@codyswann/lisa 4.64.1 → 4.64.3

package/rails/copy-overwrite/scripts/threshold-ratchet-compare.mjs

@@ -21,6 +21,7 @@ import {
   extractStrykerConstraints,
   extractStrykerMutate,
   familyFor,
+  globRoot,
   parseJson,
 } from "./threshold-ratchet-families.mjs";
 
@@ -157,15 +158,56 @@ function compareStryker(relPath, base, current) {
   );
   const baseMutate = extractStrykerMutate(base);
   const currentMutate = extractStrykerMutate(current);
+  // Roots the gate already covered, and roots this change adds. An exclusion
+  // scoped to a newly added root narrows territory that was not being mutated
+  // a moment ago, so it cannot shrink the gate — the change is a net widening.
+  //
+  // Without this, repairing an INERT `mutate` list is unreachable without a
+  // human-approved ratchet exception: the repair necessarily adds source roots
+  // AND the test-file exclusions that belong with them, and every one of those
+  // exclusions read as a weakening. Measured on two repositories whose real
+  // effect was 0 -> 69 and 0 -> 75 files mutated (CodySwannGT/lisa#4243).
+  const baseRoots = [...baseMutate.positives].map(globRoot);
+  /**
+   * Whether an exclusion might touch any baseline positive.
+   *
+   * Both containment directions matter: excluding `src` removes a baseline
+   * rooted at `src/existing`, too. An empty prefix (wildcards, braces, classes
+   * or extglobs at the root) might cover everything. We grant an exemption
+   * only for provably disjoint territory, never from a guessed glob overlap.
+   * @param {string} root A rooted glob prefix
+   * @returns {boolean} True when overlap cannot be ruled out
+   */
+  const overlapsBase = root =>
+    baseRoots.some(
+      base =>
+        root === "" ||
+        base === "" ||
+        root === base ||
+        root.startsWith(`${base}/`) ||
+        base.startsWith(`${root}/`)
+    );
+  const addedRoots = [...currentMutate.positives]
+    .filter(positive => !baseMutate.positives.has(positive))
+    .map(globRoot)
+    .filter(root => root !== "");
+  /**
+   * Whether a root lies inside territory THIS change is adding.
+   * @param {string} root A rooted glob prefix
+   * @returns {boolean} True when an added root equals or contains it
+   */
+  const underAdded = root =>
+    addedRoots.some(added => root === added || root.startsWith(`${added}/`));
   for (const negation of currentMutate.negations) {
-    if (!baseMutate.negations.has(negation)) {
-      findings.push({
-        file: relPath,
-        key: `mutate ${negation}`,
-        type: TYPE_EXEMPTION_ADDED,
-        message: `${relPath}: new mutation-testing exclusion "${negation}" — excluding files from a gate is a weakening.`,
-      });
-    }
+    if (baseMutate.negations.has(negation)) continue;
+    const root = globRoot(negation);
+    if (!overlapsBase(root) && underAdded(root)) continue;
+    findings.push({
+      file: relPath,
+      key: `mutate ${negation}`,
+      type: TYPE_EXEMPTION_ADDED,
+      message: `${relPath}: new mutation-testing exclusion "${negation}" — excluding files from a gate is a weakening.`,
+    });
   }
   for (const positive of baseMutate.positives) {
     if (!currentMutate.positives.has(positive)) {

package/rails/copy-overwrite/scripts/threshold-ratchet-families.mjs

@@ -311,6 +311,30 @@ export function extractStrykerMutate(conf) {
   return { positives, negations };
 }
 
+/**
+ * The literal directory prefix a glob is rooted at, before any wildcard.
+ *
+ * `lib/**\/*.spec.ts` and `!lib/**\/*.d.ts` are both rooted at `lib`. This is
+ * what lets the ratchet tell territory a change ADDED from territory it
+ * already covered: an exclusion inside a newly added root cannot shrink a
+ * gate, because nothing there was being mutated a moment ago.
+ * @param {string} glob A stryker mutate entry, with or without a leading `!`
+ * @returns {string} The rooted prefix, or "" when the glob starts with a wildcard
+ */
+export function globRoot(glob) {
+  const bare = glob.startsWith("!") ? glob.slice(1) : glob;
+  // Backslash escapes and parent traversal make textual containment unsafe.
+  // An unknown prefix overlaps everything rather than granting an exemption.
+  if (bare.includes("\\") || bare.split("/").includes("..")) return "";
+  const rooted = [];
+  for (const segment of bare.split("/")) {
+    if (segment === "." || segment === "") continue;
+    if (["*", "?", "{", "[", "("].some(meta => segment.includes(meta))) break;
+    rooted.push(segment);
+  }
+  return rooted.join("/");
+}
+
 /**
  * Parse one k6 threshold expression (`p(95)<1000`, `rate>=0.99`, …) into a
  * ratchet constraint. Upper bounds (`<`, `<=`) may only decrease; lower

package/typescript/copy-overwrite/scripts/lisa-mutation.mjs

@@ -47,9 +47,10 @@
  *   `nothing-to-mutate`, in a block that states no mutant was generated and no
  *   score was computed. Exit 0.
  * - **The mutate configuration selects nothing in this repository at all** —
- *   a misconfigured gate, permanently inert, green forever. Reported as
- *   `inert-mutate-config` and it FAILS, exit 1. Distinguishing the two costs
- *   one `git ls-files`.
+ *   report the missed source roots even while disabled. When enabled, derive
+ *   tracked TypeScript roots unless sourceDirs was explicitly declared. If no
+ *   viable selection results, report `inert-mutate-config` and FAIL, exit 1.
+ *   A viable project selection is never widened by derivation.
  * - **Something changed that no mutation tool can reach** — a shell guard.
  *   Reported as `uninstrumentable-language`, exit 0, because it is not a test
  *   failure. It is separated from `nothing-to-mutate` because the two are
@@ -780,7 +781,7 @@ const declarationFromJson = (cwd, name) => {
   try {
     const conf = JSON.parse(fs.readFileSync(path.join(cwd, name), "utf8"));
     if (Array.isArray(conf.mutate) && conf.mutate.length > 0) {
-      return { mutate: conf.mutate, source: name };
+      return { mutate: conf.mutate, source: name, explicit: true };
     }
     return {
       mutate: FALLBACK_MUTATE,
@@ -804,6 +805,9 @@ const declarationFromJson = (cwd, name) => {
  * @returns {{mutate: readonly string[], source: string}} Declaration and origin.
  */
 export const resolveMutateDeclaration = cwd => {
+  const declared = declarationFromSourceDirs(cwd);
+  if (declared) return declared;
+
   const found = JSON_CONFIG_NAMES.find(name =>
     fs.existsSync(path.join(cwd, name))
   );
@@ -820,6 +824,179 @@ export const resolveMutateDeclaration = cwd => {
   };
 };
 
+/**
+ * Top-level directories that are never a project's own source.
+ *
+ * Deliberately short. Every entry here is a directory whose contents would be
+ * wrong to mutate rather than merely unusual to mutate, because a false
+ * entry in this list silently shrinks a derived gate and derivation only runs
+ * where the project's own config already selected nothing. `scripts` is
+ * absent on purpose: shipped guard scripts are exactly the code a mutation
+ * gate most wants, and excluding them is the defect CodySwannGT/lisa#3668
+ * was filed about.
+ * @type {readonly string[]}
+ */
+/**
+ * Extensions derivation counts, and the ones `mutateFromSourceDirs` emits.
+ *
+ * Kept as one list because the two MUST agree: a root derived from files the
+ * generated patterns cannot select produces a suggestion that selects nothing.
+ * @type {readonly string[]}
+ */
+export const DERIVABLE_EXTENSIONS = Object.freeze([".ts", ".tsx"]);
+
+/**
+ * Filename markers that mean "not the project's own mutable source".
+ *
+ * Compared against the basename with its final extension removed, so
+ * `guard.spec.ts` yields `guard.spec` and matches `.spec`.
+ * @type {readonly string[]}
+ */
+export const NON_SOURCE_MARKERS = Object.freeze([
+  ".spec",
+  ".test",
+  ".d",
+  ".stories",
+]);
+
+export const NON_SOURCE_ROOTS = Object.freeze([
+  "__mocks__",
+  "__tests__",
+  "build",
+  "coverage",
+  "dist",
+  "e2e",
+  "fixtures",
+  "node_modules",
+  "out",
+  "test",
+  "tests",
+  "vendor",
+]);
+
+/**
+ * Whether a tracked file is a project's own mutable source.
+ * @param {string} file - Repository-relative path.
+ * @returns {boolean} True when it is source rather than a test or artifact.
+ */
+const isDerivableSource = file => {
+  const normalized = normalizePath(file);
+  // Deliberately NARROWER than `isStrykerParseable`. Derivation exists to feed
+  // `mutateFromSourceDirs`, which emits `.ts`/`.tsx` patterns only — counting a
+  // `.js` or `.vue` file here would report a root whose derived patterns then
+  // select nothing, which is a suggestion that cannot work and, worse, a
+  // non-zero root count that used to let an inert gate run on unchanged
+  // patterns. The two must agree on what counts, so they share this list.
+  if (!DERIVABLE_EXTENSIONS.includes(path.extname(normalized).toLowerCase())) {
+    return false;
+  }
+  // Suffix comparison rather than one alternating regex: the pattern that
+  // expresses this compactly (`(?:\.spec|\.test)\.[cm]?[jt]sx?$`) is exactly
+  // the shape the ReDoS rule flags, and this runs over every tracked path.
+  const base = normalized.slice(normalized.lastIndexOf("/") + 1);
+  const marker = base.slice(0, base.lastIndexOf("."));
+  if (NON_SOURCE_MARKERS.some(suffix => marker.endsWith(suffix))) return false;
+  const [root] = normalized.split("/");
+  return normalized.includes("/") && !NON_SOURCE_ROOTS.includes(root);
+};
+
+/**
+ * Source roots inferred from what the repository actually tracks.
+ *
+ * This exists because the scaffolded `mutate` list is a GUESS about layout —
+ * `src/**` for the TypeScript and Expo profiles — and a guess that misses
+ * produces a gate wired to nothing rather than an error. Derivation is only
+ * ever consulted when the project's own declaration already selects zero
+ * files, so it cannot quietly override a working configuration; it turns a
+ * dead end into a working gate and says so.
+ * @param {string} cwd - Project root.
+ * @returns {{root: string, files: number}[]} Roots with source, most first.
+ */
+export const deriveSourceRoots = cwd => {
+  let tracked;
+  try {
+    tracked = git(cwd, ["ls-files"]).split("\n");
+  } catch {
+    // probe-direction: fail-closed — an unreadable index yields no roots, and
+    // no roots means no suggestion and no derived fallback, so an enabled gate
+    // with an inert list still fails rather than quietly running against a
+    // guess. The sibling `countMutateTargetsInRepo` deliberately goes the other
+    // way on the same failure, because there an unreadable index must not block
+    // a push over something unrelated to mutation testing.
+    return [];
+  }
+  const counts = new Map();
+  for (const file of tracked) {
+    if (!file || !isDerivableSource(file)) continue;
+    const [root] = normalizePath(file).split("/");
+    counts.set(root, (counts.get(root) ?? 0) + 1);
+  }
+  return [...counts.entries()]
+    .map(([root, files]) => ({ root, files }))
+    .sort((a, b) => b.files - a.files || a.root.localeCompare(b.root));
+};
+
+/**
+ * A mutate list covering the given directories, with the usual exclusions.
+ * @param {readonly string[]} dirs - Source directories, repo-relative.
+ * @returns {string[]} Stryker `mutate` patterns.
+ */
+export const mutateFromSourceDirs = dirs => [
+  ...dirs.flatMap(dir => [`${dir}/**/*.ts`, `${dir}/**/*.tsx`]),
+  ...dirs.flatMap(dir => [
+    `!${dir}/**/*.spec.ts`,
+    `!${dir}/**/*.spec.tsx`,
+    `!${dir}/**/*.test.ts`,
+    `!${dir}/**/*.test.tsx`,
+    `!${dir}/**/*.d.ts`,
+    `!${dir}/**/*.stories.tsx`,
+  ]),
+];
+
+/**
+ * The project's declared source directories, if it declares any.
+ *
+ * Reading this from `.lisa.config.json` rather than from the Stryker config
+ * is the point: `stryker.conf.json` ships create-only, so a layout the
+ * scaffold guessed wrong can never be corrected upstream for a repository
+ * that already exists. A config key can.
+ * @param {string} cwd - Project root.
+ * @returns {{mutate: readonly string[], source: string} | null} Declaration.
+ */
+const declarationFromSourceDirs = cwd => {
+  const configPath = path.join(cwd, ".lisa.config.json");
+  if (!fs.existsSync(configPath)) return null;
+  let dirs;
+  try {
+    const conf = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    dirs = conf?.quality?.mutation?.sourceDirs;
+  } catch {
+    // A malformed project config is not this gate's error to report; the
+    // Stryker config is still a usable declaration, so fall through to it.
+    return null;
+  }
+  if (!Array.isArray(dirs) || dirs.length === 0) return null;
+  // Trailing slashes trimmed by hand rather than with `/\/+$/`: this value
+  // comes from a config file, and a `+` anchored at the end is the shape the
+  // ReDoS rule flags on attacker-influenced input.
+  const trimTrailingSlashes = dir => {
+    let end = dir.length;
+    while (end > 0 && dir[end - 1] === "/") end -= 1;
+    return dir.slice(0, end);
+  };
+  const clean = dirs
+    .filter(dir => typeof dir === "string" && dir.length > 0)
+    .map(dir => trimTrailingSlashes(normalizePath(dir)));
+  if (clean.length === 0) return null;
+  return {
+    mutate: mutateFromSourceDirs(clean),
+    source: `.lisa.config.json quality.mutation.sourceDirs (${clean.join(", ")})`,
+    explicit: true,
+    sourceDirs: true,
+    overrideMutate: true,
+  };
+};
+
 /**
  * Stryker's per-mutant budget when a config declares none, in milliseconds.
  *
@@ -2457,12 +2634,13 @@ const runStrykerCaptured = (cwd, entry, env, deadlineMs) => {
  * reachable by accident — an empty diff selection is reported as
  * `nothing-to-mutate` and returns long before here.
  * @param {string} cwd - Project root.
- * @param {readonly string[]} selected - Repository-relative paths, or empty for
+ * @param {readonly string[]} selected - Paths or resolved patterns, or empty for
  *   the project's own `mutate` patterns.
+ * @param {boolean} wholeList - Keep test-runner diff scoping empty for --all.
  * @returns {{code: number, output: string|null}} Stryker's status, and its
  *   output when this machine could keep a copy.
  */
-const runStryker = (cwd, selected) => {
+const runStryker = (cwd, selected, wholeList = false) => {
   const scope = selected.join(",");
   const base = strykerEntry(cwd);
   const sandbox = runSandboxName(resolveSandboxRoot(cwd));
@@ -2485,7 +2663,9 @@ const runStryker = (cwd, selected) => {
     // narrow with it. A project that ignores it loses nothing, and a project
     // that reads it can only ever REMOVE suites — which removes kills and
     // lowers the score — so no value of this can turn a failing gate green.
-    MUTATION_SCOPE: scope,
+    // Resolved patterns are not changed file paths. Whole-list runs must not
+    // accidentally ask a test runner to narrow its suite to these globs.
+    MUTATION_SCOPE: wholeList ? "" : scope,
   };
   // Reclaim before the run, never after — see `sweepSandboxes`. Here rather
   // than at either call site so the `--all` path cannot be given a different
@@ -2602,19 +2782,26 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
   // as a defect; the behaviour is pinned by a test rather than by this note.
   const since = process.env.MUTATION_SINCE || gate.since || "main";
 
-  if (!enabled) {
-    console.log(
-      `⚪ ${OUTCOMES.disabled} — mutation.gate.json says "enabled": false. Skipping.\n` +
-        '   Flip "enabled": true (and tune thresholds.break in stryker.conf.json) to turn it on.'
-    );
-    return finish(OUTCOMES.disabled, 0);
-  }
-
-  const declaration = resolveMutateDeclaration(cwd);
+  // Resolved BEFORE the enabled check on purpose. A disabled gate used to
+  // return here, so a repository whose patterns also selected nothing learned
+  // neither fact — and disabled is the default, so the two hid each other for
+  // as long as nobody turned the gate on. Detection is also the only thing
+  // that reaches an ALREADY-scaffolded repository: `stryker.conf.json` ships
+  // create-only, so a layout the scaffold guessed wrong can never be
+  // corrected there from upstream (CodySwannGT/lisa#4243).
+  let declaration = resolveMutateDeclaration(cwd);
   let patterns;
   try {
     patterns = compileMutatePatterns(declaration.mutate);
   } catch (error) {
+    if (!enabled) {
+      console.log(
+        `⚪ ${OUTCOMES.disabled} — mutation.gate.json says "enabled": false. Skipping.\n` +
+          `   Heads up: the \`mutate\` patterns in ${declaration.source} do not compile,\n` +
+          "   so this gate would fail immediately if it were switched on."
+      );
+      return finish(OUTCOMES.disabled, 0);
+    }
     console.error(
       `❌ ${OUTCOMES.invalidMutatePattern}\n` +
         `   ${error instanceof Error ? error.message : String(error)}\n` +
@@ -2624,15 +2811,97 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
   }
 
   if (countMutateTargetsInRepo(cwd, patterns) === 0) {
-    console.error(
-      `❌ ${OUTCOMES.inertConfig}\n` +
-        `   The mutate patterns from ${declaration.source} select NO tracked file\n` +
-        "   in this repository, so this gate can never generate a mutant and would\n" +
-        "   report success on every run forever. That is not a pass — it is a gate\n" +
-        "   that is switched on and wired to nothing.\n" +
-        "   Fix the `mutate` patterns in your Stryker config, or turn the gate off."
+    // An inert scaffolded or project-written list needs the same repair.
+    // Explicit sourceDirs are authoritative; otherwise derive tracked roots
+    // only after proving the configured selection is empty, and report the
+    // substitution. A viable project mutate list always retains its scope.
+    const roots = deriveSourceRoots(cwd);
+    const suggestion =
+      roots.length > 0
+        ? roots
+            .map(
+              entry =>
+                `${entry.root}/ (${entry.files} file${entry.files === 1 ? "" : "s"})`
+            )
+            .join(", ")
+        : null;
+
+    if (!enabled) {
+      // A repository with no source at all is not "wired to nothing" in any
+      // way worth warning about, so the extra notice fires only when there IS
+      // source the patterns are missing.
+      const detail = suggestion
+        ? [
+            `⚠️  AND the \`mutate\` patterns from ${declaration.source} select NO`,
+            "   tracked file. Before switching it on, declare the source directories;",
+            "   the candidate roots below show where tracked source exists.",
+            `   Source in this repository looks like it lives in: ${suggestion}`,
+            "   Declare it under quality.mutation.sourceDirs in .lisa.config.json.",
+          ].join("\n")
+        : '   Flip "enabled": true (and tune thresholds.break in stryker.conf.json) to turn it on.';
+      console.log(
+        `⚪ ${OUTCOMES.disabled} — mutation.gate.json says "enabled": false. Skipping.\n${detail}`
+      );
+      return finish(OUTCOMES.disabled, 0);
+    }
+
+    // Tracks whether a WORKING set of patterns was actually installed. The
+    // failure below keys on this rather than on `roots.length`, so a
+    // derivation that yields roots but no selectable file still fails closed
+    // instead of letting the gate run on the inert patterns it started with.
+    let substituted = false;
+    if (!declaration.sourceDirs && roots.length > 0) {
+      const derived = {
+        mutate: mutateFromSourceDirs(roots.map(entry => entry.root)),
+        source: `source roots derived from tracked files (${suggestion})`,
+        explicit: false,
+        overrideMutate: true,
+      };
+      const derivedPatterns = compileMutatePatterns(derived.mutate);
+      if (countMutateTargetsInRepo(cwd, derivedPatterns) > 0) {
+        substituted = true;
+        console.log(
+          `⚠️  ${declaration.source} select NO tracked file, and this project\n` +
+            "   declares no source directories. Deriving patterns from what the\n" +
+            `   repository tracks: ${suggestion}\n` +
+            "   Declare quality.mutation.sourceDirs in .lisa.config.json to make\n" +
+            "   this explicit and stop the guessing."
+        );
+        declaration = derived;
+        patterns = derivedPatterns;
+      }
+    }
+
+    if (!substituted) {
+      const where = suggestion
+        ? [
+            `   Source in this repository looks like it lives in: ${suggestion}`,
+            "   Declare it under quality.mutation.sourceDirs in .lisa.config.json,",
+            "   or widen `mutate` in your Stryker config.",
+          ].join("\n")
+        : [
+            "   No candidate source directory could be derived either, so this",
+            "   repository may simply have no mutable source yet.",
+          ].join("\n");
+      console.error(
+        [
+          `❌ ${OUTCOMES.inertConfig}`,
+          `   The mutate patterns from ${declaration.source} select NO tracked file`,
+          "   in this repository, so this gate can never generate a mutant and would",
+          "   report success on every run forever. That is not a pass — it is a gate",
+          "   that is switched on and wired to nothing.",
+          where,
+          "   Fix the `mutate` patterns in your Stryker config, or turn the gate off.",
+        ].join("\n")
+      );
+      return finish(OUTCOMES.inertConfig, 1);
+    }
+  } else if (!enabled) {
+    console.log(
+      `⚪ ${OUTCOMES.disabled} — mutation.gate.json says "enabled": false. Skipping.\n` +
+        '   Flip "enabled": true (and tune thresholds.break in stryker.conf.json) to turn it on.'
     );
-    return finish(OUTCOMES.inertConfig, 1);
+    return finish(OUTCOMES.disabled, 0);
   }
 
   const unparseable = selectUninstrumentableMutateTargets(cwd, patterns);
@@ -2662,7 +2931,10 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
       `🧬 ${OUTCOMES.wholeList} — Stryker over every pattern in ` +
         `${declaration.source}, with no diff scoping.`
     );
-    const reported = reportRun(cwd, runStryker(cwd, []), null);
+    // Stryker cannot read Lisa's sourceDirs or an in-memory derived list.
+    // Preserve native config loading unless resolution replaced that list.
+    const selected = declaration.overrideMutate ? declaration.mutate : [];
+    const reported = reportRun(cwd, runStryker(cwd, selected, true), null);
     return finish(OUTCOMES.wholeList, reported.code, reported.measured);
   }
 

package/typescript/copy-overwrite/scripts/threshold-ratchet-compare.mjs

@@ -21,6 +21,7 @@ import {
   extractStrykerConstraints,
   extractStrykerMutate,
   familyFor,
+  globRoot,
   parseJson,
 } from "./threshold-ratchet-families.mjs";
 
@@ -157,15 +158,56 @@ function compareStryker(relPath, base, current) {
   );
   const baseMutate = extractStrykerMutate(base);
   const currentMutate = extractStrykerMutate(current);
+  // Roots the gate already covered, and roots this change adds. An exclusion
+  // scoped to a newly added root narrows territory that was not being mutated
+  // a moment ago, so it cannot shrink the gate — the change is a net widening.
+  //
+  // Without this, repairing an INERT `mutate` list is unreachable without a
+  // human-approved ratchet exception: the repair necessarily adds source roots
+  // AND the test-file exclusions that belong with them, and every one of those
+  // exclusions read as a weakening. Measured on two repositories whose real
+  // effect was 0 -> 69 and 0 -> 75 files mutated (CodySwannGT/lisa#4243).
+  const baseRoots = [...baseMutate.positives].map(globRoot);
+  /**
+   * Whether an exclusion might touch any baseline positive.
+   *
+   * Both containment directions matter: excluding `src` removes a baseline
+   * rooted at `src/existing`, too. An empty prefix (wildcards, braces, classes
+   * or extglobs at the root) might cover everything. We grant an exemption
+   * only for provably disjoint territory, never from a guessed glob overlap.
+   * @param {string} root A rooted glob prefix
+   * @returns {boolean} True when overlap cannot be ruled out
+   */
+  const overlapsBase = root =>
+    baseRoots.some(
+      base =>
+        root === "" ||
+        base === "" ||
+        root === base ||
+        root.startsWith(`${base}/`) ||
+        base.startsWith(`${root}/`)
+    );
+  const addedRoots = [...currentMutate.positives]
+    .filter(positive => !baseMutate.positives.has(positive))
+    .map(globRoot)
+    .filter(root => root !== "");
+  /**
+   * Whether a root lies inside territory THIS change is adding.
+   * @param {string} root A rooted glob prefix
+   * @returns {boolean} True when an added root equals or contains it
+   */
+  const underAdded = root =>
+    addedRoots.some(added => root === added || root.startsWith(`${added}/`));
   for (const negation of currentMutate.negations) {
-    if (!baseMutate.negations.has(negation)) {
-      findings.push({
-        file: relPath,
-        key: `mutate ${negation}`,
-        type: TYPE_EXEMPTION_ADDED,
-        message: `${relPath}: new mutation-testing exclusion "${negation}" — excluding files from a gate is a weakening.`,
-      });
-    }
+    if (baseMutate.negations.has(negation)) continue;
+    const root = globRoot(negation);
+    if (!overlapsBase(root) && underAdded(root)) continue;
+    findings.push({
+      file: relPath,
+      key: `mutate ${negation}`,
+      type: TYPE_EXEMPTION_ADDED,
+      message: `${relPath}: new mutation-testing exclusion "${negation}" — excluding files from a gate is a weakening.`,
+    });
   }
   for (const positive of baseMutate.positives) {
     if (!currentMutate.positives.has(positive)) {

package/typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs

@@ -311,6 +311,30 @@ export function extractStrykerMutate(conf) {
   return { positives, negations };
 }
 
+/**
+ * The literal directory prefix a glob is rooted at, before any wildcard.
+ *
+ * `lib/**\/*.spec.ts` and `!lib/**\/*.d.ts` are both rooted at `lib`. This is
+ * what lets the ratchet tell territory a change ADDED from territory it
+ * already covered: an exclusion inside a newly added root cannot shrink a
+ * gate, because nothing there was being mutated a moment ago.
+ * @param {string} glob A stryker mutate entry, with or without a leading `!`
+ * @returns {string} The rooted prefix, or "" when the glob starts with a wildcard
+ */
+export function globRoot(glob) {
+  const bare = glob.startsWith("!") ? glob.slice(1) : glob;
+  // Backslash escapes and parent traversal make textual containment unsafe.
+  // An unknown prefix overlaps everything rather than granting an exemption.
+  if (bare.includes("\\") || bare.split("/").includes("..")) return "";
+  const rooted = [];
+  for (const segment of bare.split("/")) {
+    if (segment === "." || segment === "") continue;
+    if (["*", "?", "{", "[", "("].some(meta => segment.includes(meta))) break;
+    rooted.push(segment);
+  }
+  return rooted.join("/");
+}
+
 /**
  * Parse one k6 threshold expression (`p(95)<1000`, `rate>=0.99`, …) into a
  * ratchet constraint. Upper bounds (`<`, `<=`) may only decrease; lower

package/typescript/create-only/stryker.conf.json

@@ -12,6 +12,7 @@
   "timeoutMS": 60000,
   "_dryRunTimeoutMinutesComment": "Whole-suite liveness bound, set by dryRunTimeoutMinutes, for the single un-mutated run that measures every test before any mutant is generated. Stryker's 5-minute default is the one that fails first: a suite needing 159s on an idle box has under 2x margin, and none at all under load, and when it blows there is no score to report — the gate simply dies. 20 minutes is generous on purpose; a genuinely hung dry run still fails, just later, and CI's own job timeout still caps it. Absolute BY NECESSITY: this bounds the run that PRODUCES the timing measurement, so there is nothing yet measured to scale it against. It cannot be made adaptive the way a per-mutant budget can. The claim it makes is deliberately weak — not \"your dry run finishes in this long\" but \"a dry run still going at this point is wedged rather than slow\" — which is what lets one number hold across hardware nobody here has seen. It fails only where a HEALTHY dry run genuinely exceeds it, which takes a pathological environment rather than a slow one (a saturated temp directory can make a single mkdtemp cost seconds). In that case the environment is the bug and raising this number hides it — which is why the gate now reports a blown budget as `dry-run-timeout` naming this value, rather than as a mutation score.",
   "dryRunTimeoutMinutes": 20,
+  "_mutateComment": "Initial source-layout guess. Lisa mutation runs report when these patterns select no tracked files and derive source roots when quality.mutation.sourceDirs is absent. Declare that key in .lisa.config.json to set authoritative roots; it takes precedence in diff and --all runs. This create-only file stays project-owned.",
   "mutate": [
     "src/**/*.ts",
     "src/**/*.tsx",