fallow 3.41.0 → 3.43.0

package/issue-registry.json

@@ -1300,6 +1300,42 @@
       "license_note": null,
       "docs_url": "https://fallow.tools/docs/explanations/dead-code/#absent-component-props"
     },
+    {
+      "id": "constant-parameter",
+      "rule_id": "fallow/constant-parameter",
+      "command": "dead-code",
+      "category": "Dead code",
+      "description": "Each visible call passes a function parameter in the same way",
+      "label": "Constant Parameters",
+      "config_key": "constant-parameters",
+      "registry_index": 35,
+      "aliases": [
+        "constant-parameters"
+      ],
+      "lsp": true,
+      "filter_flag": "--constant-parameters",
+      "result_key": "constant_parameters",
+      "summary_label": "Constant parameters",
+      "summary_docs_anchor": "constant-parameters",
+      "sarif_rule_ids": [
+        "fallow/constant-parameter"
+      ],
+      "codeclimate_check_names": [
+        "fallow/constant-parameter"
+      ],
+      "ts_alias": null,
+      "counts_in_total": true,
+      "fixable": false,
+      "suppressible": true,
+      "suppress_comment": "// fallow-ignore-next-line constant-parameter",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
+      "note": "Opt-in manual review candidate; defaults to off. Inspect the calls and the intent of the parameter before changing the function. No automatic fix.",
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://fallow.tools/docs/explanations/dead-code/#constant-parameters"
+    },
     {
       "id": "unused-component-emit",
       "rule_id": "fallow/unused-component-emit",
@@ -1308,7 +1344,7 @@
       "description": "A Vue <script setup> defineEmits event is emitted nowhere in its own component",
       "label": "Unused Component Emits",
       "config_key": "unused-component-emits",
-      "registry_index": 35,
+      "registry_index": 36,
       "aliases": [
         "unused-component-emits"
       ],
@@ -1344,7 +1380,7 @@
       "description": "An Angular @Input() / signal input() / model() input is read nowhere in its own component",
       "label": "Unused Component Inputs",
       "config_key": "unused-component-inputs",
-      "registry_index": 36,
+      "registry_index": 37,
       "aliases": [
         "unused-component-inputs"
       ],
@@ -1380,7 +1416,7 @@
       "description": "An Angular @Output() / signal output() output is emitted nowhere in its own component",
       "label": "Unused Component Outputs",
       "config_key": "unused-component-outputs",
-      "registry_index": 37,
+      "registry_index": 38,
       "aliases": [
         "unused-component-outputs"
       ],
@@ -1416,7 +1452,7 @@
       "description": "A Svelte component dispatches a createEventDispatcher event whose name is listened to nowhere in the project",
       "label": "Unused Svelte Events",
       "config_key": "unused-svelte-events",
-      "registry_index": 38,
+      "registry_index": 39,
       "aliases": [
         "unused-svelte-events"
       ],
@@ -1452,7 +1488,7 @@
       "description": "A Next.js Server Action exported from a \"use server\" file is referenced by no code in the project",
       "label": "Unused Server Actions",
       "config_key": "unused-server-actions",
-      "registry_index": 39,
+      "registry_index": 40,
       "aliases": [
         "unused-server-actions"
       ],
@@ -1488,7 +1524,7 @@
       "description": "A SvelteKit load() return-object key is read by no consumer",
       "label": "Unused Load Data Keys",
       "config_key": "unused-load-data-keys",
-      "registry_index": 40,
+      "registry_index": 41,
       "aliases": [
         "unused-load-data-keys"
       ],
@@ -1524,7 +1560,7 @@
       "description": "An Effect layer is composed only into layers that nothing uses",
       "label": "Unused Effect Layers",
       "config_key": "unused-effect-layers",
-      "registry_index": 41,
+      "registry_index": 42,
       "aliases": [
         "unused-effect-layers"
       ],
@@ -1560,7 +1596,7 @@
       "description": "An Effect tagged error class is referenced only as a type or a catchTag string, and no code constructs or fails with it",
       "label": "Unused Tagged Errors",
       "config_key": "unused-tagged-errors",
-      "registry_index": 42,
+      "registry_index": 43,
       "aliases": [
         "unused-tagged-errors"
       ],
@@ -1596,7 +1632,7 @@
       "description": "A catchTag handler names a project error tag that no code produces",
       "label": "Unproduced Catch Tags",
       "config_key": "unproduced-catch-tags",
-      "registry_index": 43,
+      "registry_index": 44,
       "aliases": [
         "unproduced-catch-tags"
       ],
@@ -1632,7 +1668,7 @@
       "description": "Two or more Next.js App Router route files resolve to the same URL",
       "label": "Route Collisions",
       "config_key": "route-collision",
-      "registry_index": 44,
+      "registry_index": 45,
       "aliases": [
         "route-collisions"
       ],
@@ -1670,7 +1706,7 @@
       "description": "Sibling Next.js dynamic route segments use different slug names at the same position",
       "label": "Dynamic Segment Conflicts",
       "config_key": "dynamic-segment-name-conflict",
-      "registry_index": 45,
+      "registry_index": 46,
       "aliases": [
         "dynamic-segment-name-conflicts"
       ],
@@ -1708,7 +1744,7 @@
       "description": "Suppression comment or tag no longer matches any issue",
       "label": "Stale Suppressions",
       "config_key": "stale-suppressions",
-      "registry_index": 46,
+      "registry_index": 47,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--stale-suppressions",
@@ -1744,7 +1780,7 @@
       "description": "Suppression comment omits a required reason",
       "label": "Missing Suppression Reasons",
       "config_key": "require-suppression-reason",
-      "registry_index": 47,
+      "registry_index": 48,
       "aliases": [
         "missing-suppression-reasons"
       ],
@@ -1776,7 +1812,7 @@
       "description": "Catalog entry not referenced by any workspace package",
       "label": "Unused Catalog Entries",
       "config_key": "unused-catalog-entries",
-      "registry_index": 48,
+      "registry_index": 49,
       "aliases": [
         "catalog",
         "unused-catalog-entries"
@@ -1816,7 +1852,7 @@
       "description": "Named catalog group has no entries",
       "label": "Empty Catalog Groups",
       "config_key": "empty-catalog-groups",
-      "registry_index": 49,
+      "registry_index": 50,
       "aliases": [
         "empty-catalog",
         "empty-catalog-groups"
@@ -1856,7 +1892,7 @@
       "description": "package.json references a catalog that does not declare the package",
       "label": "Unresolved Catalog References",
       "config_key": "unresolved-catalog-references",
-      "registry_index": 50,
+      "registry_index": 51,
       "aliases": [
         "unresolved-catalog",
         "unresolved-catalog-references"
@@ -1896,7 +1932,7 @@
       "description": "Package-manager override target is not declared or resolved",
       "label": "Unused Dependency Overrides",
       "config_key": "unused-dependency-overrides",
-      "registry_index": 51,
+      "registry_index": 52,
       "aliases": [
         "unused-dependency-overrides",
         "unused-override",
@@ -1937,7 +1973,7 @@
       "description": "Package-manager override has an unparsable key or value",
       "label": "Misconfigured Dependency Overrides",
       "config_key": "misconfigured-dependency-overrides",
-      "registry_index": 52,
+      "registry_index": 53,
       "aliases": [
         "misconfigured-dependency-overrides",
         "misconfigured-override",
@@ -1978,7 +2014,7 @@
       "description": "Detected feature flag pattern",
       "label": "Feature Flags",
       "config_key": "feature-flags",
-      "registry_index": 56,
+      "registry_index": 57,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2008,7 +2044,7 @@
       "description": "A React/Preact prop is forwarded unchanged through 3+ pass-through components to a distant consumer",
       "label": "Prop Drilling",
       "config_key": "prop-drilling",
-      "registry_index": 58,
+      "registry_index": 59,
       "aliases": [],
       "lsp": true,
       "filter_flag": null,
@@ -2042,7 +2078,7 @@
       "description": "A React/Preact component whose whole body is a single spread-forwarded child render (a candidate for inlining)",
       "label": "Thin Wrappers",
       "config_key": "thin-wrapper",
-      "registry_index": 59,
+      "registry_index": 60,
       "aliases": [
         "thin-wrappers"
       ],
@@ -2078,7 +2114,7 @@
       "description": "Three or more React/Preact components across two or more files declare an identical prop-name set (a missing shared Props type)",
       "label": "Duplicate Prop Shapes",
       "config_key": "duplicate-prop-shape",
-      "registry_index": 60,
+      "registry_index": 61,
       "aliases": [
         "duplicate-prop-shapes"
       ],
@@ -2114,7 +2150,7 @@
       "description": "CSS or CSS-in-JS hardcoded styling value bypasses the design token system",
       "label": "CSS Token Drift",
       "config_key": "css-token-drift",
-      "registry_index": 61,
+      "registry_index": 62,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2144,7 +2180,7 @@
       "description": "CSS or CSS-in-JS declaration block is duplicated across rules",
       "label": "CSS Duplicate Block",
       "config_key": "css-duplicate-block",
-      "registry_index": 62,
+      "registry_index": 63,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2174,7 +2210,7 @@
       "description": "CSS selector, nesting, or important usage is structurally complex",
       "label": "CSS Selector Complexity",
       "config_key": "css-selector-complexity",
-      "registry_index": 63,
+      "registry_index": 64,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2204,7 +2240,7 @@
       "description": "CSS or CSS-in-JS surface appears unused",
       "label": "CSS Dead Surface",
       "config_key": "css-dead-surface",
-      "registry_index": 64,
+      "registry_index": 65,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2234,7 +2270,7 @@
       "description": "CSS or CSS-in-JS reference resolves to no stylesheet definition",
       "label": "CSS Broken Reference",
       "config_key": "css-broken-reference",
-      "registry_index": 65,
+      "registry_index": 66,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2264,7 +2300,7 @@
       "description": "The change weakens tests or a coverage threshold",
       "label": "Weakened Tests",
       "config_key": "weakened-tests",
-      "registry_index": 66,
+      "registry_index": 67,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2294,7 +2330,7 @@
       "description": "The change adds a suppression comment",
       "label": "Added Suppressions",
       "config_key": "added-suppression",
-      "registry_index": 67,
+      "registry_index": 68,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2324,7 +2360,7 @@
       "description": "The change adds a test-environment branch to source code",
       "label": "Test-Only Branches",
       "config_key": "test-only-branch",
-      "registry_index": 68,
+      "registry_index": 69,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2354,7 +2390,7 @@
       "description": "The change edits one copy of duplicated code but not its siblings",
       "label": "Diverged Clone Siblings",
       "config_key": "diverged-clone-sibling",
-      "registry_index": 69,
+      "registry_index": 70,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2384,7 +2420,7 @@
       "description": "The change adds a dependency",
       "label": "Added Dependencies",
       "config_key": "added-dependency",
-      "registry_index": 70,
+      "registry_index": 71,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -3336,6 +3372,36 @@
       "license_note": null,
       "docs_url": "https://fallow.tools/docs/cli/security/"
     },
+    {
+      "id": "mutation-survived",
+      "rule_id": "fallow/mutation-survived",
+      "command": "mutation",
+      "category": "Tests",
+      "description": "A small code change made no test fail",
+      "label": null,
+      "config_key": null,
+      "registry_index": null,
+      "aliases": [],
+      "lsp": false,
+      "filter_flag": null,
+      "result_key": null,
+      "summary_label": null,
+      "summary_docs_anchor": null,
+      "sarif_rule_ids": null,
+      "codeclimate_check_names": null,
+      "ts_alias": null,
+      "counts_in_total": false,
+      "fixable": false,
+      "suppressible": false,
+      "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
+      "note": null,
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://fallow.tools/docs/cli/mutation/"
+    },
     {
       "id": "mysql-multiple-statements",
       "rule_id": "security/mysql-multiple-statements",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.41.0",
+  "version": "3.43.0",
   "mcpName": "io.github.fallow-rs/fallow",
   "description": "Codebase intelligence for TypeScript and JavaScript: health, complexity, duplication, architecture, styling drift, and unused code from one graph. CLI, LSP, and MCP server. Zero config for over 100 frameworks.",
   "license": "MIT",
@@ -92,14 +92,13 @@
     "@tanstack/intent": "0.5.6"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.41.0",
-    "@fallow-cli/darwin-x64": "3.41.0",
-    "@fallow-cli/linux-x64-gnu": "3.41.0",
-    "@fallow-cli/linux-arm64-gnu": "3.41.0",
-    "@fallow-cli/linux-x64-musl": "3.41.0",
-    "@fallow-cli/linux-arm64-musl": "3.41.0",
-    "@fallow-cli/win32-arm64-msvc": "3.41.0",
-    "@fallow-cli/win32-x64-msvc": "3.41.0",
-    "fallow-type-aware": "3.41.0"
+    "@fallow-cli/darwin-arm64": "3.43.0",
+    "@fallow-cli/darwin-x64": "3.43.0",
+    "@fallow-cli/linux-x64-gnu": "3.43.0",
+    "@fallow-cli/linux-arm64-gnu": "3.43.0",
+    "@fallow-cli/linux-x64-musl": "3.43.0",
+    "@fallow-cli/linux-arm64-musl": "3.43.0",
+    "@fallow-cli/win32-arm64-msvc": "3.43.0",
+    "@fallow-cli/win32-x64-msvc": "3.43.0"
   }
 }

package/schema.json

@@ -189,11 +189,11 @@
       }
     },
     "mutation": {
-      "description": "Configures the explicit `fallow mutation` workflow: `runner` (`auto`\nor `vitest`), `operators` (kebab-case names, default each operator),\n`minScore` (0 to 100; a lower score exits with code 1), and\n`concurrency` (half the logical cores). No key starts a run, and the\nside-effect override is a CLI flag only.",
+      "description": "Configures the explicit `fallow mutation` workflow: `runner` (`auto`\nor `vitest`), `operators` (kebab-case names, default the default set),\n`minScore` (0 to 100; a lower score exits with code 1), and\n`concurrency` (half the logical cores). No key starts a run, and the\nside-effect override is a CLI flag only.",
       "$ref": "#/$defs/MutationConfig"
     },
     "health": {
-      "description": "Sets complexity and health thresholds for `fallow health` (also applied in combined `fallow` and `fallow audit`): `maxCyclomatic` (20), `maxCognitive` (15), `maxCrap` (30.0, findings at or above this are reported), `crapRefactorBand` (5, cyclomatic band below `maxCyclomatic` where a secondary refactor action is added), `maxUnitSize` (max function lines before a large-function finding, 60), `maxFileLines` (max physical lines per file before a file-level finding, 0 means off), `coverage`/`coverageRoot` (Istanbul coverage path and path-prefix strip for accurate CRAP), `ignore` globs (remove files from findings AND the health score), `thresholdOverrides` (per-file/per-function ceilings via `files`/`functions`/`maxCyclomatic`/`maxCognitive`/`maxCrap`/`maxUnitSize`/`maxFileLines`/`reason`), `ownership` (`botPatterns` and `emailMode` for `--ownership`), and `suggestInlineSuppression` (true, emit `suppress-line` action hints in JSON). Raise thresholds to relax which functions are flagged, wire `coverage` for real CRAP scores, or exempt generated/test files via `ignore` (drops them from the score too) or `thresholdOverrides` (keeps them visible under a higher ceiling). The `max*` thresholds govern findings only and never move `health_score`: its penalties use fixed calibration so grades stay comparable across projects, and `ignore` is the lever that removes files from the score.",
+      "description": "Sets complexity and health thresholds for `fallow health` (also applied in combined `fallow` and `fallow audit`): `maxCyclomatic` (20), `maxCognitive` (15), `maxCrap` (30.0, findings at or above this are reported), `crapRefactorBand` (5, cyclomatic band below `maxCyclomatic` where a secondary refactor action is added), `maxUnitSize` (max function lines before a large-function finding, 60), `maxFileLines` (max physical lines per file before a file-level finding, 0 means off), `coverage`/`coverageRoot` (Istanbul coverage path and path-prefix strip for accurate CRAP), `ignore` globs (remove files from findings AND the health score), `tailwindIgnorePatterns` (regexes on normalized `prefix-[value]` Tailwind arbitrary-value tokens to exclude from `--css` findings and analytics), `thresholdOverrides` (per-file/per-function ceilings via `files`/`functions`/`maxCyclomatic`/`maxCognitive`/`maxCrap`/`maxUnitSize`/`maxFileLines`/`reason`), `ownership` (`botPatterns` and `emailMode` for `--ownership`), and `suggestInlineSuppression` (true, emit `suppress-line` action hints in JSON). Raise thresholds to relax which functions are flagged, wire `coverage` for real CRAP scores, or exempt generated/test files via `ignore` (drops them from the score too) or `thresholdOverrides` (keeps them visible under a higher ceiling). The `max*` thresholds govern findings only and never move `health_score`: its penalties use fixed calibration so grades stay comparable across projects, and `ignore` is the lever that removes files from the score.",
       "$ref": "#/$defs/HealthConfig",
       "default": {
         "maxCyclomatic": 20,
@@ -248,6 +248,7 @@
         "unrendered-components": "warn",
         "unused-component-props": "warn",
         "absent-component-props": "off",
+        "constant-parameters": "off",
         "unused-component-emits": "warn",
         "unused-component-inputs": "warn",
         "unused-component-outputs": "warn",
@@ -332,6 +333,18 @@
         "configObjectHeuristics": false
       }
     },
+    "sharedStateAllowlist": {
+      "description": "Exact [global root, direct slot] pairs excluded from shared-state inventory.",
+      "type": "array",
+      "items": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "minItems": 2,
+        "maxItems": 2
+      }
+    },
     "security": {
       "description": "Scopes the opt-in `fallow security` catalogue: which candidate categories run and which extra local identifiers count as HTTP request objects. Set when tuning security-candidate detection; the object holds `categories` (an object with `include` and/or `exclude` string arrays of catalogue category ids, where `include` restricts to a whitelist and `exclude` removes from the admitted set, both unset admits all ordinary categories) and `requestReceivers` (a string array of project-local names that extend, not replace, the built-in `*.query`/`*.params`/`*.body` source-receiver allowlist). The `hardcoded-secret` and `secret-to-network` categories are include-required: they fire only when explicitly listed in `categories.include`, even when no include list is otherwise set. The valid category ids are enumerated (with title, CWE, and include-required flag) in the `security_categories` block of `fallow schema`, and also listed by `fallow security --help`; they are not in this config-schema.",
       "$ref": "#/$defs/SecurityConfig",
@@ -1174,7 +1187,7 @@
           "default": "auto"
         },
         "operators": {
-          "description": "The operators to use. Unset uses each operator. `--operators` wins.",
+          "description": "The operators to use. Unset uses the default set. An opt-in operator\nruns only when this list or `--operators` names it. `--operators`\nwins.",
           "type": [
             "array",
             "null"
@@ -1202,8 +1215,24 @@
           "format": "uint",
           "minimum": 1
         },
+        "mutantsPerLine": {
+          "description": "The maximum number of mutants on one source line. The plan keeps the\nmost productive mutants of the line (relational, condition,\narithmetic and logical operators first). The others are `pending`\nwith the reason `sampled-out`. Unset keeps each mutant.\n`--mutants-per-line` wins.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint",
+          "minimum": 1
+        },
+        "functionScope": {
+          "description": "Widen each changed line to the whole function that holds it, so that a\nchange to a parameter or a signature selects the mutants of the\nfunction. Only the changed-code scope uses it. Unset or `false` mutates\nthe changed lines only. `--function-scope` turns it on.",
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
         "typecheck": {
-          "description": "Type-check each survived mutant through the TypeScript-Go companion\nof `--type-aware`. A survivor that does not type-check becomes\n`compile_error` and does not count in the score. Unset or `false`\nchecks no survivor. `--typecheck` turns the check on.",
+          "description": "Type-check each survived mutant through the TypeScript-Go companion\nof `--type-aware`. A survivor that does not type-check becomes\n`compile_error` and does not count in the score. A survivor that\nremoves an optional-chaining link or a nullish fallback from a\nreceiver whose type excludes `null` and `undefined` gets an advisory\n`equivalence_hint`. Its status\nand the score do not change. Unset or `false` checks no survivor.\n`--typecheck` turns the check on.",
           "type": [
             "boolean",
             "null"
@@ -1293,7 +1322,7 @@
           "const": "boolean-literal"
         },
         {
-          "description": "A string literal emptied or filled.",
+          "description": "A string or template literal emptied or filled.",
           "type": "string",
           "const": "string-literal"
         },
@@ -1303,7 +1332,7 @@
           "const": "optional-chaining"
         },
         {
-          "description": "One token of a regular expression literal changed: an anchor\nremoved, a character class negated, or a class escape with the\nopposite case.",
+          "description": "One token of a regular expression literal changed: an anchor or a\nquantifier removed, a `{n,m}` range shortened to `{n}`, a character\nclass negated, or a class escape with the opposite case.",
           "type": "string",
           "const": "regex-literal"
         },
@@ -1311,6 +1340,56 @@
           "description": "`z.number().int()` to `z.number()` in a module-level `const`\ninitializer: one call link of a fluent chain removed.",
           "type": "string",
           "const": "removed-chain-link"
+        },
+        {
+          "description": "Opt-in. The statements of a block or function body removed.",
+          "type": "string",
+          "const": "block-statement"
+        },
+        {
+          "description": "Opt-in. `[x]` to `[]`, and `[]` to `[\"fallow\"]`.",
+          "type": "string",
+          "const": "array-literal"
+        },
+        {
+          "description": "Opt-in. A non-empty object literal to `{}`.",
+          "type": "string",
+          "const": "object-literal"
+        },
+        {
+          "description": "Opt-in. `startsWith` to `endsWith` and the other method pairs, or\n`s.trim()` to `s`.",
+          "type": "string",
+          "const": "method-expression"
+        },
+        {
+          "description": "Opt-in. The statements of a `case` clause removed.",
+          "type": "string",
+          "const": "switch-case"
+        },
+        {
+          "description": "Opt-in. A call in an expression position to `void 0`.",
+          "type": "string",
+          "const": "call-expression"
+        },
+        {
+          "description": "Opt-in. A `throw new X(...)` statement removed.",
+          "type": "string",
+          "const": "throw-statement"
+        },
+        {
+          "description": "Opt-in. The regex changes applied to a `new RegExp(\"...\")` pattern.",
+          "type": "string",
+          "const": "regex-constructor"
+        },
+        {
+          "description": "Opt-in. A lookaround negated, or `\\b` and `\\B` swapped.",
+          "type": "string",
+          "const": "regex-assertion"
+        },
+        {
+          "description": "Opt-in. `a ?? b` to `a`.",
+          "type": "string",
+          "const": "nullish-fallback"
         }
       ]
     },
@@ -1389,6 +1468,13 @@
           },
           "default": []
         },
+        "tailwindIgnorePatterns": {
+          "description": "Regular expressions excluding Tailwind arbitrary-value utilities from\ntoken-drift findings and analytics, including CVA variants. Matches the\nnormalized `prefix-[value]` token, without variants, negative signs, or\nsuffix modifiers. Both `-mt-[7px]` and `mt-[7px]` match as `mt-[7px]`;\n`bg-[#abc]/50` matches as `bg-[#abc]`. These spellings cannot be excluded\nindependently. Use `^icon-\\[` to exclude Iconify tokens, including variants.\nDefaults to no exclusions. Invalid regexes fail config loading.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "thresholdOverrides": {
           "description": "Per-file or per-function threshold overrides. These keep exceptional\nfunctions visible as configured numeric ceilings instead of hiding them\nbehind binary suppressions.",
           "type": "array",
@@ -1731,6 +1817,11 @@
           "$ref": "#/$defs/Severity",
           "default": "off"
         },
+        "constant-parameters": {
+          "description": "Parameters, and option keys of object-pattern parameters, that each\nvisible call passes in one way. Requires manual review; off by\ndefault. A `warn` finding does not change the CLI exit code unless\n`--fail-on-issues` is set. When the rule is on, the dead-code count\ngate of the GitHub Action counts it unless `fail-on-issues` is\n`false`.",
+          "$ref": "#/$defs/Severity",
+          "default": "off"
+        },
         "unused-component-emits": {
           "description": "Vue `<script setup>` `defineEmits` declared event emitted nowhere inside\nits own single-file component (no `emit('<name>')` call). The\nsingle-file dead-input direction. Defaults to `warn`, not `error`: an\nemit can be part of a deliberately-stable public component API, so\nanalyzer confidence is lower. A `warn` finding does not change the CLI\nexit code unless `--fail-on-issues` is set. The dead-code count gate of\nthe GitHub Action counts it unless `fail-on-issues` is `false`.",
           "$ref": "#/$defs/Severity",
@@ -2661,6 +2752,17 @@
             }
           ]
         },
+        "constant-parameters": {
+          "description": "Optional override for constant parameters.",
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "unused-component-emits": {
           "description": "Optional override for [`RulesConfig::unused_component_emits`].",
           "anyOf": [
@@ -3296,6 +3398,12 @@
           "minimum": 0,
           "default": 0
         },
+        "constantParameters": {
+          "description": "Baseline count of constant parameter review candidates. Absent while\nzero, so a baseline without the opt-in rule keeps its shape.",
+          "type": "integer",
+          "format": "uint",
+          "minimum": 0
+        },
         "analysisIdentity": {
           "description": "Compatibility identity for the analysis that produced these counts.\nMissing values in existing configs are treated as syntactic.",
           "$ref": "#/$defs/SemanticAnalysisIdentity",
@@ -3669,7 +3777,7 @@
       "description": "Value of `audit.gate`: which findings drive the `fallow audit` verdict.",
       "oneOf": [
         {
-          "description": "Fail only on findings the current changeset introduced, determined by\na base-snapshot attribution pass. The default.",
+          "description": "Fail only on findings the current changeset introduced, determined by\na base-snapshot attribution pass. An unused file or unused export\noutside the changed files counts when the base does not report it.\nThe default.",
           "type": "string",
           "const": "new-only"
         },
@@ -3705,7 +3813,7 @@
       "type": "object",
       "properties": {
         "dir": {
-          "description": "Directory for fallow's persistent analysis cache. Relative paths resolve\nfrom the project root.",
+          "description": "Directory for fallow's persistent analysis cache. Relative paths resolve\nfrom the project root. The directory must be inside the project: an\nabsolute path or a path that leaves the root is ignored with a\nwarning. Use `FALLOW_CACHE_DIR` to put the cache outside the project.",
           "type": [
             "string",
             "null"

package/scripts/lazy-verify.js

@@ -32,10 +32,11 @@ const {
 } = require("./verify-binary");
 
 // Bumped to 2 when SHA-256 + platformPkgDir binding landed (closes the
-// cross-install reuse gap in the shared $XDG fallback cache), and to 3 when
-// the sentinel started tracking fallow-similar-code alongside the multicall
-// CLI. Sentinels written under an older schema are invalidated automatically.
-const SENTINEL_SCHEMA_VERSION = 3;
+// cross-install reuse gap in the shared $XDG fallback cache), to 3 when the
+// sentinel tracked fallow-similar-code alongside the multicall CLI, and to 4
+// when the platform package went back to the multicall CLI alone. Sentinels
+// written under an older schema are invalidated automatically.
+const SENTINEL_SCHEMA_VERSION = 4;
 const VERIFY_LOG_ENV = "FALLOW_VERIFY_LOG";
 
 // One-shot warning state: each warning class fires once per process,