v3.21.0: runtime coverage joins the maps producers write, plus a visible discovery skip

Runtime coverage is the theme. A coverage map that fallow could not join used to read exactly like code with no tests, and in one case it could make a function look better than the static estimate. This release makes the join honest: it reads the maps other producers actually write, tells you how much of the file joined, and never lowers a score for a function it did not measure.

Discovery also stops hiding one thing it was silently skipping.

Runtime coverage joins the maps producers actually write

• v8-to-istanbul output is accepted. c8, nyc in v8 mode, and older vitest versions write a map whose branch metadata omits the implicit else. Those runs failed with exit 2; they now load.
• Accessors match. A record named get x or set x never matched its extracted function, so accessors silently fell back to the static estimate.
• A member whose parameter list holds a function no longer reports the wrong owner, and private class members no longer take coverage from the function that encloses them.
• Project-relative keys join from any working directory.
• A map that attributes nothing to a function no longer lowers its CRAP. Passing real coverage could take a function under --max-crap that failed the gate without it. Both paths now use the same estimate, so a map only ever changes a score for a function it actually measured. If a --max-crap gate starts failing after upgrading, that gate was passing on unmeasured functions before.
• The health summary reports how much of a coverage file joined. istanbul_files_matched and istanbul_files_total say how many files the map describes and how many an analyzed file matched, and the human report says so when the two differ. A run whose coverage joins completely is unchanged.
• The CI summary names --coverage-root only when the coverage file actually failed to join, instead of on every run.

Thanks @PrinceD96 for the report in #2448 and the fix in #2449.

A skipped hidden directory that holds source files is now reported

Discovery does not traverse dot-prefixed directories outside a small convention allowlist, and that skip was silent. First-party code under a directory such as .claude/hooks/ was invisible with no explanation and no config field to reach it.

A skipped-source-dotdir workspace diagnostic and one aggregated stderr note now name the directory, state that its imports and exports are not analyzed, and give the two real remedies: analyze it on its own with fallow --root <dir>, or add it to ignorePatterns to silence the advisory.

Traversal is unchanged. The advisory only fires for code the run would otherwise have analyzed, so a directory whose contents are gitignored (including through a global gitignore, which commonly covers .claude/), matched by ignorePatterns, or excluded by --production stays silent, as do generated tool output directories and non-git VCS metadata.

Two containment defects found while measuring that skip are fixed alongside it. A package.json script reference now scopes the exact root-relative path it names instead of every directory of that name in the tree, and .pnpm joins the script-scope denylist beside .pnpm-store, along with seventeen further generated-output and VCS directories.

Also fixed

• A telemetry spool lock that cannot be opened is no longer reported as contention. The two mean opposite things: contention is normal and self-correcting, while an unopenable lock file skips every spool drain and trim on every run, silently and permanently. The unopenable case now carries its underlying error into the debug diagnostic.

Upgrade notes

The skipped-source-dotdir diagnostic kind is additive under the open-set exception for workspace_diagnostics[].kind, so no envelope moves its schema_version. Validate against the schema shipped with the version you run and treat an unknown kind as "some diagnostic" rather than an error.

Full Changelog: v3.20.0...v3.21.0