rigortype 0.3.7 → 0.3.9

data/lib/rigor/scope/discovery_index.rb

@@ -27,10 +27,13 @@ module Rigor
       :discovered_superclasses,
       :discovered_header_nestings,
       :discovered_includes,
+      :discovered_extends,
       :discovered_class_sources,
       :constant_sources,
       :published_constant_names,
       :local_constant_names,
+      :published_constant_alias_names,
+      :published_constant_ivars,
       :data_member_layouts,
       :struct_member_layouts,
       :param_inferred_types,
@@ -52,6 +55,11 @@ module Rigor
       # either kind.
       METHOD_KIND_BOTH = :both
 
+      # Issue #728 — the key a `discovered_header_nestings` bucket stores its class-wide chain under, beside
+      # the per-ancestor-name entries. `nil` is used because every other key in a bucket is an ancestor name
+      # as written, and no ancestor name can be nil.
+      UNKEYED_HEADER_NESTING = nil
+
       # The shared all-empty index `Scope.empty` (and every scope that never sees a seeding pass) points at — one
       # allocation per process.
       EMPTY = new(
@@ -86,8 +94,20 @@ module Rigor
         # name — the peel is the nested spelling's answer, and it searched an `Admin::Base` that a compact
         # `class Admin::Widget < Base` written at the top level never reaches. An absent entry means "not
         # recorded" and keeps the peel, so a scope that never saw a declaration walk is unchanged.
+        #
+        # Issue #728 — the value is keyed by the ancestor NAME the site wrote, because a class's declaration
+        # sites need not share a cref: `class Foo < Base` at the top level and `class ::Foo; include Helper`
+        # inside `module Outer` resolve `Base` and `Helper` in different ones, and a single chain per class
+        # gave `Outer` to both. {UNKEYED_HEADER_NESTING} holds the union over every ancestor-naming site, for
+        # a name no site recorded under its own key.
         discovered_header_nestings: EMPTY_TABLE,
         discovered_includes: EMPTY_TABLE,
+        # Issue #898 — the singleton-side twin of `discovered_includes`: `{qualified class or module name =>
+        # [module names it `extend`s, as written]}`, built by the same `ScopeIndexer` walk that #526 already
+        # ran to fold an extended module's instance defs onto the extending class's singleton. #526 consumed
+        # the table inside the indexer and threw it away; `Narrowing` needs it to survive onto the scope,
+        # because `Singleton[C]`'s ancestry is exactly what `extend` writes and nothing else records it.
+        discovered_extends: EMPTY_TABLE,
         discovered_class_sources: EMPTY_TABLE,
         # Issue #644 — `{qualified constant name => Set[declaring file]}`, the write attribution behind the
         # cross-file value-constant table. Read only by `Scope#record_constant_dependency` during ADR-46
@@ -102,6 +122,16 @@ module Rigor
         # author cannot see. Both empty outside a runner-seeded scope, which makes the guard a no-op there.
         published_constant_names: EMPTY_NAME_SET,
         local_constant_names: EMPTY_NAME_SET,
+        # Issue #667 — the two per-file tables that carry a published constant's provenance across a COPY,
+        # which the name sets above cannot: they answer about a reference's spelling, and a copy has none.
+        # `published_constant_alias_names` is the last segments of the constants THIS FILE assigns straight
+        # from a foreign published one (`MODE2 = AppConfig::MODE`), which the local-declaration exemption
+        # would otherwise release. `published_constant_ivars` is `{class name => Set[ivar name]}` for an ivar
+        # whose class-ivar seed is such a copy (`@mode = AppConfig::MODE` in `initialize`), stamped onto the
+        # flow carrier at method entry. Both are seeded by `ScopeIndexer.index` and only when the project
+        # published something, so a project with no cross-file value constants pays no walk.
+        published_constant_alias_names: EMPTY_NAME_SET,
+        published_constant_ivars: EMPTY_TABLE,
         data_member_layouts: EMPTY_TABLE,
         struct_member_layouts: EMPTY_TABLE,
         # ADR-67 WD3 — the call-site parameter-inference table, keyed by `[class_name, method_name, kind]` (the

data/lib/rigor/scope.rb

@@ -21,7 +21,7 @@ module Rigor
     attr_reader :environment, :locals, :fact_store, :self_type,
                 :ivars, :cvars, :globals,
                 :indexed_narrowings, :method_chain_narrowings,
-                :declaration_sourced,
+                :declaration_sourced, :published_constant_sourced,
                 :source_path, :discovery, :struct_fold_safe_locals,
                 :opaque_block_self, :lexical_nesting,
                 :dynamic_origins, :local_origins, :ivar_origins,
@@ -49,12 +49,21 @@ module Rigor
     def discovered_method_visibilities = @discovery.discovered_method_visibilities
     def discovered_superclasses = @discovery.discovered_superclasses
     def discovered_includes = @discovery.discovered_includes
+    def discovered_extends = @discovery.discovered_extends
     def discovered_class_sources = @discovery.discovered_class_sources
     # Issue #644 — `{qualified constant name => Set[declaring file]}`; seeded only on an ADR-46 recording run.
     def constant_sources = @discovery.constant_sources
     def published_constant_names = @discovery.published_constant_names
     def local_constant_names = @discovery.local_constant_names
 
+    # Issue #667 — the instance-variable names of `class_name` whose class-ivar seed comes from a foreign
+    # published constant (`@mode = AppConfig::MODE` in `initialize`, read in a sibling method).
+    # `StatementEvaluator#seed_instance_ivars` stamps the flow mark for these at method-body entry, the way
+    # ADR-58's seed stamps its own; a method-local write or narrowing then drops it through `with_ivar`.
+    def published_constant_ivars_for(class_name)
+      @discovery.published_constant_ivars[class_name] || EMPTY_PUBLISHED_CONSTANT_IVARS
+    end
+
     # Issue #644 — true when the constant reference `name` (as written: `MODE` or `AppConfig::MODE`) is
     # published by the cross-file value-constant table and is NOT assigned by the file being analysed: a
     # value this file's author cannot see the declaration of. {Analysis::CheckRules::PublishedConstantGuard}
@@ -76,14 +85,27 @@ module Rigor
     # over already-qualified names rather than a second lexical ladder: the engine's ladder
     # (`Reflection.resolve_constant_type`) answers with a TYPE and not with the candidate that won, and
     # reimplementing the walk here is the very thing that made the receiver resolution wrong once already.
+    #
+    # Issue #667 — a third answer sits beside those two. `MODE2 = AppConfig::MODE` is assigned by this file,
+    # so the exemption above releases it, yet its value is still one the author never saw: the alias only
+    # renames the foreign declaration. `published_constant_alias_names` holds the last segments of exactly
+    # those aliases, and matching on the last segment over-answers in the WITHHOLDING direction, which is the
+    # safe one.
     def published_constant?(name)
       names = @discovery.published_constant_names
+      return true if published_constant_alias?(name)
       return false if names.empty?
       return false unless names.include?(name.split("::").last)
 
       !locally_declared_constant?(name)
     end
 
+    def published_constant_alias?(name)
+      aliases = @discovery.published_constant_alias_names
+      !aliases.empty? && aliases.include?(name.split("::").last)
+    end
+    private :published_constant_alias?
+
     def locally_declared_constant?(reference_name)
       local = @discovery.local_constant_names
       return false if local.empty?
@@ -153,9 +175,21 @@ module Rigor
     # threaded by reference through transitions; reset per method body (a fresh entry scope drops it), so the
     # name keys never collide across bodies.
     EMPTY_ORIGINS = {}.freeze
+    # Issue #667 — the set of variable references currently bound to a value COPIED out of a constant the
+    # project published and this file does not declare. Members are frozen `[kind, name]` pairs, the same
+    # spelling {EMPTY_DECLARATION_SOURCED} uses, but a DELIBERATELY SEPARATE carrier: this mark joins by
+    # UNION where ADR-58's kinds intersect, and it answers a different question (what a value's *constancy*
+    # rests on, not what a binding's *optionality* rests on) for a different consumer. Folding it into the
+    # ADR-58 set would be the third establishing transition its *Non-transitivity* passage reserves as a
+    # decision, on a Set that already carries two opposite join policies.
+    EMPTY_PUBLISHED_CONSTANT_SOURCED = Set.new.freeze
+    # Issue #667 — the empty answer of {#published_constant_ivars_for}, so a class with no such ivar (every
+    # class in a project that publishes nothing) allocates none.
+    EMPTY_PUBLISHED_CONSTANT_IVARS = Set.new.freeze
     private_constant :EMPTY_VAR_BINDINGS, :EMPTY_INDEXED_NARROWINGS,
                      :EMPTY_CHAIN_NARROWINGS, :EMPTY_DECLARATION_SOURCED,
-                     :EMPTY_FOLD_SAFE, :EMPTY_ORIGINS
+                     :EMPTY_FOLD_SAFE, :EMPTY_ORIGINS, :EMPTY_PUBLISHED_CONSTANT_SOURCED,
+                     :EMPTY_PUBLISHED_CONSTANT_IVARS
 
     class << self
       def empty(environment: Environment.default, source_path: nil)
@@ -207,6 +241,7 @@ module Rigor
       indexed_narrowings: EMPTY_INDEXED_NARROWINGS,
       method_chain_narrowings: EMPTY_CHAIN_NARROWINGS,
       declaration_sourced: EMPTY_DECLARATION_SOURCED,
+      published_constant_sourced: EMPTY_PUBLISHED_CONSTANT_SOURCED,
       source_path: nil,
       struct_fold_safe_locals: EMPTY_FOLD_SAFE,
       opaque_block_self: false,
@@ -231,6 +266,7 @@ module Rigor
       @indexed_narrowings = indexed_narrowings
       @method_chain_narrowings = method_chain_narrowings
       @declaration_sourced = declaration_sourced
+      @published_constant_sourced = published_constant_sourced
       @source_path = source_path
       @struct_fold_safe_locals = struct_fold_safe_locals
       @opaque_block_self = opaque_block_self
@@ -314,6 +350,10 @@ module Rigor
               indexed_narrowings: new_indexed_narrowings,
               method_chain_narrowings: new_chain_narrowings,
               declaration_sourced: drop_declaration_sourced_for(:local, name),
+              # Issue #667 — rebinding is flow-live for the published-constant mark too: the new value need
+              # not be a copy of anything. `with_published_constant_mark` re-stamps afterward when the write's
+              # rvalue is one.
+              published_constant_sourced: drop_published_constant_sourced_for(:local, name),
               local_origins: drop_origin(@local_origins, name),
               optimistic_locals: drop_origin(@optimistic_locals, name))
     end
@@ -419,6 +459,7 @@ module Rigor
               indexed_narrowings: new_indexed_narrowings,
               method_chain_narrowings: new_chain_narrowings,
               declaration_sourced: drop_declaration_sourced_for(:ivar, name),
+              published_constant_sourced: drop_published_constant_sourced_for(:ivar, name),
               ivar_origins: drop_origin(@ivar_origins, name),
               optimistic_ivars: drop_origin(@optimistic_ivars, name))
     end
@@ -445,6 +486,22 @@ module Rigor
       rebuild(declaration_sourced: add_declaration_sourced(:local, name))
     end
 
+    # Issue #667 — record that `name` is currently bound to a value copied out of a foreign published
+    # constant. Always applied AFTER the `with_local` / `with_ivar` that binds the value (both drop the mark
+    # unconditionally), exactly as {#with_local_declaration_mark} is.
+    def with_published_constant_mark(kind, name)
+      rebuild(published_constant_sourced: add_published_constant_sourced(kind, name))
+    end
+
+    # Issue #667 — true when `(kind, name)`'s current binding is a copy of a constant the project published
+    # and this file does not declare. Asked through
+    # {Analysis::CheckRules::PublishedConstantGuard}, never directly from a rule.
+    def published_constant_sourced?(kind, name)
+      return false if @published_constant_sourced.empty?
+
+      @published_constant_sourced.include?([kind.to_sym, name.to_sym])
+    end
+
     # ADR-58 WD1 — true when `(kind, name)`'s binding optionality is purely declaration-sourced (no flow-live
     # write/narrowing has touched it).
     def declaration_sourced?(kind, name)
@@ -744,6 +801,34 @@ module Rigor
       @discovery.discovered_includes[class_name.to_s] || []
     end
 
+    # Issue #898 — the module names `extend`ed onto `class_name`'s SINGLETON, as written, gathered up the
+    # as-written superclass chain because a singleton class inherits its superclass's singleton class
+    # (`class Base; extend Comparable; end; class Widget < Base; end` leaves `Widget.is_a?(Comparable)`
+    # true). Empty for a class the project never extends, and for every scope that saw no seeding pass.
+    #
+    # This is EVIDENCE FOR a singleton ancestor, never against one: the walk sees only what a constant
+    # argument to a receiverless `extend` (or, since #915, a receiverless `include` / `prepend` inside a
+    # `class << self` body) written inside a declaration body spells, so a runtime `Widget.extend(m)` and an
+    # `extend` in a file outside the analysed set are both absent from it, as is an `extend` declared only
+    # in RBS — that one reaches the same consumer through `Environment#singleton_extended_modules` instead.
+    # Its one consumer ({Inference::Narrowing.narrow_class}) therefore reads it
+    # only to WITHHOLD a `Bot`, and never to assert that a guard matches.
+    def singleton_extends_of(class_name)
+      table = @discovery.discovered_extends
+      return [] if table.empty?
+
+      names = []
+      current = class_name.to_s
+      seen = {}
+      while current && !seen[current] && seen.size <= ANCESTOR_WALK_LIMIT
+        seen[current] = true
+        record_class_dependency(current) if Analysis::DependencyRecorder.active?
+        names.concat(table[current] || [])
+        current = @discovery.discovered_superclasses[current]
+      end
+      names.uniq
+    end
+
     # ADR-24 slice 2 — the user-side ancestor walk: resolves `method_name` against `class_name`'s own `def`s,
     # then breadth-first through its included / prepended modules (mixins first, as Ruby orders them) and its
     # superclass chain. Returns `[def_node, owner]`, or `[nil, nil]` when nothing in the project defines it.
@@ -810,9 +895,56 @@ module Rigor
       [nil, nil]
     end
 
+    # Issue #633 — the ancestors a project class reaches that the project itself does NOT declare: the
+    # `< StandardError` / `< Array` superclasses and the `include Comparable` mixins the two walks above
+    # deliberately drop, gathered breadth-first over the project ancestry so an inherited edge counts too.
+    #
+    # Each entry is the CANDIDATE LIST for one as-written name ({#ancestor_name_candidates}: the nesting
+    # spellings first, the bare name last), not a resolved class — resolving it means asking the RBS
+    # environment, which this frozen-index walk does not read. The caller takes the first candidate its own
+    # oracle knows and ignores the rest, the same "most-qualified first" order the project-side resolution
+    # uses.
+    def external_ancestor_name_candidates(class_name, name_memo: {})
+      groups = []
+      queue = [class_name.to_s]
+      seen = {}
+      visited = 0
+      until queue.empty?
+        current = queue.shift
+        next if current.nil? || seen[current]
+
+        seen[current] = true
+        visited += 1
+        break if visited > ANCESTOR_WALK_LIMIT
+
+        collect_external_ancestors(current, queue, groups, name_memo)
+      end
+      groups
+    end
+
+    # One node of {#external_ancestor_name_candidates}: the project-declared ancestors continue the walk,
+    # everything else is reported as a candidate list.
+    def collect_external_ancestors(current, queue, groups, name_memo)
+      raw_names = includes_of(current).dup
+      raw_super = superclass_of(current)
+      raw_names << raw_super if raw_super
+      raw_names.each do |raw|
+        resolved = resolve_ancestor_class_name(current, raw, name_memo)
+        if resolved
+          queue.push(resolved)
+        else
+          groups << ancestor_name_candidates(current, raw)
+        end
+      end
+    end
+    private :collect_external_ancestors
+
     # The BFS node cap; a hierarchy past it gives up rather than walking unboundedly (ADR-41 WD4).
     ANCESTOR_WALK_LIMIT = 100
 
+    EMPTY_HEADER_NESTING = [].freeze
+    private_constant :EMPTY_HEADER_NESTING
+
     def ancestor_walk_gave_up
       Inference::BudgetTrace.hit(Inference::BudgetTrace::ANCESTOR_WALK_LIMIT)
       [nil, nil]
@@ -929,10 +1061,25 @@ module Rigor
       return [raw.delete_prefix("::")] if raw.start_with?("::")
 
       recorded = @discovery.discovered_header_nestings[subclass_qualified.to_s]
-      entries = recorded || peeled_header_nesting(subclass_qualified)
+      entries = recorded ? recorded_header_nesting(recorded, raw) : peeled_header_nesting(subclass_qualified)
       entries.map { |entry| "#{entry}::#{raw_ancestor}" } << raw_ancestor.to_s
     end
 
+    # Issue #728 — the chain of the declaration site that WROTE `raw`, which is the cref Ruby resolves that
+    # one name in. A class's sites need not agree: `class Foo < Base` at the top level and a rooted
+    # `class ::Foo; include Helper; end` inside `module Outer` are two sites of `Foo`, and the union of
+    # their chains put `Outer::Base` — a class Ruby never looks at — ahead of `::Base` for the superclass
+    # the top-level site wrote. That is a WRONG CLASS, not a wider candidate list.
+    #
+    # The unkeyed entry is the union, and answers a name no site recorded under its own key: an `include`
+    # attributed to this class from OUTSIDE its declaration (`Recv.class_eval { include M }`, which
+    # `Inference::ScopeIndexer#walk_class_includes` names but the header walk cannot see), or a dynamic
+    # mixin argument. It is the pre-#728 answer, so those are unchanged rather than degraded.
+    def recorded_header_nesting(bucket, raw)
+      bucket[raw] || bucket[DiscoveryIndex::UNKEYED_HEADER_NESTING] || EMPTY_HEADER_NESTING
+    end
+    private :recorded_header_nesting
+
     # The pre-#682 reading of a qualified class name: every proper prefix of it, innermost first, as if the
     # class had been declared one `module` keyword per segment.
     def peeled_header_nesting(subclass_qualified)
@@ -974,6 +1121,21 @@ module Rigor
     end
     private :record_class_dependency
 
+    # Issue #639 — the EXISTENCE edge for a bare class reference, `class:<last segment>`, the hit-side twin of
+    # the miss-side key `Inference::ExpressionTyper` already records. ADR-46 slice 1c left the existence hit
+    # edgeless on the reasoning that a file merely referencing `Post` depends on `Post`'s methods, not on its
+    # bare existence; that stops holding the moment the DECLARING FILE IS DELETED, because existence is then
+    # exactly what changed and a reference-only consumer had recorded nothing to be re-checked by.
+    #
+    # NAME-keyed rather than a positive edge to the declaring file, which is the distinction the ADR's cost
+    # argument turns on: the declared-class set of a file does not move when a method body in it is edited,
+    # so a bare referent is re-checked when the class appears or disappears and at no other time. A file edge
+    # would have re-checked every bare referent of every class the file declares on any edit to it.
+    def record_class_existence(class_name)
+      segment = class_name.to_s.delete_prefix("::").split("::").last
+      Analysis::DependencyRecorder.read_name(:class, segment) if segment
+    end
+
     # Issue #644 — the positive ADR-46 edge for a cross-file VALUE constant. `Reflection.constant_type_at`
     # calls this the moment a candidate resolves through `in_source_constants`, so the reader depends on the
     # file that wrote the constant: editing the literal, or deleting the file, re-checks the reader. Recorded
@@ -1125,7 +1287,8 @@ module Rigor
         @globals == other.globals &&
         @indexed_narrowings == other.indexed_narrowings &&
         @method_chain_narrowings == other.method_chain_narrowings &&
-        @declaration_sourced == other.declaration_sourced
+        @declaration_sourced == other.declaration_sourced &&
+        @published_constant_sourced == other.published_constant_sourced
     end
     alias eql? ==
 
@@ -1142,6 +1305,7 @@ module Rigor
       indexed_narrowings: @indexed_narrowings,
       method_chain_narrowings: @method_chain_narrowings,
       declaration_sourced: @declaration_sourced,
+      published_constant_sourced: @published_constant_sourced,
       source_path: @source_path,
       struct_fold_safe_locals: @struct_fold_safe_locals,
       opaque_block_self: @opaque_block_self,
@@ -1163,6 +1327,7 @@ module Rigor
         indexed_narrowings: indexed_narrowings,
         method_chain_narrowings: method_chain_narrowings,
         declaration_sourced: declaration_sourced,
+        published_constant_sourced: published_constant_sourced,
         source_path: source_path,
         struct_fold_safe_locals: struct_fold_safe_locals,
         opaque_block_self: opaque_block_self,
@@ -1208,6 +1373,12 @@ module Rigor
         # path made the binding flow-live (a method-local nil write / failed-guard narrowing), the merge is
         # flow-live and `possible-nil-receiver` fires as before.
         declaration_sourced: join_declaration_sourced(other),
+        # Issue #667 — UNION, the opposite of the line above, which is the first reason this mark does not
+        # ride the ADR-58 Set. The mark only ever WITHHOLDS a firing, so keeping it when either arm bound the
+        # name from a published constant is the false-positive-safe merge: `if c then m = MODE else m = MODE2
+        # end; m == :x` must not warn because one arm's copy is invisible to the reader's author. ADR-67
+        # WD6b's `:inferred_param` taint takes the same direction for the same reason.
+        published_constant_sourced: join_published_constant_sourced(other),
         source_path: source_path,
         # Issue #589 — the fold-safe set MUST survive a merge. It was simply absent from this constructor
         # call, so it fell back to the empty default and every `if` / `while` in a method silently revoked
@@ -1339,6 +1510,34 @@ module Rigor
     end
 
     # ADR-58 WD1 — set/clear the declaration-sourced provenance mark.
+    # Issue #667 — the #667 carrier's add/drop pair. Deliberately not reusing
+    # {#add_declaration_sourced} / {#drop_declaration_sourced_for}: the two sets are joined by opposite
+    # policies, so sharing the storage would make every future edit to either one a decision about both.
+    def add_published_constant_sourced(kind, name)
+      ref = [kind.to_sym, name.to_sym].freeze
+      return @published_constant_sourced if @published_constant_sourced.include?(ref)
+
+      (@published_constant_sourced.dup << ref).freeze
+    end
+
+    def drop_published_constant_sourced_for(kind, name)
+      return @published_constant_sourced if @published_constant_sourced.empty?
+
+      ref = [kind.to_sym, name.to_sym]
+      return @published_constant_sourced unless @published_constant_sourced.include?(ref)
+
+      (@published_constant_sourced - [ref]).freeze
+    end
+
+    def join_published_constant_sourced(other)
+      mine = @published_constant_sourced
+      theirs = other.published_constant_sourced
+      return mine if mine.equal?(theirs) || theirs.empty?
+      return theirs if mine.empty?
+
+      (mine | theirs).freeze
+    end
+
     def add_declaration_sourced(kind, name)
       ref = [kind.to_sym, name.to_sym]
       return @declaration_sourced if @declaration_sourced.include?(ref)