ci(nightly-tiers): pull_request paths trigger and a path-less population declaration

dispatch-gates refuses a family reachable only from a scheduled workflow, so
the nightly carries the patrol posture: a pull_request trigger paths-filtered
to its own file and the switch reader. The reader declares no-path-population
(its self-test drives a temp fixture) and resolves vitest's CLI entry by
walking up from require.resolve('vitest') instead of spelling a subpath the
derivation read as a population. Concurrency keyed per ref so a PR run never
queues behind main's.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019RfFHiRCSs3JXLK4cwcfox

Author: claude

.github/workflows/test-nightly-tiers.yml

@@ -62,13 +62,14 @@ name: Nightly Tiers
 # regex over the log — the log is presentation, the report is the contract.
 #
 # ⛔ A run on any ref but `main` NEVER writes to the board — a
-# `workflow_dispatch` on a branch proves the transport, the sharding and the
-# rendering on a real runner and publishes the would-be card to the run
-# summary instead. That is how the card that landed this was smoke-tested.
+# `workflow_dispatch` on a branch, or the `pull_request` run below, proves the
+# transport, the sharding and the rendering on a real runner and publishes the
+# would-be card to the run summary instead. That is how the card that landed
+# this was smoke-tested.
 #
 # ⛔ This job is NOT a required context and must never become one: it runs on
-# no pull request at all, so a ruleset naming it would block every PR forever
-# on a check that cannot report.
+# no pull request but one editing its own two files, so a ruleset naming it
+# would block every other PR forever on a check that cannot report.
 
 on:
   schedule:
@@ -79,6 +80,23 @@ on:
     # (05:00) have started and well before `showcase-smoke` (07:00).
     - cron: '29 5 * * *'
   workflow_dispatch: {}
+  # ⛔ PATHS-FILTERED TO THIS FILE AND THE SWITCH READER IT INVOKES, and that
+  # filter is the whole reason this trigger is allowed to exist: a change to
+  # the nightly itself is exercised before it merges — the posture every patrol
+  # in this repo keeps, and the one `scripts/pm/dispatch-gates.mjs` pins
+  # tree-wide (a family reachable only from a scheduled workflow is refused
+  # there by name). A trigger that fires only on a pull request editing these
+  # two files puts ≈ 15 minutes of e2e on no unrelated PR's critical path.
+  #
+  # ⛔ Do NOT widen this list toward the tests themselves: a `packages/**`
+  # entry here would put the two tiers back on the per-PR path, which is the
+  # thing the card this landed removed. A `pull_request` run never writes to
+  # the board — its `github.ref` is the merge ref, not `main`, and the board
+  # write is gated on `main` by name.
+  pull_request:
+    paths:
+      - '.github/workflows/test-nightly-tiers.yml'
+      - 'scripts/nightly-tiers.mjs'
 
 # Least privilege. The shards read the repo and publish artifacts of their own
 # run; the report job writes issues and nothing else — no label on anybody's
@@ -87,10 +105,12 @@ permissions:
   contents: read
   issues: write
 
-# One nightly at a time. A dispatch overlapping the schedule would have two
-# `report` jobs racing the same lookup, and the loser would mint a duplicate.
+# One nightly at a time PER REF. A dispatch overlapping the schedule on `main`
+# would have two `report` jobs racing the same lookup, and the loser would mint
+# a duplicate; a `pull_request` run never writes, so it need not queue behind
+# `main`'s run — keying the group by ref keeps exactly the writers serial.
 concurrency:
-  group: test-nightly-tiers
+  group: test-nightly-tiers-${{ github.ref }}
   cancel-in-progress: false
 
 env:

scripts/nightly-tiers.mjs

@@ -90,6 +90,8 @@ import { fileURLToPath } from 'node:url';
 import { isEntrypoint } from './invoked-as.mjs';
 import { workspacePackageDirs } from './workspace-enumerator.mjs';
 
+// dispatch-gates: no-path-population -- the --self-test (the one invocation a pull request runs, through test-nightly-tiers.yml's paths trigger) drives a temp fixture workspace and reads no tracked file; --packages, --check and --failing-files sweep the live workspace only inside the nightly run itself, which is placed by that workflow's own paths trigger, so a hint here would be a second spelling of one population
+
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 // ---------------------------------------------------------------------------
@@ -238,15 +240,34 @@ export function judgeCollection(name, tierFiles, queueListed, nightlyListed) {
   return problems;
 }
 
-/** `vitest list --filesOnly` in `pkgDir` under `mode`, package-relative paths, sorted. */
-function vitestListedFiles(pkgDir, mode) {
+/**
+ * The `vitest.mjs` CLI entry of the vitest THIS package resolves: from its main
+ * entry, walk up to the directory whose manifest is named `vitest`. Resolved
+ * rather than spelled as a subpath so the module carries no path-shaped
+ * literal for the dispatch derivation to read as a population declaration.
+ */
+function vitestCliEntry(pkgDir) {
   const require = createRequire(path.join(pkgDir, 'package.json'));
-  let vitestEntry;
+  let dir;
   try {
-    vitestEntry = path.resolve(path.dirname(require.resolve('vitest/package.json')), 'vitest.mjs');
+    dir = path.dirname(require.resolve('vitest'));
   } catch {
     throw new Error(`${pkgDir}: vitest is not resolvable from this package -- install the workspace before --check`);
   }
+  for (;;) {
+    const manifest = path.join(dir, 'package.json');
+    if (existsSync(manifest) && JSON.parse(readFileSync(manifest, 'utf8')).name === 'vitest') {
+      return path.join(dir, 'vitest.mjs');
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) throw new Error(`${pkgDir}: walked to the filesystem root without finding vitest's package root`);
+    dir = parent;
+  }
+}
+
+/** `vitest list --filesOnly` in `pkgDir` under `mode`, package-relative paths, sorted. */
+function vitestListedFiles(pkgDir, mode) {
+  const vitestEntry = vitestCliEntry(pkgDir);
   const out = execFileSync(process.execPath, [vitestEntry, 'list', '--filesOnly'], {
     cwd: pkgDir,
     env: { ...process.env, [TIER_ENV]: mode },