@williamthorsen/nmr 0.39.0 → 0.40.0

package/dist/esm/vitest-source-resolution.d.ts

@@ -1,10 +1,10 @@
 import type { Plugin } from 'vite';
 /**
- * Builds the plugin that resolves a package's `source` export condition, for a package whose files sit outside
+ * Builds the plugin that resolves a package's `source` export condition, for a package whose files are outside
  * every `node_modules`.
  *
  * The condition cannot be emitted as a `resolve.conditions` entry instead: Vitest turns the server environment's
- * conditions into `--conditions` flags on the worker process, where Node applies them to every package it
+ * conditions into `--conditions` flags on the worker process, where Node applies them to every package that it
  * resolves natively. Node refuses to strip types from a file under `node_modules`, so a dependency declaring a
  * TypeScript `source` entry fails to load as soon as the condition reaches that far.
  *
@@ -22,16 +22,16 @@ export interface SourceResolutionContext {
     packageDirs?: Map<string, string | undefined>;
 }
 /**
- * Resolves a bare specifier to the file that its package's `source` condition names, or nothing where the condition
- * does not reach it.
+ * Resolves a bare specifier to the file that its package's `source` condition names, or to nothing when the
+ * condition does not reach it.
  *
- * Answers a bare specifier naming a package whose real directory sits outside every `node_modules`. Every other
- * specifier returns nothing -- such as a relative or absolute path, a virtual module, a builtin, or a package under
- * `node_modules` -- so Vite resolves the specifier through its own conditions. Throws where the condition reaches no
- * file, because falling through to the build output is the staleness that resolving from source exists to prevent,
- * and nothing in a run reports it.
+ * Answers a bare specifier naming a package whose real directory is outside every `node_modules`. Returns nothing
+ * for every other specifier -- such as a relative or absolute path, a virtual module, a builtin, or a package under
+ * `node_modules` -- so Vite resolves the specifier through its own conditions. Throws when the condition does not
+ * reach any file, because falling through to the build output is the staleness that resolving from source exists
+ * to prevent, and nothing in a run reports it.
  *
- * A query or hash suffix is split off before the `exports` lookup and re-appended to the resolved path, as Vite
- * does, so `pkg/icon.svg?raw` matches the `./icon.svg` entry and still reaches the plugin that reads the suffix.
+ * Because a query or hash suffix is split off before the `exports` lookup and re-appended to the resolved path, as
+ * Vite does, `pkg/icon.svg?raw` matches the `./icon.svg` entry and still reaches the plugin that reads the suffix.
  */
 export declare function resolveSourceTarget(specifier: string, importer: string | undefined, context: SourceResolutionContext): string | undefined;

package/dist/esm/vitest-source-resolution.js

@@ -114,9 +114,9 @@ function findTargetFile(declaredPath) {
 }
 function formatMissingTarget(name, subpath, declaredTarget, target) {
     return [
-        `Package "${name}" declares a \`source\` export for "${subpath}" at "${declaredTarget}", which reaches no file.`,
+        `Package "${name}" declares a \`source\` export for "${subpath}" at "${declaredTarget}", which does not reach any file.`,
         `Looked for ${target}, the same path under each of ${TARGET_EXTENSIONS.join(', ')}, and an index under it.`,
-        'Point the condition at a file that exists, or remove it so the package resolves through its other conditions.',
+        'Point the condition at a file that exists, or remove it so that the package resolves through its other conditions.',
     ].join(' ');
 }
 function isFile(candidate) {

package/dist/esm/vitest.d.ts

@@ -3,8 +3,8 @@ import type { InlineConfig, ProjectConfig } from 'vitest/node';
 import { type TierName } from './tiers.js';
 export type { TierName } from './tiers.js';
 /**
- * Test options Vitest honours only at the root of a `projects` config. Derived from Vitest's own types rather than
- * hand-listed, so an option that changes scope in a later release changes scope here too.
+ * Test options that Vitest honours only at the root of a `projects` config. Derived from Vitest's own types, so an
+ * option that changes scope in a later release changes scope here too.
  */
 export type RootTestOptions = Omit<InlineConfig, keyof ProjectConfig>;
 /** Root-scoped overrides: Vite-level options plus the test options that survive at the root. */
@@ -16,7 +16,7 @@ export interface VitestConfigOptions {
      * Merged into the root config, which every project inherits because each declares `extends: true`.
      *
      * `resolve` is per-environment. Vitest resolves a test's own imports through the server environment, so a
-     * condition meant for them goes under `ssr`; a top-level `resolve.conditions` entry reaches the client
+     * condition meant for them goes under `ssr`; a top-level `resolve.conditions` entry applies to the client
      * environment, which only browser-mode tests resolve through.
      */
     root?: RootOverrides;
@@ -29,41 +29,42 @@ export interface VitestConfigOptions {
      */
     tiers?: Partial<Record<TierName, ProjectConfig>>;
     /**
-     * Directory basenames kept out of every project's collection, additive to the ones the shared config always
-     * prunes. Each name is matched at any depth, and every layer's entries are concatenated rather than the last
-     * winning, matching the config's rule for arrays.
+     * Directory basenames kept out of every project's collection, additive to the ones that the shared config always
+     * prunes and to the paths that git ignores. Each name is matched at any depth, and every layer's entries are
+     * concatenated rather than the last winning, matching the config's rule for arrays.
      *
      * The same array declares the scope of nmr's exported test-file conventions check, so the sweep and the
      * collection glob cannot drift. Excluding a directory from the sweep alone leaves a test file that runs and
-     * reports nothing; excluding it from collection alone leaves a report a consumer cannot act on. A repo wanting
+     * reports nothing; excluding it from collection alone leaves a report that a consumer cannot act on. A repo wanting
      * a glob rather than a directory name has the `project` seam's own `exclude`.
      */
     testCollectionExclude?: readonly string[];
     /**
-     * Loads nmr's git-isolation setup file into every project, ahead of any the layers supply. Defaults to `true`.
-     * Turn it off only where a suite is meant to read the developer's own git configuration.
+     * Loads nmr's git-isolation setup file into every project, ahead of any that the layers supply. Defaults to `true`.
+     * Turn it off only when a suite is meant to read the developer's own git configuration.
      */
     shouldIsolateGit?: boolean;
     /**
-     * Resolves a package whose files sit outside every `node_modules` through its `source` export condition, so a
-     * suite runs without a prior build. Defaults to `true`. A package declaring no such condition is unaffected,
-     * and so is every package under `node_modules`, which Node resolves and which the condition never reaches.
+     * Resolves a package whose files are outside every `node_modules` through its `source` export condition, so a
+     * suite runs without a prior build. Defaults to `true`. A package that does not declare a `source` condition is
+     * unaffected, and so is every package under `node_modules`, which Node resolves and to which the condition never
+     * applies.
      */
     shouldResolveFromSource?: boolean;
     /**
-     * Resolves a specifier through the `paths` a `tsconfig.json` declares, so a test reaches an alias the way `tsc`
-     * does. Defaults to `false`, matching Vite, and requires Vite 8.
+     * Resolves a test's aliased specifier through the `paths` that a `tsconfig.json` declares, the way `tsc` does.
+     * Defaults to `false`, matching Vite, and requires Vite 8.
      *
-     * Not a default, because both directions are safe to leave to the consumer: omitting it fails loudly with an
-     * unresolved import, while turning it on for a repo that declares `paths` for `tsc` alone changes which module a
-     * specifier reaches with nothing in the run reporting it. A repo declaring no `paths` is unaffected either way.
+     * Without it, an alias fails loudly as an unresolved import. With it, a repo that declares `paths` for `tsc` alone
+     * changes which module a specifier reaches, and nothing in the run reports the change. A repo that does not declare
+     * `paths` is unaffected either way.
      */
     tsconfigPaths?: boolean;
 }
 export interface RootVitestConfigOptions extends VitestConfigOptions {
     /**
-     * An absolute path to the monorepo root, which must hold `pnpm-workspace.yaml`. A root config sits at that
-     * directory by construction, so this is `import.meta.dirname`. Stated rather than searched for: resolving it
+     * An absolute path to the monorepo root, which must contain `pnpm-workspace.yaml`. A root config is in that
+     * directory by construction, so this is `import.meta.dirname`. Stated rather than searched for: Resolving it
      * from the working directory would make the config describe whichever monorepo the run happened to start in.
      */
     monorepoRoot: string;
@@ -75,18 +76,18 @@ type RootConfigLayers = [...(VitestConfigOptions | undefined)[], RootVitestConfi
  * projects. Select them at run time with `--project`, which unions when repeated and accepts negation.
  *
  * Layers fold left to right, later winning and arrays composing, so a config file shares settings by passing a
- * layer ahead of its own. Merging two of this function's *outputs* is not the way: both declare the same four
+ * layer ahead of its own. Merging two of this function's *outputs* is not the way: Both declare the same four
  * project names, which Vitest rejects at startup.
  *
- * An `undefined` layer is skipped, so `defineVitestConfig(shared, isCI ? ciLayer : undefined)` composes.
+ * An `undefined` layer is skipped, which lets `defineVitestConfig(shared, isCI ? ciLayer : undefined)` compose.
  */
 export declare function defineVitestConfig(...layers: (VitestConfigOptions | undefined)[]): ViteUserConfig;
 /**
  * Builds the shared Vitest config for repo-root tests. Excludes every workspace package from all projects, and
- * reports no coverage of its own — packages cover their own sources.
+ * does not report any coverage of its own; packages cover their own sources.
  *
- * `monorepoRoot` rides on the last layer, which is the config file's own: a shared layer describes settings, not
+ * `monorepoRoot` is set on the last layer, which is the config file's own: A shared layer describes settings, not
  * which repo they belong to, and only the root config's `import.meta.dirname` states this one. The guard below
- * still catches the JavaScript config that types never reach.
+ * still catches the JavaScript config that type checking never covers.
  */
 export declare function defineRootVitestConfig(...layers: RootConfigLayers): ViteUserConfig;

package/dist/esm/vitest.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { defaultExclude, mergeConfig } from 'vitest/config';
+import { listGitIgnoredPaths } from "./git-ignored-paths.js";
 import { isObject } from "./helpers/type-guards.js";
 import { ALL_TEST_PATTERNS, buildTierPatterns, TEST_COLLECTION_EXCLUDE, TIER_NAMES } from "./tiers.js";
 import { createSourceResolutionPlugin } from "./vitest-source-resolution.js";
@@ -13,6 +14,7 @@ const CLIENT_CONDITIONS = ['module', 'browser', 'development|production'];
 const SERVER_CONDITIONS = ['module', 'node', 'development|production'];
 const COVERAGE_EXCLUDE = ['**/__{fixtures,mocks,tests}__/**', '**/index.ts', '**/*.d.ts'];
 const PACKAGE_COVERAGE_INCLUDE = ['**/src/**/*.{ts,tsx}'];
+const GLOB_SYNTAX_PATTERN = /[!()*+?@[\]{}]/g;
 const RECOGNIZED_OPTIONS = {
     project: true,
     root: true,
@@ -32,10 +34,10 @@ const RETIRED_OPTION_KEYS = new Map([
     ['isolateGit', 'shouldIsolateGit'],
     ['resolveFromSource', 'shouldResolveFromSource'],
 ]);
-const MISSING_MONOREPO_ROOT = 'defineRootVitestConfig requires `monorepoRoot`, an absolute path to the directory holding pnpm-workspace.yaml. Pass `import.meta.dirname` in the last options layer, from the root config.';
+const MISSING_MONOREPO_ROOT = 'defineRootVitestConfig requires `monorepoRoot`, an absolute path to the directory that contains pnpm-workspace.yaml. Pass `import.meta.dirname` in the last options layer, from the root config.';
 export function defineVitestConfig(...layers) {
     assertOptionKeys(layers, RECOGNIZED_OPTION_KEYS);
-    return buildConfig(layers, { coverageInclude: PACKAGE_COVERAGE_INCLUDE });
+    return buildConfig(layers, { coverageInclude: PACKAGE_COVERAGE_INCLUDE, ignoredPathsRoot: process.cwd() });
 }
 export function defineRootVitestConfig(...layers) {
     const lastLayer = layers.at(-1);
@@ -46,11 +48,12 @@ export function defineRootVitestConfig(...layers) {
     assertOptionKeys(layers, RECOGNIZED_ROOT_OPTION_KEYS);
     return buildConfig(layers, {
         coverageInclude: [],
+        ignoredPathsRoot: monorepoRoot,
         projectExclude: getWorkspaceExcludePatterns(monorepoRoot),
         projectRoot: monorepoRoot,
     });
 }
-function buildConfig(declaredLayers, { coverageInclude, projectExclude = [], projectRoot }) {
+function buildConfig(declaredLayers, { coverageInclude, ignoredPathsRoot, projectExclude = [], projectRoot }) {
     const layers = declaredLayers.filter((layer) => layer !== undefined);
     assertKnownTiers(layers);
     const resolve = {
@@ -69,7 +72,7 @@ function buildConfig(declaredLayers, { coverageInclude, projectExclude = [], pro
                 provider: 'v8',
             },
             passWithNoTests: true,
-            projects: buildProjects(layers, projectExclude, projectRoot),
+            projects: buildProjects(layers, projectExclude, projectRoot, ignoredPathsRoot),
             silent: 'passed-only',
             watch: false,
         },
@@ -81,7 +84,7 @@ function buildConfig(declaredLayers, { coverageInclude, projectExclude = [], pro
     }
     return mergedConfig;
 }
-function buildProjects(layers, extraExclude, projectRoot) {
+function buildProjects(layers, extraExclude, projectRoot, ignoredPathsRoot) {
     const projectTiers = [
         { exclude: TIERED_PATTERNS, include: ALL_TEST_PATTERNS, name: RESIDUAL_TIER },
         ...NAMED_TIERS.map((tier) => ({
@@ -91,7 +94,7 @@ function buildProjects(layers, extraExclude, projectRoot) {
             timeoutMs: TIER_TIMEOUT_MS,
         })),
     ];
-    const collectionExclude = buildCollectionExclude(layers);
+    const collectionExclude = buildCollectionExclude(layers, ignoredPathsRoot);
     const shouldIsolateGit = resolveFlag(layers, 'shouldIsolateGit', true);
     return projectTiers.map(({ exclude, include, name, timeoutMs }) => {
         const project = {
@@ -150,10 +153,15 @@ function assertOptionKeys(layers, lastLayerKeys) {
             `${formatOptionKeys(unrecognizedKeys)}. Recognized: ${formatOptionKeys(recognizedKeys)}.`);
     });
 }
-function buildCollectionExclude(layers) {
+function buildCollectionExclude(layers, ignoredPathsRoot) {
     const declaredDirs = layers.flatMap((layer) => layer.testCollectionExclude ?? []);
     const globs = [...TEST_COLLECTION_EXCLUDE, ...declaredDirs].map((dir) => `**/${dir}/**`);
-    return [...new Set([...defaultExclude, ...globs])];
+    const ignoredGlobs = listGitIgnoredPaths(ignoredPathsRoot).map(buildIgnoredPathGlob);
+    return [...new Set([...defaultExclude, ...globs, ...ignoredGlobs])];
+}
+function buildIgnoredPathGlob(ignoredPath) {
+    const escapedPath = ignoredPath.replaceAll(GLOB_SYNTAX_PATTERN, String.raw `\$&`);
+    return escapedPath.endsWith('/') ? `${escapedPath}**` : escapedPath;
 }
 function formatOptionKeys(keys) {
     return keys

package/dist/esm/workspace.d.ts

@@ -2,14 +2,14 @@ export type { EmptyWorkspaceCause, WorkspaceResolution } from '@williamthorsen/n
 export { isMonorepoRoot, readWorkspaceOverrides, readWorkspacePackageNames, resolveWorkspace, } from '@williamthorsen/nmr-core/workspace';
 /**
  * Finds the monorepo root by walking up from `startDir` to find `pnpm-workspace.yaml`.
- * Throws if no workspace root is found.
+ * Throws if it does not find a workspace root in `startDir` or any of its parent directories.
  */
 export declare function findMonorepoRoot(startDir?: string): string;
 /**
  * Reads the workspace patterns from `pnpm-workspace.yaml` and resolves them to absolute package
- * directories, applying pnpm's pattern semantics — including `!`-prefixed exclusions.
+ * directories, applying pnpm's pattern semantics, including `!`-prefixed exclusions.
  *
- * Returns an empty array when the manifest declares no usable `packages` list, and throws when
- * `monorepoRoot` holds no manifest at all — the caller named a directory that is not a monorepo root.
+ * Returns an empty array when the manifest does not declare a usable `packages` list, and throws when
+ * `monorepoRoot` does not contain a manifest at all.
  */
 export declare function getWorkspacePackageDirs(monorepoRoot: string): string[];

package/docs/check-cache.md

@@ -4,9 +4,9 @@ How nmr skips a check that already passed on the same working tree, what decides
 
 The [README](../README.md#check-result-cache) shows a skip in action.
 
-Composite commands expand into child `nmr` processes, so one green `nmr ci` records a pass for every cacheable command in the chain, at every scope it ran at. A later `nmr check`, `nmr typecheck`, or `nmr -F core test` on the same tree skips too. The skip is [reported](reporting.md#what-nmr-reports) in every verbosity.
+Composite commands expand into child `nmr` processes, so one green `nmr ci` records a pass for every cacheable command in the chain, at every scope at which it ran. A later `nmr check`, `nmr typecheck`, or `nmr -F core test` on the same tree skips too. The skip is [reported](reporting.md#what-nmr-reports) in every verbosity.
 
-The cache is a working-tree cache, not a build cache: it answers "has this exact tree already passed this check?" and nothing else. It is also local to one checkout (the install fingerprint in its key is machine-specific), so it saves repeated work in a working copy rather than sharing results across machines or with CI.
+The cache is a working-tree cache, not a build cache: It answers "has this exact tree already passed this check?" and nothing else. It is also local to one checkout (the install fingerprint in its key is machine-specific), so it saves repeated work in a working copy rather than sharing results across machines or with CI.
 
 ## What is cached
 
@@ -14,18 +14,18 @@ Cacheable by default: `check`, `check:strict`, `ci`, `fix:check`, `fmt:check`, `
 
 Everything else runs every time:
 
-| Command                         | Why it is never skipped                                                                                                                   |
-| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| `audit`, `prepush`              | Consult a vulnerability database that moves without the tree. `prepush`'s `ci` constituent still skips while its `audit` runs every time. |
-| `build`, `compile`              | Carry a cache of their own.                                                                                                               |
-| `fix`, `fmt`, `lint`, `upgrade` | Rewrite the tree they were asked about, so a recorded pass would describe a tree that no longer exists.                                   |
-| `test:all`                      | Reaches the `localhost` and `remote` tiers, which the environment supplies rather than the tree.                                          |
+| Command                         | Why it is never skipped                                                                                                                              |
+| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `audit`, `prepush`              | Consult a vulnerability database that changes independently of the tree. `prepush`'s `ci` constituent still skips while its `audit` runs every time. |
+| `build`, `compile`              | Have a cache of their own.                                                                                                                           |
+| `fix`, `fmt`, `lint`, `upgrade` | Rewrite the tree that they were asked about, so a recorded pass would describe a tree that no longer exists.                                         |
+| `test:all`                      | Reaches the `localhost` and `remote` tiers, which the environment supplies rather than the tree.                                                     |
 
 ## The exit-status-only contract
 
-**A cacheable name promises that its whole contribution is an exit status**, through its entire chain, `:pre` and `:post` hooks included. A hit skips that chain wholesale, so any file a cacheable command was relied on to produce is a file that will not appear.
+**A cacheable name promises that its whole contribution is an exit status**, through its entire chain, `:pre` and `:post` hooks included. A hit skips that chain wholesale, so any file that a cacheable command was relied on to produce will not appear.
 
-`test:coverage` is cacheable on exactly this reading: what it contributes is the pass, not the `coverage/` directory, which a skipped run leaves as whatever the last real run wrote. Read `coverage/` after a `test:coverage` that may have skipped, and it may be stale; `--no-cache` is how you insist on a fresh one.
+`test:coverage` is cacheable on exactly this reading: It contributes the pass, not the `coverage/` directory, which a skipped run leaves as whatever the last real run wrote. After a `test:coverage` that may have skipped, `coverage/` may be stale; `--no-cache` forces a fresh one.
 
 Overriding a cacheable name, in `package.json` or in `workspaceScripts`, inherits its cacheability. An override that writes something anyone depends on belongs in `excludeCommands`.
 
@@ -33,44 +33,44 @@ Overriding a cacheable name, in `package.json` or in `workspaceScripts`, inherit
 
 A hit requires all of these to match the run that recorded the pass:
 
-- **The working tree's content**, hashed from the commit's tree object folded with the current content of every path git reports as changed or untracked. Timestamps are not content, so a `touch` that rewrites no bytes leaves the hash alone.
-- **The command string that would run**, hooks and all, and the scope it would run in.
+- **The working tree's content**, hashed from the commit's tree object folded with the current content of every path that git reports as changed or untracked. Timestamps are not content, so a `touch` that does not rewrite any bytes leaves the hash alone.
+- **The command string that would run**, hooks and all, and the scope in which it would run.
 - **nmr's version**, the **Node version**, and the **platform and architecture**.
-- **What pnpm has installed**, so an install, a prune, or a lockfile change forces a re-run.
-- **`TZ`, `LANG`, `LC_ALL`, and `NODE_OPTIONS`.** This set is fixed, so two machines that differ only in shell decoration still agree.
+- **What pnpm has installed.** An install, a prune, or a lockfile change forces a re-run.
+- **`TZ`, `LANG`, `LC_ALL`, and `NODE_OPTIONS`.** This set is fixed, so two machines that differ only in other environment variables still agree.
 
-A hit additionally requires the build output of every package nmr's own build covers to be present, and to have been built from this tree. Output is git-ignored, so neither its removal nor its replacement moves the hash: restoring a tree with `git stash` or `git checkout` restores none of the output that tree was built with. nmr compares each covered package's recorded build digest against the one on disk, so a `dist` compiled from another tree is a miss the following run repairs. A package that overrides `build` or `compile` emits on terms nmr does not know and is exempt.
+A hit additionally requires the build output of every package that nmr's own build covers to be present, and to have been built from this tree. Because output is git-ignored, neither its removal nor its replacement changes the hash: Restoring a tree with `git stash` or `git checkout` does not restore any of the output with which that tree was built. nmr compares each covered package's recorded build digest against the one on disk, and treats a `dist` compiled from another tree as a miss that the following run repairs. A package that overrides `build` or `compile` emits on terms that nmr does not know and is exempt.
 
-A pass is recorded only when the command exits 0, only when the tree still matches the one the run started against, only when every covered package's output is present and unchanged since the run started, and never for a run that executed nothing (a `""`/`":"` skip override, or an `NMR_RUN_IF_PRESENT` miss). Output that moves mid-run leaves no answer to which output the pass was earned over, whether another process rebuilt it or the chain built it itself: `nmr ci` is the one default command whose chain does, and it records nothing on a run whose build did work. The `nmr check:strict` inside that chain still records, because its own window opens after the build.
+A pass is recorded only when the command exits 0, only when the tree still matches the one against which the run started, only when every covered package's output is present and unchanged since the run started, and never for a run that executed nothing (a `""`/`":"` skip override, or an `NMR_RUN_IF_PRESENT` miss). When output changes mid-run, whether another process rebuilt it or the chain built it itself, nmr cannot tell over which output the pass was earned: `nmr ci` is the one default command whose chain builds its own output, and it does not record a pass on a run whose build did work. The `nmr check:strict` inside that chain still records a pass, because it starts after the build.
 
 ## Out of contract
 
-These change what a check concludes without moving the hash. Where one applies, exclude the affected command:
+These change what a check concludes without changing the hash. When one applies, exclude the affected command:
 
-- **Content filters.** `core.autocrlf` and `.gitattributes` filters mean the bytes on disk differ from the bytes git records; the hash follows what is on disk, but a checkout on another platform may not reproduce it.
-- **Symlinked inputs.** A symlink is hashed by the path it names, not by the content at the far end.
+- **Content filters.** `core.autocrlf` and `.gitattributes` filters mean the bytes on disk differ from the bytes that git records; the hash follows what is on disk, but a checkout on another platform may not reproduce it.
+- **Symlinked inputs.** A symlink is hashed by the path that it names, not by the content of its target.
 - **Gitignored inputs.** Anything git does not report is invisible to the hash. The build-output probe is the one exception, and covers only nmr's own build.
-- **`passWithNoTests`.** A suite that collects no files exits 0, and that green is recorded like any other.
+- **`passWithNoTests`.** A suite that does not collect any files exits 0, and that pass is recorded like any other.
 
-Committing an already-checked tree also moves the hash, because the commit's tree object is the base of the fold; the next run does the work again. The reverse holds and is useful: a rebase or an amended message that preserves content leaves the hash alone, as does checking out a branch whose tree is identical.
+Committing an already-checked tree also changes the hash, because the commit's tree object is the base of the fold; the next run does the work again. The reverse holds and is useful: A rebase or an amended message that preserves content leaves the hash alone, as does checking out a branch whose tree is identical.
 
-## When the gate stands aside
+## When the cache does not apply
 
-The gate never wrongly skips. Where it cannot be sure, it does nothing and the command runs:
+The gate never wrongly skips. When it cannot be sure, it does nothing and the command runs:
 
-- Outside a git repository, when git fails, or when there is no commit at `HEAD`.
+- Outside a git repository, when git fails, or when `HEAD` does not resolve to a commit.
 - When the repository declares or contains submodules, whose content the hash does not cover.
 - When the monorepo root is not the git toplevel.
 - When a changed path cannot be read, or is neither a file nor a symlink (an untracked nested repository, for instance).
-- When there is no pnpm install to fingerprint.
-- Under a `devBin` substitution, which runs a binary built from somewhere the hash does not describe.
+- When the repository does not have a pnpm install to fingerprint.
+- Under a `devBin` substitution, which runs a binary built from a location that the hash does not describe.
 - For any invocation carrying arguments after the command name, and for every step below it: the arguments narrow what runs, and a step served from a recorded pass is a step that did not.
 
-`NMR_DEBUG=1` reports why a run did not skip and why the gate stood aside.
+`NMR_DEBUG=1` reports why a run did not skip and why the cache did not apply.
 
 ## Replaying a skipped run's output
 
-A skip reports an excerpt of the run it recalls, marked as a recording rather than as this run's output:
+A skip reports an excerpt of the run that it recalls, marked as a recording rather than as this run's output:
 
 ```console
 $ nmr test
@@ -80,11 +80,11 @@ $ nmr test
 ⏩ nmr: test: passed 2m ago on this tree, saved ~12s — replayed: Test Files 6 passed (6) Tests 41 passed (41)
 ```
 
-The excerpt is the last blank-line-delimited block of what the command wrote, which is the closing statement a tool separates from its progress output. It is flattened onto one line, with escape sequences stripped, table rules dropped, and a redrawn progress line reduced to what a reader was left looking at. Nothing is parsed and no figure is computed: nmr replays bytes it recorded. A block wider than a few kilobytes is cut and marked with `…`, so a command whose closing statement is one long line cannot carry its whole output into the cache.
+The excerpt is the last blank-line-delimited block of what the command wrote, which is the closing statement that a tool separates from its progress output. It is flattened onto one line, with escape sequences stripped, table rules dropped, and a redrawn progress line reduced to what a reader was left looking at. nmr does not parse anything or compute any figure: It replays bytes that it recorded. A block wider than a few kilobytes is cut and marked with `…`, so a command whose closing statement is one long line cannot put its whole output in the cache.
 
-The excerpt and the whole transcript it is drawn from are written by the same operation that records the pass, so a pass declined because the tree moved or build output changed leaves neither behind, and `nmr clean` clears both along with the passes they belong to.
+The operation that records the pass also writes the excerpt and the whole transcript from which it is drawn. A pass that nmr declines to record because the tree or the build output changed leaves neither behind, and `nmr clean` clears both along with the passes to which they belong.
 
-**Capture happens at the command, and only where nmr can see its output.** A command whose stdout or stderr is a terminal writes where nmr never reads, so an interactive run retains nothing and its progress display is untouched; a piped or redirected run, and any run under `-q`, retains both streams. A composite hands its descriptors to the child `nmr` processes below it and captures nothing of its own, and a `:pre` or `:post` hook contributes nothing to the command it wraps: an excerpt is the command's own output or none.
+**nmr captures output at the command, and only when it can see that output.** A command whose stdout or stderr is a terminal writes to a stream that nmr never reads, so an interactive run retains nothing and its progress display is untouched; a piped or redirected run, and any run under `-q`, retains both streams. A composite passes its file descriptors to the child `nmr` processes below it and captures nothing of its own, and a `:pre` or `:post` hook contributes nothing to the command that it wraps: An excerpt is the command's own output or none.
 
 **A composite replays its constituents' excerpts.** Capturing nothing of its own, a composite assembles what its constituents recorded, each line attributed to the scope and command that produced it:
 
@@ -93,19 +93,19 @@ $ nmr check
 ⏩ nmr-core: check: passed 3m ago on this tree, saved ~48s — replayed: nmr-core: fmt:check: All matched files use Prettier code style!; nmr-core: test: Test Files 6 passed (6) Tests 41 passed (41)
 ```
 
-The assembly is flat: a constituent that is itself a composite contributes its own leaves' lines, so a skipped `ci` replays a package's `test` rather than one opaque `check:strict` line. A delegate expands into the scopes it fans out to, and a constituent that recorded no excerpt is absent rather than inferred: `typecheck` and `lint:check` print nothing on success and contribute nothing above, and a command outside the [cacheable set](#what-is-cached) records nothing at all, so `ci` replays what `check:strict` earned and nothing for `build`.
+The assembly is flat: A constituent that is itself a composite contributes its own leaves' lines, so a skipped `ci` replays a package's `test` rather than one opaque `check:strict` line. A delegate expands into the scopes to which it fans out, and a constituent that did not record an excerpt is absent rather than inferred: `typecheck` and `lint:check` print nothing on success and contribute nothing above, and a command outside the [cacheable set](#what-is-cached) records nothing at all. `ci` replays what `check:strict` earned and nothing for `build`.
 
-It is assembled when the composite records its pass rather than when it skips, so every excerpt in it was certified during that one run, on that one tree. `NMR_RUN_ID` is what makes that provable; see [reserved environment variables](#reserved-environment-variables).
+Every excerpt in the assembly was certified during a single run, on a single tree, because nmr assembles it when the composite records its pass rather than when it skips. `NMR_RUN_ID` makes that provable; see [reserved environment variables](#reserved-environment-variables).
 
 **A skip certifies what it replays.** Recalling a pass proves the excerpt describes this tree, and a matching retention key proves it describes this presentation environment, so a skip restamps the recalled entry with the run replaying it. A constituent already warm when a composite ran therefore still contributes its line: `nmr check` after `nmr test` replays the test summary. The restamp touches nothing else -- the instant and the duration belong to the run that earned the pass.
 
-**A replay is held to more than the pass is.** Retention carries its own key: the [pass key](#what-the-key-is-made-of) folded with the channel each output stream ran on and with `CI`, `COLUMNS`, `FORCE_COLOR`, `NO_COLOR`, and `TERM`. `NMR_OUTPUT_STYLE` is in neither key, so a rich run and a plain one share a recorded pass and replay each other's excerpts as recorded. A recording made under a different one is recalled as a pass all the same; its excerpt is simply not replayed, and the verdict prints alone, as it does for a pass that retained nothing.
+**A replay is held to more than the pass is.** Retention has its own key: the [pass key](#what-the-key-is-made-of) folded with the channel on which each output stream ran and with `CI`, `COLUMNS`, `FORCE_COLOR`, `NO_COLOR`, and `TERM`. `NMR_OUTPUT_STYLE` is in neither key, so a rich run and a plain one share a recorded pass and replay each other's excerpts as recorded. A recording made under a different one is recalled as a pass all the same; its excerpt is simply not replayed, and the verdict prints alone, as it does for a pass that retained nothing.
 
-The whole line, excerpt included, is held to the same [512-byte ceiling](reporting.md#what-nmr-reports) every verdict is, so one write still carries it whole under concurrent fan-out. An assembly wide enough to overrun it is cut and marked with `…` rather than spread over several lines.
+Because the whole line, excerpt included, is held to the same [512-byte ceiling](reporting.md#what-nmr-reports) as every verdict, one write still emits it whole under concurrent fan-out. An assembly wide enough to overrun it is cut and marked with `…` rather than spread over several lines.
 
 ## Reading a retained run
 
-The excerpt is a line; the run behind it is kept whole. `nmr --log <command>` prints it, led by a header dating what follows:
+The excerpt is a line; nmr also keeps the run's whole transcript. `nmr --log <command>` prints that transcript after a header that dates it:
 
 ```console
 $ nmr --log test
@@ -118,43 +118,43 @@ $ pnpm exec vitest --project unit --project tool
       Tests  41 passed (41)
 ```
 
-The header is what presents the body as a recording rather than as this invocation's output. The command string is the whole chain, hooks included, so it names what earned the pass and not merely what was typed. A flag rather than a subcommand, since `log` would collide with the script registry.
+The header presents the body as a recording rather than as this invocation's output. The command string is the whole chain, hooks included, so it names what earned the pass and not merely what was typed. A flag rather than a subcommand, since `log` would collide with the script registry.
 
-**Reading a recording runs nothing.** No hook runs, no verdict prints, and nothing is recorded or restamped. `--no-cache` governs running rather than reading and is ignored.
+**Reading a recording runs nothing.** nmr does not run any hook or print any verdict, and it does not record or restamp anything. `--no-cache` governs running rather than reading and is ignored.
 
-**A recording is held to the tree, not to the terminal.** `--log` prints exactly what a skip would have recalled: the [pass key](#what-the-key-is-made-of) has to match. The [retention key](#replaying-a-skipped-runs-output) is not consulted, so a recording made under a different terminal width, or through a pipe, still prints -- a reader at a terminal being shown what a piped run wrote is the case the flag exists for.
+**A recording is held to the tree, not to the terminal.** `--log` prints exactly what a skip would have recalled: The [pass key](#what-the-key-is-made-of) has to match. `--log` does not consult the [retention key](#replaying-a-skipped-runs-output), so a recording made under a different terminal width, or through a pipe, still prints -- the flag exists to show a reader at a terminal what a piped run wrote.
 
-**A composite prints its assembly.** Retaining nothing of its own, a composite prints the excerpts its constituents recorded, one attributed line each. The transcript of any one of them is that constituent's own `--log` to print.
+**A composite prints its assembly.** Retaining nothing of its own, a composite prints the excerpts that its constituents recorded, one attributed line each. To print the transcript of any one of them, run `--log` for that constituent.
 
-**Nothing to show is said rather than left blank.** A refusal names which it is -- the command is outside the [cacheable set](#what-is-cached), the gate is [standing aside](#when-the-gate-stands-aside), nothing has recorded a pass, the last pass was recorded under something this run does not share, or the pass retained no output, having printed none or written to a terminal -- and exits non-zero, so a caller can tell an empty `stdout` from a recording. A mismatch names the ingredient that moved, the tree or the chain or a version, so a reader whose `git status` is clean is not sent looking there.
+**When nmr has nothing to show, it says so rather than printing a blank.** A refusal names which case applies -- the command is outside the [cacheable set](#what-is-cached), the [cache does not apply](#when-the-cache-does-not-apply), nothing has recorded a pass, the last pass was recorded under something this run does not share, or the pass did not retain any output, having printed none or written to a terminal -- and nmr exits non-zero, so that a caller can tell an empty `stdout` from a recording. A mismatch names the ingredient that changed, whether the tree, the chain, or a version, to keep a reader whose `git status` is clean from looking there.
 
 ```console
 $ nmr --log test
-🟠 nmr: test: no recording; the last pass was 3m ago, on a tree this is not
+🟠 nmr: test: no recording; the last pass was 3m ago, on a tree that this is not
 ```
 
-**`--log` reaches the scopes `-F` and `-R` select.** The flag rides the delegate, so each scope prints its own recording. There a scope with nothing to show reports its gap and exits 0: partial coverage is a survey's normal shape, and failing on the first gap would hide every scope that had something. A selection of no scope at all is the other case and fails, as it does for a run: there is no survey to be partial.
+**`--log` applies to the scopes that `-F` and `-R` select.** nmr passes the flag to the delegate. Each scope prints its own recording. There a scope with nothing to show reports its gap and exits 0: Partial coverage is normal for a survey, and failing on the first gap would hide every scope that had something to show. A selection that does not include any scope is the other case and fails, as it does for a run: An empty selection is not a partial survey.
 
-**Retention has a ceiling of 256 KiB per recorded pass**, distinct from the 512 bytes a verdict line is held to. A transcript overrunning it keeps 128 KiB from each end, because a run's opening and its closing statement each carry what the other does not, and the drop is marked with a line naming the bytes it stands for rather than being cut silently.
+**Retention has a ceiling of 256 KiB per recorded pass**, distinct from the 512 bytes to which a verdict line is held. nmr keeps 128 KiB from each end of a transcript that overruns it, because a run's opening and its closing statement each contain what the other does not, and it marks the drop with a line that names the dropped bytes, rather than cutting silently.
 
 ## Bypassing and clearing
 
-Reach for these in order; the first is almost always the right one.
+Try these in order; the first is almost always the right one.
 
-| Step                                   | Effect                                                                    |
-| -------------------------------------- | ------------------------------------------------------------------------- |
-| `nmr --no-cache <command>`             | Runs the command, then records the fresh result. Reaches the whole chain. |
-| `NMR_NO_CACHE=1`                       | The same, for every nmr invocation in the shell.                          |
-| `rm -rf node_modules/.cache/nmr-check` | Forgets every recorded pass, leaving build output alone.                  |
-| `nmr clean`                            | Forgets every recorded pass and removes build output, at any scope.       |
+| Step                                   | Effect                                                                       |
+| -------------------------------------- | ---------------------------------------------------------------------------- |
+| `nmr --no-cache <command>`             | Runs the command, then records the fresh result. Applies to the whole chain. |
+| `NMR_NO_CACHE=1`                       | The same, for every nmr invocation in the shell.                             |
+| `rm -rf node_modules/.cache/nmr-check` | Forgets every recorded pass, leaving build output alone.                     |
+| `nmr clean`                            | Forgets every recorded pass and removes build output, at any scope.          |
 
-`--no-cache` belongs before the command name. After it, it is an argument to the command rather than a flag to nmr; nmr says so rather than letting the bypass silently not happen.
+`--no-cache` belongs before the command name. After it, it is an argument to the command rather than a flag to nmr; nmr reports this rather than silently ignoring the bypass.
 
 ## Reserved environment variables
 
-`NMR_TREE_SNAPSHOT` is nmr's own: it carries one observation of the tree from a top-level invocation down to the processes it spawns, so a chain hashes the tree once rather than at every link. nmr trusts an inherited value only while `HEAD` still stands where it did when the observation was taken, which bounds a process that outlives the run that spawned it. That bound does not extend to a tree edited without committing, so **a process that survives its run and later invokes nmr should clear `NMR_TREE_SNAPSHOT`** — a test suite that shells out to `nmr` is the case worth checking.
+`NMR_TREE_SNAPSHOT` is nmr's own: It passes one observation of the tree from a top-level invocation down to the processes that it spawns, so a chain hashes the tree once rather than at every link. nmr trusts an inherited value only while `HEAD` still points to the same commit as when the observation was taken, which bounds a process that outlives the run that spawned it. Because that bound does not extend to a tree edited without committing, **a process that survives its run and later invokes nmr should clear `NMR_TREE_SNAPSHOT`**. A test suite that shells out to `nmr` is the case worth checking.
 
-`NMR_RUN_ID` is nmr's own too: it carries one run's identity from a top-level invocation down to the processes it spawns, so the excerpts recorded at every scope during one run are recognizable as that run's, and a composite can assemble from them. Where `NMR_TREE_SNAPSHOT` is bounded by `HEAD`, this is bounded by the tree hash each entry records, so a process that outlives its run and carries the identity into a later one contributes nothing to that run's assemblies.
+`NMR_RUN_ID` is nmr's own too: It passes one run's identity from a top-level invocation down to the processes that it spawns, so that the excerpts recorded at every scope during one run are recognizable as that run's, and a composite can assemble from them. Whereas `NMR_TREE_SNAPSHOT` is bounded by `HEAD`, this one is bounded by the tree hash that each entry records. A process that outlives its run and carries the identity into a later one contributes nothing to that run's assemblies.
 
 ## Configuring
 
@@ -169,8 +169,8 @@ export default defineConfig({
 });
 ```
 
-`extraCommands` extends the default set rather than replacing it, so naming one command cannot silently drop the rest; `excludeCommands` is applied afterwards, so a name in both is excluded. `enabled: false` turns the gate off entirely. The key is `checkCache`, in the monorepo-root config.
+`extraCommands` extends the default set rather than replacing it, so naming one command cannot silently drop the rest. nmr applies `excludeCommands` afterwards and excludes a name that appears in both. `enabled: false` turns the gate off entirely. The key is `checkCache`, in the monorepo-root config.
 
-**A name in either list must resolve to a command**, whether through nmr's defaults, the repo config's script records, or a package's own `package.json` scripts. Both lists are read by name alone, so a misspelt entry would otherwise be inert: the command it meant to name would go on running, indistinguishable from one that cannot be cached at all. A name that resolves nowhere fails config load, naming the closest command where there is one. A hook name is rejected too, since a hook is never gated on its own -- it runs as part of the chain of the command it wraps, and is skipped or run with it.
+**A name in either list must resolve to a command**, whether through nmr's defaults, the repo config's script records, or a package's own `package.json` scripts. Both lists are read by name alone, so a misspelt entry would otherwise be inert: The command that it meant to name would go on running, indistinguishable from one that cannot be cached at all. A name that resolves nowhere fails config load, naming the closest command if one exists. A hook name is rejected too, since a hook is never gated on its own -- it runs as part of the chain of the command that it wraps, and is skipped or run with it.
 
-The test is resolvability rather than membership of the cacheable set, so an `excludeCommands` entry keeps standing after a release moves its name out of the defaults.
+Because the test is resolvability rather than membership of the cacheable set, an `excludeCommands` entry stays valid after a release moves its name out of the defaults.

package/docs/prettier.md

@@ -2,23 +2,23 @@
 
 The Prettier config that `@williamthorsen/nmr/prettier` publishes: what it formats, how it scopes the shell plugin, and how to customize and adopt it.
 
-`prettier` is a peer dependency (`>=3.9.5 <4`), declared optional — the consuming repo provides it. The shell and Dockerfile plugin is a dependency of nmr rather than a peer, so its version is pinned centrally and two repos cannot format the same script differently.
+`prettier` is a peer dependency (`>=3.9.5 <4`), declared optional; the consuming repo provides it. The shell and Dockerfile plugin is a dependency of nmr rather than a peer, so its version is pinned centrally and two repos cannot format the same script differently.
 
 ## What it formats
 
-Beyond everything Prettier already handles, this config formats `.sh`, `.bash`, `.zsh`, and the other extensions and dotfile names of the Shell language, plus `Dockerfile` and `Containerfile`. `nmr fmt` therefore covers shell scripts with no extra script, glob, or workflow entry.
+Beyond everything Prettier already handles, this config formats `.sh`, `.bash`, `.zsh`, and the other extensions and dotfile names of the Shell language, plus `Dockerfile` and `Containerfile`. `nmr fmt` therefore covers shell scripts without an extra script, glob, or workflow entry.
 
-Shell output matches `shfmt` run with no flags: `binaryNextLine`, `spaceRedirects`, and `switchCaseIndent` are pinned to shfmt's CLI defaults, which the underlying plugin inverts. A repo whose scripts shfmt already formatted sees no diff on adoption.
+Shell output matches `shfmt` run without flags: `binaryNextLine`, `spaceRedirects`, and `switchCaseIndent` are pinned to shfmt's CLI defaults, which the underlying plugin inverts. Adoption does not produce any diff in a repo whose scripts shfmt already formatted.
 
-Code fences inside Markdown are left alone, in every language rather than shell alone. Registering the shell plugin also routes a fence tagged `bash` to shfmt, where a documented command's angle-bracket placeholders are valid redirections: `cmd --type <type> --harness claude` is reprinted as `cmd --type claude <type >--harness`, which still runs but no longer does what it documents. It cannot be narrowed back to shell, because Prettier matches a fence tag against the same `extensions` its file inference reads, so the `.bash` routing a script also claims the tag `bash`.
+Code fences inside Markdown are left alone, in every language rather than shell alone. Registering the shell plugin also sends a fence tagged `bash` to shfmt, which reads a documented command's angle-bracket placeholders as valid redirections: `cmd --type <type> --harness claude` is reprinted as `cmd --type claude <type >--harness`, which still runs but no longer does what it documents. It cannot be narrowed back to shell, because Prettier matches a fence tag against the same `extensions` that its file inference reads, so the `.bash` extension that sends a script to the shell parser also matches the tag `bash`.
 
 ## Language scoping
 
-`prettier-plugin-sh` routes 20 further file types to the same shell parser, among them `.gitignore`, `.env`, `.csh`, `.nu`, `.properties`, `.ics`, `.vcf`, `CODEOWNERS`, and `hosts`. Since `nmr fmt` hands git's whole file list to Prettier, registering the plugin as shipped would make every one of them formattable — and the shell parser either fails on them or silently rewrites them. A `.gitignore` pattern such as `a(b)c` fails to parse, and an unquoted `&` in a `.env` or `.properties` value is split across two lines.
+`prettier-plugin-sh` assigns 20 further file types to the same shell parser, among them `.gitignore`, `.env`, `.csh`, `.nu`, `.properties`, `.ics`, `.vcf`, `CODEOWNERS`, and `hosts`. Since `nmr fmt` passes git's whole file list to Prettier, registering the plugin unmodified would make every one of them formattable, and the shell parser either fails on them or silently rewrites them. A `.gitignore` pattern such as `a(b)c` fails to parse, and an unquoted `&` in a `.env` or `.properties` value is split across two lines.
 
-This config registers a narrowed plugin, so Prettier infers a parser for the Shell and Dockerfile languages alone. `.flaskenv`, `gradlew`, and `mvnw` are dropped from Shell as well: the first holds dotenv content the plugin misfiles as shell, and the other two are vendored wrappers their generators would overwrite.
+This config registers a narrowed plugin, so Prettier infers a parser for the Shell and Dockerfile languages alone. `.flaskenv`, `gradlew`, and `mvnw` are dropped from Shell as well: The first contains dotenv content that the plugin misidentifies as shell, and the other two are vendored wrappers that their generators would overwrite.
 
-The parsers themselves stay registered, so a repo that wants a dropped language back assigns it explicitly:
+The parsers themselves stay registered. A repo that wants a dropped language back assigns it explicitly:
 
 ```js
 export default definePrettierConfig({
@@ -38,10 +38,10 @@ export default definePrettierConfig({
 });
 ```
 
-`additionalPlugins` and `additionalOverrides` append to what the config declares, so a later override wins over nmr's own and no seam can drop shell support. Passing `plugins` or `overrides` throws, and both are typed `never` — replacement is inexpressible rather than merely discouraged, because a silently ignored key would produce no diff to notice.
+`additionalPlugins` and `additionalOverrides` append to what the config declares, so a later override wins over nmr's own, and a repo cannot use either option to drop shell support. Passing `plugins` or `overrides` throws, and both are typed `never`: Replacement is inexpressible rather than merely discouraged, because a silently ignored key would not produce any diff to notice.
 
 ## Adoption caveats
 
-- **Indentation follows `.editorconfig`**, as it did under shfmt: Prettier maps `indent_style` and `indent_size` to `useTabs` and `tabWidth`, and the plugin honours both. With no `.editorconfig`, the two disagree — shfmt indents shell with tabs, Prettier with two spaces. Add `indent_style = tab` under `[*.sh]` to keep tabs.
-- **Markdown fences stop being tidied.** The carve-out that protects documented shell commands costs the `ts`, `json`, and `yaml` fences their formatting too. Fences already formatted stay as they are, so nothing churns on adoption; new ones are simply left as written. A repo whose docs hold no shell can take them back for the Markdown paths it actually uses: `additionalOverrides: [{ files: ['*.md'], options: { embeddedLanguageFormatting: 'auto' } }]` restores `.md` alone, and the carve-out still covers every other path Prettier reads as Markdown.
+- **Indentation follows `.editorconfig`**, as it did under shfmt: Prettier maps `indent_style` and `indent_size` to `useTabs` and `tabWidth`, and the plugin honours both. Without an `.editorconfig`, the two disagree: shfmt indents shell with tabs, Prettier with two spaces. Add `indent_style = tab` under `[*.sh]` to keep tabs.
+- **Markdown fences stop being tidied.** The carve-out that protects documented shell commands leaves the `ts`, `json`, and `yaml` fences unformatted too. Fences already formatted stay as they are, so adoption does not change them; new ones are simply left as written. A repo whose docs do not contain any shell can restore fence formatting for the Markdown paths that it actually uses: `additionalOverrides: [{ files: ['*.md'], options: { embeddedLanguageFormatting: 'auto' } }]` restores `.md` alone, and the carve-out still covers every other path that Prettier reads as Markdown.
 - **Adopting the house options reformats the repo.** `singleQuote`, `trailingComma`, and the rest apply on the first run; review that diff separately from the shell one.