From c1f116f1bbb2e649816077247ddca329fbc8d9ea Mon Sep 17 00:00:00 2001
From: Derek Miller <1340081+derek-miller@users.noreply.github.com>
Date: Sat, 8 Aug 2026 15:42:10 -0500
Subject: [PATCH] build: close the local .luarc.json bypasses of typecheck

`--configpath` displaces each individual setting the committed config declares,
not each table, so a suppression knob under `diagnostics` is only closed if the
committed config names it. `.luarc-typecheck.json` named none, and `make
typecheck` reads a local `.luarc.json` for everything it does not name, so a
developer could get a green run on a commit that fails `Check`.

Four live bypasses, each measured with a planted probe and the local config
removed after every run:

    local .luarc.json                      probe   before   after
    diagnostics.enable: false              any         0       2
    diagnostics.disable: [code]            code        1       2
    diagnostics.severity: {code: Hint}     code        1       2
    diagnostics.globals: [name]            global      1       2

`enable: false` silences the check entirely; the rest suppress individual codes.
The config now declares all four and each is a no-op on a clean tree. The doc
states the rule rather than the list, and says to add any further key found
reachable rather than treat four as complete.

Also adds `.luarc.json` to `.gitignore`. It is covered by a global ignore on this
machine but not by the repo, so a contributor without that entry could commit one,
and a committed `diagnostics` setting would weaken the gate for everyone rather
than just its author.
---
 .gitignore            |  3 +++
 .luarc-typecheck.json |  6 ++++++
 CLAUDE.md             | 16 +++++++++++-----
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index 46d710a..2307868 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,3 +49,6 @@ build/
 __pycache__/
 *.py[cod]
 *$py.class
+
+# Personal language-server config; typecheck pins its own via --configpath
+.luarc.json
diff --git a/.luarc-typecheck.json b/.luarc-typecheck.json
index 675578a..3bfba83 100644
--- a/.luarc-typecheck.json
+++ b/.luarc-typecheck.json
@@ -20,5 +20,11 @@
       "node_modules",
       "vendor"
     ]
+  },
+  "diagnostics": {
+    "enable": true,
+    "disable": [],
+    "severity": {},
+    "globals": []
   }
 }
diff --git a/CLAUDE.md b/CLAUDE.md
index fc9dc9f..bab7439 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -57,11 +57,17 @@ make check-types
 `.luarc-typecheck.json`. It catches what luacheck does not: undefined or duplicate
 `@alias`, returns that disagree with `@return`, fields missing from a `@class`.
 
-`--configpath` displaces `workspace.*` and `runtime.*` from a local `.luarc.json`
-but *merges* `diagnostics.disable`, so a local disable can still suppress a
-finding and produce a green run that fails `Check`. If a local result disagrees
-with CI, look there first, and compare the server version the target prints:
-`install-deps` takes whatever Homebrew has while CI pins 3.19.0.
+`--configpath` displaces each individual setting the committed config declares,
+not each table, so a suppression knob is only closed if it is named. `diagnostics`
+therefore declares four: `enable`, `disable`, `severity` and `globals`. Each was
+measured as a live bypass with a planted probe, `enable: false` silencing the check
+entirely and the rest suppressing individual codes, and each is a no-op on a clean
+tree. Anything under `diagnostics` not in that list is still reachable from a local
+`.luarc.json`, so add it here rather than assume the list is complete.
+
+The server version is not pinned locally, though. `install-deps` takes whatever
+Homebrew has while CI pins 3.19.0, so compare the version the target prints if a
+local result disagrees with CI.
 
 `vendor/` is both a `library` and an `ignoreDir`, which is load-bearing: with only
 `ignoreDir` the vendored definitions are lost and their uses become