cursedbelt 5.12.1 → 5.13.0

package/dist/scripts/guardrailsEnforce.d.ts

@@ -17,6 +17,13 @@ interface Rule {
 export declare function walk(dir: string, out?: string[]): string[];
 export declare function setReimplementedNames(names: readonly string[]): void;
 export declare const RULES: Record<string, Rule>;
+/**
+ * Rules that are about cursedbelt's OWN source and mean nothing in an app's.
+ * `control-height-tokens` reads a fixed list of the belt's control-class files.
+ */
+export declare const BELT_INTERNAL_RULES: ReadonlySet<string>;
+/** What `--all-app-rules` scans: every rule an app's source can break. */
+export declare const APP_RULES: readonly string[];
 export declare const ALLOWED_FILE_CATEGORIES: Set<string>;
 export interface FileAllow {
     rules: Set<string>;

package/dist/scripts/guardrailsEnforce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrailsEnforce.d.ts","sourceRoot":"","sources":["../../scripts/guardrailsEnforce.ts"],"names":[],"mappings":";AAuMA,UAAU,SAAS;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;sEAGkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,IAAI;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;CACzD;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CA6B9D;AA66BD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAEpE;AA+mBD,eAAO,MAAM,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAqBtC,CAAC;AASF,eAAO,MAAM,uBAAuB,aAAkD,CAAC;AAGvF,MAAM,WAAW,SAAS;IACzB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACb;AAED;2FAC2F;AAC3F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA0C3F;AAED,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAmGhC,wBAAgB,0BAA0B,CAAC,SAAS,GAAE,MAAwB,GAAG,MAAM,EAAE,CAyBxF"}
+{"version":3,"file":"guardrailsEnforce.d.ts","sourceRoot":"","sources":["../../scripts/guardrailsEnforce.ts"],"names":[],"mappings":";AA+MA,UAAU,SAAS;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;sEAGkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,IAAI;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;CACzD;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CA6B9D;AA66BD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAEpE;AA+mBD,eAAO,MAAM,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAqBtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAE5F,0EAA0E;AAC1E,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAAwE,CAAC;AAShH,eAAO,MAAM,uBAAuB,aAAkD,CAAC;AAGvF,MAAM,WAAW,SAAS;IACzB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACb;AAED;2FAC2F;AAC3F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA0C3F;AAED,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAmGhC,wBAAgB,0BAA0B,CAAC,SAAS,GAAE,MAAwB,GAAG,MAAM,EAAE,CAyBxF"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt",
-	"version": "5.12.1",
+	"version": "5.13.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The React design system of the cursedbelt split — components, styles, theme. cursedbelt-core below it; server tier in cursedbelt-server.",

package/scripts/checkAreaStyles.spec.ts

@@ -26,6 +26,21 @@ import { compileStylesheet } from './generateUtilityStyles';
  */
 const noRepoEnv = (dir: string) => ({ ...process.env, GIT_CEILING_DIRECTORIES: dirname(dir) });
 
+/** `Bun.spawnSync`-shaped, kept async — bun 1.4.2 can lose a child's exit under `bun test --parallel`
+ *  when the wait is synchronous; the async form fails at the test's timeout instead of hanging the worker. */
+async function spawnAsync(
+  argv: string[],
+  opts: { cwd?: string; env?: Record<string, string> } = {},
+): Promise<{ exitCode: number; stdout: string; stderr: string }> {
+  const child = Bun.spawn(argv, { cwd: opts.cwd, env: opts.env, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  return { exitCode, stdout, stderr };
+}
+
 const BELT = {
   union: `@layer utilities { .flex { display: flex } .rounded-full { border-radius: 9999px } .hover\\:bg-muted { &:hover { @media (hover: hover) { background: var(--muted) } } } .recharts-tip { opacity: .5; } }`,
   areas: {
@@ -89,23 +104,23 @@ describe('checkAreaStyles', () => {
     expect([...tokensInJs(`a="[&>*]:w-full p-2" b='x'`)]).toContain('[&>*]:w-full');
   });
 
-  test('the CLI exits 2 on a directory with nothing to compare, 1 on a miss, 0 when complete', () => {
+  test('the CLI exits 2 on a directory with nothing to compare, 1 on a miss, 0 when complete', async () => {
     const dir = mkdtempSync(join(tmpdir(), 'belt-area-check-'));
     try {
       const run = () =>
-        Bun.spawnSync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), dir], { cwd: dir, env: noRepoEnv(dir), stdout: 'pipe', stderr: 'pipe' });
-      expect(run().exitCode).toBe(2);
+        spawnAsync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), dir], { cwd: dir, env: noRepoEnv(dir) });
+      expect((await run()).exitCode).toBe(2);
       const { union } = readBeltSheets();
       // `truncate` is a core utility in every build of the union.
       expect(classesInCss(union).has('truncate')).toBe(true);
       mkdirSync(join(dir, 'assets'));
       writeFileSync(join(dir, 'assets', 'index.js'), 'const c="truncate";');
       writeFileSync(join(dir, 'assets', 'index.css'), '.app{color:red}');
-      const miss = run();
+      const miss = await run();
       expect(miss.exitCode).toBe(1);
-      expect(miss.stderr.toString()).toContain('truncate');
+      expect(miss.stderr).toContain('truncate');
       writeFileSync(join(dir, 'assets', 'index.css'), '.truncate{overflow:hidden}');
-      expect(run().exitCode).toBe(0);
+      expect((await run()).exitCode).toBe(0);
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
@@ -239,15 +254,15 @@ describe('🔴 the ORDER check — a base utility after a variant that sets the
     expect(hasVariantPrefix('text-[color:var(--x)]')).toBe(false);
   });
 
-  test('the CLI exits 1 on an out-of-order build even when every class is styled', () => {
+  test('the CLI exits 1 on an out-of-order build even when every class is styled', async () => {
     const dir = mkdtempSync(join(tmpdir(), 'belt-order-check-'));
     try {
       mkdirSync(join(dir, 'assets'));
       writeFileSync(join(dir, 'assets', 'index.js'), 'const c="truncate";');
       writeFileSync(join(dir, 'assets', 'index.css'), '@layer utilities{@media(min-width:40rem){.sm\\:flex{display:flex}}.truncate{overflow:hidden}.hidden{display:none}}');
-      const r = Bun.spawnSync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), dir], { cwd: dir, env: noRepoEnv(dir), stdout: 'pipe', stderr: 'pipe' });
+      const r = await spawnAsync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), dir], { cwd: dir, env: noRepoEnv(dir) });
       expect(r.exitCode).toBe(1);
-      expect(r.stderr.toString()).toContain('.hidden (later) overrides .sm:flex');
+      expect(r.stderr).toContain('.hidden (later) overrides .sm:flex');
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
@@ -301,16 +316,16 @@ describe('🔴 the THEME VARIABLE check — a `var()` of a theme variable no bui
     expect([...variablesDeclared('@property --tw-x{syntax:"*"}.a{--b:1;color:var(--c)}')].sort()).toEqual(['--b', '--tw-x']);
   });
 
-  test('the CLI exits 1 on a build that reads an undeclared theme variable, naming it', () => {
+  test('the CLI exits 1 on a build that reads an undeclared theme variable, naming it', async () => {
     const dir = mkdtempSync(join(tmpdir(), 'belt-theme-var-check-'));
     try {
       mkdirSync(join(dir, 'assets'));
       writeFileSync(join(dir, 'assets', 'index.js'), `const c="truncate";${STATION_JS}`);
       writeFileSync(join(dir, 'assets', 'index.css'), '@layer theme{:root{--color-muted:var(--muted);--color-accent:var(--accent)}}@layer utilities{.truncate{overflow:hidden}}');
-      const r = Bun.spawnSync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), dir], { cwd: dir, env: noRepoEnv(dir), stdout: 'pipe', stderr: 'pipe' });
+      const r = await spawnAsync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), dir], { cwd: dir, env: noRepoEnv(dir) });
       expect(r.exitCode).toBe(1);
-      expect(r.stderr.toString()).toContain('--color-card');
-      expect(r.stderr.toString()).not.toContain('--color-muted');
+      expect(r.stderr).toContain('--color-card');
+      expect(r.stderr).not.toContain('--color-muted');
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
@@ -319,7 +334,7 @@ describe('🔴 the THEME VARIABLE check — a `var()` of a theme variable no bui
 
 describe('🔴 the SCAN-LEAK check — a scanned file ignored only by the global gitignore (5.3.1, family 0a298a5)', () => {
   /** A git repo whose "machine-global" excludes file is a temp file — the real ~/.gitignore_global is never read. */
-  function fixture() {
+  async function fixture() {
     const base = mkdtempSync(join(tmpdir(), 'belt-scan-leak-'));
     const repo = join(base, 'app');
     mkdirSync(repo);
@@ -328,7 +343,7 @@ describe('🔴 the SCAN-LEAK check — a scanned file ignored only by the global
     const gitconfig = join(base, 'gitconfig');
     writeFileSync(gitconfig, `[core]\n\texcludesFile = ${globalIgnore}\n`);
     const env = { ...process.env, GIT_CONFIG_GLOBAL: gitconfig, GIT_CONFIG_NOSYSTEM: '1' };
-    expect(Bun.spawnSync(['git', 'init', '-q', repo], { env }).exitCode).toBe(0);
+    expect((await spawnAsync(['git', 'init', '-q', repo], { env })).exitCode).toBe(0);
     writeFileSync(join(repo, '.gitignore'), 'dist/\n');
     mkdirSync(join(repo, 'src'));
     writeFileSync(join(repo, 'src', 'App.tsx'), 'export const A = () => <div className="flex" />;');
@@ -346,8 +361,8 @@ describe('🔴 the SCAN-LEAK check — a scanned file ignored only by the global
     return { base, repo, env, globalIgnore };
   }
 
-  test('RED: each globally-ignored TEXT path is named with the file and pattern that matched', () => {
-    const { base, repo, env, globalIgnore } = fixture();
+  test('RED: each globally-ignored TEXT path is named with the file and pattern that matched', async () => {
+    const { base, repo, env, globalIgnore } = await fixture();
     try {
       const leaks = scanLeaks(repo, env);
       expect(leaks?.map((l) => l.path)).toEqual(['.agent.noindex/', 'src/probe.agent.tsx']);
@@ -362,8 +377,8 @@ describe('🔴 the SCAN-LEAK check — a scanned file ignored only by the global
     }
   });
 
-  test("GREEN once the repo's OWN .gitignore names them — the global file still matches, but no longer decides", () => {
-    const { base, repo, env } = fixture();
+  test("GREEN once the repo's OWN .gitignore names them — the global file still matches, but no longer decides", async () => {
+    const { base, repo, env } = await fixture();
     try {
       writeFileSync(join(repo, '.gitignore'), 'dist/\n.agent.noindex/\n*.agent.*\n');
       expect(scanLeaks(repo, env)).toEqual([]);
@@ -372,8 +387,8 @@ describe('🔴 the SCAN-LEAK check — a scanned file ignored only by the global
     }
   });
 
-  test('.git/info/exclude is not the repo\'s .gitignore either — RED', () => {
-    const { base, repo, env } = fixture();
+  test('.git/info/exclude is not the repo\'s .gitignore either — RED', async () => {
+    const { base, repo, env } = await fixture();
     try {
       writeFileSync(join(repo, '.gitignore'), 'dist/\n.agent.noindex/\n*.agent.*\n');
       writeFileSync(join(repo, 'notes.md'), 'bg-primary');
@@ -384,8 +399,8 @@ describe('🔴 the SCAN-LEAK check — a scanned file ignored only by the global
     }
   });
 
-  test('an app root that is itself git-ignored cannot be measured — it throws (the CLI exits 2)', () => {
-    const { base, repo, env } = fixture();
+  test('an app root that is itself git-ignored cannot be measured — it throws (the CLI exits 2)', async () => {
+    const { base, repo, env } = await fixture();
     try {
       expect(() => scanLeaks(join(repo, '.agent.noindex'), env)).toThrow(/itself git-ignored/);
     } finally {
@@ -402,27 +417,25 @@ describe('🔴 the SCAN-LEAK check — a scanned file ignored only by the global
     }
   });
 
-  test('the CLI exits 1 on a leak even when every class is styled, and 0 once the repo ignores it', () => {
-    const { base, repo, env } = fixture();
+  test('the CLI exits 1 on a leak even when every class is styled, and 0 once the repo ignores it', async () => {
+    const { base, repo, env } = await fixture();
     try {
       writeFileSync(join(repo, 'dist', 'index.css'), '.truncate{overflow:hidden}');
       const run = () =>
-        Bun.spawnSync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), 'dist'], { cwd: repo, env, stdout: 'pipe', stderr: 'pipe' });
-      const red = run();
+        spawnAsync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), 'dist'], { cwd: repo, env });
+      const red = await run();
       expect(red.exitCode).toBe(1);
-      expect(red.stderr.toString()).toContain('.agent.noindex/');
-      expect(red.stderr.toString()).toContain('src/probe.agent.tsx');
+      expect(red.stderr).toContain('.agent.noindex/');
+      expect(red.stderr).toContain('src/probe.agent.tsx');
       // --root reads the same repo from anywhere.
-      const elsewhere = Bun.spawnSync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), join(repo, 'dist'), '--root', repo], {
+      const elsewhere = await spawnAsync(['bun', join(import.meta.dir, 'checkAreaStyles.ts'), join(repo, 'dist'), '--root', repo], {
         cwd: base,
         env,
-        stdout: 'pipe',
-        stderr: 'pipe',
       });
       expect(elsewhere.exitCode).toBe(1);
       writeFileSync(join(repo, '.gitignore'), 'dist/\n.agent.noindex/\n*.agent.*\n');
-      const green = run();
-      expect(green.stderr.toString()).toBe('');
+      const green = await run();
+      expect(green.stderr).toBe('');
       expect(green.exitCode).toBe(0);
     } finally {
       rmSync(base, { recursive: true, force: true });

package/scripts/guardrailsEnforce.spec.ts

@@ -8,6 +8,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, expect, test } from 'bun:test';
 import {
+  APP_RULES,
+  BELT_INTERNAL_RULES,
   beltExportedComponentNames,
   parseFileAllows,
   RULES,
@@ -261,15 +263,15 @@ describe('no-raw-inputs', () => {
       expect(check('no-raw-inputs', source)).toHaveLength(0);
     });
 
-    test('a file-scoped allowance does not excuse it, and the run fails', () => {
-      withFixture(
+    test('a file-scoped allowance does not excuse it, and the run fails', async () => {
+      await withFixture(
         {
           'src/Choice.tsx':
             '// guardrails-file-allow no-raw-inputs: embeddable-primitive — pretend this is a standalone widget\n' +
             'export const C = () => <input type="radio" className="sr-only" />;\n',
         },
-        (dir) => {
-          const { code, report } = runCli(dir, ['no-raw-inputs', 'src']);
+        async (dir) => {
+          const { code, report } = await runCli(dir, ['no-raw-inputs', 'src']);
           expect(code).toBe(1);
           expect(report).toContain('Choice.tsx:2');
           expect(report).toContain('No opt-out');
@@ -277,14 +279,14 @@ describe('no-raw-inputs', () => {
       );
     });
 
-    test('nor does a baseline row that counts it', () => {
-      withFixture(
+    test('nor does a baseline row that counts it', async () => {
+      await withFixture(
         {
           'src/Choice.tsx': 'export const C = () => <input type="radio" className="sr-only" />;\n',
           'guardrails-baseline.json': JSON.stringify({ 'no-raw-inputs': 1 }),
         },
-        (dir) => {
-          const { code, report } = runCli(dir, ['no-raw-inputs', '--baseline', 'guardrails-baseline.json', 'src']);
+        async (dir) => {
+          const { code, report } = await runCli(dir, ['no-raw-inputs', '--baseline', 'guardrails-baseline.json', 'src']);
           expect(code).toBe(1);
           expect(report).toContain('No opt-out');
         },
@@ -1024,7 +1026,7 @@ describe('no-fast-tooltip', () => {
 
 const CLI = join(import.meta.dir, 'guardrailsEnforce.ts');
 
-function withFixture(files: Record<string, string>, body: (dir: string) => void): void {
+async function withFixture(files: Record<string, string>, body: (dir: string) => void | Promise<void>): Promise<void> {
   const root = mkdtempSync(join(tmpdir(), 'guardrails-cli-'));
   try {
     for (const [rel, contents] of Object.entries(files)) {
@@ -1032,15 +1034,20 @@ function withFixture(files: Record<string, string>, body: (dir: string) => void)
       mkdirSync(join(full, '..'), { recursive: true });
       writeFileSync(full, contents);
     }
-    body(root);
+    await body(root);
   } finally {
     rmSync(root, { recursive: true, force: true });
   }
 }
 
-function runCli(cwd: string, args: string[]): { code: number; report: string } {
-  const run = Bun.spawnSync([process.execPath, CLI, ...args], { cwd });
-  return { code: run.exitCode, report: `${run.stdout.toString()}${run.stderr.toString()}` };
+async function runCli(cwd: string, args: string[]): Promise<{ code: number; report: string }> {
+  const child = Bun.spawn([process.execPath, CLI, ...args], { cwd, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' });
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  return { code, report: `${stdout}${stderr}` };
 }
 
 /** Two hex colours and one raw <input>: counts a baseline row can be wrong about. */
@@ -1052,10 +1059,49 @@ const FIXTURE = {
 const rowsFor = (colors: number, inputs: number) =>
   JSON.stringify({ 'no-hardcoded-colors': colors, 'no-raw-inputs': inputs });
 
+describe('--all-app-rules (task 2219: a new belt rule reaches every app by itself)', () => {
+  /** A baseline with a zero row for every app rule, then `overrides` on top. */
+  const allRows = (overrides: Record<string, number | undefined> = {}) => {
+    const rows: Record<string, number> = Object.fromEntries(APP_RULES.map((name) => [name, 0]));
+    rows['no-hardcoded-colors'] = 2;
+    rows['no-raw-inputs'] = 1;
+    for (const [name, count] of Object.entries(overrides)) {
+      if (count === undefined) delete rows[name];
+      else rows[name] = count;
+    }
+    return JSON.stringify(rows);
+  };
+
+  test('scans every rule in RULES except the belt-internal ones', () => {
+    expect(APP_RULES).toEqual(Object.keys(RULES).filter((name) => !BELT_INTERNAL_RULES.has(name)));
+    expect(APP_RULES).toContain('no-raw-lazy');
+    expect(APP_RULES).not.toContain('control-height-tokens');
+  });
+
+  test('passes when the baseline has a row for every app rule', async () => {
+    await withFixture({ ...FIXTURE, 'scripts/baseline.json': allRows() }, async (dir) => {
+      const { code, report } = await runCli(dir, ['--all-app-rules', '--baseline', 'scripts/baseline.json', 'src']);
+      expect(report).toContain('✓ no-raw-lazy: 0 violation(s)');
+      expect(report).not.toContain('control-height-tokens');
+      expect(code).toBe(0);
+    });
+  });
+
+  test('🔴 a baseline missing a row for a rule the belt added FAILS, naming the rule', async () => {
+    // The whole point: bump the belt, get a new rule, and the gate says so until the app
+    // records its count — rather than the rule never running there at all.
+    await withFixture({ ...FIXTURE, 'scripts/baseline.json': allRows({ 'no-raw-lazy': undefined }) }, async (dir) => {
+      const { code, report } = await runCli(dir, ['--all-app-rules', '--baseline', 'scripts/baseline.json', 'src']);
+      expect(code).toBe(2);
+      expect(report).toContain('no row for rule(s) being scanned: no-raw-lazy');
+    });
+  });
+});
+
 describe('--baseline (a consuming repo\'s ratchet)', () => {
-  test('passes when every row equals the count that is actually there', () => {
-    withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(2, 1) }, (dir) => {
-      const { code, report } = runCli(dir, [
+  test('passes when every row equals the count that is actually there', async () => {
+    await withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(2, 1) }, async (dir) => {
+      const { code, report } = await runCli(dir, [
         'no-hardcoded-colors,no-raw-inputs',
         '--baseline',
         'scripts/baseline.json',
@@ -1067,11 +1113,11 @@ describe('--baseline (a consuming repo\'s ratchet)', () => {
     });
   });
 
-  test('🔴 a row ABOVE the real count FAILS, printing the number to paste', () => {
+  test('🔴 a row ABOVE the real count FAILS, printing the number to paste', async () => {
     // The half a one-sided ratchet gets wrong: fix a violation, leave the row where it
     // was, and the slack is available for the next one to grow back into silently.
-    withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(9, 1) }, (dir) => {
-      const { code, report } = runCli(dir, [
+    await withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(9, 1) }, async (dir) => {
+      const { code, report } = await runCli(dir, [
         'no-hardcoded-colors,no-raw-inputs',
         '--baseline',
         'scripts/baseline.json',
@@ -1083,9 +1129,9 @@ describe('--baseline (a consuming repo\'s ratchet)', () => {
     });
   });
 
-  test('a count above its row fails, the way it always did', () => {
-    withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(2, 0) }, (dir) => {
-      const { code, report } = runCli(dir, [
+  test('a count above its row fails, the way it always did', async () => {
+    await withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(2, 0) }, async (dir) => {
+      const { code, report } = await runCli(dir, [
         'no-hardcoded-colors,no-raw-inputs',
         '--baseline',
         'scripts/baseline.json',
@@ -1096,20 +1142,20 @@ describe('--baseline (a consuming repo\'s ratchet)', () => {
     });
   });
 
-  test('a row for a rule nobody scans is refused — coverage that is not there', () => {
-    withFixture(
+  test('a row for a rule nobody scans is refused — coverage that is not there', async () => {
+    await withFixture(
       { ...FIXTURE, 'scripts/baseline.json': JSON.stringify({ 'no-hardcoded-colors': 2, 'no-raw-zindex': 0 }) },
-      (dir) => {
-        const { code, report } = runCli(dir, ['no-hardcoded-colors', '--baseline', 'scripts/baseline.json', 'src']);
+      async (dir) => {
+        const { code, report } = await runCli(dir, ['no-hardcoded-colors', '--baseline', 'scripts/baseline.json', 'src']);
         expect(code).toBe(2);
         expect(report).toContain('row(s) for rules nobody scans: no-raw-zindex');
       },
     );
   });
 
-  test('a scanned rule with no row is refused — a silent 0 demands the whole pile at once', () => {
-    withFixture({ ...FIXTURE, 'scripts/baseline.json': JSON.stringify({ 'no-hardcoded-colors': 2 }) }, (dir) => {
-      const { code, report } = runCli(dir, [
+  test('a scanned rule with no row is refused — a silent 0 demands the whole pile at once', async () => {
+    await withFixture({ ...FIXTURE, 'scripts/baseline.json': JSON.stringify({ 'no-hardcoded-colors': 2 }) }, async (dir) => {
+      const { code, report } = await runCli(dir, [
         'no-hardcoded-colors,no-raw-inputs',
         '--baseline',
         'scripts/baseline.json',
@@ -1120,34 +1166,34 @@ describe('--baseline (a consuming repo\'s ratchet)', () => {
     });
   });
 
-  test('"$comment" carries the why; any OTHER non-number is a typo in a row', () => {
-    withFixture(
+  test('"$comment" carries the why; any OTHER non-number is a typo in a row', async () => {
+    await withFixture(
       {
         ...FIXTURE,
         'scripts/baseline.json': JSON.stringify({ $comment: ['the why', 'over several lines'], 'no-hardcoded-colors': 2 }),
       },
-      (dir) => {
-        expect(runCli(dir, ['no-hardcoded-colors', '--baseline', 'scripts/baseline.json', 'src']).code).toBe(0);
+      async (dir) => {
+        expect((await runCli(dir, ['no-hardcoded-colors', '--baseline', 'scripts/baseline.json', 'src'])).code).toBe(0);
       },
     );
-    withFixture({ ...FIXTURE, 'scripts/baseline.json': JSON.stringify({ 'no-hardcoded-colors': '2' }) }, (dir) => {
-      const { code, report } = runCli(dir, ['no-hardcoded-colors', '--baseline', 'scripts/baseline.json', 'src']);
+    await withFixture({ ...FIXTURE, 'scripts/baseline.json': JSON.stringify({ 'no-hardcoded-colors': '2' }) }, async (dir) => {
+      const { code, report } = await runCli(dir, ['no-hardcoded-colors', '--baseline', 'scripts/baseline.json', 'src']);
       expect(code).toBe(2);
       expect(report).toContain('"no-hardcoded-colors" is "2", not a violation count');
     });
   });
 
-  test('a missing baseline file stops the run rather than defaulting every row to 0', () => {
-    withFixture(FIXTURE, (dir) => {
-      const { code, report } = runCli(dir, ['no-hardcoded-colors', '--baseline', 'scripts/nope.json', 'src']);
+  test('a missing baseline file stops the run rather than defaulting every row to 0', async () => {
+    await withFixture(FIXTURE, async (dir) => {
+      const { code, report } = await runCli(dir, ['no-hardcoded-colors', '--baseline', 'scripts/nope.json', 'src']);
       expect(code).toBe(2);
       expect(report).toContain('no such file');
     });
   });
 
-  test('is not the packaged --scope ratchet, and says so rather than picking one', () => {
-    withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(2, 1) }, (dir) => {
-      const { code, report } = runCli(dir, [
+  test('is not the packaged --scope ratchet, and says so rather than picking one', async () => {
+    await withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(2, 1) }, async (dir) => {
+      const { code, report } = await runCli(dir, [
         'no-hardcoded-colors',
         '--scope',
         'cursedbelt',
@@ -1160,12 +1206,12 @@ describe('--baseline (a consuming repo\'s ratchet)', () => {
     });
   });
 
-  test('--scope stays ONE-sided: below its row passes and only suggests', () => {
+  test('--scope stays ONE-sided: below its row passes and only suggests', async () => {
     // The packaged baseline lives inside node_modules, so a consumer cannot lower a row
     // in it. Failing them for a number only a cursedbelt release can change would be a
     // gate nobody can turn green — which is why only --baseline is two-sided.
-    withFixture(FIXTURE, (dir) => {
-      const { code, report } = runCli(dir, ['no-hardcoded-colors', '--scope', 'cursedbelt', 'src']);
+    await withFixture(FIXTURE, async (dir) => {
+      const { code, report } = await runCli(dir, ['no-hardcoded-colors', '--scope', 'cursedbelt', 'src']);
       expect(code).toBe(1); // 2 found against the packaged cursedbelt row of 0
       expect(report).toContain('exceeds baseline of 0');
     });
@@ -1173,16 +1219,16 @@ describe('--baseline (a consuming repo\'s ratchet)', () => {
 });
 
 describe('--reimplements-from-belt', () => {
-  test('flags a local component named after one this package exports', () => {
+  test('flags a local component named after one this package exports', async () => {
     // Read off this package's own react index files, so the list is the truth of the
     // version an app installed rather than a copy it maintains.
-    withFixture(
+    await withFixture(
       {
         'src/Button.tsx': 'export function Button() { return null; }\n',
         'scripts/baseline.json': JSON.stringify({ 'no-local-reimplementation': 0 }),
       },
-      (dir) => {
-        const { code, report } = runCli(dir, [
+      async (dir) => {
+        const { code, report } = await runCli(dir, [
           'no-local-reimplementation',
           '--baseline',
           'scripts/baseline.json',
@@ -1216,7 +1262,7 @@ describe('--reimplements-from-belt', () => {
 });
 
 describe('--exclude', () => {
-  test('drops build output that lives under a source root', () => {
+  test('drops build output that lives under a source root', async () => {
     // desk's `src/generated/assets.ts` is the compiled browser app inlined as a module:
     // 282 double-counted violations that move with the bundle, reddening a two-sided
     // ratchet over work nobody did.
@@ -1225,11 +1271,11 @@ describe('--exclude', () => {
       'src/generated/assets.css': '.x { color: #123456; }\n.y { color: #654321; }\n',
       'scripts/baseline.json': rowsFor(2, 1),
     };
-    withFixture(files, (dir) => {
-      const scanned = runCli(dir, ['no-hardcoded-colors,no-raw-inputs', '--baseline', 'scripts/baseline.json', 'src']);
+    await withFixture(files, async (dir) => {
+      const scanned = await runCli(dir, ['no-hardcoded-colors,no-raw-inputs', '--baseline', 'scripts/baseline.json', 'src']);
       expect(scanned.code).toBe(1); // 4 colours, not 2 — the artifact counted as source
 
-      const { code, report } = runCli(dir, [
+      const { code, report } = await runCli(dir, [
         'no-hardcoded-colors,no-raw-inputs',
         '--baseline',
         'scripts/baseline.json',
@@ -1242,9 +1288,9 @@ describe('--exclude', () => {
     });
   });
 
-  test('an exclusion matching nothing is refused, never read as handled', () => {
-    withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(2, 1) }, (dir) => {
-      const { code, report } = runCli(dir, [
+  test('an exclusion matching nothing is refused, never read as handled', async () => {
+    await withFixture({ ...FIXTURE, 'scripts/baseline.json': rowsFor(2, 1) }, async (dir) => {
+      const { code, report } = await runCli(dir, [
         'no-hardcoded-colors,no-raw-inputs',
         '--baseline',
         'scripts/baseline.json',

package/scripts/guardrailsEnforce.ts

@@ -8,7 +8,7 @@
 // invoked from each package's `lint`/`done` script, exiting non-zero on violation).
 //
 // Usage:
-//   bun run ../cursedbelt/scripts/guardrailsEnforce.ts <rule>[,<rule>...]
+//   bun run ../cursedbelt/scripts/guardrailsEnforce.ts <rule>[,<rule>...] | --all-app-rules
 //     [--scope <name> | --baseline <path>]
 //     [--reimplements <Name,Name,…> | --reimplements-from-belt]
 //     [--exclude <path>[,<path>…]] [root...]
@@ -19,9 +19,17 @@
 //
 // A CONSUMING APP uses the other three instead, and needs no wrapper script of its own:
 //
-//   "guardrails": "bun node_modules/cursedbelt/scripts/guardrailsEnforce.ts <rules>
+//   "guardrails": "bun node_modules/cursedbelt/scripts/guardrailsEnforce.ts --all-app-rules
 //                  --baseline scripts/guardrails-baseline.json --reimplements-from-belt src"
 //
+//   --all-app-rules              in place of a rule list: every rule in `RULES` except the
+//                                belt-internal ones (`BELT_INTERNAL_RULES`). Task 2219,
+//                                2026-09-27: each app used to NAME its rules, so a rule the
+//                                belt added reached only the apps somebody remembered to
+//                                edit — `no-raw-lazy` (5.12.0) reached nine of eleven. With
+//                                this flag a belt bump that adds a rule reds the app's gate
+//                                (its two-sided `--baseline` has no row for it) until the app
+//                                records the row: adoption is a forced, visible step.
 //   --baseline <path>            a flat `{ "<rule>": <count> }` ratchet in the CALLER's
 //                                repo, TWO-SIDED — exceeding a row fails, and so does
 //                                falling below one, which prints the number to paste.
@@ -1832,6 +1840,15 @@ export const RULES: Record<string, Rule> = {
 	[noRawLazy.name]: noRawLazy,
 };
 
+/**
+ * Rules that are about cursedbelt's OWN source and mean nothing in an app's.
+ * `control-height-tokens` reads a fixed list of the belt's control-class files.
+ */
+export const BELT_INTERNAL_RULES: ReadonlySet<string> = new Set([controlHeightTokens.name]);
+
+/** What `--all-app-rules` scans: every rule an app's source can break. */
+export const APP_RULES: readonly string[] = Object.keys(RULES).filter((name) => !BELT_INTERNAL_RULES.has(name));
+
 // ── File-scoped allowances ──────────────────────────────────────────────────────
 // `guardrails-file-allow <rule>[,<rule>...]: <category> — <reason>` — a deliberate,
 // reviewable, header-only, category-tagged exemption for the rare file whose whole
@@ -2023,11 +2040,11 @@ export function beltExportedComponentNames(reactRoot: string = BELT_REACT_ROOT):
 
 function main() {
 	const [ruleArg, ...rest] = process.argv.slice(2);
-	const ruleNames = ruleArg ? ruleArg.split(",") : [];
+	const ruleNames = ruleArg === "--all-app-rules" ? [...APP_RULES] : ruleArg ? ruleArg.split(",") : [];
 	const rules = ruleNames.map((n) => RULES[n]).filter((r): r is Rule => Boolean(r));
 	if (ruleNames.length === 0 || rules.length !== ruleNames.length) {
 		console.error(
-			`Usage: bun run guardrailsEnforce.ts <rule>[,<rule>...] [--scope <name> | --baseline <path>]\n` +
+			`Usage: bun run guardrailsEnforce.ts <rule>[,<rule>...] | --all-app-rules [--scope <name> | --baseline <path>]\n` +
 				`       [--reimplements <Name,…> | --reimplements-from-belt] [--exclude <path>[,<path>…]] [root...]\n` +
 				`Known rules: ${Object.keys(RULES).join(", ")}`,
 		);

package/scripts/paths.ts

@@ -38,7 +38,7 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 /** The generation's tools this repo runs over its own tree, in the order they should fail. */
-const TOOLS = ["check-paths.ts", "check-doc-citations.ts", "check-gate-graph.ts"];
+const TOOLS = ["check-paths.ts", "check-doc-citations.ts", "check-gate-graph.ts", "check-test-spawn.ts"];
 
 /** How far up either walk looks before giving up — a bound, so a misuse is `null` in ms. */
 const MAX_HOPS = 16;

package/src/barrelsReachNoOptionalPeer.spec.ts

@@ -125,18 +125,21 @@ const STATIC_SPECIFIER = /\bfrom\s*["']([^"'\n]+)["']|^\s*import\s*["']([^"'\n]+
  * `.js` it emits — a stylesheet cannot import a package, so the CSS output is
  * irrelevant to the question and only the JS is read.
  */
-const staticExternalsOf = (entry: string): Set<string> => {
+const staticExternalsOf = async (entry: string): Promise<Set<string>> => {
   const outdir = `${process.env.TMPDIR ?? '/tmp'}/cursedbelt-barrel-scan/${entry.replace(/[^a-z0-9]+/gi, '-')}`;
-  const build = Bun.spawnSync(
+  const child = Bun.spawn(
     ['bun', 'build', entry, '--target=bun', '--packages=external', '--outdir', outdir],
-    { cwd: REPO, stdout: 'pipe', stderr: 'pipe' },
+    { cwd: REPO, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' },
   );
+  const [, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
   const emitted = [...new Bun.Glob('**/*.js').scanSync({ cwd: outdir, onlyFiles: true })];
   const bundle = emitted.map((f) => readFileSync(`${outdir}/${f}`, 'utf8')).join('\n');
-  if (build.exitCode !== 0 || bundle.trim() === '') {
-    throw new Error(
-      `could not bundle ${entry} (exit ${build.exitCode}) — a check that cannot measure is not a passing check:\n${build.stderr.toString()}`,
-    );
+  if (exitCode !== 0 || bundle.trim() === '') {
+    throw new Error(`could not bundle ${entry} (exit ${exitCode}) — a check that cannot measure is not a passing check:\n${stderr}`);
   }
   const found = new Set<string>();
   for (const match of bundle.matchAll(STATIC_SPECIFIER)) {
@@ -152,8 +155,8 @@ const staticExternalsOf = (entry: string): Set<string> => {
   return found;
 };
 
-const staticOptionalPeersOf = (entry: string): string[] =>
-  [...staticExternalsOf(entry)].filter((name) => OPTIONAL_PEERS.has(name)).sort();
+const staticOptionalPeersOf = async (entry: string): Promise<string[]> =>
+  [...(await staticExternalsOf(entry))].filter((name) => OPTIONAL_PEERS.has(name)).sort();
 
 /**
  * 🔴 The INVERSE of everything above, and the half task 149 had to add (2026-09-15).
@@ -213,17 +216,19 @@ describe('barrels reach no optional peer statically', () => {
   });
 
   for (const target of NO_STATIC_OPTIONAL_PEERS) {
-    it(`cursedbelt/${target.subpath.slice(2)} costs a consumer no optional peer to import`, () => {
+    it(`cursedbelt/${target.subpath.slice(2)} costs a consumer no optional peer to import`, async () => {
       expect(
-        staticOptionalPeersOf(target.entry),
+        await staticOptionalPeersOf(target.entry),
         `importing cursedbelt/${target.subpath.slice(2)} statically pulls these OPTIONAL peers, so every consumer must install them for code it may never call. Either import the leaf module that has what you need instead of a sibling INDEX (that is how 'otplib' got in here twice), or make the dependency lazy: \`const { x } = await import('pkg')\` inside the function that needs it.`,
       ).toEqual([]);
     });
   }
 });
 
+const reachedFromReactIndex = await staticExternalsOf('src/react/index.ts');
+
 describe('every runtime dependency is one the barrel actually needs', () => {
-  const reached = staticExternalsOf('src/react/index.ts');
+  const reached = reachedFromReactIndex;
   const declared = Object.keys(
     (pkg as { dependencies?: Record<string, string> }).dependencies ?? {},
   );

package/src/lockfileIsTracked.spec.ts

@@ -23,7 +23,6 @@
  * to skip it. Ignored-vs-not is the property that actually regresses.
  */
 import { describe, expect, test } from 'bun:test'
-import { spawnSync } from 'node:child_process'
 import { existsSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 
@@ -37,13 +36,18 @@ describe('bun.lock is part of the checkout', () => {
     ).toBe(true)
   })
 
-  test('git is not told to ignore it', () => {
-    const git = spawnSync('git', ['check-ignore', '-q', 'bun.lock'], { cwd: repoRoot })
-    if (git.error) return // no git on this host: nothing to assert about ignore rules
+  test('git is not told to ignore it', async () => {
+    let status: number
+    try {
+      const child = Bun.spawn(['git', 'check-ignore', '-q', 'bun.lock'], { cwd: repoRoot, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' })
+      status = await child.exited
+    } catch {
+      return // no git on this host: nothing to assert about ignore rules
+    }
 
     // exit 0 = the path IS ignored; 1 = it is not; anything else = git could not tell us.
     expect(
-      git.status,
+      status,
       'bun.lock is gitignored, so a fresh clone has no lockfile and `bun install --frozen-lockfile` cannot pass there. Delete the stanza from .gitignore rather than the assertion.',
     ).not.toBe(0)
   })

package/src/shippedFilesAreTracked.spec.ts

@@ -25,7 +25,6 @@
  * when `git` cannot answer — a check that silently degrades to green is worse than none.
  */
 import { describe, expect, test } from 'bun:test';
-import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import pkg from '../package.json';
@@ -36,14 +35,15 @@ const repoRoot = fileURLToPath(new URL('..', import.meta.url));
 const shippedDirs = (): string[] =>
 	((pkg as { files?: string[] }).files ?? []).filter((f) => f !== 'dist' && existsSync(`${repoRoot}/${f}`));
 
-const git = (...args: string[]): { ok: boolean; out: string } => {
-	const r = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8' });
-	return { ok: r.status === 0, out: (r.stdout ?? '').trim() };
+const git = async (...args: string[]): Promise<{ ok: boolean; out: string }> => {
+	const child = Bun.spawn(['git', '-C', repoRoot, ...args], { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' });
+	const [out, , code] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+	return { ok: code === 0, out: out.trim() };
 };
 
 describe('every file inside the published surface is tracked', () => {
-	test('git can answer at all — a degraded check must refuse, not pass', () => {
-		expect(git('rev-parse', '--is-inside-work-tree').ok, 'not a git checkout, so this check proves nothing').toBe(true);
+	test('git can answer at all — a degraded check must refuse, not pass', async () => {
+		expect((await git('rev-parse', '--is-inside-work-tree')).ok, 'not a git checkout, so this check proves nothing').toBe(true);
 	});
 
 	test('package.json names a shippable directory to scan', () => {
@@ -52,10 +52,10 @@ describe('every file inside the published surface is tracked', () => {
 		expect(shippedDirs().length, '`files` names no committed directory — nothing would be scanned').toBeGreaterThan(0);
 	});
 
-	test('no untracked file sits inside a directory `files` ships', () => {
+	test('no untracked file sits inside a directory `files` ships', async () => {
 		// --others = untracked; --exclude-standard honours .gitignore, so deliberately
 		// ignored paths (.agent.noindex, node_modules) are not offences.
-		const { ok, out } = git('ls-files', '--others', '--exclude-standard', '--', ...shippedDirs());
+		const { ok, out } = await git('ls-files', '--others', '--exclude-standard', '--', ...shippedDirs());
 		expect(ok, 'git ls-files failed').toBe(true);
 		const untracked = out === '' ? [] : out.split('\n');
 		expect(

package/src/typecheckCachesAreSeparate.spec.ts

@@ -28,7 +28,6 @@
  * ~90ms per project because `--showConfig` does no type checking at all.
  */
 import { describe, expect, it } from 'bun:test';
-import { spawnSync } from 'node:child_process';
 import { type Dirent, readdirSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 
@@ -78,13 +77,20 @@ interface Resolved {
   emits: boolean;
 }
 
-function resolveProject(path: string): Resolved {
-  const r = spawnSync(process.execPath, ['x', 'tsc', '--showConfig', '-p', path], {
+async function resolveProject(path: string): Promise<Resolved> {
+  const child = Bun.spawn([process.execPath, 'x', 'tsc', '--showConfig', '-p', path], {
     cwd: ROOT,
-    encoding: 'utf8',
+    stdin: 'ignore',
+    stdout: 'pipe',
+    stderr: 'pipe',
   });
-  expect(r.status, `tsc --showConfig failed for ${path}:\n${r.stderr}`).toBe(0);
-  const options = (JSON.parse(r.stdout) as { compilerOptions?: Record<string, unknown> }).compilerOptions ?? {};
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  expect(code, `tsc --showConfig failed for ${path}:\n${stderr}`).toBe(0);
+  const options = (JSON.parse(stdout) as { compilerOptions?: Record<string, unknown> }).compilerOptions ?? {};
   const info = options.tsBuildInfoFile;
   return {
     name: relative(ROOT, path),
@@ -94,7 +100,7 @@ function resolveProject(path: string): Resolved {
   };
 }
 
-const PROJECTS = projectPaths().map(resolveProject);
+const PROJECTS = await Promise.all(projectPaths().map(resolveProject));
 
 describe('the typecheck caches', () => {
   it('finds every tsconfig in the repo', () => {

package/src/unpeeredStaysOffTheBarrel.spec.ts

@@ -36,18 +36,24 @@ const packageOf = (specifier: string): string => {
 };
 
 /** Every package an entry's bundle names, static or dynamic, with all packages left external. */
-function packagesReachedBy(entry: string, label: string): Set<string> {
+async function packagesReachedBy(entry: string, label: string): Promise<Set<string>> {
   const outdir = `${process.env.TMPDIR ?? '/tmp'}/cursedbelt-unpeered-scan-${process.pid}/${label}`;
   rmSync(outdir, { recursive: true, force: true });
-  const build = Bun.spawnSync(['bun', 'build', entry, '--target=browser', '--packages=external', '--outdir', outdir], {
+  const child = Bun.spawn(['bun', 'build', entry, '--target=browser', '--packages=external', '--outdir', outdir], {
     cwd: REPO,
+    stdin: 'ignore',
     stdout: 'pipe',
     stderr: 'pipe',
   });
+  const [, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
   const emitted = [...new Bun.Glob('**/*.js').scanSync({ cwd: outdir, onlyFiles: true })];
   const bundle = emitted.map((f) => readFileSync(`${outdir}/${f}`, 'utf8')).join('\n');
-  if (build.exitCode !== 0 || bundle.trim() === '') {
-    throw new Error(`could not bundle ${entry} (exit ${build.exitCode}) — a check that cannot measure is not a passing check:\n${build.stderr.toString()}`);
+  if (exitCode !== 0 || bundle.trim() === '') {
+    throw new Error(`could not bundle ${entry} (exit ${exitCode}) — a check that cannot measure is not a passing check:\n${stderr}`);
   }
   const found = new Set<string>();
   for (const m of bundle.matchAll(ANY_SPECIFIER)) {
@@ -58,10 +64,10 @@ function packagesReachedBy(entry: string, label: string): Set<string> {
 }
 
 describe('unpeered packages stay off the cursedbelt/react barrel', () => {
-  it('🔴 the barrel names no unpeered package, even lazily', () => {
+  it('🔴 the barrel names no unpeered package, even lazily', async () => {
     const source = (pkg.exports as Record<string, { source?: string }>)['./react']?.source;
     expect(source, 'package.json has no ./react source entry').toBeString();
-    const reached = packagesReachedBy(`${REPO}${(source as string).slice(2)}`, 'barrel');
+    const reached = await packagesReachedBy(`${REPO}${(source as string).slice(2)}`, 'barrel');
     expect(reached.size, 'the scan found no packages at all — it is not measuring').toBeGreaterThan(0);
     expect(
       UNPEERED.filter((name) => reached.has(name)),
@@ -84,13 +90,13 @@ describe('unpeered packages stay off the cursedbelt/react barrel', () => {
     expect(UNPEERED.filter((n) => !named.has(n))).toEqual([]);
   });
 
-  it('the scan sees a lazy import — 5.0.0 reproduced, so this check can go red', () => {
+  it('the scan sees a lazy import — 5.0.0 reproduced, so this check can go red', async () => {
     const dir = `${process.env.TMPDIR ?? '/tmp'}/cursedbelt-unpeered-fixture-${process.pid}`;
     mkdirSync(dir, { recursive: true });
     const entry = `${dir}/lazy.ts`;
     writeFileSync(entry, "export const Picker = () => import('@emoji-mart/react');\nexport const zod = () => import('@hookform/resolvers/zod');\n");
     try {
-      const reached = packagesReachedBy(entry, 'fixture');
+      const reached = await packagesReachedBy(entry, 'fixture');
       expect([...reached].sort()).toEqual(['@emoji-mart/react', '@hookform/resolvers']);
     } finally {
       rmSync(dir, { recursive: true, force: true });