@erclx/canon 4.70.0 → 4.72.0

package/src/commands/pr.ts

@@ -6,7 +6,11 @@ import { execa } from 'execa'
 import { gitEnv } from '@/git-env'
 import {
   listChangedFiles,
+  listIgnoreAdditions,
+  listRenames,
   listRepositoryFiles,
+  parseIgnoreAdditions,
+  type RenamePair,
   resolveBaseRef,
 } from '@/git-files'
 import {
@@ -292,6 +296,9 @@ interface PullRequestRead {
   readonly changed: readonly string[]
   readonly head: string | undefined
   readonly number: number | undefined
+  readonly renames: readonly RenamePair[]
+  readonly ignoreAdditions: readonly string[]
+  readonly evidenceUnread: boolean
 }
 
 type SourceRead =
@@ -349,13 +356,26 @@ async function readFromApi(
       return { kind: 'refused', reason: 'gh-truncated' }
     }
 
+    const body = row.body ?? ''
+    const sorted = [...changed].sort()
+    const evidence = await resolveApiEvidence(
+      cwd,
+      body,
+      sorted,
+      row.headRefOid,
+      row.number,
+    )
+
     return {
       kind: 'read',
       source: {
-        body: row.body ?? '',
-        changed: [...changed].sort(),
+        body,
+        changed: sorted,
         head: row.headRefOid,
         number: row.number,
+        renames: evidence.renames,
+        ignoreAdditions: evidence.ignoreAdditions,
+        evidenceUnread: evidence.unread,
       },
     }
   } catch {
@@ -363,6 +383,95 @@ async function readFromApi(
   }
 }
 
+/**
+ * A rename's source path and a `.gitignore` addition, fetched only when a
+ * first pass with neither already reports an unmet claim.
+ *
+ * The probe pays for a repository listing this read takes again a moment
+ * later in `runKeyChanges`, and the `gh api …/files` call besides it only on
+ * the pass that already has something to double-check, the same trade the
+ * `gh-truncated` pagination fallback makes.
+ *
+ * `unread` separates a read that failed from one that succeeded and found
+ * neither, which an empty `renames`/`ignoreAdditions` cannot do on its own.
+ * `listFilesByPage` above refuses the whole comparison on exactly this
+ * ground: a set known to be short would let a correct bullet accuse a file
+ * nobody changed. This carries the same refusal as a flag rather than a
+ * refused `Bijection`, since the base comparison can still run and most
+ * claims never touch a rename or a `.gitignore` line at all.
+ */
+async function resolveApiEvidence(
+  cwd: string,
+  body: string,
+  changed: readonly string[],
+  head: string | undefined,
+  number: number | undefined,
+): Promise<{
+  readonly renames: readonly RenamePair[]
+  readonly ignoreAdditions: readonly string[]
+  readonly unread: boolean
+}> {
+  const clean = { renames: [], ignoreAdditions: [], unread: false }
+  const unread = { renames: [], ignoreAdditions: [], unread: true }
+
+  const tracked = await listRepositoryFiles(cwd)
+  if (tracked === undefined) return unread
+
+  const probe = compareKeyChanges({
+    body,
+    changed,
+    roots: treeRoots(tracked, changed),
+    ...(head !== undefined && { head }),
+  })
+  // A refusal here means there is no claim to credit at all, and a clean
+  // pass means every claim already resolved without the extra evidence, so
+  // neither case leaves anything for unread evidence to have mattered to.
+  if (probe.kind !== 'measured' || probe.unmet.length === 0) return clean
+
+  // Only past this point does a missing pull request number become a real
+  // gap: there is a claim the probe could not credit, and no number to fetch
+  // the evidence that might explain it.
+  if (number === undefined) return unread
+
+  // No `--jq` filter here, unlike `listFilesByPage` above. Shaping each row to
+  // {filename, previous_filename, status, patch} would make `--paginate`
+  // concatenate one filtered value per page rather than one combined array,
+  // and gh's own pretty-printing of an object result (unlike the scalar
+  // strings `--jq '.[].filename'` yields) is not guaranteed to stay
+  // line-parseable. Parsing the raw paginated array is safe under both.
+  const stdout = await gh(cwd, [
+    'api',
+    '--paginate',
+    `repos/{owner}/{repo}/pulls/${number}/files`,
+  ])
+  if (stdout === null) return unread
+
+  let rows: readonly {
+    readonly filename: string
+    readonly previous_filename?: string
+    readonly status: string
+    readonly patch?: string
+  }[]
+  try {
+    rows = JSON.parse(stdout)
+  } catch {
+    return unread
+  }
+
+  const renames = rows
+    .filter(
+      (row): row is typeof row & { previous_filename: string } =>
+        row.status === 'renamed' && row.previous_filename !== undefined,
+    )
+    .map((row) => ({ from: row.previous_filename, to: row.filename }))
+
+  const ignoreRow = rows.find((row) => row.filename === '.gitignore')
+  const ignoreAdditions =
+    ignoreRow?.patch !== undefined ? parseIgnoreAdditions(ignoreRow.patch) : []
+
+  return { renames, ignoreAdditions, unread: false }
+}
+
 /**
  * Every file a pull request changed, read through the paginated endpoint.
  *
@@ -430,10 +539,11 @@ async function readFromFile(
     return { kind: 'refused', reason: 'unreadable-changes' }
   }
 
-  const head = await $`git -C ${root} rev-parse HEAD`
-    .env(gitEnv())
-    .quiet()
-    .nothrow()
+  const [head, renames, ignoreAdditions] = await Promise.all([
+    $`git -C ${root} rev-parse HEAD`.env(gitEnv()).quiet().nothrow(),
+    listRenames(root, resolved),
+    listIgnoreAdditions(root, resolved),
+  ])
 
   return {
     kind: 'read',
@@ -442,6 +552,9 @@ async function readFromFile(
       changed,
       head: head.exitCode === 0 ? head.text().trim() : undefined,
       number: undefined,
+      renames: renames ?? [],
+      ignoreAdditions: ignoreAdditions ?? [],
+      evidenceUnread: renames === undefined || ignoreAdditions === undefined,
     },
   }
 }
@@ -469,6 +582,9 @@ async function runKeyChanges(
     body: source.source.body,
     changed: source.source.changed,
     roots: treeRoots(tracked, source.source.changed),
+    renames: source.source.renames,
+    ignoreAdditions: source.source.ignoreAdditions,
+    evidenceUnread: source.source.evidenceUnread,
     ...(source.source.head !== undefined && { head: source.source.head }),
   })
 
@@ -480,6 +596,11 @@ async function runKeyChanges(
       report.head === undefined ? '' : ` at ${report.head.slice(0, 8)}`
     }`,
   )
+  if (report.evidenceUnread) {
+    logWarn(
+      'Rename or .gitignore-addition evidence could not be read, so a claim it might have credited or accused landed in unresolved rather than unmet.',
+    )
+  }
 
   logStep(report.unmet.length === 0 ? 'Claimed' : 'Unmet')
   if (report.unmet.length === 0) {
@@ -545,6 +666,7 @@ async function runKeyChanges(
         unnamed: report.unnamed,
         incidental: report.incidental,
         unresolved: report.unresolved,
+        evidenceUnread: report.evidenceUnread,
       })}\n`,
     )
   }

package/src/commands/tasks.ts

@@ -14,6 +14,12 @@ import {
   planCitations,
 } from '@/tasks/archive'
 import { type LabelOutcome, nextLabel } from '@/tasks/label'
+import {
+  type Claim,
+  type Holder,
+  planReach,
+  type ReachOutcome,
+} from '@/tasks/reach'
 import {
   type CloseOutcome,
   closeOutcomes,
@@ -84,6 +90,12 @@ interface BranchCommandOptions {
   readonly root?: string
 }
 
+interface ReachCommandOptions {
+  readonly base?: string
+  readonly json?: boolean
+  readonly root?: string
+}
+
 interface PullRequestCommandOptions {
   readonly json?: boolean
   readonly plan?: string
@@ -326,6 +338,45 @@ export function register(program: Command): void {
       process.exitCode = await runBranch(plan, opts)
     })
 
+  tasks
+    .command('plan-reach')
+    .description('Read a branch back against what was declared about it')
+    .argument('<plan>', 'Plan path or its slug, as in dispatch-answer-gate')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--base <ref>', 'Far side of the range, defaulting to the trunk')
+    .option('--json', 'Emit a machine-readable record on stdout')
+    .option('--root <path>', 'Board root, defaulting to the main worktree')
+    .addHelpText(
+      'after',
+      [
+        '',
+        'Exit codes:',
+        '  0  the reach was read and no other track claims a changed path',
+        '  1  refused as no-plan, archived, bad-input, no-base, or no-diff',
+        '  2  read, and another live plan or Run now row claims a path',
+        '',
+        'It reports claimed first and undeclared second. A claimed path is one',
+        'another track holds and is the half worth acting on; an undeclared one',
+        'is a path this plan never named, which the ship chain writes on nearly',
+        'every branch. It reports and never gates, so branch on the record',
+        'rather than on the exit code, which a shell function wrapping canon',
+        'can flatten to zero.',
+        '',
+        'The range is read at the current directory and the plans and board at',
+        'the board root, so a linked worktree reads its own branch against the',
+        'shared records. It reads only what is written down, so the plan and',
+        'row counts say how much was there to compare against.',
+        '',
+        'Examples:',
+        '  canon tasks plan-reach dispatch-answer-gate',
+        '  canon tasks plan-reach dispatch-answer-gate --base origin/main --json',
+        '',
+      ].join('\n'),
+    )
+    .action(async (plan: string, opts: ReachCommandOptions) => {
+      process.exitCode = await runReach(plan, opts)
+    })
+
   tasks
     .command('pull-request')
     .description('Record a pull request number on the task a branch closes')
@@ -961,6 +1012,109 @@ function reportBranch(
   return EXIT_FINDINGS
 }
 
+async function runReach(
+  plan: string,
+  opts: ReachCommandOptions,
+): Promise<number> {
+  const root = opts.root ?? (await mainWorktreeRoot())
+  // The range belongs to the checkout the caller stands in, which is the linked
+  // worktree holding the branch on every dispatched run. The board root is the
+  // main worktree, where reading a range measures the trunk against itself.
+  const outcome = await planReach(root, plan, {
+    repo: process.cwd(),
+    ref: opts.base,
+  })
+
+  return reportReach(outcome, opts.json ?? false, root)
+}
+
+/**
+ * Names a holder, the declaration it matched on when that is wider than the
+ * path, and whether a holding plan carries a dispatch row. A plan with no row
+ * is the shape a plan nobody archived takes, which is what sends a reader to
+ * check the holder rather than treating the claim as a live collision.
+ */
+function describeHolder(claim: Claim, holder: Holder): string {
+  const under =
+    holder.declaration === claim.path ? '' : `, under ${holder.declaration}`
+  const rowed = holder.source === 'plan' && !holder.rowed ? ', no row' : ''
+
+  return `${holder.name} (${holder.source}${under}${rowed})`
+}
+
+function describeReachClaim(claim: Claim): string {
+  const holders = claim.holders
+    .map((holder) => describeHolder(claim, holder))
+    .join(' and ')
+
+  return `${claim.path} is held by ${holders}`
+}
+
+/**
+ * Leads with the claimed list because it is the short one. Over the wave this
+ * verb was filed against, undeclared paths ran 22 of 26 on one branch and 18 of
+ * 25 on another, so a report opening on that list is noise a reader skips past
+ * and the crossing underneath it goes with them.
+ */
+function reportReach(
+  outcome: ReachOutcome,
+  emitJson: boolean,
+  root: string,
+): number {
+  if (!outcome.ok) {
+    if (emitJson) {
+      process.stdout.write(
+        `${JSON.stringify({ ok: false, reason: outcome.reason, message: outcome.message })}\n`,
+      )
+      return 1
+    }
+
+    intro('canon tasks plan-reach')
+    logStep('Refused')
+    logError(outcome.message)
+    outro()
+    return 1
+  }
+
+  if (emitJson) {
+    process.stdout.write(`${JSON.stringify({ ...outcome, root })}\n`)
+    return outcome.claimed.length === 0 ? 0 : EXIT_FINDINGS
+  }
+
+  intro('canon tasks plan-reach')
+
+  logStep(outcome.claimed.length === 0 ? 'Uncontested' : 'Claimed')
+  if (outcome.claimed.length === 0) {
+    logInfo('no other live plan or Run now row holds a path this branch wrote')
+  } else {
+    for (const claim of outcome.claimed) logWarn(describeReachClaim(claim))
+  }
+
+  logStep('Undeclared')
+  if (outcome.undeclared.length === 0) {
+    logInfo(
+      `${outcome.plan} declared every one of the ${outcome.changed} paths`,
+    )
+  } else {
+    for (const path of outcome.undeclared) logInfo(path)
+    logInfo(
+      `${outcome.undeclared.length} of ${outcome.changed} path(s) this plan did not name, which the ship chain's own steps account for on most branches`,
+    )
+  }
+
+  // The counts are the report's own bound. A verb reading what is written down
+  // sees no hand-launched track and no track without a plan, so a clear reading
+  // over nothing compared against would otherwise read as a proof.
+  logStep('Compared against')
+  logInfo(
+    `${outcome.plans} other live plan(s) and ${outcome.rows} Run now row(s)${outcome.board ? '' : ', with no board on disk to read'}`,
+  )
+
+  outro()
+
+  return outcome.claimed.length === 0 ? 0 : EXIT_FINDINGS
+}
+
 function reportValidation(
   outcome: ValidateOutcome,
   emitJson: boolean,

package/src/commands/teach.ts

@@ -384,6 +384,7 @@ async function runStylesheet(
         root,
         slug: outcome.slug,
         path: outcome.path,
+        basePath: outcome.basePath,
         written: outcome.written,
       })}\n`,
     )
@@ -393,6 +394,7 @@ async function runStylesheet(
   intro('canon teach stylesheet')
   logStep(outcome.written ? 'Written' : 'Already present, left alone')
   logInfo(outcome.path)
+  logInfo(outcome.basePath)
   outro()
   return 0
 }

package/src/gate/measures.ts

@@ -708,6 +708,72 @@ export const readmeCitations: Measure = async (ctx) => {
   }
 }
 
+/**
+ * `deploy-site.yml` and `pr-visual-checks.yml` each carry their own literal
+ * copy of the eight path globs a landing-page change should trigger on, per
+ * Question 2 in `.canon/plans/archive/feature-render-visibility.md`. A YAML
+ * anchor cannot cross files here, so the two copies are read live and compared
+ * rather than one asserting a literal the other could drift behind unnoticed,
+ * mirroring how `web/e2e/home.spec.ts`'s rule-group test already reads live.
+ */
+export const visualPathGlobs: Measure = async (ctx) => {
+  const deployPath = '.github/workflows/deploy-site.yml'
+  const visualPath = '.github/workflows/pr-visual-checks.yml'
+  const deployFile = join(ctx.root, deployPath)
+  const visualFile = join(ctx.root, visualPath)
+
+  if (!existsSync(deployFile) || !existsSync(visualFile)) {
+    return {
+      emissions: [],
+      unmeasured: `${deployPath} or ${visualPath} is absent, so no path list was compared.`,
+    }
+  }
+
+  const deploy = Bun.YAML.parse(readFileSync(deployFile, 'utf8')) as {
+    readonly on?: { readonly push?: { readonly paths?: readonly string[] } }
+  }
+  const visual = Bun.YAML.parse(readFileSync(visualFile, 'utf8')) as {
+    readonly on?: {
+      readonly pull_request?: { readonly paths?: readonly string[] }
+    }
+  }
+
+  const deployPaths = deploy.on?.push?.paths ?? []
+  const visualPaths = visual.on?.pull_request?.paths ?? []
+
+  if (deployPaths.length === 0 || visualPaths.length === 0) {
+    return {
+      emissions: [],
+      unmeasured: `${deployPath} or ${visualPath} carries no path list to compare.`,
+    }
+  }
+
+  const onlyDeploy = deployPaths.filter((path) => !visualPaths.includes(path))
+  const onlyVisual = visualPaths.filter((path) => !deployPaths.includes(path))
+
+  if (onlyDeploy.length === 0 && onlyVisual.length === 0) {
+    return {
+      emissions: [
+        info(
+          `${deployPaths.length} path glob(s) agree between ${deployPath} and ${visualPath}`,
+        ),
+      ],
+    }
+  }
+
+  return {
+    emissions: [
+      ...onlyDeploy.map((path) =>
+        warn(`${deployPath} carries ${path}, absent from ${visualPath}`),
+      ),
+      ...onlyVisual.map((path) =>
+        warn(`${visualPath} carries ${path}, absent from ${deployPath}`),
+      ),
+    ],
+    failure: `${deployPath} and ${visualPath} carry different path globs. Bring the two lists back into agreement.`,
+  }
+}
+
 /**
  * `canon sandbox coverage` moves only when a person runs it, so a scenario added
  * with no expectation ships unnoticed.

package/src/gate/stages.ts

@@ -12,6 +12,7 @@ import {
   shippedReferences,
   standardCriteria,
   unreferencedRules,
+  visualPathGlobs,
 } from '@/gate/measures'
 import { SHIPPED_CORPORA } from '@/shipped/references'
 
@@ -424,6 +425,16 @@ export const STAGES: readonly Stage[] = [
     skipped: 'Neither copy.ts nor README.md changed, so no citation was read',
     checks: [{ kind: 'measure', measure: readmeCitations }],
   },
+  {
+    // Scoped to the two files carrying the literal path-glob copy, so an edit
+    // to either one runs the check.
+    id: 'visual-path-globs',
+    label: 'Visual check path globs',
+    scope: /^\.github\/workflows\/(deploy-site|pr-visual-checks)\.yml$/,
+    skipped:
+      'Neither deploy-site.yml nor pr-visual-checks.yml changed, so no path list was compared',
+    checks: [{ kind: 'measure', measure: visualPathGlobs }],
+  },
   {
     id: 'seed-standards',
     label: 'Seed standards',

package/src/git-files.ts

@@ -68,6 +68,75 @@ export async function listChangedFiles(
   return [...new Set(paths.filter(Boolean))].sort()
 }
 
+/** A file's old and new path across a git-detected rename. */
+export interface RenamePair {
+  readonly from: string
+  readonly to: string
+}
+
+/**
+ * Every rename `base..working tree` carries, read through the same similarity
+ * detection `git diff -M` applies by default (50%).
+ *
+ * A move heavy enough on rewritten content to fall under that floor reports
+ * as a plain delete and add rather than a rename, which is not a defect this
+ * reads around: the diff genuinely does not carry the file a claim citing the
+ * old path describes.
+ *
+ * Returns undefined when git cannot answer, matching `listChangedFiles`.
+ */
+export async function listRenames(
+  root: string,
+  base: string,
+): Promise<RenamePair[] | undefined> {
+  const output = await git(root, ['diff', '--name-status', '-M', base])
+  if (output === undefined) return undefined
+
+  const renames: RenamePair[] = []
+  for (const line of output.split('\n')) {
+    if (line === '') continue
+    const [status, from, to] = line.split('\t')
+    if (status === undefined || !status.startsWith('R')) continue
+    if (from === undefined || to === undefined) continue
+    renames.push({ from, to })
+  }
+  return renames
+}
+
+/**
+ * Added, non-comment lines from a unified diff hunk touching `.gitignore`.
+ *
+ * Shared between a local `git diff` and a patch string GitHub returns inline
+ * for the same file, so the two evidence sources read one pattern the same
+ * way.
+ */
+export function parseIgnoreAdditions(diffText: string): string[] {
+  const patterns: string[] = []
+  for (const line of diffText.split('\n')) {
+    if (!line.startsWith('+') || line.startsWith('+++')) continue
+    const pattern = line.slice(1).trim()
+    if (pattern === '' || pattern.startsWith('#')) continue
+    patterns.push(pattern)
+  }
+  return patterns
+}
+
+/**
+ * Every pattern a branch added to `.gitignore` since `base`.
+ *
+ * `-U0` keeps the hunk to changed lines alone, which is all a claim needs.
+ *
+ * Returns undefined when git cannot answer, matching `listChangedFiles`.
+ */
+export async function listIgnoreAdditions(
+  root: string,
+  base: string,
+): Promise<string[] | undefined> {
+  const output = await git(root, ['diff', '-U0', base, '--', '.gitignore'])
+  if (output === undefined) return undefined
+  return parseIgnoreAdditions(output)
+}
+
 /**
  * Lists the files under `root`: tracked, plus untracked files git does not
  * ignore. The untracked half is what keeps a file added on this branch in scope

package/src/migrate/skill-names.ts

@@ -24,6 +24,16 @@ import { defineRenameRules, type RenameRules } from '@/migrate/rename'
  * Every name takes two words. Ten of these would have landed as a bare single
  * word under a plain strip, and a bare word such as `review` or `docs` is a
  * substring of ordinary prose with no token left for a later sweep to find.
+ *
+ * No bare single-word name may ever join this map, whatever prefix it would
+ * otherwise take. `wholeToken: true` below matches a standalone word rather
+ * than a namespaced compound, so a one-word key rewrites every unrelated use
+ * of that word too. `identity` proved it: a dry run against a fifth row
+ * reading `'identity': 'draft-identity'` reported 112 occurrences across 43
+ * files, most of them a variable, field, or type name spelling the bare word
+ * rather than the skill, including `readonly identity: SelfIdentity` at
+ * `src/sessions/resolve.ts:255`, which the rewrite would have turned into
+ * invalid TypeScript. The row was never added.
  */
 export const SKILL_NAME_MAP: Readonly<Record<string, string>> = {
   'claude-address-review': 'review-address',

package/src/pr/bijection.ts

@@ -1,3 +1,4 @@
+import type { RenamePair } from '@/git-files'
 import { extractKeyChangePaths, KEY_CHANGES, type PathClaim } from '@/pr/paths'
 
 /**
@@ -53,6 +54,14 @@ export interface BijectionReport {
    * branch author.
    */
   readonly incidental: readonly string[]
+  /**
+   * True when the rename or `.gitignore`-addition evidence could not be read.
+   *
+   * A claim `unmet` would otherwise carry is downgraded to `unresolved`
+   * instead, since the unread evidence might have credited it and this
+   * comparison has no way to tell a stale claim from one it could not check.
+   */
+  readonly evidenceUnread: boolean
 }
 
 export type Bijection =
@@ -66,6 +75,20 @@ export interface BijectionInput {
   readonly roots: ReadonlySet<string>
   readonly head?: string
   readonly title?: string
+  /** A rename's source path credits a claim naming it, without ever counting as a changed file. */
+  readonly renames?: readonly RenamePair[]
+  /** A pattern newly added to `.gitignore`, crediting a claim naming it as the `.gitignore` change it is. */
+  readonly ignoreAdditions?: readonly string[]
+  /**
+   * True when the caller could not read the rename or ignore-addition
+   * evidence, rather than reading it and finding neither.
+   *
+   * The two states produce the same empty `renames`/`ignoreAdditions`, so
+   * this is the only way `compareKeyChanges` can tell a claim that is
+   * genuinely stale from one the evidence might have credited had the read
+   * succeeded.
+   */
+  readonly evidenceUnread?: boolean
 }
 
 /**
@@ -94,6 +117,28 @@ function owesNoBullet(path: string): boolean {
   return INCIDENTAL.some((pattern) => pattern.test(path))
 }
 
+/** Drops a directory claim's trailing slash so it compares against a raw `.gitignore` pattern. */
+function withoutTrailingSlash(path: string): string {
+  return path.endsWith('/') ? path.slice(0, -1) : path
+}
+
+/**
+ * Whether a claim names a pattern newly added to `.gitignore`.
+ *
+ * Compared with the trailing slash both sides may or may not carry stripped,
+ * since a bullet spells a folder pattern the way `.gitignore` itself does
+ * (`web/screenshots/`) and the diff line carries the identical text.
+ */
+function coversIgnoreAddition(
+  claim: PathClaim,
+  ignoreAdditions: readonly string[],
+): boolean {
+  const named = withoutTrailingSlash(claim.path)
+  return ignoreAdditions.some(
+    (pattern) => withoutTrailingSlash(pattern) === named,
+  )
+}
+
 /**
  * Whether one changed path is the file, or a file under the folder, a claim
  * names.
@@ -147,6 +192,10 @@ export function compareKeyChanges(input: BijectionInput): Bijection {
     return { kind: 'refused', reason: 'no-section' }
   if (read.claims.length === 0) return { kind: 'refused', reason: 'no-claims' }
 
+  const renames = input.renames ?? []
+  const ignoreAdditions = input.ignoreAdditions ?? []
+  const evidenceUnread = input.evidenceUnread ?? false
+
   const unmet: PathClaim[] = []
   const unresolved: PathClaim[] = []
   const named = new Set<string>()
@@ -155,7 +204,15 @@ export function compareKeyChanges(input: BijectionInput): Bijection {
     const hits = input.changed.filter((path) => covers(claim, path))
     for (const path of hits) named.add(path)
     if (hits.length > 0) continue
-    if (claim.anchored && claim.leading) unmet.push(claim)
+
+    if (renames.some((rename) => covers(claim, rename.from))) continue
+
+    if (coversIgnoreAddition(claim, ignoreAdditions)) {
+      named.add('.gitignore')
+      continue
+    }
+
+    if (claim.anchored && claim.leading && !evidenceUnread) unmet.push(claim)
     else unresolved.push(claim)
   }
 
@@ -170,6 +227,7 @@ export function compareKeyChanges(input: BijectionInput): Bijection {
     unresolved,
     unnamed: reached.filter((path) => !owesNoBullet(path)),
     incidental: reached.filter(owesNoBullet),
+    evidenceUnread,
   }
 }