rigortype 0.4.0 → 0.4.1

data/lib/rigor/inference/guard_rebinding.rb

@@ -33,12 +33,19 @@ module Rigor
     # The accepted gap is implicit conversion: a core method that calls back into a project method the program
     # does not spell (`puts obj` runs `obj.to_s`, `hash[obj]` runs `obj.hash`, `a.sort` runs `<=>`) is read as the
     # core method alone.
+    #
+    # Issue #1446 — a class guard's narrowing of an instance variable is restored at the same code, since code that
+    # may rebind a global may reach `self` and rebind the variable too, and at two more: `instance_variable_set` and
+    # `remove_instance_variable` on any receiver, and a write to the narrowed variable in code the scan reads (a
+    # block that may run again, a loop's next pass).
     module GuardRebinding
       # Calls that run code chosen by name or by a String.
       CODE_RUNNING_NAMES = Set[
         :send, :__send__, :public_send, :eval, :require, :require_relative, :load,
         # These rebind a constant on any receiver (`Object.const_set(:SEP, nil)`).
-        :const_set, :remove_const
+        :const_set, :remove_const,
+        # These rebind an instance variable of a receiver that may be `self` (#1446).
+        :instance_variable_set, :remove_instance_variable
       ].freeze
       # These run their literal block, which the scan reads as any block, or a String of code, which it cannot read.
       BLOCK_OR_CODE_NAMES = Set[
@@ -109,10 +116,11 @@ module Rigor
           (call_node.block.is_a?(Prism::BlockArgumentNode) && may_rebind?(call_node.block, scope))
       end
 
-      # True when running `node` may rebind one: it writes a global or constant, yields, calls `super`, or holds a
-      # call, spelled or implicit ({.implicit_call_may_rebind?}), whose method may run foreign code. A `def` and a
-      # lambda literal run nothing where they are written. Each node is visited once: a call's literal block is
-      # reached as one of its children, so a nested block chain costs its size, not its depth's power.
+      # True when running `node` may rebind one: it writes a global, a constant or an instance variable a class guard
+      # narrowed, yields, calls `super`, or holds a call, spelled or implicit ({.implicit_call_may_rebind?}), whose
+      # method may run foreign code. A `def` and a lambda literal run nothing where they are written. Each node is
+      # visited once: a call's literal block is reached as one of its children, so a nested block chain costs its
+      # size, not its depth's power.
       #
       # A local the scanned code writes has no binding in `scope` yet, so the scan reads it as the code writes it
       # ({ScanScope.with_scanned_locals}): `copy = $sep; copy.length` is a `String` call. A literal block's parameters
@@ -126,6 +134,7 @@ module Rigor
       def scan(node, scope)
         return false unless node.is_a?(Prism::Node)
         return true if REBINDING_NODES.include?(node.class)
+        return true if guarded_ivar_write?(node, scope)
         return false if node.is_a?(Prism::DefNode) || node.is_a?(Prism::LambdaNode)
         return scan_call(node, scope) if node.is_a?(Prism::CallNode)
         return true if IMPLICIT_CALL_NODES.include?(node.class) && implicit_call_may_rebind?(node, scope)
@@ -135,6 +144,18 @@ module Rigor
         found
       end
 
+      # Issue #1446 — true when `node` writes an instance variable a class guard narrowed
+      # ({Scope#guard_narrowed_ivar?}). A write to any other instance variable rebinds nothing a guard recorded.
+      def guarded_ivar_write?(node, scope)
+        case node
+        when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode,
+             Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableTargetNode
+          scope.guard_narrowed_ivar?(node.name)
+        else
+          false
+        end
+      end
+
       def scan_call(node, scope)
         return true if call_runs_foreign_code?(node, scope)
         return true if scan(node.receiver, scope) || scan(node.arguments, scope)
@@ -156,7 +177,9 @@ module Rigor
       def implicit_call_may_rebind?(node, scope)
         kind = VARIABLE_OPERATOR_WRITES[node.class]
         return type_method_foreign?(variable_type(kind, node.name, scope), node.binary_operator, scope) if kind
-        return type_method_foreign?(scope.type_of(node.collection), :each, scope) if node.is_a?(Prism::ForNode)
+        if node.is_a?(Prism::ForNode)
+          return type_method_foreign?(ScanScope.dispatch_type(node.collection, scope), :each, scope)
+        end
 
         compound_write_foreign?(node, scope)
       rescue StandardError
@@ -174,7 +197,7 @@ module Rigor
       end
 
       def compound_receiver_type(node, scope)
-        return scope.type_of(node.receiver) if node.receiver
+        return ScanScope.dispatch_type(node.receiver, scope) if node.receiver
 
         scope.self_type || Type::Combinator.nominal_of("Object")
       end
@@ -264,7 +287,7 @@ module Rigor
           return ProjectMethodOwnership.targets(self_type)
         end
 
-        ProjectMethodOwnership.targets(scope.type_of(receiver))
+        ProjectMethodOwnership.targets(ScanScope.dispatch_type(receiver, scope))
       end
 
       def foreign_target?(class_name, method_name, kind, scope)
@@ -300,8 +323,8 @@ module Rigor
         owner = definition.respond_to?(:defined_in) ? definition.defined_in : nil
         owner&.to_s&.delete_prefix("::")
       end
-      private_class_method :scan, :scan_call, :receiver_targets, :foreign_target?, :universal_delegate_foreign?,
-                           :method_owner, :deferred_block_call?,
+      private_class_method :scan, :guarded_ivar_write?, :scan_call, :receiver_targets, :foreign_target?,
+                           :universal_delegate_foreign?, :method_owner, :deferred_block_call?,
                            :compound_write_foreign?,
                            :compound_receiver_type, :compound_accessors, :compound_read_type, :variable_type,
                            :type_method_foreign?
@@ -376,9 +399,10 @@ module Rigor
           bindings.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
         end
 
-        # What the method `call_node` calls yields its block, by position, or `[]` when that cannot be read.
+        # What the method `call_node` calls yields its block, by position, or `[]` when that cannot be read. A receiver
+        # a class guard left `bot` yields what the guarded class does ({.dispatch_type}, #1446).
         def yielded_types(call_node, scope)
-          receiver = call_node.receiver ? scope.type_of(call_node.receiver) : scope.self_type
+          receiver = call_node.receiver ? dispatch_type(call_node.receiver, scope) : scope.self_type
           arguments = call_node.arguments&.arguments || []
           MethodDispatcher.expected_block_param_types(
             receiver_type: receiver, method_name: call_node.name, environment: scope.environment, scope: scope,
@@ -388,6 +412,23 @@ module Rigor
           []
         end
 
+        # Issue #1446 — the type a call on the receiver `node` dispatches on: its type in `scope`, or, where a class
+        # guard disjoint from the receiver's binding left it `bot` (`return unless @io.is_a?(StringIO)` on an `IO`),
+        # the classes the guard named ({Narrowing.bot_guard_classes_of}), since the value that passes the guard is one
+        # of them. So `@io.rewind` reads as `StringIO#rewind` and keeps the narrowing, while `@cb.call` past
+        # `@cb.is_a?(Proc)` reads as a call on a code object, and a method a project subclass or reopening defines on
+        # the class still counts. A `bot` no class guard produced stays `bot`, which no target resolves, so a call on
+        # it counts as an unresolved callee.
+        def dispatch_type(node, scope)
+          type = scope.type_of(node)
+          return type unless type.is_a?(Type::Bot)
+
+          classes = Narrowing.bot_guard_classes_of(node, scope)
+          return type if classes.nil?
+
+          Type::Combinator.union(*classes.map { |name| Type::Combinator.nominal_of(name) })
+        end
+
         # The names a block's parameter list declares: every kind of parameter, a destructured one's parts included,
         # and a `;`-block-local. A default value is not read.
         def collect_parameter_names(node, names)

data/lib/rigor/inference/macro_block_self_type.rb

@@ -168,11 +168,13 @@ module Rigor
           seen[current] = true
           # The class's own singleton defs sit ahead of EVERY `extend` in its singleton ancestry —
           # `class F; extend T::Sig; def self.sig(&b); end; end` calls F's method, not T::Sig's —
-          # once the def has executed; a `def` written after this call has not run yet.
+          # once the def has executed; a `def` written after this call has not run yet. Shadowing here
+          # WITHHOLDS the narrowing for every class but the constraint itself, so a possible def
+          # (ADR-119) keeps the same answer and needs no certainty check.
           return current == constraint if scope.singleton_def_shadows_call?(current, method_name, call_node)
 
           owner = extended_module_call_owner(current, extends, method_name, call_node, scope, environment)
-          return owner == constraint || rbs_inherits?(owner, constraint, environment) if owner
+          return extended_owner_reaches?(owner, constraint, method_name, call_node, scope, environment) if owner
 
           raw = supers[current]
           scope.ancestor_name_candidates(current, raw).each { |c| queue << c } if raw
@@ -217,6 +219,16 @@ module Rigor
                                                       environment: environment).nil?
       end
 
+      # Whether the module that answers the call is `constraint`. ADR-119 WD1 errata: here "shadows" NARROWS the
+      # block's self to the owner, so an owner whose decisive source def is only possible (`if X; def sig ...; end`)
+      # answers false — the module may not answer at runtime.
+      def extended_owner_reaches?(owner, constraint, method_name, call_node, scope, environment)
+        return false if scope.instance_def_shadows_call?(owner, method_name, call_node) &&
+                        scope.discovery.possible_method?(owner, method_name, :instance)
+
+        owner == constraint || rbs_inherits?(owner, constraint, environment)
+      end
+
       def rbs_inherits?(class_name, constraint, environment)
         %i[equal subclass].include?(environment.class_ordering(class_name, constraint))
       end

data/lib/rigor/inference/method_dispatcher/rbs_dispatch.rb

@@ -564,11 +564,11 @@ module Rigor
 
             memo = core_stdlib_memo(environment, scope)
             key = [class_name.to_s, method_name.to_sym]
-            return memo[key] if memo&.key?(key)
+            return memo[key] if memo.key?(key)
 
-            answer = compute_core_stdlib_ancestor_method(environment, class_name, method_name, scope)
-            memo[key] = answer if memo
-            answer
+            store_unless_recorded(memo, key) do
+              compute_core_stdlib_ancestor_method(environment, class_name, method_name, scope)
+            end
           end
 
           # Issue #1173 — the include-edge sibling of {#core_stdlib_ancestor_method}: a discovered
@@ -596,11 +596,11 @@ module Rigor
 
             memo = mixin_ancestor_memo(environment, scope)
             key = [class_name.to_s, method_name.to_sym]
-            return memo[key] if memo&.key?(key)
+            return memo[key] if memo.key?(key)
 
-            answer = compute_included_module_method(environment, class_name, method_name, scope)
-            memo[key] = answer if memo
-            answer
+            store_unless_recorded(memo, key) do
+              compute_included_module_method(environment, class_name, method_name, scope)
+            end
           end
 
           # The declines are conjunctive and ordered as {compute_core_stdlib_ancestor_method}'s are:
@@ -626,20 +626,12 @@ module Rigor
           end
 
           # The same one-slot memo shape as {#core_stdlib_memo}; see there for why it is one slot keyed
-          # on the discovery index's identity, and why a recording run bypasses it.
+          # on the discovery index's identity, and what a recording run may store in it.
           MIXIN_ANCESTOR_MEMO_KEY = :__rigor_mixin_ancestor_dispatch__
           private_constant :MIXIN_ANCESTOR_MEMO_KEY
 
           def mixin_ancestor_memo(environment, scope)
-            return nil if Rigor::Analysis::DependencyRecorder.active?
-
-            discovery = scope.discovery
-            slot = Thread.current[MIXIN_ANCESTOR_MEMO_KEY]
-            unless slot && slot[0].equal?(discovery) && slot[1].equal?(environment)
-              slot = [discovery, environment, {}]
-              Thread.current[MIXIN_ANCESTOR_MEMO_KEY] = slot
-            end
-            slot[2]
+            ancestor_memo_slot(MIXIN_ANCESTOR_MEMO_KEY, environment, scope)
           end
 
           # The declines are conjunctive, so their ORDER is free — and it is chosen so the two that walk
@@ -800,8 +792,10 @@ module Rigor
           # Memo for the whole decision. Every call site of a class asks the same `(class, method)`
           # question, and the answer is a pure function of the frozen discovery index and the
           # environment, so it is cacheable on their identity. A run that is RECORDING ADR-46
-          # dependency edges bypasses it: the shadow probes above read the project's method tables, and
-          # a memo would swallow that edge for every file after the first.
+          # dependency edges stores only the answers whose computation recorded nothing
+          # ({#store_unless_recorded}): the shadow probes above read the project's method tables, and
+          # serving an answer that read them from the memo would swallow those edges for every later
+          # caller.
           #
           # ONE slot, replaced rather than accumulated — see {ExternalAncestorResolution}'s twin for
           # the measurement. A `Scope` hands each analysed file its own discovery index, so an
@@ -811,15 +805,38 @@ module Rigor
           private_constant :CORE_STDLIB_ANCESTOR_MEMO_KEY
 
           def core_stdlib_memo(environment, scope)
-            return nil if Rigor::Analysis::DependencyRecorder.active?
+            ancestor_memo_slot(CORE_STDLIB_ANCESTOR_MEMO_KEY, environment, scope)
+          end
 
+          # The slot behind both memos. Whether this thread is recording is part of its key, so a slot
+          # filled with every answer is never read by a recording caller, which may only reuse the
+          # answers {#store_unless_recorded} lets through.
+          def ancestor_memo_slot(memo_key, environment, scope)
             discovery = scope.discovery
-            slot = Thread.current[CORE_STDLIB_ANCESTOR_MEMO_KEY]
-            unless slot && slot[0].equal?(discovery) && slot[1].equal?(environment)
-              slot = [discovery, environment, {}]
-              Thread.current[CORE_STDLIB_ANCESTOR_MEMO_KEY] = slot
+            recording = Rigor::Analysis::DependencyRecorder.recording?
+            slot = Thread.current[memo_key]
+            unless slot && slot[0].equal?(discovery) && slot[1].equal?(environment) && slot[2] == recording
+              slot = [discovery, environment, recording, {}]
+              Thread.current[memo_key] = slot
             end
-            slot[2]
+            slot[3]
+          end
+
+          # Computes an answer, stores it under `key` when it may be served again, and returns it.
+          # Outside recording every answer is stored. Under ADR-46 recording the block runs in an
+          # ADR-84 WD2 capture window, which sees every edge the block files for the current consumer
+          # (the reads it withholds are not among them). An answer whose window stayed empty is stored:
+          # computing it again would read the same frozen tables and file nothing again, so serving it
+          # from the memo records exactly what recomputing does. That is most of them, since both
+          # computations withhold their ancestry walk and return before any recorded probe unless an
+          # RBS declaration answered. Any other answer is recomputed on every call, which files its
+          # edges each time, as a recording run always did.
+          def store_unless_recorded(memo, key, &)
+            return memo[key] = yield unless Rigor::Analysis::DependencyRecorder.recording?
+
+            answer, read_set = Rigor::Analysis::DependencyRecorder.capture(&)
+            memo[key] = answer if read_set.reads.empty? && read_set.missing.empty?
+            answer
           end
 
           # BFS over the scope's as-written ancestry tables — include edges first, then the
@@ -889,6 +906,7 @@ module Rigor
               # The class's own `def self.x` sits ahead of every `extend` — once it has run.
               # `singleton_def_shadows_call?` orders the def against the call site, so a `def self.sig`
               # written AFTER this `sig {}` does not suppress the bridge.
+              # ADR-119: shadowing already withholds the bridge, so a possible def withholds too.
               return nil if scope.singleton_def_shadows_call?(current, method_name, call_node)
 
               resolved = rbs_complete_extended_module_for(current, extends, environment, scope,
@@ -927,6 +945,8 @@ module Rigor
             nil
           end
 
+          # ADR-119: "defines" here stops the allow-list walk (a withholding answer), so a possible def stays
+          # a definer — treating it as absent would let a later extend bridge a call the def may own.
           def extend_owner_defines?(owner, method_name, call_node, scope, environment)
             return true if scope.instance_def_shadows_call?(owner, method_name, call_node)
 

data/lib/rigor/inference/module_function_state.rb

@@ -0,0 +1,213 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../source/node_children"
+
+module Rigor
+  module Inference
+    # The one home for what a receiverless `module_function` call does to the methods around it
+    # ([#1507](https://github.com/rigortype/rigor/issues/1507),
+    # [#1197](https://github.com/rigortype/rigor/issues/1197)). Four readers used to compute it in four
+    # places. They disagree with each other and, in places, with Ruby. Each entry point below reproduces
+    # one reader's answer exactly: this module gives the readings one place to live, and does not yet make
+    # them agree. A change to one reading lands here, beside the other three. Examples are #1550's
+    # named-form snapshot and the reset a bare `public`, `private` or `protected` makes.
+    #
+    # - The singleton def-node table (`ScopeIndexer#walk_singleton_body`) reads
+    #   {.each_singleton_sibling} and {.each_singleton_copy}. A bare call covers the later direct
+    #   statements of its own body and is never reset.
+    # - The deferred ranges (`ScopeIndexer#walk_deferred_body`) read {.prescan_deferred} and
+    #   {.deferred_module_function?}. A bare call covers every later def by offset, and a call inside
+    #   control flow or a block counts.
+    # - The extends table (`ScopeIndexer#record_extend_call`) reads {.extends_self?}. A bare call covers
+    #   every instance def of the module, in any order.
+    # - sig-gen (`SigGen::Generator#walk_statements`) reads {.each_sig_gen_statement} and
+    #   {.sig_gen_module_function?}. A bare call covers the later statements of its own statement list and
+    #   what nests in them.
+    #
+    # A fifth reader does not come here yet: `rigor-activerecord`'s `ModelDiscoverer#table_name_decorators`
+    # (`plugins/rigor-activerecord/lib/rigor/plugin/activerecord/model_discoverer.rb`) reads a module body's
+    # direct statements for its table-name readers. It also accepts `self.module_function`, and there a bare
+    # call covers the instance methods written before it as well as after it, while a named call takes only a
+    # def written before it. A change to what `module_function` means must decide whether that reader follows.
+    #
+    # The deferred-ranges prescan asks `ScopeIndexer.receiver_eval_call?` and `ScopeIndexer.def_singleton?`, so
+    # `rigor/inference/scope_indexer` must be loaded before it runs. This file does not require it:
+    # `scope_indexer.rb` requires this file, and a require back would be circular. The other entry points need
+    # only Prism.
+    #
+    # `spec/rigor/inference/module_function_state_spec.rb` pins each reader's answers, and marks the ones
+    # Ruby contradicts with a "flip this when" note.
+    module ModuleFunctionState
+      module_function
+
+      # A receiverless `module_function` call, bare or named.
+      def call?(node)
+        node.name == :module_function && node.receiver.nil?
+      end
+
+      # The toggle form: a `module_function` call with no arguments.
+      def bare?(node)
+        node.arguments.nil? || node.arguments.arguments.empty?
+      end
+
+      # The singleton def-node table's reading, over one class-ish body's direct statements in source
+      # order. `ScopeIndexer#statements_of` builds that list, folding a body-level `rescue`, `else` or
+      # `ensure` clause into it. Yields `stmt, module_function_on, named_call` for every statement except a
+      # bare call:
+      #
+      # - `module_function_on` says whether a bare call precedes the statement. The toggle never switches
+      #   off, although a later bare `public`, `private` or `protected` resets it in Ruby.
+      # - `named_call` is true for a named call (`module_function :a` or `module_function def x`), which
+      #   {.each_singleton_copy} resolves; the caller records nothing else for it.
+      #
+      # A call nested in control flow or a block is not seen.
+      def each_singleton_sibling(statements)
+        module_function_on = false
+        statements.each do |stmt|
+          if stmt.is_a?(Prism::CallNode) && call?(stmt)
+            if bare?(stmt)
+              module_function_on = true
+            else
+              yield stmt, module_function_on, true
+            end
+            next
+          end
+          yield stmt, module_function_on, false
+        end
+      end
+
+      # The defs a named call copies onto the module's singleton, for the singleton def-node table. Yields
+      # `name, def_node` for each Symbol or String argument that names a receiverless def among the body's
+      # direct `statements`. The last def of that name wins wherever it sits. A def written after the call
+      # is therefore taken, although Ruby copies the one in effect at the call (#1550), and a name defined
+      # only after the call resolves, although Ruby raises `NameError` there. A `module_function def x`
+      # argument names nothing here.
+      def each_singleton_copy(call, statements)
+        defs_by_name = statements.each_with_object({}) do |stmt, acc|
+          acc[stmt.name] = stmt if stmt.is_a?(Prism::DefNode) && stmt.receiver.nil?
+        end
+        call.arguments&.arguments&.each do |arg|
+          name = symbol_argument_name(arg)
+          def_node = name && defs_by_name[name]
+          yield name, def_node if def_node
+        end
+      end
+
+      # The deferred-ranges reading, over one class-ish body's subtree. Appends to `offsets` the start of
+      # every bare call; each def that starts after one is a module function
+      # ({.deferred_module_function?}). Appends to `ranges` one row per named call, in the table's
+      # `[start, end, name, kind, owner]` shape:
+      #
+      # - a `:name` argument gives a `:singleton` row over the call itself, because the copy happens at
+      #   the call and not at the def;
+      # - a `module_function def x` argument gives a `:both` row over the def, or a `:singleton` row for
+      #   `def self.x`.
+      #
+      # The prescan looks through control flow and blocks, because a call that ran there still flips the
+      # later defs. It stops at a nested class, module, `class <<` or def body, where the call targets
+      # another module. It skips an `END` body, which runs after every def, and a `*_eval` / `*_exec`
+      # block, whose self is the receiver's module; that block gets its own prescan as a body. Nothing
+      # resets it.
+      #
+      # `qualified_prefix` names the owner, and `in_singleton_class` says whether the body is a
+      # `class <<` body; both feed `ScopeIndexer.def_singleton?`.
+      def prescan_deferred(node, qualified_prefix, in_singleton_class, offsets, ranges)
+        return unless node.is_a?(Prism::Node)
+        return if node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode) ||
+                  node.is_a?(Prism::SingletonClassNode) || node.is_a?(Prism::DefNode) ||
+                  node.is_a?(Prism::PostExecutionNode)
+
+        if node.is_a?(Prism::CallNode)
+          return prescan_call(node, qualified_prefix, in_singleton_class, offsets, ranges) if call?(node)
+          if ScopeIndexer.receiver_eval_call?(node)
+            return prescan_eval_call(node, qualified_prefix, in_singleton_class, offsets, ranges)
+          end
+        end
+
+        node.rigor_each_child do |child|
+          prescan_deferred(child, qualified_prefix, in_singleton_class, offsets, ranges)
+        end
+      end
+
+      # Whether the deferred-ranges reading makes a def starting at `start` a module function: a bare call
+      # starts before it, at any depth the prescan entered.
+      def deferred_module_function?(offsets, start)
+        offsets.any? { |offset| offset < start }
+      end
+
+      # The extends table's reading. A bare call makes the module extend itself, so every instance def the
+      # module has also answers on its singleton. That holds for defs before and after the call, and
+      # whatever a later `public` or `private` says. The over-approximation is deliberate (#526): the
+      # extra names only silence `call.undefined-method` on calls that raise. The walk reaches a call in
+      # control flow, and one in a `class_eval`-family block under that block's receiver. It does not reach
+      # one in an ordinary block, an `END` body or a `class << self` body.
+      def extends_self?(call)
+        call?(call) && bare?(call)
+      end
+
+      # sig-gen's reading, over one statement list. Yields every statement except a bare call, with
+      # whether a bare call came before it in this list or `active` was already true on entry. The
+      # generator passes the enclosing list's answer into an `if`, a block or a `begin`, but not into a
+      # nested class, module or `class << self`. A bare call in a nested list covers only that list's
+      # later statements. Nothing resets it, and a named call is not a directive at all.
+      def each_sig_gen_statement(statements, active)
+        statements.each do |stmt|
+          if sig_gen_directive?(stmt)
+            active = true
+            next
+          end
+          yield stmt, active
+        end
+      end
+
+      # A bare receiverless call, as sig-gen's statement-level directive.
+      def sig_gen_directive?(node)
+        node.is_a?(Prism::CallNode) && call?(node) && bare?(node)
+      end
+
+      # Whether sig-gen renders a def as `def self?.name`: an instance-side def under an active directive,
+      # in a class or a module alike. `kind` is `:singleton` for `def self.x` and a `class << self` body.
+      def sig_gen_module_function?(active, kind)
+        active && kind == :instance
+      end
+
+      # The prescan's call arm.
+      def prescan_call(node, qualified_prefix, in_singleton_class, offsets, ranges)
+        if bare?(node)
+          offsets << node.location.start_offset
+        else
+          owner = qualified_prefix.empty? ? nil : qualified_prefix.join("::")
+          node.arguments&.arguments&.each do |arg|
+            if arg.is_a?(Prism::DefNode)
+              kind = ScopeIndexer.def_singleton?(arg, qualified_prefix, in_singleton_class) ? :singleton : :both
+              ranges << [arg.location.start_offset, arg.location.end_offset, arg.name, kind, owner]
+            elsif (name = symbol_argument_name(arg))
+              ranges << [node.location.start_offset, node.location.end_offset, name, :singleton, owner]
+            else
+              prescan_deferred(arg, qualified_prefix, in_singleton_class, offsets, ranges)
+            end
+          end
+        end
+        return unless node.block
+
+        prescan_deferred(node.block, qualified_prefix, in_singleton_class, offsets, ranges)
+      end
+
+      # The prescan's eval arm: only the call's receiver and arguments keep this module's context.
+      def prescan_eval_call(node, qualified_prefix, in_singleton_class, offsets, ranges)
+        prescan_deferred(node.receiver, qualified_prefix, in_singleton_class, offsets, ranges) if node.receiver
+        node.arguments&.arguments&.each do |arg|
+          prescan_deferred(arg, qualified_prefix, in_singleton_class, offsets, ranges)
+        end
+      end
+
+      # The Symbol a `:name` or `"name"` literal argument names, or nil.
+      def symbol_argument_name(arg)
+        arg.unescaped.to_sym if arg.is_a?(Prism::SymbolNode) || arg.is_a?(Prism::StringNode)
+      end
+
+      private_class_method :prescan_call, :prescan_eval_call, :symbol_argument_name
+    end
+  end
+end

data/lib/rigor/inference/multi_target_binder.rb

@@ -108,31 +108,36 @@ module Rigor
       # `index_targets` maps each `Prism::IndexTargetNode` to the value it stores; {#apply_to}
       # binds nothing for it.
       Result = Data.define(:types, :optimistic, :ivars, :optimistic_ivars, :index_targets) do
-        def initialize(types:, optimistic:, ivars: NO_BINDINGS, optimistic_ivars: NO_NAMES,
-                       index_targets: NO_BINDINGS)
+        def initialize(types:, optimistic:, ivars: NO_BINDINGS, optimistic_ivars: NO_NAMES, index_targets: NO_BINDINGS)
           super
         end
 
-        # Binds every name into `scope` and records the optimistic mark after the binding, since
-        # `Scope#with_local` / `Scope#with_ivar` drop any mark the name carried before. `miss` is what
-        # each marked slot answers on a miss (issue #1302): `nil` for every mark the binder makes itself —
-        # a short array pads with `nil`, and a `nil` destructures to `nil` — so only a caller whose
-        # right-hand side a miss can make something else passes another answer
-        # ({OptimisticOrigin.destructuring_miss}).
+        # Binds every name into `scope` with its mark ({MultiTargetBinder.apply_bindings}).
         def apply_to(scope, miss: nil)
-          bound = types.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
-          bound = ivars.reduce(bound) { |acc, (name, type)| acc.with_ivar(name, type) }
-          bound = optimistic.reduce(bound) do |acc, name|
-            acc.with_optimistic_local(name, OptimisticOrigin::IMPLICITLY_RETURNS_NIL, miss: miss)
-          end
-          optimistic_ivars.reduce(bound) do |acc, name|
-            acc.with_optimistic_ivar(name, OptimisticOrigin::IMPLICITLY_RETURNS_NIL, miss: miss)
-          end
+          MultiTargetBinder.apply_bindings(scope, types, optimistic, ivars:, optimistic_ivars:, miss:)
         end
       end
 
       module_function
 
+      # The one place bindings and their optimistic marks are applied, shared by {Result#apply_to} and
+      # `BlockParameterBinder#bind_onto`. Every name is bound into the scope `bound` and the mark recorded
+      # after the binding, since `Scope#with_local` / `Scope#with_ivar` drop any mark the name carried
+      # before; the answer is the bound scope. `miss` is what each marked slot answers on a miss (issue
+      # #1302): `nil` for every mark the binder makes itself — a short array pads with `nil`, and a `nil`
+      # destructures to `nil` — so only a caller whose right-hand side a miss can make something else passes
+      # another answer ({OptimisticOrigin.destructuring_miss}). It loops with `each`, since `reduce`
+      # allocates even over the empty collections most of the four are
+      # ([#1504](https://github.com/rigortype/rigor/issues/1504)).
+      def apply_bindings(bound, types, optimistic, ivars: NO_BINDINGS, optimistic_ivars: NO_NAMES, miss: nil)
+        types.each { |name, type| bound = bound.with_local(name, type) }
+        ivars.each { |name, type| bound = bound.with_ivar(name, type).without_ivar_guard(name) }
+        origin = OptimisticOrigin::IMPLICITLY_RETURNS_NIL
+        optimistic.each { |name| bound = bound.with_optimistic_local(name, origin, miss: miss) }
+        optimistic_ivars.each { |name| bound = bound.with_optimistic_ivar(name, origin, miss: miss) }
+        bound
+      end
+
       # @param rhs_type — type of the right-hand side
       # @param scope — the scope the destructure is evaluated in, which answers the `to_ary`
       #   question for a class outside the core list; without one only the core list wraps.