flagrm 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -5,6 +5,51 @@ All notable changes to this project are documented here. The format follows
 [Semantic Versioning](https://semver.org/). Before 1.0, a minor version may
 contain breaking changes.
 
+## [Unreleased]
+
+## [0.3.0] - 2026-10-07
+
+### Changed
+
+- **Breaking:** `build` and `test` each fall back to the adapter's default on
+  their own. Setting only `test` no longer drops the default build, so the
+  dead-code check has a build log to read. `build: false` / `test: false`
+  turn one off. The default .NET test command writes TRX to
+  `.flagrm/test-results/<project>/` and sets `testResults`, so tests are
+  compared by name and tests that already failed before the removal only
+  warn. `flagrm scope --write` writes that `testResults` out along with the
+  test command, and no longer folds long commands over two lines.
+- flagrm's own setup files (`flagrm.config.yaml`, `.gitignore`,
+  `.claude/settings.json`, the installed `flagrm-*` skills and prompt files,
+  `AGENTS.md`, `flagrm.slnf`) and paths matching `exclude` no longer count as
+  part of a removal: verify's changed files, `baseline --force` and the Stop
+  hook ignore them, so generated output such as `graphify-out/` no longer
+  invalidates a passing verify. An `exclude` entry that names a directory
+  covers everything under it, as it already did for scanning.
+- `flagrm doctor` and the `/flagrm-remove` precondition accept a tree whose
+  only uncommitted files are flagrm's setup files or paths matching `exclude`,
+  so a freshly run `flagrm init` no longer blocks the first removal.
+
+### Added
+
+- `flagrm doctor` marks the build and test commands that are adapter
+  defaults, and warns about a test command without `testResults`. With
+  `--run` it fails when the test command writes no results matching
+  `testResults`, so a broken setup shows up before a removal instead of
+  halfway through, and only warns when tests already fail: the baseline
+  records those as known failures.
+- `flagrm baseline <flag> --accept config,failures` acknowledges a change to
+  the flagrm config or the baseline's failing tests, also mid-removal, when
+  `--force` is no longer allowed. verify stops warning about the accepted
+  config (tests it leaves out still count as excluded by config) and lists
+  accepted known failures as info, so `--strict` can pass. A changed `tools:`
+  no longer warns at all.
+- The `dead-code` check warns about a method, property, field or type the
+  removal left referenced only where it is declared. Compilers don't report
+  that for public or internal members. The check is text-based: strings,
+  templates, Razor views and config files count as references, comments
+  don't, and language keywords and the flag's recorded names are left out.
+
 ## [0.2.1] - 2026-10-04
 
 ### Fixed
@@ -144,6 +189,7 @@ removes the flag through the `flagrm-remove` skill, and flagrm checks the result
   `doctor` warns about an incremental `dotnet build`, which hides existing
   warnings from the dead-code comparison.
 
+[0.3.0]: https://github.com/dino-cosic/flagrm/releases/tag/v0.3.0
 [0.2.1]: https://github.com/dino-cosic/flagrm/releases/tag/v0.2.1
 [0.2.0]: https://github.com/dino-cosic/flagrm/releases/tag/v0.2.0
 [0.1.1]: https://github.com/dino-cosic/flagrm/releases/tag/v0.1.1

package/README.md

@@ -18,7 +18,7 @@ into. flagrm decides when the work is done.
 Angular and .NET projects work out of the box. Any other stack works through the
 generic adapter.
 
-> **Status:** flagrm is at version 0.1. Until 1.0, a minor release may contain
+> **Status:** flagrm is at version 0.3. Until 1.0, a minor release may contain
 > breaking changes.
 
 ## Requirements
@@ -100,9 +100,9 @@ of these reasons is a warning, for the agent to explain in its notes.
    the flag, and repeats `flagrm verify <flag>` until it passes.
 3. **The Stop hook** (Claude Code) keeps the agent from finishing while a
    removal is in progress and not verified. In progress means a file git
-   tracks changed on top of the baseline commit (changes to
-   `flagrm.config.yaml` and untracked files don't count, so a removal paused
-   on a question to the user doesn't block), or the last verify used `--skip`.
+   tracks changed on top of the baseline commit (untracked files and
+   flagrm's own setup files don't count, so a removal paused on a question to
+   the user doesn't block), or the last verify used `--skip`.
 4. **`/flagrm-verify <flag>`** runs `flagrm verify <flag> --md` and adds notes
    and a commit message.
 
@@ -111,11 +111,11 @@ of these reasons is a warning, for the agent to explain in its notes.
 | Command | What it does | Exit codes |
 |---|---|---|
 | `init` | Set up the config and `.gitignore` entry, and each chosen AI tool's files (asks, or `--tool claude-code,copilot,codex`; saved as `tools:`). Never overwrites or deletes | 0, 2 usage error |
-| `doctor` | Check the config, build and test commands (`--run` runs them), the .NET SDK `global.json` asks for, `cargo` and Docker where projects need them, git, `.gitignore`, installed skills and hook, and abandoned baselines | 0 ok, 1 problems |
+| `doctor` | Check the config, the build and test commands (marking adapter defaults; `--run` runs them and fails when tests write no readable `testResults`), the .NET SDK `global.json` asks for, `cargo` and Docker where projects need them, git, `.gitignore`, installed skills and hook, and abandoned baselines | 0 ok, 1 problems |
 | `scope` | For each .NET project, show what the machine lacks and which projects a solution filter would leave out; `--write` creates `flagrm.slnf`, adds it to `.git/info/exclude` and points the project's build and test at it | 0 nothing missing, 1 something missing |
 | `update` | Refresh the installed skills, prompt files, `AGENTS.md` block and hook from this flagrm version, for the config's `tools:` | 0 |
 | `list` | List every feature flag in the project: definitions, configured state per environment, reference counts | 0 |
-| `baseline <flag>` | Before any edit, record the git commit, build and test results and the flag's names in `.flagrm/<flag>/baseline.json`. In .NET code the names include the locals, fields, parameters and methods the flag's value travels through when they name the flag (a local, parameter or field is checked only in its own file); generic or ambiguous ones are listed as `suggestedNames`, with `parameterizedTests` that pass the value as a literal. `--file` limits `--name` entries to one file (and records them as wrappers). `--name X --kind alias\|wrapper` adds names to an existing baseline; `--json` prints a summary (test counts, at most 20 failed test names; the file keeps everything); `--force` starts over, but only while the code is unedited since the baseline commit (changes to `flagrm.config.yaml` and `testResults` files are fine); `--no-checks` skips build and tests | 0, 2 usage error |
+| `baseline <flag>` | Before any edit, record the git commit, build and test results and the flag's names in `.flagrm/<flag>/baseline.json`. In .NET code the names include the locals, fields, parameters and methods the flag's value travels through when they name the flag (a local, parameter or field is checked only in its own file); generic or ambiguous ones are listed as `suggestedNames`, with `parameterizedTests` that pass the value as a literal. `--file` limits `--name` entries to one file (and records them as wrappers). `--name X --kind alias\|wrapper` adds names to an existing baseline; `--json` prints a summary (test counts, at most 20 failed test names; the file keeps everything); `--force` starts over, but only while the code is unedited since the baseline commit; `--accept config,failures` acknowledges, also mid-removal, a config change or the baseline's failing tests so verify stops warning about them; `--no-checks` skips build and tests | 0, 2 usage error |
 | `verify <flag>` | Gate the removal with `leftovers`, `dead-code`, `build` and `tests`. Writes `.flagrm/<flag>/verify.json`. `--md` prints the overview, `--json` the full result, `--skip` skips checks, `--strict` fails on warnings | 0 pass, 1 fail, 2 usage error |
 | `hook stop` | The Claude Code Stop hook installed by `init` | always 0 |
 
@@ -127,7 +127,7 @@ of these reasons is a warning, for the agent to explain in its notes.
 | Check | Fails when |
 |---|---|
 | `leftovers` | A recorded name (the flag literal, its constants, wrappers the agent recorded) is still in code or config. A mention in a comment is a warning, and so is a test that checks text the removal deleted from the code (a test of the OFF path that never names the flag), or deleted text whose replacement on the same line no test checks (lost ON coverage) |
-| `dead-code` | The compiler reports new unused code (locals, imports, private members) in changed files |
+| `dead-code` | The compiler reports new unused code (locals, imports, private members) in changed files. A method, property, field or type the removal left named only where it is declared is a warning (compilers don't report public members) |
 | `build` | A project's build command fails |
 | `tests` | A test that passed at the baseline fails. With `testResults`, tests that already failed at the baseline are known failures and only warn. A test that no longer runs though the diff neither deletes nor renames it and the test config is unchanged, and a changed test file none of whose tests ran, are warnings for the agent to account for |
 
@@ -168,14 +168,29 @@ exclude: ['**/Migrations/**']
 ```
 
 Paths are relative to the config file, and commands run inside each project's
-path. Without `build` or `test`, the adapter's defaults are used (`dotnet build
---no-incremental`, `npx ng build`, and so on). `testResults` (JUnit XML or TRX)
-lets `verify` compare individual tests against the baseline. Only files written during the run are read, so result files left by earlier runs don't count, and projects whose patterns overlap don't count each other's files. `timeout`
-(seconds) fails a project's build or test command that runs longer, for example
+path. `build` and `test` are resolved one at a time:
+
+| In the config | Command that runs |
+|---|---|
+| absent | the adapter's default (`dotnet build --no-incremental`, `npx ng build`, and so on) |
+| a command | that command |
+| `false` | none, not even the default |
+
+`testResults` (JUnit XML or TRX) lets `verify` compare individual tests
+against the baseline, so a test that already failed before the removal only
+warns. Only files written during the run are read. The default .NET test
+command writes TRX to `.flagrm/test-results/<project>/` and reads it; a `test`
+command of your own needs its own `testResults`. `timeout` (seconds) fails a project's build or test command that runs longer, for example
 a test runner left in watch mode. `tools` lists the AI coding tools whose files
 `init` and `update` manage (`claude-code`, `copilot`, `codex`); dropping one
 leaves its files in place, and `init` names them so you can delete them.
 
+Paths matching `exclude` (relative to the config file or a project's path; a
+directory excludes everything under it) and flagrm's own setup files don't
+count as part of a removal, so generated output such as `graphify-out/` that
+changes during a session doesn't invalidate a passing verify or block the Stop
+hook. `--exclude` on the command line doesn't reach the Stop hook.
+
 ### When the machine can't build everything
 
 `flagrm init` and `flagrm doctor` check that the .NET SDK `global.json` asks

package/dist/adapters/dotnet/index.js

@@ -1,6 +1,8 @@
 import fs from "node:fs";
+import path from "node:path";
 import { discoverInText } from "../../core/discover.js";
 import { BACKEND_GLOBS } from "../../core/scan.js";
+import { relativePath } from "../../core/util.js";
 import { dotnetFlow } from "./flow.js";
 import { dotnetUnusedDiagnostics } from "./unused.js";
 /** Discover candidate flag names (appsettings config keys, [FeatureGate] args, eval-call literals, *Flags constants/enums). */
@@ -26,6 +28,14 @@ export const dotnetAdapter = {
     flow: (ctx, flags) => dotnetFlow(ctx, flags, ctx.project.methods),
     // --no-incremental: an up-to-date project skips compiling and prints none of its
     // warnings, so the baseline's dead-code comparison would have nothing to subtract.
-    defaultCommands: () => ({ build: "dotnet build --no-incremental", test: "dotnet test" }),
+    // TRX under .flagrm/, so verify compares tests by name (known failures) out of the box.
+    defaultCommands: (ctx) => {
+        const dir = path.join(ctx.config.root, ".flagrm", "test-results", ctx.name);
+        return {
+            build: "dotnet build --no-incremental",
+            test: `dotnet test --logger trx --results-directory "${relativePath(ctx.root, dir) || "."}"`,
+            testResults: path.join(dir, "*.trx"),
+        };
+    },
     unusedDiagnostics: (_ctx, input) => dotnetUnusedDiagnostics(input),
 };

package/dist/cli.js

@@ -4,8 +4,10 @@ import path from "node:path";
 import { Command } from "commander";
 import pc from "picocolors";
 import { realProbes } from "./adapters/dotnet/setup.js";
-import { addNames, assertNoEditsSinceBaseline, baselinePath, baselineSummary, discoverFlag, flagDir, mergeNames, runChecks, validateAgentNames, writeBaseline, } from "./core/baseline.js";
+import { acceptBaseline, addNames, assertNoEditsSinceBaseline, baselinePath, baselineSummary, discoverFlag, flagDir, mergeNames, parseAccept, runChecks, validateAgentNames, writeBaseline, } from "./core/baseline.js";
+import { changeFilter } from "./core/change-filter.js";
 import { loadConfig, parseTools, TOOL_IDS } from "./core/config.js";
+import { projectCommands } from "./core/config-snapshot.js";
 import { runDoctor } from "./core/doctor.js";
 import { gitState } from "./core/git.js";
 import { hookRoot, parseHookInput, stopDecision } from "./core/hook.js";
@@ -69,8 +71,27 @@ addCommonOptions(program
     .option("--kind <kind>", "how --name entries are matched: alias (qualified constant) or wrapper (identifier, calls included); default alias, wrapper with --file")
     .option("--file <path>", "check the --name entries only in this file (a local, parameter or field; implies --kind wrapper)")
     .option("--force", "start over: replace the baseline, only while the code is unedited since it")
+    .option("--accept <what>", "acknowledge without starting over, also mid-removal: config (verify stops warning about changes to the flagrm " +
+    "config so far), failures (the baseline's failing tests); comma-separated")
     .action(async (flag, opts) => {
     const { root, projects } = loadWorkspace(opts);
+    if (opts.accept !== undefined) {
+        if (opts.force || opts.name.length || opts.file || opts.kind || !opts.checks) {
+            fail(new Error("--accept only records an acknowledgement; run it without --force, --name, --file, --kind and --no-checks."));
+        }
+        let accepted;
+        try {
+            accepted = acceptBaseline(root, flag, projects, parseAccept(opts.accept));
+        }
+        catch (err) {
+            fail(err);
+        }
+        if (opts.json)
+            console.log(JSON.stringify(baselineSummary(accepted.baseline, accepted.file), null, 2));
+        else
+            printBaseline(accepted.baseline, accepted.file);
+        return;
+    }
     // Only wrappers are matched per file: a name scoped with --file is a local, parameter or field.
     const kind = opts.kind ?? (opts.file ? "wrapper" : "alias");
     if (kind !== "alias" && kind !== "wrapper") {
@@ -94,8 +115,8 @@ addCommonOptions(program
         validateAgentNames(projects, added);
         const exists = fs.existsSync(baselinePath(root, flag));
         if (exists && opts.force) {
-            const testResults = projects.flatMap(({ ctx }) => (ctx.project.testResults ? [ctx.project.testResults] : []));
-            assertNoEditsSinceBaseline(root, flag, testResults);
+            const testResults = projects.flatMap(({ adapter, ctx }) => projectCommands(adapter, ctx).testResults ?? []);
+            assertNoEditsSinceBaseline(root, flag, testResults, changeFilter(projects[0]?.ctx.config));
         }
         if (exists && !opts.force) {
             if (added.length === 0) {

package/dist/core/baseline.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import fg from "fast-glob";
-import { CONFIG_FILENAMES } from "./config.js";
+import { changeFilter } from "./change-filter.js";
 import { configSnapshot, projectCommands } from "./config-snapshot.js";
 import { environmentProblem } from "./environment.js";
 import { changedFilesSince } from "./git.js";
@@ -39,7 +39,7 @@ const MAX_FAILED_NAMES = 20;
  * `baseline.json` keeps everything.
  */
 export function baselineSummary(baseline, file) {
-    const { config: _config, checks, ...rest } = baseline;
+    const { config: _config, acceptedConfig: _accepted, checks, ...rest } = baseline;
     return {
         ...rest,
         ...(checks
@@ -84,10 +84,10 @@ export function readBaseline(root, flag) {
  * Run one shell command inside a project, streaming its output to `logFile`
  * (no buffer limit, stdout and stderr interleaved as printed). A command that
  * can't start, is killed or outlives the project's `timeout` fails with the
- * reason at the end of the log. A test run also reads the project's
- * `testResults` files written during it.
+ * reason at the end of the log. A test run also reads the `testResults`
+ * files (absolute path or glob) written during it.
  */
-export async function runCheck(ctx, check, command, logFile, claimed) {
+export async function runCheck(ctx, check, command, logFile, claimed, testResults) {
     const started = Date.now();
     fs.mkdirSync(path.dirname(logFile), { recursive: true });
     fs.writeFileSync(logFile, `$ ${command}\n`, "utf8");
@@ -115,9 +115,7 @@ export async function runCheck(ctx, check, command, logFile, claimed) {
         if (problem)
             run.failure = { kind: "environment", message: problem };
     }
-    const results = check === "test" && ctx.project.testResults
-        ? collectTestResults(ctx.project.testResults, started, claimed)
-        : undefined;
+    const results = check === "test" && testResults ? collectTestResults(testResults, started, claimed) : undefined;
     if (results)
         run.results = results;
     return run;
@@ -191,9 +189,9 @@ export function incrementalBuildGap(adapter, build) {
     return "`dotnet build` without `--no-incremental` skips up-to-date projects and prints none of their warnings, so the dead-code check may report existing unused code as new: add `--no-incremental` to `build`";
 }
 /**
- * Build then test every project. A project that configures `build` and/or
- * `test` runs exactly those; one that configures neither gets the adapter's
- * defaults (`dotnet build --no-incremental`, `npx ng test`, ...).
+ * Build then test every project, each command resolved on its own (see
+ * `projectCommands`): the configured one, none for `false`, else the
+ * adapter's default (`dotnet build --no-incremental`, `npx ng test`, ...).
  */
 export async function runChecks(projects, logDir, only = ["build", "test"]) {
     const runs = [];
@@ -205,7 +203,8 @@ export async function runChecks(projects, logDir, only = ["build", "test"]) {
             const command = commands[check];
             if (!command)
                 continue;
-            runs.push(await runCheck(ctx, check, command, path.join(logDir, `${ctx.name}.${check}.log`), claimed));
+            const log = path.join(logDir, `${ctx.name}.${check}.log`);
+            runs.push(await runCheck(ctx, check, command, log, claimed, commands.testResults));
         }
     }
     return runs;
@@ -290,29 +289,29 @@ export function mergeNames(existing, added) {
 }
 /**
  * Files changed since `sha` that count as edits to the code: everything but
- * `.flagrm/`, the flagrm config, which may change to fix the setup, and the
- * files matching `testResults` patterns (absolute), which the baseline's own
- * test run writes. Undefined when git can't tell (not a repository, or `sha`
- * isn't in it).
+ * `.flagrm/`, what `ignore` names (flagrm's setup files, which may change to
+ * fix the setup, and `exclude`d paths), and the files matching `testResults`
+ * patterns (absolute), which the baseline's own test run writes. Undefined
+ * when git can't tell (not a repository, or `sha` isn't in it).
  */
-export function editsSince(root, sha, testResults = []) {
+export function editsSince(root, sha, testResults = [], ignore = changeFilter()) {
     const results = new Set(testResults.flatMap((pattern) => fg
         .sync(path.sep === "\\" ? pattern.replace(/\\/g, "/") : pattern, { absolute: true, dot: true })
         .map((file) => relativePath(root, file))));
-    return changedFilesSince(root, sha)?.filter((rel) => !CONFIG_FILENAMES.includes(rel) && !results.has(rel));
+    return changedFilesSince(root, sha, ignore)?.filter((rel) => !results.has(rel));
 }
 /**
  * `baseline --force` starts over only before the removal began: the working
  * tree must still match the baseline commit. Otherwise the new baseline would
  * record half-removed code, and verify would no longer see those edits.
  * Without git there is nothing to compare, so it is allowed. Files matching
- * `testResults` (absolute patterns) are not edits.
+ * `testResults` (absolute patterns) and the ones `ignore` names are not edits.
  */
-export function assertNoEditsSinceBaseline(root, flag, testResults = []) {
+export function assertNoEditsSinceBaseline(root, flag, testResults = [], ignore = changeFilter()) {
     const sha = readJson(baselinePath(root, flag))?.git?.sha;
     if (!sha)
         return;
-    const edits = editsSince(root, sha, testResults);
+    const edits = editsSince(root, sha, testResults, ignore);
     if (edits === undefined) {
         throw new UsageError(`The baseline commit ${sha.slice(0, 7)} of ${flag} is not in this repository, so flagrm can't tell whether the ` +
             `code was edited since. If it wasn't, delete ${relativePath(root, flagDir(root, flag))}/ and take a new baseline.`);
@@ -320,12 +319,42 @@ export function assertNoEditsSinceBaseline(root, flag, testResults = []) {
     if (edits.length === 0)
         return;
     const shown = edits.slice(0, 5).join(", ") + (edits.length > 5 ? `, and ${edits.length - 5} more` : "");
-    const uncommitted = new Set(changedFilesSince(root, "HEAD") ?? []);
+    const uncommitted = new Set(changedFilesSince(root, "HEAD", ignore) ?? []);
     const fix = edits.every((rel) => uncommitted.has(rel))
         ? `Set the edits aside with \`git stash -u\`, run \`flagrm baseline ${flag} --force\` again, then \`git stash pop\`.`
         : `Some are committed since the baseline commit ${sha.slice(0, 7)}: check out code without the removal first.`;
     throw new UsageError(`The code changed since the baseline of ${flag} (${shown}), so --force would record a half-done removal. ${fix}`);
 }
+/** Parse `--accept config,failures`; throws on anything else, or nothing. */
+export function parseAccept(value) {
+    const items = value
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (items.length === 0)
+        throw new UsageError("--accept takes config, failures; got nothing.");
+    for (const item of items) {
+        if (item !== "config" && item !== "failures") {
+            throw new UsageError(`--accept takes config, failures; not "${item}".`);
+        }
+    }
+    return [...new Set(items)];
+}
+/**
+ * Record the user's acknowledgement: the current configuration (verify then
+ * warns only about later changes) and/or the baseline's failing tests (listed
+ * as info). The git state, checks and names stay as they are, so this is
+ * safe mid-removal, unlike `--force`.
+ */
+export function acceptBaseline(root, flag, projects, what) {
+    const { baseline } = readBaseline(root, flag);
+    const next = { ...baseline };
+    if (what.includes("config"))
+        next.acceptedConfig = configSnapshot(projects);
+    if (what.includes("failures"))
+        next.acceptedFailures = true;
+    return saveBaseline(root, next);
+}
 /** Append names to an existing baseline; its git state and checks stay as they are. */
 export function addNames(root, flag, added) {
     const { baseline } = readBaseline(root, flag);

package/dist/core/change-filter.js

@@ -0,0 +1,67 @@
+/**
+ * What is not part of a flag removal: flagrm's own setup files (`init`,
+ * `update` and `scope --write` write them, often while a removal starts) and
+ * the config's `exclude` globs (generated output such as `graphify-out/`).
+ * verify's changed files, `baseline --force`, the Stop hook and the tree
+ * fingerprint all use this one filter, so verify and the hook agree.
+ */
+import picomatch from "picomatch";
+import { CONFIG_FILENAMES, loadConfig } from "./config.js";
+import { AGENT_SKILL_DIRS, SKILLS } from "./install.js";
+import { relativePath } from "./util.js";
+/** The files `flagrm init`, `update` and `scope --write` write, relative to the config root. */
+export const SETUP_PATTERNS = [
+    ...CONFIG_FILENAMES,
+    ".gitignore",
+    ".claude/settings.json",
+    ...AGENT_SKILL_DIRS.flatMap((dir) => SKILLS.map((skill) => `${dir}/${skill}/**`)),
+    ".github/prompts/flagrm-*.prompt.md",
+    "AGENTS.md",
+    "**/flagrm.slnf",
+];
+const isSetup = picomatch([...SETUP_PATTERNS], { dot: true });
+/**
+ * The filter for a config: setup files, and paths matching an `exclude` glob
+ * relative to the config root or to the path of the project they are in
+ * (`exclude` is also read per project when scanning). Without a config, only
+ * setup files.
+ */
+export function changeFilter(config) {
+    const exclude = config?.exclude.length ? excludeMatcher(config.exclude) : undefined;
+    const projectDirs = config
+        ? config.projects.map((p) => relativePath(config.root, p.path)).filter((dir) => dir && !dir.startsWith(".."))
+        : [];
+    return (rel) => {
+        if (isSetup(rel))
+            return true;
+        if (!exclude)
+            return false;
+        if (exclude(rel))
+            return true;
+        return projectDirs.some((dir) => rel.startsWith(`${dir}/`) && exclude(rel.slice(dir.length + 1)));
+    };
+}
+/**
+ * Matches `exclude` the way scanning's fast-glob `ignore` does: a pattern
+ * that matches a directory (`graphify-out`, `graphify-out/`) excludes
+ * everything under it, so test the path and each of its parent directories.
+ */
+function excludeMatcher(patterns) {
+    const isMatch = picomatch(patterns.map((p) => p.replace(/\/+$/, "")), { dot: true });
+    return (rel) => {
+        for (let end = rel.length; end > 0; end = rel.lastIndexOf("/", end - 1)) {
+            if (isMatch(rel.slice(0, end)))
+                return true;
+        }
+        return false;
+    };
+}
+/** {@link changeFilter} for the config at `root`; only setup files when it can't be loaded. Never throws. */
+export function changeFilterAt(root) {
+    try {
+        return changeFilter(loadConfig({ quiet: true }, root));
+    }
+    catch {
+        return changeFilter();
+    }
+}

package/dist/core/config-snapshot.js

@@ -8,10 +8,32 @@ import fs from "node:fs";
 import path from "node:path";
 import YAML from "yaml";
 import { relativePath } from "./util.js";
-/** A project's build/test commands: the configured ones, or the adapter's defaults when it configures neither. */
+/**
+ * A project's build/test commands, each resolved on its own: the configured
+ * one, none for `false`, else the adapter's default. `testResults` defaults
+ * only along with the default test command, whose output location it names.
+ */
 export function projectCommands(adapter, ctx) {
-    const configured = ctx.project.build !== undefined || ctx.project.test !== undefined;
-    return configured ? { build: ctx.project.build, test: ctx.project.test } : (adapter.defaultCommands?.(ctx) ?? {});
+    const fallback = adapter.defaultCommands?.(ctx) ?? {};
+    const out = { defaults: [] };
+    for (const key of ["build", "test"]) {
+        const configured = ctx.project[key];
+        if (configured === false)
+            continue;
+        if (configured !== undefined)
+            out[key] = configured;
+        else if (fallback[key]) {
+            out[key] = fallback[key];
+            out.defaults.push(key);
+        }
+    }
+    if (ctx.project.testResults)
+        out.testResults = ctx.project.testResults;
+    else if (out.defaults.includes("test") && fallback.testResults) {
+        out.testResults = fallback.testResults;
+        out.defaults.push("testResults");
+    }
+    return out;
 }
 /** Solution and project files: a removal may edit them, so they don't count as a command's configuration. */
 const PROJECT_FILE = /\.(sln|slnx|\w*proj)$/i;
@@ -36,8 +58,8 @@ export function configSnapshot(projects) {
             entry.build = command(commands.build);
         if (commands.test)
             entry.test = command(commands.test);
-        if (ctx.project.testResults)
-            entry.testResults = relativePath(root, ctx.project.testResults);
+        if (commands.testResults)
+            entry.testResults = relativePath(root, commands.testResults);
         snapshot.projects.push(entry);
     }
     return snapshot;
@@ -144,6 +166,8 @@ function withoutCommands(text) {
     };
     if (parsed && typeof parsed === "object") {
         const config = { ...parsed };
+        // Only says which agents `init` sets up; never changes what is scanned.
+        delete config.tools;
         if (Array.isArray(config.projects))
             config.projects = config.projects.map(strip);
         for (const legacy of ["frontend", "backend"]) {

package/dist/core/config.js

@@ -135,6 +135,16 @@ function optionalString(value, where) {
         throw new Error(`${where} must be a non-empty string.`);
     return value;
 }
+/** A build/test command: a non-empty string, or `false` to run none (not even the adapter's default). */
+function optionalCommand(value, where) {
+    if (value === false)
+        return false;
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || !value.trim())
+        throw new Error(`${where} must be a non-empty string or false.`);
+    return value;
+}
 function optionalPositiveNumber(value, where) {
     if (value === undefined)
         return undefined;
@@ -162,7 +172,7 @@ function adapterDefaults(adapter, file) {
         return { methods: backend, attributes };
     return { methods: [...new Set([...frontend, ...backend])], attributes };
 }
-function parseProject(raw, index, file, fileDir) {
+function parseProject(raw, index, file, fileDir, quiet = false) {
     const where = `projects[${index}]`;
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
         throw new Error(`${where} must be an object with name, adapter and path.`);
@@ -174,7 +184,8 @@ function parseProject(raw, index, file, fileDir) {
     if (!PROJECT_NAME.test(name)) {
         throw new Error(`${where}: name "${name}" must start with a letter or digit and contain only letters, digits, _ . -`);
     }
-    warnOnUnknownKeys(p, KNOWN_PROJECT_KEYS, `project "${name}"`);
+    if (!quiet)
+        warnOnUnknownKeys(p, KNOWN_PROJECT_KEYS, `project "${name}"`);
     if (typeof p.adapter !== "string" || !ADAPTER_IDS.includes(p.adapter)) {
         throw new Error(`${where}: adapter "${String(p.adapter)}" is not one of ${ADAPTER_IDS.join(", ")}.`);
     }
@@ -187,8 +198,8 @@ function parseProject(raw, index, file, fileDir) {
         name,
         adapter,
         path: resolveProjectDir(fileDir, p.path, `Project "${name}"`),
-        build: optionalString(p.build, `${where}.build`),
-        test: optionalString(p.test, `${where}.test`),
+        build: optionalCommand(p.build, `${where}.build`),
+        test: optionalCommand(p.test, `${where}.test`),
         testResults: testResults && path.resolve(fileDir, testResults),
         timeout: optionalPositiveNumber(p.timeout, `${where}.timeout`),
         globs: optionalStringList(p.globs, `${where}.globs`),
@@ -221,12 +232,13 @@ export function loadConfig(cli, cwd = process.cwd()) {
     if (configPath && fs.existsSync(configPath)) {
         file = readConfigFile(configPath);
         fileDir = path.dirname(configPath);
-        warnOnUnknownKeys(file, KNOWN_CONFIG_KEYS, configPath);
+        if (!cli.quiet)
+            warnOnUnknownKeys(file, KNOWN_CONFIG_KEYS, configPath);
     }
     if (file.projects !== undefined && !Array.isArray(file.projects)) {
         throw new Error(`"projects" must be a list of { name, adapter, path } entries.`);
     }
-    const projects = (file.projects ?? []).map((raw, i) => parseProject(raw, i, file, fileDir));
+    const projects = (file.projects ?? []).map((raw, i) => parseProject(raw, i, file, fileDir, cli.quiet));
     const legacyProject = (name, adapter, dir) => ({
         name,
         adapter,

package/dist/core/doctor.js

@@ -7,6 +7,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { realProbes } from "../adapters/dotnet/setup.js";
 import { errorExcerpt, incrementalBuildGap, runCheck, templateCheckGap } from "./baseline.js";
+import { changeFilter, changeFilterAt } from "./change-filter.js";
 import { findConfigFile, loadConfig, TOOL_IDS } from "./config.js";
 import { projectCommands } from "./config-snapshot.js";
 import { gitState, isAncestor } from "./git.js";
@@ -25,10 +26,17 @@ export async function runDoctor(cwd, options = {}) {
     const root = configFile ? path.dirname(configFile) : cwd;
     await configChecks(cwd, configFile, options, add);
     const git = gitState(root);
+    // flagrm's own setup files and `exclude`d paths aren't part of a removal, so they needn't be committed first.
+    const dirty = git.dirtyFiles ?? [];
+    const ignore = changeFilterAt(root);
+    const other = dirty.filter((rel) => !ignore(rel));
+    const setup = dirty.filter(changeFilter());
     if (git.sha === null)
         add("warn", "not a git repository: verify can't diff against the baseline");
-    else if (git.dirty)
-        add("warn", `${git.dirtyFiles?.length ?? 0} uncommitted files — commit or stash before a removal`);
+    else if (other.length)
+        add("warn", `${other.length} uncommitted files — commit or stash before a removal`);
+    else if (setup.length)
+        add("ok", `working tree clean apart from flagrm's setup files (${setup.length}): commit them before or with the removal`);
     else
         add("ok", "working tree clean");
     const gitignore = path.join(root, ".gitignore");
@@ -102,11 +110,27 @@ async function configChecks(cwd, configFile, options, add) {
                         add("warn", `${ctx.name}: ${gap}`);
                 }
             }
+            if (check === "test" && !commands.testResults) {
+                add("warn", `${ctx.name}: test command has no testResults — verify can't compare tests by name, so a test that fails before the removal fails verify too`);
+            }
             if (!options.run) {
-                add("ok", `${ctx.name}: ${check} command \`${command}\``);
+                const source = commands.defaults.includes(check) ? " (adapter default)" : "";
+                add("ok", `${ctx.name}: ${check} command \`${command}\`${source}`);
+                continue;
+            }
+            const log = path.join(root, ".flagrm", "doctor", `${ctx.name}.${check}.log`);
+            const run = await runCheck(ctx, check, command, log, undefined, commands.testResults);
+            // Proven here rather than halfway through a removal: without readable results, verify can't compare tests.
+            if (check === "test" && commands.testResults && !run.results) {
+                add("fail", `${ctx.name}: \`${command}\` wrote no test results matching ${relativePath(cwd, commands.testResults)}`, run.exitCode === 0 ? undefined : errorExcerpt(run.log, 3));
+                continue;
+            }
+            // A suite that is already red is no setup problem: the baseline records those tests as known failures.
+            if (run.exitCode !== 0 && run.results?.failed) {
+                const failed = run.results.failed;
+                add("warn", `${ctx.name}: \`${command}\`: ${failed === 1 ? "1 test fails already — the baseline records it as a known failure" : `${failed} tests fail already — the baseline records them as known failures`}, which verify only warns about`);
                 continue;
             }
-            const run = await runCheck(ctx, check, command, path.join(root, ".flagrm", "doctor", `${ctx.name}.${check}.log`));
             if (run.exitCode === 0) {
                 add("ok", `${ctx.name}: \`${command}\` passed`);
                 continue;

package/dist/core/git.js

@@ -26,32 +26,42 @@ export function gitState(cwd) {
     const dirtyFiles = changedFilesSince(cwd, "HEAD") ?? [];
     return { sha: head.stdout.trim(), dirty: dirtyFiles.length > 0, dirtyFiles };
 }
-/** Files added, modified or deleted in the working tree since `sha` (tracked diff plus untracked files). */
-export function changedFilesSince(cwd, sha) {
+/**
+ * Files added, modified or deleted in the working tree since `sha` (tracked
+ * diff plus untracked files), without the ones `ignore` names.
+ */
+export function changedFilesSince(cwd, sha, ignore) {
     const diff = git(cwd, "diff", "-z", "--name-only", "--no-renames", "--relative", sha, ...PATHSPEC);
     if (!diff.ok)
         return undefined;
-    return [...new Set([...paths(diff.stdout), ...untracked(cwd)])].sort();
+    const all = [...new Set([...paths(diff.stdout), ...untracked(cwd)])].sort();
+    return ignore ? all.filter((rel) => !ignore(rel)) : all;
 }
 /**
  * Tracked files modified or deleted in the working tree since `sha` (staged
- * or not); untracked files don't count. Undefined when git can't tell.
+ * or not), without the ones `ignore` names; untracked files don't count.
+ * Undefined when git can't tell.
  */
-export function trackedChangesSince(cwd, sha) {
+export function trackedChangesSince(cwd, sha, ignore) {
     const diff = git(cwd, "diff", "-z", "--name-only", "--no-renames", "--relative", sha, ...PATHSPEC);
-    return diff.ok ? paths(diff.stdout).sort() : undefined;
+    if (!diff.ok)
+        return undefined;
+    const all = paths(diff.stdout).sort();
+    return ignore ? all.filter((rel) => !ignore(rel)) : all;
 }
 /** A file's content at `sha`, or undefined when it did not exist there. */
 export function fileAt(cwd, sha, relativePath) {
     const result = git(cwd, "show", `${sha}:./${relativePath.split(path.sep).join("/")}`);
     return result.ok ? result.stdout : undefined;
 }
-function gitWithIndex(cwd, index, ...args) {
+function gitWithIndex(cwd, index, args, input) {
     const result = spawnSync("git", args, {
         cwd,
         encoding: "utf8",
         maxBuffer: 256 * 1024 * 1024,
-        env: { ...process.env, GIT_INDEX_FILE: index },
+        input,
+        // Literal: a file named `[ab].txt` must not match `a.txt` when its path is passed back to git.
+        env: { ...process.env, GIT_INDEX_FILE: index, GIT_LITERAL_PATHSPECS: input === undefined ? undefined : "1" },
     });
     return { ok: result.status === 0, stdout: result.stdout ?? "" };
 }
@@ -62,12 +72,13 @@ function repoPrefix(cwd) {
 }
 /**
  * The git tree id of the working tree under `cwd` as it would be committed:
- * tracked and untracked files, not ignored ones, without `.flagrm/`. Built in a
- * temporary copy of the index, so the user's index is untouched. Committing
- * the tree doesn't change it; any edit does. Before any edit it equals
- * {@link treeAt} of HEAD.
+ * tracked and untracked files, not ignored ones, without `.flagrm/` and the
+ * paths `ignore` names. Built in a temporary copy of the index, so the user's
+ * index is untouched. Committing the tree doesn't change it; any edit does.
+ * Before any edit it equals {@link treeAt} of HEAD, as long as the ignored
+ * paths are unchanged since.
  */
-export function treeFingerprint(cwd) {
+export function treeFingerprint(cwd, ignore) {
     const prefix = repoPrefix(cwd);
     if (prefix === undefined)
         return undefined;
@@ -79,17 +90,33 @@ export function treeFingerprint(cwd) {
         if (realIndex && fs.existsSync(realIndex))
             fs.cpSync(realIndex, index, { preserveTimestamps: true });
         // Not PATHSPEC: `git add` exits 1 when an exclude pathspec names an ignored path (`.flagrm/` usually is).
-        if (!gitWithIndex(cwd, index, "add", "-A", "--", ".").ok)
+        if (!gitWithIndex(cwd, index, ["add", "-A", "--", "."]).ok)
             return undefined;
-        if (!gitWithIndex(cwd, index, "rm", "-r", "-q", "--cached", "--ignore-unmatch", "--", ".flagrm").ok)
+        if (!gitWithIndex(cwd, index, ["rm", "-r", "-q", "--cached", "--ignore-unmatch", "--", ".flagrm"]).ok)
             return undefined;
-        const tree = gitWithIndex(cwd, index, "write-tree", ...(prefix ? [`--prefix=${prefix}`] : []));
+        if (ignore && !dropIgnored(cwd, index, ignore))
+            return undefined;
+        const tree = gitWithIndex(cwd, index, ["write-tree", ...(prefix ? [`--prefix=${prefix}`] : [])]);
         return tree.ok ? tree.stdout.trim() : undefined;
     }
     finally {
         fs.rmSync(dir, { recursive: true, force: true });
     }
 }
+/**
+ * Put back each path `ignore` names as it is at HEAD (or drop it, if HEAD
+ * doesn't have it), so the fingerprint doesn't see changes to it.
+ */
+function dropIgnored(cwd, index, ignore) {
+    const listed = paths(gitWithIndex(cwd, index, ["ls-files", "-z"]).stdout).filter(ignore);
+    if (listed.length === 0)
+        return true;
+    const input = `${listed.join("\0")}\0`;
+    const fromFile = ["--pathspec-from-file=-", "--pathspec-file-nul"];
+    // `reset` also drops a path HEAD doesn't have; before the first commit there is no HEAD to reset to.
+    const args = headSha(cwd) ? ["reset", "-q", "HEAD", ...fromFile] : ["rm", "-q", "--cached", ...fromFile];
+    return gitWithIndex(cwd, index, args, input).ok;
+}
 /** The tree id of `cwd` at commit `sha`. */
 export function treeAt(cwd, sha) {
     const prefix = repoPrefix(cwd);

package/dist/core/hook.js

@@ -6,7 +6,8 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import { CONFIG_FILENAMES, findConfigRoot } from "./config.js";
+import { changeFilterAt } from "./change-filter.js";
+import { findConfigRoot } from "./config.js";
 import { headSha, trackedChangesSince, treeFingerprint } from "./git.js";
 import { readJson } from "./util.js";
 /** The hook's stdin: only a JSON object counts, and only fields of the expected type are kept. */
@@ -35,9 +36,10 @@ export function hookRoot(cwd) {
 /**
  * Whether to block the stop: a removal is in progress and no passing verify
  * matches the current tree. In progress means HEAD is still the baseline
- * commit and a file git tracks changed, other than the flagrm config (a
- * removal paused on a question to the user, or a stray test result file,
- * doesn't count), or the last verify skipped checks. Once HEAD moves (a
+ * commit and a file git tracks changed, other than flagrm's setup files and
+ * paths matching `exclude` (a removal paused on a question to the user, or a
+ * stray test result file, doesn't count), or the last verify skipped checks.
+ * The fingerprint leaves out the same paths, as verify's does. Once HEAD moves (a
  * commit, a branch switch, a merge), that removal is no longer guarded.
  */
 export function stopDecision(root, input) {
@@ -57,11 +59,12 @@ export function stopDecision(root, input) {
             .filter((flagDir) => readJson(path.join(flagDir, "baseline.json"))?.git?.sha === head);
         if (active.length === 0)
             return { block: false };
-        const edited = (trackedChangesSince(root, head) ?? []).some((rel) => !CONFIG_FILENAMES.includes(rel));
+        const ignore = changeFilterAt(root);
+        const edited = (trackedChangesSince(root, head, ignore) ?? []).length > 0;
         const started = active.filter((flagDir) => edited || lastVerifySkipped(flagDir));
         if (started.length === 0)
             return { block: false };
-        const current = treeFingerprint(root);
+        const current = treeFingerprint(root, ignore);
         if (!current)
             return { block: false };
         const reasons = started.map((flagDir) => unverified(flagDir, current)).filter((r) => r !== undefined);

package/dist/core/report.js

@@ -74,6 +74,12 @@ export function printBaseline(baseline, file) {
         const names = baseline.names.map((n) => n.kind === "literal" ? n.name : `${n.name} (${n.kind}${n.file ? ` in ${n.file}` : ""})`);
         console.log(`  names: ${pc.dim(names.join(", "))}`);
     }
+    const accepted = [
+        baseline.acceptedConfig && "the config as of now",
+        baseline.acceptedFailures && "the baseline's failing tests",
+    ].filter(Boolean);
+    if (accepted.length)
+        console.log(`  accepted: ${pc.dim(accepted.join(", "))}`);
     for (const n of baseline.suggestedNames ?? []) {
         console.log(`  ${pc.yellow("suggested")} ${n.name} ${pc.dim(`(${n.kind})`)} ${pc.cyan(`${rel(n.file)}:${n.line}`)} ` +
             pc.dim(`if it only carries this flag: --name ${n.name} --kind wrapper` +

package/dist/core/scope.js

@@ -121,6 +121,10 @@ export function writeScope(setups, projects, root, configFile) {
                 // The resolved commands: the configured ones, or the adapter's defaults when none are.
                 build: commands.build && pointAt(commands.build, rel),
                 test: commands.test && pointAt(commands.test, rel),
+                // Written out, the test command is no longer the default, so its default results location must be too.
+                testResults: commands.testResults && commands.defaults.includes("testResults")
+                    ? `./${relativePath(root, commands.testResults)}`
+                    : undefined,
             });
         }
     }
@@ -172,7 +176,9 @@ function excludeFromGit(root, file) {
 }
 /** Set the build and test commands of `projects:` entries in place, keeping the file's comments and layout. */
 function updateConfig(configFile, root, updates) {
-    const paste = updates.map((u) => `${u.project}: build: ${u.build}; test: ${u.test}`).join("; ");
+    const paste = updates
+        .map((u) => `${u.project}: build: ${u.build}; test: ${u.test}${u.testResults ? `; testResults: ${u.testResults}` : ""}`)
+        .join("; ");
     if (!configFile || configFile.endsWith(".json")) {
         return {
             path: configFile ? relativePath(root, configFile) : "flagrm.config.yaml",
@@ -196,8 +202,11 @@ function updateConfig(configFile, root, updates) {
             doc.setIn(["projects", index, "build"], u.build);
         if (u.test)
             doc.setIn(["projects", index, "test"], u.test);
+        if (u.testResults)
+            doc.setIn(["projects", index, "testResults"], u.testResults);
     }
-    const next = doc.toString();
+    // lineWidth 0: never fold a long command over two lines.
+    const next = doc.toString({ lineWidth: 0 });
     if (next !== text)
         fs.writeFileSync(configFile, next, "utf8");
     const note = missing.length

package/dist/core/verify/commands.js

@@ -8,6 +8,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { errorExcerpt, templateCheckGap } from "../baseline.js";
+import { projectCommands } from "../config-snapshot.js";
 import { escapeRegExp, isTestPath } from "../scan.js";
 import { relativePath } from "../util.js";
 import { checkResult, configFindings, plural, skippedResult } from "./context.js";
@@ -95,7 +96,7 @@ export function compareTests(v) {
                 sha: v.baseline.git.sha,
                 changedFiles: v.changedFiles,
                 names: v.baseline.names,
-                testConfigChanged: v.configChanges.some((c) => c.check === "tests" && c.project === run.project),
+                testConfigChanged: v.originalConfigChanges.some((c) => c.check === "tests" && c.project === run.project),
             }));
         }
         out.push(comparison);
@@ -116,9 +117,10 @@ function splitBaselineFailures(v, run) {
 }
 /**
  * A failed test run fails the check, unless every failed test already failed
- * at the baseline: those are known failures, and only warn.
+ * at the baseline: those are known failures, and only warn, or are only
+ * listed once the user accepted them (`baseline --accept failures`).
  */
-function failedTestFindings(run, failures) {
+function failedTestFindings(run, failures, accepted = false) {
     const list = (names, prefix) => shortTestNames(names)
         .slice(0, 20)
         .map((name) => ({ severity: "info", message: `${prefix}: ${name}`, project: run.project }));
@@ -128,8 +130,8 @@ function failedTestFindings(run, failures) {
     if (failures.new.length === 0) {
         return [
             {
-                severity: "warn",
-                message: `${plural(failures.known.length, "test fails", "tests fail")}, as at the baseline (known failures; log: ${run.log})`,
+                severity: accepted ? "info" : "warn",
+                message: `${plural(failures.known.length, "test fails", "tests fail")}, as at the baseline (known failures${accepted ? ", accepted" : ""}; log: ${run.log})`,
                 project: run.project,
                 file: run.log,
             },
@@ -168,17 +170,18 @@ export function testsCheck(v, comparisons) {
             if (failures?.new.length !== 0)
                 failed++;
             known += failures?.known.length ?? 0;
-            findings.push(...failedTestFindings(run, failures));
+            findings.push(...failedTestFindings(run, failures, v.baseline.acceptedFailures));
             if (run.failure)
                 findings.push(setupFinding(run));
         }
-        const ctx = v.projects.find(({ ctx }) => ctx.name === run.project)?.ctx;
-        const project = ctx?.project;
+        const entry = v.projects.find(({ ctx }) => ctx.name === run.project);
+        const ctx = entry?.ctx;
+        const testResults = entry && projectCommands(entry.adapter, entry.ctx).testResults;
         const comparison = comparisons.find((c) => c.project === run.project);
-        if (project?.testResults && !run.results) {
+        if (testResults && !run.results) {
             findings.push({
                 severity: "warn",
-                message: `no test results found at ${project.testResults}, so the test count was not compared`,
+                message: `no test results found at ${testResults}, so the test count was not compared`,
                 project: run.project,
             });
         }

package/dist/core/verify/dead-code.js

@@ -1,14 +1,21 @@
 /**
  * The `dead-code` check: compiler unused-code diagnostics in the changed
  * files that the baseline did not have (fail; warn when the adapter cannot
- * tell which ones are new).
+ * tell which ones are new), and declarations the removal left without
+ * references, which compilers don't flag for public members (warn).
  */
 import fs from "node:fs";
 import path from "node:path";
 import { fileAt } from "../git.js";
 import { checkResult, plural, skippedResult } from "./context.js";
+import { orphanFindings } from "./orphans.js";
 export function deadCodeCheck(v) {
-    const { findings, summary, analyzed } = compilerFindings(v);
+    const { findings, summary: compiler, analyzed } = compilerFindings(v);
+    const orphans = orphanFindings(v);
+    findings.push(...orphans);
+    const summary = orphans.length
+        ? `${compiler}; ${plural(orphans.length, "declaration")} left without references`
+        : compiler;
     // A check that did not look at every changed file must not read as a pass (a found diagnostic still fails it).
     if (!analyzed && !findings.some((f) => f.severity === "fail" || f.severity === "warn")) {
         return skippedResult("dead-code", summary, findings);

package/dist/core/verify/index.js

@@ -6,6 +6,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { flagDir, readBaseline, runChecks, verifyPath } from "../baseline.js";
+import { changeFilter, changeFilterAt } from "../change-filter.js";
 import { configChanges as configChangesSince, configSnapshot } from "../config-snapshot.js";
 import { changedFilesSince, gitState, treeFingerprint } from "../git.js";
 import { CHECK_IDS, JSON_SCHEMA_VERSION, } from "../types.js";
@@ -19,14 +20,20 @@ export async function verifyFlag(root, projects, flag, options = {}) {
     // Take the git state before running commands: their output (bin/, test
     // results) is not part of the change under review.
     const git = gitState(root);
-    const changedFiles = baseline.git.sha ? changedFilesSince(root, baseline.git.sha) : undefined;
+    // flagrm's setup files and `exclude`d paths (the config's and --exclude) aren't part of the removal.
+    const ignore = changeFilter(projects[0]?.ctx.config);
+    const changedFiles = baseline.git.sha ? changedFilesSince(root, baseline.git.sha, ignore) : undefined;
     const only = [...(skip.has("build") ? [] : ["build"]), ...(skip.has("tests") ? [] : ["test"])];
     const runs = only.length ? await runChecks(projects, path.join(flagDir(root, flag), "verify"), only) : [];
     // The fingerprint, though, is the tree the Stop hook will see next, so take it
     // after the commands: a test report they write outside .gitignore is part of it.
-    const fingerprint = treeFingerprint(root);
-    const configChanges = configChangesSince(baseline.config, configSnapshot(projects));
-    const v = { root, flag, projects, baseline, changedFiles, runs, configChanges };
+    // The Stop hook compares it with its own, so take it exactly as the hook does: from the config file
+    // alone, without --exclude, which the hook can't know.
+    const fingerprint = treeFingerprint(root, changeFilterAt(root));
+    const now = configSnapshot(projects);
+    const configChanges = configChangesSince(baseline.acceptedConfig ?? baseline.config, now);
+    const originalConfigChanges = baseline.acceptedConfig ? configChangesSince(baseline.config, now) : configChanges;
+    const v = { root, flag, projects, baseline, changedFiles, runs, configChanges, originalConfigChanges };
     const tests = compareTests(v);
     const run = {
         "dead-code": () => deadCodeCheck(v),

package/dist/core/verify/orphans.js

@@ -0,0 +1,175 @@
+/**
+ * Code the removal orphaned without a compiler noticing: a method, property
+ * or class whose last reference was in the deleted OFF path is still
+ * declared, and a public or internal member gets no "unused" diagnostic.
+ *
+ * Lexical: an identifier whose count went down in a changed code file, now
+ * found exactly once across the projects' files (its declaration) and more
+ * than once at the baseline. Comments don't count as references; strings,
+ * templates, Razor views and config files do (DI by name, interpolation,
+ * Angular bindings, options bound from appsettings), so a hit is a warning.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileAt } from "../git.js";
+import { commentSyntax, computeLexicalMask, escapeRegExp, LEX_COMMENT } from "../scan.js";
+import { SourceText } from "../source-text.js";
+/** Files whose identifiers can be declarations the removal orphaned. */
+const CODE_FILE = /\.(cs|ts|tsx|js|jsx|mjs|cjs|go|java|kt)$/;
+/** Identifiers of 4+ characters: shorter ones (`id`, `Run`) are too common to mean anything here. */
+const IDENT = /[A-Za-z_]\w{3,}/g;
+/**
+ * Keywords and built-in type names (C#, TypeScript/JavaScript, Go, Java,
+ * Kotlin) of 4+ characters: removing one can leave a single one in the
+ * project, which is no declaration.
+ */
+const KEYWORDS = new Set(("true false null this base void self super class struct record interface enum namespace package import " +
+    "export from default extends implements public private protected internal static readonly const final " +
+    "abstract virtual override sealed async await yield return throw throws break continue switch case else " +
+    "while foreach using lock fixed unsafe checked unchecked params where when select func defer chan range " +
+    "type typeof instanceof keyof infer declare module require function constructor delete void never unknown " +
+    "string bool boolean char byte short long float double decimal object dynamic number bigint symbol " +
+    "Task Void Boolean String Object Unit init operator implicit explicit event delegate goto sizeof stackalloc " +
+    "volatile extern partial global nameof value get set add remove inline data sealed open lateinit companion").split(" "));
+const MODIFIERS = "public|private|protected|internal|static|readonly|virtual|override|abstract|sealed|async|partial|const|extern|" +
+    "unsafe|required|new|final|open|suspend|inline|lateinit|declare|export|default|get|set|accessor";
+/** Words that start a statement, not a declaration's type (`return Foo;`, `await Bar();`). */
+const STATEMENT = new Set([
+    "return",
+    "await",
+    "throw",
+    "yield",
+    "else",
+    "case",
+    "goto",
+    "using",
+    "import",
+    "package",
+    "namespace",
+]);
+/**
+ * Whether `line` declares `name`, by the shape of declarations in the file's
+ * language: what is left of an orphan is its declaration, while the last use
+ * of a library member (`mock.Setup(...)`), an object key or an import is not.
+ */
+export function declares(file, line, name) {
+    const n = escapeRegExp(name);
+    if (/\.(cs|java|kt)$/.test(file)) {
+        if (new RegExp(`\\b(class|interface|record|struct|enum|object|fun|val|var)\\s+${n}\\b`).test(line))
+            return true;
+        const member = new RegExp(`^\\s*(?:\\[[^\\]]*\\]\\s*)*(?:(?:${MODIFIERS})\\s+)*([\\w.?<>\\[\\],]+)\\s+${n}\\s*(?:<[^>]*>)?\\s*(?:\\(|\\{|=>|=|;)`).exec(line);
+        return Boolean(member && !STATEMENT.has(member[1]));
+    }
+    if (/\.(ts|tsx|js|jsx|mjs|cjs)$/.test(file)) {
+        const mods = `(?:(?:${MODIFIERS})\\s+)`;
+        return [
+            new RegExp(`\\b(?:function\\*?|class|interface|enum|type|const|let|var|namespace)\\s+${n}\\b`),
+            new RegExp(`^\\s*${mods}+${n}\\s*[?!]?\\s*(?:\\(|=|:|<)`),
+            new RegExp(`^\\s*${n}\\s*[?!]?\\s*=(?![=>])`),
+            new RegExp(`^\\s*${n}\\s*[?!]?\\s*:[^,]*;\\s*$`),
+            new RegExp(`^\\s*${n}\\s*(?:<[^>]*>)?\\s*\\([^)]*\\)\\s*(?::\\s*[^{;=]+)?\\{\\s*$`),
+        ].some((re) => re.test(line));
+    }
+    if (file.endsWith(".go")) {
+        return new RegExp(`\\bfunc\\s+(?:\\([^)]*\\)\\s*)?${n}\\s*[([]|\\b(?:type|var|const)\\s+${n}\\b`).test(line);
+    }
+    return false;
+}
+/** At most this many findings: the first ones show the pattern. */
+const MAX = 20;
+/** Each identifier's occurrences outside comments (`only`: just these identifiers). */
+function occurrences(file, text, only) {
+    const syntax = commentSyntax(file);
+    const mask = syntax ? computeLexicalMask(text, syntax) : undefined;
+    const out = new Map();
+    for (const m of text.matchAll(IDENT)) {
+        if (only && !only.has(m[0]))
+            continue;
+        if (mask && mask[m.index] === LEX_COMMENT)
+            continue;
+        const seen = out.get(m[0]);
+        if (seen)
+            seen.count++;
+        else
+            out.set(m[0], { count: 1, first: m.index });
+    }
+    return out;
+}
+function read(file) {
+    try {
+        return fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function add(totals, counts) {
+    for (const [name, { count }] of counts)
+        totals.set(name, (totals.get(name) ?? 0) + count);
+}
+export function orphanFindings(v) {
+    const sha = v.baseline.git.sha;
+    if (!sha || !v.changedFiles)
+        return [];
+    const projectFiles = new Map();
+    for (const { ctx } of v.projects)
+        for (const file of ctx.files)
+            if (!projectFiles.has(file))
+                projectFiles.set(file, ctx.name);
+    const roots = v.projects.map(({ ctx }) => ctx.root);
+    const inProject = (file) => projectFiles.has(file) || (!fs.existsSync(file) && roots.some((r) => !path.relative(r, file).startsWith("..")));
+    const changed = v.changedFiles.map((rel) => path.join(v.root, rel)).filter(inProject);
+    const recorded = new Set(v.baseline.names.map((n) => n.name));
+    // Counts in the changed files then and now; unchanged files count the same both times.
+    const before = new Map();
+    const nowInChanged = new Map();
+    const candidates = new Set();
+    for (const file of changed) {
+        const was = occurrences(file, fileAt(v.root, sha, path.relative(v.root, file)) ?? "");
+        const text = read(file);
+        const is = text === undefined ? new Map() : occurrences(file, text);
+        add(before, was);
+        add(nowInChanged, is);
+        if (!CODE_FILE.test(file))
+            continue;
+        for (const [name, { count }] of was) {
+            if (count > (is.get(name)?.count ?? 0) && !recorded.has(name) && !KEYWORDS.has(name))
+                candidates.add(name);
+        }
+    }
+    if (candidates.size === 0)
+        return [];
+    const now = new Map();
+    const where = new Map();
+    for (const [file, project] of projectFiles) {
+        const text = read(file);
+        if (text === undefined)
+            continue;
+        const counts = occurrences(file, text, candidates);
+        add(now, counts);
+        for (const [name, { first }] of counts)
+            if (!where.has(name))
+                where.set(name, { file, offset: first, text, project });
+    }
+    const findings = [];
+    for (const name of [...candidates].sort()) {
+        const total = now.get(name) ?? 0;
+        const wasTotal = total - (nowInChanged.get(name) ?? 0) + (before.get(name) ?? 0);
+        const at = where.get(name);
+        if (total !== 1 || wasTotal < 2 || !at)
+            continue;
+        const source = new SourceText(at.file, at.text);
+        if (!declares(at.file, source.snippet(at.offset), name))
+            continue;
+        findings.push({
+            severity: "warn",
+            message: `${name} is now referenced only where it is declared: delete it if only the OFF path used it`,
+            project: at.project,
+            file: at.file,
+            line: source.position(at.offset).line,
+        });
+        if (findings.length === MAX)
+            break;
+    }
+    return findings;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flagrm",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Guardrails for removing feature flags with AI coding agents (Claude Code, Copilot, Codex): skills, a baseline, a verify gate and a Stop hook.",
   "type": "module",
   "license": "Apache-2.0",
@@ -55,12 +55,14 @@
     "commander": "^13.1.0",
     "fast-glob": "^3.3.3",
     "picocolors": "^1.1.1",
+    "picomatch": "^4.0.7",
     "typescript": "^5.7.0",
     "yaml": "^2.7.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.10",
     "@types/node": "^22.13.0",
+    "@types/picomatch": "^4.0.3",
     "tsx": "^4.19.0",
     "vitest": "^3.0.0"
   }

package/skills/flagrm-remove/SKILL.md

@@ -18,7 +18,7 @@ Run it as `npx --no-install flagrm`, one command per call, no `||` (plain `npx f
 
 ## 1. Preconditions
 
-- `git status --porcelain` must print nothing. Otherwise ask the user to commit or stash.
+- `flagrm doctor` must not warn about uncommitted files (flagrm's own setup files and `exclude`d paths don't count). Otherwise ask the user to commit or stash.
 - No `flagrm.config.yaml`: run `flagrm init` and fill in project paths and build/test commands with the user.
   Its doctor reports a missing SDK, `cargo` or Docker: show it. For `cargo`/Docker, offer `flagrm scope`; `--write` only on a yes.
 - `flagrm list --json`: find the flag in `flags[]`. Not there: show the closest names and ask.
@@ -30,7 +30,7 @@ Run it as `npx --no-install flagrm`, one command per call, no `||` (plain `npx f
 
 `flagrm baseline <flag> --json` records the git commit, build and test results and the flag's `names[]`.
 A `checks[]` entry with a non-zero `exitCode` and a `failure`: a setup problem. Show the user `failure.message` (and `flagrm scope`); once fixed, rerun with `--force`.
-Without `failure`: a build, stop. Tests: stop if the failures (`results.failedTests`) could cover the flag's code; else ask the user to accept them as known.
+Without `failure`: a build, stop. Tests: stop if the failures (`results.failedTests`) could cover the flag's code; else ask the user to accept them as known, and on a yes run `flagrm baseline <flag> --accept failures`.
 
 ## 3. Find every usage
 
@@ -67,7 +67,7 @@ Read `patterns.md` in this skill's directory when a case is unclear.
 | Check | Fix |
 |---|---|
 | `leftovers` | Remove each reference listed. A comment is a warning: reword or delete it. A test checking text you deleted tests the OFF path: delete it. ON text no test checks: say so in your report |
-| `dead-code` | Delete what the removal left unused |
+| `dead-code` | Delete what the removal left unused. A declaration "referenced only where it is declared" (warning): delete it if only the OFF path used it; else say why it stays |
 | `build` | Fix the error your edit caused; don't touch unrelated code. `tsc` skips templates: grep `.html` for each member you removed or renamed |
 | `tests` | A new failure means ON behavior changed: fix the edit, not the test. Known failures (failed at the baseline) only warn. A test listed as no longer running (`unexplained`) must be one you removed on purpose: say why. A changed test file whose tests didn't run: run them yourself and report it |
 
@@ -85,4 +85,4 @@ Suggest `/flagrm-verify <flag>` for the overview and commit message. Don't commi
 - Never lift code out of the OFF path into live code.
 - Match the file's formatting; don't refactor unrelated code.
 - Never edit `.flagrm/`. Rerun `flagrm baseline <flag>` only with `--name`, or with `--force` before your first edit (it refuses after).
-- Never `--skip` a failing check, and never change a test's expected value or the build/test commands to pass.
+- Never `--skip` a failing check, and never change a test's expected value or the build/test commands to pass. If the user changes the config mid-removal (say, to leave out tests that need services), run `flagrm baseline <flag> --accept config` once they confirm.