mutineer 1.0.2 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77a6283314f6511b6ea8165477cda70f0e54bc5ba25d9e80b7afb95903d168b8
-  data.tar.gz: a7172bbd15af300e3064fa4df50a4845e4710d31c5458f6c535cb54472634a75
+  metadata.gz: 2b48ca68bd77d82bd83917312fe4bc2377954403e0a63c99702c9059b9dde07b
+  data.tar.gz: 0c11eaa74d07db731902b2fe70313f71b17eded8a59f10e5652b86985c11641c
 SHA512:
-  metadata.gz: da4882d841268217538cd4e2f327efbc5630d0d198ff38636203cb304a4a5b219af9f317097c10cfa69fc85da4c8b55570add95ff5d36cfb7a23dcf4dc12b8d9
-  data.tar.gz: 7eee3c779742a39f0828027a96d1843e9dbd0843434eba9de07bdbf8528fbbf926828471253c38e05f4ef2af5a09bc3c966f11a0482685bfce560fdd3763f228
+  metadata.gz: 23505720f25f34b80bde51fb0a900c16a40295966ec8bd14713d22eca03ea0058a69d83b3f701672adee6a20b10f342f09d8b561d974f2a8f23d12a82ba22e46
+  data.tar.gz: cb2b659574bf1454ef265e3723b2c906485589696316cb63d9fb81d7696e04867e9fec73ee36b8d67063c7d941f4165fd35c922cc47cbc19466ec839ff8cbc2c

data/CHANGELOG.md

@@ -6,6 +6,130 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-09-28
+
+### Added
+- **Operand-removal operator** (Tier-2, opt-in via `--operators`):
+  `operand_removal` replaces `a && b` with `(a)` and with `(b)`, and does the
+  same for `||`, `and` and `or`. The mutant survives when no test needs the
+  operand that the mutant removes. The operator never keeps a jump operand
+  (`return`, `break`, `next`, `redo`, `retry`) alone, because a jump does not
+  parse in a value context. It never removes an operand that holds a heredoc,
+  because the heredoc body stays behind as code. It skips nested method
+  definitions, because mutineer mutates each one as its own method.
+- **Array-literal operator** (Tier-2, opt-in via `--operators`):
+  `array_literal` replaces a non-empty array literal, such as `[a, b]` or
+  `%i[a b]`, with `[]`. The mutant survives when no test checks the contents
+  of the array. The operator skips an implicit array (`x = 1, 2`), an array
+  that holds a heredoc, and nested method definitions.
+- **Sources also pair with Minitest's `test/**/test_*.rb` files** — after the
+  `_test.rb` forms, so existing projects pair as before. `lib/helper.rb` does
+  not pair with the `test/test_helper.rb` support file. A failed capture of a
+  `test_<name>.rb` file now marks `<name>.rb` uncapturable, as `<name>_test.rb`
+  does (#120). Without `framework:` set, a source with `spec/<name>_spec.rb`
+  and `test/test_<name>.rb` but no `<name>_test.rb` now pairs with the
+  Minitest file, as the "Minitest first" order says.
+
+### Fixed
+- **`reload` loads the mutant by an absolute path** — a relative source path
+  gave the mutant relative backtrace paths, so code that checks its own frames
+  by absolute path failed for every mutant, a false kill (#123).
+- **`require "test_helper"` works without `RUBYOPT`** — a standalone run puts
+  `lib`, then each test file's `test_helper.rb` directory, on the load path,
+  as boot mode and `rake test` do. A run where no test records coverage because
+  captures failed now exits 1 instead of reporting N/A (#119).
+- **A disable-line marker warns about an operator it does not know** — a
+  reason written without `--` became part of the operator name, so the marker
+  suppressed nothing and said nothing (#124). A marker followed only by spaces
+  or commas, such as `disable-line  -- why`, now disables the whole line.
+- **Coverage capture and the clean check run each source once** — they read
+  sources with `load`, so a test's own `require` ran them again: a `Struct`
+  superclass raised `superclass mismatch`, and load-time code ran twice (#122).
+  A mutant of such a class still errors under `--strategy reload`, which loads
+  the mutated file again; `--strategy redefine` runs it.
+  Code that guards itself to run once (`unless defined?(X)`) can now show as
+  covered, so its mutants run where they were `no_coverage` before.
+- **A red unmutated suite now shows why it failed** — in a standalone run, the
+  Minitest summary or RSpec output of the failing test, with its failure
+  message, goes to stderr before the "not green" error. A passing run prints
+  nothing extra. Boot mode (`--rails`, `--boot`) is unchanged (#121).
+
+## [1.1.0] - 2026-09-28
+
+### Added
+- **Safe-navigation operator** (Tier-2, opt-in via `--operators`):
+  `safe_navigation` replaces `&.` with `.`. The mutant survives when no test
+  passes `nil` to the call.
+- **Range operator** (Tier-2, opt-in via `--operators`): `range` replaces
+  `..` with `...` and `...` with `..`. The `..` -> `...` mutant survives when
+  no test checks the last element of the range. Endless ranges (`1..`) are
+  skipped, because `(1..)` and `(1...)` give the same result for slicing,
+  `include?`, `===` and pattern matching.
+- **Negation-removal operator** (Tier-2, opt-in via `--operators`):
+  `negation_removal` removes the `!` from `!x` and the `not` from `not x`.
+  The mutant survives when no test depends on the negated value. The
+  explicit form `x.!` is skipped, because `x.` does not parse.
+
+### Changed
+- **Stderr of tests and specs is visible** in the in-process and `--daemon`
+  runs. Mutineer silences stdout once per child process and no longer hides
+  stderr, so its own child diagnostics always reach you. `--test-command`
+  runs still capture stderr with stdout and show it under `--verbose`.
+- **A mutant's test run stops at the first failing test** — one failure
+  already kills the mutant, so the forked child does not run the tests that
+  remain. Killed mutants cost less time, and survived mutants cost the same.
+  Under Minitest, when the outer reporter of the run records a failure or an
+  error (a skip does not count), each remaining test and each remaining test
+  class returns before it starts. A skipped class does not start its
+  class-level hooks. The run does not unwind: a class that is running
+  finishes normally, so its `after_all` hooks and a class-level
+  `transaction { super; raise ActiveRecord::Rollback }` still run. RSpec runs
+  with `--fail-fast`. This applies to the in-process backend only: coverage
+  capture and the clean checks still run every test, and the `--daemon` and
+  `--test-command` backends do not change. The CLI `--fail-fast` flag keeps
+  its meaning. On rack's `lib/rack/utils.rb` (`--jobs 1`), a full run takes
+  about 35–41 s instead of about 86–89 s. With the same coverage map, the
+  verdicts are the same.
+- **The mutant run uses a fixed Minitest seed** — with the stop, the test
+  order can decide the verdict, so the child runs Minitest with seed `1`
+  unless the environment sets `SEED`. The same code then gives the same
+  verdict on each run. Coverage capture and the clean checks keep the random
+  seed, so the clean check runs the tests in a random order while each mutant
+  run uses the fixed order. RSpec keeps its configured order: a suite configured with
+  `config.order = :random` can still get a different verdict on each run for
+  the case below. In an order-dependent Minitest suite, the fixed seed makes
+  a false `killed` happen on every run or on no run, not on some runs.
+- **A mutant whose failing test runs before a hanging test is now `killed`,
+  not `timeout`** — the run stops at the failure, before the hang. The tests
+  did detect the mutation, so `killed` is the correct verdict. If the hanging
+  test runs first in the fixed order, the verdict stays `timeout`. Compared
+  with a baseline from an earlier version, the score usually goes up. In an
+  order-dependent suite it can also go down: a mutant that a random order
+  killed on some runs can survive on every run in the fixed order. A change
+  to the tests can change the fixed order, so a later run can move such a
+  mutant from `killed` to `timeout`, and a `--baseline` gate then reports a
+  score drop.
+- **Some runs still run most tests** — Minitest `parallelize_me!`, and Rails
+  `parallelize` above its threshold (by default more than 50 tests in the
+  child, or at any test count when `PARALLEL_WORKERS` is 2 or more in the
+  environment), queue their tests before the first result comes back, so the
+  queued tests still run. The verdict is the same as before. Below the
+  Rails threshold, the tests run one after the other in the child, and the
+  stop works.
+
+### Fixed
+- **Tests that reopen `$stdout`** (Minitest's `capture_subprocess_io`,
+  RSpec's `to_stdout_from_any_process`) no longer make a green suite
+  "not green" or count as false kills.
+- **Test or source files that print while they load** no longer make coverage
+  capture fail with `invalid coverage output`. The capture subprocess now
+  sends its result over a separate pipe, not over stdout.
+- **Chain-link operator** (Tier-2, opt-in via `--operators`):
+  `chain_link` drops one call from a chain, with its arguments and block
+  (`user.account.name` -> `user.name`). The mutant survives when no test tells
+  the chain apart from the same chain without that step. Conversions and copies
+  (`to_s`, `to_a`, `dup`, `freeze`, ...) and `new` are never dropped.
+
 ## [1.0.2] - 2026-09-21
 
 ### Added
@@ -422,6 +546,8 @@ Rails hardening + CI batch (issues #8–#13), all verified Rails-free.
 - `.mutineer.yml` configuration (CLI > config > default precedence).
 - Byte-correct source handling for multibyte (UTF-8) sources.
 
+[1.2.0]: https://github.com/davidteren/mutineer/releases/tag/v1.2.0
+[1.1.0]: https://github.com/davidteren/mutineer/releases/tag/v1.1.0
 [1.0.2]: https://github.com/davidteren/mutineer/releases/tag/v1.0.2
 [1.0.1]: https://github.com/davidteren/mutineer/releases/tag/v1.0.1
 [1.0.0]: https://github.com/davidteren/mutineer/releases/tag/v1.0.0

data/README.md

@@ -13,6 +13,8 @@ testing anything.
 - **One mutation per mutant**, validity-checked by re-parsing.
 - **Fork-isolated**, parallel execution (Linux + macOS).
 - **Coverage-guided** — each mutant runs only the test files that cover its line.
+- **Stops at the first failing test** — in-process runs (not `--daemon` or
+  `--test-command`) stop a mutant's test run at the first failure.
 
 📖 **[mutineer.github.io →](https://davidteren.github.io/mutineer/)** — overview, operators, and usage.
 
@@ -82,7 +84,8 @@ Run `mutineer --list-operators` to see them. Default (Tier 1): `arithmetic`,
 `comparison`, `boolean_connector`, `boolean_literal`, `statement_removal`.
 Available but off by default (Tier 2, enable via `--operators`): `return_nil`,
 `literal_mutation`, `condition_negation`, `string_literal`, `regex`,
-`collection_method`.
+`collection_method`, `safe_navigation`, `range`, `negation_removal`, `chain_link`,
+`operand_removal`, `array_literal`.
 
 ## Rails apps
 
@@ -210,7 +213,7 @@ Tradeoffs — this path is correct but not free:
 Some mutants are equivalent (behaviour-identical) and survive forever — keeping a
 file off 100%. Suppress them so the score and `--threshold` gate stay meaningful:
 
-- **Inline:** `some_line # mutineer:disable-line` (or scope it: `# mutineer:disable-line comparison`).
+- **Inline:** `some_line # mutineer:disable-line` (or scope it: `# mutineer:disable-line comparison`). Put a reason after `--`: `# mutineer:disable-line comparison -- the test checks only 20`.
 - **Config:** a `.mutineer.yml` `ignore:` list of stable mutant ids. Each survivor's
   `id` is printed in the JSON report, so copy it straight into `ignore:`.
 

data/lib/mutineer/child_stdout.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Mutineer
+  # Silences stdout in a forked child that runs tests. Every fork boundary
+  # calls {.silence} once, right after `fork`, so the test runners themselves
+  # do not touch stdout. The parent reads each child's result from a separate
+  # pipe or from the exit status, never from stdout.
+  #
+  # Stderr stays open: it carries mutineer's own diagnostics from the child.
+  #
+  # Stdlib-only, so the app-side daemon can load it.
+  module ChildStdout
+    # Points fd 1 at File::NULL and makes `$stdout` the real STDOUT again.
+    #
+    # The reopen goes through STDOUT, not `$stdout`: the parent may have left
+    # `$stdout` as a StringIO, which cannot reopen. A test that calls
+    # `$stdout.reopen` (Minitest's `capture_subprocess_io`, RSpec's
+    # `to_stdout_from_any_process`) then gets a real IO. Child processes of the
+    # test inherit the silenced fd 1 too.
+    #
+    # The reopen takes an open IO, not a path. A path reopen checks the access
+    # mode of STDOUT and raises ArgumentError when a parent left STDOUT on a
+    # file in another mode (for example the "w+x" Tempfile of Minitest's
+    # `capture_subprocess_io`).
+    #
+    # Call it only in a child that exits after the tests run. Nothing restores
+    # the previous stdout.
+    #
+    # @return [void]
+    def self.silence
+      File.open(File::NULL, "w") { |null| STDOUT.reopen(null) }
+      $stdout = STDOUT
+    end
+  end
+end

data/lib/mutineer/coverage_map.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "open3"
 require "json"
 require "digest"
 require "fileutils"
@@ -9,6 +8,7 @@ require "coverage"
 require "set"
 require_relative "minitest_integration"
 require_relative "test_runners"
+require_relative "child_stdout"
 
 module Mutineer
   # Maps `(source_file, line) -> [test_files]` so each mutant runs only against
@@ -22,6 +22,10 @@ module Mutineer
     # Seconds per coverage subprocess before the parent kills it.
     DEFAULT_CAPTURE_TIMEOUT = 120
 
+    # File descriptor in a capture subprocess that carries the JSON result to
+    # the parent. Stdout stays free for test output, which goes to File::NULL.
+    RESULT_FD = 3
+
     attr_reader :project_root, :failed_test_files, :failed_clean_tests, :phase_a_ran, :map
 
     # Build a QUERY-ONLY map from data captured elsewhere (the daemon builds the
@@ -92,7 +96,7 @@ module Mutineer
     # Is this source file's empty coverage the result of an *errored* capture
     # rather than a genuine coverage gap? True iff some capture failed this run
     # AND this file got zero coverage from any successful capture AND a failed
-    # test file maps to it by the standard _test/_spec naming convention. Derived
+    # test file maps to it by the _test/_spec/test_ naming convention. Derived
     # purely from already-persisted state (@map keys + @failed_test_files); no
     # rerun, no new cached field, no digest change.
     #
@@ -138,10 +142,17 @@ module Mutineer
       @map.keys.map { |k| k.rpartition(":").first }.to_set
     end
 
-    # Basenames of failed test files with a trailing _test/_spec (and .rb) stripped,
-    # i.e. the source basenames they would have covered by convention.
+    # Basenames of the sources that failed test files pair with by convention:
+    # a trailing _test/_spec is stripped first, as pairing tries that form first.
     def failed_test_targets
-      @failed_test_files.map { |t| File.basename(t, ".rb").sub(/_(test|spec)\z/, "") }.to_set
+      @failed_test_files.map do |t|
+        name = File.basename(t, ".rb")
+        case name
+        when /_(test|spec)\z/ then name.sub(/_(test|spec)\z/, "")
+        when "test_helper" then name # Minitest's support file pairs with no source
+        else name.delete_prefix("test_")
+        end
+      end.to_set
     end
 
     # Shared cache dance for both build paths: hit the digest-keyed cache, else
@@ -232,6 +243,7 @@ module Mutineer
         rd.close
         payload =
           begin
+            ChildStdout.silence
             # Fork-safety hook: the in-process path reconnects AR; the daemon
             # routes to its worker DB. Nil (non-Rails) = no-op. Injected so this
             # file needs neither Runner (Prism) nor Rails.
@@ -293,22 +305,8 @@ module Mutineer
     # before any source is loaded. Returns the wrapped capture payload
     # (`passed` + `coverage`), or nil when the subprocess failed (logged + skipped).
     def capture(test_path)
-      out = +""
-      status = nil
-      Open3.popen2(RbConfig.ruby, "-") do |stdin, stdout, wait_thr|
-        stdin.write(subprocess_script(test_path))
-        stdin.close
-        reader = Thread.new { out << stdout.read }
-        # Bound the subprocess with a wall clock: a hanging test file must not
-        # wedge the whole run before any per-mutant timeout.
-        unless wait_thr.join(@capture_timeout)
-          Process.kill(:KILL, wait_thr.pid) rescue nil # rubocop:disable Style/RescueModifier
-          reader.kill
-          return fail_test(test_path, "timed out after #{@capture_timeout}s")
-        end
-        reader.join
-        status = wait_thr.value
-      end
+      status, out = spawn_script(subprocess_script(test_path))
+      return fail_test(test_path, "timed out after #{@capture_timeout}s") unless status
       return fail_test(test_path, "subprocess exited #{status.exitstatus}") unless status.success?
 
       parsed = JSON.parse(out)
@@ -442,20 +440,72 @@ module Mutineer
     # @param test_paths [Array<String>] test file paths.
     # @return [Boolean]
     def subprocess_clean_pass?(test_paths)
-      status = nil
-      Open3.popen2(RbConfig.ruby, "-") do |stdin, stdout, wait_thr|
-        stdin.write(clean_check_script(test_paths))
-        stdin.close
-        reader = Thread.new { stdout.read }
-        unless wait_thr.join(@capture_timeout)
-          Process.kill(:KILL, wait_thr.pid) rescue nil # rubocop:disable Style/RescueModifier
-          reader.kill
-          return false
-        end
-        reader.join
-        status = wait_thr.value
+      status, = spawn_script(clean_check_script(test_paths), result: false)
+      status&.success? || false
+    end
+
+    # Runs `script` in a fresh `ruby -` that reads the script from stdin. The
+    # child's stdout goes to File::NULL, so test output never reaches the user
+    # or the result. With `result: true`, the child writes its result as one
+    # line to fd {RESULT_FD}, a pipe that only the script uses. The child's
+    # stderr is the parent's stderr, so warnings from the script reach the
+    # user. A wall clock of `@capture_timeout` bounds the whole call, so a hung
+    # test cannot wedge the run.
+    #
+    # The parent reads one line, not until EOF: a process that a test leaves
+    # running can inherit fd {RESULT_FD} (a `fork` without `exec` keeps it
+    # despite close-on-exec) and hold the pipe open long after the child exits.
+    # A clean check reports only through its exit status, so it gets no pipe.
+    #
+    # @api private
+    # @param script [String] Ruby script text.
+    # @param result [Boolean] whether to open the result pipe on fd {RESULT_FD}.
+    # @return [Array(Process::Status, String)] the exit status and the line the
+    #   child wrote to fd {RESULT_FD} (`""` without one); `[nil, ""]` after a
+    #   timeout.
+    def spawn_script(script, result: true)
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @capture_timeout
+      script_rd, script_wr = IO.pipe
+      result_rd, result_wr = IO.pipe if result
+      options = { in: script_rd, out: File::NULL }
+      options[RESULT_FD] = result_wr if result
+      pid = Process.spawn(RbConfig.ruby, "-", **options)
+      waiter = Process.detach(pid)
+      script_rd.close
+      result_wr&.close
+      reader = Thread.new { result_rd.gets.to_s } if result
+      script_wr.write(script)
+      script_wr.close
+      unless waiter.join(remaining(deadline))
+        Process.kill(:KILL, pid) rescue nil # rubocop:disable Style/RescueModifier
+        waiter.join
+        reader&.kill
+        return [nil, ""]
       end
-      status&.success?
+      [waiter.value, reader&.join(remaining(deadline))&.value.to_s]
+    ensure
+      reader&.kill
+      [script_rd, script_wr, result_rd, result_wr].compact.each { |io| io.close unless io.closed? }
+    end
+
+    # Seconds left before `deadline`, never negative.
+    #
+    # @api private
+    # @param deadline [Float] a CLOCK_MONOTONIC time.
+    # @return [Float]
+    def remaining(deadline)
+      [deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC), 0].max
+    end
+
+    # Ruby source that opens the result channel in a {#spawn_script} child. The
+    # script runs it first, so no file that a test opens can take fd
+    # {RESULT_FD}. Close-on-exec keeps the fd out of the test's own
+    # subprocesses.
+    #
+    # @api private
+    # @return [String] Ruby script text.
+    def result_channel_expression
+      "_result = IO.new(#{RESULT_FD}, \"w\"); _result.close_on_exec = true"
     end
 
     # Runs test files in a fork of the booted parent and returns whether they passed.
@@ -473,6 +523,7 @@ module Mutineer
         rd.close
         Process.setpgid(0, 0) rescue nil # rubocop:disable Style/RescueModifier
         begin
+          ChildStdout.silence
           after_fork&.call
           Coverage.result(clear: true, stop: false) if Coverage.running?
           wr.write(Marshal.dump(TestRunners.for(@framework).run(abs_tests).zero?))
@@ -535,11 +586,15 @@ module Mutineer
         require "minitest"
         require "stringio"
         def Minitest.autorun; end
+        _report = StringIO.new
+        Minitest.define_singleton_method(:plugin_mutineer_report_init) { |options| reporter << Minitest::SummaryReporter.new(_report, options) }
+        Minitest.extensions << "mutineer_report"
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_source_paths.inspect}.each { |f| load f }
+        #{abs_source_paths.inspect}.each { |f| require f }
         #{loads}
-        $stdout = StringIO.new
-        exit(Minitest.run([]) ? 0 : 1)
+        _passed = Minitest.run([])
+        $stderr.write(_report.string) unless _passed
+        exit(_passed ? 0 : 1)
       RUBY
     end
 
@@ -559,10 +614,10 @@ module Mutineer
         end
         RSpec::Core::Runner.disable_autorun!
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_source_paths.inspect}.each { |f| load f }
+        #{abs_source_paths.inspect}.each { |f| require f }
         _sink = StringIO.new
-        $stdout = _sink
         status = RSpec::Core::Runner.run(["--no-color", #{specs}], _sink, _sink)
+        $stderr.write(_sink.string) unless status.zero?
         exit(status.zero? ? 0 : 1)
       RUBY
     end
@@ -583,31 +638,36 @@ module Mutineer
     # @return [String] Ruby script text.
     def minitest_subprocess_script(test_path)
       <<~RUBY
+        #{result_channel_expression}
         require "coverage"
         require "json"
-        require "stringio"
         require "minitest"
+        require "stringio"
         def Minitest.autorun; end
+        _report = StringIO.new
+        Minitest.define_singleton_method(:plugin_mutineer_report_init) { |options| reporter << Minitest::SummaryReporter.new(_report, options) }
+        Minitest.extensions << "mutineer_report"
         Coverage.start(lines: true)
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_source_paths.inspect}.each { |f| load f }
+        #{abs_source_paths.inspect}.each { |f| require f }
         load #{absolute(test_path).inspect}
-        _orig = $stdout
-        $stdout = StringIO.new
         _passed = Minitest.run([])
-        $stdout = _orig
-        puts JSON.generate("passed" => _passed == true, "coverage" => Coverage.result,
-                           "loaded_files" => #{loaded_files_expression})
+        $stderr.write(_report.string) unless _passed
+        _result.puts JSON.generate("passed" => _passed == true, "coverage" => Coverage.result,
+                                    "loaded_files" => #{loaded_files_expression})
+        _result.close
       RUBY
     end
 
     # Same coverage-JSON contract as the minitest path, but driven by RSpec:
-    # require rspec/core lazily, load the sources under Coverage, then run the
-    # one spec via RSpec::Core::Runner with output silenced so only the JSON
-    # reaches stdout. A missing rspec makes `require` raise -> subprocess exits
-    # non-zero -> capture() records a skipped (incomplete-map) test, with a hint.
+    # require rspec/core lazily, require the sources under Coverage, then run the
+    # one spec via RSpec::Core::Runner. The JSON goes to the result channel (see
+    # {#spawn_script}), so spec output cannot corrupt it. A missing rspec makes
+    # the script exit non-zero -> capture() records a skipped (incomplete-map)
+    # test, with a hint.
     def rspec_subprocess_script(test_path)
       <<~RUBY
+        #{result_channel_expression}
         require "coverage"
         require "json"
         require "stringio"
@@ -620,14 +680,13 @@ module Mutineer
         RSpec::Core::Runner.disable_autorun!
         Coverage.start(lines: true)
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_source_paths.inspect}.each { |f| load f }
-        _orig = $stdout
+        #{abs_source_paths.inspect}.each { |f| require f }
         _sink = StringIO.new
-        $stdout = _sink
         _status = RSpec::Core::Runner.run(["--no-color", #{absolute(test_path).inspect}], _sink, _sink)
-        $stdout = _orig
-        puts JSON.generate("passed" => _status.zero?, "coverage" => Coverage.result,
-                           "loaded_files" => #{loaded_files_expression})
+        $stderr.write(_sink.string) unless _status.zero?
+        _result.puts JSON.generate("passed" => _status.zero?, "coverage" => Coverage.result,
+                                    "loaded_files" => #{loaded_files_expression})
+        _result.close
       RUBY
     end
 

data/lib/mutineer/daemon_server.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "tempfile"
+require_relative "child_stdout"
 
 module Mutineer
   # App-side daemon (persistent worker).
@@ -177,9 +178,9 @@ module Mutineer
           # New process group so a per-fork timeout can SIGKILL the whole subtree,
           # and silence the child's stdout so test output never corrupts the IPC pipe.
           Process.setpgid(0, 0) rescue nil # rubocop:disable Style/RescueModifier
-          $stdout.reopen(File::NULL, "w")
           code =
             begin
+              ChildStdout.silence
               # Route THIS fork at its own worker database before any test loads.
               # A routing failure raises here and is scored `error`, never a false verdict.
               @worker_db&.after_fork(worker, schema_for_fork)

data/lib/mutineer/isolation.rb

@@ -3,6 +3,7 @@
 require "tempfile"
 require_relative "result"
 require_relative "parser"
+require_relative "child_stdout"
 
 module Mutineer
   # Fork-based isolation for running one mutant. The block runs in a child
@@ -26,6 +27,9 @@ module Mutineer
     # exit code) or any explicit `exit` is honoured; an unhandled exception
     # becomes exit 2 with the cause written to STDERR.
     #
+    # The child silences its stdout (see {ChildStdout.silence}) before the
+    # block runs, so test output never reaches the user. Stderr stays open.
+    #
     # @param timeout [Integer] timeout in seconds.
     # @yieldreturn [Integer] child exit status.
     # @return [Mutineer::Result] result from the child process.
@@ -36,15 +40,17 @@ module Mutineer
         Process.setpgid(0, 0) rescue nil # rubocop:disable Style/RescueModifier
         code = 0
         begin
+          ChildStdout.silence
           result = yield
           code = result.is_a?(Integer) ? result : 0
         rescue SystemExit => e
           code = e.status
         rescue Exception => e # rubocop:disable Lint/RescueException
-          warn "[mutineer-child] #{e.class}: #{e.message}"
+          # STDERR, not `warn`: a test may have left `$stderr` as a StringIO.
+          STDERR.puts "[mutineer-child] #{e.class}: #{e.message}"
           code = 2
         end
-        $stderr.flush
+        STDERR.flush
         # exit! skips at_exit handlers — critical, since a child forked from
         # inside our own Minitest suite would otherwise re-run the parent's
         # at_exit autorun hook on the way out.
@@ -93,7 +99,7 @@ module Mutineer
     # @param source_file [String] original source file path.
     # @return [Object] whatever `load` returns.
     def self.apply_whole_file(mutated, source_file)
-      Tempfile.create(["mutineer_mutant", ".rb"], File.dirname(source_file)) do |f|
+      Tempfile.create(["mutineer_mutant", ".rb"], File.dirname(File.expand_path(source_file))) do |f|
         f.write(mutated)
         f.flush
         load f.path