mandrel 2.34.0 → 2.35.0

package/.agents/docs/quality-gates.md

@@ -424,6 +424,36 @@ refresh-guardrail accepts it on the next PR.
 If your test runner doesn't produce per-method coverage, see "Disabling the
 gate" below.
 
+### Coverage freshness — what triggers a capture
+
+The CRAP scorer treats "no coverage" as "skip the method", so a missing or
+stale `coverage/coverage-final.json` silently weakens the gate.
+`coverage-capture.js` closes that hole by capturing coverage in-band, and
+decides whether it needs to by two rules (Story #5076):
+
+- **The source set is derived, not configured.** Freshness is measured over
+  exactly the extensions the CRAP scanner walks — `.js`, `.mjs`, `.cjs`,
+  `.ts`, `.tsx`, `.mts`, `.cts` — defined once in
+  `.agents/scripts/lib/source-extensions.js`. There is deliberately no
+  `.agentrc.json` key for this: a consumer-settable list would be a second
+  way to mis-scope the same gate. Formats the engines cannot parse
+  (`.astro`, `.vue`, `.svelte`) are not part of it — a project written in
+  those still has its `.ts`/`.tsx` measured.
+- **Both freshness paths fail closed on an empty source set.** Finding no
+  scorable source under `crap.targetDirs` means the check learned nothing,
+  so it captures rather than assuming coverage is current, and warns naming
+  the configured dirs. If you see that warning, `targetDirs` almost
+  certainly does not point at your sources — fix it rather than living with
+  a full capture on every run.
+
+**Upgrading from a version before this fix:** a TypeScript project's sources
+matched neither path, so the capture was skipped on every run and
+`crap:check` compared the committed baseline against itself. The first run
+after upgrading captures for real and measures your committed floors for the
+first time, which may surface breaches that were always there. That is a
+one-off re-baseline (`npm run crap:update`, committed with a
+`baseline-refresh:` subject), not a regression.
+
 ### Disabling the gate (single-flag opt-out)
 
 If your repo doesn't run coverage, set `enabled: false` in your

package/.agents/docs/workflows.md

@@ -32,11 +32,12 @@ by `node .agents/scripts/generate-workflows-doc.js`; `npm run docs:check`
 fails when it drifts from the on-disk workflow set. To change a command’s
 description, edit the workflow file’s front-matter and regenerate.
 
-## Commands (27)
+## Commands (28)
 
 | Command | Description |
 | --- | --- |
 | `/audit-accessibility` | Audit WCAG accessibility conformance (static-first) with an optional runtime verification pass, and produce a structured findings report |
+| `/audit-adrs` | Audit the decisions log as a live contract — Accepted ADRs whose claims the tree has outgrown, broken supersede chains, structural gaps, and directional changes that landed with no decision recorded. A deliberately-global lens over whichever decisions-log layout the consumer ships. |
 | `/audit-architecture` | Audit architectural boundaries, module coupling, layering violations, and shipped-but-uncalled seams; emit a structured findings report keyed to the canonical severity scale. |
 | `/audit-baselines` | Audit the committed baseline surface — dead instruments, stale baselines, cross-gate hotspot clusters, trend drift, and floor-tightening headroom — and emit findings whose remediation burns the measured debt down and tightens the ratchet behind it. |
 | `/audit-clean-code` | Audit code smells, dead code, complexity hotspots, and maintainability-index outliers; emit a structured findings report. |

package/.agents/schemas/audit-rules.json

@@ -312,6 +312,23 @@
       "target": "web",
       "scope": "global",
       "substitutionKeys": []
+    },
+    "audit-adrs": {
+      "triggers": {
+        "gates": ["gate1", "gate3"],
+        "keywords": [
+          "adr",
+          "adrs",
+          "decision record",
+          "architecture decision",
+          "decisions log",
+          "supersede",
+          "superseded"
+        ],
+        "filePatterns": ["**/decisions.md", "**/decisions/**"]
+      },
+      "scope": "global",
+      "substitutionKeys": []
     }
   },
   "sensitivePaths": {
@@ -363,6 +380,33 @@
         "**/openapi/**",
         "**/graphql/**"
       ]
+    },
+    "deploy-runtime": {
+      "description": "Deployment and runtime topology: the CI/CD pipeline, infrastructure-as-code, container images, and the server/serverless entrypoint with its platform and build config. A change here alters how the product is built, bound, and run in production without necessarily touching application logic. Build configs are enumerated by name rather than matched with a blanket `**/*.config.*` glob, which would swallow the test and lint configs and flip nearly every change set to high.",
+      "filePatterns": [
+        ".github/workflows/**",
+        ".github/actions/**",
+        "**/Dockerfile",
+        "**/docker-compose*.yml",
+        "**/docker-compose*.yaml",
+        "infra/**",
+        "**/*.tf",
+        "**/*.tfvars",
+        "**/wrangler.json",
+        "**/wrangler.jsonc",
+        "**/wrangler.toml",
+        "**/worker-entry.ts",
+        "**/worker-entry.js",
+        "**/astro.config.*",
+        "**/next.config.*",
+        "**/nuxt.config.*",
+        "**/svelte.config.*",
+        "**/fly.toml",
+        "**/vercel.json",
+        "**/netlify.toml",
+        "**/serverless.yml",
+        "**/serverless.yaml"
+      ]
     }
   }
 }

package/.agents/schemas/audit-rules.schema.json

@@ -22,7 +22,7 @@
     },
     "sensitivePaths": {
       "type": "object",
-      "description": "Map of sensitive-path class name to the globs that identify it. A change set touching any registered pattern derives a `high` change level, which resolves review depth to `deep` and the acceptance critic to `fresh` regardless of how narrow the diff is (deriveChangeLevel in lib/orchestration/review-depth.js). This is configuration, not code: an operator extends the classes or their globs here without editing a module, and the globs run through the same picomatch machinery as the audit-lens `filePatterns` triggers above. An absent or empty block means no path is sensitive and depth falls back to diff width alone.",
+      "description": "Map of sensitive-path class name to the globs that identify it. A change set touching any registered pattern derives a `high` change level, which resolves review depth to `deep` and the acceptance critic to `fresh` regardless of how narrow the diff is (deriveChangeLevel in lib/orchestration/review-depth.js). This is configuration, not code: an operator extends the classes or their globs here without editing a module, and the globs run through the same picomatch machinery as the audit-lens `filePatterns` triggers above. Those lens triggers are a SEPARATE block with a separate job — they select which lens runs, never the change level — so a path registered there is not sensitive here unless it is also registered in this block. An absent or empty block means no path is sensitive and depth falls back to diff width alone.",
       "patternProperties": {
         "^[a-z][a-z0-9-]*$": { "$ref": "#/definitions/sensitivePathClass" }
       },

package/.agents/scripts/lib/baselines/kinds/crap.js

@@ -673,8 +673,13 @@ export function assessComparisonBasis(compareResult, opts = {}) {
  *
  * Story #791 retired the transitional `bootstrap` exit-0 path: a missing
  * baseline still fails closed. Story #829 (5.29.0) softened `kernelVersion`
- * and `tsTranspilerVersion` drift to **warn**, not fail; `escomplexVersion`
- * mismatch continues to fail closed.
+ * drift to **warn**, not fail, and did the same for `tsTranspilerVersion` —
+ * but that second half was re-escalated to **fatal** once Story #4866 made a
+ * TS row's `startLine` an original-source coordinate resolved through the
+ * transpiler's sourcemap. `startLine` is half the row identity key, so a
+ * transpiler change makes the rows incomparable rather than merely stale; see
+ * the `ts-transpiler-drift` axis below for the two exemptions that bound it.
+ * `escomplexVersion` mismatch has always failed closed.
  */
 /**
  * The one re-seed recipe every coordinate-invalidating axis ends on. Three

package/.agents/scripts/lib/close-validation/projections/crap.js

@@ -36,6 +36,7 @@ import { loadCoverage } from '../../coverage-utils.js';
 import { scanAndScore } from '../../crap-utils.js';
 import { cachedGitFetchSync } from '../../git/cached-fetch.js';
 import { gitSpawn as defaultGitSpawn } from '../../git-utils.js';
+import { SCORABLE_SOURCE_EXT_RE } from '../../source-extensions.js';
 import { MISSING_ARG_REASONS, validateProjectionInputs } from './inputs.js';
 
 /**
@@ -48,9 +49,6 @@ export const DEFAULT_CRAP_TOLERANCE = 0.001;
 /** Framework default for the new-method ceiling (`gates.crap.newMethodCeiling`). */
 export const DEFAULT_NEW_METHOD_CEILING = 30;
 
-/** Extensions the CRAP scanner can score. */
-const SCORABLE = /\.(?:js|mjs|cjs|ts|tsx)$/;
-
 /**
  * Map the shared predicate's fine-grained `missing-*` reason onto the
  * `missing-args` skipped-reason the sibling MI projection reports, so both
@@ -155,8 +153,9 @@ function refreshBaseRef(cwd, baseBranch, git) {
 }
 
 /**
- * Enumerate the Story branch's changed files, narrowed to the extensions
- * the CRAP scanner can score.
+ * Enumerate the Story branch's changed files, narrowed by the shared
+ * scorable-source extension set (`source-extensions.js`) so the projection
+ * selects exactly the files the CRAP scanner walks.
  *
  * @param {{ cwd: string, baseBranch: string, storyBranch: string, git: { gitSpawn: typeof defaultGitSpawn } }} opts
  * @returns {{ ok: true, files: string[] } | { ok: false, detail: string }}
@@ -168,7 +167,10 @@ function diffScorableFiles({ cwd, baseBranch, storyBranch, git }) {
       cwd,
       gitSpawn: git.gitSpawn,
     });
-    return { ok: true, files: files.filter((f) => SCORABLE.test(f)) };
+    return {
+      ok: true,
+      files: files.filter((f) => SCORABLE_SOURCE_EXT_RE.test(f)),
+    };
   } catch (err) {
     return { ok: false, detail: err.message };
   }

package/.agents/scripts/lib/coverage-capture-fullscope.js

@@ -8,7 +8,10 @@
  * logic; behaviour is byte-for-byte the pre-#4981 body.
  */
 import path from 'node:path';
-import { anyChangedUnderTargets } from './coverage-capture.js';
+import {
+  anyChangedUnderTargets,
+  describeFreshness,
+} from './coverage-capture.js';
 
 /**
  * Run the `--skip-when-no-crap-files` check (when requested), the
@@ -72,7 +75,7 @@ export function runFullScopeCapture({
   }
 
   logger.info(
-    `[coverage-capture] Coverage at ${crap.coveragePath} is ${freshness.reason}; running npm run test:coverage…`,
+    `[coverage-capture] Coverage at ${crap.coveragePath} is ${describeFreshness(freshness, crap.targetDirs)}; running npm run test:coverage…`,
   );
   const code = runCaptureImpl({
     cwd: args.cwd,

package/.agents/scripts/lib/coverage-capture.js

@@ -14,12 +14,20 @@ import { spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import {
+  isScorableSourceFile,
+  SCORABLE_SOURCE_EXT_RE,
+} from './source-extensions.js';
 
 /**
  * Walk a directory tree and return the newest mtime (ms since epoch) seen
- * across `.js` and `.mjs` files. Symlinks, missing dirs, and unreadable nodes
- * resolve to 0 so the caller treats "no sources" the same as "ancient sources"
- * — both mean "any existing coverage is fresh enough".
+ * across the scorable source files (`source-extensions.js`) — the same set
+ * the CRAP scanner walks, so freshness tracks exactly what the gate scores.
+ * Symlinks, missing dirs, and unreadable nodes resolve to 0.
+ *
+ * A 0 return means "discovery found nothing", which {@link isCoverageFresh}
+ * treats as an absence of evidence rather than as freshness — see its
+ * `no-sources` contract.
  *
  * Exported for unit testing.
  *
@@ -48,7 +56,7 @@ export function newestSourceMtime(cwd, targetDirs, io = {}) {
         continue;
       }
       if (!entry.isFile()) continue;
-      if (!entry.name.endsWith('.js') && !entry.name.endsWith('.mjs')) continue;
+      if (!isScorableSourceFile(entry.name)) continue;
       try {
         const m = statSync(childAbs).mtimeMs;
         if (m > newest) newest = m;
@@ -83,17 +91,55 @@ export function captureStampPath(cwd, coveragePath) {
   );
 }
 
-const SOURCE_EXT_RE = /\.(?:js|mjs)$/;
+/**
+ * Fold every dirty scorable working-tree file under the scanned dirs into
+ * `hash`, and report how many there were.
+ *
+ * Dirty files are not represented by their index blob SHA, so their on-disk
+ * bytes (or absence) go in explicitly. Split out of
+ * {@link computeContentDigest} to keep that function's complexity at its
+ * committed CRAP floor.
+ *
+ * @param {{
+ *   hash: import('node:crypto').Hash,
+ *   cwd: string,
+ *   readFileSync: typeof fs.readFileSync,
+ *   porcelain: string,
+ * }} opts `porcelain` is raw `git status --porcelain` output.
+ * @returns {number} Count of scorable dirty files folded in.
+ */
+function foldDirtySources({ hash, cwd, readFileSync, porcelain }) {
+  let count = 0;
+  for (const line of porcelain.split('\n').filter((l) => l.length > 3)) {
+    let file = line.slice(3).trim();
+    if (file.includes(' -> ')) file = file.split(' -> ').pop();
+    file = file.replace(/^"|"$/g, '');
+    if (!SCORABLE_SOURCE_EXT_RE.test(file)) continue;
+    count += 1;
+    hash.update(`\0${file}\0`);
+    try {
+      hash.update(readFileSync(path.resolve(cwd, file)));
+    } catch {
+      hash.update('<absent>');
+    }
+  }
+  return count;
+}
 
 /**
- * Compute a stable content digest of the `.js`/`.mjs` sources under
- * `targetDirs`: the `git ls-files -s` listing (mode + blob SHA + path) of
+ * Compute a stable content digest of the scorable sources
+ * (`source-extensions.js`) under `targetDirs`: the `git ls-files -s` listing (mode + blob SHA + path) of
  * tracked content, plus the on-disk bytes of any dirty working-tree files.
  * Checkout/branch churn leaves blob SHAs untouched, so the digest only moves
  * when content actually changes.
  *
  * Returns `null` when the digest cannot be computed (git unavailable, not a
  * repo, empty target list) so callers can fall back to the mtime heuristic.
+ * A target list that matches **no** scorable file is the same "unavailable"
+ * case, not a digest over zero files: this path is the primary freshness
+ * test, so returning a real hash of empty input would pin the artifact
+ * permanently fresh and make the mtime path's fail-closed verdict
+ * unreachable (Story #5076).
  *
  * @param {string} cwd Absolute repo root.
  * @param {string[]} targetDirs Repo-relative directories to digest.
@@ -120,26 +166,19 @@ export function computeContentDigest(cwd, targetDirs, io = {}) {
     const hash = crypto.createHash('sha256');
     const tracked = git('ls-files', '-s', '--', ...dirs)
       .split('\n')
-      .filter((line) => SOURCE_EXT_RE.test(line.trimEnd()));
+      .filter((line) => SCORABLE_SOURCE_EXT_RE.test(line.trimEnd()));
     hash.update(tracked.join('\n'));
 
-    // Dirty working-tree files are not represented by their index blob SHA,
-    // so fold in their on-disk bytes (or absence) explicitly.
-    const dirty = git('status', '--porcelain', '--', ...dirs)
-      .split('\n')
-      .filter((line) => line.length > 3);
-    for (const line of dirty) {
-      let file = line.slice(3).trim();
-      if (file.includes(' -> ')) file = file.split(' -> ').pop();
-      file = file.replace(/^"|"$/g, '');
-      if (!SOURCE_EXT_RE.test(file)) continue;
-      hash.update(`\0${file}\0`);
-      try {
-        hash.update(readFileSync(path.resolve(cwd, file)));
-      } catch {
-        hash.update('<absent>');
-      }
-    }
+    const scorableDirty = foldDirtySources({
+      hash,
+      cwd,
+      readFileSync,
+      porcelain: git('status', '--porcelain', '--', ...dirs),
+    });
+    // Discovery found nothing to digest: hashing the empty input would yield
+    // a constant that can never go stale, so report "unavailable" instead and
+    // let the caller's fail-closed mtime path decide.
+    if (tracked.length + scorableDirty === 0) return null;
     return hash.digest('hex');
   } catch {
     return null;
@@ -231,6 +270,13 @@ function readStampForScope(stamp, requireScope) {
  * under `targetDirs`. Missing files, missing target dirs, or any IO error
  * resolve to `false` so the caller captures rather than trusting stale data.
  *
+ * **Both paths fail closed on an empty source set (Story #5076).** Finding no
+ * scorable source under `targetDirs` means the check learned nothing, so it
+ * reports `{ fresh: false, reason: 'no-sources' }` and the caller captures.
+ * The alternative — treating "found nothing" as "nothing changed" — is how a
+ * `js|mjs`-only selector left the CRAP gate green while measuring nothing in
+ * every TypeScript consumer.
+ *
  * **Scope asymmetry (Story #4981, AC-4).** A stamp written by an incremental
  * capture (`scope: 'incremental'`) only covers the files the diff touched —
  * it must never satisfy a caller that requires the full-scope guarantee
@@ -299,12 +345,36 @@ export function isCoverageFresh({
     statSync,
     readdirSync,
   });
-  if (newestSrc === 0) return { fresh: true, reason: 'no-sources' };
+  // Source discovery found nothing. That is an absence of evidence, never a
+  // freshness guarantee — trusting it silently disables the capture (and with
+  // it the CRAP gate) for any tree the walk cannot see (Story #5076).
+  if (newestSrc === 0) return { fresh: false, reason: 'no-sources' };
   return coverageMtime >= newestSrc
     ? { fresh: true, reason: 'fresh' }
     : { fresh: false, reason: 'stale' };
 }
 
+/**
+ * Render a freshness verdict for the operator-facing capture log.
+ *
+ * Every reason but `no-sources` speaks for itself. That one does not: failing
+ * closed on an empty source walk is correct, but bare it reads as an
+ * unexplained full capture on every run, and the cause is far more often a
+ * `targetDirs` that does not name the project's sources than a genuine
+ * recapture — so the walked dirs and the key to fix are named inline
+ * (Story #5076).
+ *
+ * @param {{ reason?: string }} freshness Verdict from {@link isCoverageFresh}.
+ * @param {string[]} targetDirs The CRAP scan scope that was walked.
+ * @returns {string} The reason, annotated when it needs explaining.
+ */
+export function describeFreshness(freshness, targetDirs) {
+  const reason = freshness?.reason;
+  if (reason !== 'no-sources') return String(reason);
+  const dirs = (targetDirs ?? []).join(', ');
+  return `${reason} — no scorable source file found under [${dirs}]; if that does not name this project's sources, fix quality.gates.crap.targetDirs`;
+}
+
 /**
  * Narrow `changedFiles` to the subset that lives under one of `targetDirs`.
  *

package/.agents/scripts/lib/findings/route-finding.js

@@ -13,14 +13,15 @@
  *      stamped into Issue bodies.
  *   3. `routeFinding(finding, { searchIssues, searchCandidates })` — classify a
  *      finding against existing Issues into one of `new | update-existing |
- *      duplicate | regression-of-closed`. Routing is a two-stage pass: a
- *      meaning-first **semantic candidate** pass runs FIRST (when a
- *      `searchCandidates` port is injected, e.g. wired to
- *      `semantic-issue-search.js`), then the exact **fingerprint
- *      confirmation** pass runs SECOND over that candidate pool. When no
- *      semantic port is injected the helper falls back to a fingerprint-only
- *      lookup via the `searchIssues` port. Either way the ports query BOTH
- *      open and closed issues; a closed fingerprint match yields
+ *      duplicate | regression-of-closed`. Routing gathers a candidate pool,
+ *      then confirms identity against it. **Every wired port runs, and their
+ *      results union** (Story #5079): the exact `searchIssues(sha)` lookup is
+ *      what reliably retrieves an Issue by its footer sha, while the
+ *      meaning-first `searchCandidates` pass (wired to
+ *      `semantic-issue-search.js`) widens that pool to catch a reworded
+ *      finding whose sha has drifted. The semantic pass **adds** to the
+ *      fingerprint lookup; it never replaces it. Whichever ports are wired
+ *      query BOTH open and closed issues; a closed fingerprint match yields
  *      `regression-of-closed`.
  *
  * Pure orchestration: no network I/O lives here. The `searchIssues` /
@@ -455,36 +456,97 @@ function confirmCandidates(hits, { sha, semanticKey = '' }) {
 }
 
 /**
- * Route a finding against existing Issues with a two-stage pass.
- *
- * **Stage 1 — semantic candidate search (first).** When a `searchCandidates`
- * port is injected, it runs first to surface issues that *describe the same
- * problem by meaning* across BOTH open and closed issues (and, when the
- * caller wires it, an Epic's sub-issues). This widens the net beyond an exact
- * fingerprint so a reworded title or a moved file does not hide a real
- * duplicate. When no `searchCandidates` port is supplied the helper skips
- * straight to Stage 2 over the `searchIssues` lookup — the legacy
- * fingerprint-only behaviour, preserved verbatim.
- *
- * **Stage 2 — fingerprint confirmation (second).** Whatever candidates Stage 1
- * produced are filtered down to those that actually carry the finding's
- * fingerprint footer, then resolved:
+ * Union candidate pools into one flat pool, keeping first-seen order and
+ * dropping an issue number an earlier pool already contributed.
+ *
+ * The fingerprint pool is passed first, so when both ports return the same
+ * Issue it is that pool's record — the one retrieved by exact identity — that
+ * survives into confirmation. Records without a usable number are left for
+ * {@link confirmCandidates} to reject, exactly as a single port's would be.
+ *
+ * @param {Array<unknown>} pools
+ * @returns {Array<object>}
+ */
+function unionCandidatePools(pools) {
+  const seen = new Set();
+  return pools.flat().filter((issue) => {
+    const number = issue?.number;
+    if (typeof number !== 'number') return true;
+    const fresh = !seen.has(number);
+    seen.add(number);
+    return fresh;
+  });
+}
+
+/**
+ * Gather the candidate pool for a finding from every wired port.
+ *
+ * A run with a single wired port returns that port's result **verbatim**, so
+ * the fingerprint-only wiring (`qa-explore`, and every caller that injects no
+ * semantic port) keeps its behaviour exactly — including how a non-array
+ * return is handled downstream by {@link confirmCandidates}.
+ *
+ * Both ports are awaited together; a rejection from either propagates rather
+ * than degrading silently to a partial pool.
+ *
+ * @param {object} finding
+ * @param {string} sha — the finding's full fingerprint.
+ * @param {{ searchIssues?: Function, searchCandidates?: Function }} ports
+ * @returns {Promise<Array<object>|unknown>}
+ */
+async function gatherCandidates(finding, sha, ports) {
+  const call = (port, arg) => (typeof port === 'function' ? [port(arg)] : []);
+  const pools = await Promise.all([
+    ...call(ports.searchIssues, sha),
+    ...call(ports.searchCandidates, finding),
+  ]);
+  return pools.length === 1 ? pools[0] : unionCandidatePools(pools);
+}
+
+/**
+ * Route a finding against existing Issues: gather candidates, then confirm.
+ *
+ * **Gather — every wired port runs, and their pools union (Story #5079).** The
+ * two ports answer different questions and neither subsumes the other:
+ *
+ * - `searchIssues(sha)` is the **exact** lookup. A fingerprint sha is one
+ *   high-signal term, so it retrieves the Issue whose footer carries it.
+ * - `searchCandidates(finding)` is the **meaning-first** pass. It widens the
+ *   pool to Issues describing the same problem under a different title, so a
+ *   reworded finding or a moved file still confirms by semantic key.
+ *
+ * This was a ternary until Story #5079: an injected semantic port *replaced*
+ * the fingerprint lookup instead of widening it. Production always injects
+ * one, so `searchIssues` was dead code on the live path and dedup rested
+ * entirely on a ~20-token bag-of-words query that does not reliably retrieve
+ * the Issue. The audit loop consequently re-filed Stories it had already
+ * filed, against the workflow's "Never open a duplicate Issue" constraint.
+ * Running both ports and unioning their pools is what closes that loop.
+ *
+ * A port that rejects **propagates**. A pool gathered from only some of its
+ * sources is not a smaller pool, it is an unknown one, so the caller
+ * (`classifyGroupsAgainstGitHub`) must record a degraded lookup rather than
+ * report a confident `new`.
+ *
+ * **Confirm.** The pooled candidates are filtered down to those that actually
+ * carry the finding's fingerprint footer — or, when `semanticKeyConfirm` is
+ * on, its location-based semantic-key footer — then resolved:
  *   - An open match → `update-existing` (or `duplicate` when more than one
  *     open issue carries the fingerprint).
  *   - A closed match (no open match) → `regression-of-closed`.
  *   - No confirmed match → `new`.
  *
- * The decision enum is identical on both paths.
+ * The decision enum is identical however the candidates were gathered.
  *
  * @param {object} finding
  * @param {object} ports
  * @param {(sha: string) => Promise<Array<{ number: number, state: string, body?: string }>>} [ports.searchIssues]
- *   Fingerprint-keyed lookup over open+closed issues. Required when
- *   `searchCandidates` is not supplied.
+ *   Fingerprint-keyed lookup over open+closed issues. Runs whenever it is
+ *   supplied. Required when `searchCandidates` is not.
  * @param {(finding: object) => Promise<Array<{ number: number, state: string, title?: string, body?: string }>>} [ports.searchCandidates]
  *   Meaning-first candidate search over open+closed issues (and Epic
- *   sub-issues). When supplied, runs FIRST; its candidates are then
- *   fingerprint-confirmed.
+ *   sub-issues). Runs whenever it is supplied, alongside `searchIssues` rather
+ *   than instead of it; the union is then confirmed by footer.
  * @param {object} [options]
  * @param {boolean} [options.semanticKeyConfirm=false] — also confirm a
  *   candidate by the location-based semantic-key footer, not the fingerprint
@@ -510,15 +572,14 @@ export async function routeFinding(
   const { full: sha } = fingerprintFinding(finding);
   const semanticKey = options.semanticKeyConfirm ? semanticKeyFor(finding) : '';
 
-  // Stage 1: semantic candidate pass first (when wired); else fingerprint
-  // lookup. Both yield a candidate pool drawn from open AND closed issues.
-  const hits =
-    typeof searchCandidates === 'function'
-      ? await searchCandidates(finding)
-      : await searchIssues(sha);
+  // Gather: every wired port runs, and their pools union (Story #5079).
+  const hits = await gatherCandidates(finding, sha, {
+    searchIssues,
+    searchCandidates,
+  });
 
-  // Stage 2: confirm identity by fingerprint footer (and, when opted in, the
-  // location-based semantic-key footer) over the candidate pool.
+  // Confirm identity by fingerprint footer (and, when opted in, the
+  // location-based semantic-key footer) over the pooled candidates.
   const confirmed = confirmCandidates(hits, { sha, semanticKey });
 
   return decideFromConfirmed(confirmed, sha);
@@ -526,6 +587,8 @@ export async function routeFinding(
 
 export const __testing = {
   MARKER,
+  gatherCandidates,
+  unionCandidatePools,
   SEMANTIC_MARKER,
   SEP,
   confirmCandidates,

package/.agents/scripts/lib/maintainability-utils.js

@@ -6,6 +6,7 @@ import { POOL_SERIAL_THRESHOLD, runOnPool } from './cpu-pool.js';
 import { Logger } from './Logger.js';
 import { scoreFile } from './maintainability-engine.js';
 import { isScored, reportUnscorable } from './maintainability-unscorable.js';
+import { isScorableSourceFile } from './source-extensions.js';
 
 const MAINTAINABILITY_WORKER_URL = new URL(
   './workers/maintainability-worker.js',
@@ -16,17 +17,6 @@ const MAINTAINABILITY_WORKER_URL = new URL(
 // POOL_SERIAL_THRESHOLD docstring for the tuning rationale).
 const SERIAL_THRESHOLD = POOL_SERIAL_THRESHOLD;
 
-const JS_EXTS = new Set(['.js', '.mjs', '.cjs']);
-const TS_EXTS = new Set(['.ts', '.tsx', '.mts', '.cts']);
-const SUPPORTED_EXTS = new Set([...JS_EXTS, ...TS_EXTS]);
-
-/**
- * @returns {boolean} True when the path's extension is one the engines score.
- */
-function isSupportedSourceFile(filePath) {
-  return SUPPORTED_EXTS.has(path.extname(String(filePath)).toLowerCase());
-}
-
 const IGNORED_DIRS = new Set([
   'node_modules',
   '.git',
@@ -68,8 +58,10 @@ export function isIgnoredByGlobs(filePath, ignoreGlobs = [], cwd) {
 }
 
 /**
- * Recursively scans a directory for JS/TS source files. Accepts `.js`,
- * `.mjs`, `.cjs`, `.ts`, `.tsx`, `.mts`, and `.cts`. Directories listed
+ * Recursively scans a directory for JS/TS source files, selecting them by
+ * the shared `SCORABLE_SOURCE_EXTENSIONS` set (`source-extensions.js`) so the
+ * walk, the coverage-freshness check and the close-validation CRAP projection
+ * cannot drift apart. Directories listed
  * in `IGNORED_DIRS` (including `coverage` and `.next`, added in 5.29.0
  * to skip vitest's istanbul HTML scaffolding and Next.js build output)
  * are skipped.
@@ -101,7 +93,7 @@ export function scanDirectory(dir, fileList = [], opts = {}) {
       if (!IGNORED_DIRS.has(entry.name)) {
         scanDirectory(filePath, fileList, opts);
       }
-    } else if (entry.isFile() && isSupportedSourceFile(entry.name)) {
+    } else if (entry.isFile() && isScorableSourceFile(entry.name)) {
       if (isIgnoredByGlobs(filePath, ignoreGlobs, matchCwd)) {
         continue;
       }

package/.agents/scripts/lib/source-extensions.js

@@ -0,0 +1,76 @@
+/**
+ * source-extensions.js — the single source of truth for which file extensions
+ * the CRAP and maintainability scanners score.
+ *
+ * Three surfaces select "the files the scanner scores" and must agree, because
+ * a selector narrower than the scanner's own walk makes a gate green while
+ * measuring nothing: the maintainability/CRAP directory walk
+ * (`maintainability-utils.js`), the coverage-freshness check
+ * (`coverage-capture.js`), and the close-validation CRAP projection's
+ * changed-file filter (`close-validation/projections/crap.js`). Story #5076
+ * folded all three onto the set below after a TypeScript consumer's entire
+ * source tree was filtered out of the freshness check by a `js|mjs`-only
+ * literal.
+ *
+ * **This module MUST import nothing outside `node:` builtins.**
+ * `coverage-capture.js` runs on the pre-push path; `maintainability-utils.js`
+ * transitively pulls `typhonjs-escomplex` and `typescript`, so the shared set
+ * cannot live there without dragging the scoring engines into every freshness
+ * probe.
+ *
+ * The set is deliberately *not* configurable. Freshness exists only to serve
+ * the CRAP gate, so the contract is "what the scanner walks" — a
+ * consumer-settable extension list would be a second way to mis-scope the same
+ * gate.
+ *
+ * Not to be confused with `transpile.js`'s `TS_EXTS`, which answers a
+ * different question ("does this file need transpiling before scoring?") and
+ * is correctly a subset of this set rather than a fork of it.
+ */
+import path from 'node:path';
+
+/**
+ * Extensions the CRAP and maintainability engines can score, lower-cased and
+ * dot-prefixed. Frozen so a caller cannot mutate the shared set in place.
+ *
+ * Formats the engines cannot parse — `.astro`, `.vue`, `.svelte` — are
+ * deliberately absent: this set selects what the scanner already scores, not
+ * every source file that exists in a consumer's tree.
+ *
+ * Module-private: production consumers select through {@link
+ * SCORABLE_SOURCE_EXT_RE} or {@link isScorableSourceFile}, so exporting the
+ * raw list would be a dead production export.
+ *
+ * @type {readonly string[]}
+ */
+const SCORABLE_SOURCE_EXTENSIONS = Object.freeze([
+  '.js',
+  '.mjs',
+  '.cjs',
+  '.ts',
+  '.tsx',
+  '.mts',
+  '.cts',
+]);
+
+/**
+ * Anchored pattern matching a scorable source path by extension, derived from
+ * {@link SCORABLE_SOURCE_EXTENSIONS} so the list stays the only definition.
+ * Use it where a path arrives as raw text (a `git ls-files` line, a porcelain
+ * status entry) and `path.extname` would be the wrong tool.
+ *
+ * @type {RegExp}
+ */
+export const SCORABLE_SOURCE_EXT_RE = new RegExp(
+  `\\.(?:${SCORABLE_SOURCE_EXTENSIONS.map((ext) => ext.slice(1)).join('|')})$`,
+);
+
+/**
+ * @param {string} filePath Absolute or relative path; only its extension is read.
+ * @returns {boolean} True when the path's extension is one the engines score.
+ */
+export function isScorableSourceFile(filePath) {
+  return SCORABLE_SOURCE_EXTENSIONS.includes(
+    path.extname(String(filePath)).toLowerCase(),
+  );
+}

package/.agents/skills/core/documentation-and-adrs/SKILL.md

@@ -13,7 +13,7 @@ description:
 - Document the **why**, not the what. Capture context, constraints, alternatives considered, and trade-offs — code already shows what was built.
 - Write an ADR for any decision that would be expensive to reverse (framework choice, data model, auth strategy, API architecture, hosting platform).
 - Mandrel ships **two first-class decisions-log layouts** — pick one at onboarding (see [Decisions-log layouts](reference.md#decisions-log-layouts)): the **single-file dated-entry** `docs/decisions.md` (default; best for small projects) or the **index + `docs/decisions/` directory** (MADR-style, one file per ADR; best once the log outgrows a single file). Either way, the canonical ADR sections are **Status, Date, Deciders, Context, Decision, (Alternatives Considered), Consequences**.
-- Mark an ADR's status as `Accepted`, `Superseded by ADR-XXX`, or `Deprecated`. Never silently delete an ADR — supersede it.
+- Mark an ADR's status as `Accepted`, `Superseded by ADR-XXX`, `Deprecated`, or `Reverted (<date>)` — a reverted decision was **undone** rather than replaced, so unlike a superseded one it has no successor to point at. Never silently delete an ADR — supersede it.
 - Do **not** document obvious code; do **not** restate what the code already says. Stale or redundant docs are worse than no docs.
 - Comments explain **non-obvious intent** (the why). If a comment describes what the code does, refactor the code instead.
 - Keep user-facing docs (README, API docs, changelog) updated as part of the change — out-of-date docs are bugs.

package/.agents/workflows/audit-adrs.md

@@ -0,0 +1,270 @@
+---
+description: >-
+  Audit the decisions log as a live contract — Accepted ADRs whose claims the
+  tree has outgrown, broken supersede chains, structural gaps, and directional
+  changes that landed with no decision recorded. A deliberately-global lens over
+  whichever decisions-log layout the consumer ships.
+---
+
+# Decisions-Log (ADR) Audit
+
+You are a Staff Engineer & Decision Historian verifying that the consumer's
+**decisions log still describes the system that exists**. An ADR is not prose
+that merely rots — it is retrieved as *authority*: agents and humans read an
+`Accepted` decision as the settled answer and do not re-litigate it. So an
+Accepted ADR the tree has outgrown is worse than no ADR at all — it actively
+teaches a wrong contract, and it keeps teaching it until someone supersedes it.
+That is this lens's central target; structural tidiness is the cheap part.
+
+The shared lens machinery — read-only constraint, scope interpretation, report
+envelope + finding-block skeleton, severity scale, self-cross-check, and
+execution strategy — lives in
+[`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
+`{{auditOutputDir}}/audit-adrs-results.md`. Dimension values:
+`Decision Drift | Supersede-Chain Integrity | Structure & Status Hygiene |
+Missing Decision | Layout Conformance`; the report adds a **Decision Coverage**
+table.
+
+## Applicability & layout detection
+
+**Mandrel ships two first-class decisions-log layouts** (the
+[`core/documentation-and-adrs`](../skills/core/documentation-and-adrs/SKILL.md)
+Policy Capsule is the SSOT), and this lens reads whichever one the consumer
+adopted. **Both layouts keep the same entry file** — `decisions.md` under the
+configured docs root — so its mere presence never identifies the layout. Detect
+in this order, resolving `<docsRoot>` from `project.paths.docsRoot` in
+`.agentrc.json` (default `docs`):
+
+1. **Neither `<docsRoot>/decisions.md` nor `<docsRoot>/decisions/` exists** →
+   the project keeps no decisions log. Emit the not-applicable report below and
+   stop. Never invent a log, and never infer decisions from commit history.
+2. **`decisions.md` only** → **single-file dated-entry layout** (the default).
+   Every ADR body lives in that one file as an append-only entry.
+3. **`decisions.md` + a `decisions/` directory** → read the entry file to tell
+   the two apart. When it is predominantly an **index** (one row or link per
+   ADR pointing into `decisions/`), this is the **index + `decisions/`
+   directory** (MADR-style) layout, and each `decisions/NNNN-*.md` file is an
+   ADR body. When it instead carries full ADR bodies *and* a `decisions/`
+   directory holds further ADRs, the log is a hybrid — conformant **only** when
+   every file under `decisions/` is reachable from the entry file by an
+   index row or an in-entry pointer; otherwise it is a Layout Conformance
+   finding (an unreferenced ADR body is invisible to every reader who starts,
+   as they must, at the entry file).
+4. **`decisions/` only, with no entry file** → a Layout Conformance finding:
+   the entry file is the mandatory-read surface both layouts guarantee, and
+   without it the directory's ADRs are unreachable from the docs context.
+
+**Override.** An operator may pass `--paths <file ...>` (audit specific ADR
+files) or `--dir <path>` (treat that directory as the decisions root) to point
+the lens at a non-conventional location. These flags are the **only** override:
+there is deliberately no `.agentrc.json` key for the decisions-log location, so
+detection stays derived from the skill's two layouts rather than from
+configuration a consumer must maintain.
+
+## Whole-log scope (global lens)
+
+Unlike the change-set-scoped lenses, this lens **always evaluates the whole
+decisions log**, even when the change that triggered it touched one file.
+Decision integrity is a global property: a supersede chain spans entries the
+change set never names, and — the load-bearing case — a code change *elsewhere*
+is exactly what invalidates an Accepted ADR's claims. Narrowing to the change
+set would blind the lens to its primary finding class.
+
+Accordingly this lens declares `"scope": "global"` in
+[`audit-rules.json`](../schemas/audit-rules.json) — the single source of truth
+`resolveLensTier` in
+[`lib/audit-suite/selector.js`](../scripts/lib/audit-suite/selector.js) reads —
+and is **exempt from the cross-epic-leak guard** that narrows every other
+lens's evidence to its `changedFiles`. The exemption is scoped to this lens
+only; the guard is not weakened for any other lens.
+
+```text
+{{changedFiles}}
+```
+
+- For this lens, **ignore** the `{{changedFiles}}` block above even when it is
+  populated: the decisions log is evaluated whole regardless. The block is
+  rendered only for envelope-shape parity with the scoped lenses. Do use it,
+  when populated, as a **prioritization hint** — an Accepted ADR whose subject
+  the change set touches is the first one to claim-check — never as a filter on
+  what is audited or reported.
+
+## Execution strategy
+
+Run this lens as a single `subagent_type: auditor` dispatch returning the report
+path + Executive Summary; sequential inline execution is the fallback (see the
+core's Execution strategy). On a large log, the Decision Drift claim-check
+(Step 2.1) is the one dimension worth fanning out per batch of entries under
+parallel-tooling Rule 3 — merge under the shared self-cross-check.
+
+## Step 1: Deterministic structure sweep first
+
+Run the cheap exact checks before reading any ADR for meaning — they
+de-duplicate the easy findings and give Step 2 its inventory. Adjust the paths
+below to the detected layout (or the `--dir` / `--paths` override):
+
+```bash
+# Entry file + any ADR bodies (single-file layout yields just the entry file).
+ls docs/decisions.md docs/decisions/*.md 2>/dev/null
+
+# Status lines and their spelling — the vocabulary is Accepted / Superseded
+# by … / Deprecated / Reverted (…); anything else is a Structure & Status
+# Hygiene finding.
+grep -rn '^\*\*Status:\*\*\|^- \*\*Status:\*\*' docs/decisions.md docs/decisions/ 2>/dev/null
+
+# Entry headings, for the id/date/uniqueness checks in Step 1's list below.
+grep -n '^## ' docs/decisions.md 2>/dev/null
+
+# Link integrity across the docs surface, including every ADR cross-reference.
+node .agents/scripts/check-doc-links.js
+```
+
+From that output, resolve deterministically — each of these is a
+**Structure & Status Hygiene** finding except where noted:
+
+1. **Canonical sections.** Every ADR carries the canonical set the skill's
+   Policy Capsule names — **Status, Date, Deciders, Context, Decision,
+   (Alternatives Considered), Consequences**. `Alternatives Considered` is
+   optional; a missing `Status`, `Context`, `Decision`, or `Consequences` is a
+   finding, and a missing `Status` is the most severe of them because every
+   other dimension keys off it.
+2. **Status vocabulary.** Each status reads `Accepted`, `Superseded by <ref>`,
+   `Deprecated`, or `Reverted (<date>)` — a reverted decision was **undone**
+   rather than replaced, so unlike a superseded one it has no successor to
+   point at, and its missing `by <ref>` is correct rather than a defect. A
+   free-invented status word — anything outside those four — leaves the entry
+   unclassifiable by this lens and by every reader.
+3. **Unique, stable ids.** No two entries share an id/anchor; MADR files use
+   zero-padded sequential numbering matching their heading id.
+4. **Parseable dates.** Every `Date` parses, and no entry is dated in the
+   future.
+5. **Link integrity.** Report what `check-doc-links.js` finds inside the
+   decisions surface; leave findings outside it to `audit-documentation`.
+
+This lens orchestrates the existing checker only — it adds no new deterministic
+checker script, and the sweep above is inline shell by design.
+
+## Step 2: Evaluation dimensions
+
+### 2.1 Decision Drift — **`Accepted` entries only**
+
+This is the lens's primary value. For each **Accepted** entry, extract its
+load-bearing claims — the scripts, files, directories, commands, flags, config
+keys, contracts, and mechanisms it names as decided — and verify each against
+the current tree, exactly as a documentation claim-check would. Flag an
+Accepted decision whose subject the code has moved past: a named mechanism that
+no longer exists, a contract the implementation has replaced, a path or command
+that resolves to nothing, a constraint the tree now routinely violates.
+
+**Scope this claim-check to Accepted entries and no others.** A `Superseded`
+or `Deprecated` entry is *supposed* to describe a world that no longer exists —
+claim-checking it manufactures findings out of correctly-retired history, and
+on a long log it is also where the cost would go. Superseded and Deprecated
+entries get the chain checks in 2.2 and the structure checks in Step 1, and
+nothing else.
+
+**Remediation is always supersede-or-amend, never silent edit or deletion** —
+the skill's lifecycle rule is that an ADR is superseded in place, never pruned
+or archived. Say which in the finding: amend when the decision still holds and
+only its details moved; supersede when the decision itself no longer describes
+what the project does.
+
+Severity guidance: **High** — an Accepted ADR whose central decision the code
+contradicts (it will be retrieved and believed); **Medium** — an Accepted ADR
+whose supporting details drifted while its decision still holds; **Low** —
+cosmetic staleness (an old path in an aside, a renamed tool in an example).
+
+### 2.2 Supersede-Chain Integrity
+
+The chain is what keeps a retired decision honest, so audit it as a graph:
+
+- **Every supersede reference resolves** to an ADR that exists (a heading
+  anchor in the single-file layout, a file in the directory layout).
+- **No cycles**, and no entry superseding itself.
+- **Index ↔ entry agreement** (directory layout, and any single-file log
+  carrying a summary table): the status in the index row matches the status in
+  the ADR body. A row saying `Accepted` over a body saying `Superseded` is a
+  finding — readers stop at the index.
+- **Partial supersessions name what survives.** An entry recording that *some*
+  rows or clauses are superseded while the rest stand MUST say precisely which;
+  an unscoped "partly superseded" leaves every clause ambiguous.
+- **No two Accepted entries contradict each other** on the same subject. When
+  a later decision silently overrode an earlier one, the earlier is the finding:
+  it was never marked superseded.
+
+### 2.3 Structure & Status Hygiene
+
+Promote the Step 1 sweep's resolved items to findings here. Keep them terse —
+each names the entry and the missing or malformed element.
+
+### 2.4 Missing Decision
+
+The inverse gap: a directional change that landed with **no** decision
+recorded. **Bound the search by date** — inspect history since the newest
+entry's `Date`, not the whole history, or this dimension dominates the lens's
+cost on any mature repository:
+
+```bash
+git log --since=<newest-ADR-date> --pretty='%h %s' -- . | head -50
+```
+
+Flag only **directional** changes — a mechanism retired, a contract cut over, a
+dependency or platform swapped, an architectural seam moved. Routine features,
+fixes, and refactors are not decisions and must not be reported here. When the
+newest entry is recent and nothing directional landed since, record that as a
+single `Info` observation rather than straining for a finding.
+
+### 2.5 Layout Conformance
+
+Report the detection outcomes named in **Applicability & layout detection**: an
+unreferenced ADR body under `decisions/`, a `decisions/` directory with no
+entry file, or an index whose rows and directory contents disagree about which
+ADRs exist.
+
+## Not-applicable report
+
+When the project keeps **no decisions log** (neither the entry file nor the
+directory exists, and no `--paths` / `--dir` override was supplied), emit this
+explicit report instead of empty findings — and stop:
+
+```text
+# Decisions-Log (ADR) Audit Report
+
+## Executive Summary
+
+**Not applicable** — this project keeps no decisions log (no `decisions.md`
+entry file and no `decisions/` directory under the configured docs root), so
+the ADR lens has nothing to inspect and was skipped.
+
+## Detailed Findings
+
+_None — lens not applicable._
+```
+
+## Constraint (lens-specific carve-out)
+
+Read-only over the decisions log and the tree it makes claims about. The single
+write is the report artifact: never edit, supersede, renumber, reformat, or
+delete an ADR — recording that a decision needs superseding is the deliverable,
+and performing the supersession is a separate, human-owned pass. Run
+`check-doc-links.js` in its default read-only mode only. Generic documentation
+staleness outside the decisions surface belongs to
+[`audit-documentation`](audit-documentation.md); architectural boundary
+violations belong to `audit-architecture`. This lens judges whether a *recorded
+decision* still matches the tree — never whether the decision was a good one.
+
+## Report additions
+
+Beyond the shared skeleton (Executive Summary + Detailed Findings from the
+core), this lens's report carries its own title and a Decision Coverage table,
+so a reader can see what was claim-checked versus what was only chain-checked:
+
+```markdown
+# Decisions-Log (ADR) Audit Report
+
+## Decision Coverage
+
+| ADR         | Status                                          | Checked                       |
+| ----------- | ----------------------------------------------- | ----------------------------- |
+| [id, title] | [Accepted · Superseded · Deprecated · Reverted] | [Claims + chain · Chain only] |
+```

package/.agents/workflows/audit-documentation.md

@@ -211,6 +211,23 @@ findings land as actionable, tracked work rather than a report nobody reads.
 Run the deterministic checkers in `--check` mode only; the single write is the
 report artifact. Do not edit any documentation or code.
 
+### Boundary with the ADR lens
+
+**Decision-log semantics belong to [`audit-adrs`](audit-adrs.md)**, not to this
+lens: whether an `Accepted` ADR's claims still match the tree, whether its
+supersede chain resolves, whether the index and the entry bodies agree on a
+status, and whether a directional change landed with no decision recorded. That
+lens reads the whole decisions log as a graph; this one would only ever see the
+decisions file as one more prose doc.
+
+This lens keeps its **generic** coverage of that file — link integrity, command
+and path claims, and the History Bloat / Contradiction / Authority Drift
+categories above — and both lenses may legitimately touch `decisions.md`. When
+a finding turns on an ADR's **status, chain, or decided contract**, leave it to
+`audit-adrs` rather than reporting it here, so the two lenses do not
+double-report the same defect. The History Bloat remediation is unchanged and
+still applies: never prune an ADR by archiving — supersede it in place.
+
 ## Report additions
 
 Beyond the shared skeleton (Executive Summary + Detailed Findings from the

package/docs/CHANGELOG.md

@@ -15,6 +15,21 @@ All notable changes to this project will be documented in this file.
 -->
 <!-- markdownlint-disable-file MD004 MD012 MD037 -->
 
+## [2.35.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.34.0...mandrel-v2.35.0) (2026-08-28)
+
+
+### Added
+
+* add /audit-adrs — global decisions-log audit lens (decision drift, supersede-chain integrity, structure, missing decisions) ([#5072](https://github.com/dsj1984/mandrel/issues/5072)) ([#5073](https://github.com/dsj1984/mandrel/issues/5073)) ([5757e6a](https://github.com/dsj1984/mandrel/commit/5757e6ae3da471713dcdb4ac8b6d8093ea36d6f4))
+
+
+### Fixed
+
+* **adrs:** add Reverted to the ADR status vocabulary and pin it to the skill (refs [#5078](https://github.com/dsj1984/mandrel/issues/5078)) ([#5083](https://github.com/dsj1984/mandrel/issues/5083)) ([d498575](https://github.com/dsj1984/mandrel/commit/d49857573725d8241d7083ad4579583b47af4935))
+* **audit-rules:** register a deploy-runtime sensitive-path class (refs [#5069](https://github.com/dsj1984/mandrel/issues/5069)) ([#5070](https://github.com/dsj1984/mandrel/issues/5070)) ([da7f9f3](https://github.com/dsj1984/mandrel/commit/da7f9f3969aa14afa45a89d1ee4973248268a7cd))
+* **findings:** union the fingerprint lookup with the semantic pass in routeFinding (refs [#5079](https://github.com/dsj1984/mandrel/issues/5079)) ([#5082](https://github.com/dsj1984/mandrel/issues/5082)) ([fd82de3](https://github.com/dsj1984/mandrel/commit/fd82de3496b4fe02cf29bead27957ce82ef7a0b2))
+* fix coverage-capture freshness: derive the scorable-source extension set from the CRAP scanner and fail closed when discovery finds nothing ([#5076](https://github.com/dsj1984/mandrel/issues/5076)) ([#5081](https://github.com/dsj1984/mandrel/issues/5081)) ([09f89c0](https://github.com/dsj1984/mandrel/commit/09f89c0bd39adde9936ebd6c47fb4c2a5c3ee4cd))
+
 ## [2.34.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.33.0...mandrel-v2.34.0) (2026-08-27)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel",
-  "version": "2.34.0",
+  "version": "2.35.0",
   "description": "Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.",
   "files": [
     ".agents/",