evilution 1.4.0 → 1.5.1

data/lib/evilution/ast/syntax_check.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../ast"
+
+# Answers whether mutated source is Ruby the running interpreter will accept.
+#
+# Mutations are built and screened with Prism, but Prism and the older
+# parse.y parser do not agree on everything: Prism takes a bare constant
+# operator write inside a method (`def f; LIMIT ||= 1; end`) and a `nil[...]`
+# pattern, both of which parse.y rejects. An interpreter that compiles with
+# parse.y -- Ruby 3.3 by default, any later one started with
+# `--parser=parse.y` -- would be handed a mutant marked parseable and raise
+# SyntaxError evaluating it.
+#
+# So Prism decides first, and where the interpreter does not compile with
+# Prism, parse.y is asked as well. That second parse costs about what the
+# first does and is only paid on those interpreters.
+module Evilution::AST::SyntaxCheck
+  # How the interpreter says it compiles: `ruby 3.4.1 (...) +PRISM [...]`.
+  PRISM_INTERPRETER = RUBY_DESCRIPTION.include?("+PRISM")
+
+  def self.valid?(source, prism_interpreter: PRISM_INTERPRETER)
+    return false unless Prism.parse(source).success?
+
+    prism_interpreter || parse_y_accepts?(source)
+  end
+
+  # RubyVM::AbstractSyntaxTree is built on parse.y whatever the interpreter
+  # compiles with. It is CRuby's own: another implementation has no parse.y
+  # to ask, and there Prism's answer stands, as it does after a failure that
+  # is not about syntax.
+  def self.parse_y_accepts?(source)
+    return true unless defined?(RubyVM::AbstractSyntaxTree)
+
+    without_warnings { RubyVM::AbstractSyntaxTree.parse(source) }
+    true
+  rescue SyntaxError
+    false
+  rescue StandardError
+    true
+  end
+
+  # parse.y warns as it parses ("possibly useless use of == in void
+  # context"), which a mutant earns far more often than written code does.
+  def self.without_warnings
+    verbose = $VERBOSE
+    $VERBOSE = nil
+    yield
+  ensure
+    $VERBOSE = verbose
+  end
+
+  private_class_method :parse_y_accepts?, :without_warnings
+end

data/lib/evilution/ast/uncovered_code.rb

@@ -6,11 +6,11 @@ require_relative "included_block"
 
 # The lines of a file that hold code no subject covers: statements written in
 # a class, module or `class << self` body, or at the top level, outside every
-# method -- `scope` lambdas, callback macros, constant lists -- or in a
-# concern's `included` block, which is a class body written elsewhere. Mutations are
-# generated per subject, so a run aimed at these lines generates none of its
-# own, and saying so is the only way a reader can tell "nothing to mutate"
-# from "nothing reached".
+# method -- callback macros, DSL calls, logical writes on a constant -- or in a
+# concern's `included` or `prepended` block, which is a class body written
+# elsewhere. Mutations are generated per subject, so a run aimed at these
+# lines generates none of its own, and saying so is the only way a reader can
+# tell "nothing to mutate" from "nothing reached".
 #
 # Visibility keywords without arguments (`private`) carry no behaviour of
 # their own and are left out, as are `require` and `require_relative`: loading
@@ -55,8 +55,8 @@ module Evilution::AST::UncoveredCode
   def self.expand(node)
     return statements(node.body) if SCOPE_NODES.any? { |type| node.is_a?(type) }
 
-    included = Evilution::AST::IncludedBlock.of(node)
-    return statements(included.body) if included
+    hook = Evilution::AST::IncludedBlock.of(node) || Evilution::AST::IncludedBlock.prepended(node)
+    return statements(hook.body) if hook
     return [] if bare_visibility?(node) || load_call?(node)
 
     [node]

data/lib/evilution/cache.rb

@@ -12,7 +12,7 @@ class Evilution::Cache
   end
 
   def fetch(mutation)
-    return nil if mutation.original_source.nil?
+    return nil if stripped?(mutation)
 
     file_key = file_key(mutation)
     entry_key = entry_key(mutation)
@@ -27,7 +27,7 @@ class Evilution::Cache
   end
 
   def store(mutation, result_data)
-    return if mutation.original_source.nil?
+    return if stripped?(mutation)
 
     file_key = file_key(mutation)
     entry_key = entry_key(mutation)
@@ -49,13 +49,23 @@ class Evilution::Cache
 
   private
 
+  # Both keys digest a source, so a mutation missing either one cannot be keyed.
+  def stripped?(mutation)
+    mutation.original_source.nil? || mutation.mutated_source.nil?
+  end
+
   def file_key(mutation)
     content_hash = Digest::SHA256.hexdigest(mutation.original_source)
     "#{safe_filename(mutation.file_path)}_#{content_hash[0, 16]}"
   end
 
+  # Several operators emit more than one mutation at the same location (e.g.
+  # nil_replacement -> true / false / 0), so the location alone would let a
+  # killed sibling answer for a survivor. The original source is fixed per
+  # cache file, so a digest of the mutated source identifies the mutation.
   def entry_key(mutation)
-    "#{mutation.operator_name}:#{mutation.line}:#{mutation.column}"
+    mutated_digest = Digest::SHA256.hexdigest(mutation.mutated_source)
+    "#{mutation.operator_name}:#{mutation.line}:#{mutation.column}:#{mutated_digest[0, 16]}"
   end
 
   def safe_filename(path)

data/lib/evilution/cli/exit_guard.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../cli"
+require_relative "../isolation/in_process"
 
 # Gives evilution the final word on the process exit status.
 #
@@ -18,18 +19,28 @@ require_relative "../cli"
 # With no status recorded, evilution did not finish normally: an exception is on
 # its way out, and Ruby's own handling decides the status instead.
 #
+# One such ending has a status of its own. A mutation that takes the process
+# down under in-process isolation leaves a run that measured nothing, and Ruby
+# would end it with 1: the status of a score below the minimum. It ends with
+# the status of a tool error instead. The hook that reports the death is the
+# first to run, so the status is left to this one, after the project's hooks
+# and evilution's own cleanup.
+#
 # The hook belongs to the process that installed it. Evilution forks workers,
 # and a fork inherits its parent's at_exit hooks; a worker running this one
 # would exit with the parent's status and skip its own ending. The guard
 # therefore remembers its process and stands down anywhere else.
 class Evilution::CLI::ExitGuard
+  DIED = 2
+
   attr_accessor :status
 
-  def initialize(register: nil, exiter: nil, pid_source: nil, streams: nil)
+  def initialize(register: nil, exiter: nil, pid_source: nil, streams: nil, died: nil)
     @register = register || ->(&hook) { at_exit(&hook) }
     @exiter = exiter || ->(code) { exit!(code) }
-    @streams = streams || -> { [$stdout, $stderr] }
+    @streams = streams || -> { [$stdout, $stderr, STDOUT, STDERR] } # rubocop:disable Style/GlobalStdStream -- the process's own, whatever the globals point at
     @pid_source = pid_source || -> { Process.pid }
+    @died = died || -> { Evilution::Isolation::InProcess.died? }
     @status = nil
   end
 
@@ -42,15 +53,26 @@ class Evilution::CLI::ExitGuard
   private
 
   def fire
-    return if @status.nil?
     return unless @pid_source.call == @pid
 
+    status = final_status
+    return if status.nil?
+
     flush_streams
-    @exiter.call(@status)
+    @exiter.call(status)
+  end
+
+  def final_status
+    return @status unless @status.nil?
+
+    DIED if @died.call
   end
 
   # `exit!` leaves buffered output where it stands, so anything written by the
   # report, or by a hook that ran before this one, has to be pushed out first.
+  # The process's own streams are flushed as well as the current ones: a run
+  # that died under in-process isolation is left with the null streams of the
+  # mutation it was testing.
   def flush_streams
     @streams.call.each do |stream|
       stream.flush

data/lib/evilution/integration/base.rb

@@ -24,13 +24,21 @@ class Evilution::Integration::Base
     return load_error if load_error
 
     fire_hook(:mutation_insert_post, mutation: mutation, file_path: mutation.file_path)
-    run_tests(mutation)
+    Evilution.while_running_tests { run_tests(mutation) }
   ensure
-    @mutation_applier.restore(mutation)
+    @mutation_applier.restore(mutation) unless restored_by_applier?(load_error)
   end
 
   private
 
+  # The applier evaluates the original to tell that a mutant broke the load of
+  # its file; after that the file is as it was, and need not be restored again.
+  def restored_by_applier?(load_error)
+    return false if load_error.nil?
+
+    load_error[:load_crashed] == true
+  end
+
   def ensure_framework_loaded
     raise NotImplementedError, "#{self.class}#ensure_framework_loaded must be implemented"
   end

data/lib/evilution/integration/loading/body_call_neutralizer.rb

@@ -42,6 +42,7 @@ class Evilution::Integration::Loading::BodyCallNeutralizer
   REDECLARATION = "::Evilution::Integration::Loading::ConcernRedeclaration"
   GUARD = "#{REDECLARATION}.skipping? or ".freeze
   REDECLARE = "; #{REDECLARATION}.call(self)".freeze
+  REDECLARE_PREPENDED = "; #{REDECLARATION}.call(self, :prepended)".freeze
   CALLBACKS = "::Evilution::Integration::Loading::CallbackRedeclaration"
 
   class << self
@@ -79,8 +80,10 @@ class Evilution::Integration::Loading::BodyCallNeutralizer
   # the offset is spared inside its block: re-running one declaration replaces
   # it, while re-running the whole machine would register its
   # `after_all_transitions`-style callbacks a second time.
-  # When it is a concern's `included` block, the block is kept whole, since
-  # classes that include the concern later run all of it; every other call in
+  # A concern's `included` block is never blanked, whether or not it holds
+  # the offset: classes that include the concern later run all of it. Neither
+  # is its `prepended` block, for the classes that prepend it later.
+  # When it does hold the offset, every other call in
   # it is guarded and the block is followed by a ConcernRedeclaration call,
   # which re-declares the spared statement alone on the classes that include
   # the concern already. Both are added on existing lines, so no line moves.
@@ -125,6 +128,13 @@ class Evilution::Integration::Loading::BodyCallNeutralizer
   end
 
   class Walker < Prism::Visitor
+    CONSTANT_WRITES = [
+      Prism::ConstantWriteNode, Prism::ConstantPathWriteNode,
+      Prism::ConstantOperatorWriteNode, Prism::ConstantPathOperatorWriteNode,
+      Prism::ConstantOrWriteNode, Prism::ConstantPathOrWriteNode,
+      Prism::ConstantAndWriteNode, Prism::ConstantPathAndWriteNode
+    ].freeze
+
     def initialize(source, allowlist, edits, keep_offset, keep_lines)
       super()
       @source = source
@@ -165,12 +175,24 @@ class Evilution::Integration::Loading::BodyCallNeutralizer
         edit = edit_for(stmt)
         if kept?(edit)
           scan_kept(stmt)
-        else
+        elsif !registration_only?(stmt)
           @edits << edit
         end
       end
     end
 
+    # A concern's `included do ... end` runs nothing where it is written: it
+    # hands the block over for the classes that include the concern from then
+    # on. Blanked, it would leave the concern without one -- ConcernStateCleaner
+    # has just dropped the block it had -- and a class including the concern
+    # during the run would get none of its declarations. Left as written, it
+    # registers the same block again. `prepended do ... end` is the same hook
+    # for the classes that prepend the concern.
+    def registration_only?(stmt)
+      block = Evilution::AST::IncludedBlock.of(stmt) || Evilution::AST::IncludedBlock.prepended(stmt)
+      !block.nil?
+    end
+
     def scan_kept(stmt)
       scan_machine(stmt)
       scan_included(stmt)
@@ -191,14 +213,19 @@ class Evilution::Integration::Loading::BodyCallNeutralizer
 
     # A kept `included` block stays whole. Its other calls are guarded rather
     # than blanked, and what follows it re-declares the spared one on the
-    # classes that include the concern already.
+    # classes that include the concern already. A kept `prepended` block is
+    # treated the same, for the classes that prepend it.
     def scan_included(stmt)
-      block = Evilution::AST::IncludedBlock.of(stmt)
+      redeclare_hook(stmt, Evilution::AST::IncludedBlock.of(stmt), REDECLARE)
+      redeclare_hook(stmt, Evilution::AST::IncludedBlock.prepended(stmt), REDECLARE_PREPENDED)
+    end
+
+    def redeclare_hook(stmt, block, redeclare)
       return unless block && block.body.is_a?(Prism::StatementsNode)
 
       guard_others(block)
       end_offset = stmt.location.end_offset
-      @edits << [end_offset, end_offset, REDECLARE]
+      @edits << [end_offset, end_offset, redeclare]
     end
 
     # Guards every call of a block but the one holding the offset. When that
@@ -208,19 +235,37 @@ class Evilution::Integration::Loading::BodyCallNeutralizer
     # When it is a callback declaration, it is wrapped as it would be in a
     # class body: the block runs as the including class, so that is whose
     # chains CallbackRedeclaration rebuilds.
+    # A method defined in the block is guarded like a call, unless it holds
+    # the offset: defined again on a class that includes the concern already,
+    # it would replace what that class has since defined under the same name.
+    # So is a constant assigned there, which would lose what it has gathered
+    # since. A local variable is assigned again: the rest of the block reads it.
     def guard_others(block)
-      block.body.body.grep(Prism::CallNode).each do |call|
-        if kept?(edit_for(call))
-          machine = Evilution::AST::AasmDeclaration.machine_block(call)
-          guard_others(machine) if machine && machine.body.is_a?(Prism::StatementsNode)
-          wrap_callbacks(call)
-        else
-          start_offset = call.location.start_offset
-          @edits << [start_offset, start_offset, GUARD]
+      block.body.body.each do |statement|
+        case statement
+        when Prism::CallNode then guard_call(statement)
+        when Prism::DefNode, *CONSTANT_WRITES then guard(statement) unless holds_offset?(statement)
         end
       end
     end
 
+    def guard_call(call)
+      return guard(call) unless kept?(edit_for(call))
+
+      machine = Evilution::AST::AasmDeclaration.machine_block(call)
+      guard_others(machine) if machine && machine.body.is_a?(Prism::StatementsNode)
+      wrap_callbacks(call)
+    end
+
+    def guard(statement)
+      start_offset = statement.location.start_offset
+      @edits << [start_offset, start_offset, GUARD]
+    end
+
+    def holds_offset?(node)
+      kept?([node.location.start_offset, node.location.end_offset])
+    end
+
     def neutralizable?(stmt)
       return false unless stmt.is_a?(Prism::CallNode)
       return false if @allowlist.include?(stmt.name)

data/lib/evilution/integration/loading/concern_redeclaration.rb

@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
 require_relative "../loading"
+require_relative "own_methods"
 
 # Re-declares one statement of a concern's `included` block on the classes
-# that already include the concern.
+# that already include the concern, or of its `prepended` block on those that
+# prepend it.
 #
 # A mutation inside `included do ... scope :published, -> { } ... end` has two
 # audiences. Classes that include the concern later run the whole block, so
@@ -14,10 +16,14 @@ require_relative "../loading"
 # So the source evilution evaluates guards every other call of the block with
 # `skipping?` and ends the block with `call(self)`: the block is run once more
 # on each existing includer with the guard up, and only the mutated
-# declaration takes effect there. See BodyCallNeutralizer.
+# declaration takes effect there. What the block holds besides calls -- a
+# method definition, an assignment -- runs again as well, which is how a
+# mutated method of the block reaches those classes. A method the class has
+# defined itself over one of the block's is kept (OwnMethods). See
+# BodyCallNeutralizer.
 module Evilution::Integration::Loading::ConcernRedeclaration
   KEY = :evilution_concern_redeclaration
-  INCLUDED_BLOCK = :@_included_block
+  BLOCKS = { included: :@_included_block, prepended: :@_prepended_block }.freeze
 
   # Called through UnboundMethods: ObjectSpace hands over every class in the
   # VM, and one that defines `include?` or `superclass` of its own for its
@@ -25,37 +31,50 @@ module Evilution::Integration::Loading::ConcernRedeclaration
   INCLUDES = Module.instance_method(:include?)
   SUPERCLASS = Class.instance_method(:superclass)
   SINGLETON = Module.instance_method(:singleton_class?)
-  private_constant :KEY, :INCLUDED_BLOCK, :INCLUDES, :SUPERCLASS, :SINGLETON
+  ANCESTORS = Module.instance_method(:ancestors)
+  private_constant :KEY, :BLOCKS, :INCLUDES, :SUPERCLASS, :SINGLETON, :ANCESTORS
 
   def self.skipping?
     Thread.current[KEY] == true
   end
 
-  def self.call(concern)
-    return unless concern.instance_variable_defined?(INCLUDED_BLOCK)
+  # `hook` names the block: `:included` or `:prepended`.
+  def self.call(concern, hook = :included)
+    ivar = BLOCKS.fetch(hook)
+    return unless concern.instance_variable_defined?(ivar)
 
-    block = concern.instance_variable_get(INCLUDED_BLOCK)
-    includers(concern).each { |klass| redeclare(klass, block) }
+    block = concern.instance_variable_get(ivar)
+    takers(concern, prepended: hook == :prepended).each { |klass| redeclare(klass, block) }
   end
 
-  # The classes that include the concern themselves; a subclass inherits what
-  # its parent declares.
-  def self.includers(concern)
+  # The classes that took the concern themselves, by including it or by
+  # prepending it; a subclass inherits what its parent declares.
+  def self.takers(concern, prepended:)
     ObjectSpace.each_object(Class).select do |klass|
       next false if SINGLETON.bind_call(klass) || !INCLUDES.bind_call(klass, concern)
 
       parent = SUPERCLASS.bind_call(klass)
-      parent.nil? || !INCLUDES.bind_call(parent, concern)
+      inherited = !parent.nil? && INCLUDES.bind_call(parent, concern)
+      !inherited && prepended?(klass, concern) == prepended
     end
   end
 
+  # A prepended module comes before the class in its ancestors, an included
+  # one after it.
+  def self.prepended?(klass, concern)
+    ancestors = ANCESTORS.bind_call(klass)
+    ancestors.index(concern) < ancestors.index(klass)
+  end
+
   def self.redeclare(klass, block)
     previous = Thread.current[KEY]
     Thread.current[KEY] = true
-    klass.class_eval(&block)
+    Evilution::Integration::Loading::OwnMethods.keeping(klass, block.source_location.first) do
+      klass.class_eval(&block)
+    end
   ensure
     Thread.current[KEY] = previous
   end
 
-  private_class_method :includers, :redeclare
+  private_class_method :takers, :prepended?, :redeclare
 end

data/lib/evilution/integration/loading/concern_state_cleaner.rb

@@ -58,10 +58,10 @@ class Evilution::Integration::Loading::ConcernStateCleaner
       next unless IVAR_DEFINED.bind_call(mod, ivar)
 
       block = IVAR_GET.bind_call(mod, ivar)
-      block_file = block.source_location&.first
-      next unless block_file
+      location = block.source_location
+      next if location.nil?
 
-      expanded = File.expand_path(block_file)
+      expanded = File.expand_path(location.first)
       REMOVE_IVAR.bind_call(mod, ivar) if source_matches?(expanded, absolute, subpath)
     end
   end

data/lib/evilution/integration/loading/mutation_applier.rb

@@ -20,6 +20,14 @@ require_relative "../../diagnostic"
 # RedefinitionRecovery stays as a safety net for cases the neutralizer's
 # allowlist heuristic misses. Returns nil on success or a failure-shaped
 # hash on any error.
+#
+# A mutated source that raises while it is evaluated never reaches the tests.
+# When the original still evaluates right after it, the mutation is what broke
+# the load, and the failure is marked `load_crashed`: the mutant is detected,
+# as one that crashes a test is. When the original fails too, or there is none
+# to compare with, the failure says nothing about the mutant and stays an
+# error. A syntax error is never the mutant's doing in that sense: it means
+# the mutation was not valid Ruby to begin with.
 class Evilution::Integration::Loading::MutationApplier
   def initialize(syntax_validator: Evilution::Integration::Loading::SyntaxValidator.new,
                  constant_pinner: Evilution::Integration::Loading::ConstantPinner.new,
@@ -43,25 +51,44 @@ class Evilution::Integration::Loading::MutationApplier
   rescue SyntaxError => e
     failure_result(e, "syntax error in mutated source: #{e.message}")
   rescue ScriptError, StandardError => e
-    failure_result(e, "#{e.class}: #{e.message}")
+    load_failure_result(mutation, e)
   end
 
-  # Evaluates the mutation's restore_source, if it has one. Runs after the
+  # Evaluates the mutation's restore_source: the original file. Runs after the
   # tests: a failure here must not change the mutation's result, so it is
   # reported and swallowed. Concern state is cleared first, as it is before
   # applying: a concern ignores an `included` block handed to it twice from
   # the same place, and would keep the mutated one.
   def restore(mutation)
+    evaluate_original(mutation)
+  rescue ScriptError, StandardError => e
+    Evilution::Diagnostic.warn("[evilution] could not restore #{mutation.file_path}: #{e.class}: #{e.message}")
+  end
+
+  private
+
+  # Whether there was an original to evaluate.
+  def evaluate_original(mutation)
     source = mutation.respond_to?(:restore_source) ? mutation.restore_source : nil
-    return unless source
+    return false unless source
 
     @concern_state_cleaner.call(mutation.file_path)
     @source_evaluator.call(source, mutation.file_path)
-  rescue ScriptError, StandardError => e
-    Evilution::Diagnostic.warn("[evilution] could not restore #{mutation.file_path}: #{e.class}: #{e.message}")
+    true
   end
 
-  private
+  def original_loads?(mutation)
+    evaluate_original(mutation)
+  rescue ScriptError, StandardError
+    false
+  end
+
+  def load_failure_result(mutation, error)
+    message = "#{error.class}: #{error.message}"
+    return failure_result(error, message) unless original_loads?(mutation)
+
+    failure_result(error, "load failed: #{message}").merge(load_crashed: true)
+  end
 
   def resolve_eval_target(mutation)
     return mutation.eval_source if mutation.respond_to?(:eval_source)

data/lib/evilution/integration/loading/own_methods.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require_relative "../loading"
+
+# The methods a class defined itself, held while a concern's hook block is run
+# on it a second time.
+#
+# The first time, the block ran when the class took the concern, and whatever
+# the class went on to define under the same name replaced the block's method.
+# Run again, the block would put its own back in that place: code that is dead
+# for the class would come alive, and its tests would fail whatever the mutant.
+#
+# A method counts as the class's own when it was not written in the block's
+# file. One that is found written there afterwards was replaced by the block,
+# and is put back. A class that defines such a method in the concern's own file
+# cannot be told apart and is not protected.
+class Evilution::Integration::Loading::OwnMethods
+  # Called through UnboundMethods: a class may define any of these for its
+  # own purposes.
+  PUBLIC = Module.instance_method(:public_instance_methods)
+  PROTECTED = Module.instance_method(:protected_instance_methods)
+  PRIVATE = Module.instance_method(:private_instance_methods)
+  LOOKUP = Module.instance_method(:instance_method)
+  DEFINED = Module.instance_method(:method_defined?)
+  PRIVATELY_DEFINED = Module.instance_method(:private_method_defined?)
+  DEFINE = Module.instance_method(:define_method)
+  SINGLETON_CLASS = Kernel.instance_method(:singleton_class)
+  VISIBILITIES = { public: PUBLIC, protected: PROTECTED, private: PRIVATE }.freeze
+  SETTERS = VISIBILITIES.keys.to_h { |visibility| [visibility, Module.instance_method(visibility)] }.freeze
+  private_constant :PUBLIC, :PROTECTED, :PRIVATE, :LOOKUP, :DEFINED, :PRIVATELY_DEFINED, :DEFINE, :SINGLETON_CLASS,
+                   :VISIBILITIES, :SETTERS
+
+  Kept = Struct.new(:owner, :name, :definition, :visibility)
+  private_constant :Kept
+
+  # Runs the block, then puts back the methods of `klass` that the code of
+  # `file` replaced meanwhile -- also when the block raises.
+  def self.keeping(klass, file)
+    own = new(klass, file)
+    begin
+      yield
+    ensure
+      own.put_back
+    end
+  end
+
+  def initialize(klass, file)
+    @file = file
+    @kept = [klass, SINGLETON_CLASS.bind_call(klass)].flat_map { |owner| own_methods_of(owner) }
+  end
+
+  def put_back
+    @kept.each { |kept| restore(kept) if replaced?(kept) }
+  end
+
+  private
+
+  def own_methods_of(owner)
+    VISIBILITIES.flat_map do |visibility, list|
+      list.bind_call(owner, false).filter_map do |name|
+        definition = LOOKUP.bind_call(owner, name)
+        Kept.new(owner, name, definition, visibility) unless written_in_file?(definition)
+      end
+    end
+  end
+
+  def written_in_file?(definition)
+    location = definition.source_location
+    !location.nil? && location.first == @file
+  end
+
+  # A method the block removed stays removed.
+  def replaced?(kept)
+    return false unless defined_on?(kept.owner, kept.name)
+
+    written_in_file?(LOOKUP.bind_call(kept.owner, kept.name))
+  end
+
+  def defined_on?(owner, name)
+    DEFINED.bind_call(owner, name) || PRIVATELY_DEFINED.bind_call(owner, name)
+  end
+
+  def restore(kept)
+    DEFINE.bind_call(kept.owner, kept.name, kept.definition)
+    SETTERS.fetch(kept.visibility).bind_call(kept.owner, kept.name)
+  end
+end

data/lib/evilution/integration/loading/redefinition_recovery.rb

@@ -24,6 +24,7 @@ class Evilution::Integration::Loading::RedefinitionRecovery
 
   def initialize(constant_names: Evilution::AST::ConstantNames.new)
     @constant_names = constant_names
+    @warned_messages = Set.new
   end
 
   def call(source, &block)
@@ -73,10 +74,8 @@ class Evilution::Integration::Loading::RedefinitionRecovery
   end
 
   def warn_once_for(error)
-    return if @warned_messages&.include?(error.message)
+    return unless @warned_messages.add?(error.message)
 
-    @warned_messages ||= []
-    @warned_messages << error.message
     $stderr.write(
       "[evilution] swallowed idempotency violation on re-eval: " \
       "#{error.class}: #{error.message}. " \

data/lib/evilution/integration/loading/source_evaluator.rb

@@ -2,6 +2,7 @@
 
 require_relative "../loading"
 require_relative "reeval_warning_filter"
+require_relative "superseded_modules"
 
 # Evaluate source with __FILE__ set to the absolute original path so that
 # `require_relative` and `__dir__` resolve against the real source tree, where
@@ -13,13 +14,19 @@ require_relative "reeval_warning_filter"
 # between this eval path and a plain `require` of the same file is that we
 # substitute the mutated bytes — the privilege level is identical.
 class Evilution::Integration::Loading::SourceEvaluator
+  def initialize(superseded_modules: Evilution::Integration::Loading::SupersededModules.new)
+    @superseded_modules = superseded_modules
+  end
+
   def call(source, file_path)
     # When the isolator has chdir'd into a per-mutation sandbox (EV-wqxu /
     # GH #1278), anchor the eval __FILE__ against PROJECT_ROOT so siblings
     # `require_relative` can find each other from the real source tree.
     absolute = File.expand_path(file_path, Evilution.project_base_dir)
-    Evilution::Integration::Loading::ReevalWarningFilter.suppress do
-      eval(source, TOPLEVEL_BINDING, absolute, 1)
+    @superseded_modules.track(absolute) do
+      Evilution::Integration::Loading::ReevalWarningFilter.suppress do
+        eval(source, TOPLEVEL_BINDING, absolute, 1)
+      end
     end
   end
 end