@avi2dg/checks 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.21.0
+
+Released 2026-09-26.
+
+### Features
+
+- **scripts:** let quality.json set the runs-on of generated workflows (#66)
+
+## 0.20.0
+
+Released 2026-09-26.
+
+### Features
+
+- **scripts:** pin node from .node-version in the generated CI workflow (#64)
+- **scripts:** add checks-subsumed-tests to report tests another test subsumes in a (#62)
+
+### Fixes
+
+- **scripts:** lint a PR title that starts with # in the generated commitlint workflow (#63)
+
 ## 0.19.0
 
 Released 2026-09-26.

package/README.md

@@ -132,6 +132,7 @@ These bins run on their own:
 - [`checks-test`](docs/gates/checks-test.md) runs the suite as `scripts.test` and refuses a skip the repository has not declared.
 - [`checks-flake`](docs/gates/checks-flake.md) runs the suite on a schedule and records the seeds a flaky test fails with.
 - [`checks-mutation-compare`](docs/gates/checks-mutation-compare.md) holds every mutant in a pull request to no regression.
+- [`checks-subsumed-tests`](docs/gates/checks-subsumed-tests.md) lists each test another test subsumes in a mutation run.
 - [`checks-backtest`](docs/gates/checks-backtest.md) reports what the comment check would have refused in recent history.
 - [`checks-vendor`](docs/gates/checks-vendor.md) pins each library `quality.json` declares to a shared read-only clone and links it under `repos/`.
 

package/dist/feature-rules.js

@@ -153,6 +153,10 @@ var Gates = Schema3.Struct({
   scheduled: Schema3.optionalKey(Schema3.Array(Command).annotate({ description: "The commands a cron-scheduled workflow runs" })),
   lint: Schema3.optionalKey(LintGates)
 });
+var RunsOn = Schema3.NonEmptyArray(Schema3.NonEmptyString).annotate({
+  identifier: "RunsOn",
+  description: "The runner labels every job the kit generates runs on; ubuntu-latest when absent"
+});
 var EffectSources = Schema3.Struct({
   paths: Schema3.NonEmptyArray(PathGlob).annotate({
     description: "Where source is written in Effect, held to the Effect rules of oxlint and the language service"
@@ -233,6 +237,7 @@ var Quality = Schema3.Struct({
   $schema: Schema3.optionalKey(Schema3.String),
   defaultBranch: Schema3.optionalKey(Schema3.NonEmptyString.annotate({ description: "The branch pull requests merge into; main when absent" })),
   gates: Schema3.optionalKey(Gates),
+  runsOn: Schema3.optionalKey(RunsOn),
   commitIdentity: Schema3.optionalKey(CommitIdentity),
   sources: Schema3.optionalKey(Sources),
   size: Schema3.optionalKey(Size),

package/docs/configs/commit-messages.md

@@ -18,6 +18,7 @@ The workflow lints with the installed kit's `commitlint.config.js`, so every rep
 It lints the pull request title and nothing else.
 The title is the enforced subject because a squash merge uses it as the main commit subject, and per-commit messages are not linted.
 GitHub appends ` (#N)` to the squashed subject, so the workflow lints the title with that suffix attached, and the header length limit applies to the landed subject, not the bare title.
+The workflow moves git's comment character off `#`, so a title starting with `#` is linted like any other.
 
 It never sees a commit's author or committer fields, nor the `Co-authored-by` trailer GitHub writes from a foreign author when it squashes, so it cannot enforce who a commit belongs to.
 [checks-commit-identity](../gates/checks-commit-identity.md) is that enforcement.

package/docs/configs/quality-file.md

@@ -14,6 +14,7 @@ The kit's bins find the file at the git root and read it there:
     "ci": ["bun run lint", "bun run typecheck", "bun run test"],
     "scheduled": ["bunx checks-flake --runs 10 --report flake-report.json"]
   },
+  "runsOn": ["self-hosted", "Linux", "X64", "winbox"],
   "commitIdentity": { "authors": [{ "name": "avi2d", "email": "avi2dg@gmail.com" }] },
   "sources": {
     "production": ["src/**/*.ts"],
@@ -43,6 +44,7 @@ The kit's bins find the file at the git root and read it there:
 | `gates.ci` | `checks-ci-wiring`, `checks-quality` | the commands CI runs on every pull request, as [checks-ci-wiring](../gates/checks-ci-wiring.md) says |
 | `gates.scheduled` | `checks-ci-wiring` | the commands a schedule runs |
 | `gates.lint` | `checks-lint`, `checks-ci-wiring` | the gates `checks-lint` runs when not all apply, as [Gate selection](../gates/checks-lint.md#gate-selection) says |
+| `runsOn` | `checks-quality` | the runner labels every job the ci and commitlint workflows run on, `ubuntu-latest` when absent |
 | `commitIdentity.authors` | `checks-commit-identity` | the identities allowed to author and commit, as [checks-commit-identity](../gates/checks-commit-identity.md) says |
 | `sources.production` | `checks-size-budget`, `checks-repetition`, `checks-quality` | the source the repository ships, as [checks-size-budget](../gates/checks-size-budget.md) and [checks-repetition](../gates/checks-repetition.md) say |
 | `sources.effect` | `checks-quality` | the paths held to the Effect rules, and the files under them that are not, as [The Effect rules](effect-rules.md) says |

package/docs/gates/checks-quality.md

@@ -32,6 +32,8 @@ A rule only this repository needs stays in its own `.oxlintrc.json`, whose overr
 GitHub Actions reads its own YAML and nothing else, so `checks-quality generate` also writes the kit recipe workflows whole.
 `.github/workflows/ci.yml` runs every `gates.ci` command but the title lint as its own step after a frozen install.
 `.github/workflows/commitlint.yml` lints the pull request title with the installed kit config.
+Both jobs run on the runner labels `quality.json` `runsOn` lists, or on `ubuntu-latest` when the key is absent.
+A self-hosted runner in a public repository runs the code of any pull request from a fork.
 A step one repository alone needs lives in another workflow file, never in the recipe.
 All generated workflows are committed.
 
@@ -59,7 +61,7 @@ Two details of the fragments are easy to get wrong, so the kit's tests pin both:
 It reads the working tree: `quality.json`, the presets of the installed kit, `.oxlintrc.json`, `tsconfig.json`, the two fragments and the generated workflows.
 It reads the root `package.json` name, since only the kit's own tree lints titles with its root `commitlint.config.js`.
 The name also decides which kit configs `extends` must list, since the kit's own tree extends its root `oxlintrc.json` and `tsconfig.effect.json`.
-It looks for `.bun-version`, and the suite pins its bun to that file when the file exists.
+It looks for `.bun-version` and `.node-version`, and the suite pins its bun and its node to whichever of the two files exists.
 It lists the tracked and untracked files to see what each declared glob matches.
 
 ## Arguments

package/docs/gates/checks-subsumed-tests.md

@@ -0,0 +1,68 @@
+# checks-subsumed-tests
+
+`checks-subsumed-tests` is the report that lists each test another test subsumes in a Stryker mutation run, and a reader looks it up to judge whether the suite carries tests it no longer needs.
+
+## What it checks
+
+It checks nothing and fails nothing.
+It reads one Stryker `mutation.json` report, gives each test the set of mutants it kills, and prints each test whose kill set sits inside the kill set of one other test beside that test, with both kill counts.
+It then prints the tests whose kill sets are identical, then the size of a greedy cover that keeps every kill out of every test the report lists.
+A test is subsumed when its kill set sits inside the kill set of one other test, so dropping every subsumed test loses no kill in this run.
+The report informs a person and decides nothing, so keep a subsumed test unless reading the pair shows the same scenario.
+A subsumed verdict trusts the mutants the run covers, so read the files the report names before judging a test redundant.
+A test judged against a module that is not its subject looks redundant until its own subject is mutated.
+A test whose subject no mutant can touch, such as frontmatter or links, looks redundant because mutation cannot see what it checks.
+
+## What it reads
+
+It reads one Stryker `mutation.json` report built with bail off, which the shared Stryker preset's `json` reporter writes to `reports/mutation/mutation.json`.
+With `disableBail` Stryker runs every covering test for each mutant and records every test that fails as a killer, so each test gets a kill set.
+A report built with bail on records one killer per mutant, which makes every test look unique.
+Stryker writes its options into the report's `config`, so `checks-subsumed-tests` refuses a report whose `config.disableBail` is not `true`.
+A report with no `config` shows nothing about bail, so `checks-subsumed-tests` prints one warning and reads it anyway.
+Build a bail-off report with this command:
+
+```sh
+bunx stryker run --disableBail
+```
+
+The report records each killer as a test index, so it names each test by its file and its name from the report's `testFiles` table.
+
+## Arguments
+
+```sh
+checks-subsumed-tests <mutation-report>
+```
+
+## Exit codes
+
+| Code | When |
+| --- | --- |
+| 0 | the report printed |
+| 2 | the report is not a Stryker mutation report, it was built with bail on, or the arguments do not parse |
+
+## Sample output
+
+It prints the files the run mutated, then each subsumed test beside the test that subsumes it, then the tests whose kill sets are identical, then the greedy cover:
+
+```
+subsumed-tests: 2 file(s) mutated
+  mutated src/add.ts
+  mutated src/mul.ts
+subsumed tests (1):
+  "tests/add.test.ts > add sums two numbers" (1 kill) subsumed by "tests/add.test.ts > add covers every operator" (3 kills)
+identical kill sets (1 group(s)):
+  "tests/mul.test.ts > mul multiplies" (2 kills) = "tests/mul.test.ts > mul multiplies in either order" (2 kills)
+greedy cover: 3 of 6 test(s) keep all 6 kill(s)
+  cover "tests/add.test.ts > add covers every operator"
+  cover "tests/mul.test.ts > mul multiplies"
+  cover "tests/mul.test.ts > mul checks its guard"
+```
+
+## Opting out
+
+Nothing runs it but a person who wants the figures.
+
+## Related topics
+
+- [checks-mutation-compare](checks-mutation-compare.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Deterministic checks shared across the captain's TypeScript repos",
   "license": "MIT",
   "repository": {
@@ -31,6 +31,7 @@
     "scripts/flake.ts",
     "scripts/commit-identity.ts",
     "scripts/mutation-compare.ts",
+    "scripts/subsumed-tests.ts",
     "scripts/ci-wiring.ts",
     "scripts/shell-command.ts",
     "scripts/comment-matchers.ts",
@@ -75,6 +76,7 @@
     "./scripts/flake.ts": "./scripts/flake.ts",
     "./scripts/commit-identity.ts": "./scripts/commit-identity.ts",
     "./scripts/mutation-compare.ts": "./scripts/mutation-compare.ts",
+    "./scripts/subsumed-tests.ts": "./scripts/subsumed-tests.ts",
     "./scripts/ci-wiring.ts": "./scripts/ci-wiring.ts",
     "./scripts/comment-matchers.ts": "./scripts/comment-matchers.ts",
     "./scripts/prose-matchers.ts": "./scripts/prose-matchers.ts",
@@ -116,6 +118,7 @@
     "checks-flake": "scripts/flake.ts",
     "checks-commit-identity": "scripts/commit-identity.ts",
     "checks-mutation-compare": "scripts/mutation-compare.ts",
+    "checks-subsumed-tests": "scripts/subsumed-tests.ts",
     "checks-ci-wiring": "scripts/ci-wiring.ts",
     "checks-comment-gate": "scripts/comment-gate.ts",
     "checks-suppressions-ratchet": "scripts/suppressions-ratchet.ts",

package/quality.schema.json

@@ -88,6 +88,9 @@
       },
       "additionalProperties": false
     },
+    "runsOn": {
+      "$ref": "#/$defs/RunsOn"
+    },
     "commitIdentity": {
       "type": "object",
       "properties": {
@@ -406,6 +409,21 @@
       "type": "string",
       "minLength": 1
     },
+    "RunsOn": {
+      "type": "array",
+      "prefixItems": [
+        {
+          "type": "string",
+          "minLength": 1
+        }
+      ],
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
+      "description": "The runner labels every job the kit generates runs on; ubuntu-latest when absent"
+    },
     "Identity": {
       "type": "object",
       "properties": {

package/scripts/mutation-compare.ts

@@ -11,6 +11,7 @@ export type Mutant = {
   readonly status: string;
   readonly mutatorName: string;
   readonly replacement: string;
+  readonly killedBy?: readonly string[];
   readonly location: Location;
 };
 
@@ -19,6 +20,16 @@ export type ReportFile = {
   readonly mutants: readonly Mutant[];
 };
 
+export type TestFile = {
+  readonly tests: readonly { readonly id: string; readonly name: string }[];
+};
+
+export type KillRun = {
+  readonly files: ReadonlyMap<string, ReportFile>;
+  readonly testFiles: ReadonlyMap<string, TestFile>;
+  readonly bail: "off" | "on" | "unrecorded";
+};
+
 export type MutantChange = {
   readonly path: string;
   readonly location: Location;
@@ -59,33 +70,56 @@ const UNDETECTED = new Set(["Survived", "NoCoverage"]);
 const LEAVES_SCORE = new Set(["CompileError", "RuntimeError", "Ignored", "Pending"]);
 const USAGE = "usage: mutation-compare.ts [--advisory] <base-report> <head-report>";
 
-const Report = Schema.fromJsonString(
+const Files = Schema.Record(
+  Schema.String,
   Schema.Struct({
-    files: Schema.Record(
-      Schema.String,
+    source: Schema.String,
+    mutants: Schema.Array(
       Schema.Struct({
-        source: Schema.String,
-        mutants: Schema.Array(
-          Schema.Struct({
-            status: Schema.String,
-            mutatorName: Schema.String,
-            replacement: Schema.String,
-            location: Schema.Struct({
-              start: Schema.Struct({ line: Schema.Finite, column: Schema.Finite }),
-              end: Schema.Struct({ line: Schema.Finite, column: Schema.Finite }),
-            }),
-          }),
-        ),
+        status: Schema.String,
+        mutatorName: Schema.String,
+        replacement: Schema.String,
+        killedBy: Schema.optionalKey(Schema.Array(Schema.String)),
+        location: Schema.Struct({
+          start: Schema.Struct({ line: Schema.Finite, column: Schema.Finite }),
+          end: Schema.Struct({ line: Schema.Finite, column: Schema.Finite }),
+        }),
       }),
     ),
   }),
 );
-const decodeReport = Schema.decodeUnknownEffect(Report);
+const decodeReport = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ files: Files })));
+const decodeKillRun = Schema.decodeUnknownEffect(
+  Schema.fromJsonString(
+    Schema.Struct({
+      files: Files,
+      testFiles: Schema.Record(Schema.String, Schema.Struct({ tests: Schema.Array(Schema.Struct({ id: Schema.String, name: Schema.String })) })),
+      config: Schema.optionalKey(Schema.Struct({ disableBail: Schema.optionalKey(Schema.Boolean) })),
+    }),
+  ),
+);
+
+const notAReport = (source: string) => (cause: { readonly message: string }) => new ReportError({ message: `${source} is not a Stryker mutation report: ${cause.message}` });
 
 export const parseReport = (source: string, text: string): Effect.Effect<Map<string, ReportFile>, ReportError> =>
   decodeReport(text).pipe(
     Effect.map(({ files }) => new Map(Object.entries(files))),
-    Effect.mapError((cause) => new ReportError({ message: `${source} is not a Stryker mutation report: ${cause.message}` })),
+    Effect.mapError(notAReport(source)),
+  );
+
+function bailOf(config: { readonly disableBail?: boolean } | undefined): KillRun["bail"] {
+  if (config === undefined) return "unrecorded";
+  return config.disableBail === true ? "off" : "on";
+}
+
+export const parseKillRun = (source: string, text: string): Effect.Effect<KillRun, ReportError> =>
+  decodeKillRun(text).pipe(
+    Effect.map(({ files, testFiles, config }) => ({
+      files: new Map(Object.entries(files)),
+      testFiles: new Map(Object.entries(testFiles)),
+      bail: bailOf(config),
+    })),
+    Effect.mapError(notAReport(source)),
   );
 
 function byPosition(a: { readonly path: string; readonly location: Location }, b: { readonly path: string; readonly location: Location }): number {

package/scripts/quality-file.ts

@@ -82,6 +82,11 @@ const Gates = Schema.Struct({
   lint: Schema.optionalKey(LintGates),
 });
 
+const RunsOn = Schema.NonEmptyArray(Schema.NonEmptyString).annotate({
+  identifier: "RunsOn",
+  description: "The runner labels every job the kit generates runs on; ubuntu-latest when absent",
+});
+
 const EffectSources = Schema.Struct({
   paths: Schema.NonEmptyArray(PathGlob).annotate({
     description: "Where source is written in Effect, held to the Effect rules of oxlint and the language service",
@@ -205,6 +210,7 @@ export const Quality = Schema.Struct({
     Schema.NonEmptyString.annotate({ description: "The branch pull requests merge into; main when absent" }),
   ),
   gates: Schema.optionalKey(Gates),
+  runsOn: Schema.optionalKey(RunsOn),
   commitIdentity: Schema.optionalKey(CommitIdentity),
   sources: Schema.optionalKey(Sources),
   size: Schema.optionalKey(Size),

package/scripts/quality.ts

@@ -38,6 +38,7 @@ export type GeneratedWorkflow = {
 export type WorkflowRecipe = {
   readonly commitlintConfig: string;
   readonly bunVersionFile: boolean;
+  readonly nodeVersionFile: boolean;
 };
 
 class NativeConfigUnreadable extends Schema.TaggedError<NativeConfigUnreadable>()("NativeConfigUnreadable", {
@@ -104,17 +105,34 @@ function runsInTitleLint(gate: string, commitlintConfig: string): boolean {
   return words !== undefined && invokes(plainCommand(titleLint(commitlintConfig)), words);
 }
 
+// YAML 1.2's core schema resolves these plain scalars to a null, a boolean or a number, and YAML 1.1 parsers also read yes, no, on and off as booleans.
+const NON_STRING_SCALAR =
+  /^(?:~|null|Null|NULL|true|True|TRUE|false|False|FALSE|y|Y|yes|Yes|YES|n|N|no|No|NO|on|On|ON|off|Off|OFF|[-+]?(?:\.[0-9]+|[0-9]+(?:\.[0-9]*)?)(?:[eE][-+]?[0-9]+)?|0o[0-7]+|0x[0-9a-fA-F]+|[-+]?\.(?:inf|Inf|INF)|\.(?:nan|NaN|NAN))$/;
+
 function runScalar(command: string): string {
-  return /(^[\s#&*!|>@`'"%{[-])|:\s|\s#|:$|[\n\\]/.test(command) ? JSON.stringify(command) : command;
+  return /(^[\s#&*!|>@`'"%{[-])|:\s|\s#|:$|[\n\\]/.test(command) || NON_STRING_SCALAR.test(command)
+    ? JSON.stringify(command)
+    : command;
+}
+
+function flowScalar(label: string): string {
+  return /[,[\]{}]/.test(label) ? JSON.stringify(label) : runScalar(label);
 }
 
-export function commitlintWorkflow(commitlintConfig: string): string {
-  return `on:
+function runsOnLine(runsOn: Quality["runsOn"]): string {
+  if (runsOn === undefined) return "ubuntu-latest";
+  return `[${runsOn.map(flowScalar).join(", ")}]`;
+}
+
+export function commitlintWorkflow(commitlintConfig: string, runsOn: Quality["runsOn"]): string {
+  return `permissions:
+  contents: read
+on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
 jobs:
   commitlint:
-    runs-on: ubuntu-latest
+    runs-on: ${runsOnLine(runsOn)}
     steps:
       - uses: actions/checkout@v5
       - uses: oven-sh/setup-bun@v2
@@ -123,27 +141,44 @@ jobs:
       - run: printf '%s' "$PR_TITLE (#0000)" > "$RUNNER_TEMP/pr-title"
         env:
           PR_TITLE: \${{ github.event.pull_request.title }}
+      # A title starting with git's comment character lints as empty without this: commentChar moves off '#'.
       - run: ${titleLint(commitlintConfig)}
+        env:
+          GIT_CONFIG_COUNT: "1"
+          GIT_CONFIG_KEY_0: core.commentChar
+          GIT_CONFIG_VALUE_0: "\\x01"
 `;
 }
 
-export function suiteWorkflow(defaultBranch: string, gates: readonly string[], bunVersionFile: boolean): string {
+export function suiteWorkflow(
+  defaultBranch: string,
+  gates: readonly string[],
+  bunVersionFile: boolean,
+  nodeVersionFile: boolean,
+  runsOn: Quality["runsOn"],
+): string {
+  const node = nodeVersionFile
+    ? "      - uses: actions/setup-node@v5\n        with:\n          node-version-file: .node-version\n"
+    : "";
   const setup = bunVersionFile
     ? "      - uses: oven-sh/setup-bun@v2\n        with:\n          bun-version-file: .bun-version\n"
     : "      - uses: oven-sh/setup-bun@v2\n";
   const steps = gates.map((gate) => `      - run: ${runScalar(gate)}\n`).join("");
-  return `name: ci\non:\n  push:\n    branches: [${defaultBranch}]\n  pull_request:\n    types: [opened, edited, synchronize, reopened]\njobs:\n  checks:\n    runs-on: ubuntu-latest\n    steps:\n      # The head, not GitHub's merge ref, so the tree the gates read is the commit the range ends at.\n      # The whole history, since the range starts where the head branched from the base branch.\n      - uses: actions/checkout@v5\n        with:\n          ref: \${{ github.event.pull_request.head.sha || github.sha }}\n          fetch-depth: 0\n${setup}      - run: bun install --frozen-lockfile\n${steps}`;
+  return `name: ci\non:\n  push:\n    branches: [${defaultBranch}]\n  pull_request:\n    types: [opened, edited, synchronize, reopened]\njobs:\n  checks:\n    runs-on: ${runsOnLine(runsOn)}\n    steps:\n      # The head, not GitHub's merge ref, so the tree the gates read is the commit the range ends at.\n      # The whole history, since the range starts where the head branched from the base branch.\n      - uses: actions/checkout@v5\n        with:\n          ref: \${{ github.event.pull_request.head.sha || github.sha }}\n          fetch-depth: 0\n${node}${setup}      - run: bun install --frozen-lockfile\n${steps}`;
 }
 
 export function workflowsFor(quality: Quality, recipe: WorkflowRecipe): readonly GeneratedWorkflow[] {
   const commitlint: GeneratedWorkflow = {
     file: COMMITLINT_WORKFLOW,
-    content: commitlintWorkflow(recipe.commitlintConfig),
+    content: commitlintWorkflow(recipe.commitlintConfig, quality.runsOn),
   };
   if (quality.gates?.ci === undefined) return [commitlint];
   const suite = quality.gates.ci.filter((gate) => !runsInTitleLint(gate, recipe.commitlintConfig));
   return [
-    { file: SUITE_WORKFLOW, content: suiteWorkflow(quality.defaultBranch ?? DEFAULT_BRANCH, suite, recipe.bunVersionFile) },
+    {
+      file: SUITE_WORKFLOW,
+      content: suiteWorkflow(quality.defaultBranch ?? DEFAULT_BRANCH, suite, recipe.bunVersionFile, recipe.nodeVersionFile, quality.runsOn),
+    },
     commitlint,
   ];
 }
@@ -247,6 +282,7 @@ const recipeOf = Effect.fn("recipeOf")(function* (root: string) {
     // The kit never installs itself, so its own tree lints with its root config.
     commitlintConfig: (yield* isKit(root)) ? OWN_COMMITLINT_CONFIG : KIT_COMMITLINT_CONFIG,
     bunVersionFile: yield* fs.exists(path.join(root, ".bun-version")),
+    nodeVersionFile: yield* fs.exists(path.join(root, ".node-version")),
   } satisfies WorkflowRecipe;
 });
 

package/scripts/subsumed-tests.ts

@@ -0,0 +1,208 @@
+#!/usr/bin/env bun
+import { Console, Effect, FileSystem } from "effect";
+import { runMain, Usage } from "./main.ts";
+import { type KillRun, parseKillRun, ReportError } from "./mutation-compare.ts";
+
+export type KillSets = ReadonlyMap<string, ReadonlySet<string>>;
+
+export type Subsumed = {
+  readonly test: string;
+  readonly kills: number;
+  readonly subsumedBy: string;
+  readonly subsumerKills: number;
+};
+
+export type IdenticalGroup = {
+  readonly tests: readonly string[];
+  readonly kills: number;
+};
+
+export type Cover = {
+  readonly members: readonly string[];
+  readonly tests: number;
+  readonly kills: number;
+};
+
+export type Report = {
+  readonly files: readonly string[];
+  readonly subsumed: readonly Subsumed[];
+  readonly identical: readonly IdenticalGroup[];
+  readonly cover: Cover;
+};
+
+export type Options = {
+  readonly reportPath: string;
+};
+
+const USAGE = "usage: subsumed-tests.ts <mutation-report>";
+
+export function killSetsOf(run: KillRun): KillSets {
+  const kills = new Map<string, Set<string>>();
+  for (const file of run.testFiles.values()) for (const test of file.tests) kills.set(test.id, new Set<string>());
+  for (const [path, file] of run.files) {
+    file.mutants.forEach((mutant, index) => {
+      for (const test of mutant.killedBy ?? []) {
+        let set = kills.get(test);
+        if (set === undefined) {
+          set = new Set<string>();
+          kills.set(test, set);
+        }
+        set.add(`${path}#${index}`);
+      }
+    });
+  }
+  return kills;
+}
+
+function isSuperset(candidate: ReadonlySet<string>, other: ReadonlySet<string>): boolean {
+  if (candidate.size <= other.size) return false;
+  for (const kill of other) if (!candidate.has(kill)) return false;
+  return true;
+}
+
+function subsumerOf(test: string, kills: ReadonlySet<string>, sets: KillSets): { readonly name: string; readonly size: number } | undefined {
+  let best: { readonly name: string; readonly size: number } | undefined;
+  for (const [other, otherKills] of sets) {
+    if (other !== test && isSuperset(otherKills, kills) && (best === undefined || otherKills.size > best.size || (otherKills.size === best.size && other < best.name))) best = { name: other, size: otherKills.size };
+  }
+  return best;
+}
+
+export function findSubsumed(sets: KillSets): readonly Subsumed[] {
+  const subsumed: Subsumed[] = [];
+  for (const [test, kills] of sets) {
+    if (kills.size === 0) continue;
+    const subsumer = subsumerOf(test, kills, sets);
+    if (subsumer !== undefined) subsumed.push({ test, kills: kills.size, subsumedBy: subsumer.name, subsumerKills: subsumer.size });
+  }
+  return subsumed;
+}
+
+export function findIdentical(sets: KillSets): readonly IdenticalGroup[] {
+  const groups = new Map<string, string[]>();
+  for (const [test, kills] of sets) {
+    if (kills.size === 0) continue;
+    const key = [...kills].toSorted().join("\n");
+    const group = groups.get(key);
+    if (group === undefined) groups.set(key, [test]);
+    else group.push(test);
+  }
+  return [...groups.values()].filter((tests) => tests.length > 1).map((tests) => ({ tests, kills: sets.get(tests[0] ?? "")?.size ?? 0 }));
+}
+
+function uncoveredCount(kills: ReadonlySet<string>, uncovered: ReadonlySet<string>): number {
+  let count = 0;
+  for (const kill of kills) if (uncovered.has(kill)) count++;
+  return count;
+}
+
+function bestAddition(candidates: readonly (readonly [string, ReadonlySet<string>])[], members: readonly string[], uncovered: ReadonlySet<string>): readonly [string, ReadonlySet<string>] | undefined {
+  let best: readonly [string, ReadonlySet<string>] | undefined;
+  let bestCount = 0;
+  for (const candidate of candidates) {
+    if (members.includes(candidate[0])) continue;
+    const count = uncoveredCount(candidate[1], uncovered);
+    if (count > bestCount) {
+      best = candidate;
+      bestCount = count;
+    }
+  }
+  return best;
+}
+
+export function greedyCover(sets: KillSets): Cover {
+  const uncovered = new Set<string>();
+  for (const kills of sets.values()) for (const kill of kills) uncovered.add(kill);
+  const total = uncovered.size;
+  const members: string[] = [];
+  const candidates = [...sets].toSorted(([a], [b]) => (a < b ? -1 : 1));
+  while (uncovered.size > 0) {
+    const best = bestAddition(candidates, members, uncovered);
+    if (best === undefined) break;
+    members.push(best[0]);
+    for (const kill of best[1]) uncovered.delete(kill);
+  }
+  return { members, tests: sets.size, kills: total };
+}
+
+function testNames(run: KillRun): ReadonlyMap<string, string> {
+  const names = new Map<string, string>();
+  for (const [path, file] of run.testFiles) for (const test of file.tests) names.set(test.id, qualified(path, test.name));
+  return names;
+}
+
+// The bun runner writes names that already open with their file.
+function qualified(path: string, name: string): string {
+  return path === "" || name.startsWith(`${path} > `) ? name : `${path} > ${name}`;
+}
+
+const byName = (a: string, b: string) => (a < b ? -1 : 1);
+
+export function analyze(run: KillRun): Report {
+  const sets = killSetsOf(run);
+  const names = testNames(run);
+  const name = (id: string) => names.get(id) ?? id;
+  const cover = greedyCover(sets);
+  return {
+    files: [...run.files.keys()].toSorted(),
+    subsumed: findSubsumed(sets)
+      .map((one) => ({ ...one, test: name(one.test), subsumedBy: name(one.subsumedBy) }))
+      .toSorted((a, b) => byName(a.test, b.test)),
+    identical: findIdentical(sets)
+      .map((group) => ({ ...group, tests: group.tests.map(name).toSorted(byName) }))
+      .toSorted((a, b) => byName(a.tests[0] ?? "", b.tests[0] ?? "")),
+    cover: { ...cover, members: cover.members.map(name) },
+  };
+}
+
+function describeTest(test: string, kills: number): string {
+  return `${JSON.stringify(test)} (${kills} kill${kills === 1 ? "" : "s"})`;
+}
+
+export function formatReport(report: Report): string {
+  const lines = [`subsumed-tests: ${report.files.length} file(s) mutated`];
+  for (const file of report.files) lines.push(`  mutated ${file}`);
+  lines.push(`subsumed tests (${report.subsumed.length}):`);
+  for (const one of report.subsumed) lines.push(`  ${describeTest(one.test, one.kills)} subsumed by ${describeTest(one.subsumedBy, one.subsumerKills)}`);
+  lines.push(`identical kill sets (${report.identical.length} group(s)):`);
+  for (const group of report.identical) lines.push(`  ${group.tests.map((test) => describeTest(test, group.kills)).join(" = ")}`);
+  lines.push(`greedy cover: ${report.cover.members.length} of ${report.cover.tests} test(s) keep all ${report.cover.kills} kill(s)`);
+  for (const member of report.cover.members) lines.push(`  cover ${JSON.stringify(member)}`);
+  return lines.join("\n");
+}
+
+export const bailWarning = (source: string, run: KillRun): Effect.Effect<string | undefined, ReportError> => {
+  if (run.bail === "on")
+    return Effect.fail(
+      new ReportError({
+        message: `${source} was built with bail on, since its config.disableBail is not true, so each mutant records only its first killer: rerun Stryker with \`bunx stryker run --disableBail\` and pass the report it writes`,
+      }),
+    );
+  if (run.bail === "unrecorded") return Effect.succeed(`${source} records no config, so nothing shows whether bail was off: build it with \`bunx stryker run --disableBail\``);
+  return Effect.succeed(undefined);
+};
+
+export const parseArgs = Effect.fnUntraced(function* (argv: readonly string[]): Effect.fn.Return<Options, Usage> {
+  const [reportPath, ...extra] = argv.filter((arg) => !arg.startsWith("--"));
+  const flag = argv.find((arg) => arg.startsWith("--"));
+  if (flag !== undefined) return yield* new Usage({ message: `${USAGE}: unknown flag ${flag}` });
+  if (reportPath === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
+  return { reportPath };
+});
+
+const load = Effect.fn("load")(function* (path: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const text = yield* fs.readFileString(path).pipe(Effect.mapError(() => new ReportError({ message: `cannot read ${path}` })));
+  const run = yield* parseKillRun(path, text);
+  const warning = yield* bailWarning(path, run);
+  if (warning !== undefined) yield* Console.error(`subsumed-tests: warning: ${warning}`);
+  return run;
+});
+
+const report = Effect.gen(function* () {
+  const options = yield* parseArgs(process.argv.slice(2));
+  yield* Console.log(formatReport(analyze(yield* load(options.reportPath))));
+  return true;
+});
+
+if (import.meta.main) runMain("subsumed-tests", report);