sourcecode 5.9.9__py3-none-any.whl → 5.9.11__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.9"
+__version__ = "5.9.11"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = '9e8ac3fb54c7d82f42f5240ff518ec41276d9bc2'
-CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
-CLOSURE_COVERAGE = {'closed_rows': 142, 'present': 91, 'absent': 0, 'unresolved': 0, 'uncited': 51, 'unknown': 0}
+BUILD_COMMIT = '443139a89c4a318cca61eba18eb95a291255d75d'
+CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-E': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-614-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-615-07': {'commit': '', 'status': 'uncited'}, 'AUD-615-COLD-COMPACT': {'commit': '', 'status': 'uncited'}, 'AUD-615-DRIFT': {'commit': '', 'status': 'uncited'}, 'AUD-615-E': {'commit': '', 'status': 'uncited'}, 'AUD-615-F': {'commit': '', 'status': 'uncited'}, 'AUD-615-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-615-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-615-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-615-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-616-E-PROV': {'commit': '', 'status': 'uncited'}, 'AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07': {'commit': '', 'status': 'uncited'}, 'AUD-616-INTENT-TIE-COV': {'commit': '', 'status': 'uncited'}, 'AUD-616-JUNIT4-SELF': {'commit': '', 'status': 'uncited'}, 'AUD-616-KOTLIN': {'commit': '', 'status': 'uncited'}, 'AUD-616-O': {'commit': '', 'status': 'uncited'}, 'AUD-616-P': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
+CLOSURE_COVERAGE = {'closed_rows': 161, 'present': 91, 'absent': 0, 'unresolved': 0, 'uncited': 70, 'unknown': 0}

sourcecode/_docs/DEFECT-LEDGER.md

@@ -112,11 +112,37 @@ are the current release blockers and contract gaps:
 | AUD-614-SELFTEST-TIMEOUT | High / contract regression | closed 5.9.8 | `selftest --timeout` is now an overall deadline; each child receives the remaining budget, interrupted/unstarted rows are structured as `error`, and the command returns code 75. The real TeaVM flow and dedicated regression pass. The separate fourth-run hang remains mixed evidence. |
 | AUD-614-WIN-PROC | Medium | open | Windows/MSYS timeout or SIGTERM can leave `ask.exe` descendants alive, with MSYS PIDs unusable by native `taskkill`. Validate signal handling and Windows Job Objects from native Windows and Git Bash. |
 | AUD-614-G | Medium | closed 5.9.8 | The shared error authority normalizes legacy producer spellings to canonical uppercase codes (`NO_DIFF_SOURCE`, `INVALID_LICENSE`). TeaVM `review-pr` and activation contract tests pass. |
-| AUD-614-E | Low | open | Impact commands now agree on unresolved exit status, but their `risk_level` values still diverge (`unknown`/`low`/`unknown`). Define one not-found payload semantics and enforce parity. |
+| AUD-614-E | Low | closed 5.9.9 | Event topology now publishes `risk_level: unknown` for `not_found`, matching `impact` and normal `impact-chain`; `low` remains a resolved no-risk result. Focused TeaVM coverage protects the parity. |
 | AUD-614-I | Medium | closed 5.9.8 | The user manual and internal compacting comment no longer promise `~10K`; they state that `cold-start --compact` is snapshot-dependent, expose `estimated_tokens`, and require size validation before direct AI injection. The CLI help and payload already used this contract. A hard ceiling remains optional future scope. |
-| AUD-614-INTENT-TIE | Medium | open | Exact lexical ties at score `2.8284` still resolve differently for `endpoint security` and `security surface`. Define deterministic tie/margin semantics and add a real-repository regression. |
+| AUD-614-INTENT-TIE | Medium | closed 5.9.9 (reclassified) | The equal score belongs to different questions, not competing candidates. `endpoint security` selects a target-required intent and correctly refuses without a route; `security surface` is repository-wide and resolves. A focused regression locks the distinction. |
 | AUD-614-07 | Low | closed 5.9.8 (reverified) | The installed `ask spring-audi` entry point returns `Did you mean: spring-audit?`; the TeaVM path/typo regression battery passes. The external wording report is not reproducible in the current checkout. |
-| AUD-614-JUNIT4 | Medium | open | JUnit4 projects remain `project_type: unknown`; add evidence-backed classification without broad heuristic false positives. |
+| AUD-614-JUNIT4 | Medium | closed 5.9.9 | JUnit4 test-only repositories classify as `test` only with the `junit:junit` coordinate and test-only Java sources; ordinary applications/libraries retain their structural type. |
+
+**External audit intake `AUD-615`, re-audit of release 5.9.9 — 2026-08-27.** The
+auditor exercised only repositories under `testing/` and added three robustness subjects.
+The report contains conflicting headline scores (8.0 and 8.4), and shared fork scratch
+state invalidated the definitive output capture for the long `audit-report` retest. The
+ledger records the evidence and closure boundaries, not either headline score.
+
+| ID | Severity | Status | Evidence / closure boundary |
+|---|---:|---|---|
+| AUD-615-F | Critical | closed 5.9.9 (reverified) | Windows/Git Bash verification confirms 11/11 reproductions: stdout `/dev/null` preserves exit 1 and byte-identical structured stderr, including `INVALID_USAGE` as well as `INVALID_INPUT`. Keep release-artifact coverage. |
+| AUD-615-RISK-L0 | High / regression | closed 5.9.9 (reverified) | `risk --limit 0` completes in about 0.8–1.5 s as `zero_row_view`, with `analysis_skipped: true` and null totals; full analysis is not built for a view that requests no rows. |
+| AUD-615-SELFTEST-TIMEOUT | High / contract regression | closed 5.9.9 (reverified) | `selftest --timeout 5` returns exit 75 and a non-empty structured diagnostic payload, including the fourth attempt in this sample. The independent hang history remains mixed evidence. |
+| AUD-615-L | Critical / regression | open | The defect is isolated to `audit-report --format markdown`: identical `thingsboard` runs measured 200 s timeout versus 137.98 s success, with an isolated 114 s run. JSON/YAML correctly returned structured `OUTPUT_TOO_LARGE`; they are not defective here. The 700 s fork lost output to shared scratch interference. |
+| AUD-615-TUTORIALS | High / availability trend | open | Root compact on `tutorials` increased monotonically from 4m00.1s in 5.9.6 to 6m20.1s in 5.9.9, exit 124 with zero stdout. Attribute and bound the cost before large-monorepo claims. |
+| AUD-615-WIN-PROC | Medium | open | Seven `ask.exe` processes remained after successful Windows runs. Validate descendant cleanup for successful and timed-out runs with native Windows/Git Bash process controls. |
+| AUD-615-INTENT-TIE | Medium | closed 5.9.9 (reclassified) | Equal score across distinct questions is not a tie. The target-required endpoint intent refuses without a route while the global surface intent resolves; a focused regression protects that contract. |
+| AUD-615-E | Low | closed 5.9.9 | All impact-family not-found paths publish `risk_level: unknown`; focused TeaVM coverage protects the former event-topology outlier. |
+| AUD-615-07 | Low / evidence conflict | closed 5.9.9 (reverified) | Isolated TeaVM verification returns `Did you mean: spring-audit?` with exit 2, matching the installed-entry-point regression. The contrary report wording is not reproducible. |
+| AUD-615-JUNIT4 | Medium | closed 5.9.9 | JUnit4 test-only repositories classify as `test` from dependency and source-location evidence, without a broad naming heuristic. |
+| AUD-615-DRIFT | Low / investigation | closed 5.9.9 | Spring's explicit `default` profile is normalized to the implicit empty active-profile set at the access-snapshot boundary. An implicit capture and explicit `--profile default` now read one series; focused and TeaVM regression flows pass. |
+| AUD-615-COLD-COMPACT | Low / product decision | closed 5.9.9 (accepted contract) | A repeated 88,265-byte result is compatible with the documented snapshot-dependent contract. ASK exposes `estimated_tokens`; no hard ceiling is claimed or introduced. |
+
+**Audit-method control:** each parallel fork must use a unique scratch directory; shared
+`~/askaudit_599` caused cross-fork file deletion/interleaving and blocked a definitive L
+result. **Commercially**, conflicting `$25-40` and `$50-65` estimates are not evidence for
+a price increase; retain the conservative band until the availability trend is closed.
 
 The audit also confirms root cache reuse, stdin contracts, pack progress, explain and
 impact error routing, self-audit population disclosure, endpoint compact disclosure,
@@ -124,6 +150,83 @@ Spring detection controls, baseline safety and the prior `/dev/null` fix matrix.
 intermittent endpoint-security retrieval issue had 0/18 failures in this pass and stays
 under observation because its historical rate is about 2% over 51 runs.
 
+**External audit intake `AUD-616`, re-audit of release 5.9.10 — 2026-08-28.** The scope was
+again restricted to `testing/`, with direct re-verification of all twelve `AUD-615` items, a
+robustness sweep over six previously unaudited repositories and five parallel forks, each
+with its own scratch directory — the methodology control `AUD-615` required is now applied.
+The report publishes three headline numbers (8.5 provisional, 8.0 corrected, 8.1 on a
+per-axis rubric); **the governing score is the conservative 8.0/10**, and as before the rows
+below record evidence, not a headline. The installed artefact self-declares `"stale": true`;
+the auditor continued against it deliberately, so every timing is a property of that build.
+No target-repository writes, commits or Java-file changes were reported.
+
+The governing item of this round is the `tutorials` trend: five consecutive releases, each
+slower than the last, with no measurement out of order. It is escalated to critical and
+reclassified from an availability observation to a sustained performance regression.
+
+**Verdict on the round (5.9.11).** Seven of the nine rows are closed, two are partially
+closed and one — `WIN-PROC` — is carried forward as not actionable from a Darwin checkout.
+The two critical rows are the two partial ones, and both for the same reason, stated plainly
+because it changes what a future round should measure: **neither timing symptom reproduces
+in this checkout.** Root `--compact` on `tutorials` completes in 54.9 s, exit 0, 15 KB, and
+`audit-report --format markdown` on `thingsboard` ran 2/2 clean at 39.3 s and 26.8 s. The
+4m00→7m00 trend and the four-round non-completion are properties of the auditor's build and
+platform, and re-measurement there is the outstanding work on both rows.
+
+What was done instead of accepting or dismissing them was to attribute the cost and remove
+the silence. The cost is now published per phase against file count, and two mechanisms
+behind it are closed with a measured **×1.69** on the governing subject — detection 30.3 s →
+9.2 s, total 54.9 s → 32.5 s, payload byte-identical. The silence is closed at both ends: the
+root analysis stops at `ASK_MAX_ANALYSIS_SECONDS` and returns a structured partial envelope
+with a gate verdict instead of zero bytes at exit 124, and the delayed liveness warning names
+the phase, its counts and whether it has changed — the one signal that separates a blocked
+run from a slow one, and the one four consecutive rounds did not have.
+
+Three findings of this round belong to the checkout rather than to the report, and are
+recorded so they are not re-derived. `AUD-616-P`'s race did not reproduce serialized, and the
+double miss reproduced here first was **our own concurrency** — the same contamination
+`AUD-615` had to correct for; a deterministic mechanism with the identical symptom was found
+underneath it and fixed. `AUD-616-JUNIT4-SELF`'s filed remedy would not have closed the row —
+JUnit4 has three `main()`-bearing entry points, so "no entry point" was the wrong condition.
+And the root analysis joining the bounded tier exposed three batteries comparing the two
+command-name vocabularies as raw strings, or walking only to command leaves; each now goes
+through the authority that already reconciles them.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| AUD-616-TUTORIALS | Critical / sustained regression | partially closed 5.9.11 — perf attributed and bounded; the reported trend does not reproduce here | **Not reproducible as filed on this platform.** Root `--compact` on `tutorials` (24,073 Java files) completes in 54.9 s, exit 0, 15 KB, four serialized cold runs (54.9 / 52.7 / 53.5 / 57.9, max/min 1.10). The report's 4m00→7m00 with exit 124 is a property of the auditor's build and platform, not of this checkout. What was verified and fixed instead is the cost and the silence. **Cost, attributed per phase against file count** (`SOURCECODE_PERF`): discovery 3.5 s, detection 30.3 s, analysis 13.4 s, serialize 6.0 s. Two mechanisms found by cProfile and closed: `manifest_cache._key()` ran fourteen `rglob` walks per call and was called by both `load()` and `save()` for each of 246 modules (1.5 M `posix.scandir` calls, 26 s) — now one `os.walk`, memoised per root, digest unchanged and asserted against the fourteen calls it replaces; and `TypeClassifier` walked the file tree seven times per `enrich` × 246 modules — now once, threaded. **Measured: detection 30.3 → 9.2 s, total 54.9 → 32.5 s (×1.69), payload byte-identical, max/min 1.003.** **Silence, closed:** the root analysis is a `PhasedRun` over the four `perf` seams, so `ASK_MAX_ANALYSIS_SECONDS` bounds it and a spent budget emits the `partial-answer-v1` envelope — phases completed and pending, elapsed, budget and its provenance — instead of zero bytes. It declares `--ci`/`--allow-partial` and exits 75 on a cut gated run. **Still open:** a published repository-size envelope (the scale contract), and re-measurement on the auditor's platform. |
+| AUD-616-L | Critical / regression | partially closed 5.9.11 — stage-level progress shipped; the unbounded run does not reproduce | **Not reproducible as filed here.** `audit-report --format markdown` on `thingsboard` ran 2/2 clean: exit 0, 3,662 bytes both times, 39.3 s and 26.8 s — consistent with the audit's own isolated fork (3m1.4s, 1m49.7s, 3,701 bytes) and nowhere near a timeout. The **bounded structured failure** the row asks for is already shipped and verified: the command is a `PhasedRun`, and under `ASK_MAX_ANALYSIS_SECONDS=1` it returns a report declaring `Status: partial` and `Total defects: 0 (floor — this run was cut short)`. **The heartbeat half was a real defect and is fixed.** The delayed warning read `run has exceeded 5.0m; still working` and repeated that sentence unchanged for the life of the run — identical at 60 s and 420 s, which is why four rounds could not separate a blocked run from a slow one: a blocked process is also still alive. It now names the phase, the stage and its counts, how long the run has been in that phase, and whether the phase changed since the previous warning. Writing it surfaced a second defect: the first version read `_stage_t0`, which only restarts on a *counted* stage change, and published `parsing manifests for 21.1s` about a phase entered at 3 s — the run's elapsed time under a label claiming to be the phase's. A phase clock now exists separately from the counted-stage clock `_eta_seconds` uses. **Still open:** reproduction under deliberate contention on the auditor's platform. |
+| AUD-616-KOTLIN | Medium / confident falsehood | closed 5.9.11 | Reproduced exactly, then closed at both ends. `JvmExtDetector` also admits on source population now, with the sibling `.java` count as the bar rather than an absolute number, so a Kotlin repository on the Groovy DSL — or with no root build file, which is `ktor-samples` — surfaces a Kotlin stack, while a Java monolith carrying three `.kt` tests does not. Admission by source publishes `detection_method: heuristic`, no `manifests` and no `package_manager`: a build file was not read, so nothing only a build file attests is claimed. The real authority for `confidence` was `TypeClassifier._enrich_stack`, which recomputes what the detector published from a score summing *declarations* and gives the source population one point whether there are two files or twenty thousand; both ends are corrected there, once, for every stack with a source extension — zero source files caps at `low` with a `no_source_evidence` signal, and owning the largest source population against a competing manifest-backed claim floors at `medium`. `ktor-samples` now reports `kotlin` primary at `medium`, `java` at `low`, and headlines "Kotlin library / package". Controls re-measured unchanged: `spring-security`, `shenyu`, `thingsboard` keep `java` primary at `high`. |
+| AUD-616-O | Medium | closed 5.9.11 | `--output FILE` moves ahead of the format substitutions, and each substitution now states in its own text that it re-runs the command and that its cost on this repository is unmeasured. The module's ordering rule is unchanged and was not the defect; the reading of "the same answer" was. A bounding flag and `--output FILE` keep the rendering that has already run to completion here — that run is why the refusal has a size to report at all — while a different `--format` is a different composition this module has measured nothing about. The bypass stays last, the file destination is untouched, and the population is still the intersection of `FORMAT_REGISTRY` with the command's declared options, so nothing branches on a command name. |
+| AUD-616-P | Low-medium / investigation | closed 5.9.11 — race not reproduced, a deterministic mechanism with the same symptom fixed | **The race does not reproduce serialized.** On `tutorials`, store cleared first, four sequential runs: 82.1 s cold and `false`, then 1.58 / 1.48 / 1.47 s, all `true`. A double miss was reproduced here first and then attributed to two `ask` processes analysing the repository at once — runs against one repository share `~/.sourcecode/cache/<repo_id>/` whatever scratch directory they are given, so per-fork scratch isolation does not separate them. **A deterministic mechanism with the same symptom did reproduce and is fixed.** The GC's size pass sorted candidates oldest-first and could walk to the end of that list, and the end of it is the entry the calling run has just written: a core larger than the whole store budget was written and deleted inside one process, on every run, for ever. It is reachable at this scale rather than hypothetically — `tutorials` stores a 9.4 MB core against a 50 MB default. The newest core is no longer a candidate; everything older still is. When the newest entry alone exceeds the budget the store stays over budget, and `cache.status()` publishes `size_budget_mb`, `largest_core_bytes` and an `over_budget_reason` naming the variable to raise. |
+| AUD-616-JUNIT4-SELF | Low-medium / classification | closed 5.9.11 | **One correction to the remedy as filed:** it proposed classifying single-module JVM repositories "with no entry point", and JUnit4 has three — `TestRunner`, `JUnitCore` and `Version` each carry a `main()` — so that condition would have left the row open. The multi-module requirement was what was doing the wrong work: module count describes a build layout, not whether a repository is a library, and it was in the branch only because the row that introduced it (JobRunr) happened to be multi-module. By the time control reaches that point every stronger reading has been ruled out by the branches above, so what is left is a JVM repository with sources and no application-defining framework — the same inference the multi-module branch already makes. Measured over thirteen JVM repositories before and after: three change and all three are libraries (`junit4`, `mybatis-3`, `Mybatis-PageHelper`, each `unknown` → `library`); the other ten are byte-identical. A repository with no detected stack still publishes no type, which is the `shopizer` case confirmed correct by design. |
+| AUD-616-WIN-PROC | Medium | open, carried forward — not actionable on this platform | Unchanged from `AUD-614-WIN-PROC` and `AUD-615-WIN-PROC`. The subject is native Windows process-tree teardown and the auditor's own sample was declared inconclusive (contaminated by unrelated sessions). Nothing in this round can be reproduced or refuted from a Darwin checkout, and shipping a Job Objects path that no test here can exercise would be a change made blind. It needs a native Windows/Git Bash run, and the narrowed reading stands: late cleanup and non-response to the parent's termination signal, not a permanent leak. |
+| AUD-616-INTENT-TIE-COV | Low / coverage | closed 5.9.11 | Behaviour was already correct and nothing held it there. Both sides are covered now, with the tying questions derived from the shipped vocabulary rather than invented: `central classes deployment shape` ties two repository-wide intents at 2.8284, and `what endpoints break cross module impact` ties two target-required ones at 5.1962. Each refuses, names both candidates and the reason, offers no command, and reports no intent — so no consumer reads the rest of the payload as describing a losing candidate. A first test asserts the fixtures still tie, so a vocabulary change that destroys the tie fails the test depending on it instead of passing vacuously; a second asserts both candidates really are of one requirement class, without which the battery would silently become another copy of the rows it complements. |
+| AUD-616-E-PROV | Low / ledger hygiene | closed 5.9.11 | **The command is `ask impact-chain <EventClass> <repo> --type events`** — the event-topology query, a third sibling of `impact` and `impact-chain` and the one the re-audit could not identify. `EventTopologyResult` declares `risk_level: str = "low"` as its dataclass default and the `not_found` branch returned the result without overriding it, so a class absent from the CIR was published as a resolved low-risk answer while its two siblings said `unknown`. The value was corrected in 5.9.9; what nothing covered is the **parity** — three commands, three code paths, one question, and no test that fails when one drifts again. A battery now runs all three through the CLI on a repository, the way an external evaluator would, and asserts they agree. Re-verified: all three publish `resolution: not_found` and `risk_level: unknown`. |
+| AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07 | — | closed 5.9.9 (reverified in 5.9.10) | 6/6 correct exits with stdout to `/dev/null`; `risk --limit 0` in 2.8 s with `analysis_skipped: true`; `selftest --timeout` exit 75 with a 7.2 KB structured diagnostic; intent behaviour coherent with the reclassification; `drift` default profile normalized; `cold-start --compact` size stable across repeated runs. No regression in any of them. |
+
+**Size-datum note.** The report records `cold-start --compact` as 14,959-14,960 bytes in one
+block and 88,265-88,266 bytes in another. Different repositories; no reconciliation is
+claimed, and the one-byte delta is the redirection newline, not a payload change.
+
+**Robustness sweep.** Five of six new repositories behaved correctly and open no row:
+`spock` (674 Java + 607 Groovy, languages not confused), `Chronicle-Queue` (CLI tool,
+`spring_detected: false`), `javaee7-samples` (classic Java EE), `camel-examples` (474
+dependencies, no crash) and `shopizer-v1.1.5` (no root `pom.xml`, `project_type: null` with
+an explicit explanation — correct by design, the type genuinely cannot be inferred). The
+sixth, `ktor-samples`, is the first Kotlin subject in the series and opened `AUD-616-KOTLIN`.
+
+**Also stable.** `pack gate --since develop` measured 208.6 s, consistent with the 234 s
+recovery in 5.9.9: the four-round upward trend on that command remains broken. The full
+earlier closure set was re-exercised without a single regression.
+
+**Commercially**, the band stays `$25-40/developer/month` with the standing no-large-scale
+CI-gating condition. The `TUTORIALS` trend strengthens that condition rather than relaxing
+it: a degradation visible across five consecutive releases is precisely the evidence an
+annual reliability commitment cannot be sold against. Full triage is in
+[`AUDIT-2026-08-28-EXTERNAL-5.9.10.md`](AUDIT-2026-08-28-EXTERNAL-5.9.10.md).
+
+
 **Commercial boundary.** The corrected assessment is `$25-40/developer/month`, not the
 initial `$45-58` headline. Do not market enterprise-scale support or production CI
 gating for repositories above roughly 3,000 files until the four critical/high

sourcecode/_docs/USER_GUIDE.md

@@ -46,16 +46,40 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.9, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.11, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.9, with release-artifact verification
+the two pack fixes are included in release 5.9.11, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.9
+### Reliability contracts in 5.9.11
+
+**A deadline the root analysis honours.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>` now
+stops `ask <repo>` at a measured phase boundary. A run that spends its budget
+returns a structured `partial-answer-v1` payload naming the phases that completed,
+the phases that did not, the elapsed time and the budget that decided it — not an
+empty stdout. Counts in a partial answer are floors over the completed phases
+only. Add `--ci` to make a cut run fail with exit 75, and `--allow-partial` to
+accept one on purpose; both are published back in the payload as `exit_code`
+beside `gate_exit_code`, so a pipeline can tell a chosen zero from a defaulted one.
+
+**Progress that distinguishes slow from blocked.** On a non-interactive run, the
+delayed liveness warning names the phase, the stage inside it and its counts, how
+long the run has been in that phase, and whether the phase has changed since the
+previous warning. Two warnings naming different phases are progress; two naming
+the same phase are a stretch that is not reporting.
+
+**Known availability limits.** Do not place `ask audit-report . --format markdown`
+or the root compact command behind a strict timeout on repositories above roughly
+3,000 files. Markdown audit-report delivery is still contention-sensitive; for a
+supervised or CI workflow, save `risk` first and use `audit-report --from-risk`,
+prefer JSON/YAML, and retain progress output. Both limits are held open
+deliberately: neither reproduces on the engineering platform, so neither is closed
+on measurements taken there. The current closure status is in the
+[development roadmap](DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-616-re-audit-release-5910).
 
 Invalid analysis inputs fail before expensive work and use the structured
 `INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
@@ -236,7 +260,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.9
+# ask 5.9.11
 ```
 
 Requires Python 3.9+.
@@ -629,6 +653,11 @@ JSON output includes `evidence_manifest`: stable claim IDs mapped to source span
 inputs, ASK version, git HEAD and freshness metadata. Signed reports sign this manifest as
 part of the canonical payload.
 
+On large repositories, do not use Markdown delivery in a strict-timeout CI path:
+the current reliability queue records contention-sensitive completion. Persist a
+`risk` payload first and use `--from-risk`; JSON/YAML are the safer supervised
+formats while the Markdown issue remains open.
+
 ```bash
 ask audit-report .
 ask audit-report . --profile prod --format markdown

sourcecode/access_drift.py

@@ -44,6 +44,12 @@ UNMATCHED = "no_rule_matched"
 _NOT_A_CLASS = frozenset({"chains", "summary"})
 
 
+def normalise_profiles(profiles: "Optional[set[str]]") -> "set[str]":
+    """Map Spring's implicit ``default`` profile to the empty active set."""
+    return {str(profile).strip() for profile in (profiles or set())
+            if str(profile).strip() and str(profile).strip() != "default"}
+
+
 def _utc_now() -> str:
     return datetime.now(timezone.utc).replace(microsecond=0).isoformat()
 
@@ -83,10 +89,11 @@ def build_snapshot(
     """One capture of the effective access under a profile set."""
     from sourcecode.architectural_baseline import git_commit
 
+    active_profiles = normalise_profiles(profiles)
     if posture is None:
         from sourcecode.posture import build_posture
 
-        posture = build_posture(Path(root), set(profiles or ()), properties)
+        posture = build_posture(Path(root), active_profiles, properties)
 
     routes = routes_from_posture(posture)
     by_class: "dict[str, int]" = {}
@@ -100,7 +107,7 @@ def build_snapshot(
         "captured_at": _utc_now(),
         "commit": commit if commit is not None else git_commit(Path(root)),
         "repo": Path(root).name,
-        "profiles": sorted(profiles or ()),
+        "profiles": sorted(active_profiles),
         "counts": {
             "routes": len(routes),
             "by_access_class": dict(sorted(by_class.items())),
@@ -138,7 +145,7 @@ def load_series(out_dir: Path, *, profiles: "Optional[set]" = None) -> "list[dic
     if not out_dir.is_dir():
         return []
     series: "list[dict]" = []
-    wanted = sorted(profiles) if profiles is not None else None
+    wanted = sorted(normalise_profiles(profiles)) if profiles is not None else None
     for path in sorted(out_dir.glob(f"{FILENAME_PREFIX}*.json")):
         try:
             payload = json.loads(path.read_text(encoding="utf-8"))

sourcecode/answer_bounds.py

@@ -111,6 +111,17 @@ def _gaps(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
             "field": "_partial",
             "what": "the run stopped before every phase completed",
         })
+    elif payload.get("partial") is True:
+        # AUD-616-TUTORIALS. A cut run can carry its declaration in two places: a
+        # `_partial` block attached to an answer that was still produced, and — for
+        # a command that has no partial answer to attach it to — the whole payload
+        # being the `partial-answer-v1` envelope. Only the first was recognised, so
+        # a bounded deadline failure published `complete: true` beside
+        # `"partial": true` in the same object.
+        found.append({
+            "field": "partial",
+            "what": "the run stopped before every phase completed",
+        })
     return found
 
 

sourcecode/cache.py

@@ -402,6 +402,7 @@ def status(repo_root: Path) -> dict[str, Any]:
     total_bytes = sum(f.stat().st_size for f in all_files if f.exists())
     return {
         "cache_dir": str(cache_d),
+        **_size_budget_fields(cores, snapshots, cas_blobs),
         "cached_cores": len(cores),
         "snapshots": len(snapshots),
         "views": len(views),
@@ -419,6 +420,51 @@ def status(repo_root: Path) -> dict[str, Any]:
     }
 
 
+def _size_budget_fields(
+    cores: "list[Path]", snapshots: "list[Path]", cas_blobs: "list[Path]"
+) -> "dict[str, Any]":
+    """What the store's size budget is, and whether one entry cannot fit under it.
+
+    AUD-616-P. The GC no longer evicts the entry a run has just written, so a
+    repository whose core is larger than `SOURCECODE_CACHE_MAX_SIZE_MB` keeps its
+    cache and the store sits over budget. That is the honest outcome and it must
+    not be silent: the alternative the code used to take was to delete the entry
+    and leave a second identical run reporting `served_from_cache: false` with no
+    explanation anywhere.
+    """
+    try:
+        budget_mb = int(
+            os.environ.get("SOURCECODE_CACHE_MAX_SIZE_MB", _DEFAULT_MAX_SIZE_MB)
+        )
+    except ValueError:
+        budget_mb = _DEFAULT_MAX_SIZE_MB
+    counted = [p for p in (*cores, *snapshots, *cas_blobs) if p.exists()]
+    counted_bytes = sum(p.stat().st_size for p in counted)
+    largest = max((p.stat().st_size for p in cores if p.exists()), default=0)
+    budget_bytes = budget_mb * 1024 * 1024
+    reason: "Optional[str]" = None
+    if budget_bytes > 0 and counted_bytes > budget_bytes:
+        if largest > budget_bytes:
+            reason = (
+                f"one cached analysis is {round(largest / (1024 * 1024), 2)} MB, "
+                f"larger than the whole {budget_mb} MB store budget. It is kept "
+                f"rather than evicted, so this repository is still served from "
+                f"cache; raise SOURCECODE_CACHE_MAX_SIZE_MB to bring the store "
+                f"back under budget."
+            )
+        else:
+            reason = (
+                f"the store holds {round(counted_bytes / (1024 * 1024), 2)} MB "
+                f"against a {budget_mb} MB budget; older entries are evicted on "
+                f"the next write."
+            )
+    return {
+        "size_budget_mb": budget_mb,
+        "largest_core_bytes": largest,
+        "over_budget_reason": reason,
+    }
+
+
 #: E-37. Which environment variable relocates which store. Two exist, they cover
 #: different stores, and the difference is invisible in a payload that prints a
 #: path and no variable — so an operator who moves or empties "the cache" moves
@@ -1058,9 +1104,31 @@ def _gc(cache_d: Path) -> None:
             if total > max_size_bytes:
                 # Sort oldest-first; evict core+snapshot files until under budget
                 size_candidates.sort(key=lambda p: p.stat().st_mtime)
+                # AUD-616-P. The loop below used to be able to reach the end of that
+                # list, and the end of that list is the entry the run that called
+                # this GC has just written. A single core larger than the whole
+                # budget was therefore stored and deleted again inside one process,
+                # on every run, for ever: the repository could never be served from
+                # cache, `served_from_cache` stayed `false` on a second identical
+                # run, and nothing anywhere said why. `tutorials` stores a 9.4 MB
+                # core against a 50 MB default, so six distinct tree states of one
+                # large repository are enough to reach it.
+                #
+                # Eviction exists to bound a store, not to undo the work of the
+                # process performing it. The newest core is never a candidate; when
+                # it alone exceeds the budget the store stays over budget, which is
+                # a fact `status()` publishes rather than a state the GC destroys
+                # answers to hide.
+                _newest_core = max(
+                    (p for p in size_candidates if p.name.startswith("core-")),
+                    key=lambda p: p.stat().st_mtime,
+                    default=None,
+                )
                 for evict in size_candidates:
                     if evict.name.startswith("view-"):
                         continue
+                    if _newest_core is not None and evict == _newest_core:
+                        continue
                     total -= evict.stat().st_size if evict.exists() else 0
                     _safe_unlink(evict)
                     surviving = [p for p in surviving if p != evict]