saboteur 0.12.1 → 0.12.3

data/lib/saboteur/engine/coverage_store.rb

@@ -18,7 +18,10 @@ module Saboteur
       CACHE_INPUTS = %w[integration require rspec_args rails tests coverage_recorder].freeze
       # Names the freshest whole-suite map build; read as an untrusted hint:
       # only a bare 64-hex key joins the cache dir (#427).
-      WHOLE_SUITE_POINTER = "whole-suite-map"
+      # Renamed from "whole-suite-map" in 0.12.2: older versions also wrote
+      # the pointer for maps built from inferred specs, which are not whole
+      # suites, so their pointers are never read (#1286).
+      WHOLE_SUITE_POINTER = "whole-suite-map-v2"
       LOCKFILES = %w[Gemfile.lock gems.locked].freeze
       LOG = "coverage-build.log"
       # RSpec rewrites this on every run (example_status_persistence_file_path),
@@ -65,7 +68,7 @@ module Saboteur
         return serve_cached(path, cached, files, preloaded) if cached
 
         note = miss_note(files)
-        @diagnostics.inform(note.message(scoped: !@config["tests"].empty?)) if @config["cache"]
+        @diagnostics.notice(note.message(scoped: !@config["tests"].empty?)) if @config["cache"]
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         map = fresh_map(files, note, preloaded)
         build_seconds = Process.clock_gettime(Process::CLOCK_MONOTONIC) - started
@@ -237,7 +240,7 @@ module Saboteur
         return build_parts(files, parts) if parts.size > 1
 
         scope = @config["tests"].empty? ? "the whole suite" : "the selected specs"
-        @diagnostics.inform("building coverage map (runs #{scope} once)")
+        @diagnostics.notice("building coverage map (runs #{scope} once)")
         # The suite child forked next inherits this heap; pack it first, to
         # reduce later copying of shared pages.
         Execution::ForkReadiness.prepare_heap
@@ -267,7 +270,7 @@ module Saboteur
         total, counts = usage_checked { check_parts_cover_suite(parts) }
         saved = saved_parts(files, parts.size, counts)
         todo = saved.each_index.select { |index| saved[index].nil? }
-        @diagnostics.inform(parts_note(parts.size, todo.size))
+        @diagnostics.notice(parts_note(parts.size, todo.size))
         built = todo.empty? ? [] : run_parts(files, parts, todo)
         todo.zip(built) { |index, map| saved[index] = map }
         map = combine_saved(saved, total, files, parts.size)

data/lib/saboteur/engine/diagnostics.rb

@@ -187,6 +187,13 @@ module Saboteur
         @err.puts("saboteur: #{Text.display_safe_lines(message)}")
       end
 
+      # First-run explanations (#1264): the --quiet contract is findings,
+      # score and verdict, so these stay off stderr under it and print
+      # exactly as before otherwise.
+      def notice(message)
+        inform(message) unless @quiet
+      end
+
       # Chatter the default view folds into the quiet-start lines;
       # --verbose prints it byte-for-byte as before.
       def detail(message)

data/lib/saboteur/engine/pipelines.rb

@@ -104,9 +104,16 @@ module Saboteur
       # "Full run" for ignore staleness (#1206): no --since diff, no --subject
       # filter, and no narrowed include (explicit file arguments replace the
       # configured include) - only then was every in-scope subject examined, so
-      # an entry whose subject never appears really points at gone code.
+      # an entry whose subject never appears really points at gone code. The
+      # include nobody set counts as unscoped whether it is the generic
+      # default or the Rails one a config-less app gets (#1255).
       def unscoped_full_run?
-        !config["since"] && config["subjects"].empty? && config["include"] == Config::DEFAULTS["include"]
+        !config["since"] && config["subjects"].empty? && default_include?
+      end
+
+      def default_include?
+        config["include"] == Config::DEFAULTS["include"] ||
+          (config["include"] == Config::RAILS_INCLUDE && !config.explicit?("include"))
       end
 
       def external_command? = !config["test_command"].to_s.empty?

data/lib/saboteur/engine/result_cache.rb

@@ -26,7 +26,9 @@ module Saboteur
     # every source file is watched instead: reuse turns conservative, never
     # stale.
     class ResultCache
-      FORMAT = 1
+      # 2: entries carry value_differed (#1290); a version 1 file is dropped so
+      # no cached survivor reads as "never differed" without having been observed.
+      FORMAT = 2
       MAX_BYTES = 64 * 1024 * 1024
       STORED = %i[killed survived timeout].freeze
       LOCKFILES = %w[Gemfile.lock gems.locked].freeze
@@ -62,13 +64,13 @@ module Saboteur
       end
 
       # The stored verdict as a hash (status, reason, killed_by, kill_cause,
-      # runtime), or nil when it may no longer hold.
+      # runtime, value_differed), or nil when it may no longer hold.
       def lookup(subject, mutation, tests)
         entry = @entries[key(subject, mutation)]
         return nil unless entry && entry["fingerprint"] == fingerprint(subject, tests)
 
         { status: entry["status"].to_sym, reason: entry["reason"], killed_by: entry["killed_by"],
-          kill_cause: entry["kill_cause"], runtime: entry["runtime"] }
+          kill_cause: entry["kill_cause"], runtime: entry["runtime"], value_differed: entry["value_differed"] }
       end
 
       def record(result)
@@ -77,7 +79,7 @@ module Saboteur
         @entries[key(result.subject, result.mutation)] = {
           "fingerprint" => fingerprint(result.subject, result.covered_by), "status" => result.status.to_s,
           "reason" => result.reason, "killed_by" => result.killed_by, "kill_cause" => result.kill_cause,
-          "runtime" => result.runtime
+          "runtime" => result.runtime, "value_differed" => result.value_differed
         }
         checkpoint if @clock.call - @last_saved >= @save_interval
       end
@@ -154,7 +156,8 @@ module Saboteur
       def typed?(entry)
         STORED.map(&:to_s).include?(entry["status"]) && (entry["runtime"].nil? || entry["runtime"].is_a?(Numeric)) &&
           %w[reason kill_cause].all? { |key| entry[key].nil? || entry[key].is_a?(String) } &&
-          entry["killed_by"].is_a?(Array) && entry["killed_by"].all?(String)
+          entry["killed_by"].is_a?(Array) && entry["killed_by"].all?(String) &&
+          [nil, true, false].include?(entry["value_differed"])
       end
 
       def key(subject, mutation)

data/lib/saboteur/engine/scheduler.rb

@@ -235,7 +235,8 @@ module Saboteur
 
         MutantResult.new(subject: plan.subject, mutation: mutation, status: hit[:status], mutated_source: text,
                          reason: hit[:reason], runtime: hit[:runtime], killed_by: hit[:killed_by],
-                         covered_by: tests, kill_cause: hit[:kill_cause], reused: true)
+                         covered_by: tests, kill_cause: hit[:kill_cause], reused: true,
+                         value_differed: hit[:value_differed])
       end
 
       def execute(plan, mutation, text)
@@ -247,7 +248,7 @@ module Saboteur
         result = MutantResult.new(subject: plan.subject, mutation: mutation, status: outcome.status,
                                   mutated_source: text, reason: outcome.message, runtime: outcome.runtime,
                                   killed_by: outcome.failed_ids, covered_by: tests, kill_cause: outcome.kill_cause,
-                                  executed: outcome.executed_ids)
+                                  executed: outcome.executed_ids, value_differed: outcome.value_differed)
         outcome.failed_ids.each { |id| plan.killers[id] += 1 }
         note_leftovers(plan.subject, "#{mutation.operator} #{result.digest}", outcome)
         @diagnostics.progress(result)

data/lib/saboteur/engine/survivor_confirmation.rb

@@ -15,13 +15,14 @@ module Saboteur
       # confirmation_budget caps the whole pass.
       MAX_SPECS_PER_SURVIVOR = 8
 
-      def initialize(config:, map:, scheduler:, diagnostics:, budget_exceeded:, cache: nil)
+      def initialize(config:, map:, scheduler:, diagnostics:, budget_exceeded:, cache: nil, load_specs: ->(_files) {})
         @config = config
         @map = map
         @scheduler = scheduler
         @diagnostics = diagnostics
         @budget_exceeded = budget_exceeded
         @cache = cache
+        @load_specs = load_specs
       end
 
       def call(results, ignore_list:, early_stop: nil)
@@ -33,19 +34,60 @@ module Saboteur
                             "stopped early (#{early_stop.reason})")
         end
         @remaining = @config["confirmation_budget"]
+        @map_silent = 0
         results.map { |result| survivors.include?(result) ? confirm(result) : result }
                .tap { |confirmed| summarize(confirmed) }
+               .tap { warn_map_silent }
       end
 
       private
 
+      # A crash while confirming one survivor downgrades it to unconfirmed
+      # with one warning; it never ends the run (#1140).
       def confirm(result)
+        confirm_checked(result)
+      rescue RefusedSpecPath => e
+        warn_refused(e)
+        result.with_confirmation("unconfirmed_map(a covering spec from the whole-suite map was refused)")
+      rescue StandardError => e
+        warn_failed(result, e)
+        unconfirmed(result, "confirmation failed: #{e.class}")
+      end
+
+      # The map named a spec that is not a spec file inside the project: the
+      # map cannot be trusted, so its survivors stay counted (#1286).
+      def warn_refused(error)
+        return if @warned_refused
+
+        @warned_refused = true
+        @diagnostics.warn("survivor confirmation refused the whole-suite coverage map: " \
+                          "#{error.message.lines.first.strip}; its survivors stay counted; " \
+                          "run `saboteur run --all` to rebuild it")
+      end
+
+      # One line per run, however many survivors hit the same failure.
+      def warn_failed(result, error)
+        return if @warned_failure
+
+        @warned_failure = true
+        @diagnostics.warn("survivor confirmation failed for #{result.subject.id} #{result.digest} " \
+                          "(#{error.class}: #{error.message.lines.map(&:strip).reject(&:empty?).first}); " \
+                          "its survivors stay unconfirmed, outside the score")
+      end
+
+      def confirm_checked(result)
         return unconfirmed(result, "the confirmation budget is spent") if @remaining <= 0
         return unconfirmed(result, "the --max-duration budget is spent") if @budget_exceeded.call
 
-        tests = unrun_covering_tests(result)
-        return unconfirmed(result, "no covering tests") if tests.empty?
+        # Nothing in the whole-suite map covers the edited lines (the tree
+        # drifted since the map was built): the map cannot confirm anything.
+        covering = covering_tests(result)
+        return map_silent(result) if covering.empty?
 
+        tests = unrun_covering_tests(result, covering)
+        return result.with_confirmation("confirmed") if tests.empty?
+
+        load_unselected_specs(tests)
         outcome = run_confirmation(result, tests)
         @remaining -= outcome.runtime || 0
         case outcome.status
@@ -58,8 +100,14 @@ module Saboteur
       # The whole-suite map's covering tests for the mutant's edited lines
       # (branch evidence intersected, mirroring the scheduler), minus the
       # tests the mutant already ran, fastest first, capped.
-      def unrun_covering_tests(result)
-        fastest_first(covering_tests(result) - (result.executed || result.covered_by)).first(MAX_SPECS_PER_SURVIVOR)
+      def unrun_covering_tests(result, covering)
+        fastest_first(covering - (result.executed || result.covered_by)).first(MAX_SPECS_PER_SURVIVOR)
+      end
+
+      # The covering specs may live in files this run never loaded; the
+      # forked confirmation child can only run examples already in its world.
+      def load_unselected_specs(tests)
+        @load_specs.call(tests.map { |id| id.sub(/\[[\d:]+\]\z/, "") })
       end
 
       def covering_tests(result)
@@ -86,11 +134,12 @@ module Saboteur
       # becomes an error; a check the budgets never let run comes back
       # unverified - outside the score and never cached.
       def checked_kill(result, tests, outcome)
-        kill = result.with_confirmation("confirmed", status: :killed, reason: outcome.message,
-                                                     killed_by: outcome.failed_ids, covered_by: tests,
-                                                     kill_cause: outcome.kill_cause,
-                                                     runtime: (result.runtime || 0) + (outcome.runtime || 0),
-                                                     executed: (result.executed || []) + outcome.executed_ids)
+        kill = result.with_confirmation(
+          "killed_by_confirmation", status: :killed, reason: outcome.message, killed_by: outcome.failed_ids,
+                                    covered_by: tests, kill_cause: outcome.kill_cause,
+                                    runtime: (result.runtime || 0) + (outcome.runtime || 0),
+                                    executed: (result.executed || []) + outcome.executed_ids
+        )
         checked = VerdictCheck.new(run_unchanged: unchanged_runner(result.subject),
                                    baseline_timeout: @config["baseline_timeout"]).call([kill]).first
         return checked unless checked.status == :killed
@@ -108,7 +157,7 @@ module Saboteur
       # (#1079). ResultCache#record replaces the subject+mutation entry, so
       # the stale survivor verdict cannot win a later lookup.
       def record_kill(result, kill)
-        @cache&.record(kill.with_confirmation("confirmed", covered_by: covering_tests(result)))
+        @cache&.record(kill.with_confirmation("killed_by_confirmation", covered_by: covering_tests(result)))
       end
 
       # The unchanged-method re-run VerdictCheck checks a kill against, in
@@ -129,6 +178,13 @@ module Saboteur
         end
       end
 
+      # The map says nothing about the edited lines (the tree drifted since it
+      # was built): the survivor stays counted and the pass says so once.
+      def map_silent(result)
+        @map_silent += 1
+        result.with_confirmation("unconfirmed_map(no covering tests in the whole-suite map)")
+      end
+
       def unconfirmed(result, reason)
         result.with_confirmation("unconfirmed(#{reason})")
       end
@@ -148,6 +204,14 @@ module Saboteur
         durations.empty? ? nil : durations.sum / durations.size
       end
 
+      def warn_map_silent
+        return if @map_silent.zero?
+
+        @diagnostics.warn("survivor confirmation: the whole-suite coverage map covers none of the edited lines of " \
+                          "#{@map_silent} survivor#{'s' unless @map_silent == 1}, so they stay counted; " \
+                          "run `saboteur run --all` to rebuild it")
+      end
+
       def summarize(results)
         counts = results.filter_map(&:confirmation).tally
         return if counts.empty?

data/lib/saboteur/engine/test_guess.rb

@@ -116,7 +116,8 @@ module Saboteur
         # Why the subjectless files needed no spec.
         def subjectless_message(since:)
           detail = since ? "no changed mutation subjects" : "no mutation subjects"
-          "inferred specs: no spec is required for #{names(subjectless)}: they have #{detail}"
+          who = subjectless.size == 1 ? "it has" : "they have"
+          "inferred specs: no spec is required for #{names(subjectless)}: #{who} #{detail}"
         end
 
         # The per-file warning when the run proceeds with the mapped

data/lib/saboteur/engine.rb

@@ -31,11 +31,6 @@ module Saboteur
     include GatedRun
     include SelectionAnnouncement
 
-    # Confirmation only guards a partial coverage map, so it is silent unless
-    # the user opted into partial_coverage = use (#1228).
-    CONFIRMATION_SKIPPED = "survivor confirmation skipped: partial_coverage = use applies only to a cached " \
-                           "whole-suite run (no --test, one coverage part)"
-
     # Everything besides sources and tests that can change a verdict.
     VERDICT_INPUTS = %w[integration require rspec_args rails reeval sources operators exclude_operators arid
                         timeout_factor timeout_min
@@ -130,6 +125,12 @@ module Saboteur
       @coverage_store&.whole_suite_map
     end
 
+    # True when this run did not build a whole-suite map: a diff, named
+    # subjects, an explicit --test or inferred specs (#1286).
+    def scoped_selection?
+      !whole_suite_run?
+    end
+
     # False when caching is off, where no coverage build can ever leave a
     # whole-suite map to consult, so advising one would be wrong (review C1).
     def whole_suite_map_lookup?
@@ -292,15 +293,21 @@ module Saboteur
       confirm_survivors(run_candidates(subjects, lists, scheduler, cache, ignore_list), scheduler, cache, ignore_list)
     end
 
+    # Confirm each live survivor against the whole-suite coverage map (#1286):
+    # the covering specs the run's own selection never loaded get one budgeted
+    # run. Scoped runs (--since, --subject, pr) are the point, so nothing here
+    # depends on partial_coverage or on the run being unscoped. Without a
+    # whole-suite map there is nothing to confirm against; the run says so
+    # elsewhere (survivors unconfirmed: no whole-suite coverage map).
     def confirm_survivors(results, scheduler, cache, ignore_list)
-      unless CoveragePartial.use?(config, config["coverage_parts"])
-        live = results.any? { |result| result.survived? && !ignore_list.accepts?(result) }
-        @diagnostics.inform(CONFIRMATION_SKIPPED) if live && config["partial_coverage"] == "use"
-        return results
-      end
+      return results if results.none? { |result| result.survived? && !ignore_list.accepts?(result) }
 
-      SurvivorConfirmation.new(config: config, map: scheduler.map, scheduler: scheduler, diagnostics: @diagnostics,
-                               budget_exceeded: method(:budget_exceeded?), cache: cache)
+      whole = whole_suite_coverage_map
+      return results if whole.nil?
+
+      SurvivorConfirmation.new(config: config, map: whole, scheduler: scheduler, diagnostics: @diagnostics,
+                               budget_exceeded: method(:budget_exceeded?), cache: cache,
+                               load_specs: ->(files) { scheduler.runner.integration.load_spec_files(files) })
                           .call(results, ignore_list: ignore_list, early_stop: @early_stop)
     end
 
@@ -350,10 +357,19 @@ module Saboteur
     # baseline's own chatter (demoted to --verbose) would start.
     def announce_quiet_start(store, files)
       @map_cached = store.reusable?(files)
-      @diagnostics.quiet_start_header(scope: config["since"] ? "--since #{config['since']}" : "whole project",
+      @diagnostics.quiet_start_header(scope: quiet_scope,
                                       seed: config["seed"], operators: config.operator_policy["effective"].size)
     end
 
+    # Names what the run covers: the diff, the --subject filter, or the
+    # whole project (P6) - a --subject run is not "whole project".
+    def quiet_scope
+      parts = []
+      parts << "--since #{config['since']}" if config["since"]
+      parts << "--subject #{config['subjects'].join(', ')}" if config["subjects"].any?
+      parts.empty? ? "whole project" : parts.join(", ")
+    end
+
     def inform_about_run(subjects, map)
       if @diagnostics.quiet_start && !@diagnostics.verbose
         @diagnostics.quiet_baseline(passes: @completed_baseline_passes, elapsed: @baseline_elapsed,
@@ -367,11 +383,13 @@ module Saboteur
     end
 
     # This run's map is the whole-suite map only when nothing scoped it:
-    # no --since, no subjects, and tests either unset or inferred over every
-    # included file (never an explicit --test list) (review C1).
+    # no --since, no subjects, and every spec file loaded (--all or
+    # c.test_selection = :all). Inferred specs are a selection, never the
+    # whole suite: a spec with no matching source file is not in the map
+    # (#1286).
     def whole_suite_run?
       config["since"].nil? && config["subjects"].empty? &&
-        (config["tests"].empty? || !@guessed_tests.nil?)
+        config["tests"].empty? && @guessed_tests.nil?
     end
 
     def coverage_store(integration, load_lines, load_methods = {})

data/lib/saboteur/execution/runner.rb

@@ -18,10 +18,13 @@ module Saboteur
       # else the class of the error it died with (a crash, not a check).
       # executed_ids: the tests the child reports it ran; empty when it could
       # not say (a test called exit).
+      # value_differed: whether the mutated expression ever produced a value
+      # different from the original (SiteProbe); nil when the site is not
+      # probeable, never ran, or the run did not survive (#1290).
       Outcome = Data.define(:status, :runtime, :failed_ids, :message, :leftover_pids, :kill_cause,
-                            :executed_ids) do
+                            :executed_ids, :value_differed) do
         def initialize(status:, runtime:, failed_ids: [], message: nil, leftover_pids: [], kill_cause: nil,
-                       executed_ids: [])
+                       executed_ids: [], value_differed: nil)
           super
         end
       end
@@ -74,6 +77,9 @@ module Saboteur
       # sandbox: when given, a callable run first in every child (Landlock
       # makes the project tree read-only there, #152). It raises rather than
       # run half-restricted, which the child reports as an error.
+      # Survivor confirmation loads the spec files a scoped run left out (#1286).
+      attr_reader :integration
+
       def initialize(integration:, reevaluator:, log_dir:, hooks: Hooks.new, supervisor: Supervisor.new, seed: 1,
                      sandbox: nil, canary: nil, crash_log: nil)
         @integration = integration
@@ -95,6 +101,7 @@ module Saboteur
       def run(subject:, text:, test_ids:, timeout:, mutation: nil, eval_prefix: nil)
         @hooks.run(:before_fork, mutation)
         @sequence = @sequence.to_i + 1
+        text = SiteProbe.text(subject, mutation, text) || text if mutation
         job = Job.new(subject:, text:, test_ids:, timeout:, mutation:, eval_prefix:,
                       log_path: File.join(@log_dir, "child-#{Process.pid}-#{@sequence}.log"))
         log_file = open_log(job)
@@ -129,6 +136,7 @@ module Saboteur
         # Before the evaluation: a whole-file subject runs the file's own
         # top-level code there, and it must see the run's random numbers.
         Kernel.srand(@seed)
+        SiteProbe.reset
         evaluate_mutant(writer, job)
         stale = stale_captures(job)
         Protocol.emit(writer, "captures", site: stale.first, stale: stale.size) if stale.any?
@@ -167,7 +175,8 @@ module Saboteur
           Protocol.emit(writer, "error", message: "around_mutant hook did not run the tests")
         else
           called = flags[:replacement_called]
-          Protocol.emit(writer, "result", **with_crash_detail(result, started_at), replacement_called: called)
+          Protocol.emit(writer, "result", **with_crash_detail(result, started_at), replacement_called: called,
+                                                                                   value_differed: SiteProbe.differed)
           # A reload after the mutant already ran (an after-hook restore)
           # is no reason to doubt the verdict; only a never-invoked mutant
           # can have been hidden by the overwrite.
@@ -391,7 +400,8 @@ module Saboteur
           return mismatch(runtime, "executed #{executed.size} of #{test_ids.size} requested tests")
         end
 
-        Outcome.new(status: :survived, runtime: runtime, executed_ids: executed)
+        Outcome.new(status: :survived, runtime: runtime, executed_ids: executed,
+                    value_differed: result["value_differed"])
       end
 
       def killed_outcome(result, runtime, failed, executed, verbose_failure)

data/lib/saboteur/execution/site_probe.rb

@@ -0,0 +1,161 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+require "prism"
+
+module Saboteur
+  module Execution
+    # Records, in the mutant's child, whether the mutated expression produced
+    # a different value from the original one (#1290). The mutated site is
+    # wrapped as (observe((mutated), [operands]) { original }). The mutated
+    # expression runs exactly once and first, as it does unwrapped, so the
+    # suite sees the same calls and the same verdict. The original runs
+    # only when every operand is a core immutable (Integer, Float, Rational,
+    # Symbol, nil, true, false, a frozen String), so only built-in operators
+    # execute; with any other operand the site is not probed and reports
+    # nil. Only side-effect-free site shapes are wrapped at all (literals,
+    # local and instance variable reads, arithmetic and comparison on
+    # those).
+    module SiteProbe
+      OPERATORS = %i[+ - * / % ** < <= > >= == != <=> & | ^ ! -@ +@ ~].freeze
+      LEAVES = [Prism::IntegerNode, Prism::FloatNode, Prism::RationalNode, Prism::SymbolNode, Prism::NilNode,
+                Prism::TrueNode, Prism::FalseNode, Prism::LocalVariableReadNode,
+                Prism::InstanceVariableReadNode].freeze
+
+      @hits = 0
+      @differed = false
+      @comparable = true
+
+      class << self
+        # The def text with the mutated site wrapped, or nil when the site
+        # cannot be probed safely. mutated_text is what the run would
+        # evaluate unwrapped; the wrap is only offered when it is exactly
+        # the source with the mutation's edits applied.
+        def text(subject, mutation, mutated_text)
+          return nil unless subject.respond_to?(:whole_file_only?) && mutation.respond_to?(:edits)
+          return nil if subject.whole_file_only? || mutation.edits.size != 1
+
+          source = subject.source
+          return nil unless subject.apply(mutation.edits) == mutated_text
+
+          edit = mutation.edits.first
+          range = (edit.start_byte - subject.start_byte)...(edit.end_byte - subject.start_byte)
+          wrap(source.b, range, edit.replacement.b)&.force_encoding(Encoding::UTF_8)
+        rescue StandardError
+          nil # a probe must never turn a mutant run into an error
+        end
+
+        def reset
+          @hits = 0
+          @differed = false
+          @comparable = true
+        end
+
+        # nil: the site never ran, or its values could not be compared.
+        def differed
+          return nil if @hits.zero? || !@comparable
+
+          @differed
+        end
+
+        def observe(mutated, operands, &)
+          compare(mutated, &) if operands.all? { |operand| immutable?(operand) }
+          mutated
+        end
+
+        private
+
+        def immutable?(value)
+          case value
+          when Integer, Float, Rational, Symbol, nil, true, false then true
+          when String then value.frozen?
+          else false
+          end
+        end
+
+        def compare(mutated)
+          original = yield
+          @hits += 1
+          @differed ||= original != mutated
+        rescue StandardError
+          @comparable = false
+        end
+
+        def wrap(source, range, replacement)
+          top = site(Prism.parse(source).value, range)
+          # A bare edited literal differs from itself by construction: no signal.
+          return nil if top.nil? || LEAVES.any? { |leaf| top.is_a?(leaf) }
+
+          from = top.location.start_offset
+          to = top.location.end_offset
+          original = source.byteslice(from...to)
+          mutated = original.byteslice(0, range.begin - from) + replacement + original.byteslice((range.end - from)..)
+          return nil if (original + mutated).include?("\n")
+
+          source.byteslice(0, from) + probe(top, original, mutated) + source.byteslice(to..)
+        end
+
+        def probe(top, original, mutated)
+          reads = []
+          collect_reads(top, reads)
+          operands = reads.uniq.join(", ")
+          "(::Saboteur::Execution::SiteProbe.observe((#{mutated}), [#{operands}]) { #{original} })".b
+        end
+
+        def collect_reads(node, reads)
+          reads << node.slice if node.is_a?(Prism::LocalVariableReadNode) || node.is_a?(Prism::InstanceVariableReadNode)
+          node.compact_child_nodes.each { |child| collect_reads(child, reads) }
+        end
+
+        # The outermost pure expression around the edit, climbing while the
+        # parent is pure too.
+        def site(root, range)
+          path = path_to(root, range).grep_v(Prism::ArgumentsNode)
+          index = path.rindex { |node| pure?(node) }
+          return nil unless index
+
+          index -= 1 while index.positive? && climbable?(path[index - 1])
+          path[index]
+        end
+
+        def climbable?(node)
+          (node.is_a?(Prism::CallNode) || node.is_a?(Prism::ParenthesesNode)) && pure?(node)
+        end
+
+        def path_to(node, range)
+          path = [node]
+          loop do
+            child = node.compact_child_nodes.find do |c|
+              c.location.start_offset <= range.begin && range.end <= c.location.end_offset
+            end
+            return path unless child
+
+            path << child
+            node = child
+          end
+        end
+
+        def pure?(node)
+          case node
+          when *LEAVES then true
+          when Prism::ParenthesesNode then pure_parentheses?(node)
+          when Prism::CallNode then pure_call?(node)
+          else false
+          end
+        end
+
+        def pure_parentheses?(node)
+          body = node.body
+          body.is_a?(Prism::StatementsNode) && body.body.size == 1 && pure?(body.body.first)
+        end
+
+        def pure_call?(node)
+          return false unless OPERATORS.include?(node.name) && node.block.nil? && node.receiver
+
+          pure?(node.receiver) && Array(node.arguments&.arguments).size <= 1 &&
+            Array(node.arguments&.arguments).all? { |arg| pure?(arg) }
+        end
+      end
+    end
+  end
+end

data/lib/saboteur/gates.rb

@@ -205,7 +205,7 @@ module Saboteur
 
     # A subject fails a gate when at least one of its mutants survived.
     def failing_subjects(scored)
-      scored.select { |result| result.status == :survived }.map(&:subject).uniq.size
+      scored.select(&:survived?).map(&:subject).uniq.size
     end
 
     def over?(count, limit, executed)

data/lib/saboteur/integration/rspec.rb

@@ -124,6 +124,36 @@ module Saboteur
         world.example_groups.map { |group| File.expand_path(group.metadata[:file_path]) }.uniq
       end
 
+      # Loads spec files the run's own selection left out, in the parent, so a
+      # forked confirmation run can execute their examples (#1286). Files
+      # already loaded are skipped; a file that defines no group is an error,
+      # since its examples could never run.
+      def load_spec_files(paths)
+        loaded = test_files
+        absolute = paths.map { |path| File.expand_path(path, config.root) }.uniq
+        (absolute - loaded).each do |path|
+          require_inside_root(path)
+          before = world.example_groups.size
+          from_directory(config.root) { load(path) }
+          raise RefusedSpecPath, "#{path} defines no example group" if world.example_groups.size == before
+        end
+      end
+
+      # The ids come from a cached coverage map, which is untrusted input
+      # (#427): only a spec file that really lives under the project root,
+      # symlinks resolved, may be loaded.
+      def require_inside_root(path)
+        raise RefusedSpecPath, "refusing to load #{path}: not a *_spec.rb file" unless path.end_with?("_spec.rb")
+
+        root = File.realpath(config.root)
+        real = File.realpath(path)
+        return if real.start_with?("#{root}#{File::SEPARATOR}") && real.end_with?("_spec.rb")
+
+        raise RefusedSpecPath, "refusing to load #{path}: it resolves outside the project root"
+      rescue SystemCallError
+        raise RefusedSpecPath, "refusing to load #{path}: it does not exist under the project root"
+      end
+
       # Runs the tests in the order given: groups by their earliest example,
       # examples by position.
       def run(ids)