mandrel 2.47.0 → 2.49.0

package/.agents/agents/story-worker.md

@@ -48,53 +48,47 @@ the step-by-step. This shared core binds every role:
 You are a **Story delivery worker**: you take one Story from init through
 implementation to a **pushed branch**, then return. You do **not** close it —
 your caller owns the close-and-land tail. Follow the `helpers/deliver-story`
-workflow prose your caller hands you; this delta states the non-negotiable
+prose your caller hands you; this delta states the non-negotiable
 MUSTs. Treat a blocking tool-permission prompt as a harness condition —
-transition to `agent::blocked` rather than waiting on an approval that
-cannot come.
+flip to `agent::blocked` rather than waiting on an approval that cannot
+come.
 
 ## Worktree discipline (MUST)
 
 1. Initialize with
    `node .agents/scripts/single-story-init.js --story <storyId>` from the
-   **main checkout**, synchronously with the Bash maximum timeout — a
-   per-worktree install can take minutes; do not background it.
-2. Capture `workCwd` and `dependenciesInstalled` from the init envelope.
+   **main checkout**, synchronously at max Bash timeout — a per-worktree
+   install can take minutes; do not background it.
+2. Capture `workCwd` and `dependenciesInstalled` from the envelope.
    Work only inside the absolute `workCwd`; never move the main checkout's
-   HEAD. Because cwd may reset between calls, anchor every path at `workCwd`.
+   HEAD. cwd may reset between calls, so anchor every path at `workCwd`.
 
 ## Verify branch before every commit (MUST)
 
-Before staging or committing anything:
-
-```bash
-git -C "<workCwd>" branch --show-current   # MUST print story-<storyId>
-```
-
-If it does not, **STOP** — never commit Story work to `main` or outside the
-worktree/branch. Re-run `single-story-init.js` (idempotent on partial
-state) to restore the branch first.
+Before staging or committing, `git -C "<workCwd>" branch --show-current`
+MUST print `story-<storyId>`. If it does not, **STOP** — never commit Story
+work to `main` or outside the worktree/branch. Re-run
+`single-story-init.js` (idempotent) to restore it.
 
 ## Commit discipline
 
-Author Conventional Commit subjects directly on `story-<storyId>` per
+Author Conventional Commit subjects on `story-<storyId>` per
 [`git-conventions.md`](../rules/git-conventions.md): imperative mood,
-≤100 chars, referencing the Story via `(refs #<storyId>)`. Never bypass the
-`commit-msg` hook with `--no-verify` / `--no-gpg-sign`. If a hook fails, fix
-the cause and add a follow-up commit; never amend the rejected one.
+≤100 chars, `(refs #<storyId>)`. Never bypass the `commit-msg` hook
+(`--no-verify` / `--no-gpg-sign`); if one fails, fix the cause and add a
+follow-up commit, never amend.
 
 ## Docs context — digest first
 
 Do **not** re-read every file in `project.docsContextFiles`. Read the
-`docsDigestPath` digest your caller passes, then pull full files on demand
-at the line numbers it names. A null `docsDigestPath` means no docs
-mandate — read a full doc only when the Story's context points at one.
+`docsDigestPath` digest your caller passes, then pull files on demand at
+the lines it names. A null `docsDigestPath` means no mandate.
 
-## Close gates — one credited run, no ad-hoc stamping
+## Close gates — one credited run
 
 `single-story-close.js` runs the canonical close-validation chain
 (**typecheck, lint, test, format, maintainability, coverage, crap**) and is
-the authoritative gate — do not pre-run the chain. The **one** exception is
+the authoritative gate — do not pre-run it. The **one** exception is
 the full suite: run it exactly once, after the self-eval loop's last fix
 commit and immediately before the push, in the shape close credits. A bare
 `npm test` / `pnpm run test` deposits **no** credit:
@@ -107,12 +101,20 @@ node <main-repo>/.agents/scripts/evidence-gate.js --standalone \
   --scope-id <storyId> --gate test --worktree <workCwd> -- npm test
 ```
 
-Sharing `lint` / `typecheck` evidence with close via `evidence-gate.js` is
-fine; never stamp coverage / CRAP fresh any other way.
+Dispatch it in the **background**: it routinely outruns the host's
+synchronous Bash ceiling, and its completion re-invokes you — that
+notification is the signal. Never spawn a task to poll or `sleep`-loop
+against it; a waiter whose condition is wrong outlives the agent. Share
+`lint` / `typecheck` evidence with close via `evidence-gate.js`; never
+stamp coverage / CRAP fresh any other way.
+
+**It can legitimately run nothing.** With nothing changed under the CRAP
+`targetDirs` it skips capture and exits 0. An exit code is never evidence a
+gate did work — its **output** is: no credit was deposited, so run the full
+suite yourself before handing off.
 
-Before trusting a gate's output — or diagnosing a red one — read
-[`known-tooling-behavior.md`](../rules/known-tooling-behavior.md): measured
-cases where a command prints what it does not mean.
+Gate output that lies: [`known-tooling-behavior.md`](../rules/known-tooling-behavior.md).
+Waiter traps: [`parallel-tooling.md`](../workflows/helpers/parallel-tooling.md) Rule 2.
 
 ## Acceptance self-eval before close (MUST)
 
@@ -120,27 +122,27 @@ After the implementation commits land and **before** flipping to `closing`,
 run the bounded acceptance self-eval loop
 ([`acceptance-self-eval.md`](../workflows/helpers/acceptance-self-eval.md)).
 It scores the change set you computed **once** and injected into the critic
-— never one the critic re-derives (Story #4593) — against each
-`acceptance[]` item, consuming `verify[]` output as required evidence. Gate
-outcomes: **proceed** → flip to `closing`, push, hand off; **redraft** → fix
-the flagged criteria, commit, re-eval; **block** → take the blocked path
-below. Never silently hand off an unscored branch.
+— never one it re-derives — against each `acceptance[]` item,
+consuming `verify[]` output as evidence. **proceed** → flip to `closing`,
+push, hand off; **redraft** → fix the flagged criteria, commit, re-eval;
+**block** → take the blocked path below. Never hand off an unscored
+branch.
 
 ## Lifecycle: progress & blocked (MUST)
 
-- **Progress.** Relay one terse line per phase transition (e.g.
+- **Progress.** One terse line per phase transition (e.g.
   `Story #<id>: implementing → closing`).
-- **Blocked.** When you genuinely cannot proceed, transition the Story to
+- **Blocked.** When you cannot proceed, transition the Story to
   `agent::blocked`, post a `friction` comment naming the decision needed
   (or the unmet criteria and their evidence), and **exit non-zero**.
-  **Never fall silent** — a stalled child without an `agent::blocked` label
-  and no commit is indistinguishable from a dead one.
+  **Never fall silent** — a stalled child with no label and no commit is
+  indistinguishable from a dead one.
 
-## Land or block — the only sanctioned landing (#4483, MUST)
+## Land or block — the only sanctioned landing (MUST)
 
-The Story's init envelope carries `remoteVerified` + `remoteProbe`. When
-`remoteVerified` is `false`, transition the Story to `agent::blocked`
-quoting `remoteProbe.detail` and stop. A PR opened by
+The init envelope carries `remoteVerified` + `remoteProbe`. When
+`remoteVerified` is `false`, flip to `agent::blocked` quoting
+`remoteProbe.detail` and stop. A PR opened by
 `single-story-close.js` is the only sanctioned landing.
 
 ## Your turn ends at a pushed branch (MUST)
@@ -148,14 +150,12 @@ quoting `remoteProbe.detail` and stop. A PR opened by
 You do **not** run close. Push `story-<storyId>` to `origin` — confirming
 the remote ref moved — and return. The dispatching orchestrator runs
 `single-story-close.js` in its own session, serialized against your
-siblings. Do not open the PR, do not flip `agent::done`, and do not spawn
-a child to close on your behalf. If the push itself fails, take the blocked
-path above rather than returning a hand-off you cannot back.
+siblings. Do not open the PR, flip `agent::done`, or spawn a child to close
+on your behalf. If the push fails, take the blocked path above.
 
 ## Return contract — the hand-off report
 
 A short, literal hand-off your caller can act on: Story id, `workCwd`,
 branch, pushed head SHA, self-eval verdict, `verify[]` evidence. Say plainly
-that the branch is pushed and unclosed. Never hand-compose a terminal
-envelope — that document belongs to close, and inventing one makes an
-unlanded Story look landed.
+the branch is pushed and unclosed. Never hand-compose a terminal envelope —
+inventing one makes an unlanded Story look landed.

package/.agents/docs/configuration.md

@@ -690,6 +690,7 @@ Claude Code web environment-variables UI for web sessions.
 | `WEBHOOK_SECRET`           | No        | Shared secret used to sign outbound webhook payloads as `X-Signature-256: sha256=<hmac>`. Unset ships unsigned payloads.                                 |
 | `MANDREL_ALLOW_TEST_WEBHOOKS` | No     | Set to `1` to keep `NOTIFICATION_WEBHOOK_URL` live inside `npm test` / `npm run test:profile`. Default behaviour scrubs the env var from the test child so no URL resolves and the webhook never fires (see below). |
 | `MANDREL_POOL_CONCURRENCY` | No | Upper bound on the width of every `runOnPool` worker pool in the process (the MI and CRAP scan pools). Precedence is: a caller's explicit `concurrency` → this variable → a clamp of 4 under `node:test` → `os.availableParallelism()`. Set it on a constrained or shared runner where one pool per core oversubscribes the host; a non-numeric value is ignored rather than collapsing the pool. |
+| `MANDREL_BASELINE_GENERATED_AT` | No | Pins the `generatedAt` stamp every baseline envelope carries, instead of reading the clock. Set it for a reproducible build, or to make a hand-run refresh diff against a known stamp. It changes only the stamp — rows and rollup are unaffected, and a refresh that moves no row still rewrites nothing. Concurrent refreshes no longer need it to avoid conflicting: `baselines/*.json` merges by row identity (see the baseline merge driver in [quality-gates.md](quality-gates.md)). |
 | `MANDREL_AGENTRC_VALIDATOR` | No | Set to `dynamic` to compile the `.agentrc.json` AJV validator at runtime instead of loading the committed precompiled one (see below). Costs ~35 ms per process; the escape hatch exists for a hand-edited schema or a host where the generated module will not load. |
 
 ### The `.agentrc` validator is precompiled

package/.agents/docs/quality-gates.md

@@ -889,6 +889,54 @@ The schemas live under [`.agents/schemas/baselines/`](../schemas/baselines/).
 The shared AJV instance is built by `buildBaselineSchemaAjv()` in
 [`.agents/scripts/lib/baseline-schema-registry.js`](../scripts/lib/baseline-schema-registry.js).
 
+### Concurrent refreshes — the baseline merge driver
+
+`generatedAt` sits on line 4 of every envelope, so two branches that each
+refresh a baseline **always** differ there, even when they moved completely
+disjoint rows. Git merges JSON as text, and whether it can separate that hunk
+from the moved rows is an accident of proximity. Both outcomes are wrong:
+
+- it cannot → a conflict on work that never overlapped (the `coverage.json` /
+  `maintainability.json` "always conflicts" pattern);
+- it can → it splices both sides' row lines into a row set **neither side
+  scored** (the `crap.json` "silently auto-merges" pattern). The ratchet then
+  guards a number no scorer ever produced.
+
+A baseline is a set of rows keyed by identity plus a rollup derived from them,
+so [`merge-baseline.js`](../scripts/merge-baseline.js) merges it as that. Per
+row identity the standard 3-way rule applies; only a genuine double move
+conflicts, and then markers wrap that row alone. The rollup is always
+**recomputed** from the merged rows — merging two rollups is the same splice
+hazard compressed into one number — and `generatedAt` resolves to the later of
+the two stamps rather than conflicting.
+
+Row identity comes from the kind module's `rowIdentity(row)`, which is
+deliberately not `keyField`: CRAP groups by file (`keyField: 'path'`) but
+ships one row per method, so keying on `keyField` would drop every method in a
+file but one. Any `baselines/*.json` whose `$schema` is not a known per-kind
+envelope — `arch-cycles`, `cyclomatic`, `dead-exports`, `audit-ledger`,
+`context-budget`, `workflow-citations` — is handed straight back to
+`git merge-file`, so registering the driver cannot change their behaviour.
+
+Registration has two halves:
+
+```bash
+# 1. tracked, installed by `node .agents/scripts/apply-quality-bootstrap.js`
+#    → .gitattributes:  baselines/*.json merge=mandrel-baseline
+# 2. per clone — git will not run a command chosen by whoever wrote the repo
+git config merge.mandrel-baseline.driver "node .agents/scripts/merge-baseline.js %O %A %B %P"
+```
+
+Only the first ships with the repository, and a clone missing the second
+degrades **silently** back to the text merge. `mandrel doctor`'s
+`merge-driver` check is the guard: it prints the exact `git config` line
+above, and passes as skipped when `.gitattributes` does not declare the
+driver at all.
+
+`MANDREL_BASELINE_GENERATED_AT` pins the stamp for a reproducible build (see
+the environment table in [configuration.md](configuration.md)). It is no
+longer needed to dodge merge conflicts.
+
 ### Per-kind shapes
 
 Each kind contributes a `rows[]` schema and a `rollup` axis set. The

package/.agents/scripts/lib/baselines/kernel.js

@@ -35,6 +35,7 @@ import {
   name as bundleSizeName,
   projectRow as bundleSizeProjectRow,
   rollup as bundleSizeRollup,
+  rowIdentity as bundleSizeRowIdentity,
   sortRows as bundleSizeSortRows,
 } from './kinds/bundle-size.js';
 import {
@@ -46,6 +47,7 @@ import {
   name as coverageName,
   projectRow as coverageProjectRow,
   rollup as coverageRollup,
+  rowIdentity as coverageRowIdentity,
   sortRows as coverageSortRows,
 } from './kinds/coverage.js';
 import {
@@ -59,6 +61,7 @@ import {
   name as crapName,
   projectRow as crapProjectRow,
   rollup as crapRollup,
+  rowIdentity as crapRowIdentity,
   sortRows as crapSortRows,
 } from './kinds/crap.js';
 import {
@@ -70,6 +73,7 @@ import {
   name as duplicationName,
   projectRow as duplicationProjectRow,
   rollup as duplicationRollup,
+  rowIdentity as duplicationRowIdentity,
   sortRows as duplicationSortRows,
 } from './kinds/duplication.js';
 import {
@@ -81,6 +85,7 @@ import {
   name as lighthouseName,
   projectRow as lighthouseProjectRow,
   rollup as lighthouseRollup,
+  rowIdentity as lighthouseRowIdentity,
   sortRows as lighthouseSortRows,
 } from './kinds/lighthouse.js';
 import {
@@ -92,6 +97,7 @@ import {
   name as lintName,
   projectRow as lintProjectRow,
   rollup as lintRollup,
+  rowIdentity as lintRowIdentity,
   sortRows as lintSortRows,
 } from './kinds/lint.js';
 import {
@@ -103,6 +109,7 @@ import {
   name as maintainabilityName,
   projectRow as maintainabilityProjectRow,
   rollup as maintainabilityRollup,
+  rowIdentity as maintainabilityRowIdentity,
   sortRows as maintainabilitySortRows,
 } from './kinds/maintainability.js';
 import {
@@ -115,6 +122,7 @@ import {
   name as mutationName,
   projectRow as mutationProjectRow,
   rollup as mutationRollup,
+  rowIdentity as mutationRowIdentity,
   sortRows as mutationSortRows,
 } from './kinds/mutation.js';
 
@@ -135,6 +143,9 @@ function bindKindModule(members) {
   return Object.freeze({
     name: members.name,
     keyField: members.keyField,
+    // Story #5215: the merge identity, distinct from the `keyField`
+    // grouping key above — CRAP groups by file and identifies by method.
+    rowIdentity: members.rowIdentity,
     kernelVersion: members.kernelVersion,
     projectRow: members.projectRow,
     sortRows: members.sortRows,
@@ -159,6 +170,7 @@ const KIND_MODULES = Object.freeze({
   lint: bindKindModule({
     name: lintName,
     keyField: lintKeyField,
+    rowIdentity: lintRowIdentity,
     kernelVersion: lintKernelVersion,
     projectRow: lintProjectRow,
     sortRows: lintSortRows,
@@ -170,6 +182,7 @@ const KIND_MODULES = Object.freeze({
   coverage: bindKindModule({
     name: coverageName,
     keyField: coverageKeyField,
+    rowIdentity: coverageRowIdentity,
     kernelVersion: coverageKernelVersion,
     projectRow: coverageProjectRow,
     sortRows: coverageSortRows,
@@ -181,6 +194,7 @@ const KIND_MODULES = Object.freeze({
   crap: bindKindModule({
     name: crapName,
     keyField: crapKeyField,
+    rowIdentity: crapRowIdentity,
     kernelVersion: crapKernelVersion,
     projectRow: crapProjectRow,
     sortRows: crapSortRows,
@@ -194,6 +208,7 @@ const KIND_MODULES = Object.freeze({
   maintainability: bindKindModule({
     name: maintainabilityName,
     keyField: maintainabilityKeyField,
+    rowIdentity: maintainabilityRowIdentity,
     kernelVersion: maintainabilityKernelVersion,
     projectRow: maintainabilityProjectRow,
     sortRows: maintainabilitySortRows,
@@ -205,6 +220,7 @@ const KIND_MODULES = Object.freeze({
   mutation: bindKindModule({
     name: mutationName,
     keyField: mutationKeyField,
+    rowIdentity: mutationRowIdentity,
     kernelVersion: mutationKernelVersion,
     projectRow: mutationProjectRow,
     sortRows: mutationSortRows,
@@ -217,6 +233,7 @@ const KIND_MODULES = Object.freeze({
   lighthouse: bindKindModule({
     name: lighthouseName,
     keyField: lighthouseKeyField,
+    rowIdentity: lighthouseRowIdentity,
     kernelVersion: lighthouseKernelVersion,
     projectRow: lighthouseProjectRow,
     sortRows: lighthouseSortRows,
@@ -228,6 +245,7 @@ const KIND_MODULES = Object.freeze({
   'bundle-size': bindKindModule({
     name: bundleSizeName,
     keyField: bundleSizeKeyField,
+    rowIdentity: bundleSizeRowIdentity,
     kernelVersion: bundleSizeKernelVersion,
     projectRow: bundleSizeProjectRow,
     sortRows: bundleSizeSortRows,
@@ -239,6 +257,7 @@ const KIND_MODULES = Object.freeze({
   duplication: bindKindModule({
     name: duplicationName,
     keyField: duplicationKeyField,
+    rowIdentity: duplicationRowIdentity,
     kernelVersion: duplicationKernelVersion,
     projectRow: duplicationProjectRow,
     sortRows: duplicationSortRows,

package/.agents/scripts/lib/baselines/kinds/bundle-size.js

@@ -28,6 +28,18 @@ export function projectRow(row) {
   };
 }
 
+/**
+ * Canonical row identity (Story #5215). This kind does not use the shared
+ * factory scaffold, so it declares the protocol member itself; `bundle` is
+ * unique per row here, which a shipped-baseline injectivity test pins.
+ *
+ * @param {{bundle: string, rawKb: number, gzippedKb: number}} row
+ * @returns {string}
+ */
+export function rowIdentity(row) {
+  return row.bundle;
+}
+
 export function sortRows(rows) {
   return [...rows].sort((a, b) => a.bundle.localeCompare(b.bundle));
 }

package/.agents/scripts/lib/baselines/kinds/coverage.js

@@ -61,6 +61,7 @@ function perfectCoverageRow(path) {
 
 export const {
   kernelVersion,
+  rowIdentity,
   sortRows,
   rollup,
   compare,

package/.agents/scripts/lib/baselines/kinds/crap.js

@@ -242,14 +242,30 @@ export const rollup = makeRollup({ aggregate });
  * No I/O. No process exit. No friction emission.
  */
 export const compare = makeCompare({
-  identity: crapRowKey,
+  identity: rowIdentity,
   betterIsHigher: false,
   metricField: 'crap',
   // Removed methods whose crap > 0 are improvements (the debt is gone).
   removedIsImprovement: (b) => (b.crap ?? 0) > 0,
 });
 
-function crapRowKey(row) {
+/**
+ * Canonical CRAP row identity (Story #5215) — the composite
+ * `path::method@startLine`, exported under the protocol name every kind
+ * module answers to.
+ *
+ * This kind is the reason identity is a separate concept from `keyField`.
+ * `keyField` is `'path'` because the rollup groups by file, but a file
+ * ships one row per method, so a merge keyed on `keyField` would collapse
+ * every method in a file to one row and drop the rest. `compare`,
+ * `applyEpsilon` and `mergeRows` have always keyed on this composite;
+ * exporting it makes the same identity available to callers that used to
+ * have no choice but to guess from `keyField`.
+ *
+ * @param {{path: string, method: string, startLine: number}} row
+ * @returns {string}
+ */
+export function rowIdentity(row) {
   return `${row.path}::${row.method}@${row.startLine}`;
 }
 
@@ -258,7 +274,7 @@ function crapRowKey(row) {
 // absorbed the per-file queue wiring, both callers are inside it, so the
 // exports — and the re-export that used to live here — were reachable from
 // tests alone. `resolveIncrementalContext` is the production door to the
-// index; `crapRowKey` above is the composite key it halves.
+// index; `rowIdentity` above is the composite key it halves.
 
 /**
  * Pure stabilizer for s-stability-epsilon (Story #1964). CRAP rows match
@@ -271,7 +287,7 @@ function crapRowKey(row) {
  * @returns {Array<object>}
  */
 export const applyEpsilon = makeEpsilon({
-  identity: crapRowKey,
+  identity: rowIdentity,
   metricField: 'crap',
 });
 
@@ -294,7 +310,7 @@ export function mergeRows(prior, regenerated, scope) {
     regenerated,
     scope,
     scopeKey: (row) => row.path,
-    identity: (row) => crapRowKey(row),
+    identity: (row) => rowIdentity(row),
   });
 }
 

package/.agents/scripts/lib/baselines/kinds/duplication.js

@@ -89,6 +89,7 @@ function roundTo2(value) {
 
 export const {
   kernelVersion,
+  rowIdentity,
   sortRows,
   rollup,
   compare,

package/.agents/scripts/lib/baselines/kinds/kind-factory.js

@@ -38,7 +38,10 @@ import { mergeRowsByScope } from '../scope.js';
  *     | { kind: 'improvement-when', when: (row: object) => boolean },
  *   perfectRow?: (key: string) => object,
  * }} opts
- *   - `keyField`          — row identity property (`'path'` or `'route'`)
+ *   - `keyField`          — row grouping property (`'path'` or `'route'`):
+ *                           the rollup/scope key. The generated
+ *                           `rowIdentity` derives from it, but the two are
+ *                           distinct concepts — see `rowIdentity` below.
  *   - `kernelVersion`     — static semver, or a thunk for kinds that pin
  *                           to another kind's kernel (MI → CRAP)
  *   - `axes`              — metric property names compared per row
@@ -57,6 +60,7 @@ import { mergeRowsByScope } from '../scope.js';
  *   - `perfectRow`        — builds the perfect row for the policies above
  * @returns {{
  *   kernelVersion: () => string,
+ *   rowIdentity: (row: object) => string,
  *   sortRows: (rows: object[]) => object[],
  *   rollup: (rows: object[], components?: object[]) => Record<string, object>,
  *   compare: (head: object, base: object) => object,
@@ -78,6 +82,26 @@ export function makeBaselineKind({
   const kernelVersionFn =
     typeof kernelVersion === 'function' ? kernelVersion : () => kernelVersion;
 
+  /**
+   * Canonical row identity (Story #5215) — the string a 3-way merge keys a
+   * row on, and the contract every kind module must satisfy.
+   *
+   * Deliberately a separate concept from `keyField`, even though the five
+   * scaffold kinds derive one from the other. `keyField` answers "which
+   * component does this row roll up into", so a kind is free to declare a
+   * grouping key coarser than a row (CRAP declares `'path'` while shipping
+   * one row per method). Identity answers "is this the same row", and a
+   * merge that confuses the two silently drops every sibling sharing a key.
+   * Callers therefore read `rowIdentity` off the kind module and never
+   * rebuild a key from `keyField` themselves.
+   *
+   * @param {object} row
+   * @returns {string}
+   */
+  function rowIdentity(row) {
+    return String(keyOf(row));
+  }
+
   function sortRows(rows) {
     return [...rows].sort((a, b) => keyOf(a).localeCompare(keyOf(b)));
   }
@@ -183,6 +207,7 @@ export function makeBaselineKind({
 
   return {
     kernelVersion: kernelVersionFn,
+    rowIdentity,
     sortRows,
     rollup,
     compare,

package/.agents/scripts/lib/baselines/kinds/lighthouse.js

@@ -69,6 +69,7 @@ function perfectLighthouseRow(route) {
 
 export const {
   kernelVersion,
+  rowIdentity,
   sortRows,
   rollup,
   compare,

package/.agents/scripts/lib/baselines/kinds/lint.js

@@ -67,6 +67,18 @@ export function projectRow(row) {
   };
 }
 
+/**
+ * Canonical row identity (Story #5215). This kind does not use the shared
+ * factory scaffold, so it declares the protocol member itself; `path` is
+ * unique per row here, which a shipped-baseline injectivity test pins.
+ *
+ * @param {{path: string, errorCount: number, warningCount: number}} row
+ * @returns {string}
+ */
+export function rowIdentity(row) {
+  return row.path;
+}
+
 export function sortRows(rows) {
   return [...rows].sort((a, b) => a.path.localeCompare(b.path));
 }

package/.agents/scripts/lib/baselines/kinds/maintainability.js

@@ -109,6 +109,7 @@ function aggregate(rows) {
 
 export const {
   kernelVersion,
+  rowIdentity,
   sortRows,
   rollup,
   compare,

package/.agents/scripts/lib/baselines/kinds/mutation.js

@@ -178,6 +178,7 @@ function aggregate(rows) {
 
 export const {
   kernelVersion,
+  rowIdentity,
   sortRows,
   rollup,
   compare,