@avi2dg/checks 0.50.1 → 0.51.0

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.51.0
+
+Released 2026-10-23.
+
+### Features
+
+- **testing:** reuse full baseline results for unchanged files [#197](https://github.com/avi2d/checks/pull/197)
+
+### Fixes
+
+- **delivery:** accept GitHub display name on commits GitHub made [#198](https://github.com/avi2d/checks/pull/198)
+- **testing:** correct unit test fallback order wording to Bun default directory order [#195](https://github.com/avi2d/checks/pull/195)
+
 ## 0.50.1
 
 Released 2026-10-20.

package/dist/mutation/unit-test-order.js

@@ -150,7 +150,7 @@ var timedFiles = Effect2.fn("timedFiles")(function* (listed) {
   return fastestFirst(yield* fileSeconds(yield* fs.readFileString(outfile)));
 }, Effect2.scoped);
 var NodeServices = NodeChildProcessSpawner.layer.pipe(Layer.provideMerge(Layer.mergeAll(NodeFileSystem.layer, NodePath.layer)));
-var runOrder = (listed) => Effect2.runPromise(timedFiles(listed).pipe(Effect2.map((timed) => inRunOrder(listed, timed)), Effect2.catch((failure) => Console.error(`checks: ${failure.message}, so each static mutant runs the unit tests in path order`).pipe(Effect2.as(listed))), Effect2.provide(NodeServices)));
+var runOrder = (listed) => Effect2.runPromise(timedFiles(listed).pipe(Effect2.map((timed) => inRunOrder(listed, timed)), Effect2.catch((failure) => Console.error(`checks: ${failure.message}, so each static mutant runs the unit tests in Bun's default directory order`).pipe(Effect2.as(listed))), Effect2.provide(NodeServices)));
 export {
   fastestFirst,
   inRunOrder,

package/docs/gates/checks-commit-identity.md

@@ -11,6 +11,9 @@ audience: consumers
 The author and committer of each commit must be allowed.
 A commit whose trailer block carries a `Co-authored-by` trailer, as git parses it, is refused.
 `GitHub <noreply@github.com>` is allowed as committer only.
+A commit that GitHub committed allows any author name with an allowed email.
+GitHub authors a web merge under the account's display name.
+The same author on a commit with any other committer must match the allowed name too.
 `github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>` is allowed as author only of a commit whose subject is `chore: release <version>`, with or without the pull request number a squash merge adds.
 GitHub attributes the release commit [checks-release-pr](checks-release-pr.md) makes to that bot, since it commits through the workflow token.
 Such a commit may carry a `Co-authored-by` trailer naming that bot, since GitHub adds one to some squash merges of a pull request the bot opened, and every other trailer is refused.

package/docs/gates/checks-mutation-baseline.md

@@ -22,6 +22,13 @@ With `--full` it lists up to 50 `schedule` runs and up to 50 `workflow_dispatch`
 It tries those runs newest first, and restores the first `mutation-baseline-full` artifact that has not expired, downloads and holds the report.
 It tries no run after that one.
 It takes the report from `mutation.json` at the artifact's root, or else from `mutation/mutation.json`, and copies it to the destination.
+With an incremental destination it also copies `stryker-incremental.json` when the artifact holds one, so the next full run retests the mutants its changes reach, while inputs a test reads at runtime stay untracked.
+The restore then drops each test that reads a changed file and each mutant result for a changed source from the copied state.
+It drops non-killed results when any test goes stale.
+It drops the whole state when a Stryker config, stryker.preset.js, the lockfile, the Bun version, package.json apart from its version, a patch its patchedDependencies names, a file the active config loads at either revision, or the bunfig preload set or a file it loads changed.
+It walks the config and preload dependencies at both revisions, so a file only the older revision resolved still drops the state when it changes.
+A state that does not parse fails the restore instead of running on unknown results.
+Without the state file the report still restores.
 
 It creates the directories each destination needs.
 
@@ -41,9 +48,14 @@ It deletes through `gh`, which needs a token that deletes the repository's Actio
 
 It reads the runs and their artifacts through `gh`, which needs a token that reads the repository's Actions, such as `GH_TOKEN: ${{ github.token }}` with `actions: read`.
 The `mutation-baseline` artifact holds `stryker-incremental.json` and `mutation/mutation.json`, which an upload of `reports/stryker-incremental.json` and `reports/mutation/mutation.json` writes.
-The `mutation-baseline-full` artifact holds `mutation.json` at its root, which an upload of `reports/mutation/mutation.json` alone writes.
+The `mutation-baseline-full` artifact holds `mutation.json` and `stryker-incremental.json` at its root, which an upload of `${{ runner.temp }}/full/` writes.
 It reads `RUNNER_ENVIRONMENT` and `HOME` to place the runner cache, and `GITHUB_REPOSITORY_ID` to find the saved baselines.
 `--save` and `--prune` read `GITHUB_RUN_ID`.
+With `--full` and an incremental destination it reads the run's head through `gh run view <run> --json headSha`.
+It diffs that head against `HEAD`, which needs the checkout's full history.
+It shows `bunfig.toml`, `package.json`, every tracked `package.json`, and the files the active Stryker config imports at both revisions.
+It reads every tracked `.ts`, `.tsx`, `.mts`, `.cts`, `.js`, `.jsx`, `.mjs`, and `.cjs` file from the working tree for their relative imports.
+Inputs a test reads at runtime without a static import, such as markdown files, escape invalidation as a known limitation.
 
 ## The runner cache
 
@@ -91,13 +103,13 @@ It also refuses when `HOME`, `GITHUB_REPOSITORY_ID` or `GITHUB_RUN_ID` is unset.
 
 ```sh
 checks-mutation-baseline <incremental-dest> [mutation-json-dest]
-checks-mutation-baseline --full <mutation-json-dest>
+checks-mutation-baseline --full <mutation-json-dest> [incremental-dest]
 checks-mutation-baseline --save <incremental-src> [mutation-json-src]
 checks-mutation-baseline --slim <mutation-json-src> <dest>
 checks-mutation-baseline --prune [--dry-run]
 ```
 
-`--full` restores only the report of a run that started with no state.
+`--full` restores the report of a full run, and its incremental state when given an incremental destination.
 `--save` keeps this run's baseline on the runner's disk in place of an upload.
 `--slim` writes a report without `statusReason` to `<dest>`, for a report that still goes up as an artifact.
 `--prune` deletes superseded baselines after a save or an upload.
@@ -108,7 +120,7 @@ checks-mutation-baseline --prune [--dry-run]
 | Code | When |
 | --- | --- |
 | 0 | it restored a baseline, found none to restore, saved the baseline or wrote the slim report |
-| 2 | the arguments do not parse, `gh` cannot list the runs, the cache cannot be written, another job removed the entry before it was copied, a file to save or slim does not parse, or `--save` runs where it refuses |
+| 2 | the arguments do not parse, `gh` cannot list the runs, the cache cannot be written, another job removed the entry before it was copied, a file to save or slim does not parse, `--save` runs where it refuses, or `--full` with an incremental destination cannot read the run's head, diff it, or parse the restored state |
 
 A failed artifact lookup or download prints the `gh` error and moves on, as a missing artifact does.
 With `--prune`, `0` means it deleted the superseded artifacts, found none, or could not delete some.
@@ -166,15 +178,28 @@ The saved baseline uses none of the account's Actions storage, which every priva
 That storage accrues by the hour over the month, so an artifact deleted early still counts until the month ends.
 A baseline job on a GitHub-hosted runner uploads the same two files as a `mutation-baseline` artifact with `retention-days: 7` instead, since the restore reads only the newest `main` run.
 
-A full run uploads its report as the `mutation-baseline-full` artifact, which a branch comparison's scope step reads on any runner.
-It slims the report first, so the artifact holds about 0.5 MB in place of about 100 MB:
+A full baseline job restores the previous full state before its incremental Stryker run, so it retests the mutants its changes reach, while inputs a test reads at runtime stay untracked.
+The checkout behind that step fetches the full history, so the restore can diff the restored run against `HEAD`:
+
+```yaml
+- name: Restore previous full baseline state
+  env:
+    GH_TOKEN: ${{ github.token }}
+  run: bunx checks-mutation-baseline --full reports/mutation/mutation.json reports/stryker-incremental.json
+```
+
+The restore reads the repository's Actions through `gh`, so the job that holds it grants `contents: read` and `actions: read`.
+
+A full run uploads its slimmed report and its slimmed state as the `mutation-baseline-full` artifact, which a branch comparison's scope step reads on any runner.
+It slims the report and the state first, so the one directory holds about 10 MB in place of about 500 MB:
 
 ```yaml
 - run: bunx checks-mutation-baseline --slim reports/mutation/mutation.json "$RUNNER_TEMP/full/mutation.json"
+- run: bunx checks-mutation-baseline --slim reports/stryker-incremental.json "$RUNNER_TEMP/full/stryker-incremental.json"
 - uses: actions/upload-artifact@v4
   with:
     name: mutation-baseline-full
-    path: ${{ runner.temp }}/full/mutation.json
+    path: ${{ runner.temp }}/full/
     retention-days: 30
 ```
 

package/docs/gates/checks-mutation-scope.md

@@ -53,7 +53,7 @@ So a helper, fixture or preload changed on `main` since that baseline can hide a
 - The full baseline report that `checks-mutation-baseline --full` restores, for each mutant's `coveredBy` and `killedBy` and the `testFiles` that own those tests.
 
 Stryker leaves `coveredBy` empty on a static mutant, so only `killedBy` names its tests.
-The report must come from a run that restored no state, so each mutant's tests are the ones it ran against.
+A reused result needs its affected tests, sources, and configuration invalidated before reuse, so each mutant's tests are the ones the run recorded.
 With bail, Stryker's default, `killedBy` names the one test that killed the mutant first.
 One killer is enough, since a branch loses a kill through its tests only when it changes every test that made the kill.
 A test left alone, whose sources the branch also leaves alone, still kills the mutant at `HEAD`.

package/docs/gates/checks-mutation.md

@@ -30,7 +30,7 @@ So when a `stryker run` without `--ignoreStatic` loads the preset, the preset fi
 `unitTestFiles` then lists each file with a leading `./`, fastest first, and Bun runs such paths in the order given.
 It then lists each path again without the `./`, the spelling the runner matches a covering test against.
 Bun loads a file once however often the list names it.
-When that timing run fails, the preset prints why on stderr and `unitTestFiles` keeps the path order.
+When that timing run fails, the preset prints why on stderr and `unitTestFiles` keeps Bun's default directory order.
 The config then reads:
 
 ```js
@@ -82,7 +82,7 @@ An `--incremental` run with no report stops before instrumenting with the missin
 A repository runs full baselines from the mutation workflow on `workflow_dispatch`.
 A repository that picks a branch scope from a baseline starts that workflow weekly with `gh workflow run mutation`, because a GitHub schedule can start hours late.
 Run scoped checks locally during development.
-Each baseline costs a full Stryker run.
+A first baseline with no state costs a full Stryker run, and each later one retests the mutants its changes reach, while inputs a test reads at runtime stay untracked.
 
 ## Running it in CI
 
@@ -94,29 +94,42 @@ on:
   workflow_dispatch:
 jobs:
   mutation:
+    permissions:
+      contents: read
+      actions: read
     runs-on: [self-hosted, Linux, X64, winbox]
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: .bun-version
       - run: bun install --frozen-lockfile
-      - run: bunx stryker run
+      - env:
+          GH_TOKEN: ${{ github.token }}
+        run: bunx checks-mutation-baseline --full reports/mutation/mutation.json reports/stryker-incremental.json
+      - run: bunx stryker run --incremental
       - run: bunx checks-mutation-baseline --slim reports/mutation/mutation.json "$RUNNER_TEMP/full/mutation.json"
+      - run: bunx checks-mutation-baseline --slim reports/stryker-incremental.json "$RUNNER_TEMP/full/stryker-incremental.json"
       - uses: actions/upload-artifact@v4
         with:
           name: mutation-baseline-full
-          path: ${{ runner.temp }}/full/mutation.json
+          path: ${{ runner.temp }}/full/
           retention-days: 30
 ```
 
-The run restores no state, so its report names every test that covers each covered mutant and the first test that killed each killed mutant.
+A first baseline with no state tests every mutant.
+Each later restore drops the tests that read a changed file and the mutant results for a changed source from the restored state, and drops non-killed results when any test goes stale.
+It drops the whole state when a Stryker config, stryker.preset.js, the lockfile, the Bun version, package.json apart from its version, a patch its patchedDependencies names, a file the active config loads at either revision, or the bunfig preload set or a file it loads changed, and fails the restore when the state does not parse, so the run retests every mutant those changes reach and reuses the rest, while inputs a test reads at runtime stay untracked.
+The checkout fetches the full history, so the restore can tell which files changed since the previous full run.
+Its report names every test that covers each covered mutant and the first test that killed each killed mutant.
 [checks-mutation-scope](checks-mutation-scope.md#what-it-reads) says why that one killer is enough.
 The upload is the `mutation-baseline-full` artifact that a branch comparison's scope step restores with `checks-mutation-baseline --full`.
 [checks-mutation-scope](checks-mutation-scope.md) reads it to bring in the sources a changed unit test covers or kills.
 The restore reads only a successful run of `mutation.yml` on `main`, so a sweep that fails publishes nothing a scope step reads.
 The artifact keeps 30 days, so the newest full baseline outlives the week between full runs.
-The upload holds the report without each mutant's `statusReason`, as [checks-mutation-baseline](checks-mutation-baseline.md#the-saved-baselines) says, since the full report of a large repository passes 100 MB as an artifact.
+The upload holds the slimmed report and the slimmed state without each mutant's `statusReason`, as [checks-mutation-baseline](checks-mutation-baseline.md#the-saved-baselines) says, so the one directory holds about 10 MB in place of about 500 MB.
 
 The job runs on the fleet's self-hosted Linux runner labelled `winbox`, which is where a repository sends its full sweeps.
 It never reads `CI_RUNS_ON`, so an override that moves a repository's other jobs during a runner outage leaves the sweep waiting for `winbox`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.50.1",
+  "version": "0.51.0",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "license": "MIT",
   "repository": {
@@ -48,7 +48,9 @@
     "src/testing/mutation-refusal.ts",
     "src/testing/mutation-compare.ts",
     "src/testing/mutation-scope.ts",
+    "src/testing/mutation-scope-graph.ts",
     "src/testing/mutation-baseline.ts",
+    "src/testing/mutation-baseline-full.ts",
     "src/testing/mutation-baseline-saved.ts",
     "src/testing/subsumed-tests.ts",
     "src/testing/night-run.ts",

package/src/delivery/commit-identity.ts

@@ -123,11 +123,17 @@ function allows(allowed: readonly Identity[], identity: Identity): boolean {
   );
 }
 
+// GitHub authors a web merge under the account's display name, which the owner's git name need not match.
+function allowsEmail(allowed: readonly Identity[], identity: Identity): boolean {
+  return allowed.some((entry) => entry.email.toLowerCase() === identity.email.toLowerCase());
+}
+
 function inspect(commit: Commit, allowed: readonly Identity[]): Offence | undefined {
   const reasons: string[] = [];
   const release = releasedVersionOf(commit.subject) !== undefined;
   const authors = release ? [...allowed, RELEASE_AUTHOR] : allowed;
-  if (!allows(authors, commit.author)) {
+  const madeByGitHub = allows([SQUASH_COMMITTER], commit.committer);
+  if (!(madeByGitHub ? allowsEmail(authors, commit.author) : allows(authors, commit.author))) {
     reasons.push(`author ${render(commit.author)}`);
   }
   if (!allows([...allowed, SQUASH_COMMITTER], commit.committer)) {
@@ -158,7 +164,7 @@ const check = Effect.gen(function* () {
       for (const reason of reasons) lines.push(`    ${reason}`);
     }
     lines.push(`  allowed: ${allowed.map(render).join(", ")}`);
-    lines.push(`  allowed as committer only: ${render(SQUASH_COMMITTER)}`);
+    lines.push(`  allowed as committer only: ${render(SQUASH_COMMITTER)}, which also lets an allowed email author under any name`);
     lines.push(`  allowed as release author only: ${render(RELEASE_AUTHOR)}`);
     yield* Console.error(lines.join("\n"));
     return false;

package/src/testing/mutation-baseline-full.ts

@@ -0,0 +1,92 @@
+import { Console, Effect, FileSystem, Schema } from "effect";
+import { ChildProcessSpawner } from "effect/process";
+import { collect } from "../core/git.ts";
+import { isRecord, withoutStale } from "./mutation-baseline-saved.ts";
+import { STRYKER_CONFIGS, stalenessSince } from "./mutation-scope.ts";
+
+export class BaselineFailure extends Schema.TaggedError<BaselineFailure>()("BaselineFailure", {
+  message: Schema.String,
+}) {}
+
+export const gh = Effect.fn("gh")(function* (args: readonly string[]) {
+  const failed = (reason: string): BaselineFailure => new BaselineFailure({ message: `gh ${args.join(" ")}: ${reason.trim()}` });
+  const { stdout, stderr, exitCode } = yield* collect("gh", args).pipe(Effect.mapError((cause) => failed(cause.message)));
+  if (exitCode !== ChildProcessSpawner.ExitCode(0)) return yield* failed(stderr);
+  return stdout;
+});
+
+const FULL_CONFIGS = [...STRYKER_CONFIGS, "stryker.preset.js", "bun.lock", ".bun-version"];
+
+const parsedJson = (text: string) =>
+  Effect.try({
+    try: (): unknown => JSON.parse(text),
+    catch: () => new BaselineFailure({ message: "package.json is not JSON" }),
+  });
+
+const withoutVersion = (text: string) =>
+  parsedJson(text).pipe(
+    Effect.map((parsed) => {
+      if (!isRecord(parsed)) return undefined;
+      return JSON.stringify(Object.fromEntries(Object.entries(parsed).filter(([key]) => key !== "version")));
+    }),
+    Effect.catchTag("BaselineFailure", () => Effect.succeed(undefined)),
+  );
+
+const patchedPaths = (text: string | undefined): Effect.Effect<readonly string[], BaselineFailure> => {
+  if (text === undefined) return Effect.succeed([]);
+  return parsedJson(text).pipe(
+    Effect.map((parsed) => {
+      if (!isRecord(parsed)) return [];
+      const patched = parsed["patchedDependencies"];
+      if (!isRecord(patched)) return [];
+      return Object.values(patched).flatMap((value) => (typeof value === "string" ? [value.replace(/^\.\//, "")] : []));
+    }),
+    Effect.catchTag("BaselineFailure", (): Effect.Effect<readonly string[]> => Effect.succeed([])),
+  );
+};
+
+const shownAt = (rev: string, path: string) =>
+  collect("git", ["show", `${rev}:${path}`]).pipe(
+    Effect.map(({ stdout, exitCode }) => (exitCode === ChildProcessSpawner.ExitCode(0) ? stdout : undefined)),
+    Effect.mapError((cause) => new BaselineFailure({ message: cause.message })),
+    Effect.catchTag("BaselineFailure", () => Effect.succeed(undefined)),
+  );
+
+const packageInputs = Effect.fn("packageInputs")(function* (base: string, head: string, paths: ReadonlySet<string>) {
+  const inputs = new Set<string>();
+  const [before, after] = yield* Effect.all([shownAt(base, "package.json"), shownAt(head, "package.json")]);
+  if (paths.has("package.json") && (before === undefined || after === undefined || (yield* withoutVersion(before)) !== (yield* withoutVersion(after))))
+    inputs.add("package.json");
+  for (const text of [before, after]) for (const path of yield* patchedPaths(text)) if (paths.has(path)) inputs.add(path);
+  return inputs;
+});
+
+const decodeHeadSha = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ headSha: Schema.String })));
+
+const viewedHead = Effect.fn("viewedHead")(function* (run: number) {
+  return (yield* gh(["run", "view", String(run), "--json", "headSha"]).pipe(Effect.flatMap(decodeHeadSha))).headSha;
+});
+
+export const pruneFullState = Effect.fn("pruneFullState")(function* (run: number, state: string) {
+  const fs = yield* FileSystem.FileSystem;
+  if (!(yield* fs.exists(state))) return;
+  const base = yield* viewedHead(run);
+  const { paths, preload, stale, config } = yield* stalenessSince(base, "HEAD");
+  const inputs = yield* packageInputs(base, "HEAD", paths);
+  const changed = [...paths].filter((path) => FULL_CONFIGS.includes(path) || inputs.has(path) || config.has(path)).toSorted();
+  if (changed.length > 0 || preload !== undefined) {
+    yield* fs.remove(state);
+    yield* Console.log(`mutation-baseline: dropped the restored full state, ${preload ?? changed.join(" ")} changed since run ${run}`);
+    return;
+  }
+  const text = yield* fs.readFileString(state);
+  const stateJson: unknown = yield* Effect.try({
+    try: (): unknown => JSON.parse(text),
+    catch: () => new BaselineFailure({ message: `${state} is not a Stryker incremental state with its test files` }),
+  });
+  const stripped = withoutStale(stateJson, { tests: new Set(stale), sources: paths });
+  if (stripped.tests.length === 0 && stripped.sources.length === 0) return;
+  yield* fs.writeFileString(state, JSON.stringify(stripped.state));
+  const dropped = [...stripped.tests, ...stripped.sources.map((source) => `${source} results`)].join(" ");
+  yield* Console.log(`mutation-baseline: dropped ${dropped} from the restored full state`);
+});

package/src/testing/mutation-baseline-saved.ts

@@ -16,7 +16,7 @@ const SavedFiles = Schema.Struct({ [INCREMENTAL]: Schema.Unknown, [REPORT]: Sche
 export type SavedFiles = typeof SavedFiles.Type;
 const decodeSavedFiles = Schema.decodeUnknownEffect(Schema.fromJsonString(SavedFiles));
 
-const isRecord = (value: unknown): value is Readonly<Record<string, unknown>> => typeof value === "object" && value !== null && !Array.isArray(value);
+export const isRecord = (value: unknown): value is Readonly<Record<string, unknown>> => typeof value === "object" && value !== null && !Array.isArray(value);
 
 const withoutReason = (mutant: unknown): unknown => (isRecord(mutant) ? Object.fromEntries(Object.entries(mutant).filter(([key]) => key !== "statusReason")) : mutant);
 
@@ -40,6 +40,58 @@ const slimOf = Effect.fn("slimOf")(function* (from: string) {
   return withoutReasons(report);
 });
 
+export type Invalidation = { readonly tests: ReadonlySet<string>; readonly sources: ReadonlySet<string> };
+
+export type Invalidated = { readonly state: unknown; readonly tests: readonly string[]; readonly sources: readonly string[] };
+
+const isKilled = (mutant: unknown): boolean => isRecord(mutant) && mutant["status"] === "Killed";
+
+const staleTests = (state: Readonly<Record<string, unknown>>, invalidation: Invalidation): readonly string[] => {
+  const testFiles = state["testFiles"];
+  return isRecord(testFiles) ? Object.keys(testFiles).filter((file) => invalidation.tests.has(file)) : [];
+};
+
+const keptEntry = (file: unknown, stale: boolean, dropStatic: boolean): { readonly entry: unknown; readonly dropped: boolean } => {
+  if (!isRecord(file) || !Array.isArray(file["mutants"])) return { entry: file, dropped: false };
+  const before: readonly unknown[] = file["mutants"];
+  const mutants = stale ? [] : dropStatic ? before : before.filter(isKilled);
+  return { entry: mutants.length > 0 ? { ...file, mutants } : undefined, dropped: mutants.length < before.length };
+};
+
+const prunedFiles = (
+  state: Readonly<Record<string, unknown>>,
+  invalidation: Invalidation,
+): { readonly files: Record<string, unknown> | undefined; readonly sources: readonly string[] } => {
+  const files = state["files"];
+  if (!isRecord(files)) return { files: undefined, sources: [] };
+  const next: Record<string, unknown> = {};
+  const sources: string[] = [];
+  for (const [name, file] of Object.entries(files)) {
+    const kept = keptEntry(file, invalidation.sources.has(name), invalidation.tests.size === 0);
+    if (kept.entry !== undefined) next[name] = kept.entry;
+    if (kept.dropped) sources.push(name);
+  }
+  return { files: next, sources };
+};
+
+export function withoutStale(state: unknown, invalidation: Invalidation): Invalidated {
+  if (!isRecord(state)) return { state, tests: [], sources: [] };
+  const tests = staleTests(state, invalidation);
+  const pruned = prunedFiles(state, invalidation);
+  if (tests.length === 0 && pruned.sources.length === 0) return { state, tests: [], sources: [] };
+  return {
+    state: {
+      ...state,
+      ...(isRecord(state["testFiles"])
+        ? { testFiles: Object.fromEntries(Object.entries(state["testFiles"]).filter(([file]) => !invalidation.tests.has(file))) }
+        : {}),
+      ...(pruned.files === undefined ? {} : { files: pruned.files }),
+    },
+    tests: tests.toSorted(),
+    sources: pruned.sources.toSorted(),
+  };
+}
+
 export const slimmed = Effect.fn("slimmed")(function* (from: string, to: string) {
   const fs = yield* FileSystem.FileSystem;
   const report = yield* slimOf(from);

package/src/testing/mutation-baseline.ts

@@ -1,18 +1,13 @@
 #!/usr/bin/env bun
 import { Config, Console, Effect, FileSystem, Option, Path, Schema } from "effect";
-import { ChildProcessSpawner } from "effect/process";
-import { collect } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
 import { cacheRoot } from "../dependencies/cache-root.ts";
+import { BaselineFailure, gh, pruneFullState } from "./mutation-baseline-full.ts";
 import { INCREMENTAL, LATEST_ARTIFACT, outlived, REPORT, saveBaseline, savedFiles, savedShelf, slimmed } from "./mutation-baseline-saved.ts";
 
-class BaselineFailure extends Schema.TaggedError<BaselineFailure>()("BaselineFailure", {
-  message: Schema.String,
-}) {}
-
 const NAME = "checks-mutation-baseline";
 const USAGE =
-  "usage: checks-mutation-baseline <incremental-dest> [mutation-json-dest] | --full <mutation-json-dest> | --save <incremental-src> [mutation-json-src] | --slim <mutation-json-src> <dest> | --prune [--dry-run]";
+  "usage: checks-mutation-baseline <incremental-dest> [mutation-json-dest] | --full <mutation-json-dest> [incremental-dest] | --save <incremental-src> [mutation-json-src] | --slim <mutation-json-src> <dest> | --prune [--dry-run]";
 const WORKFLOW = "mutation.yml";
 const BRANCH = "main";
 const REPORT_ALONE = "mutation.json";
@@ -40,13 +35,6 @@ type Artifact = typeof Artifact.Type;
 const decodeRuns = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Array(Run)));
 const decodeArtifacts = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ artifacts: Schema.Array(Artifact) })));
 
-const gh = Effect.fn("gh")(function* (args: readonly string[]) {
-  const failed = (reason: string): BaselineFailure => new BaselineFailure({ message: `gh ${args.join(" ")}: ${reason.trim()}` });
-  const { stdout, stderr, exitCode } = yield* collect("gh", args).pipe(Effect.mapError((cause) => failed(cause.message)));
-  if (exitCode !== ChildProcessSpawner.ExitCode(0)) return yield* failed(stderr);
-  return stdout;
-});
-
 const warned = <A>(fallback: A) => (failure: BaselineFailure) => Console.error(`mutation-baseline: ${failure.message}`).pipe(Effect.as(fallback));
 
 const listed = Effect.fn("listed")(function* (event: string | undefined, limit: number) {
@@ -334,8 +322,15 @@ const FLAGS = new Map<string, (rest: readonly string[]) => Command | undefined>(
   ["--slim", ([from, to, ...extra]) => (isDestination(from) && isDestination(to) && extra.length === 0 ? { kind: "slim", from, to } : undefined)],
   [
     "--full",
-    ([report, ...extra]) =>
-      isDestination(report) && extra.length === 0 ? { kind: "restore", full: true, needed: { from: [REPORT_ALONE, REPORT], to: report }, optional: [] } : undefined,
+    ([report, incremental, ...extra]) =>
+      isDestination(report) && (incremental === undefined || isDestination(incremental)) && extra.length === 0
+        ? {
+            kind: "restore",
+            full: true,
+            needed: { from: [REPORT_ALONE, REPORT], to: report },
+            optional: incremental === undefined ? [] : [{ from: [INCREMENTAL], to: incremental }],
+          }
+        : undefined,
   ],
 ]);
 
@@ -346,14 +341,21 @@ function parsed([first, ...rest]: readonly string[]): Command | undefined {
   return restoreRequest(first, report, extra);
 }
 
+const restoredRun = Effect.fn("restoredRun")(function* (run: number, name: string, root: Option.Option<string>, shelf: Option.Option<string>, request: Request) {
+  if (Option.isSome(shelf) && (yield* restoredFromSaved(shelf.value, run, request))) return true;
+  const artifact = yield* artifactOf(run, name).pipe(Effect.catch(warned(Option.none<Artifact>())));
+  if (Option.isNone(artifact) || !(yield* restoredFrom(run, artifact.value, root, request))) return false;
+  const incremental = request.full ? request.optional[0] : undefined;
+  if (incremental !== undefined) yield* pruneFullState(run, incremental.to);
+  return true;
+});
+
 const restoreBaseline = Effect.fn("restoreBaseline")(function* (request: Request) {
   const name = request.full ? FULL_ARTIFACT : LATEST_ARTIFACT;
   const root = yield* runnerCache;
   const shelf = request.full ? Option.none<string>() : yield* savedShelf(root);
   for (const run of yield* request.full ? fullCandidates : latestCandidates) {
-    if (Option.isSome(shelf) && (yield* restoredFromSaved(shelf.value, run, request))) return true;
-    const artifact = yield* artifactOf(run, name).pipe(Effect.catch(warned(Option.none<Artifact>())));
-    if (Option.isSome(artifact) && (yield* restoredFrom(run, artifact.value, root, request))) return true;
+    if (yield* restoredRun(run, name, root, shelf, request)) return true;
   }
   yield* Console.log(`mutation-baseline: no successful ${BRANCH} run holds a ${name} artifact, so nothing was restored`);
   return true;

package/src/testing/mutation-scope-graph.ts

@@ -0,0 +1,98 @@
+export const TEST_TREE = "tests/";
+const FIXTURES = "tests/fixtures/";
+const CANDIDATE_EXTENSIONS = [".tsx", ".ts", ".mts", ".cts", ".jsx", ".js", ".mjs", ".cjs", ".json", ".node"];
+
+const IMPORT = /(?:from|import)\s*\(?\s*["'](\.[^"']*)["']|require\s*\(\s*["'](\.[^"']*)["']\s*\)/g;
+const LISTED_SEGMENTS = /["'`][ \t]*,[ \t]*["'`]/g;
+const DIRECTORY_ENDS = ['"', "'", "`", '/"', "/'", "/`", "/${"];
+
+type Needle = { readonly text: string; readonly kind: "file" | "directory"; readonly fixture: string };
+
+export function resolved(directory: string, spec: string): string {
+  const parts: string[] = [];
+  for (const part of `${directory}/${spec}`.split("/")) {
+    if (part === "..") parts.pop();
+    else if (part !== "." && part !== "") parts.push(part);
+  }
+  return parts.join("/");
+}
+
+// Bun takes the file a specifier names, then one with an extension added, and only then the directory's index.
+export function importedFile(path: string, files: ReadonlySet<string>, mains: ReadonlyMap<string, string> = new Map()): readonly string[] {
+  const probe = (target: string): readonly string[] => {
+    const bare = target.replace(/\.m?js$/, "");
+    return [target, ...CANDIDATE_EXTENSIONS.map((extension) => bare + extension)].filter((file) => files.has(file));
+  };
+  const index = (target: string): readonly string[] =>
+    CANDIDATE_EXTENSIONS.map((extension) => `${target}/index${extension}`).filter((file) => files.has(file));
+  const direct = probe(path);
+  if (direct.length > 0) return direct;
+  const main = mains.get(path);
+  if (main === undefined) return index(path);
+  const manifest = path === "" ? "package.json" : `${path}/package.json`;
+  if (main === manifest) return [manifest, ...index(path)];
+  return [manifest, ...probe(main), ...index(main), ...index(path)];
+}
+
+function fixtureNeedles(changed: readonly string[]): readonly Needle[] {
+  const needles = new Map<string, Needle>();
+  for (const fixture of changed.filter((path) => path.startsWith(FIXTURES))) {
+    const text = fixture.slice(TEST_TREE.length);
+    needles.set(text, { text, kind: "file", fixture });
+    for (let end = text.lastIndexOf("/"); end > 0; end = text.lastIndexOf("/", end - 1)) {
+      const directory = text.slice(0, end);
+      if (!needles.has(directory)) needles.set(directory, { text: directory, kind: "directory", fixture });
+    }
+  }
+  return [...needles.values()];
+}
+
+function mentions(line: string, { text, kind }: Needle): boolean {
+  if (kind === "file") return line.includes(text);
+  return DIRECTORY_ENDS.some((end) => line.includes(text + end));
+}
+
+type Edge = { readonly importer: string; readonly imported: string };
+
+export function importsOf(file: string, text: string, files: ReadonlySet<string>, mains: ReadonlyMap<string, string> = new Map()): readonly string[] {
+  const directory = file.slice(0, Math.max(file.lastIndexOf("/"), 0));
+  return [...text.matchAll(IMPORT)].flatMap(([, throughImport = "", throughRequire = ""]) => importedFile(resolved(directory, throughImport || throughRequire), files, mains));
+}
+
+const edgesOf = (file: string, text: string, files: ReadonlySet<string>, mains: ReadonlyMap<string, string> = new Map()): readonly Edge[] =>
+  importsOf(file, text, files, mains).map((imported) => ({ importer: file, imported }));
+
+function fixtureNamedIn(text: string, needles: readonly Needle[]): string | undefined {
+  if (needles.length === 0) return undefined;
+  for (const line of text.split("\n")) {
+    const joined = line.replaceAll(LISTED_SEGMENTS, "/");
+    const needle = needles.find((each) => mentions(joined, each));
+    if (needle !== undefined) return needle.fixture;
+  }
+  return undefined;
+}
+
+function spread(reached: Map<string, string>, edges: readonly Edge[]): void {
+  for (let grew = true; grew; ) {
+    grew = false;
+    for (const { importer, imported } of edges) {
+      const via = reached.get(imported);
+      if (via === undefined || reached.has(importer)) continue;
+      reached.set(importer, via);
+      grew = true;
+    }
+  }
+}
+
+// Maps each file that reads a changed path, through an import or the fixture's path, to that changed path.
+export function readersOf(sources: ReadonlyMap<string, string>, changed: readonly string[], mains: ReadonlyMap<string, string> = new Map()): Map<string, string> {
+  const reached = new Map(changed.map((path) => [path, path]));
+  const needles = fixtureNeedles(changed);
+  for (const [file, text] of sources) {
+    const fixture = reached.has(file) ? undefined : fixtureNamedIn(text, needles);
+    if (fixture !== undefined) reached.set(file, fixture);
+  }
+  const files = new Set([...sources.keys(), ...changed]);
+  spread(reached, [...sources].flatMap(([file, text]) => edgesOf(file, text, files, mains)));
+  return new Map([...reached].filter(([file, via]) => file !== via));
+}

package/src/testing/mutation-scope.ts

@@ -3,17 +3,16 @@ import { Console, Effect, FileSystem, Path, Schema } from "effect";
 import { escape, minimatch } from "minimatch";
 import { changedPaths, git, pathsAt, rangeEnds, type Change } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
+import { isRecord } from "./mutation-baseline-saved.ts";
+import { importedFile, importsOf, readersOf, resolved, TEST_TREE } from "./mutation-scope-graph.ts";
 
 const NAME = "mutation-scope";
 const USAGE = "usage: mutation-scope.ts <base> [full-baseline-report]";
-const TEST_TREE = "tests/";
 const UNIT_TESTS = "tests/unit/";
-const FIXTURES = "tests/fixtures/";
 const TEST_FILE = /\.test\.tsx?$/;
 const READ_FILE = /\.tsx?$/;
 const BUNFIG = "bunfig.toml";
 const MUTATION_RANGE = /:\d+(?::\d+)?-\d+(?::\d+)?$/;
-const IMPORTED_EXTENSIONS = [".tsx", ".ts", ".mts", ".mjs", ".js"];
 
 export const STRYKER_DEFAULT_MUTATE = [
   "{src,lib}/**/!(*.+(s|S)pec|*.+(t|T)est).+(cjs|mjs|js|ts|mts|cts|jsx|tsx|html|vue|svelte)",
@@ -21,7 +20,7 @@ export const STRYKER_DEFAULT_MUTATE = [
 ];
 
 // Stryker loads the first of these that exists, in this order.
-const STRYKER_CONFIGS = ["", "."].flatMap((dot) =>
+export const STRYKER_CONFIGS = ["", "."].flatMap((dot) =>
   [".conf", ".config"].flatMap((kind) => ["json", "js", "mjs", "cjs"].map((extension) => `${dot}stryker${kind}.${extension}`)),
 );
 
@@ -101,90 +100,7 @@ export function pickFromDiff(changes: readonly Change[], mutated: (file: string)
   };
 }
 
-const IMPORT = /(?:from|import)[ \t]*\(?[ \t]*["'](\.[^"']*)["']/g;
-const LISTED_SEGMENTS = /["'`][ \t]*,[ \t]*["'`]/g;
-const DIRECTORY_ENDS = ['"', "'", "`", '/"', "/'", "/`", "/${"];
-
-type Needle = { readonly text: string; readonly kind: "file" | "directory"; readonly fixture: string };
-
-function resolved(directory: string, spec: string): string {
-  const parts: string[] = [];
-  for (const part of `${directory}/${spec}`.split("/")) {
-    if (part === "..") parts.pop();
-    else if (part !== "." && part !== "") parts.push(part);
-  }
-  return parts.join("/");
-}
-
-// Bun takes the file a specifier names, then one with an extension added, and only then the directory's index.
-function importedFile(path: string, files: ReadonlySet<string>): string | undefined {
-  const bare = path.replace(/\.m?js$/, "");
-  const tried = [path, ...IMPORTED_EXTENSIONS.map((extension) => bare + extension), ...IMPORTED_EXTENSIONS.map((extension) => `${path}/index${extension}`)];
-  return tried.find((file) => files.has(file));
-}
-
-function fixtureNeedles(changed: readonly string[]): readonly Needle[] {
-  const needles = new Map<string, Needle>();
-  for (const fixture of changed.filter((path) => path.startsWith(FIXTURES))) {
-    const text = fixture.slice(TEST_TREE.length);
-    needles.set(text, { text, kind: "file", fixture });
-    for (let end = text.lastIndexOf("/"); end > 0; end = text.lastIndexOf("/", end - 1)) {
-      const directory = text.slice(0, end);
-      if (!needles.has(directory)) needles.set(directory, { text: directory, kind: "directory", fixture });
-    }
-  }
-  return [...needles.values()];
-}
-
-function mentions(line: string, { text, kind }: Needle): boolean {
-  if (kind === "file") return line.includes(text);
-  return DIRECTORY_ENDS.some((end) => line.includes(text + end));
-}
-
-type Edge = { readonly importer: string; readonly imported: string };
-
-function importsOf(file: string, text: string, files: ReadonlySet<string>): readonly string[] {
-  const directory = file.slice(0, Math.max(file.lastIndexOf("/"), 0));
-  return [...text.matchAll(IMPORT)].flatMap(([, spec = ""]) => importedFile(resolved(directory, spec), files) ?? []);
-}
-
-const edgesOf = (file: string, text: string, files: ReadonlySet<string>): readonly Edge[] =>
-  importsOf(file, text, files).map((imported) => ({ importer: file, imported }));
-
-function fixtureNamedIn(text: string, needles: readonly Needle[]): string | undefined {
-  if (needles.length === 0) return undefined;
-  for (const line of text.split("\n")) {
-    const joined = line.replaceAll(LISTED_SEGMENTS, "/");
-    const needle = needles.find((each) => mentions(joined, each));
-    if (needle !== undefined) return needle.fixture;
-  }
-  return undefined;
-}
-
-function spread(reached: Map<string, string>, edges: readonly Edge[]): void {
-  for (let grew = true; grew; ) {
-    grew = false;
-    for (const { importer, imported } of edges) {
-      const via = reached.get(imported);
-      if (via === undefined || reached.has(importer)) continue;
-      reached.set(importer, via);
-      grew = true;
-    }
-  }
-}
-
-// Maps each file that reads a changed path, through an import or the fixture's path, to that changed path.
-export function readersOf(sources: ReadonlyMap<string, string>, changed: readonly string[]): Map<string, string> {
-  const reached = new Map(changed.map((path) => [path, path]));
-  const needles = fixtureNeedles(changed);
-  for (const [file, text] of sources) {
-    const fixture = reached.has(file) ? undefined : fixtureNamedIn(text, needles);
-    if (fixture !== undefined) reached.set(file, fixture);
-  }
-  const files = new Set([...sources.keys(), ...changed]);
-  spread(reached, [...sources].flatMap(([file, text]) => edgesOf(file, text, files)));
-  return new Map([...reached].filter(([file, via]) => file !== via));
-}
+export { readersOf };
 
 // Names what every unit test loads that the branch changes: the preload list, a preload, or a file a preload imports.
 export function preloadChange(
@@ -264,24 +180,72 @@ const preloadsAt = Effect.fn("preloadsAt")(function* (rev: string, paths: Readon
   return (typeof preload === "string" ? [preload] : preload).map((entry) => resolved("", entry));
 });
 
-const loadedByPreloads = Effect.fn("loadedByPreloads")(function* (rev: string, preloads: readonly string[], paths: ReadonlySet<string>) {
+const transitivelyImported = Effect.fn("transitivelyImported")(function* (rev: string, roots: readonly string[], paths: ReadonlySet<string>, mains: ReadonlyMap<string, string> = new Map()) {
   const loaded = new Set<string>();
-  for (let next = preloads.flatMap((preload) => importedFile(preload, paths) ?? []); next.length > 0; ) {
+  for (let next = [...roots]; next.length > 0; ) {
     for (const file of next) loaded.add(file);
-    const read = (file: string) => git(["show", `${rev}:${file}`]).pipe(Effect.map((text) => importsOf(file, text, paths)));
+    const read = (file: string) =>
+      git(["show", `${rev}:${file}`]).pipe(
+        Effect.map((text) => importsOf(file, text, paths, mains)),
+        Effect.catchTag("GitFailure", (): Effect.Effect<readonly string[]> => Effect.succeed([])),
+      );
     const imported = (yield* Effect.forEach(next, read, { concurrency: 16 })).flat();
     next = [...new Set(imported)].filter((file) => !loaded.has(file));
   }
   return loaded;
 });
 
-const readTestTree = Effect.fn("readTestTree")(function* (paths: Iterable<string>) {
+const loadedByPreloads = Effect.fn("loadedByPreloads")(function* (rev: string, preloads: readonly string[], paths: ReadonlySet<string>, mains: ReadonlyMap<string, string> = new Map()) {
+  return yield* transitivelyImported(rev, preloads.flatMap((preload) => importedFile(preload, paths, mains)), paths, mains);
+});
+
+const mainOf = (text: string) =>
+  Effect.try({
+    try: (): unknown => JSON.parse(text),
+    catch: () => new ScopeError({ message: "package.json does not parse as JSON holding a main entry" }),
+  }).pipe(
+    Effect.map((parsed) => {
+      if (!isRecord(parsed)) return undefined;
+      const main = parsed["main"];
+      return typeof main === "string" && main.trim() !== "" ? main : undefined;
+    }),
+    Effect.catchTag("ScopeError", () => Effect.succeed(undefined)),
+  );
+
+const readMains = Effect.fn("readMains")(function* (rev: string, paths: ReadonlySet<string>) {
+  const packages = [...paths].filter((path) => path === "package.json" || path.endsWith("/package.json"));
+  const entries = yield* Effect.forEach(
+    packages,
+    (file) => git(["show", `${rev}:${file}`]).pipe(Effect.map((text): readonly [string, string] => [file, text]), Effect.catchTag("GitFailure", () => Effect.succeed(undefined))),
+    { concurrency: 16 },
+  );
+  const mains = new Map<string, string>();
+  for (const entry of entries) {
+    if (entry === undefined) continue;
+    const [file, text] = entry;
+    const main = yield* mainOf(text);
+    const directory = file.includes("/") ? file.slice(0, file.lastIndexOf("/")) : "";
+    mains.set(directory, main === undefined ? file : resolved(directory, main));
+  }
+  return mains;
+});
+
+const readFiles = Effect.fn("readFiles")(function* (files: readonly string[]) {
   const fs = yield* FileSystem.FileSystem;
-  const files = [...paths].filter((path) => path.startsWith(TEST_TREE) && READ_FILE.test(path));
   const read = (file: string) => fs.readFileString(file).pipe(Effect.map((text) => [file, text] as const));
   return new Map(yield* Effect.forEach(files, read, { concurrency: 16 }));
 });
 
+const readTestTree = Effect.fn("readTestTree")(function* (paths: Iterable<string>) {
+  return yield* readFiles([...paths].filter((path) => path.startsWith(TEST_TREE) && READ_FILE.test(path)));
+});
+
+const GRAPH_FILE = /\.(?:tsx?|mts|cts|jsx?|mjs|cjs)$/;
+
+const readImportGraph = Effect.fn("readImportGraph")(function* (paths: Iterable<string>) {
+  return yield* readFiles([...paths].filter((path) => GRAPH_FILE.test(path)));
+});
+
 const loadBaseline = Effect.fn("loadBaseline")(function* (report: string | undefined, tests: ReadonlySet<string>) {
   const fs = yield* FileSystem.FileSystem;
   if (report === undefined || !(yield* fs.exists(report))) {
@@ -308,6 +272,30 @@ const unitReaders = Effect.fn("unitReaders")(function* (picked: Picked, { base,
   return readers;
 });
 
+export type Staleness = { readonly paths: ReadonlySet<string>; readonly preload: string | undefined; readonly stale: readonly string[]; readonly config: ReadonlySet<string> };
+
+export const stalenessSince = Effect.fn("stalenessSince")(function* (base: string, head: string) {
+  const picked = pickFromDiff(yield* changedPaths(base, head, []), () => false);
+  const atBase = new Set(yield* pathsAt(base, []));
+  const atHead = new Set(yield* pathsAt(head, []));
+  const preloads = { atBase: yield* preloadsAt(base, atBase), atHead: yield* preloadsAt(head, atHead) };
+  const mains = new Map([...(yield* readMains(base, atBase)), ...(yield* readMains(head, atHead))]);
+  const loaded = new Set([...(yield* loadedByPreloads(head, preloads.atHead, atHead, mains)), ...(yield* loadedByPreloads(base, preloads.atBase, atBase, mains))]);
+  const preload = preloadChange(picked.paths, preloads, loaded);
+  const active = { atBase: STRYKER_CONFIGS.find((name) => atBase.has(name)), atHead: STRYKER_CONFIGS.find((name) => atHead.has(name)) };
+  const config = new Set([
+    ...(yield* transitivelyImported(head, active.atHead === undefined ? [] : [active.atHead], atHead, mains)),
+    ...(yield* transitivelyImported(base, active.atBase === undefined ? [] : [active.atBase], atBase, mains)),
+  ]);
+  if (preload !== undefined) return { paths: picked.paths, preload, stale: [], config };
+  if (picked.paths.size === 0) return { paths: picked.paths, preload: undefined, stale: [], config };
+  const readers = [...readersOf(yield* readImportGraph(atHead), [...picked.paths], mains)]
+    .filter(([reader]) => isUnitTest(reader))
+    .map(([reader]) => reader);
+  const stale = [...new Set([...[...picked.paths].filter(isUnitTest), ...readers])].toSorted();
+  return { paths: picked.paths, preload: undefined, stale, config };
+});
+
 // An absent coverage edge holds only for a test whose merge-base source is the one the report ran.
 const staleIn = Effect.fn("staleIn")(function* (baseline: Baseline, tests: readonly string[], base: string) {
   const recorded = new Map(Object.entries(baseline.testFiles).map(([file, { source }]) => [file, source]));