evilution 1.3.0 → 1.4.0

data/docs/architecture.md

@@ -12,7 +12,10 @@ For deeper dives on two subsystems that have their own docs, see
 ## The one-paragraph version
 
 Evilution parses each target file with [Prism](https://github.com/ruby/prism)
-into an AST with exact byte offsets. Every method becomes a *subject*. Each
+into an AST with exact byte offsets. Every method becomes a *subject*, and so
+does every value-object definition outside a method (`Point = Data.define(:x)`)
+and every scope declared with a literal body (`scope :recent, -> { ... }`),
+and every guard or callback written out inside an AASM `event` or `state`. Each
 mutation *operator* walks a subject's AST and emits *mutations* — byte-range
 edits applied by source-level surgery (no AST unparsing). For every mutation,
 evilution copies the file, applies the edit, runs the covering specs in an
@@ -48,7 +51,7 @@ Everything lives under `lib/evilution/`.
 | `Config`, `Config::*` | Merge `.evilution.yml` + CLI flags + env, validate, freeze. | `config.rb`, `config/sources.rb`, `config/validators/*` |
 | `Runner`, `Runner::*` | Orchestrate the whole run. Each stage is its own collaborator. | `runner.rb`, `runner/*` |
 | `AST`, `Subject` | Prism parse, find method subjects, source surgery, pattern matching, heredoc spans. | `ast/parser.rb`, `ast/source_surgeon.rb`, `subject.rb` |
-| `Mutator`, `Mutator::Operator::*` | 111 operators (default profile) that emit byte-edits; registry + profiles. | `mutator/base.rb`, `mutator/registry.rb`, `mutator/operator/*` |
+| `Mutator`, `Mutator::Operator::*` | 136 operators (default profile) that emit byte-edits; registry + profiles. | `mutator/base.rb`, `mutator/registry.rb`, `mutator/operator/*` |
 | `Mutation` | An immutable mutation record (original/mutated sources, slice, location, parse status). | `mutation.rb` |
 | `SpecResolver`, `SpecSelector` | Map a source file to its covering spec files (layout heuristics + explicit mappings). | `spec_resolver.rb`, `spec_selector.rb` |
 | `Isolation::{Fork,InProcess}`, `ProcessSupervisor` | Run one mutation's tests in isolation; process-group lifecycle, sandboxing, TERM/KILL ladder. | `isolation/fork.rb`, `process_supervisor.rb` |
@@ -105,13 +108,34 @@ class that owns it.
 2. **Subjects** — `Runner::SubjectPipeline#call` resolves target files (explicit,
    `source:<glob>`, or `Git::ChangedFiles`), then `AST::Parser#call` runs
    `Prism.parse` and `AST::SubjectFinder` (a `Prism::Visitor`) emits one
-   `Evilution::Subject` per `def` node. Optional descendant/target/line-range filters follow.
+   `Evilution::Subject` per `def` node (kind `:method`), plus one per
+   `Data.define` / `Struct.new` assigned to a constant or used as a superclass
+   outside any method (kind `:constant`, named after the constant), plus one per
+   `scope :name, -> { }` / `lambda { }` / `proc { }` written directly in a class
+   body (kind `:scope`, named `Class.name` after the class method it defines;
+   it spans the declaration and its node is the body; a scope declared in a
+   concern's `included do ... end` is named after the concern), plus one per literal
+   callable inside an `event` or `state` of a class-body `aasm do ... end` --
+   keyword values (`guard: -> { }`, also inside arrays), those of the event's
+   `transitions`, and callback blocks (`before { }`) -- kind `:aasm`, named
+   `Class#event` / `Class#state?` after the method the declaration defines, so
+   one event may contribute several subjects of the same name (a machine in a
+   concern's `included do ... end` is found too, and named after the concern);
+   and one per
+   literal callable of a class-body callback or validation declaration
+   (`validate`, `validates`, `validates_*`, `before_*`, `after_*`, `around_*`)
+   -- an `if:` / `unless:` condition, or the callback itself as a block or
+   lambda -- kind `:callback`, named as the declaration reads
+   (`Order.validate(:credit_limit)`, `Order.before_save`; one in a concern's
+   `included do ... end` is named after the concern). Optional
+   descendant/target/line-range filters follow.
 3. **Baseline** — `Runner::BaselineRunner#call` builds the integration from
    `Runner::INTEGRATIONS` (`rspec`/`minitest`/`test_unit`) and records spec files
    that already fail *before* any mutation, so their mutations aren't miscounted.
    An optional `Runner::Canary` proves the pipeline can observe a known mutation.
 4. **Mutations** — `Runner::MutationPlanner#call` flat-maps subjects through
-   `Mutator::Registry#mutations_for`. The registry instantiates each operator and
+   `Mutator::Registry#mutations_for`. The registry instantiates each operator whose
+   `subject_kinds` include the subject's kind (`:method`, `:scope`, `:aasm` and `:callback` by default) and
    runs `operator.call(subject, filter:)`; each operator subclasses
    `Mutator::Base` and calls `add_mutation`, which runs `AST::SourceSurgeon` and
    builds an immutable `Evilution::Mutation`. The planner then **deduplicates**
@@ -142,11 +166,20 @@ class that owns it.
    `Isolation::Fork#classify_status`: `:timeout` → `:killed` (crash) →
    `:unresolved` → `:error` → `:survived` (tests passed) → default `:killed`.
    A `NeutralizationPipeline` can reclassify results into `:neutral` — either
-   because the covering spec already failed at baseline (`Neutralizer::BaselineFailed`)
-   or because the test process crashed on infrastructure rather than on the
-   mutation (`Neutralizer::InfraError`). Each records a `Result::NeutralReason`,
-   since the two want opposite responses. A survivor is re-run against its whole
-   spec file before it is reported (`Integration::RSpec#confirm_survivor?`), so a
+   because the tests failed on nothing but examples that were already failing
+   at baseline (`Neutralizer::BaselineFailed`) or because the test process
+   crashed on infrastructure rather than on the mutation
+   (`Neutralizer::InfraError`). Each records a `Result::NeutralReason`, since
+   the two want opposite responses. For the first, the baseline reports the
+   ids of its failing examples (`Integration::RSpec::ExampleIds`, absolute path
+   plus position, so they compare across working directories;
+   `Integration::Minitest::TestIds`, `Class#test`;
+   `Integration::TestUnit::TestIds`, `test(Class)`), the integration is built
+   with them (`known_failures:`, held as `Integration::KnownFailures`), and a
+   failed run whose failed examples are all among them comes back flagged
+   `known_failures_only`; a survivor is never neutralized. A survivor is re-run
+   against its whole spec file before it is reported
+   (`Integration::RSpec#confirm?`), as is a targeted run flagged that way, so a
    narrowed example set cannot invent one; after a parallel pass,
    `MutationExecutor::InfraRetry` re-runs the infrastructure-neutralised
    mutations serially, once the contention that caused them is gone.
@@ -193,6 +226,53 @@ A mutator is a `Prism::Visitor` subclass that emits byte-range edits.
    - The operator's registered name is auto-derived from the class name
      (`MyThing` → `my_thing`); that string is the `operator` field in JSON output
      and is part of the public contract, so name it deliberately.
+   - Operators see method, scope, aasm and callback subjects. One that also applies to value-object
+     definitions outside a method overrides `self.subject_kinds` to return
+     `%i[method constant]`; a constant subject's node is the definition's
+     `CallNode`.
+   - A scope subject's mutation only takes effect if the mutated file re-runs
+     its `scope` call, which `BodyCallNeutralizer` would otherwise blank: the
+     eval source keeps that one call (`keep_offset`). Its `restore_source` is
+     the original file with the same call kept; `Integration::Base#call`
+     evaluates it after the tests, since in-process runs restore methods only
+     by re-evaluating the next mutation's source, where scopes are blanked.
+   - A scope in a concern's `included` block has two audiences. The kept
+     `included` call registers the mutated block for classes that include the
+     concern later (`ConcernStateCleaner` clears the old one first, on apply
+     and on restore: a concern ignores a block handed to it twice from the
+     same place). For classes that include it already, the eval source guards
+     every other call of the block with `ConcernRedeclaration.skipping?` and
+     follows the block with `ConcernRedeclaration.call(self)`, which runs the
+     block on each of them with the guard up, so only the scope is declared
+     again. Both additions go on existing lines; no line number moves.
+   - A callback subject's declaration is kept too, wrapped in
+     `CallbackRedeclaration.call(self, __FILE__, lines) { ... }`. Callbacks do
+     not replace on re-declaration: a symbol callback moves to the end of its
+     chain, a block or validator is added beside the first. The helper reads
+     the chains, runs the declaration and rebuilds them through
+     `__update_callbacks`, so the new callbacks sit where the ones this
+     declaration registered before were. Those are found by the source
+     location of their procs the first time (`lines` is the declaration's
+     range in the file as loaded) and from the helper's own record afterwards,
+     since a mutation may add or remove lines. In a concern's `included` block
+     the declaration is wrapped the same way inside the kept block, whose
+     other calls are guarded: run on a class that includes the concern already
+     it replaces that class's callbacks in place, run by a class including it
+     later it simply declares. `BodyCallNeutralizer` leaves a blanked call's
+     line breaks behind, so the evaluated source keeps the file's line numbers
+     and a class loaded during one mutation can be matched by location in the
+     next.
+   - An aasm subject works the same way, one level down: the `aasm` call is
+     kept, and inside its block every declaration but the `event` or `state`
+     holding the mutation is blanked. AASM stores what an event or state holds
+     by value, so re-running one replaces it; the machine's own callbacks
+     (`after_all_transitions`) accumulate, which is why the rest of the block
+     must not run again and why they get no subjects. For a machine inside a
+     concern's `included` block the two mechanisms combine: the block is kept
+     and followed by `ConcernRedeclaration.call(self)`, and both its other
+     calls and the machine's other declarations are guarded with
+     `ConcernRedeclaration.skipping?` instead of blanked -- a class that
+     includes the concern later needs the whole machine.
 
 2. **Require it** in `lib/evilution.rb` alongside the other
    `require_relative "evilution/mutator/operator/..."` lines.

data/docs/ast_pattern_syntax.md

@@ -66,6 +66,29 @@ after calling `.to_s` on both sides:
 call{name=log}       # matches when node.name.to_s == "log"
 ```
 
+**Method names** that end in `?`, `!` or `=` are written as they are, and so are
+operator methods:
+
+```
+call{name=valid?}          # record.valid?
+call{name=strip_sources!}  # strip_sources!
+call{name=value=}          # record.value = 1
+call{name=<=>}             # a <=> b
+call{name=-@}              # -a (unary minus)
+```
+
+The bare operators are `<=>`, `===`, `==`, `=~`, `[]=`, `[]`, `<=`, `<<`, `<`,
+`>=`, `>>`, `>`, `+@`, `-@`, `+`, `-`, `/`, `%`, `&`, `^` and `~`. Any other
+name — `|`, `!`, `!=`, `!~`, `*`, `**`, a backtick — goes in single or double
+quotes, since unquoted these characters mean alternation, negation or a wildcard.
+A quoted name is matched literally:
+
+```
+call{name='|'}       # a | b, not an alternation
+call{name='*'}       # a * b, not a wildcard
+call{name='!='}      # a != b, not a negation
+```
+
 **Alternatives** use `|` (OR logic) within a single attribute value:
 
 ```
@@ -139,6 +162,13 @@ ignore_patterns:
 
   # Suppress mutations on constant `ENV` reads
   - "call{receiver=constant_read{name=ENV}}"
+
+  # Suppress mutations on bang and predicate calls, and on `<=>`
+  - "call{name=strip_sources!|eager_load!|valid?}"
+  - "call{name=<=>}"
+
+  # Quote names made of reserved characters
+  - "call{name='|'}"
 ```
 
 ## Pattern Matching Semantics
@@ -164,12 +194,21 @@ value          = "!" value
                | "*"
 nested_pattern = node_type "{" attributes "}"
 alternatives   = atom { "|" atom }
-atom           = identifier | "*"
+atom           = name | "*"
+name           = identifier [ "?" | "!" | "=" ]
+               | operator
+               | "'" { any character except "'" } "'"
+               | '"' { any character except '"' } '"'
+operator       = "<=>" | "===" | "==" | "=~" | "[]=" | "[]" | "<=" | "<<" | "<"
+               | ">=" | ">>" | ">" | "+@" | "-@" | "+" | "-" | "/" | "%"
+               | "&" | "^" | "~"
 identifier     = [a-zA-Z_] [a-zA-Z0-9_]*
 ```
 
-A bare `identifier` without `{` is parsed as a scalar value (matched via `.to_s`).
-An `identifier` followed by `{` is parsed as a nested pattern.
+A bare `name` without `{` is parsed as a scalar value (matched via `.to_s`).
+An `identifier` followed by `{` is parsed as a nested pattern. Operators are
+read longest first, so `<=>` is never taken for `<=`. Node types and attribute
+names are always plain identifiers. A quoted name is at least one character long.
 
 ## Examples
 
@@ -183,6 +222,9 @@ An `identifier` followed by `{` is parsed as a nested pattern.
 | `call{receiver=**}` | `foo()`, `x.foo()`, `a.b.foo()` | *(matches all)* |
 | `def{name=to_s}` | `def to_s; ... end` | `def to_str; ... end` |
 | `call{name=!log}` | `debug()`, `info()` | `log()` |
+| `call{name=valid?\|save!}` | `x.valid?`, `save!` | `valid`, `save` |
+| `call{name=<=>}` | `a <=> b` | `a <= b` |
+| `call{name='\|'}` | `a \| b` | `a & b` |
 
 ## Design Decisions
 
@@ -191,8 +233,11 @@ An `identifier` followed by `{` is parsed as a nested pattern.
    write patterns immediately.
 
 2. **Unquoted values**: Attribute values don't require quotes. This keeps YAML clean
-   and avoids escaping issues. The tradeoff is that values cannot contain `{`, `}`,
-   `,`, `=`, `|`, or `!` — these are reserved syntax characters.
+   and avoids escaping issues. Method names ending in `?`, `!` or `=` and operators
+   that cannot be confused with pattern syntax are written bare too. Only names
+   built from reserved characters (`|`, `!`, `*`) or characters outside a method
+   name need quotes; there is no escaping inside them. In YAML, use one kind of
+   quote for the YAML string and the other inside it: `- "call{name='|'}"`.
 
 3. **Implicit wildcards for unspecified attributes**: `call{name=log}` matches
    regardless of receiver, arguments, etc. Only specified attributes constrain the

data/docs/isolation.md

@@ -22,8 +22,8 @@ transaction block with a half-delivered exception. The mask is
 [load-bearing for transaction correctness][rails-handle-interrupt].
 
 That mask interacts badly with `Timeout.timeout`. The Timeout gem schedules a
-timer thread which fires `Thread#raise Timeout::Error` at the main thread when
-the deadline hits. Ruby receives the `raise`, inspects the interrupt mask, sees
+timer thread which fires `Thread#raise` at the main thread when the deadline
+hits. Ruby receives the `raise`, inspects the interrupt mask, sees
 `Exception => :never`, and **queues the exception for later delivery** — "later"
 meaning "when the masked block exits". If the mutant is stuck in an infinite
 loop inside the transaction, the block never exits, the queued exception is
@@ -57,6 +57,26 @@ The same hazard applies to any Ruby code that uses
 blocks that wrap "must complete" sections. If your target code can touch any
 of those, prefer `--isolation fork`.
 
+## How `in_process` ends a run that is out of time
+
+The timeout raises `Evilution::Isolation::InProcess::Expired` into the run. It
+is a `SignalException`, not a `Timeout::Error`, because it has to end the
+whole test run. A test framework rescues nearly everything a test raises:
+handed a `Timeout::Error`, it records one failed test and moves on to the
+next, which may reach the same endless loop with no timer left to stop it.
+Minitest, Test::Unit and RSpec all let a `SignalException` through, so the run
+stops at once and the mutation is reported as timed out rather than killed.
+
+It is not an `Interrupt` either. Tooling that handles Ctrl-C — maxitest, for
+one — rescues `Interrupt` and skips every test from then on, which would turn
+each later mutation in the process into a survivor.
+
+One raise is all there is. Code under test, or a test, that rescues
+`Exception` or `SignalException` and then loops again cannot be stopped from
+inside its own process; use `--isolation fork` for it. The same goes for a
+mutant that crashes the Ruby VM: under `fork` that costs one child, under
+`in_process` the whole run.
+
 ## Parent-process preload
 
 Fork isolation's one downside is that every child pays the cost of loading
@@ -132,6 +152,23 @@ the MCP server is a long-lived process that handles runs from different
 projects — preloading one project's Rails stack into a shared process would
 poison subsequent runs.
 
+## Test files under `in_process` (Minitest, Test::Unit)
+
+Under `in_process` one process runs every mutation, and Minitest and
+Test::Unit learn of a test class only when it is first defined: loading its
+file a second time reopens the class and registers nothing. Each test file is
+therefore loaded once per process, and the classes it registered are
+dispatched again for every later mutation
+(`Integration::Loading::TestClassCache`).
+
+The consequence is that code in the body of a test file runs once. Tests
+generated at load time from the code under test (`OPS.each { |op|
+define_method("test_#{op}") { … } }`) keep the set built on the first load,
+and state held on a test class carries over from one mutation to the next.
+Under `fork` every child loads the file itself, so use `--isolation fork` for
+a suite that depends on either. RSpec is unaffected: it is reset and its spec
+files are loaded again for each mutation.
+
 ## Sandboxed working directory
 
 Every isolator runs `test_command.call` inside a per-mutation scratch

data/docs/migration-from-mutant.md

@@ -142,7 +142,7 @@ Key-by-key:
 | `matcher.ignore` | `ignore_patterns` / `# evilution:disable` | AST patterns or inline comments |
 | `fail_fast` | `fail_fast` | integer N or `null` |
 | `--score` gate (CLI; default `1.0`) | `min_score` | evilution defaults to `0.0` — set your own gate |
-| _(n/a)_ | `profile: strict` | opt into aggressive truthiness mutators |
+| _(n/a)_ | `profile: strict` | opt into aggressive mutators (truthiness, swallowed errors, statement order) |
 
 Run `evilution init` for a fully commented template, and point your editor at
 `schema/evilution.config.schema.json` for autocomplete/validation.

data/lib/evilution/ast/aasm_declaration.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../ast"
+require_relative "literal_callable"
+
+# The guards and callbacks of an AASM state machine that are written out as
+# literal callables:
+#
+#   aasm do
+#     state :paid, before_exit: -> { ... }
+#     event :ship, guard: -> { ... } do
+#       before { ... }
+#       transitions from: :paid, to: :shipped, guard: -> { ... }
+#     end
+#   end
+#
+# Each belongs to the `event` or `state` declaration it is written in. AASM
+# keeps what a declaration holds by value, so running that one declaration
+# again replaces it, and a mutated body takes effect. The machine's own
+# callbacks (`after_all_transitions`) accumulate instead, and are left out.
+#
+# Only a receiver-less `aasm` call with a block, written directly in a class
+# body, counts: that is the call the mutated file re-runs.
+module Evilution::AST::AasmDeclaration
+  # body: the node holding the callable's body. declaration: its `event` or
+  # `state` call. method_name: the instance method that declaration defines.
+  Callable = Data.define(:body, :declaration, :method_name)
+
+  DECLARATIONS = %i[event state].freeze
+  EVENT_CALLBACKS = %i[
+    before before_transaction before_success success after after_transaction after_commit error ensure
+  ].freeze
+  private_constant :DECLARATIONS, :EVENT_CALLBACKS
+
+  # The callables of every machine among a class body's direct statements.
+  def self.in_body(body)
+    statements_of(body).flat_map { |node| machine_callables(node) }
+  end
+
+  # The block of an `aasm` call, or nil when node is not one.
+  def self.machine_block(node)
+    return nil unless node.is_a?(Prism::CallNode) && node.name == :aasm && node.receiver.nil?
+
+    node.block if node.block.is_a?(Prism::BlockNode)
+  end
+
+  # The name specs call for whatever sits on a line of a machine: the event,
+  # or the first state, declared there. nil outside every declaration.
+  def self.token_at(machine, line)
+    declaration = declarations_of(machine).find do |node|
+      line.between?(node.location.start_line, node.location.end_line)
+    end
+    declaration && declared_name(declaration)
+  end
+
+  def self.machine_callables(machine)
+    declarations_of(machine).flat_map do |declaration|
+      bodies_of(declaration).map do |body|
+        Callable.new(body: body, declaration: declaration, method_name: method_name(declaration))
+      end
+    end
+  end
+
+  def self.declarations_of(machine)
+    block = machine_block(machine)
+    return [] unless block
+
+    statements_of(block.body).select { |node| declaration?(node) }
+  end
+
+  def self.declaration?(node)
+    bare_call?(node) && DECLARATIONS.include?(node.name) && arguments_of(node).first.is_a?(Prism::SymbolNode)
+  end
+
+  def self.declared_name(declaration)
+    arguments_of(declaration).first.unescaped
+  end
+
+  # `event :ship` defines `ship`; `state :paid` defines `paid?`.
+  def self.method_name(declaration)
+    declaration.name == :event ? declared_name(declaration) : "#{declared_name(declaration)}?"
+  end
+
+  def self.bodies_of(declaration)
+    keyword_bodies(declaration) + (declaration.name == :event ? event_block_bodies(declaration) : [])
+  end
+
+  # What an event's block holds: its transitions, with keyword callables of
+  # their own, and callbacks given as blocks (`before { }`).
+  def self.event_block_bodies(event)
+    return [] unless event.block.is_a?(Prism::BlockNode)
+
+    statements_of(event.block.body).select { |node| bare_call?(node) }.flat_map do |node|
+      if node.name == :transitions then keyword_bodies(node)
+      elsif callback_block?(node) then [node.block]
+      else []
+      end
+    end
+  end
+
+  def self.callback_block?(node)
+    EVENT_CALLBACKS.include?(node.name) && node.arguments.nil? && node.block.is_a?(Prism::BlockNode)
+  end
+
+  # `guard: -> { }` and `guards: [-> { }, :named]` alike.
+  def self.keyword_bodies(call)
+    keywords = arguments_of(call).last
+    return [] unless keywords.is_a?(Prism::KeywordHashNode)
+
+    keywords.elements.grep(Prism::AssocNode).flat_map do |pair|
+      values = pair.value.is_a?(Prism::ArrayNode) ? pair.value.elements : [pair.value]
+      values.filter_map { |value| Evilution::AST::LiteralCallable.body_of(value) }
+    end
+  end
+
+  def self.bare_call?(node)
+    node.is_a?(Prism::CallNode) && node.receiver.nil?
+  end
+
+  def self.arguments_of(call)
+    call.arguments ? call.arguments.arguments : []
+  end
+
+  def self.statements_of(body)
+    body = body.statements if body.is_a?(Prism::BeginNode)
+    body.is_a?(Prism::StatementsNode) ? body.body : []
+  end
+
+  private_class_method :machine_callables, :declarations_of, :declaration?, :declared_name, :method_name,
+                       :bodies_of, :event_block_bodies, :callback_block?, :keyword_bodies, :bare_call?,
+                       :arguments_of, :statements_of
+end

data/lib/evilution/ast/callback_declaration.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../ast"
+require_relative "literal_callable"
+
+# The callables written out in a callback or validation declaration of a
+# class body:
+#
+#   validate :credit_limit, if: -> { paid? && total.positive? }
+#   validates :title, presence: true, unless: [-> { draft? }, :imported?]
+#   before_save { self.slug = title.parameterize }
+#   after_commit -> { notify }, on: :create
+#
+# That is the condition given to `if:` / `unless:`, and the callback itself
+# when it is a block or a lambda. A condition or callback named by a symbol
+# is a method, and a subject of its own already.
+#
+# Declarations are recognised by name -- `validate`, `validates`,
+# `validates_*`, `before_*`, `after_*`, `around_*` -- and only receiver-less,
+# directly in a class body: that is the call the mutated file re-runs.
+module Evilution::AST::CallbackDeclaration
+  # body: the node holding the callable's body. declaration: the call it is
+  # written in. label: how the declaration reads, for naming the subject.
+  Callable = Data.define(:body, :declaration, :label)
+
+  NAME = /\A(?:validate|validates|validates_\w+|(?:before|after|around)_\w+)\z/
+  CONDITIONS = %w[if unless].freeze
+  private_constant :NAME, :CONDITIONS
+
+  # The callables of every callback declaration among a class body's direct
+  # statements.
+  def self.in_body(body)
+    statements = body.is_a?(Prism::BeginNode) ? body.statements : body
+    return [] unless statements.is_a?(Prism::StatementsNode)
+
+    statements.body.select { |node| match?(node) }.flat_map { |declaration| callables(declaration) }
+  end
+
+  # Whether node is a callback declaration that can be run again on its own.
+  # One holding a heredoc cannot be wrapped on its own lines, and is left out.
+  def self.match?(node)
+    node.is_a?(Prism::CallNode) && node.receiver.nil? && NAME.match?(node.name.to_s) && !heredoc?(node)
+  end
+
+  def self.callables(declaration)
+    label = label_of(declaration)
+    bodies_of(declaration).map { |body| Callable.new(body: body, declaration: declaration, label: label) }
+  end
+
+  # `validate :credit_limit, if: ...` reads as `validate(:credit_limit)`; a
+  # declaration naming nothing, as its own name.
+  def self.label_of(declaration)
+    named = arguments_of(declaration).find { |argument| argument.is_a?(Prism::SymbolNode) }
+    named ? "#{declaration.name}(:#{named.unescaped})" : declaration.name.to_s
+  end
+
+  def self.bodies_of(declaration)
+    arguments = arguments_of(declaration)
+    bodies = arguments.filter_map { |argument| Evilution::AST::LiteralCallable.body_of(argument) }
+    bodies.concat(condition_bodies(arguments.last))
+    bodies << declaration.block if declaration.block.is_a?(Prism::BlockNode)
+    bodies
+  end
+
+  # `if: -> { }` and `unless: [-> { }, :named]` alike.
+  def self.condition_bodies(keywords)
+    return [] unless keywords.is_a?(Prism::KeywordHashNode)
+
+    keywords.elements.select { |pair| condition?(pair) }.flat_map do |pair|
+      values = pair.value.is_a?(Prism::ArrayNode) ? pair.value.elements : [pair.value]
+      values.filter_map { |value| Evilution::AST::LiteralCallable.body_of(value) }
+    end
+  end
+
+  def self.condition?(pair)
+    pair.is_a?(Prism::AssocNode) && pair.key.is_a?(Prism::SymbolNode) && CONDITIONS.include?(pair.key.unescaped)
+  end
+
+  def self.arguments_of(call)
+    call.arguments ? call.arguments.arguments : []
+  end
+
+  def self.heredoc?(node)
+    return true if node.respond_to?(:heredoc?) && node.heredoc?
+
+    node.compact_child_nodes.any? { |child| heredoc?(child) }
+  end
+
+  private_class_method :callables, :label_of, :bodies_of, :condition_bodies, :condition?, :arguments_of, :heredoc?
+end

data/lib/evilution/ast/included_block.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../ast"
+
+# The block of an `ActiveSupport::Concern`'s `included do ... end`: code
+# written in a module body that runs in the body of each class including the
+# module. Only the receiver-less, argument-less form with a literal block
+# counts -- `def self.included(base)` and `included(base) { }` are plain Ruby
+# hooks with rules of their own.
+module Evilution::AST::IncludedBlock
+  # The block node, or nil when node is not an `included` block call.
+  def self.of(node)
+    return nil unless node.is_a?(Prism::CallNode) && node.name == :included
+    return nil unless node.receiver.nil? && node.arguments.nil?
+
+    node.block if node.block.is_a?(Prism::BlockNode)
+  end
+
+  # The included blocks among a module body's direct statements.
+  def self.in_body(body)
+    statements = body.is_a?(Prism::BeginNode) ? body.statements : body
+    return [] unless statements.is_a?(Prism::StatementsNode)
+
+    statements.body.filter_map { |node| of(node) }
+  end
+end

data/lib/evilution/ast/literal_callable.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../ast"
+
+# A callable written out where it is used: `-> { }`, `lambda { }` or
+# `proc { }`. Its body is what mutations go into. A constant, a variable or
+# `method(:name)` in the same place has no body of its own to mutate.
+module Evilution::AST::LiteralCallable
+  BLOCK_CALLS = %i[lambda proc].freeze
+  private_constant :BLOCK_CALLS
+
+  # The node holding the callable's body -- a LambdaNode, or the BlockNode of
+  # a `lambda` / `proc` call -- or nil when node is not a literal callable.
+  def self.body_of(node)
+    return node if node.is_a?(Prism::LambdaNode)
+    return nil unless node.is_a?(Prism::CallNode) && node.receiver.nil? && BLOCK_CALLS.include?(node.name)
+
+    node.block if node.block.is_a?(Prism::BlockNode)
+  end
+end