rigortype 0.3.2 → 0.3.3

data/lib/rigor/inference/scope_indexer.rb

@@ -7,6 +7,7 @@ require_relative "../type"
 require_relative "../source/constant_path"
 require_relative "../source/node_children"
 require_relative "../cache/file_digest"
+require_relative "anonymous_meta_class"
 require_relative "def_handle"
 require_relative "mutation_widening"
 require_relative "narrowing"
@@ -133,7 +134,7 @@ module Rigor
       # file_def_nodes]` so the caller can thread the def-node table into {#merge_project_method_indexes} without
       # walking the file a second time.
       def seed_discovered_methods(seeded_scope, default_scope, root)
-        file_methods, file_def_nodes = build_methods_and_def_nodes(root)
+        file_methods, file_def_nodes = build_methods_and_def_nodes(root, default_scope.source_path)
         discovered_methods = deep_merge_class_methods(default_scope.discovered_methods, file_methods)
         scope = seeded_scope.with_discovery(seeded_scope.discovery.with(discovered_methods: discovered_methods))
         [scope, file_def_nodes]
@@ -161,7 +162,7 @@ module Rigor
           build_discovered_singleton_def_nodes(root)
         ) { |_class, cross_file, per_file| cross_file.merge(per_file) }
         superclasses = default_scope.discovered_superclasses.merge(
-          build_discovered_superclasses(root)
+          build_discovered_superclasses(root, default_scope.source_path)
         )
         includes = default_scope.discovered_includes.merge(
           build_discovered_includes(root)
@@ -1266,10 +1267,10 @@ module Rigor
       # `walk_methods` and `walk_def_nodes` had byte-identical class / module / singleton / meta-block descents (both
       # stop at `DefNode`), so a single combined walk records both accumulators at once instead of traversing every file
       # twice.
-      def build_methods_and_def_nodes(root)
+      def build_methods_and_def_nodes(root, source_path = nil)
         methods = {}
         def_nodes = {}
-        walk_methods_and_def_nodes(root, [], false, methods, def_nodes)
+        walk_methods_and_def_nodes(root, [], false, methods, def_nodes, source_path)
         apply_alias_def_nodes(root, def_nodes)
         [methods.transform_values(&:freeze).freeze, def_nodes.transform_values(&:freeze).freeze]
       end
@@ -1315,7 +1316,8 @@ module Rigor
       # right accumulator) and the original `walk_methods` returning at `AliasMethodNode` (its symbol-only children
       # carry no def / class node, so not descending them is byte-identical for `def_nodes` too). See
       # {#build_methods_and_def_nodes}.
-      def walk_methods_and_def_nodes(node, qualified_prefix, in_singleton_class, methods_acc, def_nodes_acc)
+      def walk_methods_and_def_nodes(node, qualified_prefix, in_singleton_class, methods_acc, def_nodes_acc,
+                                     source_path = nil)
         return unless node.is_a?(Prism::Node)
 
         case node
@@ -1324,21 +1326,27 @@ module Rigor
           if name
             child_prefix = qualified_prefix + [name]
             record_meta_superclass_members(node, child_prefix, methods_acc) if node.is_a?(Prism::ClassNode)
-            walk_methods_and_def_nodes(node.body, child_prefix, false, methods_acc, def_nodes_acc) if node.body
+            if node.body
+              walk_methods_and_def_nodes(node.body, child_prefix, false, methods_acc, def_nodes_acc, source_path)
+            end
             return
           end
         when Prism::SingletonClassNode
           if node.body
             singleton_prefix = singleton_class_prefix(node, qualified_prefix)
             if singleton_prefix
-              walk_methods_and_def_nodes(node.body, singleton_prefix, true, methods_acc, def_nodes_acc)
+              walk_methods_and_def_nodes(node.body, singleton_prefix, true, methods_acc, def_nodes_acc, source_path)
               return
             end
           end
         when Prism::ConstantWriteNode
           if meta_new_block_body(node)
             child_prefix = qualified_prefix + [node.name.to_s]
-            walk_methods_and_def_nodes(meta_new_block_body(node), child_prefix, false, methods_acc, def_nodes_acc)
+            walk_methods_and_def_nodes(meta_new_block_body(node), child_prefix, false, methods_acc, def_nodes_acc,
+                                       source_path)
+            # No anonymous registration here: the constant IS the name, and `StatementEvaluator` never routes a
+            # constant-write rvalue through the block-body narrowing (its scope index still shows `self` as
+            # `Dynamic[top]` inside such a body), so the two passes agree on the constant name alone.
             return
           end
         when Prism::DefNode
@@ -1349,14 +1357,43 @@ module Rigor
           record_alias_method(node, qualified_prefix, in_singleton_class, methods_acc)
           return
         when Prism::CallNode
-          record_define_method(node, qualified_prefix, in_singleton_class, methods_acc) if node.name == :define_method
-          if ATTR_MACROS.include?(node.name)
-            record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc)
+          anonymous = record_call_node_methods(node, qualified_prefix, in_singleton_class, methods_acc, source_path)
+          if anonymous
+            walk_anonymous_meta_block(node, anonymous, qualified_prefix, in_singleton_class, methods_acc,
+                                      def_nodes_acc, source_path)
+            return
           end
         end
 
         node.rigor_each_child do |child|
-          walk_methods_and_def_nodes(child, qualified_prefix, in_singleton_class, methods_acc, def_nodes_acc)
+          walk_methods_and_def_nodes(child, qualified_prefix, in_singleton_class, methods_acc, def_nodes_acc,
+                                     source_path)
+        end
+      end
+
+      # The `Prism::CallNode` leaf actions of {#walk_methods_and_def_nodes}: the `define_method` / `attr_*` macro
+      # recorders, plus the {AnonymousMetaClass} name of a class-creating meta call carrying a block (nil for
+      # every other call), which the caller uses to decide whether the block body needs the anonymous-class-body
+      # descent.
+      def record_call_node_methods(node, qualified_prefix, in_singleton_class, methods_acc, source_path)
+        record_define_method(node, qualified_prefix, in_singleton_class, methods_acc) if node.name == :define_method
+        record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc) if ATTR_MACROS.include?(node.name)
+        AnonymousMetaClass.name_for(node, source_path)
+      end
+
+      # #319 — walks a `Class.new do ... end` / `Module.new do ... end` / `Struct.new(*sym) do ... end` /
+      # `Data.define(*sym) do ... end` block body as the class body it is at runtime, keyed by the call site's
+      # synthetic anonymous `name`; the call's other children (receiver, arguments) keep the enclosing prefix.
+      def walk_anonymous_meta_block(call_node, name, qualified_prefix, in_singleton_class, methods_acc,
+                                    def_nodes_acc, source_path)
+        call_node.rigor_each_child do |child|
+          if child.equal?(call_node.block)
+            body = call_node.block.body
+            walk_methods_and_def_nodes(body, [name], false, methods_acc, def_nodes_acc, source_path) if body
+          else
+            walk_methods_and_def_nodes(child, qualified_prefix, in_singleton_class, methods_acc, def_nodes_acc,
+                                       source_path)
+          end
         end
       end
 
@@ -1366,21 +1403,38 @@ module Rigor
       #     (semantically `class << self`).
       #   - `class << Foo` not nested in `class Foo` returns `[Foo]`
       #     so methods defined inside register on Foo's singleton.
+      #   - `class << Foo = <expr>` (#320, the private-singleton-object
+      #     idiom) is the same case: Ruby evaluates the assignment, then
+      #     opens the singleton of the resulting object — which is the
+      #     object `Foo` now holds — so the body's methods are reachable
+      #     as `Foo.<name>` exactly as for a plain constant read.
       #   - Any other expression (variable, method call) returns nil
       #     so the walker falls through and skips the body.
       def singleton_class_prefix(node, qualified_prefix)
-        case node.expression
-        when Prism::SelfNode
+        return qualified_prefix if node.expression.is_a?(Prism::SelfNode)
+
+        rendered = singleton_receiver_constant_name(node.expression)
+        return nil unless rendered
+
+        if !qualified_prefix.empty? && qualified_prefix.last == rendered
           qualified_prefix
-        when Prism::ConstantReadNode, Prism::ConstantPathNode
-          rendered = Source::ConstantPath.qualified_name(node.expression)
-          return nil unless rendered
+        else
+          rendered.split("::")
+        end
+      end
 
-          if !qualified_prefix.empty? && qualified_prefix.last == rendered
-            qualified_prefix
-          else
-            rendered.split("::")
-          end
+      # The constant a `class << X` operand names, or nil when the operand is not constant-shaped. Both the
+      # read spellings (`Foo`, `A::Foo`, `::Foo`) and the two constant-*write* spellings (`Foo = expr`,
+      # `A::Foo = expr`) resolve to the same unqualified rendering the read branch uses, so a body opened on
+      # the assignment and one opened on a later plain read land on the same table key.
+      def singleton_receiver_constant_name(expression)
+        case expression
+        when Prism::ConstantReadNode, Prism::ConstantPathNode
+          Source::ConstantPath.qualified_name(expression)
+        when Prism::ConstantWriteNode
+          expression.name.to_s
+        when Prism::ConstantPathWriteNode
+          Source::ConstantPath.qualified_name(expression.target)
         end
       end
       # rubocop:enable Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/AbcSize
@@ -1483,6 +1537,24 @@ module Rigor
         class_name = qualified_prefix.empty? ? TOP_LEVEL_DEF_KEY : qualified_prefix.join("::")
         accumulator[class_name] ||= {}
         accumulator[class_name][def_node.name] = def_node
+        record_anonymous_body_def_as_toplevel(def_node, qualified_prefix, accumulator)
+      end
+
+      # #319 — a `def` inside an anonymous `Class.new` / `Module.new` body ALSO stays in the `<toplevel>` table.
+      # Before the anonymous class had a name the body was walked with an empty prefix, so every such `def`
+      # landed there; that is the same leniency this key already grants a `def` nested in any other DSL block
+      # (see {TOP_LEVEL_DEF_KEY}), and it is what lets an implicit-self call elsewhere in the file resolve
+      # against a method the anonymous module contributes to some other object's `self` — the
+      # `Module.new { def start; end }` mixed into a spawned actor environment, then called from the sibling
+      # `spawn(...) { start }` block. Giving the body a class of its own must not silently retract it: the call
+      # resolves at runtime, and `call.unresolved-toplevel` firing on it would be a new false positive traded
+      # for the ones this change retires. Never clobbers a real top-level `def` of the same name.
+      def record_anonymous_body_def_as_toplevel(def_node, qualified_prefix, accumulator)
+        return unless qualified_prefix.length == 1
+        return unless Type::AnonymousClassName.match?(qualified_prefix.first)
+
+        table = (accumulator[TOP_LEVEL_DEF_KEY] ||= {})
+        table[def_node.name] ||= def_node
       end
 
       # Module-singleton call resolution (ADR-57 follow-up) — the SINGLETON-side mirror of `build_discovered_def_nodes`.
@@ -1617,16 +1689,18 @@ module Rigor
       # `class Foo < Bar` declaration. Only constant superclasses are recorded (`class Foo < Struct.new(...)` and other
       # non-constant superclasses produce no entry). The as-written name is resolved to a qualified class at the call
       # site against the subclass's lexical nesting — see `ExpressionTyper#resolve_ancestor_class_name`.
-      def build_discovered_superclasses(root)
+      def build_discovered_superclasses(root, source_path = nil)
         accumulator = {}
-        walk_class_superclasses(root, [], accumulator)
+        walk_class_superclasses(root, [], accumulator, source_path)
         accumulator.freeze
       end
 
-      def walk_class_superclasses(node, qualified_prefix, accumulator)
+      def walk_class_superclasses(node, qualified_prefix, accumulator, source_path = nil)
         return unless node.is_a?(Prism::Node)
 
         case node
+        when Prism::CallNode
+          record_anonymous_meta_superclass(node, accumulator, source_path)
         when Prism::ClassNode
           name = Source::ConstantPath.qualified_name(node.constant_path)
           if name
@@ -1645,10 +1719,27 @@ module Rigor
         end
 
         node.rigor_each_child do |child|
-          walk_class_superclasses(child, qualified_prefix, accumulator)
+          walk_class_superclasses(child, qualified_prefix, accumulator, source_path)
         end
       end
 
+      # #319 — `Class.new(Parent) do ... end` names its superclass in the first positional. Recording it under the
+      # call site's anonymous name keeps `Parent`'s surface reachable from the block body (whose `self_type` is now
+      # `Singleton[<anonymous>]`) and from an instance of the resulting class, so giving the anonymous class an
+      # identity does not cost the inheritance the old `Singleton[Parent]` answer carried for free.
+      def record_anonymous_meta_superclass(call_node, accumulator, source_path)
+        return unless AnonymousMetaClass.block_form_receiver(call_node) == :Class
+
+        arg = call_node.arguments&.arguments&.first
+        return if arg.nil?
+
+        superclass = Source::ConstantPath.qualified_name(arg)
+        return if superclass.nil?
+
+        name = AnonymousMetaClass.name_for(call_node, source_path)
+        accumulator[name] = superclass if name
+      end
+
       # ADR-48 — per qualified class name -> ordered `Data.define` member-name list, for both the named-subclass form
       # (`class Point < Data.define(:x, :y)`) and the constant-assigned form (`Point = Data.define(:x, :y)`). Only
       # `Data.define` is recorded: `Struct.new` instances are mutable, so member-value folding would be unsound (the
@@ -2511,7 +2602,7 @@ module Rigor
         # One combined descent yields both the methods existence table and the def-node table; the latter is also
         # consumed by `record_class_sources`, so a def-dense file is walked once here instead of three times (methods +
         # def-nodes ×2). See {#build_methods_and_def_nodes}.
-        file_methods, file_def_nodes = build_methods_and_def_nodes(root)
+        file_methods, file_def_nodes = build_methods_and_def_nodes(root, path)
         merge_discovered_defs(acc[:def_nodes], acc[:def_sources], path, file_def_nodes)
         # ADR-46 slice 4 (singleton) — record the singleton-side `"path:line"` sources alongside the nodes,
         # the exact mirror of the instance-side `merge_discovered_defs`, so a class/singleton-method body edit
@@ -2519,7 +2610,7 @@ module Rigor
         # silently degrading to the file's full ancestry closure.
         merge_discovered_defs(acc[:singleton_def_nodes], acc[:singleton_def_sources], path,
                               build_discovered_singleton_def_nodes(root))
-        superclasses = build_discovered_superclasses(root)
+        superclasses = build_discovered_superclasses(root, path)
         includes = build_discovered_includes(root)
         acc[:superclasses].merge!(superclasses)
         includes.each do |class_name, mods|

data/lib/rigor/inference/singleton_object_constant.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require_relative "../source/constant_path"
+
+module Rigor
+  module Inference
+    # Issue #320 — the *private-singleton-object* idiom: a constant holds a plain object whose singleton
+    # class carries the methods.
+    #
+    #     class << Merger = Object.new
+    #       def merge_attributes!(a, b) = a
+    #     end
+    #     Merger.merge_attributes!({}, {})
+    #
+    # {ScopeIndexer} already records such a body under the constant's own name with kind `:singleton` — that
+    # keying is correct for both spellings, since `Foo.bar` means "call `bar` on the value of constant `Foo`"
+    # whether the value is a class object or an ordinary object. The gap is on the *receiver* side: when the
+    # constant names a class or module the read types as `Singleton[Foo]` and dispatch recovers the name from
+    # the type, but when it holds an ordinary object the read types as `Nominal[Object]` and the name is
+    # gone — so every method in the body is invisible and `call.undefined-method` fires on working code.
+    #
+    # This module recovers the name from the receiver *syntax* instead, for exactly the receivers whose type
+    # has lost it. `Singleton` receivers are excluded so the established class/module path keeps its
+    # precedence; a receiver whose constant has no recorded singleton body yields nil, so an undefined method
+    # on such a constant (`Merger.nope`) still fires.
+    module SingletonObjectConstant
+      module_function
+
+      # The constant name a call's receiver names, when that receiver is a constant reference whose type is
+      # not already a `Singleton` carrier. Nil for every other receiver shape.
+      def receiver_constant_name(call_node, receiver_type)
+        return nil if receiver_type.is_a?(Type::Singleton)
+
+        receiver = call_node.receiver
+        return nil unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+
+        Source::ConstantPath.qualified_name(receiver)
+      end
+
+      # True when the project recorded `method_name` on the singleton side of the constant this call's
+      # receiver names. The suppression probe for `call.undefined-method`.
+      def recorded?(call_node, receiver_type, method_name, scope)
+        return false if scope.nil?
+
+        name = receiver_constant_name(call_node, receiver_type)
+        return false if name.nil?
+
+        scope.discovered_method?(name, method_name, :singleton)
+      end
+
+      # The `Prism::DefNode` for `method_name` in the constant's singleton body, or nil. The inference tier's
+      # entry point.
+      def def_node_for(call_node, receiver_type, method_name, scope)
+        return nil if scope.nil?
+
+        name = receiver_constant_name(call_node, receiver_type)
+        return nil if name.nil?
+
+        scope.singleton_def_for(name, method_name)
+      end
+    end
+  end
+end

data/lib/rigor/inference/statement_evaluator.rb

@@ -8,6 +8,7 @@ require_relative "../analysis/fact_store"
 require_relative "../source/node_walker"
 require_relative "../source/node_children"
 require_relative "../source/constant_path"
+require_relative "anonymous_meta_class"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
 require_relative "dynamic_origin"
@@ -20,6 +21,7 @@ require_relative "method_parameter_binder"
 require_relative "multi_target_binder"
 require_relative "mutation_widening"
 require_relative "narrowing"
+require_relative "optimistic_origin"
 
 module Rigor
   module Inference
@@ -259,17 +261,11 @@ module Rigor
         optimistic_origin_for(value_node, scope_after_rhs)
       end
 
-      # The effective optimistic-nil-free cause of an expression: the mark on its own node, else — for a bare
-      # local read or a local write used in value position (`if (x = MAP[k])`, where the write has already
-      # bound the mark) — the one propagated onto the binding.
+      # The effective optimistic-nil-free cause of an expression. {Inference::OptimisticOrigin.resolve} owns
+      # the judgment — the mark on the node itself, the binding a bare local / ivar read resolves through, and
+      # the predicate-fold derivation of issue #313.
       def optimistic_origin_for(node, scope)
-        recorded = scope.optimistic_origins[node]
-        return recorded if recorded
-
-        case node
-        when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
-        when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
-        end
+        Inference::OptimisticOrigin.resolve(node, scope)
       end
 
       # ADR-82 WD1 — the {Inference::DynamicOrigin} cause to propagate onto a local / ivar being bound to `rhs`.
@@ -1827,7 +1823,20 @@ module Rigor
         return unless block.is_a?(Prism::BlockNode)
 
         block_entry = build_block_entry_scope(node, block)
-        sub_eval(block, block_entry)
+        # #319 — `Class.new do ... end` and friends evaluate their block as a CLASS BODY (`class_eval`
+        # semantics): `self` is the freshly created class, so a `def` inside defines an instance method on it
+        # and `attr_reader` runs as a class-level macro. Enter the block under the same `self_type` /
+        # class-context a `class Foo ... end` body gets, keyed by the call site's anonymous name — the name
+        # `ScopeIndexer` registered the body's methods under. Without it the body inherits the enclosing
+        # scope, and at file top level that means `Scope#toplevel?` (a nil `self_type`) reports every macro
+        # call in the body as `call.unresolved-toplevel`.
+        #
+        # Outer locals stay visible: unlike a `class` keyword body, the block is a closure.
+        anonymous = AnonymousMetaClass.name_for(node, scope.source_path)
+        return sub_eval(block, block_entry) if anonymous.nil?
+
+        sub_eval(block, block_entry.with_self_type(Type::Combinator.singleton_of(anonymous)),
+                 class_context: [ClassFrame.new(name: anonymous, singleton: false)])
       end
 
       # Slice 6 phase C sub-phase 3b/3c. When the call carries a block whose receiving method is NOT proven
@@ -2504,7 +2513,11 @@ module Rigor
       def build_block_entry_scope(call_node, block_node)
         expected = expected_block_param_types_for(call_node)
         bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_node)
-        scope_with_params = bindings.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
+        # Issue #316 — every block body enters with `self` unmodelled (`Scope#entering_opaque_block`); the
+        # yielding method, not the lexical context, decides what `self` is, and Rigor does not track it.
+        scope_with_params = bindings.reduce(scope.entering_opaque_block) do |acc, (name, type)|
+          acc.with_local(name, type)
+        end
         block_local_names(block_node).reduce(scope_with_params) do |acc, name|
           acc.with_local(name, Type::Combinator.constant_of(nil))
         end

data/lib/rigor/plugin/node_rule_walk.rb

@@ -92,6 +92,12 @@ module Rigor
         dispatch_plugins(node, ancestors, path, scope, states)
         collector_driver&.visit(node, context)
 
+        # Issue #318 — `defined?`'s operand is never evaluated, so nothing under a `Prism::DefinedNode` is
+        # reachable code. Dispatching plugin rules / the collector driver against the DefinedNode itself is
+        # fine; descending into `#value` would feed both plugin node_rules and the built-in collectors
+        # source that can never run.
+        return if node.is_a?(Prism::DefinedNode)
+
         child_context = collector_driver&.descend(node, context)
         ancestors.push(node)
         node.rigor_each_child do |child|

data/lib/rigor/protection/closure_kill_oracle.rb

@@ -4,6 +4,7 @@ require "tempfile"
 
 require_relative "../analysis/buffer_binding"
 require_relative "../analysis/runner"
+require_relative "../inference/fork_map"
 require_relative "diagnostic_oracle"
 require_relative "discovery_seed"
 require_relative "kill_signature"
@@ -111,6 +112,18 @@ module Rigor
         [path, *(@dependents[path] || [])]
       end
 
+      # Release the process-private mutant file now, instead of waiting for `Tempfile`'s finalizer at process
+      # exit. A one-shot `rigor coverage` run does not need this — the process ends and the file goes with it —
+      # but a caller that outlives the oracle does: the spec suite's `after(:suite)` residue check (issue #330)
+      # runs while the process is still alive, so an un-released file reads as a leak there even though it
+      # would have been reclaimed a moment later. Idempotent, and safe on an oracle that never mutated
+      # anything (the file is created lazily).
+      def release!
+        @mutant_file&.close!
+        @mutant_file = nil
+        @mutant_pid = nil
+      end
+
       private
 
       # The diagnostic signatures the dependents of `path` report while `source` stands in for it. Empty (and
@@ -136,11 +149,17 @@ module Rigor
 
       # The process-private mutant file. Created lazily, and re-created after a fork ({CLI::MutationForkScan}
       # workers must not share one path), which the pid guard detects.
+      #
+      # A worker's copy goes in {Inference::ForkMap.child_scratch_dir} rather than the system temp dir: the
+      # worker ends at `exit!`, which runs neither `at_exit` nor `Tempfile`'s finalizer, so a file placed
+      # anywhere else survives the run with nobody left who knows its name (issue #330). On the parent — and
+      # on the sequential path — that reader answers `nil`, which is `Tempfile.new`'s own default, and the
+      # finalizer reclaims the file at normal exit as before.
       def mutant_file
         return @mutant_file if @mutant_file && @mutant_pid == Process.pid
 
         @mutant_pid = Process.pid
-        @mutant_file = Tempfile.new(["rigor-mutant-", ".rb"])
+        @mutant_file = Tempfile.new(["rigor-mutant-", ".rb"], Inference::ForkMap.child_scratch_dir)
       end
 
       def seed_for(buffer)

data/lib/rigor/scope.rb

@@ -23,6 +23,7 @@ module Rigor
                 :indexed_narrowings, :method_chain_narrowings,
                 :declaration_sourced,
                 :source_path, :discovery, :struct_fold_safe_locals,
+                :opaque_block_self,
                 :dynamic_origins, :local_origins, :ivar_origins,
                 :void_origins,
                 :optimistic_origins, :optimistic_locals, :optimistic_ivars
@@ -147,6 +148,7 @@ module Rigor
       declaration_sourced: EMPTY_DECLARATION_SOURCED,
       source_path: nil,
       struct_fold_safe_locals: EMPTY_FOLD_SAFE,
+      opaque_block_self: false,
       dynamic_origins: {}.compare_by_identity,
       local_origins: EMPTY_ORIGINS,
       ivar_origins: EMPTY_ORIGINS,
@@ -168,6 +170,7 @@ module Rigor
       @declaration_sourced = declaration_sourced
       @source_path = source_path
       @struct_fold_safe_locals = struct_fold_safe_locals
+      @opaque_block_self = opaque_block_self
       @dynamic_origins = dynamic_origins
       @local_origins = local_origins
       @ivar_origins = ivar_origins
@@ -274,6 +277,21 @@ module Rigor
       rebuild(struct_fold_safe_locals: locals)
     end
 
+    # Issue #316 — marks a block body whose `self` Rigor does not model. Ruby gives a block no `self` of its
+    # own: the yielding method decides, and `instance_eval` / `instance_exec` (the mechanism behind every
+    # `self`-rebinding DSL — RSpec example groups, `Class.new { … }`, Rake, Sinatra) is indistinguishable from
+    # `Array#each` without knowing the callee. The flag is set at every block entry that leaves `self_type`
+    # unnarrowed and is inherited by every scope derived inside the block; it never leaks past the block,
+    # because `eval_call` returns the caller's scope unchanged.
+    def entering_opaque_block
+      return self if @opaque_block_self
+
+      rebuild(opaque_block_self: true)
+    end
+
+    # True when this scope sits inside a block whose `self` is unmodelled ({#entering_opaque_block}).
+    def opaque_block_self? = @opaque_block_self
+
     # True when `name`'s `Struct` member reads are fold-safe in this body (the local is provably never mutated /
     # aliased / escaped).
     def struct_fold_safe?(name)
@@ -352,8 +370,11 @@ module Rigor
     # whose type is an open-call-site *lower bound* — firing against a lower bound is a false positive by
     # construction (the ADR-67 WD1 reasoning at the parameter boundary, carried one hop into the body). The
     # distinct kind keeps the inferred-param sites separable from ADR-58's ivar-copy `:local` mark, which a
-    # later un-guarding slice (WD6b) needs. `with_local` drops it on any flow-live rewrite of the local
-    # (`drop_local_declaration_marks`), so only the pristine parameter binding carries it.
+    # later un-guarding slice (WD6b) needs — and the two kinds behave OPPOSITELY on both axes: `:local` is
+    # dropped by `with_local` and intersected by `join`, while `:inferred_param` is sticky across `with_local`
+    # and unioned by `join`. See {#without_inferred_param_mark} below for the clearing contract, and
+    # `docs/internal-spec/inference-engine.md` § "Declaration-sourced provenance mark (ADR-58)" for the
+    # normative statement of both.
     def with_inferred_param_mark(name)
       rebuild(declaration_sourced: add_declaration_sourced(:inferred_param, name))
     end
@@ -505,6 +526,43 @@ module Rigor
       Inference::DefNodeResolver.resolve(entry)
     end
 
+    # Issue #316 — the CONFIDENCE-GATED companion of {#top_level_def_for}, and the only accessor the type
+    # inference may bind through. {#top_level_def_for} stays unrestricted because it also serves the
+    # *suppression* side (`call.unresolved-toplevel`, `call.undefined-method`): a name the project defines at
+    # the top level must never be reported as unresolved, whatever this gate decides.
+    #
+    # Returns nil — decline to bind, stay silent — when BOTH hold:
+    #
+    # 1. The call site sits inside a block whose `self` is unmodelled ({#opaque_block_self?}) and no narrowed
+    #    `self_type` says otherwise. A top-level `def` is a private method on `Object`, so it is *callable*
+    #    from any `self`; what the analyzer cannot see is whether the block's real `self` gained a PUBLIC
+    #    same-named method by `include` / `extend`, which wins the MRO over the private `Object` def. RSpec's
+    #    `output` / `include` / `match` matchers against a project's own `def output` are exactly this.
+    # 2. The `def` lives in a DIFFERENT file from the call site. Collocation is the evidence that the two
+    #    belong to one lexical structure — the `RSpec.describe do; def helper; end; it { helper } end` case
+    #    v0.0.3 A and #319 deliberately serve. Cross-file, the two share only a name.
+    #
+    # Both conditions are required, so a top-level helper called from genuine top-level code keeps resolving
+    # (cross-file included), and a helper defined beside its DSL-block call site keeps resolving too. When the
+    # project pre-pass recorded no source for the name, the file test cannot be answered and the historical
+    # bind is kept.
+    def bindable_top_level_def_for(method_name)
+      node = top_level_def_for(method_name)
+      return node if node.nil?
+      return node unless @opaque_block_self && @self_type.nil?
+
+      same_file_top_level_def?(method_name) ? node : nil
+    end
+
+    def same_file_top_level_def?(method_name)
+      key = Inference::ScopeIndexer::TOP_LEVEL_DEF_KEY
+      site = discovered_def_sources.dig(key, method_name.to_sym)
+      return true if site.nil? || @source_path.nil?
+
+      File.expand_path(site.sub(/:\d+\z/, "")) == File.expand_path(@source_path)
+    end
+    private :same_file_top_level_def?
+
     # ADR-46 slice 3 — a top-level (`def helper` outside any class) call has NO class ancestry to walk, so unlike
     # {#user_def_for} a miss here records no positive ancestry edge that would re-check the consumer when the
     # method later appears. Record the cross-file edge explicitly: the file defining the top-level method
@@ -756,6 +814,7 @@ module Rigor
       declaration_sourced: @declaration_sourced,
       source_path: @source_path,
       struct_fold_safe_locals: @struct_fold_safe_locals,
+      opaque_block_self: @opaque_block_self,
       dynamic_origins: @dynamic_origins,
       local_origins: @local_origins,
       ivar_origins: @ivar_origins,
@@ -774,6 +833,7 @@ module Rigor
         declaration_sourced: declaration_sourced,
         source_path: source_path,
         struct_fold_safe_locals: struct_fold_safe_locals,
+        opaque_block_self: opaque_block_self,
         dynamic_origins: dynamic_origins,
         local_origins: local_origins,
         ivar_origins: ivar_origins,

data/lib/rigor/source/node_walker.rb

@@ -14,6 +14,14 @@ module Rigor
     #
     # Non-Prism children (literals embedded in node attributes, virtual nodes, or `nil` slots) are silently
     # skipped so callers can rely on every yielded value responding to the `Prism::Node` API.
+    #
+    # Issue #318 — a `Prism::DefinedNode`'s operand is never evaluated at runtime (`defined?` inspects the
+    # expression statically; it does not run it), so the walk yields the `DefinedNode` itself but does NOT
+    # descend into its `value` subtree. Every consumer of this walker treats a yielded node as "reachable,
+    # evaluated code" (mutation/break/return scans, the check-rules main-pass oracle, coverage and precision
+    # probes); walking into the operand would make them reason about code that can never run, which is
+    # exactly the false-positive class the issue reports (`defined?(@x) && ...` flagging a call that is
+    # actually inert).
     module NodeWalker
       module_function
 
@@ -30,6 +38,8 @@ module Rigor
         return unless node.is_a?(Prism::Node)
 
         yield node
+        return if node.is_a?(Prism::DefinedNode)
+
         node.rigor_each_child { |child| walk(child, &) }
       end
 
@@ -52,6 +62,8 @@ module Rigor
         return unless node.is_a?(Prism::Node)
 
         block.call(node, ancestors)
+        return if node.is_a?(Prism::DefinedNode)
+
         ancestors.push(node)
         node.rigor_each_child { |child| walk_with_ancestors(child, ancestors, &block) }
         ancestors.pop

data/lib/rigor/type/anonymous_class_name.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Type
+    # #319 — the spelling of a class that Ruby created without a name: the `Class.new do ... end` /
+    # `Module.new do ... end` form away from constant-write position, which owns whatever its block body defines
+    # but has no constant to be keyed by.
+    #
+    # `Inference::AnonymousMetaClass` decides WHICH call sites get one and what goes in the key; this module owns
+    # the spelling, because the two places a name reaches a human live here. `#<Label:key>` is deliberately
+    # unspellable as a Ruby constant path, so a synthetic name can never collide with a real class in the
+    # discovery tables.
+    #
+    # Both renderings drop the key. `describe` keeps only the label (`#<Class>`) because the key is a file
+    # position — reproducing it would pin every `assert_type` fixture and precision snapshot to a line number.
+    # `erase_to_rbs` answers `untyped`: the name is not valid RBS, and emitting it from `rigor sig-gen` would
+    # produce a signature file that does not parse.
+    module AnonymousClassName
+      module_function
+
+      PREFIX = "#<"
+
+      # `build("Class", "lib/a.rb:3:17") #=> "#<Class:lib/a.rb:3:17>"`
+      def build(label, key)
+        "#{PREFIX}#{label}:#{key}>"
+      end
+
+      def match?(class_name)
+        class_name.is_a?(String) && class_name.start_with?(PREFIX)
+      end
+
+      # The display form: the label alone, key dropped.
+      def display(class_name)
+        return class_name unless match?(class_name)
+
+        "#{PREFIX}#{class_name.delete_prefix(PREFIX).split(':', 2).first}>"
+      end
+    end
+  end
+end