sourcecode 5.9.8__tar.gz → 5.9.9__tar.gz

{sourcecode-5.9.8 → sourcecode-5.9.9}/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [5.9.9] — 2026-08-27
+
+*Release-alignment patch release.*
+
+**Release**
+
+- Synchronizes the package, CLI, README and user-guide version surfaces at `5.9.9`.
+- Carries forward the `5.9.8` reliability fixes and their dedicated TeaVM validation.
+- Keeps the `AUD-614` availability and native Windows/MSYS verification items explicitly open.
+
 ## [5.9.8] — 2026-08-27
 
 *Audit correction and contract-alignment patch release.*

{sourcecode-5.9.8 → sourcecode-5.9.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.8
+Version: 5.9.9
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.8-blue)
+![Version](https://img.shields.io/badge/version-5.9.9-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.8 retains the shared Canonical IR
+**Current performance status.** Release 5.9.9 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -218,7 +218,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.8 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.9 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -251,7 +251,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.8 — and, on a build that has aged,
+ask version                    # ask 5.9.9 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.8 → sourcecode-5.9.9}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.8-blue)
+![Version](https://img.shields.io/badge/version-5.9.9-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.8 retains the shared Canonical IR
+**Current performance status.** Release 5.9.9 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -169,7 +169,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.8 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.9 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -202,7 +202,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.8 — and, on a build that has aged,
+ask version                    # ask 5.9.9 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.8 → sourcecode-5.9.9}/docs/DEFECT-LEDGER.md

@@ -95,6 +95,39 @@ because the prior external round reproduced it. The new queue is:
 | AUD-612-09 | Medium | closed | `--files -` is documented and enforced as a newline-delimited changed-path list; raw unified diffs fail with an `--name-only` conversion hint. Dedicated TeaVM regressions pass. |
 | AUD-612-14 | Medium | closed | The current population is 104 CLI leaves versus 110 MCP tools, explicitly decomposed as 101 runtime-derived plus 9 native orchestration tools; `mcp list-tools --json` matches and the relationship is published. Existing TeaVM-backed population regression passes. |
 | AUD-612-R | Medium | closed | README, English guide and Spanish manual document that `rename-class` requires `--from/--to`, the old positional syntax is unsupported, and `--dry-run` is the migration safety step. TeaVM dry-run verification passes. |
+| AUD-613-ROOT | High | closed 5.9.8 | On a TTY, explicit `ask .` was misclassified as bare `ask` after path preprocessing and rendered only the welcome card. An explicit-path marker now distinguishes both flows; TeaVM pseudo-TTY and focused CLI regressions pass. |
+
+**External audit intake `AUD-614`, re-audit of release 5.9.8 — 2026-08-27.**
+Five clean forks exercised the `testing/` corpus without target-repository writes,
+commits or Java-file changes. The initial **8.0/10** score was superseded by the
+addendum confirming a second severe availability regression; the governing score is
+**7.5/10**. Previously closed semantic fixes remained stable, but the following rows
+are the current release blockers and contract gaps:
+
+| ID | Severity | Status | Evidence / closure boundary |
+|---|---:|---|---|
+| AUD-614-F | Critical | closed 5.9.8 (reverified) | The external `/dev/null` false-success is not reproducible in the current checkout: invalid TeaVM input returns `exit 1` and identical structured stderr whether stdout is captured or discarded. A dedicated redirection regression protects the boundary. Native Windows/MSYS release-artifact verification remains required because the external evidence conflicts. |
+| AUD-614-L | Critical / regression | open | `audit-report` is contention-sensitive on `thingsboard` (3,714 files): one clean run completed in 136 s, while concurrent/isolated runs exceeded 5 minutes; JSON, YAML and Markdown all exhibited the problem. `tutorials` reached 5m39.6s with zero stdout. Requires profiling, stage visibility, deadline and structured partial output. |
+| AUD-614-RISK-L0 | High / regression | closed 5.9.8 | `risk --limit 0` now returns a fast explicit zero-row view without constructing the repository-wide composer. It publishes `risks: []`, `shown: 0`, null totals and `analysis_skipped: true`; the TeaVM flow and dedicated regression pass. |
+| AUD-614-SELFTEST-TIMEOUT | High / contract regression | closed 5.9.8 | `selftest --timeout` is now an overall deadline; each child receives the remaining budget, interrupted/unstarted rows are structured as `error`, and the command returns code 75. The real TeaVM flow and dedicated regression pass. The separate fourth-run hang remains mixed evidence. |
+| AUD-614-WIN-PROC | Medium | open | Windows/MSYS timeout or SIGTERM can leave `ask.exe` descendants alive, with MSYS PIDs unusable by native `taskkill`. Validate signal handling and Windows Job Objects from native Windows and Git Bash. |
+| AUD-614-G | Medium | closed 5.9.8 | The shared error authority normalizes legacy producer spellings to canonical uppercase codes (`NO_DIFF_SOURCE`, `INVALID_LICENSE`). TeaVM `review-pr` and activation contract tests pass. |
+| AUD-614-E | Low | open | Impact commands now agree on unresolved exit status, but their `risk_level` values still diverge (`unknown`/`low`/`unknown`). Define one not-found payload semantics and enforce parity. |
+| AUD-614-I | Medium | closed 5.9.8 | The user manual and internal compacting comment no longer promise `~10K`; they state that `cold-start --compact` is snapshot-dependent, expose `estimated_tokens`, and require size validation before direct AI injection. The CLI help and payload already used this contract. A hard ceiling remains optional future scope. |
+| AUD-614-INTENT-TIE | Medium | open | Exact lexical ties at score `2.8284` still resolve differently for `endpoint security` and `security surface`. Define deterministic tie/margin semantics and add a real-repository regression. |
+| AUD-614-07 | Low | closed 5.9.8 (reverified) | The installed `ask spring-audi` entry point returns `Did you mean: spring-audit?`; the TeaVM path/typo regression battery passes. The external wording report is not reproducible in the current checkout. |
+| AUD-614-JUNIT4 | Medium | open | JUnit4 projects remain `project_type: unknown`; add evidence-backed classification without broad heuristic false positives. |
+
+The audit also confirms root cache reuse, stdin contracts, pack progress, explain and
+impact error routing, self-audit population disclosure, endpoint compact disclosure,
+Spring detection controls, baseline safety and the prior `/dev/null` fix matrix. The
+intermittent endpoint-security retrieval issue had 0/18 failures in this pass and stays
+under observation because its historical rate is about 2% over 51 runs.
+
+**Commercial boundary.** The corrected assessment is `$25-40/developer/month`, not the
+initial `$45-58` headline. Do not market enterprise-scale support or production CI
+gating for repositories above roughly 3,000 files until the four critical/high
+availability and error-transport rows are independently closed with bounded evidence.
 
 Commercially, normal repositories up to about 4,000 files remain viable at a provisional
 $40-55/developer/month. B02, B04 and L block annual CI-gating and extreme-monorepo claims;

{sourcecode-5.9.8 → sourcecode-5.9.9}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,10 +3,15 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.8`; external reconciliation `AUD-612` is partially closed, with scale blockers retained.**
-> The latest re-audit confirms the main B05-B11 corrections but adds a confirmed
-> `audit-report` performance regression, a YAML cache-hit disclosure defect and
-> several contract-parity gaps. `AUD-611` remains the preceding audit record.
+> **CURRENT QUEUE — release `5.9.9`; external re-audit `AUD-614` remains the reliability gate.**
+> The latest external pass confirms the cache, stdin, progress, error-channel and
+> population fixes, but reports a serious availability regression: `audit-report`
+> is contention-sensitive on a normal large repository. The `/dev/null` report is
+> reverified as fixed in the current checkout; native Windows/MSYS release-artifact
+> confirmation remains. `risk --limit 0` and the `selftest --timeout` contract are now
+> closed in this cycle; Windows process-tree cleanup remains separately open.
+> `AUD-612` remains the preceding audit record; `AUD-614` is the governing queue
+> for the current `5.9.9` state, carrying forward the `5.9.8` fixes.
 > The 2026-08-27 external review adds `AUD-610-B01` through `AUD-610-B10`, led by
 > silent `selftest` nondeterminism, silent root/audit-report failures, a legal-zero
 > `risk --limit 0` crash, an unvalidated consumer path and contradictory Spring
@@ -242,6 +247,46 @@ that result remains release-artifact verification rather than erased history.
 | AUD-612-09 | Medium / docs | **Closed in this fix.** Help now describes `--files -` as a newline-delimited changed-path list. Raw unified diffs are rejected early with an `--name-only` conversion hint instead of being interpreted as file paths. TeaVM list and rejection regressions pass. | Keep the stdin grammar and raw-diff rejection tests green. |
 | AUD-612-14 | Medium / governance | **Closed in this reconciliation.** Current `self-audit` publishes 104 registered CLI leaves and 110 served MCP tools, decomposed as 101 runtime-derived plus 9 native orchestration tools; `mcp list-tools --json` matches 110. The payload states that the populations are intentionally different and gives the formula. Existing TeaVM-backed population regression passes. | Keep the population formula and parity regression generated from the live registries. |
 | AUD-612-R | Medium / migration | **Closed in this fix.** The explicit `--from/--to` contract is now documented in README, English guide and Spanish manual; the old positional syntax is explicitly marked unsupported and `--dry-run` is recommended for script migration. TeaVM dry-run verification passes. | Keep migration guidance aligned with the live command signature. |
+| AUD-613-ROOT | High / regression | **Closed in this fix.** On a TTY, explicit `ask <repo>` paths were removed during argv preprocessing and misclassified as a bare invocation, so `ask .` rendered only the welcome card. The preprocessor now retains an explicit-path marker: bare `ask` still shows the welcome card, while `ask .` analyzes and emits JSON. A real TeaVM pseudo-TTY run and focused CLI regressions pass. | Keep the bare-invocation versus explicit-root differential test green. |
+
+### External Audit Intake — `AUD-614` re-audit, release 5.9.8
+
+The external re-audit covered the repositories under `Documents/workspace/testing/`
+using five clean forks. It reports no target-repository writes, commits or Java-file
+changes. The initial score of **8.0/10** was superseded by the addendum after the
+previously incomplete `risk --limit 0` run was confirmed; the governing assessment is
+**7.5/10**, the first decline in the series. No previously closed semantic fix was
+reported as broken, but availability and contract reliability regressed.
+
+| ID | Severity | Finding | Required future closure |
+|---|---:|---|---|
+| AUD-614-F | Critical | **Closed in this verification.** The reported `/dev/null` false-success is not reproducible in the current `5.9.8` checkout: invalid TeaVM input returns `exit 1` and the identical structured stderr envelope with normal stdout capture or stdout discarded. A dedicated redirection matrix now protects this boundary. Keep release-artifact verification on native Windows/MSYS because the external witness remains contradictory. | Keep the redirection matrix green across error classes, entry points and platforms. |
+| AUD-614-L | Critical / regression | `audit-report` is not reliably bounded. `thingsboard` (3,714 files) completed once in 136 s but timed out after more than 5 minutes under concurrent load; JSON, YAML and Markdown all showed the same sensitivity. `tutorials` remained at 5m39.6s with zero stdout. | Profile contention and shared-cache/worker behaviour, expose stages, enforce a deadline and structured partial/failure output, and define a supported repository-size/load envelope. |
+| AUD-614-RISK-L0 | High / regression | **Closed in this fix.** `risk --limit 0` now returns a fast explicit zero-row view without constructing the repository-wide composer. It publishes `risks: []`, `shown: 0`, null totals and `analysis_skipped: true`, so an empty requested view is not misread as a zero-risk census. The real TeaVM flow completes within 12 s and the dedicated regression passes. | Keep the zero-row contract and ensure filters that request actual composition continue through the normal analysis path. |
+| AUD-614-SELFTEST-TIMEOUT | High / contract regression | **Closed in this fix.** `selftest` now treats `--timeout` as an overall execution deadline, bounds each child by the remaining budget, emits structured errors for the interrupted and unstarted rows, and returns code 75. The real TeaVM flow and dedicated regression pass. The separate fourth-run hang remains mixed evidence. | Keep the parent/child deadline and code-75 contract green on the installed entry point and TeaVM. |
+| AUD-614-WIN-PROC | Medium | On Windows/MSYS, timeout or SIGTERM can leave `ask.exe` descendants alive; the MSYS PID cannot be cleaned with native `taskkill`. The audit observed low-memory orphan processes after a timed-out run. | Implement signal/CTRL_BREAK cleanup and Windows Job Objects or document a verified equivalent; test parent and descendant termination from native Windows and Git Bash. |
+| AUD-614-G | Medium | **Closed in this fix.** The shared error authority now normalizes legacy producer spellings to canonical uppercase codes: `NO_DIFF_SOURCE` and `INVALID_LICENSE`. The TeaVM `review-pr` flow and activation contract tests pass. | Keep all public error producers on the canonical code authority. |
+| AUD-614-E | Low / semantic parity | The impact family now returns consistent `exit 1` for unresolved symbols, but `risk_level` still differs cosmetically (`unknown`/`low`/`unknown`) across the three commands. | Decide one not-found semantic shape and generate all impact-family payloads from it. |
+| AUD-614-I | Medium / contract | **Closed in this fix.** The user manual no longer promises `~10K` for `cold-start --compact`; it now states that the orientation subset depends on the stored snapshot, exposes `estimated_tokens`, and recommends checking the measured size before direct AI injection. The CLI help and payload already carried the same non-fixed-size contract. | Keep the manual, help and payload wording derived from the snapshot-size contract; a hard ceiling remains a separate product decision. |
+| AUD-614-INTENT-TIE | Medium | Equal lexical scores (`2.8284`) still produce different verdicts: `endpoint security` is refused while `security surface` resolves. This has remained unchanged for two rounds and exposes unstable tie semantics. | Define deterministic tie handling, publish the competing intents and margin, and add a real-repository regression for exact-score collisions. |
+| AUD-614-07 | Low / UX regression | **Closed in this verification.** The installed `ask spring-audi` entry point returns the command-admission error with `Did you mean: spring-audit?`; the TeaVM path/typo regression battery passes. The external wording report is not reproducible in the current checkout. | Keep command admission, error wording and help aligned in the installed-CLI test. |
+| AUD-614-JUNIT4 | Medium / classification | JUnit4 repositories remain classified as `unknown`; no change from the previous audit. | Add evidence-backed JUnit4 detection without weakening confidence or introducing Kotlin/Java false positives. |
+
+**Confirmed stable in this round.** Root cache reuse (cold 267 s to warm 1-2 s),
+`pr-impact`/`pr-risk --files -`, progress propagation through `pack gate --since`,
+`explain` error routing, impact exit status, self-audit population explanation,
+endpoint compact disclosure, Spring detection across six controls, baseline safety and
+the earlier `/dev/null` fix matrix were revalidated without regression. The intermittent
+`retrieve endpoint-security` issue had no failures in the latest 18 runs (51-run
+history: about 2%); keep it as a monitored investigation rather than a closure claim.
+
+**Commercial interpretation.** The first headline estimate of `$45-58/developer/month`
+is superseded by the corrected assessment of `$25-40/developer/month`. ASK remains
+credible for normal repositories, but the product must not claim enterprise-scale
+support or production CI gating for repositories above roughly 3,000 files until
+`AUD-614-F` and `AUD-614-L` have a bounded, independently reproduced closure. The
+Windows process-tree item remains a platform-specific reliability risk. The absence
+of target mutation remains a positive safety signal, not evidence of availability.
 
 **Commercial interpretation.** Normal repositories up to roughly 4,000 files remain a
 credible adoption target, with the external estimate at **$40-55/developer/month**.

{sourcecode-5.9.8 → sourcecode-5.9.9}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.8`, following the external `5.9.3` reconciliation.**
+> **CURRENT UPDATE — release `5.9.9`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -19,6 +19,19 @@
 > non-reproduction did not cover the payload shape now identified. Details are
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
+> **RE-AUDIT — 5.9.9, received 2026-08-27.** The external re-audit confirms the
+> cache, stdin, progress, error-channel and population corrections, but the corrected
+> score is **7.5/10** after confirming a serious availability regression. `audit-report`
+> is sensitive to contention and can exceed five minutes even on a 3,714-file repository;
+> `risk . --limit 0` and `selftest --timeout` were also investigated and are now
+> bounded by explicit contracts. The long-standing `/dev/null` false-success is
+> reverified as fixed in the current checkout, with native Windows/MSYS artifact
+> confirmation still pending; `audit-report` remains sensitive to contention. Do not position ASK
+> for enterprise-scale repositories or production CI gating above roughly 3,000 files
+> until these remaining bounded reliability contracts are independently closed. The corrected commercial estimate is
+> `$25-40/developer/month`, superseding the preliminary `$45-58` headline. Full detail
+> is recorded as `AUD-614` in the development roadmap and defect ledger.
+
 > **RE-AUDIT — 5.9.7, received 2026-08-27.** Three independent forks added roughly
 > 130 invocations and retested the AUD-611 queue. The score rose to **7.8/10** and
 > confirmed the help, stdin, Git-ref, intent, impact-score and progress corrections.

{sourcecode-5.9.8 → sourcecode-5.9.9}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.9.8**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.9**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,7 +8,7 @@
 
 ## 1. ¿Qué es ASK Engine?
 
-### Contratos de fiabilidad de la versión 5.9.8
+### Contratos de fiabilidad de la versión 5.9.9
 
 Las entradas inválidas se rechazan antes del análisis costoso mediante el
 envelope estructurado `INVALID_INPUT`: un `--consumer` inexistente, un feed CVE
@@ -1010,7 +1010,7 @@ foto).
 `ask cache freshness .` si necesitas comprobar su relación con el HEAD actual.
 
 **Aviso de tamaño:** la salida completa es grande (~100K–200K tokens en repos medianos).
-- `--compact`: emite un subconjunto compacto (~10K tokens): status, `git_head`, stacks, puntos de entrada y dependencias clave. **Seguro para inyectar directamente en una IA.**
+- `--compact`: emite un subconjunto de orientación con `status`, `git_head`, stacks y puntos de entrada. Su tamaño depende del snapshot persistido y no tiene un techo fijo; para imponer un límite de salida usa la configuración de ceiling o guarda la respuesta con `--output`. **Comprueba `estimated_tokens` antes de inyectarlo directamente en una IA.**
 - `--output` / `-o`: guarda la foto completa en fichero para herramientas de búsqueda local.
 - `--copy` / `-c`: al portapapeles. Con la salida completa esto son cientos de KB; normalmente lo que quieres copiar es `--compact -c`.
 

{sourcecode-5.9.8 → sourcecode-5.9.9}/docs/USER_GUIDE.md

@@ -46,16 +46,16 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.8, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.9, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.8, with release-artifact verification
+the two pack fixes are included in release 5.9.9, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.8
+### Reliability contracts in 5.9.9
 
 Invalid analysis inputs fail before expensive work and use the structured
 `INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
@@ -236,7 +236,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.8
+# ask 5.9.9
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.8 → sourcecode-5.9.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.8"
+version = "5.9.9"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.8 → sourcecode-5.9.9}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.8"
+__version__ = "5.9.9"

{sourcecode-5.9.8 → sourcecode-5.9.9}/src/sourcecode/cli.py

@@ -1029,6 +1029,11 @@ def _set_detected_path(value: str) -> None:
     _tls.detected_path = value
 
 
+def _explicit_path_was_supplied() -> bool:
+    """Whether argv contained a repository path later removed by preprocessing."""
+    return bool(_tls.__dict__.get("explicit_path", False))
+
+
 # Options that take a value token — their next arg must not be treated as a path.
 _OPTIONS_WITH_VALUE: frozenset[str] = frozenset({
     "--format", "-f",
@@ -1271,6 +1276,7 @@ def _preprocess_args(args: list[str]) -> list[str]:
     ``_reject_path_before_subcommand``.
     """
     result = _normalise_repository_option(list(args))
+    _tls.explicit_path = False
     skip_next = False
     _path_index: int = -1
     for i, arg in enumerate(result):
@@ -1302,13 +1308,14 @@ def _preprocess_args(args: list[str]) -> list[str]:
         # A single missing token that is very close to a command is a command
         # typo, not a repository path. Existing directories retain the implicit
         # `ask <path>` grammar, including names that resemble commands.
-        if not Path(arg).exists():
+        if not Path(arg).exists() and "/" not in arg and "\\" not in arg:
             _command_matches = difflib.get_close_matches(
                 arg, sorted(_SUBCOMMANDS), n=3, cutoff=0.6
             )
             if _command_matches:
                 _reject_unknown_command(arg)
         _set_detected_path(arg)
+        _tls.explicit_path = True
         _path_index = i
     if _path_index >= 0:
         result.pop(_path_index)
@@ -5327,7 +5334,7 @@ def main(
     # Bare invocation at a human terminal → branded quickstart instead of
     # dumping a large JSON blob. Agents/pipes are untouched: any arg/flag, or a
     # non-TTY stdout (piped), falls through to the normal analysis + JSON.
-    if len(sys.argv) <= 1 and sys.stdout.isatty():
+    if len(sys.argv) <= 1 and not _explicit_path_was_supplied() and sys.stdout.isatty():
         _print_welcome()
         raise typer.Exit()
 
@@ -13393,7 +13400,7 @@ def risk_cmd(
     """
     _require_answer_delivery("risk")
     _apply_jobs(jobs)
-    from sourcecode.risk import build_risk
+    from sourcecode.risk import build_risk, zero_risk_payload
 
     path = _admit_path(path)
     # B18: both spellings of the same fact, resolved by the crosswalk the report
@@ -13433,6 +13440,19 @@ def risk_cmd(
             raise typer.Exit(code=1)
         band_filter = _resolved_band
 
+    # AUD-614-RISK-L0: a zero-row view must not construct the full repository-wide
+    # composer only to discard every result. The payload says totals were skipped,
+    # rather than turning an empty requested view into a false zero census.
+    if limit == 0 and not table and not rule_filter and band_filter is None and not top_n:
+        data = zero_risk_payload(
+            path, min_band=min_band, profiles=_profile_set(profile),
+        )
+        _emit_command_output(
+            _serialize_dict(data, format), output_path, copy,
+            success_msg=f"risk written to {output_path} (0 rows requested)",
+        )
+        return
+
     # `risk` composes six axes by re-reading five other commands' authorities — it
     # is the slowest command in the CLI (15s on BroadleafCommerce) and shipped
     # without a single byte on stderr while it ran.
@@ -19483,7 +19503,8 @@ def cold_start_cmd(
     finally:
         _prog.stop()
     if compact:
-        # P1-C: cap at ~10K tokens — keep the fields that orient a reader.
+        # Keep the fields that orient a reader; the resulting size depends on
+        # the stored snapshot and is not a fixed token ceiling.
         #
         # B14. This used to be a fixed key allowlist and a silent `[:30]`, and it
         # took 1 968 807 characters to 16 452 (−99,2 %) while removing 11 of 19

{sourcecode-5.9.8 → sourcecode-5.9.9}/src/sourcecode/error_schema.py

@@ -8,6 +8,19 @@ INVALID_USAGE_CODE = "INVALID_USAGE"
 EXECUTION_FAILED_CODE = "EXECUTION_FAILED"
 INTERNAL_ERROR_CODE = "INTERNAL_ERROR"
 
+# Domain-specific producers historically used snake_case while the public error
+# contract uses canonical uppercase identifiers. Keep the normalization here so
+# every CLI surface that builds the shared envelope agrees.
+_CANONICAL_CODE_ALIASES = {
+    "no_diff_source": "NO_DIFF_SOURCE",
+    "invalid_license": "INVALID_LICENSE",
+}
+
+
+def canonical_error_code(code: str) -> str:
+    """Return the public spelling for a producer's error code."""
+    return _CANONICAL_CODE_ALIASES.get(code, code)
+
 #: The exit code each error class leaves with — the other half of `AUD-596-D11`.
 #:
 #: That row closed the *code* half: `INVALID_INPUT` used to exit 1 or 2 depending
@@ -59,6 +72,7 @@ def build_error_object(
     hint: str | None = None,
     expected: str | None = None,
 ) -> dict[str, str]:
+    code = canonical_error_code(code)
     return {
         "code": code,
         "message": message,

{sourcecode-5.9.8 → sourcecode-5.9.9}/src/sourcecode/risk.py

@@ -50,6 +50,67 @@ if TYPE_CHECKING:
 RISK_SCHEMA = "risk-v1"
 
 
+def zero_risk_payload(
+    root: Path,
+    *,
+    min_band: str,
+    profiles: "Optional[set[str]]" = None,
+) -> dict:
+    """Return an honest zero-row view without paying for repository analysis.
+
+    `--limit 0` asks for no risk rows. Running the full composer and then slicing
+    to zero paid the repository-wide analysis cost while producing no evidence.
+    Totals are therefore explicitly unknown rather than falsely reported as zero.
+    """
+    from sourcecode import non_coverage
+    from sourcecode.provenance import build_evidence_manifest
+
+    payload: dict[str, Any] = {
+        "schema_version": RISK_SCHEMA,
+        "model": RISK_MODEL,
+        "status": "zero_row_view",
+        "note": (
+            "No risk rows were requested (`--limit 0`), so repository analysis was "
+            "skipped. `risks: []` means no rows were requested, not that the "
+            "repository has no defects. Re-run without zero limit to measure totals."
+        ),
+        "total_defects": None,
+        "total_findings": None,
+        "composition_working_set": {
+            "source_files": None,
+            "audit_findings": None,
+            "candidate_defects": None,
+            "defects_composed": 0,
+            "basis": "analysis skipped because the requested row limit was zero",
+        },
+        "counts_note": (
+            "Totals are null because no repository analysis ran; risks is an empty "
+            "requested view, not a finding census."
+        ),
+        "shown": 0,
+        "by_band": {},
+        "by_tier": {},
+        "risks": [],
+        "limit": 0,
+        "min_band": min_band,
+        "non_coverage": non_coverage.block("security_surface"),
+        "zero_row_view": {
+            "requested_limit": 0,
+            "analysis_skipped": True,
+            "rerun": "ask risk <repository> without --limit 0",
+        },
+    }
+    if profiles is not None:
+        payload["profile_set"] = sorted(profiles)
+    payload["evidence_manifest"] = build_evidence_manifest(
+        payload,
+        command="risk",
+        root=root,
+        inputs={"limit": 0, "min_band": min_band, "profiles": sorted(profiles) if profiles else None},
+    )
+    return payload
+
+
 #: What a bounded row keeps, in one place, so the view and the declaration of the
 #: view cannot be edited apart.
 #:

{sourcecode-5.9.8 → sourcecode-5.9.9}/src/sourcecode/selftest.py

@@ -87,7 +87,7 @@ class Subject:
     entry_point: str
     java_files: int = 0
     platform: str = ""
-    timeout: int = 900
+    timeout: float = 900
 
     def run(
         self, *args: str, sanitize_environment: bool = False
@@ -882,8 +882,9 @@ def run_selftest(
         entry_point=entry_point or _entry_point(),
         platform=f"{_platform_label()} / python "
                  f"{_platform.python_version()}",
-        timeout=timeout,
+        timeout=float(timeout),
     )
+    deadline = time.monotonic() + float(timeout)
     try:
         subject.java_files = len(find_java_files(Path(repo)))
     except Exception:
@@ -894,12 +895,51 @@ def run_selftest(
     unknown = sorted(wanted - {row.id.upper() for row in ROWS})
 
     results: "list[dict[str, Any]]" = []
-    for row in selected:
+    for index, row in enumerate(selected):
         started = time.perf_counter()
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            outcome = _result(
+                ERROR,
+                f"the check did not start before the overall {timeout}s deadline",
+            )
+            results.append({
+                "row": row.id,
+                "what": row.what,
+                "assertion": row.assertion,
+                "seconds": round(time.perf_counter() - started, 2),
+                **outcome,
+            })
+            for pending in selected[index + 1:]:
+                results.append({
+                    "row": pending.id,
+                    "what": pending.what,
+                    "assertion": pending.assertion,
+                    "seconds": 0.0,
+                    **_result(ERROR, f"not started: overall {timeout}s deadline exhausted"),
+                })
+            break
+        subject.timeout = remaining
         try:
             outcome = row.check(subject)
         except subprocess.TimeoutExpired:
             outcome = _result(ERROR, f"the check did not finish in {subject.timeout}s")
+            results.append({
+                "row": row.id,
+                "what": row.what,
+                "assertion": row.assertion,
+                "seconds": round(time.perf_counter() - started, 2),
+                **outcome,
+            })
+            for pending in selected[index + 1:]:
+                results.append({
+                    "row": pending.id,
+                    "what": pending.what,
+                    "assertion": pending.assertion,
+                    "seconds": 0.0,
+                    **_result(ERROR, f"not started: overall {timeout}s deadline exhausted"),
+                })
+            break
         except Exception as exc:  # a broken check is not a passing row
             outcome = _result(ERROR, f"{type(exc).__name__}: {exc}")
         results.append({
@@ -909,6 +949,7 @@ def run_selftest(
             "seconds": round(time.perf_counter() - started, 2),
             **outcome,
         })
+        subject.timeout = float(timeout)
 
     counts = {status: 0 for status in (PASS, FAIL, NOT_APPLICABLE, ERROR)}
     for result in results: