sourcecode 5.9.6__tar.gz → 5.9.8__tar.gz

{sourcecode-5.9.6 → sourcecode-5.9.8}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [5.9.8] — 2026-08-27
+
+*Audit correction and contract-alignment patch release.*
+
+**Fixed**
+
+- Standardizes `review-pr` and `activate` failures on structured stderr envelopes.
+- Distinguishes command typos from implicit repository paths and suggests commands.
+- Rejects raw unified diffs passed to `--files -`; the option now accepts path lists only.
+- Streams child progress from `pack gate` without contaminating aggregate stdout.
+- Adds per-row timeout control to `selftest` and removes the fixed-size `cold-start` warning.
+
+**Documentation and validation**
+
+- Reconciles CLI/MCP population documentation and `rename-class` migration guidance.
+- Updates README, English and Spanish guides, roadmap, ledger and CLI version output.
+- Validated with dedicated regressions against `/Users/user/Documents/workspace/testing/teavm`.
+
 ## [5.9.6] — 2026-08-27
 
 *Roadmap correction and release-alignment patch release.*
@@ -9217,3 +9235,13 @@ implementors.
 - 3 `--slim` tests verifying the option is absent from help and CLI surface.
 - 6 `angular_version` parsing tests covering `dependencies`, `devDependencies`,
   `peerDependencies`, `null` JSON values, and version prefix stripping.
+## [5.9.7] — 2026-08-27
+
+### Fixed
+- Exposed functional root options in `ask --help` and aligned help discoverability tests.
+- Unified empty `--files -` handling for `pr-impact` and `pr-risk`.
+- Normalized Git reference failures to `GIT_REF_NOT_FOUND`.
+- Corrected the `cold-start --compact` size contract and endpoint omission disclosure.
+- Added delayed liveness warnings for long non-interactive runs.
+- Improved natural-language routing for unsecured endpoint questions.
+- Kept unresolved impact symbols explicitly unscored.

{sourcecode-5.9.6 → sourcecode-5.9.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.6
+Version: 5.9.8
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.6-blue)
+![Version](https://img.shields.io/badge/version-5.9.8-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.6 retains the shared Canonical IR
+**Current performance status.** Release 5.9.8 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -218,7 +218,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.6 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.8 also hardens the boundary contracts: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -251,7 +251,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.6 — and, on a build that has aged,
+ask version                    # ask 5.9.8 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -501,6 +501,10 @@ The everyday loop: diff-based PR review, symptom-driven bug triage, and delta co
 
 ### 7 · Utilities
 `ask rename-class` (word-boundary Java rename) · `ask chunk-file` (split large files for agents) · `ask cache` (status / warm / model / clear / freshness) · `ask self-audit` (does the installed build's own registry agree with itself?)
+
+`rename-class` migration note: current releases require the explicit form
+`ask rename-class <repo> --from OldName --to NewName`. Older positional forms are
+not accepted; use `--dry-run` first when migrating scripts.
 → [reference](docs/USER_GUIDE.md)
 
 ---

{sourcecode-5.9.6 → sourcecode-5.9.8}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.6-blue)
+![Version](https://img.shields.io/badge/version-5.9.8-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.6 retains the shared Canonical IR
+**Current performance status.** Release 5.9.8 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -169,7 +169,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.6 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.8 also hardens the boundary contracts: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -202,7 +202,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.6 — and, on a build that has aged,
+ask version                    # ask 5.9.8 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -452,6 +452,10 @@ The everyday loop: diff-based PR review, symptom-driven bug triage, and delta co
 
 ### 7 · Utilities
 `ask rename-class` (word-boundary Java rename) · `ask chunk-file` (split large files for agents) · `ask cache` (status / warm / model / clear / freshness) · `ask self-audit` (does the installed build's own registry agree with itself?)
+
+`rename-class` migration note: current releases require the explicit form
+`ask rename-class <repo> --from OldName --to NewName`. Older positional forms are
+not accepted; use `--dry-run` first when migrating scripts.
 → [reference](docs/USER_GUIDE.md)
 
 ---

{sourcecode-5.9.6 → sourcecode-5.9.8}/docs/DEFECT-LEDGER.md

@@ -41,6 +41,65 @@ polyglot repository. It also did not open zero endpoints, minimum token-budget
 refusal, unsupported `explain --compact`, or contractless `verify`: each matched
 the declared contract and non-coverage in the observed run.
 
+**External audit intake AUD-611, re-audit of release 5.9.6 — 2026-08-27.**
+The external scope was restricted to repositories under Documents/workspace/testing
+and covered about 250 real invocations across seven forks, with 104/104 CLI
+commands exercised. The auditor reports zero target-repository writes, commits
+or dirty worktrees. The final score was 7.4/10; an earlier interim pass recorded
+8/10, so 7.4/10 is the governing result.
+
+The three TeaVM field fixes are confirmed across eight or more control
+repositories with no regressions. The new and still-relevant queue is:
+
+| ID | Severity | Status | Evidence / closure boundary |
+|---|---:|---|---|
+| AUD-611-B01 | Critical | open | With stdout redirected to /dev/null, an invalid invocation returned exit 0 and empty stderr in 5/5 runs; normal files, pipes and command substitution retained exit 1. Scope is currently INVALID_INPUT only. Fix error transport and exit status independently, then test every error class and redirection form. |
+| AUD-611-B02 | Critical | open | tutorials has 24,073 Java files; cold root compact ran 240.092 seconds, ended with external timeout exit 124 and zero stdout/stderr. CPU was active, so deadlock versus extreme analysis cost is unresolved. Reproduce on supported Windows/Git Bash and POSIX environments, add progress/deadline/partial diagnostics and define a scale contract. |
+| AUD-611-B03 | High | open | Root compact/agent YAML took 85-380 seconds and reported served_from_cache false on repeated unchanged runs. Add a format/view cache regression and publish latency expectations. |
+| AUD-611-B04 | High | open | One selftest hang occurred in about 16 aggregate runs. Other suspected hangs were retracted after adequate-timeout reruns. Add phase correlation, bounded execution and structured timeout failure. |
+| AUD-611-B05 | High | closed | Root help now exposes all 22 accepted functional flags. Dedicated parity coverage and a real TeaVM execution of `--tree --compact` pass; future internal-only options must be explicitly deprecated or hidden. |
+| AUD-611-B06 | Medium | closed | `pr-risk --files -` now rejects an empty list with the same `INVALID_INPUT` stderr envelope and `exit 1` as `pr-impact`; dedicated TeaVM regression passes. No-diff behavior from implicit Git sources remains separately scoped. |
+| AUD-611-B07 | Medium | closed | Shared Git-ref failures now publish canonical `GIT_REF_NOT_FOUND`; TeaVM regressions cover delta and contract-diff, and existing ref consumers were aligned. |
+| AUD-611-B08 | Medium | closed | `cold-start --compact` now qualifies its size as snapshot-dependent instead of claiming `~10K`; the TeaVM no-RIS path and compact identity regressions pass. A hard ceiling remains an optional future product requirement. |
+| AUD-611-B09 | Medium-high | closed | Non-interactive long runs now emit one delayed stderr warning after 60 seconds by default, configurable with `ASK_PROGRESS_WARNING_SECONDS`; short runs remain silent. TeaVM stdout JSON remains valid under the regression. |
+| AUD-611-B10 | Medium | closed | Added the missing `which endpoints have no security` anchor for `security-surface`; natural TeaVM resolution succeeds without scanning, while equal security-intent questions still refuse deterministically. |
+| AUD-611-B11 | Medium | closed | Missing-symbol `impact-chain` results now use `risk_score: null` and `risk_score_raw: null`, matching `impact`'s unscored semantics; both TeaVM command paths return `not_found`, `unknown`, and `exit 1`. |
+| AUD-611-B12 | Medium | open | Compact endpoint omission now carries explicit `population_total` and an inline measured-population note; the JUnit4 project-type classification half remains open. |
+| AUD-611-B13 | Medium | investigation | retrieve endpoint-security failed silently once in 15 runs (6.7%), exit 1 and zero bytes. Add phase/correlation capture and repeated/concurrent reproduction before closure. |
+
+Commercially, the audit supports normal repositories up to several thousand
+files and keeps a provisional $35-50/developer/month range, but B01/B02 block
+annual-grade reliability and enterprise-scale positioning until resolved.
+
+**External audit intake `AUD-612`, re-audit of release 5.9.7 — 2026-08-27.**
+The external scope covered roughly 130 new invocations across three forks and direct
+retests of all AUD-611 items. It reports five clean forks, no target writes, commits
+or task-kills, and a score of **7.8/10**. It confirms B05, B06, B08, B09, B10 and B11,
+and reports B01 fixed in its own matrix; B01 remains release-artifact verification
+because the prior external round reproduced it. The new queue is:
+
+| ID | Severity | Status | Evidence / closure boundary |
+|---|---:|---|---|
+| AUD-612-B02 | Critical | open | `tutorials` root compact still timed out after 300-311s with zero stdout; warning proves activity, not completion. Define scale, deadline and partial-diagnostic contracts. |
+| AUD-612-B03 | High | closed | YAML cache-hit delivery now publishes `_cache.cache_source` and `timing_ms.served_from_cache` consistently; TeaVM YAML smoke plus the direct cache-hit seam regression pass. A real L2 benchmark remains follow-up because this environment rebuilt both runs. |
+| AUD-612-B04 | High | partial | Each `selftest` row now has configurable 120 s default timeout and structured timeout diagnostics/code 75; valid-row scale latency remains open for profiling. Dedicated TeaVM timeout contract regression passes. |
+| AUD-612-B07 | Medium | closed | `pr-impact --since` now resolves refs through the shared authority and publishes `GIT_REF_NOT_FOUND`; dedicated TeaVM and existing Git-ref regressions pass. |
+| AUD-612-B13 | Medium | closed/no-repro | Controlled TeaVM campaign: 30/30 `retrieve endpoint-security --endpoint /` executions completed with exit 0, valid JSON, no errors and stable content identity after cache warm-up. Reopen on a new correlated failure. |
+| AUD-612-L | High | open | `audit-report --format markdown` timed out at 420s/500s, 2/2, after ~228s in 5.9.6. Performance regression remains open; the one-shot heartbeat sub-issue is mitigated by repeated warnings. |
+| AUD-612-K | Medium | closed | Pack orchestration now streams child stderr, forwarding inherited `ASK_PROGRESS=1` progress while preserving aggregate stdout JSON. Dedicated TeaVM gate regression passes. |
+| AUD-612-M | Medium | closed | `explain` missing-class failures now use structured `INVALID_INPUT` stderr and `exit 1`; dedicated TeaVM regression passes. |
+| AUD-612-E | Medium | closed | The events branch now applies `_exit_on_unresolved_target`; missing event symbols return `not_found` with `exit 1`. TeaVM regression passes. |
+| AUD-612-G | Medium | closed | `review-pr` runtime failures and `activate` failures now publish the shared `error.code` envelope on stderr; stdout remains reserved for valid results. `no_diff` remains the intentional successful `no_changes` result. Dedicated TeaVM and contract tests pass. |
+| AUD-612-I | Medium | closed | Removed the residual `~10K` wording from the large-output warning; help, runtime warning and compact payload consistently describe a snapshot-dependent subset with explicit `full_available` metadata. Dedicated TeaVM regression passes. |
+| AUD-612-07 | Low | closed | Missing single tokens close to a registered command now use command admission with a nearest-command suggestion; existing paths retain implicit root-scan behavior. Dedicated TeaVM regression passes. |
+| AUD-612-09 | Medium | closed | `--files -` is documented and enforced as a newline-delimited changed-path list; raw unified diffs fail with an `--name-only` conversion hint. Dedicated TeaVM regressions pass. |
+| AUD-612-14 | Medium | closed | The current population is 104 CLI leaves versus 110 MCP tools, explicitly decomposed as 101 runtime-derived plus 9 native orchestration tools; `mcp list-tools --json` matches and the relationship is published. Existing TeaVM-backed population regression passes. |
+| AUD-612-R | Medium | closed | README, English guide and Spanish manual document that `rename-class` requires `--from/--to`, the old positional syntax is unsupported, and `--dry-run` is the migration safety step. TeaVM dry-run verification passes. |
+
+Commercially, normal repositories up to about 4,000 files remain viable at a provisional
+$40-55/developer/month. B02, B04 and L block annual CI-gating and extreme-monorepo claims;
+B03, K, M and G weaken machine-consumable evidence.
+
 **External audit intake `AUD-610`, release 5.9.3 — 2026-08-27.** The attached
 report scored the build **7.2/10** after five parallel batches and approximately
 120 invocations. It verified a clean target repository, no Java-file changes,

{sourcecode-5.9.6 → sourcecode-5.9.8}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,10 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.6`; external reconciliation `AUD-610` is triaged and the reproducible fixes are implemented.**
+> **CURRENT QUEUE — release `5.9.8`; external reconciliation `AUD-612` is partially closed, with scale blockers retained.**
+> The latest re-audit confirms the main B05-B11 corrections but adds a confirmed
+> `audit-report` performance regression, a YAML cache-hit disclosure defect and
+> several contract-parity gaps. `AUD-611` remains the preceding audit record.
 > The 2026-08-27 external review adds `AUD-610-B01` through `AUD-610-B10`, led by
 > silent `selftest` nondeterminism, silent root/audit-report failures, a legal-zero
 > `risk --limit 0` crash, an unvalidated consumer path and contradictory Spring
@@ -170,6 +173,82 @@ unsupported flag, and `verify` returning `UNVERIFIED` without contracts all
 matched their documented contracts. These behaviours must remain in regression
 coverage, but are not roadmap bugs from this run.
 
+### External Audit Intake — `AUD-611` re-audit, release 5.9.6
+
+The external re-audit covered only repositories under the testing corpus:
+antlr4, netty, junit4, struts, spring-petclinic, spring-framework-petclinic,
+thingsboard, dropwizard, quarkus-quickstarts, vertx-examples, byte-buddy,
+aspectj, mall, spring-security, openmrs-core and tutorials. It reports
+approximately 250 real invocations across seven forks, 104/104 CLI commands
+exercised, no target-repository writes, no commits and clean Git status
+throughout. The final score is 7.4/10 (an interim pass recorded 8/10); the
+final score is the governing assessment.
+
+The audit confirms the previous cache, Spring-presence and README-badge fixes
+across multiple repositories with no regression. It also confirms that
+audit-report, risk --limit 0, timeline, consumer-path admission, CVE validation,
+baseline collision protection, MCP population disclosure and empty baseline
+handling now behave correctly. The following queue captures the new defects and
+the older findings that remain materially relevant:
+
+| ID | Severity | Finding | Required future closure |
+|---|---:|---|---|
+| AUD-611-B01 | Critical | Redirecting an invalid invocation with ask <bad-input> >/dev/null suppresses both the structured error and the non-zero exit: 5/5 reproductions returned exit 0 with empty stderr. Pipes and command substitution retained exit 1. Only INVALID_INPUT was tested; other error classes remain unverified. | Make error emission and process status independent of stdout destination. Test /dev/null, regular files, pipes, merged streams and all error codes; require structured stderr and non-zero status. |
+| AUD-611-B02 | Critical | Cold root ask . --compact on tutorials (24,073 Java files) ran for exactly 240 seconds until external timeout, returned exit 124 and produced zero bytes on stdout/stderr. The process consumed CPU; no progress or partial answer was available. Windows/Git Bash signal handling may contribute and must be distinguished from analysis cost. | Reproduce on the supported matrix, publish phase progress/heartbeat, enforce an internal deadline that preserves diagnostics, and establish an explicit scale ceiling or bounded execution mode before enterprise-scale claims. |
+| AUD-611-B03 | High | Three consecutive root --compact/--agent -f yaml runs took 85-380 seconds and reported served_from_cache false every time on the same unchanged repository. Output eventually completed, so this is cache/performance correctness rather than a crash. | Include format/view/mode in the canonical cache key or share the context cache correctly; add a cold/warm multi-process benchmark and document expected latency. |
+| AUD-611-B04 | High | selftest still hung once in approximately 16 aggregate executions across three evaluators. Prior suspected hangs for pr-risk, pack gate and audit-report were retracted after isolated reruns with adequate timeouts. | Instrument phase/correlation IDs, enforce bounded child execution and preserve a structured failure envelope; distinguish tool hangs from auditor timeout artefacts. |
+| AUD-611-B05 | High | **Closed in this fix.** Root --help now exposes the 22 functional root flags accepted by the callback, including architecture, tree, symbol, graph, dependency and docs flags. | Keep the live help/registry parity test green; internal-only options must be explicitly deprecated or hidden rather than silently omitted. |
+| AUD-611-B06 | Medium | **Closed in this fix.** Empty `--files -` now yields the same `INVALID_INPUT` structured stderr envelope and `exit 1` in `pr-impact` and `pr-risk`. | Keep both command contracts covered; no-diff paths not sourced from `--files` remain a separate policy surface. |
+| AUD-611-B07 | Medium | **Closed in this fix.** Shared Git reference failures now publish `GIT_REF_NOT_FOUND` across delta, contract-diff and the other ref-consuming surfaces. | Keep the cross-command error-code vocabulary test green. |
+| AUD-611-B08 | Medium | **Closed in this fix.** `cold-start --compact` no longer promises a fixed `~10K` ceiling; help and command documentation now state that the bounded orientation subset depends on stored snapshot size. No data is silently truncated to satisfy a false bound. | If a hard token ceiling becomes a product requirement, implement it with explicit omission metadata and corpus benchmarks. |
+| AUD-611-B09 | Medium-high | **Closed in this fix.** Non-interactive runs now emit one delayed stderr liveness warning after 60 seconds by default (configurable with `ASK_PROGRESS_WARNING_SECONDS`), while short runs remain byte-silent and stdout stays machine-readable. | Keep the warning opt-out and periodic `--progress` heartbeat contracts covered. |
+| AUD-611-B10 | Medium | **Closed in this fix.** The natural question `which endpoints have no security` now maps deterministically to `security-surface`; equal security intents continue to refuse with both candidates named. | Keep lexical anchors and equal-score refusal tests synchronized with the retrieve registry. |
+| AUD-611-B11 | Medium | **Closed in this fix.** For missing symbols, `impact-chain` now publishes null risk scores instead of the misleading numeric zero and preserves the same `not_found`/`unknown`/`exit 1` policy as `impact`. | Keep the shared not-found risk semantics covered; `impact`'s existing omission of `risk_score_raw` remains a separate schema choice. |
+| AUD-611-B12 | Medium | **Partially closed in this fix.** Compact endpoint output now publishes an explicit `population_total` beside the omitted rows and repeats the measured population in the inline note, so `endpoints: []` cannot be read as “no endpoints”. JUnit4 classification remains open. | Add evidence-backed JUnit4 project classification without heuristic overreach. |
+| AUD-611-B13 | Medium | retrieve endpoint-security failed silently once in 15 consecutive attempts (6.7%), exit 1 and zero bytes, with normal timing and no traceback. | Capture correlation/phase failures and reproduce under repeated/concurrent cache-control tests before claiming deterministic closure. |
+
+**Commercial interpretation.** The audit supports adoption for normal repositories up
+to several thousand files and values the product at a provisional $35-50 per
+developer/month, but the final score and the critical /dev/null and extreme-scale
+findings block an annual-grade reliability claim. Pricing and enterprise
+positioning remain hypotheses until AUD-611-B01 and AUD-611-B02 are closed and
+the latency contract is explicit.
+
+### External Audit Intake — `AUD-612` re-audit, release 5.9.7
+
+The external re-audit covered repositories under `Documents/workspace/testing/` and
+ran approximately 130 new invocations across three forks, plus direct retests of all
+13 `AUD-611` items. It reports five clean forks, no target-repository changes, no
+commits and no task-kill intervention. The score is **7.8/10**, up from the recorded
+`AUD-611` score of 7.4/10. It confirms complete closure of B05, B06, B08, B09, B10
+and B11, confirms the endpoint compact disclosure improvement, and reports B01 as
+fixed in its own 13-run matrix. Because the preceding external round reproduced B01,
+that result remains release-artifact verification rather than erased history.
+
+| ID | Severity | Finding | Required future closure |
+|---|---:|---|---|
+| AUD-612-B02 | Critical | Cold root `ask . --compact` on `tutorials` (24,073 Java files) still timed out after 300-311 seconds with zero stdout; the 60-second warning proves activity but does not deliver a result. | Define and enforce a scale contract, bound or accelerate the root scan, and preserve structured partial/deadline diagnostics. |
+| AUD-612-B03 | High | **Closed in this fix.** The YAML cache-hit delivery branch now injects `_cache.cache_source` and refreshes `timing_ms.served_from_cache` from the same authoritative hit state as JSON. | Keep the YAML cache seam regression and a real cold/warm multi-process benchmark green; the current TeaVM environment did not generate an L2 hit spontaneously. |
+| AUD-612-B04 | High | **Partially closed in this fix.** `selftest` now bounds every ledger child with configurable `--timeout` (120 s default) and preserves structured timeout diagnostics/code 75. Valid-row scale latency remains open for profiling. TeaVM timeout contract regression passes. | Add phase/correlation IDs and profile slow valid rows; do not raise the default without evidence. |
+| AUD-612-B07 | Medium | **Closed in this fix.** `pr-impact --since` now resolves refs through the shared Git authority and publishes `GIT_REF_NOT_FOUND`, matching posture and timeline. | Keep the complete ref-consumer matrix green. |
+| AUD-612-B13 | Medium / investigation | **Closed as not reproduced in this investigation.** A controlled 30-run TeaVM campaign with an isolated cache completed 30/30 with exit 0, valid JSON, 0 errors and one stable content identity after warm-up. Reopen on any new failure with per-run correlation data. | Keep repeated/concurrent retrieval coverage in release audits. |
+| AUD-612-L | High / regression | `audit-report . --format markdown` timed out at 420s with contention and 500s in isolation, 2/2, after completing in about 228s in 5.9.6. The heartbeat-only sub-issue is now mitigated: warnings repeat at the configured interval. | Reproduce with a 900s diagnostic window, identify the performance regression and add a bounded failure envelope. |
+| AUD-612-K | Medium | **Closed in this fix.** Pack orchestration now forwards child stderr while each component runs, so inherited `ASK_PROGRESS=1` heartbeats reach the operator without contaminating the aggregate stdout JSON. TeaVM gate regression passes. | Keep nested progress and stdout purity tests green. |
+| AUD-612-M | Medium | **Closed in this fix.** `explain <nonexistent-class>` now emits `INVALID_INPUT` as structured stderr with `exit 1`; the internal explanation API remains unchanged. | Keep class-not-found and no-diff contract tests green for the remaining public commands. |
+| AUD-612-E | Medium | **Closed in this fix.** `impact-chain --type events` now applies the shared not-found exit policy after emitting its result, returning `exit 1` for unresolved symbols. | Keep every impact type on the shared CLI exit-policy test. |
+| AUD-612-G | Medium | **Closed in this fix.** `review-pr` runtime failures and `activate` failures now publish the shared `error.code` envelope on stderr, with stdout reserved for valid results. The intentional `review-pr` `no_diff` result remains `exit 0` / `no_changes`. TeaVM and contract regressions pass. | Keep public failure paths on the shared envelope and preserve the no-diff success semantics. |
+| AUD-612-I | Medium | **Closed in this fix.** The remaining `~10K` promise in the large-output warning is removed; help, runtime warning and compact payload now consistently describe a snapshot-dependent orientation subset with explicit `full_available` metadata. TeaVM compact regression passes. | Keep compact-size wording derived from the actual snapshot contract. |
+| AUD-612-07 | Low / UX | **Closed in this fix.** A missing single token close to a registered command is now rejected as an unknown command with nearest-command suggestions; existing paths retain implicit root-scan behavior. TeaVM path and typo regressions pass. | Keep command admission and implicit-path differential tests green. |
+| AUD-612-09 | Medium / docs | **Closed in this fix.** Help now describes `--files -` as a newline-delimited changed-path list. Raw unified diffs are rejected early with an `--name-only` conversion hint instead of being interpreted as file paths. TeaVM list and rejection regressions pass. | Keep the stdin grammar and raw-diff rejection tests green. |
+| AUD-612-14 | Medium / governance | **Closed in this reconciliation.** Current `self-audit` publishes 104 registered CLI leaves and 110 served MCP tools, decomposed as 101 runtime-derived plus 9 native orchestration tools; `mcp list-tools --json` matches 110. The payload states that the populations are intentionally different and gives the formula. Existing TeaVM-backed population regression passes. | Keep the population formula and parity regression generated from the live registries. |
+| AUD-612-R | Medium / migration | **Closed in this fix.** The explicit `--from/--to` contract is now documented in README, English guide and Spanish manual; the old positional syntax is explicitly marked unsupported and `--dry-run` is recommended for script migration. TeaVM dry-run verification passes. | Keep migration guidance aligned with the live command signature. |
+
+**Commercial interpretation.** Normal repositories up to roughly 4,000 files remain a
+credible adoption target, with the external estimate at **$40-55/developer/month**.
+The product is not yet suitable for annual CI-gating commitments or extreme monorepos:
+B02, B04 and regression L leave the system without a reliable completion contract,
+while K and the remaining performance rows weaken machine-consumable evidence and completion confidence.
+
 ### External Audit Intake — `AUD-610` detail, release 5.9.3
 
 The attached external report audited ASK `5.9.3` in five parallel batches

{sourcecode-5.9.6 → sourcecode-5.9.8}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.6`, following the external `5.9.3` reconciliation.**
+> **CURRENT UPDATE — release `5.9.8`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -19,6 +19,30 @@
 > non-reproduction did not cover the payload shape now identified. Details are
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
+> **RE-AUDIT — 5.9.7, received 2026-08-27.** Three independent forks added roughly
+> 130 invocations and retested the AUD-611 queue. The score rose to **7.8/10** and
+> confirmed the help, stdin, Git-ref, intent, impact-score and progress corrections.
+> It also found a high-severity `audit-report --format markdown` performance regression
+> (420-500s without completion), a YAML cache-hit disclosure defect, missing progress
+> propagation in `pack gate`, and inconsistent error envelopes in `explain`, `review-pr`
+> and `activate`. B02/B04 and the new regression remain blockers for annual CI-gating
+> or extreme-monorepo positioning. Normal repositories around 4,000 files remain the
+> viable commercial segment at a provisional `$40-55/developer/month`. Full detail is
+> recorded as `AUD-612` in the development roadmap and defect ledger.
+
+> **RE-AUDIT — 5.9.6, received 2026-08-27.** Seven independent forks exercised
+> approximately 250 invocations across the testing corpus with no target-repository
+> mutation or regression in the three latest fixes. The final score is **7.4/10**.
+> Commercial adoption remains suitable for normal repositories, provisionally
+> `$35-50/developer/month`, but annual-grade reliability is blocked by two new
+> critical findings: invalid-input errors can be suppressed by redirecting stdout
+> to `/dev/null`, and the root compact scan of a 24,073-Java-file repository timed
+> out after 240 seconds with no output. Additional roadmap debt covers root help
+> parity, cache reuse for YAML/view combinations, default progress signals, intent
+> tie semantics, impact not-found parity, compact sizing and one intermittent
+> retrieve failure. Full engineering detail is recorded in `AUD-611` in the
+> development roadmap and defect ledger.
+
 > **EXTERNAL REVIEW — 5.9.2, received 2026-08-27.** No regression was reported in the
 > previously closed surface. Two `auth workspace` defects are now open: overlapping
 > parent/child paths can double-count Java files, and nonexistent paths are accepted as

{sourcecode-5.9.6 → sourcecode-5.9.8}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.9.6**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.8**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,7 +8,7 @@
 
 ## 1. ¿Qué es ASK Engine?
 
-### Contratos de fiabilidad de la versión 5.9.6
+### Contratos de fiabilidad de la versión 5.9.8
 
 Las entradas inválidas se rechazan antes del análisis costoso mediante el
 envelope estructurado `INVALID_INPUT`: un `--consumer` inexistente, un feed CVE
@@ -955,6 +955,11 @@ ask rename-class . --from OldName --to NewName --output rename-audit.json
 **Opciones:**
 - `--from` (**obligatorio**): nombre actual de la clase (PascalCase, p. ej. `ServiceA`).
 - `--to` / `-t` (**obligatorio**): nombre nuevo (PascalCase, p. ej. `ServiceB`).
+
+**Nota de migracion:** las versiones actuales exigen la forma explicita
+`ask rename-class <repo> --from NombreAntiguo --to NombreNuevo`. La sintaxis
+posicional antigua ya no se acepta. Al actualizar scripts, anade `--dry-run`
+para revisar primero el plan de cambios.
 - `--dry-run`: calcula los cambios pero **no escribe ni renombra** nada en disco.
 - `--no-tests`: excluye los ficheros de test del rename (solo `src/main`).
 - `--format`: `json` (por defecto) o `yaml`.

{sourcecode-5.9.6 → sourcecode-5.9.8}/docs/USER_GUIDE.md

@@ -46,16 +46,16 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.6, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.8, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.6, with release-artifact verification
+the two pack fixes are included in release 5.9.8, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.6
+### Reliability contracts in 5.9.8
 
 Invalid analysis inputs fail before expensive work and use the structured
 `INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
@@ -236,7 +236,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.6
+# ask 5.9.8
 ```
 
 Requires Python 3.9+.
@@ -1381,6 +1381,10 @@ explaining. The rest do one thing; `ask <command> --help` is the whole story.
 | `ask chunk-file <file>` | supported | Split a large Java file into semantic chunks an agent can consume |
 | `ask intent "<question>"` | supported | Resolve a plain-language question to the typed `retrieve` query that answers it (scored lexical match against a declared vocabulary — no model, no generation). Prints the query; `--run` executes it. A question fitting two intents too closely is refused with both named. |
 | `ask rename-class` | supported | Word-boundary Java rename across the repository |
+
+**Migration note:** `rename-class` requires the explicit `--from OldName --to NewName`
+options. Older positional name syntax is no longer accepted. Add `--dry-run` when
+updating an existing script so the planned file changes can be reviewed first.
 | `ask schema <name>` | supported | Print a published JSON Schema for this tool's output |
 | `ask self-audit` | supported | Check the SHIPPED build's own coherence — cache model, format contract, schema registry and output affordances. Declares explicitly that the semantic engine does not apply to this product's own source (ASK analyses Java; this build is Python), rather than reporting zeros. `ask selftest` is the different question: the defect ledger run against a real repository. |
 | `ask auth workspace <repo>...` | supported | Aggregate workspace entitlement preview. `--enforce` opts into the named-buyer pilot that reuses the existing Pro gate when the organization-sized threshold is crossed; advisory mode remains the default and the CLI does not bill. |

{sourcecode-5.9.6 → sourcecode-5.9.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.6"
+version = "5.9.8"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.6 → sourcecode-5.9.8}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.6"
+__version__ = "5.9.8"