mandrel 2.16.0 → 2.17.0

package/.agents/scripts/lib/baselines/envelope.js

@@ -133,6 +133,7 @@ function resolveGeneratedAt(explicit) {
  *   rows: Array<object>,
  *   kernelVersion: string,
  *   generatedAt?: string,
+ *   extras?: Record<string, unknown>,
  * }} params
  * @returns {{
  *   $schema: string,
@@ -148,6 +149,7 @@ export function buildEnvelope({
   rows,
   kernelVersion,
   generatedAt,
+  extras,
 } = {}) {
   if (typeof kind !== 'string' || !KNOWN_KINDS.includes(kind)) {
     throw new TypeError(
@@ -176,10 +178,15 @@ export function buildEnvelope({
     throw new TypeError('envelope.buildEnvelope: rows must be an array');
   }
 
+  // Per-kind envelope-level stamps (Story #4775). A kind whose SCORING
+  // SEMANTICS can change independently of its kernel version contributes them
+  // here; `assertEnvelope` still validates the result against the kind's
+  // schema, so an unrecognised extra fails closed rather than being persisted.
   return {
     $schema: schemaRefFor(kind),
     kernelVersion,
     generatedAt: resolveGeneratedAt(generatedAt),
+    ...(extras && typeof extras === 'object' ? extras : {}),
     rollup,
     rows,
   };

package/.agents/scripts/lib/baselines/kernel.js

@@ -50,7 +50,9 @@ import {
 } from './kinds/coverage.js';
 import {
   applyEpsilon as crapApplyEpsilon,
+  assertBaselineCompatible as crapAssertBaselineCompatible,
   compare as crapCompare,
+  envelopeExtras as crapEnvelopeExtras,
   kernelVersion as crapKernelVersion,
   keyField as crapKeyField,
   mergeRows as crapMergeRows,
@@ -139,6 +141,12 @@ function bindKindModule(members) {
     compare: members.compare,
     applyEpsilon: members.applyEpsilon,
     mergeRows: members.mergeRows,
+    // Optional per-kind hooks (Story #4775). `envelopeExtras` contributes
+    // envelope-level stamps the shared writer would not otherwise know about;
+    // `assertBaselineCompatible` lets a kind refuse a loaded baseline whose
+    // scoring semantics predate the running scorer.
+    envelopeExtras: members.envelopeExtras,
+    assertBaselineCompatible: members.assertBaselineCompatible,
   });
 }
 
@@ -179,6 +187,8 @@ const KIND_MODULES = Object.freeze({
     compare: crapCompare,
     applyEpsilon: crapApplyEpsilon,
     mergeRows: crapMergeRows,
+    envelopeExtras: crapEnvelopeExtras,
+    assertBaselineCompatible: crapAssertBaselineCompatible,
   }),
   maintainability: bindKindModule({
     name: maintainabilityName,
@@ -270,6 +280,27 @@ export function currentKernelVersion(kind) {
   return getKindModule(kind).kernelVersion();
 }
 
+/**
+ * Ask a kind whether a loaded baseline is compatible with the running
+ * scorer's SEMANTICS — a dimension `kernelVersion` cannot express, because a
+ * kind's scoring can change while the upstream package it stamps does not
+ * (Story #4775). Kinds without the hook always answer "compatible".
+ *
+ * @param {string} kind
+ * @param {object|null} baseline
+ * @returns {string|null} Operator-facing message, or null when compatible.
+ */
+export function checkBaselineSemantics(kind, baseline) {
+  let mod;
+  try {
+    mod = getKindModule(kind);
+  } catch {
+    return null;
+  }
+  if (typeof mod.assertBaselineCompatible !== 'function') return null;
+  return mod.assertBaselineCompatible(baseline);
+}
+
 /**
  * Compare a baseline's stamped version against the currently running
  * kernel for the same kind. Returns `{ match, current }` so callers can

package/.agents/scripts/lib/baselines/kinds/crap.js

@@ -75,6 +75,41 @@ export function kernelVersion() {
   return '0.0.0';
 }
 
+/**
+ * Scoring-semantics stamp (Story #4775, fix part 5).
+ *
+ * `kernelVersion()` above tracks the `typhonjs-escomplex` package and
+ * `escomplexVersion` tracks the same dependency — so a change in how THIS
+ * repo joins escomplex methods to istanbul coverage moves neither. Rows
+ * scored by the pre-#4775 join (exact transpiled-line equality, methods
+ * dropped when unresolved) are not comparable to rows scored by the join
+ * that replaced it (original-source coordinates, containment matching,
+ * honest `requireCoverage: false`): the same method can carry a different
+ * `crap`, a different `startLine`, or exist in one baseline and not the
+ * other. Comparing across that boundary produces phantom regressions and,
+ * worse, phantom passes.
+ *
+ * The stamp makes the boundary explicit and fails closed. Bump it whenever
+ * the coverage join, the line coordinate system, or the unresolved-method
+ * policy changes.
+ *
+ * Deliberately module-local: `envelopeExtras()` is the single production door
+ * to this value, so exporting the bare constant would add a second entry
+ * point that nothing in production reaches. Callers and tests that need the
+ * string read it off `envelopeExtras().scoringSemantics`.
+ */
+const SCORING_SEMANTICS = 'coverage-join-v2';
+
+/**
+ * Envelope-level stamps this kind contributes beyond the shared envelope
+ * keys. Consumed by `writer.write` via the kind-module protocol.
+ *
+ * @returns {{scoringSemantics: string}}
+ */
+export function envelopeExtras() {
+  return { scoringSemantics: SCORING_SEMANTICS };
+}
+
 export function projectRow(row) {
   return {
     path: canonicalise(row.path ?? row.file),
@@ -372,6 +407,23 @@ export const CRAP_COMPAT_AXES = [
         : null,
   },
   kernelDriftAxis('CRAP'),
+  {
+    name: 'scoring-semantics-drift',
+    severity: 'fatal',
+    check: ({ baseline }) => {
+      if (!baseline) return null;
+      const stamped = baseline.scoringSemantics ?? null;
+      if (stamped === SCORING_SEMANTICS) return null;
+      return (
+        `[CRAP] scoring semantics changed: baseline=${stamped ?? '<unstamped>'} ` +
+        `running=${SCORING_SEMANTICS}. Rows scored by the previous per-method ` +
+        'coverage join are not comparable to rows scored by the current one, ' +
+        'so this baseline cannot be compared — it must be re-derived. Run ' +
+        "'npm run test:coverage' then 'npm run crap:update -- --full-scope' " +
+        "and commit the result with a 'baseline-refresh:' subject."
+      );
+    },
+  },
   {
     name: 'ts-transpiler-drift',
     severity: 'warn',
@@ -401,6 +453,30 @@ export function evaluateBaselineCompatibility(ctx) {
   return reduceCompatAxes(CRAP_COMPAT_AXES, ctx);
 }
 
+/**
+ * Kind-module hook (Story #4775): the subset of the compat table that a
+ * *loaded* v2 envelope can be judged against on its own, with no running
+ * dependency versions to compare. The unified `check-baselines` gate calls it
+ * straight after `reader.load` and turns a message into a fail-closed
+ * schema-class error, so a baseline written by the previous scoring semantics
+ * can never be silently compared against new-semantics scores.
+ *
+ * The version-drift axes stay out: the v2 envelope does not carry
+ * `escomplexVersion` / `tsTranspilerVersion`, and running those checks against
+ * an absent field would compare `undefined` to `undefined` and pass
+ * vacuously — worse than not running them.
+ *
+ * @param {object|null} baseline A loaded v2 baseline envelope.
+ * @returns {string|null} Operator-facing message, or null when compatible.
+ */
+export function assertBaselineCompatible(baseline) {
+  if (!baseline) return null;
+  const axis = CRAP_COMPAT_AXES.find(
+    (a) => a.name === 'scoring-semantics-drift',
+  );
+  return axis ? axis.check({ baseline }) : null;
+}
+
 /**
  * Pure helper: resolve the CRAP baseline either from the working tree
  * (via `getCrapBaseline`) or, when `epicRef` is supplied, from

package/.agents/scripts/lib/baselines/reader.js

@@ -18,7 +18,8 @@
 //      hand-edited while inside a story worktree — so downstream
 //      consumers see canonical repo-relative paths.
 //   5. Returns the envelope's headline fields plus rows/rollup as a
-//      narrow contract: `{ rollup, rows, kernelVersion, generatedAt }`.
+//      narrow contract: `{ rollup, rows, kernelVersion, generatedAt,
+//      scoringSemantics }`.
 //
 // Reader-only: the writer side lives in a sibling module (Story #1891).
 // No I/O happens here beyond reading the JSON file itself.
@@ -215,6 +216,11 @@ function readAndShape(kind, absolutePath) {
     rows,
     kernelVersion: parsed.kernelVersion,
     generatedAt: parsed.generatedAt,
+    // Story #4775 — carry the per-kind scoring-semantics stamp through the
+    // narrowing. The gate's compat check reads it off the LOADED envelope, so
+    // dropping it here would make every baseline look unstamped and fail the
+    // whole repo closed on a stamp that is actually present on disk.
+    scoringSemantics: parsed.scoringSemantics,
   };
 }
 
@@ -303,6 +309,11 @@ export function loadFile(absolutePath, opts = {}) {
     rows,
     kernelVersion: parsed.kernelVersion,
     generatedAt: parsed.generatedAt,
+    // Story #4775 — carry the per-kind scoring-semantics stamp through the
+    // narrowing. The gate's compat check reads it off the LOADED envelope, so
+    // dropping it here would make every baseline look unstamped and fail the
+    // whole repo closed on a stamp that is actually present on disk.
+    scoringSemantics: parsed.scoringSemantics,
   };
 }
 

package/.agents/scripts/lib/baselines/refresh-service.js

@@ -355,11 +355,17 @@ const KIND_SCORER_BUILDERS = Object.freeze({
  * rather than crashing the refresh. The production crap/maintainability paths
  * never rely on this fallback — they inject an explicit, configured scorer.
  *
+ * Exported since Story #4776 so the full-scope drift detector
+ * (`check-baseline-drift.js`) re-scores through the *same* scorer that
+ * writes the baseline. A drift check scoring by a second, parallel
+ * implementation would report the two implementations' disagreement as
+ * drift, which is exactly the false signal it exists to rule out.
+ *
  * @param {string} kind
  * @param {{ cwd: string }} opts
  * @returns {((files: string[], opts: object) => Promise<object[]> | object[]) | undefined}
  */
-function resolveDefaultScorer(kind, { cwd } = {}) {
+export function resolveDefaultScorer(kind, { cwd } = {}) {
   const builder = KIND_SCORER_BUILDERS[kind];
   if (typeof builder !== 'function') return undefined;
   const effectiveCwd = cwd ?? process.cwd();

package/.agents/scripts/lib/baselines/writer.js

@@ -184,6 +184,8 @@ export function write({
     rollup,
     kernelVersion: kernelVersion ?? currentKernelVersion(kind),
     generatedAt,
+    extras:
+      typeof mod.envelopeExtras === 'function' ? mod.envelopeExtras() : null,
   });
   assertEnvelope(envelope);
   return envelope;
@@ -258,10 +260,18 @@ export function writeFile(absPath, envelope, opts = {}) {
   // Canonical key order on the top-level envelope keeps diffs stable
   // across runs and platforms. Per-kind row keys retain their natural
   // declaration order; the row sort is done by `sortRows()`.
+  //
+  // Story #4775: the projection is deliberately explicit, so any per-kind
+  // envelope stamp (`scoringSemantics`) must be carried through by name or it
+  // is silently dropped on the way to disk — the stamp would then be present
+  // in memory, validated, and absent from the file it exists to protect.
   const canonical = {
     $schema: envelope.$schema,
     kernelVersion: envelope.kernelVersion,
     generatedAt: envelope.generatedAt,
+    ...(envelope.scoringSemantics === undefined
+      ? {}
+      : { scoringSemantics: envelope.scoringSemantics }),
     rollup: envelope.rollup,
     rows: envelope.rows,
   };

package/.agents/scripts/lib/checks/story-init-not-backgrounded.js

@@ -26,7 +26,7 @@
  * fan-out target, or `&` shell backgrounding) within a small line window.
  */
 
-import { readdirSync, readFileSync } from 'node:fs';
+import nodeFs from 'node:fs';
 import path from 'node:path';
 
 const SCAN_ROOT_DEFAULT = '.agents';
@@ -54,14 +54,20 @@ const BACKGROUND_TOKENS = [
  * and `.md` sources. Skips `node_modules`, `.worktrees`, and directories
  * starting with `.git`.
  *
+ * The optional final `fsImpl` parameter defaults to the real `node:fs`
+ * (`.agents/rules/test-seams.md` rule 1) and is forwarded to the recursive
+ * call rather than re-acquired there (rule 4), so a test drives the whole walk
+ * through a plain stub object instead of module mocking (rule 5).
+ *
  * @param {string} dir
+ * @param {typeof nodeFs} [fsImpl]
  * @returns {string[]}
  */
-function walkSources(dir) {
+export function walkSources(dir, fsImpl = nodeFs) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync(dir, { withFileTypes: true });
+    entries = fsImpl.readdirSync(dir, { withFileTypes: true });
   } catch {
     return out;
   }
@@ -75,7 +81,7 @@ function walkSources(dir) {
       ) {
         continue;
       }
-      out.push(...walkSources(full));
+      out.push(...walkSources(full, fsImpl));
       continue;
     }
     if (!entry.isFile()) continue;
@@ -94,11 +100,14 @@ function walkSources(dir) {
  * any dedicated check module (this file): the source-of-truth
  * implementation legitimately mentions itself.
  *
+ * Pure: it is handed the already-read source, so it needs no filesystem seam
+ * of its own.
+ *
  * @param {string} file
  * @param {string} src
  * @returns {Array<{ line: number, kind: string }>}
  */
-function scanFile(file, src) {
+export function scanFile(file, src) {
   const offences = [];
   // Don't flag the actual story-init script, self-references, or the
   // parallel-tooling helper — the helper documents both Rule 2
@@ -149,15 +158,21 @@ export default {
   scope: ['story-close', 'retro'],
   autoCorrect: 'refuse-and-print',
 
-  detect(state) {
+  /**
+   * @param {{ cwd?: string, scanRoot?: string, scope?: string }} [state]
+   * @param {typeof nodeFs} [fsImpl] Optional final filesystem seam; defaults
+   *   to the real `node:fs` (`.agents/rules/test-seams.md` rule 1) and is
+   *   forwarded to {@link walkSources} rather than re-acquired (rule 4).
+   */
+  detect(state, fsImpl = nodeFs) {
     const cwd = state?.cwd ?? process.cwd();
     const root = state?.scanRoot ?? path.join(cwd, SCAN_ROOT_DEFAULT);
-    const files = walkSources(root);
+    const files = walkSources(root, fsImpl);
     const offences = [];
     for (const file of files) {
       let src;
       try {
-        src = readFileSync(file, 'utf8');
+        src = fsImpl.readFileSync(file, 'utf8');
       } catch {
         continue;
       }

package/.agents/scripts/lib/cli-utils.js

@@ -18,6 +18,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { respondToHelp } from './cli-usage.js';
 import { formatCliError } from './error-redactor.js';
+import { flushStdio } from './stdio-flush.js';
 
 /**
  * Is the current module being executed directly as a CLI (as opposed to
@@ -32,11 +33,48 @@ export function isDirectInvocation(importMetaUrl) {
   return fileURLToPath(importMetaUrl) === path.resolve(entry);
 }
 
+/**
+ * Settle one CLI run: await `main`, translate its outcome into an exit code,
+ * then flush stdio.
+ *
+ * **The exit is never eager** (Story #4783). This helper assigns
+ * `process.exitCode` and returns, letting Node terminate once the event loop
+ * is empty — which is *after* the pending stdout writes drain. The previous
+ * `process.exit()` call terminated first, discarding anything still queued
+ * behind a full pipe buffer, so any CLI emitting more than 64 KiB into a pipe
+ * truncated silently while still reporting success. The resulting exit code is
+ * identical for every caller: `code ?? 0` on the `propagateExitCode` path,
+ * `options.exitCode` (default 1) on the fatal-error path, and an untouched 0
+ * everywhere else.
+ *
+ * @param {() => Promise<unknown>} main
+ * @param {{ source: string, exitCode: number, onError?: (err: Error) => void,
+ *   propagateExitCode: boolean, errorPrefix?: string }} settings
+ * @returns {Promise<void>}
+ */
+async function settleCli(main, settings) {
+  const { source, exitCode, onError, propagateExitCode, errorPrefix } =
+    settings;
+  try {
+    const code = await main();
+    if (propagateExitCode) process.exitCode = code ?? 0;
+  } catch (err) {
+    if (typeof onError === 'function') {
+      onError(err);
+    } else {
+      const prefix = errorPrefix ?? `[${source}] Fatal error`;
+      console.error(`${prefix}: ${formatCliError(err)}`);
+      process.exitCode = exitCode;
+    }
+  }
+  await flushStdio();
+}
+
 /**
  * Run `main` as the CLI entry point for the caller's module. No-op when the
  * module is imported rather than invoked directly. Promise rejection from
  * `main` is funnelled through either the caller-supplied `onError` callback
- * or the default handler (prefixed stderr line + `process.exit(exitCode)`).
+ * or the default handler (prefixed stderr line + `process.exitCode`).
  *
  * A `usage` option makes the script self-describing: when the argv carries
  * `--help` / `-h`, the rendered usage block goes to stdout and `main` is
@@ -51,6 +89,9 @@ export function isDirectInvocation(importMetaUrl) {
  * @param {string} [options.source='CLI']           Prefix used in the default error message.
  * @param {number} [options.exitCode=1]             Exit code used by the default error handler.
  * @param {(err: Error) => void} [options.onError]  Full override of the error handler.
+ * @param {boolean} [options.propagateExitCode=false] Adopt `main`'s resolved
+ *   value as the process exit code.
+ * @param {string} [options.errorPrefix]            Overrides the `[source] Fatal error` prefix.
  * @param {object|string} [options.usage]           Usage spec (or pre-rendered
  *   text) printed for `--help`; see `lib/cli-usage.js`.
  */
@@ -65,17 +106,11 @@ export function runAsCli(importMetaUrl, main, options = {}) {
     usage,
   } = options;
   if (usage && respondToHelp(process.argv.slice(2), usage)) return;
-  const promise = main();
-  if (propagateExitCode) {
-    promise.then((code) => process.exit(code ?? 0));
-  }
-  promise.catch((err) => {
-    if (typeof onError === 'function') {
-      onError(err);
-      return;
-    }
-    const prefix = errorPrefix ?? `[${source}] Fatal error`;
-    console.error(`${prefix}: ${formatCliError(err)}`);
-    process.exit(exitCode);
+  void settleCli(main, {
+    source,
+    exitCode,
+    onError,
+    propagateExitCode,
+    errorPrefix,
   });
 }

package/.agents/scripts/lib/close-validation/projections/advisories.js

@@ -0,0 +1,184 @@
+// .agents/scripts/lib/close-validation/projections/advisories.js
+/**
+ * advisories.js — the projection layer's single call site (Story #4776).
+ *
+ * `projections/maintainability.js` shipped fully written, fully unit-tested
+ * and imported by nothing: the v2 Epic-tier collapse removed its caller and
+ * left the module behind. The practical consequence was that the advisory
+ * telling an operator to run `npm run maintainability:update` and commit a
+ * `baseline-refresh:` subject had never fired in v2 — consumers refreshed
+ * their baselines by hand or not at all.
+ *
+ * This module is that caller, for both projections. It is deliberately the
+ * only door: `close-validation/runner.js` invokes `runProjectionAdvisories`
+ * once, after the gate chain has passed, and every per-kind concern (gate
+ * enablement, baseline path resolution, scorer construction, formatting)
+ * lives here rather than being re-derived at the runner boundary.
+ *
+ * **Advisory, always.** Nothing in here can fail a close. `check-baselines`
+ * already fails closed on a real regression; the projections add the refresh
+ * half of the loop, not a second gate. Every projection is wrapped so a
+ * throw becomes a logged skip.
+ */
+
+import path from 'node:path';
+import { getQuality } from '../../config/quality.js';
+import {
+  createCrapScorer,
+  formatCrapProjection,
+  projectCrapBreaches,
+} from './crap.js';
+import {
+  formatMaintainabilityProjection,
+  projectMaintainabilityRegressions,
+} from './maintainability.js';
+
+/** Default on-disk baseline locations, mirroring the per-gate defaults. */
+const DEFAULT_BASELINE_PATHS = Object.freeze({
+  maintainability: 'baselines/maintainability.json',
+  crap: 'baselines/crap.json',
+});
+
+/**
+ * Resolve a gate's baseline file to an absolute path.
+ *
+ * @param {string} kind
+ * @param {object} gate resolved `delivery.quality.gates.<kind>` block
+ * @param {string} cwd
+ * @returns {string}
+ */
+function resolveBaselinePath(kind, gate, cwd) {
+  const rel =
+    typeof gate?.baselinePath === 'string' && gate.baselinePath.length > 0
+      ? gate.baselinePath
+      : DEFAULT_BASELINE_PATHS[kind];
+  return path.isAbsolute(rel) ? rel : path.resolve(cwd, rel);
+}
+
+/**
+ * A gate is projected unless it is explicitly disabled. An absent gate
+ * block means "framework defaults", which enable it — the same reading
+ * `buildDefaultGates` applies.
+ *
+ * @param {object|undefined} gate
+ * @returns {boolean}
+ */
+function isEnabled(gate) {
+  return gate?.enabled !== false;
+}
+
+/**
+ * Run one projection with its formatter, swallowing every failure into a
+ * logged skip. Returns the projection result (or `null` when it threw) so
+ * callers and tests can inspect what happened without parsing log lines.
+ *
+ * @param {{ kind: string, log: (m: string) => void, run: () => Promise<object>|object, format: (r: object) => string|null }} opts
+ * @returns {Promise<object|null>}
+ */
+async function runOne({ kind, log, run, format }) {
+  let result;
+  try {
+    result = await run();
+  } catch (err) {
+    log(
+      `[close-validation]   ⚠ ${kind} projection skipped (errored): ${err?.message ?? err}`,
+    );
+    return null;
+  }
+  if (result?.skipped) {
+    log(
+      `[close-validation] ⏭ ${kind} projection skipped (${result.skipped}${
+        result.detail ? `: ${result.detail}` : ''
+      })`,
+    );
+    return result;
+  }
+  const advisory = format(result);
+  if (advisory) log(advisory);
+  return result;
+}
+
+/**
+ * Run the maintainability and CRAP pre-merge projections and log their
+ * advisories. Never throws; never affects the close verdict.
+ *
+ * @param {{
+ *   cwd: string,
+ *   baseBranch: string,
+ *   storyBranch: string,
+ *   config?: object,
+ *   quality?: object,
+ *   log?: (m: string) => void,
+ *   projectMaintainability?: typeof projectMaintainabilityRegressions,
+ *   formatMaintainability?: typeof formatMaintainabilityProjection,
+ *   projectCrap?: typeof projectCrapBreaches,
+ *   formatCrap?: typeof formatCrapProjection,
+ * }} opts
+ * @returns {Promise<{ maintainability: object|null, crap: object|null }>}
+ */
+export async function runProjectionAdvisories({
+  cwd,
+  baseBranch,
+  storyBranch,
+  config,
+  quality,
+  log = () => {},
+  projectMaintainability = projectMaintainabilityRegressions,
+  formatMaintainability = formatMaintainabilityProjection,
+  projectCrap = projectCrapBreaches,
+  formatCrap = formatCrapProjection,
+} = {}) {
+  const out = { maintainability: null, crap: null };
+  let gates;
+  try {
+    gates = quality ?? getQuality(config) ?? {};
+  } catch {
+    gates = {};
+  }
+
+  const miGate = gates.maintainability;
+  if (isEnabled(miGate)) {
+    out.maintainability = await runOne({
+      kind: 'maintainability',
+      log,
+      format: formatMaintainability,
+      run: () =>
+        projectMaintainability({
+          cwd,
+          baseBranch,
+          storyBranch,
+          baselinePath: resolveBaselinePath('maintainability', miGate, cwd),
+        }),
+    });
+  } else {
+    log('[close-validation] ⏭ maintainability projection skipped (disabled)');
+  }
+
+  const crapGate = gates.crap;
+  if (isEnabled(crapGate)) {
+    out.crap = await runOne({
+      kind: 'crap',
+      log,
+      format: formatCrap,
+      run: () =>
+        projectCrap({
+          cwd,
+          baseBranch,
+          storyBranch,
+          baselinePath: resolveBaselinePath('crap', crapGate, cwd),
+          newMethodCeiling: crapGate?.newMethodCeiling,
+          scoreFiles: createCrapScorer({
+            cwd,
+            targetDirs: crapGate?.targetDirs,
+            ignoreGlobs: crapGate?.ignoreGlobs,
+            requireCoverage: crapGate?.requireCoverage,
+            coveragePath: crapGate?.coveragePath,
+          }),
+        }),
+    });
+  } else {
+    log('[close-validation] ⏭ crap projection skipped (disabled)');
+  }
+
+  return out;
+}