sourcecode 5.9.28__tar.gz → 5.9.30__tar.gz

{sourcecode-5.9.28 → sourcecode-5.9.30}/CHANGELOG.md

@@ -1,5 +1,149 @@
 # Changelog
 
+## [5.9.30] — 2026-09-02
+
+*A full pass over the open queue from the two 5.9.29 field audits. Nine rows
+closed or materially narrowed, one commit each, every change carrying its own
+test.*
+
+### Fixed
+
+- **A run nobody is watching now leaves the same forensic trail a watched
+  one does.** The in-flight marker's stage field went blank in exactly the
+  environment it exists to observe -- off a TTY, in CI, under `NO_COLOR`,
+  piped through `timeout` -- because the code path that records a stage was
+  only ever built when the visible progress line was displayed. It no longer
+  is: the forensic write and the visible display are now independent, and the
+  auditor's own captured hang is the regression test.
+- **`ask endpoints` names a file it could not fully parse, at any answer
+  size.** A file whose extracted symbols were not trustworthy -- a type
+  declaration that produced none, or a syntax error the extractor's
+  brace/paren check catches -- was already disclosed by `spring-audit`/`risk`
+  and silently dropped by `endpoints`, because the two commands parse the
+  same sources through two independent code paths and only one of them ran
+  the check. One shared authority now backs both.
+- **`ask plan` refuses an unscoped run over a workspace before doing any
+  work**, the same guard `selftest` shipped last release, applied to the
+  same class of defect: a lone positional argument silently left the
+  repository path at its default `.`, and an implicit `.` covering nested Git
+  repositories used to drive a full, unvalidated analysis.
+- **Every command that names "the repository" accepts every spelling of the
+  flag**, including the ones that declare it as an option rather than a
+  positional argument -- `compare A B --repo <path>` now works, where it used
+  to demand `--path` specifically.
+- **The Spring-density statement names the actual number.** A repository
+  where Spring is present but marginal already got a correctly bounded
+  answer; the sentence explaining why now states the measured percentage
+  instead of leaving the reader to divide two raw counts themselves.
+- **`--detach`'s envelope reports an absolute output path.** A relative
+  `--output` used to come back exactly as typed, unusable from outside the
+  invocation's own working directory.
+- **Vert.x's fluent router chain is recognized as unmodeled routing
+  evidence**, closing the one framework of eleven surveyed that fell through
+  to a generic disclaimer with no file named -- `router.get("/x").handler(...)`
+  carries no annotation for the existing detection rule to match, so a second,
+  equally vendor-neutral rule was added for the call-chain shape specifically.
+- The root `ask` command's asynchronous cache write no longer re-joins its own
+  daemon thread at process exit, which could delay returning control to the
+  caller for up to 30 seconds after the answer had already been delivered.
+
+### Added
+
+- `tests/test_new01_silent_empty_success_regime.py`: an automated, real-CLI
+  battery over every command that must never report success with nothing to
+  show, closing the standing request behind four consecutive rounds of
+  103-for-103 external verification.
+
+### Investigated, Left Unchanged
+
+- The specific mechanism behind a `verify` invocation that produced a
+  complete answer and was still killed by an external timeout remains
+  unconfirmed; one independently-discovered instance of the same failure
+  shape elsewhere in the codebase is fixed above, but `verify` does not share
+  that code path.
+- `pack assessment`'s unbounded default output was reproduced and understood,
+  not changed: `--compact` already bounds it correctly (a prior round's own
+  fix), and the unbounded default is a deliberate, tested, opt-in answer
+  rather than an oversight. Flipping it would be a product decision affecting
+  every existing caller, not a bug fix.
+
+## [5.9.29] — 2026-09-02
+
+*The 5.9.28 field round's two P0s and its P1, plus the suite's first green run
+in several releases. Where 5.9.28 answered a question about the worker pool,
+this release answers the one about where a run stops when it stops.*
+
+### Added
+
+- **An in-flight marker for runs that never finish (`R-01-INFLIGHT`).** The
+  field measured four `spring-audit` hangs and could say nothing about any of
+  them: every diagnostic this product had — the envelope, the forensic sidecar
+  — lives on a path a hung run never reaches. A marker is now written when a
+  hang-prone command starts, rewritten at each phase and stage change the
+  heartbeat already reports, and deleted on the way out. A run killed
+  externally leaves `inflight/<pid>.json` naming its argv, its start time, the
+  phase and the stage it stopped in. Abandoned markers are published by a
+  later run in `_meta.incomplete_runs`, because the run that stops cannot
+  report anything itself; each row states whether it is a measurement (the
+  process is gone) or an inference (no refresh, on a platform that cannot
+  probe liveness safely). Covers the audit family plus `onboard` and
+  `remediate`, the two commands the field reports hanging outside it.
+  `ASK_NO_INFLIGHT_MARKER=1` disables it.
+- **`timings.rule_families`** — wall time per rule family, highest first, with
+  a basis stating that it ranks cost and not complexity. The phase split could
+  say `security_rules: 12,617 ms` and never which of six families spent it.
+
+### Fixed
+
+- **The most expensive rule family is between 3 and 24 times faster, with a
+  byte-identical answer (P1).** `SEC-010` was 85 % of the rule phase and 35 %
+  of a whole audit; profiling found the walk under it re-reading every
+  remaining source, from disk, once per callee name it resolved — 96,399 reads
+  for 28 lookups. It indexes declarable names in the pass that already reads
+  each file once. Measured warm: `SEC-010` 10,830 → 3,246 ms on a 3,860-file
+  repository (audit 15.5 → 12.2 s) and 64,391 → 2,628 ms on an 878-file one
+  (audit 71.1 → 8.4 s), unchanged where a repository has no HTTP-input seeds.
+  `content_id` identical on all three.
+- **That family reports while it runs, and a deadline can stop it inside.** It
+  owned the longest stretch of an audit and left one heartbeat line unchanged
+  for the whole of it, which from outside is what the field calls a hang. A
+  budget cut returns what it measured instead of surfacing as an analysis
+  error.
+- **`manifest_cache` keyed its entries on a list that omitted every
+  lockfile.** Two repositories with identical manifests and different resolved
+  dependencies hashed the same, and the second was served the first's answer.
+  The key now reads the analyzer's own `INPUT_FILENAMES`, and a battery reads
+  that module's source and fails if it opens a file the set does not name.
+- **`SpringAuditResult.merge()` dropped `spring_footprint`**, which switched
+  BUG-03's marginal-detection disclosure back off on every `--scope all` run —
+  the default.
+- Machine-census leases are refreshed while a run is alive, so a killed run no
+  longer makes every later run on that machine halve its worker pool for an
+  hour; the lease directory is capped.
+
+### Changed
+
+- The suite is green: 13,748 tests, 0 failures. It had carried twenty-one
+  standing reds for several releases, which is how a real regression becomes
+  indistinguishable from the background. Two were the product defects above;
+  the rest were assertions that had fallen behind the code they pin, each
+  fixed or opted out with the reason stated.
+
+### Known Limitations
+
+- `ALT-01`/`ALT-03` remain open. The bisection the field asked for ran over two
+  corpora — 250 to 4,772 files on one, 9,195 on another — and found no size at
+  which `spring-audit` stops answering: 5.8 s to 39.6 s, sublinear, `rc=0`
+  throughout. File count alone is exonerated on this platform at up to 2.75x
+  the field repository's size. This release makes the stretch the failing runs
+  sat in several times shorter and, for the first time, visible while it
+  happens; it does not claim to have fixed the hang.
+- The next field round should send `inflight/` and `entry-trace.jsonl`
+  together after a hang. A marker still stuck in `SEC-010` says the family is
+  not the cause; a marker in another stage moves the search there; no marker
+  at all keeps it upstream of `main_entry`.
+- `BUG-02` and `BUG-12` still need the field's own large repository.
+
 ## [5.9.28] — 2026-09-02
 
 *Remediation batch on the 5.9.27 audit queue: nine rows, one commit each. The

{sourcecode-5.9.28 → sourcecode-5.9.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.28
+Version: 5.9.30
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.28-blue)
+![Version](https://img.shields.io/badge/version-5.9.30-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -290,7 +290,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.28 — and, on a build that has aged,
+ask version                    # ask 5.9.30 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.28 → sourcecode-5.9.30}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.28-blue)
+![Version](https://img.shields.io/badge/version-5.9.30-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -241,7 +241,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.28 — and, on a build that has aged,
+ask version                    # ask 5.9.30 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.28 → sourcecode-5.9.30}/docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md

@@ -12,7 +12,7 @@ a regression assertion exist.
 
 ## Executive Result
 
-The audit rates ASK Engine **6.6/10** on the large MSAS corpus and **7.5/10** on
+The audit rates ASK Engine **6.6/10** on the large native-Windows corpus and **7.5/10** on
 the smaller nine-axis assessment. The measurements agree on the main risk:
 source analysis is accurate and unusually explicit about uncertainty, but large
 repository execution and several output contracts are not yet reliable enough
@@ -52,7 +52,7 @@ SQL-injection recall, memory, and inconsistent CLI contracts.
 ## Performance Evidence
 
 The audit measured `--agent` on ThingsBoard at **182.6 s / 2,088 MB RSS** and
-`spring-audit` at **164.2 s cold**. On the larger MSAS corpus it reports
+`spring-audit` at **164.2 s cold**. On the larger native-Windows corpus it reports
 `ask . --agent` at **447 s**, `contract-diff` at **329 s**, `delta` at **187 s**,
 and `validation --compact` at **91 s**. Warm root compact analysis can be below
 one second; these are cold/deep-path costs.

{sourcecode-5.9.28 → sourcecode-5.9.30}/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.27.md

@@ -2,7 +2,7 @@
 
 ## Scope And Verdict
 
-Native-Windows re-audit on the same MSAS repository (3,342 Java files) used
+Native-Windows re-audit on the same audited repository (3,342 Java files) used
 in every prior round. Score **4.6/10**, the first uptick in four rounds (5.9.22
 6.6, 5.9.23 4.9, 5.9.25 4.3, 5.9.26 3.8). The uptick carries a large
 qualification discovered mid-session: this audit's own machine was shared
@@ -40,7 +40,7 @@ pass ... 0/35 ... 3.8/10"). This auditor states plainly that the first pass
 and its 7.4/10 score do not correspond to anything they ran or reported. Given
 the newly confirmed shared-machine contention, the likely explanation is that
 5.9.26's report mixed observations from two concurrent, independent audit
-sessions on the same machine (the MSAS/native-Windows lineage and a
+sessions on the same machine (the native-Windows lineage and a
 multi-repository "testing/" corpus lineage matching the five OSS repos found
 in the trace this round) rather than one evaluator's two passes. Recorded as
 an open provenance question, not resolved either way — see
@@ -97,6 +97,6 @@ concurrent `ask` test harness during at least part of the observation window.
 Reliability figures in this round should be read as measured under
 uncontrolled, real contention, not as an isolated single-process baseline.
 The auditor's own recommendation: repeat `spring-audit . --compact` x3 on
-both a reference repo and MSAS in the same clean window, nothing else
+both a reference repo and the audited repository in the same clean window, nothing else
 running, to separate "the repository" from "the shared machine" as the
 variable.

sourcecode-5.9.30/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md

@@ -0,0 +1,174 @@
+# Alternative External Audit - 5.9.28
+
+*The audited repository is referred to neutrally throughout (3,342 Java files,
+`repo_id 7fced5c877cacfc5`, dirty working tree) — it is the same subject as
+every prior round in this lineage.*
+
+## Scope And Verdict
+
+Native-Windows re-audit, sixth round in this lineage. Score **6.2/10** (5.9.22
+6.6, 5.9.23 4.9, 5.9.25 4.3, 5.9.26 3.8, 5.9.27 4.6, 5.9.28 6.2) — the first
+substantial rise in five versions, and the first with a root cause identified
+in code rather than a symptom patched. **No regression against 5.9.27 was
+found.** Windows 11 Pro 10.0.26200, Python 3.10.0, pipx, `ask.EXE`, build
+`adbbf9ca7652e2ad2dfdb2db911c12e1793dded5`.
+
+| Axis | 5.9.27 | 5.9.28 | Basis |
+|---|---:|---:|---|
+| Analysis accuracy | 9.0 | 9.5 | Overload anchoring exact and cross-checked against the real source |
+| Honesty of figures | 9.0 | 9.3 | `audit_time_ms` null instead of a false `0.0`; every cache store publishes its eviction contract |
+| Diagnostic instrumentation | partial progress | real step, known limit | `_meta.concurrency` is precise and actionable — and absent from exactly the runs that fail |
+| CLI ergonomics | 6.5 | 7.5 | Nested-workspace `selftest` refusal; `retrieve --target` explains and redirects |
+| Audit-family reliability | 2/12 | 2/8, cause bounded | `migrate-check`/`migrate-apply` clean; `spring-audit` 0/4, `verify` 0/1, `risk` 0/1, `audit-report` 0/1 |
+| Light-path performance | 6.5 | 6.5 | `impact-chain` 11.3 s, `review-pr` 29.4 s — within range under residual contention |
+
+## Priority Finding — The Hang Reproduces With Contention Ruled Down
+
+The most important measurement of this round. The auditor isolated the
+contention variable to its lowest observable level across six sessions, and
+the failure persisted at 100%:
+
+1. `entry-trace.jsonl` was monitored for 120 s with nothing launched, waiting
+   for a quiet window.
+2. 100 s of total calm confirmed — no new lines.
+3. `timeout -k 5 150 ask spring-audit . --compact` launched into that window.
+4. Result: `rc=124`, 150,176 ms, **0 bytes of stdout**.
+5. The trace grew by two lines over the whole 150 s window: the auditor's own
+   invocation, and one light foreign invocation (`risk thingsboard --limit
+   20`) — against the *dozens* of concurrent foreign invocations measured in
+   the 5.9.27 session.
+
+Session total: **4/4 hangs** of `spring-audit . --compact`, the last of them
+under the lowest contention load obtainable in six audits.
+
+The 5.9.28 release note states: *"one hang was observed with nothing else
+running, and that is unexplained."* This round supplies four repetitions of
+that case rather than one, which turns "unexplained" into "unexplained and
+reproducible" — a better-defined problem, still unsolved. Contention is a
+real, now precisely measured factor; it is **not the sole cause**. Something
+specific to this repository still breaks `spring-audit` on a near-idle
+machine.
+
+The auditor's recommendation: profile the `applying all rules over 3342 Java
+files` phase (the one the stderr heartbeat names) against a growing subset of
+the repository — 250, 500, 1,000, 2,000, 3,342 files — to find where the
+behaviour changes from "answers" to "hangs indefinitely". If the command
+exhausts memory or time deterministically on some code pattern in this tree,
+contention would be worsening a failure that already exists in isolation
+rather than causing one.
+
+## Instrumentation Gap — The Blind Spot `_meta.concurrency` Cannot Cover
+
+`_meta.concurrency` is described as the best instrumentation to appear in six
+sessions. On a successful `endpoints --output` run it read
+`{"peer_invocations_at_start": 17, "worker_budget_shared": true, "jobs": 1,
+"jobs_unshared": 4}` — exact, actionable, and enough for any consumer to tell
+a contaminated timing from an isolated one without doing process archaeology.
+
+It never appears on a hung or empty run: stderr across the four `spring-audit`
+hangs contains zero mentions of `concurrency`, because those processes die
+before assembling any payload. This is the same blind spot `R-01` identified
+in the 5.9.26 round (the process does not reach the output guard); what has
+changed is that we now know it *would* publish something useful if it got
+there.
+
+Concrete suggestion from the auditor: write an in-flight marker
+(`inflight/<pid>.json` carrying `{argv, started_at, last_phase}`, updated at
+each phase change the heartbeat already reports) when an audit-family command
+starts, and delete it on completion. A process that hangs or dies leaves that
+file orphaned — which is precisely the forensic evidence the next field
+session needs, without depending on an external observer correlating
+timestamps in a trace file shared with an unknown number of other processes.
+
+## Measured Reliability — Six Versions, Same Invocation, Same Repository
+
+| Invocation | 5.9.23 | 5.9.25 | 5.9.26 | 5.9.27 | 5.9.28 |
+|---|---:|---:|---:|---:|---|
+| `spring-audit . --compact` | 0/24 | 0/18 | 0/8 | 0/5 | 0/4 (3 under verified-minimal contention) |
+| `verify .` | 0/24 | 0/18 | 0/5 | 0/1 | 0/1 |
+| `migrate-check . --compact` | 7/12 | 4/26 | 0/5 | 1/1 | 1/1 ✓ |
+| `migrate-apply .` | 14/24 | 0/26 | 0/5 | 1/1 | 1/1 ✓ |
+| `risk . --limit 20` | 0/13 | 0/7 | 0/4 | 0/1 | 0/1 |
+| `audit-report . --format markdown` | 0/7 | 0/7 | 0/4 | 0/1 | 0/1 |
+
+`migrate-check` and `migrate-apply` have now answered reliably in two
+consecutive sessions (38–39 s, correct payloads) — a trend rather than luck.
+The other four remain at zero.
+
+## Verified Fixes — Checked With The Auditor's Own Data
+
+- **`NEW-02`/`BUG-05` (overload anchoring) — closed, cross-checked against the
+  real source.** `ask endpoints . --output`: the four endpoints of one
+  overloaded handler pair now publish `anchor_ambiguity: true`,
+  `overload_count: 2`, `anchor_candidate_lines: [134, 145]`, and those two
+  line numbers match the two real annotations the auditor had verified by hand
+  three sessions earlier. First defect tracked since the 5.9.22 round that is
+  genuinely resolved rather than "not reproduced this time".
+- **`BUG-13` (nested-workspace `selftest`) — closed, verified against a
+  purpose-built fixture.** The auditor built a workspace holding two real
+  nested Git repositories: refusal in **373 ms**, `{"code": "INVALID_USAGE",
+  ..., "nested_repositories": 2}`, with `--allow-nested` documented. Against
+  1/12 rows passing in 120 s before.
+- **`BUG-16` (cache eviction contract) — closed.** `ask cache status` now
+  prints, per store, when and how entries are evicted — information absent for
+  four versions.
+- **`ALT-25` (`impact-chain.audit_time_ms`) — closed.** `null` with
+  `findings_status: "not_computed"` and the rule stated, replacing the
+  misleading `0.0`.
+- **`retrieve security-surface --target` — closed, high quality.** The refusal
+  now says the intent is repository-wide and names
+  `ask retrieve security-chain --target <symbol>`, after four sessions of
+  "No such option: --target".
+- **`R-01`'s mechanism — confirmed real and quantified** (see above), with the
+  reservation that the disclosure cannot reach the failing runs.
+
+## Not Verified This Round
+
+- **`ALT-08` — the auditor ran the wrong command and says so.**
+  `ask review-pr . --files -` (119,979 bytes, above the declared 100,000-byte
+  ceiling) carries no `_truncation_summary` at all: that field belongs to
+  `ask prepare-context review-pr`, a different command sharing the task name.
+  Neither claimed nor refuted; pending a repeat with the correct command.
+- `BUG-22`/`REG-02` (`--agent` not relaunched), `BUG-10` (needs a repository
+  with the routing styles it detects, absent here), `ALT-07`, `ALT-10`,
+  `BUG-02`, `BUG-12`, `BUG-09`, `BUG-23`: not relaunched for time budget, no
+  regression signal against any of them.
+- `ask --help`: 12.3 s cold, 2.9 s on immediate repetition. Still high on the
+  audit machine, consistent with residual contention rather than a defect in
+  the command.
+
+## Verified And Defect-Free In 5.9.28
+
+`endpoints` (3,763, exact), `impact-chain` (37,445 bytes), `posture`,
+`verify-edit`, `explain`, `impact`, `drift`, `trend`, `chunk-file`, `intent`,
+`pr-risk`, `review-pr` (119,979 bytes, coherent), `migrate-check` (38,081
+bytes), `migrate-apply` (10,142 bytes), `selftest` with an explicit path
+(`rc=75`, 9,910 bytes) and with nesting detection (`rc=2`). `--jobs`
+out-of-range rejection confirmed for the sixth consecutive session.
+
+## Commercial Position
+
+The reliable subset grew for real this round — `migrate-check`,
+`migrate-apply`, `endpoints`, `posture`, `impact-chain`, `pr-risk`,
+`review-pr`, `selftest` with an explicit path, now with correct overload
+anchors — and is valued at **18–20 €/dev/month**, up from prior rounds. The
+central security-audit family (`spring-audit`, `verify`, `risk`,
+`audit-report`) remains unusable on this repository for the sixth consecutive
+version.
+
+**Upgrade recommendation: yes, unconditionally** — no regression against
+5.9.27, and four corrections verified with the auditor's own data rather than
+accepted on the changelog's word. For anyone who needs the audit family on
+this repository specifically: still not the moment, but for the first time the
+team has a concrete, reproducible lead instead of a diffuse symptom.
+
+## Attack Order Requested By The Auditor
+
+1. `R-01` — bisect the `applying all rules` phase over a growing file subset
+   (250 → 3,342) to find where the behaviour changes; the trigger may not be
+   purely concurrency.
+2. Extend `R-01`'s instrumentation to runs that never complete — the in-flight
+   marker above.
+3. `R-02` — repeat the `ALT-08` verification with `ask prepare-context
+   review-pr`.
+4. Remaining rows unchanged in priority from the 5.9.27 report.

sourcecode-5.9.30/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.29.md

@@ -0,0 +1,143 @@
+# Alternative External Audit - 5.9.29
+
+*The audited repository is referred to neutrally (3,342 Java files, `repo_id
+7fced5c877cacfc5`, dirty working tree) — the same subject as every prior round
+in this lineage.*
+
+## Scope And Verdict
+
+Native-Windows re-audit, seventh round. Score **7.8/10** (5.9.22 6.6, 5.9.23
+4.9, 5.9.25 4.3, 5.9.26 3.8, 5.9.27 4.6, 5.9.28 6.2, 5.9.29 7.8) — the largest
+jump of the seven, and the first with a root cause found and fixed rather than
+mitigated. Build `6df1bd2436f8b562ee173fbaf7ba499ee783f0f8`, Windows 11 Pro
+10.0.26200, Python 3.10.0, pipx, `ask.EXE`.
+
+**All six audit-family commands answered in this session.** The auditor's own
+sentence: *the first time in seven rounds I can write that.*
+
+| Invocation | 5.9.23 | 5.9.25 | 5.9.26 | 5.9.27 | 5.9.28 | 5.9.29 |
+|---|---:|---:|---:|---:|---:|---|
+| `spring-audit . --compact` | 0/24 | 0/18 | 0/8 | 0/5 | 0/4 | **3/4** |
+| `verify .` | 0/24 | 0/18 | 0/5 | 0/1 | 0/1 | **2/2** (one killed at 200 s despite a complete answer — see `R-02`) |
+| `migrate-check . --compact` | 7/12 | 4/26 | 0/5 | 1/1 | 1/1 | 1/1 |
+| `migrate-apply .` | 14/24 | 0/26 | 0/5 | 1/1 | 1/1 | 1/1 |
+| `risk . --limit 20` | 0/13 | 0/7 | 0/4 | 0/1 | 0/1 | **1/1**, first in six sessions |
+| `audit-report . --format markdown` | 0/7 | 0/7 | 0/4 | 0/1 | 0/1 | **1/1**, first in six sessions |
+| `remediate .` | — | — | hung | hung | — | **1/1**, 74.8 s, first ever |
+
+`onboard` answered in 691 ms. `selftest` with an explicit path rose from 1/12
+to **6/12** passing rows, which the auditor attributes to the `SEC-010` work:
+the `ASK-16` row — does `spring-audit` publish its own timings — now passes
+clean.
+
+## Confirmed With The Auditor's Own Data
+
+- **The `SEC-010` fix is real and measured.** Three successive `spring-audit`
+  runs, identical `content_id` (`4a0429c7784da360`), 385 findings each, with
+  the family's own time falling as the cache warmed: **42.8 s → 25.4 s →
+  20.0 s**. The whole command went 73.9 s → 46.9 s → 35.9 s. This is the
+  warm-cache benefit the product had promised and no session had been able to
+  observe.
+- **`ALT-08` closed, byte-exact, with the right command this time.**
+  `ask prepare-context review-pr` — not `ask review-pr`, the confusion that
+  left the row unverified last round — gives `final_size_bytes: 93,462`,
+  matching `len(json.dumps(payload without _meta))` exactly.
+- **The in-flight marker works, and works on the case it was built for.** It
+  captured the auditor's own hung process with phase and timestamps. It had
+  also preserved a genuine *foreign* orphan from an earlier session
+  (`audit-report thingsboard`, phase `packaging audit evidence`) that predated
+  their run — the mechanism persists orphans exactly as documented.
+- `migrate-check`/`migrate-apply` reliable for a third consecutive session
+  (15.9 s and 14.7 s, faster than either previous round).
+
+## `R-01` — New, Precise Evidence: The Hang Happened Before The Rules Phase
+
+One of four `spring-audit` runs hung (200 s, 0 bytes). For the first time the
+process left a record:
+
+```json
+{"argv": ["spring-audit", ".", "--compact"],
+ "started_at": 1788411595.5325525,
+ "last_phase": "applying all rules over 3342 Java files [population=production_java_sources]",
+ "phase_entered_at": 1788411734.8912373,
+ "last_stage": null, "stage_entered_at": null}
+```
+
+`1788411734.89 − 1788411595.53 = 139.36 s` spent **before** the run entered
+the phase that holds the rules — roughly 70 % of the time it lived. The stderr
+heartbeat agrees: two warnings naming `auditing 3342 Java files` at one and
+two minutes, then `applying all rules … for 41.4s` at three. On the successful
+runs of the same session the same stretch took ~72.7 s in total, so this was
+not a slow phase, it was an outlier by a factor the bisection never saw.
+
+Two readings follow, and they belong to different owners:
+
+**The auditor's inference is refutable in source.** They suspected the new
+`seeds()` pre-index shipped for `SEC-010` had moved the cost earlier.
+It cannot have: `_http_input_query_sinks` is called from `SEC-010`'s
+`analyze`, which runs inside the `security_rules` phase — that is, *inside*
+"applying all rules", after the point their marker recorded. What lives in the
+139 s is the phase before it: the CIR build, the XML security-configuration
+scan and the start of the semantic model, all published under one heartbeat
+label.
+
+**Their evidence exposes a real defect in the marker.** `last_stage: null`
+should not have happened: the run was in a phase whose stages the heartbeat
+does name (`parsing`, `linking`, `assembling the IR`, `scanning XML security
+configuration`). It is null because stage capture rides on `Progress.work`,
+and the sink that calls it is created only when the heartbeat is *enabled* —
+which it is not off a TTY, in CI, under `NO_COLOR`, or piped through
+`timeout`, which is the field's configuration in every one of these seven
+sessions. The marker's most useful field is therefore blank in exactly the
+environment it was built for. That is ours, and it is the first thing to fix.
+
+The auditor's three instrumentation requests stand and are adopted: split the
+`auditing N Java files` phase into visible sub-stages, publish the pre-index
+as its own timing entry, and repeat the bisection measuring that phase
+separately from the rules phase rather than only the total.
+
+## `R-02` — New: A Complete Answer From A Process That Did Not Exit
+
+```
+timeout -k 5 200 ask verify .
+# rc=124 · 200,183 ms · 5,333 bytes of stdout
+```
+
+Unlike every hang in six previous sessions, this one **produced a full,
+valid answer**: `verdict: "pass"`, `contract_count: 14`,
+`content_id: ca00e3a40668e5bf`, `answer_bounds.complete: true`. The analysis
+finished; the process did not leave. This is a different failure class from
+"no answer": the work is done and the exit is late.
+
+The auditor's own hypotheses — a non-daemon thread outliving the answer (the
+parse worker pool, the heartbeat thread, or the concurrency lease) — are the
+right place to look, and the last of those is this product's own recent
+addition. Verifying that nothing this codebase starts can delay interpreter
+shutdown after the answer is written belongs in the next round.
+
+## Open, Unchanged
+
+`REG-02` (`--agent` fails by default on large repositories: 1,623 MB and
+2,572 MB observed, in the same range as three prior rounds — fourth
+consecutive report with no functional change), `BUG-02`, `BUG-12`, `BUG-09`,
+`BUG-23`. `pack gate --since` and `pack assessment` still do not complete
+inside the auditor's budget, though `pack assessment` now shows granular
+progress (`5/6 components`) where it used to fail with no sign of internal
+movement.
+
+## Verification Boundary
+
+`3/4` and `1/1` are not the 25–30 repetitions per command this ledger's own
+closure criterion requires for `ALT-01`/`ALT-03`. The auditor states plainly
+that `R-01` leaves open the possibility that the bottleneck was moved rather
+than removed. Their recommendation for the next round: repeat this battery at
+that repetition count, and split the phase timings first so the answer is
+attributable when it comes.
+
+## Commercial Position
+
+First report of seven where the auditor recommends *starting to evaluate*
+`spring-audit`/`risk`/`audit-report`/`remediate` as part of a CI gate for this
+repository, with the reservation above. Price raised to **25–30 €/dev/month**
+for the full command set, conditional on the next session sustaining an
+audit-family success rate above 80 %. Upgrade recommended without conditions.