rigortype 0.3.9 → 0.4.0

data/lib/rigor/inference/stored_block_call.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    # The calls that keep their literal block to run later instead of running it before they return: the Kernel
+    # functions that wrap it in a Proc (`lambda`, `proc`), the definers that install it as a method body
+    # (`define_method`, `define_singleton_method`, on any receiver), and the constructors that keep it as a proc,
+    # a thread or fiber body, an enumerator's generator or a hash's default proc.
+    #
+    # A `break` in such a block never becomes the call's value — it returns from the lambda or the defined method
+    # when that is called, or raises `LocalJumpError` — so the #853 break-arm union
+    # (`ExpressionTyper#call_break_arm_types`) MUST NOT read it. Unioning the arm typed
+    # `lambda do |t| break if flag; t end` as `Proc | nil`, and the lambda's next `.call` drew
+    # `call.possible-nil-receiver`.
+    #
+    # A project redefinition of one of these names is not excluded: dropping the arm there loses a `break`
+    # value, never invents one.
+    module StoredBlockCall
+      KERNEL_WRAPPERS = %i[lambda proc].freeze
+      DEFINERS = %i[define_method define_singleton_method].freeze
+      CONSTRUCTORS = {
+        Proc: %i[new], Thread: %i[new start fork], Fiber: %i[new], Enumerator: %i[new], Hash: %i[new]
+      }.transform_values(&:freeze).freeze
+      NO_NAMES = [].freeze
+      private_constant :KERNEL_WRAPPERS, :DEFINERS, :CONSTRUCTORS, :NO_NAMES
+
+      module_function
+
+      def stores_block?(call_node)
+        name = call_node.name
+        return kernel_spelled?(call_node.receiver) if KERNEL_WRAPPERS.include?(name)
+        return true if DEFINERS.include?(name)
+
+        constant = root_constant_name(call_node.receiver)
+        !constant.nil? && CONSTRUCTORS.fetch(constant, NO_NAMES).include?(name)
+      end
+
+      # Implicit self, `self.`, or `Kernel.` / `::Kernel.` — the spellings that reach Kernel's function.
+      def kernel_spelled?(receiver)
+        receiver.nil? || receiver.is_a?(Prism::SelfNode) || root_constant_name(receiver) == :Kernel
+      end
+
+      # `Foo` or `::Foo`'s name, else nil.
+      def root_constant_name(receiver)
+        case receiver
+        when Prism::ConstantReadNode then receiver.name
+        when Prism::ConstantPathNode then receiver.name if receiver.parent.nil?
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/string_mutation.rb

@@ -17,21 +17,39 @@ module Rigor
     module StringMutation
       # Receiver-mutating String methods only. The non-bang siblings (`upcase` vs `upcase!`, `sub` vs `sub!`)
       # return a new String and leave the receiver's value intact, so they stay precise.
+      #
+      # This is the one String table: `MutationWidening::SHAPE_MUTATORS` unions it with the Array and Hash ones, and
+      # the effect classifier and the effect catalogue's `mutators: string` cite it rather than keep a list of their
+      # own (ADR-103 WD3). A spec holds it to every bang method `String` defines plus the non-bang mutators reflection
+      # cannot find by name.
       MUTATORS = %i[
         << concat insert prepend replace clear []= slice!
+        setbyte bytesplice append_as_bytes force_encoding
         sub! gsub! tr! tr_s! delete! squeeze! succ! next!
         upcase! downcase! capitalize! swapcase! reverse!
-        strip! lstrip! rstrip! chomp! chop! force_encoding
+        strip! lstrip! rstrip! chomp! chop!
+        delete_prefix! delete_suffix! encode! scrub! unicode_normalize!
       ].to_set.freeze
 
-      # The {MUTATORS} that can leave the receiver EMPTY, and so retract a `non-empty-string` refinement. The
-      # rest are appenders or same-length rewrites: `s << x` / `s.prepend(x)` / `s.upcase!` cannot empty a
-      # string that already holds a character, so the refinement is still provable afterwards.
-      EMPTYING_MUTATORS = %i[
-        replace clear slice! []=
-        sub! gsub! delete! squeeze! strip! lstrip! rstrip! chomp! chop!
+      # The {MUTATORS} that CANNOT leave a non-empty receiver empty, and so keep a `non-empty-string` refinement:
+      # appenders (`<<`, `concat`, `insert`, `prepend`, `append_as_bytes`), and rewrites that keep at least one
+      # character (`setbyte`, `force_encoding`, the case mappings, `reverse!`, `succ!` / `next!`, `squeeze!`,
+      # `unicode_normalize!`). A whitelist, as `RefinementMutation::EMPTY_PRESERVING` is for Array and Hash: a mutator
+      # missing here retracts the witness, which costs precision, where a mutator missing from a list of emptiers kept
+      # the witness of a string it had just emptied — `tr!` and `tr_s!` did, since `"a".tr!("a", "")` is `""`.
+      EMPTY_PRESERVING = %i[
+        << concat insert prepend append_as_bytes
+        setbyte force_encoding
+        upcase! downcase! capitalize! swapcase! reverse! succ! next! squeeze! unicode_normalize!
       ].to_set.freeze
 
+      # `tr!` / `tr_s!` map every character they match to one character of the replacement (padded with its last), so
+      # they empty the buffer only through an EMPTY replacement: `"a".tr!("a", "")` is `""`, `"a".tr!("a", "_")` is
+      # `"_"`. They keep the witness when their second argument is provably a non-empty String.
+      TRANSLATORS = %i[tr! tr_s!].to_set.freeze
+
+      NO_ARG_TYPES = [].freeze
+
       module_function
 
       # `Constant["ab"]` under a String mutator → the bare `String` nominal. The pinned value is what the
@@ -55,6 +73,25 @@ module Rigor
       def constant?(type)
         type.is_a?(Type::Constant) && type.value.is_a?(String)
       end
+
+      # Whether `method_name`, called with `arg_types` (the call's positional argument types, possibly none), can leave
+      # a non-empty receiver empty, and so retract a `non-empty-string` refinement. Every mutator outside
+      # {EMPTY_PRESERVING} can, except a {TRANSLATORS} call whose replacement is provably non-empty.
+      def may_empty?(method_name, arg_types = NO_ARG_TYPES)
+        return false if EMPTY_PRESERVING.include?(method_name)
+        return true unless TRANSLATORS.include?(method_name)
+
+        !non_empty_string?(arg_types[1])
+      end
+
+      def non_empty_string?(type)
+        case type
+        when Type::Constant then constant?(type) && !type.value.empty?
+        when Type::Difference then type.removes_empty_witness? && type.base.class_name == "String"
+        when Type::Union then type.members.all? { |member| non_empty_string?(member) }
+        else false
+        end
+      end
     end
   end
 end

data/lib/rigor/inference/unknown_store_widening.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+require_relative "element_read_widening"
+require_relative "mutation_widening"
+
+module Rigor
+  module Inference
+    # What a binding can hold after each of a set of in-place mutation sites — the nodes
+    # {CapturedLocals.content_mutations} collects — has run any number of times, storing values nothing typed.
+    #
+    # Each site takes its own straight-line widening ({MutationWidening.widen_for_mutator}), fed one
+    # `Dynamic[top]` per argument, and every site that can STORE a value then gives each type argument of the
+    # widened `Array` / `Hash` a `Dynamic[top]` arm: `{ a: 0 }` under `h[k] += 1` reads
+    # `Hash[Dynamic[top] | Symbol, Dynamic[top] | Integer]`. The second step is not redundant. The widening
+    # joins argument evidence only for the plain adders (`<<`, `push`, `[]=`, `store`, …); a site whose stored
+    # values its arguments do not describe — `map!`, a block-form `fill`, `transform_values!`, `merge!`,
+    # `flatten!` — comes back with the seed's element types alone, which is a wrong precise answer once the
+    # block has run: `a = [1]` under `a.map!(&:to_s)` would read `Array[Integer]`. Only a site that removes or
+    # reorders ({VALUE_PRESERVING}) keeps its content as the widening left it, since it cannot put a value
+    # there that was not there before — unless it is the site that CLOSES a literal carrier. A `Tuple` or
+    # `HashShape` knows which slots and keys exist, and the nominal it widens to cannot say that any may be
+    # missing, so it takes the gradual arm too: `{ a: 0 }` under a lone `h.delete(:a)` read `Hash[Symbol, 0]`,
+    # whose `h[:b]` answered `0` where Ruby answers `nil`, and `s = [0]` under `p = s.pop; s.push(x)` closed to
+    # `Array[0]`, a precise nominal the `push` after it then declined, so `p` stayed `0?`. With the arm the
+    # answer for a `Tuple` / `HashShape` seed (alone or in a `Union`) no longer depends on the order the sites are
+    # written in; a refinement seed (`non-empty-array[0]`) still can, since its remover does not close a literal.
+    #
+    # A site whose widening declines leaves the binding as it is, exactly as the straight-line seam does: a
+    # precise nominal (a declared or inferred `Array[String]` is a claim this seam may not grow), a receiver
+    # that is no carrier, or a name the mutator tables do not list for that carrier (`store` on a `Tuple`, a method
+    # its class does not define). The caller MUST therefore not read an unchanged binding as describing later
+    # iterations. An empty-witness refinement under a storing mutator that keeps the witness is not such a decline:
+    # the straight-line widening grows it (issue #936), and gives a site whose arguments describe nothing it stores
+    # (`non-empty-array[String]` under `map!`) the gradual arm itself ({RewriteMutation}),
+    # so the site widens like any other storing site.
+    #
+    # The per-element block fold is the consumer: it types every position from one entry scope, so the binding
+    # it lays under each position has to hold whatever earlier iterations stored. Unknown evidence is the point,
+    # not a shortcut — a stored value typed in that same entry scope (`h[k] = h[k] + 1`) is itself a
+    # first-iteration answer.
+    #
+    # Two more kinds of site change a binding's contents without naming it as the receiver, and each is widened
+    # the way straight-line code widens it:
+    #
+    # - A mutator on an ELEMENT of the binding (`a[0] << e`, `a.first.push(e)`): the site's receiver is an element
+    #   read rooted at the variable ({ElementReadWidening.element_read_path}), and the same widening runs on the
+    #   element the path selects, rebuilding the carrier around it. The other slots keep their types, and a path
+    #   {ElementReadWidening} cannot follow (a `HashShape` slot) declines, as it does on straight-line code.
+    # - A self-call whose callee content-mutates the parameter the binding is passed to (`add_to(a, e)`, a
+    #   {CalleeStore}): nothing at the call says what the callee stores or removes, so each collection the binding
+    #   can hold is floored to its bare carrier ({.content_floor}), as ADR-57's callee floor does after the call.
+    module UnknownStoreWidening
+      # Mutators that only remove or reorder what the receiver already holds.
+      VALUE_PRESERVING = %i[
+        pop shift delete delete_at delete_if reject! select! filter! keep_if clear compact! uniq! slice!
+        sort! sort_by! reverse! rotate! shuffle!
+      ].to_set.freeze
+
+      # A site that mutates a binding through a callee: `call` passes the variable, read by one of `arguments`, to
+      # a parameter the callee content-mutates.
+      CalleeStore = Data.define(:call, :arguments)
+
+      COLLECTION_CLASSES = %w[Array Hash].freeze
+      FLOORED_CLASSES = %w[Array Hash String].freeze
+
+      NO_ARG_NODES = [].freeze
+      private_constant :COLLECTION_CLASSES, :FLOORED_CLASSES, :NO_ARG_NODES
+
+      module_function
+
+      # @param sites — in-place mutation nodes whose receiver, or an element read their receiver starts from, can
+      #   evaluate to the binding `type` describes, and {CalleeStore}s whose call passes that binding.
+      # @return `type` widened through every site; `type` itself when no site's widening applies.
+      def widen(type, sites)
+        sites.reduce(type) { |acc, site| widen_site(acc, site) || acc }
+      end
+
+      # `type` widened through one site, or `nil` when its widening declines.
+      def widen_site(type, site)
+        return content_floor(type) if site.is_a?(CalleeStore)
+
+        method_name, arg_types = unknown_store(site)
+        path = ElementReadWidening.element_read_path(site.receiver)
+        return widen_store(type, method_name, arg_types) if path.nil?
+
+        ElementReadWidening.widen_through_path(type, path.last, method_name, arg_types) do |element|
+          widen_store(element, method_name, arg_types)
+        end
+      end
+
+      # The straight-line widening of `type` under `method_name`, with the gradual arm on every site that can store.
+      def widen_store(type, method_name, arg_types)
+        widened = MutationWidening.widen_for_mutator(type, method_name, arg_types: arg_types)
+        return nil if widened.nil?
+
+        VALUE_PRESERVING.include?(method_name) && !literal_carrier?(type) ? widened : gradual_content(widened)
+      end
+
+      # Every `Array` / `Hash` / `String` carrier `type` can be as its bare carrier: `Array[Dynamic[top]]`,
+      # `Hash[Dynamic[top], Dynamic[top]]`, `String`. A literal, a nominal (a precise one included) and a refinement
+      # over one ({.carrier_class}) all floor; so `non-empty-string`, which a callee can empty, reads `String`.
+      # Unlike the escaping floor (`StatementEvaluator#content_floor_for`), which answers one carrier for a whole
+      # `Union`, this floors a `Union` member by member, so a member no callee can fill (`nil`) stays: the binding
+      # stands where the entry binding stood, and dropping a member would narrow it. Anything else is returned
+      # untouched.
+      def content_floor(type)
+        return Type::Combinator.union(*type.members.map { |member| content_floor(member) }) if type.is_a?(Type::Union)
+
+        carrier = carrier_class(type)
+        carrier ? carrier_floor(carrier) : type
+      end
+
+      # `"Array"`, `"Hash"` or `"String"` when `type` is a form of that carrier — a literal, a nominal, or a
+      # difference, refinement or intersection over one (`non-empty-array[Integer]`, `decimal-int-string`,
+      # `non-empty-uppercase-string`) — else nil.
+      def carrier_class(type)
+        case type
+        when Type::Tuple then "Array"
+        when Type::HashShape then "Hash"
+        when Type::Constant then "String" if type.value.is_a?(String)
+        when Type::Nominal then type.class_name if FLOORED_CLASSES.include?(type.class_name)
+        when Type::Difference, Type::Refined then carrier_class(type.base)
+        when Type::Intersection then intersection_carrier_class(type)
+        end
+      end
+
+      def intersection_carrier_class(type)
+        type.members.each do |member|
+          carrier = carrier_class(member)
+          return carrier if carrier
+        end
+        nil
+      end
+
+      def carrier_floor(class_name)
+        return Type::Combinator.nominal_of("String") if class_name == "String"
+
+        arity = class_name == "Hash" ? 2 : 1
+        Type::Combinator.nominal_of(class_name, type_args: Array.new(arity) { Type::Combinator.untyped })
+      end
+
+      # A carrier that still records its slots or keys: a `Tuple` / `HashShape`, alone or as a `Union` member.
+      def literal_carrier?(type)
+        case type
+        when Type::Tuple, Type::HashShape then true
+        when Type::Union then type.members.any? { |member| literal_carrier?(member) }
+        else false
+        end
+      end
+
+      # `[mutator, arg_types]` for one site: a call stores through its own name and arguments, an index write
+      # through `[]=` with its index arguments ahead of the value. A splat stays the `nil` arity marker the
+      # `[]=` splice classifier reads.
+      def unknown_store(site)
+        arguments = site.arguments&.arguments || NO_ARG_NODES
+        unknown = arguments.map { |arg| arg.is_a?(Prism::SplatNode) ? nil : Type::Combinator.untyped }
+        return [site.name, unknown] if site.is_a?(Prism::CallNode)
+
+        [:[]=, unknown + [Type::Combinator.untyped]]
+      end
+
+      # An `Array` / `Hash` nominal (alone, as a `Union` member, or as a refinement's base) with a value-pinned type
+      # argument. `Type::Combinator.widen_value_pinned` does not look inside type arguments, so each one is asked on
+      # its own. A `bool` or a literal union a signature declared (`Array[:a | :b]`) counts as pinned too; the arm it
+      # takes can only quiet a report, which is the accepted cost of reading every such binding past one iteration.
+      # A class-level argument (`Array[Integer]`) is not pinned: a store of the same class leaves it true, which is
+      # the claim this seam may not grow.
+      def value_pinned_collection?(type)
+        case type
+        when Type::Union then type.members.any? { |member| value_pinned_collection?(member) }
+        when Type::Difference then value_pinned_collection?(type.base)
+        when Type::Nominal
+          COLLECTION_CLASSES.include?(type.class_name) &&
+            type.type_args.any? { |arg| Type::Combinator.widen_value_pinned(arg) != arg }
+        else false
+        end
+      end
+
+      # Every type argument of an `Array` / `Hash` carrier joined with `Dynamic[top]`, member-wise through a
+      # `Union` and through a `Difference`'s base. Anything else is returned untouched.
+      def gradual_content(type)
+        case type
+        when Type::Union then Type::Combinator.union(*type.members.map { |member| gradual_content(member) })
+        when Type::Difference then Type::Combinator.difference(gradual_content(type.base), type.removed)
+        when Type::Nominal
+          return type unless COLLECTION_CLASSES.include?(type.class_name) && !type.type_args.empty?
+
+          Type::Combinator.nominal_of(
+            type.class_name,
+            type_args: type.type_args.map { |arg| Type::Combinator.union(arg, Type::Combinator.untyped) }
+          )
+        else type
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/unthreaded_rebinds.rb

@@ -0,0 +1,282 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../source/node_walker"
+require_relative "captured_locals"
+
+module Rigor
+  module Inference
+    # The names of a {CapturedLocals.writes} set that a block body rebinds somewhere `StatementEvaluator` does
+    # not carry into the body's exit scope.
+    #
+    # The per-element fold's issue #587 (b) fixpoint reads each pass's exit binding out of that evaluator, so a
+    # rebind the exit never sees leaves the fixpoint on a binding the program has already moved past, and every
+    # position of the fold re-reads it. Issue #617's unmoved-pin floor caught such a name only while nothing else
+    # moved its binding: `seen = nil; [1, 2].find { |e| seen ||= 0; (seen += 1) == 2 }` threads the `||=`, so the
+    # fixpoint left the seed, and every predicate read `0 + 1 == 2`. A name this scan returns takes the floor
+    # whatever the fixpoint converged to.
+    #
+    # The scan admits a write from these positions only, each one the evaluator threads, measured against it
+    # rather than read off it:
+    #
+    # - a statement, and the body of `(…)`, `begin` / `rescue` / `else` / `ensure`;
+    # - an assignment's value — every variable-write form, and an index `||=` / `&&=` / `op=`, but not its
+    #   receiver or index arguments;
+    # - an `if` / `unless` / `case` predicate and every branch, but not a `when` condition or an `in` guard;
+    # - both operands of `&&` / `||`;
+    # - a `while` / `until` predicate and body, a `for` index, collection and body;
+    # - a multi-assign value and its local and instance-variable targets, and the LOCAL a `rescue => e`
+    #   reference, a `for` index, a pattern capture or `=~`'s named captures binds — the evaluator binds no
+    #   class variable or global through any of them, and no instance variable outside a multi-assign;
+    # - a nested block or lambda body, for a local or an instance variable: the call's write-back fixpoint, which
+    #   joins the block's `next` and `break` paths, or the escaping-block floor covers both, and nothing covers
+    #   a class variable or global there.
+    #
+    # Every other position counts as unthreaded: a call's receiver and arguments, an array or hash literal, an
+    # interpolation, a `return` / `next` / `break` value, `rescue` modifier, `self.w =` (which rebinds `@w` with
+    # no write node at all), a `def` or class body. The list is a whitelist, so a position the evaluator gains
+    # later floors a name needlessly rather than letting a pin through. Issue #1223 is such a gain: the evaluator
+    # threads a call's receiver and arguments, the literals, the interpolations and a `rescue` modifier
+    # ({StatementEvaluator#eval_call}), and the scan does not admit them yet.
+    #
+    # A threaded rebind can still miss the exit binding when a jump leaves after it. The fold's pass and a
+    # nested block's write-back join every block-level `next` (and the write-back every `break`) into the exit
+    # ({StatementEvaluator#evaluate_invocation}), but a `while` / `until` / `for` loop's continuation joins its
+    # `next` and `break` paths only in part ({StatementEvaluator#loop_iteration}): a `for` body runs one pass,
+    # and a name outside the `while` / `until` rebind fixpoint (an instance variable) sees the first pass's
+    # `next` exits and no `break` — so the rebind such a branch made can still drop out — and `redo` / `retry`
+    # re-enter code with bindings no join sees. A rebind that textually precedes such a jump is therefore
+    # unthreaded too; the body runs forward-only, so a rebind after every jump cannot be on a jump's path, and
+    # a jump that is its construct's final statement leaves with the exit scope itself. A rebind in an `ensure`
+    # runs after any jump in its `begin`, so under any such jump it counts as preceding one.
+    module UnthreadedRebinds
+      VARIABLE_WRITE_NODES = (CapturedLocals::LOCAL_WRITE_NODES | CapturedLocals::NON_LOCAL_WRITE_NODES).freeze
+      private_constant :VARIABLE_WRITE_NODES
+
+      TARGET_NODES = Set[
+        Prism::LocalVariableTargetNode, Prism::InstanceVariableTargetNode,
+        Prism::ClassVariableTargetNode, Prism::GlobalVariableTargetNode
+      ].freeze
+      private_constant :TARGET_NODES
+
+      VALUE_ONLY = { value: :code }.freeze
+      private_constant :VALUE_ONLY
+
+      # Parent class => the child fields the evaluator threads, each with how it is entered: `:code` threads
+      # writes, `:binding` threads only the targets the construct binds ({#binding_target_threaded?}),
+      # `:ensure` is an `ensure` body, `:loop` a loop body, `:nested` a call's block and `:lambda` a lambda's
+      # body.
+      THREADED_FIELDS = {
+        Prism::StatementsNode => { body: :code },
+        Prism::ParenthesesNode => { body: :code },
+        Prism::BeginNode => { statements: :code, rescue_clause: :code, else_clause: :code, ensure_clause: :code },
+        Prism::RescueNode => { reference: :binding, statements: :code, subsequent: :code },
+        Prism::EnsureNode => { statements: :ensure },
+        Prism::ElseNode => { statements: :code },
+        Prism::IfNode => { predicate: :code, statements: :code, subsequent: :code },
+        Prism::UnlessNode => { predicate: :code, statements: :code, else_clause: :code },
+        Prism::CaseNode => { predicate: :code, conditions: :code, else_clause: :code },
+        Prism::WhenNode => { statements: :code },
+        Prism::CaseMatchNode => { predicate: :code, conditions: :code, else_clause: :code },
+        Prism::InNode => { pattern: :binding, statements: :code },
+        Prism::AndNode => { left: :code, right: :code },
+        Prism::OrNode => { left: :code, right: :code },
+        Prism::MatchPredicateNode => { value: :code, pattern: :binding },
+        Prism::MatchRequiredNode => { value: :code, pattern: :binding },
+        Prism::MatchWriteNode => { targets: :binding },
+        Prism::MultiWriteNode => { lefts: :binding, rest: :binding, rights: :binding, value: :code },
+        Prism::WhileNode => { predicate: :code, statements: :loop },
+        Prism::UntilNode => { predicate: :code, statements: :loop },
+        Prism::ForNode => { index: :binding, collection: :code, statements: :loop },
+        Prism::CallNode => { block: :nested },
+        Prism::BlockNode => { body: :code },
+        Prism::LambdaNode => { body: :lambda },
+        Prism::IndexOrWriteNode => VALUE_ONLY,
+        Prism::IndexAndWriteNode => VALUE_ONLY,
+        Prism::IndexOperatorWriteNode => VALUE_ONLY,
+        **(VARIABLE_WRITE_NODES - TARGET_NODES).to_h { |klass| [klass, VALUE_ONLY] }
+      }.transform_values(&:freeze).freeze
+      private_constant :THREADED_FIELDS
+
+      # The jumps whose path the exit binding misses, per construct. A block's `next` and `break` are joined
+      # ({StatementEvaluator#evaluate_invocation}, the write-back), and a `break` out of the fold's own call ends
+      # it, so no later iteration reads what it carried; `redo` and `retry` are joined nowhere. A loop joins
+      # its `next` and `break` paths only in part, so both still count.
+      BLOCK_JUMPS = Set[Prism::RedoNode, Prism::RetryNode].freeze
+      LOOP_JUMPS = (BLOCK_JUMPS | [Prism::NextNode, Prism::BreakNode]).freeze
+      private_constant :BLOCK_JUMPS, :LOOP_JUMPS
+
+      # The constructs that own the jumps inside them.
+      JUMP_BOUNDARY_NODES = Set[
+        Prism::BlockNode, Prism::LambdaNode, Prism::DefNode,
+        Prism::WhileNode, Prism::UntilNode, Prism::ForNode
+      ].freeze
+      private_constant :JUMP_BOUNDARY_NODES
+
+      NO_JUMP = -1
+      private_constant :NO_JUMP
+
+      EMPTY = Set.new.freeze
+      private_constant :EMPTY
+
+      # How a walk position reaches the exit scope: whether a local rebind there is threaded, whether an
+      # instance variable's is, whether a class variable's or global's is, the offset below which a rebind
+      # precedes a jump,
+      # whether the position binds targets only (`:multi_assign` under a multi-assign, `:capture` under any
+      # other binding construct, false otherwise), and the locals a nested block shadows.
+      Position = Data.define(:local, :ivar, :other, :horizon, :binding, :shadowed)
+      private_constant :Position
+
+      module_function
+
+      # @param names — the rebound names from {CapturedLocals.writes}, sigil and all.
+      # @return the subset of `names` the body rebinds somewhere the exit scope misses.
+      def names(block_node, names)
+        body = block_node.body
+        return EMPTY if body.nil? || names.empty?
+
+        wanted = names.to_set
+        found = Set.new
+        horizon = last_jump_offset(body, BLOCK_JUMPS)
+        start = Position.new(local: true, ivar: true, other: true, horizon: horizon, binding: false, shadowed: EMPTY)
+        visit(body, start, wanted, found)
+        found
+      end
+
+      def visit(node, position, wanted, found)
+        return unless node.is_a?(Prism::Node)
+        return if node.is_a?(Prism::DefinedNode)
+
+        check(node, position, wanted, found)
+        return node.rigor_each_child { |child| visit(child, position, wanted, found) } if position.binding
+
+        fields = THREADED_FIELDS[node.class]
+        return node.rigor_each_child { |child| visit_unthreaded(child, wanted, found) } if fields.nil?
+
+        threaded = threaded_children(node, fields)
+        node.rigor_each_child do |child|
+          mode = threaded[child]
+          if mode
+            visit(child, enter(node, child, mode, position), wanted, found)
+          else
+            visit_unthreaded(child, wanted, found)
+          end
+        end
+      end
+
+      def threaded_children(node, fields)
+        threaded = {}.compare_by_identity
+        fields.each do |field, mode|
+          value = node.public_send(field)
+          if value.is_a?(Array)
+            value.each { |child| threaded[child] = mode }
+          elsif value
+            threaded[value] = mode
+          end
+        end
+        threaded
+      end
+
+      # Every rebind under an unthreaded position misses the exit scope, whatever the position beneath it.
+      def visit_unthreaded(node, wanted, found)
+        Source::NodeWalker.each(node) do |descendant|
+          name = rebound_name(descendant)
+          found << name if name && wanted.include?(name)
+        end
+      end
+
+      def enter(parent, child, mode, position)
+        case mode
+        when :binding then position.with(binding: parent.is_a?(Prism::MultiWriteNode) ? :multi_assign : :capture)
+        when :ensure then position.with(horizon: position.horizon == NO_JUMP ? NO_JUMP : Float::INFINITY)
+        when :loop then extend_horizon(position, child, LOOP_JUMPS)
+        when :nested then nested_block(child, position)
+        when :lambda then nested_body(parent, child, position)
+        else position
+        end
+      end
+
+      def extend_horizon(position, body, kinds)
+        position.with(horizon: [position.horizon, last_jump_offset(body, kinds)].max)
+      end
+
+      # A call's block. A block-pass argument (`&blk`) carries no body the call's write-back reads.
+      def nested_block(child, position)
+        return position.with(local: false, ivar: false, other: false) unless child.is_a?(Prism::BlockNode)
+
+        nested_body(child, child.body, position)
+      end
+
+      # A block or lambda body: its parameters and block-locals shadow, its own jumps join the horizon, and a
+      # class variable's or global's rebind is no longer carried out.
+      def nested_body(owner, body, position)
+        extend_horizon(position, body, BLOCK_JUMPS).with(
+          other: false, shadowed: position.shadowed | CapturedLocals.introduced_locals(owner)
+        )
+      end
+
+      def check(node, position, wanted, found)
+        name = rebound_name(node)
+        return if name.nil? || !wanted.include?(name)
+        return if position.shadowed.include?(name)
+
+        found << name unless threaded_rebind?(node, name, position)
+      end
+
+      def threaded_rebind?(node, name, position)
+        return false unless VARIABLE_WRITE_NODES.include?(node.class)
+        return false unless TARGET_NODES.include?(node.class) == (position.binding ? true : false)
+
+        kind = CapturedLocals.variable_kind(name)
+        return false if position.binding && !binding_target_threaded?(kind, position.binding)
+        return false unless kind_threaded?(kind, position)
+
+        node.location.start_offset >= position.horizon
+      end
+
+      def kind_threaded?(kind, position)
+        case kind
+        when :local then position.local
+        when :ivar then position.ivar
+        else position.other
+        end
+      end
+
+      # A binding construct's target reaches the exit scope only for the kinds the evaluator binds there: a
+      # multi-assign binds locals and instance variables, and a `rescue =>` reference, a `for` index, a pattern
+      # capture or a named capture binds locals only. `a, $g = 1, :z` leaves `$g` where it was.
+      def binding_target_threaded?(kind, binding)
+        kind == :local || (kind == :ivar && binding == :multi_assign)
+      end
+
+      def rebound_name(node)
+        return node.name if VARIABLE_WRITE_NODES.include?(node.class)
+
+        CapturedLocals.setter_ivar_name(node)
+      end
+
+      # The start offset of the last `kinds` jump that belongs to the construct whose body is `body`, or
+      # {NO_JUMP}. A jump that is the body's final statement is skipped: it leaves with the exit scope itself.
+      def last_jump_offset(body, kinds)
+        return NO_JUMP if body.nil?
+
+        final = body.body.last if body.is_a?(Prism::StatementsNode)
+        offset = NO_JUMP
+        each_owned_jump(body, kinds) do |jump|
+          offset = [offset, jump.location.start_offset].max unless jump.equal?(final)
+        end
+        offset
+      end
+
+      def each_owned_jump(node, kinds, &)
+        yield node if kinds.include?(node.class)
+        return if node.is_a?(Prism::DefinedNode)
+
+        node.rigor_each_child do |child|
+          each_owned_jump(child, kinds, &) unless JUMP_BOUNDARY_NODES.include?(child.class)
+        end
+      end
+    end
+  end
+end

data/lib/rigor/language_server/debouncer.rb

@@ -68,7 +68,6 @@ module Rigor
         end
       end
 
-      # @return number of currently-pending tasks.
       def pending_size
         @mutex.synchronize { @tasks.size }
       end

data/lib/rigor/language_server/diagnostic_publisher.rb

@@ -268,8 +268,9 @@ module Rigor
 
       # Runs `Analysis::Runner` with a `BufferBinding` so the buffer bytes (instead of the on-disk file) drive
       # the parse. The `Rigor::Analysis::ProjectScan` cached on the ProjectContext is passed through
-      # `prebuilt:` so plugin `#prepare`, the dependency-source walker, and the synthetic-method /
-      # project-patched scanners do not re-run per publish. The snapshot rebuilds only when
+      # `prebuilt:` so plugin `#prepare`, the dependency-source walker, the synthetic-method /
+      # project-patched scanners and (#1038) the template-unit transforms do not re-run per publish — the
+      # last of those is an Erubi compile of every view for an ERB project. The snapshot rebuilds only when
       # `ProjectContext#invalidate!` fires (watched-file or configuration change). Returns the LSP-shaped
       # Diagnostic Array, ready to serialize into the notification's `params.diagnostics` field.
       def run_analysis(path:, bytes:)

data/lib/rigor/language_server/hover_renderer.rb

@@ -83,9 +83,9 @@ module Rigor
         )
       end
 
-      # @return , nil] the resolved method definition, the receiver
-      #   class name, and the dispatch kind (`:instance` or `:singleton`); nil when the receiver shape isn't
-      #   yet supported or the method doesn't resolve through the RBS env.
+      # @return `[definition, receiver_class_name, kind]` — the resolved method definition (nil when the
+      #   method doesn't resolve through the RBS env), the receiver class name, and the dispatch kind
+      #   (`:instance` or `:singleton`); `[nil, nil, nil]` when the receiver shape isn't yet supported.
       def lookup_method(receiver_type, method_name, scope)
         case receiver_type
         when Type::Singleton