@avi2dg/checks 0.48.1 → 0.49.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.49.0
+
+Released 2026-10-20.
+
+### Features
+
+- **testing:** build the full mutation baseline with bail, fastest unit tests first [#190](https://github.com/avi2d/checks/pull/190)
+
+### Fixes
+
+- **delivery:** name the parsed invocation's line in CI wiring refusals [#189](https://github.com/avi2d/checks/pull/189)
+- **quality:** refuse named font sizes in font shorthand and build token map once per file [#188](https://github.com/avi2d/checks/pull/188)
+- **delivery:** judge shell-shaped release references in checks-ci-wiring [#186](https://github.com/avi2d/checks/pull/186)
+
 ## 0.48.1
 
 Released 2026-10-20.

package/README.md

@@ -25,6 +25,7 @@ Each repository owns its workflows and native tool configs, as [Native settings]
   - `html-validate` 11.16.0
   - `playwright-core` 1.63.0
   - `postcss-html` 2.0.0
+  - `postcss-value-parser` 4.2.0
   - `stylelint` 17.16.0
   - `stylelint-config-standard` 40.0.0
   - `stylelint-plugin-use-baseline` 1.4.7

package/dist/mutation/unit-test-order.js

@@ -0,0 +1,159 @@
+// src/testing/unit-test-order.ts
+import { NodeChildProcessSpawner, NodeFileSystem, NodePath } from "@effect/platform-node-shared";
+import { Console, Effect as Effect2, FileSystem, Layer, Path, Schema as Schema2 } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+
+// src/testing/test-report.ts
+import { Effect, Schema } from "effect";
+
+class ReportError extends Schema.TaggedError()("ReportError", {
+  message: Schema.String
+}) {
+}
+var NAME_SEPARATOR = " > ";
+function reporterArgs(outfile) {
+  return ["--reporter=junit", `--reporter-outfile=${outfile}`];
+}
+var MARKUP = /<(?:\?[\s\S]*?\?>|!--[\s\S]*?-->|!\[CDATA\[[\s\S]*?\]\]>|(\/?)([A-Za-z_][\w.:-]*)((?:\s+[A-Za-z_][\w.:-]*\s*=\s*"[^"<]*")*)\s*(\/?)>)/g;
+var ATTRIBUTE = /([A-Za-z_][\w.:-]*)\s*=\s*"([^"<]*)"/g;
+var ENTITY = /&(?:(amp|lt|gt|quot|apos)|#(\d+)|#x([0-9A-Fa-f]+));/g;
+var NAMED_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
+var decodeSuite = Schema.decodeUnknownEffect(Schema.Struct({ name: Schema.String }));
+var decodeCase = Schema.decodeUnknownEffect(Schema.Struct({ name: Schema.String, file: Schema.String, line: Schema.NumberFromString.check(Schema.isInt()) }));
+var decodeCrash = Schema.decodeUnknownEffect(Schema.Struct({ file: Schema.String }));
+var decodeTimed = Schema.decodeUnknownEffect(Schema.Struct({ file: Schema.String, time: Schema.FiniteFromString }));
+function unescape(text) {
+  return text.replace(ENTITY, (_, named, decimal, hex) => {
+    if (named !== undefined)
+      return NAMED_ENTITIES[named] ?? "";
+    return String.fromCodePoint(decimal === undefined ? Number.parseInt(hex ?? "", 16) : Number.parseInt(decimal, 10));
+  });
+}
+function attributesOf(source) {
+  const attributes = {};
+  for (const [, name, value] of source.matchAll(ATTRIBUTE)) {
+    if (name !== undefined && value !== undefined)
+      attributes[name] = unescape(value);
+  }
+  return attributes;
+}
+var malformed = (reason) => new ReportError({ message: `the junit report is malformed: ${reason}` });
+var takeTag = Effect.fnUntraced(function* (open, match) {
+  const [, closing, tag, attributes, selfClosing] = match;
+  if (tag === undefined)
+    return;
+  const parent = open.at(-1);
+  if (parent === undefined)
+    return yield* malformed(`<${tag}> after the root closed`);
+  if (closing === "/") {
+    if (parent.tag !== tag)
+      return yield* malformed(`</${tag}> closes <${parent.tag}>`);
+    open.pop();
+    return;
+  }
+  const element = { tag, attributes: attributesOf(attributes ?? ""), children: [] };
+  parent.children.push(element);
+  if (selfClosing !== "/")
+    open.push(element);
+});
+var parseElements = Effect.fnUntraced(function* (xml) {
+  const document = { tag: "", attributes: {}, children: [] };
+  const open = [document];
+  let consumed = 0;
+  for (const match of xml.matchAll(MARKUP)) {
+    if (xml.slice(consumed, match.index).includes("<"))
+      return yield* malformed(`stray < before offset ${match.index}`);
+    consumed = match.index + match[0].length;
+    yield* takeTag(open, match);
+  }
+  if (xml.slice(consumed).includes("<"))
+    return yield* malformed("stray < after the last element");
+  if (open.length !== 1)
+    return yield* malformed(`<${open.at(-1)?.tag}> never closes`);
+  const [root, ...extra] = document.children;
+  if (root?.tag !== "testsuites" || extra.length > 0)
+    return yield* malformed("the root is not one <testsuites>");
+  return root;
+});
+function outcomeOf(testcase) {
+  const skipped = testcase.children.find((child) => child.tag === "skipped");
+  if (skipped !== undefined)
+    return skipped.attributes["message"] === "TODO" ? "todo" : "skipped";
+  return testcase.children.some((child) => child.tag === "failure" || child.tag === "error") ? "failed" : "passed";
+}
+function crashed(testcase) {
+  return testcase.attributes["line"] === undefined && outcomeOf(testcase) === "failed";
+}
+var collect = Effect.fnUntraced(function* (suite, describes, report) {
+  const unreadable = (tag) => (cause) => new ReportError({ message: `the junit report holds a <${tag}> bun never writes: ${cause.message}` });
+  for (const child of suite.children) {
+    if (child.tag === "testsuite") {
+      const { name } = yield* decodeSuite(child.attributes).pipe(Effect.mapError(unreadable(child.tag)));
+      yield* collect(child, [...describes, name], report);
+    } else if (child.tag === "testcase" && crashed(child)) {
+      const { file } = yield* decodeCrash(child.attributes).pipe(Effect.mapError(unreadable(child.tag)));
+      report.crashedFiles.push(file);
+    } else if (child.tag === "testcase") {
+      const { name, file, line } = yield* decodeCase(child.attributes).pipe(Effect.mapError(unreadable(child.tag)));
+      report.results.push({ file, name: [...describes, name].join(NAME_SEPARATOR), line, outcome: outcomeOf(child) });
+    }
+  }
+});
+var parseReport = Effect.fn("parseReport")(function* (xml) {
+  const root = yield* parseElements(xml);
+  const results = [];
+  const crashedFiles = [];
+  for (const fileSuite of root.children) {
+    if (fileSuite.tag === "testsuite")
+      yield* collect(fileSuite, [], { results, crashedFiles });
+  }
+  return { results, crashedFiles };
+});
+var fileSeconds = Effect.fn("fileSeconds")(function* (xml) {
+  const root = yield* parseElements(xml);
+  const seconds = new Map;
+  for (const fileSuite of root.children) {
+    if (fileSuite.tag !== "testsuite")
+      continue;
+    const { file, time } = yield* decodeTimed(fileSuite.attributes).pipe(Effect.mapError((cause) => new ReportError({ message: `the junit report holds a <testsuite> with no file or time: ${cause.message}` })));
+    seconds.set(file, time);
+  }
+  return seconds;
+});
+
+// src/testing/unit-test-order.ts
+class OrderError extends Schema2.TaggedError()("OrderError", {
+  message: Schema2.String
+}) {
+}
+var NON_RUNS = ["--help", "-h", "--version"];
+function ordersTests(command, args) {
+  return command === "run" && !args.some((arg) => NON_RUNS.includes(arg) || arg === "--ignoreStatic");
+}
+function fastestFirst(seconds) {
+  return [...seconds].toSorted(([file, time], [other, otherTime]) => time - otherTime || file.localeCompare(other)).map(([file]) => file);
+}
+function inRunOrder(listed, timed) {
+  const known = new Set(listed);
+  const first = new Set(timed.filter((file) => known.has(file)));
+  const rest = listed.filter((file) => !first.has(file));
+  return [...[...first, ...rest].map((file) => `./${file}`), ...listed];
+}
+var timedFiles = Effect2.fn("timedFiles")(function* (listed) {
+  const fs = yield* FileSystem.FileSystem;
+  const outfile = (yield* Path.Path).join(yield* fs.makeTempDirectoryScoped({ prefix: "checks-test-order-" }), "junit.xml");
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const args = ["test", ...listed.map((file) => `./${file}`), ...reporterArgs(outfile)];
+  const exitCode = yield* spawner.exitCode(ChildProcess.make("bun", args, { stdin: "ignore", stdout: "ignore", stderr: "ignore" }));
+  if (exitCode !== ChildProcessSpawner.ExitCode(0))
+    return yield* new OrderError({ message: `bun test exited ${exitCode} while timing the unit tests` });
+  return fastestFirst(yield* fileSeconds(yield* fs.readFileString(outfile)));
+}, Effect2.scoped);
+var NodeServices = NodeChildProcessSpawner.layer.pipe(Layer.provideMerge(Layer.mergeAll(NodeFileSystem.layer, NodePath.layer)));
+var runOrder = (listed) => Effect2.runPromise(timedFiles(listed).pipe(Effect2.map((timed) => inRunOrder(listed, timed)), Effect2.catch((failure) => Console.error(`checks: ${failure.message}, so each static mutant runs the unit tests in path order`).pipe(Effect2.as(listed))), Effect2.provide(NodeServices)));
+export {
+  fastestFirst,
+  inRunOrder,
+  ordersTests,
+  runOrder
+};

package/dist/presets/stylelint.js

@@ -1,5 +1,6 @@
 // src/quality/presets/stylelint.ts
 import { fileURLToPath } from "node:url";
+import valueParser from "postcss-value-parser";
 var HTML_AND_ASTRO = ["**/*.html", "**/*.astro"];
 var MARKUP = [...HTML_AND_ASTRO, "**/*.vue", "**/*.svelte"];
 function peer(name) {
@@ -56,36 +57,81 @@ var FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH = "(?:normal|italic|oblique(?:\\s+-?[\\d.
 var FONT_FAMILY = `(?:"[^"]*"|'[^']*'|${VAR}|-?[a-z_][\\w-]*(?:\\s+-?[a-z_][\\w-]*)*)`;
 var FONT_FAMILIES = `${FONT_FAMILY}(?:\\s*,\\s*${FONT_FAMILY})*`;
 var FONT_FAMILY_VALUE = new RegExp(`^${FONT_FAMILIES}$`, "i");
-var FONT_VALUE = new RegExp(`^(?:${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}\\s+)*(?<size>${VAR})(?:\\s*\\/\\s*(?:${VAR}|[\\w.%-]+))?(?:\\s+(?<families>${FONT_FAMILIES}))?$`, "i");
+var NAMED_FONT_SIZES = new Set([
+  "xx-small",
+  "x-small",
+  "small",
+  "medium",
+  "large",
+  "x-large",
+  "xx-large",
+  "xxx-large",
+  "larger",
+  "smaller",
+  "math"
+]);
+var SIZE_PRECEDER = new RegExp(`^${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}$`, "i");
+var FONT_VALUE = new RegExp(`^(?:${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}\\s+)*(?<size>${VAR})(?<lineHeight>\\s*\\/\\s*(?:${VAR}|[\\w.%-]+))?(?:\\s+(?<families>${FONT_FAMILIES}))?$`, "i");
 var FONT_SIZE_RULE = "checks/font-size-from-tokens";
 function varNames(value) {
   return [...value.matchAll(VAR_NAMES)].map(([, name]) => name).filter((name) => name !== undefined);
 }
+function sizePosition(families) {
+  const position = valueParser(families).nodes.find(({ type, value }) => type !== "space" && !(type === "word" && SIZE_PRECEDER.test(value)));
+  return position === undefined ? "" : valueParser.stringify(position);
+}
+function fontSizePosition(font) {
+  return font.lineHeight === undefined ? sizePosition(font.families ?? "") : "";
+}
+function namedSize(position) {
+  return NAMED_FONT_SIZES.has(position.toLowerCase()) ? position : undefined;
+}
 function sizeCarriers(property, value) {
   const name = property.toLowerCase();
   if (name === "font-size" && FONT_SIZE_VALUE.test(value))
-    return varNames(value).map((token) => ({ token, setTo: FONT_SIZE_VALUE }));
+    return varNames(value).map((token) => ({ token, setTo: FONT_SIZE_VALUE, atSize: false }));
   const font = name === "font" ? FONT_VALUE.exec(value)?.groups : undefined;
   if (font?.size === undefined)
     return [];
+  const atSize = varNames(fontSizePosition(font));
   return [
-    ...varNames(font.size).map((token) => ({ token, setTo: FONT_SIZE_VALUE })),
-    ...varNames(font.families ?? "").map((token) => ({ token, setTo: FONT_FAMILY_VALUE }))
+    ...varNames(font.size).map((token) => ({ token, setTo: FONT_SIZE_VALUE, atSize: false })),
+    ...varNames(font.families ?? "").map((token) => ({ token, setTo: FONT_FAMILY_VALUE, atSize: atSize.includes(token) }))
   ];
 }
-function fromTokens({ token, setTo }, declared, seen) {
+function literalSize(property, value) {
+  const font = property.toLowerCase() === "font" ? FONT_VALUE.exec(value)?.groups : undefined;
+  return font?.size === undefined ? undefined : namedSize(fontSizePosition(font));
+}
+function fromTokens({ token, setTo, atSize }, declared, seen) {
   const values = declared.get(token);
   if (values === undefined)
     return true;
-  return values.every((value) => setTo.test(value) && varNames(value).every((alias) => !seen.has(alias) && fromTokens({ token: alias, setTo }, declared, new Set([...seen, alias]))));
+  return values.every((value) => {
+    const position = atSize ? sizePosition(value) : "";
+    return setTo.test(value) && namedSize(position) === undefined && varNames(value).every((alias) => !seen.has(alias) && fromTokens({ token: alias, setTo, atSize: varNames(position).includes(alias) }, declared, new Set([...seen, alias])));
+  });
+}
+var declaredByFile = new WeakMap;
+function fileDeclarations(document) {
+  const cached = declaredByFile.get(document);
+  if (cached !== undefined)
+    return cached;
+  const fresh = new Map;
+  document.walkDecls(/^--/, ({ prop, value }) => {
+    fresh.set(prop, [...fresh.get(prop) ?? [], value]);
+  });
+  declaredByFile.set(document, fresh);
+  return fresh;
 }
 var fontSizeFromTokens = () => async (root, result) => {
   const { utils } = (await import("stylelint")).default;
-  const declared = new Map;
-  result.root.walkDecls(/^--/, ({ prop, value }) => {
-    declared.set(prop, [...declared.get(prop) ?? [], value]);
-  });
+  const declared = fileDeclarations(result.root);
   root.walkDecls((node) => {
+    const literal = literalSize(node.prop, node.value);
+    if (literal !== undefined) {
+      utils.report({ ruleName: FONT_SIZE_RULE, result, node, word: literal, message: `Expected the font size from the token files rather than the literal "${literal}"` });
+    }
     for (const carrier of sizeCarriers(node.prop, node.value)) {
       if (fromTokens(carrier, declared, new Set([carrier.token])))
         continue;

package/docs/design.md

@@ -113,7 +113,8 @@ The `.ts` bins keep a `bun` shebang and need no build step, unlike the oxlint pl
 
 The bins are written in Effect.
 So `effect` is a peer dependency, and `@effect/platform-bun`, which only the bins use, is a dependency.
-`@effect/platform-node-shared` is a direct dependency only to pin its version.
+The Stryker test order helper runs under Node, so it takes its services from `@effect/platform-node-shared`, which is a direct dependency.
+That dependency also pins its version.
 `@effect/platform-bun` asks for it with a `^` range, so a newer minor of it could resolve and peer on a newer `effect` than the exact version consumers install.
 So the three packages move together at one exact version.
 

package/docs/gates/checks-ci-wiring.md

@@ -24,7 +24,9 @@ It also refuses a workflow that does not trigger on both `opened` and `synchroni
 A path filter cannot cover every pull request and therefore cannot satisfy the check.
 It refuses a reference to a workflow or job the repository does not hold.
 Each literal `checks-release-pr` and `checks-release-tag` argument names a workflow file, so every one must match a file under `.github/workflows/`.
+A call counts directly, through `bunx`, or through `bun` or `bun run` with the bin's path or its source file.
 An argument built from a variable or an expression is known only when the job runs, so the check passes over it.
+An argument built by command substitution is known only when the job runs, so the check passes over it.
 Each `on.workflow_run.workflows` entry names a workflow by its `name`, so every one must match a name in the repository.
 A workflow without a `name` answers to its path from the repository root.
 A local reusable `uses` must name a file under `.github/workflows/` that the repository holds.

package/docs/gates/checks-frontend-syntax.md

@@ -37,7 +37,7 @@ A control that needs selection off sets it on its own selector, such as `.drag-h
 | G1 correctness | `stylelint-config-recommended`, the stylelint team's rules for likely mistakes, such as `font-variant-numeric: oldstyle-num` for `oldstyle-nums` | on |
 | G2 conventions | `stylelint-config-standard`, which extends G1 with the stylelint team's notation and spacing rules | on |
 | G3 selector complexity | `selector-max-specificity` at `0,3,2` and `selector-max-compound-selectors` at 3 | on |
-| G4 design tokens | `color-no-hex`, `color-named: "never"`, `function-disallowed-list` over `rgb`, `rgba`, `hsl`, `hsla`, `hwb`, `lab`, `lch`, `oklab`, `oklch` and `color`, `font-size` only as one `var(--…)` with no fallback, or `inherit`, `font` only as `inherit`, or as such a `var(--…)` for its size after any literal style, variant, weight or width, and before an optional line height and a family list of names, strings and `var(--…)`s, and `checks/font-size-from-tokens`, which refuses a `var(--…)` for a size or a family naming a custom property that any style block or attribute of the same file sets, unless the file sets it only to another such `var(--…)`, or for a family to a family list | off until `tokens` names the token files, and off in those files |
+| G4 design tokens | `color-no-hex`, `color-named: "never"`, `function-disallowed-list` over `rgb`, `rgba`, `hsl`, `hsla`, `hwb`, `lab`, `lch`, `oklab`, `oklch` and `color`, `font-size` only as one `var(--…)` with no fallback, or `inherit`, `font` only as `inherit`, or as such a `var(--…)` for its size after any literal style, variant, weight or width, and before an optional line height and a family list of names, strings and `var(--…)`s, and `checks/font-size-from-tokens`, which refuses a `var(--…)` for a size or a family naming a custom property that any style block or attribute of the same file sets, unless the file sets it only to another such `var(--…)`, or for a family to a family list, and refuses a named size such as `small` or `math` at the one place the size can still stand, the first family word after any style, variant, weight or width while no line height fixes the `var(--…)` as the size, written there or set there by such a property | off until `tokens` names the token files, and off in those files |
 | G5 Baseline target | `plugin/use-baseline` from `stylelint-plugin-use-baseline`, which judges each property, value, function, at-rule, selector and unit against the Baseline data, and passes a property inside an `@supports` block. It passes `@property` at every target, since a browser without `@property` treats the declaration as an unregistered custom property | on, at the target `baseline` sets |
 | G6 comments refused | `comment-word-disallowed-list` over `/^[\s\S]*$/`, which refuses every comment, including an empty `/* */` | on |
 | G7 language-free selectors | `selector-disallowed-list` over `/[^\x00-\x7F]/`, which refuses any selector holding a non-ASCII character, in attribute values, class names and ids alike | on |
@@ -134,7 +134,7 @@ A config not built with `defineConfig` names its own `customSyntax` for markup,
 The repository installs the optional peers the gate loads, at the versions the kit pins:
 
 ```sh
-bun add -d stylelint@17.16.0 postcss-html@2.0.0 stylelint-config-standard@40.0.0 stylelint-plugin-use-baseline@1.4.7
+bun add -d stylelint@17.16.0 postcss-html@2.0.0 stylelint-config-standard@40.0.0 stylelint-plugin-use-baseline@1.4.7 postcss-value-parser@4.2.0
 ```
 
 ## Arguments

package/docs/gates/checks-mutation-scope.md

@@ -53,7 +53,11 @@ So a helper, fixture or preload changed on `main` since that baseline can hide a
 - The full baseline report that `checks-mutation-baseline --full` restores, for each mutant's `coveredBy` and `killedBy` and the `testFiles` that own those tests.
 
 Stryker leaves `coveredBy` empty on a static mutant, so only `killedBy` names its tests.
-The report must come from a run that restored no state and passed `--disableBail`, which lists every killing test.
+The report must come from a run that restored no state, so each mutant's tests are the ones it ran against.
+With bail, Stryker's default, `killedBy` names the one test that killed the mutant first.
+One killer is enough, since a branch loses a kill through its tests only when it changes every test that made the kill.
+A test left alone, whose sources the branch also leaves alone, still kills the mutant at `HEAD`.
+So whichever killer the report names is a changed test, and a deleted test counts as changed.
 
 ## Arguments
 

package/docs/gates/checks-mutation.md

@@ -25,7 +25,12 @@ The preset also registers an ignore plugin that checks the incremental report on
 A config that replaces `plugins` or `ignorers` must keep the preset's entries, or that check does not run.
 The preset also exports `unitTestFiles`, which lists every `.test.ts` and `.test.tsx` file under `tests/unit` at config load.
 A repository sets `bun.testFiles` to its result, so a covered, non-static mutant loads only the test files that cover it.
-A static mutant has no per-test coverage, so it still loads every listed file.
+A static mutant has no per-test coverage, so it still loads every listed file, and with bail it stops at the first test that fails.
+So when a `stryker run` without `--ignoreStatic` loads the preset, the preset first runs the listed files once with `bun test` and times each file.
+`unitTestFiles` then lists each file with a leading `./`, fastest first, and Bun runs such paths in the order given.
+It then lists each path again without the `./`, the spelling the runner matches a covering test against.
+Bun loads a file once however often the list names it.
+When that timing run fails, the preset prints why on stderr and `unitTestFiles` keeps the path order.
 The config then reads:
 
 ```js
@@ -96,7 +101,7 @@ jobs:
         with:
           bun-version-file: .bun-version
       - run: bun install --frozen-lockfile
-      - run: bunx stryker run --disableBail
+      - run: bunx stryker run
       - run: bunx checks-mutation-baseline --slim reports/mutation/mutation.json "$RUNNER_TEMP/full/mutation.json"
       - uses: actions/upload-artifact@v4
         with:
@@ -105,7 +110,8 @@ jobs:
           retention-days: 30
 ```
 
-The run restores no state and passes `--disableBail`, so its report names every test that covers or kills each mutant.
+The run restores no state, so its report names every test that covers each covered mutant and the first test that killed each killed mutant.
+[checks-mutation-scope](checks-mutation-scope.md#what-it-reads) says why that one killer is enough.
 The upload is the `mutation-baseline-full` artifact that a branch comparison's scope step restores with `checks-mutation-baseline --full`.
 [checks-mutation-scope](checks-mutation-scope.md) reads it to bring in the sources a changed unit test covers or kills.
 The restore reads only a successful run of `mutation.yml` on `main`, so a sweep that fails publishes nothing a scope step reads.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.48.1",
+  "version": "0.49.0",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "license": "MIT",
   "repository": {
@@ -180,7 +180,7 @@
   },
   "scripts": {
     "prepare": "bun src/dependencies/vendor.ts --library effect --package effect --repository https://github.com/Effect-TS/effect.git --tag 'effect@{version}' --path packages/effect/package.json",
-    "build": "bun build src/quality/effect-channel/index.ts --outdir dist/effect-channel --target node --format esm && bun build src/complexity/readability/index.ts --outdir dist/readability --target node --format esm && bun build src/quality/data-shape/index.ts --outdir dist/data-shape --target node --format esm && bun build src/testing/mutation-guard-plugin.ts src/testing/mutation-refusal.ts --outdir dist/mutation --target node --format esm && bun build src/quality/presets/oxlint.ts src/quality/presets/knip.ts src/quality/presets/dependency-cruiser.ts src/quality/presets/stylelint.ts --outdir dist/presets --target node --format esm --packages external && tsc -p tsconfig.presets.json && bun scripts/configs-write.ts && bun src/quality/effect-scope.ts && bun scripts/doc-templates-write.ts && bun src/delivery/changelog-write.ts && bun scripts/doc-blocks-write.ts",
+    "build": "bun build src/quality/effect-channel/index.ts --outdir dist/effect-channel --target node --format esm && bun build src/complexity/readability/index.ts --outdir dist/readability --target node --format esm && bun build src/quality/data-shape/index.ts --outdir dist/data-shape --target node --format esm && bun build src/testing/mutation-guard-plugin.ts src/testing/mutation-refusal.ts src/testing/unit-test-order.ts --outdir dist/mutation --target node --format esm --packages external && bun build src/quality/presets/oxlint.ts src/quality/presets/knip.ts src/quality/presets/dependency-cruiser.ts src/quality/presets/stylelint.ts --outdir dist/presets --target node --format esm --packages external && tsc -p tsconfig.presets.json && bun scripts/configs-write.ts && bun src/quality/effect-scope.ts && bun scripts/doc-templates-write.ts && bun src/delivery/changelog-write.ts && bun scripts/doc-blocks-write.ts",
     "lint": "oxlint && bun src/core/lint.ts",
     "typecheck": "tsc --noEmit && effect-tsgo diagnostics --project tsconfig.json --format text --strict",
     "test": "bun src/testing/test.ts",
@@ -202,6 +202,7 @@
     "oxlint-tsgolint": "7.0.2002",
     "playwright-core": "1.63.0",
     "postcss-html": "2.0.0",
+    "postcss-value-parser": "4.2.0",
     "stylelint": "17.16.0",
     "stylelint-config-standard": "40.0.0",
     "stylelint-plugin-use-baseline": "1.4.7",
@@ -220,6 +221,9 @@
     "postcss-html": {
       "optional": true
     },
+    "postcss-value-parser": {
+      "optional": true
+    },
     "stylelint": {
       "optional": true
     },
@@ -247,6 +251,7 @@
     "oxlint-tsgolint": "7.0.2002",
     "playwright-core": "1.63.0",
     "postcss-html": "2.0.0",
+    "postcss-value-parser": "4.2.0",
     "stylelint": "17.16.0",
     "stylelint-config-standard": "40.0.0",
     "stylelint-plugin-use-baseline": "1.4.7",

package/src/delivery/shell-command.ts

@@ -64,7 +64,9 @@ export function plainCommand(script: string): Command | undefined {
   return words.length === 0 ? undefined : words;
 }
 
-type ShellPart = Span & { readonly substitutions: readonly string[] };
+export type Word = { readonly text: string; readonly start: number };
+
+type ShellPart = Span & { readonly substitutions: readonly Word[] };
 
 const COMMAND_BREAKS = new Set(["\n", ";", "&", "|", "(", ")", "`"]);
 const WORD_BREAKS = new Set([" ", "\t"]);
@@ -87,8 +89,11 @@ const LAUNCHER_OPERANDS = new Map<string, ReadonlySet<string>>([
 
 function substitutionEnd(script: string, start: number): number {
   if (script.charAt(start) === "`") {
-    const close = script.indexOf("`", start + 1);
-    return close === -1 ? script.length : close;
+    for (let index = start + 1; index < script.length; index += 1) {
+      if (script.charAt(index) === "\\") index += 1;
+      else if (script.charAt(index) === "`") return index;
+    }
+    return script.length;
   }
   let depth = 0;
   for (let index = start + 1; index < script.length; index += 1) {
@@ -106,12 +111,14 @@ function doubleQuotedPart(script: string, index: number): ShellPart {
   if (char === "\\" && DOUBLE_QUOTE_ESCAPES.has(next)) return { text: next, end: index + 2, substitutions: [] };
   if (char !== "`" && !(char === "$" && next === "(")) return { text: char, end: index + 1, substitutions: [] };
   const end = substitutionEnd(script, index);
-  return { text: "", end: end + 1, substitutions: [script.slice(index + (char === "`" ? 1 : 2), end)] };
+  const start = index + (char === "`" ? 1 : 2);
+  // An unresolved expansion never becomes an empty literal.
+  return { text: "$", end: end + 1, substitutions: [{ text: script.slice(start, end), start }] };
 }
 
 function shellDoubleQuoted(script: string, open: number): ShellPart {
   let text = "";
-  const substitutions: string[] = [];
+  const substitutions: Word[] = [];
   let index = open + 1;
   while (index < script.length && script.charAt(index) !== '"') {
     const part = doubleQuotedPart(script, index);
@@ -142,31 +149,32 @@ function commentEnd(script: string, from: number): number {
 export const SHELLS = ["sh", "bash", "dash", "ksh", "zsh"];
 
 type Heredoc = {
-  readonly consumer: Command;
+  readonly consumer: readonly Word[];
   readonly delimiter: string;
   readonly tabs: boolean;
   readonly literal: boolean;
 };
 
 type ShellParse = {
-  readonly commands: string[][];
-  readonly substitutions: string[];
+  readonly commands: (readonly Word[])[];
+  readonly substitutions: Word[];
   readonly heredocs: Heredoc[];
-  words: string[];
+  words: Word[];
   word: string | undefined;
+  wordStart: number;
   redirecting: boolean;
 };
 
 function endWord(parse: ShellParse): void {
   if (parse.word === undefined) return;
-  if (!parse.redirecting) parse.words.push(parse.word);
+  if (!parse.redirecting) parse.words.push({ text: parse.word, start: parse.wordStart });
   parse.redirecting = false;
   parse.word = undefined;
 }
 
 function endCommand(parse: ShellParse): void {
   endWord(parse);
-  parse.commands.push(parse.words);
+  parse.commands.push(...parse.substitutions.splice(0).flatMap(nested), parse.words);
   parse.words = [];
   parse.redirecting = false;
 }
@@ -206,8 +214,8 @@ function heredocBody(script: string, from: number, { delimiter, tabs }: Heredoc)
   return { text: script.slice(from), end: script.length };
 }
 
-function bodySubstitutions(body: string): readonly string[] {
-  const substitutions: string[] = [];
+function bodySubstitutions(body: string): readonly Word[] {
+  const substitutions: Word[] = [];
   let index = 0;
   while (index < body.length) {
     const part = doubleQuotedPart(body, index);
@@ -221,16 +229,41 @@ function skipHeredocs(parse: ShellParse, script: string, from: number): number {
   let index = from;
   for (const heredoc of parse.heredocs.splice(0)) {
     const body = heredocBody(script, index, heredoc);
-    const [program = ""] = fromProgram(heredoc.consumer);
-    if (SHELLS.includes(program.slice(program.lastIndexOf("/") + 1))) parse.substitutions.push(body.text);
-    else if (!heredoc.literal) parse.substitutions.push(...bodySubstitutions(body.text));
+    const [program = ""] = fromProgram(texts(heredoc.consumer));
+    if (SHELLS.includes(program.slice(program.lastIndexOf("/") + 1))) parse.substitutions.push({ text: body.text, start: index });
+    else if (!heredoc.literal) parse.substitutions.push(...bodySubstitutions(body.text).map(({ text, start }) => ({ text, start: start + index })));
     index = body.end;
   }
   return index;
 }
 
-export function shellCommands(script: string): readonly Command[] {
-  const parse: ShellParse = { commands: [], substitutions: [], heredocs: [], words: [], word: undefined, redirecting: false };
+function extendWord(parse: ShellParse, script: string, index: number): number {
+  const part = shellPart(script, index);
+  if (parse.word === undefined) parse.wordStart = index;
+  parse.word = (parse.word ?? "") + part.text;
+  parse.substitutions.push(...part.substitutions);
+  return part.end;
+}
+
+function extendBacktick(parse: ShellParse, script: string, index: number): number {
+  const end = substitutionEnd(script, index);
+  if (parse.word === undefined) parse.wordStart = index;
+  parse.word = (parse.word ?? "") + "$";
+  parse.substitutions.push({ text: script.slice(index + 1, end), start: index + 1 });
+  return end + 1;
+}
+
+function texts(words: readonly Word[]): Command {
+  return words.map(({ text }) => text);
+}
+
+function nested({ text, start }: Word): readonly (readonly Word[])[] {
+  return shellWords(text).map((words) => words.map((word) => ({ text: word.text, start: word.start + start })));
+}
+
+// Each word starts at its offset in the script.
+export function shellWords(script: string): readonly (readonly Word[])[] {
+  const parse: ShellParse = { commands: [], substitutions: [], heredocs: [], words: [], word: undefined, wordStart: 0, redirecting: false };
   let index = 0;
   while (index < script.length) {
     const char = script.charAt(index);
@@ -240,6 +273,8 @@ export function shellCommands(script: string): readonly Command[] {
       index = commentEnd(script, index);
     } else if (REDIRECTS.has(char)) {
       index = startRedirect(parse, script, index);
+    } else if (char === "`") {
+      index = extendBacktick(parse, script, index);
     } else if (COMMAND_BREAKS.has(char)) {
       endCommand(parse);
       index = char === "\n" ? skipHeredocs(parse, script, index + 1) : index + 1;
@@ -247,14 +282,15 @@ export function shellCommands(script: string): readonly Command[] {
       endWord(parse);
       index += 1;
     } else {
-      const part = shellPart(script, index);
-      parse.word = (parse.word ?? "") + part.text;
-      parse.substitutions.push(...part.substitutions);
-      index = part.end;
+      index = extendWord(parse, script, index);
     }
   }
   endCommand(parse);
-  return [...parse.commands, ...parse.substitutions.flatMap(shellCommands)].filter((command) => command.length > 0);
+  return parse.commands.filter((command) => command.length > 0);
+}
+
+export function shellCommands(script: string): readonly Command[] {
+  return shellWords(script).map(texts);
 }
 
 export function withoutOptions(words: Command, operands: ReadonlySet<string>): Command {

package/src/delivery/workflow-references.ts

@@ -1,4 +1,4 @@
-import { fromProgram, shellCommands, type Command } from "./shell-command.ts";
+import { fromProgram, shellWords, type Command } from "./shell-command.ts";
 
 export type Workflow = {
   readonly path: string;
@@ -28,6 +28,10 @@ export function names(value: unknown): readonly string[] | undefined {
 
 type Key = string | number;
 
+type Target = { readonly name: string; readonly invocation: number };
+
+type Piece = { readonly at: number; readonly text: string };
+
 type Locator = (keys: readonly Key[], needle: string, fallback: string) => string;
 
 // Lines from..to hold the node, and its child keys start at column.
@@ -45,18 +49,25 @@ function isPathTo(word: string, files: readonly string[]): boolean {
 }
 
 function releaseArguments(program: Command): readonly string[] {
-  const [head, target] = program;
+  const [head, target, entry] = program;
   if (head !== undefined && (RELEASE_BINS.includes(head) || isPathTo(head, RELEASE_BINS))) return program.slice(1);
+  if (head === "bun" && target === "run" && entry !== undefined && (RELEASE_SOURCES.includes(entry) || isPathTo(entry, [...RELEASE_SOURCES, ...RELEASE_BINS]))) {
+    return program.slice(3);
+  }
   if (head === "bun" && target !== undefined && (RELEASE_SOURCES.includes(target) || isPathTo(target, [...RELEASE_SOURCES, ...RELEASE_BINS]))) {
     return program.slice(2);
   }
   return [];
 }
 
-function literalTargets(run: string): readonly string[] {
-  return shellCommands(run.replace(EXPRESSION, "$EXPRESSION"))
-    .flatMap((command) => releaseArguments(fromProgram(command)))
-    .filter((target) => !target.includes("$"));
+// The stand-in for an expression keeps its length, so each invocation starts at its offset in run.
+function literalTargets(run: string): readonly Target[] {
+  return shellWords(run.replace(EXPRESSION, (expression) => `$${"_".repeat(expression.length - 1)}`)).flatMap((words) => {
+    const invocation = words[0]?.start ?? 0;
+    return releaseArguments(fromProgram(words.map(({ text }) => text)))
+      .filter((name) => !name.includes("$"))
+      .map((name) => ({ name, invocation }));
+  });
 }
 
 function escapeRegExp(text: string): string {
@@ -113,6 +124,102 @@ function nodeAt(lines: readonly string[], keys: readonly Key[]): Node | undefine
   );
 }
 
+const BLOCK_HEADER = /^[|>][1-9+-]*\s*(#.*)?$/;
+const PLAIN_COMMENT = /(^|\s)#/;
+const ESCAPES = new Map([
+  ["0", "\0"], ["a", "\x07"], ["b", "\b"], ["t", "\t"], ["\t", "\t"], ["n", "\n"], ["v", "\v"], ["f", "\f"], ["r", "\r"], ["e", "\x1b"],
+  [" ", " "], ['"', '"'], ["/", "/"], ["\\", "\\"], ["N", "\x85"], ["_", "\xa0"], ["L", "\u2028"], ["P", "\u2029"],
+]);
+const HEX_ESCAPES = new Map([["x", 2], ["u", 4], ["U", 8]]);
+
+function rawPieces(lines: readonly string[], node: Node): readonly Piece[] {
+  const head = lines[node.from] ?? "";
+  const keyColumn = /^\s*(?:-\s+)?/.exec(head)?.[0].length ?? 0;
+  return [
+    { at: node.from, text: head.slice(head.indexOf(":") + 1).trim() },
+    ...lines.slice(node.from + 1, node.to).map((line, index) => ({ at: node.from + 1 + index, text: indentOf(line) > keyColumn ? line.trim() : "" })),
+  ];
+}
+
+function plainPieces(pieces: readonly Piece[]): readonly Piece[] {
+  const decoded: Piece[] = [];
+  for (const { at, text } of pieces) {
+    const comment = PLAIN_COMMENT.exec(text);
+    const content = comment === null ? text : text.slice(0, comment.index).trimEnd();
+    decoded.push({ at, text: content });
+    if (comment !== null && decoded.some((piece) => piece.text !== "")) break;
+  }
+  return decoded;
+}
+
+function escaped(text: string, at: number): { readonly text: string; readonly end: number } {
+  const code = text.charAt(at + 1);
+  const width = HEX_ESCAPES.get(code);
+  if (width !== undefined) return { text: String.fromCodePoint(Number.parseInt(text.slice(at + 2, at + 2 + width), 16)), end: at + 2 + width };
+  return { text: ESCAPES.get(code) ?? code, end: at + 2 };
+}
+
+function quotedPieces(pieces: readonly Piece[], quote: "'" | '"'): readonly Piece[] {
+  const decoded: Piece[] = [];
+  for (const [position, { at, text }] of pieces.entries()) {
+    let content = "";
+    let index = position === 0 ? 1 : 0;
+    while (index < text.length) {
+      const char = text.charAt(index);
+      if (quote === "'" && char === "'" && text.charAt(index + 1) === "'") {
+        content += "'";
+        index += 2;
+      } else if (char === quote) {
+        return [...decoded, { at, text: content }];
+      } else if (quote === '"' && char === "\\") {
+        const escape = escaped(text, index);
+        content += escape.text;
+        index = escape.end;
+      } else {
+        content += char;
+        index += 1;
+      }
+    }
+    decoded.push({ at, text: content });
+  }
+  return decoded;
+}
+
+function quoteOf(text: string): "'" | '"' | undefined {
+  return text.startsWith("'") ? "'" : text.startsWith('"') ? '"' : undefined;
+}
+
+// Each piece holds what its physical line adds to the value, without the folding between lines.
+function scalarPieces(lines: readonly string[], node: Node): readonly Piece[] {
+  const [head, ...body] = rawPieces(lines, node);
+  if (head === undefined) return [];
+  if (BLOCK_HEADER.test(head.text)) return body;
+  const open = quoteOf(head.text);
+  if (open !== undefined) return quotedPieces([head, ...body], open);
+  if (head.text !== "" && !head.text.startsWith("#")) return plainPieces([head, ...body]);
+  const first = body.findIndex((piece) => piece.text !== "" && !piece.text.startsWith("#"));
+  const token = first === -1 ? undefined : quoteOf(body[first]?.text ?? "");
+  return token === undefined ? plainPieces([head, ...body]) : quotedPieces(body.slice(first), token);
+}
+
+function scalarLine(lines: readonly string[], node: Node, value: string, offset: number): number {
+  let line = node.from;
+  let cursor = 0;
+  for (const { at, text } of scalarPieces(lines, node)) {
+    const start = text === "" ? -1 : value.indexOf(text, cursor);
+    if (start === -1) continue;
+    if (start > offset) break;
+    line = at;
+    cursor = start + text.length;
+  }
+  return line;
+}
+
+function releaseLocation(path: string, lines: readonly string[], keys: readonly Key[], run: string, target: Target, fallback: string): string {
+  const node = nodeAt(lines, keys);
+  return node === undefined ? `${path} ${fallback}` : `${path} line ${scalarLine(lines, node, run, target.invocation) + 1}`;
+}
+
 export function locate(path: string, lines: readonly string[]): Locator {
   const used = new Map<string, number>();
   return (keys, needle, fallback) => {
@@ -144,7 +251,14 @@ function missingTarget(uses: string, paths: ReadonlySet<string>, at: Locator, ke
     : undefined;
 }
 
-function missingJobRefs(id: string, job: unknown, paths: ReadonlySet<string>, at: Locator): readonly MissingReference[] {
+function missingJobRefs(
+  id: string,
+  job: unknown,
+  paths: ReadonlySet<string>,
+  at: Locator,
+  path: string,
+  lines: readonly string[],
+): readonly MissingReference[] {
   if (!isRecord(job)) return [];
   const missing: MissingReference[] = [];
   if (typeof job["uses"] === "string") {
@@ -162,8 +276,9 @@ function missingJobRefs(id: string, job: unknown, paths: ReadonlySet<string>, at
     }
     if (typeof step["run"] !== "string") return;
     for (const target of literalTargets(step["run"])) {
-      if (!paths.has(`${WORKFLOWS}/${target}`)) {
-        missing.push({ location: at(["jobs", id, "steps", index, "run"], target, fallback), fault: `names missing workflow ${target}` });
+      if (!paths.has(`${WORKFLOWS}/${target.name}`)) {
+        const location = releaseLocation(path, lines, ["jobs", id, "steps", index, "run"], step["run"], target, fallback);
+        missing.push({ location, fault: `names missing workflow ${target.name}` });
       }
     }
   });
@@ -176,11 +291,12 @@ export function findMissingWorkflows(workflows: readonly Workflow[]): readonly M
   const titles = new Set(workflows.map((workflow) => workflowTitle(workflow.document) ?? workflow.path));
   return workflows.flatMap((workflow) => {
     const missing: MissingReference[] = [];
-    const at = locate(workflow.path, workflow.text.split("\n"));
+    const lines = workflow.text.split("\n");
+    const at = locate(workflow.path, lines);
     const jobs = isRecord(workflow.document) ? workflow.document["jobs"] : undefined;
     if (isRecord(jobs)) {
       missing.push(...missingNeeds(jobs, at));
-      for (const [id, job] of Object.entries(jobs)) missing.push(...missingJobRefs(id, job, paths, at));
+      for (const [id, job] of Object.entries(jobs)) missing.push(...missingJobRefs(id, job, paths, at, workflow.path, lines));
     }
     const on = isRecord(workflow.document) ? workflow.document["on"] : undefined;
     const watched = isRecord(on) ? on["workflow_run"] : undefined;

package/src/quality/presets/stylelint.ts

@@ -1,4 +1,5 @@
 import { fileURLToPath } from "node:url";
+import valueParser from "postcss-value-parser";
 import type { Config, Plugin, RuleBase } from "stylelint";
 
 type Globs = readonly [string, ...string[]];
@@ -101,9 +102,24 @@ const FONT_FAMILIES = `${FONT_FAMILY}(?:\\s*,\\s*${FONT_FAMILY})*`;
 
 const FONT_FAMILY_VALUE = new RegExp(`^${FONT_FAMILIES}$`, "i");
 
-// A family name or a token name can hold a size word, so the token is required in the size slot rather than size words refused anywhere.
+const NAMED_FONT_SIZES = new Set([
+  "xx-small",
+  "x-small",
+  "small",
+  "medium",
+  "large",
+  "x-large",
+  "xx-large",
+  "xxx-large",
+  "larger",
+  "smaller",
+  "math",
+]);
+
+const SIZE_PRECEDER = new RegExp(`^${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}$`, "i");
+
 const FONT_VALUE = new RegExp(
-  `^(?:${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}\\s+)*(?<size>${VAR})(?:\\s*\\/\\s*(?:${VAR}|[\\w.%-]+))?(?:\\s+(?<families>${FONT_FAMILIES}))?$`,
+  `^(?:${FONT_STYLE_VARIANT_WEIGHT_OR_WIDTH}\\s+)*(?<size>${VAR})(?<lineHeight>\\s*\\/\\s*(?:${VAR}|[\\w.%-]+))?(?:\\s+(?<families>${FONT_FAMILIES}))?$`,
   "i",
 );
 
@@ -113,36 +129,80 @@ function varNames(value: string): string[] {
   return [...value.matchAll(VAR_NAMES)].map(([, name]) => name).filter((name) => name !== undefined);
 }
 
-type SizeCarrier = { readonly token: string; readonly setTo: RegExp };
+type SizeCarrier = { readonly token: string; readonly setTo: RegExp; readonly atSize: boolean };
+
+// The size follows any style, variant, weight and width, so the first other word or var() is the one place a family list can hold it.
+function sizePosition(families: string): string {
+  const position = valueParser(families).nodes.find(({ type, value }) => type !== "space" && !(type === "word" && SIZE_PRECEDER.test(value)));
+  return position === undefined ? "" : valueParser.stringify(position);
+}
+
+// A line height fixes the var() before it as the size, which leaves the family list no size to hold.
+function fontSizePosition(font: Readonly<Record<string, string | undefined>>): string {
+  return font.lineHeight === undefined ? sizePosition(font.families ?? "") : "";
+}
+
+function namedSize(position: string): string | undefined {
+  return NAMED_FONT_SIZES.has(position.toLowerCase()) ? position : undefined;
+}
 
 // A var() before the size var can be a weight, which leaves a family var() free to hold the size.
 function sizeCarriers(property: string, value: string): SizeCarrier[] {
   const name = property.toLowerCase();
-  if (name === "font-size" && FONT_SIZE_VALUE.test(value)) return varNames(value).map((token) => ({ token, setTo: FONT_SIZE_VALUE }));
+  if (name === "font-size" && FONT_SIZE_VALUE.test(value)) return varNames(value).map((token) => ({ token, setTo: FONT_SIZE_VALUE, atSize: false }));
   const font = name === "font" ? FONT_VALUE.exec(value)?.groups : undefined;
   if (font?.size === undefined) return [];
+  const atSize = varNames(fontSizePosition(font));
   return [
-    ...varNames(font.size).map((token) => ({ token, setTo: FONT_SIZE_VALUE })),
-    ...varNames(font.families ?? "").map((token) => ({ token, setTo: FONT_FAMILY_VALUE })),
+    ...varNames(font.size).map((token) => ({ token, setTo: FONT_SIZE_VALUE, atSize: false })),
+    ...varNames(font.families ?? "").map((token) => ({ token, setTo: FONT_FAMILY_VALUE, atSize: atSize.includes(token) })),
   ];
 }
 
-function fromTokens({ token, setTo }: SizeCarrier, declared: ReadonlyMap<string, readonly string[]>, seen: ReadonlySet<string>): boolean {
+function literalSize(property: string, value: string): string | undefined {
+  const font = property.toLowerCase() === "font" ? FONT_VALUE.exec(value)?.groups : undefined;
+  return font?.size === undefined ? undefined : namedSize(fontSizePosition(font));
+}
+
+function fromTokens({ token, setTo, atSize }: SizeCarrier, declared: ReadonlyMap<string, readonly string[]>, seen: ReadonlySet<string>): boolean {
   const values = declared.get(token);
   if (values === undefined) return true;
-  return values.every(
-    (value) => setTo.test(value) && varNames(value).every((alias) => !seen.has(alias) && fromTokens({ token: alias, setTo }, declared, new Set([...seen, alias]))),
-  );
+  return values.every((value) => {
+    const position = atSize ? sizePosition(value) : "";
+    return (
+      setTo.test(value) &&
+      namedSize(position) === undefined &&
+      varNames(value).every((alias) => !seen.has(alias) && fromTokens({ token: alias, setTo, atSize: varNames(position).includes(alias) }, declared, new Set([...seen, alias])))
+    );
+  });
+}
+
+const declaredByFile = new WeakMap<object, Map<string, string[]>>();
+
+type DeclarationDocument = {
+  walkDecls(filter: RegExp, visit: (decl: { readonly prop: string; readonly value: string }) => void): void;
+};
+
+function fileDeclarations(document: DeclarationDocument): Map<string, string[]> {
+  const cached = declaredByFile.get(document);
+  if (cached !== undefined) return cached;
+  const fresh = new Map<string, string[]>();
+  document.walkDecls(/^--/, ({ prop, value }) => {
+    fresh.set(prop, [...(fresh.get(prop) ?? []), value]);
+  });
+  declaredByFile.set(document, fresh);
+  return fresh;
 }
 
 // postcss-html hands the rule one root per style block or attribute, so the file's declarations sit on the result's document.
 const fontSizeFromTokens: RuleBase = () => async (root, result) => {
   const { utils } = (await import("stylelint")).default;
-  const declared = new Map<string, string[]>();
-  result.root.walkDecls(/^--/, ({ prop, value }) => {
-    declared.set(prop, [...(declared.get(prop) ?? []), value]);
-  });
+  const declared = fileDeclarations(result.root);
   root.walkDecls((node) => {
+    const literal = literalSize(node.prop, node.value);
+    if (literal !== undefined) {
+      utils.report({ ruleName: FONT_SIZE_RULE, result, node, word: literal, message: `Expected the font size from the token files rather than the literal "${literal}"` });
+    }
     for (const carrier of sizeCarriers(node.prop, node.value)) {
       if (fromTokens(carrier, declared, new Set([carrier.token]))) continue;
       utils.report({ ruleName: FONT_SIZE_RULE, result, node, word: carrier.token, message: `Expected "${carrier.token}" from the token files rather than set in this file` });

package/src/testing/mutation-scope.ts

@@ -196,7 +196,8 @@ export function preloadChange(
   return [...preloads.atBase, ...loaded].find((path) => changed.has(path));
 }
 
-// Stryker leaves coveredBy empty on a static mutant, so only killedBy names its tests, and all of them only from a run without bail.
+// Stryker leaves coveredBy empty on a static mutant, so only killedBy names its tests.
+// A kill is lost only when every test that made it changed, so the one killer a run with bail records is enough.
 export function coveringTests(baseline: Baseline, tests: ReadonlySet<string>, mutated: (file: string) => boolean): Map<string, readonly string[]> {
   const owners = new Map(Object.entries(baseline.testFiles).flatMap(([file, { tests: listed }]) => listed.map(({ id }) => [id, file] as const)));
   const covering = new Map<string, readonly string[]>();

package/src/testing/test-report.ts

@@ -42,6 +42,7 @@ const decodeCase = Schema.decodeUnknownEffect(
   Schema.Struct({ name: Schema.String, file: Schema.String, line: Schema.NumberFromString.check(Schema.isInt()) }),
 );
 const decodeCrash = Schema.decodeUnknownEffect(Schema.Struct({ file: Schema.String }));
+const decodeTimed = Schema.decodeUnknownEffect(Schema.Struct({ file: Schema.String, time: Schema.FiniteFromString }));
 
 function unescape(text: string): string {
   return text.replace(ENTITY, (_, named: string | undefined, decimal: string | undefined, hex: string | undefined) => {
@@ -133,3 +134,17 @@ export const parseReport = Effect.fn("parseReport")(function* (xml: string) {
   }
   return { results, crashedFiles } satisfies Report;
 });
+
+// Bun names a file's top-level <testsuite> by its path with no leading ./ whatever spelling ran it, and times the whole file there.
+export const fileSeconds = Effect.fn("fileSeconds")(function* (xml: string) {
+  const root = yield* parseElements(xml);
+  const seconds = new Map<string, number>();
+  for (const fileSuite of root.children) {
+    if (fileSuite.tag !== "testsuite") continue;
+    const { file, time } = yield* decodeTimed(fileSuite.attributes).pipe(
+      Effect.mapError((cause) => new ReportError({ message: `the junit report holds a <testsuite> with no file or time: ${cause.message}` })),
+    );
+    seconds.set(file, time);
+  }
+  return seconds;
+});

package/stryker.preset.js

@@ -3,6 +3,7 @@ import { availableParallelism } from "node:os";
 import { fileURLToPath } from "node:url";
 import { GUARD_IGNORER } from "./dist/mutation/mutation-guard-plugin.js";
 import { fullRunRefusal } from "./dist/mutation/mutation-refusal.js";
+import { ordersTests, runOrder } from "./dist/mutation/unit-test-order.js";
 
 const [, , command, ...args] = process.argv;
 const refusal = command === "run" ? fullRunRefusal(args, process.env.CI ?? "") : undefined;
@@ -11,12 +12,16 @@ if (refusal !== undefined) throw new Error(refusal);
 export const halfAvailableCores = (cores = availableParallelism()) => Math.max(1, Math.floor(cores / 2));
 
 // The bun runner narrows a mutant's run to its covering files only when each listed path equals a test id's file part, which carries no leading ./.
-export const unitTestFiles = () =>
+const listedUnitTests = () =>
   readdirSync("tests/unit", { recursive: true, encoding: "utf8" })
     .filter((name) => name.endsWith(".test.ts") || name.endsWith(".test.tsx"))
     .map((name) => `tests/unit/${name}`)
     .toSorted();
 
+const timedUnitTests = ordersTests(command, args) ? await runOrder(listedUnitTests()) : undefined;
+
+export const unitTestFiles = () => timedUnitTests ?? listedUnitTests();
+
 export default {
   packageManager: "npm",
   plugins: [