evilution 1.3.0 → 1.5.0

data/docs/architecture.md

@@ -12,7 +12,13 @@ For deeper dives on two subsystems that have their own docs, see
 ## The one-paragraph version
 
 Evilution parses each target file with [Prism](https://github.com/ruby/prism)
-into an AST with exact byte offsets. Every method becomes a *subject*. Each
+into an AST with exact byte offsets. Every method becomes a *subject*, and so
+does every value-object definition outside a method (`Point = Data.define(:x)`),
+every other constant assignment outside a method (`LIMIT = 10`), every scope
+declared with a literal body (`scope :recent, -> { ... }`), every guard or
+callback written out inside an AASM `event` or `state`, and the conditions and
+bodies of callback and validation declarations — in a class body or in a
+concern's `included` / `prepended` block. Each
 mutation *operator* walks a subject's AST and emits *mutations* — byte-range
 edits applied by source-level surgery (no AST unparsing). For every mutation,
 evilution copies the file, applies the edit, runs the covering specs in an
@@ -48,7 +54,7 @@ Everything lives under `lib/evilution/`.
 | `Config`, `Config::*` | Merge `.evilution.yml` + CLI flags + env, validate, freeze. | `config.rb`, `config/sources.rb`, `config/validators/*` |
 | `Runner`, `Runner::*` | Orchestrate the whole run. Each stage is its own collaborator. | `runner.rb`, `runner/*` |
 | `AST`, `Subject` | Prism parse, find method subjects, source surgery, pattern matching, heredoc spans. | `ast/parser.rb`, `ast/source_surgeon.rb`, `subject.rb` |
-| `Mutator`, `Mutator::Operator::*` | 111 operators (default profile) that emit byte-edits; registry + profiles. | `mutator/base.rb`, `mutator/registry.rb`, `mutator/operator/*` |
+| `Mutator`, `Mutator::Operator::*` | 155 operators (default profile) that emit byte-edits; registry + profiles. | `mutator/base.rb`, `mutator/registry.rb`, `mutator/operator/*` |
 | `Mutation` | An immutable mutation record (original/mutated sources, slice, location, parse status). | `mutation.rb` |
 | `SpecResolver`, `SpecSelector` | Map a source file to its covering spec files (layout heuristics + explicit mappings). | `spec_resolver.rb`, `spec_selector.rb` |
 | `Isolation::{Fork,InProcess}`, `ProcessSupervisor` | Run one mutation's tests in isolation; process-group lifecycle, sandboxing, TERM/KILL ladder. | `isolation/fork.rb`, `process_supervisor.rb` |
@@ -105,16 +111,43 @@ class that owns it.
 2. **Subjects** — `Runner::SubjectPipeline#call` resolves target files (explicit,
    `source:<glob>`, or `Git::ChangedFiles`), then `AST::Parser#call` runs
    `Prism.parse` and `AST::SubjectFinder` (a `Prism::Visitor`) emits one
-   `Evilution::Subject` per `def` node. Optional descendant/target/line-range filters follow.
+   `Evilution::Subject` per `def` node (kind `:method`), plus one per
+   `Data.define` / `Struct.new` assigned to a constant or used as a superclass
+   outside any method (kind `:constant`, named after the constant), plus one per
+   `scope :name, -> { }` / `lambda { }` / `proc { }` written directly in a class
+   body (kind `:scope`, named `Class.name` after the class method it defines;
+   it spans the declaration and its node is the body; a scope declared in a
+   concern's `included do ... end` or `prepended do ... end` is named after the
+   concern), plus one per literal
+   callable inside an `event` or `state` of a class-body `aasm do ... end` --
+   keyword values (`guard: -> { }`, also inside arrays), those of the event's
+   `transitions`, and callback blocks (`before { }`) -- kind `:aasm`, named
+   `Class#event` / `Class#state?` after the method the declaration defines, so
+   one event may contribute several subjects of the same name (a machine in a
+   concern's `included do ... end` or `prepended do ... end` is found too, and
+   named after the concern);
+   and one per
+   literal callable of a class-body callback or validation declaration
+   (`validate`, `validates`, `validates_*`, `before_*`, `after_*`, `around_*`)
+   -- an `if:` / `unless:` condition, or the callback itself as a block or
+   lambda -- kind `:callback`, named as the declaration reads
+   (`Order.validate(:credit_limit)`, `Order.before_save`; one in a concern's
+   `included do ... end` or `prepended do ... end` is named after the concern).
+   Optional
+   descendant/target/line-range filters follow.
 3. **Baseline** — `Runner::BaselineRunner#call` builds the integration from
    `Runner::INTEGRATIONS` (`rspec`/`minitest`/`test_unit`) and records spec files
    that already fail *before* any mutation, so their mutations aren't miscounted.
    An optional `Runner::Canary` proves the pipeline can observe a known mutation.
 4. **Mutations** — `Runner::MutationPlanner#call` flat-maps subjects through
-   `Mutator::Registry#mutations_for`. The registry instantiates each operator and
+   `Mutator::Registry#mutations_for`. The registry instantiates each operator whose
+   `subject_kinds` include the subject's kind (`:method`, `:scope`, `:aasm` and `:callback` by default) and
    runs `operator.call(subject, filter:)`; each operator subclasses
    `Mutator::Base` and calls `add_mutation`, which runs `AST::SourceSurgeon` and
-   builds an immutable `Evilution::Mutation`. The planner then **deduplicates**
+   builds an immutable `Evilution::Mutation`. Whether the mutated source parses
+   is `AST::SyntaxCheck`'s call: Prism first and, on an interpreter that
+   compiles with parse.y (Ruby 3.3, or `--parser=parse.y`), parse.y as well,
+   since the two disagree on a few constructs. The planner then **deduplicates**
    (by `file_path` + mutated source), and filters **disabled** (`DisableComment`),
    **Sorbet `sig`** (`AST::SorbetSigDetector`), and **equivalent**
    (`Equivalent::Detector`) mutations. Equivalent ones become `:equivalent`
@@ -141,12 +174,25 @@ class that owns it.
    guard / unresolved); the final symbol is chosen by
    `Isolation::Fork#classify_status`: `:timeout` → `:killed` (crash) →
    `:unresolved` → `:error` → `:survived` (tests passed) → default `:killed`.
+   A crash is a test that raised, or a mutated source that raised while it was
+   loaded and whose original still loads (`MutationApplier` marks it
+   `load_crashed` after evaluating the original); a load failure the original
+   shares stays an `:error`.
    A `NeutralizationPipeline` can reclassify results into `:neutral` — either
-   because the covering spec already failed at baseline (`Neutralizer::BaselineFailed`)
-   or because the test process crashed on infrastructure rather than on the
-   mutation (`Neutralizer::InfraError`). Each records a `Result::NeutralReason`,
-   since the two want opposite responses. A survivor is re-run against its whole
-   spec file before it is reported (`Integration::RSpec#confirm_survivor?`), so a
+   because the tests failed on nothing but examples that were already failing
+   at baseline (`Neutralizer::BaselineFailed`) or because the test process
+   crashed on infrastructure rather than on the mutation
+   (`Neutralizer::InfraError`). Each records a `Result::NeutralReason`, since
+   the two want opposite responses. For the first, the baseline reports the
+   ids of its failing examples (`Integration::RSpec::ExampleIds`, absolute path
+   plus position, so they compare across working directories;
+   `Integration::Minitest::TestIds`, `Class#test`;
+   `Integration::TestUnit::TestIds`, `test(Class)`), the integration is built
+   with them (`known_failures:`, held as `Integration::KnownFailures`), and a
+   failed run whose failed examples are all among them comes back flagged
+   `known_failures_only`; a survivor is never neutralized. A survivor is re-run
+   against its whole spec file before it is reported
+   (`Integration::RSpec#confirm?`), as is a targeted run flagged that way, so a
    narrowed example set cannot invent one; after a parallel pass,
    `MutationExecutor::InfraRetry` re-runs the infrastructure-neutralised
    mutations serially, once the contention that caused them is gone.
@@ -158,7 +204,9 @@ class that owns it.
    the score. `Commands::Run` maps `summary.success?(min_score:)` to exit code
    `0`/`1` (`2` on error), and `CLI::ExitGuard` — installed by the executable before
    anything can preload the project — has the final word on the process status, so a
-   preloaded spec helper's at-exit hook cannot replace it.
+   preloaded spec helper's at-exit hook cannot replace it. The guard also ends a run
+   that a mutation took down under in-process isolation with `2`, where Ruby would
+   end it with `1`.
 
 ## How to add a new mutator
 
@@ -193,6 +241,82 @@ A mutator is a `Prism::Visitor` subclass that emits byte-range edits.
    - The operator's registered name is auto-derived from the class name
      (`MyThing` → `my_thing`); that string is the `operator` field in JSON output
      and is part of the public contract, so name it deliberately.
+   - Operators see method, scope, aasm and callback subjects. One that also applies to value-object
+     definitions outside a method overrides `self.subject_kinds` to return
+     `%i[method constant]`; a constant subject's node is the definition's
+     `CallNode`.
+   - Every other assignment to a constant outside a method (`LIMIT = 10`) is a
+     `:constant_write` subject, whose node is the whole assignment.
+     An operator write (`LIMIT += 1`) is one too, under the same name.
+     `ConstantWriteToNil` takes no other kind and nils the value of a plain
+     assignment only. `CompoundAssignment` handles the operator writes, and
+     with the literal operators extends `Mutator::ConstantValueSubjects` to
+     take constant-write subjects alongside the default kinds. `SubjectPipeline` drops subjects of a kind no registered operator
+     accepts (`Registry#accepts?`). Re-evaluating the mutated file assigns the constant again
+     and the restore source puts it back; what read the constant while
+     the file first loaded (a class-body call, a constant in another file
+     computed from it) keeps the old value.
+   - A scope subject's mutation only takes effect if the mutated file re-runs
+     its `scope` call, which `BodyCallNeutralizer` would otherwise blank: the
+     eval source keeps that one call (`keep_offset`). Its `restore_source` is
+     the original file with the same call kept.
+   - Every mutation carries a `restore_source`, which `Integration::Base#call`
+     evaluates after the tests: the original file, class-body calls
+     neutralized. An in-process run would otherwise leave the last mutation
+     of a file applied while the next file is mutated, and that file's tests
+     would fail on its behalf. For a subject with no declaration to keep it
+     is one string per file, built once and shared
+     (`Mutator::Base.original_restore_source`).
+   - A scope in a concern's `included` block has two audiences. The kept
+     `included` call registers the mutated block for classes that include the
+     concern later (`ConcernStateCleaner` clears the old one first, on apply
+     and on restore: a concern ignores a block handed to it twice from the
+     same place). For classes that include it already, the eval source guards
+     every other call of the block with `ConcernRedeclaration.skipping?` and
+     follows the block with `ConcernRedeclaration.call(self)`, which runs the
+     block on each of them with the guard up, so only the scope is declared
+     again. Both additions go on existing lines; no line number moves.
+   - A method defined in a concern's `included` or `prepended` block, or a
+     constant assigned there, is handled the same way: the parser marks every
+     subject written in such a block (`Subject#concern_hook?`), and
+     `Mutator::Base` keeps the block for it as it does for a scope. The other
+     methods of the block and the constants it assigns are guarded like its
+     calls, so only the mutated one is defined again and no constant loses
+     what it has gathered. For a `prepended` block the eval source ends it with
+     `ConcernRedeclaration.call(self, :prepended)`, which runs it on the
+     classes that prepend the concern (it comes before them in their
+     ancestors) rather than on those that include it. A method the class has
+     defined itself over one of the block's is put back afterwards
+     (`Integration::Loading::OwnMethods`, which tells the two apart by the
+     file they were written in).
+   - A callback subject's declaration is kept too, wrapped in
+     `CallbackRedeclaration.call(self, __FILE__, lines) { ... }`. Callbacks do
+     not replace on re-declaration: a symbol callback moves to the end of its
+     chain, a block or validator is added beside the first. The helper reads
+     the chains, runs the declaration and rebuilds them through
+     `__update_callbacks`, so the new callbacks sit where the ones this
+     declaration registered before were. Those are found by the source
+     location of their procs the first time (`lines` is the declaration's
+     range in the file as loaded) and from the helper's own record afterwards,
+     since a mutation may add or remove lines. In a concern's `included` block
+     the declaration is wrapped the same way inside the kept block, whose
+     other calls are guarded: run on a class that includes the concern already
+     it replaces that class's callbacks in place, run by a class including it
+     later it simply declares. `BodyCallNeutralizer` leaves a blanked call's
+     line breaks behind, so the evaluated source keeps the file's line numbers
+     and a class loaded during one mutation can be matched by location in the
+     next.
+   - An aasm subject works the same way, one level down: the `aasm` call is
+     kept, and inside its block every declaration but the `event` or `state`
+     holding the mutation is blanked. AASM stores what an event or state holds
+     by value, so re-running one replaces it; the machine's own callbacks
+     (`after_all_transitions`) accumulate, which is why the rest of the block
+     must not run again and why they get no subjects. For a machine inside a
+     concern's `included` block the two mechanisms combine: the block is kept
+     and followed by `ConcernRedeclaration.call(self)`, and both its other
+     calls and the machine's other declarations are guarded with
+     `ConcernRedeclaration.skipping?` instead of blanked -- a class that
+     includes the concern later needs the whole machine.
 
 2. **Require it** in `lib/evilution.rb` alongside the other
    `require_relative "evilution/mutator/operator/..."` lines.

data/docs/ast_pattern_syntax.md

@@ -66,6 +66,29 @@ after calling `.to_s` on both sides:
 call{name=log}       # matches when node.name.to_s == "log"
 ```
 
+**Method names** that end in `?`, `!` or `=` are written as they are, and so are
+operator methods:
+
+```
+call{name=valid?}          # record.valid?
+call{name=strip_sources!}  # strip_sources!
+call{name=value=}          # record.value = 1
+call{name=<=>}             # a <=> b
+call{name=-@}              # -a (unary minus)
+```
+
+The bare operators are `<=>`, `===`, `==`, `=~`, `[]=`, `[]`, `<=`, `<<`, `<`,
+`>=`, `>>`, `>`, `+@`, `-@`, `+`, `-`, `/`, `%`, `&`, `^` and `~`. Any other
+name — `|`, `!`, `!=`, `!~`, `*`, `**`, a backtick — goes in single or double
+quotes, since unquoted these characters mean alternation, negation or a wildcard.
+A quoted name is matched literally:
+
+```
+call{name='|'}       # a | b, not an alternation
+call{name='*'}       # a * b, not a wildcard
+call{name='!='}      # a != b, not a negation
+```
+
 **Alternatives** use `|` (OR logic) within a single attribute value:
 
 ```
@@ -139,6 +162,13 @@ ignore_patterns:
 
   # Suppress mutations on constant `ENV` reads
   - "call{receiver=constant_read{name=ENV}}"
+
+  # Suppress mutations on bang and predicate calls, and on `<=>`
+  - "call{name=strip_sources!|eager_load!|valid?}"
+  - "call{name=<=>}"
+
+  # Quote names made of reserved characters
+  - "call{name='|'}"
 ```
 
 ## Pattern Matching Semantics
@@ -164,12 +194,21 @@ value          = "!" value
                | "*"
 nested_pattern = node_type "{" attributes "}"
 alternatives   = atom { "|" atom }
-atom           = identifier | "*"
+atom           = name | "*"
+name           = identifier [ "?" | "!" | "=" ]
+               | operator
+               | "'" { any character except "'" } "'"
+               | '"' { any character except '"' } '"'
+operator       = "<=>" | "===" | "==" | "=~" | "[]=" | "[]" | "<=" | "<<" | "<"
+               | ">=" | ">>" | ">" | "+@" | "-@" | "+" | "-" | "/" | "%"
+               | "&" | "^" | "~"
 identifier     = [a-zA-Z_] [a-zA-Z0-9_]*
 ```
 
-A bare `identifier` without `{` is parsed as a scalar value (matched via `.to_s`).
-An `identifier` followed by `{` is parsed as a nested pattern.
+A bare `name` without `{` is parsed as a scalar value (matched via `.to_s`).
+An `identifier` followed by `{` is parsed as a nested pattern. Operators are
+read longest first, so `<=>` is never taken for `<=`. Node types and attribute
+names are always plain identifiers. A quoted name is at least one character long.
 
 ## Examples
 
@@ -183,6 +222,9 @@ An `identifier` followed by `{` is parsed as a nested pattern.
 | `call{receiver=**}` | `foo()`, `x.foo()`, `a.b.foo()` | *(matches all)* |
 | `def{name=to_s}` | `def to_s; ... end` | `def to_str; ... end` |
 | `call{name=!log}` | `debug()`, `info()` | `log()` |
+| `call{name=valid?\|save!}` | `x.valid?`, `save!` | `valid`, `save` |
+| `call{name=<=>}` | `a <=> b` | `a <= b` |
+| `call{name='\|'}` | `a \| b` | `a & b` |
 
 ## Design Decisions
 
@@ -191,8 +233,11 @@ An `identifier` followed by `{` is parsed as a nested pattern.
    write patterns immediately.
 
 2. **Unquoted values**: Attribute values don't require quotes. This keeps YAML clean
-   and avoids escaping issues. The tradeoff is that values cannot contain `{`, `}`,
-   `,`, `=`, `|`, or `!` — these are reserved syntax characters.
+   and avoids escaping issues. Method names ending in `?`, `!` or `=` and operators
+   that cannot be confused with pattern syntax are written bare too. Only names
+   built from reserved characters (`|`, `!`, `*`) or characters outside a method
+   name need quotes; there is no escaping inside them. In YAML, use one kind of
+   quote for the YAML string and the other inside it: `- "call{name='|'}"`.
 
 3. **Implicit wildcards for unspecified attributes**: `call{name=log}` matches
    regardless of receiver, arguments, etc. Only specified attributes constrain the

data/docs/isolation.md

@@ -22,8 +22,8 @@ transaction block with a half-delivered exception. The mask is
 [load-bearing for transaction correctness][rails-handle-interrupt].
 
 That mask interacts badly with `Timeout.timeout`. The Timeout gem schedules a
-timer thread which fires `Thread#raise Timeout::Error` at the main thread when
-the deadline hits. Ruby receives the `raise`, inspects the interrupt mask, sees
+timer thread which fires `Thread#raise` at the main thread when the deadline
+hits. Ruby receives the `raise`, inspects the interrupt mask, sees
 `Exception => :never`, and **queues the exception for later delivery** — "later"
 meaning "when the masked block exits". If the mutant is stuck in an infinite
 loop inside the transaction, the block never exits, the queued exception is
@@ -57,6 +57,99 @@ The same hazard applies to any Ruby code that uses
 blocks that wrap "must complete" sections. If your target code can touch any
 of those, prefer `--isolation fork`.
 
+## How `in_process` ends a run that is out of time
+
+The timeout raises `Evilution::Isolation::InProcess::Expired` into the run. It
+is a `SignalException`, not a `Timeout::Error`, because it has to end the
+whole test run. A test framework rescues nearly everything a test raises:
+handed a `Timeout::Error`, it records one failed test and moves on to the
+next, which may reach the same endless loop with no timer left to stop it.
+Minitest, Test::Unit and RSpec all let a `SignalException` through, so the run
+stops at once and the mutation is reported as timed out rather than killed.
+
+It is not an `Interrupt` either. Tooling that handles Ctrl-C — maxitest, for
+one — rescues `Interrupt` and skips every test from then on, which would turn
+each later mutation in the process into a survivor.
+
+One raise is all there is. Code under test, or a test, that rescues
+`Exception` or `SignalException` and then loops again cannot be stopped from
+inside its own process; use `--isolation fork` for it. The same goes for a
+mutant that crashes the Ruby VM: under `fork` that costs one child, under
+`in_process` the whole run.
+
+## What `in_process` cannot contain
+
+A mutant runs in the same Ruby process as evilution, so whatever takes that
+process down takes the run with it.
+
+An exception outside `StandardError` that leaves the test run is contained:
+a `SystemStackError` from a mutant that recurses without end is the usual
+one. It is reported for that mutation and the run goes on. The mutation is
+`killed` when the exception left the tests after the mutated source loaded,
+as a crashing test would be, and an `error` when it was raised earlier.
+
+One kind of stack overflow is not contained. When the recursion goes through
+`const_missing` — a mutant of a `const_missing` that is installed on `Object`
+does that — Ruby may run neither `rescue` nor `ensure`, or abort outright
+with a `[BUG]` report. Which one depends on the stack limit of the process
+(`ulimit -s`): under the usual 8 MB the machine stack gives out first and the
+process is lost, under a much larger limit the overflow unwinds like any
+other. The other recursions tried (plain method calls, blocks, `send`,
+`method_missing`, `to_s`, a Hash default proc) unwind normally under the
+usual limit, on Ruby 3.4 and 4.0.
+
+When the process ends this way without aborting, a line on stderr names the
+mutation:
+
+```
+[evilution] the run died while testing a mutation under in-process isolation:
+constant_namespace_strip: lib/foo.rb:202 (SystemStackError: stack level too deep).
+In-process isolation cannot contain a mutation that takes the Ruby process down;
+re-run with --isolation fork.
+```
+
+The process then ends with status 2, the status of a tool error: nothing was
+measured, and the line says what to change in the invocation. Ruby's own
+status for an uncaught exception is 1, which would read as a score below
+`--min-score`. The hooks the project registered with `at_exit` still run
+first. Ruby's backtrace of the exception is not printed; the line carries its
+class and message. A run that is interrupted (Ctrl-C) keeps the status Ruby
+gives it.
+
+After a `[BUG]` abort there is no such line and no such status: Ruby's own
+crash report is all there is, and the process ends as an abort does (134 from
+a shell), since no `at_exit` hook runs. In both cases no report is written
+and the verdicts collected so far are lost. Re-run with `--isolation fork`,
+where the same mutant costs one child process.
+
+## State a file leaves behind when it is evaluated again
+
+`in_process` evaluates a source file once for every mutation of it, and once
+more to put the original back. A fork child evaluates it once and ends. A file
+whose evaluation adds to something, instead of replacing it, therefore behaves
+differently under the two.
+
+One such case is handled. A file that installs a module it never names,
+
+```ruby
+handler = Module.new { def const_missing(name) = ... }
+Object.extend(handler)
+```
+
+leaves one more module on its host every time it is evaluated, and Ruby has no
+way to take one off. Left alone, the mutation under test would reach the code
+of every earlier mutation through `super`, fail on a predecessor's bug, and be
+reported killed. Evilution remembers the anonymous modules a file's evaluation
+creates and removes their methods when the file is evaluated next, so that
+method lookup passes through them. Only modules are emptied, not anonymous
+classes, and only the methods written in that file.
+
+Other things a file can add to at load time are not undone: an `at_exit`
+hook, a `Signal.trap`, a `TracePoint`, a callback pushed into a registry of
+some library. If the file you are mutating does one of those at the top
+level, compare an `in_process` run with a `--isolation fork` run before
+trusting its kills.
+
 ## Parent-process preload
 
 Fork isolation's one downside is that every child pays the cost of loading
@@ -132,6 +225,23 @@ the MCP server is a long-lived process that handles runs from different
 projects — preloading one project's Rails stack into a shared process would
 poison subsequent runs.
 
+## Test files under `in_process` (Minitest, Test::Unit)
+
+Under `in_process` one process runs every mutation, and Minitest and
+Test::Unit learn of a test class only when it is first defined: loading its
+file a second time reopens the class and registers nothing. Each test file is
+therefore loaded once per process, and the classes it registered are
+dispatched again for every later mutation
+(`Integration::Loading::TestClassCache`).
+
+The consequence is that code in the body of a test file runs once. Tests
+generated at load time from the code under test (`OPS.each { |op|
+define_method("test_#{op}") { … } }`) keep the set built on the first load,
+and state held on a test class carries over from one mutation to the next.
+Under `fork` every child loads the file itself, so use `--isolation fork` for
+a suite that depends on either. RSpec is unaffected: it is reset and its spec
+files are loaded again for each mutation.
+
 ## Sandboxed working directory
 
 Every isolator runs `test_command.call` inside a per-mutation scratch
@@ -169,6 +279,15 @@ single in-flight mutation is recorded as `:timeout` / `:error`, and the run
 continues with the remaining work. A single pathological mutation costs you one
 result, not the entire run.
 
+The same holds for a worker whose reply cannot be trusted. The pipes between
+the parent and a worker are inherited by every process the worker forks, so
+code under test that writes to a descriptor it did not open can put bytes on
+them. A frame that does not decode, that decodes to something other than a
+result of an item the worker holds, or that stops short of the length it
+announced (ten seconds are allowed for the rest) ends that worker: it is
+killed and replaced, and the mutation it held is recorded as an `:error` with
+the message `worker's result could not be read; the worker was replaced`.
+
 Each worker is also its own process-group leader, so killing a worker reaps the
 mutation subprocess and any grandchildren it spawned rather than orphaning them,
 and a terminal interrupt (Ctrl-C) is forwarded to every worker group — an

data/docs/migration-from-mutant.md

@@ -142,7 +142,7 @@ Key-by-key:
 | `matcher.ignore` | `ignore_patterns` / `# evilution:disable` | AST patterns or inline comments |
 | `fail_fast` | `fail_fast` | integer N or `null` |
 | `--score` gate (CLI; default `1.0`) | `min_score` | evilution defaults to `0.0` — set your own gate |
-| _(n/a)_ | `profile: strict` | opt into aggressive truthiness mutators |
+| _(n/a)_ | `profile: strict` | opt into aggressive mutators (truthiness, swallowed errors, statement order) |
 
 Run `evilution init` for a fully commented template, and point your editor at
 `schema/evilution.config.schema.json` for autocomplete/validation.

data/lib/evilution/ast/aasm_declaration.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../ast"
+require_relative "literal_callable"
+
+# The guards and callbacks of an AASM state machine that are written out as
+# literal callables:
+#
+#   aasm do
+#     state :paid, before_exit: -> { ... }
+#     event :ship, guard: -> { ... } do
+#       before { ... }
+#       transitions from: :paid, to: :shipped, guard: -> { ... }
+#     end
+#   end
+#
+# Each belongs to the `event` or `state` declaration it is written in. AASM
+# keeps what a declaration holds by value, so running that one declaration
+# again replaces it, and a mutated body takes effect. The machine's own
+# callbacks (`after_all_transitions`) accumulate instead, and are left out.
+#
+# Only a receiver-less `aasm` call with a block, written directly in a class
+# body, counts: that is the call the mutated file re-runs.
+module Evilution::AST::AasmDeclaration
+  # body: the node holding the callable's body. declaration: its `event` or
+  # `state` call. method_name: the instance method that declaration defines.
+  Callable = Data.define(:body, :declaration, :method_name)
+
+  DECLARATIONS = %i[event state].freeze
+  EVENT_CALLBACKS = %i[
+    before before_transaction before_success success after after_transaction after_commit error ensure
+  ].freeze
+  private_constant :DECLARATIONS, :EVENT_CALLBACKS
+
+  # The callables of every machine among a class body's direct statements.
+  def self.in_body(body)
+    statements_of(body).flat_map { |node| machine_callables(node) }
+  end
+
+  # The block of an `aasm` call, or nil when node is not one.
+  def self.machine_block(node)
+    return nil unless node.is_a?(Prism::CallNode) && node.name == :aasm && node.receiver.nil?
+
+    node.block if node.block.is_a?(Prism::BlockNode)
+  end
+
+  # The name specs call for whatever sits on a line of a machine: the event,
+  # or the first state, declared there. nil outside every declaration.
+  def self.token_at(machine, line)
+    declaration = declarations_of(machine).find do |node|
+      line.between?(node.location.start_line, node.location.end_line)
+    end
+    declaration && declared_name(declaration)
+  end
+
+  def self.machine_callables(machine)
+    declarations_of(machine).flat_map do |declaration|
+      bodies_of(declaration).map do |body|
+        Callable.new(body: body, declaration: declaration, method_name: method_name(declaration))
+      end
+    end
+  end
+
+  def self.declarations_of(machine)
+    block = machine_block(machine)
+    return [] unless block
+
+    statements_of(block.body).select { |node| declaration?(node) }
+  end
+
+  def self.declaration?(node)
+    bare_call?(node) && DECLARATIONS.include?(node.name) && arguments_of(node).first.is_a?(Prism::SymbolNode)
+  end
+
+  def self.declared_name(declaration)
+    arguments_of(declaration).first.unescaped
+  end
+
+  # `event :ship` defines `ship`; `state :paid` defines `paid?`.
+  def self.method_name(declaration)
+    declaration.name == :event ? declared_name(declaration) : "#{declared_name(declaration)}?"
+  end
+
+  def self.bodies_of(declaration)
+    keyword_bodies(declaration) + (declaration.name == :event ? event_block_bodies(declaration) : [])
+  end
+
+  # What an event's block holds: its transitions, with keyword callables of
+  # their own, and callbacks given as blocks (`before { }`).
+  def self.event_block_bodies(event)
+    return [] unless event.block.is_a?(Prism::BlockNode)
+
+    statements_of(event.block.body).select { |node| bare_call?(node) }.flat_map do |node|
+      if node.name == :transitions then keyword_bodies(node)
+      elsif callback_block?(node) then [node.block]
+      else []
+      end
+    end
+  end
+
+  def self.callback_block?(node)
+    EVENT_CALLBACKS.include?(node.name) && node.arguments.nil? && node.block.is_a?(Prism::BlockNode)
+  end
+
+  # `guard: -> { }` and `guards: [-> { }, :named]` alike.
+  def self.keyword_bodies(call)
+    keywords = arguments_of(call).last
+    return [] unless keywords.is_a?(Prism::KeywordHashNode)
+
+    keywords.elements.grep(Prism::AssocNode).flat_map do |pair|
+      values = pair.value.is_a?(Prism::ArrayNode) ? pair.value.elements : [pair.value]
+      values.filter_map { |value| Evilution::AST::LiteralCallable.body_of(value) }
+    end
+  end
+
+  def self.bare_call?(node)
+    node.is_a?(Prism::CallNode) && node.receiver.nil?
+  end
+
+  def self.arguments_of(call)
+    call.arguments ? call.arguments.arguments : []
+  end
+
+  def self.statements_of(body)
+    body = body.statements if body.is_a?(Prism::BeginNode)
+    body.is_a?(Prism::StatementsNode) ? body.body : []
+  end
+
+  private_class_method :machine_callables, :declarations_of, :declaration?, :declared_name, :method_name,
+                       :bodies_of, :event_block_bodies, :callback_block?, :keyword_bodies, :bare_call?,
+                       :arguments_of, :statements_of
+end