@avi2dg/checks 0.56.0 → 0.57.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.57.0
+
+Released 2026-10-27.
+
+### Features
+
+- **testing:** run live tier and four lint gates at night [#13](https://github.com/avi2d/checks/pull/13)
+
+## 0.56.1
+
+Released 2026-10-27.
+
+### Fixes
+
+- **complexity:** merge unused, exports and imports walks into one pass [#12](https://github.com/avi2d/checks/pull/12)
+
 ## 0.56.0
 
 Released 2026-10-27.

package/docs/bins.md

@@ -9,7 +9,7 @@ The kit ships one bin per check, each named `checks-` and called from a package
 ## What runs
 
 `checks-lint` runs each of these gates that applies to the repository, and names every one that fails.
-A gate reads either the working tree or the range `checks-lint` resolves.
+A gate reads either the working tree or the range `checks-lint` resolves, or the whole tree at the head under `checks-lint --night`.
 It scopes tree gates to the change unless `--full` forces the full run, and `--desk` runs the fast tree gates.
 The table groups the gates by vector, the part of a repository each one judges.
 
@@ -19,8 +19,7 @@ The table groups the gates by vector, the part of a repository each one judges.
 | --- | --- | --- | --- |
 | complexity | [`checks-suppressions-ratchet`](gates/checks-suppressions-ratchet.md) | the range | every repository |
 | complexity | [`checks-repetition`](gates/checks-repetition.md) | the range | a repository tracking `*.ts` or `*.tsx` |
-| complexity | [`checks-unused`](gates/checks-unused.md) | the working tree | a repository tracking `*.ts` or `*.tsx` or `*.astro` |
-| complexity | [`checks-exports`](gates/checks-exports.md) | the range | a repository tracking `*.ts` or `*.tsx` |
+| complexity | [`checks-graphwalk`](gates/checks-graphwalk.md) | the range | a repository tracking `*.ts` or `*.tsx` or `*.astro` |
 | quality | [`checks-lint-coverage`](gates/checks-lint-coverage.md) | the working tree | a repository tracking `*.ts` or `*.tsx` or `*.astro` |
 | quality | [`checks-comment-gate`](gates/checks-comment-gate.md) | the range | every repository |
 | quality | [`checks-effect-scope`](gates/checks-effect-scope.md) | the working tree | a repository tracking `oxlint.config.ts` |
@@ -34,11 +33,14 @@ The table groups the gates by vector, the part of a repository each one judges.
 | delivery | [`checks-commit-identity`](gates/checks-commit-identity.md) | the range | every repository |
 | delivery | [`checks-ci-wiring`](gates/checks-ci-wiring.md) | the working tree | every repository |
 | delivery | [`checks-secrets`](gates/checks-secrets.md) | the range | every repository |
-| dependencies | [`checks-imports`](gates/checks-imports.md) | the working tree | a repository tracking `*.ts` or `*.tsx` |
 | dependencies | [`checks-advisories`](gates/checks-advisories.md) | the range | a repository tracking `bun.lock` |
 
 <!-- end generated gates -->
 
+Four of these gates run only at night.
+They are `checks-lint-coverage`, `checks-quarantine-clock`, `checks-repetition` and `checks-suppressions-ratchet`.
+The night-run workflow runs them with `checks-lint --night`, which hands each range gate `--whole-tree HEAD`, so the four judge the whole tree with no base.
+
 These bins run on their own:
 
 - [`checks-test`](gates/checks-test.md) runs the suite as `scripts.test` and refuses a skip without a reason at its test site.
@@ -48,7 +50,7 @@ These bins run on their own:
 - [`checks-mutation-baseline`](gates/checks-mutation-baseline.md) restores the newest mutation baseline from `main`, saves it on a self-hosted runner's disk in place of an artifact, and deletes superseded baselines after a `main` run.
 - [`checks-mutation-scope`](gates/checks-mutation-scope.md) turns a branch's diff into the files its mutation runs mutate.
 - [`checks-subsumed-tests`](gates/checks-subsumed-tests.md) lists each test another test subsumes in a mutation run.
-- [`checks-night-run`](gates/checks-night-run.md) opens or comments on one GitHub issue per finding of a night run on `main`, each file whose mutation score fell and each failing test.
+- [`checks-night-run`](gates/checks-night-run.md) opens or comments on one GitHub issue per finding of a night run on `main`, each file whose mutation score fell, each failing test, and each failed nightly gate.
 - [`checks-changelog`](gates/checks-changelog.md) writes the pending release into `CHANGELOG.md` from the conventional commits since the last release.
 - [`checks-release-notes`](gates/checks-release-notes.md) writes one `CHANGELOG.md` section to a file for a GitHub release.
 - [`checks-release-report`](gates/checks-release-report.md) tells whether the history holds unreleased features or fixes since the last tag.

package/docs/configs/dependency-rules.md

@@ -11,7 +11,7 @@ The kit's dependency-cruiser rules hold a repository's imports, and a repository
 `defineConfig` from `@avi2dg/checks/dependency-cruiser` returns these rules, with or without a config of the repository's own:
 
 - `no-circular`
-- `no-orphans`, which a repository that depends on `astro` gets only by listing its own, as [checks-imports](../gates/checks-imports.md) explains
+- `no-orphans`, which a repository that depends on `astro` gets only by listing its own, as [checks-graphwalk](../gates/checks-graphwalk.md) explains
 - `not-to-dev-dep`, which refuses shipped source importing a dev-only package, and a package listed in `peerDependencies` too is not dev-only
 - `no-non-package-json`, which refuses an import of an installed package that the nearest `package.json` does not declare, and counts a peer that `peerDependenciesMeta` marks optional as declared
 - `not-to-unresolvable`, which refuses a specifier nothing installed answers
@@ -61,9 +61,9 @@ A rule under `forbidden` that takes a kit rule's name replaces that rule whole,
 
 ## Running it
 
-`checks-lint` runs [checks-imports](../gates/checks-imports.md) in the full run, which cruises every tracked TypeScript file against `dependency-cruiser.config.ts`, or against the kit's defaults when the repository holds no config.
+`checks-lint` runs [checks-graphwalk](../gates/checks-graphwalk.md) in the full run, which cruises every tracked TypeScript file against `dependency-cruiser.config.ts`, or against the kit's defaults when the repository holds no config.
 
 ## Related topics
 
-- [checks-imports](../gates/checks-imports.md)
+- [checks-graphwalk](../gates/checks-graphwalk.md)
 - [Why it is shaped this way](../design.md)

package/docs/configs/native-settings.md

@@ -14,11 +14,11 @@ A consuming repository puts each setting in the file its tool reads, and no mani
 | `oxlint.config.ts` | Effect paths and their exemptions, ignore patterns, and any rule or budget the repository sets over the kit's defaults | oxlint and `checks-effect-scope` |
 | `oxlint-suppressions.json` | The existing violations oxlint suppresses, per file and rule | oxlint and `checks-suppressions-ratchet` |
 | `stylelint-suppressions.json` | The existing violations stylelint suppresses, per file and rule | stylelint, `checks-frontend-syntax` and `checks-suppressions-ratchet` |
-| `exports-baseline.json` | The existing unused exports and types, per file, kind and name | `checks-exports` |
+| `exports-baseline.json` | The existing unused exports and types, per file, kind and name | `checks-graphwalk` |
 | `.jscpd.json` | The `path` and `ignore` globs of the files repetition is measured in | jscpd and `checks-repetition` |
-| `knip.config.ts` | The `entry` globs Knip traces unreferenced files from | Knip, `checks-unused` and `checks-exports` |
+| `knip.config.ts` | The `entry` globs Knip traces unreferenced files from | Knip and `checks-graphwalk` |
 | `stylelint.config.ts` | The Baseline target, the token files, the CSS families the repository turns on, and any stylelint rule the repository sets over the kit's families | `checks-frontend-syntax` |
-| `dependency-cruiser.config.ts` | Entry points nothing imports, paths that may import dev dependencies, and import boundaries, when the kit's defaults do not fit | `checks-imports` |
+| `dependency-cruiser.config.ts` | Entry points nothing imports, paths that may import dev dependencies, and import boundaries, when the kit's defaults do not fit | `checks-graphwalk` |
 | `tsconfig.json` | Compiler options, and the Effect language service plugin whose `overrides` and kit severities `checks-effect-scope` writes, keeping every other key | TypeScript and Effect language service |
 | `package.json` | `scripts` with the `checks-vendor` arguments in `prepare`, `author` and `contributors` | Bun, `checks-commit-identity` and `checks-vendor` |
 | `bunfig.toml` | Test discovery and quarantine exclusion | Bun and `checks-test-layout` |
@@ -69,7 +69,7 @@ import { defineConfig } from "@avi2dg/checks/knip";
 export default defineConfig({ entry: ["src/index.ts"] });
 ```
 
-`dependency-cruiser.config.ts` is optional, since `checks-imports` cruises against the kit's defaults without one:
+`dependency-cruiser.config.ts` is optional, since `checks-graphwalk` cruises against the kit's defaults without one:
 
 ```ts
 import { defineConfig } from "@avi2dg/checks/dependency-cruiser";
@@ -93,7 +93,7 @@ export default defineConfig({ baseline: "widely", tokens: false });
 
 The size rules are oxlint's own rules at `error`, which every `oxlint.config.ts` built with `defineConfig` sets over the whole tree, so `bun run lint` fails on any file over them.
 A repository records its existing violations with `oxlint --suppress-all`, which writes them to `oxlint-suppressions.json`.
-`checks-suppressions-ratchet` refuses any count in that file that rises.
+`checks-suppressions-ratchet` refuses every count that file still holds when the night run scans the whole tree.
 `SOURCE_LIMITS` holds the limits for sources and `TEST_LIMITS` the limits for tests:
 
 <!-- generated size-limits: bun run build writes it from SOURCE_LIMITS, TEST_LIMITS, SOURCES and TESTS in src/quality/presets/oxlint.ts and scripts/doc-blocks.ts -->

package/docs/design.md

@@ -125,9 +125,10 @@ A gate then behaves the same alone or through `checks-lint`, and `lint-coverage.
 The gates run one at a time and pass their output straight through, so each report reads whole and in the order of the gate table.
 `checks-lint` picks the gates that apply from the tracked files for the full run, and a repository cannot select gates.
 A scoped run selects a subset by changed paths, and the desk run selects the fast tree gates.
-A TypeScript gate applies as soon as the repository tracks TypeScript source, and `checks-lint-coverage` and `checks-unused` also apply on tracked Astro source.
+A TypeScript gate applies as soon as the repository tracks TypeScript source, and `checks-lint-coverage` and `checks-graphwalk` also apply on tracked Astro source.
+`checks-lint-coverage` and `checks-repetition` run only at night.
 
-dependency-cruiser runs as the `checks-imports` gate rather than as a script each repository adds to `lint`, so the full run keeps it.
+dependency-cruiser runs inside the `checks-graphwalk` gate rather than as a script each repository adds to `lint`, so the full run keeps it.
 A repository with no config of its own is cruised against the kit's defaults, since every rule has one.
 The gate cruises the tracked TypeScript, so a build output or a linked library outside git never reaches the cruise.
 It runs dependency-cruiser under Bun, which loads a TypeScript config wherever it sits, the kit's defaults under `node_modules` among them.
@@ -162,6 +163,7 @@ A stylesheet already over 400 lines fails until it is split, whatever the suppre
 `checks-repetition` runs jscpd at both ends of the range with the head's `.jscpd.json`, so the same `path` and `ignore` globs pick the files at both ends.
 It compares each file's count of repeated lines, and does not use jscpd's `--baseline-from-ref`.
 That flag reports a repeated block as new once its text changes, so a change that shortens an existing repeated block would fail.
+At night `checks-lint --night` runs both ratchets over the whole tree with no base, so every suppression count and every repeated line still present fails until it is removed.
 
 ## checks-test runs the suite itself
 

package/docs/gates/checks-frontend-syntax.md

@@ -54,14 +54,14 @@ The builder changes four of the shared config's rules:
 - In an `.html` or `.astro` file, `declaration-block-single-line-max-declarations` is off, since a `style` attribute is one line.
 
 The comment rule refuses every comment but a sourcemap `/*# */` one, which stylelint passes to keep the map.
-CSS repetition is not a family of this gate: a repository adds `"css"` to `format` in `.jscpd.json`, and [checks-repetition](checks-repetition.md) then fails when a stylesheet's repeated lines grow.
+CSS repetition is not a family of this gate: a repository adds `"css"` to `format` in `.jscpd.json`, and [checks-repetition](checks-repetition.md) then fails at night on every repeated line a stylesheet still holds.
 A stylesheet's length is not a family of this gate either, and [checks-css-size](checks-css-size.md) fails one that holds more than 400 lines.
 
 ### What no comment turns off
 
 It sets stylelint's `ignoreDisables`, so a `stylelint-disable` comment silences nothing in either run, and [checks-comment-gate](checks-comment-gate.md) refuses one on the line that adds it.
 A repository adopts a family over existing problems by counting them in `stylelint-suppressions.json` with `--suppress`.
-stylelint lets a file and rule through while its problems stay within the count, and [checks-suppressions-ratchet](checks-suppressions-ratchet.md) fails a change that raises a count.
+stylelint lets a file and rule through while its problems stay within the count, and the nightly [checks-suppressions-ratchet](checks-suppressions-ratchet.md) fails on every count still present until it is removed.
 `--suppress` counts only what the repository run reports, and a file that does not parse still fails in the kit run.
 
 ### Files

package/docs/gates/checks-graphwalk.md

@@ -0,0 +1,126 @@
+---
+kind: reference
+audience: consumers
+---
+# checks-graphwalk
+
+`checks-graphwalk` is the gate that judges unreferenced files, unused exports and import violations together, running Knip once over the working tree for unreferenced files and unused exports and dependency-cruiser once for import violations, plus Knip once more on the base checkout when the range adds baseline entries.
+
+## What it checks
+
+It runs Knip once with the repository's own configuration and names each `.ts`, `.tsx` or `.astro` file no entry reaches.
+It names each exported value and type no file imports from the same run, so one graph build feeds both findings.
+It reads only the files, exports and types issue types, so an unused dependency never fails it.
+It asks Knip for those issue types itself, so a configuration that narrows `include` or excludes them still judges them.
+A configuration that turns the exports or types rules off silences those symbols, so keep both rules on.
+A configuration that turns the files rule off still has its files judged.
+It holds each reported symbol against `exports-baseline.json`, and fails on any symbol the baseline does not hold.
+It fails on any baseline entry the range adds unless Knip reports that same symbol unused at the base, so the baseline records debt that already existed and never debt the range creates.
+It fails on any baseline entry Knip no longer reports, so the baseline only shrinks.
+It runs dependency-cruiser over every tracked `.ts`, `.tsx`, `.mts` and `.cts` file and names each violation with its rule, the importing module and the module it reaches.
+It fails on a violation whose rule has `error` severity, and lists a `warn` or `info` violation without failing.
+It fails when the repository tracks no `.ts`, `.tsx`, `.astro`, `.mts` or `.cts` file, since an empty scan would pass without judging anything.
+It fails when the repository holds no Knip configuration, since Knip's default entries cannot tell a dead file from an entry point.
+
+In a repository whose `package.json` lists `astro` under `dependencies` or `devDependencies`, the kit's defaults leave `no-orphans` out.
+The cruise never reads an `.astro` file, so a `.ts` module only a page imports would read as an orphan.
+The unreferenced-files section already names each file no entry reaches there, and it reads `.astro` imports.
+A repository that wants the rule back lists its own `no-orphans` under `forbidden` in `dependency-cruiser.config.ts`.
+
+## What it reads
+
+It runs Knip and dependency-cruiser over the working tree, so an uncommitted file is judged like a committed one.
+It reads the repository's Knip configuration, which names the entries.
+The repository writes `knip.config.ts` with the kit's builder, which requires `entry`, the files nothing imports:
+
+```ts
+import { defineConfig } from "@avi2dg/checks/knip";
+
+export default defineConfig({ entry: ["src/index.ts"] });
+```
+
+The builder sets `include` to unreferenced files alone, and adds `tests/**/*.test.ts`, `dependency-cruiser.config.ts` and `oxlint.config.ts` to the entries.
+In a repository that depends on `astro`, Knip reads `.astro` imports, so a file only an `.astro` entry imports counts as used and an `.astro` file no entry reaches is named.
+The gate resolves the Knip binary from the installed kit, so a consumer installs nothing beyond the kit.
+It reads `exports-baseline.json` in the repository root, which holds each accepted unused export as a file, kind and name triple.
+It reads `exports-baseline.json` again at the base of the range, where a commit without the file counts as empty.
+When the range adds baseline entries, it runs Knip again on a temporary checkout of the base and removes the checkout when it ends.
+That checkout links the repository's `node_modules`, so a configuration importing the kit's builder loads there too.
+It cruises against the first config it finds there:
+
+1. `dependency-cruiser.config.ts`, which calls `defineConfig` from `@avi2dg/checks/dependency-cruiser`.
+1. A config under one of dependency-cruiser's own names, such as `.dependency-cruiser.cjs`.
+1. The kit's defaults, which `defineConfig()` returns with no argument.
+
+It runs dependency-cruiser from the installed kit under Bun, which loads a TypeScript config wherever it sits.
+It leaves out a tracked file the working tree no longer holds.
+
+## Arguments
+
+```sh
+checks-graphwalk
+checks-graphwalk <ref>
+checks-graphwalk <base-ref> <head-ref>
+checks-graphwalk --write
+```
+
+With no argument it judges `HEAD` alone.
+With one the base is that commit's parent, or the empty tree for a repository's first commit, where nothing counts as already unused.
+With two arguments the base is where the head branched off, at their merge-base.
+When the checked-out commit is a merge of the head ref and one other commit, as a pull request's default checkout is, the base is that other commit instead.
+So under `checks-lint` a pull request's merge checkout is judged against the base branch tip it merges, and a symbol that branch already baselined does not count as added.
+With `--write` it records every unused export and type Knip reports into `exports-baseline.json`, the way `oxlint --suppress-all` seeds `oxlint-suppressions.json`.
+
+A repository adopting the gate runs `checks-graphwalk --write` on a branch that changes no source and commits the file it writes.
+The gate passes that range, since Knip reports every seeded symbol unused at the base too.
+A seed written after the range adds a dead export, or after it removes the last import of one, fails on that symbol.
+
+## Exit codes
+
+| Code | When |
+| --- | --- |
+| 0 | no file is unreferenced, no symbol is unlisted, added or stale, and no import breaks an `error` rule, or `--write` recorded the baseline |
+| 1 | a file is unreferenced, a symbol is unlisted, added or stale, an import breaks an `error` rule, or the repository holds no Knip configuration |
+| 2 | a ref does not resolve, a scanner cannot run, or a Knip report, a cruise report or the baseline does not parse |
+
+The gate exits 1 when any section reports a violation, and exits 2 only when no section reports one and at least one section cannot decide.
+
+It also exits 2 when the repository tracks no `.ts`, `.tsx`, `.astro`, `.mts` or `.cts` file, or, with `--write`, when it tracks no TypeScript file.
+A repository that tracks `.astro` files but no `.ts`, `.tsx`, `.mts` or `.cts` file prints only the unreferenced-files section.
+
+## Sample output
+
+```
+unused: 1 unreferenced file(s):
+  src/dead.ts
+exports: 2 unused export(s) not in exports-baseline.json:
+  src/used.ts: unusedExport (export)
+  src/used.ts: UnusedOptions (type)
+imports: 1 violation(s) in 5 module(s) cruised against the kit's defaults
+  error no-orphans: src/dead.ts
+```
+
+A passing run counts what each section judged:
+
+```
+unused: no unreferenced files among 3 tracked .ts/.tsx/.astro file(s)
+exports: no unused exports or types
+imports: 3 module(s) cruised against the kit's defaults, no violation
+```
+
+A passing run with a held baseline counts what it holds:
+
+```
+exports: 2 unused export(s) in exports-baseline.json, and no new ones
+```
+
+## When it runs
+
+`checks-lint` runs it over each pull request's range when the repository tracks a `.ts`, `.tsx` or `.astro` file.
+Such a repository names its entries in a Knip configuration.
+
+## Related topics
+
+- [checks-lint](checks-lint.md)
+- [checks-repetition](checks-repetition.md)
+- [The dependency rules](../configs/dependency-rules.md)

package/docs/gates/checks-lint-coverage.md

@@ -53,7 +53,8 @@ lint-coverage: the program tsconfig.json builds holds the ts-reset rules is-arra
 
 ## When it runs
 
-`checks-lint` runs it in the full run when the repository tracks a `.ts`, `.tsx` or `.astro` file.
+`checks-lint --night` runs it nightly when the repository tracks a `.ts`, `.tsx` or `.astro` file.
+No pull request run selects it.
 
 ## Related topics
 

package/docs/gates/checks-lint.md

@@ -4,18 +4,19 @@ audience: consumers
 ---
 # checks-lint
 
-`checks-lint` runs every applicable kit lint gate in the selected set over one range and reports each failure.
+`checks-lint` runs every applicable gate in the selected set and reports each failure.
 
 ## What it checks
 
 It runs the gates under [What runs](../bins.md#what-runs), each in its own process.
+With `--night` it runs the four nightly gates instead.
 It scopes the run to the gates the change reaches, and the full run stays the fallback.
 Applicability below selects the full run, and a scoped or desk run selects a subset.
 A Markdown change runs the range gates plus `checks-copy`.
 A TypeScript source change runs every applicable gate.
 A test file classifies as TypeScript, so its change runs every applicable gate too.
 Gates requiring tracked TypeScript files begin running when the repository tracks TypeScript.
-`checks-lint-coverage` and `checks-unused` also begin running when the repository tracks an `.astro` file.
+`checks-lint-coverage` and `checks-graphwalk` also begin running when the repository tracks an `.astro` file.
 `checks-advisories` begins running when the repository tracks `bun.lock`.
 `checks-lint` defers its scan to the scheduled run, so the desk and the pull request fetch no database.
 `checks-frontend-syntax` begins running when the repository tracks `frontend-syntax.json` at its root.
@@ -31,6 +32,7 @@ A local run with `GITHUB_BASE_REF` set starts at that branch on `origin` instead
 A clone with no remote tracking refs checks `HEAD` alone.
 On a pull request the range ends at the event's head commit and starts at its merge base with the event's base branch.
 Tree gates read the working tree rather than the range.
+With `--night` the range gates read the whole tree at `HEAD` instead of a range.
 
 ## Arguments
 
@@ -38,11 +40,13 @@ Tree gates read the working tree rather than the range.
 checks-lint
 checks-lint [--full | --desk]
 checks-lint [--full | --desk] <base-ref> <head-ref>
+checks-lint --night
 ```
 
 With two arguments, the base and head override range discovery.
 `--full` forces the unscoped run.
 `--desk` runs the fast tree gates.
+With `--night`, it takes no other arguments and runs the four nightly gates over the whole tree.
 
 ## Exit codes
 
@@ -54,11 +58,11 @@ With two arguments, the base and head override range discovery.
 
 ## Sample output
 
-<!-- generated lint-sample: bun run build writes it from KIT_GATES in src/core/gates.ts and scripts/doc-blocks.ts -->
+<!-- generated lint-sample: bun run build writes it from PR_GATES in src/core/gates.ts and scripts/doc-blocks.ts -->
 
 ```
 checks-lint: range 2504acf098d120e73a8ece3c96f22b934f35c6a8..10ba7d8935b73ed72624120a1542e51bd21ca7c7 from HEAD against origin/main
-checks-lint: 1 of 19 gate(s) failed: checks-comment-gate
+checks-lint: 1 of 13 gate(s) failed: checks-comment-gate
 ```
 
 <!-- end generated lint-sample -->
@@ -66,9 +70,10 @@ checks-lint: 1 of 19 gate(s) failed: checks-comment-gate
 ## When it runs
 
 A repository runs it from `bun run lint` in a pull request workflow that fetches the whole git history.
-It leaves out the TypeScript gates while the repository tracks no TypeScript file, except that `checks-lint-coverage` and `checks-unused` run when it tracks an `.astro` file.
+It leaves out the TypeScript gates while the repository tracks no TypeScript file, except that `checks-lint-coverage` and `checks-graphwalk` run when it tracks an `.astro` file.
 It never runs `checks-browser`, which a product runs after it builds its site.
 A pull request run scopes the gates to the change.
+A repository runs the four nightly gates from its night-run workflow with `checks-lint --night` over the whole tree.
 
 ## Related topics
 

package/docs/gates/checks-night-run.md

@@ -4,7 +4,7 @@ audience: consumers
 ---
 # checks-night-run
 
-`checks-night-run` turns a night run on `main` into GitHub issues, one for each file whose mutation score fell and one for each failing test.
+`checks-night-run` turns a night run on `main` into GitHub issues, one for each file whose mutation score fell, one for each failing test, and one for each failed nightly gate.
 
 ## What it checks
 
@@ -15,6 +15,9 @@ A file only one night holds is no finding, since it lacks one of the two scores.
 A file with no scored mutant has no score, so it is no finding either.
 An equal score is no finding, even when it counts other mutants.
 Each failing test in a JUnit report is a finding, whatever the previous night holds.
+Each nightly gate the lint log names as failed is a finding.
+A log where every named gate is undecided files `checks-lint` itself, with no per-gate issue.
+A log with no passing run and no named gate files `checks-lint` itself, so a gate run that never finished still reaches an issue.
 A file whose test worker crashed is one finding, since Bun reports none of its tests.
 With no previous night it compares no score and still files each failing test.
 With no mutation report it compares and records no score and still files each failing test.
@@ -26,6 +29,7 @@ Each finding has a key that stays the same from night to night:
 | a file whose mutation score fell | `mutation:<file>` |
 | a failing test | `test:<file> > <describe> > <name>` |
 | a file whose test worker crashed | `test:<file>` |
+| a nightly gate that failed | `gates:<gate>` |
 
 ## How it files a finding
 
@@ -33,8 +37,8 @@ It creates the `night-run` label when the repository lacks it.
 It reads every open issue labelled `night-run`, and reads the key each one carries in a hidden marker in its body.
 A finding whose key an open issue carries gets one comment on that issue, so a regression that lasts two nights stays one issue.
 Any other finding opens one issue labelled `night-run`.
-The issue and the comment name tonight's run, the file and either the test or the score of both nights.
-The body holds the file, the full test name and the finding key.
+The issue and the comment name tonight's run, the file and the test, the score of both nights or the failed gate.
+The body holds the file, the full test name or the failed gate, and the finding key.
 A title longer than GitHub's 256 characters is cut to at most 256 and ends in `…`.
 A night with no finding makes no call to GitHub's issues or labels at all.
 Closing an issue ends it, and the same finding on a later night opens a new one.
@@ -44,6 +48,7 @@ A run on any ref but `refs/heads/main` files no issue and records no score, and
 ## What it reads
 
 It reads tonight's Stryker `mutation.json` report, when the mutation run left one, and any number of JUnit reports, such as the ones `checks-test --junit=<file>` keeps, as [checks-test](checks-test.md#arguments) says.
+It reads the lint log `--gates` names for the `gate(s) failed:` line `checks-lint --night` prints.
 It scans the newest 30 successful runs of the same workflow on `main` from newest to oldest.
 It takes the first run whose `night-run` artifact still exists as the previous night.
 That artifact holds `night-run.json`, the scores the run recorded.
@@ -56,11 +61,12 @@ It calls `gh` with the job's `GH_TOKEN`, which needs `actions: read` for the pre
 ## Arguments
 
 ```sh
-checks-night-run [--mutation <mutation-report>] [--tests <junit-report>]...
+checks-night-run [--mutation <mutation-report>] [--tests <junit-report>]... [--gates <lint-log>]
 ```
 
 `--mutation` names tonight's Stryker report and is given at most once.
 `--tests` names one JUnit report and is given once per report.
+`--gates` names tonight's `checks-lint --night` log and is given at most once.
 At least one report is given.
 
 ## Exit codes
@@ -68,7 +74,7 @@ At least one report is given.
 | Code | When |
 | --- | --- |
 | 0 | it filed every finding and recorded tonight's scores, it found nothing to file, or the run is off `main` and it listed each finding |
-| 2 | an argument does not parse, a report does not decode, a GitHub Actions variable is unset or a `gh` call fails |
+| 2 | an argument does not parse, a report or the lint log does not decode, a GitHub Actions variable is unset or a `gh` call fails |
 
 It never exits 1, because a finding becomes an issue rather than a failed run.
 
@@ -83,7 +89,7 @@ checks-night-run: recorded 42 file score(s) in reports/night-run.json
 
 ## When it runs
 
-Only a night workflow the repository writes runs it, after that workflow's full mutation run and its long test tiers.
+Only a night workflow the repository writes runs it, after that workflow's full mutation run, its long test tiers and its nightly lint gates.
 
 ## Running it at night
 
@@ -132,8 +138,24 @@ jobs:
           name: night-run-tests
           path: reports/night-run-tests/
           retention-days: 1
+  gates:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: .bun-version
+      - run: bun install --frozen-lockfile
+      - run: mkdir -p reports/night-run-gates && bunx checks-lint --night > reports/night-run-gates/gates.log 2>&1 || true
+      - uses: actions/upload-artifact@v4
+        with:
+          name: night-run-gates
+          path: reports/night-run-gates/
+          retention-days: 1
   report:
-    needs: [mutation, tests]
+    needs: [mutation, gates, tests]
     if: ${{ !cancelled() && needs.tests.result == 'success' }}
     runs-on: ubuntu-latest
     permissions:
@@ -151,13 +173,18 @@ jobs:
         with:
           name: night-run-mutation
           path: reports/mutation
+      - if: needs.gates.result == 'success'
+        uses: actions/download-artifact@v4
+        with:
+          name: night-run-gates
+          path: reports/night-run-gates
       - uses: actions/download-artifact@v4
         with:
           name: night-run-tests
           path: reports/night-run-tests
       - env:
           GH_TOKEN: ${{ github.token }}
-        run: bunx checks-night-run ${{ needs.mutation.result == 'success' && '--mutation reports/mutation/mutation.json' || '' }} --tests reports/night-run-tests/live.xml --tests reports/night-run-tests/pixel.xml
+        run: bunx checks-night-run ${{ needs.mutation.result == 'success' && '--mutation reports/mutation/mutation.json' || '' }} --tests reports/night-run-tests/live.xml --tests reports/night-run-tests/pixel.xml ${{ needs.gates.result == 'success' && '--gates reports/night-run-gates/gates.log' || '' }}
       - uses: actions/upload-artifact@v4
         with:
           name: night-run
@@ -171,14 +198,16 @@ A repository takes minute 7 of its own tier's 30 minute night window, so reposit
 The tests job runs each long tier the repository holds, `live` and `pixel` as [checks-test](checks-test.md#test-tiers) names them, and keeps each JUnit report.
 Each `|| true` lets the job go on to the upload after a failing test, since that test becomes an issue.
 A tier that writes no report fails the report job, because `checks-night-run` cannot read it.
+The gates job runs the nightly lint gates and keeps the log, since a failing gate becomes an issue.
 The report job runs whenever the tests job succeeds, so a failing test that also stops Stryker still becomes an issue.
 It passes `--mutation` only when the mutation job succeeded, and the failed mutation job still fails the run.
+It passes `--gates` only when the gates job succeeded, and the failed gates job still fails the run.
 The concurrency group queues a run started by hand behind the scheduled one, so two runs never file the same finding twice.
 A dispatch on a branch runs both jobs and lists its findings in the report job's log, and `if-no-files-found: ignore` lets that run upload no record.
 `issues: write` on the report job is the one permission beyond reading the repository and its runs.
 A public repository keeps `runs-on: ubuntu-latest` on every job.
 A private repository sets `runs-on` on the mutation job to the labels declared under `checks.mutationRunner` in `package.json`, and [checks-ci-wiring](checks-ci-wiring.md#runners) refuses a mutation job that names `CI_RUNS_ON`.
-A private repository sets `runs-on: ${{ vars.CI_RUNS_ON || 'ubuntu-latest' }}` on the tests and report jobs.
+A private repository sets `runs-on: ${{ vars.CI_RUNS_ON || 'ubuntu-latest' }}` on the tests, gates, and report jobs.
 A successful run uploads `night-run`, so the next night compares with it, and a failed run uploads nothing a later night reads.
 The artifact keeps 90 days, so a gap of nights still leaves a previous night to compare with.
 

package/docs/gates/checks-no-plain-js.md

@@ -57,4 +57,4 @@ no-plain-js: 2 violation(s)
 
 - [checks-lint](checks-lint.md)
 - [checks-test-layout](checks-test-layout.md)
-- [checks-unused](checks-unused.md)
+- [checks-graphwalk](checks-graphwalk.md)

package/docs/gates/checks-quarantine-clock.md

@@ -25,10 +25,12 @@ A rebase keeps the entry's author date and moves the head's committer date forwa
 ```sh
 checks-quarantine-clock <base-ref> <head-ref>
 checks-quarantine-clock <ref>
+checks-quarantine-clock --whole-tree <head-ref>
 ```
 
-With two arguments it judges the head, and the base only satisfies the range `checks-lint` hands every range gate.
+With two arguments it judges the head, and the base must resolve but changes nothing.
 With one it judges that commit, including a repository's first commit.
+With `--whole-tree` it judges the named head, which is the form `checks-lint --night` runs.
 
 ## Exit codes
 
@@ -47,7 +49,7 @@ quarantine-clock: 1 test(s) in tests/quarantine/ is past 30 days; fix each and m
 
 ## When it runs
 
-`checks-lint` runs it over each pull request's range in every repository, as [checks-lint](checks-lint.md) says.
+`checks-lint --night` runs it nightly in every repository, as [checks-lint](checks-lint.md) says.
 A repository with no test file under `tests/quarantine/` passes with nothing checked.
 
 ## Related topics

package/docs/gates/checks-repetition.md

@@ -12,11 +12,12 @@ The gate runs jscpd at 50 tokens and 5 lines against the base and head revisions
 It compares repeated lines for each file, so a decrease in another file never offsets a rise.
 It follows an edited rename back to the original file.
 A file that repeats lines without a rise is advisory.
+At night `checks-lint --night` scans the head alone with no base, so every file that repeats lines at the head fails until the repetition is removed, and no file is advisory.
 A block two bins need goes into a module both import, as `rangeFromArgs` and `checkoutFiles` in `src/core/git.ts` show.
 
 ## What it reads
 
-jscpd reads the head's `.jscpd.json` at both ends, so its `path` and `ignore` globs select the files to measure.
+jscpd reads the head's `.jscpd.json` at each end it scans, so its `path` and `ignore` globs select the files to measure.
 A `path` entry the base revision lacks reads as empty there, so a newly measured folder never fails the scan.
 
 ```json
@@ -27,33 +28,37 @@ A repository that lists `"css"` in `format` measures its stylesheets the same wa
 
 The gate sets the 50 tokens and 5 lines itself, over any the file names.
 A `threshold` the file names never fails the gate, which reads jscpd's report once the scan finishes.
-The bin reads the base and head commits rather than the working tree's file contents.
+The bin reads the named commits rather than the working tree's file contents.
 
 ## Arguments
 
 ```sh
 checks-repetition <base-ref> <head-ref>
 checks-repetition <ref>
+checks-repetition --whole-tree <head-ref>
 ```
 
+With `--whole-tree` it scans the named head alone, which is the form `checks-lint --night` runs.
+
 ## Exit codes
 
 | Code | Result |
 | --- | --- |
-| 0 | No measured file repeated more lines. |
-| 1 | At least one measured file repeated more lines. |
+| 0 | Across a range, no measured file repeated more lines. With `--whole-tree`, no measured file repeats lines at the head. |
+| 1 | Across a range, at least one measured file repeated more lines. With `--whole-tree`, at least one measured file repeats lines at the head. |
 | 2 | A config or ref is invalid, or jscpd cannot run. |
 
 ## Sample output
 
 ```
-repetition: 1 file(s) .jscpd.json holds repeat more lines than where the range starts, at 50 tokens and 5 lines:
-  src/copy.ts: 10 repeated line(s), up from 0
+repetition: 1 file(s) .jscpd.json holds repeat lines at the head, at 50 tokens and 5 lines:
+  src/copy.ts: 10 repeated line(s)
+    src/copy.ts:1-10 repeats src/ledger.ts:1-10
 ```
 
 ## When it runs
 
-`checks-lint` runs it over each pull request's range when the repository tracks a `.ts` or `.tsx` file.
+`checks-lint --night` runs it nightly when the repository tracks a `.ts` or `.tsx` file.
 When the head holds no `.jscpd.json`, the gate reports that no file was measured.
 
 ## Related topics

package/docs/gates/checks-suppressions-ratchet.md

@@ -11,6 +11,7 @@ audience: consumers
 oxlint accepts whatever `oxlint --suppress-all` writes to `oxlint-suppressions.json`, so raising a count to let a new site through passes the lint.
 stylelint accepts `stylelint-suppressions.json` the same way, and writes it in the same shape, a count per rule per file.
 The ratchet fails naming the suppressions file, the file and the rule of each count that rose or appeared.
+At night `checks-lint --night` compares the head against the empty tree, so every count still present is reported until it is removed.
 A count that fell and an entry that went both pass.
 
 ## What it reads
@@ -23,10 +24,12 @@ A commit without a file counts it as empty, so the commit that first adds a base
 ```sh
 checks-suppressions-ratchet <base-ref> <head-ref>
 checks-suppressions-ratchet <ref>
+checks-suppressions-ratchet --whole-tree <head-ref>
 ```
 
 With two arguments it reads the base where the head branched off, at their merge-base, so a count the base branch lowered since does not read as a rise at the head.
 With one it compares that commit with its parent, or with the empty tree for a repository's first commit.
+With `--whole-tree` it compares the named head with the empty tree, which is the form `checks-lint --night` runs.
 
 ## Exit codes
 
@@ -46,8 +49,8 @@ suppressions-ratchet: 2 count(s) rose or appeared; fix the site instead of suppr
 
 ## When it runs
 
-`checks-lint` runs it over each pull request's range in every repository, as [checks-lint](checks-lint.md) says.
-A repository with neither file passes, since both ends count as empty.
+`checks-lint --night` runs it nightly in every repository, as [checks-lint](checks-lint.md) says.
+A repository with neither file passes.
 
 ## Related topics