mandrel 2.25.0 → 2.27.0

package/.agents/scripts/lib/audit-suite/selector.js

@@ -30,42 +30,6 @@ import { readAuditRulesSync } from './audit-rules-reader.js';
 
 const DEFAULT_GIT_TIMEOUT_MS = 30000;
 
-/**
- * The audit-lens identifier for the navigability lens (Epic #4131, F2/F3).
- * Authored as `.agents/workflows/audit-navigability.md`; registered here so the
- * roster, the global-lens allowlist, and the route-added routing seam all
- * reference one symbol rather than a hard-coded string.
- */
-export const NAVIGABILITY_LENS = 'audit-navigability';
-
-/**
- * The **global-lens allowlist** — lenses that evaluate a property of the
- * **whole** product (not just the Epic's change set) and are therefore exempt
- * from the cross-epic-leak guard (`#3362`) that narrows every other lens's
- * evidence to the Epic's `changedFiles`. A lens in this set still runs through
- * the SAME `runAuditSuite` / `selectAuditStrategy` engine; only the
- * change-set narrowing is bypassed, and only for the listed lenses. The guard
- * is **not** weakened for any lens absent from this set.
- *
- * Navigability is the founding member: reachability is a global property — a
- * change can orphan a route it never touched — so the lens must read the whole
- * route tree + nav registry regardless of which file triggered it.
- */
-export const GLOBAL_LENS_ALLOWLIST = Object.freeze([NAVIGABILITY_LENS]);
-
-/**
- * True when `lens` is on the global-lens allowlist and is therefore exempt
- * from the cross-epic-leak guard's change-set narrowing. Pure; the single
- * read-side of {@link GLOBAL_LENS_ALLOWLIST} so callers never hard-code the
- * membership test.
- *
- * @param {string} lens
- * @returns {boolean}
- */
-export function isGlobalLens(lens) {
-  return GLOBAL_LENS_ALLOWLIST.includes(lens);
-}
-
 /**
  * The canonical concern-ownership tiers a lens can declare via its
  * `scope` field in [`audit-rules.json`](../../../schemas/audit-rules.json).
@@ -222,40 +186,23 @@ export function selectSensitivePathClasses({
 /**
  * Resolve the consumer's navigability route globs from the resolved config.
  * Reads `delivery.quality.navigability.routeGlobs` — the route-tree SSOT the
- * navigability lens enumerates and the route-added routing predicate matches
- * against. Returns an empty array when the block (or any ancestor) is absent,
- * so an unconfigured consumer routes nothing and the lens degrades to a silent
- * no-op (Epic #4131 — "no-op when unconfigured").
+ * navigability lens enumerates. Returns an empty array when the block (or any
+ * ancestor) is absent, so an unconfigured consumer contributes no web-surface
+ * evidence (Epic #4131 — "no-op when unconfigured").
+ *
+ * Module-local: the sole reader is {@link hasWebSurface}. It was previously
+ * exported alongside a route-added routing seam that Story #4926 removed —
+ * lens routing is decided by the `scope` field in `audit-rules.json`, never by
+ * a second predicate here.
  *
  * @param {object|null|undefined} config Resolved `.agentrc.json` wrapper.
  * @returns {string[]} Route globs, or `[]` when unconfigured.
  */
-export function resolveNavigabilityRouteGlobs(config) {
+function resolveNavigabilityRouteGlobs(config) {
   const globs = config?.delivery?.quality?.navigability?.routeGlobs;
   return Array.isArray(globs) ? globs.filter((g) => typeof g === 'string') : [];
 }
 
-/**
- * Decide whether a change set routes the navigability lens. The lens is routed
- * when any `changedFiles` entry matches a consumer-configured route glob
- * (`delivery.quality.navigability.routeGlobs`) — i.e. the change set adds or
- * touches a route file. When no route globs are configured, this returns
- * `false` (the unconfigured no-op), so the existing change-set-scoped lens
- * selection is unchanged.
- *
- * A pure predicate over a change set — the same input {@link selectAudits} and
- * {@link selectLocalLenses} already match against. The caller unions its result
- * into the lens roster it is assembling; no new routing machinery is added.
- *
- * @param {{ changedFiles?: string[], config?: object|null }} params
- * @returns {boolean}
- */
-export function routesNavigabilityLens({ changedFiles, config } = {}) {
-  const globs = resolveNavigabilityRouteGlobs(config);
-  if (globs.length === 0) return false;
-  return matchesAnyFilePattern(globs, changedFiles ?? []);
-}
-
 /**
  * Package names (or scope/name segments of them) that declare a **web
  * rendering surface**. Matched against the consumer's root `package.json`

package/.agents/scripts/lib/audit-to-stories/audit-lenses.js

@@ -27,6 +27,7 @@
 export const AUDIT_LENSES = Object.freeze([
   'accessibility',
   'architecture',
+  'baselines',
   'clean-code',
   'data-model',
   'dependencies',

package/.agents/scripts/lib/baseline-schema-registry.js

@@ -45,10 +45,22 @@ export const BASELINE_KIND_SCHEMA_FILES = Object.freeze([
   'duplication.schema.json',
 ]);
 
-/** Every baseline schema filename (envelope + per-kind) in registration order. */
+/**
+ * Report schemas that live under `.agents/schemas/baselines/` but describe
+ * an *engine's output about* the baselines rather than a committed baseline
+ * (Story #4902). They are registered here for two reasons: the AJV instance
+ * below is the one place a caller can compile a baselines-directory schema
+ * without re-registering the envelope, and the mirror-drift test compares
+ * this registry against the on-disk listing — an unregistered file there is
+ * drift regardless of which category it belongs to.
+ */
+const BASELINE_REPORT_SCHEMA_FILES = ['audit-baselines-envelope.schema.json'];
+
+/** Every baseline schema filename (envelope + per-kind + report) in registration order. */
 export const BASELINE_SCHEMA_FILES = Object.freeze([
   BASELINE_ENVELOPE_FILE,
   ...BASELINE_KIND_SCHEMA_FILES,
+  ...BASELINE_REPORT_SCHEMA_FILES,
 ]);
 
 /**

package/.agents/scripts/lib/baselines/diff-scope-cli.js

@@ -3,26 +3,32 @@
  * the manual baseline-update CLIs (Story #1974 / Task #1986, Epic #1943).
  *
  * `update-coverage-baseline.js`, `update-crap-baseline.js`,
- * `update-maintainability-baseline.js`, and `update-mutation-baseline.js`
- * all accept an opt-in `--diff-scope <ref>` flag. When supplied, the
- * baseline write narrows to files changed since `<ref>` (resolved via
- * `git diff --name-only <ref>...HEAD`). Out-of-scope rows are preserved
- * verbatim from the prior on-disk baseline via the per-kind `mergeRows`.
+ * `update-maintainability-baseline.js`, and
+ * `update-duplication-baseline.js` all accept an opt-in `--diff-scope <ref>`
+ * flag. When supplied, the baseline write narrows to files changed since
+ * `<ref>`; out-of-scope rows are preserved verbatim from the prior on-disk
+ * baseline.
  *
- * When the flag is absent, the CLIs behave exactly as they did before
- * #1974 — full regenerate + write — preserving operator workflows that
- * intentionally rewrite the whole baseline.
+ * The helper is shared to keep the flag's contract identical across the four
+ * scripts: one argv parser, one spelling, one error message.
  *
- * The helper is shared to keep the flag's contract identical across the
- * four scripts: same argv parser, same git invocation, same forward-slash
- * path normalisation. The four CLIs differ only in how they pipe the
- * resolved scope through to their writer.
+ * **Scope of this module, post-Story #4944.** It parses the flag and nothing
+ * else. Everything downstream of the parse — resolving the changed-file set,
+ * reading the prior envelope, and assembling the writer call — used to live
+ * here too, in `buildWriterScopeArgs` and its helpers. Those were the
+ * pre-service path; `lib/baselines/refresh-service.js` owns all of it now
+ * (`resolveScope`, `readPriorEnvelope`, and the `writer.write()` handoff),
+ * and `refreshBaseline()` derives its own diff via `execFile` rather than
+ * `spawnSync`. `update-duplication-baseline.js` was the last caller of the
+ * legacy path; when it migrated, the whole write-side half of this module
+ * became unreachable and was removed rather than left shipped-but-uncalled.
+ *
+ * Note for anyone tracing the per-kind prior-row reader that used to live
+ * here: it is gone, not relocated. The service reads the prior envelope
+ * kind-agnostically (any `{ rows: [], rollup: {} }` document), so the
+ * per-kind row-shape filter it needed no longer has a job to do.
  */
 
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import { parseNameOnlyStdout } from '../changed-files.js';
-
 /**
  * Parse `--diff-scope <ref>` (and the legacy `--diff-scope=<ref>` form)
  * from an argv slice. Returns `null` when the flag is absent. Throws a
@@ -57,147 +63,3 @@ export function parseDiffScopeFlag(argv = []) {
   }
   return null;
 }
-
-/**
- * Resolve the file footprint of `git diff --name-only <ref>...HEAD`.
- * Returns a `Set<string>` of repo-relative paths with forward-slash
- * normalisation. Returns an empty Set when the diff is empty or git
- * exits non-zero (best-effort; a missing-ref or corrupt repo is the
- * operator's signal to inspect the working tree).
- *
- * The `spawnImpl` seam exists for unit tests — production callers omit it.
- *
- * @param {{ ref: string, cwd?: string, spawnImpl?: typeof spawnSync }} args
- * @returns {Set<string>}
- */
-export function resolveDiffScopeFiles({
-  ref,
-  cwd = process.cwd(),
-  spawnImpl = spawnSync,
-} = {}) {
-  if (typeof ref !== 'string' || ref.length === 0) return new Set();
-  const res = spawnImpl('git', ['diff', '--name-only', `${ref}...HEAD`], {
-    cwd,
-    encoding: 'utf8',
-  });
-  if (!res || res.status !== 0) return new Set();
-  return new Set(parseNameOnlyStdout(res.stdout));
-}
-
-/**
- * Convenience: parse `--diff-scope` and resolve files in one call.
- * Returns `null` when the flag is absent (so the caller can branch on
- * "scope was opted in?"); otherwise returns
- * `{ ref, files: Set<string>, scope: { mode: 'diff', files } }` ready to
- * pass into `writer.write({ scope })`.
- *
- * @param {{ argv: string[], cwd?: string, spawnImpl?: typeof spawnSync }} args
- * @returns {{ ref: string, files: Set<string>, scope: {mode: 'diff', files: Set<string>} } | null}
- */
-export function resolveDiffScope({ argv, cwd, spawnImpl } = {}) {
-  const ref = parseDiffScopeFlag(argv);
-  if (ref === null) return null;
-  const files = resolveDiffScopeFiles({ ref, cwd, spawnImpl });
-  return { ref, files, scope: { mode: 'diff', files } };
-}
-
-/**
- * Read + parse the prior baseline at `absBaselinePath` and return the
- * canonical `rows[]` array (per-kind row shape with `path:` keys, as
- * expected by the per-kind `mergeRows` / `applyEpsilon` helpers from
- * Story #1974). Returns `null` when the file is absent, malformed, or
- * missing a `rows[]` envelope; the caller treats `null` as "skip the
- * merge" (regression-fail-safe — equivalent to a fresh write).
- *
- * Pure-by-design (file I/O through the injected `fsImpl` seam).
- *
- * @param {{ kind: 'maintainability' | 'crap', absBaselinePath: string, fsImpl?: typeof fs }} args
- * @returns {Array<object> | null}
- */
-// Read + JSON-parse a baseline file. Returns `null` on any I/O or parse
-// failure (the caller treats "no prior" the same as "unreadable prior").
-function readBaselineJson(absBaselinePath, fsImpl) {
-  let raw;
-  try {
-    raw = fsImpl.readFileSync(absBaselinePath, 'utf8');
-  } catch {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === 'object' ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-
-// CRAP path: envelope `rows[]` only; rows already carry canonical `path:`.
-function readCrapPriorRows(parsed) {
-  if (!Array.isArray(parsed.rows)) return null;
-  return parsed.rows;
-}
-
-// Maintainability path: envelope `rows[]` only; rows already carry
-// canonical `path:` + `mi:`.
-function readMaintainabilityPriorRows(parsed) {
-  if (!Array.isArray(parsed.rows)) return null;
-  return parsed.rows.filter(
-    (r) => r && typeof r.path === 'string' && typeof r.mi === 'number',
-  );
-}
-
-export function readPriorBaselineRows({ kind, absBaselinePath, fsImpl = fs }) {
-  const parsed = readBaselineJson(absBaselinePath, fsImpl);
-  if (!parsed) return null;
-  if (kind === 'crap') return readCrapPriorRows(parsed);
-  return readMaintainabilityPriorRows(parsed);
-}
-
-/**
- * Compose the full Story #1974 write-side payload for a manual baseline
- * CLI: read prior rows, resolve `--diff-scope`, log the scope decision,
- * and return the four params (`prior`, `epsilon`, `scope`, plus the
- * resolved `diffScope` for caller-side logging) that the CLI feeds into
- * `writer.write({ ..., prior, epsilon, scope })`.
- *
- * Returns a flat record so each CLI can spread it into the writer call.
- *
- * @param {{
- *   kind: 'maintainability' | 'crap',
- *   absBaselinePath: string,
- *   epsilon: number,
- *   argv?: string[],
- *   cwd?: string,
- *   logger?: { info?: (msg: string) => void },
- *   logTag: string,
- * }} args
- * @returns {{
- *   prior: Array<object> | undefined,
- *   epsilon: number | undefined,
- *   scope: {mode: 'diff', files: Set<string>} | undefined,
- *   diffScope: {ref: string, files: Set<string>, scope: object} | null,
- * }}
- */
-export function buildWriterScopeArgs({
-  kind,
-  absBaselinePath,
-  epsilon,
-  argv = process.argv.slice(2),
-  cwd,
-  logger,
-  logTag,
-}) {
-  const prior = readPriorBaselineRows({ kind, absBaselinePath });
-  const diffScope = resolveDiffScope({ argv, cwd });
-  if (diffScope && logger?.info) {
-    logger.info(
-      `${logTag} --diff-scope ${diffScope.ref}: ${diffScope.files.size} file(s) in scope; out-of-scope rows preserved verbatim.`,
-    );
-  }
-  return {
-    prior: prior ?? undefined,
-    epsilon: prior ? epsilon : undefined,
-    scope: diffScope?.scope,
-    diffScope,
-  };
-}

package/.agents/scripts/lib/baselines/duplication-scanner.js

@@ -26,11 +26,38 @@
  */
 
 import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import path from 'node:path';
 
 const DEFAULT_MIN_TOKENS = 50;
 const DEFAULT_FORMATS = Object.freeze(['javascript']);
 
+const require = createRequire(import.meta.url);
+
+/**
+ * Resolve jscpd's `detectClones` lazily. The jscpd ESM entrypoint has a
+ * broken transitive `colors/safe` specifier under Node's strict ESM
+ * resolver, so we load the CJS build via `createRequire`. Isolated behind a
+ * function so the rest of the module stays import-pure and testable — no
+ * importer of this file pays the jscpd load unless it actually scans.
+ *
+ * Lives here rather than in `update-duplication-baseline.js` since Story
+ * #4944: the refresh service's default duplication scorer needs the same
+ * seam, and a second copy in the CLI would be the classic "two
+ * implementations of one probe" divergence.
+ *
+ * @returns {(opts: object) => Promise<Array<object>>}
+ */
+export function resolveDetectClones() {
+  const jscpd = require('jscpd');
+  if (typeof jscpd.detectClones !== 'function') {
+    throw new Error(
+      "[Duplication] jscpd.detectClones is not available — run 'npm install'",
+    );
+  }
+  return jscpd.detectClones;
+}
+
 /**
  * Normalise a jscpd `sourceId` (or any path) to a canonical POSIX
  * repo-relative path. jscpd already emits cwd-relative paths, but a future

package/.agents/scripts/lib/baselines/git-base.js

@@ -29,10 +29,15 @@
 //     loader treats this as a normal "no baseline at base ref" case
 //     and returns `null`. Callers branch on `result === null` rather
 //     than catching an error.
-//   - Any other non-zero exit (bad ref, corrupted repo, git binary
-//     missing): rethrown so the dispatcher can surface a config-error
-//     exit code rather than silently treating the failure as "no
-//     baseline". A bad ref is a config bug, not a missing file.
+//   - Any other outcome (bad ref, corrupted repo, git binary missing, or
+//     the child killed by signal so `status` is `null`): thrown so the
+//     dispatcher can surface a config-error exit code rather than
+//     silently treating the failure as "no baseline". A bad ref is a
+//     config bug, not a missing file.
+//
+// That two-way split is load-bearing (Story #4914): `null` means and only
+// means "path absent at ref". Callers may therefore treat a throw as a
+// hard failure without having to re-diagnose it.
 
 import { spawnSync } from 'node:child_process';
 
@@ -47,6 +52,21 @@ import { spawnSync } from 'node:child_process';
 
 const DEFAULT_MAX_ENTRIES = 64;
 
+/**
+ * Story #4914 — explicit stdout ceiling for every git read in this module.
+ *
+ * `child_process.spawnSync` defaults `maxBuffer` to 1 MB. A committed
+ * baseline legitimately grows past that (a real consumer's crap baseline
+ * measured 1,178,910 bytes), at which point the child is killed —
+ * `status: null`, `signal: 'SIGTERM'`, `error.code: 'ENOBUFS'` — and the
+ * read fails for a reason that has nothing to do with the repository.
+ *
+ * 64 MB is not a new number: it is the bound already used at
+ * `run-test-profile.js:87`, `audit-baselines/trend.js:61` and
+ * `audit-baselines/weights.js:65`. This module was the outlier.
+ */
+const MAX_BUFFER_BYTES = 64 * 1024 * 1024;
+
 let _spawnSync = spawnSync;
 let _cache = new Map();
 let _maxEntries = DEFAULT_MAX_ENTRIES;
@@ -165,6 +185,7 @@ export function readBaseFromGit(ref, file, opts = {}) {
     encoding: 'utf-8',
     shell: false,
     env: cleanGitEnv(),
+    maxBuffer: MAX_BUFFER_BYTES,
   });
 
   // `child_process.spawnSync` returns `status: null` when the child died
@@ -232,6 +253,7 @@ export function readRangeSubjectsTouchingFile(baseRef, file, opts = {}) {
         encoding: 'utf-8',
         shell: false,
         env: cleanGitEnv(),
+        maxBuffer: MAX_BUFFER_BYTES,
       },
     );
   } catch {

package/.agents/scripts/lib/baselines/kinds/crap.js

@@ -19,6 +19,7 @@ import {
   COORDINATE_TRANSPILED,
   deriveFixGuidance,
 } from '../../crap-engine.js';
+import { isAnonymousMethodLabel } from '../../crap-method-identity.js';
 import { getCrapBaseline } from '../../crap-utils.js';
 import { loadBaseline } from '../../gates/baseline-store.js';
 import { Logger } from '../../Logger.js';
@@ -95,15 +96,23 @@ export function kernelVersion() {
  * worse, phantom passes.
  *
  * The stamp makes the boundary explicit and fails closed. Bump it whenever
- * the coverage join, the line coordinate system, or the unresolved-method
- * policy changes.
+ * the coverage join, the line coordinate system, the unresolved-method policy,
+ * or the **method identity rule** changes.
+ *
+ * Story #4969 bumped it to `method-identity-v3` for the last of those. An
+ * anonymous method used to be keyed by escomplex's `<anon method-N>` ordinal
+ * and is now keyed by its enclosing-scope path; 34.6% of rows changed identity
+ * in one step. Rows keyed the old way and rows keyed the new way describe the
+ * same functions under different names, so pairing them is exactly the
+ * mis-keyed join this stamp exists to refuse — hence the bump, which is what
+ * makes the migration report nothing rather than a wall of phantom verdicts.
  *
  * Deliberately module-local: `envelopeExtras()` is the single production door
  * to this value, so exporting the bare constant would add a second entry
  * point that nothing in production reaches. Callers and tests that need the
  * string read it off `envelopeExtras().scoringSemantics`.
  */
-const SCORING_SEMANTICS = 'coverage-join-v2';
+const SCORING_SEMANTICS = 'method-identity-v3';
 
 /**
  * Envelope-level stamps this kind contributes beyond the shared envelope
@@ -116,12 +125,22 @@ const SCORING_SEMANTICS = 'coverage-join-v2';
  * the stamp on disk the `ts-transpiler-drift` axis had nothing to compare and
  * passed vacuously.
  *
- * @returns {{scoringSemantics: string, tsTranspilerVersion: string}}
+ * `provenanceStamped` joined in Story #4901 as a **positive** marker: the
+ * writer asserting it recorded per-row provenance at all. Absence is the only
+ * evidence a pre-#4866 baseline leaves, and no other stamp detects it —
+ * `kernelVersion` / `escomplexVersion` track the escomplex package (unmoved
+ * by the fix), `scoringSemantics` did not change, and `tsTranspilerVersion`
+ * is unreliable in the negative (the `'0.0.0'` sentinel). See the
+ * `provenance-unstamped` axis.
+ *
+ * @returns {{scoringSemantics: string, tsTranspilerVersion: string,
+ *   provenanceStamped: boolean}}
  */
 export function envelopeExtras() {
   return {
     scoringSemantics: SCORING_SEMANTICS,
     tsTranspilerVersion: resolveTsTranspilerVersion(),
+    provenanceStamped: true,
   };
 }
 
@@ -144,6 +163,12 @@ export function projectRow(row) {
   if (row.coordinateSystem === COORDINATE_TRANSPILED) {
     projected.coordinateSystem = COORDINATE_TRANSPILED;
   }
+  // Story #4969, same write-only-when-non-default idiom: `anonymous` marks a
+  // `method` that is a derived scope-path identity rather than a name the
+  // source carries. A named row stays the exact four-key row it always was.
+  if (row.anonymous === true) {
+    projected.anonymous = true;
+  }
   return projected;
 }
 
@@ -636,6 +661,17 @@ export function assessComparisonBasis(compareResult, opts = {}) {
  * and `tsTranspilerVersion` drift to **warn**, not fail; `escomplexVersion`
  * mismatch continues to fail closed.
  */
+/**
+ * The one re-seed recipe every coordinate-invalidating axis ends on. Three
+ * axes and the unsound-basis diagnostic previously carried their own copy of
+ * this sentence; a single constant keeps them from drifting apart on the
+ * command an operator is told to run.
+ */
+const RESEED_REMEDY =
+  "Re-derive the baseline: run 'npm run test:coverage' then " +
+  "'npm run crap:update -- --full-scope' and commit the result with a " +
+  "'baseline-refresh:' subject.";
+
 export const CRAP_COMPAT_AXES = [
   // Universal axes hoisted into envelope.js (Story #2467, Task #2492). The
   // missing-baseline and kernel-drift checks live in exactly one place;
@@ -661,9 +697,7 @@ export const CRAP_COMPAT_AXES = [
         `[CRAP] scoring semantics changed: baseline=${stamped ?? '<unstamped>'} ` +
         `running=${SCORING_SEMANTICS}. Rows scored by the previous per-method ` +
         'coverage join are not comparable to rows scored by the current one, ' +
-        'so this baseline cannot be compared — it must be re-derived. Run ' +
-        "'npm run test:coverage' then 'npm run crap:update -- --full-scope' " +
-        "and commit the result with a 'baseline-refresh:' subject."
+        `so this baseline cannot be compared. ${RESEED_REMEDY}`
       );
     },
   },
@@ -688,10 +722,65 @@ export const CRAP_COMPAT_AXES = [
         `[CRAP] tsTranspilerVersion changed: baseline=${baselineTs} running=${runningTsTranspilerVersion}. ` +
         "A TS row's startLine is an original-source coordinate only because the transpiler's " +
         'sourcemap said so, and that coordinate is half the row identity key — so rows scored ' +
-        'under the previous transpiler are not comparable to rows scored under this one. ' +
-        "Re-derive the baseline: run 'npm run test:coverage' then " +
-        "'npm run crap:update -- --full-scope' and commit the result with a " +
-        "'baseline-refresh:' subject."
+        `under the previous transpiler are not comparable to rows scored under this one. ${RESEED_REMEDY}`
+      );
+    },
+  },
+  {
+    // Story #4901. Closes the exemption directly above: `ts-transpiler-drift`
+    // returns null for an unstamped baseline rather than fail every
+    // pre-existing one for want of evidence — and a pre-#4866 baseline is
+    // exactly that shape, so the one door that could catch it lets it through
+    // while it asserts by omission that all its rows are original coordinates.
+    // Keyed on a positive marker because absence alone cannot separate
+    // "written before provenance existed" from "typescript was unresolvable".
+    // Scoped like `ts-transpiler-drift`: a pure-JavaScript baseline's two
+    // coordinate systems coincide, so it was never affected and must not fail.
+    name: 'provenance-unstamped',
+    severity: 'fatal',
+    check: ({ baseline }) =>
+      baseline &&
+      baseline.provenanceStamped !== true &&
+      hasTranspiledRows(baseline)
+        ? '[CRAP] baseline predates coordinate-provenance stamping: it carries ' +
+          'transpiled-source rows but no `provenanceStamped` marker, so it ' +
+          'asserts by omission that every row is an original-source coordinate. ' +
+          '`startLine` is half the row identity key, so the comparator would ' +
+          'key those rows against a coordinate space they are not in and ' +
+          `report regressions no edit can satisfy. ${RESEED_REMEDY}`
+        : null,
+  },
+  {
+    // Story #4969. The `scoring-semantics-drift` axis above rejects a baseline
+    // stamped with the OLD semantics wholesale, which covers a clean migration.
+    // It cannot see a HALF-migrated one: a diff-scoped refresh preserves
+    // out-of-scope rows verbatim, so a baseline can carry ordinal-keyed rows
+    // for the files that were never re-scored while the writer stamps the
+    // envelope with the current semantics — the stamp says v3, some rows are
+    // still v2, and the one axis that would catch it has already passed.
+    //
+    // Such a row cannot be paired with anything: its `<anon method-N>` label
+    // matches no scope-path identity, so the comparator files the live method
+    // as NEW (scored against the ceiling, not its own baseline) and the stale
+    // row as removed. Keyed on the positive `anonymous` marker for the same
+    // reason `provenance-unstamped` is: absence is the only trace the old
+    // writer leaves.
+    name: 'anon-identity-unstamped',
+    severity: 'fatal',
+    check: ({ baseline }) => {
+      if (!baseline) return null;
+      const stale = (baseline.rows ?? []).filter(
+        (row) => isAnonymousMethodLabel(row?.method) && row?.anonymous !== true,
+      );
+      if (stale.length === 0) return null;
+      return (
+        `[CRAP] baseline carries ${stale.length} anonymous row(s) keyed by the ` +
+        'superseded `<anon method-N>` ordinal (e.g. ' +
+        `${stale[0].path ?? stale[0].file}::${stale[0].method}) while the ` +
+        'envelope claims the current scoring semantics. Those ordinals ' +
+        'renumber whenever any anonymous function is added or removed, so the ' +
+        'comparator would score the live methods against the new-method ' +
+        `ceiling instead of their own baseline. ${RESEED_REMEDY}`
       );
     },
   },
@@ -742,15 +831,23 @@ export function evaluateBaselineCompatibility(ctx) {
 
 /**
  * The compat axes a *loaded* envelope can be judged against on its own,
- * without a second baseline to diff. Both are coordinate-invalidating: one
- * names the join that produced the rows, the other names the transpiler whose
- * sourcemap decided what a TS row's `startLine` even means.
+ * without a second baseline to diff. Each invalidates one half of the row
+ * identity key. Three are about the `startLine` half: one names the join that
+ * produced the rows, one names the transpiler whose sourcemap decided what a
+ * TS row's `startLine` even means, and one (Story #4901) catches a baseline
+ * predating both questions. The fourth (Story #4969) is about the `method`
+ * half — a baseline still carrying ordinal-keyed anonymous rows.
  *
  * `escomplex-mismatch` and `kernel-drift` stay out — the v2 envelope carries
  * no `escomplexVersion`, so that axis would compare `undefined` to `undefined`
  * and pass vacuously, which is worse than not running it.
  */
-const LOADED_ENVELOPE_AXES = ['scoring-semantics-drift', 'ts-transpiler-drift'];
+const LOADED_ENVELOPE_AXES = [
+  'scoring-semantics-drift',
+  'ts-transpiler-drift',
+  'provenance-unstamped',
+  'anon-identity-unstamped',
+];
 
 /**
  * Kind-module hook (Story #4775, extended by Story #4866): judge a *loaded*