv: "list[str]") -> None:
     """Note that this invocation asked for a file, before anything is parsed.
@@ -4270,6 +4294,12 @@ COMMANDS_WITHOUT_BOUNDING: "frozenset[str]" = frozenset({
 
 
 #: The one help string for `--jobs` (F-AQ; the scope sentence is C3-84/CL-18).
+#: The largest worker count `--jobs` accepts. One constant, because the number
+#: appeared twice — in the range Click enforces and in the sentence the help
+#: prints — and a bound stated in two places is a bound that can disagree with
+#: itself.
+JOBS_MAX = 128
+
 JOBS_OPTION_HELP = (
     "Worker processes used to parse files (default: CPU count − 1). "
     "`--jobs 1` parses in this process. Parallelism only warms the "
@@ -4279,6 +4309,7 @@ JOBS_OPTION_HELP = (
     "clock and every rule together 8 %, so this flag covers the phase that holds "
     "the cost — but only while there is something to parse, and on a warm cache "
     "there is not, so raising it buys nothing there. Env: ASK_JOBS."
+    f" Maximum accepted value: {JOBS_MAX}."
 )
 
 
@@ -4311,8 +4342,8 @@ def _jobs_option() -> Any:
         "--jobs",
         "-j",
         min=1,
-        max=128,
-        help=JOBS_OPTION_HELP + " Maximum accepted value: 128.",
+        max=JOBS_MAX,
+        help=JOBS_OPTION_HELP,
     )
 
 
@@ -12899,6 +12930,11 @@ def spring_audit_cmd(
             # that the rule pass asks it.
             _rules_cut: list[str] = []
             _phases_cut: list[str] = []
+            # ALT-03: the two rule-pass observers, named before the scope
+            # branches so a scope that runs one of them can still publish the
+            # family timings of the one that ran.
+            _tx_watch: Any = None
+            _sec_watch: Any = None
             # C3-79: families the budget stopped *inside*, with how far each got.
             _rules_partial: list[dict] = []
             _projection_stages_cut: list[str] = []
@@ -13009,6 +13045,28 @@ def spring_audit_cmd(
             # assembled — so `unaccounted_ms` covers exactly what it claims:
             # serialization, ceiling estimation and interpreter start.
             combined.metadata["timings"] = _timings.to_dict()
+            # ALT-03 (5.9.28 bisection): `security_rules` is one phase and six
+            # families, and the bisection measured 47 % of a 3 860-file audit
+            # inside a single one of them — with the heartbeat line for that
+            # family unchanged for 10.6 s at the end, which from outside is
+            # indistinguishable from a hang. The phase split could not say
+            # which family; this can. Absent when no family ran, never zeroed.
+            _family_ms: "dict[str, float]" = {}
+            for _watch in (_tx_watch, _sec_watch):
+                for _rule_id, _ms in (getattr(_watch, "durations_ms", {}) or {}).items():
+                    _family_ms[_rule_id] = round(_family_ms.get(_rule_id, 0.0) + _ms, 2)
+            if _family_ms:
+                combined.metadata["timings"]["rule_families"] = dict(
+                    sorted(_family_ms.items(), key=lambda kv: kv[1], reverse=True)
+                )
+                combined.metadata["timings"]["rule_families_basis"] = (
+                    "Wall time per rule family inside the rule phases above, "
+                    "highest first. The families are not comparable units — one "
+                    "walks every symbol in the repository, the next reads one "
+                    "annotation — so this ranks cost, not complexity. A family "
+                    "cut by the budget is absent here and named in "
+                    "`_partial.rules_not_run`."
+                )
             if _excluded_tests and not include_tests:
                 combined.limitations.append(
                     f"{len(_excluded_tests)} test source(s) were excluded from this "
@@ -21825,6 +21883,19 @@ def main_entry() -> None:
     if any(tok in REQUIRED_ANSWER_COMMANDS for tok in sys.argv[1:]):
         from sourcecode import empty_answer_diagnostics as _diag
         _diag.record_entry_reached(sys.argv[1:])
+    # R-01-INFLIGHT (5.9.28 re-audit): the entry trace proves the process
+    # started and nothing after that. Four `spring-audit` hangs in one session
+    # produced no payload, no sidecar and no phase — every diagnostic this
+    # product had lived on a path a hung run never reaches. The marker opened
+    # here survives an external kill and names the phase and stage the run
+    # stopped in, over the commands the field reports hanging.
+    if any(tok in MARKED_COMMANDS for tok in sys.argv[1:]):
+        try:
+            from sourcecode import inflight as _inflight
+
+            _inflight.begin(sys.argv[1:])
+        except Exception:
+            pass
     # R-01 (5.9.27 alternative audit): announce this invocation on the machine
     # before any work, so a peer that starts later sizes its worker pool
     # against a census that includes this run — and so this run's own payload
@@ -21849,7 +21920,11 @@ def main_entry() -> None:
     try:
         from sourcecode import resource_budget as _rb_arm
 
-        _rb_arm.arm(" ".join(["ask", *sys.argv[1:2]]).strip())
+        _rb_arm.arm(
+            "ask " + next(
+                (tok for tok in sys.argv[1:] if not tok.startswith("-")), ""
+            ).strip()
+        )
     except Exception:
         pass
     from sourcecode.perf import mark_command_start as _mark_command_start

sourcecode/concurrency.py

@@ -62,12 +62,18 @@ from typing import Any, Optional
 #: is precisely the shape the 5.9.27 audit found).
 _LEASE_DIR_NAME = "live"
 
-#: A lease older than this is treated as abandoned. It is the only liveness
-#: signal available on Windows, so it is generous: a long `spring-audit` on a
-#: large repository is a real invocation, not a stale file. Over-counting a
-#: dead peer costs a smaller worker pool for one run; under-counting a live
-#: one costs the oversubscription this module exists to remove.
-LEASE_TTL_S = 3600.0
+#: A lease not refreshed for this long is treated as abandoned. It is the only
+#: liveness signal available on Windows, and the number matters there: the
+#: field's own harness kills runs with `timeout` constantly, so a lease that
+#: outlives its process by an hour would make every later run on that machine
+#: believe it is sharing the cores with a corpse and halve its pool. Live runs
+#: refresh the lease at every phase change (`touch`), so this only has to
+#: outlast the longest single phase, not the longest run.
+LEASE_TTL_S = 900.0
+
+#: Leases kept before the oldest are dropped. A machine whose runs are killed
+#: faster than the sweep can prove them dead must not grow this directory.
+_MAX_LEASES = 200
 
 #: Set inside parallel workers (`parallel.ENV_WORKER`). A worker is not an
 #: invocation and must never be counted as one, or a pool would be observed
@@ -139,11 +145,36 @@ def register(argv: "Optional[list[str]]" = None) -> None:
             encoding="utf-8",
         )
         _own_lease = path
+        _prune(directory)
         atexit.register(release)
     except Exception:
         _own_lease = None
 
 
+def touch() -> None:
+    """Refresh this invocation's lease so a peer can tell it from a corpse.
+
+    Called from `progress._record_phase`, the same seam the in-flight marker
+    uses: a run that is reporting phases is a run that is alive, and on
+    Windows that timestamp is the only liveness evidence a peer can read.
+    """
+    if _own_lease is None:
+        return
+    try:
+        os.utime(_own_lease, None)
+    except Exception:
+        pass
+
+
+def _prune(directory: Path) -> None:
+    try:
+        leases = sorted(directory.glob("*.json"), key=lambda p: p.stat().st_mtime)
+        for stale in leases[: max(0, len(leases) - _MAX_LEASES)]:
+            stale.unlink(missing_ok=True)
+    except Exception:
+        pass
+
+
 def release() -> None:
     """Drop this invocation's lease. Idempotent; never raises."""
     global _own_lease

sourcecode/dependency_analyzer.py

@@ -153,6 +153,31 @@ def _infer_role(name: str, ecosystem: str, scope: str) -> str:
     return "devtool" if is_dev else "runtime"
 
 
+#: Every file this analyzer reads from a repository root, and therefore every
+#: file whose bytes decide its answer. `manifest_cache` keys its entries on
+#: exactly this set: the lockfiles were missing from that key, so two roots
+#: with identical manifests and *different* resolved dependencies shared one
+#: cache entry — a stale answer with nothing in it to say so. The battery in
+#: `tests/test_manifest_cache.py` reads this module's own source and fails if a
+#: filename it opens is absent here, because a vocabulary kept by hand beside
+#: the code that uses it is the drift this repository has a rule against.
+INPUT_FILENAMES = frozenset({
+    # Java / JVM
+    "pom.xml", "build.gradle", "build.gradle.kts", "gradle.properties",
+    # Node
+    "package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock",
+    # Python
+    "pyproject.toml", "requirements.txt", "requirements-dev.txt",
+    "requirements.lock", "poetry.lock", "uv.lock", "Pipfile.lock",
+    # PHP / Ruby / Rust / Go / .NET
+    "composer.json", "composer.lock", "Gemfile", "Gemfile.lock",
+    "Cargo.toml", "Cargo.lock", "go.mod", "packages.lock.json",
+})
+
+#: Matched by suffix rather than by name (one project file per directory).
+INPUT_SUFFIXES = (".csproj",)
+
+
 class DependencyAnalyzer:
     """Resuelve dependencias desde manifests y lockfiles sin ejecutar toolchains."""
 

sourcecode/empty_answer_diagnostics.py

@@ -79,6 +79,17 @@ def record(command: Optional[str], reason: str, **extra: Any) -> Optional[str]:
             "python": sys.version.split()[0],
             "platform": sys.platform,
         }
+        # R-01-INFLIGHT: what else on this machine stopped without reporting.
+        # A guard firing now, with three abandoned markers beside it, is a
+        # different situation from a guard firing on a quiet machine.
+        try:
+            from sourcecode import inflight as _inflight
+
+            _abandoned = _inflight.abandoned()
+            if _abandoned:
+                snapshot["abandoned_runs"] = _abandoned[:10]
+        except Exception:
+            pass
         snapshot.update(extra)
         directory = _diagnostics_dir()
         directory.mkdir(parents=True, exist_ok=True)