fix(report): disclose explicit coverage exclusions

[BenSheridanEdwards]

Why does this feature exist?

A complete coverage report claimed every registered surface was captured even when the coverage ledger contained an explicit exclusion. Separately, a clean advisory Action comment told reviewers to rebuild the map even though its captures and certification were already complete. Both messages contradicted their source artifacts.

What changed?

• Reports now show the exact split between registered surfaces that were captured and surfaces that were explicitly excluded.
• Clean advisory Action comments now state that no approval is required; advisory reports with changes direct reviewers to inspect those changes without claiming the map is stale.
• Added regressions for a three-surface registry with two captures and one reviewed exclusion, and for clean/changed advisory comment guidance.
• Documented both corrections under the unreleased changelog.

Behavioural Proof (with video and screenshots)

Not applicable — this changes generated Markdown evidence, not a rendered application UI. The replacement proof is the privacy-clean generated output and automated regressions below.

**Certification**
- **Coverage** — ✓ complete (2 of 3 registered surface(s) captured; 1 explicitly excluded)
- **Determinism** — ✓ proven (base self-checked, head self-checked)
- **Inventory** — ✓ navigable set unchanged

_StyleProof is advisory for this repository; no approval is required._

✔ complete coverage distinguishes captures from explicit exclusions
✔ clean advisory reports use truthful non-approval guidance
✔ changed advisory reports direct reviewers to the report without stale-map guidance

Verification Summary

• Definition of Done: followed .agents/project/DEFINITION_OF_DONE.md.
• Commands run:
  • npm run build && npm run typecheck && npm run lint && npm run format:check
  • npm run privacy:check
  • npm test
  • npm run test:e2e
  • npm run demo:report
  • npm pack --dry-run --json
  • npm audit --audit-level=high
• Results: all static gates passed; 671 unit tests and 121 browser E2E tests passed; the demo report remained fresh; the package contains the required license, docs, build output, and CLI files; the audit found zero high-severity vulnerabilities. All hosted checks passed on exact head 4b20808 and GitHub reports the PR CLEAN and mergeable.
• Known risks or skipped checks: screenshots are not applicable because the output is Markdown. No required automated check was skipped.

Checklist

• Proof above — pasted the generated report excerpts and regression results
• If you changed capture/diff/report rendering, ran npm run demo:report and committed docs/demo/
• npm run build && npm run typecheck && npm run lint && npm run format:check pass
• npm test passes (and npm run test:e2e if the capture/engine path changed)
• Added/updated tests for the change
• Updated the README / CHANGELOG if behaviour or the public API changed
• If captured output changed, noted that adopters must regenerate baselines
• Followed .agents/project/DEFINITION_OF_DONE.md and .agents/skills/pr-inline-screenshot-proof/SKILL.md
• Screenshots are committed and embedded inline with ![alt](...png?raw=1), or the proof section says Not applicable with the technical reason
• The PR body has no bare screenshot links, local paths, relative paths, or proof placeholders

[github-actions]

Note

Synthetic action dogfood receipt. This report is the final deliberately failing fixture in the action contract suite. It proves that unproven evidence is rejected; it does not certify this pull request.

🗺️ StyleProof report

📊 View the side-by-side visual report →

---

Coverage, determinism, or report/diff consistency evidence is incomplete — repair the capture or reflow source; reviewer approval cannot clear this failure.