muterprater

The engine that damages a subject on purpose, to find out whether anybody would have noticed. Say it like mutater crossed with interpreter, because that is what it is — the instrument that plants the mutation and the interpreter loop that reads what firing it meant, one word because in this home they are one move.

A passing suite proves that the code you wrote agrees with the tests you wrote. It does not prove that the tests would object to code you did not write. This home breaks the subject in ways an owner has admitted, runs the witnesses again, and records which damages got through.

A damage that gets through is not a failure — it is a sentence you can act on: this claim has no judge for that kind of mistake.

The chain a kill has to walk

A word like “killed” is cheap. What makes it worth anything is that four independent questions were answered first, and each of them keeps its own seat:

A mutant “caught” by an already-failing suite proves nothing. A damage nothing reached says nothing about the suite that did not catch it. So a kill is minted by a constructor that walks those four in order, and a survivor cannot exist without a positive firing observation — which means a lane whose backend cannot observe firing reports inconclusive, never survived.

Reading one axis as another is how a harness grades itself green on a question it never asked.

Four evidence books, kept apart

Pressure arrives by four roads, and none of them can be relabelled into another after the fact.

• A wrapped external backend (wrap) reads cargo-mutants console output into the axis-composed record. It mutates real source and runs the test command itself, outside the wall. Persistent pressure carries one typed artifact manifest retaining backend, version, command tokens, target and toolchain, exact output identity, parser profile, and the exact revision of every source file named by a parsed report. Source currency is admitted only after those artifact revisions equal a complete caller-supplied current roster. Its ceiling remains witness rejection, because a console stream carries no channel that could watch a damage fire.
• A separately compiled projection (specimen) renders unchanged and selected source as bytes, hands both to a caller-owned compiler host, and requires the unchanged report to pass and the selected report to refuse.
• An in-process evaluation callable (interpret) is the rapid loop this instrument is named for: one compile, then selection among damages an owner already admitted.
• Structural rewrites (rewrite) are descriptors — a pattern and what it rewrites to — planned as audit candidates and admitted last.

Nothing here executes a subject on its own initiative. Every one of those roads ends at the harness’s ordinary trial binding and report vocabulary, so mutation pressure never becomes a second runner with opinions of its own.

What an owner declares, and what the harness refuses to guess

The harness knows nothing about what your code means, so every semantic fact is handed to it.

A producer offers discovery: sites, the unchanged operation at each, the alternative meanings it found, and where a selected alternative would fire. An owner offers policy: per claim, the operator families it is willing to have attacked. discover::lower_discoveries is the only road between the two, and it is all-or-nothing per site — one unpermitted family withholds the whole point rather than quietly narrowing what gets pressed. Every offered site stays in the reading with its disposition, so the denominator never shrinks silently.

Where a fact is genuinely unavailable, the harness says so instead of inventing it. A coordinate with no owning claim becomes OwnerUnmapped and widens the witness selection. A damage the operator-family bank does not name becomes OutsideTheBank. Neither is a guess dressed as an answer.

The order trust opens in

An in-process mutation result is the cheapest evidence to produce and the easiest to fool yourself with, so it is admitted last and only behind three earlier facts:

1. A qualified adapter. Somebody states that the console grammar this harness reads was checked against real output of the exact backend version a reading names. Nobody having checked is an honest posture to hold, and it opens no gate.
2. A generic suite bite. At least one lawful kill, read out of a current-source-qualified artifact under that qualified profile.
3. Exact projection pressure. One separately compiled selected artifact that a real witness really rejected — carrying with it the mandatory no-mutation parity, where production and the evaluation callable must agree on the same input before either is believed about a mutant.

Only then does interpreted execution run, and only for the one selection that pressure already covers.

Where a find goes

A survivor becomes an explanation: what survived, the claim that owns it, which kind of judge is missing, and the check that would close the gap. An explanation over a target with no owning claim is refused rather than guessed.

From there the road is candidate → staged proof → proposal → human. Candidates are proved in memory, against the complete authored table with the candidate overlaid. A claimed kill is demonstrated with the mutant active, never asserted. “Not a duplicate” is a comparison the constructor performs, not a paragraph a reviewer has to check.

A proposal is process-local until a caller’s own [ProposalSink] stores it — one of the crate’s two caller-owned storage seams, holding review material a human rules on; the other is the ReplayDepotSink, which replay-bearing admission additionally calls to store the admitted entry, and the two custodies never trade roles. Then a human admits it, explicitly, by calling the operation for its ground. Rust cannot authenticate who made that call, and this home does not pretend otherwise.

What this home never claims

• That the subject is correct. It measures whether the witnesses would object.
• That a mutant nothing reached tells you anything.
• That a reported coordinate still names the same bytes in your working tree.
• That a caller’s compiler host really ran a compiler. It records what the host reported, and binds it to the exact bytes and request it was given.
• That equivalence proven in one population holds in another.