saboteur 0.8.0 → 0.9.0

data/lib/saboteur/deep_source.rb

@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+module Saboteur
+  # A file nested deeper than the walkers can safely recurse (#719).
+  class DeepSourceError < Error
+    def initialize(file, limit)
+      super("#{file} nests deeper than #{limit} AST levels; saboteur cannot walk it safely")
+    end
+  end
+
+  # The AST walkers (SubjectFinder, ConstantSubjectFinder, AttributeFinder
+  # and the operator visits) recurse one stack frame per nesting level and
+  # overflow the Ruby stack around a thousand nested calls, while Prism
+  # still parses to about five thousand (#719). Measuring depth iteratively
+  # before any walk turns that crash into a clean refusal: the CLI boundary
+  # prints one line naming the file and exits 3.
+  module DeepSource
+    # Two AST levels per nested call (`a(` adds a CallNode and an
+    # ArgumentsNode). The finders walk a file from its root and survive a
+    # thousand nested calls, so their limit sits just above that. The
+    # operator visits recurse deeper per level (method_swap overflows a
+    # bare stack around 900 nested calls, earlier under the engine), so a
+    # subject's body refuses earlier. Both margins stay deterministic:
+    # a clean refusal instead of a SystemStackError that depends on how
+    # deep the caller's stack already is.
+    MAX_AST_DEPTH = 2200
+    MAX_MUTATION_DEPTH = 1200
+
+    def self.check!(program, file, limit: MAX_AST_DEPTH)
+      raise DeepSourceError.new(file, limit) if depth(program) > limit
+    end
+
+    # Iterative on purpose: a recursive measure would crash on exactly the
+    # files it exists to catch (#719, same shape as #711).
+    def self.depth(node)
+      max = 0
+      work = [[node, 1]]
+      until work.empty?
+        current, level = work.pop
+        next if current.nil?
+
+        max = level if level > max
+        current.compact_child_nodes.each { |child| work << [child, level + 1] }
+      end
+      max
+    end
+  end
+end

data/lib/saboteur/dirty_tree_warning.rb

@@ -2,8 +2,9 @@
 # frozen_string_literal: true
 
 module Saboteur
-  # The warning shown before a run on a tree with uncommitted changes
-  # (#309, #316). Mutants run your code and can change the tree, so the
+  # The warning shown before a run on a tree with uncommitted
+  # changes (#309, #316); the headline says uncommitted or untracked, so a
+  # tree of only scratch files is not read as edits (#604). Mutants run your code and can change the tree, so the
   # warning stays; it splits the raw count so a tree full of notes or trial
   # setup files does not read like application edits about to be mutated.
   #
@@ -25,7 +26,7 @@ module Saboteur
     # unknown tree. The root is physical (realpath), like the paths
     # Config#included_files returns.
     def self.for(config, config_path:, gemfile: ENV.fetch("BUNDLE_GEMFILE", nil))
-      state = WorkingTree.new(config.root, ignored: config.output_paths).state
+      state = WorkingTree.new(config.root, ignored: config.ignored_tree_paths(gemfile: gemfile)).state
       root = File.realpath(config.root)
       new(state, included: relative(config.included_files, root), include: config["include"],
                  exclude: config["exclude"], root: root,
@@ -101,7 +102,8 @@ module Saboteur
       groups = [scope.empty? ? "none inside the mutation scope" : counted("inside the mutation scope", scope),
                 counted("outside it", outside)]
       groups << counted("saboteur setup file(s)", setup) unless setup.empty?
-      "saboteur: warning: #{@state.changed_files} uncommitted change(s) in the working tree: #{groups.join(', ')}."
+      "saboteur: warning: #{@state.changed_files} uncommitted or untracked change(s) in the working tree: " \
+        "#{groups.join(', ')}."
     end
 
     def counted(label, changes)

data/lib/saboteur/doctor.rb

@@ -19,6 +19,7 @@ module Saboteur
     def call
       Engine::Boot.refuse_recursion!
       check_runtime
+      check_environment
       check_coverage
       check_boot_files
       check_custom_map
@@ -55,6 +56,11 @@ module Saboteur
       raise Error, "target boot failed: #{e.class}: #{e.message}; check require files, hooks and rspec_args"
     end
 
+    def check_environment
+      hints = EnvironmentHints.all(@config.root)
+      @out.puts "Environment: #{hints.empty? ? 'no bundler/appraisal problems detected' : hints.join('; ')}"
+    end
+
     def check_runtime
       @out.puts "Ruby: #{RUBY_DESCRIPTION}"
       unless Gem::Version.new(RUBY_VERSION) >= Gem::Version.new("3.3") && Process.respond_to?(:fork)
@@ -102,8 +108,12 @@ module Saboteur
           @out.puts %(Seatbelt (opt-in, #436): probe #{Execution::Seatbelt.probe} - capability probe only, ) \
                     "not verified isolation"
         elsif RUBY_PLATFORM.match?(/darwin/i)
+          # Point at the way OUT of the degraded state, like the run
+          # warning does (#667): the opt-in Seatbelt sandbox, or silence.
           @out.puts "macOS: mutants run unsandboxed (Landlock is Linux-only) - a container contains " \
                     "filesystem writes outside the project"
+          @out.puts %(macOS: opt into the sandbox with c.sandbox = "seatbelt" ) \
+                    "(docs/guides/macos-seatbelt-sandbox.md), or set c.sandbox = false to silence this"
           @out.puts "Network: never restricted on any platform, and a plain container keeps outbound " \
                     "access - deny or stub the network when a mutant could reach real APIs"
         end

data/lib/saboteur/engine/baseline_guard.rb

@@ -5,6 +5,7 @@ require "json"
 require "fileutils"
 require_relative "../text"
 require_relative "../frameworks/sqlite_memory_database"
+require_relative "baseline_parts"
 
 module Saboteur
   class Engine
@@ -12,6 +13,8 @@ module Saboteur
     # or mutation source is used. This catches observed instability, not all
     # possible flaky behaviour.
     class BaselineGuard
+      include BaselineParts
+
       # How many unchanged-suite checks actually completed and validated:
       # the number of order comparisons a run can claim is one less.
       attr_reader :completed_passes
@@ -24,7 +27,7 @@ module Saboteur
       # coverage build when the cache is cold, so the first timed pass can
       # price the rest (#260).
       def initialize(config:, integration:, hooks:, supervisor:, diagnostics:, full_passes: 2, between_passes: nil,
-                     timeout_cap: nil)
+                     timeout_cap: nil, run_started: nil)
         @config = config
         @integration = integration
         @hooks = hooks
@@ -33,6 +36,7 @@ module Saboteur
         @full_passes = full_passes
         @between_passes = between_passes
         @timeout_cap = timeout_cap
+        @run_started = run_started
         @completed_passes = 0
       end
 
@@ -51,10 +55,7 @@ module Saboteur
           started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
           data = check(number)
           announce_first_pass_cost(number, started)
-          unless data["passed"] && data["failed"].empty?
-            refuse(number,
-                   with_hint("the suite failed: #{Array(data['failed']).join(', ')}", data))
-          end
+          refuse_suite_failure(number, data) unless data["passed"] && data["failed"].empty?
           executed = data["executed"]
           refuse(number, "executed tests do not match the loaded suite") unless
             executed.sort == expected.sort
@@ -67,6 +68,16 @@ module Saboteur
 
       private
 
+      def refuse_failed_suite(number, data)
+        outside = data["failed"].empty?
+        reason = if outside
+                   "the suite errored outside any example; see the log tail"
+                 else
+                   "the suite failed: #{data['failed'].join(', ')}"
+                 end
+        refuse(number, with_hint(reason, data), tail: outside)
+      end
+
       # A spent --max-duration budget skips the remaining passes - including
       # the first, when boot alone already spent it (#245).
       def budget_spent?(_index)
@@ -95,9 +106,10 @@ module Saboteur
 
         coverage_pending = @full_passes > @config["baseline_passes"]
         remaining = @full_passes - number - (coverage_pending ? 1 : 0)
+        elapsed = (Process.clock_gettime(Process::CLOCK_MONOTONIC) - started).round
+        warn_budget_projection(elapsed, remaining + (coverage_pending ? 1 : 0))
         return if remaining.zero? && !coverage_pending
 
-        elapsed = (Process.clock_gettime(Process::CLOCK_MONOTONIC) - started).round
         work = []
         work << "the remaining #{remaining} full #{remaining == 1 ? 'pass' : 'passes'}" if remaining.positive?
         work << "the coverage map build" if coverage_pending
@@ -106,6 +118,28 @@ module Saboteur
                             "#{work.join(' and ')} at that rate")
       end
 
+      # The first timed pass also prices the run against --max-duration:
+      # boot and this pass are spent, the remaining passes and a cold
+      # coverage build cost about that much again at that rate, and only
+      # what is left feeds mutants. Warn while a Ctrl-C is still cheap -
+      # the refusal only fires once the coverage build is unaffordable
+      # outright (#637).
+      def warn_budget_projection(pass_elapsed, remaining_passes)
+        budget = @config["max_duration"]
+        return unless budget && @run_started
+
+        spent = Process.clock_gettime(Process::CLOCK_MONOTONIC) - @run_started
+        projected = spent + (pass_elapsed * remaining_passes)
+        mutants_get = budget - projected
+        return if mutants_get >= pass_elapsed
+
+        verdict = mutants_get <= 0 ? "exceeds" : "barely fits"
+        @diagnostics.warn("raise --max-duration, pass fewer --baseline-passes, or narrow the scope\n  " \
+                          "projected baseline+coverage ~#{projected.round}s #{verdict} " \
+                          "--max-duration #{budget.round}s; mutants would get " \
+                          "~#{format('%g', [mutants_get, 0].max.round(1))}s")
+      end
+
       # An admitted pass still gets only the time left in the run budget:
       # without the cap it would overrun a spent --max-duration by its
       # whole coverage_timeout.
@@ -145,6 +179,9 @@ module Saboteur
       end
 
       def check(number)
+        parts = baseline_parts
+        return check_parts(number, parts) if parts.size > 1
+
         Execution::ForkReadiness.prepare_heap
         heartbeat = @diagnostics.progress_heartbeat("baseline check #{number}").watch(log_path(number))
         admitted = phase_timeout
@@ -152,6 +189,11 @@ module Saboteur
                                  label: "baseline child died during setup/run") do |writer|
           record(writer, number)
         end
+        settled(number, result, admitted)
+      end
+
+      def settled(number, result, admitted, part: nil)
+        @part = part
         refuse_budget_stop(number, admitted) if budget_stopped?(result, admitted)
         refuse(number, stopped_reason(result)) if result.stopped_by
         # Before the payload checks: a child killed by a signal (the OOM
@@ -190,15 +232,16 @@ module Saboteur
           data["executed"].is_a?(Array) && data["executed"].all?(String)
       end
 
-      def record(writer, number)
-        path = log_path(number)
+      def record(writer, number, files: nil, part: nil)
+        path = log_path(number, part)
         FileUtils.mkdir_p(File.dirname(path))
         $stdout.reopen(path, "w")
         $stdout.sync = true
         $stderr.reopen($stdout)
         @hooks.run(:after_fork)
         Kernel.srand(@config["seed"])
-        result = @integration.run_baseline(seed: @config["seed"])
+        seed = @config["seed"]
+        result = files ? @integration.run_baseline(seed: seed, files: files) : @integration.run_baseline(seed: seed)
         payload = { passed: result.passed, failed: result.failed_ids, executed: result.executed_ids }
         payload[:hint] = Frameworks::SqliteMemoryDatabase.fork_loss_hint unless result.passed
         writer.write(JSON.generate(payload))
@@ -209,14 +252,74 @@ module Saboteur
         writer.close
       end
 
+      # A failed unchanged suite never runs mutants: warn first when the
+      # failure carries the Minitest signature (#626), then refuse.
+      def refuse_suite_failure(number, data)
+        warn_minitest_signature(number)
+        refuse_failed_suite(number, data)
+      end
+
+      # Minitest::Spec suites in *_spec.rb clothing load under the RSpec
+      # integration and then fail the baseline with NoMethodError for
+      # Minitest-only methods (#626): the refusal still reads "fix the
+      # suite", so warn what the signature actually points at. It stays a
+      # warning: an RSpec suite can require minitest for a helper and
+      # fail for its own reason, and a heuristic refusal would
+      # false-positive there.
+      def warn_minitest_signature(number)
+        lines = log_lines(number)
+        errors = lines.grep(/NoMethodError/)
+        return if errors.empty? || !spec_helper_requires_minitest?
+
+        symptom = (lines.find { |line| line.include?("undefined method") } || errors.first).strip
+        @diagnostics.warn("run saboteur on an RSpec suite: it is RSpec-only, so a Minitest suite cannot be " \
+                          "mutation tested with it\n  " \
+                          "the baseline failure looks like a Minitest suite running under RSpec, not a " \
+                          "broken RSpec suite: the log shows #{errors.size} " \
+                          "NoMethodError#{'s' if errors.size > 1} (for example: #{symptom.slice(0, EXCERPT_WIDTH)}) " \
+                          "and spec/spec_helper.rb requires minitest")
+      end
+
+      # The framework check behind the warning: spec_helper is the
+      # suite's own declaration of what it runs on. Parsed, not grepped: a
+      # regex also fires on commented-out or heredoc "require" lines for a
+      # framework the project does not use (#708).
+      def spec_helper_requires_minitest?
+        require_calls(Prism.parse_file(File.join(@config.root, "spec", "spec_helper.rb")).value)
+          .any? { |name| name == "minitest" || name.start_with?("minitest/") }
+      rescue SystemCallError
+        false
+      end
+
+      # Iterative like RefinementActivations.collect: a deeply nested
+      # spec_helper must never raise SystemStackError out of a warning
+      # heuristic (same class as #711).
+      def require_calls(node)
+        found = []
+        work = [node]
+        until work.empty?
+          current = work.pop
+          next unless current.is_a?(Prism::Node)
+
+          if current.is_a?(Prism::CallNode) && current.name == :require && current.receiver.nil?
+            argument = current.arguments&.arguments&.first
+            found << argument.unescaped if argument.is_a?(Prism::StringNode)
+          end
+          work.concat(current.compact_child_nodes)
+        end
+        found
+      end
+
       # A child that recognises its own failure shape (an empty sqlite
       # :memory: database after the fork, #387) says how to fix it.
       def with_hint(reason, data)
         data["hint"] ? "#{reason}. #{data['hint']}" : reason
       end
 
-      def log_path(number)
-        File.join(@config.path("cache_dir"), "baseline-#{number}.log")
+      # A split check keeps one log per part: baseline-1-part-2.log.
+      def log_path(number, part = @part)
+        name = part ? "baseline-#{number}-part-#{part + 1}.log" : "baseline-#{number}.log"
+        File.join(@config.path("cache_dir"), name)
       end
 
       # Leftover children are a pass-with-leaks verdict, not a suite
@@ -230,9 +333,9 @@ module Saboteur
         "the suite passed but left #{count} child #{count == 1 ? 'process' : 'processes'} behind: #{detail}"
       end
 
-      def refuse(number, reason, excerpt: true)
+      def refuse(number, reason, excerpt: true, tail: false)
         raise Error, "baseline check #{number} failed at seed #{@config['seed']}: #{reason}. " \
-                     "#{failure_excerpt(number) if excerpt}See the full log at #{log_path(number)}. " \
+                     "#{failure_excerpt(number, tail: tail) if excerpt}See the full log at #{log_path(number)}. " \
                      "Fix the suite or its setup, then run saboteur again with the same seed. " \
                      "No mutants were started."
       end
@@ -240,11 +343,11 @@ module Saboteur
       # The first lines of the failure, inline, so the cause is readable
       # without opening the log: RSpec's "Failures:" section when the log has
       # one, otherwise the last lines of the log.
-      def failure_excerpt(number)
+      def failure_excerpt(number, tail: false)
         lines = log_lines(number)
         return "" if lines.empty?
 
-        start = lines.index { |line| line.start_with?("Failures:") }
+        start = lines.index { |line| line.start_with?("Failures:") } unless tail
         shown = start ? lines[start, EXCERPT_LINES] : lines.last(EXCERPT_LINES)
         "The log says:\n#{shown.map { |line| "  #{line.slice(0, EXCERPT_WIDTH)}" }.join("\n")}\n"
       end

data/lib/saboteur/engine/baseline_parts.rb

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+require_relative "suite_partition"
+
+module Saboteur
+  class Engine
+    # A baseline check split like the coverage build (--coverage-parts N):
+    # the same disjoint spec-file parts run as children at once, each over
+    # its own files. Uses the guard's @config, @integration, @supervisor,
+    # @diagnostics, @part and settled/phase_timeout/log_path.
+    #
+    # The check's contract is unchanged. Every part must pass, and the
+    # examples the parts executed together must be exactly the loaded
+    # suite's (the guard compares them before it accepts the pass). What a
+    # split no longer shows is a failure that needs the whole suite in one
+    # process.
+    module BaselineParts
+      private
+
+      # The parts the coverage build would use. One part (or none, for an
+      # adapter that lists no spec files) means the ordinary single check.
+      def baseline_parts
+        Engine::SuitePartition.parts(@integration.test_files, @config["coverage_parts"])
+      end
+
+      def check_parts(number, parts)
+        Execution::ForkReadiness.prepare_heap
+        heartbeat = @diagnostics.progress_heartbeat("baseline check #{number} (#{parts.size} parts)")
+                                .watch(log_path(number, 0))
+        admitted = phase_timeout
+        results = @supervisor.run_many(parts.size, timeout: admitted, on_tick: heartbeat.method(:tick),
+                                                   label: "baseline child died during setup/run") do |writer, slot|
+          ENV["TEST_ENV_NUMBER"] = slot.zero? ? "" : (slot + 1).to_s
+          record(writer, number, files: parts[slot], part: slot)
+        end
+        joined(results.each_with_index.map { |result, slot| settled(number, result, admitted, part: slot) })
+      end
+
+      # What the guard's checks read: the first failing part's own result
+      # (its failures and hint; @part names its log), or a pass carrying
+      # every example the parts executed.
+      def joined(datas)
+        @part = datas.index { |data| !(data["passed"] && data["failed"].empty?) }
+        return datas[@part] if @part
+
+        { "passed" => true, "failed" => [], "executed" => datas.flat_map { |data| data["executed"] } }
+      end
+    end
+  end
+end

data/lib/saboteur/engine/boot.rb

@@ -66,9 +66,15 @@ module Saboteur
         @rails = rails = Frameworks::Rails.new(@config, @hooks) if @config["rails"]
         rails&.before_boot
         @hooks.run(:before_boot)
-        add_spec_to_load_path if @config["rails"]
+        add_spec_to_load_path
+        # Helpers may configure RSpec before the integration loads specs.
+        Integration::RSpec.new(@config).require_framework if @config["integration"] == "rspec"
         @config["require"].each { |file| require File.expand_path(file, @root) }
         integration = Integration.fetch(@config["integration"]).new(@config)
+        # Running outside the bundle or beside an Appraisal gemfile set
+        # loads the wrong gems; say so before the spec load fails in
+        # confusing ways (#598, #609). Advisory only.
+        EnvironmentHints.all(@root).each { |hint| warn "saboteur: warning: #{hint}" }
         integration.setup
         rails&.after_boot
         @hooks.run(:after_boot)
@@ -78,8 +84,10 @@ module Saboteur
       private
 
       # rspec puts spec/ on the load path, so a boot file under spec/ (a
-      # dummy app's rails_helper, say) can require its siblings. Match
-      # that, or the same require list fails to load.
+      # dummy app's rails_helper, or a non-Rails gem's spec_helper that
+      # requires its siblings) can require its siblings. Match that for
+      # every project - a non-Rails gem does not add spec/ itself (#615) -
+      # or the same require list fails to load.
       def add_spec_to_load_path
         path = File.join(@root, "spec")
         $LOAD_PATH.unshift(path) unless $LOAD_PATH.include?(path)

data/lib/saboteur/engine/bytecode_equivalence.rb

@@ -42,11 +42,27 @@ module Saboteur
 
       def fingerprint(text, frozen)
         options = { frozen_string_literal: frozen }
-        strip_positions(RubyVM::InstructionSequence.compile(text, nil, nil, 1, options).to_a)
+        iseq = warnings_silenced do
+          RubyVM::InstructionSequence.compile(text, "saboteur/bytecode-equivalence", nil, 1, options)
+        end
+        strip_positions(iseq.to_a)
       rescue SyntaxError, StandardError
         nil
       end
 
+      # Mutants compile one by one, and generated bodies (body_nil,
+      # statement_removal) trip Ruby's own void-context warnings, so a host
+      # suite running with -w gets one line per mutant flooding stderr
+      # (#592, #656). The check is internal: silence the compiler. A mutant
+      # that does not parse still fails the compile and runs.
+      def warnings_silenced
+        saved = $VERBOSE
+        $VERBOSE = nil
+        yield
+      ensure
+        $VERBOSE = saved
+      end
+
       # Structural equality that never coerces: an Integer is not a Float,
       # and +0.0 is not -0.0 (1.0 / +0.0 and 1.0 / -0.0 are different
       # infinities), which eql? alone would not tell apart.

data/lib/saboteur/engine/candidate_selection.rb

@@ -8,11 +8,12 @@ module Saboteur
     class CandidateSelection
       attr_reader :skipped_subjects, :selected, :unscoped_digests
 
-      def initialize(candidates:, map:, limit:, diagnostics:)
+      def initialize(candidates:, map:, limit:, diagnostics:, root: nil)
         @candidates = candidates
         @map = map
         @limit = limit
         @diagnostics = diagnostics
+        @root = root
         @skipped_subjects = {}
         @selected = {}
         @unscoped_digests = {}
@@ -29,6 +30,7 @@ module Saboteur
           return @selected[subject] = []
         end
 
+        warn_boot_once(subject)
         list = @candidates.for(subject)
         # The full pre-scope digests let IgnoreList#apply tell "mutation gone"
         # from "mutation scoped out of this run" (#284).
@@ -48,24 +50,33 @@ module Saboteur
 
       private
 
+      # A note, not a verdict (#575): every mutant still runs and scores.
+      def warn_boot_once(subject)
+        return unless @map.boot_once?(subject)
+
+        @diagnostics.warn("#{subject.id}: verify a survivor here by mutating the file on disk\n  " \
+                          "covered by every test and run at boot: mutants apply after boot, so a survivor " \
+                          "can be a boot-once effect the suite cannot re-observe (#575)")
+      end
+
       # A scoped no-coverage skip names the specs the run loaded: coverage
       # living in a sibling spec file is otherwise invisible, and the false
       # read is "untestable" when the truth is "not loaded" (#636). Names
       # at most five, like the other selection notes.
       def skip_announcement(subject, reason)
-        line = "#{subject.id}: skipped (#{reason}); its change is not verified by this run"
+        line = "#{subject.id} (#{subject.location(@root)}): skipped (#{reason}); its change is not verified by this run"
         return line unless reason == "no coverage"
 
         loaded = @map.tests.map { |id| id.split("[").first.delete_prefix("./") }.uniq.sort
-        more = loaded.size > 5 ? ", ..." : ""
-        names = loaded.empty? ? "none" : loaded.first(5).join(", ")
-        "#{line} - loaded specs: #{names}#{more}; " \
+        names = loaded.empty? ? "none" : Text.name_list(loaded)
+        "#{line} - loaded specs: #{names}; " \
           "other spec files may cover it, pass --test to load them"
       end
 
       # Load-only code is not "no coverage": it ran, just never inside a
       # test, and no forked test can re-run it (see CoverageMap::RAN_AT_LOAD).
       def skip_reason_for(subject)
+        return Selection::CoverageMap::PRELOADED if @map.preloaded?(subject.file)
         return "no coverage" unless @map.ran_at_load?(subject.file, subject.coverage_lines)
 
         Selection::CoverageMap::RAN_AT_LOAD

data/lib/saboteur/engine/candidates.rb

@@ -109,6 +109,9 @@ module Saboteur
       end
 
       def proposals(source, subject)
+        # The operator visits recurse over the subject's body; refuse a
+        # body nested too deeply instead of crashing the run (#719).
+        DeepSource.check!(subject.node, subject.file, limit: DeepSource::MAX_MUTATION_DEPTH)
         proposals = source.mutations_for(subject)
         if proposals.empty?
           @diagnostics.record_generation(subject, source: source_name(source), reason: "empty_generation")
@@ -142,7 +145,7 @@ module Saboteur
 
         [mutation, text]
       rescue ArgumentError => e
-        @diagnostics.warn("#{subject.id}: dropped #{mutation.source} mutation: #{e.message}")
+        @diagnostics.warn("#{subject.id}: dropped #{mutation.source} mutation\n  #{e.message}")
         record_drop(subject, mutation, "invalid_edit")
       end