@avi2dg/checks 0.56.1 → 0.57.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.57.0
+
+Released 2026-10-27.
+
+### Features
+
+- **testing:** run live tier and four lint gates at night [#13](https://github.com/avi2d/checks/pull/13)
+
 ## 0.56.1
 
 Released 2026-10-27.

package/docs/bins.md

@@ -9,7 +9,7 @@ The kit ships one bin per check, each named `checks-` and called from a package
 ## What runs
 
 `checks-lint` runs each of these gates that applies to the repository, and names every one that fails.
-A gate reads either the working tree or the range `checks-lint` resolves.
+A gate reads either the working tree or the range `checks-lint` resolves, or the whole tree at the head under `checks-lint --night`.
 It scopes tree gates to the change unless `--full` forces the full run, and `--desk` runs the fast tree gates.
 The table groups the gates by vector, the part of a repository each one judges.
 
@@ -37,6 +37,10 @@ The table groups the gates by vector, the part of a repository each one judges.
 
 <!-- end generated gates -->
 
+Four of these gates run only at night.
+They are `checks-lint-coverage`, `checks-quarantine-clock`, `checks-repetition` and `checks-suppressions-ratchet`.
+The night-run workflow runs them with `checks-lint --night`, which hands each range gate `--whole-tree HEAD`, so the four judge the whole tree with no base.
+
 These bins run on their own:
 
 - [`checks-test`](gates/checks-test.md) runs the suite as `scripts.test` and refuses a skip without a reason at its test site.
@@ -46,7 +50,7 @@ These bins run on their own:
 - [`checks-mutation-baseline`](gates/checks-mutation-baseline.md) restores the newest mutation baseline from `main`, saves it on a self-hosted runner's disk in place of an artifact, and deletes superseded baselines after a `main` run.
 - [`checks-mutation-scope`](gates/checks-mutation-scope.md) turns a branch's diff into the files its mutation runs mutate.
 - [`checks-subsumed-tests`](gates/checks-subsumed-tests.md) lists each test another test subsumes in a mutation run.
-- [`checks-night-run`](gates/checks-night-run.md) opens or comments on one GitHub issue per finding of a night run on `main`, each file whose mutation score fell and each failing test.
+- [`checks-night-run`](gates/checks-night-run.md) opens or comments on one GitHub issue per finding of a night run on `main`, each file whose mutation score fell, each failing test, and each failed nightly gate.
 - [`checks-changelog`](gates/checks-changelog.md) writes the pending release into `CHANGELOG.md` from the conventional commits since the last release.
 - [`checks-release-notes`](gates/checks-release-notes.md) writes one `CHANGELOG.md` section to a file for a GitHub release.
 - [`checks-release-report`](gates/checks-release-report.md) tells whether the history holds unreleased features or fixes since the last tag.

package/docs/configs/native-settings.md

@@ -93,7 +93,7 @@ export default defineConfig({ baseline: "widely", tokens: false });
 
 The size rules are oxlint's own rules at `error`, which every `oxlint.config.ts` built with `defineConfig` sets over the whole tree, so `bun run lint` fails on any file over them.
 A repository records its existing violations with `oxlint --suppress-all`, which writes them to `oxlint-suppressions.json`.
-`checks-suppressions-ratchet` refuses any count in that file that rises.
+`checks-suppressions-ratchet` refuses every count that file still holds when the night run scans the whole tree.
 `SOURCE_LIMITS` holds the limits for sources and `TEST_LIMITS` the limits for tests:
 
 <!-- generated size-limits: bun run build writes it from SOURCE_LIMITS, TEST_LIMITS, SOURCES and TESTS in src/quality/presets/oxlint.ts and scripts/doc-blocks.ts -->

package/docs/design.md

@@ -126,6 +126,7 @@ The gates run one at a time and pass their output straight through, so each repo
 `checks-lint` picks the gates that apply from the tracked files for the full run, and a repository cannot select gates.
 A scoped run selects a subset by changed paths, and the desk run selects the fast tree gates.
 A TypeScript gate applies as soon as the repository tracks TypeScript source, and `checks-lint-coverage` and `checks-graphwalk` also apply on tracked Astro source.
+`checks-lint-coverage` and `checks-repetition` run only at night.
 
 dependency-cruiser runs inside the `checks-graphwalk` gate rather than as a script each repository adds to `lint`, so the full run keeps it.
 A repository with no config of its own is cruised against the kit's defaults, since every rule has one.
@@ -162,6 +163,7 @@ A stylesheet already over 400 lines fails until it is split, whatever the suppre
 `checks-repetition` runs jscpd at both ends of the range with the head's `.jscpd.json`, so the same `path` and `ignore` globs pick the files at both ends.
 It compares each file's count of repeated lines, and does not use jscpd's `--baseline-from-ref`.
 That flag reports a repeated block as new once its text changes, so a change that shortens an existing repeated block would fail.
+At night `checks-lint --night` runs both ratchets over the whole tree with no base, so every suppression count and every repeated line still present fails until it is removed.
 
 ## checks-test runs the suite itself
 

package/docs/gates/checks-frontend-syntax.md

@@ -54,14 +54,14 @@ The builder changes four of the shared config's rules:
 - In an `.html` or `.astro` file, `declaration-block-single-line-max-declarations` is off, since a `style` attribute is one line.
 
 The comment rule refuses every comment but a sourcemap `/*# */` one, which stylelint passes to keep the map.
-CSS repetition is not a family of this gate: a repository adds `"css"` to `format` in `.jscpd.json`, and [checks-repetition](checks-repetition.md) then fails when a stylesheet's repeated lines grow.
+CSS repetition is not a family of this gate: a repository adds `"css"` to `format` in `.jscpd.json`, and [checks-repetition](checks-repetition.md) then fails at night on every repeated line a stylesheet still holds.
 A stylesheet's length is not a family of this gate either, and [checks-css-size](checks-css-size.md) fails one that holds more than 400 lines.
 
 ### What no comment turns off
 
 It sets stylelint's `ignoreDisables`, so a `stylelint-disable` comment silences nothing in either run, and [checks-comment-gate](checks-comment-gate.md) refuses one on the line that adds it.
 A repository adopts a family over existing problems by counting them in `stylelint-suppressions.json` with `--suppress`.
-stylelint lets a file and rule through while its problems stay within the count, and [checks-suppressions-ratchet](checks-suppressions-ratchet.md) fails a change that raises a count.
+stylelint lets a file and rule through while its problems stay within the count, and the nightly [checks-suppressions-ratchet](checks-suppressions-ratchet.md) fails on every count still present until it is removed.
 `--suppress` counts only what the repository run reports, and a file that does not parse still fails in the kit run.
 
 ### Files

package/docs/gates/checks-lint-coverage.md

@@ -53,7 +53,8 @@ lint-coverage: the program tsconfig.json builds holds the ts-reset rules is-arra
 
 ## When it runs
 
-`checks-lint` runs it in the full run when the repository tracks a `.ts`, `.tsx` or `.astro` file.
+`checks-lint --night` runs it nightly when the repository tracks a `.ts`, `.tsx` or `.astro` file.
+No pull request run selects it.
 
 ## Related topics
 

package/docs/gates/checks-lint.md

@@ -4,11 +4,12 @@ audience: consumers
 ---
 # checks-lint
 
-`checks-lint` runs every applicable kit lint gate in the selected set over one range and reports each failure.
+`checks-lint` runs every applicable gate in the selected set and reports each failure.
 
 ## What it checks
 
 It runs the gates under [What runs](../bins.md#what-runs), each in its own process.
+With `--night` it runs the four nightly gates instead.
 It scopes the run to the gates the change reaches, and the full run stays the fallback.
 Applicability below selects the full run, and a scoped or desk run selects a subset.
 A Markdown change runs the range gates plus `checks-copy`.
@@ -31,6 +32,7 @@ A local run with `GITHUB_BASE_REF` set starts at that branch on `origin` instead
 A clone with no remote tracking refs checks `HEAD` alone.
 On a pull request the range ends at the event's head commit and starts at its merge base with the event's base branch.
 Tree gates read the working tree rather than the range.
+With `--night` the range gates read the whole tree at `HEAD` instead of a range.
 
 ## Arguments
 
@@ -38,11 +40,13 @@ Tree gates read the working tree rather than the range.
 checks-lint
 checks-lint [--full | --desk]
 checks-lint [--full | --desk] <base-ref> <head-ref>
+checks-lint --night
 ```
 
 With two arguments, the base and head override range discovery.
 `--full` forces the unscoped run.
 `--desk` runs the fast tree gates.
+With `--night`, it takes no other arguments and runs the four nightly gates over the whole tree.
 
 ## Exit codes
 
@@ -54,11 +58,11 @@ With two arguments, the base and head override range discovery.
 
 ## Sample output
 
-<!-- generated lint-sample: bun run build writes it from KIT_GATES in src/core/gates.ts and scripts/doc-blocks.ts -->
+<!-- generated lint-sample: bun run build writes it from PR_GATES in src/core/gates.ts and scripts/doc-blocks.ts -->
 
 ```
 checks-lint: range 2504acf098d120e73a8ece3c96f22b934f35c6a8..10ba7d8935b73ed72624120a1542e51bd21ca7c7 from HEAD against origin/main
-checks-lint: 1 of 17 gate(s) failed: checks-comment-gate
+checks-lint: 1 of 13 gate(s) failed: checks-comment-gate
 ```
 
 <!-- end generated lint-sample -->
@@ -69,6 +73,7 @@ A repository runs it from `bun run lint` in a pull request workflow that fetches
 It leaves out the TypeScript gates while the repository tracks no TypeScript file, except that `checks-lint-coverage` and `checks-graphwalk` run when it tracks an `.astro` file.
 It never runs `checks-browser`, which a product runs after it builds its site.
 A pull request run scopes the gates to the change.
+A repository runs the four nightly gates from its night-run workflow with `checks-lint --night` over the whole tree.
 
 ## Related topics
 

package/docs/gates/checks-night-run.md

@@ -4,7 +4,7 @@ audience: consumers
 ---
 # checks-night-run
 
-`checks-night-run` turns a night run on `main` into GitHub issues, one for each file whose mutation score fell and one for each failing test.
+`checks-night-run` turns a night run on `main` into GitHub issues, one for each file whose mutation score fell, one for each failing test, and one for each failed nightly gate.
 
 ## What it checks
 
@@ -15,6 +15,9 @@ A file only one night holds is no finding, since it lacks one of the two scores.
 A file with no scored mutant has no score, so it is no finding either.
 An equal score is no finding, even when it counts other mutants.
 Each failing test in a JUnit report is a finding, whatever the previous night holds.
+Each nightly gate the lint log names as failed is a finding.
+A log where every named gate is undecided files `checks-lint` itself, with no per-gate issue.
+A log with no passing run and no named gate files `checks-lint` itself, so a gate run that never finished still reaches an issue.
 A file whose test worker crashed is one finding, since Bun reports none of its tests.
 With no previous night it compares no score and still files each failing test.
 With no mutation report it compares and records no score and still files each failing test.
@@ -26,6 +29,7 @@ Each finding has a key that stays the same from night to night:
 | a file whose mutation score fell | `mutation:<file>` |
 | a failing test | `test:<file> > <describe> > <name>` |
 | a file whose test worker crashed | `test:<file>` |
+| a nightly gate that failed | `gates:<gate>` |
 
 ## How it files a finding
 
@@ -33,8 +37,8 @@ It creates the `night-run` label when the repository lacks it.
 It reads every open issue labelled `night-run`, and reads the key each one carries in a hidden marker in its body.
 A finding whose key an open issue carries gets one comment on that issue, so a regression that lasts two nights stays one issue.
 Any other finding opens one issue labelled `night-run`.
-The issue and the comment name tonight's run, the file and either the test or the score of both nights.
-The body holds the file, the full test name and the finding key.
+The issue and the comment name tonight's run, the file and the test, the score of both nights or the failed gate.
+The body holds the file, the full test name or the failed gate, and the finding key.
 A title longer than GitHub's 256 characters is cut to at most 256 and ends in `…`.
 A night with no finding makes no call to GitHub's issues or labels at all.
 Closing an issue ends it, and the same finding on a later night opens a new one.
@@ -44,6 +48,7 @@ A run on any ref but `refs/heads/main` files no issue and records no score, and
 ## What it reads
 
 It reads tonight's Stryker `mutation.json` report, when the mutation run left one, and any number of JUnit reports, such as the ones `checks-test --junit=<file>` keeps, as [checks-test](checks-test.md#arguments) says.
+It reads the lint log `--gates` names for the `gate(s) failed:` line `checks-lint --night` prints.
 It scans the newest 30 successful runs of the same workflow on `main` from newest to oldest.
 It takes the first run whose `night-run` artifact still exists as the previous night.
 That artifact holds `night-run.json`, the scores the run recorded.
@@ -56,11 +61,12 @@ It calls `gh` with the job's `GH_TOKEN`, which needs `actions: read` for the pre
 ## Arguments
 
 ```sh
-checks-night-run [--mutation <mutation-report>] [--tests <junit-report>]...
+checks-night-run [--mutation <mutation-report>] [--tests <junit-report>]... [--gates <lint-log>]
 ```
 
 `--mutation` names tonight's Stryker report and is given at most once.
 `--tests` names one JUnit report and is given once per report.
+`--gates` names tonight's `checks-lint --night` log and is given at most once.
 At least one report is given.
 
 ## Exit codes
@@ -68,7 +74,7 @@ At least one report is given.
 | Code | When |
 | --- | --- |
 | 0 | it filed every finding and recorded tonight's scores, it found nothing to file, or the run is off `main` and it listed each finding |
-| 2 | an argument does not parse, a report does not decode, a GitHub Actions variable is unset or a `gh` call fails |
+| 2 | an argument does not parse, a report or the lint log does not decode, a GitHub Actions variable is unset or a `gh` call fails |
 
 It never exits 1, because a finding becomes an issue rather than a failed run.
 
@@ -83,7 +89,7 @@ checks-night-run: recorded 42 file score(s) in reports/night-run.json
 
 ## When it runs
 
-Only a night workflow the repository writes runs it, after that workflow's full mutation run and its long test tiers.
+Only a night workflow the repository writes runs it, after that workflow's full mutation run, its long test tiers and its nightly lint gates.
 
 ## Running it at night
 
@@ -132,8 +138,24 @@ jobs:
           name: night-run-tests
           path: reports/night-run-tests/
           retention-days: 1
+  gates:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: .bun-version
+      - run: bun install --frozen-lockfile
+      - run: mkdir -p reports/night-run-gates && bunx checks-lint --night > reports/night-run-gates/gates.log 2>&1 || true
+      - uses: actions/upload-artifact@v4
+        with:
+          name: night-run-gates
+          path: reports/night-run-gates/
+          retention-days: 1
   report:
-    needs: [mutation, tests]
+    needs: [mutation, gates, tests]
     if: ${{ !cancelled() && needs.tests.result == 'success' }}
     runs-on: ubuntu-latest
     permissions:
@@ -151,13 +173,18 @@ jobs:
         with:
           name: night-run-mutation
           path: reports/mutation
+      - if: needs.gates.result == 'success'
+        uses: actions/download-artifact@v4
+        with:
+          name: night-run-gates
+          path: reports/night-run-gates
       - uses: actions/download-artifact@v4
         with:
           name: night-run-tests
           path: reports/night-run-tests
       - env:
           GH_TOKEN: ${{ github.token }}
-        run: bunx checks-night-run ${{ needs.mutation.result == 'success' && '--mutation reports/mutation/mutation.json' || '' }} --tests reports/night-run-tests/live.xml --tests reports/night-run-tests/pixel.xml
+        run: bunx checks-night-run ${{ needs.mutation.result == 'success' && '--mutation reports/mutation/mutation.json' || '' }} --tests reports/night-run-tests/live.xml --tests reports/night-run-tests/pixel.xml ${{ needs.gates.result == 'success' && '--gates reports/night-run-gates/gates.log' || '' }}
       - uses: actions/upload-artifact@v4
         with:
           name: night-run
@@ -171,14 +198,16 @@ A repository takes minute 7 of its own tier's 30 minute night window, so reposit
 The tests job runs each long tier the repository holds, `live` and `pixel` as [checks-test](checks-test.md#test-tiers) names them, and keeps each JUnit report.
 Each `|| true` lets the job go on to the upload after a failing test, since that test becomes an issue.
 A tier that writes no report fails the report job, because `checks-night-run` cannot read it.
+The gates job runs the nightly lint gates and keeps the log, since a failing gate becomes an issue.
 The report job runs whenever the tests job succeeds, so a failing test that also stops Stryker still becomes an issue.
 It passes `--mutation` only when the mutation job succeeded, and the failed mutation job still fails the run.
+It passes `--gates` only when the gates job succeeded, and the failed gates job still fails the run.
 The concurrency group queues a run started by hand behind the scheduled one, so two runs never file the same finding twice.
 A dispatch on a branch runs both jobs and lists its findings in the report job's log, and `if-no-files-found: ignore` lets that run upload no record.
 `issues: write` on the report job is the one permission beyond reading the repository and its runs.
 A public repository keeps `runs-on: ubuntu-latest` on every job.
 A private repository sets `runs-on` on the mutation job to the labels declared under `checks.mutationRunner` in `package.json`, and [checks-ci-wiring](checks-ci-wiring.md#runners) refuses a mutation job that names `CI_RUNS_ON`.
-A private repository sets `runs-on: ${{ vars.CI_RUNS_ON || 'ubuntu-latest' }}` on the tests and report jobs.
+A private repository sets `runs-on: ${{ vars.CI_RUNS_ON || 'ubuntu-latest' }}` on the tests, gates, and report jobs.
 A successful run uploads `night-run`, so the next night compares with it, and a failed run uploads nothing a later night reads.
 The artifact keeps 90 days, so a gap of nights still leaves a previous night to compare with.
 

package/docs/gates/checks-quarantine-clock.md

@@ -25,10 +25,12 @@ A rebase keeps the entry's author date and moves the head's committer date forwa
 ```sh
 checks-quarantine-clock <base-ref> <head-ref>
 checks-quarantine-clock <ref>
+checks-quarantine-clock --whole-tree <head-ref>
 ```
 
-With two arguments it judges the head, and the base only satisfies the range `checks-lint` hands every range gate.
+With two arguments it judges the head, and the base must resolve but changes nothing.
 With one it judges that commit, including a repository's first commit.
+With `--whole-tree` it judges the named head, which is the form `checks-lint --night` runs.
 
 ## Exit codes
 
@@ -47,7 +49,7 @@ quarantine-clock: 1 test(s) in tests/quarantine/ is past 30 days; fix each and m
 
 ## When it runs
 
-`checks-lint` runs it over each pull request's range in every repository, as [checks-lint](checks-lint.md) says.
+`checks-lint --night` runs it nightly in every repository, as [checks-lint](checks-lint.md) says.
 A repository with no test file under `tests/quarantine/` passes with nothing checked.
 
 ## Related topics

package/docs/gates/checks-repetition.md

@@ -12,11 +12,12 @@ The gate runs jscpd at 50 tokens and 5 lines against the base and head revisions
 It compares repeated lines for each file, so a decrease in another file never offsets a rise.
 It follows an edited rename back to the original file.
 A file that repeats lines without a rise is advisory.
+At night `checks-lint --night` scans the head alone with no base, so every file that repeats lines at the head fails until the repetition is removed, and no file is advisory.
 A block two bins need goes into a module both import, as `rangeFromArgs` and `checkoutFiles` in `src/core/git.ts` show.
 
 ## What it reads
 
-jscpd reads the head's `.jscpd.json` at both ends, so its `path` and `ignore` globs select the files to measure.
+jscpd reads the head's `.jscpd.json` at each end it scans, so its `path` and `ignore` globs select the files to measure.
 A `path` entry the base revision lacks reads as empty there, so a newly measured folder never fails the scan.
 
 ```json
@@ -27,33 +28,37 @@ A repository that lists `"css"` in `format` measures its stylesheets the same wa
 
 The gate sets the 50 tokens and 5 lines itself, over any the file names.
 A `threshold` the file names never fails the gate, which reads jscpd's report once the scan finishes.
-The bin reads the base and head commits rather than the working tree's file contents.
+The bin reads the named commits rather than the working tree's file contents.
 
 ## Arguments
 
 ```sh
 checks-repetition <base-ref> <head-ref>
 checks-repetition <ref>
+checks-repetition --whole-tree <head-ref>
 ```
 
+With `--whole-tree` it scans the named head alone, which is the form `checks-lint --night` runs.
+
 ## Exit codes
 
 | Code | Result |
 | --- | --- |
-| 0 | No measured file repeated more lines. |
-| 1 | At least one measured file repeated more lines. |
+| 0 | Across a range, no measured file repeated more lines. With `--whole-tree`, no measured file repeats lines at the head. |
+| 1 | Across a range, at least one measured file repeated more lines. With `--whole-tree`, at least one measured file repeats lines at the head. |
 | 2 | A config or ref is invalid, or jscpd cannot run. |
 
 ## Sample output
 
 ```
-repetition: 1 file(s) .jscpd.json holds repeat more lines than where the range starts, at 50 tokens and 5 lines:
-  src/copy.ts: 10 repeated line(s), up from 0
+repetition: 1 file(s) .jscpd.json holds repeat lines at the head, at 50 tokens and 5 lines:
+  src/copy.ts: 10 repeated line(s)
+    src/copy.ts:1-10 repeats src/ledger.ts:1-10
 ```
 
 ## When it runs
 
-`checks-lint` runs it over each pull request's range when the repository tracks a `.ts` or `.tsx` file.
+`checks-lint --night` runs it nightly when the repository tracks a `.ts` or `.tsx` file.
 When the head holds no `.jscpd.json`, the gate reports that no file was measured.
 
 ## Related topics

package/docs/gates/checks-suppressions-ratchet.md

@@ -11,6 +11,7 @@ audience: consumers
 oxlint accepts whatever `oxlint --suppress-all` writes to `oxlint-suppressions.json`, so raising a count to let a new site through passes the lint.
 stylelint accepts `stylelint-suppressions.json` the same way, and writes it in the same shape, a count per rule per file.
 The ratchet fails naming the suppressions file, the file and the rule of each count that rose or appeared.
+At night `checks-lint --night` compares the head against the empty tree, so every count still present is reported until it is removed.
 A count that fell and an entry that went both pass.
 
 ## What it reads
@@ -23,10 +24,12 @@ A commit without a file counts it as empty, so the commit that first adds a base
 ```sh
 checks-suppressions-ratchet <base-ref> <head-ref>
 checks-suppressions-ratchet <ref>
+checks-suppressions-ratchet --whole-tree <head-ref>
 ```
 
 With two arguments it reads the base where the head branched off, at their merge-base, so a count the base branch lowered since does not read as a rise at the head.
 With one it compares that commit with its parent, or with the empty tree for a repository's first commit.
+With `--whole-tree` it compares the named head with the empty tree, which is the form `checks-lint --night` runs.
 
 ## Exit codes
 
@@ -46,8 +49,8 @@ suppressions-ratchet: 2 count(s) rose or appeared; fix the site instead of suppr
 
 ## When it runs
 
-`checks-lint` runs it over each pull request's range in every repository, as [checks-lint](checks-lint.md) says.
-A repository with neither file passes, since both ends count as empty.
+`checks-lint --night` runs it nightly in every repository, as [checks-lint](checks-lint.md) says.
+A repository with neither file passes.
 
 ## Related topics
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.56.1",
+  "version": "0.57.0",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",
@@ -210,6 +210,7 @@
     "test:fast": "bun scripts/test-fast.ts",
     "test:unit": "bun src/testing/test.ts --tier=unit",
     "test:e2e": "bun src/testing/test.ts --tier=e2e --parallel=4",
+    "test:live": "bun src/testing/test.ts --tier=live",
     "mutate": "bunx stryker run",
     "mutate:incremental": "bunx stryker run --incremental"
   },

package/src/complexity/repetition.ts

@@ -1,7 +1,8 @@
 #!/usr/bin/env bun
 import { Console, Effect, FileSystem, Path, Schema } from "effect";
-import { changedPaths, checkoutFiles, collect, git, pathsAt, rangeFromArgs } from "../core/git.ts";
-import { runMain } from "../core/main.ts";
+import { changedPaths, checkoutFiles, collect, commitOf, git, pathsAt, rangeFromArgs } from "../core/git.ts";
+import { WHOLE_TREE } from "../core/gates.ts";
+import { Usage, runMain } from "../core/main.ts";
 
 export type Fragment = {
   readonly file: string;
@@ -29,7 +30,7 @@ class JscpdUnreadable extends Schema.TaggedError<JscpdUnreadable>()("JscpdUnread
 }) {}
 
 const NAME = "repetition";
-const USAGE = "usage: repetition.ts <ref> | <base-ref> <head-ref>";
+const USAGE = "usage: repetition.ts <ref> | <base-ref> <head-ref> | --whole-tree <head-ref>";
 const MIN_TOKENS = 50;
 const MIN_LINES = 5;
 const MEASURE = `at ${MIN_TOKENS} tokens and ${MIN_LINES} lines`;
@@ -164,31 +165,65 @@ const runHold = Effect.fn("runHold")(function* (root: string, config: string, ba
   return heldOf(sources, rises, after) satisfies Held;
 });
 
+const runWholeTree = Effect.fn("runWholeTree")(function* (root: string, config: string, head: string) {
+  const { sources, clones } = yield* scan(root, head, config, []);
+  const after = repeatedLines(clones);
+  const rises = risesOf([...after.keys()], new Map(), after, new Map(), clones);
+  return heldOf(sources, rises, after) satisfies Held;
+});
+
+function cloneLines(clones: readonly Clone[]): readonly string[] {
+  return clones.map(([own, other]) => `    ${own.file}:${own.start}-${own.end} repeats ${other.file}:${other.start}-${other.end}`);
+}
+
 export function describe({ file, before, after, clones }: Rise): readonly string[] {
-  return [
-    `  ${file}: ${after} repeated line(s), up from ${before}`,
-    ...clones.map(([own, other]) => `    ${own.file}:${own.start}-${own.end} repeats ${other.file}:${other.start}-${other.end}`),
-  ];
+  return [`  ${file}: ${after} repeated line(s), up from ${before}`, ...cloneLines(clones)];
+}
+
+function wholeTreeRise({ file, after, clones }: Rise): readonly string[] {
+  return [`  ${file}: ${after} repeated line(s)`, ...cloneLines(clones)];
 }
 
+const noticeOf = (advisory: Held["advisory"]): readonly string[] =>
+  advisory.size === 0
+    ? []
+    : [
+        `${NAME}: advisory, ${advisory.size} file(s) repeat lines the hold does not fail:`,
+        ...[...advisory].map(([file, lines]) => `  ${file}: ${lines} repeated line(s)`),
+      ];
+
 export function report({ measured, rises, advisory }: Held): string {
   const verdict =
     rises.length === 0
       ? [`${NAME}: ${measured} file(s) ${CONFIG} holds repeat no more lines than where the range starts, ${MEASURE}`]
       : [`${NAME}: ${rises.length} file(s) ${CONFIG} holds repeat more lines than where the range starts, ${MEASURE}:`, ...rises.flatMap(describe)];
-  const notice =
-    advisory.size === 0
-      ? []
-      : [
-          `${NAME}: advisory, ${advisory.size} file(s) repeat lines the hold does not fail:`,
-          ...[...advisory].map(([file, lines]) => `  ${file}: ${lines} repeated line(s)`),
-        ];
-  return [...verdict, ...notice].join("\n");
+  return [...verdict, ...noticeOf(advisory)].join("\n");
+}
+
+export function reportWholeTree({ measured, rises }: Held): string {
+  const verdict =
+    rises.length === 0
+      ? [`${NAME}: ${measured} file(s) ${CONFIG} holds repeat no lines at the head, ${MEASURE}`]
+      : [`${NAME}: ${rises.length} file(s) ${CONFIG} holds repeat lines at the head, ${MEASURE}:`, ...rises.flatMap(wholeTreeRise)];
+  return verdict.join("\n");
 }
 
 const hold = Effect.gen(function* () {
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const { base, head } = yield* rangeFromArgs(process.argv.slice(2), USAGE, root);
+  const args = process.argv.slice(2);
+  if (args[0] === WHOLE_TREE) {
+    const headArg = args[1];
+    if (args.length !== 2 || headArg === undefined) return yield* new Usage({ message: USAGE });
+    const wholeHead = yield* commitOf(headArg);
+    if ((yield* pathsAt(wholeHead, [`:(literal)${CONFIG}`], root)).length === 0) {
+      yield* Console.log(`${NAME}: the head holds no ${CONFIG}, so no file is measured`);
+      return true;
+    }
+    const whole = yield* runWholeTree(root, yield* git(["show", `${wholeHead}:${CONFIG}`], root), wholeHead);
+    yield* Console.log(reportWholeTree(whole));
+    return whole.rises.length === 0;
+  }
+  const { base, head } = yield* rangeFromArgs(args, USAGE, root);
   if ((yield* pathsAt(head, [`:(literal)${CONFIG}`], root)).length === 0) {
     yield* Console.log(`${NAME}: the head holds no ${CONFIG}, so no file is measured`);
     return true;

package/src/complexity/suppressions-ratchet.ts

@@ -1,7 +1,8 @@
 #!/usr/bin/env bun
 import { Console, Effect, Schema } from "effect";
-import { git, commitOf, parentOrEmptyTree, refArgs } from "../core/git.ts";
-import { runMain } from "../core/main.ts";
+import { git, commitOf, emptyTree, parentOrEmptyTree, refArgs } from "../core/git.ts";
+import { WHOLE_TREE } from "../core/gates.ts";
+import { Usage, runMain } from "../core/main.ts";
 
 export const SUPPRESSIONS = ["oxlint-suppressions.json", "stylelint-suppressions.json"] as const;
 
@@ -23,7 +24,7 @@ export class SuppressionsError extends Schema.TaggedError<SuppressionsError>()("
   message: Schema.String,
 }) {}
 
-const USAGE = "usage: suppressions-ratchet.ts <ref> | <base-ref> <head-ref>";
+const USAGE = "usage: suppressions-ratchet.ts <ref> | <base-ref> <head-ref> | --whole-tree <head-ref>";
 
 const parseJson = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown));
 const decodeObject = Schema.decodeUnknownEffect(Schema.Record(Schema.String, Schema.Unknown));
@@ -124,11 +125,19 @@ export const runTip = Effect.fn("runTip")(function* (tip: string) {
   return yield* compareAt(yield* parentOrEmptyTree(tipCommit), tipCommit);
 });
 
+export const runWholeTree = Effect.fn("runWholeTree")(function* (head: string) {
+  return yield* compareAt(yield* emptyTree(), yield* commitOf(head));
+});
+
 const ratchet = Effect.gen(function* () {
   const { first, second } = yield* refArgs(process.argv.slice(2), USAGE);
-
+  if (first === WHOLE_TREE) {
+    if (second === undefined) return yield* new Usage({ message: USAGE });
+    const whole = yield* runWholeTree(second);
+    yield* Console.log(report(whole));
+    return whole.rises.length === 0;
+  }
   const result = second !== undefined ? yield* runRange(first, second) : yield* runTip(first);
-
   yield* Console.log(report(result));
   return result.rises.length === 0;
 });

package/src/core/gates.ts

@@ -26,6 +26,7 @@ export type KitGate = {
   readonly args?: readonly string[];
   readonly env?: Readonly<Record<string, string>>;
   readonly appliesTo: typeof EVERY_REPOSITORY | TrackedContent;
+  readonly night?: true;
 };
 
 export const ENTRY_POINT: Program = { bin: "checks-lint", script: "core/lint.ts" };
@@ -48,8 +49,10 @@ const STYLESHEET: TrackedContent = { pathspecs: ["*.css"], content: "a styleshee
 
 const COPY_DECLARATION: TrackedContent = { pathspecs: ["copy.json"], content: "a copy declaration" };
 
+export const WHOLE_TREE = "--whole-tree";
+
 export const KIT_GATES = [
-  { bin: "checks-lint-coverage", vector: "quality", file: "lint-coverage.sh", reads: "tree", appliesTo: LINTED_SOURCE },
+  { bin: "checks-lint-coverage", vector: "quality", file: "lint-coverage.sh", reads: "tree", appliesTo: LINTED_SOURCE, night: true },
   { bin: "checks-test-layout", vector: "testing", file: "test-layout.ts", reads: "tree", appliesTo: TYPESCRIPT_SOURCE },
   { bin: "checks-commit-identity", vector: "delivery", file: "commit-identity.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
   { bin: "checks-comment-gate", vector: "quality", file: "comment-gate.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
@@ -57,14 +60,14 @@ export const KIT_GATES = [
   { bin: "checks-frontend-syntax", vector: "quality", file: "frontend-syntax.ts", reads: "tree", appliesTo: FRONTEND_SYNTAX_DECLARATION },
   { bin: "checks-css-size", vector: "quality", file: "css-size.ts", reads: "tree", appliesTo: STYLESHEET },
   { bin: "checks-no-plain-js", vector: "quality", file: "no-plain-js.ts", reads: "tree", appliesTo: TYPESCRIPT_SOURCE },
-  { bin: "checks-suppressions-ratchet", vector: "complexity", file: "suppressions-ratchet.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
+  { bin: "checks-suppressions-ratchet", vector: "complexity", file: "suppressions-ratchet.ts", reads: "range", appliesTo: EVERY_REPOSITORY, night: true },
   { bin: "checks-ci-wiring", vector: "delivery", file: "ci-wiring.ts", reads: "tree", appliesTo: EVERY_REPOSITORY },
   { bin: "checks-secrets", vector: "delivery", file: "secrets.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
   { bin: "checks-docs", vector: "docs", file: "docs.ts", reads: "range", alsoReads: "every agent file at the head commit", appliesTo: EVERY_REPOSITORY },
   { bin: "checks-copy", vector: "docs", file: "copy.ts", reads: "tree", appliesTo: COPY_DECLARATION },
-  { bin: "checks-repetition", vector: "complexity", file: "repetition.ts", reads: "range", appliesTo: TYPESCRIPT_SOURCE },
+  { bin: "checks-repetition", vector: "complexity", file: "repetition.ts", reads: "range", appliesTo: TYPESCRIPT_SOURCE, night: true },
   { bin: "checks-graphwalk", vector: "complexity", file: "graphwalk.ts", reads: "range", appliesTo: LINTED_SOURCE },
-  { bin: "checks-quarantine-clock", vector: "testing", file: "quarantine-clock.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
+  { bin: "checks-quarantine-clock", vector: "testing", file: "quarantine-clock.ts", reads: "range", appliesTo: EVERY_REPOSITORY, night: true },
   {
     bin: "checks-advisories",
     vector: "dependencies",
@@ -74,3 +77,7 @@ export const KIT_GATES = [
     appliesTo: BUN_LOCKFILE,
   }
 ] as const satisfies readonly KitGate[];
+
+export const NIGHT_GATES: readonly KitGate[] = KIT_GATES.filter((gate) => "night" in gate);
+
+export const PR_GATES: readonly KitGate[] = KIT_GATES.filter((gate) => !("night" in gate));

package/src/core/git.ts

@@ -168,7 +168,9 @@ export const changedLines = Effect.fn("changedLines")(function* (
   return parseAddedLines(diff);
 });
 
-const emptyTree = (cwd?: string) => git(["hash-object", "-t", "tree", "/dev/null"], cwd).pipe(Effect.map((sha) => sha.trim()));
+export const emptyTree = Effect.fn("emptyTree")(function* (cwd?: string) {
+  return (yield* git(["hash-object", "-t", "tree", "/dev/null"], cwd)).trim();
+});
 
 export const pathsAt = Effect.fn("pathsAt")(function* (rev: string, pathspecs: readonly string[], cwd?: string) {
   const listed = yield* git(["diff", "--name-only", "-z", "--no-renames", yield* emptyTree(cwd), rev, "--", ...pathspecs], cwd);

package/src/core/lint.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 import { Config, Console, Effect, FileSystem, Option, Path, Schema } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import { EVERY_REPOSITORY, KIT_GATES, type KitGate } from "./gates.ts";
+import { EVERY_REPOSITORY, NIGHT_GATES, PR_GATES, WHOLE_TREE, type KitGate } from "./gates.ts";
 import { changedPaths, defaultBranch, git } from "./git.ts";
 import { runMain, Usage } from "./main.ts";
 import { FAST_TREE_GATES, selectScope } from "./scope.ts";
@@ -22,7 +22,8 @@ class GatesUndecided extends Schema.TaggedError<GatesUndecided>()("GatesUndecide
 }) {}
 
 const NAME = "checks-lint";
-const USAGE = "usage: lint.ts [--full | --desk] [<base-ref> <head-ref>]";
+const USAGE = "usage: lint.ts [--full | --desk] [<base-ref> <head-ref>] | --night";
+const NIGHT = "--night";
 const PULL_REQUEST_EVENT = "pull_request";
 const SHALLOW_HINT = "a CI checkout needs actions/checkout fetch-depth: 0";
 
@@ -159,11 +160,16 @@ function outcomeOf(exitCode: number): Outcome {
   return exitCode === 1 ? "violated" : "undecided";
 }
 
-const runGate = Effect.fn("runGate")(function* (gate: KitGate, range: Range) {
+const runGate = Effect.fn("runGate")(function* (gate: KitGate, range: Range, wholeTree: boolean) {
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   const script = (yield* Path.Path).join(import.meta.dir, "..", gate.vector, gate.file);
   const program = gate.file.endsWith(".sh") ? "sh" : process.execPath;
-  const args = gate.reads === "range" ? [script, ...range.refs] : [script, ...(gate.args ?? [])];
+  const args =
+    gate.reads === "range"
+      ? wholeTree
+        ? [script, WHOLE_TREE, ...range.refs]
+        : [script, ...range.refs]
+      : [script, ...(gate.args ?? [])];
   const extra = gate.env === undefined ? {} : { env: gate.env, extendEnv: true };
   const exitCode = yield* spawner
     .exitCode(ChildProcess.make(program, args, { stdin: "ignore", stdout: "inherit", stderr: "inherit", ...extra }))
@@ -175,6 +181,11 @@ const runGate = Effect.fn("runGate")(function* (gate: KitGate, range: Range) {
   return { gate, outcome: outcomeOf(exitCode) };
 });
 
+const wholeTreeRange = Effect.fn("wholeTreeRange")(function* () {
+  const head = yield* commitOf("HEAD");
+  return { refs: [head], source: "the whole tree at HEAD" } satisfies Range;
+});
+
 const scopedGates = Effect.fn("scopedGates")(function* (range: Range, root: string) {
   if (range.refs.length === 1) return { bins: undefined, detail: "the full run, since a lone tip scopes nothing" };
   const [base, head] = range.refs;
@@ -187,39 +198,62 @@ const scopedGates = Effect.fn("scopedGates")(function* (range: Range, root: stri
   return { bins: scope.gates, detail: "" };
 });
 
+const pullRequestSelection = Effect.fn("pullRequestSelection")(function* (
+  split: { readonly mode: LintMode; readonly rest: readonly string[] },
+  range: Range,
+  root: string,
+  applicable: readonly KitGate[],
+) {
+  if (split.mode === "desk") {
+    return {
+      bins: applicable.filter((gate) => FAST_TREE_GATES.includes(gate.bin)).map((gate) => gate.bin),
+      detail: "the desk run",
+    };
+  }
+  if (split.mode === "full") {
+    return { bins: applicable.map((gate) => gate.bin), detail: "the full run (--full)" };
+  }
+  return yield* scopedGates(range, root);
+});
+
+function selectionDetail(night: boolean, mode: LintMode, scopeDetail: string, count: number): string | undefined {
+  if (night) return undefined;
+  if (mode === "scoped" && scopeDetail === "") return `${count} gate(s) for this change`;
+  return scopeDetail === "" ? undefined : scopeDetail;
+}
+
 const lint = Effect.gen(function* () {
-  const split = splitMode(process.argv.slice(2));
+  const raw = process.argv.slice(2);
+  const night = raw.includes(NIGHT);
+  if (night && raw.length > 1) return yield* new Usage({ message: USAGE });
+  const split = night ? { mode: "full" as const, rest: [] as readonly string[] } : splitMode(raw);
   if (split === undefined) return yield* new Usage({ message: USAGE });
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const range = yield* resolveRange(split.rest);
+  const range = night ? yield* wholeTreeRange() : yield* resolveRange(split.rest);
   yield* Console.log(`${NAME}: ${describe(range)} from ${range.source}`);
-  const applicable = yield* Effect.filter(KIT_GATES, (gate) =>
+  const applicable = yield* Effect.filter(night ? NIGHT_GATES : PR_GATES, (gate) =>
     gate.appliesTo === EVERY_REPOSITORY
       ? Effect.succeed(true)
       : git(["ls-files", "--", ...gate.appliesTo.pathspecs], root).pipe(Effect.map((files) => files.trim() !== "")),
   );
-  const scoped = split.mode === "desk"
-    ? {
-      bins: applicable.filter((gate) => FAST_TREE_GATES.includes(gate.bin)).map((gate) => gate.bin),
-      detail: "the desk run",
-    }
-    : split.mode === "full"
-      ? { bins: applicable.map((gate) => gate.bin), detail: "the full run (--full)" }
-      : yield* scopedGates(range, root);
+  const scoped = night
+    ? { bins: applicable.map((gate) => gate.bin) as readonly string[] | undefined, detail: "" }
+    : yield* pullRequestSelection(split, range, root, applicable);
   const bins = scoped.bins;
   const gates = bins === undefined ? applicable : applicable.filter((gate) => bins.includes(gate.bin));
-  const detail = split.mode === "scoped" && bins !== undefined ? `${gates.length} gate(s) for this change` : scoped.detail;
-  yield* Console.log(`${NAME}: ${detail}`);
-  const verdicts = yield* Effect.forEach(gates, (gate) => runGate(gate, range));
+  const detail = selectionDetail(night, split.mode, scoped.detail, gates.length);
+  if (detail !== undefined) yield* Console.log(`${NAME}: ${detail}`);
+  const verdicts = yield* Effect.forEach(gates, (gate) => runGate(gate, range, night));
   const failed = verdicts.filter((verdict) => verdict.outcome !== "passed");
   if (failed.length === 0) {
     yield* Console.log(`${NAME}: ${gates.length} gate(s) pass`);
     return true;
   }
-  const summary = `${failed.length} of ${gates.length} gate(s) failed: ${failed.map((verdict) => verdict.gate.bin).join(", ")}`;
+  const names = failed.map((verdict) => verdict.gate.bin).join(", ");
   if (failed.every((verdict) => verdict.outcome === "undecided")) {
-    return yield* new GatesUndecided({ message: summary });
+    return yield* new GatesUndecided({ message: `${failed.length} of ${gates.length} gate(s) undecided: ${names}` });
   }
+  const summary = `${failed.length} of ${gates.length} gate(s) failed: ${names}`;
   yield* Console.error(`${NAME}: ${summary}`);
   return false;
 });

package/src/testing/night-run-findings.ts

@@ -19,7 +19,8 @@ export type PreviousNight = { readonly url: string; readonly record: NightRecord
 export type Finding =
   | { readonly kind: "mutation"; readonly file: string; readonly before: Score; readonly after: Score; readonly since: string }
   | { readonly kind: "test"; readonly file: string; readonly name: string }
-  | { readonly kind: "crash"; readonly file: string };
+  | { readonly kind: "crash"; readonly file: string }
+  | { readonly kind: "gates"; readonly file: string };
 
 function scoreOf(file: ReportFile): Score {
   let detected = 0;
@@ -45,6 +46,7 @@ function fell(before: Score, after: Score): boolean {
 export function keyOf(finding: Finding): string {
   if (finding.kind === "mutation") return `mutation:${finding.file}`;
   if (finding.kind === "test") return `test:${finding.file}${NAME_SEPARATOR}${finding.name}`;
+  if (finding.kind === "gates") return `gates:${finding.file}`;
   return `test:${finding.file}`;
 }
 
@@ -65,8 +67,23 @@ function testFindings(reports: readonly TestReport[]): readonly Finding[] {
   return [...new Map(failing.map((finding) => [keyOf(finding), finding])).values()];
 }
 
-export function findingsOf(previous: Option.Option<PreviousNight>, tonight: Tonight): readonly Finding[] {
-  return [...scoreFindings(previous, tonight.scores), ...testFindings(tonight.tests)].sort((one, other) => keyOf(one).localeCompare(keyOf(other)));
+export function findingsOf(previous: Option.Option<PreviousNight>, tonight: Tonight, gates: readonly Finding[] = []): readonly Finding[] {
+  return [...scoreFindings(previous, tonight.scores), ...testFindings(tonight.tests), ...gates].sort((one, other) =>
+    keyOf(one).localeCompare(keyOf(other)),
+  );
+}
+
+const FAILED_GATES = /of \d+ gate\(s\) failed: (.+)/;
+const PASSED_GATES = /gate\(s\) pass/;
+
+export function gatesOf(log: string): readonly Finding[] {
+  const names = log
+    .split("\n")
+    .flatMap((line) => FAILED_GATES.exec(line)?.[1]?.split(",") ?? [])
+    .map((name) => name.trim())
+    .filter((name) => name !== "");
+  if (names.length > 0) return [...new Map(names.map((file): [string, Finding] => [file, { kind: "gates", file }])).values()];
+  return PASSED_GATES.test(log) ? [] : [{ kind: "gates", file: "checks-lint" }];
 }
 
 export function percent(score: Score): string {

package/src/testing/night-run.ts

@@ -5,11 +5,11 @@ import { DEFAULT_BRANCH } from "../core/gates.ts";
 import { runMain, Usage } from "../core/main.ts";
 import { gh, type GitHubFailure, gitHubJson, REPOSITORY } from "../delivery/github.ts";
 import { parseReport as parseMutationReport } from "./mutation-compare.ts";
-import { type Finding, findingsOf, keyOf, NightRecordSchema, type NightRecord, percent, type PreviousNight, scoresOf, type TestReport } from "./night-run-findings.ts";
+import { type Finding, findingsOf, gatesOf, keyOf, NightRecordSchema, type NightRecord, percent, type PreviousNight, scoresOf, type TestReport } from "./night-run-findings.ts";
 import { parseReport as parseTestReport } from "./test-report.ts";
 
 const NAME = "checks-night-run";
-const USAGE = `usage: ${NAME} [--mutation <mutation-report>] [--tests <junit-report>]...`;
+const USAGE = `usage: ${NAME} [--mutation <mutation-report>] [--tests <junit-report>]... [--gates <lint-log>]`;
 export const LABEL = "night-run";
 const LABEL_COLOR = "5319e7";
 const LABEL_DESCRIPTION = "A regression a night run on main found";
@@ -23,19 +23,22 @@ class NightRunFailure extends Schema.TaggedError<NightRunFailure>()("NightRunFai
   message: Schema.String,
 }) {}
 
-export type Options = { readonly mutation: Option.Option<string>; readonly tests: readonly string[] };
+export type Options = { readonly mutation: Option.Option<string>; readonly tests: readonly string[]; readonly gates: Option.Option<string> };
 
 export const parseArgs = Effect.fnUntraced(function* (argv: readonly string[]): Effect.fn.Return<Options, Usage> {
   const mutation: string[] = [];
   const tests: string[] = [];
+  const gates: string[] = [];
   for (let at = 0; at < argv.length; at += 2) {
     const [flag, value] = [argv[at], argv[at + 1]];
-    const into = flag === "--mutation" ? mutation : flag === "--tests" ? tests : undefined;
+    const into = flag === "--mutation" ? mutation : flag === "--tests" ? tests : flag === "--gates" ? gates : undefined;
     if (into === undefined || value === undefined || value.startsWith("--")) return yield* new Usage({ message: USAGE });
     into.push(value);
   }
-  if (mutation.length > 1 || mutation.length + tests.length === 0) return yield* new Usage({ message: USAGE });
-  return { mutation: Option.fromNullishOr(mutation[0]), tests };
+  if (mutation.length > 1 || gates.length > 1 || mutation.length + tests.length + gates.length === 0) {
+    return yield* new Usage({ message: USAGE });
+  }
+  return { mutation: Option.fromNullishOr(mutation[0]), tests, gates: Option.fromNullishOr(gates[0]) };
 });
 
 export type OpenIssue = { readonly number: number; readonly key: string };
@@ -102,6 +105,7 @@ const openIssues = Effect.gen(function* () {
 function fullTitleOf(finding: Finding): string {
   if (finding.kind === "mutation") return `Night run: mutation score fell in ${finding.file}`;
   if (finding.kind === "test") return `Night run: ${finding.file} > ${finding.name} fails`;
+  if (finding.kind === "gates") return `Night run: nightly gate ${finding.file} failed`;
   return `Night run: ${finding.file} crashed its test worker`;
 }
 
@@ -125,6 +129,7 @@ export function findingText(finding: Finding, run: string): string {
     ].join("\n");
   }
   if (finding.kind === "test") return `The night run ${run} failed \`${finding.name}\` in \`${finding.file}\`.`;
+  if (finding.kind === "gates") return `The night run ${run} failed nightly gate \`${finding.file}\`.`;
   return `The night run ${run} lost every result of \`${finding.file}\`, because the worker running it crashed.`;
 }
 
@@ -240,8 +245,9 @@ const nightRun = Effect.gen(function* () {
   const actions = yield* actionsRun;
   const scores = Option.isSome(options.mutation) ? Option.some(yield* tonightScores(options.mutation.value)) : Option.none<NightRecord["scores"]>();
   const tests: TestReport[] = yield* Effect.forEach(options.tests, testReport);
+  const gates: readonly Finding[] = Option.isSome(options.gates) ? gatesOf(yield* readText(options.gates.value)) : [];
   const previous = Option.isSome(scores) ? yield* previousNight(actions) : Option.none<PreviousNight>();
-  const findings = findingsOf(previous, { scores: Option.getOrElse(scores, () => ({})), tests });
+  const findings = findingsOf(previous, { scores: Option.getOrElse(scores, () => ({})), tests }, gates);
   const filing: Filing = actions.ref === `refs/heads/${DEFAULT_BRANCH}` ? { onMain: true, filed: yield* fileFindings(findings, actions.run) } : { onMain: false, ref: actions.ref };
   if (filing.onMain && Option.isSome(scores)) yield* writeRecord({ scores: scores.value });
   yield* Console.log(report(actions.run, Option.map(scores, (tonight) => Object.keys(tonight).length), previous, findings, filing));

package/src/testing/quarantine-clock.ts

@@ -1,7 +1,8 @@
 #!/usr/bin/env bun
 import { Console, Effect, Schema } from "effect";
 import { commitOf, git, isShallowBoundary, refArgs, writtenAt } from "../core/git.ts";
-import { runMain } from "../core/main.ts";
+import { WHOLE_TREE } from "../core/gates.ts";
+import { Usage, runMain } from "../core/main.ts";
 import { TEST_FILE } from "./test-layout.ts";
 
 export const QUARANTINE = "tests/quarantine/";
@@ -12,7 +13,7 @@ export class QuarantineError extends Schema.TaggedError<QuarantineError>()("Quar
   message: Schema.String,
 }) {}
 
-const USAGE = "usage: quarantine-clock.ts <ref> | <base-ref> <head-ref>";
+const USAGE = "usage: quarantine-clock.ts <ref> | <base-ref> <head-ref> | --whole-tree <head-ref>";
 
 export type Entry =
   | { readonly kind: "entered"; readonly sha: string; readonly at: number; readonly day: string }
@@ -133,6 +134,13 @@ export const runHead = Effect.fn("runHead")(function* (root: string, head: strin
 
 const clock = Effect.gen(function* () {
   const { first, second } = yield* refArgs(process.argv.slice(2), USAGE);
+  if (first === WHOLE_TREE) {
+    if (second === undefined) return yield* new Usage({ message: USAGE });
+    const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+    const result = yield* runHead(root, yield* commitOf(second));
+    yield* Console.log(report(result));
+    return result.overdue.length === 0;
+  }
   if (second !== undefined) yield* commitOf(first);
   const head = yield* commitOf(second ?? first);
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();