@avi2dg/checks 0.48.0 → 0.49.0

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.49.0
+
+Released 2026-10-20.
+
+### Features
+
+- **testing:** build the full mutation baseline with bail, fastest unit tests first [#190](https://github.com/avi2d/checks/pull/190)
+
+### Fixes
+
+- **delivery:** name the parsed invocation's line in CI wiring refusals [#189](https://github.com/avi2d/checks/pull/189)
+- **quality:** refuse named font sizes in font shorthand and build token map once per file [#188](https://github.com/avi2d/checks/pull/188)
+- **delivery:** judge shell-shaped release references in checks-ci-wiring [#186](https://github.com/avi2d/checks/pull/186)
+
+## 0.48.1
+
+Released 2026-10-20.
+
+### Fixes
+
+- **quality:** hold font shorthand and local size custom properties to the tokens option [#185](https://github.com/avi2d/checks/pull/185)
+- **testing:** compare checks-night-run against the latest night that recorded scores [#184](https://github.com/avi2d/checks/pull/184)
+- **testing:** default checks-test --parallel to the machine's core count [#182](https://github.com/avi2d/checks/pull/182)
+
 ## 0.48.0
 
 Released 2026-10-19.

package/README.md

@@ -25,6 +25,7 @@ Each repository owns its workflows and native tool configs, as [Native settings]
   - `html-validate` 11.16.0
   - `playwright-core` 1.63.0
   - `postcss-html` 2.0.0
+  - `postcss-value-parser` 4.2.0
   - `stylelint` 17.16.0
   - `stylelint-config-standard` 40.0.0
   - `stylelint-plugin-use-baseline` 1.4.7

package/dist/mutation/unit-test-order.js

@@ -0,0 +1,159 @@
+// src/testing/unit-test-order.ts
+import { NodeChildProcessSpawner, NodeFileSystem, NodePath } from "@effect/platform-node-shared";
+import { Console, Effect as Effect2, FileSystem, Layer, Path, Schema as Schema2 } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+
+// src/testing/test-report.ts
+import { Effect, Schema } from "effect";
+
+class ReportError extends Schema.TaggedError()("ReportError", {
+  message: Schema.String
+}) {
+}
+var NAME_SEPARATOR = " > ";
+function reporterArgs(outfile) {
+  return ["--reporter=junit", `--reporter-outfile=${outfile}`];
+}
+var MARKUP = /<(?:\?[\s\S]*?\?>|!--[\s\S]*?-->|!\[CDATA\[[\s\S]*?\]\]>|(\/?)([A-Za-z_][\w.:-]*)((?:\s+[A-Za-z_][\w.:-]*\s*=\s*"[^"<]*")*)\s*(\/?)>)/g;
+var ATTRIBUTE = /([A-Za-z_][\w.:-]*)\s*=\s*"([^"<]*)"/g;
+var ENTITY = /&(?:(amp|lt|gt|quot|apos)|#(\d+)|#x([0-9A-Fa-f]+));/g;
+var NAMED_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
+var decodeSuite = Schema.decodeUnknownEffect(Schema.Struct({ name: Schema.String }));
+var decodeCase = Schema.decodeUnknownEffect(Schema.Struct({ name: Schema.String, file: Schema.String, line: Schema.NumberFromString.check(Schema.isInt()) }));
+var decodeCrash = Schema.decodeUnknownEffect(Schema.Struct({ file: Schema.String }));
+var decodeTimed = Schema.decodeUnknownEffect(Schema.Struct({ file: Schema.String, time: Schema.FiniteFromString }));
+function unescape(text) {
+  return text.replace(ENTITY, (_, named, decimal, hex) => {
+    if (named !== undefined)
+      return NAMED_ENTITIES[named] ?? "";
+    return String.fromCodePoint(decimal === undefined ? Number.parseInt(hex ?? "", 16) : Number.parseInt(decimal, 10));
+  });
+}
+function attributesOf(source) {
+  const attributes = {};
+  for (const [, name, value] of source.matchAll(ATTRIBUTE)) {
+    if (name !== undefined && value !== undefined)
+      attributes[name] = unescape(value);
+  }
+  return attributes;
+}
+var malformed = (reason) => new ReportError({ message: `the junit report is malformed: ${reason}` });
+var takeTag = Effect.fnUntraced(function* (open, match) {
+  const [, closing, tag, attributes, selfClosing] = match;
+  if (tag === undefined)
+    return;
+  const parent = open.at(-1);
+  if (parent === undefined)
+    return yield* malformed(`<${tag}> after the root closed`);
+  if (closing === "/") {
+    if (parent.tag !== tag)
+      return yield* malformed(`</${tag}> closes <${parent.tag}>`);
+    open.pop();
+    return;
+  }
+  const element = { tag, attributes: attributesOf(attributes ?? ""), children: [] };
+  parent.children.push(element);
+  if (selfClosing !== "/")
+    open.push(element);
+});
+var parseElements = Effect.fnUntraced(function* (xml) {
+  const document = { tag: "", attributes: {}, children: [] };
+  const open = [document];
+  let consumed = 0;
+  for (const match of xml.matchAll(MARKUP)) {
+    if (xml.slice(consumed, match.index).includes("<"))
+      return yield* malformed(`stray < before offset ${match.index}`);
+    consumed = match.index + match[0].length;
+    yield* takeTag(open, match);
+  }
+  if (xml.slice(consumed).includes("<"))
+    return yield* malformed("stray < after the last element");
+  if (open.length !== 1)
+    return yield* malformed(`<${open.at(-1)?.tag}> never closes`);
+  const [root, ...extra] = document.children;
+  if (root?.tag !== "testsuites" || extra.length > 0)
+    return yield* malformed("the root is not one <testsuites>");
+  return root;
+});
+function outcomeOf(testcase) {
+  const skipped = testcase.children.find((child) => child.tag === "skipped");
+  if (skipped !== undefined)
+    return skipped.attributes["message"] === "TODO" ? "todo" : "skipped";
+  return testcase.children.some((child) => child.tag === "failure" || child.tag === "error") ? "failed" : "passed";
+}
+function crashed(testcase) {
+  return testcase.attributes["line"] === undefined && outcomeOf(testcase) === "failed";
+}
+var collect = Effect.fnUntraced(function* (suite, describes, report) {
+  const unreadable = (tag) => (cause) => new ReportError({ message: `the junit report holds a <${tag}> bun never writes: ${cause.message}` });
+  for (const child of suite.children) {
+    if (child.tag === "testsuite") {
+      const { name } = yield* decodeSuite(child.attributes).pipe(Effect.mapError(unreadable(child.tag)));
+      yield* collect(child, [...describes, name], report);
+    } else if (child.tag === "testcase" && crashed(child)) {
+      const { file } = yield* decodeCrash(child.attributes).pipe(Effect.mapError(unreadable(child.tag)));
+      report.crashedFiles.push(file);
+    } else if (child.tag === "testcase") {
+      const { name, file, line } = yield* decodeCase(child.attributes).pipe(Effect.mapError(unreadable(child.tag)));
+      report.results.push({ file, name: [...describes, name].join(NAME_SEPARATOR), line, outcome: outcomeOf(child) });
+    }
+  }
+});
+var parseReport = Effect.fn("parseReport")(function* (xml) {
+  const root = yield* parseElements(xml);
+  const results = [];
+  const crashedFiles = [];
+  for (const fileSuite of root.children) {
+    if (fileSuite.tag === "testsuite")
+      yield* collect(fileSuite, [], { results, crashedFiles });
+  }
+  return { results, crashedFiles };
+});
+var fileSeconds = Effect.fn("fileSeconds")(function* (xml) {
+  const root = yield* parseElements(xml);
+  const seconds = new Map;
+  for (const fileSuite of root.children) {
+    if (fileSuite.tag !== "testsuite")
+      continue;
+    const { file, time } = yield* decodeTimed(fileSuite.attributes).pipe(Effect.mapError((cause) => new ReportError({ message: `the junit report holds a <testsuite> with no file or time: ${cause.message}` })));
+    seconds.set(file, time);
+  }
+  return seconds;
+});
+
+// src/testing/unit-test-order.ts
+class OrderError extends Schema2.TaggedError()("OrderError", {
+  message: Schema2.String
+}) {
+}
+var NON_RUNS = ["--help", "-h", "--version"];
+function ordersTests(command, args) {
+  return command === "run" && !args.some((arg) => NON_RUNS.includes(arg) || arg === "--ignoreStatic");
+}
+function fastestFirst(seconds) {
+  return [...seconds].toSorted(([file, time], [other, otherTime]) => time - otherTime || file.localeCompare(other)).map(([file]) => file);
+}
+function inRunOrder(listed, timed) {
+  const known = new Set(listed);
+  const first = new Set(timed.filter((file) => known.has(file)));
+  const rest = listed.filter((file) => !first.has(file));
+  return [...[...first, ...rest].map((file) => `./${file}`), ...listed];
+}
+var timedFiles = Effect2.fn("timedFiles")(function* (listed) {
+  const fs = yield* FileSystem.FileSystem;
+  const outfile = (yield* Path.Path).join(yield* fs.makeTempDirectoryScoped({ prefix: "checks-test-order-" }), "junit.xml");
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const args = ["test", ...listed.map((file) => `./${file}`), ...reporterArgs(outfile)];
+  const exitCode = yield* spawner.exitCode(ChildProcess.make("bun", args, { stdin: "ignore", stdout: "ignore", stderr: "ignore" }));
+  if (exitCode !== ChildProcessSpawner.ExitCode(0))
+    return yield* new OrderError({ message: `bun test exited ${exitCode} while timing the unit tests` });
+  return fastestFirst(yield* fileSeconds(yield* fs.readFileString(outfile)));
+}, Effect2.scoped);
+var NodeServices = NodeChildProcessSpawner.layer.pipe(Layer.provideMerge(Layer.mergeAll(NodeFileSystem.layer, NodePath.layer)));
+var runOrder = (listed) => Effect2.runPromise(timedFiles(listed).pipe(Effect2.map((timed) => inRunOrder(listed, timed)), Effect2.catch((failure) => Console.error(`checks: ${failure.message}, so each static mutant runs the unit tests in path order`).pipe(Effect2.as(listed))), Effect2.provide(NodeServices)));
+export {
+  fastestFirst,
+  inRunOrder,
+  ordersTests,
+  runOrder
+};

package/dist/presets/stylelint.js

@@ -1,5 +1,6 @@
 // src/quality/presets/stylelint.ts
 import { fileURLToPath } from "node:url";
+import valueParser from "postcss-value-parser";
 var HTML_AND_ASTRO = ["**/*.html", "**/*.astro"];
 var MARKUP = [...HTML_AND_ASTRO, "**/*.vue", "**/*.svelte"];
 function peer(name) {
@@ -49,11 +50,108 @@ var PSEUDO_ARGUMENT = "(?:[^()]|\\([^()]*\\))*";
 var PSEUDO_CLASS = `::?[\\w-]+(?:\\(${PSEUDO_ARGUMENT}\\))?`;
 var HAS_IN_PSEUDO_CLASS = `(?::has\\(${PSEUDO_ARGUMENT}\\)|::?[\\w-]+\\(${PSEUDO_ARGUMENT}:has\\([^()]*\\)${PSEUDO_ARGUMENT}\\))`;
 var CLASSLESS_HAS = `/(?:^|[\\s>+~,])(?:${PSEUDO_CLASS})*${HAS_IN_PSEUDO_CLASS}(?:${PSEUDO_CLASS})*(?=[\\s>+~,]|$)/i`;
+var VAR = "var\\(\\s*--[^\\s,()]+\\s*\\)";
+var VAR_NAMES = /var\(\s*(--[^\s,()]+)\s*\)/gi;
+var FONT_SIZE_VALUE = new RegExp(`^${VAR}$`, "i");
+var FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH = "(?:normal|italic|oblique(?:\\s+-?[\\d.]+(?:deg|grad|rad|turn))?|small-caps|bold|bolder|lighter|[1-9]\\d*(?:\\.\\d+)?|(?:ultra-|extra-|semi-)?(?:condensed|expanded))";
+var FONT_FAMILY = `(?:"[^"]*"|'[^']*'|${VAR}|-?[a-z_][\\w-]*(?:\\s+-?[a-z_][\\w-]*)*)`;
+var FONT_FAMILIES = `${FONT_FAMILY}(?:\\s*,\\s*${FONT_FAMILY})*`;
+var FONT_FAMILY_VALUE = new RegExp(`^${FONT_FAMILIES}$`, "i");
+var NAMED_FONT_SIZES = new Set([
+  "xx-small",
+  "x-small",
+  "small",
+  "medium",
+  "large",
+  "x-large",
+  "xx-large",
+  "xxx-large",
+  "larger",
+  "smaller",
+  "math"
+]);
+var SIZE_PRECEDER = new RegExp(`^${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}$`, "i");
+var FONT_VALUE = new RegExp(`^(?:${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}\\s+)*(?<size>${VAR})(?<lineHeight>\\s*\\/\\s*(?:${VAR}|[\\w.%-]+))?(?:\\s+(?<families>${FONT_FAMILIES}))?$`, "i");
+var FONT_SIZE_RULE = "checks/font-size-from-tokens";
+function varNames(value) {
+  return [...value.matchAll(VAR_NAMES)].map(([, name]) => name).filter((name) => name !== undefined);
+}
+function sizePosition(families) {
+  const position = valueParser(families).nodes.find(({ type, value }) => type !== "space" && !(type === "word" && SIZE_PRECEDER.test(value)));
+  return position === undefined ? "" : valueParser.stringify(position);
+}
+function fontSizePosition(font) {
+  return font.lineHeight === undefined ? sizePosition(font.families ?? "") : "";
+}
+function namedSize(position) {
+  return NAMED_FONT_SIZES.has(position.toLowerCase()) ? position : undefined;
+}
+function sizeCarriers(property, value) {
+  const name = property.toLowerCase();
+  if (name === "font-size" && FONT_SIZE_VALUE.test(value))
+    return varNames(value).map((token) => ({ token, setTo: FONT_SIZE_VALUE, atSize: false }));
+  const font = name === "font" ? FONT_VALUE.exec(value)?.groups : undefined;
+  if (font?.size === undefined)
+    return [];
+  const atSize = varNames(fontSizePosition(font));
+  return [
+    ...varNames(font.size).map((token) => ({ token, setTo: FONT_SIZE_VALUE, atSize: false })),
+    ...varNames(font.families ?? "").map((token) => ({ token, setTo: FONT_FAMILY_VALUE, atSize: atSize.includes(token) }))
+  ];
+}
+function literalSize(property, value) {
+  const font = property.toLowerCase() === "font" ? FONT_VALUE.exec(value)?.groups : undefined;
+  return font?.size === undefined ? undefined : namedSize(fontSizePosition(font));
+}
+function fromTokens({ token, setTo, atSize }, declared, seen) {
+  const values = declared.get(token);
+  if (values === undefined)
+    return true;
+  return values.every((value) => {
+    const position = atSize ? sizePosition(value) : "";
+    return setTo.test(value) && namedSize(position) === undefined && varNames(value).every((alias) => !seen.has(alias) && fromTokens({ token: alias, setTo, atSize: varNames(position).includes(alias) }, declared, new Set([...seen, alias])));
+  });
+}
+var declaredByFile = new WeakMap;
+function fileDeclarations(document) {
+  const cached = declaredByFile.get(document);
+  if (cached !== undefined)
+    return cached;
+  const fresh = new Map;
+  document.walkDecls(/^--/, ({ prop, value }) => {
+    fresh.set(prop, [...fresh.get(prop) ?? [], value]);
+  });
+  declaredByFile.set(document, fresh);
+  return fresh;
+}
+var fontSizeFromTokens = () => async (root, result) => {
+  const { utils } = (await import("stylelint")).default;
+  const declared = fileDeclarations(result.root);
+  root.walkDecls((node) => {
+    const literal = literalSize(node.prop, node.value);
+    if (literal !== undefined) {
+      utils.report({ ruleName: FONT_SIZE_RULE, result, node, word: literal, message: `Expected the font size from the token files rather than the literal "${literal}"` });
+    }
+    for (const carrier of sizeCarriers(node.prop, node.value)) {
+      if (fromTokens(carrier, declared, new Set([carrier.token])))
+        continue;
+      utils.report({ ruleName: FONT_SIZE_RULE, result, node, word: carrier.token, message: `Expected "${carrier.token}" from the token files rather than set in this file` });
+    }
+  });
+};
+var FONT_SIZE_PLUGIN = {
+  ruleName: FONT_SIZE_RULE,
+  rule: Object.assign(fontSizeFromTokens, { ruleName: FONT_SIZE_RULE, messages: {} })
+};
 var DESIGN_TOKENS = {
   "color-no-hex": true,
   "color-named": "never",
   "function-disallowed-list": COLOUR_FUNCTIONS.map((name) => `/^${name}$/i`),
-  "declaration-property-value-allowed-list": { "/^font-size$/i": ["/^var\\(\\s*--[^\\s,()]+\\s*\\)$/i", "/^inherit$/i"] }
+  "declaration-property-value-allowed-list": {
+    "/^font-size$/i": [String(FONT_SIZE_VALUE), "/^inherit$/i"],
+    "/^font$/i": [String(FONT_VALUE), "/^inherit$/i"]
+  },
+  [FONT_SIZE_RULE]: true
 };
 var REFUSED_BASELINE = '@avi2dg/checks/stylelint: set baseline to "widely", "newly" or a year such as 2024';
 var REFUSED_TOKENS = "@avi2dg/checks/stylelint: set tokens to the globs of the token files, or false to leave the design token rules off";
@@ -112,7 +210,7 @@ function defineConfig({ baseline, tokens, bem, flatSelectors, noPageHas, rules,
   return {
     ...rest,
     extends: [peer("stylelint-config-standard")],
-    plugins: [peer("stylelint-plugin-use-baseline")],
+    plugins: [peer("stylelint-plugin-use-baseline"), FONT_SIZE_PLUGIN],
     rules: { ...merged, [BASELINE_RULE]: passProperty(merged[BASELINE_RULE]) },
     overrides: [
       { files: [...MARKUP], customSyntax: peer("postcss-html") },

package/docs/design.md

@@ -113,7 +113,8 @@ The `.ts` bins keep a `bun` shebang and need no build step, unlike the oxlint pl
 
 The bins are written in Effect.
 So `effect` is a peer dependency, and `@effect/platform-bun`, which only the bins use, is a dependency.
-`@effect/platform-node-shared` is a direct dependency only to pin its version.
+The Stryker test order helper runs under Node, so it takes its services from `@effect/platform-node-shared`, which is a direct dependency.
+That dependency also pins its version.
 `@effect/platform-bun` asks for it with a `^` range, so a newer minor of it could resolve and peer on a newer `effect` than the exact version consumers install.
 So the three packages move together at one exact version.
 
@@ -305,10 +306,10 @@ A browser check needs a built site and a browser, and a backend repository has n
 So a product opts in by declaring `browser-checks.json`, `checks-lint` never starts a browser, and the browser libraries are optional peers a backend never installs.
 `checks-frontend-syntax` needs no browser and runs inside `checks-lint`, but only where `frontend-syntax.json` declares its inputs, since a repository with no interface has no CSS to hold to it.
 
-Each check wraps a detector that already works rather than a rule of the kit's own.
+Each check wraps a detector that already works, and the kit writes a rule of its own only where none decides the constraint.
 The syntax gate runs two of stylelint's built-in rules and the stylelint team's shared configs, `axe` runs axe-core and `nesting` runs one html-validate rule.
 Its Baseline family runs `stylelint-plugin-use-baseline`, the one stylelint rule that judges against the Baseline data rather than a browser list.
-Its design token family is stylelint's own colour and value rules, applied outside the files a repository names as its tokens.
+Its design token family is stylelint's own colour and value rules and the kit's `checks/font-size-from-tokens`, applied outside the files a repository names as its tokens.
 A check of the rendered page against declared tokens would need a token format of the kit's own.
 The repository's `stylelint.config.ts` sets the Baseline target and the token files, since only the repository knows either.
 The gate imports that file itself, because stylelint's config loader calls `typescript.findConfigFile`, which TypeScript 7 lacks, and a JavaScript config is what [checks-no-plain-js](gates/checks-no-plain-js.md) refuses.

package/docs/gates/checks-ci-wiring.md

@@ -24,7 +24,9 @@ It also refuses a workflow that does not trigger on both `opened` and `synchroni
 A path filter cannot cover every pull request and therefore cannot satisfy the check.
 It refuses a reference to a workflow or job the repository does not hold.
 Each literal `checks-release-pr` and `checks-release-tag` argument names a workflow file, so every one must match a file under `.github/workflows/`.
+A call counts directly, through `bunx`, or through `bun` or `bun run` with the bin's path or its source file.
 An argument built from a variable or an expression is known only when the job runs, so the check passes over it.
+An argument built by command substitution is known only when the job runs, so the check passes over it.
 Each `on.workflow_run.workflows` entry names a workflow by its `name`, so every one must match a name in the repository.
 A workflow without a `name` answers to its path from the repository root.
 A local reusable `uses` must name a file under `.github/workflows/` that the repository holds.

package/docs/gates/checks-flake.md

@@ -15,8 +15,10 @@ A run that fails with no failing test, such as a test file that throws while loa
 
 ## Parallel hunts
 
-A repository whose `test` script passes `--parallel=<workers>` to [checks-test](checks-test.md#parallel-runs) is hunted with the same worker count, so each run is `bun test --randomize --seed=<seed> --parallel=<workers>`, the mode CI runs in.
-A `test` script without the option keeps the serial hunt.
+A repository whose `test` script runs [checks-test](checks-test.md#parallel-runs) is hunted with the worker count `checks-test` runs on.
+That is the `--parallel=<workers>` the script passes, or else one worker per core of the machine.
+So each run is `bun test --randomize --seed=<seed> --parallel=<workers>`, the mode CI runs in.
+A `test` script that does not run `checks-test` gets the serial hunt.
 
 Under workers a seed fixes the order Bun hands out the files.
 Which worker takes each file is a race between the workers.
@@ -42,7 +44,8 @@ A run whose worker crashed gets a replay of that worker's files up to the crashe
 ## What it reads
 
 It reads bun's JUnit report of each run.
-It reads the worker count from the `test` script in `package.json`, as [checks-test-layout](checks-test-layout.md) validates that script, and hunts serially when the file is missing.
+It reads the worker count from the `test` script in `package.json`, as [checks-test-layout](checks-test-layout.md) validates that script.
+It hunts serially when the file is missing or its `test` script does not run `checks-test`.
 Under workers it reads the record its preload writes of which worker ran each file.
 For each replay it reads the order Bun ran its placeholder files.
 Under GitHub Actions it appends its summary to the file `GITHUB_STEP_SUMMARY` names, which is the job summary.

package/docs/gates/checks-frontend-syntax.md

@@ -37,7 +37,7 @@ A control that needs selection off sets it on its own selector, such as `.drag-h
 | G1 correctness | `stylelint-config-recommended`, the stylelint team's rules for likely mistakes, such as `font-variant-numeric: oldstyle-num` for `oldstyle-nums` | on |
 | G2 conventions | `stylelint-config-standard`, which extends G1 with the stylelint team's notation and spacing rules | on |
 | G3 selector complexity | `selector-max-specificity` at `0,3,2` and `selector-max-compound-selectors` at 3 | on |
-| G4 design tokens | `color-no-hex`, `color-named: "never"`, `function-disallowed-list` over `rgb`, `rgba`, `hsl`, `hsla`, `hwb`, `lab`, `lch`, `oklab`, `oklch` and `color`, and `font-size` only as one `var(--…)` with no fallback, or `inherit` | off until `tokens` names the token files, and off in those files |
+| G4 design tokens | `color-no-hex`, `color-named: "never"`, `function-disallowed-list` over `rgb`, `rgba`, `hsl`, `hsla`, `hwb`, `lab`, `lch`, `oklab`, `oklch` and `color`, `font-size` only as one `var(--…)` with no fallback, or `inherit`, `font` only as `inherit`, or as such a `var(--…)` for its size after any literal style, variant, weight or width, and before an optional line height and a family list of names, strings and `var(--…)`s, and `checks/font-size-from-tokens`, which refuses a `var(--…)` for a size or a family naming a custom property that any style block or attribute of the same file sets, unless the file sets it only to another such `var(--…)`, or for a family to a family list, and refuses a named size such as `small` or `math` at the one place the size can still stand, the first family word after any style, variant, weight or width while no line height fixes the `var(--…)` as the size, written there or set there by such a property | off until `tokens` names the token files, and off in those files |
 | G5 Baseline target | `plugin/use-baseline` from `stylelint-plugin-use-baseline`, which judges each property, value, function, at-rule, selector and unit against the Baseline data, and passes a property inside an `@supports` block. It passes `@property` at every target, since a browser without `@property` treats the declaration as an unregistered custom property | on, at the target `baseline` sets |
 | G6 comments refused | `comment-word-disallowed-list` over `/^[\s\S]*$/`, which refuses every comment, including an empty `/* */` | on |
 | G7 language-free selectors | `selector-disallowed-list` over `/[^\x00-\x7F]/`, which refuses any selector holding a non-ASCII character, in attribute values, class names and ids alike | on |
@@ -74,6 +74,7 @@ These are outside what it decides:
 
 - A `transition` shorthand that names no property, such as `transition: 200ms`, which the browser reads as `all`.
 - A value it cannot see, such as `transition: var(--motion)`, a style a script sets, or a colour a build writes into CSS outside the declared inputs.
+- A font size custom property that one stylesheet outside the token files sets and another reads.
 - `user-select: none` in a `style` attribute on `<body>`, which has no selector to judge.
 - A viewport that disables zoom, since stylelint reads only CSS.
   A repository that runs only this gate gets no viewport check, and [checks-browser](checks-browser.md) refuses one on the rendered page through axe's `meta-viewport` rule.
@@ -133,7 +134,7 @@ A config not built with `defineConfig` names its own `customSyntax` for markup,
 The repository installs the optional peers the gate loads, at the versions the kit pins:
 
 ```sh
-bun add -d stylelint@17.16.0 postcss-html@2.0.0 stylelint-config-standard@40.0.0 stylelint-plugin-use-baseline@1.4.7
+bun add -d stylelint@17.16.0 postcss-html@2.0.0 stylelint-config-standard@40.0.0 stylelint-plugin-use-baseline@1.4.7 postcss-value-parser@4.2.0
 ```
 
 ## Arguments

package/docs/gates/checks-mutation-scope.md

@@ -53,7 +53,11 @@ So a helper, fixture or preload changed on `main` since that baseline can hide a
 - The full baseline report that `checks-mutation-baseline --full` restores, for each mutant's `coveredBy` and `killedBy` and the `testFiles` that own those tests.
 
 Stryker leaves `coveredBy` empty on a static mutant, so only `killedBy` names its tests.
-The report must come from a run that restored no state and passed `--disableBail`, which lists every killing test.
+The report must come from a run that restored no state, so each mutant's tests are the ones it ran against.
+With bail, Stryker's default, `killedBy` names the one test that killed the mutant first.
+One killer is enough, since a branch loses a kill through its tests only when it changes every test that made the kill.
+A test left alone, whose sources the branch also leaves alone, still kills the mutant at `HEAD`.
+So whichever killer the report names is a changed test, and a deleted test counts as changed.
 
 ## Arguments
 

package/docs/gates/checks-mutation.md

@@ -25,7 +25,12 @@ The preset also registers an ignore plugin that checks the incremental report on
 A config that replaces `plugins` or `ignorers` must keep the preset's entries, or that check does not run.
 The preset also exports `unitTestFiles`, which lists every `.test.ts` and `.test.tsx` file under `tests/unit` at config load.
 A repository sets `bun.testFiles` to its result, so a covered, non-static mutant loads only the test files that cover it.
-A static mutant has no per-test coverage, so it still loads every listed file.
+A static mutant has no per-test coverage, so it still loads every listed file, and with bail it stops at the first test that fails.
+So when a `stryker run` without `--ignoreStatic` loads the preset, the preset first runs the listed files once with `bun test` and times each file.
+`unitTestFiles` then lists each file with a leading `./`, fastest first, and Bun runs such paths in the order given.
+It then lists each path again without the `./`, the spelling the runner matches a covering test against.
+Bun loads a file once however often the list names it.
+When that timing run fails, the preset prints why on stderr and `unitTestFiles` keeps the path order.
 The config then reads:
 
 ```js
@@ -96,7 +101,7 @@ jobs:
         with:
           bun-version-file: .bun-version
       - run: bun install --frozen-lockfile
-      - run: bunx stryker run --disableBail
+      - run: bunx stryker run
       - run: bunx checks-mutation-baseline --slim reports/mutation/mutation.json "$RUNNER_TEMP/full/mutation.json"
       - uses: actions/upload-artifact@v4
         with:
@@ -105,7 +110,8 @@ jobs:
           retention-days: 30
 ```
 
-The run restores no state and passes `--disableBail`, so its report names every test that covers or kills each mutant.
+The run restores no state, so its report names every test that covers each covered mutant and the first test that killed each killed mutant.
+[checks-mutation-scope](checks-mutation-scope.md#what-it-reads) says why that one killer is enough.
 The upload is the `mutation-baseline-full` artifact that a branch comparison's scope step restores with `checks-mutation-baseline --full`.
 [checks-mutation-scope](checks-mutation-scope.md) reads it to bring in the sources a changed unit test covers or kills.
 The restore reads only a successful run of `mutation.yml` on `main`, so a sweep that fails publishes nothing a scope step reads.

package/docs/gates/checks-night-run.md

@@ -44,8 +44,10 @@ A run on any ref but `refs/heads/main` files no issue and records no score, and
 ## What it reads
 
 It reads tonight's Stryker `mutation.json` report, when the mutation run left one, and any number of JUnit reports, such as the ones `checks-test --junit=<file>` keeps, as [checks-test](checks-test.md#arguments) says.
-It reads the previous night from the `night-run` artifact of the newest successful run of the same workflow on `main`.
-That artifact holds `night-run.json`, the scores the run recorded, and a newest run without it counts as no previous night.
+It scans the newest 30 successful runs of the same workflow on `main` from newest to oldest.
+It takes the first run whose `night-run` artifact still exists as the previous night.
+That artifact holds `night-run.json`, the scores the run recorded.
+When no scanned run holds the artifact it compares no score.
 A run on another branch never becomes the previous night.
 On `main` with a mutation report it writes tonight's scores to `reports/night-run.json`, and the workflow uploads that file as the `night-run` artifact.
 It reads the run from `GITHUB_SERVER_URL`, `GITHUB_REPOSITORY`, `GITHUB_RUN_ID`, `GITHUB_WORKFLOW_REF` and `GITHUB_REF`, so it runs only inside a GitHub Actions job.

package/docs/gates/checks-test-layout.md

@@ -26,7 +26,7 @@ It fails unless the repository holds this shape, and names the file and the path
   It may not import `$`, `spawn`, `spawnSync`, `connect`, `serve` or `listen` from `bun`, may not touch `Bun.$` or `Bun.spawn`, and may not call `fetch`.
   A test at the `e2e`, `live` or `pixel` level may do all of it, under `tests/quarantine/` as well.
   Helpers in `tests/lib/**` answer to the same rule, since an in-process test reaches them.
-- `scripts.test` is `checks-test`, optionally with `--parallel=<workers>`, which runs `bun test --randomize` as [checks-test](checks-test.md) says.
+- `scripts.test` is `checks-test`, optionally with `--parallel=<workers>`, which runs `bun test --randomize --parallel=<workers>` as [checks-test](checks-test.md#parallel-runs) says.
 - `scripts.lint` runs this check, itself or through `checks-lint` called by its bare bin name.
 - `bunfig.toml` carries every `[test]` key of the shipped preset with the same value.
   `[test].pathIgnorePatterns` is the preset's `["**/tests/quarantine/**", "**/tests/live/**", "**/tests/pixel/**", "repos/**"]`, which the check pins itself, so the kit's own repository, whose bunfig is the preset, cannot drift it either.

package/docs/gates/checks-test.md

@@ -8,7 +8,7 @@ audience: consumers
 
 ## What it checks
 
-It runs the default suite with `bun test --randomize` and reads Bun's JUnit report from that run.
+It runs the default suite with `bun test --randomize --parallel=<workers>`, as [Parallel runs](#parallel-runs) says, and reads Bun's JUnit report from that run.
 It runs Bun with `CI=true`, so `test.only` fails the run in every environment.
 Bun exits zero when tests skip, so `checks-test` checks every skipped test against its source declaration.
 A test that `test.skip`, `test.skipIf`, `test.if`, `test.todo` or an enclosing `describe.skip` skips fails unless the test declares its reason.
@@ -76,7 +76,9 @@ Bun ignores both directories during the default run.
 
 ## Parallel runs
 
-A repository runs its test files in parallel by passing a worker count in its `test` script:
+`checks-test` runs `bun test --randomize --parallel=<workers>`, so Bun hands each test file to one of that many worker processes.
+Without `--parallel=<workers>`, the count is one worker per core, as `os.availableParallelism()` reports it, so a local run never oversubscribes the machine.
+A repository sets its own count by passing `--parallel=<workers>` in its `test` script:
 
 ```json
 {
@@ -86,13 +88,12 @@ A repository runs its test files in parallel by passing a worker count in its `t
 }
 ```
 
-`checks-test --parallel=<workers>` runs `bun test --randomize --parallel=<workers>`, so Bun hands each test file to one of that many worker processes.
-Each file then runs in a fresh global, so a file cannot lean on state another file left behind.
-The count is a whole number from 1 up, and without the option the suite runs serially in one process.
+The count is a whole number from 1 up.
+Each file runs in a fresh global, so a file cannot lean on state another file left behind.
 Tests still run in random order, and `test.only` still fails the run.
-Bun merges every worker's results into the one JUnit report, so each skipped test and each todo is judged as in a serial run.
+Bun merges every worker's results into the one JUnit report, so each skipped test and each todo is judged across the whole suite.
 A tier script takes the same option, as in `checks-test --tier=live --parallel=4`.
-[checks-flake](checks-flake.md#parallel-hunts) hunts with the worker count the `test` script sets.
+[checks-flake](checks-flake.md#parallel-hunts) hunts with the same worker count.
 
 A file whose worker crashes, for example when a test calls `process.exit`, fails the run.
 Bun reports no result from that file, so its skips are not judged and its declarations are not reported as stale.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "license": "MIT",
   "repository": {
@@ -180,7 +180,7 @@
   },
   "scripts": {
     "prepare": "bun src/dependencies/vendor.ts --library effect --package effect --repository https://github.com/Effect-TS/effect.git --tag 'effect@{version}' --path packages/effect/package.json",
-    "build": "bun build src/quality/effect-channel/index.ts --outdir dist/effect-channel --target node --format esm && bun build src/complexity/readability/index.ts --outdir dist/readability --target node --format esm && bun build src/quality/data-shape/index.ts --outdir dist/data-shape --target node --format esm && bun build src/testing/mutation-guard-plugin.ts src/testing/mutation-refusal.ts --outdir dist/mutation --target node --format esm && bun build src/quality/presets/oxlint.ts src/quality/presets/knip.ts src/quality/presets/dependency-cruiser.ts src/quality/presets/stylelint.ts --outdir dist/presets --target node --format esm && tsc -p tsconfig.presets.json && bun scripts/configs-write.ts && bun src/quality/effect-scope.ts && bun scripts/doc-templates-write.ts && bun src/delivery/changelog-write.ts && bun scripts/doc-blocks-write.ts",
+    "build": "bun build src/quality/effect-channel/index.ts --outdir dist/effect-channel --target node --format esm && bun build src/complexity/readability/index.ts --outdir dist/readability --target node --format esm && bun build src/quality/data-shape/index.ts --outdir dist/data-shape --target node --format esm && bun build src/testing/mutation-guard-plugin.ts src/testing/mutation-refusal.ts src/testing/unit-test-order.ts --outdir dist/mutation --target node --format esm --packages external && bun build src/quality/presets/oxlint.ts src/quality/presets/knip.ts src/quality/presets/dependency-cruiser.ts src/quality/presets/stylelint.ts --outdir dist/presets --target node --format esm --packages external && tsc -p tsconfig.presets.json && bun scripts/configs-write.ts && bun src/quality/effect-scope.ts && bun scripts/doc-templates-write.ts && bun src/delivery/changelog-write.ts && bun scripts/doc-blocks-write.ts",
     "lint": "oxlint && bun src/core/lint.ts",
     "typecheck": "tsc --noEmit && effect-tsgo diagnostics --project tsconfig.json --format text --strict",
     "test": "bun src/testing/test.ts",
@@ -202,6 +202,7 @@
     "oxlint-tsgolint": "7.0.2002",
     "playwright-core": "1.63.0",
     "postcss-html": "2.0.0",
+    "postcss-value-parser": "4.2.0",
     "stylelint": "17.16.0",
     "stylelint-config-standard": "40.0.0",
     "stylelint-plugin-use-baseline": "1.4.7",
@@ -220,6 +221,9 @@
     "postcss-html": {
       "optional": true
     },
+    "postcss-value-parser": {
+      "optional": true
+    },
     "stylelint": {
       "optional": true
     },
@@ -247,6 +251,7 @@
     "oxlint-tsgolint": "7.0.2002",
     "playwright-core": "1.63.0",
     "postcss-html": "2.0.0",
+    "postcss-value-parser": "4.2.0",
     "stylelint": "17.16.0",
     "stylelint-config-standard": "40.0.0",
     "stylelint-plugin-use-baseline": "1.4.7",

package/src/delivery/shell-command.ts

@@ -64,7 +64,9 @@ export function plainCommand(script: string): Command | undefined {
   return words.length === 0 ? undefined : words;
 }
 
-type ShellPart = Span & { readonly substitutions: readonly string[] };
+export type Word = { readonly text: string; readonly start: number };
+
+type ShellPart = Span & { readonly substitutions: readonly Word[] };
 
 const COMMAND_BREAKS = new Set(["\n", ";", "&", "|", "(", ")", "`"]);
 const WORD_BREAKS = new Set([" ", "\t"]);
@@ -87,8 +89,11 @@ const LAUNCHER_OPERANDS = new Map<string, ReadonlySet<string>>([
 
 function substitutionEnd(script: string, start: number): number {
   if (script.charAt(start) === "`") {
-    const close = script.indexOf("`", start + 1);
-    return close === -1 ? script.length : close;
+    for (let index = start + 1; index < script.length; index += 1) {
+      if (script.charAt(index) === "\\") index += 1;
+      else if (script.charAt(index) === "`") return index;
+    }
+    return script.length;
   }
   let depth = 0;
   for (let index = start + 1; index < script.length; index += 1) {
@@ -106,12 +111,14 @@ function doubleQuotedPart(script: string, index: number): ShellPart {
   if (char === "\\" && DOUBLE_QUOTE_ESCAPES.has(next)) return { text: next, end: index + 2, substitutions: [] };
   if (char !== "`" && !(char === "$" && next === "(")) return { text: char, end: index + 1, substitutions: [] };
   const end = substitutionEnd(script, index);
-  return { text: "", end: end + 1, substitutions: [script.slice(index + (char === "`" ? 1 : 2), end)] };
+  const start = index + (char === "`" ? 1 : 2);
+  // An unresolved expansion never becomes an empty literal.
+  return { text: "$", end: end + 1, substitutions: [{ text: script.slice(start, end), start }] };
 }
 
 function shellDoubleQuoted(script: string, open: number): ShellPart {
   let text = "";
-  const substitutions: string[] = [];
+  const substitutions: Word[] = [];
   let index = open + 1;
   while (index < script.length && script.charAt(index) !== '"') {
     const part = doubleQuotedPart(script, index);
@@ -142,31 +149,32 @@ function commentEnd(script: string, from: number): number {
 export const SHELLS = ["sh", "bash", "dash", "ksh", "zsh"];
 
 type Heredoc = {
-  readonly consumer: Command;
+  readonly consumer: readonly Word[];
   readonly delimiter: string;
   readonly tabs: boolean;
   readonly literal: boolean;
 };
 
 type ShellParse = {
-  readonly commands: string[][];
-  readonly substitutions: string[];
+  readonly commands: (readonly Word[])[];
+  readonly substitutions: Word[];
   readonly heredocs: Heredoc[];
-  words: string[];
+  words: Word[];
   word: string | undefined;
+  wordStart: number;
   redirecting: boolean;
 };
 
 function endWord(parse: ShellParse): void {
   if (parse.word === undefined) return;
-  if (!parse.redirecting) parse.words.push(parse.word);
+  if (!parse.redirecting) parse.words.push({ text: parse.word, start: parse.wordStart });
   parse.redirecting = false;
   parse.word = undefined;
 }
 
 function endCommand(parse: ShellParse): void {
   endWord(parse);
-  parse.commands.push(parse.words);
+  parse.commands.push(...parse.substitutions.splice(0).flatMap(nested), parse.words);
   parse.words = [];
   parse.redirecting = false;
 }
@@ -206,8 +214,8 @@ function heredocBody(script: string, from: number, { delimiter, tabs }: Heredoc)
   return { text: script.slice(from), end: script.length };
 }
 
-function bodySubstitutions(body: string): readonly string[] {
-  const substitutions: string[] = [];
+function bodySubstitutions(body: string): readonly Word[] {
+  const substitutions: Word[] = [];
   let index = 0;
   while (index < body.length) {
     const part = doubleQuotedPart(body, index);
@@ -221,16 +229,41 @@ function skipHeredocs(parse: ShellParse, script: string, from: number): number {
   let index = from;
   for (const heredoc of parse.heredocs.splice(0)) {
     const body = heredocBody(script, index, heredoc);
-    const [program = ""] = fromProgram(heredoc.consumer);
-    if (SHELLS.includes(program.slice(program.lastIndexOf("/") + 1))) parse.substitutions.push(body.text);
-    else if (!heredoc.literal) parse.substitutions.push(...bodySubstitutions(body.text));
+    const [program = ""] = fromProgram(texts(heredoc.consumer));
+    if (SHELLS.includes(program.slice(program.lastIndexOf("/") + 1))) parse.substitutions.push({ text: body.text, start: index });
+    else if (!heredoc.literal) parse.substitutions.push(...bodySubstitutions(body.text).map(({ text, start }) => ({ text, start: start + index })));
     index = body.end;
   }
   return index;
 }
 
-export function shellCommands(script: string): readonly Command[] {
-  const parse: ShellParse = { commands: [], substitutions: [], heredocs: [], words: [], word: undefined, redirecting: false };
+function extendWord(parse: ShellParse, script: string, index: number): number {
+  const part = shellPart(script, index);
+  if (parse.word === undefined) parse.wordStart = index;
+  parse.word = (parse.word ?? "") + part.text;
+  parse.substitutions.push(...part.substitutions);
+  return part.end;
+}
+
+function extendBacktick(parse: ShellParse, script: string, index: number): number {
+  const end = substitutionEnd(script, index);
+  if (parse.word === undefined) parse.wordStart = index;
+  parse.word = (parse.word ?? "") + "$";
+  parse.substitutions.push({ text: script.slice(index + 1, end), start: index + 1 });
+  return end + 1;
+}
+
+function texts(words: readonly Word[]): Command {
+  return words.map(({ text }) => text);
+}
+
+function nested({ text, start }: Word): readonly (readonly Word[])[] {
+  return shellWords(text).map((words) => words.map((word) => ({ text: word.text, start: word.start + start })));
+}
+
+// Each word starts at its offset in the script.
+export function shellWords(script: string): readonly (readonly Word[])[] {
+  const parse: ShellParse = { commands: [], substitutions: [], heredocs: [], words: [], word: undefined, wordStart: 0, redirecting: false };
   let index = 0;
   while (index < script.length) {
     const char = script.charAt(index);
@@ -240,6 +273,8 @@ export function shellCommands(script: string): readonly Command[] {
       index = commentEnd(script, index);
     } else if (REDIRECTS.has(char)) {
       index = startRedirect(parse, script, index);
+    } else if (char === "`") {
+      index = extendBacktick(parse, script, index);
     } else if (COMMAND_BREAKS.has(char)) {
       endCommand(parse);
       index = char === "\n" ? skipHeredocs(parse, script, index + 1) : index + 1;
@@ -247,14 +282,15 @@ export function shellCommands(script: string): readonly Command[] {
       endWord(parse);
       index += 1;
     } else {
-      const part = shellPart(script, index);
-      parse.word = (parse.word ?? "") + part.text;
-      parse.substitutions.push(...part.substitutions);
-      index = part.end;
+      index = extendWord(parse, script, index);
     }
   }
   endCommand(parse);
-  return [...parse.commands, ...parse.substitutions.flatMap(shellCommands)].filter((command) => command.length > 0);
+  return parse.commands.filter((command) => command.length > 0);
+}
+
+export function shellCommands(script: string): readonly Command[] {
+  return shellWords(script).map(texts);
 }
 
 export function withoutOptions(words: Command, operands: ReadonlySet<string>): Command {

package/src/delivery/workflow-references.ts

@@ -1,4 +1,4 @@
-import { fromProgram, shellCommands, type Command } from "./shell-command.ts";
+import { fromProgram, shellWords, type Command } from "./shell-command.ts";
 
 export type Workflow = {
   readonly path: string;
@@ -28,6 +28,10 @@ export function names(value: unknown): readonly string[] | undefined {
 
 type Key = string | number;
 
+type Target = { readonly name: string; readonly invocation: number };
+
+type Piece = { readonly at: number; readonly text: string };
+
 type Locator = (keys: readonly Key[], needle: string, fallback: string) => string;
 
 // Lines from..to hold the node, and its child keys start at column.
@@ -45,18 +49,25 @@ function isPathTo(word: string, files: readonly string[]): boolean {
 }
 
 function releaseArguments(program: Command): readonly string[] {
-  const [head, target] = program;
+  const [head, target, entry] = program;
   if (head !== undefined && (RELEASE_BINS.includes(head) || isPathTo(head, RELEASE_BINS))) return program.slice(1);
+  if (head === "bun" && target === "run" && entry !== undefined && (RELEASE_SOURCES.includes(entry) || isPathTo(entry, [...RELEASE_SOURCES, ...RELEASE_BINS]))) {
+    return program.slice(3);
+  }
   if (head === "bun" && target !== undefined && (RELEASE_SOURCES.includes(target) || isPathTo(target, [...RELEASE_SOURCES, ...RELEASE_BINS]))) {
     return program.slice(2);
   }
   return [];
 }
 
-function literalTargets(run: string): readonly string[] {
-  return shellCommands(run.replace(EXPRESSION, "$EXPRESSION"))
-    .flatMap((command) => releaseArguments(fromProgram(command)))
-    .filter((target) => !target.includes("$"));
+// The stand-in for an expression keeps its length, so each invocation starts at its offset in run.
+function literalTargets(run: string): readonly Target[] {
+  return shellWords(run.replace(EXPRESSION, (expression) => `$${"_".repeat(expression.length - 1)}`)).flatMap((words) => {
+    const invocation = words[0]?.start ?? 0;
+    return releaseArguments(fromProgram(words.map(({ text }) => text)))
+      .filter((name) => !name.includes("$"))
+      .map((name) => ({ name, invocation }));
+  });
 }
 
 function escapeRegExp(text: string): string {
@@ -113,6 +124,102 @@ function nodeAt(lines: readonly string[], keys: readonly Key[]): Node | undefine
   );
 }
 
+const BLOCK_HEADER = /^[|>][1-9+-]*\s*(#.*)?$/;
+const PLAIN_COMMENT = /(^|\s)#/;
+const ESCAPES = new Map([
+  ["0", "\0"], ["a", "\x07"], ["b", "\b"], ["t", "\t"], ["\t", "\t"], ["n", "\n"], ["v", "\v"], ["f", "\f"], ["r", "\r"], ["e", "\x1b"],
+  [" ", " "], ['"', '"'], ["/", "/"], ["\\", "\\"], ["N", "\x85"], ["_", "\xa0"], ["L", "\u2028"], ["P", "\u2029"],
+]);
+const HEX_ESCAPES = new Map([["x", 2], ["u", 4], ["U", 8]]);
+
+function rawPieces(lines: readonly string[], node: Node): readonly Piece[] {
+  const head = lines[node.from] ?? "";
+  const keyColumn = /^\s*(?:-\s+)?/.exec(head)?.[0].length ?? 0;
+  return [
+    { at: node.from, text: head.slice(head.indexOf(":") + 1).trim() },
+    ...lines.slice(node.from + 1, node.to).map((line, index) => ({ at: node.from + 1 + index, text: indentOf(line) > keyColumn ? line.trim() : "" })),
+  ];
+}
+
+function plainPieces(pieces: readonly Piece[]): readonly Piece[] {
+  const decoded: Piece[] = [];
+  for (const { at, text } of pieces) {
+    const comment = PLAIN_COMMENT.exec(text);
+    const content = comment === null ? text : text.slice(0, comment.index).trimEnd();
+    decoded.push({ at, text: content });
+    if (comment !== null && decoded.some((piece) => piece.text !== "")) break;
+  }
+  return decoded;
+}
+
+function escaped(text: string, at: number): { readonly text: string; readonly end: number } {
+  const code = text.charAt(at + 1);
+  const width = HEX_ESCAPES.get(code);
+  if (width !== undefined) return { text: String.fromCodePoint(Number.parseInt(text.slice(at + 2, at + 2 + width), 16)), end: at + 2 + width };
+  return { text: ESCAPES.get(code) ?? code, end: at + 2 };
+}
+
+function quotedPieces(pieces: readonly Piece[], quote: "'" | '"'): readonly Piece[] {
+  const decoded: Piece[] = [];
+  for (const [position, { at, text }] of pieces.entries()) {
+    let content = "";
+    let index = position === 0 ? 1 : 0;
+    while (index < text.length) {
+      const char = text.charAt(index);
+      if (quote === "'" && char === "'" && text.charAt(index + 1) === "'") {
+        content += "'";
+        index += 2;
+      } else if (char === quote) {
+        return [...decoded, { at, text: content }];
+      } else if (quote === '"' && char === "\\") {
+        const escape = escaped(text, index);
+        content += escape.text;
+        index = escape.end;
+      } else {
+        content += char;
+        index += 1;
+      }
+    }
+    decoded.push({ at, text: content });
+  }
+  return decoded;
+}
+
+function quoteOf(text: string): "'" | '"' | undefined {
+  return text.startsWith("'") ? "'" : text.startsWith('"') ? '"' : undefined;
+}
+
+// Each piece holds what its physical line adds to the value, without the folding between lines.
+function scalarPieces(lines: readonly string[], node: Node): readonly Piece[] {
+  const [head, ...body] = rawPieces(lines, node);
+  if (head === undefined) return [];
+  if (BLOCK_HEADER.test(head.text)) return body;
+  const open = quoteOf(head.text);
+  if (open !== undefined) return quotedPieces([head, ...body], open);
+  if (head.text !== "" && !head.text.startsWith("#")) return plainPieces([head, ...body]);
+  const first = body.findIndex((piece) => piece.text !== "" && !piece.text.startsWith("#"));
+  const token = first === -1 ? undefined : quoteOf(body[first]?.text ?? "");
+  return token === undefined ? plainPieces([head, ...body]) : quotedPieces(body.slice(first), token);
+}
+
+function scalarLine(lines: readonly string[], node: Node, value: string, offset: number): number {
+  let line = node.from;
+  let cursor = 0;
+  for (const { at, text } of scalarPieces(lines, node)) {
+    const start = text === "" ? -1 : value.indexOf(text, cursor);
+    if (start === -1) continue;
+    if (start > offset) break;
+    line = at;
+    cursor = start + text.length;
+  }
+  return line;
+}
+
+function releaseLocation(path: string, lines: readonly string[], keys: readonly Key[], run: string, target: Target, fallback: string): string {
+  const node = nodeAt(lines, keys);
+  return node === undefined ? `${path} ${fallback}` : `${path} line ${scalarLine(lines, node, run, target.invocation) + 1}`;
+}
+
 export function locate(path: string, lines: readonly string[]): Locator {
   const used = new Map<string, number>();
   return (keys, needle, fallback) => {
@@ -144,7 +251,14 @@ function missingTarget(uses: string, paths: ReadonlySet<string>, at: Locator, ke
     : undefined;
 }
 
-function missingJobRefs(id: string, job: unknown, paths: ReadonlySet<string>, at: Locator): readonly MissingReference[] {
+function missingJobRefs(
+  id: string,
+  job: unknown,
+  paths: ReadonlySet<string>,
+  at: Locator,
+  path: string,
+  lines: readonly string[],
+): readonly MissingReference[] {
   if (!isRecord(job)) return [];
   const missing: MissingReference[] = [];
   if (typeof job["uses"] === "string") {
@@ -162,8 +276,9 @@ function missingJobRefs(id: string, job: unknown, paths: ReadonlySet<string>, at
     }
     if (typeof step["run"] !== "string") return;
     for (const target of literalTargets(step["run"])) {
-      if (!paths.has(`${WORKFLOWS}/${target}`)) {
-        missing.push({ location: at(["jobs", id, "steps", index, "run"], target, fallback), fault: `names missing workflow ${target}` });
+      if (!paths.has(`${WORKFLOWS}/${target.name}`)) {
+        const location = releaseLocation(path, lines, ["jobs", id, "steps", index, "run"], step["run"], target, fallback);
+        missing.push({ location, fault: `names missing workflow ${target.name}` });
       }
     }
   });
@@ -176,11 +291,12 @@ export function findMissingWorkflows(workflows: readonly Workflow[]): readonly M
   const titles = new Set(workflows.map((workflow) => workflowTitle(workflow.document) ?? workflow.path));
   return workflows.flatMap((workflow) => {
     const missing: MissingReference[] = [];
-    const at = locate(workflow.path, workflow.text.split("\n"));
+    const lines = workflow.text.split("\n");
+    const at = locate(workflow.path, lines);
     const jobs = isRecord(workflow.document) ? workflow.document["jobs"] : undefined;
     if (isRecord(jobs)) {
       missing.push(...missingNeeds(jobs, at));
-      for (const [id, job] of Object.entries(jobs)) missing.push(...missingJobRefs(id, job, paths, at));
+      for (const [id, job] of Object.entries(jobs)) missing.push(...missingJobRefs(id, job, paths, at, workflow.path, lines));
     }
     const on = isRecord(workflow.document) ? workflow.document["on"] : undefined;
     const watched = isRecord(on) ? on["workflow_run"] : undefined;

package/src/quality/presets/stylelint.ts

@@ -1,5 +1,6 @@
 import { fileURLToPath } from "node:url";
-import type { Config } from "stylelint";
+import valueParser from "postcss-value-parser";
+import type { Config, Plugin, RuleBase } from "stylelint";
 
 type Globs = readonly [string, ...string[]];
 
@@ -87,11 +88,142 @@ const HAS_IN_PSEUDO_CLASS = `(?::has\\(${PSEUDO_ARGUMENT}\\)|::?[\\w-]+\\(${PSEU
 // A compound of pseudo-classes alone, :scope and :not(.card) among them, can match the root element, so its :has() reads page state.
 const CLASSLESS_HAS = `/(?:^|[\\s>+~,])(?:${PSEUDO_CLASS})*${HAS_IN_PSEUDO_CLASS}(?:${PSEUDO_CLASS})*(?=[\\s>+~,]|$)/i`;
 
+const VAR = "var\\(\\s*--[^\\s,()]+\\s*\\)";
+
+const VAR_NAMES = /var\(\s*(--[^\s,()]+)\s*\)/gi;
+
+const FONT_SIZE_VALUE = new RegExp(`^${VAR}$`, "i");
+
+const FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH = "(?:normal|italic|oblique(?:\\s+-?[\\d.]+(?:deg|grad|rad|turn))?|small-caps|bold|bolder|lighter|[1-9]\\d*(?:\\.\\d+)?|(?:ultra-|extra-|semi-)?(?:condensed|expanded))";
+
+const FONT_FAMILY = `(?:"[^"]*"|'[^']*'|${VAR}|-?[a-z_][\\w-]*(?:\\s+-?[a-z_][\\w-]*)*)`;
+
+const FONT_FAMILIES = `${FONT_FAMILY}(?:\\s*,\\s*${FONT_FAMILY})*`;
+
+const FONT_FAMILY_VALUE = new RegExp(`^${FONT_FAMILIES}$`, "i");
+
+const NAMED_FONT_SIZES = new Set([
+  "xx-small",
+  "x-small",
+  "small",
+  "medium",
+  "large",
+  "x-large",
+  "xx-large",
+  "xxx-large",
+  "larger",
+  "smaller",
+  "math",
+]);
+
+const SIZE_PRECEDER = new RegExp(`^${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}$`, "i");
+
+const FONT_VALUE = new RegExp(
+  `^(?:${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}\\s+)*(?<size>${VAR})(?<lineHeight>\\s*\\/\\s*(?:${VAR}|[\\w.%-]+))?(?:\\s+(?<families>${FONT_FAMILIES}))?$`,
+  "i",
+);
+
+const FONT_SIZE_RULE = "checks/font-size-from-tokens";
+
+function varNames(value: string): string[] {
+  return [...value.matchAll(VAR_NAMES)].map(([, name]) => name).filter((name) => name !== undefined);
+}
+
+type SizeCarrier = { readonly token: string; readonly setTo: RegExp; readonly atSize: boolean };
+
+// The size follows any style, variant, weight and width, so the first other word or var() is the one place a family list can hold it.
+function sizePosition(families: string): string {
+  const position = valueParser(families).nodes.find(({ type, value }) => type !== "space" && !(type === "word" && SIZE_PRECEDER.test(value)));
+  return position === undefined ? "" : valueParser.stringify(position);
+}
+
+// A line height fixes the var() before it as the size, which leaves the family list no size to hold.
+function fontSizePosition(font: Readonly<Record<string, string | undefined>>): string {
+  return font.lineHeight === undefined ? sizePosition(font.families ?? "") : "";
+}
+
+function namedSize(position: string): string | undefined {
+  return NAMED_FONT_SIZES.has(position.toLowerCase()) ? position : undefined;
+}
+
+// A var() before the size var can be a weight, which leaves a family var() free to hold the size.
+function sizeCarriers(property: string, value: string): SizeCarrier[] {
+  const name = property.toLowerCase();
+  if (name === "font-size" && FONT_SIZE_VALUE.test(value)) return varNames(value).map((token) => ({ token, setTo: FONT_SIZE_VALUE, atSize: false }));
+  const font = name === "font" ? FONT_VALUE.exec(value)?.groups : undefined;
+  if (font?.size === undefined) return [];
+  const atSize = varNames(fontSizePosition(font));
+  return [
+    ...varNames(font.size).map((token) => ({ token, setTo: FONT_SIZE_VALUE, atSize: false })),
+    ...varNames(font.families ?? "").map((token) => ({ token, setTo: FONT_FAMILY_VALUE, atSize: atSize.includes(token) })),
+  ];
+}
+
+function literalSize(property: string, value: string): string | undefined {
+  const font = property.toLowerCase() === "font" ? FONT_VALUE.exec(value)?.groups : undefined;
+  return font?.size === undefined ? undefined : namedSize(fontSizePosition(font));
+}
+
+function fromTokens({ token, setTo, atSize }: SizeCarrier, declared: ReadonlyMap<string, readonly string[]>, seen: ReadonlySet<string>): boolean {
+  const values = declared.get(token);
+  if (values === undefined) return true;
+  return values.every((value) => {
+    const position = atSize ? sizePosition(value) : "";
+    return (
+      setTo.test(value) &&
+      namedSize(position) === undefined &&
+      varNames(value).every((alias) => !seen.has(alias) && fromTokens({ token: alias, setTo, atSize: varNames(position).includes(alias) }, declared, new Set([...seen, alias])))
+    );
+  });
+}
+
+const declaredByFile = new WeakMap<object, Map<string, string[]>>();
+
+type DeclarationDocument = {
+  walkDecls(filter: RegExp, visit: (decl: { readonly prop: string; readonly value: string }) => void): void;
+};
+
+function fileDeclarations(document: DeclarationDocument): Map<string, string[]> {
+  const cached = declaredByFile.get(document);
+  if (cached !== undefined) return cached;
+  const fresh = new Map<string, string[]>();
+  document.walkDecls(/^--/, ({ prop, value }) => {
+    fresh.set(prop, [...(fresh.get(prop) ?? []), value]);
+  });
+  declaredByFile.set(document, fresh);
+  return fresh;
+}
+
+// postcss-html hands the rule one root per style block or attribute, so the file's declarations sit on the result's document.
+const fontSizeFromTokens: RuleBase = () => async (root, result) => {
+  const { utils } = (await import("stylelint")).default;
+  const declared = fileDeclarations(result.root);
+  root.walkDecls((node) => {
+    const literal = literalSize(node.prop, node.value);
+    if (literal !== undefined) {
+      utils.report({ ruleName: FONT_SIZE_RULE, result, node, word: literal, message: `Expected the font size from the token files rather than the literal "${literal}"` });
+    }
+    for (const carrier of sizeCarriers(node.prop, node.value)) {
+      if (fromTokens(carrier, declared, new Set([carrier.token]))) continue;
+      utils.report({ ruleName: FONT_SIZE_RULE, result, node, word: carrier.token, message: `Expected "${carrier.token}" from the token files rather than set in this file` });
+    }
+  });
+};
+
+const FONT_SIZE_PLUGIN = {
+  ruleName: FONT_SIZE_RULE,
+  rule: Object.assign(fontSizeFromTokens, { ruleName: FONT_SIZE_RULE, messages: {} }),
+} satisfies Plugin;
+
 const DESIGN_TOKENS = {
   "color-no-hex": true,
   "color-named": "never",
   "function-disallowed-list": COLOUR_FUNCTIONS.map((name) => `/^${name}$/i`),
-  "declaration-property-value-allowed-list": { "/^font-size$/i": ["/^var\\(\\s*--[^\\s,()]+\\s*\\)$/i", "/^inherit$/i"] },
+  "declaration-property-value-allowed-list": {
+    "/^font-size$/i": [String(FONT_SIZE_VALUE), "/^inherit$/i"],
+    "/^font$/i": [String(FONT_VALUE), "/^inherit$/i"],
+  },
+  [FONT_SIZE_RULE]: true,
 } as const satisfies Rules;
 
 const REFUSED_BASELINE = '@avi2dg/checks/stylelint: set baseline to "widely", "newly" or a year such as 2024';
@@ -154,7 +286,7 @@ export function defineConfig({ baseline, tokens, bem, flatSelectors, noPageHas,
   return {
     ...rest,
     extends: [peer("stylelint-config-standard")],
-    plugins: [peer("stylelint-plugin-use-baseline")],
+    plugins: [peer("stylelint-plugin-use-baseline"), FONT_SIZE_PLUGIN],
     rules: { ...merged, [BASELINE_RULE]: passProperty(merged[BASELINE_RULE]) },
     overrides: [
       { files: [...MARKUP], customSyntax: peer("postcss-html") },

package/src/testing/flake.ts

@@ -3,7 +3,7 @@ import { Config, Console, Effect, FileSystem, Option, Path, Random, Schema } fro
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { runMain, Usage } from "../core/main.ts";
 import { NAME_SEPARATOR, parseReport, ReportError, reporterArgs, type TestResult } from "./test-report.ts";
-import { scriptOptions } from "./test.ts";
+import { scriptOptions, workerCount } from "./test.ts";
 
 export type Run = {
   readonly seed: number;
@@ -90,7 +90,8 @@ const workersOf = Effect.fn("workersOf")(function* (root: string) {
     Effect.flatMap(decodeManifest),
     Effect.mapError((cause) => new ManifestError({ message: `cannot read ${file}: ${cause.message}` })),
   );
-  return scriptOptions(scripts?.["test"])?.workers;
+  const options = scriptOptions(scripts?.["test"]);
+  return options === undefined ? undefined : workerCount(options.workers);
 });
 
 const assignmentOf = Effect.fn("assignmentOf")(function* (log: string) {

package/src/testing/mutation-scope.ts

@@ -196,7 +196,8 @@ export function preloadChange(
   return [...preloads.atBase, ...loaded].find((path) => changed.has(path));
 }
 
-// Stryker leaves coveredBy empty on a static mutant, so only killedBy names its tests, and all of them only from a run without bail.
+// Stryker leaves coveredBy empty on a static mutant, so only killedBy names its tests.
+// A kill is lost only when every test that made it changed, so the one killer a run with bail records is enough.
 export function coveringTests(baseline: Baseline, tests: ReadonlySet<string>, mutated: (file: string) => boolean): Map<string, readonly string[]> {
   const owners = new Map(Object.entries(baseline.testFiles).flatMap(([file, { tests: listed }]) => listed.map(({ id }) => [id, file] as const)));
   const covering = new Map<string, readonly string[]>();

package/src/testing/night-run.ts

@@ -175,24 +175,26 @@ const decodeRecord = Schema.decodeUnknownEffect(Schema.fromJsonString(NightRecor
 
 const unreadable = (source: string) => (cause: { readonly message: string }) => new NightRunFailure({ message: `cannot read ${source}: ${cause.message}` });
 
-// Only the newest successful run on main counts, so a branch dispatch never becomes the night a later run compares with.
+// A skipped night records no artifact, so the newest successful run can carry no baseline.
 const previousNight = Effect.fn("previousNight")(
   function* ({ runs, workflow }: Actions) {
-    const listed = ["run", "list", "--workflow", workflow, "--branch", DEFAULT_BRANCH, "--status", "success", "--limit", "1", "--json", "databaseId,event,createdAt"];
-    const [newest] = yield* gh(listed).pipe(Effect.flatMap(decodeRuns), Effect.mapError(unreadable(`the runs of ${workflow}`)));
-    if (newest === undefined) return Option.none<PreviousNight>();
-    const run = newest.databaseId;
-    const { artifacts } = yield* gh(["api", `${REPOSITORY}/actions/runs/${run}/artifacts?name=${ARTIFACT}`]).pipe(
-      Effect.flatMap(decodeArtifacts),
-      Effect.mapError(unreadable(`the artifacts of run ${run}`)),
-    );
-    if (!artifacts.some((artifact) => artifact.name === ARTIFACT && !artifact.expired)) return Option.none<PreviousNight>();
-    const fs = yield* FileSystem.FileSystem;
-    const dir = yield* fs.makeTempDirectoryScoped({ prefix: "checks-night-run-" });
-    yield* gh(["run", "download", String(run), "--name", ARTIFACT, "--dir", dir]);
-    const file = (yield* Path.Path).join(dir, RECORD_NAME);
-    const record = yield* fs.readFileString(file).pipe(Effect.flatMap(decodeRecord), Effect.mapError(unreadable(`the ${ARTIFACT} artifact of run ${run}`)));
-    return Option.some<PreviousNight>({ url: `${runs}/${run}`, record });
+    const listed = ["run", "list", "--workflow", workflow, "--branch", DEFAULT_BRANCH, "--status", "success", "--limit", "30", "--json", "databaseId,event,createdAt"];
+    const candidates = yield* gh(listed).pipe(Effect.flatMap(decodeRuns), Effect.mapError(unreadable(`the runs of ${workflow}`)));
+    for (const candidate of candidates) {
+      const run = candidate.databaseId;
+      const { artifacts } = yield* gh(["api", `${REPOSITORY}/actions/runs/${run}/artifacts?name=${ARTIFACT}`]).pipe(
+        Effect.flatMap(decodeArtifacts),
+        Effect.mapError(unreadable(`the artifacts of run ${run}`)),
+      );
+      if (!artifacts.some((artifact) => artifact.name === ARTIFACT && !artifact.expired)) continue;
+      const fs = yield* FileSystem.FileSystem;
+      const dir = yield* fs.makeTempDirectoryScoped({ prefix: "checks-night-run-" });
+      yield* gh(["run", "download", String(run), "--name", ARTIFACT, "--dir", dir]);
+      const file = (yield* Path.Path).join(dir, RECORD_NAME);
+      const record = yield* fs.readFileString(file).pipe(Effect.flatMap(decodeRecord), Effect.mapError(unreadable(`the ${ARTIFACT} artifact of run ${run}`)));
+      return Option.some<PreviousNight>({ url: `${runs}/${run}`, record });
+    }
+    return Option.none<PreviousNight>();
   },
   Effect.scoped,
 );

package/src/testing/test-report.ts

@@ -42,6 +42,7 @@ const decodeCase = Schema.decodeUnknownEffect(
   Schema.Struct({ name: Schema.String, file: Schema.String, line: Schema.NumberFromString.check(Schema.isInt()) }),
 );
 const decodeCrash = Schema.decodeUnknownEffect(Schema.Struct({ file: Schema.String }));
+const decodeTimed = Schema.decodeUnknownEffect(Schema.Struct({ file: Schema.String, time: Schema.FiniteFromString }));
 
 function unescape(text: string): string {
   return text.replace(ENTITY, (_, named: string | undefined, decimal: string | undefined, hex: string | undefined) => {
@@ -133,3 +134,17 @@ export const parseReport = Effect.fn("parseReport")(function* (xml: string) {
   }
   return { results, crashedFiles } satisfies Report;
 });
+
+// Bun names a file's top-level <testsuite> by its path with no leading ./ whatever spelling ran it, and times the whole file there.
+export const fileSeconds = Effect.fn("fileSeconds")(function* (xml: string) {
+  const root = yield* parseElements(xml);
+  const seconds = new Map<string, number>();
+  for (const fileSuite of root.children) {
+    if (fileSuite.tag !== "testsuite") continue;
+    const { file, time } = yield* decodeTimed(fileSuite.attributes).pipe(
+      Effect.mapError((cause) => new ReportError({ message: `the junit report holds a <testsuite> with no file or time: ${cause.message}` })),
+    );
+    seconds.set(file, time);
+  }
+  return seconds;
+});

package/src/testing/test.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { availableParallelism } from "node:os";
 import { Config, Console, Effect, FileSystem, Option, Path, Schema } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { TEST_ENTRY_POINT } from "../core/gates.ts";
@@ -164,10 +165,13 @@ function tierArgs(tier: TestTier | undefined): readonly string[] {
   return [`./tests/${tier}`];
 }
 
+export function workerCount(workers: number | undefined): number {
+  return workers ?? availableParallelism();
+}
+
 const runSuite = Effect.fn("runSuite")(function* (outfile: string, { tier, workers }: TestOptions) {
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-  const parallelArgs = workers === undefined ? [] : [`--parallel=${workers}`];
-  const args = ["test", "--randomize", ...parallelArgs, ...tierArgs(tier), ...reporterArgs(outfile)];
+  const args = ["test", "--randomize", `--parallel=${workerCount(workers)}`, ...tierArgs(tier), ...reporterArgs(outfile)];
   return yield* spawner.exitCode(
     ChildProcess.make(process.execPath, args, {
       stdin: "ignore",

package/stryker.preset.js

@@ -3,6 +3,7 @@ import { availableParallelism } from "node:os";
 import { fileURLToPath } from "node:url";
 import { GUARD_IGNORER } from "./dist/mutation/mutation-guard-plugin.js";
 import { fullRunRefusal } from "./dist/mutation/mutation-refusal.js";
+import { ordersTests, runOrder } from "./dist/mutation/unit-test-order.js";
 
 const [, , command, ...args] = process.argv;
 const refusal = command === "run" ? fullRunRefusal(args, process.env.CI ?? "") : undefined;
@@ -11,12 +12,16 @@ if (refusal !== undefined) throw new Error(refusal);
 export const halfAvailableCores = (cores = availableParallelism()) => Math.max(1, Math.floor(cores / 2));
 
 // The bun runner narrows a mutant's run to its covering files only when each listed path equals a test id's file part, which carries no leading ./.
-export const unitTestFiles = () =>
+const listedUnitTests = () =>
   readdirSync("tests/unit", { recursive: true, encoding: "utf8" })
     .filter((name) => name.endsWith(".test.ts") || name.endsWith(".test.tsx"))
     .map((name) => `tests/unit/${name}`)
     .toSorted();
 
+const timedUnitTests = ordersTests(command, args) ? await runOrder(listedUnitTests()) : undefined;
+
+export const unitTestFiles = () => timedUnitTests ?? listedUnitTests();
+
 export default {
   packageManager: "npm",
   plugins: [