sourcecode 5.9.8__tar.gz → 5.9.10__tar.gz

{sourcecode-5.9.8 → sourcecode-5.9.10}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [5.9.10] — 2026-08-27
+
+*Release-alignment patch release.*
+
+**Release**
+
+- Synchronizes package metadata, CLI runtime, README and user-guide version surfaces at `5.9.10`.
+- Carries forward the `5.9.9` documentation and availability guidance.
+- Keeps the `AUD-615` reliability limits explicit pending their independent closure.
+
+## [5.9.9] — 2026-08-27
+
+*Release-alignment patch release.*
+
+**Release**
+
+- Synchronizes the package, CLI, README and user-guide version surfaces at `5.9.9`.
+- Carries forward the `5.9.8` reliability fixes and their dedicated TeaVM validation.
+- Keeps the `AUD-614` availability and native Windows/MSYS verification items explicitly open.
+
 ## [5.9.8] — 2026-08-27
 
 *Audit correction and contract-alignment patch release.*

{sourcecode-5.9.8 → sourcecode-5.9.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.8
+Version: 5.9.10
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.8-blue)
+![Version](https://img.shields.io/badge/version-5.9.10-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,14 +196,16 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.8 retains the shared Canonical IR
+**Current performance status.** Release 5.9.10 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
-not duration promises. A controlled external warm-path audit has opened performance
-and bounded-output regressions for this release; use `ask cache model <repo>` and
-`--progress stderr` for supervised runs, and consult the
-[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md) before
-treating a historical timing or bounded flag as a current guarantee.
+not duration promises. The current external audit records two open availability
+limits: `audit-report --format markdown` is not reliable under contention, and
+the root compact flow is not suitable for strict timeouts on very large monorepos.
+Use `ask cache model <repo>`, `--progress stderr`, `audit-report --from-risk` and
+JSON/YAML output for supervised runs; consult the
+[current reliability queue](docs/DEVELOPMENT-ROADMAP.md#aud-615-re-audit-release-599)
+before treating a historical timing or bounded flag as a current guarantee.
 
 **CI delivery and workspace licensing.** `migrate-check --format sarif` emits
 ASK-owned migration findings with source locations and provenance; it does not
@@ -218,7 +220,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.8 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.10 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -251,7 +253,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.8 — and, on a build that has aged,
+ask version                    # ask 5.9.10 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.8 → sourcecode-5.9.10}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.8-blue)
+![Version](https://img.shields.io/badge/version-5.9.10-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,14 +147,16 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.8 retains the shared Canonical IR
+**Current performance status.** Release 5.9.10 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
-not duration promises. A controlled external warm-path audit has opened performance
-and bounded-output regressions for this release; use `ask cache model <repo>` and
-`--progress stderr` for supervised runs, and consult the
-[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md) before
-treating a historical timing or bounded flag as a current guarantee.
+not duration promises. The current external audit records two open availability
+limits: `audit-report --format markdown` is not reliable under contention, and
+the root compact flow is not suitable for strict timeouts on very large monorepos.
+Use `ask cache model <repo>`, `--progress stderr`, `audit-report --from-risk` and
+JSON/YAML output for supervised runs; consult the
+[current reliability queue](docs/DEVELOPMENT-ROADMAP.md#aud-615-re-audit-release-599)
+before treating a historical timing or bounded flag as a current guarantee.
 
 **CI delivery and workspace licensing.** `migrate-check --format sarif` emits
 ASK-owned migration findings with source locations and provenance; it does not
@@ -169,7 +171,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.8 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.10 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -202,7 +204,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.8 — and, on a build that has aged,
+ask version                    # ask 5.9.10 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.8 → sourcecode-5.9.10}/docs/DEFECT-LEDGER.md

@@ -95,6 +95,65 @@ because the prior external round reproduced it. The new queue is:
 | AUD-612-09 | Medium | closed | `--files -` is documented and enforced as a newline-delimited changed-path list; raw unified diffs fail with an `--name-only` conversion hint. Dedicated TeaVM regressions pass. |
 | AUD-612-14 | Medium | closed | The current population is 104 CLI leaves versus 110 MCP tools, explicitly decomposed as 101 runtime-derived plus 9 native orchestration tools; `mcp list-tools --json` matches and the relationship is published. Existing TeaVM-backed population regression passes. |
 | AUD-612-R | Medium | closed | README, English guide and Spanish manual document that `rename-class` requires `--from/--to`, the old positional syntax is unsupported, and `--dry-run` is the migration safety step. TeaVM dry-run verification passes. |
+| AUD-613-ROOT | High | closed 5.9.8 | On a TTY, explicit `ask .` was misclassified as bare `ask` after path preprocessing and rendered only the welcome card. An explicit-path marker now distinguishes both flows; TeaVM pseudo-TTY and focused CLI regressions pass. |
+
+**External audit intake `AUD-614`, re-audit of release 5.9.8 — 2026-08-27.**
+Five clean forks exercised the `testing/` corpus without target-repository writes,
+commits or Java-file changes. The initial **8.0/10** score was superseded by the
+addendum confirming a second severe availability regression; the governing score is
+**7.5/10**. Previously closed semantic fixes remained stable, but the following rows
+are the current release blockers and contract gaps:
+
+| ID | Severity | Status | Evidence / closure boundary |
+|---|---:|---|---|
+| AUD-614-F | Critical | closed 5.9.8 (reverified) | The external `/dev/null` false-success is not reproducible in the current checkout: invalid TeaVM input returns `exit 1` and identical structured stderr whether stdout is captured or discarded. A dedicated redirection regression protects the boundary. Native Windows/MSYS release-artifact verification remains required because the external evidence conflicts. |
+| AUD-614-L | Critical / regression | open | `audit-report` is contention-sensitive on `thingsboard` (3,714 files): one clean run completed in 136 s, while concurrent/isolated runs exceeded 5 minutes; JSON, YAML and Markdown all exhibited the problem. `tutorials` reached 5m39.6s with zero stdout. Requires profiling, stage visibility, deadline and structured partial output. |
+| AUD-614-RISK-L0 | High / regression | closed 5.9.8 | `risk --limit 0` now returns a fast explicit zero-row view without constructing the repository-wide composer. It publishes `risks: []`, `shown: 0`, null totals and `analysis_skipped: true`; the TeaVM flow and dedicated regression pass. |
+| AUD-614-SELFTEST-TIMEOUT | High / contract regression | closed 5.9.8 | `selftest --timeout` is now an overall deadline; each child receives the remaining budget, interrupted/unstarted rows are structured as `error`, and the command returns code 75. The real TeaVM flow and dedicated regression pass. The separate fourth-run hang remains mixed evidence. |
+| AUD-614-WIN-PROC | Medium | open | Windows/MSYS timeout or SIGTERM can leave `ask.exe` descendants alive, with MSYS PIDs unusable by native `taskkill`. Validate signal handling and Windows Job Objects from native Windows and Git Bash. |
+| AUD-614-G | Medium | closed 5.9.8 | The shared error authority normalizes legacy producer spellings to canonical uppercase codes (`NO_DIFF_SOURCE`, `INVALID_LICENSE`). TeaVM `review-pr` and activation contract tests pass. |
+| AUD-614-E | Low | closed 5.9.9 | Event topology now publishes `risk_level: unknown` for `not_found`, matching `impact` and normal `impact-chain`; `low` remains a resolved no-risk result. Focused TeaVM coverage protects the parity. |
+| AUD-614-I | Medium | closed 5.9.8 | The user manual and internal compacting comment no longer promise `~10K`; they state that `cold-start --compact` is snapshot-dependent, expose `estimated_tokens`, and require size validation before direct AI injection. The CLI help and payload already used this contract. A hard ceiling remains optional future scope. |
+| AUD-614-INTENT-TIE | Medium | closed 5.9.9 (reclassified) | The equal score belongs to different questions, not competing candidates. `endpoint security` selects a target-required intent and correctly refuses without a route; `security surface` is repository-wide and resolves. A focused regression locks the distinction. |
+| AUD-614-07 | Low | closed 5.9.8 (reverified) | The installed `ask spring-audi` entry point returns `Did you mean: spring-audit?`; the TeaVM path/typo regression battery passes. The external wording report is not reproducible in the current checkout. |
+| AUD-614-JUNIT4 | Medium | closed 5.9.9 | JUnit4 test-only repositories classify as `test` only with the `junit:junit` coordinate and test-only Java sources; ordinary applications/libraries retain their structural type. |
+
+**External audit intake `AUD-615`, re-audit of release 5.9.9 — 2026-08-27.** The
+auditor exercised only repositories under `testing/` and added three robustness subjects.
+The report contains conflicting headline scores (8.0 and 8.4), and shared fork scratch
+state invalidated the definitive output capture for the long `audit-report` retest. The
+ledger records the evidence and closure boundaries, not either headline score.
+
+| ID | Severity | Status | Evidence / closure boundary |
+|---|---:|---|---|
+| AUD-615-F | Critical | closed 5.9.9 (reverified) | Windows/Git Bash verification confirms 11/11 reproductions: stdout `/dev/null` preserves exit 1 and byte-identical structured stderr, including `INVALID_USAGE` as well as `INVALID_INPUT`. Keep release-artifact coverage. |
+| AUD-615-RISK-L0 | High / regression | closed 5.9.9 (reverified) | `risk --limit 0` completes in about 0.8–1.5 s as `zero_row_view`, with `analysis_skipped: true` and null totals; full analysis is not built for a view that requests no rows. |
+| AUD-615-SELFTEST-TIMEOUT | High / contract regression | closed 5.9.9 (reverified) | `selftest --timeout 5` returns exit 75 and a non-empty structured diagnostic payload, including the fourth attempt in this sample. The independent hang history remains mixed evidence. |
+| AUD-615-L | Critical / regression | open | The defect is isolated to `audit-report --format markdown`: identical `thingsboard` runs measured 200 s timeout versus 137.98 s success, with an isolated 114 s run. JSON/YAML correctly returned structured `OUTPUT_TOO_LARGE`; they are not defective here. The 700 s fork lost output to shared scratch interference. |
+| AUD-615-TUTORIALS | High / availability trend | open | Root compact on `tutorials` increased monotonically from 4m00.1s in 5.9.6 to 6m20.1s in 5.9.9, exit 124 with zero stdout. Attribute and bound the cost before large-monorepo claims. |
+| AUD-615-WIN-PROC | Medium | open | Seven `ask.exe` processes remained after successful Windows runs. Validate descendant cleanup for successful and timed-out runs with native Windows/Git Bash process controls. |
+| AUD-615-INTENT-TIE | Medium | closed 5.9.9 (reclassified) | Equal score across distinct questions is not a tie. The target-required endpoint intent refuses without a route while the global surface intent resolves; a focused regression protects that contract. |
+| AUD-615-E | Low | closed 5.9.9 | All impact-family not-found paths publish `risk_level: unknown`; focused TeaVM coverage protects the former event-topology outlier. |
+| AUD-615-07 | Low / evidence conflict | closed 5.9.9 (reverified) | Isolated TeaVM verification returns `Did you mean: spring-audit?` with exit 2, matching the installed-entry-point regression. The contrary report wording is not reproducible. |
+| AUD-615-JUNIT4 | Medium | closed 5.9.9 | JUnit4 test-only repositories classify as `test` from dependency and source-location evidence, without a broad naming heuristic. |
+| AUD-615-DRIFT | Low / investigation | closed 5.9.9 | Spring's explicit `default` profile is normalized to the implicit empty active-profile set at the access-snapshot boundary. An implicit capture and explicit `--profile default` now read one series; focused and TeaVM regression flows pass. |
+| AUD-615-COLD-COMPACT | Low / product decision | closed 5.9.9 (accepted contract) | A repeated 88,265-byte result is compatible with the documented snapshot-dependent contract. ASK exposes `estimated_tokens`; no hard ceiling is claimed or introduced. |
+
+**Audit-method control:** each parallel fork must use a unique scratch directory; shared
+`~/askaudit_599` caused cross-fork file deletion/interleaving and blocked a definitive L
+result. **Commercially**, conflicting `$25-40` and `$50-65` estimates are not evidence for
+a price increase; retain the conservative band until the availability trend is closed.
+
+The audit also confirms root cache reuse, stdin contracts, pack progress, explain and
+impact error routing, self-audit population disclosure, endpoint compact disclosure,
+Spring detection controls, baseline safety and the prior `/dev/null` fix matrix. The
+intermittent endpoint-security retrieval issue had 0/18 failures in this pass and stays
+under observation because its historical rate is about 2% over 51 runs.
+
+**Commercial boundary.** The corrected assessment is `$25-40/developer/month`, not the
+initial `$45-58` headline. Do not market enterprise-scale support or production CI
+gating for repositories above roughly 3,000 files until the four critical/high
+availability and error-transport rows are independently closed with bounded evidence.
 
 Commercially, normal repositories up to about 4,000 files remain viable at a provisional
 $40-55/developer/month. B02, B04 and L block annual CI-gating and extreme-monorepo claims;

{sourcecode-5.9.8 → sourcecode-5.9.10}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,10 +3,15 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.8`; external reconciliation `AUD-612` is partially closed, with scale blockers retained.**
-> The latest re-audit confirms the main B05-B11 corrections but adds a confirmed
-> `audit-report` performance regression, a YAML cache-hit disclosure defect and
-> several contract-parity gaps. `AUD-611` remains the preceding audit record.
+> **CURRENT QUEUE — release `5.9.10`; external re-audit `AUD-615` remains the reliability gate.**
+> The latest external pass confirms the cache, stdin, progress, error-channel and
+> population fixes, but reports a serious availability regression: `audit-report`
+> is contention-sensitive on a normal large repository. The `/dev/null` report is
+> reverified as fixed in the current checkout; native Windows/MSYS release-artifact
+> confirmation remains. `risk --limit 0` and the `selftest --timeout` contract are now
+> closed in this cycle; Windows process-tree cleanup remains separately open.
+> `AUD-612` and `AUD-614` remain preceding audit records; `AUD-615` is the governing
+> queue for the current `5.9.10` state, carrying forward the `5.9.8` and `5.9.9` fixes.
 > The 2026-08-27 external review adds `AUD-610-B01` through `AUD-610-B10`, led by
 > silent `selftest` nondeterminism, silent root/audit-report failures, a legal-zero
 > `risk --limit 0` crash, an unvalidated consumer path and contradictory Spring
@@ -242,6 +247,82 @@ that result remains release-artifact verification rather than erased history.
 | AUD-612-09 | Medium / docs | **Closed in this fix.** Help now describes `--files -` as a newline-delimited changed-path list. Raw unified diffs are rejected early with an `--name-only` conversion hint instead of being interpreted as file paths. TeaVM list and rejection regressions pass. | Keep the stdin grammar and raw-diff rejection tests green. |
 | AUD-612-14 | Medium / governance | **Closed in this reconciliation.** Current `self-audit` publishes 104 registered CLI leaves and 110 served MCP tools, decomposed as 101 runtime-derived plus 9 native orchestration tools; `mcp list-tools --json` matches 110. The payload states that the populations are intentionally different and gives the formula. Existing TeaVM-backed population regression passes. | Keep the population formula and parity regression generated from the live registries. |
 | AUD-612-R | Medium / migration | **Closed in this fix.** The explicit `--from/--to` contract is now documented in README, English guide and Spanish manual; the old positional syntax is explicitly marked unsupported and `--dry-run` is recommended for script migration. TeaVM dry-run verification passes. | Keep migration guidance aligned with the live command signature. |
+| AUD-613-ROOT | High / regression | **Closed in this fix.** On a TTY, explicit `ask <repo>` paths were removed during argv preprocessing and misclassified as a bare invocation, so `ask .` rendered only the welcome card. The preprocessor now retains an explicit-path marker: bare `ask` still shows the welcome card, while `ask .` analyzes and emits JSON. A real TeaVM pseudo-TTY run and focused CLI regressions pass. | Keep the bare-invocation versus explicit-root differential test green. |
+
+### External Audit Intake — `AUD-614` re-audit, release 5.9.8
+
+The external re-audit covered the repositories under `Documents/workspace/testing/`
+using five clean forks. It reports no target-repository writes, commits or Java-file
+changes. The initial score of **8.0/10** was superseded by the addendum after the
+previously incomplete `risk --limit 0` run was confirmed; the governing assessment is
+**7.5/10**, the first decline in the series. No previously closed semantic fix was
+reported as broken, but availability and contract reliability regressed.
+
+| ID | Severity | Finding | Required future closure |
+|---|---:|---|---|
+| AUD-614-F | Critical | **Closed in this verification.** The reported `/dev/null` false-success is not reproducible in the current `5.9.8` checkout: invalid TeaVM input returns `exit 1` and the identical structured stderr envelope with normal stdout capture or stdout discarded. A dedicated redirection matrix now protects this boundary. Keep release-artifact verification on native Windows/MSYS because the external witness remains contradictory. | Keep the redirection matrix green across error classes, entry points and platforms. |
+| AUD-614-L | Critical / regression | `audit-report` is not reliably bounded. `thingsboard` (3,714 files) completed once in 136 s but timed out after more than 5 minutes under concurrent load; JSON, YAML and Markdown all showed the same sensitivity. `tutorials` remained at 5m39.6s with zero stdout. | Profile contention and shared-cache/worker behaviour, expose stages, enforce a deadline and structured partial/failure output, and define a supported repository-size/load envelope. |
+| AUD-614-RISK-L0 | High / regression | **Closed in this fix.** `risk --limit 0` now returns a fast explicit zero-row view without constructing the repository-wide composer. It publishes `risks: []`, `shown: 0`, null totals and `analysis_skipped: true`, so an empty requested view is not misread as a zero-risk census. The real TeaVM flow completes within 12 s and the dedicated regression passes. | Keep the zero-row contract and ensure filters that request actual composition continue through the normal analysis path. |
+| AUD-614-SELFTEST-TIMEOUT | High / contract regression | **Closed in this fix.** `selftest` now treats `--timeout` as an overall execution deadline, bounds each child by the remaining budget, emits structured errors for the interrupted and unstarted rows, and returns code 75. The real TeaVM flow and dedicated regression pass. The separate fourth-run hang remains mixed evidence. | Keep the parent/child deadline and code-75 contract green on the installed entry point and TeaVM. |
+| AUD-614-WIN-PROC | Medium | On Windows/MSYS, timeout or SIGTERM can leave `ask.exe` descendants alive; the MSYS PID cannot be cleaned with native `taskkill`. The audit observed low-memory orphan processes after a timed-out run. | Implement signal/CTRL_BREAK cleanup and Windows Job Objects or document a verified equivalent; test parent and descendant termination from native Windows and Git Bash. |
+| AUD-614-G | Medium | **Closed in this fix.** The shared error authority now normalizes legacy producer spellings to canonical uppercase codes: `NO_DIFF_SOURCE` and `INVALID_LICENSE`. The TeaVM `review-pr` flow and activation contract tests pass. | Keep all public error producers on the canonical code authority. |
+| AUD-614-E | Low / semantic parity | **Closed in this fix.** The event topology branch now publishes `risk_level: unknown` for `not_found`, matching `impact` and normal `impact-chain`; `low` remains reserved for a resolved topology with no measured risk. | Keep not-found payloads generated from the shared unknown-risk semantics. |
+| AUD-614-I | Medium / contract | **Closed in this fix.** The user manual no longer promises `~10K` for `cold-start --compact`; it now states that the orientation subset depends on the stored snapshot, exposes `estimated_tokens`, and recommends checking the measured size before direct AI injection. The CLI help and payload already carried the same non-fixed-size contract. | Keep the manual, help and payload wording derived from the snapshot-size contract; a hard ceiling remains a separate product decision. |
+| AUD-614-INTENT-TIE | Medium | **Closed as a false tie.** Both questions score `2.8284`, but they are different declared queries: `endpoint security` selects a target-required intent and correctly refuses without a route, while `security surface` selects a repository-wide intent. Equal scores across different inputs are not competing candidates. A focused regression locks the distinction. | Keep target-required admission separate from repository-wide intent selection. |
+| AUD-614-07 | Low / UX regression | **Closed in this verification.** The installed `ask spring-audi` entry point returns the command-admission error with `Did you mean: spring-audit?`; the TeaVM path/typo regression battery passes. The external wording report is not reproducible in the current checkout. | Keep command admission, error wording and help aligned in the installed-CLI test. |
+| AUD-614-JUNIT4 | Medium / classification | **Closed in this fix.** A repository is classified as `test` only when it has the `junit:junit` coordinate and all Java sources are test sources; applications and libraries that merely use JUnit retain their structural type. | Keep the dependency-plus-source-population regression green. |
+
+### External Audit Intake — `AUD-615` re-audit, release 5.9.9
+
+The external re-audit covered only repositories under `Documents/workspace/testing/`,
+with additional robustness passes over `micronaut-guides`, `jhipster-sample-app` and
+`mall` (including a non-English README). The report contains two headline scores (**8.0/10**
+and **8.4/10**) and a methodological limitation: forks shared `~/askaudit_599`, so output
+files were deleted or interleaved during the critical `audit-report` retest. The detailed
+findings below take precedence over either headline score. No target-repository mutation
+was reported.
+
+| ID | Severity | Finding | Required future closure |
+|---|---:|---|---|
+| AUD-615-F | Critical | **Confirmed fixed on Windows/Git Bash.** Two independent forks report 11/11 successful reproductions: redirecting stdout to `/dev/null` preserves `exit 1` and the byte-identical structured stderr envelope. The fix also covers `INVALID_USAGE` (`--depth 0`), not only `INVALID_INPUT`. | Preserve the cross-platform redirection matrix and repeat it against release artefacts. |
+| AUD-615-RISK-L0 | High / regression | **Confirmed fixed.** `risk --limit 0` returns in about 0.8–1.5 s with `status: zero_row_view`, `analysis_skipped: true`, empty requested rows and null totals; it avoids constructing the discarded full analysis. | Keep the semantic zero-row contract and test non-zero limits through the normal analysis path. |
+| AUD-615-SELFTEST-TIMEOUT | High / contract regression | **Confirmed fixed in this sample.** `selftest --timeout 5` returns exit 75 with 8,365 bytes of structured diagnostics, including the fourth attempt. This improves the mixed evidence from previous rounds but does not prove the separate hang impossible. | Keep the overall deadline, child budget propagation and code-75 envelope under repeated installed-CLI runs. |
+| AUD-615-L | Critical / regression | **Open, scope corrected.** `audit-report --format markdown` remains non-deterministic under contention: identical `thingsboard` runs measured 200 s timeout versus 137.98 s success; an isolated run took 114 s. The 700 s fork lost its output to shared scratch interference. JSON/YAML returned honest `OUTPUT_TOO_LARGE`, so they are not part of this bug. | Isolate per-run artefacts, profile contention/cache/worker scheduling, add stage visibility and a bounded timeout with structured failure/partial output. Define the supported size/load envelope. |
+| AUD-615-TUTORIALS | High / availability trend | Root compact on `tutorials` increased monotonically from 4m00.1s in 5.9.6 to 6m20.1s in 5.9.9, exit 124 with zero stdout. | Attribute and bound the cost before large-monorepo claims. |
+| AUD-615-WIN-PROC | Medium | **Still open.** Seven `ask.exe` processes remained after successful Windows runs; the footprint was small, but descendant cleanup appears incomplete. | Validate process-tree cleanup for successful and timed-out runs with native Windows/Git Bash controls and Job Objects or a verified equivalent. |
+| AUD-615-INTENT-TIE | Medium / semantic | **Closed as a false tie.** The equal score belongs to different questions, not two candidates for one question. `endpoint security` requires an endpoint anchor and refuses without one; `security surface` is repository-wide and resolves. | Keep the focused regression and do not collapse target-required intent into a global query. |
+| AUD-615-E | Low / semantic parity | **Closed in this fix.** All three impact-family not-found paths publish `risk_level: unknown`; a focused TeaVM regression covers the events outlier. | Keep not-found payloads generated from the shared unknown-risk semantics. |
+| AUD-615-07 | Low / evidence conflict | **Closed by isolated verification.** TeaVM's installed-compatible entry point returns `Did you mean: spring-audit?` with exit 2; the report's detailed-table wording is contradicted by both direct evidence and the existing admission regression. | Keep the installed-entry-point assertion green. |
+| AUD-615-JUNIT4 | Medium / classification | **Closed in this fix.** JUnit4 test-only repositories now classify as `test` from dependency and source-location evidence, without a broad name heuristic. | Keep the dependency-plus-source-population regression green. |
+| AUD-615-DRIFT | Low / investigation | **Closed in this fix.** Spring's explicit `default` profile now normalizes to the implicit empty active-profile set in the access-snapshot authority, so implicit capture and explicit `--profile default` read the same series. TeaVM capture/query and a focused store regression pass. | Keep profile normalization at the snapshot boundary. |
+| AUD-615-COLD-COMPACT | Low / product decision | **Closed as an accepted contract.** A byte-identical 88,265-byte result does not contradict the snapshot-dependent compact contract. The product deliberately exposes `estimated_tokens` rather than claiming a hard size ceiling. | Reopen only with evidence that help, payload or manual promise a fixed bound. |
+
+**Methodology control.** Future parallel audits must allocate a unique UUID/timestamp
+scratch directory per fork. Shared `~/askaudit_599` caused cross-fork interference and
+prevented definitive output capture for `AUD-615-L`.
+
+**Commercial interpretation.** The report contains conflicting price bands (`$25-40` and
+`$50-65` per developer/month). Until `AUD-615-L` and the large-repository trend are closed,
+retain the conservative `$25-40` band and do not market `audit-report --format markdown`,
+the root command, or production CI gating for repositories above roughly 3,000 files.
+The additional repositories showed correct Spring/full-stack detection and Chinese README
+encoding handling, with no new false-positive or false-negative finding.
+
+**Confirmed stable in this round.** Root cache reuse (cold 267 s to warm 1-2 s),
+`pr-impact`/`pr-risk --files -`, progress propagation through `pack gate --since`,
+`explain` error routing, impact exit status, self-audit population explanation,
+endpoint compact disclosure, Spring detection across six controls, baseline safety and
+the earlier `/dev/null` fix matrix were revalidated without regression. The intermittent
+`retrieve endpoint-security` issue had no failures in the latest 18 runs (51-run
+history: about 2%); keep it as a monitored investigation rather than a closure claim.
+
+**Commercial interpretation.** The first headline estimate of `$45-58/developer/month`
+is superseded by the corrected assessment of `$25-40/developer/month`. ASK remains
+credible for normal repositories, but the product must not claim enterprise-scale
+support or production CI gating for repositories above roughly 3,000 files until
+`AUD-614-F` and `AUD-614-L` have a bounded, independently reproduced closure. The
+Windows process-tree item remains a platform-specific reliability risk. The absence
+of target mutation remains a positive safety signal, not evidence of availability.
 
 **Commercial interpretation.** Normal repositories up to roughly 4,000 files remain a
 credible adoption target, with the external estimate at **$40-55/developer/month**.

{sourcecode-5.9.8 → sourcecode-5.9.10}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.8`, following the external `5.9.3` reconciliation.**
+> **CURRENT UPDATE — release `5.9.10`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -19,6 +19,20 @@
 > non-reproduction did not cover the payload shape now identified. Details are
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
+> **RE-AUDIT — 5.9.9, received 2026-08-27.** The external re-audit confirms the
+> cache, stdin, progress, error-channel and population corrections, and raises the
+> assessment to the **8.0-8.4/10** range. It does not clear the availability gate:
+> `audit-report --format markdown`
+> remains non-deterministic under contention, while the root compact flow on `tutorials`
+> has worsened across five versions to 6m20.1s with no stdout. `risk . --limit 0` and
+> `selftest --timeout` are now bounded by explicit contracts. The former `/dev/null`
+> false-success is confirmed fixed on Windows/Git Bash in 11/11 reproductions. Do not position ASK
+> for enterprise-scale repositories or production CI gating above roughly 3,000 files
+> until the availability contracts are independently closed. The report contains conflicting
+> commercial bands (`$25-40` and `$50-65`); retain the conservative `$25-40/developer/month`
+> position pending independent closure. Full detail is recorded as `AUD-615` in the
+> development roadmap and defect ledger.
+
 > **RE-AUDIT — 5.9.7, received 2026-08-27.** Three independent forks added roughly
 > 130 invocations and retested the AUD-611 queue. The score rose to **7.8/10** and
 > confirmed the help, stdin, Git-ref, intent, impact-score and progress corrections.

{sourcecode-5.9.8 → sourcecode-5.9.10}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.9.8**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.10**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,7 +8,14 @@
 
 ## 1. ¿Qué es ASK Engine?
 
-### Contratos de fiabilidad de la versión 5.9.8
+### Contratos de fiabilidad de la versión 5.9.10
+
+**Límites de disponibilidad conocidos.** No sitúes `ask audit-report . --format
+markdown` ni el comando raíz compacto detrás de un timeout estricto en repositorios
+de más de unas 3.000 fichas. La entrega Markdown de `audit-report` sigue siendo
+susceptible a contención. Para CI o ejecución supervisada, guarda primero `risk`,
+usa `audit-report --from-risk`, prefiere JSON/YAML y conserva el progreso. El
+estado de cierre está en la [hoja de ruta de desarrollo](DEVELOPMENT-ROADMAP.md#aud-615-re-audit-release-599).
 
 Las entradas inválidas se rechazan antes del análisis costoso mediante el
 envelope estructurado `INVALID_INPUT`: un `--consumer` inexistente, un feed CVE
@@ -1010,7 +1017,7 @@ foto).
 `ask cache freshness .` si necesitas comprobar su relación con el HEAD actual.
 
 **Aviso de tamaño:** la salida completa es grande (~100K–200K tokens en repos medianos).
-- `--compact`: emite un subconjunto compacto (~10K tokens): status, `git_head`, stacks, puntos de entrada y dependencias clave. **Seguro para inyectar directamente en una IA.**
+- `--compact`: emite un subconjunto de orientación con `status`, `git_head`, stacks y puntos de entrada. Su tamaño depende del snapshot persistido y no tiene un techo fijo; para imponer un límite de salida usa la configuración de ceiling o guarda la respuesta con `--output`. **Comprueba `estimated_tokens` antes de inyectarlo directamente en una IA.**
 - `--output` / `-o`: guarda la foto completa en fichero para herramientas de búsqueda local.
 - `--copy` / `-c`: al portapapeles. Con la salida completa esto son cientos de KB; normalmente lo que quieres copiar es `--compact -c`.
 

{sourcecode-5.9.8 → sourcecode-5.9.10}/docs/USER_GUIDE.md

@@ -46,16 +46,23 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.8, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.10, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.8, with release-artifact verification
+the two pack fixes are included in release 5.9.10, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.8
+### Reliability contracts in 5.9.10
+
+**Known availability limits.** Do not place `ask audit-report . --format markdown`
+or the root compact command behind a strict timeout on repositories above roughly
+3,000 files. Markdown audit-report delivery is still contention-sensitive; for a
+supervised or CI workflow, save `risk` first and use `audit-report --from-risk`,
+prefer JSON/YAML, and retain progress output. The current closure status is in the
+[development roadmap](DEVELOPMENT-ROADMAP.md#aud-615-re-audit-release-599).
 
 Invalid analysis inputs fail before expensive work and use the structured
 `INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
@@ -236,7 +243,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.8
+# ask 5.9.10
 ```
 
 Requires Python 3.9+.
@@ -629,6 +636,11 @@ JSON output includes `evidence_manifest`: stable claim IDs mapped to source span
 inputs, ASK version, git HEAD and freshness metadata. Signed reports sign this manifest as
 part of the canonical payload.
 
+On large repositories, do not use Markdown delivery in a strict-timeout CI path:
+the current reliability queue records contention-sensitive completion. Persist a
+`risk` payload first and use `--from-risk`; JSON/YAML are the safer supervised
+formats while the Markdown issue remains open.
+
 ```bash
 ask audit-report .
 ask audit-report . --profile prod --format markdown

{sourcecode-5.9.8 → sourcecode-5.9.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.8"
+version = "5.9.10"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.8 → sourcecode-5.9.10}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.8"
+__version__ = "5.9.10"

{sourcecode-5.9.8 → sourcecode-5.9.10}/src/sourcecode/access_drift.py

@@ -44,6 +44,12 @@ UNMATCHED = "no_rule_matched"
 _NOT_A_CLASS = frozenset({"chains", "summary"})
 
 
+def normalise_profiles(profiles: "Optional[set[str]]") -> "set[str]":
+    """Map Spring's implicit ``default`` profile to the empty active set."""
+    return {str(profile).strip() for profile in (profiles or set())
+            if str(profile).strip() and str(profile).strip() != "default"}
+
+
 def _utc_now() -> str:
     return datetime.now(timezone.utc).replace(microsecond=0).isoformat()
 
@@ -83,10 +89,11 @@ def build_snapshot(
     """One capture of the effective access under a profile set."""
     from sourcecode.architectural_baseline import git_commit
 
+    active_profiles = normalise_profiles(profiles)
     if posture is None:
         from sourcecode.posture import build_posture
 
-        posture = build_posture(Path(root), set(profiles or ()), properties)
+        posture = build_posture(Path(root), active_profiles, properties)
 
     routes = routes_from_posture(posture)
     by_class: "dict[str, int]" = {}
@@ -100,7 +107,7 @@ def build_snapshot(
         "captured_at": _utc_now(),
         "commit": commit if commit is not None else git_commit(Path(root)),
         "repo": Path(root).name,
-        "profiles": sorted(profiles or ()),
+        "profiles": sorted(active_profiles),
         "counts": {
             "routes": len(routes),
             "by_access_class": dict(sorted(by_class.items())),
@@ -138,7 +145,7 @@ def load_series(out_dir: Path, *, profiles: "Optional[set]" = None) -> "list[dic
     if not out_dir.is_dir():
         return []
     series: "list[dict]" = []
-    wanted = sorted(profiles) if profiles is not None else None
+    wanted = sorted(normalise_profiles(profiles)) if profiles is not None else None
     for path in sorted(out_dir.glob(f"{FILENAME_PREFIX}*.json")):
         try:
             payload = json.loads(path.read_text(encoding="utf-8"))

{sourcecode-5.9.8 → sourcecode-5.9.10}/src/sourcecode/classifier.py

@@ -280,6 +280,17 @@ class TypeClassifier:
         if stack_names & _JVM_STACKS and self._is_multi_module(file_tree):
             return "library"
 
+        # A JUnit 4-only repository is a test suite, not an unknown application.
+        # Require both the dependency and test-only Java sources so an ordinary
+        # library that uses JUnit for its own tests keeps its structural type.
+        java_paths = [path for path in flat_paths if path.endswith(".java")]
+        if (
+            "JUnit 4" in framework_names
+            and java_paths
+            and all("/src/test/" in path or path.startswith("src/test/") for path in java_paths)
+        ):
+            return "test"
+
         # Weak CLI heuristic: a top-level bin/ directory (only when nothing stronger).
         if any(path.startswith("bin/") for path in flat_paths):
             return "cli"

{sourcecode-5.9.8 → sourcecode-5.9.10}/src/sourcecode/cli.py

@@ -1029,6 +1029,11 @@ def _set_detected_path(value: str) -> None:
     _tls.detected_path = value
 
 
+def _explicit_path_was_supplied() -> bool:
+    """Whether argv contained a repository path later removed by preprocessing."""
+    return bool(_tls.__dict__.get("explicit_path", False))
+
+
 # Options that take a value token — their next arg must not be treated as a path.
 _OPTIONS_WITH_VALUE: frozenset[str] = frozenset({
     "--format", "-f",
@@ -1271,6 +1276,7 @@ def _preprocess_args(args: list[str]) -> list[str]:
     ``_reject_path_before_subcommand``.
     """
     result = _normalise_repository_option(list(args))
+    _tls.explicit_path = False
     skip_next = False
     _path_index: int = -1
     for i, arg in enumerate(result):
@@ -1302,13 +1308,14 @@ def _preprocess_args(args: list[str]) -> list[str]:
         # A single missing token that is very close to a command is a command
         # typo, not a repository path. Existing directories retain the implicit
         # `ask <path>` grammar, including names that resemble commands.
-        if not Path(arg).exists():
+        if not Path(arg).exists() and "/" not in arg and "\\" not in arg:
             _command_matches = difflib.get_close_matches(
                 arg, sorted(_SUBCOMMANDS), n=3, cutoff=0.6
             )
             if _command_matches:
                 _reject_unknown_command(arg)
         _set_detected_path(arg)
+        _tls.explicit_path = True
         _path_index = i
     if _path_index >= 0:
         result.pop(_path_index)
@@ -5327,7 +5334,7 @@ def main(
     # Bare invocation at a human terminal → branded quickstart instead of
     # dumping a large JSON blob. Agents/pipes are untouched: any arg/flag, or a
     # non-TTY stdout (piped), falls through to the normal analysis + JSON.
-    if len(sys.argv) <= 1 and sys.stdout.isatty():
+    if len(sys.argv) <= 1 and not _explicit_path_was_supplied() and sys.stdout.isatty():
         _print_welcome()
         raise typer.Exit()
 
@@ -13393,7 +13400,7 @@ def risk_cmd(
     """
     _require_answer_delivery("risk")
     _apply_jobs(jobs)
-    from sourcecode.risk import build_risk
+    from sourcecode.risk import build_risk, zero_risk_payload
 
     path = _admit_path(path)
     # B18: both spellings of the same fact, resolved by the crosswalk the report
@@ -13433,6 +13440,19 @@ def risk_cmd(
             raise typer.Exit(code=1)
         band_filter = _resolved_band
 
+    # AUD-614-RISK-L0: a zero-row view must not construct the full repository-wide
+    # composer only to discard every result. The payload says totals were skipped,
+    # rather than turning an empty requested view into a false zero census.
+    if limit == 0 and not table and not rule_filter and band_filter is None and not top_n:
+        data = zero_risk_payload(
+            path, min_band=min_band, profiles=_profile_set(profile),
+        )
+        _emit_command_output(
+            _serialize_dict(data, format), output_path, copy,
+            success_msg=f"risk written to {output_path} (0 rows requested)",
+        )
+        return
+
     # `risk` composes six axes by re-reading five other commands' authorities — it
     # is the slowest command in the CLI (15s on BroadleafCommerce) and shipped
     # without a single byte on stderr while it ran.
@@ -13841,6 +13861,10 @@ def audit_report_cmd(
     `--sign-key` adds an HMAC-SHA256 signature over the canonical JSON payload.
     The key is local and explicit; no network trust service or new PKI is implied.
 
+    On repositories above roughly 3,000 files, do not put Markdown delivery
+    behind a strict timeout: it remains contention-sensitive. For supervised
+    automation, persist `risk` first, use `--from-risk`, and prefer JSON/YAML.
+
     \b
     Examples:
       ask audit-report .
@@ -19483,7 +19507,8 @@ def cold_start_cmd(
     finally:
         _prog.stop()
     if compact:
-        # P1-C: cap at ~10K tokens — keep the fields that orient a reader.
+        # Keep the fields that orient a reader; the resulting size depends on
+        # the stored snapshot and is not a fixed token ceiling.
         #
         # B14. This used to be a fixed key allowlist and a silent `[:30]`, and it
         # took 1 968 807 characters to 16 452 (−99,2 %) while removing 11 of 19

{sourcecode-5.9.8 → sourcecode-5.9.10}/src/sourcecode/context_summarizer.py

@@ -38,6 +38,7 @@ _TYPE_LABELS: dict[str, str] = {
     "cli": "CLI tool",
     "worker": "Background worker / service",
     "library": "Library / package",
+    "test": "Test suite",
     "unknown": "Application",
 }