mandrel 2.15.0 → 2.17.0

package/.agents/scripts/lib/baselines/envelope.js

@@ -133,6 +133,7 @@ function resolveGeneratedAt(explicit) {
  *   rows: Array<object>,
  *   kernelVersion: string,
  *   generatedAt?: string,
+ *   extras?: Record<string, unknown>,
  * }} params
  * @returns {{
  *   $schema: string,
@@ -148,6 +149,7 @@ export function buildEnvelope({
   rows,
   kernelVersion,
   generatedAt,
+  extras,
 } = {}) {
   if (typeof kind !== 'string' || !KNOWN_KINDS.includes(kind)) {
     throw new TypeError(
@@ -176,10 +178,15 @@ export function buildEnvelope({
     throw new TypeError('envelope.buildEnvelope: rows must be an array');
   }
 
+  // Per-kind envelope-level stamps (Story #4775). A kind whose SCORING
+  // SEMANTICS can change independently of its kernel version contributes them
+  // here; `assertEnvelope` still validates the result against the kind's
+  // schema, so an unrecognised extra fails closed rather than being persisted.
   return {
     $schema: schemaRefFor(kind),
     kernelVersion,
     generatedAt: resolveGeneratedAt(generatedAt),
+    ...(extras && typeof extras === 'object' ? extras : {}),
     rollup,
     rows,
   };

package/.agents/scripts/lib/baselines/kernel.js

@@ -50,7 +50,9 @@ import {
 } from './kinds/coverage.js';
 import {
   applyEpsilon as crapApplyEpsilon,
+  assertBaselineCompatible as crapAssertBaselineCompatible,
   compare as crapCompare,
+  envelopeExtras as crapEnvelopeExtras,
   kernelVersion as crapKernelVersion,
   keyField as crapKeyField,
   mergeRows as crapMergeRows,
@@ -139,6 +141,12 @@ function bindKindModule(members) {
     compare: members.compare,
     applyEpsilon: members.applyEpsilon,
     mergeRows: members.mergeRows,
+    // Optional per-kind hooks (Story #4775). `envelopeExtras` contributes
+    // envelope-level stamps the shared writer would not otherwise know about;
+    // `assertBaselineCompatible` lets a kind refuse a loaded baseline whose
+    // scoring semantics predate the running scorer.
+    envelopeExtras: members.envelopeExtras,
+    assertBaselineCompatible: members.assertBaselineCompatible,
   });
 }
 
@@ -179,6 +187,8 @@ const KIND_MODULES = Object.freeze({
     compare: crapCompare,
     applyEpsilon: crapApplyEpsilon,
     mergeRows: crapMergeRows,
+    envelopeExtras: crapEnvelopeExtras,
+    assertBaselineCompatible: crapAssertBaselineCompatible,
   }),
   maintainability: bindKindModule({
     name: maintainabilityName,
@@ -270,6 +280,27 @@ export function currentKernelVersion(kind) {
   return getKindModule(kind).kernelVersion();
 }
 
+/**
+ * Ask a kind whether a loaded baseline is compatible with the running
+ * scorer's SEMANTICS — a dimension `kernelVersion` cannot express, because a
+ * kind's scoring can change while the upstream package it stamps does not
+ * (Story #4775). Kinds without the hook always answer "compatible".
+ *
+ * @param {string} kind
+ * @param {object|null} baseline
+ * @returns {string|null} Operator-facing message, or null when compatible.
+ */
+export function checkBaselineSemantics(kind, baseline) {
+  let mod;
+  try {
+    mod = getKindModule(kind);
+  } catch {
+    return null;
+  }
+  if (typeof mod.assertBaselineCompatible !== 'function') return null;
+  return mod.assertBaselineCompatible(baseline);
+}
+
 /**
  * Compare a baseline's stamped version against the currently running
  * kernel for the same kind. Returns `{ match, current }` so callers can

package/.agents/scripts/lib/baselines/kinds/crap.js

@@ -75,6 +75,41 @@ export function kernelVersion() {
   return '0.0.0';
 }
 
+/**
+ * Scoring-semantics stamp (Story #4775, fix part 5).
+ *
+ * `kernelVersion()` above tracks the `typhonjs-escomplex` package and
+ * `escomplexVersion` tracks the same dependency — so a change in how THIS
+ * repo joins escomplex methods to istanbul coverage moves neither. Rows
+ * scored by the pre-#4775 join (exact transpiled-line equality, methods
+ * dropped when unresolved) are not comparable to rows scored by the join
+ * that replaced it (original-source coordinates, containment matching,
+ * honest `requireCoverage: false`): the same method can carry a different
+ * `crap`, a different `startLine`, or exist in one baseline and not the
+ * other. Comparing across that boundary produces phantom regressions and,
+ * worse, phantom passes.
+ *
+ * The stamp makes the boundary explicit and fails closed. Bump it whenever
+ * the coverage join, the line coordinate system, or the unresolved-method
+ * policy changes.
+ *
+ * Deliberately module-local: `envelopeExtras()` is the single production door
+ * to this value, so exporting the bare constant would add a second entry
+ * point that nothing in production reaches. Callers and tests that need the
+ * string read it off `envelopeExtras().scoringSemantics`.
+ */
+const SCORING_SEMANTICS = 'coverage-join-v2';
+
+/**
+ * Envelope-level stamps this kind contributes beyond the shared envelope
+ * keys. Consumed by `writer.write` via the kind-module protocol.
+ *
+ * @returns {{scoringSemantics: string}}
+ */
+export function envelopeExtras() {
+  return { scoringSemantics: SCORING_SEMANTICS };
+}
+
 export function projectRow(row) {
   return {
     path: canonicalise(row.path ?? row.file),
@@ -372,6 +407,23 @@ export const CRAP_COMPAT_AXES = [
         : null,
   },
   kernelDriftAxis('CRAP'),
+  {
+    name: 'scoring-semantics-drift',
+    severity: 'fatal',
+    check: ({ baseline }) => {
+      if (!baseline) return null;
+      const stamped = baseline.scoringSemantics ?? null;
+      if (stamped === SCORING_SEMANTICS) return null;
+      return (
+        `[CRAP] scoring semantics changed: baseline=${stamped ?? '<unstamped>'} ` +
+        `running=${SCORING_SEMANTICS}. Rows scored by the previous per-method ` +
+        'coverage join are not comparable to rows scored by the current one, ' +
+        'so this baseline cannot be compared — it must be re-derived. Run ' +
+        "'npm run test:coverage' then 'npm run crap:update -- --full-scope' " +
+        "and commit the result with a 'baseline-refresh:' subject."
+      );
+    },
+  },
   {
     name: 'ts-transpiler-drift',
     severity: 'warn',
@@ -401,6 +453,30 @@ export function evaluateBaselineCompatibility(ctx) {
   return reduceCompatAxes(CRAP_COMPAT_AXES, ctx);
 }
 
+/**
+ * Kind-module hook (Story #4775): the subset of the compat table that a
+ * *loaded* v2 envelope can be judged against on its own, with no running
+ * dependency versions to compare. The unified `check-baselines` gate calls it
+ * straight after `reader.load` and turns a message into a fail-closed
+ * schema-class error, so a baseline written by the previous scoring semantics
+ * can never be silently compared against new-semantics scores.
+ *
+ * The version-drift axes stay out: the v2 envelope does not carry
+ * `escomplexVersion` / `tsTranspilerVersion`, and running those checks against
+ * an absent field would compare `undefined` to `undefined` and pass
+ * vacuously — worse than not running them.
+ *
+ * @param {object|null} baseline A loaded v2 baseline envelope.
+ * @returns {string|null} Operator-facing message, or null when compatible.
+ */
+export function assertBaselineCompatible(baseline) {
+  if (!baseline) return null;
+  const axis = CRAP_COMPAT_AXES.find(
+    (a) => a.name === 'scoring-semantics-drift',
+  );
+  return axis ? axis.check({ baseline }) : null;
+}
+
 /**
  * Pure helper: resolve the CRAP baseline either from the working tree
  * (via `getCrapBaseline`) or, when `epicRef` is supplied, from

package/.agents/scripts/lib/baselines/reader.js

@@ -18,7 +18,8 @@
 //      hand-edited while inside a story worktree — so downstream
 //      consumers see canonical repo-relative paths.
 //   5. Returns the envelope's headline fields plus rows/rollup as a
-//      narrow contract: `{ rollup, rows, kernelVersion, generatedAt }`.
+//      narrow contract: `{ rollup, rows, kernelVersion, generatedAt,
+//      scoringSemantics }`.
 //
 // Reader-only: the writer side lives in a sibling module (Story #1891).
 // No I/O happens here beyond reading the JSON file itself.
@@ -215,6 +216,11 @@ function readAndShape(kind, absolutePath) {
     rows,
     kernelVersion: parsed.kernelVersion,
     generatedAt: parsed.generatedAt,
+    // Story #4775 — carry the per-kind scoring-semantics stamp through the
+    // narrowing. The gate's compat check reads it off the LOADED envelope, so
+    // dropping it here would make every baseline look unstamped and fail the
+    // whole repo closed on a stamp that is actually present on disk.
+    scoringSemantics: parsed.scoringSemantics,
   };
 }
 
@@ -303,6 +309,11 @@ export function loadFile(absolutePath, opts = {}) {
     rows,
     kernelVersion: parsed.kernelVersion,
     generatedAt: parsed.generatedAt,
+    // Story #4775 — carry the per-kind scoring-semantics stamp through the
+    // narrowing. The gate's compat check reads it off the LOADED envelope, so
+    // dropping it here would make every baseline look unstamped and fail the
+    // whole repo closed on a stamp that is actually present on disk.
+    scoringSemantics: parsed.scoringSemantics,
   };
 }
 

package/.agents/scripts/lib/baselines/refresh-service.js

@@ -355,11 +355,17 @@ const KIND_SCORER_BUILDERS = Object.freeze({
  * rather than crashing the refresh. The production crap/maintainability paths
  * never rely on this fallback — they inject an explicit, configured scorer.
  *
+ * Exported since Story #4776 so the full-scope drift detector
+ * (`check-baseline-drift.js`) re-scores through the *same* scorer that
+ * writes the baseline. A drift check scoring by a second, parallel
+ * implementation would report the two implementations' disagreement as
+ * drift, which is exactly the false signal it exists to rule out.
+ *
  * @param {string} kind
  * @param {{ cwd: string }} opts
  * @returns {((files: string[], opts: object) => Promise<object[]> | object[]) | undefined}
  */
-function resolveDefaultScorer(kind, { cwd } = {}) {
+export function resolveDefaultScorer(kind, { cwd } = {}) {
   const builder = KIND_SCORER_BUILDERS[kind];
   if (typeof builder !== 'function') return undefined;
   const effectiveCwd = cwd ?? process.cwd();

package/.agents/scripts/lib/baselines/writer.js

@@ -184,6 +184,8 @@ export function write({
     rollup,
     kernelVersion: kernelVersion ?? currentKernelVersion(kind),
     generatedAt,
+    extras:
+      typeof mod.envelopeExtras === 'function' ? mod.envelopeExtras() : null,
   });
   assertEnvelope(envelope);
   return envelope;
@@ -258,10 +260,18 @@ export function writeFile(absPath, envelope, opts = {}) {
   // Canonical key order on the top-level envelope keeps diffs stable
   // across runs and platforms. Per-kind row keys retain their natural
   // declaration order; the row sort is done by `sortRows()`.
+  //
+  // Story #4775: the projection is deliberately explicit, so any per-kind
+  // envelope stamp (`scoringSemantics`) must be carried through by name or it
+  // is silently dropped on the way to disk — the stamp would then be present
+  // in memory, validated, and absent from the file it exists to protect.
   const canonical = {
     $schema: envelope.$schema,
     kernelVersion: envelope.kernelVersion,
     generatedAt: envelope.generatedAt,
+    ...(envelope.scoringSemantics === undefined
+      ? {}
+      : { scoringSemantics: envelope.scoringSemantics }),
     rollup: envelope.rollup,
     rows: envelope.rows,
   };

package/.agents/scripts/lib/checks/story-init-not-backgrounded.js

@@ -26,7 +26,7 @@
  * fan-out target, or `&` shell backgrounding) within a small line window.
  */
 
-import { readdirSync, readFileSync } from 'node:fs';
+import nodeFs from 'node:fs';
 import path from 'node:path';
 
 const SCAN_ROOT_DEFAULT = '.agents';
@@ -54,14 +54,20 @@ const BACKGROUND_TOKENS = [
  * and `.md` sources. Skips `node_modules`, `.worktrees`, and directories
  * starting with `.git`.
  *
+ * The optional final `fsImpl` parameter defaults to the real `node:fs`
+ * (`.agents/rules/test-seams.md` rule 1) and is forwarded to the recursive
+ * call rather than re-acquired there (rule 4), so a test drives the whole walk
+ * through a plain stub object instead of module mocking (rule 5).
+ *
  * @param {string} dir
+ * @param {typeof nodeFs} [fsImpl]
  * @returns {string[]}
  */
-function walkSources(dir) {
+export function walkSources(dir, fsImpl = nodeFs) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync(dir, { withFileTypes: true });
+    entries = fsImpl.readdirSync(dir, { withFileTypes: true });
   } catch {
     return out;
   }
@@ -75,7 +81,7 @@ function walkSources(dir) {
       ) {
         continue;
       }
-      out.push(...walkSources(full));
+      out.push(...walkSources(full, fsImpl));
       continue;
     }
     if (!entry.isFile()) continue;
@@ -94,11 +100,14 @@ function walkSources(dir) {
  * any dedicated check module (this file): the source-of-truth
  * implementation legitimately mentions itself.
  *
+ * Pure: it is handed the already-read source, so it needs no filesystem seam
+ * of its own.
+ *
  * @param {string} file
  * @param {string} src
  * @returns {Array<{ line: number, kind: string }>}
  */
-function scanFile(file, src) {
+export function scanFile(file, src) {
   const offences = [];
   // Don't flag the actual story-init script, self-references, or the
   // parallel-tooling helper — the helper documents both Rule 2
@@ -149,15 +158,21 @@ export default {
   scope: ['story-close', 'retro'],
   autoCorrect: 'refuse-and-print',
 
-  detect(state) {
+  /**
+   * @param {{ cwd?: string, scanRoot?: string, scope?: string }} [state]
+   * @param {typeof nodeFs} [fsImpl] Optional final filesystem seam; defaults
+   *   to the real `node:fs` (`.agents/rules/test-seams.md` rule 1) and is
+   *   forwarded to {@link walkSources} rather than re-acquired (rule 4).
+   */
+  detect(state, fsImpl = nodeFs) {
     const cwd = state?.cwd ?? process.cwd();
     const root = state?.scanRoot ?? path.join(cwd, SCAN_ROOT_DEFAULT);
-    const files = walkSources(root);
+    const files = walkSources(root, fsImpl);
     const offences = [];
     for (const file of files) {
       let src;
       try {
-        src = readFileSync(file, 'utf8');
+        src = fsImpl.readFileSync(file, 'utf8');
       } catch {
         continue;
       }

package/.agents/scripts/lib/cli-utils.js

@@ -18,6 +18,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { respondToHelp } from './cli-usage.js';
 import { formatCliError } from './error-redactor.js';
+import { flushStdio } from './stdio-flush.js';
 
 /**
  * Is the current module being executed directly as a CLI (as opposed to
@@ -32,11 +33,48 @@ export function isDirectInvocation(importMetaUrl) {
   return fileURLToPath(importMetaUrl) === path.resolve(entry);
 }
 
+/**
+ * Settle one CLI run: await `main`, translate its outcome into an exit code,
+ * then flush stdio.
+ *
+ * **The exit is never eager** (Story #4783). This helper assigns
+ * `process.exitCode` and returns, letting Node terminate once the event loop
+ * is empty — which is *after* the pending stdout writes drain. The previous
+ * `process.exit()` call terminated first, discarding anything still queued
+ * behind a full pipe buffer, so any CLI emitting more than 64 KiB into a pipe
+ * truncated silently while still reporting success. The resulting exit code is
+ * identical for every caller: `code ?? 0` on the `propagateExitCode` path,
+ * `options.exitCode` (default 1) on the fatal-error path, and an untouched 0
+ * everywhere else.
+ *
+ * @param {() => Promise<unknown>} main
+ * @param {{ source: string, exitCode: number, onError?: (err: Error) => void,
+ *   propagateExitCode: boolean, errorPrefix?: string }} settings
+ * @returns {Promise<void>}
+ */
+async function settleCli(main, settings) {
+  const { source, exitCode, onError, propagateExitCode, errorPrefix } =
+    settings;
+  try {
+    const code = await main();
+    if (propagateExitCode) process.exitCode = code ?? 0;
+  } catch (err) {
+    if (typeof onError === 'function') {
+      onError(err);
+    } else {
+      const prefix = errorPrefix ?? `[${source}] Fatal error`;
+      console.error(`${prefix}: ${formatCliError(err)}`);
+      process.exitCode = exitCode;
+    }
+  }
+  await flushStdio();
+}
+
 /**
  * Run `main` as the CLI entry point for the caller's module. No-op when the
  * module is imported rather than invoked directly. Promise rejection from
  * `main` is funnelled through either the caller-supplied `onError` callback
- * or the default handler (prefixed stderr line + `process.exit(exitCode)`).
+ * or the default handler (prefixed stderr line + `process.exitCode`).
  *
  * A `usage` option makes the script self-describing: when the argv carries
  * `--help` / `-h`, the rendered usage block goes to stdout and `main` is
@@ -51,6 +89,9 @@ export function isDirectInvocation(importMetaUrl) {
  * @param {string} [options.source='CLI']           Prefix used in the default error message.
  * @param {number} [options.exitCode=1]             Exit code used by the default error handler.
  * @param {(err: Error) => void} [options.onError]  Full override of the error handler.
+ * @param {boolean} [options.propagateExitCode=false] Adopt `main`'s resolved
+ *   value as the process exit code.
+ * @param {string} [options.errorPrefix]            Overrides the `[source] Fatal error` prefix.
  * @param {object|string} [options.usage]           Usage spec (or pre-rendered
  *   text) printed for `--help`; see `lib/cli-usage.js`.
  */
@@ -65,17 +106,11 @@ export function runAsCli(importMetaUrl, main, options = {}) {
     usage,
   } = options;
   if (usage && respondToHelp(process.argv.slice(2), usage)) return;
-  const promise = main();
-  if (propagateExitCode) {
-    promise.then((code) => process.exit(code ?? 0));
-  }
-  promise.catch((err) => {
-    if (typeof onError === 'function') {
-      onError(err);
-      return;
-    }
-    const prefix = errorPrefix ?? `[${source}] Fatal error`;
-    console.error(`${prefix}: ${formatCliError(err)}`);
-    process.exit(exitCode);
+  void settleCli(main, {
+    source,
+    exitCode,
+    onError,
+    propagateExitCode,
+    errorPrefix,
   });
 }

package/.agents/scripts/lib/close-validation/process.js

@@ -11,22 +11,48 @@ import { spawn } from 'node:child_process';
  * Pipe a child stream's output line-by-line through `emit`, prepending
  * `prefix` to each line. Tail bytes without a trailing newline flush on
  * `end` so the operator never loses the last line of a gate's output.
+ *
+ * ## The drain must stay cheap (Story #4766)
+ *
+ * This handler runs on the reader side of the child's stdout/stderr pipe.
+ * Every microsecond spent here is a microsecond the pipe is not being read,
+ * and once the OS pipe buffer fills, the child's own write blocks — or, on a
+ * non-blocking pipe, fails outright with `EAGAIN`. A gate child is not
+ * obliged to survive that: Biome's `biome_console` `.unwrap()`s the error and
+ * aborts the process with exit 101, so a green lint verdict presents as a
+ * failed close. Two consequences bind everything on this path:
+ *
+ *   1. Splitting is O(chunk), not O(chunk × lines) — the scan advances a
+ *      `start` index instead of re-slicing the buffer once per line, so a
+ *      64KB chunk carrying 500 lines does not copy 16MB.
+ *   2. **`emit` MUST NOT block.** A synchronous per-line file write is
+ *      exactly the stall this path cannot afford; the close path's capture
+ *      sink (`single-story-close/gate-log.js`) buffers to an async stream for
+ *      that reason.
  */
 function pipePrefixed(stream, prefix, emit) {
   let buf = '';
   stream.setEncoding('utf8');
   stream.on('data', (chunk) => {
     buf += chunk;
-    while (true) {
-      const nl = buf.indexOf('\n');
-      if (nl === -1) break;
-      emit(prefix + buf.slice(0, nl));
-      buf = buf.slice(nl + 1);
+    let start = 0;
+    let nl = buf.indexOf('\n', start);
+    while (nl !== -1) {
+      emit(prefix + buf.slice(start, nl));
+      start = nl + 1;
+      nl = buf.indexOf('\n', start);
     }
+    if (start > 0) buf = buf.slice(start);
   });
   stream.on('end', () => {
-    if (buf.length > 0) emit(prefix + buf);
+    if (buf.length > 0) {
+      emit(prefix + buf);
+      buf = '';
+    }
   });
+  // A pipe-level error (EIO on a vanished child) must not become an
+  // unhandled 'error' event that takes the whole close down.
+  stream.on('error', () => {});
 }
 
 /** Wire the AbortSignal so an abort kills the child. Returns the cleanup fn. */
@@ -68,6 +94,18 @@ export function gateExitCode(code, sig) {
 const BIOME_NO_FILES_PROCESSED =
   'No files were processed in the specified paths';
 
+/**
+ * How many trailing gate lines the "No files were processed" probe retains.
+ *
+ * The marker only ever appears when biome processed nothing, and in that case
+ * its whole output is a handful of lines — so a bounded tail always contains
+ * it when it is there at all. Retaining a tail rather than the full transcript
+ * keeps the drain path's per-line work O(1) in the volume of gate output
+ * (Story #4766): the previous `captured += line` grew a string without limit,
+ * on the one gate (biome/format) whose output is the loudest.
+ */
+const MARKER_PROBE_TAIL_LINES = 32;
+
 /**
  * Whether biome's combined gate output carries the "No files were processed"
  * marker. Pure function — no I/O. Exported for unit coverage (Story #4292).
@@ -85,8 +123,11 @@ export function isBiomeNoFilesProcessed(output) {
  * Default async gate runner — used by `runCloseValidation` when no `runner`
  * is injected. Spawns the gate via `child_process.spawn`, prefixes every
  * stdout/stderr line with `[gate-name] ` (so concurrent gates don't bleed
- * into each other in the operator's terminal), and resolves only when the
- * child exits.
+ * into each other in the operator's terminal), and resolves only once the
+ * child has exited and both stdio pipes are drained.
+ *
+ * `opts.log` is the drain sink and **must not block** — see `pipePrefixed`
+ * above for what a synchronous per-line write costs the child (Story #4766).
  *
  * Honours `opts.signal`: a TERM is delivered to the child the moment the
  * signal fires, so a sibling gate's failure aborts the rest of the wave
@@ -119,13 +160,14 @@ export function defaultGateRunner(cmd, args, opts = {}) {
   const prefix = gateName ? `[${gateName}] ` : '';
   const emit =
     typeof log === 'function' ? log : (m) => process.stdout.write(`${m}\n`);
-  // Capture the combined output only when we may need to inspect it for the
-  // biome "No files were processed" marker — otherwise the stream is purely
-  // piped through to the operator (no retained buffer).
-  let captured = '';
+  // Retain a bounded tail only when we may need to inspect it for the biome
+  // "No files were processed" marker — otherwise the stream is purely piped
+  // through to the operator (no retained buffer).
+  const recent = [];
   const tap = tolerateNoFilesProcessed
     ? (line) => {
-        captured += `${line}\n`;
+        recent.push(line);
+        if (recent.length > MARKER_PROBE_TAIL_LINES) recent.shift();
         emit(line);
       }
     : emit;
@@ -133,13 +175,17 @@ export function defaultGateRunner(cmd, args, opts = {}) {
   pipePrefixed(child.stderr, prefix, tap);
   const detach = attachGateAbortHandler(child, signal);
   return new Promise((resolve) => {
-    child.on('exit', (code, sig) => {
+    // 'close', not 'exit' (Story #4766): 'close' fires only once the child has
+    // exited AND both stdio pipes have been fully drained and closed, so no
+    // gate ever reports its status while lines are still in flight. Resolving
+    // on 'exit' raced the tail of a high-volume gate's output.
+    child.on('close', (code, sig) => {
       detach();
       const status = gateExitCode(code, sig);
       if (
         status !== 0 &&
         tolerateNoFilesProcessed &&
-        isBiomeNoFilesProcessed(captured)
+        isBiomeNoFilesProcessed(recent.join('\n'))
       ) {
         emit(
           `${prefix}↳ biome processed zero files (all changed paths are config-ignored); treating as a clean skip`,