saboteur 0.5.0 → 0.7.0

data/lib/saboteur/engine/canary.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "open3"
+require_relative "../text"
 
 module Saboteur
   class Engine
@@ -15,7 +16,9 @@ module Saboteur
       GIT_DIR = ".git"
 
       def initialize(root, cache_dir: ".saboteur")
-        @root = root
+        # Retag losslessly: path bytes are identity here, and later
+        # File.join calls must not mix encodings.
+        @root = Text.utf8_identity(root.to_s)
         @cache_dir = cache_dir.to_s
         @snapshot = inventory
       end
@@ -29,16 +32,40 @@ module Saboteur
 
         of = " of #{subject.id}" if subject
         culprit = digest ? " The most recent mutant, #{digest}#{of}, is the likely cause." : ""
-        raise Saboteur::CanaryTripped,
-              "canary: #{missing.size} watched file(s) vanished from the working tree while mutants ran " \
-              "(first: #{missing.first}).#{culprit} The canary watches tracked files and .git presence " \
-              "and only detects the loss after the fact; it cannot restore anything. Recover from your " \
-              "own backup, a fresh checkout, or a reclone - a deleted .git or uncommitted work is gone " \
-              "unless you have another copy."
+        raise Saboteur::CanaryTripped, message(missing, culprit)
+      end
+
+      # The cheap per-mutant probe (#235): stats the snapshot paths only -
+      # no git, no glob - so it can run after every mutant.
+      def probe
+        @snapshot.reject { |rel| present?(rel) }
+      end
+
+      # Like check!, but for the per-mutant probe: the mutant whose run just
+      # ended is named, never the subject's most recent mutant.
+      def probe!(subject: nil, digest: nil)
+        missing = probe
+        return if missing.empty?
+
+        of = " of #{subject.id}" if subject
+        culprit = digest ? " The mutant that just ran, #{digest}#{of}, is the likely cause." : ""
+        raise Saboteur::CanaryTripped.new(message(missing, culprit), culprit_digest: digest)
       end
 
       private
 
+      def present?(rel)
+        File.exist?(File.join(@root, rel)) || File.symlink?(File.join(@root, rel))
+      end
+
+      def message(missing, culprit)
+        "canary: #{missing.size} watched file(s) vanished from the working tree while mutants ran " \
+          "(first: #{Text.utf8(missing.first)}).#{culprit} The canary watches tracked files and .git presence " \
+          "and only detects the loss after the fact; it cannot restore anything. Recover from your " \
+          "own backup, a fresh checkout, or a reclone - a deleted .git or uncommitted work is gone " \
+          "unless you have another copy."
+      end
+
       def inventory
         files = git? ? git_tracked_files : walk_files
         files << GIT_DIR if File.exist?(File.join(@root, GIT_DIR))
@@ -54,15 +81,19 @@ module Saboteur
         return walk_files unless status.success?
 
         # ls-files reads the index, which still names a deleted file; keep
-        # only paths present in the worktree so a deletion shows up.
-        out.split("\0").reject { |rel| cache_path?(rel) }
+        # only paths present in the worktree so a deletion shows up. Split
+        # the raw bytes first and retag each path losslessly: scrubbing a
+        # raw-byte name would make the File.exist? probe fail and drop the
+        # file from the watch, so its deletion would go unseen.
+        out.b.split("\0".b).map { |rel| Text.utf8_identity(rel) }
+           .reject { |rel| cache_path?(rel) }
            .select { |rel| File.exist?(File.join(@root, rel)) || File.symlink?(File.join(@root, rel)) }
       end
 
       def walk_files
         Dir.glob(File.join(@root, "**", "*"), File::FNM_DOTMATCH)
            .select { |path| File.file?(path) }
-           .map { |path| path.delete_prefix("#{@root}/") }
+           .map { |path| Text.utf8_identity(path).delete_prefix("#{@root}/") }
            .reject { |rel| rel.start_with?("#{GIT_DIR}/") || cache_path?(rel) }
       end
 

data/lib/saboteur/engine/candidate_selection.rb

@@ -6,7 +6,7 @@ module Saboteur
     # Selects a bounded list for each covered subject before workers fork.
     # Subject skips are not mutants and do not enter the mutation score.
     class CandidateSelection
-      attr_reader :skipped_subjects, :selected
+      attr_reader :skipped_subjects, :selected, :unscoped_digests
 
       def initialize(candidates:, map:, limit:, diagnostics:)
         @candidates = candidates
@@ -15,6 +15,7 @@ module Saboteur
         @diagnostics = diagnostics
         @skipped_subjects = {}
         @selected = {}
+        @unscoped_digests = {}
       end
 
       def for(subject, scope: nil)
@@ -25,6 +26,13 @@ module Saboteur
         end
 
         list = @candidates.for(subject)
+        # The full pre-scope digests let IgnoreList#apply tell "mutation gone"
+        # from "mutation scoped out of this run" (#284).
+        if scope
+          @unscoped_digests[subject.id] = list.map do |mutation, _|
+            mutation.digest(subject_start: subject.start_byte, original_source: subject.file_source)
+          end
+        end
         list = scope.restrict(subject, list) if scope
         omitted = list.size - @limit
         if omitted.positive?

data/lib/saboteur/engine/candidates.rb

@@ -13,7 +13,10 @@ module Saboteur
       def self.build_sources(config)
         root = File.realpath(config.root)
         config["sources"].map do |entry|
-          next MutationSource::Builtin.new(arid: config["arid"], operators: config["operators"]) if entry == "builtin"
+          if entry == "builtin"
+            next MutationSource::Builtin.new(arid: config["arid"], operators: config["operators"],
+                                             exclude_operators: config["exclude_operators"])
+          end
 
           file, const = entry.split(":", 2)
           raise ConfigError, "mutation source #{entry.inspect} must be builtin or path.rb:ClassName" unless const

data/lib/saboteur/engine/coverage_guard.rb

@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+module Saboteur
+  class Engine
+    # Owns the host process's Coverage state across a run: suspends after
+    # boot, and at the end resumes only its own suspension. A CLI process
+    # exits right after, so resume matters to hosts that embed the engine -
+    # a spec, or the dogfood's own coverage-map build (#254).
+    class CoverageGuard
+      def initialize(diagnostics)
+        @diagnostics = diagnostics
+      end
+
+      def suspend
+        @was_running = Coverage.state == :running
+        Coverage.suspend if @was_running
+      end
+
+      # Best-effort: a host that disturbed Coverage mid-run gets a warning,
+      # never a masked run outcome.
+      def resume
+        Coverage.resume if @was_running && Coverage.state == :suspended
+      rescue StandardError => e
+        @diagnostics.warn("coverage resume failed: #{e.class}: #{e.message}")
+      end
+    end
+  end
+end

data/lib/saboteur/engine/coverage_store.rb

@@ -15,19 +15,29 @@ module Saboteur
       LOCKFILES = %w[Gemfile.lock gems.locked].freeze
       LOG = "coverage-build.log"
 
-      def initialize(config:, integration:, hooks:, supervisor:, diagnostics:, load_lines: {})
+      def initialize(config:, integration:, hooks:, supervisor:, diagnostics:, load_lines: {}, timeout_cap: nil)
         @config = config
         @integration = integration
         @hooks = hooks
         @supervisor = supervisor
         @diagnostics = diagnostics
+        @timeout_cap = timeout_cap
         @load_lines = load_lines
         @root = File.realpath(config.root)
       end
 
+      # True when fetch would reuse the cached map instead of running the
+      # suite pass that builds it: lets the run announce the real number of
+      # full passes up front (#260). Loads the map with the same validation
+      # fetch uses and retains it, so a corrupt or truncated cache announces
+      # a build pass, not a reuse it cannot keep.
+      def reusable?(files)
+        !cached_map(files).nil?
+      end
+
       def fetch(files)
-        path = File.join(@config.path("cache_dir"), "coverage-#{cache_key(files)}.json")
-        cached = @config["cache"] ? Selection::CoverageMap.load(path) : nil
+        path = cache_path(files)
+        cached = cached_map(files)
         return refuse_empty_map(cached, files) if cached
 
         map = refuse_empty_map(build(files), files)
@@ -39,6 +49,16 @@ module Saboteur
 
       private
 
+      def cache_path(files)
+        File.join(@config.path("cache_dir"), "coverage-#{cache_key(files)}.json")
+      end
+
+      def cached_map(files)
+        return nil unless @config["cache"]
+
+        @cached_map ||= Selection::CoverageMap.load(cache_path(files))
+      end
+
       def cache_key(files)
         inputs = JSON.generate(CACHE_INPUTS.to_h { |key| [key, @config[key]] })
         all = files + @integration.test_files + SuiteFiles.new(@config).files + lockfiles
@@ -49,6 +69,12 @@ module Saboteur
         LOCKFILES.map { |file| File.join(@root, file) }.select { |file| File.file?(file) }
       end
 
+      # An admitted build still gets only the time left in the run budget
+      # (see BaselineGuard#phase_timeout).
+      def build_timeout
+        @timeout_cap ? @timeout_cap.call(@config["coverage_timeout"]) : @config["coverage_timeout"]
+      end
+
       def build(files)
         unless Coverage.respond_to?(:state) && Coverage.state == :suspended
           raise Error, "Coverage is #{Coverage.state}; saboteur must set it up before the app loads. " \
@@ -61,13 +87,16 @@ module Saboteur
         # reduce later copying of shared pages.
         Execution::ForkReadiness.prepare_heap
         heartbeat = @diagnostics.progress_heartbeat("building coverage map").watch(log_path)
-        result = @supervisor.run(timeout: @config["coverage_timeout"], on_tick: heartbeat.method(:tick)) do |writer|
+        admitted = build_timeout
+        result = @supervisor.run(timeout: admitted, on_tick: heartbeat.method(:tick),
+                                 label: "coverage child died during the map build") do |writer|
           record(writer, files)
         end
-        map_from(result)
+        map_from(result, admitted)
       end
 
-      def map_from(result)
+      def map_from(result, admitted = @config["coverage_timeout"])
+        raise_budget_stop(admitted) if budget_stopped?(result, admitted)
         raise Error, "coverage map build stopped: #{result.detail}" if result.stopped_by
         raise Error, "coverage map build failed: #{died(result.exit_status)}" if result.payload.empty?
 
@@ -77,6 +106,19 @@ module Saboteur
         with_parent_load_lines(Selection::CoverageMap.from_json(result.payload))
       end
 
+      # A build that hit its deadline only because --max-duration shortened
+      # the admission below the configured phase timeout: the budget ended
+      # the run, the suite is not broken (see BaselineGuard#budget_stopped?).
+      def budget_stopped?(result, admitted)
+        result.stopped_by == :timeout && admitted < @config["coverage_timeout"]
+      end
+
+      def raise_budget_stop(admitted)
+        raise BudgetPhaseTimeout, "the --max-duration budget stopped the coverage map build " \
+                                  "(admitted #{admitted.round(1)}s of the #{@config['coverage_timeout']}s " \
+                                  "phase timeout)"
+      end
+
       # The parent's load lines merge into the freshly built map: the forked
       # build child cannot inherit the parent's Coverage counters.
       def with_parent_load_lines(map)

data/lib/saboteur/engine/diagnostics.rb

@@ -76,8 +76,9 @@ module Saboteur
       attr_reader :warnings, :invalid_mutations, :generation_events, :omissions, :discovery_failures,
                   :hazard_suppressions, :inline_suppressions
 
-      def initialize(err)
+      def initialize(err, verbose: false)
         @err = err
+        @verbose = verbose
         @warnings = []
         @invalid_mutations = 0
         @generation_events = []
@@ -102,8 +103,11 @@ module Saboteur
         @generation_events << GenerationEvent.new(*values)
       end
 
+      # The selection and the test inference each walk the same changed
+      # files in one run; a failure either of them finds is recorded once.
       def record_discovery_failure(file, reason:)
-        @discovery_failures << DiscoveryFailure.new(file: file.to_s.dup.freeze, reason: reason.to_s.dup.freeze)
+        failure = DiscoveryFailure.new(file: file.to_s.dup.freeze, reason: reason.to_s.dup.freeze)
+        @discovery_failures << failure unless @discovery_failures.include?(failure)
       end
 
       # A mutant the hazard guard refused to generate (issue #102): counted
@@ -129,6 +133,23 @@ module Saboteur
         @err.puts("saboteur: #{message}")
       end
 
+      # --verbose: one line per finished subject with its result marks, so a
+      # survivor is attributable to a method as soon as the subject
+      # completes, before the whole run ends (#262).
+      def subject_progress(subject, results)
+        return unless @verbose
+        return if results.empty?
+
+        marks = results.map { |result| MARKS.fetch(result.status, "?") }.join
+        inform("#{subject.id}  #{marks}")
+      end
+
+      # A message that is both a report warning and a stderr note.
+      def announce(message)
+        warn(message)
+        inform(message)
+      end
+
       # A heartbeat for a long phase: the supervisor's wait loop calls tick
       # in the parent after the fork, so no extra thread is ever alive at
       # fork time. Prints "<label>: N s elapsed" about every interval

data/lib/saboteur/engine/diff_scope.rb

@@ -1,6 +1,8 @@
 # SPDX-License-Identifier: MIT
 # frozen_string_literal: true
 
+require_relative "../text"
+
 module Saboteur
   class Engine
     # Review-shaped diff mode (--since). A reviewer asks "do the tests check
@@ -14,7 +16,7 @@ module Saboteur
       end
 
       def restrict(subject, candidates)
-        changed = @changed_lines.fetch(subject.file, Set.new)
+        changed = lines_for(subject)
         candidates.select do |mutation, _|
           mutation.coarse || mutation.edits.any? { |edit| edited_lines(subject, edit).any? { changed.include?(_1) } }
         end
@@ -24,22 +26,39 @@ module Saboteur
       # several lines is mutated as one piece and reported at its first line,
       # which can sit above the line that changed; this names the changed line.
       def changed_lines_for(subject, mutation)
-        changed = @changed_lines.fetch(subject.file, Set.new)
+        changed = lines_for(subject)
         mutation.edits.flat_map { |edit| edited_lines(subject, edit).to_a }.uniq.select { changed.include?(_1) }.sort
       end
 
       # Distance to the nearest changed line in this file. Unknown outside
-      # the diff is nil, not a made-up nearby location.
+      # the diff is nil, not a made-up nearby location. A range answers
+      # geometrically - 0 when the edit overlaps, else the gap to the nearer
+      # endpoint - so a whole-file range never materializes one entry per
+      # line.
       def distance_for(subject, mutation)
-        changed = @changed_lines.fetch(subject.file, Set.new)
+        changed = lines_for(subject)
         mutation.edits.map do |edit|
           first, last = edited_lines(subject, edit).minmax
-          changed.map { |line| (line - line.clamp(first, last)).abs }.min
+          if changed.is_a?(Range)
+            if last < changed.begin then changed.begin - last
+            elsif first > changed.end then first - changed.end
+            else 0
+            end
+          else
+            changed.map { |line| (line - line.clamp(first, last)).abs }.min
+          end
         end.min
       end
 
       private
 
+      # subject.file carries the locale tag under a non-UTF-8 locale
+      # while the map keys are UTF-8; retag losslessly or a non-ASCII
+      # path never matches and every fine mutant is silently dropped.
+      def lines_for(subject)
+        @changed_lines.fetch(Text.utf8_identity(subject.file), Set.new)
+      end
+
       def edited_lines(subject, edit)
         first = subject.line_of(edit.start_byte)
         last = subject.line_of([edit.end_byte - 1, edit.start_byte].max)

data/lib/saboteur/engine/distribution.rb

@@ -9,23 +9,31 @@ module Saboteur
     # candidate list, so results look the same either way.
     class Distribution
       # After run: the subjects a stop_after callable left unrun (always empty
-      # without one).
-      attr_reader :unreached
+      # without one), and the subjects that started but stopped mid-list as
+      # [subject, omitted_candidate_count] pairs (a spent --max-duration
+      # breaking a subject's scheduler loop). unverified lists the subjects
+      # whose fresh kills the spent budget left unchecked (#296).
+      attr_reader :unreached, :truncated, :unverified
 
       # stop_after: nil, or a callable that gets one subject's results and
       # returns true to stop before the next subject (--fail-fast). It only
       # works on one process: parallel workers have already started the
       # other subjects.
       def initialize(jobs:, scheduler:, diagnostics:, cache:, on_start: nil, after_subject: nil,
-                     stop_after: nil)
+                     stop_after: nil, halt_check: nil,
+                     drain_timeout: 30) # seconds; two minimum-strength mutant deadlines at default settings
         @jobs = jobs
         @stop_after = stop_after
+        @halt_check = halt_check
         @unreached = []
+        @truncated = []
+        @unverified = []
         @on_start = on_start
         @scheduler = scheduler
         @diagnostics = diagnostics
         @cache = cache
         @after_subject = after_subject
+        @drain_timeout = drain_timeout
       end
 
       # lists: each subject's [[mutation, text]] candidates, in subject order.
@@ -35,23 +43,116 @@ module Saboteur
         # The watcher runs as each subject's row arrives, before the pool
         # hands out more work, so a tripped canary stops the queue (jobs>1
         # used to check only after the whole batch returned, issue #102).
-        arrival = lambda do |i, row|
-          @after_subject&.call(subjects[i], decode(row, subjects[i], lists[i]))
+        # A tool error no longer raises on sight: one wiped log dir hits
+        # every worker, and a bystander whose current job ran no mutant
+        # reports "an unknown mutant", which could land before the report
+        # of the worker whose mutant did the damage (macOS CI on #285).
+        # The pool is halted instead - no new work, and the drain is
+        # bounded by drain_timeout so a wedged worker cannot stall the
+        # abort - and the abort raises the report with the best
+        # attribution.
+        # The abort reports and the pool are run state: a Distribution
+        # runs once. @pool is only read from arrivals, which fire inside
+        # @pool.map after the assignment.
+        # A budget already spent by boot, baselines or the coverage map
+        # launches nothing: every subject comes back unreached (#245).
+        if @halt_check&.call
+          @unreached = subjects
+          return []
         end
-        pool = Execution::WorkerPool.new(jobs: @jobs, on_start: @on_start, on_result: arrival)
-        rows = pool.map(subjects.each_index.to_a, weights: lists.map(&:size)) do |i|
+
+        @abort_reports = []
+        arrival = arrival_for(subjects, lists)
+        @pool = Execution::WorkerPool.new(jobs: @jobs, on_start: @on_start, on_result: arrival,
+                                          drain_timeout: @drain_timeout)
+        rows = @pool.map(subjects.each_index.to_a, weights: lists.map(&:size)) do |i|
           work(subjects[i], lists[i])
         end
-        rows.each_with_index.flat_map { |row, i| rebuild(row, subjects[i], lists[i]) }
+        raise_preferred_tool_error(@abort_reports) if @abort_reports.any?
+        record_unreached(rows, subjects, lists)
+        rows.each_with_index.flat_map do |row, i|
+          next [] if row.nil?
+
+          raise_if_tool_error(row)
+          rebuild(row, subjects[i], lists[i])
+        end
       end
 
       private
 
+      # @pool is only read here from arrivals, which fire inside @pool.map
+      # after the assignment. A spent --max-duration budget stops the queue
+      # without the safety-abort drain: in-flight subjects finish and
+      # report, and only never-started ones come back as nil holes, so
+      # unreached never mislabels an interrupted subject as unrun (#245).
+      def arrival_for(subjects, lists)
+        lambda do |i, row|
+          if row["tool_error"]
+            collect_abort_report(row)
+          else
+            check_subject(subjects, lists, i, row)
+            @pool.halt!(drain: false) if @halt_check&.call
+          end
+        end
+      end
+
+      # nil rows never started; a short results list is a subject whose
+      # scheduler stopped mid-list at the budget deadline. Worker-level error
+      # rows synthesize an error per candidate, so they never look truncated.
+      def unverified_result?(result)
+        result.is_a?(MutantResult) && result.status == :unverified
+      end
+
+      def record_unreached(rows, subjects, lists)
+        @unreached = []
+        @truncated = []
+        @unverified = []
+        rows.each_with_index do |row, i|
+          if row.nil?
+            @unreached << subjects[i]
+            next
+          end
+          next unless row["results"] && !row["error"]
+
+          @truncated << [subjects[i], lists[i].size - row["results"].size] if row["results"].size < lists[i].size
+          @unverified << subjects[i] if row["results"].any? { |result| result["status"] == "unverified" }
+        end
+      end
+
+      # @pool is always assigned when an arrival fires: arrivals only fire
+      # from inside @pool.map, which runs after the assignment.
+      def collect_abort_report(row)
+        @abort_reports << row
+        @pool.halt!
+      end
+
+      # A canary trip from the end-of-subject check folds into the same
+      # record + halt + preferred-report path as a worker's own report:
+      # escaping the pool here would override a collected report that
+      # names the real culprit (#285 review).
+      def check_subject(subjects, lists, index, row)
+        @after_subject&.call(subjects[index], decode(row, subjects[index], lists[index]))
+      rescue Error => e
+        collect_abort_report(Execution::WorkerPool.tool_error_row(e))
+      end
+
       def run_serially(subjects, lists)
         results = []
         subjects.zip(lists).each_with_index do |(subject, list), index|
+          # Same pre-dispatch budget check as the parallel first wave: an
+          # already-spent baseline starts no further subjects (#245).
+          if @halt_check&.call
+            @unreached = subjects.drop(index)
+            break
+          end
+
           subject_results = @scheduler.call(subject, list)
           results.concat(subject_results)
+          # A scheduler that stopped mid-list at the budget deadline: the
+          # completed results stay, the omitted candidates are accounted.
+          omitted = list.size - subject_results.size
+          @truncated << [subject, omitted] if omitted.positive?
+          @unverified << subject if subject_results.any? { |result| unverified_result?(result) }
           @after_subject&.call(subject, subject_results)
           next unless @stop_after&.call(subject_results)
 
@@ -91,6 +192,21 @@ module Saboteur
 
       # Turns a worker row back into results, without diagnostics or caching:
       # used both at result arrival (the canary) and at rebuild time.
+      # A tool error from the worker (a vanished cache dir, ...) aborts
+      # the whole run with exit 3; it is not a per-mutant outcome (#283).
+      def raise_if_tool_error(row)
+        raise Error, row["tool_error"] if row["tool_error"]
+      end
+
+      # The abort names a culprit when any report can, ranked by
+      # attribution quality (#285 review): a report carrying its mutant's
+      # per-mutant digest first, then a canary trip (the hazard report
+      # still beats a bare report, #283), then the first bare report.
+      def raise_preferred_tool_error(rows)
+        row = rows.find { |r| r["culprit"] } || rows.find { |r| r["canary"] } || rows.first
+        raise Error, row["tool_error"]
+      end
+
       def decode(row, subject, list)
         return failed(row["error"], subject, list) if row["error"]
 

data/lib/saboteur/engine/early_stop_recording.rb

@@ -0,0 +1,46 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+module Saboteur
+  class Engine
+    # Records the subjects an early stop left behind - whole subjects that
+    # never started and candidates skipped mid-way through a subject - so
+    # the report says the verdict covers less than the selection.
+    module EarlyStopRecording
+      private
+
+      # The subjects a stop left unrun or mid-way: the verdict covers less than the selection.
+      def record_early_stop(distribution)
+        return if distribution.unreached.empty? && distribution.truncated.empty? && distribution.unverified.empty?
+
+        truncated = distribution.truncated.map { |subject, omitted| { subject: subject.id, omitted: omitted } }
+        @early_stop = EarlyStop.new(reason: stop_reason(distribution), unreached: distribution.unreached.map(&:id),
+                                    truncated: truncated, unverified: distribution.unverified.map(&:id))
+      end
+
+      # Mid-subject omissions and skipped checks are budget work: only a
+      # stop that left whole subjects unreached can be fail_fast's.
+      def stop_reason(distribution)
+        return "max_duration" if distribution.truncated.any? || distribution.unverified.any?
+
+        run_early_stop_reason
+      end
+
+      # max_duration was announced before fail_fast could stop the run: a
+      # budget stop overrides a failure stop announced later.
+      def run_early_stop_reason
+        @budget_announced ? "max_duration" : "fail_fast"
+      end
+
+      # A baseline or coverage phase stopped because --max-duration ate its
+      # allowance: budget exhaustion, not a broken suite. The run reports
+      # partial with every selected subject unreached (exit 4) (#296).
+      def budget_phase_stop(error, subjects)
+        @diagnostics.warn(error.message)
+        @early_stop = EarlyStop.new(reason: "max_duration", unreached: subjects.map(&:id), truncated: [],
+                                    unverified: [])
+        []
+      end
+    end
+  end
+end

data/lib/saboteur/engine/result_cache.rb

@@ -4,6 +4,7 @@
 require "digest"
 require "fileutils"
 require "json"
+require_relative "../text"
 
 module Saboteur
   class Engine
@@ -65,7 +66,7 @@ module Saboteur
       private
 
       def load
-        data = JSON.parse(File.read(@path))
+        data = JSON.parse(Text.utf8_strict(File.read(@path)))
         data["format"] == FORMAT ? data["entries"] : {}
       rescue SystemCallError, JSON::ParserError
         {}