mandrel 2.53.0 → 2.55.0

package/.agents/scripts/lib/orchestration/run-epilogue.js

@@ -7,8 +7,8 @@
  *   2. Rolls up friction follow-ups across every Story in the run and
  *      files/posts them on the primary Story.
  *   3. Checks sibling Spec/acceptance coherence across Story bodies.
- *   4. Reports the container Epics whose children all landed (Story #5139),
- *      delegating the derivation and the close to `epic-rollup.js`.
+ *   4. Reports what the per-Story land tails left the run's container Epics
+ *      in — closed, or still open (Story #5139; read-only since #5280).
  *
  * There is no inert planner-only path: `planRunEpilogue` enumerates steps
  * and `runPlanRunEpilogue` executes them. Single-Story runs skip the
@@ -21,7 +21,7 @@ import { selectAudits } from '../audit-suite/index.js';
 import { graduateRetroProposals } from '../feedback-loop/retro-proposals-graduator.js';
 import { gitSpawn } from '../git-utils.js';
 import { Logger } from '../Logger.js';
-import { rollUpEpicForStory } from './epic-rollup.js';
+import { isEpicTicket } from './epic-container.js';
 import { composeRoutedProposals } from './retro-proposals.js';
 import {
   assessRollupOutcome,
@@ -44,54 +44,51 @@ export const RUN_EPILOGUE_STEP_KINDS = Object.freeze([
 ]);
 
 /**
- * Close every container Epic whose children all landed in this run.
+ * Report which container Epics this run's Stories left closed, and which are
+ * still open.
  *
- * Delegates to `epic-rollup.js` (Story #5205) rather than deriving anything
- * itself. That module owns the child→parent scan, the body-checklist-union-
- * native-sub-issue child read, and the one-way closure rule, and it is also
- * invoked from the per-Story land tail — which is what closes a container
- * whose last open child was a single Story, a case this epilogue never
- * reaches because a one-Story run reports `applicable: false`.
+ * **It derives nothing and writes nothing.** It used to: it walked every Story
+ * and re-ran the full rollup, closing containers itself. That made sense while
+ * the rollup only fired on the edges someone had wired, and the epilogue was
+ * the backstop for the ones that were missed. Every child state change is now
+ * an edge — init, post-land, the supersede close — so by the time the last
+ * Story of a run has landed, its container has already been derived from a
+ * complete child set by that Story's own land tail. Re-deriving here would ask
+ * the same question a second time and answer it identically, at the cost of a
+ * full re-read per Story and a second writer on the same issue.
  *
- * The step survives for its report: this is the surface an operator reads to
- * see which containers a multi-Story run closed and which are still pending.
+ * What survives is the report, which is why the step exists at all: one place
+ * an operator reads to see what a multi-Story run did to its containers. A
+ * pending Epic here is a real signal — it means a land tail's rollup declined
+ * to close, and the tail's own outcome says why.
  *
- * Non-fatal throughout: the epilogue is a reporting tail, and a container
- * left open costs tidiness, not correctness.
+ * Non-fatal throughout: a container it cannot read is simply not reported.
  *
- * @param {{ stories: string[], provider: object, config?: object }} opts
+ * @param {{ stories: string[], provider: object }} opts
  * @returns {Promise<{ kind: string, closed: number[], pending: number[] }>}
  */
-async function executeEpicClose({ stories, provider, config }) {
+async function executeEpicClose({ stories, provider }) {
   const closed = new Set();
   const pending = new Set();
-  // Siblings share a container, so an Epic resolved by one Story's rollup is
-  // withheld from the next one's — otherwise the second Story would re-derive
-  // and re-close what the first already closed.
+  // Siblings share a container: resolve each distinct Epic once, however many
+  // of the run's Stories point at it.
   const seen = new Set();
 
-  // `rollUpEpicForStory` never throws and always returns the full envelope,
-  // so its three lists are read directly — a `?? []` guard here would be an
-  // unreachable branch asserting a contract the module already keeps.
   for (const raw of stories) {
     const storyId = Number(raw);
     if (!Number.isInteger(storyId) || storyId <= 0) continue;
-    const outcome = await rollUpEpicForStory({
-      storyId,
-      provider,
-      config,
-      skipEpicIds: seen,
-    });
-    for (const epic of outcome.epics) seen.add(epic.epicId);
-    for (const epicId of outcome.closed) closed.add(epicId);
-    for (const epicId of outcome.pending) pending.add(epicId);
+    const epic = await readContainerFor({ storyId, provider });
+    if (!epic) continue;
+    const epicId = Number(epic.id);
+    if (!Number.isInteger(epicId) || seen.has(epicId)) continue;
+    seen.add(epicId);
+    if (String(epic.state ?? '').toLowerCase() === 'closed') {
+      closed.add(epicId);
+    } else {
+      pending.add(epicId);
+    }
   }
 
-  // An Epic this run closed can also have been reported pending by an
-  // earlier Story's rollup, when a sibling had not landed yet. The close is
-  // the later, truer answer.
-  for (const epicId of closed) pending.delete(epicId);
-
   return {
     kind: 'epic-close',
     closed: [...closed],
@@ -99,6 +96,30 @@ async function executeEpicClose({ stories, provider, config }) {
   };
 }
 
+/**
+ * Read one Story's container Epic, or null.
+ *
+ * One request per Story via the declared parent port. Degrades to null on any
+ * failure and on a provider without the port — this is a report, and a
+ * container it could not read is better omitted than guessed at.
+ *
+ * @param {{ storyId: number, provider: object }} opts
+ * @returns {Promise<object|null>}
+ */
+async function readContainerFor({ storyId, provider }) {
+  if (typeof provider?.getParentIssue !== 'function') return null;
+  try {
+    const parent = await provider.getParentIssue(storyId);
+    return parent && isEpicTicket(parent) ? parent : null;
+  } catch (err) {
+    Logger.warn(
+      `[run-epilogue] could not read the container for Story #${storyId} ` +
+        `(${err?.message ?? err}); omitting it from the Epic report.`,
+    );
+    return null;
+  }
+}
+
 /**
  * @param {string|number|{ id?: string|number, slug?: string }} entry
  * @returns {string|null}
@@ -185,7 +206,7 @@ export function planRunEpilogue({ planRunId, stories } = {}) {
     },
     {
       kind: 'epic-close',
-      description: `Close any container Epic whose children all landed in run ${effectiveRunId}`,
+      description: `Report the container Epic state the land tails of run ${effectiveRunId} left behind`,
       stories: ids,
     },
   ];
@@ -892,7 +913,7 @@ export async function runPlanRunEpilogue({
         );
       } else if (step.kind === 'epic-close') {
         results.push(
-          await executeEpicClose({ stories: plan.stories, provider, config }),
+          await executeEpicClose({ stories: plan.stories, provider }),
         );
       }
     } catch (err) {

package/.agents/scripts/lib/orchestration/single-story-close/close-note.js

@@ -0,0 +1,81 @@
+/**
+ * close-note.js — the human-readable `note` on close's result record
+ * (Story #5266).
+ *
+ * ## Why this is its own module
+ *
+ * The note used to branch on `waitedForMerge` — whether close *waited* — and
+ * not on `merged`. A bounded wait that expired with the PR still open
+ * therefore wrote "Close-and-land: PR merge confirmed … the issue closed"
+ * into `story-close-result-<id>.log` **beside `merged: false`**, while the
+ * schema-validated terminal envelope correctly reported
+ * `status: pending, phase: confirm-merge`. That log is what close's summary
+ * line points the operator at, so the contradiction is what gets read first:
+ * a merge that never happened, reported as confirmed.
+ *
+ * The invariant this module exists to hold:
+ *
+ *   > **No note may assert a state the same object denies.**
+ *
+ * Every branch below is therefore derived from the result's OWN
+ * `merged` / `directMerged` / `autoMergeEnabled` / `landCompleted` fields —
+ * the ones the note ships next to — so no input can produce a note that
+ * contradicts them. Story #5279 added the fourth, because `merged: true`
+ * used to imply the flip, the issue close and the post-land tail: a direct
+ * squash-merge under `--no-wait-merge`, and a merge whose `agent::done` write
+ * failed, now reach it with none of the three, and reusing the confirmed
+ * wording for them would reintroduce the defect above one field over. The
+ * unmerged branches deliberately claim nothing about the Story's label state
+ * either: close's ending may be `pending` OR `blocked` with the same
+ * `merged: false`, and the terminal envelope is the authority on which. They
+ * also avoid the merge-completion vocabulary entirely — no `agent::done`, no
+ * "the merge confirms" — so that a reader skimming for those words cannot
+ * take a next-step instruction for a report of what happened.
+ */
+
+/**
+ * The one line the note is not allowed to get wrong.
+ *
+ * @param {{ merged?: boolean, directMerged?: boolean,
+ *   autoMergeEnabled?: boolean, landCompleted?: boolean }} result
+ *   `landCompleted` — did THIS run flip `agent::done`, close the issue and
+ *   run the post-land tail? Defaults to `merged`, the pre-#5279 equivalence.
+ * @returns {string}
+ */
+export function deriveCloseNote({
+  merged = false,
+  directMerged = false,
+  autoMergeEnabled = false,
+  landCompleted = merged,
+} = {}) {
+  if (merged) {
+    const how = directMerged
+      ? 'PR merge confirmed by a DIRECT squash-merge (native auto-merge was ' +
+        'unavailable on this repository).'
+      : 'PR merge confirmed.';
+    return landCompleted
+      ? `Close-and-land: ${how} Story flipped agent::closing → agent::done, ` +
+          'the issue closed (confirmStoryMerged), and the post-land tail ran.'
+      : `Close-and-land: ${how} This close did NOT finish the land: ` +
+          'agent::done was not flipped and the post-land tail did not run. ' +
+          'Finish it with single-story-confirm-merge.js, idempotent against an ' +
+          'already-merged PR. The terminal envelope is authoritative.';
+  }
+  if (autoMergeEnabled) {
+    return (
+      'PR open against baseBranch and NOT merged; auto-merge is armed. ' +
+      'GitHub will squash-merge it once the required checks pass — resume ' +
+      'with single-story-confirm-merge.js then, to finish the land and ' +
+      'release the lease this close is still holding. The terminal envelope ' +
+      '(status / phase / blocked) is authoritative for what happened here.'
+    );
+  }
+  return (
+    'PR open against baseBranch and NOT merged; auto-merge was not armed ' +
+    '(see autoMergeReason). The operator owns the land: merge via the GitHub ' +
+    'UI, then resume with single-story-confirm-merge.js to finish the land ' +
+    'and release the lease this close is still holding. The terminal ' +
+    'envelope (status / phase / blocked) is authoritative for what happened ' +
+    'here.'
+  );
+}

package/.agents/scripts/lib/orchestration/single-story-close/failed-terminal.js

@@ -50,8 +50,11 @@ const GATE_PHASES = Object.freeze([
 ]);
 
 /**
- * The names the split baselines gate registers under, mirrored from
- * `BASELINES_GATE_NAMES` in `lib/close-validation/gates.js` (Story #5172).
+ * The names the unified baselines gate can register under, mirrored from
+ * `BASELINES_GATE_NAMES` in `lib/close-validation/gates.js` (Story #5172) —
+ * all three, matching the projection the SUCCESS path applies in
+ * `runner.js#baselinesEnvelopeGates`, so the two endings of one run cannot
+ * key the same gate differently.
  *
  * Deliberately a local copy rather than an import: several close suites
  * replace that module wholesale via `t.mock.module`, and a named import here
@@ -61,48 +64,37 @@ const GATE_PHASES = Object.freeze([
  * against each other so the copy cannot drift.
  */
 const BASELINES_ENTRY_NAMES = Object.freeze([
+  'check-baselines',
   'check-baselines-independent',
   'check-baselines-coverage',
 ]);
 
 /**
- * Outcome for each split baselines entry on a run that died at `phase`.
+ * Project the baselines entries out of the per-gate outcomes THIS run
+ * observed (Story #5279).
  *
- * The two entries sit in ONE pipeline phase, so the phase walk alone cannot
- * separate them — `failedGate` (tagged onto the error by the close-validation
- * phase) is what names the entry that actually broke. Rules, in the module's
- * house style of never claiming a pass it cannot prove:
- *   - validation skipped, or the run died before reaching it → both `skipped`.
- *   - the run cleared validation entirely → both `passed`.
- *   - the run died IN validation on the coverage-independent entry → that one
- *     `failed`, the coverage one `skipped` (it runs behind `coverage-capture`,
- *     which the failure pre-empted).
- *   - died on the coverage-consuming entry → that one `failed`, and the
- *     independent one `passed`: it is in the parallel partition that must go
- *     green before any serial gate starts.
- *   - died in validation on some other gate → both `skipped`; which of them
- *     had run is not knowable from the phase alone.
+ * This used to RECONSTRUCT them: it inferred, from the phase the run died in
+ * plus the name of the failing gate, what the two split entries "must have"
+ * done — and it did so over a hardcoded pair, so every failed close reported
+ * both split names whether or not the run had ever registered them. A repo
+ * whose config resolves to the unsplit `check-baselines`, or to only one half
+ * of the pair, got envelope keys for gates that did not exist; a run that
+ * died at `init` got them too, reported as `skipped`, which reads as "the
+ * gate was turned off" rather than "there was no such gate".
  *
- * @param {string} phase
- * @param {{ skipValidation?: boolean, failedGate?: string|null }} args
+ * Reporting instead of reconstructing removes the whole class: an outcome
+ * appears only for a gate the run actually observed, and the runner tags
+ * exactly that set onto the error (`err.closeGates`).
+ *
+ * @param {Record<string, string>|null|undefined} observedGates
  * @returns {Record<string, 'passed'|'failed'|'skipped'>}
  */
-function baselinesGatesForFailedPhase(phase, { skipValidation, failedGate }) {
-  const [independent, coverage] = BASELINES_ENTRY_NAMES;
-  const both = (outcome) => ({ [independent]: outcome, [coverage]: outcome });
-  const failedAt = PHASE_ORDER.indexOf(phase);
-  const validationAt = PHASE_ORDER.indexOf('close-validation');
-  if (skipValidation || failedAt < 0 || failedAt < validationAt) {
-    return both('skipped');
-  }
-  if (failedAt > validationAt) return both('passed');
-  if (failedGate === independent) {
-    return { [independent]: 'failed', [coverage]: 'skipped' };
-  }
-  if (failedGate === coverage) {
-    return { [independent]: 'passed', [coverage]: 'failed' };
+function baselinesGatesObserved(observedGates) {
+  const out = {};
+  for (const [name, outcome] of Object.entries(observedGates ?? {})) {
+    if (BASELINES_ENTRY_NAMES.includes(name)) out[name] = outcome;
   }
-  return both('skipped');
+  return out;
 }
 
 /**
@@ -119,14 +111,17 @@ function baselinesGatesForFailedPhase(phase, { skipValidation, failedGate }) {
  * turned off via `--skip-validation` / `--skip-sync` is `skipped` too (it did
  * not pass — it never ran).
  *
- * Story #5172 — the reported set also carries the two split baselines
- * entries under their own names, so a failed close says WHICH half of the
- * baselines gate breached instead of a single generic verdict.
+ * Story #5172 — the reported set also carries the baselines entries under
+ * their own names, so a failed close says WHICH half of the baselines gate
+ * breached instead of a single generic verdict. Story #5279 — those names
+ * are REPORTED from `observedGates`, never reconstructed, so only a gate the
+ * run registered can appear.
  *
  * @param {string} phase The phase the run died in.
- * @param {{ skipValidation?: boolean, skipSync?: boolean, failedGate?: string|null }} args
- *   Parsed CLI args, plus the gate name tagged onto the error by the
- *   close-validation phase.
+ * @param {{ skipValidation?: boolean, skipSync?: boolean,
+ *   observedGates?: Record<string, string>|null }} args
+ *   Parsed CLI args, plus the per-gate outcomes the runner tagged onto the
+ *   error.
  * @returns {Record<string, 'passed'|'failed'|'skipped'>}
  */
 export function gatesForFailedPhase(phase, args = {}) {
@@ -139,13 +134,7 @@ export function gatesForFailedPhase(phase, args = {}) {
     else if (failedAt < 0 || at > failedAt) gates[gate] = 'skipped';
     else gates[gate] = skipped[gate] ? 'skipped' : 'passed';
   }
-  return {
-    ...gates,
-    ...baselinesGatesForFailedPhase(phase, {
-      skipValidation: args.skipValidation,
-      failedGate: args.failedGate ?? null,
-    }),
-  };
+  return { ...gates, ...baselinesGatesObserved(args.observedGates) };
 }
 
 /**
@@ -163,9 +152,9 @@ export function gatesForFailedPhase(phase, args = {}) {
  * holding the script had been reaped mid-run. On failure this returns null
  * and the caller rethrows the original.
  *
- * `err.closeGate` — tagged by the close-validation phase — names the gate that
- * died inside that phase, which is what lets the reported gates separate the
- * two split baselines entries (Story #5172).
+ * `err.closeGates` — tagged by the runner — carries the per-gate outcomes the
+ * run observed, which is what lets the reported gates name the baselines
+ * entries that actually ran (Story #5172 / #5279) instead of a hardcoded pair.
  *
  * @param {unknown} err
  * @param {{ storyId?: string|number, skipValidation?: boolean, skipSync?: boolean }} args
@@ -186,7 +175,7 @@ export function failedTerminalFor(err, args = {}) {
       phase,
       gates: gatesForFailedPhase(phase, {
         ...args,
-        failedGate: err?.closeGate ?? null,
+        observedGates: err?.closeGates ?? null,
       }),
       failure: { reason: String(err?.message ?? err) },
       nextCommand: NEXT_COMMANDS.recover(storyId),

package/.agents/scripts/lib/orchestration/single-story-close/phases/auto-merge.js

@@ -66,7 +66,7 @@ import { resolveAutoMergeArmCwd } from '../../auto-merge-cwd.js';
 import {
   advisoryCheckFailedBlocksArm,
   deriveRedHeadRuns,
-  formatAdvisoryGateReason,
+  resolveAdvisoryGateVerdict,
   selectBlockingRedRuns,
 } from '../../merge-poll.js';
 
@@ -430,10 +430,17 @@ async function evaluateAdvisoryGate({
     probe.redHeadRuns,
     advisoryAllowlist,
   );
+  // Story #5266 — the class travels with the reason. This pre-arm gate
+  // classifies on the text the ROLLUP carried (a legacy StatusContext's
+  // `description`); the merge wait, which owns the common case, additionally
+  // reads the check-run output. Either way a run whose failure cannot be read
+  // as "never finished" keeps the `advisory-gate-red` verdict.
+  const verdict = resolveAdvisoryGateVerdict({ blockingRuns });
   return {
     blocked: true,
     blockingRuns,
-    reason: formatAdvisoryGateReason(blockingRuns),
+    blockClass: verdict.blockClass,
+    reason: verdict.reason,
   };
 }
 
@@ -522,6 +529,7 @@ export async function runAutoMergePhase({
       autoMergeReason: 'advisory-gate-red',
       advisoryGate: {
         blockingRuns: advisory.blockingRuns,
+        blockClass: advisory.blockClass,
         reason: advisory.reason,
       },
     };

package/.agents/scripts/lib/orchestration/single-story-close/phases/base-sync.js

@@ -13,8 +13,18 @@
  * On a merge conflict the Story is transitioned to `agent::blocked` via
  * `handleSyncFailure` and the caller throws — the operator resolves in
  * the worktree and re-runs.
+ *
+ * Story #5267: a sync that lands tracked content also spends the worker's
+ * pre-push credit, because that credit is keyed on the tree. The phase says
+ * so out loud — see `buildStampInvalidatedWarning` — instead of leaving
+ * close's second full suite looking like a bug. Story #5278 splits the claim
+ * in two: gate evidence is spent by any tracked path, the capture stamp only
+ * by one under `crap.targetDirs`.
  */
 
+import { getQuality } from '../../../config/quality.js';
+import { resolveConfig } from '../../../config-resolver.js';
+import { filterFilesUnderTargets } from '../../../coverage-capture.js';
 import { syncBranchFromBase } from '../../../git/sync-from-base.js';
 import { Logger } from '../../../Logger.js';
 import { AGENT_LABELS } from '../../../label-constants.js';
@@ -40,6 +50,7 @@ import {
  *   storyId: number,
  *   provider: object,
  *   injectedSync?: typeof syncBranchFromBase,
+ *   resolveConfigImpl?: typeof resolveConfig,
  *   progress: (tag: string, msg: string) => void,
  * }} args
  */
@@ -52,6 +63,7 @@ export async function runBaseSyncPhase({
   storyId,
   provider,
   injectedSync,
+  resolveConfigImpl = resolveConfig,
   progress,
 }) {
   const syncCwd = worktreePath ?? cwd;
@@ -87,6 +99,95 @@ export async function runBaseSyncPhase({
     );
   }
   progress('SYNC', `✅ Synced from origin/${baseBranch} (${syncResult.kind}).`);
+  for (const line of buildStampInvalidatedWarning({
+    baseBranch,
+    result: syncResult,
+    targetDirs: resolveCrapTargetDirs(resolveConfigImpl, syncCwd),
+  })) {
+    progress('SYNC', line);
+  }
+}
+
+/**
+ * The CRAP scoring scope, or `[]` when it cannot be resolved. A `[]` makes
+ * the warning below fall back to naming the capture stamp unconditionally —
+ * the pre-#5278 wording — because an unresolvable scope is no evidence that
+ * the stamp survived.
+ *
+ * @param {typeof resolveConfig} resolveConfigImpl
+ * @param {string} cwd
+ * @returns {string[]}
+ */
+function resolveCrapTargetDirs(resolveConfigImpl, cwd) {
+  try {
+    return getQuality(resolveConfigImpl({ cwd }))?.crap?.targetDirs ?? [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * How many changed paths the warning names before it stops listing.
+ * Enough to recognise the change set; short enough that the warning still
+ * reads as a warning rather than as a diff.
+ */
+const WARNED_PATH_LIMIT = 12;
+
+/**
+ * The loud "your credit is spent" warning, or `[]` when the sync changed
+ * nothing (Story #5267, narrowed by #5278).
+ *
+ * The worker banks two kinds of credit before the push: gate evidence keyed
+ * on the tree (lint, typecheck) and one full-suite capture stamp keyed on the
+ * content of `crap.targetDirs`. This sync runs after that, and the two are
+ * spent on different conditions — which is why #5267's single blanket
+ * sentence was wrong half the time:
+ *
+ *   - **Gate evidence** is spent by any tracked path at all, because the tree
+ *     hash it is keyed on moves with the first byte.
+ *   - **The capture stamp** is spent only when a merged path lands under
+ *     `crap.targetDirs`. A sync that brings in docs, workflows or CI config
+ *     leaves it perfectly valid, and announcing it as spent taught operators
+ *     to expect a second full suite that close was never going to run.
+ *
+ * Quiet by construction on the outcome that cannot spend either: a
+ * `noop-already-current` sync never touched the tree. A content-changing
+ * fast-forward DOES warn — it moves the tree exactly as a merge commit does,
+ * and staying quiet there would be a lie of omission.
+ *
+ * Pure. Module-private: the phase is the seam tests drive it through
+ * (`injectedSync` + a `progress` spy), so it needs no export of its own.
+ *
+ * @param {{ baseBranch: string, result: { kind?: string, changedPaths?: string[] }, targetDirs?: string[] }} args
+ * @returns {string[]} Progress lines, in order. Empty when nothing changed.
+ */
+function buildStampInvalidatedWarning({ baseBranch, result, targetDirs }) {
+  const changed = Array.isArray(result?.changedPaths)
+    ? result.changedPaths
+    : [];
+  if (changed.length === 0) return [];
+  const dirs = Array.isArray(targetDirs) ? targetDirs : [];
+  // An unresolvable scope (`[]`) cannot prove the stamp survived, so it fails
+  // closed to the unconditional wording.
+  const scored =
+    dirs.length === 0 ? changed : filterFilesUnderTargets(changed, dirs);
+  const shown = changed.slice(0, WARNED_PATH_LIMIT);
+  const overflow = changed.length - shown.length;
+  return [
+    `⚠️  BASE MOVED: the ${result?.kind ?? 'sync'} from origin/${baseBranch} ` +
+      `brought ${changed.length} tracked path(s) into this branch, so the tree ` +
+      `hash the pre-push lint/typecheck evidence was keyed on has changed. ` +
+      `That evidence cannot be credited; those gates re-run below.`,
+    scored.length > 0
+      ? `⚠️  The full-suite capture stamp is spent too: ${scored.length} of ` +
+        `those path(s) fall under the CRAP target dirs [${dirs.join(', ')}], ` +
+        `so the suite re-runs against the merged tree. This is expected, not a fault.`
+      : `⚠️  The full-suite capture stamp SURVIVES: no merged path falls under ` +
+        `the CRAP target dirs [${dirs.join(', ')}], so the coverage artifact still ` +
+        `describes this tree and the suite is not re-run.`,
+    ...shown.map((f) => `⚠️    ${f}`),
+    ...(overflow > 0 ? [`⚠️    …and ${overflow} more`] : []),
+  ];
 }
 
 /**