Source → metamutant transform, expressed as an explicit pipeline over a small intermediate representation.

Rather than walk every node and then subtract the positions that must not be mutated (the old blacklist), the transform classifies each node's context positively, builds a plan, then renders it. The plan is three typed pieces:

• Mutare.Transform.ModulePlan — a statement sequence (a module body) classified into items: a clause group to lift, a clause group to keep in place, or any other statement. This is "module planning", separated from emission.
• Mutare.Transform.FunctionPlan — one liftable clause group: its signature, its clauses, a single shared tagged clause group, and the typed lifted candidates (Candidate.Lifted / Candidate.Drop) it admits.
• Mutare.Transform.Candidate — the typed, pre-id description of a single mutant. One struct per legal kind (see that module's moduledoc for the current set), so the redundant context/kind/operation triple (and its illegal combinations) is gone.

The stages, run per subtree:

1. Analyze + classify — analyze/3 is one context-threaded recursive descent: it names the context of each position as it descends and, for every node a mutator recognises in a mutating context, attaches a typed Candidate.InPlace to the node's own metadata (meta[:mutare]). Mutators run once, here. Routing is positional (the spec side of a :: goes one way, the value side another), which is why it can't be a flat Macro.traverse accumulator. Three contexts are threaded — :runtime (mutate, → in-place; :guard/:clause_drop/head-pattern literals come from the lift path), :pattern (don't mutate in place, but keep descending so default-arg values and size() args are reached), and :scaffold (a known compile-time module-level statement: descend but never mutate its own expressions — they run once at compile time, so a selector there is inert — yet still reach any explicit def body, which flips back to :runtime); the rest (:compile_time, :spec, :guard, :capture_arity) are recognised and pruned, producing no candidate.
2. Plan — a statement sequence is grouped into a ModulePlan; each liftable clause group becomes a FunctionPlan carrying its lifted candidates. No ids are assigned yet.
3. Assign — emission walks the plan and the annotated tree bottom-up and hands each candidate the next mutant id. Ids are assigned in post-order DFS and the counter advances even for :skip_ids, so ids stay stable across the poison-recovery rebuilds the runner relies on.
4. Emit — an in-place candidate becomes a tail-position selector case; a FunctionPlan becomes one private function (threading the active id as an extra arg) behind a dispatcher, each mutant a single guarded clause.
5. Render — annotations are stripped and the tree is rendered to source (with a Sourceror keyword-block workaround); # mutare:ignore directives (parsed by Mutare.Ignore) are applied to the recorded sites.

Carrying the Candidate.InPlace in the node's own metadata is what lets emission find "this exact node" without a fragile {line, column} identity: metadata is intrinsic to the node and rides through any Macro rebuild, so duplicate subtrees can never collide.

In-place selector (body expressions)

An operator inside a body is wrapped in a tail-position case reading the active mutant id from :persistent_term:

# source:   total >= threshold
case :persistent_term.get(:mutare_active, 0) do
  17 -> total > threshold     # mutant 17:  >= → >
  _  -> total >= threshold    # baseline + every other mutant
end

Substituting a node with a value-equivalent case preserves its position, so tail calls stay tail calls (LCO). Nested sites work because the catch-all holds the transformed children, reachable whenever an outer mutant is inactive.

One position the selector case is not legal in: the right side of a pipe. x |> case … end parses but fails to compile (Kernel.|>/2 cannot pipe into a case), so when a mutated node is a pipe stage, emission lifts the selector out of the pipe into a one-shot closure invoked on the piped value (PipeEmit.hoist/2): lhs |> (fn v -> case … (each branch pipesv) … end).(). The piped value is computed once (it stays the pipe's LHS) and bound to v, so each branch references a cheap variable — keeping a chain of mutated stages linear in the rendered source, where distributing lhs into every branch would copy the whole upstream chain per branch and blow up exponentially. The Site still records the bare stage, so the diff is unchanged.

Function lifting + dispatcher (guards, dispatch)

A case is illegal in a when guard, and guards drive dispatch across clauses, so guard mutations (and head-pattern / clause-drop mutations) cannot be done in place. Instead the whole clause group becomes one private function that takes the active mutant id as an extra first arg (mutare_active); the public f/arity becomes a dispatcher that reads the id and forwards. Each source clause is emitted once as an original gated when mutare_active !== <id> for every mutant that overrides/drops it; each mutant adds a single clause gated when mutare_active === <id>, placed before the original it replaces:

def f(a) do
  mutare_active = :persistent_term.get(:mutare_active, 0)
  __mutare_f_1_g1(mutare_active, a)
end
defp __mutare_f_1_g1(mutare_active, a) when mutare_active === 5 and a > 1, do: ...  # mutant 5: guard >= → >
defp __mutare_f_1_g1(mutare_active, a) when mutare_active !== 5 and a >= 1, do: ... # original (in-place applies here)

Exactly one clause wins for any (id, args): the mutant when its id is active and its head/guard match, else the original. This is per-clause: a mutant touching one clause no longer copies the other N−1, so a group with C clauses and M mutants emits ~C+M clauses, not C×M (see NOTES "lifting blowup"). In-place selectors live only in the original clauses (and non-lifted code); a mutant clause reuses the raw body — sound because exactly one mutant is ever active. The public f/arity is unchanged at the module boundary.

Ranges are captured against the original AST, which is what the diff report patches against.

Where the work lives

Mutare.Transform.{ModulePlan,FunctionPlan,Candidate} own the vocabulary — the plan structs and pure discovery (chunking clauses, finding guard/drop candidates). This module owns the top-level emission walk and the lifted-function orchestrator; focused delivery modules own the smaller specialized paths, with shared selector mechanics factored through SelectorEmit.

Focused helper modules keep the pure node-building and the smaller specialized delivery paths out of this file:

• Mutare.Transform.ClauseAST — the shared def/defp clause shape and the primitives that navigate it (head/args/guards/when), used by both this module and FunctionPlan.
• Mutare.Transform.GuardBuild — the dispatch guards (<var> === <id> gate, exclusion, and-into), shared by the lifted and case paths.
• Mutare.Transform.LiftedEmit — the dispatcher + gated base clauses for a lifted group (the assembly half of emit_function_plan/2).
• Mutare.Transform.CaseClauseEmit — the tuple-the-scrutinee delivery for per-clause case pattern/guard mutants.
• Mutare.Transform.BindingEscapeEmit — the tuple-export delivery for binding escaping = matches and known macros.
• Mutare.Transform.HostedEmit — the selector-host delivery for hosted DSL fragments.
• Mutare.Transform.ImportWitness — the dead-code import witness spliced alongside a mutated bare imported call.
• Mutare.Transform.SelectorEmit — the shared id/site claim, selector subject, catch-all coverage branch, and ordinary selector-case assembly.