What a change scan found.

everything is a successful scan, not a failure: a blast-radius file changed, so the dep-graph filter cannot be trusted and the whole suite must run. Making that a named variant is the point of this type. It used to be null, returned alongside a Set and against a throw for real failure — so the caller held a Set<string> | null | Error and discriminated it by instanceof, with changed === null ("run everything") sitting directly beside changed.size === 0 ("run nothing"). Two adjacent branches, opposite meanings, one of them a sentinel.

const full: ChangeScan = { scope: 'everything', trigger: 'package.json' };
const subset: ChangeScan = { scope: 'paths', paths: new Set(['/proj/lib/a.ts']) };