sourcecode 5.9.29__py3-none-any.whl → 5.9.31__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.29"
+__version__ = "5.9.31"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = '6df1bd2436f8b562ee173fbaf7ba499ee783f0f8'
-CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-E': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-614-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-615-07': {'commit': '', 'status': 'uncited'}, 'AUD-615-COLD-COMPACT': {'commit': '', 'status': 'uncited'}, 'AUD-615-DRIFT': {'commit': '', 'status': 'uncited'}, 'AUD-615-E': {'commit': '', 'status': 'uncited'}, 'AUD-615-F': {'commit': '', 'status': 'uncited'}, 'AUD-615-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-615-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-615-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-615-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-616-E-PROV': {'commit': '', 'status': 'uncited'}, 'AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07': {'commit': '', 'status': 'uncited'}, 'AUD-616-INTENT-TIE-COV': {'commit': '', 'status': 'uncited'}, 'AUD-616-JUNIT4-SELF': {'commit': '', 'status': 'uncited'}, 'AUD-616-KOTLIN': {'commit': '', 'status': 'uncited'}, 'AUD-616-O': {'commit': '', 'status': 'uncited'}, 'AUD-616-P': {'commit': '', 'status': 'uncited'}, 'Suite hygiene': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ALT-25`': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`AUD-619-WATCH`': {'commit': '', 'status': 'uncited'}, '`AUD-620-COMMAND-SURFACE`': {'commit': '', 'status': 'uncited'}, '`AUD-620-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`AUD-621-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-13`': {'commit': '', 'status': 'uncited'}, '`BUG-15`': {'commit': '', 'status': 'uncited'}, '`BUG-16`': {'commit': '', 'status': 'uncited'}, '`BUG-21`': {'commit': '', 'status': 'uncited'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`NEW-02` / `BUG-05`': {'commit': '', 'status': 'uncited'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}, '`REG-01`': {'commit': '', 'status': 'uncited'}, '`REG-04`': {'commit': '', 'status': 'uncited'}, '`retrieve security-surface --target`': {'commit': '', 'status': 'uncited'}}
-CLOSURE_COVERAGE = {'closed_rows': 175, 'present': 91, 'absent': 0, 'unresolved': 0, 'uncited': 84, 'unknown': 0}
+BUILD_COMMIT = '1cca45c9b950c882c44b7a21aaad5e230cdddab7'
+CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-E': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-614-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-615-07': {'commit': '', 'status': 'uncited'}, 'AUD-615-COLD-COMPACT': {'commit': '', 'status': 'uncited'}, 'AUD-615-DRIFT': {'commit': '', 'status': 'uncited'}, 'AUD-615-E': {'commit': '', 'status': 'uncited'}, 'AUD-615-F': {'commit': '', 'status': 'uncited'}, 'AUD-615-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-615-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-615-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-615-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-616-E-PROV': {'commit': '', 'status': 'uncited'}, 'AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07': {'commit': '', 'status': 'uncited'}, 'AUD-616-INTENT-TIE-COV': {'commit': '', 'status': 'uncited'}, 'AUD-616-JUNIT4-SELF': {'commit': '', 'status': 'uncited'}, 'AUD-616-KOTLIN': {'commit': '', 'status': 'uncited'}, 'AUD-616-O': {'commit': '', 'status': 'uncited'}, 'AUD-616-P': {'commit': '', 'status': 'uncited'}, 'Suite hygiene': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ALT-08` (arithmetic half)': {'commit': '', 'status': 'uncited'}, '`ALT-25`': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`AUD-619-WATCH`': {'commit': '', 'status': 'uncited'}, '`AUD-620-COMMAND-SURFACE`': {'commit': '', 'status': 'uncited'}, '`AUD-620-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`AUD-621-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-03` (statement half)': {'commit': '', 'status': 'uncited'}, '`BUG-09`': {'commit': '', 'status': 'uncited'}, '`BUG-10` (Vert.x residual)': {'commit': '', 'status': 'uncited'}, '`BUG-13`': {'commit': '', 'status': 'uncited'}, '`BUG-13`, `BUG-15`, `BUG-17`, `BUG-21`, `BUG-08`, `BUG-10`/`BUG-23`': {'commit': '', 'status': 'uncited'}, '`BUG-14`': {'commit': '', 'status': 'uncited'}, '`BUG-15`': {'commit': '', 'status': 'uncited'}, '`BUG-16`': {'commit': '', 'status': 'uncited'}, '`BUG-20`': {'commit': '', 'status': 'uncited'}, '`BUG-21`': {'commit': '', 'status': 'uncited'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`NEW-01` (regime row)': {'commit': '', 'status': 'uncited'}, '`NEW-02` / `BUG-05`': {'commit': '', 'status': 'uncited'}, '`R-01-INFLIGHT` (stage capture)': {'commit': '', 'status': 'uncited'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}, '`REG-01`': {'commit': '', 'status': 'uncited'}, '`REG-04`': {'commit': '', 'status': 'uncited'}, '`SEC-010` cost': {'commit': '', 'status': 'uncited'}, '`retrieve security-surface --target`': {'commit': '', 'status': 'uncited'}}
+CLOSURE_COVERAGE = {'closed_rows': 185, 'present': 91, 'absent': 0, 'unresolved': 0, 'uncited': 94, 'unknown': 0}

sourcecode/_docs/DEFECT-LEDGER.md

@@ -14,6 +14,76 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — Release `5.9.30`, nine rows worked on the 5.9.29 queue (2026-09-02)
+
+**A full pass over the open queue from the two 5.9.29 audits, one commit per
+row, batteries run against every change.** Nine rows closed or materially
+narrowed; two — `R-02` and the `pack assessment` default — investigated and
+left open with the reasoning recorded, rather than guessed at.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `R-01-INFLIGHT` (stage capture) | High | **closed** | `Progress.work()`'s sink was built only when the visible heartbeat was *enabled* — false off a TTY, in CI, under `NO_COLOR`, and piped through `timeout`, the field's configuration in all seven sessions. `_work_sink`/`_rule_pass_progress` now build the sink whenever a `Progress`/deadline object exists at all: `Progress.work()` is cheap regardless of whether it prints (a lock, a tuple compare, `_beat()`'s own internal `enabled` check), so an unwatched run's hang now records its stage exactly as a watched one does. Two invariant tests that pinned the old contract are updated to the corrected one; two new tests assert the unwatched case directly. |
+| `R-02` (the process does not exit) | High | **one confirmed instance fixed, not proven to be the field's exact mechanism** | Auditing every background thread and process pool in this codebase found one genuine defect of this shape: the root `ask` command's async cache write started a `daemon=True` thread — specifically so an unfinished write could not hold up exit — and then registered `atexit.register(_cache_write_thread.join, 30.0)`, re-joining it anyway. Removed. `verify` itself does not go through this code path, so this is not asserted to be the auditor's exact mechanism; it is a real, independently confirmed instance of the same failure class, fixed on the same principle the codebase already states elsewhere (`parse_cache._delete_behind`): a daemon thread's unfinished work costs the next run a cache miss, not the caller a wait after their answer already arrived. |
+| `BUG-14` | High | **closed** | Same class as `BUG-13`, the pattern named by request: `plan TARGET [PATH]` read a lone positional as the change target, leaving `path` at its default `.` — over a workspace of nested repositories, that drove a full IR build with no validation. The same nested-repository guard now refuses before any build starts, naming the count, with `--allow-nested`, and the hint explicitly names the grammar confusion (`plan` reads a lone argument as the target, not the repository). |
+| `BUG-01` | Critical maximum | **widened, closed for `endpoints`** | `build_repo_ir` already detected a file whose extracted symbols are not trustworthy and published it as `parse_failures`; `extract_java_endpoints` parses the same sources through its own independent loop and never ran that check. The exact field shape (`total: 1`, one file silently missing) had no honesty pattern to catch it — `zero_result_reason` only fires when the whole answer is empty. `_parse_health_row` is now the one authority both extractors call (`build_repo_ir`'s own behaviour verified byte-identical against its existing battery); `endpoints` publishes `parse_failures`/`parse_failures_basis` whenever non-empty, at any total. |
+| `NEW-01` (regime row) | High | **closed** | 103/103 across four consecutive external rounds was never going to be closed by a fifth measurement — the ask was the product's own guarantee. `tests/test_new01_silent_empty_success_regime.py` runs the real CLI dispatch (not the guard functions mocked in isolation, which a separate existing file already covers) across the whole `REQUIRED_ANSWER_COMMANDS` population against a real fixture repository, and fails if any of them ever reports success with nothing behind it — verified non-vacuous before committing (5 of 6 commands exit 0 with 10-27 KB real payloads on the fixture; `verify` exits its own documented 2 for no contracts declared). |
+| `BUG-03` (statement half) | High | **closed** | The merge-half fix (previous round) already made every audit-family surface correctly classify a majority non-Spring stack as `fit: "partial"` — verified end to end on struts (1,488 Java files, 5 beans) across `spring-audit`, `risk`, `posture` and `audit-report` (inherits it via the other two). What the audit's "mismo stack_fit.statement sin proporción" still named: the statement said only "marginal" in prose, with the raw counts published beside it but not divided for the reader. It now states the density directly — "5 of 1488 Java files carry a Spring bean (0.34%)" — and a `spring_density_pct` field carries the same number for a machine reader, published only on the partial branch. |
+| `BUG-20` | Low | **closed** | The `--detach` envelope's `output` field carried whatever string the operator typed, with nothing saying which directory it was relative to — unusable from outside that invocation's shell. `_resolved_output_path` joins a relative path against the invocation's own root with `.absolute()`, not `.resolve()`: it states where the path points without canonicalising symlinks nobody asked to have normalised away, which is also what keeps the existing detach battery's exact-path assertions passing on macOS (`/var/...` vs `/private/var/...`). |
+| `BUG-09` | Medium | **closed** | AUD-597-D06 unified three repository-flag spellings across the catalogue, but its mechanism only ever moved an alias into an empty *positional* slot. `compare`'s repository is the declared option `--path`, not a positional, so `compare A B --repo <r>` was never recognised — four rounds hit this exact repro. `_normalise_repository_option_flag` covers the second shape: where a command declares its repository as an option named `path`/`repo`/`dir`, any other alias is rewritten to the declared one, in place, with the same duplicate-spelling guard the positional case already has. |
+| `BUG-10` (Vert.x residual) | Medium | **closed for Vert.x; Ktor stays out of scope** | The one repository of eleven left with only the generic disclaimer: Vert.x's Router is a fluent call chain (`router.get("/x").handler(...)`) with no `@` anywhere, structurally invisible to the annotation-shaped evidence rule. A second, equally vendor-neutral rule now catches it — an HTTP-verb method called with one path-like literal, chained into a handler-attachment call — guarded against firing on unrelated code (`Map.get("/key")` with no handler chain, a bare `.route().handler()` with no path). Ktor's routing DSL lives in `.kt` files, which this extractor never reads; extending file discovery to a second language is a different, larger change than this row. |
+| `pack assessment` default | — | **investigated, left unchanged, reasoning recorded** | Reproduced on spring-petclinic: the unbounded default is 68.5K estimated tokens (over the 50K ceiling), `--compact` brings it to 35KB (well under). `--compact` genuinely bounds it — this was AUD-600-B02's own fix, verified still holding. The unbounded default measuring 2.29M tokens on a larger repository (that round's own number) makes clear the full report is a deliberately unbounded, opt-in answer, not an oversight: flipping the default would need a `--compact/--no-compact` toggle pair (today only `--compact` is declared) and would change behaviour for every existing caller who relies on the current default producing the full report on a repository small enough not to hit the ceiling. Left as a product-default question rather than changed unilaterally. |
+
+Suite: run in full after the batch, same population as the last recorded
+green run — see the commit history for the exact count. One vacuous
+assertion introduced earlier in the session by this same battery (`or True`
+in a stage-capture test) was caught by the suite's own mutation-testing
+battery and fixed in the same pass, not left for an eighth round to find.
+
+## Current Synchronization — Two audits of `5.9.29`: the audit family answers, and the marker's own gap (2026-09-02)
+
+**Both lineages report the release positively and neither found a regression.**
+The multi-repository round scores **8.5/10** (8.4 for 5.9.28, from 8.1) and
+calls 5.9.29 a consolidation: nothing closed, nothing regressed, and the
+coverage sweep byte-identical to the previous session across eleven
+repositories — the 5.9.26–5.9.28 corrections hold under repetition rather than
+being one-build accidents. The native-Windows round scores **7.8/10**, its
+largest jump in seven, and reports the sentence six sessions could not
+produce: **all six audit-family commands answered.** `spring-audit` 3/4,
+`verify` 2/2, `risk` 1/1 and `audit-report` 1/1 (both firsts in six sessions),
+`migrate-check`/`migrate-apply` 1/1 each, `remediate` 1/1 at 74,8 s after two
+rounds of hanging. Full evidence:
+[`AUDIT-2026-09-02-ALTERNATIVE-5.9.29.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.29.md)
+and [`AUDIT-2026-09-02-EXTERNAL-5.9.29.md`](AUDIT-2026-09-02-EXTERNAL-5.9.29.md).
+
+**The `SEC-010` work is confirmed from the field, with their numbers:** three
+successive runs, one `content_id` (`4a0429c7784da360`), 385 findings each, and
+the family's own clock falling 42,8 → 25,4 → 20,0 s as the cache warmed. The
+command went 73,9 → 46,9 → 35,9 s. `selftest` rose from 1/12 to 6/12 passing
+rows on the same deadline.
+
+**And the in-flight marker did its job on the first try — including against
+us.** It captured a hang, and what it captured contradicts part of what this
+ledger assumed. See `R-01` below.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `R-01` (phase attribution) | Critical maximum | **open, sharpest evidence in seven rounds** | The marker on the one hung run: `started_at` 1788411595,53 and `phase_entered_at` 1788411734,89 — **139,36 s spent before the run reached "applying all rules"**, about 70 % of the time it lived, with the stderr heartbeat agreeing (two warnings naming `auditing 3342 Java files`, then the rules phase for 41,4 s). The successful runs of the same session covered that whole stretch in ~72,7 s. The auditor's inference that the new `seeds()` pre-index moved the cost earlier is **refutable in source**: `_http_input_query_sinks` is called from `SEC-010`'s `analyze`, inside the `security_rules` phase — after the point their marker recorded. What sits in those 139 s is the CIR build, the XML security-configuration scan and the start of the semantic model, all published under one heartbeat label. Required work, adopted from their three requests: split that phase into visible sub-stages, publish the pre-index as its own timing entry, and repeat the bisection measuring that phase separately from the rules phase rather than only the total. |
+| `R-01-INFLIGHT` (stage capture) | High | **open, defect in what 5.9.29 shipped, found by their evidence** | Their capture reads `last_stage: null` for the ~60 s the run spent in the rules phase, and null through the 139 s before it — in a phase whose stages the heartbeat does name. The cause is ours: stage capture rides on `Progress.work`, and the sink that calls it is built only when the heartbeat is **enabled**, which it is not off a TTY, in CI, under `NO_COLOR`, or piped through `timeout` — the field's configuration in all seven sessions. The marker's most useful field is therefore blank in exactly the environment it was built for. Closure: record the stage regardless of whether anything is watching. |
+| `R-02` (the process does not exit) | High | **open, new failure class** | `timeout -k 5 200 ask verify .` returned `rc=124` with **5 333 bytes of a complete, valid answer** — `verdict: pass`, `contract_count: 14`, `content_id: ca00e3a40668e5bf`, `answer_bounds.complete: true`. Six sessions of hangs produced 0 bytes; this one finished the work and did not leave. Distinct from `ALT-01`/`ALT-03` and to be tracked apart: the analysis is not the problem here, the exit is. Candidates, one of them this product's own recent addition: a non-daemon thread outliving the answer — the parse worker pool, the heartbeat thread, or the concurrency lease. Closure: prove nothing this codebase starts can delay interpreter shutdown after the answer is written. |
+| `SEC-010` cost | Medium | **closed 5.9.29, confirmed in the field** | Three runs, identical `content_id`, 42,8 → 25,4 → 20,0 s with the cache warming. The warm-path benefit the product promised and no session had observed. |
+| `ALT-08` (arithmetic half) | Low | **closed, field verification received** | `ask prepare-context review-pr` — the correct command this time — gives `final_size_bytes: 93 462`, matching `len(json.dumps(payload without _meta))` byte for byte. |
+| `ALT-01` / `ALT-03` | Critical maximum | **open, materially narrowed** | 3/4 and six families answering is the best measurement of seven rounds and is not the 25–30 repetitions per command this ledger requires. `R-01` above leaves open that the bottleneck was moved rather than removed, and this ledger does not close a row on a hypothesis it has just been given evidence against. |
+| `NEW-01` (regime row) | High | **open, and the request is not for more measurement** | 103/103 across four consecutive versions in the multi-repository lineage. What is asked for is the product's own guarantee: the explanation of what fixed it, published in this ledger, plus an automated regime assertion, so closure stops depending on a recurring external audit. |
+| `BUG-14` | High | **open, fourth round, fix pattern already exists here** | `ask plan <repo>` still hangs to an external kill at 45 s with an empty stderr, because a repository path is accepted where the signature reads `TARGET [PATH]`. Same class as `BUG-13`, which 5.9.28 closed by validating before starting, counting what it found and offering `--allow-nested`. The auditor asks for that pattern, by name, on this row. |
+| `BUG-01` | Critical maximum | **open, and the honesty pattern needs widening** | A file with a parse error still disappears with no signal (`total: 1`, only `/ok`). `zero_result_reason` fires only at `total: 0`, so the disclosure that closed `BUG-10` does not reach this shape. Required: name files excluded by a parse failure at **any** total, not only when the answer is empty. |
+| `BUG-10` (routing DSL residual) | Medium | **partially closed, residual named** | `unmodeled_routing_evidence` verified across 11 repositories (198 files of Micronaut annotations, 52 of Servlets, 6 of `@Route`/`@WebSocket`) and `null` where a repository has endpoints. A fluent router DSL carries no annotation and no path literal, so it yields neither evidence nor a declared gap — one repository of eleven is left with the generic disclaimer alone. |
+| `REG-03` | Medium | **the auditor retracts their own claim** | The warm-path delta went −22,4 % → −9,2 % → **+24,0 %** on the same pair of consecutive invocations while absolute cold time fell 69,1 → 21,9 s. Their conclusion: system load at the moment of measurement dominates this metric, not ASK's cache state, and their 5.9.27 report of *the first real warm-cache gain ever observed* is withdrawn to "possible, not confirmed". Recorded here because a retraction by the party who made the claim is evidence, and because this product must not quote that figure as a benchmark either. |
+| `REG-02` | Critical | **open, fourth consecutive round** | `--agent` fails by default on large repositories (1 623 MB and 2 572 MB observed, same range as three prior rounds, no trend either way). |
+| `BUG-16` | Medium | **disclosure closed, size open** | The eviction contracts shipped in 5.9.29 are confirmed present through `cache status`. What the auditor still records is the size: 2,4 GB total, 1,8 GB of it the context cache. The contract this product publishes for that store is entry count and age, not bytes — which is honest and is also why the store can be this large. Whether it should have a byte budget is the open half. |
+| `BUG-13`, `BUG-15`, `BUG-17`, `BUG-21`, `BUG-08`, `BUG-10`/`BUG-23` | — | **closed, stable under repetition** | Re-verified across four to five consecutive versions with no sign of relapse, and byte-identical coverage figures between the last two sessions. |
+| `BUG-09`, `BUG-11`, `BUG-20`, `BUG-02`, `BUG-12`, `BUG-03` | — | **open, unchanged** | Flag vocabulary, `pack assessment` returning `OUTPUT_TOO_LARGE` by default (now with granular progress where it used to fail silently), an unresolved POSIX path under `--detach`, and the three rows that need the field's own large repository. |
+
 ## Current Synchronization — Release `5.9.29`, hardening pass and a green suite (2026-09-02)
 
 **The suite is green — 13 748 tests, 0 failures — for the first time in

sourcecode/_docs/USER_GUIDE.md

@@ -279,7 +279,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.29
+# ask 5.9.31
 ```
 
 Requires Python 3.9+.

sourcecode/cli.py

@@ -1206,6 +1206,71 @@ def _leaf_for_args(args: "list[str]") -> "tuple[Any, int]":
         return None, 0
 
 
+def _normalise_repository_option_flag(
+    args: "list[str]", *, leaf: Any, consumed: int, declared: "set[str]"
+) -> "Optional[list[str]]":
+    """BUG-09: the other shape AUD-597-D06 named and did not yet cover.
+
+    That row's own docstring lists three conventions — a positional (most of
+    the catalogue), `--path` (`compare`), `--repo` (the ref forms of `delta`
+    and `contract-diff`) — and the mechanism below it only ever reconciles
+    the *first* against the other two: it moves an alias into an empty
+    *positional* slot. `compare`'s repository is not positional, it is the
+    option `--path` itself, so `compare A B --repo <r>` was never a spelling
+    the rewrite recognised — `--repo` was simply not one of `compare`'s
+    declared options, and Click refused it as such, four audit rounds
+    running.
+
+    Where the command's repository lives in a declared OPTION named
+    `path`/`repo`/`dir` (Click infers the option's `param.name` from the
+    Python parameter the same way it does for a positional), any *other*
+    alias spelling typed by the caller is rewritten in place to the one this
+    command declares — in place, because unlike the positional case there is
+    no slot to move the value into, only a flag token to rename beside the
+    value that already follows it.
+    """
+    option_slot = next(
+        (
+            param for param in (getattr(leaf, "params", None) or ())
+            if not is_argument(param)
+            and str(getattr(param, "name", "")) in _REPOSITORY_ARGUMENT_NAMES
+        ),
+        None,
+    )
+    if option_slot is None:
+        return None
+    canonical = next(
+        (a for a in _REPOSITORY_OPTION_ALIASES if a in declared), None
+    )
+    if canonical is None:
+        return None
+    other_aliases = [
+        a for a in _REPOSITORY_OPTION_ALIASES if a != canonical and a not in declared
+    ]
+    if not other_aliases:
+        return None
+
+    rest = args[consumed:]
+    if any(token.partition("=")[0] == canonical for token in rest):
+        # The command's own spelling is already there — a second one is a
+        # duplicate to refuse, not a spelling to accept, matching the
+        # positional guard's own "every slot already named" rule.
+        return None
+
+    rewritten = False
+    out: "list[str]" = []
+    for token in rest:
+        name, sep, inline = token.partition("=")
+        if not rewritten and name in other_aliases:
+            out.append(canonical + (sep + inline if sep else ""))
+            rewritten = True
+            continue
+        out.append(token)
+    if not rewritten:
+        return None
+    return args[:consumed] + out
+
+
 def _normalise_repository_option(args: "list[str]") -> "list[str]":
     """`--path <repo>` on a command that takes the repository positionally.
 
@@ -1236,7 +1301,12 @@ def _normalise_repository_option(args: "list[str]") -> "list[str]":
         str(getattr(param, "name", "")) in _REPOSITORY_ARGUMENT_NAMES
         for param in slots
     ):
-        return args  # nothing here means "the repository"
+        # Not a positional-repository command — try the declared-option shape
+        # (`compare --path`) before giving up on this command entirely.
+        _flag_rewrite = _normalise_repository_option_flag(
+            args, leaf=leaf, consumed=consumed, declared=declared
+        )
+        return args if _flag_rewrite is None else _flag_rewrite
 
     aliases = [a for a in _REPOSITORY_OPTION_ALIASES if a not in declared]
     if not aliases:
@@ -2937,10 +3007,22 @@ def _work_sink(prog: Any) -> Any:
     waiting for — `phase=auditing 3342 Java files elapsed=6.8m` for 6,8 minutes,
     with no denominator and no rate. The counts can only come from the loop doing
     the work, so the analysis is given a sink rather than the spinner being given
-    a guess. `None` when nothing is watching, which keeps the build's inner loop
-    exactly as it was for every run that is not printing a heartbeat.
+    a guess. `None` only when there is no `Progress` object at all (no command
+    context to attribute counts to).
+
+    R-01-INFLIGHT (5.9.29 re-audit). This used to also return `None` when the
+    heartbeat was disabled — off a TTY, in CI, under `NO_COLOR`, piped through
+    `timeout` — which is the field's configuration in every one of seven
+    sessions. That made `Progress.work()` unreachable on exactly the runs the
+    in-flight marker exists to diagnose, so a captured hang read
+    `last_stage: null` even mid-phase, in a phase whose sub-stages
+    (`parsing`, `linking`, `assembling the IR`, `scanning XML security
+    configuration`) the heartbeat already names. `prog.work()` is cheap by
+    construction — a lock, a tuple compare, and `_beat()`'s own `enabled` check
+    — so calling it unconditionally costs nothing extra on a watched run and
+    gives an unwatched one the same forensic stage capture.
     """
-    if prog is None or not getattr(prog, "enabled", False):
+    if prog is None:
         return None
 
     def sink(done: int, total: int, stage: str) -> None:
@@ -2982,26 +3064,35 @@ def _rule_pass_progress(
     """
     from sourcecode.rule_pass import RulePassProgress
 
-    watching = prog is not None and getattr(prog, "enabled", False)
-    if not watching and stop_when is None:
+    # R-01-INFLIGHT (5.9.29 re-audit). `sink`/`detail_sink` used to be built
+    # only when a heartbeat was actively watching, so a family's stage detail
+    # (`SEC-010: parsing callees 129/772 files`) never reached `prog.work()`
+    # on an unwatched run — exactly the field's configuration. `prog.work()`
+    # is cheap regardless of whether it prints, so the sinks are built
+    # whenever a `Progress` object exists at all; `stop_when` already forced
+    # this object into existence for the deadline's sake, and now the same
+    # object also gives an unwatched run's hang its forensic stage.
+    if prog is None and stop_when is None:
         return None
 
     def sink(done: int, total: int, rule_id: str) -> None:
-        prog.work(
-            done, total,
-            stage=f"{stage} ({rule_id})",
-            unit=unit,
-            estimate=False,
-        )
+        if prog is not None:
+            prog.work(
+                done, total,
+                stage=f"{stage} ({rule_id})",
+                unit=unit,
+                estimate=False,
+            )
 
     def detail_sink(done: int, total: int, label: str, detail_unit: str) -> None:
         # C3-79: inside a family the units *are* comparable to each other — files
         # are files — so the ETA is allowed here, unlike the family counter above.
-        prog.work(done, total, stage=f"{stage} ({label})", unit=detail_unit)
+        if prog is not None:
+            prog.work(done, total, stage=f"{stage} ({label})", unit=detail_unit)
 
     return RulePassProgress(
-        sink=sink if watching else None,
-        detail_sink=detail_sink if watching else None,
+        sink=sink if prog is not None else None,
+        detail_sink=detail_sink if prog is not None else None,
         stop_when=stop_when,
     )
 
@@ -4806,10 +4897,19 @@ def _get_command_with_preprocessing(typer_instance: Any) -> Any:
         started = time.monotonic()
         command = _telemetry_command(args)
         success = True
+        error_kind = None
         try:
             return _orig_cmd_main(args=args, **kwargs)
-        except BaseException:
+        except SystemExit as exc:
+            # Click uses SystemExit(0) even after successful CLI/MCP calls.
+            # Preserve its exit while recording the outcome, not the exception.
+            success = exc.code is None or exc.code == 0
+            if not success:
+                error_kind = type(exc).__name__
+            raise
+        except BaseException as exc:
             success = False
+            error_kind = type(exc).__name__
             raise
         finally:
             try:
@@ -4821,6 +4921,7 @@ def _get_command_with_preprocessing(typer_instance: Any) -> Any:
                     flags=_telemetry_flags(args),
                     duration_s=time.monotonic() - started,
                     success=success,
+                    error_kind=error_kind,
                 )
             except Exception:
                 pass
@@ -7618,10 +7719,27 @@ def main(
             if os.environ.get("SOURCECODE_CACHE_SYNC") in ("1", "true", "yes"):
                 _write_cache_async()
             else:
-                import atexit as _atexit
+                # R-02 (5.9.29 re-audit): this used to register
+                # `atexit.register(_cache_write_thread.join, 30.0)` — a
+                # blocking join on a thread the two lines above deliberately
+                # made `daemon=True` so it would NOT hold up exit. The field
+                # measured a `verify` invocation that wrote a complete, valid
+                # answer to stdout and was still killed by an external
+                # 200-second timeout: the work was done, the process would
+                # not leave. A daemon thread that gets re-joined at atexit is
+                # not asynchronous, it is synchronous with extra steps, on
+                # exactly the machine where a slow disk or a contended cache
+                # directory (the customer's own R-01 environment) makes that
+                # 30-second bound real rather than theoretical. The comment
+                # above already states the intent — "low-latency asynchronous
+                # path for ordinary analysis" — this now matches it: if the
+                # write has not landed by the time the interpreter tears
+                # down, it is lost, same as any other daemon thread's
+                # unfinished work, and the next run pays a cache miss instead
+                # of the caller paying an unexplained wait after their answer
+                # already arrived.
                 _cache_write_thread = _threading.Thread(target=_write_cache_async, daemon=True)
                 _cache_write_thread.start()
-                _atexit.register(_cache_write_thread.join, 30.0)
 
     # Update RIS with aggregated snapshot data (non-fatal side-effect).
     # Update RIS whenever git is available, even when L1/L2 cache is skipped
@@ -10987,6 +11105,11 @@ def plan_cmd(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
     ),
+    allow_nested: bool = typer.Option(
+        False, "--allow-nested",
+        help="Run anyway when the implicit `.` covers nested Git repositories "
+             "(BUG-14, same class as BUG-13). The default refuses.",
+    ),
     format: str = _format_option(help="Output format: json (default) or yaml."),
     copy: bool = _copy_option(),
     progress_mode: Optional[str] = _progress_option(),
@@ -11015,6 +11138,37 @@ def plan_cmd(
 
     target_dir = _admit_path(path, usage="ask plan <target> <path>")
 
+    # BUG-14, same class as BUG-13. `plan TARGET [PATH]` took a single
+    # positional argument in the field (`ask plan spring-petclinic`) and
+    # Click's grammar consumed it as `target`, silently leaving `path` at its
+    # default `.` — over a workspace of 31 nested Git repositories, that
+    # implicit `.` drove a full IR build over the whole workspace with no
+    # validation, and the field cut it at 45s with an empty stderr, nothing
+    # this product's own guard for `selftest` would have allowed. The same
+    # guard applies here: an implicit `.` that covers nested repositories is
+    # refused before any expensive work starts, with the same escape hatch.
+    if str(path) == ".":
+        from sourcecode.selftest import nested_repository_count
+
+        _nested = nested_repository_count(target_dir)
+        if _nested and not allow_nested:
+            _emit_error_json(
+                INVALID_USAGE_CODE,
+                f"plan refuses an unscoped run: the implicit `.` covers "
+                f"{_nested} nested Git repository(s), so the change plan "
+                f"would build its IR over a workspace rather than a "
+                f"repository.",
+                hint=(
+                    "Pass the repository explicitly (`ask plan <target> "
+                    "<path/to/repo>`), or `--allow-nested` to run over the "
+                    "workspace on purpose. If `<target>` was meant to name "
+                    "the repository, `plan` reads it as the change target — "
+                    "the repository is the second, optional argument."
+                ),
+                nested_repositories=_nested,
+            )
+            raise typer.Exit(code=2)
+
     from sourcecode.context_graph import ContextGraph
     from sourcecode.change_plan import build_change_plan
     from sourcecode.repository_ir import find_java_files

sourcecode/detach.py

@@ -152,6 +152,26 @@ def output_path_of(args: "list[str]") -> Optional[str]:
     return None
 
 
+def _resolved_output_path(args: "list[str]", *, root: Path) -> Optional[str]:
+    """`output_path_of`, made absolute against the invocation's own directory.
+
+    BUG-20: a relative `--output` (the common case, typed from wherever the
+    operator happened to be) came back in the envelope exactly as given —
+    "output.json", never "which directory". A caller reading the envelope
+    back from outside that shell (a monitoring script, a different working
+    directory, a log shipped elsewhere) had a string it could not use.
+    `.absolute()`, not `.resolve()`: this states where the path points
+    without also canonicalising symlinks the caller never asked to have
+    normalised away — the two shapes a detached run needs are "usable from
+    anywhere" and "still the path that was typed," not "the same inode's
+    other name."
+    """
+    raw = output_path_of(args)
+    if raw is None:
+        return None
+    return str((root / Path(raw)).absolute())
+
+
 def run_detached(args: "list[str]", *, root: Path) -> dict:
     """Start `args` (already free of the flag) detached; return the envelope."""
     stamp = f"{int(time.time())}-{os.getpid()}"
@@ -168,7 +188,7 @@ def run_detached(args: "list[str]", *, root: Path) -> dict:
         "pid": pid,
         "broke_away_from_parent_job": broke_away,
         "log": str(log_path),
-        "output": output_path_of(args),
+        "output": _resolved_output_path(args, root=root),
         "how_to_read": (
             "The analysis runs in a process that does not belong to this shell. "
             "Its answer appears at `output` when it finishes; a `.partial` file "

sourcecode/non_coverage.py

@@ -558,15 +558,26 @@ def stack_fit(
     beans = int(footprint.get("spring_beans") or 0)
     java_files = int(footprint.get("java_files") or 0)
     if spring_detected and java_files and beans / java_files < 0.1:
+        # BUG-03 (5.9.29, statement half): the machine-readable ratio was
+        # already published in `spring_footprint`, but the sentence a reader
+        # actually reads said only "marginal" — an auditor who read the prose
+        # and not the two raw integers beside it could not tell 9,9 % from
+        # 0,03 % apart, both of which take this branch. The density is now
+        # stated in the sentence itself, not left for the reader to divide.
+        _density_pct = round(100 * beans / java_files, 2)
         return {
             "schema_version": STACK_FIT_SCHEMA,
             "spring_detected": True,
             "fit": "partial",
             "spring_footprint": {"spring_beans": beans, "java_files": java_files},
+            "spring_density_pct": _density_pct,
             "statement": (
-                "Spring is present but marginal in this scope, so Spring-shaped axes "
-                "model only the detected Spring population. Do not read their absence "
-                "of findings as coverage of the remaining repository."
+                f"Spring is present but marginal in this scope — {beans} of "
+                f"{java_files} Java files carry a Spring bean ({_density_pct:g} %), "
+                "under the 10 % floor this axis treats as coverage — so "
+                "Spring-shaped axes model only the detected Spring population. Do "
+                "not read their absence of findings as coverage of the remaining "
+                "repository."
             ),
             "how_to_read": "Use Spring results for the detected Spring population only.",
         }

sourcecode/release_info.py

@@ -27,7 +27,7 @@ from typing import Any, Optional
 #: The date `__version__` was released, from that version's CHANGELOG entry.
 #: `tests/test_release_info.py` fails the build if the two disagree, so this is
 #: a copy of a fact rather than a second authority for it.
-RELEASE_DATE = "2026-09-02"
+RELEASE_DATE = "2026-09-12"
 
 #: Releases per day, measured over the latest 30 CHANGELOG releases (the same
 #: computation the test re-runs). The nine-day interval before 5.9.0 lowers

sourcecode/repository_ir.py

@@ -2642,6 +2642,61 @@ def _mask_java(text: str) -> str:
     return ''.join(out)
 
 
+
+def _parse_health_row(
+    rel_path: str, source: str, symbols: "list[Any]"
+) -> "Optional[dict]":
+    """One verdict on whether *rel_path*'s extracted symbols are trustworthy.
+
+    BUG-01. Shared by every extractor that reads Java source into symbols —
+    `build_repo_ir` and `extract_java_endpoints` chief among them — so a file
+    with a syntax error cannot be named as a parse failure on one surface and
+    vanish silently on another. Returns a `parse_failures`-shaped row, or
+    `None` for a clean file.
+
+    Two shapes, in order:
+
+    1. A type declaration (`class`/`interface`/`enum`/`record`) that yielded
+       zero symbols at all — `type_declaration_produced_no_symbols`.
+    2. A file that DID yield symbols, but whose brace or paren count is
+       unbalanced once literals and comments are masked out — meaning the
+       extractor's regex-based recovery stopped somewhere the reader cannot
+       see. Brace balance alone misses a missing `;` or a missing `)` on a
+       method signature (both still extract a clean class+method pair with
+       balanced braces); the paren check catches that second shape without a
+       real Java grammar, because a parameter or argument list that never
+       closes is invalid Java regardless of what the braces do.
+    """
+    if not symbols and _TYPE_DECL_KEYWORD_RE.search(source):
+        from sourcecode.reconciliation import declares_java_type
+
+        if declares_java_type(_mask_java(source)):
+            return {
+                "path": rel_path,
+                "status": "failed",
+                "reason": "type_declaration_produced_no_symbols",
+            }
+        return None
+    if symbols and (
+        source.count("{") != source.count("}")
+        or source.count("(") != source.count(")")
+    ):
+        _masked_src = _mask_java(source)
+        if _masked_src.count("{") != _masked_src.count("}"):
+            return {
+                "path": rel_path,
+                "status": "recovered",
+                "reason": "unbalanced_braces",
+            }
+        if _masked_src.count("(") != _masked_src.count(")"):
+            return {
+                "path": rel_path,
+                "status": "recovered",
+                "reason": "unbalanced_parens",
+            }
+    return None
+
+
 def _located_body(raw_lines: list[str], start_idx: int) -> tuple[str, list[tuple[int, int]]]:
     """Like `_method_body`, but returns (masked_body, line_map) where `line_map[k]`
     = (source_line_1based, col_offset) is the absolute coordinate of column 0 of the
@@ -6816,50 +6871,19 @@ def build_repo_ir(
             elif _previous != _value:
                 del _repo_constants[_name]
                 _ambiguous_constants.add(_name)
-        # P1-E (parse-coverage reconciliation): a file that declares a type but
-        # yielded zero symbols is silently invisible to the graph. Record the
-        # candidate here (source is already in memory; masking only runs for the
-        # rare zero-symbol file) — the reconciliation rule turns the set into an
-        # analysis_gaps entry at assembly.
-        if not symbols and _TYPE_DECL_KEYWORD_RE.search(source):
-            from sourcecode.reconciliation import declares_java_type
-            if declares_java_type(_mask_java(source)):
+        # BUG-01 (5.9.29 widening): the check below used to live only here,
+        # so a file whose symbols were untrustworthy vanished with a signal
+        # from `spring-audit`/`risk` but with none at all from `endpoints`,
+        # which parses this same source through its own independent loop.
+        # `_parse_health_row` is the one authority both call, so the same
+        # file gets the same verdict on every surface that reads it.
+        _health_row = _parse_health_row(rel_path, source, symbols)
+        if _health_row is not None:
+            if _health_row["reason"] == "type_declaration_produced_no_symbols":
                 _unparsed_type_files.append(rel_path)
-                _parse_failures.setdefault(rel_path, {
-                    "path": rel_path,
-                    "status": "failed",
-                    "reason": "type_declaration_produced_no_symbols",
-                })
-        # E-10: a brace that never closes is not a style question — it means the
-        # symbols recovered from this file stop somewhere the reader cannot see.
-        #
-        # BUG-01 (5.9.25 audit): brace balance alone missed most real syntax
-        # errors — `int x = 5` with a missing `;`, or `void broken( {` with a
-        # missing `)`, both extract a clean class+method symbol pair with
-        # balanced braces, so the file vanished with no disclosure at all. An
-        # unbalanced *paren* count, masked the same way, catches the second
-        # shape cheaply without a real Java grammar: a method or call whose
-        # parameter/argument list never closes is invalid Java regardless of
-        # what its braces do.
-        elif symbols and (
-            source.count("{") != source.count("}")
-            or source.count("(") != source.count(")")
-        ):
-            _masked_src = _mask_java(source)
-            if _masked_src.count("{") != _masked_src.count("}"):
-                _unbalanced_files.append(rel_path)
-                _parse_failures.setdefault(rel_path, {
-                    "path": rel_path,
-                    "status": "recovered",
-                    "reason": "unbalanced_braces",
-                })
-            elif _masked_src.count("(") != _masked_src.count(")"):
+            else:
                 _unbalanced_files.append(rel_path)
-                _parse_failures.setdefault(rel_path, {
-                    "path": rel_path,
-                    "status": "recovered",
-                    "reason": "unbalanced_parens",
-                })
+            _parse_failures.setdefault(rel_path, _health_row)
         _per_file.append((rel_path, package, raw_imports, symbols))
         if "@" in source:
             _parsed_refs = _extract_annotation_type_refs(source, package)
@@ -8315,6 +8339,20 @@ def extract_java_endpoints(
     _ROUTE_LITERAL_ANN_RE = _re.compile(
         r"@(\w+)\s*\(\s*(?:(?:value|path)\s*=\s*)?\"(/[^\"]*)\"",
     )
+    # BUG-10 (residual, 5.9.29): Vert.x's Router is a fluent call chain, not an
+    # annotation — `router.get("/subscriptions").handler(ctx -> …)` — so no
+    # `@`-prefixed evidence rule can ever see it, and it was the one framework
+    # of eleven surveyed that fell through to the bare disclaimer with no file
+    # named. The shape is as vendor-neutral as the annotation rule above: an
+    # HTTP-verb method called with exactly one path-like string literal,
+    # immediately chained into a call this repository's own routers all use to
+    # attach a handler. `route(...)` is included for `Router#route`, which
+    # Vert.x also dispatches on a path before choosing a verb.
+    _ROUTE_LITERAL_CHAIN_RE = _re.compile(
+        r"\.(get|post|put|delete|patch|head|options|route)\s*\(\s*"
+        r"\"(/[^\"]*)\"\s*\)\s*\.\s*"
+        r"(?:handler|blockingHandler|coroutineHandler|produces|consumes)\b"
+    )
     #: The annotations this model already reads. Evidence from one of these is
     #: covered surface, not a gap — the list is an exclusion, never the rule.
     _MODELED_ROUTE_ANNS = frozenset({
@@ -8322,6 +8360,14 @@ def extract_java_endpoints(
         "DeleteMapping", "PatchMapping", "Path", "FeignClient", "RequestLine",
     })
     _unmodeled_routing: "dict[str, list[tuple[str, str]]]" = {}
+    # BUG-01 (5.9.29 widening): this extractor parses every source itself,
+    # independently of `build_repo_ir`, so the same syntax-error shape that
+    # `_parse_health_row` catches there was invisible here — a file could
+    # vanish from `endpoints` with `total: 1` and no signal at all, because
+    # the health check that would have named it only ran on the other
+    # surface. One dict, filled from the same authority, published as
+    # `parse_failures` alongside the routes it could not fully trust.
+    _endpoint_parse_failures: "dict[str, dict]" = {}
 
     # BUG #3 (JobRunr field test): imperative router-DSL routes. Lightweight HTTP
     # frameworks that deliberately avoid Spring/JAX-RS (JobRunr's own dashboard
@@ -8389,12 +8435,13 @@ def extract_java_endpoints(
         # against the endpoints this run produced once the surface is built —
         # a file that shows a path literal and contributes no endpoint is the
         # gap this row is about.
-        for _ann, _literal in _ROUTE_LITERAL_ANN_RE.findall(
-            _strip_java_comments(source)
-        ):
+        _stripped_source = _strip_java_comments(source)
+        for _ann, _literal in _ROUTE_LITERAL_ANN_RE.findall(_stripped_source):
             if _ann in _MODELED_ROUTE_ANNS:
                 continue
-            _unmodeled_routing.setdefault(rel, []).append((_ann, _literal))
+            _unmodeled_routing.setdefault(rel, []).append((f"@{_ann}", _literal))
+        for _verb, _literal in _ROUTE_LITERAL_CHAIN_RE.findall(_stripped_source):
+            _unmodeled_routing.setdefault(rel, []).append((f".{_verb}(…)", _literal))
         # C3-6: this extractor parsed every file itself while `build_repo_ir`
         # read the content-addressed parse cache for the same bytes, so a run
         # that does both — the root `--compact` view builds the summary here and
@@ -8416,6 +8463,9 @@ def extract_java_endpoints(
                 _pkey, _pkg, _imports, symbols,
                 _fstats.get("excluded_statements", 0),
             )
+        _health_row = _parse_health_row(rel, source, symbols)
+        if _health_row is not None:
+            _endpoint_parse_failures.setdefault(rel, _health_row)
         # Cross-file constants for annotation-path folding (see _collect_repo_constants).
         for _cname, _cval in _collect_file_constants(source).items():
             if _cname in _const_ambiguous:
@@ -9190,6 +9240,30 @@ def extract_java_endpoints(
         )
     except Exception:
         pass
+    # BUG-01 (5.9.29 widening): the same authority `build_repo_ir` uses to
+    # name a file whose extracted symbols are not trustworthy — a type
+    # declaration that yielded none, or a brace/paren count that stays
+    # unbalanced after masking comments and literals — publishes here too.
+    # Before this, such a file simply produced no endpoint and nothing said
+    # why: `total: 1, only /ok` for a repository that also has `Bad.java`
+    # read as "this repository exposes one endpoint," not "one file could
+    # not be trusted." Published whenever non-empty, at any total — the
+    # honesty pattern is not only for the zero case.
+    if _endpoint_parse_failures:
+        result["parse_failures"] = [
+            _endpoint_parse_failures[path] for path in sorted(_endpoint_parse_failures)
+        ]
+        result["parse_failures_basis"] = (
+            "Files whose extracted symbols are not fully trustworthy: a type "
+            "declaration that yielded zero symbols, or a brace/paren count "
+            "that stays unbalanced once comments and string literals are "
+            "masked out. `status: \"failed\"` means nothing from the file "
+            "reached this answer; `status: \"recovered\"` means some symbols "
+            "did, but the file's structure past the imbalance is unverified. "
+            "The same check `spring-audit`/`risk` publish under this name — "
+            "one authority for whether a file's symbols can be trusted."
+        )
+
     # BUG-10: reconcile the route-shaped evidence against what this run
     # actually modelled. A file that showed a path literal and produced an
     # endpoint is covered; one that produced none is a routing style this model
@@ -9207,22 +9281,31 @@ def extract_java_endpoints(
     if _unmodeled_files:
         _EVIDENCE_CAP = 10
         _examples = [
-            {"file": rel, "annotation": f"@{ann}", "path_literal": literal}
+            {"file": rel, "marker": marker, "path_literal": literal}
             for rel in sorted(_unmodeled_files)
-            for ann, literal in _unmodeled_files[rel][:1]
+            for marker, literal in _unmodeled_files[rel][:1]
         ]
-        _annotations = sorted({f"@{ann}" for hits in _unmodeled_files.values() for ann, _ in hits})
+        _markers = sorted({marker for hits in _unmodeled_files.values() for marker, _ in hits})
         result["unmodeled_routing_evidence"] = {
             "files": len(_unmodeled_files),
-            "annotations": _annotations,
+            # BUG-10 (residual): the field kept the field name `annotations`,
+            # so it stays, even though the population it names has widened
+            # past annotations — `.get(…)` is a fluent call-chain marker, not
+            # one. `markers` is the same list under a name that admits both.
+            "annotations": _markers,
+            "markers": _markers,
             "examples": _examples[:_EVIDENCE_CAP],
             "basis": (
-                "Files declaring an annotation whose argument is a path-like "
-                "string literal, which produced no entry in this endpoint "
-                "population. The rule names no framework: a path literal on an "
-                "annotation is what a declarative route looks like everywhere. "
-                "This is evidence of routing this model does not read — not a "
-                "route list, and never added to `total`."
+                "Files with route-shaped evidence that produced no entry in "
+                "this endpoint population: either a declarative annotation "
+                "whose argument is a path-like string literal (`@Route(\"/x\")`),"
+                " or an HTTP-verb call chained straight into a handler "
+                "attachment (`.get(\"/x\").handler(…)`, Vert.x's Router). The "
+                "rule names no framework: a path literal is what a declarative "
+                "route looks like, chained into a handler call is what a "
+                "fluent router looks like, in every framework that uses either "
+                "shape. This is evidence of routing this model does not read — "
+                "not a route list, and never added to `total`."
             ),
             **_cap_effect(
                 "unmodeled_routing_examples",
@@ -9312,15 +9395,18 @@ def extract_java_endpoints(
         elif _unmodeled_files:
             # BUG-10: this branch used to say "no recognized routing construct
             # was found" over a repository whose files carry route-shaped
-            # annotations this model does not read. The measurement exists; the
-            # sentence has to state it.
-            _anns = ", ".join(
-                sorted({f"@{ann}" for hits in _unmodeled_files.values() for ann, _ in hits})[:6]
+            # evidence this model does not read. The measurement exists; the
+            # sentence has to state it. Widened (5.9.29) past annotations to
+            # the fluent call-chain marker (`.get(…)`, Vert.x's Router), which
+            # was the one framework of eleven surveyed left with no evidence
+            # at all — only the disclaimer below now applies to it.
+            _markers_seen = ", ".join(
+                sorted({marker for hits in _unmodeled_files.values() for marker, _ in hits})[:6]
             )
             result["zero_result_reason"] = (
                 f"0 endpoints recognized. Searched: {_searched}. "
-                f"{len(_unmodeled_files)} file(s) declare a route-shaped annotation "
-                f"this model does not read ({_anns}) — see "
+                f"{len(_unmodeled_files)} file(s) declare route-shaped evidence "
+                f"this model does not read ({_markers_seen}) — see "
                 f"`unmodeled_routing_evidence`. Do NOT read this as 'no public API': "
                 f"the routing style, not the surface, is what is missing here."
             )

{sourcecode-5.9.29.dist-info → sourcecode-5.9.31.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.29
+Version: 5.9.31
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.29-blue)
+![Version](https://img.shields.io/badge/version-5.9.31-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -290,7 +290,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.29 — and, on a build that has aged,
+ask version                    # ask 5.9.31 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.29.dist-info → sourcecode-5.9.31.dist-info}/RECORD

@@ -1,6 +1,6 @@
-sourcecode/__init__.py,sha256=ZTtz4rDUGfnJRUJYAt8vUocaNXxSi6ZuqV_BZuQrDDo,309
+sourcecode/__init__.py,sha256=aE6bZn3549jPrAPXdSSzOOUcSbTElZNwvDgnf8PkQRw,309
 sourcecode/__main__.py,sha256=qDFVkobwsdZrX0B3stiRqsUNivVpybKO-egzAwCW4xw,165
-sourcecode/_build_commit.py,sha256=bU1cHe7k3Xf05zAnyUJl1qqxlthYqZgX7NGWsEkT8xM,12172
+sourcecode/_build_commit.py,sha256=soR9bluaRLiRQOZKiKG6JgH8eSuPbG1Am0XOse7hd9s,12816
 sourcecode/access_drift.py,sha256=uYD8ipiEAaTnkz0IhG6ujU_KI3LghdY-6ycurs-BZnc,9355
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/analysis_budget.py,sha256=ZuNEboPF8A6GK-_V7WNt92ezgriga7_Rbr-vvSN4UEE,4183
@@ -35,7 +35,7 @@ sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,129
 sourcecode/ci_output.py,sha256=X4NRokWWMRF9Ex8OQrEO2g04GzJ00GDP5zYIoqI9YCc,4625
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=ft1RGPIChvO84q2QMrEH93x1J15AXNWMh26lnxvoRao,26476
-sourcecode/cli.py,sha256=rplsDRtiijKhkwTs7B9xYhZKdSTqDc0BnHQat3oVCTA,980589
+sourcecode/cli.py,sha256=XII7rmrcJA-eN-sMlfLCKP7fUNl83iEXQfP_-Okdyy8,988561
 sourcecode/click_runtime.py,sha256=K2cUdzFhbd6uEUpucWptXE89_z-ZNZGsqgd-34usUXk,1890
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
@@ -63,7 +63,7 @@ sourcecode/defect_identity.py,sha256=XS2VFDImg9NLaRImybKTeyk-CoDSsXmchldg0dwvM7c
 sourcecode/degradation.py,sha256=XmmCjuwSPBi5QX_Ww-0mGYk6Ks1dmVq9T5z3LNPeo7A,19035
 sourcecode/dependency_analyzer.py,sha256=YJ0EECXGrpUWr9CTjQTtSZQfoBWcNQ5ksofZOC6Fv7Q,65835
 sourcecode/deployment_prefix.py,sha256=kPHPT6ZLg6CnMqCp9QwhbNNjDyS0sXAfKlPtSHUMggs,12180
-sourcecode/detach.py,sha256=Otoe7Egcn5Mcl_cRAstXLyDWA5D7dPAhOv39T5fJYpo,8257
+sourcecode/detach.py,sha256=lmymkamQQm_YGl86J9aACgEd5FFfrFEr9Pmws86JECw,9242
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/dynamic_argument_surface.py,sha256=u6zJoY-zChYVw1-SrgiyAq-rUwqMZ5ZqBwLfbPJ_8ng,2960
 sourcecode/empty_answer_diagnostics.py,sha256=VMgR6aGL_1YREuA7KizlIK1pglDDOxn-QsDYIxfVuYE,7294
@@ -108,7 +108,7 @@ sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6a
 sourcecode/migrate_check.py,sha256=jpxjQVruHkxGFIfTD4pnNZmBXKrJcZ6Q5nBtgkfRNmE,172846
 sourcecode/migration_apply.py,sha256=36E9IUq7RbpGVt6RZ8PlSZKgDoEMHorZrXw6UVWPnpw,8692
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
-sourcecode/non_coverage.py,sha256=0voxV7GdEZBaDHKDaw9RjHeb2qH-8ZdAUAOiu71vd8I,31508
+sourcecode/non_coverage.py,sha256=jUXEyIcGldORR5Pi5qlK3f9L_yBu3aMZIx6qJZjrSGA,32264
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/openrewrite_recipe.py,sha256=0pS-61falE6rSfkos2MPnmoDamvoeTT-8Kmj7smj_DI,12987
 sourcecode/output_bounds.py,sha256=BvaRQY5nuytgfNUJHyO7JDLOHuSy0vdjqasISxmxLxI,15516
@@ -143,7 +143,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/reference_facts.py,sha256=mx7H-Ax5y8sKAQHrnJCXlgjkUzqZtQTByv9Zy2lxKQQ,15500
 sourcecode/regress.py,sha256=6rlFP2rsIzVKAA0spJ66To528GyBtnRI2Zg9vAGq8kQ,13264
 sourcecode/regulatory_pack.py,sha256=xVWd8hYg6MjGfkFP8UWcYeLmNMxEk8k2uSbTcnGMbhg,3421
-sourcecode/release_info.py,sha256=vYe0WiVq1H7D5h07cvTfNRXi_43pJK3SC7lcaTQG6pc,5918
+sourcecode/release_info.py,sha256=u-opkkqIN4jnbtXmQVPV35Ga9zvbORXP2w2MHNUbbDg,5918
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/remediation_diff.py,sha256=fGYqPmQF7bO54L8ivztX5PgmW4fVu54gNcG6OEQ192U,9730
 sourcecode/remediation_flow.py,sha256=OFlrNCD2dKw1WlX5cHqVl1yrQZHi2TjCThH8Q3X1PwI,10294
@@ -151,7 +151,7 @@ sourcecode/remediation_report.py,sha256=3B7sFR-guQn6vxAxTRcm7k82mRNPsyj4e9ON_X3F
 sourcecode/remedies.py,sha256=V2_cD4pLq8bKRkzF-3RGFoiu1xWYZS384WDVp1MrlZw,10225
 sourcecode/rename_refactor.py,sha256=oASZIf7TxcOBy3RQ0FuOe-4HlNW_JOu9RW9JqCxGNBE,17225
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=1pyHxb-q05i2V1x3zdZnHqlBAj3yIJ-cU8ylfWj686Q,537380
+sourcecode/repository_ir.py,sha256=PHpxMG4EKwo7wwW_eMd1OJi8Ys1PMISS38cOmDU_AV0,542323
 sourcecode/resource_budget.py,sha256=WbJqw4pT70Da_KJP2ibZfNTPR6aiEFD2ziF1fSdWLNM,12656
 sourcecode/ris.py,sha256=HsLVHZfseEHNqMyxrj8SvrzUK7jE_85lsWjHtsEw9ik,29196
 sourcecode/risk.py,sha256=jzSq_TaT-EXrhM0V5sOXQHE_XRGvupRfz8mAM0_VpF4,107641
@@ -278,13 +278,13 @@ sourcecode/telemetry/consent.py,sha256=-Wb8BFGXEexOs8M0Eja7F-T6ZtLNPeRoZnHcHvlP7
 sourcecode/telemetry/events.py,sha256=l3Z2SQUO4_C2D2ItXOOdVNimAmHedUHnUxqYFTxnsAE,2900
 sourcecode/telemetry/filters.py,sha256=-lqT2oorECuqEIdeHb--7AZ6BCaUx0bya720a-Z5x6w,7335
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=44QCONDfNKPLPZOdgh5zIywIm4JCCnxyJdd8doRKQaU,1216872
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=o2CY-nisHJOuYpn2qnUv2jVjEtSdnkiC-ilnu0kiFss,1233466
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=A30WnrqZ8Xk70rUMC3yrN3bFnotyVcF0vaBHGsDz4p4,108622
-sourcecode-5.9.29.dist-info/METADATA,sha256=Uu4EbKR1Fzo67dBSo-8nLb5tQWRdZQHbbJyXz5qgYJw,67653
-sourcecode-5.9.29.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.9.29.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.9.29.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.9.29.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.9.29.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=ta7lNm3q9ME6CyXZx4ttLh3sB2POEa2FeP5IE0GZoqY,108622
+sourcecode-5.9.31.dist-info/METADATA,sha256=TLlOxRRCLsXdoOy04SIYFjpNDl0I-xl_GimBpyKnk7A,67653
+sourcecode-5.9.31.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.9.31.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.9.31.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.9.31.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.9.31.dist-info/RECORD,,