rigortype 0.0.8 → 0.0.9

data/lib/rigor/environment/rbs_loader.rb

@@ -42,9 +42,29 @@ module Rigor
         def reset_default!
           @default = nil
         end
+
+        # Builds an `RBS::Environment` from explicit `libraries` and
+        # `signature_paths`. Stateless surface so the v0.0.9
+        # {Cache::RbsEnvironment} producer can build an env on cache
+        # miss without holding a loader instance, and the
+        # instance-side {#build_env} delegates here so the
+        # implementation stays single-rooted.
+        def build_env_for(libraries:, signature_paths:)
+          rbs_loader = RBS::EnvironmentLoader.new
+          libraries.each do |library|
+            next unless rbs_loader.has_library?(library: library, version: nil)
+
+            rbs_loader.add(library: library, version: nil)
+          end
+          signature_paths.each do |path|
+            path = Pathname(path) unless path.is_a?(Pathname)
+            rbs_loader.add(path: path) if path.directory?
+          end
+          RBS::Environment.from_loader(rbs_loader).resolve_type_names
+        end
       end
 
-      attr_reader :libraries, :signature_paths
+      attr_reader :libraries, :signature_paths, :cache_store
 
       # @param libraries [Array<String, Symbol>] stdlib library names to
       #   load on top of core (e.g., `["pathname", "json"]`). Empty by
@@ -57,9 +77,16 @@ module Rigor
       #   `sig/` tree). Non-existent or non-directory paths are filtered
       #   out at build time so the loader stays robust to fixtures and
       #   bare repositories.
-      def initialize(libraries: [], signature_paths: [])
+      # @param cache_store [Rigor::Cache::Store, nil] the persistent
+      #   cache the loader consults for translated constant lookups
+      #   (and, in later v0.0.9 slices, other Marshal-clean
+      #   reflection artefacts). Pass `nil` (the default) to skip
+      #   the cache entirely; the runner threads its own Store
+      #   through here when caching is enabled.
+      def initialize(libraries: [], signature_paths: [], cache_store: nil)
         @libraries = libraries.map(&:to_s).freeze
         @signature_paths = signature_paths.map { |p| Pathname(p) }.freeze
+        @cache_store = cache_store
         @state = { env: nil, builder: nil }
         @instance_definition_cache = {}
         @singleton_definition_cache = {}
@@ -71,11 +98,35 @@ module Rigor
       # name is loaded. Accepts unprefixed or top-level-prefixed names
       # ("Integer" or "::Integer"). Memoized per-name (positive and
       # negative results both cache).
+      #
+      # When `cache_store` is set, the loader fetches the entire set of
+      # known class / module / alias names once (per process) through
+      # {Cache::RbsKnownClassNames.fetch} and answers `class_known?`
+      # from the in-memory Set. Cold runs pay a single env walk and
+      # persist the result; warm runs (and a separate loader sharing
+      # the same Store) skip the env walk entirely.
       def class_known?(name)
         key = name.to_s
         return @class_known_cache[key] if @class_known_cache.key?(key)
 
-        @class_known_cache[key] = compute_class_known(name)
+        @class_known_cache[key] = if cache_store
+                                    cached_class_known(name)
+                                  else
+                                    compute_class_known(name)
+                                  end
+      end
+
+      # Yields every known class / module / alias name (top-level
+      # prefixed) currently loaded into the environment. The cache
+      # producer that materialises the known-name set uses this so
+      # it never recurses back through {#class_known?}.
+      def each_known_class_name
+        return enum_for(:each_known_class_name) unless block_given?
+
+        env.class_decls.each_key { |rbs_name| yield rbs_name.to_s }
+        env.class_alias_decls.each_key { |rbs_name| yield rbs_name.to_s }
+      rescue StandardError
+        # fail-soft: a broken environment yields no names.
       end
 
       # @return [RBS::Definition, nil] the resolved instance definition
@@ -133,7 +184,19 @@ module Rigor
       # names (the loader stays fail-soft). NOTE: in the `rbs` gem,
       # `RBS::Definition#type_params` returns `Array<Symbol>` directly,
       # not the AST `TypeParam` object (those live on the AST level).
+      #
+      # When `cache_store` is set, the loader fetches the entire
+      # type-parameter-name table once (per process) through
+      # {Cache::RbsClassTypeParamNames.fetch} and answers point
+      # lookups from it. Cold runs build the table once and persist
+      # it; warm runs (and a separate loader sharing the same Store)
+      # skip the env walk entirely.
       def class_type_param_names(class_name)
+        if cache_store
+          key = class_name.to_s.delete_prefix("::")
+          return type_param_names_table.fetch(key, []).dup
+        end
+
         definition = instance_definition(class_name)
         return [] unless definition
 
@@ -155,6 +218,21 @@ module Rigor
         []
       end
 
+      # Yields `(name, entry)` for every RBS constant declaration
+      # currently loaded into the environment. The cache producer
+      # uses this to materialise the constant-type table without
+      # going back through {#constant_type} (which would recurse
+      # back into the cache when `cache_store` is set).
+      def each_constant_decl
+        return enum_for(:each_constant_decl) unless block_given?
+
+        env.constant_decls.each do |rbs_name, entry|
+          yield rbs_name.to_s, entry
+        end
+      rescue StandardError
+        # fail-soft: a broken environment yields no entries.
+      end
+
       # Slice A constant-value lookup. Returns the translated
       # `Rigor::Type` for a non-class constant declaration
       # (`BUCKETS: Array[Symbol]`, `DEFAULT_PATH: String`, ...) or
@@ -164,23 +242,73 @@ module Rigor
       # nil; the loader does NOT consult the class declarations
       # here — class objects are still resolved through
       # {#class_known?} and `Environment#singleton_for_name`.
+      #
+      # When `cache_store` is set, the loader fetches the entire
+      # translated constant table once (per process) through
+      # {Cache::RbsConstantTable.fetch} and answers point lookups
+      # from it. Cold runs pay the translation cost up-front and
+      # write the result to disk; warm runs skip the translation
+      # entirely and pay only a `Marshal.load` of the table.
       def constant_type(name)
         rbs_name = parse_type_name(name)
         return nil unless rbs_name
 
+        if cache_store
+          constant_type_table[rbs_name.to_s]
+        else
+          translate_constant_decl(rbs_name)
+        end
+      rescue StandardError
+        nil
+      end
+
+      private
+
+      def constant_type_table
+        @constant_type_table ||= begin
+          require_relative "../cache/rbs_constant_table"
+          Cache::RbsConstantTable.fetch(loader: self, store: cache_store)
+        end
+      end
+
+      def known_class_names_set
+        @known_class_names_set ||= begin
+          require_relative "../cache/rbs_known_class_names"
+          Cache::RbsKnownClassNames.fetch(loader: self, store: cache_store)
+        end
+      end
+
+      def type_param_names_table
+        @type_param_names_table ||= begin
+          require_relative "../cache/rbs_class_type_param_names"
+          Cache::RbsClassTypeParamNames.fetch(loader: self, store: cache_store)
+        end
+      end
+
+      def cached_class_known(name)
+        rbs_name = parse_type_name(name)
+        return false unless rbs_name
+
+        known_class_names_set.include?(rbs_name.to_s)
+      rescue StandardError
+        false
+      end
+
+      def translate_constant_decl(rbs_name)
         entry = env.constant_decls[rbs_name]
         return nil unless entry
 
         translated = Inference::RbsTypeTranslator.translate(entry.decl.type)
         translated unless translated.is_a?(Type::Bot)
-      rescue StandardError
-        nil
       end
 
-      private
-
       def env
-        @state[:env] ||= build_env
+        @state[:env] ||= cache_store ? cached_env : build_env
+      end
+
+      def cached_env
+        require_relative "../cache/rbs_environment"
+        Cache::RbsEnvironment.fetch(loader: self, store: cache_store)
       end
 
       def builder
@@ -188,23 +316,7 @@ module Rigor
       end
 
       def build_env
-        rbs_loader = RBS::EnvironmentLoader.new
-        @libraries.each do |library|
-          # Phase 2a deliberately fails-soft on unknown stdlib libraries
-          # so a stale `.rigor.yml` (or future config plumbing) does not
-          # take down the whole analyzer. Phase 2b will surface this
-          # through diagnostics once the configuration layer can name
-          # the offending source. The unknown-library check happens at
-          # `from_loader` time, not at `add` time, so we have to gate
-          # ahead of `add`.
-          next unless rbs_loader.has_library?(library: library, version: nil)
-
-          rbs_loader.add(library: library, version: nil)
-        end
-        @signature_paths.each do |path|
-          rbs_loader.add(path: path) if path.directory?
-        end
-        RBS::Environment.from_loader(rbs_loader).resolve_type_names
+        self.class.build_env_for(libraries: @libraries, signature_paths: @signature_paths)
       end
 
       def build_instance_definition(class_name)

data/lib/rigor/environment.rb

@@ -76,11 +76,20 @@ module Rigor
       #   list of `sig/`-style directories. When `nil` (the default),
       #   the canonical project layout `<root>/sig` is used if it
       #   exists, otherwise no signature path is loaded.
+      # @param cache_store [Rigor::Cache::Store, nil] persistent cache
+      #   threaded into the underlying {Environment::RbsLoader} so
+      #   constant lookups (and, in later v0.0.9 slices, other
+      #   reflection artefacts) consult the cache. Pass `nil` (the
+      #   default) to skip caching for this environment.
       # @return [Rigor::Environment]
-      def for_project(root: Dir.pwd, libraries: [], signature_paths: nil)
+      def for_project(root: Dir.pwd, libraries: [], signature_paths: nil, cache_store: nil)
         resolved_paths = signature_paths || default_signature_paths(root)
         merged_libraries = (DEFAULT_LIBRARIES + libraries.map(&:to_s)).uniq
-        loader = RbsLoader.new(libraries: merged_libraries, signature_paths: resolved_paths)
+        loader = RbsLoader.new(
+          libraries: merged_libraries,
+          signature_paths: resolved_paths,
+          cache_store: cache_store
+        )
         new(rbs_loader: loader)
       end
 

data/lib/rigor/flow_contribution.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+module Rigor
+  # The public packaging of a flow contribution at a single call edge.
+  # Plugins, `RBS::Extended` annotations, and built-in narrowing rules
+  # all hand the analyzer this same bundle shape; the inference engine
+  # merges contributions through the policy described in
+  # [ADR-2 § "Plugin Contribution Merging"](../../docs/adr/2-extension-api.md)
+  # rather than letting any one source override another silently.
+  #
+  # Eight content slots plus a {Provenance} block. A slot left as `nil`
+  # (or, for collection-shaped slots, an empty collection) means the
+  # contribution does not assert anything in that dimension; the merge
+  # policy treats it as absent.
+  #
+  # The struct is the only shape plugin authors need to learn. Richer
+  # or more permissive shapes are not part of the first public
+  # contract — see ADR-2 § "Flow Contribution Bundle" for the binding
+  # definition.
+  #
+  # The element-list flattening (`to_element_list`) ADR-2 mentions is
+  # intentionally not implemented yet: it is the analyzer-internal
+  # bookkeeping behind the merge policy and will land alongside the
+  # plugin contribution merger in v0.1.0. Plugin authors should not
+  # rely on it.
+  class FlowContribution
+    # Provenance carries the metadata every contribution needs for
+    # diagnostic attribution and cache invalidation. `source_family`
+    # mirrors {Rigor::Analysis::Diagnostic::DEFAULT_SOURCE_FAMILY};
+    # `descriptor` is the {Rigor::Cache::Descriptor} this
+    # contribution attaches to (or `nil` when the contribution does
+    # not need its own cache slice).
+    Provenance = Data.define(:source_family, :plugin_id, :node, :descriptor) do
+      def self.builtin
+        new(source_family: :builtin, plugin_id: nil, node: nil, descriptor: nil)
+      end
+    end
+
+    SLOT_NAMES = %i[
+      return_type
+      truthy_facts
+      falsey_facts
+      post_return_facts
+      mutations
+      invalidations
+      exceptional
+      role_conformance
+    ].freeze
+
+    attr_reader(*SLOT_NAMES, :provenance)
+
+    # @param return_type [Object, nil] normal-edge return type. Use
+    #   `nil` when the contribution does not refine the return type
+    #   selected from the RBS contract.
+    # @param truthy_facts [Array, nil] facts that hold only on the
+    #   truthy control-flow edge. Edge-local: a truthy-edge fact does
+    #   NOT imply its falsey-edge complement (ADR-2 § "Plugin
+    #   Contribution Merging").
+    # @param falsey_facts [Array, nil] dual of `truthy_facts`.
+    # @param post_return_facts [Array, nil] facts that hold after the
+    #   call returns normally on every edge — the carrier for
+    #   assertion-style contributions.
+    # @param mutations [Array, nil] receiver and argument mutation
+    #   effects.
+    # @param invalidations [Array, nil] targeted fact invalidations
+    #   beyond what mutation effects already imply.
+    # @param exceptional [Object, nil] non-returning, raising, or
+    #   unreachable effect.
+    # @param role_conformance [Array, nil] capability-role conformance
+    #   facts the contribution provides.
+    # @param provenance [Provenance] source-family, plugin-id, node,
+    #   and cache-descriptor metadata. Defaults to `Provenance.builtin`.
+    # rubocop:disable Metrics/ParameterLists
+    def initialize(return_type: nil, truthy_facts: nil, falsey_facts: nil,
+                   post_return_facts: nil, mutations: nil, invalidations: nil,
+                   exceptional: nil, role_conformance: nil,
+                   provenance: Provenance.builtin)
+      # rubocop:enable Metrics/ParameterLists
+      @return_type = return_type
+      @truthy_facts = freeze_collection(truthy_facts)
+      @falsey_facts = freeze_collection(falsey_facts)
+      @post_return_facts = freeze_collection(post_return_facts)
+      @mutations = freeze_collection(mutations)
+      @invalidations = freeze_collection(invalidations)
+      @exceptional = exceptional
+      @role_conformance = freeze_collection(role_conformance)
+      @provenance = provenance
+      freeze
+    end
+
+    # @return [Boolean] true when every content slot is unset (nil or
+    #   an empty collection). Provenance does not count toward
+    #   emptiness — an empty bundle still carries source attribution.
+    def empty?
+      SLOT_NAMES.all? { |slot| slot_empty?(public_send(slot)) }
+    end
+
+    def to_h
+      SLOT_NAMES.each_with_object(provenance: provenance.to_h) do |slot, acc|
+        acc[slot] = public_send(slot)
+      end
+    end
+
+    def ==(other)
+      other.is_a?(FlowContribution) && to_h == other.to_h
+    end
+    alias eql? ==
+
+    def hash
+      to_h.hash
+    end
+
+    private
+
+    def freeze_collection(value)
+      return nil if value.nil?
+
+      value.dup.freeze
+    end
+
+    def slot_empty?(value)
+      return true if value.nil?
+      return value.empty? if value.respond_to?(:empty?)
+
+      false
+    end
+  end
+end

data/lib/rigor/inference/builtins/encoding_catalog.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require_relative "method_catalog"
+
+module Rigor
+  module Inference
+    module Builtins
+      # `Encoding` catalog. Singleton — load once, consult during
+      # dispatch.
+      #
+      # Encoding instances are deep-frozen value objects: once
+      # registered, their `name` / `dummy?` / `ascii_compatible?`
+      # slots never change and the C bodies for the per-instance
+      # methods are pure. The C-body classifier therefore lands
+      # every instance method as `:leaf` correctly.
+      #
+      # The blocklist focuses on the *singleton* surface where the
+      # hidden state is the process-wide encoding registry. Every
+      # method classified `:leaf` on the singleton actually reads
+      # (or, for the setters, writes) a global, so a hypothetical
+      # `Constant<Encoding>`-class receiver MUST NOT fold them
+      # against the analyzer process's registry — what UTF-8's
+      # alias list is in the analyzer is not necessarily what it
+      # is in the analysed program.
+      ENCODING_CATALOG = MethodCatalog.new(
+        path: File.expand_path(
+          "../../../../data/builtins/ruby_core/encoding.yml",
+          __dir__
+        ),
+        mutating_selectors: {
+          "Encoding" => Set[
+            # Defence-in-depth: mirrors range_catalog.rb /
+            # complex_catalog.rb. Encoding does not currently
+            # expose a public `initialize_copy` (Encoding objects
+            # are deep-frozen and #dup is a no-op), but the
+            # convention keeps the door closed against future
+            # CRuby changes that would leak a copy-mutator.
+            :initialize_copy,
+            :hash,
+            :eql?,
+            # `Encoding.find(name)` walks the global encoding
+            # registry. Pure with respect to its argument but
+            # the registry itself can drift (load-order, locale,
+            # process-wide `default_external=` calls), so a
+            # constant-fold would lock in the analyzer's view.
+            :find,
+            # `Encoding.list` / `Encoding.aliases` /
+            # `Encoding.name_list` enumerate the same global
+            # registry. Same reasoning as `find` — the values
+            # are not guaranteed to match the analysed program's
+            # registry.
+            :list,
+            :aliases,
+            :name_list,
+            # Global-default mutators. `MethodCatalog#blocked?`
+            # only auto-blocks `!`-suffixed selectors, so we MUST
+            # list these explicitly: each writes the process-wide
+            # default-encoding slot read by `default_external` /
+            # `default_internal`.
+            :default_external=,
+            :default_internal=
+          ]
+        }
+      )
+    end
+  end
+end

data/lib/rigor/inference/builtins/exception_catalog.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require_relative "method_catalog"
+
+module Rigor
+  module Inference
+    module Builtins
+      # `Exception` catalog. Singleton — load once, consult during
+      # dispatch.
+      #
+      # Exception is the base of every Ruby error class (RuntimeError,
+      # StandardError, KeyError, …). The Init_Exception block in
+      # `references/ruby/error.c` registers the entire hierarchy in
+      # one pass, so the YAML carries 27 classes — but only the base
+      # `Exception` row is wired into `CATALOG_BY_CLASS` for v0.0.5.
+      # A `RuntimeError` receiver hits the Exception arm via
+      # `is_a?(Exception)` and the catalog answers with the base-class
+      # entries; subclass-specific methods (`KeyError#receiver`,
+      # `NameError#name`, …) intentionally miss the lookup until a
+      # later slice routes per-subclass class_names.
+      #
+      # The catalog tier here is *defence in depth* — every base
+      # method that could plausibly fold has been weighed against the
+      # robustness principle (strict on returns) and either left
+      # `:dispatch` / `:mutates_self` (in which case the catalog
+      # already declines) or blocklisted because the static classifier
+      # missed an indirect side effect. The remaining `:leaf` method
+      # that DOES fold is `#cause`, a pure accessor.
+      EXCEPTION_CATALOG = MethodCatalog.new(
+        path: File.expand_path(
+          "../../../../data/builtins/ruby_core/exception.yml",
+          __dir__
+        ),
+        mutating_selectors: {
+          "Exception" => Set[
+            # `exc_initialize` writes `mesg` / `backtrace` ivars on
+            # self via `rb_ivar_set` — the C-body classifier missed
+            # the indirect mutator because the helpers are not in
+            # its regex. Blocklisted so a hypothetical future
+            # `Constant<Exception>` carrier cannot fold an aliasing
+            # constructor through the catalog.
+            :initialize,
+            # `exc_exception` either returns self (no-arg) or calls
+            # `rb_obj_clone` + `exc_initialize_internal` on the
+            # clone — the clone branch mutates fresh state through
+            # the same indirect helpers as `:initialize`. Conservative
+            # blocklist; the cost is one folded no-arg call.
+            :exception,
+            # `exc_detailed_message` formats with platform / locale
+            # data (highlight markers depend on `$stderr.tty?` via
+            # the keyword arg default and `rb_io_tty_p`). Folding
+            # would freeze a value that depends on the calling
+            # process's stderr state.
+            :detailed_message,
+            # `exc_backtrace` reads the captured frame list, which
+            # depends on where the exception was raised — context
+            # the static fold tier cannot reproduce.
+            :backtrace,
+            # Same rationale as `:backtrace`; `Thread::Backtrace::Location`
+            # objects are runtime artefacts.
+            :backtrace_locations,
+            # `exc_set_backtrace` mutates the @backtrace ivar via
+            # `rb_ivar_set` — another indirect mutator the classifier
+            # missed.
+            :set_backtrace,
+            # `initialize_copy` is blocklisted by convention so a
+            # hypothetical future `Constant<Exception>` carrier
+            # cannot fold an aliasing copy through the catalog.
+            :initialize_copy,
+            # Defensive entries for the universal mutation surface.
+            # Object-identity hashing on a constant carrier is fine,
+            # but `eql?` on Exception delegates to `==` (dispatch);
+            # blocking both keeps the constant-fold tier honest.
+            :hash,
+            :eql?
+          ],
+          # `Exception.to_tty?` (singleton) calls
+          # `rb_io_tty_p($stderr)`; its return depends on the
+          # process's stderr state at runtime, never on compile-time
+          # arguments. The catalog tier today only consults
+          # `mutating_selectors` for instance-receiver dispatches via
+          # `CATALOG_BY_CLASS`, so this row is documentation-grade —
+          # it records the soundness rationale for any future slice
+          # that wires the singleton path through the catalog.
+          "Exception.singleton" => Set[
+            :to_tty?
+          ]
+        }
+      )
+    end
+  end
+end

data/lib/rigor/inference/builtins/proc_catalog.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require_relative "method_catalog"
+
+module Rigor
+  module Inference
+    module Builtins
+      # `Proc` / `Method` / `UnboundMethod` catalog. Singleton —
+      # load once, consult during dispatch.
+      #
+      # The three callable carriers are imported together because
+      # `Init_Proc` registers them in a single C init block. They
+      # share the same fundamental hazard at the catalog tier:
+      # most of their public methods invoke the wrapped Ruby code
+      # (the proc body, the bound method's receiver, …) and that
+      # code can do anything — read mutable state, call I/O, return
+      # different values on successive calls. The static C-body
+      # classifier marks these `:leaf` because the C functions
+      # themselves do not call `rb_funcall*` / `rb_yield` directly
+      # (they delegate through the VM's optimised call paths and
+      # method-entry table), but folding any of them at compile
+      # time would freeze a value the runtime never actually
+      # produces twice.
+      #
+      # The blocklist below errs aggressively on the side of
+      # caution: a hypothetical future `Constant<Proc>` /
+      # `Constant<Method>` / `Constant<UnboundMethod>` carrier
+      # would have very little to gain from these folds and a
+      # great deal to lose if user code ran behind the analyzer's
+      # back. Reflective readers (`#arity`, `#parameters`,
+      # `#source_location`, `#name`, `#owner`, `#receiver`) remain
+      # foldable; the RBS tier still resolves return types for
+      # the blocklisted methods so callers do not lose precision.
+      PROC_CATALOG = MethodCatalog.new(
+        path: File.expand_path(
+          "../../../../data/builtins/ruby_core/proc.yml",
+          __dir__
+        ),
+        mutating_selectors: {
+          "Proc" => Set[
+            # `#call` / `#[]` / `#===` / `#yield` invoke the proc
+            # body. The C body routes through
+            # `OPTIMIZED_METHOD_TYPE_CALL` (a VM fast path the
+            # classifier cannot see into); the proc body can do
+            # anything — read globals, mutate captured locals,
+            # raise. MUST decline to fold.
+            :call,
+            :[],
+            :===,
+            :yield,
+            # `#curry` / `#<<` / `#>>` allocate a fresh `Proc`
+            # that closes over the receiver (and, for `<<` /
+            # `>>`, over the argument). Folding would freeze a
+            # specific `Proc` instance whose identity the runtime
+            # never actually produces (object_id differs every
+            # call), so the catalog tier declines.
+            :curry,
+            :<<,
+            :>>,
+            # `#to_proc` returns `self` for `Proc` (cheap), but
+            # blocking it keeps the rule shape uniform across the
+            # three callable carriers (Method#to_proc allocates a
+            # fresh `Proc`).
+            :to_proc,
+            # Identity-based equality and hashing: `#hash` is
+            # derived from the underlying ISeq pointer; `#==` /
+            # `#eql?` compare ISeq + binding. Folding to a
+            # `Constant<Integer>` / `Constant<bool>` would freeze
+            # an answer that depends on memory layout. Defensive.
+            :hash,
+            :==,
+            :eql?,
+            # `initialize_copy` is blocklisted by convention so a
+            # hypothetical future `Constant<Proc>` carrier cannot
+            # fold an aliasing copy through the catalog.
+            :initialize_copy
+          ],
+          "Method" => Set[
+            # `#call` / `#[]` / `#===` invoke the bound method.
+            # Same hazard as `Proc#call`: arbitrary user code,
+            # arbitrary side effects.
+            :call,
+            :[],
+            :===,
+            # `#curry` / `#<<` / `#>>` allocate a fresh `Proc`
+            # that closes over the bound method.
+            :curry,
+            :<<,
+            :>>,
+            # `#to_proc` allocates a fresh `Proc` wrapping the
+            # bound method — folding would freeze its object_id.
+            # The classifier already marks it `:block_dependent`,
+            # but the explicit entry keeps the intent obvious.
+            :to_proc,
+            # `#unbind` allocates a fresh `UnboundMethod` whose
+            # identity differs every call.
+            :unbind,
+            # Identity-based equality and hashing.
+            :hash,
+            :==,
+            :eql?,
+            # `initialize_copy` is blocklisted by convention.
+            :initialize_copy
+          ],
+          "UnboundMethod" => Set[
+            # `#bind` allocates a fresh `Method` whose object_id
+            # differs every call; `#bind_call` invokes the bound
+            # method (already classified `:block_dependent`).
+            :bind,
+            :bind_call,
+            # Identity-based equality and hashing.
+            :hash,
+            :==,
+            :eql?,
+            # `initialize_copy` is blocklisted by convention.
+            :initialize_copy
+          ]
+        }
+      )
+    end
+  end
+end