Source → metamutant transform, expressed as an explicit pipeline over a small intermediate representation.

Rather than walk every node and then subtract the positions that must not be mutated (the old blacklist), the transform classifies each node's context positively, builds a plan, then renders it. The plan is three typed pieces:

• Mutare.Transform.ModulePlan — a statement sequence (a module body) classified into items: a clause group to lift, a clause group to keep in place, or any other statement. This is "module planning", separated from emission.
• Mutare.Transform.FunctionPlan — one liftable clause group: its signature, its clauses, a single shared tagged clause group, and the typed lifted candidates (Candidate.Lifted / Candidate.Drop) it admits.
• Mutare.Transform.Candidate — the typed, pre-id description of a single mutant. One struct per legal kind (see that module's moduledoc for the current set), so the redundant context/kind/operation triple (and its illegal combinations) is gone.

The stages, run per subtree:

1. Analyze + classify — analyze/3 is one context-threaded recursive descent: it names the context of each position as it descends and, for every node a mutator recognises in a mutating context, attaches a typed Candidate.InPlace to the node's own metadata (meta[:mutare]). Mutators run once, here. Routing is positional (the spec side of a :: goes one way, the value side another), which is why it can't be a flat Macro.traverse accumulator. Three contexts are threaded — :runtime (mutate, → in-place; :guard/:clause_drop/head-pattern literals come from the lift path), :pattern (don't mutate in place, but keep descending so default-arg values and size() args are reached), and :scaffold (a known compile-time module-level statement: descend but never mutate its own expressions — they run once at compile time, so a selector there is inert — yet still reach any explicit def body, which flips back to :runtime); the rest (:compile_time, :spec, :guard, :capture_arity) are recognised and pruned, producing no candidate.
2. Plan — a statement sequence is grouped into a ModulePlan; each liftable clause group becomes a FunctionPlan carrying its lifted candidates. No ids are assigned yet.
3. Assign — emission walks the plan and the annotated tree bottom-up and hands each candidate the next mutant id. Ids are assigned in post-order DFS and the counter advances even for ignored, unselected, and :skip_ids mutants. Ignore directives are matched against each recorded site's line, family, and variant before deciding whether to emit its code.
4. Emit — an in-place candidate becomes a tail-position selector case; a FunctionPlan becomes one private function (threading the active id as an extra arg) behind a dispatcher, each mutant a single guarded clause. Ignored, unselected, and poisoned mutants retain their sites but emit no code. A function holding two or more selector sites also keeps its source beside the instrumented code, as a clean region: a lifted group gains a copy of its original clauses, a clause that stays in place a second :do body, and one decision on the already-read id sends a mutation elsewhere to the source. Baseline/probe and the region's full id interval retain the instrumented path. Any source may be copied: a copy that fails to compile is attributed to its region, which poison recovery then drops (:skip_regions). A copied call still enters its callee through that callee's own dispatcher.
5. Render — annotations are stripped and the tree is rendered to source (with a Sourceror keyword-block workaround).

Carrying the Candidate.InPlace in the node's own metadata is what lets emission find "this exact node" without a fragile {line, column} identity: metadata is intrinsic to the node and rides through any Macro rebuild, so duplicate subtrees can never collide.

In-place selector (body expressions)

An operator inside a body is wrapped in a tail-position case reading the active mutant id from :persistent_term:

# source:   total >= threshold
case :persistent_term.get(:mutare_active, 0) do
  17 -> total > threshold     # mutant 17:  >= → >
  _  -> total >= threshold    # baseline + every other mutant
end

Substituting a node with a value-equivalent case preserves its position, so tail calls stay tail calls (LCO). Nested sites work because the catch-all holds the transformed children, reachable whenever an outer mutant is inactive.

A pipe stage is analyzed as the call it is sugar for (left |> stage(args) as stage(left, args) — WrittenPipe), so no selector ever lands on the right side of a pipe, where a case is illegal. Emission binds the piped value once, in a one-shot closure invoked on it (PipeEmit): lhs |> (fn v -> case … (each branch pipesv) … end).(). Each branch references a cheap variable — keeping a chain of mutated stages linear in the rendered source, where distributing lhs into every branch would copy the whole upstream chain per branch. The Site still records the stage as written, so the diff is unchanged.

The closure evaluates the piped value ahead of the stage, as an ordinary call does its first argument — and a call is ordinary in every respect its route does not address (Mutare.CallRouting, "Ordinary calls"). So it is used when the stage's first position is a value (unrouted, :expression or :interior); one routed :lazy_expression, or as syntax, is never evaluated ahead of the call. A mutant that moves or drops the piped value goes in a selector around the closure instead, evaluating its own expression in its own order. No stage reaches emission as a pipe: the rewritten calls are direct calls in the emitted tree (their mutant branches hold the as-written arguments, the catch-all the emitted ones), and Render spells each as the pipe it was written as. Code left as written — a :raw argument, a :skipped call — keeps its pipe untouched. Only Kernel's |> is treated as a pipe at all; one a module displaced is a call to that module's operator.

Function lifting + dispatcher (guards, dispatch)

A case is illegal in a when guard, and guards drive dispatch across clauses, so guard mutations (and head-pattern / clause-drop mutations) cannot be done in place. Instead the whole clause group becomes one private function that takes the active mutant id as an extra first arg (mutare_active); the public f/arity becomes a dispatcher that reads the id and forwards. Each source clause is emitted once as an original gated when mutare_active !== <id> for every mutant that overrides/drops it; each mutant adds a single clause gated when mutare_active === <id>, placed before the original it replaces:

def f(a) do
  mutare_active = :persistent_term.get(:mutare_active, 0)
  __mutare_f_1_g1(mutare_active, a)
end
defp __mutare_f_1_g1(mutare_active, a) when mutare_active === 5 and a > 1, do: ...  # mutant 5: guard >= → >
defp __mutare_f_1_g1(mutare_active, a) when mutare_active !== 5 and a >= 1, do: ... # original (in-place applies here)

Exactly one clause wins for any (id, args): the mutant when its id is active and its head/guard match, else the original. This is per-clause: a mutant touching one clause no longer copies the other N−1, so a group with C clauses and M mutants emits ~C+M clauses, not C×M (see NOTES "lifting blowup"). In-place selectors live only in the original clauses (and non-lifted code); a mutant clause reuses the raw body — sound because exactly one mutant is ever active. The public f/arity is unchanged at the module boundary.

Ranges are captured against the original AST, which is what the diff report patches against.

Implementation modules

Mutare.Transform.{ModulePlan,FunctionPlan,Candidate} define the intermediate representation — the plan structs and pure discovery (chunking clauses, finding guard/drop candidates). This module implements the top-level emission traversal and coordinates function lifting; focused delivery modules implement the smaller specialized paths, with shared selector mechanics factored through SelectorEmit.

Focused helper modules keep the pure node-building and the smaller specialized delivery paths out of this file:

• Mutare.Transform.ClauseAST — the shared def/defp clause shape and the primitives that navigate it (head/args/guards/when), used by both this module and FunctionPlan.
• Mutare.Transform.GuardBuild — the dispatch guards (<var> === <id> gate, exclusion, and-into), shared by the lifted and case paths.
• Mutare.Transform.LiftedEmit — the dispatcher + gated base clauses for a lifted group (the assembly half of emit_function_plan/2).
• Mutare.Transform.CleanRegion — the one decision that sends a mutation elsewhere to a function's uninstrumented source, the policy for when that repays its code, and the reader that lets a failing copy be blamed on its region.
• Mutare.Transform.CaseClauseEmit — the tuple-the-scrutinee delivery for per-clause case pattern/guard mutants.
• Mutare.Transform.FnClauseEmit — per-clause anonymous-function delivery, capturing the selector and recording head/guard coverage at closure creation.
• Mutare.Transform.ReceiveClauseEmit — per-clause receive delivery, preserving native mailbox order and one timeout evaluation; clause guards are shared with anonymous functions through Mutare.Transform.ClauseVariants.
• Mutare.Transform.ClauseGuardEmit — guard-only delivery for the clauses that can host no extra clause (with/for <-, with/try else, try catch, for … reduce: do): the guard becomes a gated guard sequence in place.
• Mutare.Transform.RescueEmit — shares protected bodies across rescue mutants when native handler dispatch can reuse an existing exception binding; other shapes retain whole-try selection.
• Mutare.Transform.BindingEscapeEmit — the tuple-export delivery for binding escaping = matches and known macros.
• Mutare.Transform.HostedEmit — the selector-host delivery for hosted DSL fragments.
• Mutare.Transform.ImportWitness — the dead-code import witness spliced alongside a mutated bare imported call.
• Mutare.Transform.CoverageEmit — scope-aware coverage gate emission and binding dependencies; delivery paths retain ownership of recording positions.
• Mutare.Transform.SelectorEmit — the shared id/site claim, selector subject, catch-all coverage branch, and ordinary selector-case assembly.