evilution 1.4.0 → 1.5.0

data/docs/architecture.md

@@ -13,9 +13,12 @@ For deeper dives on two subsystems that have their own docs, see
 
 Evilution parses each target file with [Prism](https://github.com/ruby/prism)
 into an AST with exact byte offsets. Every method becomes a *subject*, and so
-does every value-object definition outside a method (`Point = Data.define(:x)`)
-and every scope declared with a literal body (`scope :recent, -> { ... }`),
-and every guard or callback written out inside an AASM `event` or `state`. Each
+does every value-object definition outside a method (`Point = Data.define(:x)`),
+every other constant assignment outside a method (`LIMIT = 10`), every scope
+declared with a literal body (`scope :recent, -> { ... }`), every guard or
+callback written out inside an AASM `event` or `state`, and the conditions and
+bodies of callback and validation declarations — in a class body or in a
+concern's `included` / `prepended` block. Each
 mutation *operator* walks a subject's AST and emits *mutations* — byte-range
 edits applied by source-level surgery (no AST unparsing). For every mutation,
 evilution copies the file, applies the edit, runs the covering specs in an
@@ -51,7 +54,7 @@ Everything lives under `lib/evilution/`.
 | `Config`, `Config::*` | Merge `.evilution.yml` + CLI flags + env, validate, freeze. | `config.rb`, `config/sources.rb`, `config/validators/*` |
 | `Runner`, `Runner::*` | Orchestrate the whole run. Each stage is its own collaborator. | `runner.rb`, `runner/*` |
 | `AST`, `Subject` | Prism parse, find method subjects, source surgery, pattern matching, heredoc spans. | `ast/parser.rb`, `ast/source_surgeon.rb`, `subject.rb` |
-| `Mutator`, `Mutator::Operator::*` | 136 operators (default profile) that emit byte-edits; registry + profiles. | `mutator/base.rb`, `mutator/registry.rb`, `mutator/operator/*` |
+| `Mutator`, `Mutator::Operator::*` | 155 operators (default profile) that emit byte-edits; registry + profiles. | `mutator/base.rb`, `mutator/registry.rb`, `mutator/operator/*` |
 | `Mutation` | An immutable mutation record (original/mutated sources, slice, location, parse status). | `mutation.rb` |
 | `SpecResolver`, `SpecSelector` | Map a source file to its covering spec files (layout heuristics + explicit mappings). | `spec_resolver.rb`, `spec_selector.rb` |
 | `Isolation::{Fork,InProcess}`, `ProcessSupervisor` | Run one mutation's tests in isolation; process-group lifecycle, sandboxing, TERM/KILL ladder. | `isolation/fork.rb`, `process_supervisor.rb` |
@@ -114,20 +117,23 @@ class that owns it.
    `scope :name, -> { }` / `lambda { }` / `proc { }` written directly in a class
    body (kind `:scope`, named `Class.name` after the class method it defines;
    it spans the declaration and its node is the body; a scope declared in a
-   concern's `included do ... end` is named after the concern), plus one per literal
+   concern's `included do ... end` or `prepended do ... end` is named after the
+   concern), plus one per literal
    callable inside an `event` or `state` of a class-body `aasm do ... end` --
    keyword values (`guard: -> { }`, also inside arrays), those of the event's
    `transitions`, and callback blocks (`before { }`) -- kind `:aasm`, named
    `Class#event` / `Class#state?` after the method the declaration defines, so
    one event may contribute several subjects of the same name (a machine in a
-   concern's `included do ... end` is found too, and named after the concern);
+   concern's `included do ... end` or `prepended do ... end` is found too, and
+   named after the concern);
    and one per
    literal callable of a class-body callback or validation declaration
    (`validate`, `validates`, `validates_*`, `before_*`, `after_*`, `around_*`)
    -- an `if:` / `unless:` condition, or the callback itself as a block or
    lambda -- kind `:callback`, named as the declaration reads
    (`Order.validate(:credit_limit)`, `Order.before_save`; one in a concern's
-   `included do ... end` is named after the concern). Optional
+   `included do ... end` or `prepended do ... end` is named after the concern).
+   Optional
    descendant/target/line-range filters follow.
 3. **Baseline** — `Runner::BaselineRunner#call` builds the integration from
    `Runner::INTEGRATIONS` (`rspec`/`minitest`/`test_unit`) and records spec files
@@ -138,7 +144,10 @@ class that owns it.
    `subject_kinds` include the subject's kind (`:method`, `:scope`, `:aasm` and `:callback` by default) and
    runs `operator.call(subject, filter:)`; each operator subclasses
    `Mutator::Base` and calls `add_mutation`, which runs `AST::SourceSurgeon` and
-   builds an immutable `Evilution::Mutation`. The planner then **deduplicates**
+   builds an immutable `Evilution::Mutation`. Whether the mutated source parses
+   is `AST::SyntaxCheck`'s call: Prism first and, on an interpreter that
+   compiles with parse.y (Ruby 3.3, or `--parser=parse.y`), parse.y as well,
+   since the two disagree on a few constructs. The planner then **deduplicates**
    (by `file_path` + mutated source), and filters **disabled** (`DisableComment`),
    **Sorbet `sig`** (`AST::SorbetSigDetector`), and **equivalent**
    (`Equivalent::Detector`) mutations. Equivalent ones become `:equivalent`
@@ -165,6 +174,10 @@ class that owns it.
    guard / unresolved); the final symbol is chosen by
    `Isolation::Fork#classify_status`: `:timeout` → `:killed` (crash) →
    `:unresolved` → `:error` → `:survived` (tests passed) → default `:killed`.
+   A crash is a test that raised, or a mutated source that raised while it was
+   loaded and whose original still loads (`MutationApplier` marks it
+   `load_crashed` after evaluating the original); a load failure the original
+   shares stays an `:error`.
    A `NeutralizationPipeline` can reclassify results into `:neutral` — either
    because the tests failed on nothing but examples that were already failing
    at baseline (`Neutralizer::BaselineFailed`) or because the test process
@@ -191,7 +204,9 @@ class that owns it.
    the score. `Commands::Run` maps `summary.success?(min_score:)` to exit code
    `0`/`1` (`2` on error), and `CLI::ExitGuard` — installed by the executable before
    anything can preload the project — has the final word on the process status, so a
-   preloaded spec helper's at-exit hook cannot replace it.
+   preloaded spec helper's at-exit hook cannot replace it. The guard also ends a run
+   that a mutation took down under in-process isolation with `2`, where Ruby would
+   end it with `1`.
 
 ## How to add a new mutator
 
@@ -230,12 +245,28 @@ A mutator is a `Prism::Visitor` subclass that emits byte-range edits.
      definitions outside a method overrides `self.subject_kinds` to return
      `%i[method constant]`; a constant subject's node is the definition's
      `CallNode`.
+   - Every other assignment to a constant outside a method (`LIMIT = 10`) is a
+     `:constant_write` subject, whose node is the whole assignment.
+     An operator write (`LIMIT += 1`) is one too, under the same name.
+     `ConstantWriteToNil` takes no other kind and nils the value of a plain
+     assignment only. `CompoundAssignment` handles the operator writes, and
+     with the literal operators extends `Mutator::ConstantValueSubjects` to
+     take constant-write subjects alongside the default kinds. `SubjectPipeline` drops subjects of a kind no registered operator
+     accepts (`Registry#accepts?`). Re-evaluating the mutated file assigns the constant again
+     and the restore source puts it back; what read the constant while
+     the file first loaded (a class-body call, a constant in another file
+     computed from it) keeps the old value.
    - A scope subject's mutation only takes effect if the mutated file re-runs
      its `scope` call, which `BodyCallNeutralizer` would otherwise blank: the
      eval source keeps that one call (`keep_offset`). Its `restore_source` is
-     the original file with the same call kept; `Integration::Base#call`
-     evaluates it after the tests, since in-process runs restore methods only
-     by re-evaluating the next mutation's source, where scopes are blanked.
+     the original file with the same call kept.
+   - Every mutation carries a `restore_source`, which `Integration::Base#call`
+     evaluates after the tests: the original file, class-body calls
+     neutralized. An in-process run would otherwise leave the last mutation
+     of a file applied while the next file is mutated, and that file's tests
+     would fail on its behalf. For a subject with no declaration to keep it
+     is one string per file, built once and shared
+     (`Mutator::Base.original_restore_source`).
    - A scope in a concern's `included` block has two audiences. The kept
      `included` call registers the mutated block for classes that include the
      concern later (`ConcernStateCleaner` clears the old one first, on apply
@@ -245,6 +276,19 @@ A mutator is a `Prism::Visitor` subclass that emits byte-range edits.
      follows the block with `ConcernRedeclaration.call(self)`, which runs the
      block on each of them with the guard up, so only the scope is declared
      again. Both additions go on existing lines; no line number moves.
+   - A method defined in a concern's `included` or `prepended` block, or a
+     constant assigned there, is handled the same way: the parser marks every
+     subject written in such a block (`Subject#concern_hook?`), and
+     `Mutator::Base` keeps the block for it as it does for a scope. The other
+     methods of the block and the constants it assigns are guarded like its
+     calls, so only the mutated one is defined again and no constant loses
+     what it has gathered. For a `prepended` block the eval source ends it with
+     `ConcernRedeclaration.call(self, :prepended)`, which runs it on the
+     classes that prepend the concern (it comes before them in their
+     ancestors) rather than on those that include it. A method the class has
+     defined itself over one of the block's is put back afterwards
+     (`Integration::Loading::OwnMethods`, which tells the two apart by the
+     file they were written in).
    - A callback subject's declaration is kept too, wrapped in
      `CallbackRedeclaration.call(self, __FILE__, lines) { ... }`. Callbacks do
      not replace on re-declaration: a symbol callback moves to the end of its

data/docs/isolation.md

@@ -77,6 +77,79 @@ inside its own process; use `--isolation fork` for it. The same goes for a
 mutant that crashes the Ruby VM: under `fork` that costs one child, under
 `in_process` the whole run.
 
+## What `in_process` cannot contain
+
+A mutant runs in the same Ruby process as evilution, so whatever takes that
+process down takes the run with it.
+
+An exception outside `StandardError` that leaves the test run is contained:
+a `SystemStackError` from a mutant that recurses without end is the usual
+one. It is reported for that mutation and the run goes on. The mutation is
+`killed` when the exception left the tests after the mutated source loaded,
+as a crashing test would be, and an `error` when it was raised earlier.
+
+One kind of stack overflow is not contained. When the recursion goes through
+`const_missing` — a mutant of a `const_missing` that is installed on `Object`
+does that — Ruby may run neither `rescue` nor `ensure`, or abort outright
+with a `[BUG]` report. Which one depends on the stack limit of the process
+(`ulimit -s`): under the usual 8 MB the machine stack gives out first and the
+process is lost, under a much larger limit the overflow unwinds like any
+other. The other recursions tried (plain method calls, blocks, `send`,
+`method_missing`, `to_s`, a Hash default proc) unwind normally under the
+usual limit, on Ruby 3.4 and 4.0.
+
+When the process ends this way without aborting, a line on stderr names the
+mutation:
+
+```
+[evilution] the run died while testing a mutation under in-process isolation:
+constant_namespace_strip: lib/foo.rb:202 (SystemStackError: stack level too deep).
+In-process isolation cannot contain a mutation that takes the Ruby process down;
+re-run with --isolation fork.
+```
+
+The process then ends with status 2, the status of a tool error: nothing was
+measured, and the line says what to change in the invocation. Ruby's own
+status for an uncaught exception is 1, which would read as a score below
+`--min-score`. The hooks the project registered with `at_exit` still run
+first. Ruby's backtrace of the exception is not printed; the line carries its
+class and message. A run that is interrupted (Ctrl-C) keeps the status Ruby
+gives it.
+
+After a `[BUG]` abort there is no such line and no such status: Ruby's own
+crash report is all there is, and the process ends as an abort does (134 from
+a shell), since no `at_exit` hook runs. In both cases no report is written
+and the verdicts collected so far are lost. Re-run with `--isolation fork`,
+where the same mutant costs one child process.
+
+## State a file leaves behind when it is evaluated again
+
+`in_process` evaluates a source file once for every mutation of it, and once
+more to put the original back. A fork child evaluates it once and ends. A file
+whose evaluation adds to something, instead of replacing it, therefore behaves
+differently under the two.
+
+One such case is handled. A file that installs a module it never names,
+
+```ruby
+handler = Module.new { def const_missing(name) = ... }
+Object.extend(handler)
+```
+
+leaves one more module on its host every time it is evaluated, and Ruby has no
+way to take one off. Left alone, the mutation under test would reach the code
+of every earlier mutation through `super`, fail on a predecessor's bug, and be
+reported killed. Evilution remembers the anonymous modules a file's evaluation
+creates and removes their methods when the file is evaluated next, so that
+method lookup passes through them. Only modules are emptied, not anonymous
+classes, and only the methods written in that file.
+
+Other things a file can add to at load time are not undone: an `at_exit`
+hook, a `Signal.trap`, a `TracePoint`, a callback pushed into a registry of
+some library. If the file you are mutating does one of those at the top
+level, compare an `in_process` run with a `--isolation fork` run before
+trusting its kills.
+
 ## Parent-process preload
 
 Fork isolation's one downside is that every child pays the cost of loading
@@ -206,6 +279,15 @@ single in-flight mutation is recorded as `:timeout` / `:error`, and the run
 continues with the remaining work. A single pathological mutation costs you one
 result, not the entire run.
 
+The same holds for a worker whose reply cannot be trusted. The pipes between
+the parent and a worker are inherited by every process the worker forks, so
+code under test that writes to a descriptor it did not open can put bytes on
+them. A frame that does not decode, that decodes to something other than a
+result of an item the worker holds, or that stops short of the length it
+announced (ten seconds are allowed for the rest) ends that worker: it is
+killed and replaced, and the mutation it held is recorded as an `:error` with
+the message `worker's result could not be read; the worker was replaced`.
+
 Each worker is also its own process-group leader, so killing a worker reaps the
 mutation subprocess and any grandchildren it spawned rather than orphaning them,
 and a terminal interrupt (Ctrl-C) is forwarded to every worker group — an

data/lib/evilution/ast/class_body.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../ast"
+
+# The body of a class, module or `class << self`: the code written outside
+# every method, where no method subject reaches it.
+#
+# Operators that mutate such code attribute their mutants to one method, so
+# each mutant has exactly one subject. That method is the scope's anchor: the
+# first method written in the scope, in source order. Blocks of the body
+# (`included do ... end`) are searched, nested scopes are not: their methods
+# anchor the inner scope. A scope with no method of its own borrows the anchor
+# of the first singleton class in its body that has one, so a class whose
+# methods all sit in `class << self` is still reached.
+class Evilution::AST::ClassBody
+  SCOPES = [Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+  # Nodes whose children belong to something else: a method, or another scope.
+  OPAQUE = [Prism::DefNode, *SCOPES].freeze
+
+  # The location that closes each kind of conditional or loop.
+  CLOSINGS = {
+    Prism::IfNode => :end_keyword_loc,
+    Prism::UnlessNode => :end_keyword_loc,
+    Prism::ElseNode => :end_keyword_loc,
+    Prism::WhileNode => :closing_loc,
+    Prism::UntilNode => :closing_loc
+  }.freeze
+
+  attr_reader :node
+
+  # The bodies anchored at the method starting on the given line, outermost
+  # first. A method anchors its own scope, and with it any enclosing scope
+  # that borrows from it.
+  def self.anchored_at(tree, line)
+    scopes_in(tree).map { |scope| new(scope) }.select { |body| body.anchor_line == line }
+  end
+
+  def self.scopes_in(node)
+    node.compact_child_nodes.flat_map do |child|
+      nested = scopes_in(child)
+      SCOPES.include?(child.class) ? [child, *nested] : nested
+    end
+  end
+
+  private_class_method :scopes_in
+
+  def initialize(node)
+    @node = node
+  end
+
+  def anchor_line
+    first_method = contents.find { |child| child.is_a?(Prism::DefNode) }
+    return first_method.location.start_line if first_method
+
+    singleton_classes = contents.grep(Prism::SingletonClassNode)
+    singleton_classes.filter_map { |scope| self.class.new(scope).anchor_line }.first
+  end
+
+  # The statements of the body the block selects, each one removable: cut
+  # out, it leaves code that still parses. Methods and nested scopes are
+  # neither offered nor searched, and neither is a statement guarded by a
+  # modifier (`include Foo if legacy?`) or an expression used as a value.
+  def declarations(&)
+    body = @node.body
+    return [] unless body
+
+    statements_in(body, removable: body.is_a?(Prism::StatementsNode)).select(&)
+  end
+
+  private
+
+  # Every node written in the scope, in source order, down to the methods and
+  # nested scopes, which are listed but not entered. The scope's own header
+  # (its name, its superclass expression) is not part of the body.
+  def contents
+    @contents ||= @node.body ? descend(@node.body) : []
+  end
+
+  def statements_in(node, removable:)
+    node.compact_child_nodes.flat_map do |child|
+      next [] if OPAQUE.include?(child.class)
+
+      nested = statements_in(child, removable: child.is_a?(Prism::StatementsNode) && !modifier?(node))
+      removable ? [child, *nested] : nested
+    end
+  end
+
+  # A conditional or loop written without its closing keyword: the modifier
+  # forms and the ternary, whose statements cannot be cut out.
+  def modifier?(node)
+    closing = CLOSINGS[node.class]
+    !closing.nil? && node.public_send(closing).nil?
+  end
+
+  def descend(node)
+    node.compact_child_nodes.flat_map do |child|
+      OPAQUE.include?(child.class) ? [child] : [child, *descend(child)]
+    end
+  end
+end

data/lib/evilution/ast/included_block.rb

@@ -11,17 +11,31 @@ require_relative "../ast"
 module Evilution::AST::IncludedBlock
   # The block node, or nil when node is not an `included` block call.
   def self.of(node)
-    return nil unless node.is_a?(Prism::CallNode) && node.name == :included
+    hook_block(node, :included)
+  end
+
+  # The block node of a `prepended do ... end`, the same hook for the classes
+  # that prepend the module; nil when node is not one.
+  def self.prepended(node)
+    hook_block(node, :prepended)
+  end
+
+  def self.hook_block(node, name)
+    return nil unless node.is_a?(Prism::CallNode) && node.name == name
     return nil unless node.receiver.nil? && node.arguments.nil?
 
     node.block if node.block.is_a?(Prism::BlockNode)
   end
+  private_class_method :hook_block
 
-  # The included blocks among a module body's direct statements.
-  def self.in_body(body)
-    statements = body.is_a?(Prism::BeginNode) ? body.statements : body
-    return [] unless statements.is_a?(Prism::StatementsNode)
+  # The included and prepended blocks among a module body's direct statements.
+  def self.hooks_in_body(body)
+    direct_statements(body).filter_map { |node| of(node) || prepended(node) }
+  end
 
-    statements.body.filter_map { |node| of(node) }
+  def self.direct_statements(body)
+    statements = body.is_a?(Prism::BeginNode) ? body.statements : body
+    statements.is_a?(Prism::StatementsNode) ? statements.body : []
   end
+  private_class_method :direct_statements
 end

data/lib/evilution/ast/never_nil.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../ast"
+
+# Expressions whose value is never nil whatever the program does: `self` and
+# the literals other than `nil`. Anything read or computed (a variable, a
+# constant, a call) is not one.
+module Evilution::AST::NeverNil
+  NODE_TYPES = [
+    Prism::SelfNode,
+    Prism::StringNode,
+    Prism::InterpolatedStringNode,
+    Prism::XStringNode,
+    Prism::InterpolatedXStringNode,
+    Prism::SymbolNode,
+    Prism::InterpolatedSymbolNode,
+    Prism::IntegerNode,
+    Prism::FloatNode,
+    Prism::RationalNode,
+    Prism::ImaginaryNode,
+    Prism::ArrayNode,
+    Prism::HashNode,
+    Prism::RangeNode,
+    Prism::RegularExpressionNode,
+    Prism::InterpolatedRegularExpressionNode,
+    Prism::TrueNode,
+    Prism::FalseNode,
+    Prism::LambdaNode
+  ].freeze
+  private_constant :NODE_TYPES
+
+  def self.node?(node)
+    NODE_TYPES.any? { |type| node.is_a?(type) }
+  end
+end

data/lib/evilution/ast/parser.rb

@@ -46,41 +46,41 @@ module Evilution::AST
       @subjects = []
       @context = []
       @singleton = [false]
+      @hooks = []
     end
 
     def visit_module_node(node)
-      @context.push(constant_name(node.constant_path))
-      IncludedBlock.in_body(node.body).each do |block|
-        add_scope_subjects(block.body)
-        add_aasm_subjects(block.body)
-        add_callback_subjects(block.body)
+      within_context(constant_name(node.constant_path), rooted: rooted?(node.constant_path)) do
+        hooks = IncludedBlock.hooks_in_body(node.body)
+        within_hooks(hooks) do
+          hooks.each { |block| add_declaration_subjects(block.body) }
+          within_scope(singleton: false) { super }
+        end
       end
-      within_scope(singleton: false) { super }
-      @context.pop
     end
 
     # A class whose superclass is a value-object definition
     # (`class Coord < Data.define(:lat, :lng)`) makes a constant subject of
     # that definition, named after the class.
     def visit_class_node(node)
-      @context.push(constant_name(node.constant_path))
-      superclass = node.superclass
-      add_subject(superclass, @context.join("::"), :constant) if ValueObjectDefinition.match?(superclass)
-      add_scope_subjects(node.body)
-      add_aasm_subjects(node.body)
-      add_callback_subjects(node.body)
-      within_scope(singleton: false) { super }
-      @context.pop
+      within_context(constant_name(node.constant_path), rooted: rooted?(node.constant_path)) do
+        superclass = node.superclass
+        add_subject(superclass, @context.join("::"), :constant) if ValueObjectDefinition.match?(superclass)
+        add_declaration_subjects(node.body)
+        within_scope(singleton: false) { super }
+      end
     end
 
     # A `def` inside `class << self` defines a method on the enclosing
     # class's singleton, like `def self.name`; inside `class << Store` it
     # defines one on Store.
     def visit_singleton_class_node(node)
-      constant = constant_expression?(node.expression)
-      @context.push(constant_name(node.expression)) if constant
-      within_scope(singleton: true) { super }
-      @context.pop if constant
+      expression = node.expression
+      return within_scope(singleton: true) { super } unless constant_expression?(expression)
+
+      within_context(constant_name(expression), rooted: rooted?(expression)) do
+        within_scope(singleton: true) { super }
+      end
     end
 
     def visit_def_node(node)
@@ -89,16 +89,36 @@ module Evilution::AST
       super
     end
 
+    # An assignment to a constant cannot be written inside a method, so it is
+    # a subject of its own: the whole assignment, named after the constant. A
+    # value-object definition keeps its narrower constant subject instead.
     def visit_constant_write_node(node)
-      return super unless ValueObjectDefinition.match?(node.value)
+      return within_definition(node.value, node.name.to_s) { super } if ValueObjectDefinition.match?(node.value)
 
-      within_definition(node.value, node.name.to_s) { super }
+      add_subject(node, scoped_name(node.name), :constant_write)
+      super
     end
 
     def visit_constant_path_write_node(node)
-      return super unless ValueObjectDefinition.match?(node.value)
+      name = path_name(node.target)
+      rooted = rooted?(node.target)
+      return within_definition(node.value, name, rooted: rooted) { super } if ValueObjectDefinition.match?(node.value)
+
+      add_subject(node, rooted ? name : scoped_name(name), :constant_write)
+      super
+    end
 
-      within_definition(node.value, path_name(node.target)) { super }
+    # `LIMIT += 1` assigns the constant again and is a subject like the
+    # assignment it follows, under the same name.
+    def visit_constant_operator_write_node(node)
+      add_subject(node, scoped_name(node.name), :constant_write)
+      super
+    end
+
+    def visit_constant_path_operator_write_node(node)
+      name = path_name(node.target)
+      add_subject(node, rooted?(node.target) ? name : scoped_name(name), :constant_write)
+      super
     end
 
     private
@@ -110,6 +130,30 @@ module Evilution::AST
       @singleton.pop
     end
 
+    # What the block finds inside one of these hook blocks of a concern is
+    # marked as written there.
+    def within_hooks(blocks)
+      enclosing = @hooks
+      @hooks = blocks.map { |block| block.location.start_offset...block.location.end_offset }
+      yield
+    ensure
+      @hooks = enclosing
+    end
+
+    def in_hook?(location)
+      @hooks.any? { |range| range.cover?(location.start_offset) }
+    end
+
+    def scoped_name(name)
+      [*@context, name].join("::")
+    end
+
+    # `::LIMIT` and `::Shared::LIMIT` name a constant from the top level,
+    # whatever scope they are written in.
+    def rooted?(path)
+      path.slice.start_with?("::")
+    end
+
     def constant_expression?(node)
       node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
     end
@@ -117,17 +161,35 @@ module Evilution::AST
     # A value-object definition assigned to a constant is a subject of its
     # own, and a scope for what its block defines: `def area` in
     # `Size = Struct.new(:w, :h) do ... end` is `Size#area`.
-    def within_definition(definition, name)
-      @context.push(name)
-      add_subject(definition, @context.join("::"), :constant)
+    def within_definition(definition, name, rooted: false)
+      within_context(name, rooted: rooted) do
+        add_subject(definition, @context.join("::"), :constant)
+        yield
+      end
+    end
+
+    # Names what the block finds under `name`: within the scope being
+    # visited, or from the top level when the name was written rooted.
+    def within_context(name, rooted:)
+      enclosing = @context
+      @context = rooted ? [name] : [*enclosing, name]
       yield
-      @context.pop
+    ensure
+      @context = enclosing
+    end
+
+    # The callables handed to the declarations of a class body, or of a
+    # concern's `included` or `prepended` block.
+    def add_declaration_subjects(body)
+      add_scope_subjects(body)
+      add_aasm_subjects(body)
+      add_callback_subjects(body)
     end
 
     # `scope :recent, -> { ... }` defines the class method `recent`. The
     # subject spans the whole declaration and mutates its body.
-    # Written in a concern's `included` block it defines that method on every
-    # class including the concern, and is named after the concern.
+    # Written in a concern's `included` or `prepended` block it defines that
+    # method on every class taking the concern, and is named after the concern.
     def add_scope_subjects(body)
       ScopeDeclaration.in_body(body).each do |declaration|
         name = "#{@context.join("::")}.#{ScopeDeclaration.scope_name(declaration)}"
@@ -170,7 +232,8 @@ module Evilution::AST
         line_number: loc.start_line,
         source: source,
         node: node,
-        kind: kind
+        kind: kind,
+        concern_hook: in_hook?(loc)
       )
     end
 
@@ -186,7 +249,7 @@ module Evilution::AST
     # either; like `path_name`, they are named by their own constant.
     def constant_name(node)
       if node.respond_to?(:full_name)
-        node.full_name
+        node.full_name.delete_prefix("::")
       else
         node.name.to_s
       end

data/lib/evilution/ast/round_half_mode.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../ast"
+
+# The tie-breaking mode of a `round` call: the `:even` of
+# `amount.round(2, half: :even)`. Only a literal mode Ruby accepts counts; a
+# mode held in a variable, `nil` or an unknown symbol is not one.
+module Evilution::AST::RoundHalfMode
+  MODES = %i[up even down].freeze
+
+  # The symbol node holding the mode, or nil when node is not a `round` call
+  # with a literal mode.
+  def self.of(node)
+    return nil unless node.is_a?(Prism::CallNode) && node.name == :round
+
+    value = half_value(node.arguments)
+    value if value.is_a?(Prism::SymbolNode) && MODES.include?(value.unescaped.to_sym)
+  end
+
+  # The value given to `half:`, whatever it is.
+  def self.half_value(arguments)
+    return nil unless arguments
+
+    keywords = arguments.arguments.grep(Prism::KeywordHashNode).flat_map(&:elements)
+    pair = keywords.find { |element| half_key?(element) }
+    pair.value if pair
+  end
+
+  def self.half_key?(element)
+    return false unless element.is_a?(Prism::AssocNode)
+
+    key = element.key
+    key.is_a?(Prism::SymbolNode) && key.unescaped == "half"
+  end
+
+  private_class_method :half_value, :half_key?
+end

data/lib/evilution/ast/source_surgeon.rb

@@ -1,8 +1,7 @@
 # frozen_string_literal: true
 
-require "prism"
-
 require_relative "../ast"
+require_relative "syntax_check"
 
 module Evilution::AST::SourceSurgeon
   Result = Struct.new(:source, :status, keyword_init: true) do
@@ -19,7 +18,7 @@ module Evilution::AST::SourceSurgeon
     binary = source.b
     binary[offset, length] = replacement.b
     mutated = binary.force_encoding(source.encoding)
-    status = Prism.parse(mutated).success? ? :ok : :unparseable
+    status = Evilution::AST::SyntaxCheck.valid?(mutated) ? :ok : :unparseable
     Result.new(source: mutated, status: status).freeze
   end
 end