mutineer 0.11.0 → 0.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2dd1784f527b49eaed8d13a3e03c59c8a30082a44cf625f3a6ce1f252ffb3a60
-  data.tar.gz: 164d53165ea6f85c31158783ea43f8f2c88c3df058240d748df01f960da23897
+  metadata.gz: 42d278a96730cdf9616492a720c701ba9119195299f64fa74b339b3737e4e545
+  data.tar.gz: ef2148e5752ea9790403ca256e4bc6672b5e8c2656289d74b9cd3ffcd067f475
 SHA512:
-  metadata.gz: a8bcaae29c133ca1ac0f9da31dc143b7b5deeef347104e209386cf6029252e77586d1240440e97bcec082e9e11a355087ffda91e7ca5495de85ac0f6bf1c2155
-  data.tar.gz: 06f108bfbb0f4b32318ca120e086ce88516b036ebc622e37b81963f4f93b7a87d5cdb6403b95cd69aa7a196e910718ba52b632d376a10f2763bf05f9f94a8fc8
+  metadata.gz: 82879be78e820ef184dca76bf52ad883298f3c0e8becdb6344061b32321f44945464025c6f7d8064e9b649486b6b5f258b60b43baf0ec6f0d38356b314af5793
+  data.tar.gz: 67399daaa12b9b312a4ad0fcad144ae763783d2f5994e474b1303ad7ed0ddd5c5d42fba5b39c750115a0614356b4e4a2593238b91e39eee38edd96981c4afa5a

data/CHANGELOG.md

@@ -6,6 +6,33 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.11.1] - 2026-07-23
+
+### Fixed
+- **`--daemon` score disclosure** — stop claiming “no coverage narrowing / lower
+  bound” on every run (narrowing already ships). Warn only when the coverage map
+  is unavailable and the run falls back to the full `--test` set (#48).
+- **`--threshold` CI fidelity** — exit 1 when a positive threshold is set but the
+  run produced only errors/timeouts/uncapturable (nil score with a broken harness)
+  instead of silently green; pure no_coverage / all-ignored still skips the gate
+  (#49). Non-numeric `--threshold` / YAML `threshold` is a usage error (exit 2),
+  not a silent gate-off (#51).
+- **`--daemon` contracts** — reject `--framework rspec` (exit 2); force
+  `--strategy reload` with a clear warning when redefine was requested (daemon
+  whole-file only) (#50). **In-process `--rails` always serial** unless
+  `--daemon` (only daemon has per-worker DB isolation) (#55).
+- **Isolation timeout** — kill the child process group and honor a clean exit
+  that races the deadline (not always timeout) (#52). **External backend** —
+  signal death is `error`, not `killed` (#53).
+- **`--fail-fast` is serial** on the in-process path (matches daemon) so the
+  survivor set is deterministic under any `--jobs` (#54).
+- **Dry-run uses `collect_jobs`** so candidates match a real run (#59).
+- **Daemon schema load once per worker** (not every mutant fork) (#56).
+- **Nested `statement_removal`** visits inner statement lists (#62).
+- Dead seams: remove unused `RailsWorkerDb.provision`, simplify parallel daemon
+  fail-fast branch, drop unused `validate_daemon!` arg (#60).
+- Archive historical implementation spec under `docs/archive/` (#61).
+
 ## [0.11.0] - 2026-07-02
 
 ### Added
@@ -217,6 +244,7 @@ Rails hardening + CI batch (issues #8–#13), all verified Rails-free.
 - `.mutineer.yml` configuration (CLI > config > default precedence).
 - Byte-correct source handling for multibyte (UTF-8) sources.
 
+[0.11.1]: https://github.com/davidteren/mutineer/releases/tag/v0.11.1
 [0.11.0]: https://github.com/davidteren/mutineer/releases/tag/v0.11.0
 [0.10.0]: https://github.com/davidteren/mutineer/releases/tag/v0.10.0
 [0.9.1]: https://github.com/davidteren/mutineer/releases/tag/v0.9.1

data/lib/mutineer/cli.rb

@@ -93,12 +93,20 @@ module Mutineer
         end
         o.on("--list-operators") { show_operators = true }
         o.on("--dry-run") { opts[:dry_run] = true }
-        o.on("--fail-fast") { opts[:fail_fast] = true }
+        o.on("--fail-fast") { opts[:fail_fast] = true; explicit << :fail_fast }
         o.on("--only NAME") { |v| opts[:only] = v; explicit << :only }
         o.on("--since REF") { |v| opts[:since] = v; explicit << :since }
         o.on("--test FILE") { |v| (opts[:tests] ||= []) << v }
         o.on("--operators LIST") { |v| opts[:operators] = v.split(",").map(&:strip); explicit << :operators }
-        o.on("--threshold FLOAT") { |v| opts[:threshold] = v.to_f; explicit << :threshold }
+        o.on("--threshold FLOAT") do |v|
+          f = Float(v, exception: false)
+          if f.nil?
+            warn "mutineer: --threshold requires a number between 0 and 100 (got: #{v.inspect})"
+            exit 2
+          end
+          opts[:threshold] = f
+          explicit << :threshold
+        end
         o.on("--jobs N") { |v| opts[:jobs] = v; explicit << :jobs }
         o.on("--strategy STRAT") { |v| opts[:strategy] = v; explicit << :strategy }
         o.on("--framework NAME") { |v| opts[:framework] = v; explicit << :framework }
@@ -248,21 +256,21 @@ module Mutineer
       end
 
       validate_test_command!(config) if config.test_command
-      validate_daemon!(config, explicit) if config.daemon
 
       validate_since!(config) if config.since
       preflight_output!(config.output) if config.output
       preflight_baseline!(config.baseline) if config.baseline
 
-      # #11: when --test is omitted, infer each source's test by convention so the
-      # boot-once/fork-per-test core (which pairs empirically by coverage) gets a
-      # populated config.tests. Runs after every flag/usage check above so a
-      # mistyped flag still reports the flag; skipped under --dry-run (no tests
-      # needed). validate_paths! then sees the inferred (real) tests.
+      # When --test is omitted, infer each source's test by convention. Autopair
+      # also re-detects framework from inferred tests when --framework was not set.
       autopair!(config, explicit) unless config.dry_run
 
-      # Boot mode does no coverage selection — every mutant runs the given tests —
-      # so at least one --test file is mandatory (there is nothing to select from).
+      # Daemon validation runs AFTER autopair so auto-inferred *_spec.rb tests
+      # cannot bypass the RSpec rejection (framework would still be minitest if we
+      # validated before discovery).
+      validate_daemon!(config) if config.daemon
+
+      # Boot mode needs at least one --test file (nothing to select from otherwise).
       if config.boot && config.tests.empty?
         warn "mutineer: --boot/--rails requires at least one --test file"
         exit 2
@@ -307,28 +315,34 @@ module Mutineer
       config.jobs = 1
     end
 
-    # #26/#27 Phase 2 (U8): --daemon selects the persistent-daemon backend (boot once,
-    # fork per mutant, per-worker DB isolation). Two usage errors, both exit 2 (KTD-10):
-    # it cannot be combined with --test-command (choose ONE backend — never silently
-    # pick one), and it requires an app to boot (--rails or --boot). Under Rails,
-    # Config.resolve already keeps --jobs serial unless the user explicitly asks for
-    # parallelism, and each worker gets its own SQLite database on demand — so there is
-    # no "missing worker DB" precondition to check here for SQLite. Postgres worker-DB
-    # provisioning + its missing-DB error (KTD-9) arrives with the Postgres adapter (U10).
+    # --daemon selects the persistent-daemon backend (boot once, fork per mutant,
+    # per-worker DB isolation on SQLite). Usage errors exit 2: cannot combine with
+    # --test-command; requires --rails or --boot; minitest only; reload strategy only
+    # (redefine needs a shared VM surgical path the daemon does not ship).
     #
     # @api private
     # @param config [Mutineer::Config] run configuration.
-    # @param explicit [Set<Symbol>] explicit CLI fields.
     # @return [void]
-    def self.validate_daemon!(config, _explicit = Set.new)
+    def self.validate_daemon!(config)
       if config.test_command
         warn "mutineer: choose one backend — --daemon and --test-command cannot be combined"
         exit 2
       end
-      return if config.rails || config.boot
+      unless config.rails || config.boot
+        warn "mutineer: --daemon needs an app to boot; add --rails (or --boot FILE)"
+        exit 2
+      end
+      if config.framework == "rspec"
+        warn "mutineer: --daemon supports only --framework minitest " \
+             "(rspec is not implemented on the daemon path yet)"
+        exit 2
+      end
+      return if config.strategy == "reload"
 
-      warn "mutineer: --daemon needs an app to boot; add --rails (or --boot FILE)"
-      exit 2
+      # --rails defaults strategy to redefine; daemon always whole-file loads.
+      warn "[mutineer] --daemon uses --strategy reload " \
+           "(redefine is not supported on the daemon path); forcing reload."
+      config.strategy = "reload"
     end
 
     # --since needs a real git repo and a resolvable ref; either failure is a
@@ -458,26 +472,18 @@ module Mutineer
       reporter.report(out: $stdout, err: $stderr, threshold: config.threshold,
                       format: config.format, output: config.output, baseline: delta)
 
-      # #27/KTD-6: warn (stderr, so it never pollutes json/html) that an external
-      # run's score is not comparable to an in-process run — it has no coverage
-      # narrowing, so uncovered mutants count as survivors, and an infra failure is
-      # scored as a kill (upper bound).
+      # Warn (stderr, so it never pollutes json/html) that an external run's score
+      # is not comparable to an in-process run: no coverage narrowing (uncovered
+      # mutants count as survivors), and an infra failure is scored as a kill
+      # (upper bound). Daemon coverage fallback warnings are emitted from the runner
+      # only when the map is unavailable — not on every --daemon run.
       if config.test_command
         warn "[mutineer] --test-command score is an upper bound, not comparable to an " \
              "in-process run: no coverage narrowing (uncovered mutants count as survivors) " \
              "and an infra failure is scored as a kill."
       end
 
-      # #26/U8: same disclosure as --test-command above — the daemon backend has no
-      # coverage narrowing yet (Phase 2c), so this score is a lower bound (uncovered
-      # mutants count as survivors) and not comparable to an in-process run.
-      if config.daemon
-        warn "[mutineer] --daemon score is a lower bound, not comparable to an " \
-             "in-process run: no coverage narrowing yet (uncovered mutants count as " \
-             "survivors)."
-      end
-
-      # #14: nudge toward the opt-in tier-2 operators (human report only — never
+      # Nudge toward the opt-in tier-2 operators (human report only — never
       # pollute JSON output).
       if !%w[json html].include?(config.format) && (hint = tier2_hint(config.operators))
         puts hint
@@ -504,50 +510,37 @@ module Mutineer
         "enable with --operators <list>."
     end
 
-    # Runs dry-run mode.
+    # Runs dry-run mode. Reuses Runner.collect_jobs (+ filter_since) so the
+    # candidate list cannot drift from a real run's job selection.
     #
     # @param config [Mutineer::Config] run configuration.
     # @return [void]
     def self.dry_run(config)
       operator_classes = MutatorRegistry.resolve(config.operators || MutatorRegistry::DEFAULT_NAMES)
-      sources = {}
+      jobs, ignored_results, source_map = Runner.collect_jobs(config, operator_classes)
+      # Narrow jobs and ignored the same way so the summary matches the printed list.
+      if config.since
+        jobs = Runner.filter_since(jobs, source_map, config)
+        ignored_jobs = ignored_results.map { |r| [r.subject, r.mutation, r.id] }
+        ignored = Runner.filter_since(ignored_jobs, source_map, config).size
+      else
+        ignored = ignored_results.size
+      end
+
       per_operator = Hash.new(0)
       skipped = 0
-      ignored = 0
-      ignore_set = config.ignore.to_set
-
-      # --since narrows the preview to changed lines too, so `--dry-run --since`
-      # shows exactly what a real `--since` run would mutate.
-      changed = if config.since
-                  ChangedLines.for(ref: config.since, files: config.sources,
-                                   project_root: config.project_root)
-                end
-
-      Project.discover(config.sources, only: config.only).each do |subject|
-        source = (sources[subject.file] ||= Parser.parse_file(subject.file).source.source)
-        # #22: honor suppression so the preview matches what a real run mutates.
-        # Mirror execute's per-subject shape (ids need the full mutation list).
-        disabled = Runner.suppress_map(source)
-        mutations = operator_classes.flat_map { |klass| klass.new.mutations_for(subject, source) }
-        ids = MutantId.for_subject(subject, source, mutations)
-        mutations.each_with_index do |mutation, i|
-          unless mutation.valid?(source)
-            skipped += 1
-            next
-          end
-          line = source.byteslice(0, mutation.start_offset).count("\n") + 1
-          next if changed && !changed[File.expand_path(subject.file, config.project_root)]&.include?(line)
-
-          if Runner.suppressed?(mutation.operator, line, ids[i], disabled, ignore_set)
-            ignored += 1
-            next
-          end
-
-          per_operator[mutation.operator] += 1
-          original = source.byteslice(mutation.start_offset...mutation.end_offset)
-          puts "[#{mutation.operator}] #{subject.qualified_name}  " \
-               "#{subject.file}:#{line}  `#{original}` -> `#{mutation.replacement}`"
+      jobs.each do |subject, mutation, _id|
+        source = source_map[subject.file]
+        unless mutation.valid?(source)
+          skipped += 1
+          next
         end
+
+        line = source.byteslice(0, mutation.start_offset).count("\n") + 1
+        per_operator[mutation.operator] += 1
+        original = source.byteslice(mutation.start_offset...mutation.end_offset)
+        puts "[#{mutation.operator}] #{subject.qualified_name}  " \
+             "#{subject.file}:#{line}  `#{original}` -> `#{mutation.replacement}`"
       end
 
       total = per_operator.values.sum

data/lib/mutineer/config.rb

@@ -112,17 +112,21 @@ module Mutineer
       file_hash.each { |k, v| merged[k] = v unless explicit.include?(k) }
       config = new(**merged)
 
-      # --rails sugar: boot config/environment and prefer the surgical (redefine)
-      # strategy, which avoids writing tempfiles into the app tree and Zeitwerk
-      # reload hazards. An explicit --strategy always wins.
+      # --rails sugar: boot config/environment. Prefer redefine only for the
+      # in-process path (daemon is whole-file reload only). In-process --rails
+      # shares one test database — force serial unless --daemon.
       if config.rails
         config.boot ||= "config/environment"
-        config.strategy = "redefine" unless explicit.include?(:strategy)
-        # #12: parallel mutant forks share one database; transactional-fixture
-        # setup/teardown across processes contends and deadlocks. Default to
-        # serial under --rails; an explicit --jobs N opts back into parallelism
-        # (with the per-worker DB-isolation that implies).
-        config.jobs = 1 unless explicit.include?(:jobs)
+        unless config.daemon || explicit.include?(:strategy)
+          config.strategy = "redefine"
+        end
+        unless config.daemon
+          if config.jobs.to_i > 1
+            warn "[mutineer] --rails without --daemon runs serially (shared test DB); " \
+                 "forcing --jobs 1. Use --daemon for safe --jobs N."
+          end
+          config.jobs = 1
+        end
       end
 
       # Auto-detect the framework only when neither CLI nor config file set it
@@ -162,13 +166,20 @@ module Mutineer
       case known_key
       when "operators" then filter_operators(Array(value).map(&:to_s), file_name)
       when "jobs"      then value.to_i
-      when "threshold" then value.to_f
+      when "threshold"
+        f = Float(value, exception: false)
+        if f.nil?
+          raise ConfigError, "#{file_name}: threshold must be a number between 0 and 100 " \
+                             "(got: #{value.inspect})"
+        end
+        f
       when "require"   then Array(value).map(&:to_s)
       when "boot"      then value.to_s
       when "framework" then value.to_s
       when "rails"     then value == true || value.to_s == "true"
       when "daemon"    then value == true || value.to_s == "true"
       when "verbose"   then value == true || value.to_s == "true"
+      when "fail_fast" then value == true || value.to_s == "true"
       when "ignore"    then Array(value).map(&:to_s)
       when "baseline"  then value.to_s
       when "test_command" then value.to_s

data/lib/mutineer/daemon_server.rb

@@ -127,6 +127,8 @@ module Mutineer
         @worker_db = RailsWorkerDb.available? ? RailsWorkerDb : nil
         schema = cfg["schema"] && File.expand_path(cfg["schema"])
         @schema_path = schema if schema && File.exist?(schema)
+        # Schema is loaded once per worker slot on first use (not every mutant fork).
+        @schema_ready = {}
       rescue LoadError => e
         @errio.puts("[daemon] worker-DB routing unavailable: #{e.message}")
         @worker_db = nil
@@ -165,18 +167,18 @@ module Mutineer
       def run_mutant(req)
         timeout = req.fetch("timeout", 30)
         worker  = req.fetch("worker", 0)
+        # Load schema until the first killed/survived fork for this worker slot.
+        schema_for_fork = (@worker_db && @schema_path && !@schema_ready[worker]) ? @schema_path : nil
         pid = fork do
-          # New process group so a per-fork timeout can SIGKILL the whole subtree
-          # (carries the Phase-1 pgroup discipline), and silence the child's stdout so
-          # test-framework output can never corrupt the IPC pipe (KTD-6).
+          # New process group so a per-fork timeout can SIGKILL the whole subtree,
+          # and silence the child's stdout so test output never corrupts the IPC pipe.
           Process.setpgid(0, 0) rescue nil # rubocop:disable Style/RescueModifier
           $stdout.reopen(File::NULL, "w")
           code =
             begin
-              # Route THIS fork at its own worker database before any test loads, so
-              # concurrent workers can't clobber each other's fixtures (#26). A routing
-              # failure raises here and is scored `error` below, never a false verdict.
-              @worker_db&.after_fork(worker, @schema_path)
+              # Route THIS fork at its own worker database before any test loads.
+              # A routing failure raises here and is scored `error`, never a false verdict.
+              @worker_db&.after_fork(worker, schema_for_fork)
               apply_payload(req["payload"])
               run_tests(Array(req["tests"]))
             rescue Exception => e # rubocop:disable Lint/RescueException
@@ -186,6 +188,10 @@ module Mutineer
           exit!(code)
         end
         verdict = wait_verdict(pid, timeout)
+        # Mark ready only when the child finished cleanly after schema load
+        # (killed/survived). Timeout can interrupt mid-load_schema; error is a
+        # routing failure — both leave the slot unready so the next fork reloads.
+        @schema_ready[worker] = true if schema_for_fork && %w[killed survived].include?(verdict)
         # A SIGKILLed timeout child skipped its Tempfile unlink — sweep the orphan so
         # it can't outlive the run or trip Zeitwerk on a later fork.
         sweep_temps if verdict == "timeout"
@@ -222,7 +228,14 @@ module Mutineer
             rescue Errno::ESRCH, Errno::EPERM
               Process.kill(:KILL, pid) rescue nil # rubocop:disable Style/RescueModifier
             end
-            Process.waitpid(pid) rescue nil # rubocop:disable Style/RescueModifier
+            begin
+              _reaped, status = Process.waitpid2(pid)
+              if status && status.exited? && !status.signaled?
+                return { 0 => "survived", 1 => "killed" }.fetch(status.exitstatus, "error")
+              end
+            rescue Errno::ECHILD
+              # already reaped
+            end
             return "timeout"
           end
           sleep POLL

data/lib/mutineer/external_backend.rb

@@ -62,6 +62,12 @@ module Mutineer
         Result.timeout
       else # :exited
         return Result.survived if code&.zero?
+        # Signal death (nil exitstatus) is infrastructure, not a suite assertion
+        # failure — match Isolation/daemon (error), do not inflate kill rate.
+        if code.nil?
+          warn output if verbose && !output.empty?
+          return Result.error("test-command terminated by signal")
+        end
 
         warn output if verbose && !output.empty?
         Result.killed
@@ -151,7 +157,13 @@ module Mutineer
           rescue Errno::ESRCH, Errno::EPERM
             Process.kill(:KILL, pid) rescue nil # rubocop:disable Style/RescueModifier
           end
-          Process.waitpid(pid) rescue nil # rubocop:disable Style/RescueModifier
+          begin
+            _reaped, status = Process.waitpid2(pid)
+            # Finished cleanly between poll and kill — honor real exit code.
+            return [:exited, status.exitstatus] if status && status.exited? && !status.signaled?
+          rescue Errno::ECHILD
+            # already reaped
+          end
           return [:timeout, nil]
         end
         sleep POLL

data/lib/mutineer/isolation.rb

@@ -31,6 +31,9 @@ module Mutineer
     # @return [Mutineer::Result] result from the child process.
     def self.run(timeout: DEFAULT_TIMEOUT)
       pid = fork do
+        # Own process group so a timeout kill can reap grandchildren (match
+        # daemon/external backends). Best-effort: if setpgid fails, kill the pid.
+        Process.setpgid(0, 0) rescue nil # rubocop:disable Style/RescueModifier
         code = 0
         begin
           result = yield
@@ -48,20 +51,27 @@ module Mutineer
         exit!(code)
       end
 
-      # Single-threaded deadline poll (R2): we are the ONLY caller of waitpid
-      # on this pid, so we never reap-then-kill. We SIGKILL only after WNOHANG
-      # shows the child is still alive past the deadline — so the kill can
-      # never hit a reaped/recycled pid. Timeout is a parent-side fact
-      # (deadline reached), not status.signaled? (which is true for ANY signal
-      # death, e.g. SIGSEGV).
+      # Single-threaded deadline poll: we are the ONLY caller of waitpid on this
+      # pid, so we never reap-then-kill. SIGKILL the process group only after
+      # WNOHANG shows the child is still alive past the deadline.
       deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
       loop do
         reaped, status = Process.waitpid2(pid, Process::WNOHANG)
         return decode(status) if reaped
 
         if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
-          Process.kill(:KILL, pid) rescue nil # rubocop:disable Style/RescueModifier
-          Process.waitpid(pid) rescue nil # rubocop:disable Style/RescueModifier
+          begin
+            Process.kill(:KILL, -pid)
+          rescue Errno::ESRCH, Errno::EPERM
+            Process.kill(:KILL, pid) rescue nil # rubocop:disable Style/RescueModifier
+          end
+          begin
+            _reaped, status = Process.waitpid2(pid)
+            # Child may have finished cleanly between WNOHANG and kill; honor it.
+            return decode(status) if status && status.exited? && !status.signaled?
+          rescue Errno::ECHILD
+            # already reaped
+          end
           return Result.timeout
         end
         sleep 0.005

data/lib/mutineer/mutators/statement_removal.rb

@@ -14,17 +14,19 @@ module Mutineer
       # @return [void]
       def visit_statements_node(node)
         stmts = node.body
-        return if stmts.length < 2
-
-        stmts[0...-1].each do |stmt|
-          loc = stmt.location
-          @mutations << Mutation.new(
-            start_offset: loc.start_offset,
-            end_offset: loc.end_offset,
-            replacement: "nil",
-            operator: :statement_removal
-          )
+        if stmts.length >= 2
+          stmts[0...-1].each do |stmt|
+            loc = stmt.location
+            @mutations << Mutation.new(
+              start_offset: loc.start_offset,
+              end_offset: loc.end_offset,
+              replacement: "nil",
+              operator: :statement_removal
+            )
+          end
         end
+        # Nested statement lists (if/begin/while bodies) are separate StatementsNodes.
+        super
       end
     end
   end

data/lib/mutineer/rails_worker_db.rb

@@ -17,10 +17,9 @@ module Mutineer
   # fixtures then repopulate that isolated database per test.
   #
   # Scope: this pass ships the **SQLite** adapter (per-worker file, hermetic,
-  # spike-proven). Postgres per-worker provisioning (`CREATE DATABASE <db>-<worker>` —
-  # the measured corruption case) extends {worker_db_config}/{provision} at the marked
-  # seam in U10; until then a non-SQLite config raises a clear NotImplementedError
-  # rather than silently mis-routing.
+  # spike-proven). Postgres per-worker DBs (`CREATE DATABASE <db>-<worker>`) are not
+  # implemented yet; a non-SQLite config raises a clear NotImplementedError rather
+  # than silently mis-routing.
   #
   # Honest limit (KTD-5): routing failures surface as `error` via {verify_connection!}.
   # Re-raising an AR error that fires *inside a test body* past Minitest (so an in-test
@@ -63,7 +62,7 @@ module Mutineer
       # What's gated is runtime PROVISIONING: SQLite files are created on connect,
       # but Postgres needs an explicit `CREATE DATABASE` per worker (U10). Until that
       # lands, refuse non-SQLite loudly rather than route to a database that doesn't
-      # exist. To finish U10: implement provision() for PG and drop this guard.
+      # exist until Postgres worker creation is implemented.
       unless adapter.start_with?("sqlite")
         raise NotImplementedError,
               "worker-DB isolation currently provisions SQLite only (got adapter #{adapter.inspect}); " \
@@ -112,31 +111,8 @@ module Mutineer
       verify_connection!
     end
 
-    # Explicit, parent-side provisioning: create + schema-load every worker database
-    # up front, then restore the app's default connection. This is the EXPLICIT
-    # provisioning entry point (V2 — never silent auto-create mid-audit) and the seam
-    # U10 extends for Postgres (`CREATE DATABASE` per worker). For SQLite the files are
-    # created on connect and the schema load makes them ready; idempotent to re-run.
-    #
-    # @param worker_count [Integer] number of worker databases to provision.
-    # @param schema_path [String, nil] absolute path to `db/schema.rb`, or nil to skip.
-    # @return [void]
-    def self.provision(worker_count, schema_path)
-      return unless available?
-
-      original = ActiveRecord::Base.connection_db_config
-      (0...worker_count).each do |worker|
-        ActiveRecord::Base.establish_connection(worker_db_config(worker))
-        load_schema(schema_path) if schema_path
-      end
-    ensure
-      ActiveRecord::Base.establish_connection(original) if original
-    end
-
-    # Load a Rails `schema.rb` into the current connection with its output silenced,
-    # so a parent-side {provision} call can never spill schema chatter onto the daemon
-    # IPC pipe. (In a fork the child's stdout is already `File::NULL`; this guards the
-    # parent path too.)
+    # Load a Rails `schema.rb` into the current connection with output silenced
+    # (fork child stdout is already File::NULL; this is belt-and-braces).
     #
     # @param schema_path [String] absolute path to `db/schema.rb`.
     # @return [void]

data/lib/mutineer/reporter.rb

@@ -69,12 +69,21 @@ module Mutineer
       verdict(out, threshold) if threshold && threshold.positive?
     end
 
-    # 0 pass / 1 below threshold. Usage errors (exit 2) are the CLI's job.
+    # 0 pass / 1 below threshold or untestable-with-errors. Usage errors (exit 2)
+    # are the CLI's job. When the score is nil (nothing killed or survived), pure
+    # no_coverage / all-ignored / empty still skip the gate; if any mutant was
+    # errored, timed out, or uncapturable, fail the gate so a broken harness
+    # cannot green CI under --threshold.
     def exit_code(threshold:)
       return 0 if threshold.nil? || threshold <= 0
 
       score = @agg.mutation_score
-      return 0 if score.nil? # no testable mutants — gate skipped (warning already emitted)
+      if score.nil?
+        broken = @agg.errored_count + @agg.timeout_count + @agg.uncapturable_count
+        return 1 if @agg.total.positive? && broken.positive?
+
+        return 0 # pure no_coverage / ignored / empty — gate skipped
+      end
 
       score >= threshold ? 0 : 1
     end
@@ -380,12 +389,38 @@ module Mutineer
                  "#{@agg.ignored_count} ignored excluded"
       if score.nil?
         out.puts "Mutation score: N/A  (no covered mutants)"
-        err.puts "[mutineer] no covered mutations; mutation score is N/A and the threshold check is skipped."
+        if broken_nil_score?
+          err.puts "[mutineer] no covered mutations (#{broken_nil_score_detail}); " \
+                   "threshold gate fails under a positive --threshold (broken harness)."
+        else
+          err.puts "[mutineer] no covered mutations; mutation score is N/A and the threshold check is skipped."
+        end
       else
         out.puts "Mutation score: #{score}%  (killed / (killed + survived); #{excluded})"
       end
     end
 
+    # True when nil score is due to errors/timeouts/uncapturable (gate must fail).
+    #
+    # @api private
+    # @return [Boolean]
+    def broken_nil_score?
+      @agg.total.positive? &&
+        (@agg.errored_count + @agg.timeout_count + @agg.uncapturable_count).positive?
+    end
+
+    # Human-readable counts for a broken nil-score run.
+    #
+    # @api private
+    # @return [String]
+    def broken_nil_score_detail
+      parts = []
+      parts << "#{@agg.errored_count} errored" if @agg.errored_count.positive?
+      parts << "#{@agg.timeout_count} timeout" if @agg.timeout_count.positive?
+      parts << "#{@agg.uncapturable_count} uncapturable" if @agg.uncapturable_count.positive?
+      parts.join(", ")
+    end
+
     # #11: one line per source after the global summary, so a multi-source run
     # shows which file is weak. Omitted for a single-source run — the global
     # summary already says everything (ponytail: no redundant one-line block).
@@ -470,7 +505,13 @@ module Mutineer
     # @return [void]
     def verdict(out, threshold)
       score = @agg.mutation_score
-      return if score.nil?
+      if score.nil?
+        if broken_nil_score?
+          out.puts "FAILED: no covered mutants (#{broken_nil_score_detail}); " \
+                   "threshold #{threshold}% cannot pass with a broken harness"
+        end
+        return
+      end
 
       if score >= threshold
         out.puts "PASSED: #{score}% >= threshold #{threshold}%"

data/lib/mutineer/runner.rb

@@ -112,13 +112,15 @@ module Mutineer
       sweep_orphans(dirs)
 
       strategy = config.strategy
+      # Fail-fast must be serial: a parallel stop_when fires on the first survivor
+      # by wall-clock, not input order, so the survivor set would diverge from
+      # --jobs 1 (daemon already forces serial for the same reason).
+      jobs_n = config.fail_fast ? 1 : config.jobs
       results =
         begin
           framework = config.framework
-          # #21: --fail-fast stops scheduling new mutants after the first survivor;
-          # in-flight workers drain, unscheduled jobs stay nil (dropped below).
           stop_when = config.fail_fast ? ->(r) { r.survived? } : nil
-          bare = WorkerPool.new(config.jobs).run(jobs, stop_when: stop_when) do |subject, mutation|
+          bare = WorkerPool.new(jobs_n).run(jobs, stop_when: stop_when) do |subject, mutation|
             run(mutation, source_file: subject.file, coverage_map: coverage_map,
                 subject: subject, strategy: strategy, rails: config.rails, framework: framework)
           end
@@ -229,13 +231,12 @@ module Mutineer
       end
     end
 
-    # #26/#27 Phase 2a — daemon backend orchestration (serial). Boots the app ONCE in
-    # a persistent subprocess and forks per mutant, restoring the one-boot speed the
-    # Phase 1 subprocess path gives up. Tool-side we build the ready-to-`load` payload
-    # (KTD-2/KTD-3: whole-file reload by default — the spike-proven path) and ship it;
-    # the daemon needs no Prism/mutineer. Serial in 2a (worker-DB isolation +
-    # parallelism is Phase 2b). No coverage narrowing yet (Phase 2c), so every mutant
-    # runs the full `--test` set.
+    # Daemon backend: boot the app once in a persistent subprocess and fork per
+    # mutant. Tool-side we build the ready-to-`load` payload (whole-file reload by
+    # default) and ship it; the daemon needs no Prism/mutineer. Coverage is built
+    # once via a short-lived daemon so each mutant runs only its covering tests.
+    # When jobs > 1, each worker uses its own database (SQLite). Fail-fast forces
+    # serial so the survivor set matches jobs 1.
     #
     # @return [Array(Mutineer::AggregateResult, Hash<String,String>)] aggregate and source map.
     def self.execute_daemon(config, operator_classes)
@@ -243,10 +244,9 @@ module Mutineer
       jobs = filter_since(jobs, source_map, config) if config.since
       abs_tests = config.tests.map { |t| File.expand_path(t, config.project_root) }
 
-      # #26/U7: build the coverage map once (app-side, via a short-lived daemon) so
-      # each mutant runs ONLY its covering tests and a mutant on an uncovered line is
-      # no_coverage. nil when the build fails — the runners fall back to the full
-      # --test set (no narrowing) rather than mis-scoring everything as no_coverage.
+      # Build the coverage map once (app-side). nil when the build fails — runners
+      # fall back to the full --test set (and emit a stderr warning) rather than
+      # mis-scoring everything as no_coverage.
       coverage_map = daemon_coverage_map(config, abs_tests)
 
       # #26/U6: worker count = resolved --jobs, capped at the job count (no idle
@@ -270,24 +270,16 @@ module Mutineer
       [AggregateResult.new(results + ignored_results), source_map]
     end
 
-    # #26/U7: build the coverage map via a short-lived daemon (boots the app once,
-    # captures per-test coverage app-side, ships the map back). Returns a query-only
+    # Build the coverage map via a short-lived daemon (boots the app once, captures
+    # per-test coverage app-side, ships the map back). Returns a query-only
     # CoverageMap, or nil when the build fails / returns empty — callers then run the
-    # full --test set (no narrowing) rather than mis-scoring. The dedicated daemon
-    # costs one extra boot; correctness over that boot (ponytail — the map is reused
-    # for every mutant).
+    # full --test set. Coverage-build IPC has no wall-clock (same limitation as
+    # in-process build_via_fork). A normal nonempty map scores like in-process;
+    # nil falls back to the full suite (more testing, not comparable).
     #
     # @param config [Mutineer::Config] the run config.
     # @param abs_tests [Array<String>] absolute --test paths.
     # @return [Mutineer::CoverageMap, nil]
-    #
-    # ponytail: the coverage-build IPC read is unbounded (no wall-clock) — a --test
-    # file that infinite-loops during capture wedges this call, mirroring the existing
-    # in-process build_via_fork limitation. A capture timeout is a follow-up. When the
-    # map comes back empty (all captures failed), this returns nil and the run falls
-    # back to the FULL --test set per mutant — so on a total capture failure the daemon
-    # score is an upper bound (more testing), diverging from the in-process no_coverage
-    # scoring for that degenerate case only; a normal (nonempty) map scores identically.
     def self.daemon_coverage_map(config, abs_tests)
       client = DaemonClient.new(boot: daemon_boot_config(config, abs_tests, coverage: true),
                                 app_root: config.project_root).start
@@ -296,14 +288,30 @@ module Mutineer
       ensure
         client.quit
       end
-      return nil unless data && !(data["map"] || {}).empty?
+      unless data && !(data["map"] || {}).empty?
+        reason = data.is_a?(Hash) && data["error"] ? data["error"] : "empty map"
+        warn_daemon_coverage_fallback(reason)
+        return nil
+      end
 
       CoverageMap.from_data(map: data["map"], failed_test_files: data["failed_test_files"] || [],
                             project_root: config.project_root)
-    rescue DaemonBootError
+    rescue DaemonBootError => e
+      warn_daemon_coverage_fallback("#{e.class}: #{e.message}")
       nil
     end
 
+    # Stderr note when daemon coverage is unavailable (full --test set per mutant).
+    #
+    # @api private
+    # @param reason [String] short cause (boot error message, empty map, …).
+    # @return [void]
+    def self.warn_daemon_coverage_fallback(reason = "unknown")
+      warn "[mutineer] daemon coverage map unavailable (#{reason}); running every " \
+           "mutant against the full --test set (score not comparable to an in-process run)."
+    end
+    private_class_method :warn_daemon_coverage_fallback
+
     # Serial daemon path: one daemon (worker 0), one mutant at a time. Honors
     # --fail-fast (#21: stop at the first survivor).
     #
@@ -324,24 +332,16 @@ module Mutineer
       results
     end
 
-    # Parallel daemon path (#26/U6): N daemon handles, each pinned to its own worker
-    # slot (→ its own DB, so concurrent workers can't clobber each other's fixtures).
-    # A shared queue of job indices feeds N tool-side threads; each thread blocks on
-    # IPC (GVL released), so the N daemons run genuinely concurrently. Results are
-    # placed by input index and compacted, so the verdict SET is identical to serial
-    # regardless of finish order (R7). `execute_daemon` never calls this with
-    # `config.fail_fast` set (forced to the serial path instead) — a wall-clock stop
-    # here, unlike serial's input-index break, would make the survivor set and score
-    # non-deterministic. The stop-flag machinery below stays as a defensive no-op for
-    # any direct caller that bypasses that guard.
+    # Parallel daemon path: N daemon handles, each pinned to its own worker slot
+    # (own DB). A shared queue of job indices feeds N tool-side threads; results
+    # are placed by input index so the verdict set matches serial. Callers must
+    # not pass fail_fast here (execute_daemon forces serial for fail-fast).
     #
     # @return [Array<Mutineer::Result>] completed results in input order.
     def self.run_daemon_parallel(jobs, worker_count, config, abs_tests, coverage_map, source_map)
-      results    = Array.new(jobs.size)
-      queue      = Queue.new
+      results = Array.new(jobs.size)
+      queue   = Queue.new
       jobs.each_index { |i| queue << i }
-      stop       = false
-      stop_mutex = Mutex.new
 
       clients = Array.new(worker_count) do
         DaemonClient.new(boot: daemon_boot_config(config, abs_tests),
@@ -350,15 +350,13 @@ module Mutineer
 
       clients.each_with_index.map do |client, worker|
         Thread.new do
-          until stop_mutex.synchronize { stop }
+          loop do
             i = begin
-              queue.pop(true) # non-blocking; ThreadError when drained
+              queue.pop(true)
             rescue ThreadError
               break
             end
-            r = daemon_job_result(jobs[i], i, client, worker, config, coverage_map, abs_tests, source_map)
-            results[i] = r
-            stop_mutex.synchronize { stop = true } if config.fail_fast && r.survived?
+            results[i] = daemon_job_result(jobs[i], i, client, worker, config, coverage_map, abs_tests, source_map)
           end
         ensure
           client.quit
@@ -433,8 +431,9 @@ module Mutineer
       [:run, chosen.map { |t| File.expand_path(t, coverage_map.project_root) }]
     end
 
-    # Default per-mutant timeout on the daemon path. Generous because 2a runs the full
-    # `--test` set per mutant (no coverage narrowing until Phase 2c).
+    # Default per-mutant timeout on the daemon path (seconds). Coverage narrowing
+    # usually keeps each job short; this still covers a slow suite or full-suite
+    # fallback when the coverage map is unavailable.
     DAEMON_TIMEOUT = 60
 
     # The boot config the daemon needs to boot the app once: where to boot, the test

data/lib/mutineer/version.rb

@@ -2,5 +2,5 @@
 
 module Mutineer
   # Current Mutineer release version.
-  VERSION = "0.11.0"
+  VERSION = "0.11.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mutineer
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.11.1
 platform: ruby
 authors:
 - David Teren