saboteur 0.5.0 → 0.7.0

data/lib/saboteur/config.rb

@@ -1,6 +1,8 @@
 # SPDX-License-Identifier: MIT
 # frozen_string_literal: true
 
+require_relative "text"
+
 require_relative "mutation_source/builtin"
 require_relative "mutation_source/operator_registry"
 require_relative "mutation_source/hazard_guard"
@@ -39,8 +41,11 @@ module Saboteur
       "custom_map" => "config/saboteur_custom_map.rb",
       "sources" => ["builtin"],
       "operators" => [],
+      "exclude_operators" => [],
       "hooks" => [],
       "rails" => false,
+      # Hosts the user asserts are disposable test databases (issue #258).
+      "allow_db_hosts" => [],
       "reeval" => "nesting",
       "cache_dir" => ".saboteur",
       "json_report" => ".saboteur/report.json",
@@ -54,8 +59,13 @@ module Saboteur
       "allow_focus" => false,
       "fail_fast" => false,
       "guess_tests" => false,
+      "all" => false,
+      "test_selection" => "auto",
       "matrix" => false,
       "seed" => 1,
+      "baseline_passes" => 2,
+      "max_duration" => nil,
+      "max_duration_ok" => false,
       "tests" => [],
       "fingerprint_extra" => [],
       "threshold" => nil,
@@ -63,12 +73,13 @@ module Saboteur
       "max_errors" => nil
     }.freeze
 
-    INTEGER_KEYS = %w[jobs max_memory_mb max_processes max_mutants_per_method seed].freeze
+    INTEGER_KEYS = %w[jobs max_memory_mb max_processes max_mutants_per_method seed baseline_passes].freeze
     FLOAT_KEYS = %w[timeout_factor timeout_min baseline_timeout coverage_timeout].freeze
+    NILABLE_FLOAT_KEYS = %w[threshold max_duration].freeze
     THRESHOLD_RANGE = (0.0..100.0)
 
     LIST_KEYS = %w[require include exclude arid hazard sources hooks rspec_args subjects tests
-                   fingerprint_extra sandbox_writable operators whole_file].freeze
+                   fingerprint_extra sandbox_writable operators exclude_operators whole_file allow_db_hosts].freeze
 
     attr_reader :root
 
@@ -93,11 +104,19 @@ module Saboteur
       hash.to_h { |key, value| [key.to_s, value] }.compact
     end
 
-    def initialize(values = {}, root: Dir.pwd)
-      @root = File.expand_path(root)
+    # Deprecations found while loading: printed by the CLI, never fatal.
+    attr_reader :deprecation_warnings
+
+    def initialize(values = {}, root: Dir.pwd, explicit: nil)
+      # Retag the root losslessly: under a non-UTF-8 locale it arrives
+      # locale-tagged, and every glob, join and expand below would mix
+      # encodings with the UTF-8 patterns from the config file (#231).
+      @root = Text.utf8_identity(File.expand_path(root))
       unknown = values.keys - DEFAULTS.keys
       raise ConfigError, "unknown config key(s): #{unknown.join(', ')}" if unknown.any?
 
+      @deprecation_warnings = deprecations(values)
+      @explicit_keys = (explicit || values.keys).map(&:to_s).freeze
       @values = DEFAULTS.merge(values)
       coerce!
       validate!
@@ -112,6 +131,26 @@ module Saboteur
       @values.fetch(key.to_s, default)
     end
 
+    # Keys the user set (config file or CLI flag) rather than relying on
+    # the default; carried through Engine's config clone so provenance
+    # survives (#296).
+    attr_reader :explicit_keys
+
+    # A copy with some values replaced or dropped, keeping which keys the
+    # user set explicitly: the replacements count as explicit, the dropped
+    # keys lose it (#296).
+    def with(values, except: [])
+      merged = to_h.except(*except).merge(values)
+      Config.new(merged, root: root, explicit: (explicit_keys - except.map(&:to_s)) | values.keys.map(&:to_s))
+    end
+
+    # Whether the user set a key (config file or CLI flag) rather than
+    # relying on the default. An explicitly requested report artifact is
+    # completion evidence, so its write failure is a hard error (#296).
+    def explicit?(key)
+      @explicit_keys.include?(key.to_s)
+    end
+
     def to_h
       @values.dup
     end
@@ -121,7 +160,8 @@ module Saboteur
       matched = self["include"].flat_map { |pattern| Dir.glob(pattern, base: root) }
       excluded = self["exclude"].flat_map { |pattern| Dir.glob(pattern, base: root) }
       (matched - excluded).select { |file| file.end_with?(".rb") }
-                          .map { |file| File.realpath(File.expand_path(file, root)) }.uniq.sort
+                          .map { |file| File.realpath(File.expand_path(Text.utf8_identity(file), root)) }
+                          .uniq.sort
     end
 
     # Patterns that match no file. A pattern goes stale when files move;
@@ -148,11 +188,23 @@ module Saboteur
 
     private
 
+    # An explicit guess_tests = false (config file or --no-guess-tests) used
+    # to keep the whole suite; inference is the default now, so the opt-out
+    # is --all / c.test_selection = :all. guess_tests = true is the default
+    # behavior spelled out, so it stays silent.
+    def deprecations(values)
+      return [] unless values["guess_tests"] == false
+
+      ["guess_tests = false is deprecated: inferred specs are the default and it no longer restores the " \
+       "whole suite; use --all or c.test_selection = :all to run every spec"]
+    end
+
     def coerce!
       INTEGER_KEYS.each { |key| @values[key] = Integer(@values[key]) }
       FLOAT_KEYS.each { |key| @values[key] = Float(@values[key]) }
       LIST_KEYS.each { |key| @values[key] = Array(@values[key]).map(&:to_s) }
-      @values["threshold"] = Float(@values["threshold"]) unless @values["threshold"].nil?
+      NILABLE_FLOAT_KEYS.each { |key| @values[key] = Float(@values[key]) unless @values[key].nil? }
+      @values["test_selection"] = @values["test_selection"].to_s
     rescue ArgumentError, TypeError => e
       raise ConfigError, "invalid config value: #{e.message}"
     end
@@ -161,6 +213,13 @@ module Saboteur
       raise ConfigError, "max_mutants_per_method must be > 0" unless self["max_mutants_per_method"].positive?
     end
 
+    # The unchanged-suite checks: how many, and the whole run's clock (#55, #245).
+    def validate_baseline!
+      raise ConfigError, "seed must be >= 0" if self["seed"].negative?
+      raise ConfigError, "baseline_passes must be >= 1" if self["baseline_passes"] < 1
+      raise ConfigError, "max_duration must be > 0" if self["max_duration"] && !self["max_duration"].positive?
+    end
+
     def validate_report_paths!
       json = path("json_report")
       if json && json == path("html_report")
@@ -176,7 +235,7 @@ module Saboteur
     def validate_modes!
       validate_fail_fast!
       validate_matrix!
-      validate_guess_tests!
+      validate_test_selection!
       validate_gates!
     end
 
@@ -205,11 +264,10 @@ module Saboteur
       raise ConfigError, "threshold must be between 0 and 100"
     end
 
-    def validate_guess_tests!
-      return unless self["guess_tests"]
+    def validate_test_selection!
+      return if %w[auto all].include?(self["test_selection"])
 
-      raise ConfigError, "guess_tests needs since" unless self["since"]
-      raise ConfigError, "guess_tests cannot be combined with tests" if self["tests"].any?
+      raise ConfigError, "test_selection must be one of: auto, all"
     end
 
     def validate_reeval!
@@ -226,7 +284,7 @@ module Saboteur
       validate_mutant_limit!
       validate_threshold!
       validate_modes!
-      raise ConfigError, "seed must be >= 0" if self["seed"].negative?
+      validate_baseline!
       raise ConfigError, "max_memory_mb must be > 0" unless self["max_memory_mb"].positive?
       raise ConfigError, "max_processes must be > 0" unless self["max_processes"].positive?
       raise ConfigError, "timeout_factor must be > 0" unless self["timeout_factor"].positive?
@@ -236,8 +294,25 @@ module Saboteur
       validate_operator_config!
     end
 
+    public
+
+    def operator_policy
+      MutationSource::OperatorRegistry.policy(self["operators"], self["exclude_operators"])
+    end
+
+    # Versioned policy travels with every identity, not with mutation digests.
+    def selection_settings
+      to_h.merge("operator_policy" => operator_policy)
+    end
+
+    private
+
     def validate_operator_config!
-      MutationSource::OperatorRegistry.resolve(self["operators"])
+      effective = MutationSource::OperatorRegistry.select(self["operators"], self["exclude_operators"])
+      if effective.empty?
+        raise ConfigError,
+              "operator selection is empty: enable at least one operator or clear exclusions"
+      end
 
       self["arid"].each { |pattern| Regexp.new(pattern) }
     rescue RegexpError => e

data/lib/saboteur/crash_report.rb

@@ -0,0 +1,154 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "tmpdir"
+require "pathname"
+
+module Saboteur
+  # Last-resort crash reporting, shared by the CLI's StandardError rescue
+  # and the exe-level wrapper: one bounded line on stderr, the full
+  # backtrace in a log file the line names, the backtrace on stderr with
+  # --verbose, and the same failure as agent JSON when an agent listens.
+  # Always returns EXIT_TOOL.
+  module CrashReport
+    ISSUES_URL = "https://github.com/vamsipavanmahesh/saboteur/issues"
+
+    # Same value as CLI::EXIT_TOOL, kept local so the reporter still works
+    # when the CLI itself never finished loading.
+    EXIT_TOOL = 3
+
+    # The crash log's file name under the run's cache dir; the runner reads
+    # it back to explain a nested run's crash in the failure detail (#296).
+    LOG_NAME = "internal-error.log"
+
+    module_function
+
+    def call(error, verbose:, agent:, err:, out:, log_path: nil)
+      summary = "internal error (#{error.class}: #{one_line(error.message)})"
+      line = "saboteur: #{summary} - please report it: #{ISSUES_URL}"
+      written = write_log(log_path, error)
+      line = "#{line}; full backtrace: #{display_path(written)}" if written
+      err.puts(line)
+      err.puts(full_text(error)) if verbose
+      out.print(agent_json(summary)) if agent
+      EXIT_TOOL
+    end
+
+    # A crash message can span lines or carry bytes that are invalid in
+    # UTF-8 (a LANG=C failure, say); the one-line diagnostic must survive
+    # both, and stay one bounded line.
+    def one_line(message)
+      text = scrub(message).gsub(/\s+/, " ").strip
+      text.length > 160 ? "#{text[0...160]}..." : text
+    end
+
+    # Class, full message and backtrace, scrubbed so locale-invalid bytes
+    # cannot corrupt the log or the terminal.
+    def full_text(error)
+      (["#{error.class}: #{scrub(error.message)}"] + Array(error.backtrace).map { |frame| scrub(frame) }).join("\n")
+    end
+
+    # Writes the log next to the other run state; returns the written path,
+    # or nil when the log cannot be written - the crash itself must still
+    # be reported, so an unwritable directory is not a second failure.
+    # Reporter::Agent.failure's payload, reproduced minimally for crashes
+    # before the CLI's reporter files load: same schema and pretty rendering;
+    # the summary is already normalized, so no message cap is needed here.
+    def agent_json(summary)
+      payload =
+        if defined?(Reporter::Agent)
+          Reporter::Agent.failure(summary, EXIT_TOOL)
+        else
+          { version: 1, status: "error", verdict: "tool_failure", exitCode: EXIT_TOOL,
+            message: summary, next: { help: "saboteur help run" } }
+        end
+      "#{JSON.pretty_generate(payload)}\n"
+    end
+
+    def write_log(log_path, error)
+      return nil unless log_path
+
+      # The primary path is user-configured but still predictable: without
+      # O_NOFOLLOW a planted symlink would redirect the truncate/chmod, and
+      # without O_NONBLOCK a planted FIFO would block the open. Where the
+      # platform lacks either, only the EXCL-created temp fallback is safe
+      # (#296).
+      if safe_log_io?
+        begin
+          FileUtils.mkdir_p(File.dirname(log_path))
+          # Private like the temp fallback: the runner only reads logs with
+          # no group/other bits, from the same no-follow fd (#296).
+          flags = File::CREAT | File::WRONLY | File::TRUNC | nofollow_flag | nonblock_flag
+          File.open(log_path, flags, 0o600) do |file|
+            file.chmod(0o600)
+            file.write("#{full_text(error)}\n")
+          end
+          return log_path
+        rescue SystemCallError, IOError
+          # Fall through to the temp fallback.
+        end
+      end
+      write_tmp_log(error)
+    end
+
+    # The fallback is computed lazily, only once the primary write failed:
+    # an eager tmp_log_path call could itself raise (Dir.tmpdir finds no
+    # usable dir) and mask the crash it was meant to log (#296).
+    #
+    # The fallback path is predictable and lives in a shared directory, so
+    # it is created privately: CREAT|EXCL|WRONLY|NOFOLLOW never follows or
+    # overwrites a pre-existing file or symlink, and the mode pins the log
+    # to 0600. A taken or hostile path means no log - the crash report
+    # itself must still go out, so every failure here degrades to nil.
+    def write_tmp_log(error)
+      File.open(tmp_log_path, File::CREAT | File::EXCL | File::WRONLY | nofollow_flag, 0o600) do |file|
+        file.write("#{full_text(error)}\n")
+      end
+      tmp_log_path
+    rescue SystemCallError, IOError, ArgumentError
+      nil
+    end
+
+    # O_NOFOLLOW where the platform has it (every CI target does).
+    def nofollow_flag
+      File.const_defined?(:NOFOLLOW) ? File::NOFOLLOW : 0
+    end
+
+    # O_NONBLOCK where the platform has it (every CI target does).
+    def nonblock_flag
+      File.const_defined?(:NONBLOCK) ? File::NONBLOCK : 0
+    end
+
+    # The private crash-log write/read needs both flags: without O_NOFOLLOW
+    # a planted symlink redirects the open, without O_NONBLOCK a planted
+    # FIFO blocks it. Where either is missing, the log is omitted rather
+    # than opened unsafely (#296).
+    def safe_log_io?
+      File.const_defined?(:NOFOLLOW) && File.const_defined?(:NONBLOCK)
+    end
+
+    # Where the log lands when a configured cache dir is not writable - a
+    # sandboxed child holds the project read-only, but the system temp dir is
+    # granted (#296). Only a configured log path falls back: cache_dir = nil
+    # still means no log at all. Keyed by pid so parallel children never
+    # share a file; the runner reads the same path back in the same process.
+    def tmp_log_path(pid: Process.pid)
+      File.join(Dir.tmpdir, "saboteur-#{pid}-#{LOG_NAME}")
+    end
+
+    # The message names the log; relative to the working directory when it
+    # sits inside it, so the line stays short.
+    def display_path(path)
+      relative = Pathname(path).relative_path_from(Pathname(Dir.pwd)).to_s
+      relative.start_with?("..") ? path : relative
+    rescue ArgumentError
+      path
+    end
+
+    def scrub(string)
+      string.to_s.dup.force_encoding(Encoding::UTF_8).scrub("?")
+    end
+  end
+end

data/lib/saboteur/custom_map.rb

@@ -1,6 +1,8 @@
 # SPDX-License-Identifier: MIT
 # frozen_string_literal: true
 
+require_relative "text"
+
 module Saboteur
   # Explicit source-file -> spec-file mapping from config/saboteur_custom_map.rb:
   #
@@ -109,7 +111,7 @@ module Saboteur
     def duplicate_keys(path)
       seen = Hash.new(0)
       File.readlines(path).each do |line|
-        seen[::Regexp.last_match(1)] += 1 if line =~ /^\s*"(.+?)"\s*=>/
+        seen[::Regexp.last_match(1)] += 1 if Text.utf8(line) =~ /^\s*"(.+?)"\s*=>/
       end
       seen.select { |_, count| count > 1 }.keys
     end

data/lib/saboteur/doctor.rb

@@ -3,6 +3,8 @@
 
 require "coverage"
 require_relative "baseline_health"
+require_relative "engine/sandbox_policy"
+require_relative "execution/sandbox"
 
 module Saboteur
   # Reports the current environment, never mutations. The two unchanged suite
@@ -25,8 +27,10 @@ module Saboteur
       integration = boot_target(hooks)
       @out.puts "Integration: #{@config['integration']} (loaded)"
       @out.puts "Rails: #{@config['rails'] ? 'enabled' : 'disabled'}"
+      check_database_hosts
       @out.puts "SimpleCov: #{defined?(::SimpleCov) ? 'present; start suppressed for this process' : 'not loaded'}"
-      check_coverage
+      verify_coverage
+      check_sandbox
       check_suite(integration, hooks)
       true
     end
@@ -62,15 +66,51 @@ module Saboteur
             "doctor supports the rspec integration; set integration: rspec"
     end
 
+    # Printed once; verified twice. Boot must not wake coverage up, so the
+    # post-boot check re-reads the state without printing a second line.
     def check_coverage
       state = Coverage.state
       @out.puts "Coverage: #{state}"
+      verify_coverage(state)
+    end
+
+    def verify_coverage(state = Coverage.state)
       return if Coverage.supported?(:lines) && Coverage.supported?(:methods) && state == :suspended
 
       raise Error, "Coverage must be suspended with line and method support before boot; use the saboteur " \
                    "executable, disable SimpleCov and remove other Coverage.start calls"
     end
 
+    # A kernel capability probe, not verified isolation: what the kernel
+    # would let mutant children do, and what the run does with that - the
+    # engine's sandbox policy owns the refusal or degradation itself.
+    def check_sandbox
+      if @config["sandbox"] == false
+        @out.puts "Sandbox: off (c.sandbox = false)"
+        return
+      end
+      abi = sandbox_abi
+      if abi >= 3
+        @out.puts "Sandbox: kernel Landlock ABI #{abi} - capability probe only, not verified isolation"
+      elsif @config["sandbox"] == "strict"
+        @out.puts "Sandbox: #{Engine::SandboxPolicy.sandbox_gap(abi)}; " \
+                  'c.sandbox = "strict" refuses to run - children never run degraded'
+      else
+        @out.puts "Sandbox: #{Engine::SandboxPolicy.sandbox_gap(abi)}; " \
+                  "children would run with the hazard guard and canary only"
+      end
+    end
+
+    # The probe contract the engine's policy already keeps: an errored probe
+    # (EPERM under a seccomp policy, ...) is an actionable tool error, not a
+    # CLI internal error - doctor stays read-only.
+    def sandbox_abi
+      Execution::Sandbox.abi_version
+    rescue SystemCallError => e
+      raise Error, "sandbox is on but the Landlock probe failed (#{e.message}); a run would refuse the same way - " \
+                   "set c.sandbox = false to check without the sandbox"
+    end
+
     # Match against all included source definitions, not the current diff or
     # selected tests. A limited run must not make a valid ignore look stale.
     def check_ignore_subjects
@@ -105,11 +145,33 @@ module Saboteur
       @out.puts "Custom map: #{map.entries.size} entries (loaded)"
     end
 
+    # Prints the test database hosts the booted app reports, so a non-local
+    # refusal names the host here instead of only at target boot (issue #258).
+    def check_database_hosts
+      return unless @config["rails"]
+      return @out.puts("Databases: ActiveRecord did not load; host check skipped") unless defined?(::ActiveRecord::Base)
+
+      configs = ::ActiveRecord::Base.configurations.configs_for(env_name: "test")
+      configs.each do |db|
+        host = db.configuration_hash[:host]
+        @out.puts "Database: #{db.name} (host #{host.to_s.empty? ? 'local socket' : host})"
+      end
+      remote = Frameworks::Rails.remote_databases(configs, @config["allow_db_hosts"])
+      return if remote.empty?
+
+      raise ConfigError, "non-local test databases: #{remote.join(', ')}; if they are disposable test databases, " \
+                         "allow them with c.allow_db_hosts in #{Config::FILE}"
+    end
+
     def check_boot_files
       %w[require hooks].each do |key|
         @config[key].each do |file|
           path = File.expand_path(file, @config.root)
-          raise ConfigError, "#{key} file missing: #{file}; fix config/saboteur.rb" unless File.file?(path)
+          # Resolve the way Kernel#require does: the path as given, or with
+          # .rb appended (the Rails quickstart sets ./config/environment, issue #257).
+          unless File.file?(path) || File.file?("#{path}.rb")
+            raise ConfigError, "#{key} file missing: #{file}; fix config/saboteur.rb"
+          end
 
           @out.puts "#{key}: #{file} (found)"
         end

data/lib/saboteur/engine/baseline_guard.rb

@@ -3,6 +3,7 @@
 
 require "json"
 require "fileutils"
+require_relative "../text"
 
 module Saboteur
   class Engine
@@ -10,16 +11,28 @@ module Saboteur
     # or mutation source is used. This catches observed instability, not all
     # possible flaky behaviour.
     class BaselineGuard
+      # How many unchanged-suite checks actually completed and validated:
+      # the number of order comparisons a run can claim is one less.
+      attr_reader :completed_passes
+
       EXCERPT_LINES = 10
       EXCERPT_WIDTH = 200
       EXCERPT_SCAN_LINES = 5000
 
-      def initialize(config:, integration:, hooks:, supervisor:, diagnostics:)
+      # full_passes: every full-suite pass the run will make, including the
+      # coverage build when the cache is cold, so the first timed pass can
+      # price the rest (#260).
+      def initialize(config:, integration:, hooks:, supervisor:, diagnostics:, full_passes: 2, between_passes: nil,
+                     timeout_cap: nil)
         @config = config
         @integration = integration
         @hooks = hooks
         @supervisor = supervisor
         @diagnostics = diagnostics
+        @full_passes = full_passes
+        @between_passes = between_passes
+        @timeout_cap = timeout_cap
+        @completed_passes = 0
       end
 
       def call
@@ -27,11 +40,16 @@ module Saboteur
         raise Error, "baseline has no tests. Check rspec_args and the suite filters before running saboteur again." if
           expected.empty?
 
-        @diagnostics.inform("checking the unchanged suite twice (seed #{@config['seed']})")
+        passes = @config["baseline_passes"]
+        @diagnostics.inform(announce(passes))
         previous = nil
-        2.times do |index|
+        passes.times do |index|
+          break if budget_spent?(index)
+
           number = index + 1
+          started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
           data = check(number)
+          announce_first_pass_cost(number, started)
           unless data["passed"] && data["failed"].empty?
             refuse(number,
                    "the suite failed: #{Array(data['failed']).join(', ')}")
@@ -41,18 +59,73 @@ module Saboteur
             executed.sort == expected.sort
           refuse(number, "test order changed between baseline checks") if previous && executed != previous
           previous = executed
+          @completed_passes += 1
         end
         nil
       end
 
       private
 
+      # A spent --max-duration budget skips the remaining passes - including
+      # the first, when boot alone already spent it (#245).
+      def budget_spent?(_index)
+        !@between_passes.nil? && @between_passes.call
+      end
+
+      def announce(passes)
+        case passes
+        when 1
+          "checking the unchanged suite once (seed #{@config['seed']}); " \
+          "order stability between passes is not checked (baseline_passes: 1)"
+        when 2
+          "checking the unchanged suite twice (seed #{@config['seed']})"
+        else
+          "checking the unchanged suite #{passes} times (seed #{@config['seed']})"
+        end
+      end
+
+      # Once the first pass is timed, the total cost stops being a guess:
+      # the remaining full passes cost roughly the same each.
+      def announce_first_pass_cost(number, started)
+        return unless number == 1
+
+        remaining = @full_passes - number
+        return if remaining.zero?
+
+        elapsed = (Process.clock_gettime(Process::CLOCK_MONOTONIC) - started).round
+        @diagnostics.inform("baseline check #{number} took #{elapsed} s; about #{elapsed * remaining} s left for " \
+                            "the remaining #{remaining} full #{remaining == 1 ? 'pass' : 'passes'} at that rate")
+      end
+
+      # An admitted pass still gets only the time left in the run budget:
+      # without the cap it would overrun a spent --max-duration by its
+      # whole coverage_timeout.
+      def phase_timeout
+        @timeout_cap ? @timeout_cap.call(@config["coverage_timeout"]) : @config["coverage_timeout"]
+      end
+
+      # A pass that hit its deadline only because --max-duration shortened
+      # the admission below the configured phase timeout: the budget ended
+      # the run, the suite is not broken (#296).
+      def budget_stopped?(result, admitted)
+        result.stopped_by == :timeout && admitted < @config["coverage_timeout"]
+      end
+
+      def refuse_budget_stop(number, admitted)
+        raise BudgetPhaseTimeout, "the --max-duration budget stopped baseline check #{number} " \
+                                  "(admitted #{admitted.round(1)}s of the #{@config['coverage_timeout']}s " \
+                                  "phase timeout)"
+      end
+
       def check(number)
         Execution::ForkReadiness.prepare_heap
         heartbeat = @diagnostics.progress_heartbeat("baseline check #{number}").watch(log_path(number))
-        result = @supervisor.run(timeout: @config["coverage_timeout"], on_tick: heartbeat.method(:tick)) do |writer|
+        admitted = phase_timeout
+        result = @supervisor.run(timeout: admitted, on_tick: heartbeat.method(:tick),
+                                 label: "baseline child died during setup/run") do |writer|
           record(writer, number)
         end
+        refuse_budget_stop(number, admitted) if budget_stopped?(result, admitted)
         refuse(number, "the suite stopped: #{result.stopped_by} (#{result.detail})") if result.stopped_by
         # Before the payload checks: a child killed by a signal (the OOM
         # killer, say) writes nothing, and the signal is the explanation. A
@@ -129,7 +202,8 @@ module Saboteur
       end
 
       def log_lines(number)
-        File.foreach(log_path(number), chomp: true).first(EXCERPT_SCAN_LINES).reject { |line| line.strip.empty? }
+        File.foreach(log_path(number), chomp: true).first(EXCERPT_SCAN_LINES)
+            .map { |line| Text.utf8(line) }.reject { |line| line.strip.empty? }
       rescue SystemCallError
         []
       end

data/lib/saboteur/engine/boot.rb

@@ -83,10 +83,21 @@ module Saboteur
 
       def load_hooks
         Saboteur.current_hooks = @hooks
-        @config["hooks"].each { |file| load File.expand_path(file, @root) }
+        @config["hooks"].each { |file| load hook_path(file) }
       ensure
         Saboteur.current_hooks = nil
       end
+
+      # Kernel#load does not append .rb the way Kernel#require does, and
+      # doctor accepts the extensionless form (#257), so resolve it the same
+      # way here: the exact path first, then path.rb.
+      def hook_path(file)
+        path = File.expand_path(file, @root)
+        rb = "#{path}.rb"
+        return rb if !File.exist?(path) && File.extname(path).empty? && File.file?(rb)
+
+        path
+      end
     end
   end
 end