Summary

Four independent changes, one commit each.

1. Enum proxies lose constant-expression case values — Fixes #600

EnumProxyGenerator::resolveEnumData() only recognized String_/Int_ literal case values, so case Negative = -1;, case Shifted = 1 << 2; and case FromConst = self::SHIFT + 10; resolved to null, EnumGenerator::addEnumCase() skipped setValue(), and the proxy declared a pure case inside a backed enum — a PHP fatal error ("Case Negative of backed enum ... must have a value") at proxy load time.

Fix: the parser-reflection path now carries the raw PhpParser Expr node through to EnumGenerator, which emits it verbatim (Builder\EnumCase::setValue() accepts Expr natively). self::CONST keeps resolving on the proxy because class constants stay in the woven trait and trait constants participate in the composing class since PHP 8.2 — verified at runtime, not just lint: a test weaves the fixture enum, loads the woven trait + proxy enum, and asserts Negative->value === -1, Shifted->value === 4, FromConst->value === 12 and from(12) works.

Tests: EnumGeneratorTest (verbatim Expr emission), EnumProxyGeneratorTest (native-reflection path emits evaluated scalars, never valueless cases), WeavingTransformerTest (golden php81-enum-const-expr{,-woven,-proxy}.php fixtures + runtime load check), EnumWeavingTest (end-to-end project fixture ConstExprBackedEnum).

2. Pointcut expressiveness — Fixes #604

(a) ReturnTypePointcut union/intersection/DNF support. Pattern and actual type are normalized into sets of intersection groups (split on | at paren depth 0, then &; parens and leading backslashes removed; leading ? on the actual type expands to |null). Semantics (documented in the class docblock, "not supported yet" note removed):

• single-type pattern (string, Exc*) matches if any member of the actual type matches (wildcards kept per member);
• composite pattern (string|int, Countable&Iterator) must correspond one-to-one to the actual member set, order-insensitively;
• in the pattern, ? keeps its historical single-char-wildcard meaning (BC) — nullable patterns are written Foo|null.

The grammar now accepts union/intersection return types after : (e.g. execution(public Example->method(*): string|int), ...: Countable&Iterator, DNF paren-free as A&B|C which equals (A&B)|C per PHP precedence).

(b) Modifier predicates readonly, private(set), protected(set) for ModifierPointcut/grammar, mapped to ReflectionProperty::IS_READONLY / IS_PRIVATE_SET / IS_PROTECTED_SET. Matching stays bitmask-based: both native reflection and Go\ParserReflection\ReflectionProperty expose these bits via getModifiers() (verified against vendor parser-reflection), so no method_exists guards are needed. The asymmetric tokens are lexed as single tokens (private(set)), keeping full BC. The LALR parse table was regenerated from the updated grammar — zero conflicts, all pre-existing grammar tests pass unchanged.

Deferred (small, deliberate): parenthesized DNF groups in the grammar ((A&B)|C) — the paren-free equivalent parses and matches identically, and ReturnTypePointcut itself normalizes parenthesized patterns when constructed directly; wildcards inside grammar-level return-type members (supported via direct construction). Neither requires further grammar surgery for the issue's use cases.

3. docs/php85-limitations.md — Fixes #605

New document modeled on docs/php84-limitations.md, capturing the PHP 8.5.10 / 8.6.0beta2 audit facts from PR #597: what works (pipe |> in woven bodies, clone with, #[\NoDiscard] propagation with join-point dispatch returning the value, attributes on class constants incl. #[\Deprecated], closures/FCC parameter defaults, final promoted + static asymmetric visibility on non-intercepted properties, self/parent reflection resolution) and what is limited — each phrased as "tracked in #NNN" (#598, #599, #600, #601, #602, #603) since fixes are in flight on other branches — plus the permanent engine constraint that static properties are never interceptable via access() (no property hooks for statics). docs/php84-limitations.md untouched. README links the new page.

4. Hygiene — Partially addresses #610

• Deleted 12 orphaned fixtures in tests/Instrument/Transformer/_files/ after verifying each basename is unreferenced across tests/ and src/. Note: yii_style.php / yii_style_output.php from the issue's list of 14 are not orphaned — FilterInjectorTransformerTest still reads them — so they were kept.
• .github/workflows/phpstan.yml: PHP 8.4 + 8.5 matrix with per-version cache keys (php-8.4 / php-8.5).
• tests/functions.php: typed the Symfony Finder glob() override as glob(string $pattern, int $flags = 0): array — matching how Finder::searchInDirectory() invokes it (string pattern, int GLOB_* bitmask).

Rest of #610 (PARAMETER_WIDENING removal, constructor promotion, replacement coverage fixtures) intentionally not touched — owned by other work.

Test evidence

Fixes #600
Fixes #604
Fixes #605
Partially addresses #610

Generated by Claude Code