flagrm 0.1.1 → 0.2.0

package/dist/core/verify/deleted-text.js

@@ -0,0 +1,180 @@
+/**
+ * Tests of the OFF path that never name the flag: a flag mock returns false
+ * by default, so a test can check OFF behavior without mentioning the flag at
+ * all. What gives it away is the text it expects. When the removal deletes a
+ * string literal from the code (`"Single organization policy"`), a test still
+ * checking that text most likely tests the OFF path. And when no test checks
+ * the text that replaced it on the same line, the ON behavior lost coverage.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileAt } from "../git.js";
+import { computeLexicalMask, isTestPath, LEX_STRING } from "../scan.js";
+import { SourceText } from "../source-text.js";
+import { toLf } from "../text-utils.js";
+/** Extensions whose string literals are read: the `//`-comment languages flagrm's adapters cover. */
+const CODE_FILE = /\.(cs|ts|tsx|js|jsx|mjs|cjs|go|java|kt)$/;
+/** At most this many findings: the first ones show the pattern. */
+const MAX = 20;
+/** String literals worth looking for in tests: text (a space or 8+ characters, mostly letters), not interpolated. */
+export function stringLiterals(text) {
+    const mask = computeLexicalMask(text, "slash");
+    const source = new SourceText("", text);
+    const out = [];
+    let i = 0;
+    while (i < text.length) {
+        if (mask[i] !== LEX_STRING) {
+            i++;
+            continue;
+        }
+        const start = i;
+        while (i < text.length && mask[i] === LEX_STRING)
+            i++;
+        const raw = text.slice(start, i);
+        const m = /^([$@]*)(["'`]{1,3})([\s\S]*?)\2$/.exec(raw);
+        if (!m)
+            continue;
+        // The lexer leaves a lone `$` (C# `$"..."`) outside the string.
+        const interpolated = m[1].includes("$") || text[start - 1] === "$" || m[2] === "`";
+        const value = m[3];
+        if (interpolated && /\{|\$\{/.test(value))
+            continue;
+        if (!isText(value))
+            continue;
+        out.push({ value, line: source.position(start).line });
+    }
+    return out;
+}
+function isText(value) {
+    const letters = value.replace(/[^\p{L}]/gu, "").length;
+    if (letters < 4 || letters < value.length / 2)
+        return false;
+    return /\s/.test(value.trim()) || value.length >= 8;
+}
+/**
+ * Literals the removal deleted from non-test code: in a changed file at the
+ * baseline, and in no non-test file now (a string moved elsewhere wasn't deleted).
+ */
+function deletedTexts(v, codeNow, skip) {
+    const sha = v.baseline.git.sha;
+    if (!sha || !v.changedFiles)
+        return [];
+    const out = new Map();
+    for (const rel of v.changedFiles) {
+        if (!CODE_FILE.test(rel) || isTestPath(rel))
+            continue;
+        const before = fileAt(v.root, sha, rel);
+        if (before === undefined)
+            continue;
+        const now = read(path.join(v.root, rel)) ?? "";
+        const remaining = new Set(stringLiterals(now).map((l) => l.value));
+        const literals = stringLiterals(toLf(before));
+        for (const l of literals) {
+            if (remaining.has(l.value) || skip.has(l.value) || out.has(l.value))
+                continue;
+            const counterparts = literals
+                .filter((o) => o.line === l.line && o.value !== l.value && remaining.has(o.value))
+                .map((o) => o.value);
+            out.set(l.value, { value: l.value, file: rel, counterparts });
+        }
+    }
+    return [...out.values()].filter((d) => !codeNow.some((text) => text.includes(d.value)));
+}
+function read(file) {
+    try {
+        return toLf(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The test enclosing `index`: the last `it('title'` / `test(` or C#/Java test method before it. */
+function testName(text, index) {
+    const before = text.slice(0, index);
+    let name;
+    for (const m of before.matchAll(/\b(?:it|test)\s*\(\s*(['"`])((?:(?!\1).)*)\1|\b(?:public|internal)\s+(?:async\s+)?(?:Task|void)\s+(\w+)\s*\(|\bfunc\s+(Test\w+)\s*\(/g)) {
+        name = m[2] ?? m[3] ?? m[4];
+    }
+    return name;
+}
+/**
+ * Warnings for tests that still check text the removal deleted from the
+ * code, and for deleted text whose replacement no test checks.
+ */
+export function deletedTextFindings(v) {
+    const files = new Map();
+    for (const { ctx } of v.projects) {
+        for (const file of ctx.files) {
+            if (CODE_FILE.test(file) && !files.has(file)) {
+                files.set(file, { project: ctx.name, isTest: isTestPath(path.relative(ctx.root, file)) });
+            }
+        }
+    }
+    const tests = [];
+    const code = [];
+    for (const [file, { project, isTest }] of files) {
+        const text = read(file);
+        if (text === undefined)
+            continue;
+        if (isTest)
+            tests.push({ file, project, text });
+        else
+            code.push(text);
+    }
+    const skip = new Set(v.baseline.names.map((n) => n.name));
+    const findings = [];
+    const deletedList = deletedTexts(v, code, skip);
+    const before = deletedList.length ? baselineTests(v) : [];
+    for (const deleted of deletedList) {
+        const quoted = JSON.stringify(deleted.value);
+        let checked = false;
+        for (const t of tests) {
+            // One finding per test that checks the text, at its first check.
+            const seen = new Set();
+            for (let at = t.text.indexOf(deleted.value); at !== -1; at = t.text.indexOf(deleted.value, at + 1)) {
+                checked = true;
+                const name = testName(t.text, at);
+                if (seen.has(name))
+                    continue;
+                seen.add(name);
+                findings.push({
+                    severity: "warn",
+                    project: t.project,
+                    file: t.file,
+                    line: new SourceText(t.file, t.text).position(at).line,
+                    message: `${name ? `\`${name}\` ` : ""}checks ${quoted}, which the removal deleted from ${deleted.file}: ` +
+                        "likely a test of the OFF path (the flag mock returns false by default); delete it",
+                });
+            }
+        }
+        const coveredBefore = checked || before.some((text) => text.includes(deleted.value));
+        if (coveredBefore && deleted.counterparts.length) {
+            // `"Single organization"` inside the OFF test's `"Single organization policy"` isn't a test of it.
+            const onTested = deleted.counterparts.some((c) => tests.some((t) => t.text.split(deleted.value).join("\0").includes(c)));
+            if (!onTested) {
+                findings.push({
+                    severity: "warn",
+                    message: `a test checked ${quoted} (deleted from ${deleted.file}), but none checks ` +
+                        `${deleted.counterparts.map((c) => JSON.stringify(c)).join(" or ")}, the text kept on its line: ` +
+                        "the ON path lost its test coverage",
+                });
+            }
+        }
+    }
+    if (findings.length <= MAX)
+        return findings;
+    return [
+        ...findings.slice(0, MAX),
+        { severity: "info", message: `and ${findings.length - MAX} more tests checking deleted text` },
+    ];
+}
+/** The baseline text of the test files changed since the baseline: a deleted OFF test is in one of them. */
+function baselineTests(v) {
+    const sha = v.baseline.git.sha;
+    if (!sha)
+        return [];
+    return (v.changedFiles ?? [])
+        .filter((rel) => CODE_FILE.test(rel) && isTestPath(rel))
+        .map((rel) => fileAt(v.root, sha, rel))
+        .filter((text) => text !== undefined);
+}

package/dist/core/verify/index.js

@@ -6,6 +6,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { flagDir, readBaseline, runChecks, verifyPath } from "../baseline.js";
+import { configChanges as configChangesSince, configSnapshot } from "../config-snapshot.js";
 import { changedFilesSince, gitState, treeFingerprint } from "../git.js";
 import { CHECK_IDS, JSON_SCHEMA_VERSION, } from "../types.js";
 import { buildCheck, compareTests, testsCheck } from "./commands.js";
@@ -24,7 +25,8 @@ export async function verifyFlag(root, projects, flag, options = {}) {
     // The fingerprint, though, is the tree the Stop hook will see next, so take it
     // after the commands: a test report they write outside .gitignore is part of it.
     const fingerprint = treeFingerprint(root);
-    const v = { root, flag, projects, baseline, changedFiles, runs };
+    const configChanges = configChangesSince(baseline.config, configSnapshot(projects));
+    const v = { root, flag, projects, baseline, changedFiles, runs, configChanges };
     const tests = compareTests(v);
     const run = {
         "dead-code": () => deadCodeCheck(v),

package/dist/core/verify/leftovers.js

@@ -5,7 +5,9 @@
 import { FEATURE_MANAGEMENT_SECTION } from "../discover.js";
 import { discoverCandidates } from "../inventory.js";
 import { findIdentifiers, findMentions } from "../mentions.js";
-import { checkResult, plural } from "./context.js";
+import { relativePath } from "../util.js";
+import { checkResult, configFindings, plural } from "./context.js";
+import { deletedTextFindings } from "./deleted-text.js";
 const STILL = {
     config: "still configured",
     attribute: "still gated by attribute",
@@ -39,8 +41,20 @@ export async function leftoversCheck(v) {
     // `FeatureManagement__Flag=true` configures the flag through an environment variable (.env, docker-compose);
     // `GetValue<bool>("FeatureManagement:Flag")` reads it by its section-qualified key.
     literals.flatMap((name) => [`${FEATURE_MANAGEMENT_SECTION}__${name}`, `${FEATURE_MANAGEMENT_SECTION}:${name}`]));
+    // A local, parameter or field the flag's value travelled through is only checked in its own file.
+    const scopes = new Map();
+    for (const n of v.baseline.names.filter((x) => x.kind === "wrapper")) {
+        const current = scopes.get(n.name);
+        if (!n.file || current === "everywhere")
+            scopes.set(n.name, "everywhere");
+        else
+            scopes.set(n.name, new Set([...(current ?? []), n.file]));
+    }
     for (const hit of hits) {
         const isLiteral = literals.includes(hit.token);
+        const scope = isLiteral ? "everywhere" : scopes.get(hit.token);
+        if (scope instanceof Set && !scope.has(relativePath(v.root, hit.file)))
+            continue;
         // A bare literal name in code is an identifier that merely shares the name; only its comments and
         // config keys (`new-checkout: true`) count.
         if (isLiteral && !hit.inComment && !hit.isConfigKey)
@@ -70,5 +84,8 @@ export async function leftoversCheck(v) {
         : [fails && `${plural(fails, "reference")} left`, warns && `${plural(warns, "comment")} naming the flag`]
             .filter(Boolean)
             .join(", ");
-    return checkResult("leftovers", summary, findings);
+    const offTests = deletedTextFindings(v);
+    const offCount = offTests.filter((f) => f.severity === "warn").length;
+    const withOff = offCount ? `${summary}; ${plural(offCount, "warning")} about tests of deleted text` : summary;
+    return checkResult("leftovers", withOff, [...findings, ...offTests, ...configFindings(v, "leftovers")]);
 }

package/dist/core/verify/removed-tests.js

@@ -0,0 +1,141 @@
+/**
+ * Why each baseline test no longer runs. Deleting the OFF path's tests and
+ * dropping the flag from test names is part of a removal, and a narrower test
+ * command leaves tests out on purpose; only the rest needs explaining.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { flagWords, words } from "../flag-words.js";
+import { fileAt } from "../git.js";
+import { escapeRegExp, isTestPath } from "../scan.js";
+import { JUNIT_SEPARATOR, testKey } from "./test-results.js";
+/** Sort the tests that no longer run (`removed`) using the new ones (`added`) and the diff. */
+export function classifyRemovedTests(removed, added, afterNames, ctx) {
+    const out = { deleted: [], renamed: [], excludedByConfig: [], unexplained: [] };
+    const renamedTo = matchRenames(removed, added, flagWords(ctx.names));
+    const stillRuns = new Set(afterNames.map(testKey));
+    const files = changedTestFiles(ctx);
+    for (const name of removed) {
+        const to = renamedTo.get(testKey(name));
+        if (to)
+            out.renamed.push({ from: name, to });
+        else if (isDeleted(name, stillRuns.has(testKey(name)), files))
+            out.deleted.push(name);
+        else if (ctx.testConfigChanged)
+            out.excludedByConfig.push(name);
+        else
+            out.unexplained.push(name);
+    }
+    return out;
+}
+// --- renames -------------------------------------------------------------------
+/** A test name's class (`Ns.ClassTests`, JUnit classname) and its own name (method or title). */
+function split(key) {
+    const sep = key.indexOf(JUNIT_SEPARATOR);
+    if (sep >= 0)
+        return { owner: key.slice(0, sep), own: key.slice(sep + JUNIT_SEPARATOR.length) };
+    const dot = key.lastIndexOf(".");
+    return { owner: key.slice(0, Math.max(dot, 0)), own: key.slice(dot + 1) };
+}
+function isSubsequence(short, long) {
+    let i = 0;
+    for (const w of long)
+        if (i < short.length && w === short[i])
+            i++;
+    return i === short.length;
+}
+/**
+ * Removed test keys mapped to the new test they were renamed to: same class,
+ * the new name's words in order within the old one's, and the dropped words
+ * include one of the flag's. Each new test explains one old one; the closest
+ * (fewest dropped words) wins.
+ */
+function matchRenames(removed, added, flag) {
+    const addedByKey = new Map();
+    for (const name of added)
+        if (!addedByKey.has(testKey(name)))
+            addedByKey.set(testKey(name), name);
+    const candidates = [];
+    for (const from of new Set(removed.map(testKey))) {
+        const old = split(from);
+        const oldWords = words(old.own);
+        for (const to of addedByKey.keys()) {
+            const neu = split(to);
+            if (neu.owner !== old.owner)
+                continue;
+            const newWords = words(neu.own);
+            if (newWords.length === 0 || newWords.length >= oldWords.length || !isSubsequence(newWords, oldWords))
+                continue;
+            const dropped = [...oldWords];
+            for (const w of newWords)
+                dropped.splice(dropped.indexOf(w), 1);
+            if (dropped.some((w) => flag.has(w)))
+                candidates.push({ from, to, dropped: dropped.length });
+        }
+    }
+    const out = new Map();
+    const used = new Set();
+    for (const c of candidates.sort((a, b) => a.dropped - b.dropped)) {
+        if (out.has(c.from) || used.has(c.to))
+            continue;
+        out.set(c.from, addedByKey.get(c.to) ?? c.to);
+        used.add(c.to);
+    }
+    return out;
+}
+function changedTestFiles(ctx) {
+    if (!ctx.sha)
+        return [];
+    const out = [];
+    for (const rel of ctx.changedFiles ?? []) {
+        if (!isTestPath(rel))
+            continue;
+        const before = fileAt(ctx.root, ctx.sha, rel);
+        if (before === undefined)
+            continue;
+        let now;
+        try {
+            now = fs.readFileSync(path.join(ctx.root, rel), "utf8");
+        }
+        catch {
+            now = undefined;
+        }
+        out.push({ before, now });
+    }
+    return out;
+}
+/**
+ * Whether a changed test file had this test at the baseline and the edit
+ * removed it: the method or title is gone, or (a data row whose test still
+ * runs) the file still has it but with fewer rows.
+ */
+function isDeleted(name, keyStillRuns, files) {
+    const { owner, own } = split(testKey(name));
+    const ownerName = owner.split(/[.+/\\ ]/).pop() ?? "";
+    const junit = name.includes(JUNIT_SEPARATOR);
+    const has = (text) => junit
+        ? text.includes(own)
+        : new RegExp(`\\b${escapeRegExp(own)}\\b`).test(text) && (!ownerName || text.includes(ownerName));
+    return files.some((f) => has(f.before) &&
+        (f.now === undefined ||
+            !has(f.now) ||
+            (keyStillRuns && dataRows(f.now, own, junit) < dataRows(f.before, own, junit))));
+}
+/** xUnit (`InlineData`, `[Bit]AutoData(...)` with values), NUnit and MSTest attributes that each add a data row. */
+const DATA_ROW = /\b(?:\w*InlineData|\w*AutoData|TestCase|DataRow)\s*\(/g;
+/**
+ * How many data rows `own` has in `text`: the row attributes between the end
+ * of the previous member and its declaration. For JUnit names (`it.each`
+ * titles), how often the title appears.
+ */
+function dataRows(text, own, junit) {
+    if (junit)
+        return text.split(own).length - 1;
+    let rows = 0;
+    for (const m of text.matchAll(new RegExp(`\\b${escapeRegExp(own)}\\s*\\(`, "g"))) {
+        const before = text.slice(0, m.index);
+        const start = Math.max(before.lastIndexOf("}"), before.lastIndexOf(";"), before.lastIndexOf("{")) + 1;
+        rows += before.slice(start).match(DATA_ROW)?.length ?? 0;
+    }
+    return rows;
+}

package/dist/core/verify/test-results.js

@@ -81,7 +81,7 @@ export function shortTestNames(names) {
  * AutoFixture-style attributes put random values in them on every run. JUnit
  * names are kept whole (a test title may contain parentheses).
  */
-function testKey(name) {
+export function testKey(name) {
     if (name.includes(JUNIT_SEPARATOR))
         return name;
     const m = /^([\w.`+<>,[\]]+)\(.*\)$/s.exec(name);
@@ -111,6 +111,25 @@ export function diffTestNames(before, after) {
     };
     return { removed: onlyIn(before, after), added: onlyIn(after, before) };
 }
+/**
+ * Split the tests failing now into the ones that already failed at the
+ * baseline (`known`) and the rest (`new`). Names are compared without TRX
+ * data-row arguments, counting rows per test: a theory whose OFF row failed at
+ * the baseline and whose ON row fails now has a new failure.
+ */
+export function splitFailures(baseline, now) {
+    const left = new Map();
+    for (const name of baseline)
+        left.set(testKey(name), (left.get(testKey(name)) ?? 0) + 1);
+    const out = { known: [], new: [] };
+    for (const name of now) {
+        const n = left.get(testKey(name)) ?? 0;
+        if (n > 0)
+            left.set(testKey(name), n - 1);
+        (n > 0 ? out.known : out.new).push(name);
+    }
+    return out;
+}
 /** One `<testcase>` per test; a `<failure>`/`<error>` child fails it, `<skipped>` skips it. */
 export function parseJUnit(xml) {
     const results = empty();
@@ -126,19 +145,25 @@ export function parseJUnit(xml) {
 /**
  * Merge every result file matching `pattern` (an absolute path or glob)
  * modified at or after `since` — test runners keep older result files around.
- * Undefined when no such file exists.
+ * Files in `claimed` that haven't changed since are skipped: another
+ * project's run just wrote them, and an overlapping pattern
+ * (`./**\/TestResults/*.trx`) would count them twice. The files read are
+ * added to `claimed`. Undefined when no such file exists.
  */
-export function collectTestResults(pattern, since) {
+export function collectTestResults(pattern, since, claimed = new Map()) {
     // Filesystem timestamps can be coarser than Date.now().
     const cutoff = since - 2000;
     const files = fg
         .sync(path.sep === "\\" ? pattern.replace(/\\/g, "/") : pattern, { absolute: true, dot: true })
-        .filter((file) => fs.statSync(file).mtimeMs >= cutoff)
-        .sort();
+        .map((file) => ({ file, mtime: fs.statSync(file).mtimeMs }))
+        .filter(({ file, mtime }) => mtime >= cutoff && claimed.get(file) !== mtime)
+        .sort((a, b) => a.file.localeCompare(b.file));
+    for (const { file, mtime } of files)
+        claimed.set(file, mtime);
     if (files.length === 0)
         return undefined;
     const merged = empty();
-    for (const file of files) {
+    for (const { file } of files) {
         const xml = fs.readFileSync(file, "utf8");
         const parsed = /<TestRun\b/.test(xml) ? parseTrx(xml) : parseJUnit(xml);
         merged.total += parsed.total;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flagrm",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Guardrails for removing feature flags with AI coding agents (Claude Code, Copilot, Codex): skills, a baseline, a verify gate and a Stop hook.",
   "type": "module",
   "license": "Apache-2.0",

package/skills/flagrm-remove/SKILL.md

@@ -10,8 +10,7 @@ description: >
 
 # Remove a feature flag
 
-**The flag is permanently ON.** Keep the ON path, delete the OFF path and
-everything only it used. Behavior with the flag ON must not change.
+**The flag is permanently ON.** Keep the ON path, delete the OFF path and everything only it used. Behavior with the flag ON must not change.
 
 You find and edit the code. `flagrm` records the state before you start and
 decides when you are done: **done means `flagrm verify <flag> --json` exited 0.**
@@ -21,6 +20,7 @@ Run it as `npx --no-install flagrm`, one command per call, no `||` (plain `npx f
 
 - `git status --porcelain` must print nothing. Otherwise ask the user to commit or stash.
 - No `flagrm.config.yaml`: run `flagrm init` and fill in project paths and build/test commands with the user.
+  Its doctor reports a missing SDK, `cargo` or Docker: show it. For `cargo`/Docker, offer `flagrm scope`; `--write` only on a yes.
 - `flagrm list --json`: find the flag in `flags[]`. Not there: show the closest names and ask.
 - `state` is `off`, `mixed` or `conditional`: name the environments in `config[]` that change and get a yes, or stop.
   `unconfigured` (set in a flag service): ask if it is ON everywhere. The removal request is not that answer.
@@ -28,17 +28,17 @@ Run it as `npx --no-install flagrm`, one command per call, no `||` (plain `npx f
 
 ## 2. Baseline
 
-`flagrm baseline <flag> --json` records the git commit, build and test results and the flag's
-`names[]`. A `checks[]` entry with a non-zero `exitCode` means the code is already broken: stop.
+`flagrm baseline <flag> --json` records the git commit, build and test results and the flag's `names[]`.
+A `checks[]` entry with a non-zero `exitCode` and a `failure`: a setup problem. Show the user `failure.message` (and `flagrm scope`); once fixed, rerun with `--force`.
+Without `failure`: a build, stop. Tests: stop if the failures (`results.failedTests`) could cover the flag's code; else ask the user to accept them as known.
 
 ## 3. Find every usage
 
-- Grep for each name in `names[]`: code, templates, config and tests.
-- Follow how the value travels: a method or property returning the flag, a field
-  or local holding it, a parameter it's passed as, a DI-registered bool. Record
-  each so `verify` checks it too, then grep for it:
-  `flagrm baseline <flag> --name IsNewCheckoutEnabledAsync --kind wrapper`
-  (`--kind alias` for a qualified constant like `Flags.NewCheckout`).
+- Grep for each name in `names[]`: code, templates, config and tests. `parameterizedTests[]` are test calls passing ON/OFF.
+- `suggestedNames[]`: values of the flag with generic names. Record each that carries only this flag, a local, parameter or field with `--file <its file>`.
+- Follow the value further: a method or property returning it, a field or local holding it, a parameter
+  it's passed as, a DI-registered bool. Record each so `verify` checks it, then grep for it:
+  `flagrm baseline <flag> --name IsNewCheckoutEnabledAsync --kind wrapper` (`--kind alias` for a constant like `Flags.NewCheckout`).
 
 ## 4. Remove
 
@@ -66,10 +66,10 @@ Read `patterns.md` in this skill's directory when a case is unclear.
 
 | Check | Fix |
 |---|---|
-| `leftovers` | Remove each reference listed. A comment is a warning: reword or delete it |
+| `leftovers` | Remove each reference listed. A comment is a warning: reword or delete it. A test checking text you deleted tests the OFF path: delete it. ON text no test checks: say so in your report |
 | `dead-code` | Delete what the removal left unused |
 | `build` | Fix the error your edit caused; don't touch unrelated code. `tsc` skips templates: grep `.html` for each member you removed or renamed |
-| `tests` | A failure means ON behavior changed: fix the edit, not the test. Tests that no longer run must be ones you deleted on purpose. A changed test file whose tests didn't run: run them yourself and report it |
+| `tests` | A new failure means ON behavior changed: fix the edit, not the test. Known failures (failed at the baseline) only warn. A test listed as no longer running (`unexplained`) must be one you removed on purpose: say why. A changed test file whose tests didn't run: run them yourself and report it |
 
 Exit 2 is a usage or config error: read the message. `--skip build,tests` is fine for a quick check
 in between; only a full run counts, and the Stop hook won't let you finish on one with `--skip`. After three failed attempts on one check, show the user the findings.
@@ -84,5 +84,5 @@ Suggest `/flagrm-verify <flag>` for the overview and commit message. Don't commi
 
 - Never lift code out of the OFF path into live code.
 - Match the file's formatting; don't refactor unrelated code.
-- Never edit `.flagrm/`. Never run `flagrm baseline <flag>` again without `--name`.
-- Never `--skip` a failing check, and never change a test's expected value to pass.
+- Never edit `.flagrm/`. Rerun `flagrm baseline <flag>` only with `--name`, or with `--force` before your first edit (it refuses after).
+- Never `--skip` a failing check, and never change a test's expected value or the build/test commands to pass.