v3.26.0: stale-baseline gate, built-in exclusion diagnostics, rule overrides everywhere

Features

• --fail-on-stale-baseline turns a rotting baseline into a failing build. The new global flag exits 1 when a loaded --baseline has an entry that matched nothing this run. It works on dead-code / check, the bare run, dupes and health, in every output format. A run that cannot judge the baseline skips the flag and says so on stderr. That covers a scoped run, health --report-only, audit and decision-surface. JSON output is unchanged. (#2637)
• dead-code --baseline warns when the saved baseline has gone stale. The wording matches what health --baseline has printed since 3.12.0. When a quarter or more of the entries match no current issue, the run says so and points at the re-save command. Exit codes are untouched. Thanks @cloud-walker for the report. (#2627)
• A run can say which built-in ignore pattern removed source files. The walk assigns every excluded candidate to the pattern that removed it. It records one excluded-by-default-ignore entry per pattern in workspace_diagnostics[]. The entry has the glob, an exact file count, the matched-directory count and a project-relative anchor. --explain-skipped prints the breakdown on check, dead-code, audit and the default run. Without the flag, only a run that discovered no source files at all prints a two-fact warning that points at the flag. (#2638)
• Oxfmt is a built-in plugin. The plugin marks oxfmt.config.ts and its siblings always-used, and credits static imports from those configs. Thanks @uzosrc for the request. (#2614)
• fallow now recognizes the Expo Router route exports SuspenseFallback, getNavOptions and generateMetadata. Thanks @tilgovi for the SuspenseFallback patch (#2618).

Changed

• The built-in build exclusion now matches at any depth (**/build/**), which lines up with the dist and coverage defaults. Nested build output in a monorepo no longer produces unused-file, unused-export, duplication and health findings. The changelog states five consequences with the remedy for each. Among them, the walk now skips hand-written source in a nested build/ directory. Thanks @michalius for the report. (#2622)
• Unused- and unlisted-dependency checks are faster on large workspace monorepos. The run resolves the owning workspace of each file once per analysis. On a repository with about 18,000 files and 800 workspaces the check went from roughly 30 seconds to 6 seconds. Thanks @Freakazo for the patch (#2624).

Bug fixes

• Rule severity, including per-path overrides[].rules, applies everywhere fallow reports. Inline editor diagnostics now match the result set fallow dead-code reports. The programmatic runtime behind the MCP tools and the Node bindings matches it, and so do the decision surface and --type-aware CLI runs. The language server also watches every config file name the loader accepts, so editing .fallowrc.json refreshes diagnostics. Thanks @JasonHassold for the report. (#2621, #2636)
• fallow audit no longer hangs on a sparse checkout of a large monorepo. The audit filters the committed tree through the sparse cone before it touches any blob. A blobless partial clone therefore no longer fetches every out-of-cone blob. Thanks @AndranikSimonian for the report and the reproduction. (#2615)
• Istanbul statement coverage no longer charges a nested function body to the function that contains it. fallow assigns each statement to the innermost function whose body encloses it. For a function that lexically contains another function, coverage_pct, coverage_tier and crap now describe its own body. Thanks @ntdkhang for the precise reproduction. (#2620)
• The config JSON Schema declares the JSONC dialect fallow parses (allowComments, allowTrailingCommas). An editor built on the JSON language service stops reporting trailing commas in .fallowrc.json. Thanks @michalius. (#2623)
• dupes --baseline warns about a partially stale baseline. A project with nothing left to compare gets no baseline warning. A scoped dead-code --baseline run no longer advises a re-save that would gut the baseline. With health --production --baseline, a fresh baseline no longer counts as stale. (#2627, #2637)
• The graph cache is reused again on a project where a dynamic-import pattern matches no files. Thanks @Freakazo for the patch (#2626).

Upgrade notes

• If a nested directory named build holds hand-written source, rename or move it, or analyze it as its own project with fallow --root <dir>. ignorePatterns has no negation.
• Agent-facing JSON from the MCP tools and the Node bindings now applies default-off rules such as private-type-leaks. That matches what the CLI has always shown.

Full Changelog: v3.25.0...v3.26.0