saboteur 0.8.0 → 0.8.1

data/lib/saboteur/engine/subject_selection.rb

@@ -4,12 +4,39 @@
 require_relative "../text"
 require_relative "../constant_subject"
 require_relative "../constant_subject_finder"
+require_relative "../attribute_finder"
 require_relative "../constant_reads"
 
 module Saboteur
   class Engine
     # The subjects to mutate: every def in the included files, narrowed by
     # --subject patterns and by --since (methods with a changed line).
+    # A heredoc body is code the static subject walk cannot see: methods
+    # defined by class_eval'ing the string, or behavior living in a
+    # template constant, exist only when the string is evaluated (#467).
+    module HeredocSpans
+      module_function
+
+      def changed_lines_inside?(file, changed_lines)
+        result = Prism.parse(File.binread(file))
+        return false if result.failure?
+
+        spans = collect(result.value)
+        changed_lines.any? { |line| spans.any? { |span| span.cover?(line) } }
+      end
+
+      def collect(node, spans = [])
+        if (node.is_a?(Prism::StringNode) || node.is_a?(Prism::InterpolatedStringNode)) &&
+           node.opening_loc&.slice&.start_with?("<<")
+          # The node location of an interpolated string stops at the opening
+          # marker; opening through closing covers the whole heredoc body.
+          spans << (node.opening_loc.start_line..node.closing_loc.end_line)
+        end
+        node.compact_child_nodes.each { |child| collect(child, spans) }
+        spans
+      end
+    end
+
     class SubjectSelection
       # Lines changed since the --since ref, by file; nil without --since.
       attr_reader :changed_lines
@@ -33,12 +60,36 @@ module Saboteur
           subjects += constant_subjects
         end
         @discovered = subjects
+        warn_unmatched_whole_file(subjects) if @config["since"]
         subjects = by_pattern(subjects, @config["subjects"]) if @config["subjects"].any?
         subjects = by_change(subjects, @config["since"]) if @config["since"]
         subjects = drop_intentionally_untested(subjects)
+        inform_nothing_to_test(subjects)
         attach_consumers(subjects)
       end
 
+      # A --since run can legitimately select nothing: the range is empty
+      # (a checkout AT the base, #643) or its changes carry no mutable Ruby
+      # (a docs-only diff, #659). Exit 0 with a notice, not a silent green:
+      # name the base, the changed-file count and why nothing was selected.
+      def inform_nothing_to_test(subjects)
+        ref = @config["since"]
+        return unless ref && subjects.empty?
+
+        changed = Selection::GitDiff.changed_paths(ref, root: @root)
+        count = changed[:present].size + changed[:deleted].size
+        reason = if count.zero?
+                   "the resolved range has no changes"
+                 elsif !@raw_changed_files.intersect?(@files)
+                   "#{count} changed file#{'s' unless count == 1}, none in mutation scope " \
+                     "(docs-only, excluded, or non-Ruby)"
+                 else
+                   "no subject covers the changed lines (layout-only edits, deletions, " \
+                     "or intentionally untested code)"
+                 end
+        @diagnostics.inform("--since #{ref}: nothing to test - #{reason}")
+      end
+
       # "Klass#meth", "Klass.meth", or a namespace prefix ("Klass", "A::B").
       def self.match?(id, pattern)
         id == pattern || %w[# . ::].any? { |separator| id.start_with?("#{pattern}#{separator}") }
@@ -96,16 +147,12 @@ module Saboteur
           subjects.any? { |subject| self.class.match?(subject.id, pattern) }
         end
         missed.each do |pattern|
-          @diagnostics.warn("--subject #{pattern} matches no subject (patterns are names like " \
-                            "Klass, Klass#meth or Klass.meth, not globs)")
+          @diagnostics.warn(missed_pattern_message(pattern))
         end
         # A total miss is a typo: refuse instead of a green zero-subject
         # summary (#379). A partial miss runs, but the matched count is
         # on the record.
-        if missed.size == patterns.size
-          raise ConfigError, "--subject #{patterns.join(', ')} matches no subject (patterns are names like " \
-                             "Klass, Klass#meth or Klass.meth, not globs)"
-        end
+        raise ConfigError, total_miss_message(missed) if missed.size == patterns.size
 
         if missed.any?
           @diagnostics.warn("#{patterns.size - missed.size} of #{patterns.size} --subject patterns matched")
@@ -113,6 +160,37 @@ module Saboteur
         subjects.select { |subject| patterns.any? { |pattern| self.class.match?(subject.id, pattern) } }
       end
 
+      # The refusal when every pattern missed (#379). A pattern naming an
+      # attribute-macro method gets the real reason - the method exists but
+      # has no body to mutate (#373) - instead of the pattern-format hint.
+      def total_miss_message(missed)
+        if missed.all? { |pattern| attribute_macro_for(pattern) }
+          return missed.map { |pattern| missed_pattern_message(pattern) }.join("; ")
+        end
+
+        "--subject #{missed.join(', ')} matches no subject (patterns are names like " \
+          "Klass, Klass#meth or Klass.meth, not globs)"
+      end
+
+      # Why one missed pattern matched nothing: when it names a method an
+      # attribute macro generated, say so (#373); otherwise the pattern
+      # itself is suspect.
+      def missed_pattern_message(pattern)
+        macro = attribute_macro_for(pattern)
+        return "--subject #{pattern} is defined by #{macro} and has no body to mutate" if macro
+
+        "--subject #{pattern} matches no subject (patterns are names like " \
+          "Klass, Klass#meth or Klass.meth, not globs)"
+      end
+
+      # The attribute macro that generated the method a pattern names, if
+      # any. The files are parsed for macros once, only when a pattern
+      # missed.
+      def attribute_macro_for(pattern)
+        attributes = @attributes ||= @files.flat_map { |file| AttributeFinder.new.call(file) }
+        attributes.find { |found| found.id == pattern }&.macro
+      end
+
       def by_change(subjects, ref)
         changed = changed_subjects(subjects)
         warn_changed_files_without_subjects
@@ -193,7 +271,8 @@ module Saboteur
         @diagnostics.warn("--since: constant subject(s) in #{path} are not mutated: the file runs code at " \
                           "load (#{listed}) that every constant mutant would run again, and saboteur " \
                           "cannot vet what re-running it does. List the constant in c.whole_file to " \
-                          "replay the file anyway, or move the literal into its own file.")
+                          "replay the file anyway, or move the literal into its own file. " \
+                          "#{whole_file_id_hint(rest)}")
         opted_in
       end
 
@@ -203,6 +282,32 @@ module Saboteur
         Array(@config["whole_file"]).any? { |pattern| File.fnmatch?(pattern.to_s, subject.id) }
       end
 
+      # A bare constant name only ever matches a top-level constant's id -
+      # never a nested one - so name the exact ids to copy into c.whole_file.
+      # The glob example carries its blast radius: it opts in every matching
+      # subject project-wide, so the exact id(s) are the safer pick (#635).
+      def whole_file_id_hint(subjects)
+        ids = subjects.map(&:id)
+        named = ids.first(3).map { |id| "\"#{id}\"" }.join(", ")
+        named += ", +#{ids.size - 3} more" if ids.size > 3
+        "Exact id(s): #{named} (preferred); a glob like \"*#{ids.first.split('::').last}*\" also " \
+          "works but opts in every matching subject project-wide."
+      end
+
+      # A whole_file pattern that matches nothing silently does nothing (#635):
+      # name the pattern and what subject ids look like, so a bare constant
+      # name for a nested constant (which never matches its qualified id)
+      # stands out. Scoped to this run: a pattern for a file outside the
+      # current include set also matches nothing.
+      def warn_unmatched_whole_file(subjects)
+        @config["whole_file"].each do |pattern|
+          next if subjects.any? { |subject| File.fnmatch?(pattern.to_s, subject.id) }
+
+          @diagnostics.warn("--since: whole_file pattern \"#{pattern}\" matches no discovered " \
+                            "subject in this run; subject ids look like RULES, A::B::C or A::B#m")
+        end
+      end
+
       def warn_unsupported_constant(found)
         path = found.file.delete_prefix("#{@root}/")
         @diagnostics.warn("--since: changed constant #{found.id} in #{path} is not mutated: #{found.reason}. " \
@@ -325,30 +430,9 @@ module Saboteur
           "strings are not mutation subjects, so this run cannot see that behavior."
       end
 
-      # A heredoc body is code the static subject walk cannot see: methods
-      # defined by class_eval'ing the string, or behavior living in a
-      # template constant, exist only when the string is evaluated (#467).
-      # Changed lines inside one deserve the specific warning, not the
-      # generic parse/method guess. A file that does not parse keeps the
-      # generic hint: its problem is named there already.
-      def changed_lines_inside_heredoc?(file)
-        result = Prism.parse(File.binread(file))
-        return false if result.failure?
-
-        spans = heredoc_spans(result.value)
-        @changed_lines[file].any? { |line| spans.any? { |span| span.cover?(line) } }
-      end
-
-      def heredoc_spans(node, spans = [])
-        if (node.is_a?(Prism::StringNode) || node.is_a?(Prism::InterpolatedStringNode)) &&
-           node.opening_loc&.slice&.start_with?("<<")
-          # The node location of an interpolated string stops at the opening
-          # marker; opening through closing covers the whole heredoc body.
-          spans << (node.opening_loc.start_line..node.closing_loc.end_line)
-        end
-        node.compact_child_nodes.each { |child| heredoc_spans(child, spans) }
-        spans
-      end
+      # Changed lines inside a heredoc deserve the specific warning, not the
+      # generic parse/method guess (#467); the scan lives in HeredocSpans.
+      def changed_lines_inside_heredoc?(file) = HeredocSpans.changed_lines_inside?(file, @changed_lines[file])
 
       # A changed Ruby file that an include pattern covers but c.exclude
       # removes yields zero candidates with no other sign - this repo's own

data/lib/saboteur/engine/test_guess.rb

@@ -16,6 +16,38 @@ module Saboteur
     # subject need a guessed spec; without --since, every included file with
     # a mutation subject needs one. A file that needs a spec and has none
     # stops the run before boot.
+    # A project with no *_spec.rb anywhere under its root has no RSpec suite
+    # at all: a per-file stop would print one line per
+    # source file and bury the real problem (#606, sibling of the
+    # missing-rspec-core refusal #542). The stop is one line naming it, with
+    # a Minitest pointer when test/ exists; --verbose keeps the per-file list.
+    module NoSuiteStop
+      MINITEST = "no RSpec suite found - saboteur needs RSpec; " \
+                 "this project appears to use Minitest (test/), see docs/minitest.md"
+      PLAIN = "no RSpec suite found - saboteur needs RSpec; no spec file exists to run, see docs/minitest.md"
+
+      module_function
+
+      # nil when the run should not claim a missing suite: a --subject run
+      # already names its expected spec, nothing is unmatched, or a suite
+      # exists. The suite can live outside spec/ - rspec_args can point
+      # RSpec at another default path - so look under the whole root;
+      # claiming "no spec file exists" for such a project is false and
+      # drops the --test/--all remedy (#606). :minitest or :plain otherwise.
+      def layout(root, unmatched, subject_run)
+        return if subject_run || unmatched.empty?
+
+        return unless Dir.glob(File.join(root, "**", "*_spec.rb")).empty?
+
+        File.directory?(File.join(root, "test")) ? :minitest : :plain
+      end
+
+      def message(layout, pairs:, verbose: false)
+        line = layout == :minitest ? MINITEST : PLAIN
+        verbose ? "#{line} Files without a guessed spec: #{pairs.join(', ')}." : line
+      end
+    end
+
     class TestGuess
       # hints: unmatched file -> its conventional spec path (which does
       # not exist; that is why the file is unmatched), for the stop-before-boot
@@ -25,8 +57,9 @@ module Saboteur
       # in specs; skipped_specs: spec files the diff touches that cannot run,
       # each with the reason.
       Result = Data.define(:specs, :unmatched, :subjectless, :changed, :hints, :changed_specs,
-                           :skipped_specs, :out_of_scope, :excluded, :near) do
-        def initialize(changed_specs: [], skipped_specs: {}, out_of_scope: [], excluded: [], near: {}, **fields)
+                           :skipped_specs, :out_of_scope, :excluded, :near, :no_suite) do
+        def initialize(changed_specs: [], skipped_specs: {}, out_of_scope: [], excluded: [], near: {},
+                       no_suite: nil, **fields)
           super
         end
 
@@ -35,7 +68,11 @@ module Saboteur
         # command, which could carry a hostile ref or a wrong source scope.
         # When the diff deleted the expected spec or added others, it says
         # so: a renamed spec is the usual cause.
-        def unmatched_message
+        def unmatched_message(verbose: false)
+          if no_suite
+            return NoSuiteStop.message(no_suite, pairs: unmatched.map { |f| pair_description(f) }, verbose: verbose)
+          end
+
           pairs = unmatched.map { |file| pair_description(file) }
           changed = changed_specs.any? ? " Specs the diff adds or changes: #{changed_specs.join(', ')}." : ""
           "no spec found for #{pairs.join(', ')}, so nothing ran.#{changed} Re-run the same command with " \
@@ -148,7 +185,9 @@ module Saboteur
       def call_for(files, patterns = [])
         files = effective_subject_files(files, patterns) if @config["since"]
         guesses = files.to_h { |file| [file, guess_for(file)] }
-        result(guesses, [], files.size)
+        # A --subject run already knows its suite: the stop names the one
+        # expected spec, never the no-suite line (#606 is the full-run flood).
+        result(guesses, [], files.size, subject_run: true)
       end
 
       # specs: existing spec files (relative paths) guessed for the files in
@@ -211,7 +250,7 @@ module Saboteur
 
       # Changed specs join only a run that mutates something: with no file
       # in scope there is nothing for them to kill.
-      def result(guesses, subjectless, changed, out_of_scope: [])
+      def result(guesses, subjectless, changed, out_of_scope: [], subject_run: false)
         unmatched = guesses.select { |_, specs| specs.nil? }.keys
         excluded = guesses.select { |_, specs| specs == :excluded }.keys.sort
         inferred = guesses.values.grep(Array).flatten
@@ -226,7 +265,8 @@ module Saboteur
                    changed_specs: diff[:run],
                    skipped_specs: diff[:skipped],
                    out_of_scope: out_of_scope,
-                   excluded: excluded)
+                   excluded: excluded,
+                   no_suite: NoSuiteStop.layout(@root, unmatched, subject_run))
       end
 
       # Changed Ruby files the include scope hides (#483), relative to the
@@ -303,13 +343,17 @@ module Saboteur
       # --test without hunting (#370). Bounded; computed only for
       # unmatched files, which are about to stop or warn.
       def nearby_specs(file)
-        # The basename is data, not a pattern: [, ], {, }, ?, * and \ are
-        # glob metacharacters and must be escaped to match literally.
-        basename = File.basename(file, ".rb").gsub(/[\[\]{}?*\\]/) { |char| "\\#{char}" }
+        basename = escape_glob(File.basename(file, ".rb"))
         Dir.glob("spec/**/#{basename}_spec.rb", base: @root)
            .select { |path| File.file?(File.join(@root, path)) }.sort.first(3)
       end
 
+      # A path segment is data, not a pattern: [, ], {, }, ?, * and \ are
+      # glob metacharacters and must be escaped to match literally.
+      def escape_glob(segment)
+        segment.gsub(/[\[\]{}?*\\]/) { |char| "\\#{char}" }
+      end
+
       # lstat, not stat: a symlink can point anywhere, including a spec of
       # another application or a fixture the suite excludes.
       def unrunnable_reason(path)
@@ -417,7 +461,10 @@ module Saboteur
         return expand_mapped(file, mapped) if mapped
 
         conventional = candidates_for(file).find { |path| File.file?(File.join(@root, path)) }
-        conventional && [conventional]
+        return [conventional] if conventional
+
+        unique = unique_suffix_spec(file)
+        unique && [unique]
       end
 
       # A mapped spec can be a glob (expanded against the root) or a regexp
@@ -464,14 +511,31 @@ module Saboteur
 
       # Layouts that mirror less of the source path, after every mirrored
       # guess (#394): a spec/unit/ prefix (shoulda-matchers mirrors below
-      # it, #393), the basename at the spec root (pundit), and both
-      # together (aasm, #370). Weaker guesses come last: the first
-      # candidate that exists wins. A file outside the source roots
-      # keeps its literal guess only: dropping directories from a path
-      # the roots never anchored would guess any same-named spec.
+      # it, #393), directories dropped between the gem namespace and the
+      # file (rubocop-ast tests lib/rubocop/ast/node/block_node.rb in
+      # spec/rubocop/ast/block_node_spec.rb, #586), the basename at the
+      # spec root (pundit), and both together (aasm, #370). Weaker
+      # guesses come last: the first candidate that exists wins. A file
+      # outside the source roots keeps its literal guess only: dropping
+      # directories from a path the roots never anchored would guess any
+      # same-named spec.
       def layout_variants(names)
         flat = names.map { |name| name.split("/").last }.uniq
-        (names + names.map { |name| "unit/#{name}" } + flat + flat.map { |name| "unit/#{name}" }).uniq
+        (names + names.map { |name| "unit/#{name}" } + flattened_below_namespace(names) + flat +
+          flat.map { |name| "unit/#{name}" }).uniq
+      end
+
+      # Every way to drop mid directories from a name, fewest dropped
+      # first: each guess keeps at least the leading namespace segment
+      # and the basename, so it stays anchored on the gem namespace and
+      # more specific than the bare basename flatten (#586).
+      def flattened_below_namespace(names)
+        names.flat_map do |name|
+          segments = name.split("/")
+          (segments.size - 2).downto(1).map do |keep|
+            (segments.first(keep) + [segments.last]).join("/")
+          end
+        end.uniq
       end
 
       # Rails tests controllers as request specs: spec/requests/users_spec.rb
@@ -483,6 +547,32 @@ module Saboteur
         ["requests/#{path}", "requests/#{path.delete_suffix('_controller')}"].uniq
       end
 
+      # The last-resort guess when no named candidate exists (#600): a
+      # spec tree can strip directories the convention keeps - aasm tests
+      # lib/aasm/core/invokers/proc_invoker.rb in
+      # spec/unit/invokers/proc_invoker_spec.rb, dropping the aasm and
+      # core segments. The one anchor such a layout keeps is the file's
+      # parent directory and basename, so a spec under the spec root
+      # ending in that suffix is the guess - but only a unique one: a
+      # second match makes the layout ambiguous, and guessing would run
+      # the wrong specs, a false verdict worse than the stop, whose
+      # near-miss hint names the candidates. Only files under a source
+      # root with a real parent directory qualify: a bare basename can
+      # collide anywhere, so it stays a near-miss hint.
+      def unique_suffix_spec(file)
+        pack = pack_of(file)
+        stem = file.delete_prefix("#{pack}/").delete_suffix(".rb")
+        root_segment, _, name = stem.partition("/")
+        return nil unless SOURCE_ROOTS.include?(root_segment) && name.include?("/")
+
+        suffix = name.split("/").last(2).map { |segment| escape_glob(segment) }.join("/")
+        spec_root = pack ? "#{pack}/spec" : "spec"
+        matches = Dir.glob(File.join(@root, spec_root, "**", "#{suffix}_spec.rb"))
+                     .select { |path| File.file?(path) }
+                     .map { |path| path.delete_prefix("#{@root}/") }.sort
+        matches.one? ? matches.first : nil
+      end
+
       # The nearest ancestor directory holding a package.yml (a packwerk
       # pack), relative to the root. The root itself is not a pack here:
       # Pathname#ascend stops above "." for these relative paths.

data/lib/saboteur/engine.rb

@@ -136,7 +136,7 @@ module Saboteur
       return if guess.changed.zero?
 
       inform_skipped_specs(guess)
-      raise ConfigError, guess.unmatched_message if guess.unmatched.any?
+      raise ConfigError, guess.unmatched_message(verbose: @diagnostics.verbose) if guess.unmatched.any?
 
       @diagnostics.inform(guess.excluded_message) if guess.excluded.any?
       # Every file in scope intentionally untested: mutate nothing. An
@@ -268,7 +268,8 @@ module Saboteur
       guard = BaselineGuard.new(config: config, integration: integration, hooks: hooks,
                                 supervisor: supervisor(memory_factor: 4), diagnostics: @diagnostics,
                                 full_passes: full_passes, timeout_cap: method(:budget_capped_timeout),
-                                between_passes: config["max_duration"] ? method(:budget_exceeded?) : nil)
+                                between_passes: config["max_duration"] ? method(:budget_exceeded?) : nil,
+                                run_started: @run_started)
       started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
       guard.call
       @baseline_elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - started

data/lib/saboteur/execution/external_runner.rb

@@ -335,6 +335,7 @@ module Saboteur
         if defined?(Bundler)
           original = Bundler.original_env
           BUNDLER_PASSTHROUGH_KEYS.each { |key| env[key] = original[key] if original.key?(key) }
+          restore_dropped_rubylib_entries(env, original)
         end
         if (rubyopt = env["RUBYOPT"])
           rubyopt = rubyopt.gsub(%r{\s*-rbundler/setup}, "").strip
@@ -343,6 +344,23 @@ module Saboteur
         env.merge(CHILD_MARKER => "1")
       end
 
+      # bundler <=2.5 scrubs even shell-exported entries (verified
+      # 2.5.22); bundler >=2.6.0 restores the pre-bundler value wholesale
+      # (verified 2.6.0/2.6.9), where this restore is a no-op. A
+      # relocated/toolcache Ruby needs that entry to find its stdlib
+      # (#584). Rebuild the list from the pre-bundler one - RUBYLIB is
+      # ordered, and two directories providing the same feature load in
+      # path order - then append entries only the scrubbed list has;
+      # bundler's own additions (absent from the pre-bundler value) stay
+      # dropped, and duplicates collapse to first occurrence.
+      def restore_dropped_rubylib_entries(env, original)
+        before = original["RUBYLIB"].to_s.split(File::PATH_SEPARATOR)
+        return if before.empty?
+
+        after = env["RUBYLIB"].to_s.split(File::PATH_SEPARATOR)
+        env["RUBYLIB"] = (before | after).join(File::PATH_SEPARATOR)
+      end
+
       # Only a failing exit proves the command saw the broken file; a
       # pass is the anchoring or no-coverage case, and a timeout or setup
       # failure leaves visibility unknown. Both warn and name the file.

data/lib/saboteur/execution/fiddle_loader.rb

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+module Saboteur
+  module Execution
+    # The one guarded door for fiddle (#639). Ruby ships fiddle itself - a
+    # default gem on 3.x, a bundled gem from 4.0 - so a run never needs to
+    # compile it, and a box where it cannot load has a broken Ruby or a
+    # missing Gemfile line, not a reason to run mutants without the sandbox
+    # layers. Every load goes through here and a failure REFUSES with the
+    # fixes, instead of a bundler-time source build dying on missing ffi.h.
+    module FiddleLoader
+      MESSAGE = "saboteur cannot load fiddle, which Ruby normally includes " \
+                "(a default gem on Ruby 3.x, a bundled gem on Ruby 4.0+), " \
+                "and refuses to run without its sandbox layers. Fix one of: " \
+                "reinstall Ruby so its shipped fiddle returns; " \
+                "run `gem install fiddle`; " \
+                "add `gem \"fiddle\"` to the Gemfile (required on Ruby 4.0+); " \
+                "or install the libffi headers (libffi-dev on Debian/Ubuntu, " \
+                "libffi-devel on Fedora/RHEL) and reinstall fiddle."
+
+      # Loads fiddle (plus fiddle/import for the one caller using its
+      # mixin). require is idempotent, so every touchpoint asks again for
+      # free. A LoadError means the sandbox layers cannot work: REFUSE -
+      # the error propagates, it is never downgraded to a warning.
+      def self.require_fiddle!(with_import: false)
+        require "fiddle"
+        require "fiddle/import" if with_import
+      rescue LoadError
+        raise Error, MESSAGE
+      end
+    end
+  end
+end

data/lib/saboteur/execution/marker_sweep.rb

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MIT
 # frozen_string_literal: true
 
-require "fiddle"
+require_relative "fiddle_loader"
 
 module Saboteur
   module Execution
@@ -33,6 +33,7 @@ module Saboteur
       # usable prctl (macOS) the environment marker still names exec'd
       # descendants and the tree still tracks the rest.
       def write_comm(marker)
+        FiddleLoader.require_fiddle!
         prctl = Fiddle::Function.new(Fiddle::Handle::DEFAULT["prctl"],
                                      [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP] + ([Fiddle::TYPE_LONG] * 3),
                                      Fiddle::TYPE_INT)

data/lib/saboteur/execution/process_table.rb

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MIT
 # frozen_string_literal: true
 
-require "fiddle"
+require_relative "fiddle_loader"
 
 module Saboteur
   module Execution
@@ -111,14 +111,18 @@ module Saboteur
           return @functions if defined?(@functions)
 
           @functions = begin
-            require "fiddle"
+            FiddleLoader.require_fiddle!
             library = Fiddle.dlopen("/usr/lib/libproc.dylib")
             [Fiddle::Function.new(library["proc_listallpids"], [Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT],
                                   Fiddle::TYPE_INT),
              Fiddle::Function.new(library["proc_pidinfo"],
                                   [Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_LONG_LONG,
                                    Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_INT)]
-          rescue LoadError, Fiddle::DLError
+          # Error first: the loader's refusal (#639) must match even when
+          # Fiddle is undefined (the DLError constant would not resolve).
+          # The process table is not a sandbox layer, so it keeps
+          # degrading to the next backend.
+          rescue Error, LoadError, Fiddle::DLError
             nil
           end
         end

data/lib/saboteur/execution/reevaluator.rb

@@ -191,6 +191,13 @@ module Saboteur
         source = subject.file_source.dup.force_encoding(Encoding::UTF_8)
         spliced = source.byteslice(0, subject.start_byte) + text + source.byteslice(subject.end_byte..)
         silencing_warnings { TOPLEVEL_BINDING.eval(spliced, subject.file, 1) }
+        # The eval just loaded the file for this run: a later lazy require
+        # of it (dry-rb load_extensions-style) must be a no-op, or its
+        # re-assignment of the file's constants fires "already initialized
+        # constant" - fatal in --warnings suites with a raising Warning
+        # gate, which wrongly reports every mutant as an error (#632).
+        loaded = File.expand_path(subject.file)
+        $LOADED_FEATURES << loaded unless $LOADED_FEATURES.include?(loaded)
       end
 
       def eval_in_owner(owner, subject, text, extra_lines)

data/lib/saboteur/execution/sandbox.rb

@@ -1,8 +1,7 @@
 # SPDX-License-Identifier: MIT
 # frozen_string_literal: true
 
-require "fiddle"
-require "fiddle/import"
+require_relative "fiddle_loader"
 
 module Saboteur
   module Execution
@@ -57,6 +56,13 @@ module Saboteur
         return @abi_version if defined?(@abi_version)
         return @abi_version = 0 unless linux?
 
+        # Refuses when fiddle cannot load (#639): the sandbox is mandatory,
+        # so this error must reach the run, not the DLError degrade below.
+        FiddleLoader.require_fiddle!(with_import: true)
+        @abi_version = probed_abi_version
+      end
+
+      def probed_abi_version
         # Build the errno reader BEFORE the probe: its lazy dlopen/dlsym run
         # libc calls that can set errno, so building it between the probe and
         # the read can replace the real answer with a stale 0.
@@ -66,11 +72,11 @@ module Saboteur
         # the kernel's real answer - the read was clobbered between the call
         # and here. Probe once more, now with every Fiddle function warm.
         version, errno = probe_once if !version.positive? && errno.zero?
-        @abi_version = probe_abi(version, errno)
+        probe_abi(version, errno)
       rescue Fiddle::DLError
         # No usable libc (an unusual musl/ldso layout): the sandbox cannot
         # be built here, so degrade to the unsandboxed note, not a crash.
-        @abi_version = 0
+        0
       end
 
       # A positive answer is the ABI. ENOSYS/EOPNOTSUPP mean the kernel has

data/lib/saboteur/execution/seatbelt.rb

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MIT
 # frozen_string_literal: true
 
-require "fiddle"
+require_relative "fiddle_loader"
 
 module Saboteur
   module Execution
@@ -50,9 +50,16 @@ module Saboteur
         return @probe if defined?(@probe)
         return @probe = :unsupported_platform unless darwin?
 
-        @probe = run_probe
+        # Refuses when fiddle cannot load (#639), before the DLError
+        # degrade below can turn it into a silent :unavailable.
+        FiddleLoader.require_fiddle!
+        @probe = probed
+      end
+
+      def probed
+        run_probe
       rescue Fiddle::DLError
-        @probe = :unavailable
+        :unavailable
       end
 
       def available?

data/lib/saboteur/execution/supervisor.rb

@@ -5,6 +5,7 @@ require "securerandom"
 
 require_relative "process_tree"
 require_relative "protocol"
+require_relative "fiddle_loader"
 
 module Saboteur
   module Execution
@@ -457,7 +458,7 @@ module Saboteur
       def become_subreaper
         return unless RUBY_PLATFORM.include?("linux")
 
-        require "fiddle"
+        FiddleLoader.require_fiddle!
         prctl = Fiddle::Function.new(Fiddle::Handle::DEFAULT["prctl"],
                                      [Fiddle::TYPE_INT, Fiddle::TYPE_LONG], Fiddle::TYPE_INT)
         prctl.call(PR_SET_CHILD_SUBREAPER, 1)