rigortype 0.3.1 → 0.3.2

data/lib/rigor/inference/method_dispatcher/uri_folding.rb

@@ -20,12 +20,31 @@ module Rigor
       #   decode. Returns `Constant[String]`.
       # * `encode_uri_component(str)` / `decode_uri_component(str)` — Same encoding but may preserve
       #   additional reserved chars (Ruby 3.2+). Returns `Constant[String]`.
+      # * `encode_www_form(enum)` — the whole-form encoder, over a `Tuple` of `[key, value]` `Tuple`s (an
+      #   array literal) or a `HashShape` (a hash literal) whose keys and values are all `Constant`.
+      #   Returns `Constant[String]`.
+      # * `decode_www_form(str)` — the inverse, over a `Constant[String]`. Returns a `Tuple` of two-element
+      #   `Tuple[Constant[String], Constant[String]]` pairs rather than the RBS tier's
+      #   `Array[[String, String]]`, so a destructuring read of a known form gets the concrete strings.
+      # * `extract(str)` — the URIs a constant string contains, as a `Tuple` of `Constant[String]` rather
+      #   than `Array[String]`. Single-argument form only (see {.fold_extract}).
+      #
+      # === Deliberately NOT folded
+      #
+      # `URI.parse` and `URI.join` are the two remaining gaps in this module's coverage note, and both are
+      # declined on the repo's own existing rule rather than on judgement: they return `URI::Generic` and
+      # friends, which are absent from `ConstantFolding::FOLDABLE_CONSTANT_CLASSES`, so there is no
+      # `Constant[…]` for this tier to produce. Narrowing `URI.parse`'s ten-arm return union to the one
+      # scheme class a constant string selects WOULD be a real precision win, but it makes a gradually-valid
+      # dispatch precise and can therefore surface a diagnostic that does not fire today — which puts it in
+      # the bucket-3 / P0 category, not in this FP-safe fold category ([#121](
+      # https://github.com/rigortype/rigor/issues/121)).
       #
       # === Non-constant / unsupported cases
       #
       # Returns `nil` (deferring to the next dispatcher tier) when:
       # - the receiver is not `Singleton[URI]`,
-      # - the first argument is not a `Constant[String]`,
+      # - an argument is not the constant shape the method's fold requires,
       # - the method is not in the supported set.
       module URIFolding
         URI_COMPONENT_METHODS = Set[
@@ -34,6 +53,12 @@ module Rigor
         ].freeze
         private_constant :URI_COMPONENT_METHODS
 
+        # A form long enough to suggest generated or accumulated data rather than a literal a reader wrote;
+        # past it the folded `Constant[String]` stops being useful in a diagnostic and only costs memory.
+        # Mirrors the byte ceiling `ShapeDispatch`'s own `tuple_join` fold applies for the same reason.
+        FORM_PAIR_LIMIT = 64
+        private_constant :FORM_PAIR_LIMIT
+
         module_function
 
         # @return [Rigor::Type, nil] folded result, or nil to defer.
@@ -42,11 +67,109 @@ module Rigor
           method_name = context.method_name
           args = context.args
           return nil unless SingletonFolding.receiver?(receiver, "URI")
+          return fold_encode_www_form(args) if method_name == :encode_www_form
+          return fold_decode_www_form(args) if method_name == :decode_www_form
+          return fold_extract(args) if method_name == :extract
           return nil unless URI_COMPONENT_METHODS.include?(method_name)
 
           fold_uri_call(method_name, args)
         end
 
+        # `URI.encode_www_form(enum)` — deterministic over its whole input, so it folds only when EVERY key
+        # and value is already a `Constant`. One non-constant pair declines the whole call: a partially
+        # known form has no `Constant[String]` to stand for it.
+        def fold_encode_www_form(args)
+          return nil unless args.size == 1
+
+          pairs = form_pairs(args.first)
+          return nil if pairs.nil? || pairs.size > FORM_PAIR_LIMIT
+
+          Type::Combinator.constant_of(URI.encode_www_form(pairs))
+        rescue StandardError
+          nil
+        end
+
+        # The `[key, value]` pairs of a literal form argument, or nil when the shape is not fully known:
+        # a `Tuple` of two-element `Tuple`s (the array-of-pairs spelling) or a `HashShape` (the hash
+        # spelling). `HashShape` pairs are read only when the shape is CLOSED and carries no optional key —
+        # an open or partially-optional shape describes a hash whose real contents this fold cannot see.
+        def form_pairs(arg)
+          case arg
+          when Type::Tuple then tuple_form_pairs(arg)
+          when Type::HashShape then hash_form_pairs(arg)
+          end
+        end
+
+        def tuple_form_pairs(tuple)
+          tuple.elements.map do |element|
+            return nil unless element.is_a?(Type::Tuple) && element.elements.size == 2
+            return nil unless element.elements.all?(Type::Constant)
+
+            element.elements.map(&:value)
+          end
+        end
+
+        def hash_form_pairs(shape)
+          return nil unless shape.closed? && shape.optional_keys.empty?
+
+          shape.pairs.map do |key, value|
+            return nil unless value.is_a?(Type::Constant)
+
+            [key, value.value]
+          end
+        end
+
+        # `URI.decode_www_form(str)` — the pair list of a constant form, as a `Tuple` of two-element
+        # `Tuple`s so a destructuring read (`k, v = URI.decode_www_form(s).first`) reaches the concrete
+        # strings instead of the RBS tier's `Array[[String, String]]`.
+        def fold_decode_www_form(args)
+          return nil unless args.size == 1
+
+          str = SingletonFolding.constant_string(args.first)
+          return nil if str.nil?
+
+          pairs = URI.decode_www_form(str)
+          return nil if pairs.size > FORM_PAIR_LIMIT
+
+          Type::Combinator.tuple_of(*pairs.map { |key, value| constant_pair(key, value) })
+        rescue StandardError
+          nil
+        end
+
+        def constant_pair(key, value)
+          Type::Combinator.tuple_of(Type::Combinator.constant_of(key), Type::Combinator.constant_of(value))
+        end
+
+        # `URI.extract(str)` — the URIs a constant string contains, as a `Tuple` of `Constant[String]`
+        # instead of the RBS tier's `Array[String]`. Only the single-argument form folds: the optional
+        # second argument is a schema FILTER, and honouring it means reproducing `URI.extract`'s own
+        # argument handling rather than the one call this fold makes, so it declines instead.
+        #
+        # Ruby emits an obsolescence warning for this method under `$VERBOSE`; the fold calls it with
+        # warnings silenced, because a warning about the ANALYZED program's API choice must not appear on
+        # the analyzer's own stderr, where a reader would attribute it to Rigor.
+        def fold_extract(args)
+          return nil unless args.size == 1
+
+          str = SingletonFolding.constant_string(args.first)
+          return nil if str.nil?
+
+          found = silence_warnings { URI.extract(str) }
+          return nil if found.nil? || found.size > FORM_PAIR_LIMIT
+
+          Type::Combinator.tuple_of(*found.map { |uri| Type::Combinator.constant_of(uri) })
+        rescue StandardError
+          nil
+        end
+
+        def silence_warnings
+          previous = $VERBOSE
+          $VERBOSE = nil
+          yield
+        ensure
+          $VERBOSE = previous
+        end
+
         def fold_uri_call(method_name, args)
           return nil unless args.size == 1
 

data/lib/rigor/inference/mutation_widening.rb

@@ -2,6 +2,7 @@
 
 require_relative "../type"
 require_relative "../source/node_children"
+require_relative "receiver_alias"
 
 module Rigor
   module Inference
@@ -45,6 +46,10 @@ module Rigor
     #
     # - `arr.<mutator>(...)` where `arr` is a local variable.
     # - `@arr.<mutator>(...)` where `@arr` is an instance variable.
+    # - a receiver that *selects* among such variables rather than naming one —
+    #   `(kind == :required ? required : optional)[key] = info`, an `if`/`else`, `||` / `&&`. Every
+    #   variable the expression can evaluate to is a possible mutation target, so every one widens
+    #   (issue #277). See {ReceiverAlias}.
     #
     # Out of scope (left for a separate cycle):
     #
@@ -100,10 +105,10 @@ module Rigor
         PURE_SELF_RETURNERS.include?(method_name)
       end
 
-      # Returns a scope with the call's receiver widened, when the receiver is a
-      # local-/instance-variable read whose current binding is a literal-shape carrier
+      # Returns a scope with the call's receiver widened, for every variable the receiver expression
+      # can evaluate to ({ReceiverAlias.candidates}) whose current binding is a literal-shape carrier
       # (`Tuple` / `HashShape`) or an empty-witness refinement (`non-empty-array` /
-      # `non-empty-hash`) AND the call name is a known in-place mutator for that shape.
+      # `non-empty-hash`) AND whose call name is a known in-place mutator for that shape.
       # Returns `current_scope` unchanged otherwise.
       #
       # @param call_node     [Prism::CallNode]
@@ -115,13 +120,8 @@ module Rigor
         receiver = call_node.receiver
         return current_scope if receiver.nil?
 
-        case receiver
-        when Prism::LocalVariableReadNode
-          widen_local(call_node.name, receiver.name, current_scope)
-        when Prism::InstanceVariableReadNode
-          widen_ivar(call_node.name, receiver.name, current_scope)
-        else
-          current_scope
+        ReceiverAlias.candidates(receiver).reduce(current_scope) do |acc, read|
+          widen_alias_read(call_node.name, read, acc)
         end
       end
 
@@ -130,13 +130,13 @@ module Rigor
       # LOCALS are otherwise invisible to the post-call outer scope (ivars are handled correctly
       # already because they live in the method-body scope, not the block-local scope).
       #
-      # Walks the block AST for `<receiver>.<method>(...)` calls whose receiver is either a
-      # `LocalVariableReadNode` with `depth > 0` (a captured outer local — Prism's `depth`
-      # counts scope hops outward; `depth == 0` means a block-local) or an
-      # `InstanceVariableReadNode` (always method-scope), and applies `widen_after_call` for
-      # each one against the outer scope. The widening is always safe — it can only LOSE
-      # precision — so blindly propagating is sound regardless of whether the block actually
-      # runs.
+      # Walks the block AST for `<receiver>.<method>(...)` calls, resolves the receiver expression
+      # to the variables it can evaluate to ({ReceiverAlias.candidates}), and widens each one
+      # against the outer scope. A `LocalVariableReadNode` with `depth == 0` is skipped — Prism's
+      # `depth` counts scope hops outward, so `0` means a block-local, not a capture; an
+      # `InstanceVariableReadNode` is always method-scope and always applies. The widening is
+      # always safe — it can only LOSE precision — so blindly propagating is sound regardless of
+      # whether the block actually runs.
       #
       # Recurses into nested expression nodes so chained / nested forms (`arr << f(x); arr <<
       # g(y)`, `arr.push(x) if cond`) are all caught. Does NOT recurse into nested
@@ -174,15 +174,20 @@ module Rigor
         receiver = call_node.receiver
         return scope if receiver.nil?
 
-        case receiver
-        when Prism::LocalVariableReadNode
-          return scope if receiver.depth.zero?
+        ReceiverAlias.candidates(receiver).reduce(scope) do |acc, read|
+          # A block-local read (`depth == 0`) is not a capture of the outer scope, so widening its
+          # name against the OUTER scope would hit an unrelated same-named binding.
+          next acc if read.is_a?(Prism::LocalVariableReadNode) && read.depth.zero?
 
-          widen_local(call_node.name, receiver.name, scope)
-        when Prism::InstanceVariableReadNode
-          widen_ivar(call_node.name, receiver.name, scope)
-        else
-          scope
+          widen_alias_read(call_node.name, read, acc)
+        end
+      end
+
+      def widen_alias_read(method_name, read, scope)
+        case read
+        when Prism::LocalVariableReadNode then widen_local(method_name, read.name, scope)
+        when Prism::InstanceVariableReadNode then widen_ivar(method_name, read.name, scope)
+        else scope
         end
       end
 

data/lib/rigor/inference/narrowing.rb

@@ -1169,7 +1169,9 @@ module Rigor
         # so the proven-absent key reads `nil`. Returns the input unchanged when nothing
         # applies (caller detects "no narrowing"). Only an *optional* present key is removed: a
         # required key makes `key?` always true (the false edge is dead, leave the shape opaque)
-        # and a key absent from `pairs` already reads `nil`.
+        # and a key absent from `pairs` already reads `nil` on a closed shape. On an open shape an
+        # undeclared key keeps reading `untyped` on this edge — sound but imprecise, since the shape
+        # carries no per-key exclusion to record what the guard just proved absent.
         def narrow_hash_key_absent(type, key)
           case type
           when Type::HashShape

data/lib/rigor/inference/optimistic_origin.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    # Marks a value whose *nil-freeness* rests on Rigor's deliberate choice to ignore core RBS's
+    # `%a{implicitly-returns-nil}` annotation rather than on the value's class. See
+    # docs/internal-spec/inference-engine.md § "That deferred-to answer is nil-free for a lookup that can
+    # miss": `Hash#[]` reads as `V` and `Array#first` as `E` because pessimising them to `V?` costs 25
+    # measured false positives on Rigor's own `lib`. The consequence the spec draws is that such a value is
+    # **optimistic, not proof** — `MAP[key]` reading as `"x" | "y"` asserts nothing about whether the key was
+    # present.
+    #
+    # A side channel in the ADR-75 / ADR-82 sense: it never participates in subtyping, consistency,
+    # normalization or erasure, and no diagnostic fires from it. It differs from {DynamicOrigin} in what it
+    # attaches to — the value here is *not* `Dynamic`; it is an ordinary `Union` / `Constant` / `Nominal`
+    # that happens to have been produced optimistically.
+    #
+    # Issue #286: the `if` / `unless` branch elision is a third consumer of `Narrowing.predicate_certainty`,
+    # and unlike `flow.always-truthy-condition` and the `&&` / `||` gate it is not constrained by the spec
+    # passage above. This channel is what lets a certainty judgment tell the two apart.
+    module OptimisticOrigin
+      # The core-RBS annotation `RbsDispatch` reads the return type past.
+      ANNOTATION = "implicitly-returns-nil"
+
+      # The single cause carried today. Kept as a symbol (rather than a bare `true`) so a later slice can
+      # distinguish further optimistic families without changing the table's shape.
+      IMPLICITLY_RETURNS_NIL = :implicitly_returns_nil
+
+      module_function
+
+      # Whether the overload the selector actually picked carries the ignored annotation. The judgment is
+      # per-overload, which is what makes it precise: `Array#first` is optimistic while `Array#first(3)` is
+      # not, and `String#[]` / `Enumerable#find` are honest because they already spell the miss as `?`.
+      #
+      # @param method_definition [RBS::Definition::Method]
+      # @param method_type [RBS::MethodType] the overload {OverloadSelector.select} returned
+      # @return [Boolean]
+      def optimistic_overload?(method_definition, method_type)
+        type_def = matching_type_def(method_definition, method_type)
+        return false unless type_def.respond_to?(:overload_annotations)
+
+        type_def.overload_annotations.any? { |annotation| annotation.string == ANNOTATION }
+      end
+
+      # `RBS::Definition::Method#defs` runs parallel to `#method_types`, and the selector returns one of the
+      # latter's elements verbatim (`ReceiverAffinity.reorder` permutes the array without copying its
+      # members), so identity resolves the overload exactly. Equality is a fallback for any future path that
+      # rebuilds the method type.
+      def matching_type_def(method_definition, method_type)
+        return nil unless method_definition.respond_to?(:defs)
+
+        defs = method_definition.defs
+        defs.find { |type_def| type_def.type.equal?(method_type) } ||
+          defs.find { |type_def| type_def.type == method_type }
+      end
+    end
+  end
+end

data/lib/rigor/inference/protection_scanner.rb

@@ -3,6 +3,7 @@
 require_relative "scope_indexer"
 require_relative "origin_lookup"
 require_relative "../source/node_walker"
+require_relative "../analysis/check_rules/inferred_param_guard"
 
 module Rigor
   module Inference
@@ -20,7 +21,11 @@ module Rigor
       # A single unprotected call site.
       Site = Data.define(:line, :receiver, :method_name, :dynamic_origin)
 
-      FileResult = Data.define(:protected_count, :unprotected_count, :sites) do
+      # `lower_bound_typed` is a split WITHIN `protected_count`, never a move out of it (issue #263):
+      # a site whose receiver is concrete but rooted at a WD6b-marked inferred parameter (
+      # {Analysis::CheckRules::InferredParamGuard.rooted?}) is a lower-bound type — `protected_count`
+      # and `ratio` stay exactly as before, so `--threshold` never moves on unchanged code.
+      FileResult = Data.define(:protected_count, :unprotected_count, :lower_bound_typed, :sites) do
         def total = protected_count + unprotected_count
 
         # Protected ratio; a file with no dispatch sites is vacuously fully protected (nothing to get
@@ -37,6 +42,7 @@ module Rigor
       def scan(root)
         index = ScopeIndexer.index(root, default_scope: @scope)
         protected_count = 0
+        lower_bound_typed = 0
         sites = []
 
         Source::NodeWalker.each(root) do |node|
@@ -46,6 +52,7 @@ module Rigor
           receiver_type = scope.type_of(node.receiver)
           if concrete_receiver?(receiver_type)
             protected_count += 1
+            lower_bound_typed += 1 if lower_bound_typed?(node.receiver, scope)
           else
             origin = OriginLookup.origin_for(scope, node.receiver)
             sites << Site.new(
@@ -57,7 +64,8 @@ module Rigor
           end
         end
 
-        FileResult.new(protected_count: protected_count, unprotected_count: sites.size, sites: sites)
+        FileResult.new(protected_count: protected_count, unprotected_count: sites.size,
+                       lower_bound_typed: lower_bound_typed, sites: sites)
       end
 
       private
@@ -77,6 +85,14 @@ module Rigor
         end
       end
 
+      # ADR-67 WD6b (issue #263) — true when a concrete receiver is rooted at an inferred-but-undeclared
+      # parameter: the type is a call-site lower bound, so the negative in-body rules decline on it (no
+      # diagnostic can actually fire here yet). Delegates to the single-homed shared predicate every
+      # negative rule already consults — nothing is re-derived.
+      def lower_bound_typed?(receiver, scope)
+        Analysis::CheckRules::InferredParamGuard.rooted?(receiver, scope)
+      end
+
       def safe_describe(type)
         type.respond_to?(:describe) ? type.describe(:short) : type.to_s
       rescue StandardError

data/lib/rigor/inference/receiver_alias.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    # Which variables can a receiver EXPRESSION evaluate to?
+    #
+    # A receiver-fact invalidation (see {MutationWidening}) has to name the binding it invalidates,
+    # and the overwhelmingly common receiver — a bare `arr` / `@arr` read — names exactly one. But a
+    # receiver may also *select* among variables without naming any of them:
+    #
+    #     (kind == :required ? required : optional)[key] = info
+    #
+    # The mutation lands on whichever of `required` / `optional` the ternary picked, so BOTH are
+    # possible targets and both must forget their literal shape. Reading only the syntactic head
+    # left both hashes carrying the empty `HashShape` the literal `{}` wrote, and a downstream
+    # `.empty?` then constant-folded into a false `flow.always-truthy-condition`
+    # ([#277](https://github.com/rigortype/rigor/issues/277)).
+    #
+    # The recursion covers only the forms whose value IS one of the sub-expressions: `if` / `unless`
+    # (including the ternary spelling), the short-circuit operators, and the transparent wrappers.
+    # Anything else — an index read (`declared[kind] << key`), a call result, a literal — names an
+    # object no binding can be attributed to and yields `[]`, which is what every receiver form
+    # outside the single-read case already contributed. The walk is depth-capped so a pathological
+    # nest cannot make receiver classification unbounded.
+    module ReceiverAlias
+      # Deep enough for any hand-written selection; a nest beyond it degrades to "names no binding".
+      WALK_DEPTH_CAP = 6
+
+      module_function
+
+      # @param node  [Prism::Node, nil] the receiver expression.
+      # @param depth [Integer] recursion depth, internal.
+      # @return [Array<Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode>] every variable
+      #   read the expression can evaluate to; empty when it can evaluate to none.
+      def candidates(node, depth = 0)
+        return [] if node.nil? || depth > WALK_DEPTH_CAP
+
+        case node
+        when Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode then [node]
+        when Prism::ParenthesesNode then candidates(node.body, depth + 1)
+        when Prism::StatementsNode then candidates(node.body.last, depth + 1)
+        when Prism::ElseNode then candidates(node.statements, depth + 1)
+        when Prism::IfNode then branches(node.statements, node.subsequent, depth)
+        when Prism::UnlessNode then branches(node.statements, node.else_clause, depth)
+        when Prism::OrNode, Prism::AndNode then branches(node.left, node.right, depth)
+        else []
+        end
+      end
+
+      def branches(first, second, depth)
+        candidates(first, depth + 1) + candidates(second, depth + 1)
+      end
+    end
+  end
+end

data/lib/rigor/inference/scope_indexer.rb

@@ -1275,16 +1275,40 @@ module Rigor
       end
 
       # Merges two `class_name => { method => kind }` tables, unioning the per-class method maps (so a seeded cross-file
-      # table and the current file's table combine instead of clobbering).
+      # table and the current file's table combine instead of clobbering). A name recorded on both sides — an instance
+      # `def` here and a `class << self` twin there — merges to {Scope::DiscoveryIndex::METHOD_KIND_BOTH} rather than
+      # letting the overlay's kind win (#239).
       def deep_merge_class_methods(base, overlay)
         return overlay if base.nil? || base.empty?
         return base if overlay.empty?
 
         base.merge(overlay) do |_class_name, base_methods, overlay_methods|
-          base_methods.merge(overlay_methods)
+          merge_method_kinds(base_methods, overlay_methods)
         end
       end
 
+      # `{ method => kind }` union that promotes a kind disagreement to `METHOD_KIND_BOTH` instead of clobbering.
+      def merge_method_kinds(base_methods, overlay_methods)
+        base_methods.merge(overlay_methods) do |_method_name, base_kind, overlay_kind|
+          base_kind == overlay_kind ? base_kind : Scope::DiscoveryIndex::METHOD_KIND_BOTH
+        end
+      end
+
+      # The single write path into a `class_name => { method => kind }` existence table. Every recorder goes through
+      # it so a class that defines one name on both sides keeps both facts: the table is keyed by name alone, so a
+      # bare assignment silently replaced the other side's kind and `Scope#discovered_method?` then answered false for
+      # a method the source plainly defines (#239).
+      def record_method_kind(accumulator, class_name, method_name, kind)
+        table = (accumulator[class_name] ||= {})
+        recorded = table[method_name]
+        table[method_name] =
+          if recorded.nil? || recorded == kind
+            kind
+          else
+            Scope::DiscoveryIndex::METHOD_KIND_BOTH
+          end
+      end
+
       # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/AbcSize
       # Combined `walk_methods` + `walk_def_nodes` descent. The two walks had identical class / module / singleton-class
       # / meta-block traversals and both stopped at `DefNode`; the only divergences are leaf actions (recorded into the
@@ -1393,8 +1417,7 @@ module Rigor
         return if members.empty?
 
         class_name = qualified_prefix.join("::")
-        table = (accumulator[class_name] ||= {})
-        members.each { |member| table[member] ||= :instance }
+        members.each { |member| record_method_kind(accumulator, class_name, member, :instance) }
       end
 
       # The Symbol member names of a `Data.define(*Symbol)` / `Struct.new(*Symbol [, keyword_init:])` call. For
@@ -1412,8 +1435,7 @@ module Rigor
         class_name = qualified_prefix.join("::")
         singleton = def_singleton?(def_node, qualified_prefix, in_singleton_class)
         kind = singleton ? :singleton : :instance
-        accumulator[class_name] ||= {}
-        accumulator[class_name][def_node.name] = kind
+        record_method_kind(accumulator, class_name, def_node.name, kind)
       end
 
       # `def Foo.bar` inside `module Foo` (or `def Meta.init` inside `module Meta`) is semantically equivalent to `def
@@ -1918,7 +1940,7 @@ module Rigor
         class_name = qualified_prefix.join("::")
         new_name = alias_node.new_name.unescaped.to_sym
         kind = in_singleton_class ? :singleton : :instance
-        (accumulator[class_name] ||= {})[new_name] = kind
+        record_method_kind(accumulator, class_name, new_name, kind)
       end
 
       # Post-pass over the `def_nodes` accumulator: for every `alias` declaration inside a class body, if the original
@@ -1981,8 +2003,7 @@ module Rigor
         return if method_name.nil?
 
         class_name = qualified_prefix.join("::")
-        accumulator[class_name] ||= {}
-        accumulator[class_name][method_name] = in_singleton_class ? :singleton : :instance
+        record_method_kind(accumulator, class_name, method_name, in_singleton_class ? :singleton : :instance)
       end
 
       # The `attr_*` accessor macros that introduce methods Rigor must treat as source-declared. Without this, a class
@@ -2005,9 +2026,8 @@ module Rigor
           base = literal_method_name(arg)
           next if base.nil?
 
-          accumulator[class_name] ||= {}
-          accumulator[class_name][base] = kind if reader
-          accumulator[class_name][:"#{base}="] = kind if writer
+          record_method_kind(accumulator, class_name, base, kind) if reader
+          record_method_kind(accumulator, class_name, :"#{base}=", kind) if writer
         end
       end
 
@@ -2352,7 +2372,7 @@ module Rigor
         file_index[:def_nodes].each { |cn, methods| (acc[:def_nodes][cn] ||= {}).merge!(methods) }
         file_index[:singleton_def_nodes].each { |cn, methods| (acc[:singleton_def_nodes][cn] ||= {}).merge!(methods) }
         file_index[:method_visibilities].each { |cn, table| (acc[:method_visibilities][cn] ||= {}).merge!(table) }
-        file_index[:methods].each { |cn, table| (acc[:methods][cn] ||= {}).merge!(table) }
+        file_index[:methods].each { |cn, table| acc[:methods][cn] = merge_method_kinds(acc[:methods][cn] || {}, table) }
         fold_def_sources(acc, :def_sources, file_index[:def_sources])
         fold_def_sources(acc, :singleton_def_sources, file_index[:singleton_def_sources])
       end
@@ -2468,10 +2488,18 @@ module Rigor
 
       # Removes, per class, the method names that have a project `def` node, leaving only
       # accessor/alias/define_method-introduced methods in the cross-file suppression table.
+      #
+      # `def_nodes` is the INSTANCE-side table, so a name recorded on both sides keeps its singleton half: that half
+      # comes from a `def self.x` / `class << self` definition this rule never covered, and dropping it whole would
+      # reintroduce #239's false `call.undefined-method` across files.
       def subtract_def_methods(methods, def_nodes)
         methods.each_with_object({}) do |(class_name, table), out|
           defs = def_nodes[class_name] || {}
-          kept = table.reject { |method_name, _kind| defs.key?(method_name) }
+          kept = table.each_with_object({}) do |(method_name, kind), acc|
+            next acc[method_name] = kind unless defs.key?(method_name)
+
+            acc[method_name] = :singleton if kind == Scope::DiscoveryIndex::METHOD_KIND_BOTH
+          end
           out[class_name] = kept unless kept.empty?
         end
       end
@@ -2517,7 +2545,7 @@ module Rigor
           (acc[:method_visibilities][class_name] ||= {}).merge!(table)
         end
         file_methods.each do |class_name, table|
-          (acc[:methods][class_name] ||= {}).merge!(table)
+          acc[:methods][class_name] = merge_method_kinds(acc[:methods][class_name] || {}, table)
         end
       end
 
@@ -2570,24 +2598,47 @@ module Rigor
         node.rigor_each_child { |child| collect_class_decls(child, qualified_prefix, accumulator) }
       end
 
-      # T1 (template-corpora survey) — record a `Const = Class.new(Super)` (and the bare `Class.new` / `Module.new`)
-      # class-creating constant in the cross-file discovery table so a reference to `Const` from ANOTHER file under the
-      # same namespace resolves to the project class instead of falling through to a core same-named class
+      # T1 (template-corpora survey) — record a class-creating constant write (`Const = Class.new(Super)`, the bare
+      # `Class.new` / `Module.new`, and the `Data.define(*sym)` / `Struct.new(*sym)` forms, each with or without a
+      # block) in the cross-file discovery table so a reference to `Const` from ANOTHER file under the same namespace
+      # resolves to the project class instead of falling through to a same-named class elsewhere
       # (`Liquid::SyntaxError = Class.new(Error)` referenced in a sibling file's `rescue SyntaxError => e`, which
       # otherwise resolved to core `::SyntaxError`). Mirrors the single-file `in_source_constants` answer, which types
-      # `Class.new(Super)` as `Singleton[Super]` (the constructed class answers method lookups through Super's chain).
-      # The superclass name is resolved lexically against the enclosing prefix; a bare `Class.new` with no superclass
-      # (or `Module.new`) types as `Singleton[Const]` itself. The block form is left to the existing
-      # `meta_new_block_body` machinery — only the plain `Class.new(Super)` constant (the namespaced-sibling-error
-      # idiom) is added here.
+      # `Class.new(Super)` as `Singleton[Super]` (the constructed class answers method lookups through Super's chain)
+      # and every other recognised form as `Singleton[Const]`.
+      #
+      # #271 — the Data/Struct forms are here because their absence was an ACTIVE false positive, not merely a missed
+      # resolution: a nested `Const = Data.define(...)` invisible cross-file lets Ruby's lexical walk continue to the
+      # PARENT namespace's same-named sibling, so `Analysis::PluginFactFingerprint.from_registry(...).opaque?` typed
+      # its receiver as the unrelated `Rigor::Analysis::Result` and reported `call.undefined-method` on correct code.
+      # Nested `Result` / `Entry` / `Config` Data constants shadowing a sibling are ordinary Ruby, and only the
+      # DEFINING file's `in_source_constants` (never part of the project seed) knew about them.
       def record_class_new_constant_decl(node, qualified_prefix, accumulator)
         rvalue = node.value
-        return unless class_new_call?(rvalue) || module_new_call?(rvalue)
-        return if rvalue.block # block form: handled by meta_new_block_body walks
+        return unless meta_new_constant_rvalue?(rvalue)
 
         full = (qualified_prefix + [node.name.to_s]).join("::")
-        super_name = class_new_superclass_name(rvalue, qualified_prefix, accumulator)
-        accumulator[full] = Type::Combinator.singleton_of(super_name || full)
+        accumulator[full] = Type::Combinator.singleton_of(
+          meta_new_constant_decl_name(rvalue, full, qualified_prefix, accumulator)
+        )
+      end
+
+      # The four recognised class-creating rvalue shapes at constant-write position — the same set
+      # {#meta_new_block_body} recognises, so the cross-file table and the per-file block-as-method walk agree on what
+      # counts as a declaration.
+      def meta_new_constant_rvalue?(rvalue)
+        class_new_call?(rvalue) || module_new_call?(rvalue) ||
+          data_define_call?(rvalue) || struct_new_call?(rvalue)
+      end
+
+      # The name the constant's `Singleton[...]` carries. Only a block-less `Class.new(Super)` borrows its superclass's
+      # name (the constructed class answers lookups through `Super`'s chain and declares nothing of its own); every
+      # other form — Data/Struct members, any block body — owns methods under its OWN qualified name, which is exactly
+      # what the per-file `meta_new_constant_type` answers.
+      def meta_new_constant_decl_name(rvalue, full, qualified_prefix, accumulator)
+        return full if rvalue.block || data_define_call?(rvalue) || struct_new_call?(rvalue)
+
+        class_new_superclass_name(rvalue, qualified_prefix, accumulator) || full
       end
 
       # Lexically-qualified name of a `Class.new(Super)` superclass argument, or nil when there is no positional