rigortype 0.3.6 → 0.3.8

data/lib/rigor/environment.rb

@@ -8,6 +8,7 @@ require_relative "environment/rbs_loader"
 require_relative "environment/reflection"
 require_relative "environment/reporters"
 require_relative "environment/hkt_registry_holder"
+require_relative "environment/failure_slot"
 require_relative "environment/constant_type_cache_holder"
 require_relative "environment/missing_gem_constant_index"
 require_relative "environment/bundle_sig_discovery"
@@ -38,9 +39,9 @@ module Rigor
     # ADR-87 WD4 boot-slimming probe can read it without loading the inference engine.
 
     # ADR-72 — a Gemfile.lock gem name mapped to the opt-in plugin id that ships the SAME core-ext RBS. When
-    # that plugin is loaded the auto-overlay for the gem stands down, so the two never both declare the
-    # methods (which would raise a duplicate-declaration error). Keyed on the gem name `RbsCoverageReport`
-    # reports.
+    # that plugin's signatures are reachable the auto-overlay for the gem stands down, so the two never both
+    # declare the methods (which would raise a duplicate-declaration error). Keyed on the gem name
+    # `RbsCoverageReport` reports.
     GEM_OVERLAY_PLUGIN_IDS = { "activesupport" => "activesupport-core-ext" }.freeze
 
     attr_reader :class_registry, :rbs_loader, :plugin_registry, :dependency_source_index,
@@ -88,6 +89,10 @@ module Rigor
       # --no-stats` from doing the RBS env build at all.
       @hkt_registry_base = hkt_registry || Inference::HktRegistry::EMPTY
       @hkt_registry_holder = HktRegistryHolder.new
+      # Issue #784 — where either stage of the HKT-registry build (the plugin overlay, #791; the RBS
+      # `type`-alias scan) records a raise, so it surfaces once for the run instead of once per file — or,
+      # for the overlay, instead of aborting the run outright (see {#hkt_registry}).
+      @hkt_scan_failure = FailureSlot.new
       @constant_type_cache = ConstantTypeCacheHolder.new
       # ADR-82 WD9 — `[gem_name, version]` pairs for the locked gems with no resolvable RBS. The
       # root-constant ownership index over them is built lazily (first unresolved constant read) so runs
@@ -104,21 +109,93 @@ module Rigor
     # beat plugin entries, which beat the bundled JSON_VALUE. Memoised; single-threaded use only (under the
     # Ractor pool path each worker has its own Environment so cross-worker mutation is impossible; the LSP
     # single-publish-at-a-time invariant serialises here).
+    #
+    # BOTH stages are guarded (#784, #791): whichever raises is recorded on {#hkt_scan_failure} with the
+    # stage that failed and the other stage still runs, so this getter never raises into its callers —
+    # neither into a file's `analyze_body` rescue nor out of the run-owned demands, which have no rescue
+    # above them at all.
     def hkt_registry
       @hkt_registry_holder.fetch do
-        with_plugin_overlay = if @plugin_registry.respond_to?(:hkt_overlay_registry)
-                                @hkt_registry_base.merge(@plugin_registry.hkt_overlay_registry)
-                              else
-                                @hkt_registry_base
-                              end
-        Inference::HktRegistry.scan_rbs_loader(
-          @rbs_loader,
-          base: with_plugin_overlay,
-          reporter: rbs_extended_reporter
-        )
+        pre_scan = pre_scan_hkt_registry
+        begin
+          Inference::HktRegistry.scan_rbs_loader(
+            @rbs_loader,
+            base: pre_scan,
+            reporter: rbs_extended_reporter
+          )
+        rescue StandardError => e
+          # Issue #784 — the seam. This build is shared and memoised, and it is first demanded from inside
+          # a file's analysis, so a raise here would otherwise land in every file's `analyze_body` rescue
+          # and turn the whole run into N identical `internal analyzer error` rows (issue #776). Record it
+          # and degrade to the pre-scan registry: analysis proceeds, HKT inference from RBS `type` aliases
+          # reads its bound (`Dynamic[top]`, ADR-20 WD2), and the run surfaces ONE
+          # `rbs.coverage.hkt-scan-failed` row. Not a silent skip — the row is `:error` and names the
+          # exception and raise site — and the same shape as `RbsLoader#record_env_build_failure`.
+          # Memoising the degraded registry is what keeps the scan from being re-attempted per file.
+          record_hkt_registry_failure(e, stage: :scan)
+          pre_scan
+        end
       end
     end
 
+    # Issue #791 — the OTHER build behind {#hkt_registry}, and the reason the seam covers two stages
+    # rather than one. Aggregating the loaded plugins' manifest-declared HKT entries runs plugin-authored
+    # code (`Plugin::Registry#hkt_overlay_registry` reads each manifest); before this it sat one line ABOVE
+    # the #784 rescue, so a raise there escaped {#hkt_registry} entirely. Post-#788 that is not a per-file
+    # crash storm but an uncaught abort: {HktRegistryHolder#fetch} memoises only on success, so the raise
+    # is re-attempted at every demand, and the run-owned demands (`Runner::PoolCoordinator#hkt_scan_outcome`
+    # after the file loop, `Analysis::WorkerSession#drain_reporters`) sit outside any rescue.
+    #
+    # The degradation is narrower than the scan's: only the plugin overlay is dropped, and the RBS scan
+    # still runs on top of the bundled base, so a user's own `.rbs` HKT registrations survive a plugin
+    # defect. First-write-wins on the slot means a run whose overlay AND scan both raise reports the
+    # overlay — the actionable one, since the plugin is what a user can remove.
+    #
+    # @return [Rigor::Inference::HktRegistry] the registry the RBS scan is layered on top of.
+    def pre_scan_hkt_registry
+      return @hkt_registry_base unless @plugin_registry.respond_to?(:hkt_overlay_registry)
+
+      @hkt_registry_base.merge(@plugin_registry.hkt_overlay_registry)
+    rescue StandardError => e
+      record_hkt_registry_failure(e, stage: :overlay)
+      @hkt_registry_base
+    end
+    private :pre_scan_hkt_registry
+
+    # Issue #784 — the `[error_class_name, first_message_line, raw_frame_or_nil, stage]` tuple the seam in
+    # {#hkt_registry} recorded, or nil when both stages built (or were never demanded). `stage` is `:scan`
+    # for the RBS `type`-alias scan and `:overlay` for the plugin-manifest aggregation (#791); it decides
+    # the row's wording, because "the implicit HKT scan over RBS `type` aliases raised" would point a user
+    # at their own `.rbs` for a plugin's defect. The run reads the tuple only after demanding
+    # {#hkt_registry} itself — after the file loop on the sequential paths, at drain time in each pool
+    # worker (the coordinator never analyses a file under the pool, so the drain is how its snapshot learns
+    # the outcome: the #696 lesson), and from a resolved environment when the analyze set is empty — so the
+    # row never depends on which files happened to be analysed.
+    #
+    # @return [Array(String, String, String, Symbol), Array(String, String, nil, Symbol), nil]
+    def hkt_scan_failure
+      @hkt_scan_failure.value
+    end
+
+    def record_hkt_registry_failure(error, stage:)
+      frames = error.backtrace || []
+      frame = frames.find { |f| f.include?("/lib/rigor/") } || frames.first
+      # `Class#name` is nil for an anonymous exception class; its nearest NAMED ancestor is the stable
+      # description (`inspect` embeds an object address, which would make the row's text differ across
+      # processes). Each String is frozen individually, not just the Array: the tuple crosses the fork
+      # boundary Marshal-clean and the drain channel's stated invariant
+      # ({Analysis::WorkerSession#drain_reporters}) is that its payload is also `Ractor.shareable?`, which a
+      # shallow freeze over `chomp`'s fresh String would not satisfy.
+      named = error.class.ancestors.find { |a| a.is_a?(Class) && a.name }
+      @hkt_scan_failure.record([
+                                 (error.class.name || "anonymous #{named&.name || 'Exception'}").dup.freeze,
+                                 error.message.to_s.lines.first.to_s.chomp.freeze,
+                                 frame&.dup&.freeze,
+                                 stage
+                               ])
+    end
+    private :record_hkt_registry_failure
+
     # ADR-82 WD9 — the gem name owning `root_constant_name`, when that gem is locked in the project's
     # Gemfile.lock, ships no resolvable RBS, and its entry file declares the constant at top level. Nil for
     # everything else — the caller then keeps the generic provenance cause. The index is built once, lazily,
@@ -190,7 +267,7 @@ module Rigor
       #   {Environment::RbsLoader} so constant lookups (and, in later v0.0.9 slices, other reflection
       #   artefacts) consult the cache. Pass `nil` (the default) to skip caching for this environment.
       # @return [Rigor::Environment]
-      # rubocop:disable Metrics/MethodLength, Metrics/ParameterLists
+      # rubocop:disable-next Metrics/MethodLength, Metrics/ParameterLists
       def for_project(root: Dir.pwd, libraries: [], signature_paths: nil, cache_store: nil,
                       plugin_registry: nil, dependency_source_index: nil,
                       rbs_extended_reporter: nil, boundary_cross_reporter: nil,
@@ -253,11 +330,13 @@ module Rigor
         # extensions resolve (e.g. `Integer#minutes` on a Rails project) — turning a systematic false
         # `call.undefined-method` into a no-op while a project WITHOUT the gem still sees the genuine
         # diagnostic. Appended last so any RBS the project already supplies wins, and skipped for a gem whose
-        # opt-in plugin twin is loaded (no duplicate declaration). The paths ride in
-        # `loader_signature_paths`, so the env cache descriptor digests them for free.
+        # opt-in plugin twin is REACHABLE — loaded as a plugin, or wired in by `signature_paths:` (#672) —
+        # so the two never both declare the methods. The paths ride in `loader_signature_paths`, so the env
+        # cache descriptor digests them for free.
         missing_gems, overlay_paths = missing_gems_and_overlay_paths(
           locked: locked, default_libraries: merged_libraries, bundle_sig_paths: gem_sig_paths,
-          rbs_collection_paths: collection_paths, plugin_registry: plugin_registry
+          rbs_collection_paths: collection_paths, plugin_registry: plugin_registry,
+          signature_paths: resolved_paths
         )
         loader_signature_paths = resolved_paths + plugin_sig_paths + gem_sig_paths +
                                  collection_paths + overlay_paths
@@ -276,7 +355,11 @@ module Rigor
           libraries: merged_libraries,
           signature_paths: loader_signature_paths,
           cache_store: cache_store,
-          virtual_rbs: virtual_rbs
+          virtual_rbs: virtual_rbs,
+          # Issue #610 — the plugin-contributed subset is loaded LAST and may stand down against a colliding
+          # generic arity. Only the bundled plugins' own `sig/` is deferred: the user's `signature_paths:`,
+          # the bundle walk and `rbs collection install` all stay authoritative.
+          deferred_signature_paths: plugin_sig_paths
         )
         # ADR-20 slice 2c + 2e — seed hkt_registry with the bundled builtins. The Environment's
         # `#hkt_registry` getter then LAZILY merges in the RBS env scan on first call so fast paths that
@@ -297,7 +380,6 @@ module Rigor
           missing_rbs_bundle_path: bundle_root
         )
       end
-      # rubocop:enable Metrics/MethodLength, Metrics/ParameterLists
 
       private
 
@@ -330,27 +412,45 @@ module Rigor
       # and consumed twice: as `[gem_name, version]` pairs for the ADR-82 WD9 constant-ownership index, and
       # as the eligible-gem set for the ADR-72 overlay resolution. Returns `[pairs, overlay_paths]`.
       def missing_gems_and_overlay_paths(locked:, default_libraries:, bundle_sig_paths:,
-                                         rbs_collection_paths:, plugin_registry:)
+                                         rbs_collection_paths:, plugin_registry:, signature_paths: [])
         return [[], []] if locked.empty?
 
         rows = RbsCoverageReport.classify(
           locked_gems: locked, default_libraries: default_libraries,
           bundle_sig_paths: bundle_sig_paths, rbs_collection_paths: rbs_collection_paths
         ).select { |row| row.source == :missing }
-        overlays = gem_overlay_paths(missing_gem_names: rows.map(&:gem_name), plugin_registry: plugin_registry)
+        overlays = gem_overlay_paths(
+          missing_gem_names: rows.map(&:gem_name), plugin_registry: plugin_registry,
+          signature_paths: signature_paths
+        )
         [rows.map { |row| [row.gem_name, row.version] }, overlays]
       end
 
       # ADR-72 — resolve the bundled RBS overlay directories to load for this project. A gem is eligible when
-      # it is classified `:missing` (see {missing_rbs_gem_rows}) and its conflicting opt-in plugin (if any)
-      # is not loaded. Returns `[Pathname]`, deterministically ordered, or `[]` when no eligible gem.
-      def gem_overlay_paths(missing_gem_names:, plugin_registry:)
+      # it is classified `:missing` (see {missing_rbs_gem_rows}) and its conflicting opt-in plugin twin (if
+      # any) is NOT already reachable. Returns `[Pathname]`, deterministically ordered, or `[]` when no
+      # eligible gem.
+      #
+      # "Reachable" is two questions, not one. The plugin being LOADED is the route ADR-72 anticipated. The
+      # second is the route issue #672 found: a project that wires the plugin's signatures through
+      # `signature_paths:` instead of `plugins:` reaches the same `.rbs` with no registry entry to key on, so
+      # both halves loaded, `RBS::DefinitionBuilder` raised `DuplicatedMethodDefinitionError` for every class
+      # they share, and each one silently degraded to `Dynamic[top]` — the run reported LESS while exiting 0.
+      #
+      # This method keeps the POLICY (which gem maps to which plugin id, and when an overlay is eligible at
+      # all); `RbsLoader.bundled_overlay_twin_signatures_loaded?` answers the filesystem half, beside the
+      # overlay-side answer to the same question, and carries the reasoning for why it asks what an entry
+      # LOADS rather than what it looks like.
+      def gem_overlay_paths(missing_gem_names:, plugin_registry:, signature_paths: [])
         return [] if missing_gem_names.empty?
 
         loaded_ids = plugin_registry ? plugin_registry.ids.to_set : Set.new
         eligible = missing_gem_names.reject do |gem_name|
           plugin_id = GEM_OVERLAY_PLUGIN_IDS[gem_name]
-          plugin_id && loaded_ids.include?(plugin_id)
+          next false unless plugin_id
+
+          loaded_ids.include?(plugin_id) ||
+            RbsLoader.bundled_overlay_twin_signatures_loaded?(plugin_id, signature_paths)
         end.sort
         RbsLoader.gem_overlay_sig_paths(eligible)
       end

data/lib/rigor/inference/acceptance.rb

@@ -23,7 +23,7 @@ module Rigor
     # `Nominal[Hash, [K, V]]` the shape is projected to its underlying nominal so the existing
     # generic-acceptance pipeline continues to apply; the converse direction (a Tuple receiver accepting a
     # generic Array) stays conservative because the analyzer cannot verify arity from a raw nominal alone.
-    # rubocop:disable Metrics/ModuleLength
+    # rubocop:disable-next Metrics/ModuleLength
     module Acceptance
       module_function
 
@@ -67,11 +67,15 @@ module Rigor
         Type::Refined => :accepts_refined,
         Type::Intersection => :accepts_intersection,
         Type::Tuple => :accepts_tuple,
-        Type::HashShape => :accepts_hash_shape
+        Type::HashShape => :accepts_hash_shape,
+        Type::Result => :accepts_result,
+        Type::Maybe => :accepts_maybe,
+        Type::StructClass => :accepts_class_factory,
+        Type::DataClass => :accepts_class_factory
       }.freeze
       private_constant :TYPE_HANDLERS
 
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class << self
         private
 
@@ -165,20 +169,28 @@ module Rigor
           end
         end
 
-        # Singleton[C] only accepts another Singleton[D] where D is a subclass of (or equal to) C. Any other
-        # carrier (instance, constant, ...) is no, because the singleton type's inhabitants are the class
-        # objects themselves.
+        # Singleton[C] only accepts another Singleton[D] (or StructClass / DataClass) where D is a subclass
+        # of (or equal to) C. Any other carrier (instance, constant, ...) is no, because the singleton type's
+        # inhabitants are the class objects themselves.
         def accepts_singleton(self_type, other_type, mode)
-          unless other_type.is_a?(Type::Singleton)
-            return Type::AcceptsResult.no(
-              mode: mode,
-              reasons: "Singleton[#{self_type.class_name}] does not accept #{other_type.class}"
-            )
-          end
+          actual_name =
+            case other_type
+            when Type::Singleton then other_type.class_name
+            when Type::StructClass, Type::DataClass
+              return Type::AcceptsResult.yes(mode: mode, reasons: "exact name match") if
+                other_type.class_name == self_type.class_name
+
+              class_factory_base_name(other_type)
+            else
+              return Type::AcceptsResult.no(
+                mode: mode,
+                reasons: "Singleton[#{self_type.class_name}] does not accept #{other_type.class}"
+              )
+            end
 
           class_subtype_result(
             target_name: self_type.class_name,
-            actual_name: other_type.class_name,
+            actual_name: actual_name,
             mode: mode,
             kind: :singleton
           )
@@ -195,11 +207,13 @@ module Rigor
         # - HashShape{*} when self is the Hash (or a supertype) family, projected to
         #   `Nominal[Hash, [union(keys), union(values)]]`.
         # - Singleton: never (wrong value kind).
+        # - StructClass / DataClass: class-side carriers, accepted when C is a meta nominal (Class, Module, ...).
         def accepts_nominal(self_type, other_type, mode)
           case other_type
           when Type::Nominal then accepts_nominal_from_nominal(self_type, other_type, mode)
           when Type::Constant then accepts_nominal_from_constant(self_type, other_type, mode)
           when Type::Singleton then accepts_nominal_from_singleton(self_type, other_type, mode)
+          when Type::StructClass, Type::DataClass then accepts_nominal_from_class_factory(self_type, other_type, mode)
           when Type::IntegerRange then accepts_nominal_from_integer_range(self_type, other_type, mode)
           else accepts_nominal_from_shape(self_type, other_type, mode)
           end
@@ -234,6 +248,8 @@ module Rigor
             # is bounded because every refinement carrier's `base` is closer to the nominal layer.
             accepts(self_type, other_type.base, mode: mode)
               .with_reason("projected #{other_type.class.name.split('::').last} to its base")
+          when Type::Result, Type::Maybe
+            accepts_nominal_from_monad(self_type, other_type, mode)
           else
             Type::AcceptsResult.no(
               mode: mode,
@@ -242,6 +258,32 @@ module Rigor
           end
         end
 
+        def accepts_nominal_from_monad(self_type, other_type, mode)
+          cls = self_type.class_name.sub(/\A::/, "")
+          case other_type
+          when Type::Result
+            unless %w[Dry::Monads::Result Result].include?(cls)
+              return Type::AcceptsResult.no(mode: mode, reasons: "Nominal[#{self_type.class_name}] rejects Result")
+            end
+
+            target = Type::Combinator.nominal_of(
+              self_type.class_name,
+              type_args: [other_type.ok_type, other_type.err_type]
+            )
+            accepts(self_type, target, mode: mode).with_reason("projected Result to Nominal")
+          when Type::Maybe
+            unless %w[Dry::Monads::Maybe Maybe].include?(cls)
+              return Type::AcceptsResult.no(mode: mode, reasons: "Nominal[#{self_type.class_name}] rejects Maybe")
+            end
+
+            target = Type::Combinator.nominal_of(
+              self_type.class_name,
+              type_args: [other_type.value_type]
+            )
+            accepts(self_type, target, mode: mode).with_reason("projected Maybe to Nominal")
+          end
+        end
+
         # `Nominal[Integer]` (and anything Integer is-a, like Numeric) accepts any `IntegerRange`; nothing
         # else does. Argument-bearing `Nominal`s never accept `IntegerRange` because IntegerRange has no
         # type args.
@@ -275,11 +317,11 @@ module Rigor
         # introspection patterns. The rule conservatively answers `:yes` for `Module` (every singleton is at
         # least a Module) and for `Class` / `Object` / `BasicObject` (the class object inherits from those).
         # Other Nominals fall through to the default `:no`.
-        META_NOMINALS_FROM_SINGLETON = %w[Module Class Object BasicObject].freeze
-        private_constant :META_NOMINALS_FROM_SINGLETON
+        CLASS_OBJECT_NOMINALS = %w[Module Class Object Kernel BasicObject].freeze
+        private_constant :CLASS_OBJECT_NOMINALS
 
         def accepts_nominal_from_singleton(self_type, other_type, mode)
-          if META_NOMINALS_FROM_SINGLETON.include?(self_type.class_name)
+          if CLASS_OBJECT_NOMINALS.include?(self_type.class_name)
             return Type::AcceptsResult.yes(
               mode: mode,
               reasons: "Singleton[#{other_type.class_name}] is-a #{self_type.class_name}"
@@ -292,6 +334,38 @@ module Rigor
           )
         end
 
+        def accepts_nominal_from_class_factory(self_type, other_type, mode)
+          if CLASS_OBJECT_NOMINALS.include?(self_type.class_name) && self_type.type_args.empty?
+            return Type::AcceptsResult.yes(
+              mode: mode,
+              reasons: "#{other_type.describe} is-a #{self_type.class_name}"
+            )
+          end
+
+          if self_type.class_name == "Class" && self_type.type_args.one?
+            return accepts_class_factory_instance_arg(self_type.type_args.first, other_type, mode)
+          end
+
+          Type::AcceptsResult.no(
+            mode: mode,
+            reasons: "Nominal[#{self_type.class_name}] rejects #{other_type.class}"
+          )
+        end
+
+        def accepts_class_factory_instance_arg(formal, factory, mode)
+          if factory.class_name
+            named = accepts(formal, Type::Combinator.nominal_of(factory.class_name), mode: mode)
+            return named.with_reason("matched the factory class name") if named.yes?
+          end
+
+          accepts(formal, Type::Combinator.nominal_of(class_factory_base_name(factory)), mode: mode)
+            .with_reason("projected the factory instance type")
+        end
+
+        def class_factory_base_name(factory)
+          factory.is_a?(Type::StructClass) ? "Struct" : "Data"
+        end
+
         def accepts_nominal_from_nominal(self_type, other_type, mode)
           class_result = class_subtype_result(
             target_name: self_type.class_name,
@@ -753,6 +827,63 @@ module Rigor
           Type::AcceptsResult.no(mode: mode, reasons: reason)
         end
 
+        def accepts_result(self_type, other_type, mode)
+          case other_type
+          when Type::Result
+            combine_arg_results(
+              [
+                accepts(self_type.ok_type, other_type.ok_type, mode: mode),
+                accepts(self_type.err_type, other_type.err_type, mode: mode)
+              ],
+              mode
+            )
+          when Type::Nominal
+            cls = other_type.class_name.sub(/\A::/, "")
+            if %w[Dry::Monads::Result Result].include?(cls) && other_type.type_args.size == 2
+              combine_arg_results(
+                [
+                  accepts(self_type.ok_type, other_type.type_args[0], mode: mode),
+                  accepts(self_type.err_type, other_type.type_args[1], mode: mode)
+                ],
+                mode
+              )
+            else
+              Type::AcceptsResult.no(mode: mode, reasons: "Result does not accept Nominal[#{other_type.class_name}]")
+            end
+          else
+            Type::AcceptsResult.no(
+              mode: mode,
+              reasons: "Result does not accept #{other_type.class}"
+            )
+          end
+        end
+
+        def accepts_maybe(self_type, other_type, mode)
+          case other_type
+          when Type::Maybe
+            accepts(self_type.value_type, other_type.value_type, mode: mode)
+          when Type::Nominal
+            cls = other_type.class_name.sub(/\A::/, "")
+            if %w[Dry::Monads::Maybe Maybe].include?(cls) && other_type.type_args.size == 1
+              accepts(self_type.value_type, other_type.type_args[0], mode: mode)
+            else
+              Type::AcceptsResult.no(mode: mode, reasons: "Maybe does not accept Nominal[#{other_type.class_name}]")
+            end
+          else
+            Type::AcceptsResult.no(
+              mode: mode,
+              reasons: "Maybe does not accept #{other_type.class}"
+            )
+          end
+        end
+
+        def accepts_class_factory(self_type, other_type, mode)
+          Type::AcceptsResult.no(
+            mode: mode,
+            reasons: "#{self_type.describe} rejects #{other_type.class}"
+          )
+        end
+
         # Uses Ruby's actual class hierarchy via Object.const_get to answer "is D a subclass of C?" for core,
         # stdlib, and application classes. When either name fails to resolve we surface "maybe": the caller
         # (overload selector) treats yes/maybe identically, so the conservative answer keeps overload
@@ -791,14 +922,35 @@ module Rigor
           end
         end
 
+        # Resolves a class name taken from the analysed program without triggering `const_missing`
+        # or executing a pending autoload.
+        #
+        # `const_defined?(part, false)` answers true for a REGISTERED-BUT-NOT-YET-TRIGGERED autoload,
+        # so on its own it does not mean "already in memory" and `const_get` would execute the target
+        # file inside the analyzer. `Module#autoload?` separates the two: it returns the registered
+        # path while the autoload is pending and nil once it has run, so declining on it declines
+        # exactly the dangerous case and still resolves a class genuinely loaded ([#680], [#689]).
+        #
+        # The rescue catches `StandardError`, `ScriptError` and `SystemExit`. `Interrupt`,
+        # `SignalException` and `NoMemoryError` stay uncaught on purpose.
         def resolve_class(name)
-          Object.const_get(name)
-        rescue NameError
+          return nil unless name.is_a?(::String)
+
+          parts = name.delete_prefix("::").split("::")
+          return nil if parts.empty?
+
+          mod = ::Object
+          parts.each do |part|
+            return nil unless mod.is_a?(::Module) && mod.const_defined?(part, false)
+            return nil if mod.autoload?(part)
+
+            mod = mod.const_get(part, false)
+          end
+          mod.is_a?(::Module) ? mod : nil
+        rescue ::StandardError, ::ScriptError, ::SystemExit
           nil
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
-    # rubocop:enable Metrics/ModuleLength
   end
 end

data/lib/rigor/inference/captured_locals.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../source/node_walker"
+require_relative "block_parameter_binder"
+
+module Rigor
+  module Inference
+    # The outer locals a block body can REBIND — the one name set that ADR-56's captured-local write-back
+    # (`StatementEvaluator#write_back_block_captures`), the escaping-block narrowing drop
+    # (`StatementEvaluator#drop_captured_narrowing`) and issue #587's per-element fold
+    # (`ExpressionTyper#per_element_captured_bindings`) all key on. It lives in one place so the four
+    # cannot disagree about what "captured" means.
+    #
+    # A write counts across every local-write form — plain `=` (`LocalVariableWriteNode`), the operator /
+    # `||=` / `&&=` compound forms, and a multi-assign target (`x, y = …` → `LocalVariableTargetNode` under
+    # a `MultiWriteNode`) — at ANY depth: a block is a closure, so a write inside a nested block binds the
+    # same outer variable. Block-introduced names (parameters, numbered parameters, `;`-locals) and names
+    # not bound in the outer scope are excluded; a write to either is not a captured rebind of an outer
+    # variable.
+    module CapturedLocals
+      LOCAL_WRITE_NODES = [
+        Prism::LocalVariableWriteNode,
+        Prism::LocalVariableOperatorWriteNode,
+        Prism::LocalVariableOrWriteNode,
+        Prism::LocalVariableAndWriteNode,
+        Prism::LocalVariableTargetNode
+      ].freeze
+
+      module_function
+
+      # @param block_node [Prism::BlockNode]
+      # @param base_scope [Rigor::Scope] the call-site scope the block closes over.
+      # @return [Array<Symbol>] the captured names the body writes, each once, in first-write order.
+      def writes(block_node, base_scope)
+        body = block_node.body
+        return [] if body.nil?
+
+        introduced = introduced_locals(block_node)
+        outer_writes = []
+        Source::NodeWalker.each(body) do |descendant|
+          next unless LOCAL_WRITE_NODES.any? { |klass| descendant.is_a?(klass) }
+          next if introduced.include?(descendant.name)
+          next unless base_scope.locals.key?(descendant.name)
+
+          outer_writes << descendant.name
+        end
+        outer_writes.uniq
+      end
+
+      # Names the block itself introduces: parameters (numbered parameters included, via
+      # `BlockParameterBinder`) plus the explicit `;`-prefixed block-locals on `BlockParametersNode`.
+      def introduced_locals(block_node)
+        introduced = Set.new(BlockParameterBinder.new.bind(block_node).keys)
+        params_root = block_node.parameters
+        params_root.locals.each { |loc| introduced << loc.name } if params_root.is_a?(Prism::BlockParametersNode)
+        introduced
+      end
+    end
+  end
+end