D-161: zero coverage is not a clean pass — Clojure gap names + -require-project

[MoSLoF]

What

Closes the D-161 candidate from the 2026-08-28 swytchdb live scan: swytch.jepsen — a Leiningen project whose project.clj declares org.postgresql:postgresql@42.7.4 (3 real advisories) — produced no supported projects found (nothing to scan) at exit 0, with -fail-on-incomplete set.

Verification narrowed the diagnosis

The report framed this as "-fail-on-incomplete passes the zero-coverage case." That's half right. Reproduced live before writing any code:

• The D-59 machinery already works: a recognized-but-unresolvable manifest (e.g. a bare pom.xml) is disclosed as incomplete coverage and exits 3 under -fail-on-incomplete today. The jepsen miss was two absent table entries — project.clj and deps.edn were simply not in gapManifestByName.
• The genuinely open shape was a directory with no recognized manifest at all: its clean exit is deliberate (a full-send sweep must not fail on an empty or unsupported-only repo), but for a CI job pointed at a repo that must contain a project, a deleted/renamed manifest is indistinguishable from a clean pass.

Fix — two parts matching the two shapes

1. Gap tables: project.clj (leiningen) and deps.edn (clojure) join the exact-name table (.clj/.edn are general extensions, so name-only per the OPU-18 dedication rule). A jepsen-shaped repo now discloses as incomplete coverage, emits a real JSON verdict (previously: no output at all — the report's third ask, satisfied by flowing through the normal pipeline), and fails -fail-on-incomplete at exit 3.
2. -require-project (opt-in): zero discovered projects fails the run at exit 3 instead of the clean nothing-to-scan pass, in both recursive and -no-recursive modes. Defaults unchanged: sweeps still cross empty repos clean, and -fail-on-incomplete alone still passes a genuinely empty directory, because nothing was expected there.

Validation

• Two-sided CLI tests (d161_zero_coverage_test.go): jepsen shape ungated (disclosed, exit 0) and gated (exit 3); empty dir clean by default and under -fail-on-incomplete, exit 3 under -require-project in both modes; -require-project passes on a real project.
• Mutation-checked: reverting the two fix files fails all three new tests.
• Live-fired through the built binary on the original repro directories, same results.
• Full suite green (34 packages), -race clean on touched packages, gofmt/vet silent.
• D-161 entry appended to docs/DECISIONS.md.

Not included (deliberate)

• Homebrew formulae: a distribution-integrity surface, not a dependency manifest; .rb is any Ruby source, so this needs real formula parsing, not a name-table entry. Left as the narrower ask the report itself judged it.
• Actually parsing Maven/Clojars manifests: ecosystem work of a different size — the declared deps still aren't resolved against OSV, they're now disclosed as unread instead of silently skipped. Backlog item.

---

🤖 Generated with Claude Code

---

Generated by Claude Code