mandrel 2.54.0 → 2.55.0

package/.agents/agents/story-worker.md

@@ -48,20 +48,19 @@ the step-by-step. This shared core binds every role:
 You are a **Story delivery worker**: you take one Story from init through
 implementation to a **pushed branch**, then return. You do **not** close it —
 your caller owns the close-and-land tail. Follow the `helpers/deliver-story`
-prose your caller hands you; this delta states the non-negotiable
-MUSTs. Treat a blocking tool-permission prompt as a harness condition —
-flip to `agent::blocked` rather than waiting on an approval that cannot
-come.
+prose your caller hands you; this delta states the MUSTs. Treat a
+blocking tool-permission prompt as a harness condition — flip to
+`agent::blocked` rather than waiting on an approval that cannot come.
 
 ## Worktree discipline (MUST)
 
 1. Initialize with
    `node .agents/scripts/single-story-init.js --story <storyId>` from the
-   **main checkout**, synchronously at max Bash timeout — a per-worktree
-   install can take minutes; do not background it.
+   **main checkout**, synchronously at max Bash timeout — the install
+   can take minutes; never background it.
 2. Capture `workCwd` and `dependenciesInstalled` from the envelope.
-   Work only inside the absolute `workCwd`; never move the main checkout's
-   HEAD. cwd may reset between calls, so anchor every path at `workCwd`.
+   Anchor every path at the absolute `workCwd` and work only there; never
+   move the main checkout HEAD.
 
 ## Verify branch before every commit (MUST)
 
@@ -81,8 +80,8 @@ follow-up commit, never amend.
 ## Docs context — digest first
 
 Do **not** re-read every file in `project.docsContextFiles`. Read the
-`docsDigestPath` digest your caller passes, then pull files on demand at
-the lines it names. A null `docsDigestPath` means no mandate.
+digest your caller passes, then pull files on demand at the lines it
+names. A null digest path means no docs mandate.
 
 ## Close gates — one credited run
 
@@ -90,7 +89,7 @@ the lines it names. A null `docsDigestPath` means no mandate.
 (**typecheck, lint, test, format, maintainability, coverage, crap**) and is
 the authoritative gate — do not pre-run it. The **one** exception is
 the full suite: run it exactly once, after the self-eval loop's last fix
-commit and immediately before the push, in the shape close credits. A bare
+commit and immediately after the push, in the shape close credits. A bare
 `npm test` / `pnpm run test` deposits **no** credit:
 
 ```bash
@@ -102,8 +101,9 @@ node <main-repo>/.agents/scripts/evidence-gate.js --standalone \
 ```
 
 Dispatch it in the **background**: it routinely outruns the host's sync
-Bash ceiling, and its completion re-invokes you — that is the signal. Never spawn a task to poll or `sleep`-loop
-against it; a waiter whose condition is wrong outlives the agent. Share
+Bash ceiling, and its completion re-invokes you — which is why the push
+comes first. Never spawn a task to poll or `sleep`-loop
+against it; a waiter with a wrong condition outlives the agent. Share
 `lint` / `typecheck` evidence with close via `evidence-gate.js`; never
 stamp coverage / CRAP fresh any other way.
 
@@ -117,13 +117,12 @@ Waiter traps: [`parallel-tooling.md`](../workflows/helpers/parallel-tooling.md)
 
 ## Acceptance self-eval before close (MUST)
 
-After the implementation commits land and **before** flipping to `closing`,
-run the bounded acceptance self-eval loop
+**Before** flipping to `closing`, run the bounded self-eval loop
 ([`acceptance-self-eval.md`](../workflows/helpers/acceptance-self-eval.md)).
 It scores the change set you computed **once** and injected into the critic
 — never one it re-derives — against each `acceptance[]` item,
 consuming `verify[]` output as evidence. **proceed** → flip to `closing`,
-push, hand off; **redraft** → fix the flagged criteria, commit, re-eval;
+push, capture, hand off; **redraft** → fix the criteria, commit, re-eval;
 **block** → take the blocked path below. Never hand off an unscored
 branch.
 
@@ -141,20 +140,22 @@ branch.
 
 The init envelope carries `remoteVerified` + `remoteProbe`. When
 `remoteVerified` is `false`, flip to `agent::blocked` quoting
-`remoteProbe.detail` and stop. A PR opened by
-`single-story-close.js` is the only sanctioned landing.
+`remoteProbe.detail` and stop. A PR opened by `single-story-close.js` is
+the only sanctioned landing.
 
 ## Your turn ends at a pushed branch (MUST)
 
 You do **not** run close. Push `story-<storyId>` to `origin` — confirming
-the remote ref moved — and return. The dispatching orchestrator runs
+the remote ref moved — **before** the credited capture, then return: the
+capture is backgrounded, so its completion ends your turn, and a turn that
+ends unpushed reads as unfinished work. The orchestrator runs
 `single-story-close.js` in its own session, serialized against your
-siblings. Do not open the PR, flip `agent::done`, or spawn a child to close
-on your behalf. If the push fails, take the blocked path above.
+siblings. Do not open the PR, flip `agent::done`, or spawn a child to
+close for you. If the push fails, take the blocked path above.
 
 ## Return contract — the hand-off report
 
 A short, literal hand-off your caller can act on: Story id, `workCwd`,
-branch, pushed head SHA, self-eval verdict, `verify[]` evidence. Say plainly
-the branch is pushed and unclosed. Never hand-compose a terminal envelope —
+branch, pushed head SHA, self-eval verdict, `verify[]` evidence. Say the
+branch is pushed and unclosed. Never hand-compose a terminal envelope —
 inventing one makes an unlanded Story look landed.

package/.agents/audit-checklists/accessibility.md

@@ -24,7 +24,4 @@ Self-check your change against this lens's concerns before you ship:
 - [ ] Media alternatives
 - [ ] Contrast where statically derivable
 - [ ] Raw-element census
-- [ ] Resolve the target from config — never a hardcoded URL.
-- [ ] Sample routes from the navigability SSOT.
 - [ ] Run an accessibility engine per sampled route.
-- [ ] Median-of-3 or provisional.

package/.agents/audit-checklists/mobile.md

@@ -28,8 +28,4 @@ Self-check your change against this lens's concerns before you ship:
 - [ ] Typography and spacing
 - [ ] Coverage — is anything exercised at a non-desktop viewport?
 - [ ] Effectiveness — does that exercise assert anything mobile-specific?
-- [ ] Resolve the target from config — never a hardcoded URL.
-- [ ] Sample routes from the navigability SSOT.
 - [ ] Drive two form factors per route.
-- [ ] Median-of-3 or provisional.
-- [ ] Leave the viewport as you found it.

package/.agents/docs/agentrc-reference.json

@@ -75,7 +75,8 @@
     ],
     "memoryPool": {
       "staleAfterDays": 30,
-      "growthDelta": 25
+      "growthDelta": 25,
+      "indexByteCeiling": 24576
     },
     "failOnSharedEditors": false,
     "requireExplicitCrossStoryDeps": false,
@@ -353,7 +354,8 @@
       },
       "autoMerge": "trust-ci",
       "blockOnAdvisoryFailure": true,
-      "advisoryAllowlist": []
+      "advisoryAllowlist": [],
+      "rerunAdvisory": 0
     },
     "routing": {
       "roleScopedAgents": true,

package/.agents/docs/configuration.md

@@ -130,6 +130,7 @@ Inputs to `/mandrel-plan`: risk escalation heuristics, ceremony-lite routing, th
 | `memoryPool` | No | `object` | — | Thresholds for the memory-hygiene advisory `/mandrel-plan` surfaces at Gate #1. Advisory only: it recommends `/memory-consolidate` and never gates, reroutes, or mutates the memory pool. |
 | `memoryPool.staleAfterDays` | No | `integer` | `30` | Recommend a consolidation pass once the pool's stamp is older than this many days. Default 30. |
 | `memoryPool.growthDelta` | No | `integer` | `25` | Recommend a consolidation pass once this many entries have been written since the last one. Measured against the entry count the last pass stamped, so a stamp predating that field leaves growth unmeasured and only the age threshold applies. Default 25. |
+| `memoryPool.indexByteCeiling` | No | `integer` | `24576` | Recommend a consolidation pass once the pool's `MEMORY.md` index exceeds this many bytes. Independent of the age and growth thresholds: the harness truncates the index it loads into each session at its own byte cap, so an oversized index is a loss already happening — every entry listed after the cut is invisible — rather than a hygiene forecast. Default 24576, the harness cap itself. |
 | `failOnSharedEditors` | No | `boolean` | `false` | When true, upgrade shared-editor conflict findings to hard errors (default false — advisory soft findings only). |
 | `requireExplicitCrossStoryDeps` | No | `boolean` | `false` | When true, upgrade implicit cross-Story dependency findings to hard errors (default false — advisory soft findings only). |
 | `crossCuttingRegistries` | No | `string[]` or `{ append?, prepend? }` | `["lib/orchestration/lifecycle/listeners/index.js","**/listeners/index.js","**/handlers/index.js"]` | Registry path patterns whose concurrent edits across Stories are flagged as conflicts. Defaults to the framework listener/handler index patterns when omitted. |
@@ -330,6 +331,7 @@ Everything `/mandrel-deliver` and `single-story-close` consume: execution timeou
 | `ci.autoMerge` | No | `"trust-ci"` \| `"strict"` | `"trust-ci"` | Story #4356 (Epic #4355). Merge posture. 'trust-ci' (default) merges once required checks pass; 'strict' additionally requires a clean review gate. |
 | `ci.blockOnAdvisoryFailure` | No | `boolean` | `true` | Story #5096. When true (default), delivery refuses to arm — and disarms — GitHub native auto-merge while a non-required (advisory) check is genuinely red on the PR head and GitHub reports the PR mergeable anyway (mergeStateStatus=UNSTABLE). `--auto` waits on REQUIRED contexts only, so without this a red advisory quality gate merges unattended. Set false to restore the pre-#5096 behaviour verbatim. |
 | `ci.advisoryAllowlist` | No | `array<string>` | `[]` | Story #5096. Check-run names exempt from blockOnAdvisoryFailure — a red run whose name matches exactly never blocks arming. Matching is exact; an unnamed run can never match and always blocks. |
+| `ci.rerunAdvisory` | No | `integer` | `0` | Story #5266. How many times close may re-run a failed advisory workflow run before blocking on it, per close invocation. Default 0: close spends no CI minutes and issues no GitHub mutation on an advisory red unless asked. At n > 0 the failed run(s) are re-run within that allowance and the merge wait re-polls inside its existing budget, landing or blocking on the re-run verdict. Overridden per invocation by --rerun-advisory <n>. |
 | `routing` | No | `object` | — | v2 delivery-spawn routing: role-scoped boot contexts and maker-checker sampling. The v1 singleDelivery epic-route kill-switch was removed in Stage 6. |
 | `routing.roleScopedAgents` | No | `boolean` | `true` | Epic #4478 (M7-B). Kill-switch for the role-scoped boot contexts. When true (default), a converted delivery spawn (`story-worker`, `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system prompt instead of re-paying the full CLAUDE.md @-import closure. When false, every converted spawn falls back to `subagent_type: general-purpose` — the instant, code-rollback-free per-consumer revert, and the universal escape for hosts that ignore `.claude/agents/`. The fallback is the full-closure agent that ran before M7-B, so flipping it off never drops a gate. |
 | `routing.freshCriticSampleRate` | No | `number` | `0.2` | Epic #4478 (M7-B, Part 2). Maker-checker sampling floor. Under the standard profile, a change set touching no sensitive path routes its acceptance clusters down the contract-identical inline critic path, but this fraction of them is still forced through a fresh-context critic so a low derived level never means zero independent checking. Clamped to [0, 1]; 0 disables the floor, 1 forces every cluster fresh. Consumed by resolveCeremonyForRisk (lib/orchestration/ceremony-routing.js). |

package/.agents/schemas/agentrc.schema.json

@@ -377,6 +377,12 @@
               "minimum": 1,
               "description": "Recommend a consolidation pass once this many entries have been written since the last one. Measured against the entry count the last pass stamped, so a stamp predating that field leaves growth unmeasured and only the age threshold applies. Default 25.",
               "default": 25
+            },
+            "indexByteCeiling": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "Recommend a consolidation pass once the pool's `MEMORY.md` index exceeds this many bytes. Independent of the age and growth thresholds: the harness truncates the index it loads into each session at its own byte cap, so an oversized index is a loss already happening — every entry listed after the cut is invisible — rather than a hygiene forecast. Default 24576, the harness cap itself.",
+              "default": 24576
             }
           },
           "additionalProperties": false
@@ -1975,6 +1981,12 @@
               },
               "description": "Story #5096. Check-run names exempt from blockOnAdvisoryFailure — a red run whose name matches exactly never blocks arming. Matching is exact; an unnamed run can never match and always blocks.",
               "default": []
+            },
+            "rerunAdvisory": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Story #5266. How many times close may re-run a failed advisory workflow run before blocking on it, per close invocation. Default 0: close spends no CI minutes and issues no GitHub mutation on an advisory red unless asked. At n > 0 the failed run(s) are re-run within that allowance and the merge wait re-polls inside its existing budget, landing or blocking on the re-run verdict. Overridden per invocation by --rerun-advisory <n>.",
+              "default": 0
             }
           },
           "additionalProperties": false
@@ -2084,7 +2096,9 @@
                         "not": {
                           "pattern": "([;&|`]|\\$\\()"
                         },
-                        "minLength": 1
+                        "minLength": 1,
+                        "pattern": "^[a-z0-9][a-z0-9._-]*(?:\\/[a-z0-9][a-z0-9._-]*)+$",
+                        "description": "Tier-relative skill id, e.g. `stack/qa/acme-sso`: lowercase segments of letters, digits, `.`, `_` or `-`, at least two of them, separated by `/`. A traversal (`../..`), an absolute path, a backslash or an uppercase segment is rejected here rather than normalized."
                       }
                     },
                     "required": ["skill"],

package/.agents/schemas/lifecycle/merge.unlanded.schema.json

@@ -30,7 +30,8 @@
         "arm-failure",
         "api-race-other",
         "predicate-refused",
-        "advisory-gate-red"
+        "advisory-gate-red",
+        "advisory-gate-inconclusive"
       ]
     },
     "reason": { "type": "string", "minLength": 1 },

package/.agents/schemas/story-deliver-terminal.schema.json

@@ -131,6 +131,7 @@
             "api-race-other",
             "predicate-refused",
             "advisory-gate-red",
+            "advisory-gate-inconclusive",
             "merged-flip-failed"
           ]
         },

package/.agents/scripts/audit-to-stories.js

@@ -50,13 +50,17 @@ import {
 } from './lib/audit-to-stories/ledger-commit.js';
 import {
   parseAuditReports,
-  parseSeverityTally,
+  readSeverityTally,
 } from './lib/audit-to-stories/parse-audit-md.js';
 import { buildPlanSeedMarkdown } from './lib/audit-to-stories/seed-from-findings.js';
 import { wireAuditStoryEdges } from './lib/audit-to-stories/wire-dependencies.js';
 import { runAsCli } from './lib/cli-utils.js';
 import { searchSemanticCandidates } from './lib/findings/semantic-issue-search.js';
-import { SEVERITIES, SEVERITY_RANK } from './lib/findings/severity.js';
+import {
+  normalizeSeverity,
+  SEVERITIES,
+  SEVERITY_RANK,
+} from './lib/findings/severity.js';
 import { Logger } from './lib/Logger.js';
 import { parse as parseStoryBody } from './lib/story-body/story-body.js';
 
@@ -209,6 +213,11 @@ function auditReportFailures({
  *   hand-written report). `allowMissingTally` downgrades ONLY this kind to a
  *   warning, for an interactive `--scan` over legacy reports.
  * - `tally-mismatch` — the report says one thing and the parse says another.
+ * - `duplicate-tally` — the report declares the tally more than once, so there
+ *   is no single number to check against. Adopting whichever line the scan
+ *   reached first would compare the parse against an arbitrary one of two
+ *   declarations, which is a cross-check in name only. `allowMissingTally`
+ *   does NOT downgrade it: the report is contradictory, not merely old.
  * - `unresolved-severity` — a finding parsed with no resolvable severity. It
  *   is a report defect, never an `unknown` group.
  *
@@ -232,7 +241,11 @@ function crossCheckReports({ reports, findings, allowMissingTally }) {
   for (const report of reports) {
     const own = byReport.get(report.sourceReport) ?? [];
     const parsed = comparableTally(own);
-    const reported = parseSeverityTally(report.markdown);
+    const {
+      tally: reported,
+      matches: tallyLines,
+      duplicate,
+    } = readSeverityTally(report.markdown);
     const sourceReport = report.sourceReport;
     const unresolved = own.filter((f) => !f.severity);
     if (unresolved.length > 0) {
@@ -244,6 +257,16 @@ function crossCheckReports({ reports, findings, allowMissingTally }) {
         titles: unresolved.map((f) => f.title),
       });
     }
+    if (duplicate) {
+      failures.push({
+        sourceReport,
+        kind: 'duplicate-tally',
+        reported: null,
+        parsed,
+        tallyLines,
+      });
+      continue;
+    }
     if (!reported) {
       const failure = {
         sourceReport,
@@ -282,7 +305,7 @@ function missingTallyWarning(failure) {
  *
  * Pure: returns the message string so the caller owns the single `Logger.warn`.
  *
- * @param {Array<{ sourceReport: string, kind: string, reported: object|null, parsed: object, titles?: string[] }>} failures
+ * @param {Array<{ sourceReport: string, kind: string, reported: object|null, parsed: object, titles?: string[], tallyLines?: string[] }>} failures
  * @returns {string}
  */
 function reportFailureWarning(failures) {
@@ -290,7 +313,13 @@ function reportFailureWarning(failures) {
     const titles = f.titles?.length
       ? ` findings=${f.titles.map((t) => `"${t}"`).join(', ')}`
       : '';
-    return `  - ${f.sourceReport} [${f.kind}] reported=${formatTally(f.reported)} parsed=${formatTally(f.parsed)}${titles}`;
+    // A duplicate names the competing lines rather than a tally: there is no
+    // single `reported` number to print, and "which two lines" is the whole
+    // remedy.
+    const declared = f.tallyLines?.length
+      ? ` declared=${f.tallyLines.map((t) => `"${t}"`).join(' | ')}`
+      : '';
+    return `  - ${f.sourceReport} [${f.kind}] reported=${formatTally(f.reported)} parsed=${formatTally(f.parsed)}${titles}${declared}`;
   });
   return [
     `audit report cross-check FAILED for ${failures.length} report(s) — the declared severity tally does not match the parsed findings:`,
@@ -359,6 +388,34 @@ function normaliseIssueHit(hit) {
   };
 }
 
+/**
+ * Walk the list endpoint once per label and merge the pages into one
+ * deduplicated, normalised issue list.
+ *
+ * `labels` is an OR across the run's lenses, which the REST list endpoint
+ * cannot express in one query (its `labels` parameter is an AND), so one call
+ * per label is the narrowest honest read. Each is a paginated **list**, not a
+ * search — a different, far larger rate-limit budget.
+ *
+ * @param {object} provider
+ * @param {string[]} labels
+ * @returns {Promise<Array<object>>}
+ */
+async function listIssuesForLabels(provider, labels) {
+  const seen = new Map();
+  for (const label of labels) {
+    const issues = await provider.listIssuesByLabel({
+      state: 'all',
+      labels: label,
+    });
+    for (const raw of issues ?? []) {
+      const hit = normaliseIssueHit(raw);
+      if (!seen.has(hit.number)) seen.set(hit.number, hit);
+    }
+  }
+  return [...seen.values()];
+}
+
 /**
  * The two read ports the dedupe module consumes, adapted off the provider's
  * one full-text `searchIssues` call: `findIssuesByFingerprint(sha)` for the
@@ -368,7 +425,8 @@ function normaliseIssueHit(hit) {
  *
  * @param {object} provider
  * @param {{ owner: string, repo: string }} coords
- * @returns {{ findIssuesByFingerprint: Function, searchCandidates: Function }}
+ * @returns {{ findIssuesByFingerprint: Function, listAuditIssues: Function,
+ *   searchCandidates: Function }}
  */
 function buildDedupPorts(provider, { owner, repo }) {
   return {
@@ -376,6 +434,21 @@ function buildDedupPorts(provider, { owner, repo }) {
       const hits = await provider.searchIssues({ query: sha, owner, repo });
       return (hits ?? []).map(normaliseIssueHit);
     },
+    /**
+     * List every Issue carrying one of the run's `audit::*` labels, once, off
+     * the REST list endpoint. The dedup module indexes the result and answers
+     * every exact-fingerprint lookup from it, so the rate-limited search API is
+     * spent only on findings it has never seen. A provider without the list
+     * port yields `null`, which returns dedup to the per-finding search path
+     * rather than silently skipping it.
+     *
+     * @param {string[]} labels
+     * @returns {Promise<Array<object>|null>}
+     */
+    async listAuditIssues(labels) {
+      if (typeof provider.listIssuesByLabel !== 'function') return null;
+      return listIssuesForLabels(provider, labels);
+    },
     async searchCandidates(finding) {
       // Wire the shared semantic search onto the provider's full-text
       // issue search (open + closed) so route-finding's Stage-1 pass runs.
@@ -667,6 +740,7 @@ async function buildPlan(
         groups,
         provider,
         searchCandidates: provider.searchCandidates,
+        listAuditIssues: provider.listAuditIssues,
       });
       classifications = result.classifications;
       summary = result.summary;
@@ -1117,6 +1191,73 @@ export const __testing = {
  * }} [deps]
  * @returns {Promise<void>}
  */
+/**
+ * The one-line `--ledger-commit` outcome, for stderr.
+ *
+ * Names the branch and the PR on success — the two things an operator needs to
+ * go look at it — and the skip reason otherwise, because "nothing happened" and
+ * "the ledger was already clean" are different facts and only one of them is
+ * fine.
+ *
+ * @param {{ committed?: boolean, reason?: string, branch?: string,
+ *   prUrl?: string|null, resumed?: boolean, ledgerPath?: string }} [result]
+ * @returns {string}
+ */
+function describeLedgerCommit(result) {
+  return result?.committed
+    ? ledgerCommittedLine(result)
+    : ledgerSkippedLine(result);
+}
+
+/**
+ * The success half: the branch, whether it resumed a half-finished one, and
+ * the PR to go look at.
+ * @param {object} result
+ * @returns {string}
+ */
+function ledgerCommittedLine(result) {
+  const resumed = result.resumed ? ' (resumed an unpushed ledger branch)' : '';
+  const pr = result.prUrl ?? '(no URL reported by gh)';
+  return `--ledger-commit: pushed ${result.branch}${resumed} and opened ${pr}.`;
+}
+
+/**
+ * The skip half. It names the ledger file, because the fact that matters is
+ * which state is still only in the working tree.
+ * @param {object} [result]
+ * @returns {string}
+ */
+function ledgerSkippedLine(result) {
+  const reason = result?.reason ?? 'no result';
+  const ledgerPath = result?.ledgerPath ?? 'the ledger';
+  return `--ledger-commit: skipped (${reason}) — ${ledgerPath} was not committed.`;
+}
+
+/**
+ * Validate `--severity` against the canonical scale, failing on a value the
+ * filter would silently ignore.
+ *
+ * `meetsSeverity` reads an unknown threshold as rank `0`, so a typo — the
+ * classic being `--severity Hgh` — quietly widened the run to every finding
+ * instead of narrowing it. On an unattended sweep that is the difference
+ * between filing a batch and filing the backlog, with nothing on stderr to say
+ * so. An absent flag stays absent: the floor then resolves from config.
+ *
+ * @param {string|undefined} raw
+ * @returns {string|undefined} the canonical level.
+ */
+function validateSeverityFlag(raw) {
+  if (raw === undefined || raw === null || raw === '') return undefined;
+  if (String(raw).toLowerCase() === 'all') return 'all';
+  const level = normalizeSeverity(String(raw), null);
+  if (!level) {
+    throw new Error(
+      `[audit-to-stories] --severity "${raw}" is not a severity. Accepted: ${SEVERITIES.join(', ')} (or "all").`,
+    );
+  }
+  return level;
+}
+
 export async function runAuditToStories(
   argv = process.argv.slice(2),
   deps = {},
@@ -1156,6 +1297,8 @@ export async function runAuditToStories(
     strict: false,
   });
 
+  values.severity = validateSeverityFlag(values.severity);
+
   const json = (value) => JSON.stringify(value, null, 2);
 
   const runAutoSummary = async () =>
@@ -1175,7 +1318,15 @@ export async function runAuditToStories(
   // findings, so the PR attempt is the last thing the run does (Story #5145).
   const commitLedger = async () => {
     if (!values['ledger-commit'] || values['dry-run']) return;
-    await runLedgerCommitImpl({ ledgerPath: values.ledger });
+    // Say what happened. The tail used to run silently, so an operator could
+    // not tell a ledger PR from a skip without going to look for the branch —
+    // and a skip is the outcome that matters, because it means the sweep's
+    // memory is still only in the working tree.
+    Logger.warn(
+      describeLedgerCommit(
+        await runLedgerCommitImpl({ ledgerPath: values.ledger }),
+      ),
+    );
   };
 
   const scanPlan = () =>