rigortype 0.3.9 → 0.4.0

data/lib/rigor/inference/operand_effects.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../source/node_children"
+require_relative "captured_locals"
+require_relative "element_read_widening"
+require_relative "jump_targets"
+require_relative "mutation_widening"
+require_relative "receiver_alias"
+
+module Rigor
+  module Inference
+    # Whether an expression `StatementEvaluator` would otherwise type as a pure value — a call's receiver or
+    # argument, a literal, an interpolation, a `rescue` modifier — holds something the scope after it must see:
+    # a variable write whose binding outlives the expression, or a `next` / `break` whose path a jump join
+    # reads. Issue #1223: `out << (n += 1)` left `n` on its pre-write binding, straight-line and through
+    # ADR-56's block write-back, and `puts(x && next)` never reached the block's `next` join.
+    #
+    # A local write counts only when it binds past every block and lambda it is nested in within the
+    # expression (its `depth` reaches the expression's own scope): `puts(xs.map { |x| y = x })` binds `y` in
+    # the block alone, while `puts(xs.each { t = 1 })` rebinds the outer `t`. Every instance-variable,
+    # class-variable and global write counts wherever it is, and so does an index `||=` / `&&=` / `op=`,
+    # whose store widens its receiver. A jump counts only where it targets the construct around the
+    # expression ({JumpTargets}). A `def`, class or module body is a scope of its own, and `defined?`
+    # evaluates nothing, so neither is looked into.
+    #
+    # An in-place mutation counts on the same terms as a write ({.outliving_mutation?}): a call to a name the
+    # straight-line widening responds to ({MutationWidening::SHAPE_MUTATORS}) on a receiver naming a variable
+    # that outlives the expression. The mutator's widening runs in the evaluator's post-call effects, which a
+    # pure-value operand never reached, so a chained `b.push(2).size`, an argument `puts(b.push(2))` or
+    # `d.map!.with_index { … }` left `b` / `d` on the literal their assignment wrote.
+    #
+    # Short-circuiting and allocation-free outside a mutator-named call: the evaluator asks it of every call's
+    # operands, and asks it again of each operand it threads. A found effect stops the recursion without a
+    # `return` out of the child block, which would allocate once per frame it unwinds and make a deep literal
+    # quadratic.
+    module OperandEffects
+      LOCAL_WRITE_NODES = CapturedLocals::LOCAL_WRITE_NODES
+      OUTLIVING_WRITE_NODES = (
+        CapturedLocals::NON_LOCAL_WRITE_NODES |
+        Set[Prism::IndexOrWriteNode, Prism::IndexAndWriteNode, Prism::IndexOperatorWriteNode]
+      ).freeze
+      INSTANCE_WRITE_NODES = Set[
+        Prism::InstanceVariableWriteNode, Prism::InstanceVariableOperatorWriteNode,
+        Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode, Prism::InstanceVariableTargetNode
+      ].freeze
+      GLOBAL_WRITE_NODES = Set[
+        Prism::GlobalVariableWriteNode, Prism::GlobalVariableOperatorWriteNode, Prism::GlobalVariableOrWriteNode,
+        Prism::GlobalVariableAndWriteNode, Prism::GlobalVariableTargetNode
+      ].freeze
+      COMPOUND_LOCAL_WRITES = Set[
+        Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode
+      ].freeze
+      COMPOUND_INSTANCE_WRITES = Set[
+        Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableOrWriteNode,
+        Prism::InstanceVariableAndWriteNode
+      ].freeze
+      JUMP_NODES = Set[Prism::NextNode, Prism::BreakNode].freeze
+      SCOPE_NODES = Set[Prism::BlockNode, Prism::LambdaNode].freeze
+      OPAQUE_NODES = Set[
+        Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode, Prism::DefinedNode
+      ].freeze
+      private_constant :LOCAL_WRITE_NODES, :OUTLIVING_WRITE_NODES, :INSTANCE_WRITE_NODES, :GLOBAL_WRITE_NODES,
+                       :COMPOUND_LOCAL_WRITES,
+                       :COMPOUND_INSTANCE_WRITES, :JUMP_NODES, :SCOPE_NODES, :OPAQUE_NODES
+
+      module_function
+
+      def any?(node)
+        node.is_a?(Prism::Node) && effect?(node, 0, true)
+      end
+
+      # `nesting` counts the blocks and lambdas between `node` and the expression's root; `jumps` is false once
+      # the walk has crossed a construct that retargets a jump.
+      def effect?(node, nesting, jumps)
+        klass = node.class
+        return true if LOCAL_WRITE_NODES.include?(klass) && node.depth >= nesting
+        return true if OUTLIVING_WRITE_NODES.include?(klass)
+        return true if jumps && JUMP_NODES.include?(klass)
+        return true if klass == Prism::CallNode && outliving_mutation?(node, nesting)
+        return false if OPAQUE_NODES.include?(klass)
+
+        nesting += 1 if SCOPE_NODES.include?(klass)
+        jumps &&= !JumpTargets.boundary?(node)
+        found = false
+        node.rigor_each_child { |child| found ||= effect?(child, nesting, jumps) }
+        found
+      end
+      private_class_method :effect?
+
+      # True when `node` is a call the straight-line widening would answer for a variable that outlives the
+      # expression: a {MutationWidening::SHAPE_MUTATORS} name on a receiver whose {ReceiverAlias.mutated_reads},
+      # or the local an element read is rooted at ({ElementReadWidening.element_read_path}, `a[0] << e`), reach
+      # past the blocks between `node` and the expression's root. A block's own local — its parameter, a name it
+      # introduces — is that block's to widen.
+      def outliving_mutation?(node, nesting)
+        return false unless MutationWidening::SHAPE_MUTATORS.include?(node.name)
+
+        receiver = node.receiver
+        return false if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+        path = ElementReadWidening.element_read_path(receiver)
+        return outliving_read?(path.first, nesting) if path
+
+        ReceiverAlias.mutated_reads(receiver).any? { |read| outliving_read?(read, nesting) }
+      end
+      private_class_method :outliving_mutation?
+
+      # A local read reaches the expression's own scope when its `depth` does; an `it` read is always the
+      # innermost block's parameter, so only one outside every block in the expression does. An instance
+      # variable, class variable or global always outlives it.
+      def outliving_read?(read, nesting)
+        case read
+        when Prism::LocalVariableReadNode then read.depth >= nesting
+        when Prism::ItLocalVariableReadNode then nesting.zero?
+        else true
+        end
+      end
+      private_class_method :outliving_read?
+
+      # The locals (bare names), instance variables and globals (sigil-prefixed names, as {CapturedLocals.bind}
+      # reads them) `node` writes on the terms {.any?} counts a write, in first-write order.
+      def written_variables(node)
+        names = []
+        collect_written(node, 0, names) if node.is_a?(Prism::Node)
+        names.uniq
+      end
+
+      # The locals and instance variables `node` reads, named as {.written_variables} names them. A compound write
+      # (`x += 1`, `x ||= v`) reads the variable it writes.
+      def read_variables(node)
+        names = []
+        collect_read(node, 0, names) if node.is_a?(Prism::Node)
+        names.uniq
+      end
+
+      def collect_read(node, nesting, names)
+        klass = node.class
+        if klass == Prism::LocalVariableReadNode || COMPOUND_LOCAL_WRITES.include?(klass)
+          names << node.name if node.depth >= nesting
+        elsif klass == Prism::InstanceVariableReadNode || COMPOUND_INSTANCE_WRITES.include?(klass)
+          names << node.name
+        end
+        return if OPAQUE_NODES.include?(klass)
+
+        nesting += 1 if SCOPE_NODES.include?(klass)
+        node.rigor_each_child { |child| collect_read(child, nesting, names) }
+      end
+      private_class_method :collect_read
+
+      def collect_written(node, nesting, names)
+        klass = node.class
+        if LOCAL_WRITE_NODES.include?(klass)
+          names << node.name if node.depth >= nesting
+        elsif INSTANCE_WRITE_NODES.include?(klass) || GLOBAL_WRITE_NODES.include?(klass)
+          names << node.name
+        end
+        return if OPAQUE_NODES.include?(klass)
+
+        nesting += 1 if SCOPE_NODES.include?(klass)
+        node.rigor_each_child { |child| collect_written(child, nesting, names) }
+      end
+      private_class_method :collect_written
+    end
+  end
+end

data/lib/rigor/inference/operand_walk.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    # Issue #1256 — the later operands of one expression `StatementEvaluator` threads and types as a whole (a
+    # call, a literal, a `rescue` modifier): the operands entered from a scope an earlier operand moved, rather
+    # than from the one the whole expression is typed from. `puts(b.unshift("s"), b.first.upcase)` enters
+    # `b.first.upcase` after the `unshift` widened `b`, and `[n += 1, n += 1]` its second element after the first
+    # write.
+    #
+    # Each such operand is recorded into the per-node scope index with the scope it was entered from, so the
+    # diagnostics read it there, and typed from that scope once, so the whole expression's value holds it
+    # ({#types}). The operand holding a write is still typed from its own entry: `out << (n += 1)` appends `1`.
+    #
+    # The walk takes an operand before anything below it, and compares an operand's entry against the scope its
+    # nearest taken ancestor is typed from, so each later operand is typed exactly once: from the bottom up, each
+    # holding the values of the ones below it. A threaded call below the root is still not typed as a whole
+    # (`StatementEvaluator#call_effects`); its later operands join the root's walk.
+    class OperandWalk
+      # Positions `ExpressionTyper` gives no value of their own: it reads their children directly, never the node,
+      # so a later one is recorded but not typed, and its children are compared against its ancestor's scope.
+      # A keyword hash is typed whole only as a plain hash: the `**h` form reads the splatted value itself
+      # (`ExpressionTyper#double_splat_hash_shape`), so its children are taken instead.
+      NON_VALUE_NODES = Set[
+        Prism::ArgumentsNode, Prism::AssocNode, Prism::AssocSplatNode, Prism::BlockArgumentNode, Prism::SplatNode,
+        Prism::KeywordHashNode
+      ].freeze
+      private_constant :NON_VALUE_NODES
+
+      # The per-node scope index's `(node, scope) ->` recorder, or nil for an unrecorded pass.
+      attr_reader :recorder
+
+      def initialize(recorder)
+        @recorder = recorder
+        @entries = nil
+        @types = nil
+      end
+
+      # The position the next taken operand lands at, for {#types}' `since:`.
+      def mark
+        @entries.nil? ? 0 : @entries.size
+      end
+
+      # Takes `node`, entered from `entry`. Answers the slot {#resolve} fills, or nil for a {NON_VALUE_NODES}
+      # position.
+      def later(node, entry)
+        @recorder&.call(node, entry)
+        return nil if NON_VALUE_NODES.include?(node.class)
+
+        (@entries ||= []) << [node, entry, nil]
+        @entries.size - 1
+      end
+
+      # The value the handler that evaluated the operand in `slot` typed it to, from its entry.
+      def resolve(slot, type)
+        @entries[slot][2] = type
+      end
+
+      # The identity-comparing table of every taken operand's value, for `ExpressionTyper`'s `operand_types:`, or
+      # nil when the walk took none at or after `since` (a {#mark}). An operand the evaluator did not type is typed
+      # from its entry here, after every operand below it. A threaded call below the root asks for the operands
+      # taken under it once they are all taken; they are typed then and only then, and the table keeps growing,
+      # so the root's own request types only what is left.
+      def types(tracer, since: 0)
+        return nil if @entries.nil? || @entries.size <= since
+
+        @types ||= {}.compare_by_identity
+        (@entries.size - 1).downto(since) do |index|
+          node, entry, type = @entries[index]
+          next if @types.key?(node)
+
+          @types[node] = type || self.class.type_of(entry, node, tracer, @types)
+        end
+        @types
+      end
+
+      # `node`'s type from `scope`, answering each node `operand_types` holds with its value there. `Scope#type_of`
+      # itself is plugin-facing and keeps its surface, so the table goes to the typer directly.
+      def self.type_of(scope, node, tracer, operand_types)
+        return scope.type_of(node, tracer: tracer) if operand_types.nil?
+
+        ExpressionTyper.new(scope: scope, tracer: tracer, operand_types: operand_types).type_of(node)
+      end
+    end
+  end
+end

data/lib/rigor/inference/optimistic_origin.rb

@@ -43,16 +43,68 @@ module Rigor
       # them would widen this channel into a taint that silences genuine diagnostics.
       NIL_COLLAPSING_PREDICATES = %i[nil? !].freeze
 
+      # Issue #1094 — the binary comparisons that are the same statement as `nil?` when one operand is the `nil`
+      # literal: `x == nil`, `nil != x`, `x.equal?(nil)`, `nil === x`. Every one folds from the other operand's
+      # nil-freeness alone, so the derivation is exactly as sound as the unary one. A comparison against any
+      # other value folds from the carrier's value and stays out, for the reason the value predicates do.
+      NIL_COMPARISONS = %i[== != eql? equal? ===].freeze
+
+      # {.miss_answer}'s answer for an expression whose value on a miss cannot be told.
+      UNKNOWN_MISS = Object.new.freeze
+
+      # Issue #1302 — a local / ivar mark that also records what the bound value answers on a miss, so
+      # {.miss_answer} reads a predicate through the binding as it reads the inline form. `Scope` stores it in
+      # the mark table in place of the bare cause, so the answer is kept and dropped with the mark itself; a
+      # binding whose miss answer cannot be told stores the bare cause, as before.
+      BoundMark = Data.define(:cause, :miss)
+
+      # The marks a binding of today's single cause records, interned so that marking `v = h[k]` allocates
+      # nothing beyond the table it always rebuilt.
+      INTERNED_BOUND_MARKS = [nil, true, false].to_h do |miss|
+        [miss, BoundMark.new(cause: IMPLICITLY_RETURNS_NIL, miss: miss)]
+      end.freeze
+      private_constant :INTERNED_BOUND_MARKS
+
       module_function
 
+      # What `Scope` stores for a binding marked with `cause` whose value answers `miss` on a miss.
+      def bound_mark(cause, miss)
+        return cause if miss.equal?(UNKNOWN_MISS)
+
+        (cause == IMPLICITLY_RETURNS_NIL && INTERNED_BOUND_MARKS[miss]) || BoundMark.new(cause: cause, miss: miss)
+      end
+
+      # The cause and the recorded miss answer of an entry {.bound_mark} made (or nil for no entry).
+      def bound_cause(mark) = mark.is_a?(BoundMark) ? mark.cause : mark
+      def bound_miss(mark) = mark.is_a?(BoundMark) ? mark.miss : UNKNOWN_MISS
+
+      # The entry a control-flow join keeps for a name both arms mark: the answer survives only when the arms
+      # agree on it, since otherwise a miss can take either arm's.
+      def join_bound_marks(mine, theirs) = mine == theirs ? mine : bound_cause(mine)
+
+      # `rebound` — `scope` with the local `name` rebound to its type across a loop's iterations
+      # (`CapturedLocals.bind`) — re-marked with the mark `scope` holds for `name` or `optimistic`, the one an
+      # iteration's own rebind made. `scope`'s recorded miss answer is kept unless an iteration's mark joins it:
+      # that one comes without its answer, so the pair's cannot be told.
+      def carry_local_mark(scope, rebound, name, optimistic)
+        miss = optimistic ? UNKNOWN_MISS : scope.optimistic_local_miss(name)
+        rebound.with_optimistic_local(name, scope.optimistic_local(name) || optimistic, miss: miss)
+      end
+
+      # {.carry_local_mark} for an instance variable.
+      def carry_ivar_mark(scope, rebound, name, optimistic)
+        miss = optimistic ? UNKNOWN_MISS : scope.optimistic_ivar_miss(name)
+        rebound.with_optimistic_ivar(name, scope.optimistic_ivar(name) || optimistic, miss: miss)
+      end
+
       # The effective optimistic-nil-free cause of an expression under `scope`, or nil when its nil-freeness is
       # a property of the value rather than a bet. The single owner of the judgment: `ExpressionTyper`,
       # `StatementEvaluator` and `AlwaysTruthyConditionCollector` all route here, so the three consumers the
       # spec binds cannot drift apart.
       #
       # Resolution order — the mark recorded on the node itself, then the binding a bare local / ivar read (or
-      # a write in value position, `if (x = MAP[k])`) resolves through, then the predicate-fold derivation
-      # issue #313 added.
+      # a write in value position, `if (x = MAP[k])`) resolves through, then a safe-navigation call and the
+      # predicate-fold derivation issue #313 added.
       def resolve(node, scope)
         return nil if node.nil? || scope.nil?
 
@@ -63,20 +115,85 @@ module Rigor
         when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
         when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
         when Prism::AndNode, Prism::OrNode then resolve(node.left, scope) || resolve(node.right, scope)
-        when Prism::CallNode then resolve_through_predicate(node, scope)
+        when Prism::CallNode then resolve_through_safe_navigation(node, scope) || resolve_through_predicate(node, scope)
         when Prism::ParenthesesNode then resolve_through_parentheses(node, scope)
         end
       end
 
-      # `recv.nil?` / `!recv` — the fold is a statement about `recv`, so it is exactly as optimistic as `recv`
-      # is. A block or any argument means this is not the unary predicate it looks like (`x.!(y)` is a
-      # user-defined operator), and the derivation declines.
+      # `recv&.m` is `nil` exactly when `recv` is (or when `m` answers `nil`), so it restates `recv`'s presence
+      # and is as optimistic as `recv`. Only the call carrying the `&.` is derived: Ruby skips that one call and
+      # no more, so `recv&.m.n` sends `n` to the `nil` and raises (or answers `NilClass#n`), and neither it nor
+      # a plain read `recv.m` produces the `nil` a miss would — their own nil-freeness rests on the method's
+      # answer. A nil-collapsing predicate over the call (`recv&.m.nil?`) still resolves, through
+      # {.resolve_through_predicate} and back here.
+      def resolve_through_safe_navigation(node, scope)
+        resolve(node.receiver, scope) if node.safe_navigation?
+      end
+
+      # `recv.nil?` / `!recv` / `recv == nil` — the fold is a statement about `recv`, so it is exactly as
+      # optimistic as `recv` is.
       def resolve_through_predicate(node, scope)
-        return nil unless NIL_COLLAPSING_PREDICATES.include?(node.name)
+        operand = nil_question_operand(node)
+        operand && resolve(operand, scope)
+      end
+
+      # The operand a nil-collapsing predicate restates the nil-ness of, or nil when `node` is not one. A block
+      # or any argument means `nil?` / `!` is not the unary predicate it looks like (`x.!(y)` is a user-defined
+      # operator). A comparison needs exactly one positional argument and exactly one `nil` literal side, and
+      # answers the other side (`nil == nil` states nothing about a carrier).
+      def nil_question_operand(node)
         return nil unless node.block.nil?
-        return nil unless node.arguments.nil? || node.arguments.arguments.empty?
 
-        resolve(node.receiver, scope)
+        arguments = node.arguments&.arguments || []
+        if NIL_COLLAPSING_PREDICATES.include?(node.name)
+          node.receiver if arguments.empty?
+        elsif NIL_COMPARISONS.include?(node.name) && arguments.size == 1
+          nil_comparison_operand(node.receiver, arguments.first)
+        end
+      end
+
+      def nil_comparison_operand(receiver, argument)
+        if argument.is_a?(Prism::NilNode) && !receiver.nil? && !receiver.is_a?(Prism::NilNode)
+          receiver
+        elsif receiver.is_a?(Prism::NilNode) && !argument.is_a?(Prism::NilNode)
+          argument
+        end
+      end
+
+      # What a marked expression answers when the carrier its mark rests on misses, or {UNKNOWN_MISS}. The
+      # carrier itself — the read the mark is recorded on, or a `recv&.m` over a marked receiver — answers `nil`,
+      # and each nil-collapsing predicate over it answers what it answers for that value: `!` its negation,
+      # `nil?` / `== nil` whether it is `nil`, `!= nil` the reverse. A local / ivar read answers what its binding
+      # recorded beside the mark ({BoundMark}, issue #1302): `nil` for `x = h[k]` and for `x = recv&.m?`. An
+      # `&&` / `||`, a binding that recorded nothing, and anything else is unknown. `ExpressionTyper` widens a
+      # predicate's folded boolean only when the miss answers the other boolean (or cannot be told), so
+      # `!recv&.empty?` — `!false` on a hit, `!nil` on a miss — stays `true`, and so does `x = recv&.empty?; !x`.
+      def miss_answer(node, scope)
+        return nil if scope.optimistic_origins[node]
+
+        case node
+        when Prism::LocalVariableReadNode then scope.optimistic_local_miss(node.name)
+        when Prism::InstanceVariableReadNode then scope.optimistic_ivar_miss(node.name)
+        when Prism::CallNode then miss_answer_of_call(node, scope)
+        when Prism::ParenthesesNode
+          body = node.body
+          body.is_a?(Prism::StatementsNode) && body.body.size == 1 ? miss_answer(body.body.first, scope) : UNKNOWN_MISS
+        else UNKNOWN_MISS
+        end
+      end
+
+      def miss_answer_of_call(node, scope)
+        return nil if node.safe_navigation? && resolve(node.receiver, scope)
+
+        operand = nil_question_operand(node)
+        inner = operand ? miss_answer(operand, scope) : UNKNOWN_MISS
+        return UNKNOWN_MISS if inner.equal?(UNKNOWN_MISS)
+
+        case node.name
+        when :! then !inner
+        when :!= then !inner.nil?
+        else inner.nil?
+        end
       end
 
       # `(x.nil?)` — a single-statement parenthesised body is its own value, and authors do parenthesise a
@@ -89,6 +206,32 @@ module Rigor
         resolve(body.body.first, scope)
       end
 
+      # The mark a multiple assignment's right-hand side hands to the slots it fills, in the shape
+      # `MultiTargetBinder.bind_marked`'s `optimistic:` takes. `true` when the whole right-hand side resolves
+      # to a mark: a miss makes it `nil`, and `k, v = nil` binds `nil` to every fixed slot, so each slot's
+      # nil-freeness is the same bet (the rule a nested target under an optimistic slot already follows). A
+      # literal array right-hand side (`x, y = h[k], 1`) is judged element-wise instead — an Array of each
+      # element's own marks, nested for a nested literal — since each element is its slot's value; a splat
+      # element makes the slot positions unknowable and declines. `false` when nothing is marked.
+      def destructuring_marks(node, scope)
+        return true if resolve(node, scope)
+        return false unless node.is_a?(Prism::ArrayNode) && node.elements.none?(Prism::SplatNode)
+
+        marks = node.elements.map { |element| destructuring_marks(element, scope) }
+        marks.any? { |mark| mark != false } ? marks : false
+      end
+
+      # Issue #1302 — the miss answer every slot {.destructuring_marks} marks records: `nil` when each marked
+      # part of the right-hand side answers `nil` on a miss, since `nil` destructures to `nil` in every slot, and
+      # {UNKNOWN_MISS} otherwise. A marked right-hand side a miss makes a boolean (`a, b = !h[k]`) binds it to
+      # the first slot only, so its slots are not told apart and all of them record nothing.
+      def destructuring_miss(node, scope)
+        return miss_answer(node, scope).nil? ? nil : UNKNOWN_MISS if resolve(node, scope)
+        return nil unless node.is_a?(Prism::ArrayNode)
+
+        node.elements.all? { |element| destructuring_miss(element, scope).nil? } ? nil : UNKNOWN_MISS
+      end
+
       # Whether the overload the selector actually picked carries the ignored annotation. The judgment is
       # per-overload, which is what makes it precise: `Array#first` is optimistic while `Array#first(3)` is
       # not, and `String#[]` / `Enumerable#find` are honest because they already spell the miss as `?`.

data/lib/rigor/inference/parameter_inference_collector.rb

@@ -265,7 +265,7 @@ module Rigor
         method_visibilities: :discovered_method_visibilities,
         methods: :discovered_methods,
         data_member_layouts: :data_member_layouts,
-        struct_member_layouts: :struct_member_layouts
+        struct_member_layouts: :struct_member_layouts, deferred_ranges: :discovered_deferred_ranges
       }.freeze
       private_constant :DISCOVERY_FIELD
 
@@ -329,7 +329,8 @@ module Rigor
           arg.is_a?(Prism::AssocSplatNode)
       end
 
-      # @return , nil]
+      # @return the callee's `[class_name, method_name, kind, def_node]`, or nil when the receiver's class
+      #   or the method's `def` is not in the project index
       def resolve_callee(call_node, scope, index)
         if call_node.receiver.nil?
           class_name, kind = implicit_self_target(scope)

data/lib/rigor/inference/project_method_ownership.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require_relative "../type"
+require_relative "external_ancestor_resolution"
+
+module Rigor
+  module Inference
+    # Issue #1234 — does the PROJECT define the method a receiver answers a name with? The captured-binding
+    # pass reads a catalogued iterator name on an unclassified receiver as repetition
+    # ({ClosureEscapeAnalyzer.repeats_by_name?}), and that reading is wrong for a method the project wrote
+    # under the same name: `class Vault; def select(key) = yield(key.to_s); end` runs its block once. The
+    # ancestry step of {ClosureEscapeAnalyzer.classify} asks the same question, of the same call, to rule the
+    # project out as the method's owner.
+    #
+    # "Defines" is a `def`, `define_method` or `attr_*` anywhere in a project class's ancestry, on the
+    # instance side or on the singleton side for a class-object receiver, or a signature whose declaring
+    # owner is a project class or module.
+    module ProjectMethodOwnership
+      NO_TARGETS = [].freeze
+      private_constant :NO_TARGETS
+
+      MEMO_KEY = :__rigor_project_method_ownership_memo__
+      private_constant :MEMO_KEY
+
+      module_function
+
+      # The `[class_name, kind]` pairs the receiver's method is looked up on — `[]` for a receiver Rigor
+      # cannot see at all — or nil when the carrier names a class this cannot resolve, or is one it does not
+      # recognise, so a caller that cannot tell whether the project owns the method can decline. The audit,
+      # carrier by carrier:
+      #
+      # - `Dynamic`, `Top` — unseen: `[]`.
+      # - `Nominal`, `StructInstance`, `DataInstance` — their `class_name`, instance side.
+      # - `Singleton`, `StructClass`, `DataClass` — their `class_name`, singleton side.
+      # - `Tuple` → `Array`, `HashShape` → `Hash`, `IntegerRange` → `Integer`, `FloatRange` → `Float`,
+      #   `Constant` → its value's class, `BoundMethod` → `Method`: instance side of that core class, which a
+      #   project reopening may still define the method on.
+      # - `Union`, `Intersection` — every member's targets; a member it cannot resolve resolves the whole.
+      # - `Refined`, `Difference` — their `base`. `App` — its erasure `bound`.
+      # - A struct / data carrier with no `class_name` (an anonymous `Struct.new` value), `Bot`, `Maybe`,
+      #   `Result`, and any carrier added later — nil.
+      def targets(receiver_type)
+        case receiver_type
+        when Type::Dynamic, Type::Top then NO_TARGETS
+        when Type::Nominal, Type::StructInstance, Type::DataInstance
+          class_target(receiver_type.class_name, :instance)
+        when Type::Singleton, Type::StructClass, Type::DataClass
+          class_target(receiver_type.class_name, :singleton)
+        when Type::Union, Type::Intersection then member_targets(receiver_type.members)
+        when Type::Refined, Type::Difference then targets(receiver_type.base)
+        when Type::App then targets(receiver_type.bound)
+        else core_targets(receiver_type)
+        end
+      end
+
+      # Whether the project's source, or a signature whose declaring owner is a project class or module,
+      # defines `method_sym` on `class_name` or an ancestor the project declares. Memoised ({.memo}): the
+      # ancestry step and the name reading ask it of the same call, and every block call on the class asks
+      # it again.
+      def defines?(class_name, method_sym, kind, scope)
+        return false if scope.nil?
+
+        by_method = (memo(scope)[kind][class_name] ||= {})
+        return by_method[method_sym] if by_method.key?(method_sym)
+
+        by_method[method_sym] = compute_defines?(class_name, method_sym, kind, scope)
+      end
+
+      # One slot per thread, keyed on the identity of the scope's frozen discovery index and its environment —
+      # the only inputs {.defines?} and the ancestry step read — and replaced, not accumulated, when either
+      # changes: the shape of `ExpressionTyper#class_graph_buckets`, whose rationale applies unchanged. A
+      # `Scope` merges each file's discovery with the project pre-pass, so the slot turns over per file, and
+      # an ADR-46 dependency the first lookup recorded belongs to the file every later hit serves. Pool
+      # workers are separate processes, and a Ractor has its own `Thread.current`. The `:ancestry` bucket
+      # belongs to {ClosureEscapeAnalyzer}'s ancestry step.
+      def memo(scope)
+        discovery = scope.discovery
+        environment = scope.environment
+        slot = Thread.current[MEMO_KEY]
+        unless slot && slot[0].equal?(discovery) && slot[1].equal?(environment)
+          slot = [discovery, environment, { instance: {}, singleton: {}, ancestry: {} }]
+          Thread.current[MEMO_KEY] = slot
+        end
+        slot[2]
+      end
+
+      class << self
+        private
+
+        def class_target(class_name, kind)
+          class_name.nil? ? nil : [[class_name.to_s, kind]]
+        end
+
+        def member_targets(members)
+          members.each_with_object([]) do |member, out|
+            resolved = targets(member)
+            return nil if resolved.nil?
+
+            out.concat(resolved)
+          end
+        end
+
+        def core_targets(receiver_type)
+          case receiver_type
+          when Type::Tuple then class_target("Array", :instance)
+          when Type::HashShape then class_target("Hash", :instance)
+          when Type::IntegerRange then class_target("Integer", :instance)
+          when Type::FloatRange then class_target("Float", :instance)
+          when Type::Constant then class_target(receiver_type.value.class.name, :instance)
+          when Type::BoundMethod then class_target("Method", :instance)
+          end
+        end
+
+        def compute_defines?(class_name, method_sym, kind, scope)
+          return true if source_defines?(class_name, method_sym, kind, scope)
+
+          # `ExternalAncestorResolution.method_definition` owns the rescue for a malformed signature.
+          definition = ExternalAncestorResolution.method_definition(class_name, method_sym, kind, scope: scope)
+          owner = definition.respond_to?(:defined_in) ? definition.defined_in : nil
+          !owner.nil? && scope.known_user_class?(owner.to_s.delete_prefix("::"))
+        end
+
+        def source_defines?(class_name, method_sym, kind, scope)
+          return true if scope.discovered_method_through_ancestors?(class_name, method_sym, kind)
+
+          found, = if kind == :singleton
+                     scope.singleton_def_through_ancestors(class_name, method_sym)
+                   else
+                     scope.user_def_through_ancestors(class_name, method_sym)
+                   end
+          !found.nil?
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/project_patched_methods.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "global_write_census"
+
 module Rigor
   module Inference
     # ADR-17 § "Inference contract" — project-wide patched-method registry populated by the pre-eval
@@ -26,16 +28,19 @@ module Rigor
         end
       end
 
-      attr_reader :by_key
+      attr_reader :by_key, :write_census
 
       # @param entries — flat list of declarations observed during the pre-pass.
       #   First-write-wins on `(class_name, method_name, kind)` duplicates so the
       #   `pre-eval.duplicate-declaration` diagnostic emission stays decoupled from registry behaviour.
-      def initialize(entries: [])
+      # @param write_census — issue #1367: the `pre_eval:` files' {GlobalWriteCensus}, which the `global.*` write
+      #   rules join with the project's, since a patch file is loaded ahead of the code it patches.
+      def initialize(entries: [], write_census: GlobalWriteCensus::EMPTY)
         @by_key = entries.each_with_object({}) do |entry, acc|
           key = [entry.class_name, entry.method_name, entry.kind]
           acc[key] ||= entry
         end.freeze
+        @write_census = write_census.frozen? ? write_census : write_census.dup.freeze
         freeze
       end