mutineer 1.5.0 → 1.7.0

data/lib/mutineer/coverage_map.rb

@@ -9,10 +9,15 @@ require "set"
 require_relative "minitest_integration"
 require_relative "test_runners"
 require_relative "child_stdout"
+require_relative "orphan_guard"
+require_relative "redaction"
 require_relative "project_path"
 require_relative "pairing"
 
 module Mutineer
+  # A `--coverage-from` capture that cannot be read, or does not fit this run.
+  class CoverageFromError < StandardError; end
+
   # Maps `(source_file, line) -> [test_files]` so each mutant runs only against
   # the tests that actually exercise its line. Built once, then queried per
   # mutant via #tests_for. Persisted to .mutineer/coverage.json with a
@@ -28,8 +33,36 @@ module Mutineer
     # the parent. Stdout stays free for test output, which goes to File::NULL.
     RESULT_FD = 3
 
+    # Seconds a capture waits for its result after the child exits in time.
+    # The result is already in the pipe then; the wait only lets the reader
+    # thread run, even when the capture deadline has passed (#129).
+    RESULT_GRACE = 1
+
     attr_reader :project_root, :failed_test_files, :failed_clean_tests, :phase_a_ran, :map
 
+    # The source lines that ran while the app booted or the sources and the
+    # `--require` files loaded, before any test ran, as a Set of "file:line"
+    # keys like {#map}'s (#187, #217).
+    # A mutant on such a line can change a value computed before the mutant was
+    # applied, so its verdict is not trusted (`ran_at_load`).
+    #
+    # @return [Set<String>]
+    attr_reader :load_lines
+
+    # The source methods that were called while the app booted or the sources
+    # and the `--require` files loaded, as a Set of "file:line:column" keys of
+    # their `def` (#209). Line coverage cannot tell this for a one-line or
+    # endless method: its `def` line counts when the method is defined.
+    #
+    # @return [Set<String>]
+    attr_reader :load_methods
+
+    # Seconds each test file took to capture, keyed by project-relative path
+    # (#203). {#order_tests} runs the cheaper files first.
+    #
+    # @return [Hash{String => Float}]
+    attr_reader :timings
+
     # Build a QUERY-ONLY map from data captured elsewhere (the daemon builds the
     # map app-side and ships `map` + `failed_test_files` over IPC; the tool
     # reconstructs it here for per-mutant selection). Skips the capture machinery
@@ -40,10 +73,18 @@ module Mutineer
     # @param failed_test_files [Array<String>] test files whose capture failed.
     # @param project_root [String] project root (for path relativization).
     # @param failed_clean_tests [Array<String>] test files whose unmutated run failed.
+    # @param load_lines [Array<String>, Set<String>] "file:line" keys that ran at load ({#load_lines}).
+    # @param load_methods [Array<String>, Set<String>] "file:line:column" keys of methods called at load
+    #   ({#load_methods}).
+    # @param timings [Hash{String => Float}] capture seconds per test file ({#timings}).
     # @return [Mutineer::CoverageMap] a query-only map.
-    def self.from_data(map:, failed_test_files:, project_root:, failed_clean_tests: [])
+    def self.from_data(map:, failed_test_files:, project_root:, failed_clean_tests: [], load_lines: [],
+                       load_methods: [], timings: {})
       instance = allocate
       instance.instance_variable_set(:@map, map || {})
+      instance.instance_variable_set(:@timings, timings || {})
+      instance.instance_variable_set(:@load_lines, Set.new(load_lines || []))
+      instance.instance_variable_set(:@load_methods, Set.new(load_methods || []))
       instance.instance_variable_set(:@failed_test_files, failed_test_files || [])
       instance.instance_variable_set(:@failed_clean_tests, failed_clean_tests || [])
       instance.instance_variable_set(:@project_root, project_root)
@@ -53,10 +94,12 @@ module Mutineer
     def initialize(source_paths:, test_paths:, cache_dir: ".mutineer",
                    load_paths: ["lib"], project_root: Dir.pwd,
                    capture_timeout: DEFAULT_CAPTURE_TIMEOUT, boot_path: nil,
-                   framework: "minitest", verbose: false)
+                   framework: "minitest", verbose: false, require_paths: [], coverage_from: nil)
       @source_paths = Array(source_paths)
+      @require_paths = Array(require_paths)
       @test_paths   = Array(test_paths)
       @cache_dir    = cache_dir
+      @coverage_from = coverage_from
       @load_paths   = Array(load_paths)
       @project_root = project_root
       @capture_timeout = capture_timeout
@@ -66,6 +109,9 @@ module Mutineer
       @map          = {}
       @failed_test_files = []
       @failed_clean_tests = []
+      @load_lines   = Set.new
+      @load_methods = Set.new
+      @timings      = {}
       @loaded_dependencies = {}
       @phase_a_ran  = false
     end
@@ -83,8 +129,15 @@ module Mutineer
     # the booted parent instead. Inverts into the same map #tests_for reads, and
     # reuses the digest cache (the digest mixes in the boot file so a boot cache
     # never collides with a standalone one).
+    #
+    # The lines that ran during boot are read here on every run, cache or not:
+    # the boot runs every time, and no test is credited with those lines.
     def build_via_fork(after_fork: nil)
       warn_external_sources
+      # Matched by real path in #record_load: a Coverage key is the path as
+      # required, which can differ from the configured one (/var, /private/var).
+      booted = Coverage.running? ? Coverage.peek_result : {}
+      record_load(booted.transform_values { |v| v.is_a?(Hash) ? load_entry(v[:lines], v[:methods]) : v })
       cached_or(after_fork: after_fork) { run_phase_a_via_fork(after_fork: after_fork) }
     end
 
@@ -95,6 +148,54 @@ module Mutineer
       @map["#{relativize(file)}:#{line}"] || []
     end
 
+    # The covering `tests` of a mutant in `file`, in the order a mutant run
+    # loads them (#203): the files {Pairing.infer_tests} pairs with `file`
+    # first, then the cheapest by {#timings}. A file with no timing comes
+    # after the timed ones, and the path breaks a tie, so the same cache gives
+    # the same order on every run. Costs compare in doubling buckets
+    # (`log2(seconds - fastest + 1)`), so files of close cost keep their path
+    # order when a rebuild measures them again. Taking off the fastest
+    # captured file's time removes the startup cost every standalone capture
+    # pays; a failed capture is timed again on each run, so it does not count.
+    # A run that stops at the first failure then reaches a fast killing test
+    # before a slow file uses up the timeout.
+    #
+    # @param file [String] the mutated source file path.
+    # @param tests [Array<String>] project-relative test paths from {#tests_for}.
+    # @return [Array<String>] the same paths, reordered.
+    def order_tests(file, tests)
+      rel = relativize(absolute(file))
+      @paired ||= {}
+      paired = @paired[rel] ||= Pairing.infer_tests(rel, project_root: @project_root,
+                                                         prefer: @framework || "minitest")
+      base = @timings.except(*@failed_test_files).values.min || 0
+      tests.sort_by do |t|
+        cost = @timings[t]
+        [paired.include?(t) ? 0 : 1, cost ? Math.log2(cost - base + 1).floor : Float::INFINITY, t]
+      end
+    end
+
+    # True when `file:line` ran while the app booted or the sources loaded
+    # (see {#load_lines}).
+    #
+    # @param file [String] source file path.
+    # @param line [Integer] 1-based line.
+    # @return [Boolean]
+    def ran_at_load?(file, line)
+      @load_lines.include?("#{relativize(file)}:#{line}")
+    end
+
+    # True when the method whose `def` starts at `line` and `column` of `file`
+    # was called while the app booted or the sources loaded (see {#load_methods}).
+    #
+    # @param file [String] source file path.
+    # @param line [Integer] 1-based line of the `def`.
+    # @param column [Integer] 0-based byte column of the `def`.
+    # @return [Boolean]
+    def method_ran_at_load?(file, line, column)
+      @load_methods.include?("#{relativize(file)}:#{line}:#{column}")
+    end
+
     # Is this source file's empty coverage the result of an *errored* capture
     # rather than a genuine coverage gap? True iff some capture failed this run
     # AND this file got zero coverage from any successful capture AND a failed
@@ -271,9 +372,26 @@ module Mutineer
     # @return [Mutineer::CoverageMap] self.
     def cached_or(after_fork: nil)
       @digest = compute_digest
+      return reuse_capture(after_fork) if @coverage_from
+
       cached = read_cache
-      if cached && cached["digest"] == @digest && dependencies_match?(cached)
+      # A cache from before load methods (#209) or test timings (#203) were
+      # saved rebuilds once. A cache that does not record this process's
+      # PARALLEL_WORKERS value rebuilds too. Rails reads that value inside
+      # parallelize, so a map from another worker count selects the wrong
+      # tests. The daemon writes this same file. Boot mode reads its load
+      # lines and methods from the live boot instead (#build_via_fork), but
+      # its map from before #209 lacks the `def` lines of the methods each
+      # test called.
+      if cached && cached["digest"] == @digest && dependencies_match?(cached) &&
+         cached.key?("load_methods") && cached.key?("timings") &&
+         parallel_workers_match?(cached)
         @map = cached["map"] || {}
+        @timings = cached["timings"] || {}
+        unless @boot_path
+          @load_lines = Set.new(cached["load_lines"])
+          @load_methods = Set.new(cached["load_methods"])
+        end
         @failed_test_files = cached["failed_test_files"] || []
         @failed_clean_tests = []
         @loaded_dependencies = cached["dependencies"] || {}
@@ -291,18 +409,152 @@ module Mutineer
       self
     end
 
+    # Takes the map from the `--coverage-from` capture instead of capturing,
+    # keeping only this run's sources, then runs the tests clean. A mutant runs
+    # only the tests that cover its line, often one file alone, so each test
+    # that covers one of this run's sources runs alone, as on a cache hit: a
+    # test that fails alone here would otherwise kill every mutant it runs. The
+    # other tests never run alone in this run, so only the combined check
+    # covers them.
+    #
+    # @api private
+    # @param after_fork [Proc, nil] boot-mode fork hook.
+    # @return [Mutineer::CoverageMap] self.
+    # @raise [Mutineer::CoverageFromError] when the capture does not fit.
+    def reuse_capture(after_fork)
+      cached = accepted_capture
+      sources = source_fingerprints.keys.to_set
+      @map = cached["map"].select { |key, _| sources.include?(key_source(key)) }
+      @timings = cached["timings"] || {}
+      @failed_test_files = []
+      @failed_clean_tests = []
+      @loaded_dependencies = cached["dependencies"]
+      covering = @map.values.flatten.to_set
+      verify_cached_clean(after_fork: after_fork,
+                          test_paths: @test_paths.select { |t| covering.include?(relativize(t)) })
+      verify_combined_clean(after_fork: after_fork)
+      save
+      self
+    end
+
+    # The parsed `--coverage-from` capture, once it fits this run.
+    #
+    # @api private
+    # @return [Hash] the parsed coverage.json.
+    # @raise [Mutineer::CoverageFromError] when it cannot be read or does not fit.
+    def accepted_capture
+      if File.expand_path(@coverage_from) == File.expand_path(cache_path)
+        raise CoverageFromError, "--coverage-from #{@coverage_from} is this run's own cache; give the run another --cache-dir"
+      end
+
+      cached = JSON.parse(File.read(@coverage_from))
+      reason = capture_mismatch(cached)
+      raise CoverageFromError, "--coverage-from #{@coverage_from} cannot be reused: #{reason}" if reason
+
+      cached
+    rescue SystemCallError, JSON::ParserError => e
+      raise CoverageFromError, "--coverage-from #{@coverage_from} cannot be read: #{e.message}"
+    end
+
+    # Why a capture does not fit this run, or nil when it does.
+    #
+    # @api private
+    # @param cached [Object] the parsed coverage.json.
+    # @return [String, nil]
+    def capture_mismatch(cached)
+      return "it is not a coverage cache" unless cached.is_a?(Hash) && cached["map"].is_a?(Hash)
+      unless cached["sources"] && cached["owners"] && cached["inputs"]
+        return "it has no source fingerprints; capture it again with this version and --rails/--boot"
+      end
+      return "its entries are not the shape a coverage cache saves; capture it again" unless well_formed_capture?(cached)
+      return "its tests, --require files, boot file, load paths or framework differ" unless cached["inputs"] == compute_digest(inputs_only: true)
+
+      fingerprints = source_fingerprints
+      missing = fingerprints.keys - cached["sources"].keys
+      return "it was not captured over #{missing.join(', ')}" if missing.any?
+
+      changed = fingerprints.reject { |rel, fingerprint| cached["sources"][rel] == fingerprint }.keys
+      return "#{changed.join(', ')} changed since the capture" if changed.any?
+
+      owners = ownership_paths - cached["owners"]
+      return "#{owners.join(', ')} appeared since the capture and can own a split test" if owners.any?
+
+      # The capture can list owners of sources outside this run, so compare
+      # with the disk, not with this run's owners.
+      gone = cached["owners"].reject { |rel| File.file?(absolute(rel)) }
+      return "#{gone.join(', ')} disappeared since the capture and could own a split test" if gone.any?
+
+      return "a file its tests loaded changed since the capture" unless dependencies_match?(cached)
+      unless parallel_workers_match?(cached)
+        return "it was captured with PARALLEL_WORKERS=#{cached['parallel_workers'].inspect}, " \
+               "this run has #{ENV.fetch('PARALLEL_WORKERS', nil).inspect}"
+      end
+
+      failed = Array(cached["failed_test_files"])
+      return "capture failed for #{failed.join(', ')}" if failed.any?
+
+      moved = load_mismatch(cached, fingerprints.keys.to_set)
+      return nil if moved.empty?
+
+      "lines of #{moved.join(', ')} ran at load in only one of the capture and this run: loading the capture's " \
+        "other sources ran them. Under --strategy redefine, eager-load in both (config.eager_load = true)"
+    end
+
+    # True when every entry the reuse reads has the type {#save} writes, so a
+    # hand-edited or foreign file is rejected with a reason, not a backtrace.
+    #
+    # @api private
+    # @param cached [Hash] the parsed coverage.json.
+    # @return [Boolean]
+    def well_formed_capture?(cached)
+      strings = ->(value) { value.is_a?(Array) && value.all?(String) }
+      cached["inputs"].is_a?(String) && strings.(cached["owners"]) &&
+        cached["sources"].is_a?(Hash) && cached["sources"].all? { |k, v| k.is_a?(String) && v.is_a?(String) } &&
+        cached["map"].all? { |k, v| k.is_a?(String) && strings.(v) } &&
+        %w[load_lines load_methods].all? { |key| cached[key].nil? || strings.(cached[key]) } &&
+        (cached["timings"].nil? || cached["timings"].is_a?(Hash))
+    end
+
+    # This run's sources whose load lines or load methods differ in the capture.
+    #
+    # @api private
+    # @param cached [Hash] the parsed coverage.json.
+    # @param sources [Set<String>] project-relative source paths.
+    # @return [Array<String>] the sources that differ, sorted.
+    def load_mismatch(cached, sources)
+      owned = ->(keys) { Array(keys).select { |key| sources.include?(key_source(key)) }.to_set }
+      moved = (owned.(cached["load_lines"]) ^ owned.(@load_lines)) + (owned.(cached["load_methods"]) ^ owned.(@load_methods))
+      moved.map { |key| key_source(key) }.uniq.sort
+    end
+
+    # Fingerprint of each source, by project-relative path.
+    #
+    # @return [Hash{String => String}]
+    def source_fingerprints
+      @source_paths.to_h { |p| [relativize(absolute(p)), file_fingerprint(absolute(p))] }
+    end
+
+    # The source path of a "file:line" or "file:line:column" key.
+    #
+    # @param key [String] a map, load line or load method key.
+    # @return [String]
+    def key_source(key) = key.sub(/(?::\d+)+\z/, "")
+
     # Runs standalone coverage capture.
     #
     # @api private
     def run_phase_a
       @phase_a_ran = true
       @map = {}
+      @load_lines = Set.new
+      @load_methods = Set.new
+      @timings = {}
       @failed_test_files = []
       @failed_clean_tests = []
       @loaded_dependencies = {}
 
       @test_paths.each do |test_path|
-        payload = capture(test_path)
+        payload = timed(test_path) { capture(test_path) }
         next unless payload
 
         accept_capture_payload(test_path, payload)
@@ -317,51 +569,83 @@ module Mutineer
     def run_phase_a_via_fork(after_fork:)
       @phase_a_ran = true
       @map = {}
+      @timings = {}
       @failed_test_files = []
       @failed_clean_tests = []
       @loaded_dependencies = {}
       abs_sources = abs_source_paths
 
       @test_paths.each do |test_path|
-        # Tri-state payload: Hash = capture result, String = error diagnostic from
-        # the child, nil = pipe gone / empty. The String diagnostic is what
-        # becomes an :uncapturable status.
-        case (payload = fork_capture(absolute(test_path), abs_sources, after_fork))
-        when Hash then accept_capture_payload(test_path, payload)
-        when String
-          fail_test(test_path, @verbose ? "fork capture failed: #{payload}" :
-            "fork capture produced no result (re-run with --verbose for the error)")
-        else fail_test(test_path, "fork capture produced no result")
-        end
+        accept_fork_payload(test_path, timed(test_path) { fork_capture(absolute(test_path), abs_sources, after_fork) })
+      end
+    end
+
+    # Runs the block, a capture of `test_path`, and records its wall-clock
+    # seconds in {#timings}. The parent times the whole capture, so the
+    # numbers compare files, not exact test cost.
+    #
+    # @api private
+    # @param test_path [String] test file path.
+    # @yieldreturn [Object] the capture result.
+    # @return [Object] the block's value.
+    def timed(test_path)
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      value = yield
+      @timings[relativize(test_path)] = (Process.clock_gettime(Process::CLOCK_MONOTONIC) - started).round(3)
+      value
+    end
+
+    # Records a {#fork_capture} result. Hash = capture result, String = error
+    # diagnostic from the child, :timeout = the capture deadline passed, nil =
+    # pipe gone / empty. The String diagnostic is what becomes an
+    # :uncapturable status.
+    #
+    # @api private
+    # @param test_path [String] test file path.
+    # @param payload [Hash, String, Symbol, nil] what {#fork_capture} returned.
+    # @return [void]
+    def accept_fork_payload(test_path, payload)
+      case payload
+      when Hash then accept_capture_payload(test_path, payload)
+      when :timeout then fail_test(test_path, "timed out after #{@capture_timeout}s")
+      when String
+        fail_test(test_path, @verbose ? "fork capture failed: #{payload}" :
+          "fork capture produced no result (re-run with --verbose for the error)")
+      else fail_test(test_path, "fork capture produced no result")
       end
     end
 
     # Fork the booted parent, run one test under the inherited Coverage, and
-    # return its per-source counts hash (or nil on failure). Reuses the same
+    # return its per-source counts hash, a String diagnostic on failure, or
+    # :timeout after `@capture_timeout` (see {#await_child}). Reuses the same
     # fork + Marshal-over-pipe + hard-exit! discipline as WorkerPool/Isolation.
     def fork_capture(abs_test, abs_sources, after_fork)
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @capture_timeout
       rd, wr = IO.pipe
       # Marshal output is binary: an un-binmoded pipe can raise
       # Encoding::UndefinedConversionError on write, which the child's rescue then
       # swallows, losing the real error and yielding a bare "no result".
       rd.binmode
       wr.binmode
+      parent = Process.pid
       pid = fork do
         rd.close
+        Process.setpgid(0, 0) rescue nil # rubocop:disable Style/RescueModifier
+        OrphanGuard.start(parent)
         payload =
           begin
             ChildStdout.silence
             # Fork-safety hook: the in-process path reconnects AR; the daemon
-            # routes to its worker DB. Nil (non-Rails) = no-op. Injected so this
-            # file needs neither Runner (Prism) nor Rails.
+            # drops its protocol channel and routes to its worker DB. Nil =
+            # no-op. Injected so this file needs neither Runner (Prism) nor Rails.
             after_fork&.call
             Coverage.result(clear: true, stop: false) # discard pre-test delta
             passed = TestRunners.for(@framework).run([abs_test]).zero?
-            # lines:true yields {file => {lines: [...]}}; reduce to the counts
+            # {file => {lines: [...], methods: {...}}}; reduce to the counts
             # array record() expects, keeping only our source files.
             coverage = Coverage.result(stop: false)
                                .select { |f, _| abs_sources.include?(f) }
-                               .transform_values { |v| v.is_a?(Hash) ? v[:lines] : v }
+                               .transform_values { |v| v.is_a?(Hash) ? lines_with_called_defs(v) : v }
             { "passed" => passed, "coverage" => coverage,
               "loaded_files" => capture_loaded_files }
           rescue Exception => e # rubocop:disable Lint/RescueException
@@ -379,18 +663,22 @@ module Mutineer
         end
       end
       wr.close
-      data = rd.read
-      rd.close
-      _, status = Process.waitpid2(pid)
+      # Marshal.load reads exactly one object, not until EOF: a process that the
+      # test leaves running (even outside the group) can hold the pipe open.
+      status, payload = await_child(pid, deadline) { read_marshal(rd) }
+      return :timeout unless status
+
       # An empty pipe means the child died before writing (e.g. a hard crash,
       # OOM, or a signal from the test's own subprocess handling). Report HOW it
       # died (exit status / signal) as a diagnostic string so --verbose has
       # something actionable instead of a silent "no result".
-      return "child wrote no result (#{describe_status(status)})" if data.empty?
+      return "child wrote no result (#{describe_status(status)})" if payload.nil?
 
-      Marshal.load(data)
+      payload
     rescue StandardError => e
       "parent could not read capture result: #{e.class}: #{e.message}"
+    ensure
+      [rd, wr].compact.each { |io| io.close unless io.closed? }
     end
 
     # Human description of a child Process::Status for capture diagnostics.
@@ -433,7 +721,8 @@ module Mutineer
     def fail_test(test_path, reason)
       rel = relativize(test_path)
       @failed_test_files << rel
-      warn "[mutineer] coverage skipped for #{rel}: #{reason}"
+      # The reason can quote an app error, and so a credentialed DATABASE_URL.
+      warn "[mutineer] coverage skipped for #{rel}: #{Redaction.text(reason)}"
       nil
     end
 
@@ -462,6 +751,7 @@ module Mutineer
       end
 
       record_loaded(payload["loaded_files"])
+      record_load(payload["load_coverage"])
 
       unless payload["passed"]
         @failed_clean_tests << relativize(test_path)
@@ -477,9 +767,10 @@ module Mutineer
     #
     # @api private
     # @param after_fork [Proc, nil] boot-mode fork hook.
+    # @param test_paths [Array<String>] the tests to run, each alone.
     # @return [void]
-    def verify_cached_clean(after_fork: nil)
-      @test_paths.each do |test_path|
+    def verify_cached_clean(after_fork: nil, test_paths: @test_paths)
+      test_paths.each do |test_path|
         rel = relativize(test_path)
         next if @failed_test_files.include?(rel)
 
@@ -507,16 +798,9 @@ module Mutineer
       pending.each do |rel|
         test_path = @test_paths.find { |t| relativize(t) == rel } || rel
         if @boot_path
-          payload = fork_capture(absolute(test_path), abs_sources, after_fork)
-          case payload
-          when Hash then accept_capture_payload(test_path, payload)
-          when String
-            fail_test(test_path, @verbose ? "fork capture failed: #{payload}" :
-              "fork capture produced no result (re-run with --verbose for the error)")
-          else fail_test(test_path, "fork capture produced no result")
-          end
+          accept_fork_payload(test_path, timed(test_path) { fork_capture(absolute(test_path), abs_sources, after_fork) })
         else
-          payload = capture(test_path)
+          payload = timed(test_path) { capture(test_path) }
           accept_capture_payload(test_path, payload) if payload
         end
       end
@@ -556,8 +840,8 @@ module Mutineer
     # or the result. With `result: true`, the child writes its result as one
     # line to fd {RESULT_FD}, a pipe that only the script uses. The child's
     # stderr is the parent's stderr, so warnings from the script reach the
-    # user. A wall clock of `@capture_timeout` bounds the whole call, so a hung
-    # test cannot wedge the run.
+    # user. A wall clock of `@capture_timeout` bounds the whole call (see
+    # {#await_child}), so a hung test cannot wedge the run.
     #
     # The parent reads one line, not until EOF: a process that a test leaves
     # running can inherit fd {RESULT_FD} (a `fork` without `exec` keeps it
@@ -574,27 +858,72 @@ module Mutineer
       deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @capture_timeout
       script_rd, script_wr = IO.pipe
       result_rd, result_wr = IO.pipe if result
-      options = { in: script_rd, out: File::NULL }
+      options = { in: script_rd, out: File::NULL, pgroup: true }
       options[RESULT_FD] = result_wr if result
       pid = Process.spawn(RbConfig.ruby, "-", **options)
-      waiter = Process.detach(pid)
       script_rd.close
       result_wr&.close
-      reader = Thread.new { result_rd.gets.to_s } if result
-      script_wr.write(script)
-      script_wr.close
-      unless waiter.join(remaining(deadline))
-        Process.kill(:KILL, pid) rescue nil # rubocop:disable Style/RescueModifier
-        waiter.join
-        reader&.kill
-        return [nil, ""]
+      begin
+        script_wr.write(script)
+      rescue Errno::EPIPE
+        # The child exited before reading its script; await_child still reaps it.
       end
-      [waiter.value, reader&.join(remaining(deadline))&.value.to_s]
+      script_wr.close
+      status, out = await_child(pid, deadline) { read_result_line(result_rd) if result }
+      [status, out.to_s]
     ensure
-      reader&.kill
       [script_rd, script_wr, result_rd, result_wr].compact.each { |io| io.close unless io.closed? }
     end
 
+    # Reads the one result line a {#spawn_script} child writes to fd
+    # {RESULT_FD}.
+    #
+    # @api private
+    # @param io [IO] the parent end of the result pipe.
+    # @return [String] the line, or `""` at end of file.
+    def read_result_line(io) = io.gets.to_s
+
+    # Reads the one Marshal object a forked capture child writes, without
+    # waiting for end of file.
+    #
+    # @api private
+    # @param io [IO] the parent end of the binary result pipe.
+    # @return [Object, nil] the object, or nil when the child wrote none.
+    def read_marshal(io)
+      Marshal.load(io)
+    rescue EOFError
+      nil
+    end
+
+    # Waits for capture child `pid`, which leads its own process group, while
+    # a thread runs the block to read the child's result. One `deadline`
+    # bounds the run, the read, and the reap. Past it, the whole group gets
+    # SIGKILL, so a process the test started does not outlive a hung capture.
+    # Process.detach owns reaping. The same deadline and group kill as
+    # DaemonServer#wait_verdict, plus a reader, because the child reports
+    # through a pipe.
+    #
+    # A child that exits before the deadline has written its result, so the
+    # reader gets the time left, and at least {RESULT_GRACE} seconds, to finish.
+    #
+    # @api private
+    # @param pid [Integer] child pid, also its process group id.
+    # @param deadline [Float] a CLOCK_MONOTONIC time.
+    # @yieldreturn [Object] what the child wrote.
+    # @return [Array(Process::Status, Object)] the exit status and the block's
+    #   value (nil when the reader did not finish); `[nil, nil]` after a timeout.
+    def await_child(pid, deadline, &read)
+      waiter = Process.detach(pid)
+      reader = Thread.new(&read)
+      reader.report_on_exception = false
+      return [nil, nil] unless waiter.join(remaining(deadline))
+
+      [waiter.value, reader.join([remaining(deadline), RESULT_GRACE].max)&.value]
+    ensure
+      kill_group(pid, waiter) if waiter&.alive?
+      reader&.kill
+    end
+
     # Seconds left before `deadline`, never negative.
     #
     # @api private
@@ -623,12 +952,15 @@ module Mutineer
     # @param after_fork [Proc, nil] boot-mode fork hook.
     # @return [Boolean]
     def fork_clean_pass?(abs_tests, after_fork)
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @capture_timeout
       rd, wr = IO.pipe
       rd.binmode
       wr.binmode
+      parent = Process.pid
       pid = fork do
         rd.close
         Process.setpgid(0, 0) rescue nil # rubocop:disable Style/RescueModifier
+        OrphanGuard.start(parent)
         begin
           ChildStdout.silence
           after_fork&.call
@@ -642,34 +974,32 @@ module Mutineer
         end
       end
       wr.close
-      readable, = IO.select([rd], nil, nil, @capture_timeout)
-      unless readable
-        kill_fork_clean(pid)
-        rd.close
-        return false
-      end
-      data = rd.read
-      rd.close
-      Process.waitpid2(pid)
-      return false if data.empty?
-
-      Marshal.load(data)
+      _, passed = await_child(pid, deadline) { read_marshal(rd) }
+      passed == true
     rescue StandardError
       false
+    ensure
+      [rd, wr].compact.each { |io| io.close unless io.closed? }
     end
 
-    # SIGKILLs a hung clean-check child (and its group) then reaps it.
+    # SIGKILLs capture child `pid` and its process group, then waits for
+    # `waiter` to reap the child. Falls back to the pid alone when the group
+    # does not exist yet.
     #
     # @api private
-    # @param pid [Integer] child pid.
+    # @param pid [Integer] child pid, also its process group id.
+    # @param waiter [Thread] the Process.detach thread for `pid`.
     # @return [void]
-    def kill_fork_clean(pid)
+    def kill_group(pid, waiter)
       begin
         Process.kill(:KILL, -pid)
       rescue Errno::ESRCH, Errno::EPERM
-        Process.kill(:KILL, pid) rescue nil # rubocop:disable Style/RescueModifier
+        # No group yet: the child has not run setpgid. Never signal a reaped pid.
+        if waiter.alive?
+          Process.kill(:KILL, pid) rescue nil # rubocop:disable Style/RescueModifier
+        end
       end
-      Process.waitpid2(pid) rescue nil # rubocop:disable Style/RescueModifier
+      waiter.join
     end
 
     # Builds a pass/fail-only subprocess script (no coverage instrumentation).
@@ -681,8 +1011,9 @@ module Mutineer
       @framework == "rspec" ? rspec_clean_check_script(test_paths) : minitest_clean_check_script(test_paths)
     end
 
-    # Minitest clean-suite check. Preloads configured sources like capture and
-    # standalone {Runner.execute}, so tests that rely on that preload stay green.
+    # Minitest clean-suite check. Preloads configured sources and `--require`
+    # files like capture and standalone {Runner.execute}, so tests that rely on
+    # that preload stay green.
     #
     # @api private
     # @param test_paths [Array<String>] test file paths.
@@ -697,7 +1028,7 @@ module Mutineer
         Minitest.define_singleton_method(:plugin_mutineer_report_init) { |options| reporter << Minitest::SummaryReporter.new(_report, options) }
         Minitest.extensions << "mutineer_report"
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_source_paths.inspect}.each { |f| require f }
+        #{abs_preload_paths.inspect}.each { |f| require f }
         #{loads}
         _passed = Minitest.run([])
         $stderr.write(_report.string) unless _passed
@@ -705,7 +1036,8 @@ module Mutineer
       RUBY
     end
 
-    # RSpec clean-suite check. Preloads configured sources like capture.
+    # RSpec clean-suite check. Preloads configured sources and `--require`
+    # files like capture.
     #
     # @api private
     # @param test_paths [Array<String>] spec file paths.
@@ -721,7 +1053,7 @@ module Mutineer
         end
         RSpec::Core::Runner.disable_autorun!
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_source_paths.inspect}.each { |f| require f }
+        #{abs_preload_paths.inspect}.each { |f| require f }
         _sink = StringIO.new
         status = RSpec::Core::Runner.run(["--no-color", #{specs}], _sink, _sink)
         $stderr.write(_sink.string) unless status.zero?
@@ -754,13 +1086,16 @@ module Mutineer
         _report = StringIO.new
         Minitest.define_singleton_method(:plugin_mutineer_report_init) { |options| reporter << Minitest::SummaryReporter.new(_report, options) }
         Minitest.extensions << "mutineer_report"
-        Coverage.start(lines: true)
+        Coverage.start(lines: true, methods: true)
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_source_paths.inspect}.each { |f| require f }
+        #{abs_preload_paths.inspect}.each { |f| require f }
+        _load = #{load_coverage_expression}
         load #{absolute(test_path).inspect}
         _passed = Minitest.run([])
         $stderr.write(_report.string) unless _passed
-        _result.puts JSON.generate("passed" => _passed == true, "coverage" => Coverage.result,
+        _coverage = Coverage.result.transform_values { |v| v.is_a?(Hash) ? v[:lines] : v }
+        _result.puts JSON.generate("passed" => _passed == true, "coverage" => _coverage,
+                                    "load_coverage" => _load,
                                     "loaded_files" => #{loaded_files_expression})
         _result.close
       RUBY
@@ -785,13 +1120,16 @@ module Mutineer
           exit 3
         end
         RSpec::Core::Runner.disable_autorun!
-        Coverage.start(lines: true)
+        Coverage.start(lines: true, methods: true)
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_source_paths.inspect}.each { |f| require f }
+        #{abs_preload_paths.inspect}.each { |f| require f }
+        _load = #{load_coverage_expression}
         _sink = StringIO.new
         _status = RSpec::Core::Runner.run(["--no-color", #{absolute(test_path).inspect}], _sink, _sink)
         $stderr.write(_sink.string) unless _status.zero?
-        _result.puts JSON.generate("passed" => _status.zero?, "coverage" => Coverage.result,
+        _coverage = Coverage.result.transform_values { |v| v.is_a?(Hash) ? v[:lines] : v }
+        _result.puts JSON.generate("passed" => _status.zero?, "coverage" => _coverage,
+                                    "load_coverage" => _load,
                                     "loaded_files" => #{loaded_files_expression})
         _result.close
       RUBY
@@ -802,16 +1140,95 @@ module Mutineer
     # path outside the project (stdlib/gem files).
     def record(coverage, test_path)
       rel_test = relativize(test_path)
+      each_covered_key(coverage) { |key| (@map[key] ||= []) << rel_test }
+    end
+
+    # Adds the configured source lines that ran at load to {#load_lines}, and
+    # the methods called at load to {#load_methods}. Lines of other files
+    # (tests, helpers, gems) are dropped.
+    #
+    # @api private
+    # @param coverage [Hash, nil] counts per absolute file, as {#record} reads
+    #   them; a Hash entry can also hold "methods", as {#load_entry} builds it.
+    # @return [void]
+    def record_load(coverage)
+      return unless coverage.is_a?(Hash)
+
+      @source_rels ||= @source_paths.to_set { |p| relativize(absolute(p)) }
+      ours = coverage.select { |abs_file, _| @source_rels.include?(relativize(abs_file)) }
+      each_covered_key(ours) { |key| @load_lines << key }
+      ours.each do |abs_file, data|
+        next unless data.is_a?(Hash) && data["methods"].is_a?(Array)
+
+        data["methods"].each { |line, column| @load_methods << "#{relativize(abs_file)}:#{line}:#{column}" }
+      end
+    end
+
+    # One file's line counts, with the `def` line of each method the test
+    # called counted too (#209). A forked capture does not see the `def` lines
+    # run, since the boot defined the methods before the test. Ruby counts no
+    # line when an endless method runs, so without this its mutants would be
+    # `no_coverage` even when a test calls it. A line where more than one
+    # method starts is not counted: the map keys tests by line, so the test
+    # would also be credited with the methods it did not call.
+    #
+    # @api private
+    # @param data [Hash] `Coverage` result for one file, with `:lines` and `:methods`.
+    # @return [Array, nil] line counts.
+    def lines_with_called_defs(data)
+      lines = data[:lines]
+      return lines unless lines && data[:methods]
+
+      lines = lines.dup
+      starts = data[:methods].keys.map { |key| key[2] }.tally
+      data[:methods].each do |key, count|
+        line = key[2]
+        lines[line - 1] = [lines[line - 1].to_i, count].max if count.positive? && starts[line] == 1
+      end
+      lines
+    end
+
+    # One file's load-time coverage in the shape {#record_load} reads: the line
+    # counts, and the `[line, column]` of each method called at least once.
+    # {#load_coverage_expression} builds the same shape in a capture child.
+    #
+    # @api private
+    # @param lines [Array, nil] line counts.
+    # @param methods [Hash, nil] `Coverage` method counts, keyed by
+    #   `[owner, name, start_line, start_column, end_line, end_column]`.
+    # @return [Hash{String => Array}]
+    def load_entry(lines, methods)
+      { "lines" => lines, "methods" => (methods || {}).filter_map { |key, count| key[2, 2] if count.positive? } }
+    end
+
+    # Ruby source of the capture child's load-time coverage: `Coverage.peek_result`
+    # for the configured sources only, matched by real path (a Coverage key is
+    # the path as required), so the payload does not carry every loaded gem.
+    # Each entry has the shape {#load_entry} builds.
+    #
+    # @api private
+    # @return [String] expression to embed in a capture subprocess script.
+    def load_coverage_expression
+      "Coverage.peek_result.select { |f, _| #{abs_source_paths.inspect}.include?((File.realpath(f) rescue f)) }" \
+        ".transform_values { |v| { \"lines\" => v[:lines], " \
+        "\"methods\" => v[:methods].filter_map { |k, n| k[2, 2] if n.positive? } } }"
+    end
+
+    # Yields a "file:line" key for every project line with a non-zero count.
+    #
+    # @api private
+    # @param coverage [Hash] counts per absolute file: an Array, or a Hash with "lines".
+    # @yieldparam key [String] the "file:line" key.
+    # @return [void]
+    def each_covered_key(coverage)
       coverage.each do |abs_file, data|
         rel = relativize(abs_file)
         next if rel.start_with?("/") # outside project_root: not our source
 
-        counts = data.is_a?(Array) ? data : data["lines"]
-        counts.each_with_index do |count, idx|
-          next unless count&.positive?
+        counts = data.is_a?(Hash) ? data["lines"] : data
+        next unless counts.is_a?(Array) # a Coverage mode without line counts
 
-          (@map["#{rel}:#{idx + 1}"] ||= []) << rel_test
-        end
+        counts.each_with_index { |count, idx| yield "#{rel}:#{idx + 1}" if count&.positive? }
       end
     end
 
@@ -906,16 +1323,32 @@ module Mutineer
       end
     end
 
+    # True when `cached` records the same +PARALLEL_WORKERS+ value this process
+    # has now. Rails reads that variable inside +parallelize+ and can run one
+    # test file in several workers. A missing key is a map saved before this
+    # value was stored. In-process runs and the daemon write this same file.
+    #
+    # @api private
+    # @param cached [Hash] parsed coverage.json.
+    # @return [Boolean]
+    def parallel_workers_match?(cached)
+      cached.key?("parallel_workers") && cached["parallel_workers"] == ENV.fetch("PARALLEL_WORKERS", nil)
+    end
+
     # Digest each file's ROLE + relative path + content length + content, plus
     # the load_paths. Without role/path/length delimiters the digest collides
     # (("ab","c") == ("a","bc")) and is blind to source/test role swaps, silently
     # accepting a stale cached map.
-    def compute_digest
+    #
+    # @param inputs_only [Boolean] leave out the sources and their owners.
+    def compute_digest(inputs_only: false)
       d = Digest::SHA256.new
-      digest_group(d, "source", @source_paths)
+      digest_group(d, "source", @source_paths) unless inputs_only
       digest_group(d, "test", @test_paths)
-      digest_group(d, "boot", [boot_digest_path]) if @boot_path
-      ownership_paths.each do |rel|
+      # One group per file: digest_group sorts, and the load order matters.
+      @require_paths.each { |p| digest_group(d, "require", [digest_path(p)]) }
+      digest_group(d, "boot", [digest_path(@boot_path)]) if @boot_path
+      (inputs_only ? [] : ownership_paths).each do |rel|
         d.update("owner\0")
         d.update(rel)
         d.update("\0")
@@ -961,10 +1394,13 @@ module Mutineer
       paths.uniq.sort
     end
 
-    # boot_path is a require-style path (e.g. "config/environment", no extension);
-    # resolve it to the real file for reading, appending ".rb" when needed.
-    def boot_digest_path
-      File.exist?(absolute(@boot_path)) ? @boot_path : "#{@boot_path}.rb"
+    # boot_path and require_paths are require-style paths (e.g. "config/environment",
+    # no extension); resolve one to the file `require` loads: the path itself, then
+    # ".rb", then a native extension. A folder of the same name (lib/my_gem/ next to
+    # lib/my_gem.rb) is not the file.
+    def digest_path(path)
+      ["", ".rb", ".#{RbConfig::CONFIG['DLEXT']}"].map { |ext| "#{path}#{ext}" }
+                                                .find { |p| File.file?(absolute(p)) } || "#{path}.rb"
     end
 
     # Groups a digest with its role and paths.
@@ -1026,7 +1462,13 @@ module Mutineer
 
       FileUtils.mkdir_p(@cache_dir)
       data = { "digest" => @digest, "failed_test_files" => @failed_test_files,
-               "dependencies" => @loaded_dependencies, "map" => @map }
+               "dependencies" => @loaded_dependencies, "map" => @map,
+               "load_lines" => @load_lines.to_a.sort, "load_methods" => @load_methods.to_a.sort,
+               "timings" => @timings, "parallel_workers" => ENV.fetch("PARALLEL_WORKERS", nil) }
+      if @boot_path
+        data.merge!("inputs" => compute_digest(inputs_only: true), "sources" => source_fingerprints,
+                    "owners" => ownership_paths)
+      end
       tmp = "#{cache_path}.tmp"
       File.write(tmp, JSON.generate(data))
       File.rename(tmp, cache_path) # atomic swap
@@ -1046,6 +1488,13 @@ module Mutineer
     # @return [Array<String>] absolute source paths.
     def abs_source_paths = @source_paths.map { |p| absolute(p) }
 
+    # The sources, then the `--require` files, in the order standalone
+    # {Runner.execute} requires them before it forks the mutants (#217).
+    #
+    # @api private
+    # @return [Array<String>] absolute paths.
+    def abs_preload_paths = abs_source_paths + @require_paths.map { |p| absolute(p) }
+
     # Returns absolute load paths.
     #
     # @return [Array<String>] absolute load paths.