sourcecode 5.9.9__tar.gz → 5.9.10__tar.gz

{sourcecode-5.9.9 → sourcecode-5.9.10}/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [5.9.10] — 2026-08-27
+
+*Release-alignment patch release.*
+
+**Release**
+
+- Synchronizes package metadata, CLI runtime, README and user-guide version surfaces at `5.9.10`.
+- Carries forward the `5.9.9` documentation and availability guidance.
+- Keeps the `AUD-615` reliability limits explicit pending their independent closure.
+
 ## [5.9.9] — 2026-08-27
 
 *Release-alignment patch release.*

{sourcecode-5.9.9 → sourcecode-5.9.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.9
+Version: 5.9.10
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.9-blue)
+![Version](https://img.shields.io/badge/version-5.9.10-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,14 +196,16 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.9 retains the shared Canonical IR
+**Current performance status.** Release 5.9.10 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
-not duration promises. A controlled external warm-path audit has opened performance
-and bounded-output regressions for this release; use `ask cache model <repo>` and
-`--progress stderr` for supervised runs, and consult the
-[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md) before
-treating a historical timing or bounded flag as a current guarantee.
+not duration promises. The current external audit records two open availability
+limits: `audit-report --format markdown` is not reliable under contention, and
+the root compact flow is not suitable for strict timeouts on very large monorepos.
+Use `ask cache model <repo>`, `--progress stderr`, `audit-report --from-risk` and
+JSON/YAML output for supervised runs; consult the
+[current reliability queue](docs/DEVELOPMENT-ROADMAP.md#aud-615-re-audit-release-599)
+before treating a historical timing or bounded flag as a current guarantee.
 
 **CI delivery and workspace licensing.** `migrate-check --format sarif` emits
 ASK-owned migration findings with source locations and provenance; it does not
@@ -218,7 +220,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.9 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.10 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -251,7 +253,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.9 — and, on a build that has aged,
+ask version                    # ask 5.9.10 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.9 → sourcecode-5.9.10}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.9-blue)
+![Version](https://img.shields.io/badge/version-5.9.10-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,14 +147,16 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.9 retains the shared Canonical IR
+**Current performance status.** Release 5.9.10 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
-not duration promises. A controlled external warm-path audit has opened performance
-and bounded-output regressions for this release; use `ask cache model <repo>` and
-`--progress stderr` for supervised runs, and consult the
-[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md) before
-treating a historical timing or bounded flag as a current guarantee.
+not duration promises. The current external audit records two open availability
+limits: `audit-report --format markdown` is not reliable under contention, and
+the root compact flow is not suitable for strict timeouts on very large monorepos.
+Use `ask cache model <repo>`, `--progress stderr`, `audit-report --from-risk` and
+JSON/YAML output for supervised runs; consult the
+[current reliability queue](docs/DEVELOPMENT-ROADMAP.md#aud-615-re-audit-release-599)
+before treating a historical timing or bounded flag as a current guarantee.
 
 **CI delivery and workspace licensing.** `migrate-check --format sarif` emits
 ASK-owned migration findings with source locations and provenance; it does not
@@ -169,7 +171,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.9 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.10 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -202,7 +204,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.9 — and, on a build that has aged,
+ask version                    # ask 5.9.10 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.9 → sourcecode-5.9.10}/docs/DEFECT-LEDGER.md

@@ -112,11 +112,37 @@ are the current release blockers and contract gaps:
 | AUD-614-SELFTEST-TIMEOUT | High / contract regression | closed 5.9.8 | `selftest --timeout` is now an overall deadline; each child receives the remaining budget, interrupted/unstarted rows are structured as `error`, and the command returns code 75. The real TeaVM flow and dedicated regression pass. The separate fourth-run hang remains mixed evidence. |
 | AUD-614-WIN-PROC | Medium | open | Windows/MSYS timeout or SIGTERM can leave `ask.exe` descendants alive, with MSYS PIDs unusable by native `taskkill`. Validate signal handling and Windows Job Objects from native Windows and Git Bash. |
 | AUD-614-G | Medium | closed 5.9.8 | The shared error authority normalizes legacy producer spellings to canonical uppercase codes (`NO_DIFF_SOURCE`, `INVALID_LICENSE`). TeaVM `review-pr` and activation contract tests pass. |
-| AUD-614-E | Low | open | Impact commands now agree on unresolved exit status, but their `risk_level` values still diverge (`unknown`/`low`/`unknown`). Define one not-found payload semantics and enforce parity. |
+| AUD-614-E | Low | closed 5.9.9 | Event topology now publishes `risk_level: unknown` for `not_found`, matching `impact` and normal `impact-chain`; `low` remains a resolved no-risk result. Focused TeaVM coverage protects the parity. |
 | AUD-614-I | Medium | closed 5.9.8 | The user manual and internal compacting comment no longer promise `~10K`; they state that `cold-start --compact` is snapshot-dependent, expose `estimated_tokens`, and require size validation before direct AI injection. The CLI help and payload already used this contract. A hard ceiling remains optional future scope. |
-| AUD-614-INTENT-TIE | Medium | open | Exact lexical ties at score `2.8284` still resolve differently for `endpoint security` and `security surface`. Define deterministic tie/margin semantics and add a real-repository regression. |
+| AUD-614-INTENT-TIE | Medium | closed 5.9.9 (reclassified) | The equal score belongs to different questions, not competing candidates. `endpoint security` selects a target-required intent and correctly refuses without a route; `security surface` is repository-wide and resolves. A focused regression locks the distinction. |
 | AUD-614-07 | Low | closed 5.9.8 (reverified) | The installed `ask spring-audi` entry point returns `Did you mean: spring-audit?`; the TeaVM path/typo regression battery passes. The external wording report is not reproducible in the current checkout. |
-| AUD-614-JUNIT4 | Medium | open | JUnit4 projects remain `project_type: unknown`; add evidence-backed classification without broad heuristic false positives. |
+| AUD-614-JUNIT4 | Medium | closed 5.9.9 | JUnit4 test-only repositories classify as `test` only with the `junit:junit` coordinate and test-only Java sources; ordinary applications/libraries retain their structural type. |
+
+**External audit intake `AUD-615`, re-audit of release 5.9.9 — 2026-08-27.** The
+auditor exercised only repositories under `testing/` and added three robustness subjects.
+The report contains conflicting headline scores (8.0 and 8.4), and shared fork scratch
+state invalidated the definitive output capture for the long `audit-report` retest. The
+ledger records the evidence and closure boundaries, not either headline score.
+
+| ID | Severity | Status | Evidence / closure boundary |
+|---|---:|---|---|
+| AUD-615-F | Critical | closed 5.9.9 (reverified) | Windows/Git Bash verification confirms 11/11 reproductions: stdout `/dev/null` preserves exit 1 and byte-identical structured stderr, including `INVALID_USAGE` as well as `INVALID_INPUT`. Keep release-artifact coverage. |
+| AUD-615-RISK-L0 | High / regression | closed 5.9.9 (reverified) | `risk --limit 0` completes in about 0.8–1.5 s as `zero_row_view`, with `analysis_skipped: true` and null totals; full analysis is not built for a view that requests no rows. |
+| AUD-615-SELFTEST-TIMEOUT | High / contract regression | closed 5.9.9 (reverified) | `selftest --timeout 5` returns exit 75 and a non-empty structured diagnostic payload, including the fourth attempt in this sample. The independent hang history remains mixed evidence. |
+| AUD-615-L | Critical / regression | open | The defect is isolated to `audit-report --format markdown`: identical `thingsboard` runs measured 200 s timeout versus 137.98 s success, with an isolated 114 s run. JSON/YAML correctly returned structured `OUTPUT_TOO_LARGE`; they are not defective here. The 700 s fork lost output to shared scratch interference. |
+| AUD-615-TUTORIALS | High / availability trend | open | Root compact on `tutorials` increased monotonically from 4m00.1s in 5.9.6 to 6m20.1s in 5.9.9, exit 124 with zero stdout. Attribute and bound the cost before large-monorepo claims. |
+| AUD-615-WIN-PROC | Medium | open | Seven `ask.exe` processes remained after successful Windows runs. Validate descendant cleanup for successful and timed-out runs with native Windows/Git Bash process controls. |
+| AUD-615-INTENT-TIE | Medium | closed 5.9.9 (reclassified) | Equal score across distinct questions is not a tie. The target-required endpoint intent refuses without a route while the global surface intent resolves; a focused regression protects that contract. |
+| AUD-615-E | Low | closed 5.9.9 | All impact-family not-found paths publish `risk_level: unknown`; focused TeaVM coverage protects the former event-topology outlier. |
+| AUD-615-07 | Low / evidence conflict | closed 5.9.9 (reverified) | Isolated TeaVM verification returns `Did you mean: spring-audit?` with exit 2, matching the installed-entry-point regression. The contrary report wording is not reproducible. |
+| AUD-615-JUNIT4 | Medium | closed 5.9.9 | JUnit4 test-only repositories classify as `test` from dependency and source-location evidence, without a broad naming heuristic. |
+| AUD-615-DRIFT | Low / investigation | closed 5.9.9 | Spring's explicit `default` profile is normalized to the implicit empty active-profile set at the access-snapshot boundary. An implicit capture and explicit `--profile default` now read one series; focused and TeaVM regression flows pass. |
+| AUD-615-COLD-COMPACT | Low / product decision | closed 5.9.9 (accepted contract) | A repeated 88,265-byte result is compatible with the documented snapshot-dependent contract. ASK exposes `estimated_tokens`; no hard ceiling is claimed or introduced. |
+
+**Audit-method control:** each parallel fork must use a unique scratch directory; shared
+`~/askaudit_599` caused cross-fork file deletion/interleaving and blocked a definitive L
+result. **Commercially**, conflicting `$25-40` and `$50-65` estimates are not evidence for
+a price increase; retain the conservative band until the availability trend is closed.
 
 The audit also confirms root cache reuse, stdin contracts, pack progress, explain and
 impact error routing, self-audit population disclosure, endpoint compact disclosure,

{sourcecode-5.9.9 → sourcecode-5.9.10}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,15 +3,15 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.9`; external re-audit `AUD-614` remains the reliability gate.**
+> **CURRENT QUEUE — release `5.9.10`; external re-audit `AUD-615` remains the reliability gate.**
 > The latest external pass confirms the cache, stdin, progress, error-channel and
 > population fixes, but reports a serious availability regression: `audit-report`
 > is contention-sensitive on a normal large repository. The `/dev/null` report is
 > reverified as fixed in the current checkout; native Windows/MSYS release-artifact
 > confirmation remains. `risk --limit 0` and the `selftest --timeout` contract are now
 > closed in this cycle; Windows process-tree cleanup remains separately open.
-> `AUD-612` remains the preceding audit record; `AUD-614` is the governing queue
-> for the current `5.9.9` state, carrying forward the `5.9.8` fixes.
+> `AUD-612` and `AUD-614` remain preceding audit records; `AUD-615` is the governing
+> queue for the current `5.9.10` state, carrying forward the `5.9.8` and `5.9.9` fixes.
 > The 2026-08-27 external review adds `AUD-610-B01` through `AUD-610-B10`, led by
 > silent `selftest` nondeterminism, silent root/audit-report failures, a legal-zero
 > `risk --limit 0` crash, an unvalidated consumer path and contradictory Spring
@@ -266,11 +266,47 @@ reported as broken, but availability and contract reliability regressed.
 | AUD-614-SELFTEST-TIMEOUT | High / contract regression | **Closed in this fix.** `selftest` now treats `--timeout` as an overall execution deadline, bounds each child by the remaining budget, emits structured errors for the interrupted and unstarted rows, and returns code 75. The real TeaVM flow and dedicated regression pass. The separate fourth-run hang remains mixed evidence. | Keep the parent/child deadline and code-75 contract green on the installed entry point and TeaVM. |
 | AUD-614-WIN-PROC | Medium | On Windows/MSYS, timeout or SIGTERM can leave `ask.exe` descendants alive; the MSYS PID cannot be cleaned with native `taskkill`. The audit observed low-memory orphan processes after a timed-out run. | Implement signal/CTRL_BREAK cleanup and Windows Job Objects or document a verified equivalent; test parent and descendant termination from native Windows and Git Bash. |
 | AUD-614-G | Medium | **Closed in this fix.** The shared error authority now normalizes legacy producer spellings to canonical uppercase codes: `NO_DIFF_SOURCE` and `INVALID_LICENSE`. The TeaVM `review-pr` flow and activation contract tests pass. | Keep all public error producers on the canonical code authority. |
-| AUD-614-E | Low / semantic parity | The impact family now returns consistent `exit 1` for unresolved symbols, but `risk_level` still differs cosmetically (`unknown`/`low`/`unknown`) across the three commands. | Decide one not-found semantic shape and generate all impact-family payloads from it. |
+| AUD-614-E | Low / semantic parity | **Closed in this fix.** The event topology branch now publishes `risk_level: unknown` for `not_found`, matching `impact` and normal `impact-chain`; `low` remains reserved for a resolved topology with no measured risk. | Keep not-found payloads generated from the shared unknown-risk semantics. |
 | AUD-614-I | Medium / contract | **Closed in this fix.** The user manual no longer promises `~10K` for `cold-start --compact`; it now states that the orientation subset depends on the stored snapshot, exposes `estimated_tokens`, and recommends checking the measured size before direct AI injection. The CLI help and payload already carried the same non-fixed-size contract. | Keep the manual, help and payload wording derived from the snapshot-size contract; a hard ceiling remains a separate product decision. |
-| AUD-614-INTENT-TIE | Medium | Equal lexical scores (`2.8284`) still produce different verdicts: `endpoint security` is refused while `security surface` resolves. This has remained unchanged for two rounds and exposes unstable tie semantics. | Define deterministic tie handling, publish the competing intents and margin, and add a real-repository regression for exact-score collisions. |
+| AUD-614-INTENT-TIE | Medium | **Closed as a false tie.** Both questions score `2.8284`, but they are different declared queries: `endpoint security` selects a target-required intent and correctly refuses without a route, while `security surface` selects a repository-wide intent. Equal scores across different inputs are not competing candidates. A focused regression locks the distinction. | Keep target-required admission separate from repository-wide intent selection. |
 | AUD-614-07 | Low / UX regression | **Closed in this verification.** The installed `ask spring-audi` entry point returns the command-admission error with `Did you mean: spring-audit?`; the TeaVM path/typo regression battery passes. The external wording report is not reproducible in the current checkout. | Keep command admission, error wording and help aligned in the installed-CLI test. |
-| AUD-614-JUNIT4 | Medium / classification | JUnit4 repositories remain classified as `unknown`; no change from the previous audit. | Add evidence-backed JUnit4 detection without weakening confidence or introducing Kotlin/Java false positives. |
+| AUD-614-JUNIT4 | Medium / classification | **Closed in this fix.** A repository is classified as `test` only when it has the `junit:junit` coordinate and all Java sources are test sources; applications and libraries that merely use JUnit retain their structural type. | Keep the dependency-plus-source-population regression green. |
+
+### External Audit Intake — `AUD-615` re-audit, release 5.9.9
+
+The external re-audit covered only repositories under `Documents/workspace/testing/`,
+with additional robustness passes over `micronaut-guides`, `jhipster-sample-app` and
+`mall` (including a non-English README). The report contains two headline scores (**8.0/10**
+and **8.4/10**) and a methodological limitation: forks shared `~/askaudit_599`, so output
+files were deleted or interleaved during the critical `audit-report` retest. The detailed
+findings below take precedence over either headline score. No target-repository mutation
+was reported.
+
+| ID | Severity | Finding | Required future closure |
+|---|---:|---|---|
+| AUD-615-F | Critical | **Confirmed fixed on Windows/Git Bash.** Two independent forks report 11/11 successful reproductions: redirecting stdout to `/dev/null` preserves `exit 1` and the byte-identical structured stderr envelope. The fix also covers `INVALID_USAGE` (`--depth 0`), not only `INVALID_INPUT`. | Preserve the cross-platform redirection matrix and repeat it against release artefacts. |
+| AUD-615-RISK-L0 | High / regression | **Confirmed fixed.** `risk --limit 0` returns in about 0.8–1.5 s with `status: zero_row_view`, `analysis_skipped: true`, empty requested rows and null totals; it avoids constructing the discarded full analysis. | Keep the semantic zero-row contract and test non-zero limits through the normal analysis path. |
+| AUD-615-SELFTEST-TIMEOUT | High / contract regression | **Confirmed fixed in this sample.** `selftest --timeout 5` returns exit 75 with 8,365 bytes of structured diagnostics, including the fourth attempt. This improves the mixed evidence from previous rounds but does not prove the separate hang impossible. | Keep the overall deadline, child budget propagation and code-75 envelope under repeated installed-CLI runs. |
+| AUD-615-L | Critical / regression | **Open, scope corrected.** `audit-report --format markdown` remains non-deterministic under contention: identical `thingsboard` runs measured 200 s timeout versus 137.98 s success; an isolated run took 114 s. The 700 s fork lost its output to shared scratch interference. JSON/YAML returned honest `OUTPUT_TOO_LARGE`, so they are not part of this bug. | Isolate per-run artefacts, profile contention/cache/worker scheduling, add stage visibility and a bounded timeout with structured failure/partial output. Define the supported size/load envelope. |
+| AUD-615-TUTORIALS | High / availability trend | Root compact on `tutorials` increased monotonically from 4m00.1s in 5.9.6 to 6m20.1s in 5.9.9, exit 124 with zero stdout. | Attribute and bound the cost before large-monorepo claims. |
+| AUD-615-WIN-PROC | Medium | **Still open.** Seven `ask.exe` processes remained after successful Windows runs; the footprint was small, but descendant cleanup appears incomplete. | Validate process-tree cleanup for successful and timed-out runs with native Windows/Git Bash controls and Job Objects or a verified equivalent. |
+| AUD-615-INTENT-TIE | Medium / semantic | **Closed as a false tie.** The equal score belongs to different questions, not two candidates for one question. `endpoint security` requires an endpoint anchor and refuses without one; `security surface` is repository-wide and resolves. | Keep the focused regression and do not collapse target-required intent into a global query. |
+| AUD-615-E | Low / semantic parity | **Closed in this fix.** All three impact-family not-found paths publish `risk_level: unknown`; a focused TeaVM regression covers the events outlier. | Keep not-found payloads generated from the shared unknown-risk semantics. |
+| AUD-615-07 | Low / evidence conflict | **Closed by isolated verification.** TeaVM's installed-compatible entry point returns `Did you mean: spring-audit?` with exit 2; the report's detailed-table wording is contradicted by both direct evidence and the existing admission regression. | Keep the installed-entry-point assertion green. |
+| AUD-615-JUNIT4 | Medium / classification | **Closed in this fix.** JUnit4 test-only repositories now classify as `test` from dependency and source-location evidence, without a broad name heuristic. | Keep the dependency-plus-source-population regression green. |
+| AUD-615-DRIFT | Low / investigation | **Closed in this fix.** Spring's explicit `default` profile now normalizes to the implicit empty active-profile set in the access-snapshot authority, so implicit capture and explicit `--profile default` read the same series. TeaVM capture/query and a focused store regression pass. | Keep profile normalization at the snapshot boundary. |
+| AUD-615-COLD-COMPACT | Low / product decision | **Closed as an accepted contract.** A byte-identical 88,265-byte result does not contradict the snapshot-dependent compact contract. The product deliberately exposes `estimated_tokens` rather than claiming a hard size ceiling. | Reopen only with evidence that help, payload or manual promise a fixed bound. |
+
+**Methodology control.** Future parallel audits must allocate a unique UUID/timestamp
+scratch directory per fork. Shared `~/askaudit_599` caused cross-fork interference and
+prevented definitive output capture for `AUD-615-L`.
+
+**Commercial interpretation.** The report contains conflicting price bands (`$25-40` and
+`$50-65` per developer/month). Until `AUD-615-L` and the large-repository trend are closed,
+retain the conservative `$25-40` band and do not market `audit-report --format markdown`,
+the root command, or production CI gating for repositories above roughly 3,000 files.
+The additional repositories showed correct Spring/full-stack detection and Chinese README
+encoding handling, with no new false-positive or false-negative finding.
 
 **Confirmed stable in this round.** Root cache reuse (cold 267 s to warm 1-2 s),
 `pr-impact`/`pr-risk --files -`, progress propagation through `pack gate --since`,

{sourcecode-5.9.9 → sourcecode-5.9.10}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.9`, following the external `5.9.3` reconciliation.**
+> **CURRENT UPDATE — release `5.9.10`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -20,17 +20,18 @@
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
 > **RE-AUDIT — 5.9.9, received 2026-08-27.** The external re-audit confirms the
-> cache, stdin, progress, error-channel and population corrections, but the corrected
-> score is **7.5/10** after confirming a serious availability regression. `audit-report`
-> is sensitive to contention and can exceed five minutes even on a 3,714-file repository;
-> `risk . --limit 0` and `selftest --timeout` were also investigated and are now
-> bounded by explicit contracts. The long-standing `/dev/null` false-success is
-> reverified as fixed in the current checkout, with native Windows/MSYS artifact
-> confirmation still pending; `audit-report` remains sensitive to contention. Do not position ASK
+> cache, stdin, progress, error-channel and population corrections, and raises the
+> assessment to the **8.0-8.4/10** range. It does not clear the availability gate:
+> `audit-report --format markdown`
+> remains non-deterministic under contention, while the root compact flow on `tutorials`
+> has worsened across five versions to 6m20.1s with no stdout. `risk . --limit 0` and
+> `selftest --timeout` are now bounded by explicit contracts. The former `/dev/null`
+> false-success is confirmed fixed on Windows/Git Bash in 11/11 reproductions. Do not position ASK
 > for enterprise-scale repositories or production CI gating above roughly 3,000 files
-> until these remaining bounded reliability contracts are independently closed. The corrected commercial estimate is
-> `$25-40/developer/month`, superseding the preliminary `$45-58` headline. Full detail
-> is recorded as `AUD-614` in the development roadmap and defect ledger.
+> until the availability contracts are independently closed. The report contains conflicting
+> commercial bands (`$25-40` and `$50-65`); retain the conservative `$25-40/developer/month`
+> position pending independent closure. Full detail is recorded as `AUD-615` in the
+> development roadmap and defect ledger.
 
 > **RE-AUDIT — 5.9.7, received 2026-08-27.** Three independent forks added roughly
 > 130 invocations and retested the AUD-611 queue. The score rose to **7.8/10** and

{sourcecode-5.9.9 → sourcecode-5.9.10}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.9.9**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.10**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,7 +8,14 @@
 
 ## 1. ¿Qué es ASK Engine?
 
-### Contratos de fiabilidad de la versión 5.9.9
+### Contratos de fiabilidad de la versión 5.9.10
+
+**Límites de disponibilidad conocidos.** No sitúes `ask audit-report . --format
+markdown` ni el comando raíz compacto detrás de un timeout estricto en repositorios
+de más de unas 3.000 fichas. La entrega Markdown de `audit-report` sigue siendo
+susceptible a contención. Para CI o ejecución supervisada, guarda primero `risk`,
+usa `audit-report --from-risk`, prefiere JSON/YAML y conserva el progreso. El
+estado de cierre está en la [hoja de ruta de desarrollo](DEVELOPMENT-ROADMAP.md#aud-615-re-audit-release-599).
 
 Las entradas inválidas se rechazan antes del análisis costoso mediante el
 envelope estructurado `INVALID_INPUT`: un `--consumer` inexistente, un feed CVE

{sourcecode-5.9.9 → sourcecode-5.9.10}/docs/USER_GUIDE.md

@@ -46,16 +46,23 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.9, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.10, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.9, with release-artifact verification
+the two pack fixes are included in release 5.9.10, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.9
+### Reliability contracts in 5.9.10
+
+**Known availability limits.** Do not place `ask audit-report . --format markdown`
+or the root compact command behind a strict timeout on repositories above roughly
+3,000 files. Markdown audit-report delivery is still contention-sensitive; for a
+supervised or CI workflow, save `risk` first and use `audit-report --from-risk`,
+prefer JSON/YAML, and retain progress output. The current closure status is in the
+[development roadmap](DEVELOPMENT-ROADMAP.md#aud-615-re-audit-release-599).
 
 Invalid analysis inputs fail before expensive work and use the structured
 `INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
@@ -236,7 +243,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.9
+# ask 5.9.10
 ```
 
 Requires Python 3.9+.
@@ -629,6 +636,11 @@ JSON output includes `evidence_manifest`: stable claim IDs mapped to source span
 inputs, ASK version, git HEAD and freshness metadata. Signed reports sign this manifest as
 part of the canonical payload.
 
+On large repositories, do not use Markdown delivery in a strict-timeout CI path:
+the current reliability queue records contention-sensitive completion. Persist a
+`risk` payload first and use `--from-risk`; JSON/YAML are the safer supervised
+formats while the Markdown issue remains open.
+
 ```bash
 ask audit-report .
 ask audit-report . --profile prod --format markdown

{sourcecode-5.9.9 → sourcecode-5.9.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.9"
+version = "5.9.10"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.9 → sourcecode-5.9.10}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.9"
+__version__ = "5.9.10"

{sourcecode-5.9.9 → sourcecode-5.9.10}/src/sourcecode/access_drift.py

@@ -44,6 +44,12 @@ UNMATCHED = "no_rule_matched"
 _NOT_A_CLASS = frozenset({"chains", "summary"})
 
 
+def normalise_profiles(profiles: "Optional[set[str]]") -> "set[str]":
+    """Map Spring's implicit ``default`` profile to the empty active set."""
+    return {str(profile).strip() for profile in (profiles or set())
+            if str(profile).strip() and str(profile).strip() != "default"}
+
+
 def _utc_now() -> str:
     return datetime.now(timezone.utc).replace(microsecond=0).isoformat()
 
@@ -83,10 +89,11 @@ def build_snapshot(
     """One capture of the effective access under a profile set."""
     from sourcecode.architectural_baseline import git_commit
 
+    active_profiles = normalise_profiles(profiles)
     if posture is None:
         from sourcecode.posture import build_posture
 
-        posture = build_posture(Path(root), set(profiles or ()), properties)
+        posture = build_posture(Path(root), active_profiles, properties)
 
     routes = routes_from_posture(posture)
     by_class: "dict[str, int]" = {}
@@ -100,7 +107,7 @@ def build_snapshot(
         "captured_at": _utc_now(),
         "commit": commit if commit is not None else git_commit(Path(root)),
         "repo": Path(root).name,
-        "profiles": sorted(profiles or ()),
+        "profiles": sorted(active_profiles),
         "counts": {
             "routes": len(routes),
             "by_access_class": dict(sorted(by_class.items())),
@@ -138,7 +145,7 @@ def load_series(out_dir: Path, *, profiles: "Optional[set]" = None) -> "list[dic
     if not out_dir.is_dir():
         return []
     series: "list[dict]" = []
-    wanted = sorted(profiles) if profiles is not None else None
+    wanted = sorted(normalise_profiles(profiles)) if profiles is not None else None
     for path in sorted(out_dir.glob(f"{FILENAME_PREFIX}*.json")):
         try:
             payload = json.loads(path.read_text(encoding="utf-8"))

{sourcecode-5.9.9 → sourcecode-5.9.10}/src/sourcecode/classifier.py

@@ -280,6 +280,17 @@ class TypeClassifier:
         if stack_names & _JVM_STACKS and self._is_multi_module(file_tree):
             return "library"
 
+        # A JUnit 4-only repository is a test suite, not an unknown application.
+        # Require both the dependency and test-only Java sources so an ordinary
+        # library that uses JUnit for its own tests keeps its structural type.
+        java_paths = [path for path in flat_paths if path.endswith(".java")]
+        if (
+            "JUnit 4" in framework_names
+            and java_paths
+            and all("/src/test/" in path or path.startswith("src/test/") for path in java_paths)
+        ):
+            return "test"
+
         # Weak CLI heuristic: a top-level bin/ directory (only when nothing stronger).
         if any(path.startswith("bin/") for path in flat_paths):
             return "cli"

{sourcecode-5.9.9 → sourcecode-5.9.10}/src/sourcecode/cli.py

@@ -13861,6 +13861,10 @@ def audit_report_cmd(
     `--sign-key` adds an HMAC-SHA256 signature over the canonical JSON payload.
     The key is local and explicit; no network trust service or new PKI is implied.
 
+    On repositories above roughly 3,000 files, do not put Markdown delivery
+    behind a strict timeout: it remains contention-sensitive. For supervised
+    automation, persist `risk` first, use `--from-risk`, and prefer JSON/YAML.
+
     \b
     Examples:
       ask audit-report .

{sourcecode-5.9.9 → sourcecode-5.9.10}/src/sourcecode/context_summarizer.py

@@ -38,6 +38,7 @@ _TYPE_LABELS: dict[str, str] = {
     "cli": "CLI tool",
     "worker": "Background worker / service",
     "library": "Library / package",
+    "test": "Test suite",
     "unknown": "Application",
 }
 

{sourcecode-5.9.9 → sourcecode-5.9.10}/src/sourcecode/detectors/java.py

@@ -492,6 +492,8 @@ class JavaDetector(AbstractDetector):
             frameworks.append(FrameworkDetection(name="Spring AOP", source=source))
         if "spring-boot-starter-activemq" in text or "activemq-broker" in text or "activemq-client" in text:
             frameworks.append(FrameworkDetection(name="ActiveMQ", source=source))
+        if "junit:junit" in text:
+            frameworks.append(FrameworkDetection(name="JUnit 4", source=source))
         return frameworks
 
     def _collect_entry_points(self, context: DetectionContext) -> list[EntryPoint]:

{sourcecode-5.9.9 → sourcecode-5.9.10}/src/sourcecode/spring_event_topology.py

@@ -254,6 +254,7 @@ class EventTopologyOrchestrator:
             return EventTopologyResult(
                 event_class=event_class,
                 resolution="not_found",
+                risk_level="unknown",
                 limitations=limitations + [f"Event class '{event_class}' not found in CIR."],
                 confidence="low",
                 metadata={"query_time_ms": elapsed},

{sourcecode-5.9.9 → sourcecode-5.9.10}/src/sourcecode/summarizer.py

@@ -134,6 +134,7 @@ class ProjectSummarizer:
             "webapp": "Web application",
             "api": "API",
             "library": "Library",
+            "test": "Test suite",
             "cli": "CLI",
             "monorepo": "Monorepo",
             "fullstack": "Full-stack project",
@@ -606,6 +607,7 @@ class ProjectSummarizer:
         "web_mvc": "Server-side MVC web app",
         "webapp": "Web application",
         "library": "Library",
+        "test": "Test suite",
         "monorepo": "Monorepo",
         "fullstack": "Full-stack project",
     }