rigortype 0.3.2 → 0.3.4

data/lib/rigor/effects/unknown_label_report.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative "label_intent"
+
+module Rigor
+  module Effects
+    # One `effect.unknown-label` finding, rendered (ADR-103 WD1 / WD14; #384).
+    #
+    # It carries the spelling, the nearest recognised label and the retirement record, and knows how
+    # to say all three in one sentence. What it deliberately does NOT carry is where the label was
+    # written or what the surface was: an envelope in `.rbs`, an rbs-inline annotation in `.rb` and a
+    # `.rigor.yml` list all reduce to "a place named this label, and now it means nothing", so the
+    # caller supplies the `subject` and the `consequence` and this supplies the vocabulary judgment.
+    # That is the seam [#385](https://github.com/rigortype/rigor/issues/385)'s `envelopes[].effect`
+    # and `attribution:` values point at.
+    #
+    # {.for} answers `nil` unless {LabelIntent} says the spelling is evidently a label — the whole
+    # point of the diagnostic is that it fires where intent is evident and nowhere else.
+    class UnknownLabelReport < Data.define(:token, :suggestion, :retirement)
+      # @param token [String] the spelling as written.
+      # @param registry [Rigor::Effects::Registry, nil] the vocabulary after plugin load.
+      # @param siblings [Array<String>] the other tokens written alongside it.
+      # @return [UnknownLabelReport, nil]
+      def self.for(token:, registry:, siblings: [])
+        return nil unless LabelIntent.evident?(token, registry, siblings: siblings)
+
+        new(
+          token: token.to_s,
+          suggestion: registry.suggest(token.to_s),
+          retirement: Array(registry.retired(token.to_s)).map(&:to_s).freeze
+        )
+      end
+
+      # Whether the vocabulary once carried this spelling and moved it. A retirement outranks a
+      # nearest-neighbour guess: the registry KNOWS where this label went, so guessing would be
+      # strictly worse information.
+      def retired?
+        !retirement.nil? && !retirement.empty?
+      end
+
+      # The sentence a reader can act on. `subject` names the declaration ("Effect envelope on
+      # `Foo#bar`"), `consequence` says what the degradation cost ("the annotation now bounds
+      # nothing") — the fail-open reading stated out loud, because a silently-unbounded envelope is
+      # exactly what this diagnostic exists to make visible.
+      def message(subject:, consequence:)
+        "#{subject} names #{token}, which is not a known effect label#{qualifier}; #{consequence}."
+      end
+
+      private
+
+      def qualifier
+        return " (#{token} is retired; write #{retirement.join(' or ')} instead)" if retired?
+        return " (did you mean #{suggestion}?)" if suggestion
+
+        ""
+      end
+    end
+  end
+end

data/lib/rigor/effects.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "effects/label"
+require_relative "effects/label_set"
+require_relative "effects/registry"
+require_relative "effects/taint_cause"
+require_relative "effects/attribution"
+require_relative "effects/catalog"
+require_relative "effects/collector"
+require_relative "effects/config_envelopes"
+require_relative "effects/discharge"
+require_relative "effects/effect_table"
+require_relative "effects/envelope"
+require_relative "effects/envelope_check"
+require_relative "effects/envelope_index"
+require_relative "effects/file_collection"
+require_relative "effects/liskov_check"
+require_relative "effects/method_key"
+require_relative "effects/origin"
+require_relative "effects/propagator"
+require_relative "effects/summary"
+
+module Rigor
+  # The effect-label vocabulary (ADR-103; normative in
+  # `docs/type-specification/effect-labels.md`).
+  #
+  # Two layers live here. The label *language* — the grammar, the subsumption relation, the label
+  # sets a summary and an envelope are made of, the registry that says which spellings are
+  # recognised, and the closed enum of taint causes. And, on top of it, the observational machinery
+  # of #379: the {Collector} that records what the typer decided, the {Summary} / {FileCollection}
+  # values it produces, the built-in {Catalog}, and the {Propagator} that closes them into an
+  # {EffectTable}. On top of both sits the one thing here that DOES judge: an {Envelope} — an
+  # author-declared upper bound read off the project's RBS or written by convention in `.rigor.yml`
+  # ({ConfigEnvelopes}) — and the two checks that judge one: {EnvelopeCheck} compares a method against
+  # its own bound (`effect.envelope-exceeded`, #383 / #385) and {LiskovCheck} an override against the
+  # bound it inherits (`effect.liskov-widened`, #386). The same declarations are read a third way, which
+  # judges nothing: {EnvelopeIndex} resolves them per CALL SITE, so a caller reads what its callee
+  # promised as a `≤` bound. Beside them sit the project's policy
+  # surfaces: {Attribution} colours code Rigor never analysed, into the declared lane, and {Discharge}
+  # applies `effects.tolerated:` per origin at judgment time. The effect snapshot (#381) and the
+  # vocabulary diagnostic (#384) are their own slices.
+  #
+  # "Effect label", "effect summary" and "effect envelope" are trapped compounds in `CONTEXT.md`;
+  # bare "effect" still names `Rigor::FlowContribution`'s flow-effect bundle.
+  module Effects
+  end
+end

data/lib/rigor/environment/rbs_loader.rb

@@ -1256,6 +1256,40 @@ module Rigor
         end
       end
 
+      # ADR-103 WD6 / #386 — yields `[class name, RBS::AST::Members::MethodDefinition]` for every method
+      # member in the built environment that carries at least one annotation.
+      #
+      # The one reason this walk lives here rather than in its caller: `#env` is private, and it stays
+      # private. The effect-envelope reader needs the *annotations* a gem's shipped signatures and
+      # Rigor's bundled overlays declare — the accepted stratum of ADR-103 WD6, which discharges a call
+      # site's taint because the same trust is already extended to those files' types — and nothing more
+      # of the environment. Handing out the environment to get at them would trade a several-MB mutable
+      # object for a read the loader can perform itself.
+      #
+      # Nested declarations are not descended into: `RBS::Environment` already flattens a nested
+      # `class Foo::Bar` into its own `class_decls` entry, so a descent would key one member twice.
+      #
+      # Fail-soft, like every other query here: no environment (a build failure) yields nothing.
+      def each_annotated_method_member
+        environment = env
+        return if environment.nil?
+
+        environment.class_decls.each do |type_name, entry|
+          class_name = type_name.to_s.sub(/\A::/, "")
+          self.class.entry_declarations(entry).each do |decl|
+            members = decl.respond_to?(:members) ? decl.members : nil
+            next if members.nil?
+
+            members.each do |member|
+              next unless member.is_a?(::RBS::AST::Members::MethodDefinition)
+              next if member.annotations.nil? || member.annotations.empty?
+
+              yield class_name, member
+            end
+          end
+        end
+      end
+
       private
 
       # The `::`-stripped names of every class/module entry whose declarations ALL originated from the given

data/lib/rigor/environment.rb

@@ -311,11 +311,18 @@ module Rigor
       # activesupport, the Rack status table) can then require the analyzed project's own locked gems when
       # Rigor's host gem environment does not carry them — the standalone `gem install rigortype` case,
       # where activesupport is deliberately not a runtime dependency.
+      # The hand-off is a module ivar, which a non-main Ractor may not write (`Ractor::IsolationError`) —
+      # and every Ractor-pool worker builds its Environment inside its own Ractor, so an unguarded write
+      # killed the whole backend at `WorkerSession#initialize` (#414). The resolution is deterministic per
+      # configuration and `Runner`'s pre-passes already perform it on the main Ractor before the pool
+      # spawns, so a worker reads the value the main set (a frozen String, hence shareable) and skips the
+      # write. The local return value is unaffected, so the missing-gem constant index still gets its root
+      # even when the write is skipped.
       def resolve_target_bundle_root(bundle_path:, project_root:, auto_detect:)
         bundle_root = BundleSigDiscovery.resolve_bundle_path(
           bundle_path: bundle_path, project_root: project_root, auto_detect: auto_detect
         )&.to_s
-        Plugin::Isolation.target_bundle_root = bundle_root
+        Plugin::Isolation.target_bundle_root = bundle_root if Ractor.current == Ractor.main
         bundle_root
       end
 

data/lib/rigor/flow_contribution/element.rb

@@ -21,6 +21,7 @@ module Rigor
       invalidation
       exception
       role
+      effects
     ].freeze
 
     class Element < Data.define(:target, :edge, :kind, :payload, :provenance)

data/lib/rigor/flow_contribution/merge_result.rb

@@ -13,13 +13,13 @@ module Rigor
     # for the slice-3 normative description.
     class MergeResult
       attr_reader :return_type, :truthy_facts, :falsey_facts, :post_return_facts,
-                  :mutations, :invalidations, :exceptional, :role_conformance,
+                  :mutations, :invalidations, :exceptional, :role_conformance, :effects,
                   :provenances, :conflicts
 
       # rubocop:disable Metrics/ParameterLists
       def initialize(return_type: nil, truthy_facts: [], falsey_facts: [],
                      post_return_facts: [], mutations: [], invalidations: [],
-                     exceptional: nil, role_conformance: [],
+                     exceptional: nil, role_conformance: [], effects: nil,
                      provenances: [], conflicts: [])
         # rubocop:enable Metrics/ParameterLists
         @return_type = return_type
@@ -30,6 +30,7 @@ module Rigor
         @invalidations = invalidations.dup.freeze
         @exceptional = exceptional
         @role_conformance = role_conformance.dup.freeze
+        @effects = effects
         @provenances = provenances.dup.freeze
         @conflicts = conflicts.dup.freeze
         freeze
@@ -42,7 +43,7 @@ module Rigor
       def empty?
         @return_type.nil? && @truthy_facts.empty? && @falsey_facts.empty? &&
           @post_return_facts.empty? && @mutations.empty? && @invalidations.empty? &&
-          @exceptional.nil? && @role_conformance.empty?
+          @exceptional.nil? && @role_conformance.empty? && @effects.nil?
       end
 
       def to_h
@@ -55,6 +56,7 @@ module Rigor
           "invalidations" => invalidations,
           "exceptional" => exceptional,
           "role_conformance" => role_conformance,
+          "effects" => effects,
           "provenances" => provenances.map { |p| p.respond_to?(:to_h) ? p.to_h : p },
           "conflicts" => conflicts.map(&:to_h)
         }

data/lib/rigor/flow_contribution/merger.rb

@@ -99,6 +99,7 @@ module Rigor
           fold_effects(state, contribution)
           fold_exceptional(state, contribution, tier)
           fold_role_conformance(state, contribution)
+          fold_effect_labels(state, contribution)
         end
 
         def fold_return_type(state, contribution, tier)
@@ -182,6 +183,18 @@ module Rigor
           accumulate(state.role_conformance, contribution.role_conformance)
         end
 
+        # ADR-103 WD5 — the `effects` slot merges by UNION, unconditionally and across every authority
+        # tier. A label set is an upper bound on what a call does, and two sources that each name part of
+        # a footprint together name more of it; there is no reading under which one source's claim
+        # cancels another's, so there is no conflict to report either. `nil` ("says nothing") stays nil
+        # until some contribution speaks.
+        def fold_effect_labels(state, contribution)
+          incoming = contribution.effects
+          return if incoming.nil?
+
+          state.effects = state.effects.nil? ? incoming : state.effects.join(incoming)
+        end
+
         def accumulate(target, incoming)
           Array(incoming).each do |item|
             target << item unless target.include?(item)
@@ -217,7 +230,7 @@ module Rigor
       # {MergeResult} at the end via {#to_result}.
       class MergeState
         attr_accessor :return_type, :return_type_tier, :return_type_provenance,
-                      :exceptional, :exceptional_tier, :exceptional_provenance
+                      :exceptional, :exceptional_tier, :exceptional_provenance, :effects
         attr_reader :truthy_facts, :falsey_facts, :post_return_facts,
                     :mutations, :invalidations, :role_conformance,
                     :provenances, :conflicts
@@ -235,6 +248,7 @@ module Rigor
           @exceptional_tier = nil
           @exceptional_provenance = nil
           @role_conformance = []
+          @effects = nil
           @provenances = []
           @conflicts = []
         end
@@ -253,6 +267,7 @@ module Rigor
             invalidations: @invalidations,
             exceptional: @exceptional,
             role_conformance: @role_conformance,
+            effects: @effects,
             provenances: @provenances,
             conflicts: @conflicts
           )

data/lib/rigor/flow_contribution.rb

@@ -9,7 +9,7 @@ module Rigor
   # [ADR-2 § "Plugin Contribution Merging"](../../docs/adr/2-extension-api.md) rather than letting any one
   # source override another silently.
   #
-  # Eight content slots plus a {Provenance} block. A slot left as `nil` (or, for collection-shaped slots, an
+  # Nine content slots plus a {Provenance} block. A slot left as `nil` (or, for collection-shaped slots, an
   # empty collection) means the contribution does not assert anything in that dimension; the merge policy
   # treats it as absent.
   #
@@ -38,8 +38,15 @@ module Rigor
       invalidations
       exceptional
       role_conformance
+      effects
     ].freeze
 
+    # `effects` is scalar-shaped like `return_type` and `exceptional`: only `nil` means "asserts
+    # nothing". An EMPTY {Rigor::Effects::LabelSet} is the positive claim that the call performs no
+    # effects — the reading of `%a{pure}` — so it must not be mistaken for an unset slot the way an
+    # empty fact Array is.
+    SCALAR_SLOTS = %i[return_type exceptional effects].freeze
+
     attr_reader(*SLOT_NAMES, :provenance)
 
     # @param return_type [Object, nil] normal-edge return type. Use `nil` when the contribution does not
@@ -54,12 +61,17 @@ module Rigor
     #   imply.
     # @param exceptional [Object, nil] non-returning, raising, or unreachable effect.
     # @param role_conformance [Array, nil] capability-role conformance facts the contribution provides.
+    # @param effects [Rigor::Effects::LabelSet, nil] ADR-103 WD5 — the effect labels this call edge
+    #   attributes to its callee, as an upper bound. `nil` means "says nothing about effects", which is
+    #   NOT the same as the empty set (which asserts the call performs none). Merged by union, the
+    #   conservative direction: two sources that each name part of a call's footprint together name
+    #   more of it, and neither can shrink the other's claim.
     # @param provenance [Provenance] source-family, plugin-id, node, and cache-descriptor metadata. Defaults
     #   to `Provenance.builtin`.
     # rubocop:disable Metrics/ParameterLists
     def initialize(return_type: nil, truthy_facts: nil, falsey_facts: nil,
                    post_return_facts: nil, mutations: nil, invalidations: nil,
-                   exceptional: nil, role_conformance: nil,
+                   exceptional: nil, role_conformance: nil, effects: nil,
                    provenance: Provenance.builtin)
       # rubocop:enable Metrics/ParameterLists
       @return_type = return_type
@@ -70,6 +82,7 @@ module Rigor
       @invalidations = freeze_collection(invalidations)
       @exceptional = exceptional
       @role_conformance = freeze_collection(role_conformance)
+      @effects = effects
       @provenance = provenance
       freeze
     end
@@ -77,7 +90,7 @@ module Rigor
     # @return [Boolean] true when every content slot is unset (nil or an empty collection). Provenance does
     #   not count toward emptiness — an empty bundle still carries source attribution.
     def empty?
-      SLOT_NAMES.all? { |slot| slot_empty?(public_send(slot)) }
+      SLOT_NAMES.all? { |slot| slot_empty?(slot, public_send(slot)) }
     end
 
     def to_h
@@ -102,6 +115,7 @@ module Rigor
     # | invalidations       | normal        | invalidation        | (per-fact target)       |
     # | exceptional         | exceptional   | exception           | :raise                  |
     # | role_conformance    | normal        | role                | (per-role target)       |
+    # | effects             | normal        | effects             | :effects                |
     #
     # @return [Array<Element>]
     def to_element_list # rubocop:disable Metrics/AbcSize
@@ -116,6 +130,7 @@ module Rigor
       Array(invalidations).each { |i| elements << element_for(fact_target(i), :normal, :invalidation, i) }
       elements << element_for(:raise, :exceptional, :exception, exceptional) unless exceptional.nil?
       Array(role_conformance).each { |r| elements << element_for(fact_target(r), :normal, :role, r) }
+      elements << element_for(:effects, :normal, :effects, effects) unless effects.nil?
       elements.freeze
     end
 
@@ -149,8 +164,9 @@ module Rigor
       value.dup.freeze
     end
 
-    def slot_empty?(value)
+    def slot_empty?(slot, value)
       return true if value.nil?
+      return false if SCALAR_SLOTS.include?(slot)
       return value.empty? if value.respond_to?(:empty?)
 
       false

data/lib/rigor/inference/anonymous_meta_class.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type/anonymous_class_name"
+
+module Rigor
+  module Inference
+    # #319 — identity for the class a `Class.new do ... end` / `Module.new do ... end` creates away from
+    # constant-write position.
+    #
+    # Ruby evaluates such a block with `self` bound to the freshly created class (`class_eval` semantics): a
+    # `def` inside it defines an instance method on that class and `attr_reader` runs as a class-level macro.
+    # `ScopeIndexer` has always walked that body as a class body — but only through its
+    # `Prism::ConstantWriteNode` branch, because the constant supplied the name the discovered-method tables
+    # are keyed by. At every other position (`klass = Class.new do ... end`, a bare expression, a method
+    # return) there was no name, so the body fell through to the enclosing — usually top-level — scope. Two
+    # false positives followed on correct code: `attr_reader` became a `call.unresolved-toplevel` warning
+    # (`Scope#toplevel?` is `self_type.nil?`), and the class itself typed as the bare `Singleton[Object]`
+    # `MethodDispatcher#class_new_lift` hands back, taking `Object`'s zero-arity `new` with it.
+    #
+    # This module supplies the missing name: a per-call-site synthetic one, spelled so that no Ruby constant
+    # path can collide with it in the discovery tables, and stable across the index pass and the dispatch
+    # pass because both derive it from the same `(call node, source path)` pair.
+    module AnonymousMetaClass
+      module_function
+
+      # The class-creating meta calls whose block body is a class body. `Struct.new` / `Data.define` are here
+      # because the body semantics are identical — the block is `class_eval`'d on the generated subclass — not
+      # because their anonymous *value* is modelled: those keep the `StructClass` / `DataClass` carriers
+      # {MethodDispatcher::StructFolding} / {MethodDispatcher::DataFolding} build for them.
+      META_NEW_SELECTORS = { Class: :new, Module: :new, Struct: :new, Data: :define }.freeze
+
+      # The receiver constant name (`:Class`, `:Module`, `:Struct`, `:Data`) of a class-creating meta call that
+      # carries a literal block, or nil for anything else. The receiver MUST be the bare constant (or its
+      # `::`-rooted spelling) — a call through a variable or another call's return has no statically known
+      # identity, exactly as `ScopeIndexer#meta_constant_receiver?` requires.
+      #
+      # Argument shapes are deliberately NOT inspected: `Class.new(Base) { ... }` and
+      # `Data.define(*members) { ... }` evaluate their block as a class body whatever the arguments are, and a
+      # narrower gate here would leave the body in top-level scope again.
+      def block_form_receiver(node)
+        return nil unless node.is_a?(Prism::CallNode)
+        return nil unless node.block.is_a?(Prism::BlockNode)
+
+        receiver_name = literal_constant_name(node.receiver)
+        return nil if receiver_name.nil?
+        return nil unless META_NEW_SELECTORS[receiver_name] == node.name
+
+        receiver_name
+      end
+
+      # The synthetic class name for `node`'s block body, or nil when `node` is not a recognised block form.
+      # {Type::AnonymousClassName} owns the spelling; this decides which call sites earn one and what the key
+      # holds.
+      #
+      # `source_path` is part of the key so two files whose anonymous classes happen to share a line and column
+      # do not merge their method sets when the per-file tables are folded into the cross-file seed. It is
+      # omitted when the caller has no path (unit-level probes over a bare `Prism` program) — passed through
+      # verbatim rather than defaulted, so every pass over the same file derives the same name.
+      def name_for(node, source_path = nil)
+        receiver_name = block_form_receiver(node)
+        return nil if receiver_name.nil?
+
+        location = node.location
+        key = [source_path, location.start_line, location.start_column].compact.join(":")
+        Type::AnonymousClassName.build(receiver_name, key)
+      end
+
+      # The bare-constant receiver's name (`Class`, `::Class`), or nil for every other receiver shape.
+      def literal_constant_name(node)
+        case node
+        when Prism::ConstantReadNode
+          node.name
+        when Prism::ConstantPathNode
+          node.name if node.parent.nil?
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/expression_typer.rb

@@ -13,12 +13,15 @@ require_relative "body_fixpoint"
 require_relative "budget_trace"
 require_relative "dynamic_origin"
 require_relative "origin_lookup"
+require_relative "../effects/collector"
 require_relative "fallback"
 require_relative "flow_tracer"
 require_relative "indexed_narrowing"
 require_relative "macro_block_self_type"
 require_relative "method_dispatcher"
 require_relative "narrowing"
+require_relative "singleton_object_constant"
+require_relative "optimistic_origin"
 require_relative "struct_fold_safety"
 
 module Rigor
@@ -609,16 +612,11 @@ module Rigor
         elide_or_union(node.predicate, else_type, then_type)
       end
 
-      # Issue #286 — the effective optimistic-nil-free cause of an expression, resolving a bare local read (or
-      # a local write in value position) through its binding. Mirrors `StatementEvaluator#optimistic_origin_for`.
+      # Issue #286 — the effective optimistic-nil-free cause of an expression. {OptimisticOrigin.resolve} owns
+      # the judgment, shared verbatim with `StatementEvaluator#optimistic_origin_for` and the
+      # `flow.always-truthy-condition` collector.
       def optimistic_origin_for(node)
-        recorded = scope.optimistic_origins[node]
-        return recorded if recorded
-
-        case node
-        when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
-        when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
-        end
+        OptimisticOrigin.resolve(node, scope)
       end
 
       def if_else_type(subsequent)
@@ -663,7 +661,7 @@ module Rigor
       # fallback is preserved.
       def type_of_and_or(node)
         left_type = type_of(node.left)
-        polarity = constant_value_polarity(left_type)
+        polarity = left_operand_polarity(node.left, left_type)
         return short_circuit_for(node, left_type, polarity) if polarity
 
         # The left operand only flows through on the edge that short-circuits: `a || b` yields `a` solely
@@ -689,6 +687,19 @@ module Rigor
         end
       end
 
+      # Issue #313 — the node-aware wrapper the `&&` / `||` short-circuit reads. The spec's exclusion binds
+      # this gate as much as it binds `flow.always-truthy-condition`, and a `Constant`-only gate is not by
+      # itself enough to honour it: a literal hash whose values share one type reads as a lone `Constant`
+      # (`UNIFORM[key]` → `Constant[1]`), so the gate would judge the left operand of `UNIFORM[key] || key`
+      # provably truthy and discard the author's fallback — the counter-example the spec names verbatim.
+      # Declining returns the union of both operands, which is what `StatementEvaluator#eval_and_or` produces
+      # anyway, so the two `&&` / `||` typers stay in agreement.
+      def left_operand_polarity(left_node, left_type)
+        return nil unless optimistic_origin_for(left_node).nil?
+
+        constant_value_polarity(left_type)
+      end
+
       # Returns `:truthy` / `:falsey` for a `Type::Constant`, nil otherwise. Mirrors
       # `constant_predicate_polarity` but operates on a typed value (already-type-of'd) rather than a Prism
       # node, so the same predicate analysis can be reused in both contexts.
@@ -1092,8 +1103,12 @@ module Rigor
       # through `Enumerable#select` / `Object#select` and the caller observes `Array[Elem]` instead of the
       # helper's actual return type. The check fires only for `node.receiver.nil?` (true implicit self), so
       # explicit-receiver dispatch is unaffected.
+      #
+      # Issue #316 — the lookup goes through the confidence-gated `Scope#bindable_top_level_def_for`, not the
+      # raw table: inside a block whose `self` is unmodelled, a top-level `def` from ANOTHER file is not
+      # evidence about which method the call reaches, so the bind is declined and the call widens.
       def try_local_def_dispatch(node, receiver, arg_types)
-        local_def = node.receiver.nil? ? scope.top_level_def_for(node.name) : nil
+        local_def = node.receiver.nil? ? scope.bindable_top_level_def_for(node.name) : nil
         return nil unless local_def
 
         local_inference = infer_top_level_user_method(local_def, receiver, arg_types)
@@ -1120,6 +1135,11 @@ module Rigor
         arg_types = call_arg_types(node)
         block_type = block_return_type_for(node, receiver, arg_types)
 
+        # ADR-103 WD13 — the effect collector's one hot-path site. Purely observational: it reads the
+        # receiver type the typer has just computed and the `dynamic_origins` cause already recorded, and
+        # asks nothing further of dispatch. Off (the default) this is one integer read.
+        Effects::Collector.record_call(node, receiver, scope) if Effects::Collector.active?
+
         local_def_result = try_local_def_dispatch(node, receiver, arg_types)
         return local_def_result if local_def_result
 
@@ -1159,7 +1179,7 @@ module Rigor
         # `module_function` body, re-type that body with the call args bound. Sits after the RBS dispatch
         # tier, so foreign / RBS-known singletons (`Math.sqrt`) keep their catalog answer; only
         # project-defined singleton methods reach here.
-        singleton_inference = try_singleton_method_inference(receiver, node, arg_types)
+        singleton_inference = try_project_singleton_inference(receiver, node, arg_types)
         return singleton_inference if singleton_inference
 
         # Dynamic-origin propagation: when the receiver is Dynamic[T] and no positive rule resolves the call,
@@ -1167,11 +1187,19 @@ module Rigor
         # semantic outcome, not a fail-soft compromise, so it MUST NOT record a tracer event.
         return inherit_receiver_origin(node) if receiver.is_a?(Type::Dynamic)
 
-        # ADR-24 slice 4a — this is the engine choke-point where an implicit-self call has exhausted every
-        # resolution tier (RBS dispatch + user-class ancestor walk) and falls through to `Dynamic[top]`. When
-        # the slice-4 recorder is active, capture the miss so a later slice's closed-class gate can flag it.
-        # Off by default: `active?` is a plain integer read.
+        unresolved_call_result(node, receiver)
+      end
+
+      # The engine choke-point where a call has exhausted every resolution tier (RBS dispatch + user-class
+      # ancestor walk) and falls through to `Dynamic[top]`. Two observational recorders read it, both a
+      # plain integer read when inactive, and neither changes the answer:
+      #
+      # - ADR-24 slice 4a captures an implicit-self miss so a later slice's closed-class gate can flag it;
+      # - ADR-103 WD13 retracts the effect collector's optimistic `resolved: true`, which is what separates
+      #   an implicit-self call the closed world has no definition for from an ordinary inherited one.
+      def unresolved_call_result(node, receiver)
         record_unresolved_self_call(node, receiver) if Analysis::SelfCallResolutionRecorder.active?
+        Effects::Collector.record_unresolved(node, scope.source_path) if Effects::Collector.active?
 
         fallback_for(node, family: :prism)
       end
@@ -1336,6 +1364,31 @@ module Rigor
         nil
       end
 
+      # The project-side singleton-method band: a `Foo.bar` call resolved against a `class << …` / `def self.…`
+      # body the project itself wrote. Which of the two tiers applies is decided by the receiver carrier —
+      # `Singleton[Foo]` when the constant names a class or module, `Nominal[…]` when it holds an ordinary
+      # object (#320) — so the two are mutually exclusive and consulting both is one resolution attempt.
+      def try_project_singleton_inference(receiver, call_node, arg_types)
+        try_singleton_method_inference(receiver, call_node, arg_types) ||
+          try_singleton_object_constant_inference(receiver, call_node, arg_types)
+      end
+
+      # #320 — resolves a call whose receiver is a constant holding an ordinary object with a `class << Const`
+      # singleton body, re-typing that body with the call's argument types bound. `self` inside the body IS
+      # that object, so the receiver carrier is passed through unchanged. Own-constant only, and only for a
+      # name the project actually recorded — a miss degrades to today's `Dynamic[top]`, never a false
+      # resolution. `Singleton` receivers never reach here: {#try_singleton_method_inference} owns them.
+      def try_singleton_object_constant_inference(receiver, call_node, arg_types)
+        return nil unless receiver.is_a?(Type::Nominal)
+
+        def_node = SingletonObjectConstant.def_node_for(call_node, receiver, call_node.name, scope)
+        return nil if def_node.nil?
+
+        infer_user_method_return(def_node, receiver, arg_types)
+      rescue StandardError
+        nil
+      end
+
       # ADR-24 slice 2 — resolves `method_name` against `class_name`'s own `def`s, then walks the user-class
       # ancestor chain: included / prepended modules (transitive) and the superclass chain. RBS-known
       # ancestors are NOT walked here — the `MethodDispatcher` RBS tier runs before
@@ -2444,7 +2497,11 @@ module Rigor
         case block_arg
         when Prism::BlockNode
           bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_arg)
-          block_scope = bindings.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
+          # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
+          # yielding method's business, so the return-typing pass must see the same unmodelled-self mark.
+          block_scope = bindings.reduce(scope.entering_opaque_block) do |acc, (name, type)|
+            acc.with_local(name, type)
+          end
           block_scope = block_scope.with_self_type(narrowed_self_type) if narrowed_self_type
           type_block_body(block_arg, block_scope)
         when Prism::BlockArgumentNode