rigortype 0.3.5 → 0.3.7

data/lib/rigor/plugin/io_boundary.rb

@@ -19,7 +19,14 @@ module Rigor
     # Slice 2 ships a minimal surface:
     #
     # - `#read_file(path)` — validates against the policy, returns the file's contents, and adds a
-    #   digest-keyed {Cache::Descriptor::FileEntry} to the boundary's accumulated descriptor.
+    #   digest-keyed {Cache::Descriptor::FileEntry} to the boundary's accumulated descriptor. A read that
+    #   fails because the path does not exist adds an ABSENCE row instead (ADR-45 WD1, #577), so a result
+    #   computed on the file being missing invalidates once it appears.
+    # - `#file?(path)` / `#directory?(path)` — the existence PROBE (ADR-45 WD1b, #613): the same answer
+    #   `File.file?` / `File.directory?` gives, plus the existence row `#read_file` would have recorded.
+    #   A plugin that gates its read or its glob on one of these shapes its result on the answer, so the
+    #   answer is a dependency; probing through `File` directly leaves that dependency unrecorded and the
+    #   warm run serves the pre-appearance result.
     # - `#open_url(url)` — fetches the URL when the policy permits it (`network_policy: :allowlist` plus an
     #   `allowed_url_hosts` match) and raises {AccessDeniedError} otherwise. v0.1.2 ships the allowlist
     #   surface; the default project policy still has `network_policy: :disabled` so plugins that want network
@@ -46,8 +53,18 @@ module Rigor
       end
 
       # Reads the file at `path` after validating it against the policy. Raises {AccessDeniedError} when the
-      # path is outside every allowed read root. Records a `:digest` {FileEntry} so the resulting cache slice
-      # invalidates on content change.
+      # path is outside every allowed read root. Records a `:stat` {Cache::Descriptor::FileEntry} so the
+      # resulting cache slice invalidates on content change.
+      #
+      # ADR-45 WD1 (#577) — a read that fails because the path does NOT exist (`Errno::ENOENT`, or
+      # `Errno::ENOTDIR` when a parent component is a regular file) is a deliberate existence probe: the
+      # plugin asked for the file and shaped its answer on the file being absent (rigor-activerecord's
+      # reduced mode on a missing `db/schema.rb`). That is a dependency too — "the analysis depended on X
+      # being absent" — so the boundary records an ABSENCE row ({Cache::Descriptor::FileEntry.absent})
+      # before re-raising, and every cache built on this boundary's descriptor (the run-result entry, the
+      # plugin-producer entries) goes stale the moment the path comes into existence. Only the not-there
+      # outcome is recorded: a path that exists but cannot be read (`EISDIR`, `EACCES`) is a failure the
+      # plugin reports, not a probe of absence, and records nothing — as before.
       def read_file(path)
         absolute = File.expand_path(path.to_s)
         unless @policy.allow_read?(absolute)
@@ -59,11 +76,39 @@ module Rigor
           )
         end
 
-        contents = File.binread(absolute)
+        contents = begin
+          File.binread(absolute)
+        rescue Errno::ENOENT, Errno::ENOTDIR
+          record_absence_entry(absolute)
+          raise
+        end
         record_file_entry(absolute, contents)
         contents
       end
 
+      # ADR-45 WD1b (#613) — the existence probe. Returns exactly what `File.file?(path)` returns, and
+      # records the answer as a {Cache::Descriptor::FileEntry} `:exists` row so a plugin that gates its read
+      # on the probe carries the same dependency a plugin that just called {#read_file} carries.
+      # `File.file?` in plugin code records nothing, which is how the #577 staleness class survived at every
+      # `return nil unless File.file?(config)` gate: the miss shaped the result and left no edge for the
+      # file's later appearance.
+      #
+      # @param path [String] project path; relative paths expand against the working directory
+      # @return [Boolean] `File.file?`'s answer, unchanged
+      def file?(path)
+        probe(path) { |absolute| File.file?(absolute) }
+      end
+
+      # ADR-45 WD1b (#613) — {#file?} for directories: the answer `File.directory?` gives, plus the
+      # existence row. The discovery shape (`next [] unless directory?(root)` before a `Dir.glob`) depends
+      # on the root existing exactly as a config read depends on the config file existing.
+      #
+      # @param path [String] project path; relative paths expand against the working directory
+      # @return [Boolean] `File.directory?`'s answer, unchanged
+      def directory?(path)
+        probe(path) { |absolute| File.directory?(absolute) }
+      end
+
       # Fetches the URL when the policy permits it. Returns the response body. Raises {AccessDeniedError} when
       # the policy is `:disabled`, the URL scheme is not `https`, the host is not on the allowlist, the
       # response is non-2xx, the body exceeds {URL_MAX_BYTES}, or the request times out
@@ -96,6 +141,36 @@ module Rigor
 
       private
 
+      # ADR-45 WD1b (#613) — the shared body of {#file?} / {#directory?}.
+      #
+      # The probe answers TRUTHFULLY for every path, in or out of the trusted-read scope, and never raises:
+      # it replaces a bare `File.file?` in plugin code, and a predicate that raised (or answered `false` for
+      # an out-of-scope path that exists) would change what the converted plugin does rather than only what
+      # it records. Existence is not content — ADR-2's boundary is not a sandbox, and the plugin could ask
+      # `File` directly — so the policy governs RECORDING here, not the answer: an out-of-scope path
+      # contributes no dependency row, exactly as an out-of-scope read contributes none.
+      #
+      # Three outcomes, mirroring {#read_file}'s bounds:
+      #
+      # - the probe found what it asked for → a PRESENCE row (`:exists` / `"true"`), stale once the path is
+      #   gone;
+      # - the probe found nothing at all → an ABSENCE row, stale once anything appears there;
+      # - the path exists but is not what was asked for (a directory where a file was wanted, or the
+      #   reverse) → NOTHING, the same bound `#read_file` pins for `EISDIR`: the probe observed neither a
+      #   usable file nor an absence, and either row would misdescribe what the plugin saw.
+      def probe(path)
+        absolute = File.expand_path(path.to_s)
+        answer = yield(absolute)
+        return answer unless @policy.allow_read?(absolute)
+
+        if answer
+          record_presence_entry(absolute)
+        elsif !File.exist?(absolute)
+          record_absence_entry(absolute)
+        end
+        answer
+      end
+
       def record_file_entry(path, contents)
         # ADR-87 WD1 — the boundary descriptor is validation-only (it never keys a cache), so a plugin-read
         # file rides the stat-then-digest `:stat` tier: a warm run stat-checks the (on a Rails monorepo,
@@ -103,9 +178,37 @@ module Rigor
         # we just read; `FileEntry.stat` stats the same path to pack the tuple.
         digest = Digest::SHA256.hexdigest(contents)
         entry = Cache::Descriptor::FileEntry.stat(path: path, digest: digest)
+        # A content row replaces an earlier existence row for the same path outright: the file appeared and
+        # its bytes were consumed, and a content row validates existence as well as content.
         @mutex.synchronize { @file_entries[path] = entry }
       end
 
+      # ADR-45 WD1 (#577) — the absence row for a probed-but-missing path. A content row already recorded
+      # for the same path is KEPT in preference: two outcomes for one path within one run mean the file
+      # moved under the analysis, and of the two rows the content row is the one whose validation covers
+      # both the content that was read and the file's existence — so it is the one that reads stale while
+      # the file is gone. The reverse order (probed absent, then read once it appeared) is the content
+      # row's replacement above.
+      #
+      # WD1b (#613) — the same `||=` also settles absence against PRESENCE: the FIRST existence row for a
+      # path stands. Both orders are then conservative under a mid-run mutation, because the row that
+      # stands describes the world the earlier decision was shaped on, and it reads stale the moment the
+      # world stops matching it — a recompute, never a wrong hit.
+      def record_absence_entry(path)
+        entry = Cache::Descriptor::FileEntry.absent(path: path)
+        @mutex.synchronize { @file_entries[path] ||= entry }
+      end
+
+      # ADR-45 WD1b (#613) — the presence row: fresh while the probed path exists, stale once it is gone.
+      # It is the weakest row the boundary records (a rename that keeps a file at the path leaves it fresh),
+      # and it is the honest one for a probe that never read the bytes — a discovery root globbed for `.rb`
+      # files, a config file whose mere existence switched a mode. Ranked under a content row, and under an
+      # earlier existence row, by the `||=`/`=` split above.
+      def record_presence_entry(path)
+        entry = Cache::Descriptor::FileEntry.present(path: path)
+        @mutex.synchronize { @file_entries[path] ||= entry }
+      end
+
       def record_url_entry(url, body)
         digest = Digest::SHA256.hexdigest(body)
         key = "url:#{url}"

data/lib/rigor/plugin/loader.rb

@@ -76,6 +76,20 @@ module Rigor
         File.file?(path) ? path : nil
       end
 
+      # The signature half of {.bundled_plugin_path}: the absolute `sig/` directory of the engine's OWN
+      # bundled copy of a plugin gem (`<ENGINE_ROOT>/plugins/<gem>/sig`), or nil when the engine does not
+      # bundle it, it ships no signatures, or the packaging carries no `plugins/` tree (ADR-27).
+      #
+      # Unlike its sibling this is NOT a require anchor — nothing loads Ruby from it. It exists so the
+      # engine can recognise its own bundled RBS when a project reaches that directory by a route the
+      # plugin registry never sees: a `signature_paths:` entry pointing straight at it (issue #672). The
+      # anchor is deliberately the same `ENGINE_ROOT`, so a git checkout and an installed `rigortype` gem
+      # answer identically and the two halves of a bundled plugin can never resolve to different copies.
+      def self.bundled_plugin_sig_path(gem_name)
+        path = File.join(ENGINE_ROOT, "plugins", gem_name, "sig")
+        File.directory?(path) ? path : nil
+      end
+
       # @param entries [Array<String, Hash>] the raw `plugins:` list from the configuration.
       # @return [Registry]
       def load(entries)

data/lib/rigor/protection/analysis_guard.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require_relative "../analysis/crash_signature"
+
+module Rigor
+  module Protection
+    # Issue #686 — raised when an oracle's re-analysis came back from a crashed run, so its diagnostics say
+    # nothing about the code that was analysed.
+    #
+    # A named class, not a bare RuntimeError: {MutationScanner#classify} already folds a per-mutant
+    # `StandardError` into the `:harness_error` bucket, and the scanner's file-level rescue must catch THIS
+    # and nothing else, so the two failure modes stay distinguishable at every site that handles either.
+    class AnalyzerCrashed < StandardError; end
+
+    # The kill oracles' guard against judging a mutant by a run that never happened.
+    #
+    # A kill oracle answers one question: did re-analysing the mutant produce a diagnostic the clean
+    # baseline did not carry? When a check rule raises, `Runner#analyze_file_body` rescues it into ONE
+    # `internal analyzer error` diagnostic for the whole file and discards the rest — deterministically, on
+    # the SAME file, for the SAME reason. So the baseline and the mutant come back carrying the identical
+    # synthetic row, the set difference is empty, and the oracle reports the mutant SURVIVED. Not "we could
+    # not tell": survived. Every mutant in the affected file scores the same way, which inflates the
+    # survivor count — the mutation harness's headline signal — in the direction that manufactures work,
+    # and the harness has no way to notice.
+    #
+    # An indeterminate run must not be scored as either killed or survived, so the oracles raise here and
+    # let {MutationScanner} put the mutant in the `harness_errors` bucket (#264), which is already excluded
+    # from `killed + survived` and already surfaced by the CLI. A crash then READS as a crash.
+    #
+    # Only {Analysis::Result#crashed?} is armed — the check-rule rescue, the one shape that REPLACES a
+    # file's whole diagnostic list. Refusing more than that is the same error pointed the other way, and it
+    # was measured: on a project whose plugin `prepare` raises, refusing the `:plugin` row took a file from
+    # `killed=1 survived=6` to `killed=0 survived=0 harness_errors=7` — the builtin rules had run, their
+    # diagnostics were all present, and a real measurement was thrown away. `invoke_plugin_prepare` appends
+    # its row to every sequential run, so arming it would have refused every run for the life of the
+    # process. `:rbs_build` is excluded for the same reason plus one more: the site filter that admits
+    # mutations already drops receivers whose type did not resolve, so a class whose definition failed to
+    # build contributes no measured sites to begin with.
+    module AnalysisGuard
+      module_function
+
+      # Takes the whole {Analysis::Result} rather than its diagnostics so the question is asked through
+      # {Analysis::Result#crashed?} — the same predicate the spec-side guard reads, off the same
+      # {Analysis::CrashSignature} table. Hands back the diagnostics, which is all a kill comparison wants.
+      #
+      # @param result [Rigor::Analysis::Result] one analysis run.
+      # @param context [String] which oracle call produced it, so the raise points at the right seam.
+      # @return [Array<Rigor::Analysis::Diagnostic>] the run's diagnostics, when the run was healthy.
+      # @raise [AnalyzerCrashed]
+      def checked(result, context:)
+        return result.diagnostics unless result.crashed?
+
+        raise AnalyzerCrashed,
+              "#{context}: the analyzer crashed, so this run's diagnostics say nothing about the code " \
+              "(#{Analysis::CrashSignature.describe(result.crash_diagnostics.first)}). A kill comparison " \
+              "against it would score the mutant a survivor it was never measured against. See issue #686."
+      end
+    end
+  end
+end

data/lib/rigor/protection/closure_kill_oracle.rb

@@ -5,6 +5,7 @@ require "tempfile"
 require_relative "../analysis/buffer_binding"
 require_relative "../analysis/runner"
 require_relative "../inference/fork_map"
+require_relative "analysis_guard"
 require_relative "diagnostic_oracle"
 require_relative "discovery_seed"
 require_relative "kill_signature"
@@ -29,7 +30,7 @@ module Rigor
     # closure, and the two effects were indistinguishable in the total.
     #
     # **The mutant's bytes are never on the measured file's disk.** For the closure half they are written to a
-    # process-private temp file and bound to the measured path through {Analysis::BufferBinding} — the #146
+    # block-scoped temp file and bound to the measured path through {Analysis::BufferBinding} — the #146
     # editor seam, whose whole purpose is "analyse THESE bytes at THAT logical path". The binding reaches three
     # places that would otherwise read the file as it sits on disk:
     #
@@ -112,18 +113,6 @@ module Rigor
         [path, *(@dependents[path] || [])]
       end
 
-      # Release the process-private mutant file now, instead of waiting for `Tempfile`'s finalizer at process
-      # exit. A one-shot `rigor coverage` run does not need this — the process ends and the file goes with it —
-      # but a caller that outlives the oracle does: the spec suite's `after(:suite)` residue check (issue #330)
-      # runs while the process is still alive, so an un-released file reads as a leak there even though it
-      # would have been reclaimed a moment later. Idempotent, and safe on an oracle that never mutated
-      # anything (the file is created lazily).
-      def release!
-        @mutant_file&.close!
-        @mutant_file = nil
-        @mutant_pid = nil
-      end
-
       private
 
       # The diagnostic signatures the dependents of `path` report while `source` stands in for it. Empty (and
@@ -138,28 +127,35 @@ module Rigor
       end
 
       # Binds `source` to `path` for the duration of the block, yielding the binding and the seed tables
-      # rebuilt against it. One temp file per process (never per mutant): the digest that invalidates the
-      # mutated file's bundle is taken over the file's CONTENT, and the per-run digest memo is not installed
-      # out here, so rewriting one path in place cannot serve a stale answer.
-      def with_mutant(source, path)
-        File.binwrite(mutant_file.path, source)
-        buffer = Analysis::BufferBinding.new(logical_path: path, physical_path: mutant_file.path)
-        yield(buffer, seed_for(buffer))
-      end
-
-      # The process-private mutant file. Created lazily, and re-created after a fork ({CLI::MutationForkScan}
-      # workers must not share one path), which the pid guard detects.
+      # rebuilt against it.
+      #
+      # The mutant's bytes live in a **block-scoped** temp file: created and unlinked inside this method, so
+      # the oracle holds no file between calls and no caller needs a teardown hook to reclaim one. Issue #572
+      # — the previous design kept one `Tempfile` per process, which `Tempfile` reclaims only from its
+      # finalizer, i.e. at GC time. That made the file's disappearance a timing coin flip: the spec suite's
+      # issue-#330 residue check runs while the process is still alive, so it saw a live `rigor-mutant-*.rb`
+      # and failed a CI shard that the identical head passed on rerun.
       #
-      # A worker's copy goes in {Inference::ForkMap.child_scratch_dir} rather than the system temp dir: the
-      # worker ends at `exit!`, which runs neither `at_exit` nor `Tempfile`'s finalizer, so a file placed
-      # anywhere else survives the run with nobody left who knows its name (issue #330). On the parent — and
-      # on the sequential path — that reader answers `nil`, which is `Tempfile.new`'s own default, and the
-      # finalizer reclaims the file at normal exit as before.
-      def mutant_file
-        return @mutant_file if @mutant_file && @mutant_pid == Process.pid
-
-        @mutant_pid = Process.pid
-        @mutant_file = Tempfile.new(["rigor-mutant-", ".rb"], Inference::ForkMap.child_scratch_dir)
+      # Per-mutant rather than per-process is safe on both axes the per-process comment defended. Freshness:
+      # the digest that invalidates the mutated file's discovery bundle is taken over the file's CONTENT and
+      # the bundles are keyed by the LOGICAL path, so nothing depends on the physical name being stable — a
+      # name that is never reused is strictly further from a stale answer than one rewritten in place. Cost:
+      # one `mkstemp` + `unlink` against the whole analysis-per-dependent this call already runs.
+      #
+      # The directory stays {Inference::ForkMap.child_scratch_dir}, and that is not redundant. A
+      # {CLI::MutationForkScan} worker unwinds this block on both paths it can take on its own — a normal
+      # return and the `StandardError` {Inference::ForkMap.run_worker} rescues — but a worker killed by a
+      # signal unwinds nothing, and its `exit!` runs neither `at_exit` nor a finalizer. The parent's fork
+      # tmpdir stays the backstop for exactly that case (issue #330); on the parent and on the sequential
+      # path the reader answers `nil`, which is `Tempfile.create`'s own default.
+      def with_mutant(source, path)
+        Tempfile.create(["rigor-mutant-", ".rb"], Inference::ForkMap.child_scratch_dir) do |file|
+          file.binmode
+          file.write(source)
+          file.flush
+          buffer = Analysis::BufferBinding.new(logical_path: path, physical_path: file.path)
+          yield(buffer, seed_for(buffer))
+        end
       end
 
       def seed_for(buffer)
@@ -179,11 +175,20 @@ module Rigor
       # and emits nothing. A closure oracle built that way would report zero cross-file kills and look
       # entirely plausible doing it. Passing both selects option B (#146), where the closure wins and the
       # buffer is one member of it.
+      #
+      # Issue #686 — the guard is on this line for the reason the whole class exists. `killed?` decides by
+      # SET DIFFERENCE between the baseline's signatures and the mutant's, and a crashed check rule makes
+      # both sides the same deterministic `internal analyzer error` row on the same file: the difference is
+      # empty and the mutant is scored a survivor, not "indeterminate". Every mutant in the file scores the
+      # same way, which inflates the survivor count the harness reports as its headline signal.
       def analyse(paths, buffer, seed)
-        Analysis::Runner.new(
-          configuration: @configuration, environment: @environment, prebuilt: @project_scan,
-          cache_store: nil, collect_stats: false, buffer: buffer, discovery_seed: seed, analyze_only: paths
-        ).run(paths).diagnostics
+        AnalysisGuard.checked(
+          Analysis::Runner.new(
+            configuration: @configuration, environment: @environment, prebuilt: @project_scan,
+            cache_store: nil, collect_stats: false, buffer: buffer, discovery_seed: seed, analyze_only: paths
+          ).run(paths),
+          context: "ClosureKillOracle closure analysis of #{paths.join(', ')}"
+        )
       end
     end
   end

data/lib/rigor/protection/diagnostic_oracle.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../analysis/runner"
+require_relative "analysis_guard"
 require_relative "kill_signature"
 
 module Rigor
@@ -42,11 +43,18 @@ module Rigor
 
       private
 
+      # Issue #686 — the diagnostics of a CRASHED run are not an answer, and this oracle's whole job is to
+      # compare two runs' diagnostics. Both sides of that comparison come through here, so refusing once
+      # here covers `#baseline` and `#killed?` alike; {MutationScanner} turns the raise into a
+      # `harness_errors` count rather than a kill or a survivor.
       def analyse(source, path)
-        Rigor::Analysis::Runner.new(
-          configuration: @configuration, environment: @environment, prebuilt: @project_scan,
-          cache_store: nil, collect_stats: false, discovery_seed: @discovery_seed
-        ).run_source(source: source, path: path).diagnostics
+        AnalysisGuard.checked(
+          Rigor::Analysis::Runner.new(
+            configuration: @configuration, environment: @environment, prebuilt: @project_scan,
+            cache_store: nil, collect_stats: false, discovery_seed: @discovery_seed
+          ).run_source(source: source, path: path),
+          context: "DiagnosticOracle re-analysis of #{path}"
+        )
       end
     end
   end

data/lib/rigor/protection/discovery_seed.rb

@@ -98,7 +98,7 @@ module Rigor
         def_index = index.fetch(:def_index)
         tables = { discovered_classes: index.fetch(:classes) }
         %i[
-          def_nodes singleton_def_nodes def_sources singleton_def_sources superclasses includes
+          def_nodes def_nestings singleton_def_nodes def_sources singleton_def_sources superclasses includes
           method_visibilities methods data_member_layouts struct_member_layouts
         ].each do |slot|
           tables[seed_key(slot)] = def_index.fetch(slot)

data/lib/rigor/protection/measurement_integrity.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Protection
+    # Issue #686 — the single definition of "was this file measured at all", and the one place the two
+    # counts' escalation rule is written down rather than restated.
+    #
+    # `killed + survived == 0` means two different things, and telling them apart is the whole point:
+    #
+    # - with no `harness_errors`, the file had no type-relevant mutation, and the vacuous-file convention
+    #   scores it fully effective — there was no breakage available to miss;
+    # - with `harness_errors`, every mutant it had failed inside the harness, so the file measured the
+    #   HARNESS and says nothing about the code. Borrowing the first's 1.0 made a wholly crashed file report
+    #   100% effective and pass `--threshold`.
+    #
+    # The predicate lives here because four call sites need the same answer — the per-file results, the exit
+    # gate, the stderr warning and both renderers — and four independent spellings of
+    # `harness_errors.positive? && total.zero?` agree only by coincidence (issue #696 review, second pass).
+    module MeasurementIntegrity
+      module_function
+
+      # @return [Boolean] false only when nothing could be measured AND something failed trying.
+      def measured?(total:, harness_errors:)
+        !(total.zero? && harness_errors.positive?)
+      end
+
+      # The report-level companion: a project ratio computed over nothing, where something went wrong.
+      # Distinct from an empty project, which is legitimately vacuous.
+      #
+      # @return [Boolean]
+      def ratio_unmeasurable?(grand_total:, unmeasured_files:)
+        grand_total.zero? && unmeasured_files.positive?
+      end
+    end
+  end
+end

data/lib/rigor/protection/mutation_scanner.rb

@@ -2,6 +2,8 @@
 
 require "prism"
 
+require_relative "analysis_guard"
+require_relative "measurement_integrity"
 require_relative "mutator"
 require_relative "diagnostic_oracle"
 
@@ -38,9 +40,21 @@ module Rigor
         # harness-level failure measures the harness, not the code, exactly like a parse-invalid mutant).
         def total = killed + survived
 
-        # Effectiveness ratio; a file with no type-relevant mutation is vacuously fully effective (no breakage
-        # was available to miss).
-        def ratio = total.zero? ? 1.0 : killed.to_f / total
+        # Issue #686 — "nothing was measured here" is NOT the same as "there was nothing to measure", and
+        # `total.zero?` cannot tell them apart on its own. A file with no type-relevant mutation is
+        # vacuously fully effective; a file whose every mutant landed in `harness_errors` measured the
+        # harness and says nothing about the code. Before this, the second borrowed the first's 1.0 and a
+        # wholly crashed file reported 100% effective.
+        def measured? = MeasurementIntegrity.measured?(total: total, harness_errors: harness_errors)
+
+        # Effectiveness ratio. 0.0 rather than 1.0 for an unmeasured file — both are wrong as a measurement,
+        # and only one of them turns a red `--threshold` gate green. Read it next to {#measured?}, which is
+        # what the renderer and the exit gate consult.
+        def ratio
+          return 0.0 unless measured?
+
+          total.zero? ? 1.0 : killed.to_f / total
+        end
       end
 
       # ADR-70 — one type-survivor classified by the dynamic (test) axis. `protection` is `:test` (a test caught
@@ -62,8 +76,15 @@ module Rigor
         def unprotected = sites.size
         def total = type_killed + test_killed + unprotected
 
+        # Issue #686 — see {FileResult#measured?}.
+        def measured? = MeasurementIntegrity.measured?(total: total, harness_errors: harness_errors)
+
         # Fused protected ratio — caught by *either* axis.
-        def ratio = total.zero? ? 1.0 : (type_killed + test_killed).to_f / total
+        def ratio
+          return 0.0 unless measured?
+
+          total.zero? ? 1.0 : (type_killed + test_killed).to_f / total
+        end
       end
 
       # @param configuration [Rigor::Configuration]
@@ -114,7 +135,9 @@ module Rigor
         kept = kept_mutations(source, path)
         return FileResult.new(path: path, killed: 0, survived: 0, sites: []) if kept.empty?
 
-        baseline = @oracle.baseline(source: source, path: path)
+        baseline = clean_baseline(source, path)
+        return crashed_baseline_result(path, kept.size) if baseline.nil?
+
         killed = 0
         harness_errors = 0
         sites = []
@@ -140,7 +163,12 @@ module Rigor
         kept = kept_mutations(source, path)
         return FusedFileResult.new(path: path, type_killed: 0, test_killed: 0, sites: []) if kept.empty?
 
-        baseline = @oracle.baseline(source: source, path: path)
+        baseline = clean_baseline(source, path)
+        if baseline.nil?
+          return FusedFileResult.new(path: path, type_killed: 0, test_killed: 0, sites: [],
+                                     harness_errors: kept.size)
+        end
+
         type_killed = 0
         test_killed = 0
         harness_errors = 0
@@ -185,6 +213,12 @@ module Rigor
       # only the latter is a harness defect worth counting and surfacing. Both stay OUT of `killed + survived`
       # exactly as before (containment is unchanged) — #264 is about visibility, not about admitting either
       # bucket into the denominator.
+      #
+      # #686 — a {AnalysisGuard::AnalyzerCrashed} from the oracle's re-analysis arrives here as a
+      # `StandardError` and lands in the same bucket, which is exactly right: an indeterminate mutant must
+      # be scored neither killed nor survived. Before the oracle refused, a crashed re-analysis produced the
+      # same synthetic diagnostic on both sides of the kill comparison, so the mutant was scored a SURVIVOR
+      # and the harness reported a hole it had never measured.
       def classify(source, path, mut, baseline)
         mutant_source = mut.apply(source)
         return :invalid unless Prism.parse(mutant_source).success?
@@ -196,6 +230,27 @@ module Rigor
         :harness_error
       end
 
+      # The clean per-file baseline, or nil when the analyzer crashed while computing it (#686).
+      #
+      # The baseline is computed ONCE per file, outside {#classify}'s per-mutant rescue, so a crash here is
+      # not one mutant's problem: every mutant of this file would be judged against a baseline that knows
+      # nothing, and each would come back a survivor. Reported as `harness_errors` — one per mutant that
+      # would have been measured — rather than raised, so one bad file does not abort a whole sweep, and
+      # rather than silently skipped, so the count the CLI already warns about accounts for it.
+      #
+      # Deliberately narrow: only {AnalyzerCrashed}. Any other exception out of an oracle's baseline
+      # propagates exactly as it did before, because widening that rescue would hide unrelated harness bugs
+      # behind the very bucket this issue exists to make honest.
+      def clean_baseline(source, path)
+        @oracle.baseline(source: source, path: path)
+      rescue AnalyzerCrashed
+        nil
+      end
+
+      def crashed_baseline_result(path, mutant_count)
+        FileResult.new(path: path, killed: 0, survived: 0, sites: [], harness_errors: mutant_count)
+      end
+
       def sample(mutations)
         return mutations unless @limit