rigortype 0.4.0 → 0.4.1

data/lib/rigor/inference/narrowing.rb

@@ -440,6 +440,20 @@ module Rigor
         Source::ConstantPath.rooted?(node) ? "::#{name}" : name
       end
 
+      # Issue #1446 — the classes a class guard narrowed the receiver `node` to where the guard left it `bot`
+      # ({Scope#bot_guard_classes_for}), or nil: a node that is not a local, instance-variable, global or constant
+      # read, or one no such guard narrowed.
+      def bot_guard_classes_of(node, scope)
+        case node
+        when Prism::LocalVariableReadNode then scope.bot_guard_classes_for(:local, node.name)
+        when Prism::InstanceVariableReadNode then scope.bot_guard_classes_for(:ivar, node.name)
+        when Prism::GlobalVariableReadNode then scope.bot_guard_classes_for(:global, node.name)
+        when Prism::ConstantReadNode, Prism::ConstantPathNode
+          key = constant_key(node)
+          key && scope.bot_guard_classes_for(:constant, key)
+        end
+      end
+
       # Public predicate analyser. Returns `[truthy_scope, falsey_scope]`, always; when no
       # narrowing rule matches the predicate node both entries are the receiver scope unchanged.
       def predicate_scopes(node, scope)
@@ -504,15 +518,20 @@ module Rigor
         # a different regex. Applied even when the subject is not a narrowable local read.
         body_scope = apply_when_regex_globals(conditions, scope)
 
-        # Issue #1429 — a global or constant subject (`case $stdout when StringIO`) narrows as a local does.
+        # Issue #1429 — a global or constant subject (`case $stdout when StringIO`) narrows as a local does, and so
+        # does an instance variable (#1446).
         slot = receiver_slot(subject, scope, kinds: CASE_SUBJECT_KINDS)
         return [body_scope, scope] if slot.nil?
 
         truthy_type, falsey_type = case_when_types(scope, slot.current, conditions)
-        [narrow_slot(body_scope, slot, truthy_type), narrow_slot(scope, slot, falsey_type)]
+        classes = conditions.map do |condition|
+          lexical_class_name(condition, scope) || case_equality_target_class(condition)
+        end
+        body_scope = record_bot_guard(narrow_guarded_slot(body_scope, slot, truthy_type), slot, truthy_type, classes)
+        [body_scope, narrow_guarded_slot(scope, slot, falsey_type)]
       end
 
-      CASE_SUBJECT_KINDS = %i[local global constant].freeze
+      CASE_SUBJECT_KINDS = %i[local ivar global constant].freeze
       private_constant :CASE_SUBJECT_KINDS
 
       # When the clause has exactly one `RegularExpressionNode` literal condition, narrow the
@@ -979,8 +998,9 @@ module Rigor
         end
 
         GLOBAL_AND_CONSTANT = %i[global constant].freeze
+        CLASS_GUARD_SLOT_KINDS = %i[ivar global constant].freeze
         ALL_SLOT_KINDS = %i[local ivar global constant].freeze
-        private_constant :GLOBAL_AND_CONSTANT, :ALL_SLOT_KINDS
+        private_constant :GLOBAL_AND_CONSTANT, :CLASS_GUARD_SLOT_KINDS, :ALL_SLOT_KINDS
 
         # The {ReceiverSlot} `node` reads, among `kinds`, or nil. A local or instance variable needs a binding. A
         # global the scope does not bind is read as it reads unbound, and a constant reference as it resolves
@@ -1029,6 +1049,25 @@ module Rigor
           end
         end
 
+        # Issue #1446 — {#narrow_slot} for a class guard: an instance variable narrows with its pre-guard type
+        # recorded, as a global does, since code that may reach `self` may rebind it. The other guards on an instance
+        # variable keep {#narrow_slot}'s unrecorded binding.
+        def narrow_guarded_slot(scope, slot, type)
+          return narrow_slot(scope, slot, type) unless slot.kind == :ivar
+          return scope if type == slot.current
+
+          scope.with_guarded_ivar(slot.name, type, slot.current)
+        end
+
+        # Issue #1446 — `scope`, the guard's truthy edge, with `class_names` recorded for `slot` when the guard left
+        # it `bot` ({Scope#with_bot_guard_classes}): the value that passes it is one of those classes. Nothing is
+        # recorded when a condition names no class.
+        def record_bot_guard(scope, slot, type, class_names)
+          return scope unless type.is_a?(Type::Bot) && !class_names.empty? && class_names.none?(&:nil?)
+
+          scope.with_bot_guard_classes(slot.kind, slot.name, class_names)
+        end
+
         def narrow_global_slot(scope, slot, type)
           return scope if type == slot.current
 
@@ -1234,7 +1273,7 @@ module Rigor
         end
 
         def simple_dispatch_name?(name)
-          %i[nil? ! is_a? kind_of? instance_of? == != === =~ match? key? has_key? empty? any?
+          %i[nil? ! is_a? kind_of? instance_of? == != === =~ !~ match? key? has_key? empty? any?
              none? respond_to? nan? finite?].include?(name)
         end
 
@@ -1245,7 +1284,7 @@ module Rigor
           when :instance_of? then analyse_class_predicate(node, scope, exact: true)
           when :==, :!= then analyse_equality_predicate(node, scope, equality: name)
           when :=== then analyse_case_equality_predicate(node, scope)
-          when :=~ then analyse_regex_match_predicate(node, scope)
+          when :=~, :!~ then dispatch_regex_match_predicate(node, scope, name)
           when :match? then analyse_whole_regex_match_predicate(node, scope)
           when :key?, :has_key? then analyse_key_presence_predicate(node, scope)
           when :empty?, :any?, :none? then analyse_array_emptiness_predicate(node, scope, name)
@@ -1254,6 +1293,10 @@ module Rigor
           end
         end
 
+        def dispatch_regex_match_predicate(node, scope, name)
+          name == :=~ ? analyse_regex_match_predicate(node, scope) : analyse_regex_not_match_predicate(node, scope)
+        end
+
         # T3 (template-corpora survey) — `recv.respond_to?(sym)` truthy edge narrows `recv`
         # non-nil. `nil.respond_to?(m)` is `false` for every method `m` that `NilClass` does not
         # define, so a truthy `respond_to?` proves the receiver was not `nil` UNLESS the queried
@@ -1532,7 +1575,9 @@ module Rigor
         #
         # Returns nil (no narrowing) when the receiver / argument pair does not resolve to exactly one
         # regex pattern we can count (see {#regex_match_pattern}).
-        def analyse_regex_match_predicate(node, scope)
+        #
+        # `refine: false` leaves out the whole-receiver refinement, which names a String.
+        def analyse_regex_match_predicate(node, scope, refine: true)
           return nil if node.arguments.nil?
           return nil unless node.arguments.arguments.size == 1
 
@@ -1552,10 +1597,96 @@ module Rigor
           # match-global logic above. A successful `str =~ /\A\d+\z/` proves the WHOLE string
           # matched, so the string operand narrows to the imported refinement the anchored pattern
           # names. The falsey edge is untouched: a failed match proves nothing about the shape.
-          truthy = apply_whole_receiver_refinement(truthy, node.receiver, arg, pattern.source, scope)
+          truthy = apply_whole_receiver_refinement(truthy, node.receiver, arg, pattern.source, scope) if refine
           [truthy, falsey]
         end
 
+        # Issue #1379 — `subject !~ pattern` is `Kernel#!~`, which returns `!(subject =~ pattern)`. It runs the same
+        # match in the caller's frame, so its edges are {#analyse_regex_match_predicate}'s swapped: the falsey edge is
+        # the match edge (`$~` a `MatchData`, an unconditional `$N` a `String`, and the whole-receiver refinement), the
+        # truthy edge the no-match edge (`$~` and `$N` nil). The same patterns are recognised and the same ones
+        # declined (a non-regex operand, an ambiguous constant, `//x`).
+        #
+        # Unlike `=~`'s, an edge here is narrowed only when the receiver proves what the frame holds on it
+        # ({#not_match_receiver_edges}). An edge it cannot vouch for keeps the match globals forgotten, since the call
+        # may still have rebound them. The refinement is kept only when the local it would narrow is known to be a
+        # String on the match edge ({#refinable_operand?}).
+        def analyse_regex_not_match_predicate(node, scope)
+          edges = analyse_regex_match_predicate(node, scope, refine: refinable_operand?(node, scope))
+          return nil if edges.nil?
+
+          match, no_match = edges
+          forgotten = scope.forget_match_globals
+          case not_match_receiver_edges(node, scope)
+          when :both then [no_match, match]
+          when :match then [forgotten, match]
+          else [forgotten, forgotten]
+          end
+        end
+
+        # Which edges of `recv !~ pattern` the receiver lets {#analyse_regex_not_match_predicate} narrow. `Kernel#!~`
+        # dispatches `=~` on the receiver:
+        #
+        # - A Regexp receiver (the pattern on the left) runs `Regexp#=~`, which sets `$~` on both outcomes, a `nil`
+        #   argument included: `:both`.
+        # - `String#=~` and `Symbol#=~` do the same: `:both` when every member of the receiver's type is a String or a
+        #   Symbol.
+        # - `NilClass#=~` answers nil and leaves `$~` alone, so a nil receiver reaches the no-match edge with the
+        #   previous match still bound; it never reaches the match edge. A `Dynamic` receiver may be nil at run time
+        #   whatever its static facet says: `:match` when every member is a String, a Symbol, nil, or a `Dynamic`
+        #   that is untyped or whose facet holds only those.
+        # - Any other receiver may define `=~` in Ruby, which binds `$~` in its own frame, not the caller's: nil.
+        #
+        # A safe-navigation `recv&.!~(pattern)` answers nil without matching on a nil receiver, so it declines too.
+        def not_match_receiver_edges(node, scope)
+          return nil if node.receiver.nil? || node.safe_navigation?
+          return :both if regex_operand_pattern(node.receiver, scope).is_a?(RegexMatchPattern)
+
+          kinds = not_match_member_kinds(scope.type_of(node.receiver), scope)
+          return :both if kinds.all? { |kind| %i[string symbol].include?(kind) }
+
+          :match if kinds.all? { |kind| %i[string symbol nil dynamic].include?(kind) }
+        end
+
+        # Whether the local operand {#apply_whole_receiver_refinement} would narrow holds only Strings and nil, which
+        # the match edge excludes. The refinement names a String, so a member that may be a Symbol — a Symbol, or an
+        # untyped `Dynamic` that `Kernel#!~` accepts as the receiver or `Regexp#=~` as the argument — keeps it out:
+        # `return if raw !~ /\A\d+\z/` on an untyped `raw` must not make `raw.to_proc` an undefined method.
+        def refinable_operand?(node, scope)
+          operand = [node.receiver, *node.arguments&.arguments].find { |o| o.is_a?(Prism::LocalVariableReadNode) }
+          type = operand && scope.local(operand.name)
+          return true if type.nil?
+
+          not_match_member_kinds(type, scope).all? { |kind| %i[string nil].include?(kind) }
+        end
+
+        def not_match_member_kinds(type, scope)
+          (type.is_a?(Type::Union) ? type.members : [type]).map { |member| not_match_member_kind(member, scope) }
+        end
+
+        # `:string` or `:symbol` for a member {.narrow_not_class} proves a String or a Symbol (a value or refinement of
+        # either, or a class the environment orders below it; a project subclass it cannot order reads as neither),
+        # `:nil`, `:dynamic` for a `Dynamic` whose facet is untyped or holds only Strings, Symbols and nil, or nil for
+        # anything else.
+        def not_match_member_kind(member, scope)
+          return not_match_dynamic_kind(member, scope) if member.is_a?(Type::Dynamic)
+          return :nil if narrow_nil(member) == member && !member.is_a?(Type::Bot)
+
+          environment = scope.environment
+          { "String" => :string, "Symbol" => :symbol }.each do |class_name, kind|
+            return kind if narrow_not_class(member, class_name, environment: environment, scope: scope).is_a?(Type::Bot)
+          end
+          nil
+        end
+
+        def not_match_dynamic_kind(member, scope)
+          facet = member.static_facet
+          return :dynamic if facet.is_a?(Type::Top)
+
+          facet_kinds = not_match_member_kinds(facet, scope)
+          :dynamic if facet_kinds.all? { |kind| %i[string symbol nil].include?(kind) }
+        end
+
         # `str.match?(/\A\d+\z/)` — `String#match?` is a pure boolean predicate whose truthy edge
         # proves a property of the ENTIRE receiver. When the argument is a fully `\A…\z`-anchored
         # single-char-class pattern recognised by {RegexRefinement.for_whole_pattern}, narrow the
@@ -2239,9 +2370,10 @@ module Rigor
         end
 
         # Issue #1429 — `$stdout.is_a?(StringIO)`, `STDOUT.kind_of?(StringIO)`: a global or constant receiver
-        # narrows as a local does ({#class_predicate_scopes}), with the pre-guard type recorded ({#narrow_slot}).
+        # narrows as a local does ({#class_predicate_scopes}), with the pre-guard type recorded ({#narrow_slot}). So
+        # does an instance variable (#1446, {#narrow_guarded_slot}).
         def analyse_class_predicate_on_slot(receiver, scope, class_name, exact)
-          slot = receiver_slot(receiver, scope, kinds: GLOBAL_AND_CONSTANT)
+          slot = receiver_slot(receiver, scope, kinds: CLASS_GUARD_SLOT_KINDS)
           return nil if slot.nil?
 
           class_slot_scopes(scope, slot, class_name, exact: exact)
@@ -2250,11 +2382,9 @@ module Rigor
         def class_slot_scopes(scope, slot, class_name, exact:)
           environment = scope.environment
           truthy = narrow_class(slot.current, class_name, exact: exact, environment: environment, scope: scope)
-          [
-            narrow_slot(scope, slot, truthy),
-            narrow_slot(scope, slot, narrow_not_class(slot.current, class_name, exact: exact,
-                                                                                environment: environment, scope: scope))
-          ]
+          falsey = narrow_not_class(slot.current, class_name, exact: exact, environment: environment, scope: scope)
+          truthy_scope = record_bot_guard(narrow_guarded_slot(scope, slot, truthy), slot, truthy, [class_name])
+          [truthy_scope, narrow_guarded_slot(scope, slot, falsey)]
         end
 
         # The class name a `is_a?` / `kind_of?` / `instance_of?` argument denotes: the top-level
@@ -2429,12 +2559,12 @@ module Rigor
         end
 
         # Issue #1429 — `StringIO === $stdout`, `StringIO === STDOUT`: the class-constant receiver form on a global or
-        # constant argument. The Range / Regexp receivers stay local-only.
+        # constant argument, and on an instance variable (#1446). The Range / Regexp receivers stay local-only.
         def analyse_case_equality_on_slot(receiver, arg, scope)
           class_name = lexical_class_name(receiver, scope)
           return nil if class_name.nil?
 
-          slot = receiver_slot(arg, scope, kinds: GLOBAL_AND_CONSTANT)
+          slot = receiver_slot(arg, scope, kinds: CLASS_GUARD_SLOT_KINDS)
           return nil if slot.nil?
 
           class_slot_scopes(scope, slot, class_name, exact: false)

data/lib/rigor/inference/parameter_inference_collector.rb

@@ -245,13 +245,16 @@ module Rigor
         tables[:discovered_classes] = classes unless classes.empty?
         DISCOVERY_FIELD.each do |index_key, field|
           table = def_index.fetch(index_key)
-          tables[field] = table unless table.empty?
+          tables[field] = table unless table.empty? && !Scope::DiscoveryIndex.paired?(field)
         end
-        tables
-      rescue StandardError
+        # ADR-119 WD1 — the pairs travel together: a pair is dropped only when both halves are empty. A sibling whose
+        # member this collector does not seed completes to that member's empty value, which the base scope holds.
+        Scope::DiscoveryIndex.compact_pairs(tables.merge(def_index.fetch(:siblings)))
+      rescue StandardError => e
         # Discovery is best-effort; a malformed corner of the project must not crash the
-        # protection scan. Without discovery the collector simply resolves fewer call sites.
-        {}
+        # protection scan. Without discovery the collector simply resolves fewer call sites. A broken
+        # walk contract is not such a corner, and an empty seed would hide it.
+        e.is_a?(DeclarationWalk::ContractError) ? raise : {}
       end
 
       DISCOVERY_FIELD = {
@@ -260,7 +263,7 @@ module Rigor
         def_sources: :discovered_def_sources,
         superclasses: :discovered_superclasses,
         header_nestings: :discovered_header_nestings,
-        includes: :discovered_includes,
+        includes: :discovered_includes, unpositioned_mixins: :unpositioned_mixins,
         class_sources: :discovered_class_sources,
         method_visibilities: :discovered_method_visibilities,
         methods: :discovered_methods,
@@ -359,9 +362,7 @@ module Rigor
       end
 
       def lookup_def(scope, class_name, method, kind)
-        table = kind == :singleton ? scope.discovered_singleton_def_nodes : scope.discovered_def_nodes
-        per_class = table[class_name]
-        per_class && per_class[method]
+        scope.def_node_slot(class_name, method, kind)
       end
 
       # The leading required-positional parameters — the ones a call's leading positional arguments

data/lib/rigor/inference/scope_indexer/certainty.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    module ScopeIndexer
+      # ADR-119 WD3 — which of a file's method contributions are `possible`: the classifier the def-contribution
+      # producers ({ScopeIndexer#build_methods_and_def_nodes}, {ScopeIndexer#build_discovered_singleton_def_nodes})
+      # consult to fill `possible_discovered_methods` and the `contested_*` siblings.
+      #
+      # A contribution is `certain` when its statement executes whenever the file's top level executes. The certain
+      # regions are:
+      #
+      # - the program's statements, and the bodies of `class`, `module` and `class << self` declarations that are
+      #   themselves certain;
+      # - the block of a meta-new constant write (`K = Class.new do … end`, `Module.new`, `Struct.new`,
+      #   `Data.define`, {ScopeIndexer#meta_new_block_call}) and of a bare factory call
+      #   ({AnonymousMetaClass.block_form_receiver}), when the write or the call is certain: Ruby runs the block once,
+      #   as the new class's body (ADR-119 WD2, "Conditional definers");
+      # - a `begin` WITHOUT a `rescue` clause: its main statements and its `ensure` clause;
+      # - the receiver and arguments of a certain call, so `private def x` and `memoize def x` stay certain.
+      #
+      # Everything else is `possible`: the branches of `if` / `unless` / `case` and the modifiers, loop bodies, the
+      # right operand of `&&` / `||`, every other block and every lambda, `BEGIN` / `END`, a `class X … end if Y`
+      # reopening, and the WHOLE of a `begin` that has a `rescue` clause, its main statements included. That last
+      # rule refines WD3's wording: a rescued raise skips every statement after the raising one, so the main body of
+      # a rescuing `begin` is not certain either, while a `begin` with no rescue either runs its main statements
+      # and `ensure` or propagates the raise out of the file's top level. A `def` inside a method body is never
+      # recorded by the walks (they return at a `DefNode`), so the classifier does not descend there either.
+      #
+      # The answer is an identity Set of the POSSIBLE contribution nodes — the nodes a producer records from — and
+      # {EMPTY} when the file has none, so a file written entirely in certain regions allocates nothing. It is
+      # separate from {MixinAccumulator}, which answers a different question (whether an edge's POSITION is a fact).
+      module Certainty
+        # The answer for a file with no possible contribution.
+        EMPTY = Set.new.compare_by_identity.freeze
+
+        # The nodes a def-contribution producer records from: a `def`, an `alias` / `undef`, a call (`attr_*`,
+        # `define_method`, `alias_method`, `module_function :x`, a factory's members), and the declarations whose
+        # header records members (`class X < Struct.new(:a)`, `X = Struct.new(:a) do … end`).
+        CONTRIBUTIONS = Set[
+          Prism::DefNode, Prism::AliasMethodNode, Prism::UndefNode, Prism::CallNode, Prism::ClassNode,
+          Prism::ConstantWriteNode, Prism::ConstantPathWriteNode, Prism::ConstantOrWriteNode,
+          Prism::ConstantPathOrWriteNode
+        ].freeze
+
+        CONSTANT_WRITES = Set[
+          Prism::ConstantWriteNode, Prism::ConstantPathWriteNode, Prism::ConstantOrWriteNode,
+          Prism::ConstantPathOrWriteNode
+        ].freeze
+
+        # The nodes whose whole subtree is possible.
+        POSSIBLE_ROOTS = Set[
+          Prism::BlockNode, Prism::LambdaNode, Prism::PreExecutionNode, Prism::PostExecutionNode,
+          Prism::RescueModifierNode
+        ].freeze
+        private_constant :CONSTANT_WRITES, :POSSIBLE_ROOTS
+
+        module_function
+
+        # The possible contribution nodes of the tree under `root`, an identity Set ({EMPTY} when none).
+        def possible_nodes(root)
+          classifier = Classifier.new
+          classifier.certain(root)
+          classifier.result
+        end
+
+        # Whether `node` was classified possible in `possible` (a {possible_nodes} answer).
+        def possible?(possible, node)
+          !possible.empty? && possible.include?(node)
+        end
+
+        # One classification walk. `certain` descends a certain region; `possible` marks every contribution in a
+        # subtree, since nothing below a possible node is certain.
+        class Classifier
+          def initialize
+            @possible = nil
+          end
+
+          def result
+            @possible ? @possible.freeze : EMPTY
+          end
+
+          def certain(node) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity
+            return unless node.is_a?(Prism::Node)
+            return possible(node) if POSSIBLE_ROOTS.include?(node.class)
+
+            case node
+            when Prism::DefNode then return
+            when Prism::IfNode then return branch(node.predicate, node.statements, node.subsequent)
+            when Prism::UnlessNode then return branch(node.predicate, node.statements, node.else_clause)
+            when Prism::CaseNode, Prism::CaseMatchNode then return case_branches(node)
+            when Prism::WhileNode, Prism::UntilNode then return branch(node.predicate, node.statements)
+            when Prism::ForNode then return branch(node.collection, node.index, node.statements)
+            when Prism::AndNode, Prism::OrNode then return branch(node.left, node.right)
+            when Prism::BeginNode then return begin_block(node)
+            when Prism::CallNode then return call(node)
+            end
+            return if CONSTANT_WRITES.include?(node.class) && meta_new_write?(node)
+
+            node.rigor_each_child { |child| certain(child) }
+          end
+
+          # Marks every contribution of the subtree.
+          def possible(node)
+            return unless node.is_a?(Prism::Node)
+
+            (@possible ||= Set.new.compare_by_identity) << node if CONTRIBUTIONS.include?(node.class)
+            return if node.is_a?(Prism::DefNode)
+
+            node.rigor_each_child { |child| possible(child) }
+          end
+
+          private
+
+          # The first node runs whenever the construct does; the rest may not.
+          def branch(first, *rest)
+            certain(first)
+            rest.each { |node| possible(node) }
+          end
+
+          def case_branches(node)
+            certain(node.predicate)
+            node.conditions.each { |clause| possible(clause) }
+            possible(node.else_clause)
+          end
+
+          # Without a rescue the main statements run (or the raise leaves the file) and `ensure` runs; with one, a
+          # rescued raise skips every statement after the raising one, so all of it is possible.
+          def begin_block(node)
+            return possible_children(node) if node.rescue_clause
+
+            certain(node.statements)
+            possible(node.else_clause)
+            certain(node.ensure_clause)
+          end
+
+          def possible_children(node)
+            node.rigor_each_child { |child| possible(child) }
+          end
+
+          # The receiver and arguments of a certain call run; its block runs as a class body only for a bare
+          # factory call. A safe-navigation call may skip its arguments.
+          def call(node)
+            certain(node.receiver)
+            if node.safe_navigation?
+              possible(node.arguments)
+              possible(node.block)
+              return
+            end
+            certain(node.arguments)
+            block = node.block
+            if block.is_a?(Prism::BlockNode) && AnonymousMetaClass.block_form_receiver(node)
+              certain(block.body)
+            else
+              certain(block)
+            end
+          end
+
+          # A meta-new constant write: the factory's receiver and arguments, and its block as the class body.
+          def meta_new_write?(node)
+            call = ScopeIndexer.meta_new_block_call(node)
+            return false unless call
+
+            certain(call.receiver)
+            certain(call.arguments)
+            block = call.block
+            certain(block.is_a?(Prism::BlockNode) ? block.body : block)
+            true
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/scope_indexer/class_cvars_collector.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require_relative "../declaration_walk/traversal"
+
+module Rigor
+  module Inference
+    module ScopeIndexer
+      # The `class_cvars` discovery table (slice 7 phase 6) as a {DeclarationWalk} collector: every
+      # `@@x = …` a `def` body writes, typed under the census scope and unioned per class. Ruby cvars are
+      # shared by the instance and singleton facets, so every `def` counts, `def self.x` included.
+      class ClassCvarsCollector
+        include DeclarationWalk::Collector
+
+        def initialize
+          @table = {}
+        end
+
+        # `@@x` in a `def` resolves through the LEXICAL cref: `Module.nesting` is the same inside a meta-new or
+        # eval block, so the context's `prefix` keys the write and its rebound `self` never does —
+        # `K = Class.new { def m = @@x }` inside `class C` writes `C::@@x`. The walk goes no further in: the
+        # gather reads the body with `def`, `class` and `module` as barriers, and nothing below a `def` reaches
+        # this table.
+        def on_def(node, context)
+          ScopeIndexer.collect_def_cvar_writes(node, context.prefix, context.scope, @table)
+          DeclarationWalk::DECLINE
+        end
+
+        # The table as the discovery index holds it: each class's entry frozen, then the whole.
+        def table
+          @table.transform_values(&:freeze).freeze
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/scope_indexer/def_nestings_collector.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "../declaration_walk/traversal"
+
+module Rigor
+  module Inference
+    module ScopeIndexer
+      # Issue #681's `{Prism::DefNode => Module.nesting}` table as a {DeclarationWalk} collector: the chain every
+      # `def` is declared under, keyed by node identity. A top-level `def` records the empty chain (#716); a `def`
+      # below a header that renders no name records nothing, because no chain survives it.
+      class DefNestingsCollector
+        include DeclarationWalk::Collector
+
+        # The rules `walk_def_nestings` answered differently from the walk, kept so the table stays
+        # byte-identical (ADR-116 WD5). Each is a legacy answer, and #1521 tracks converging it:
+        #
+        # - `factory_block: :ordinary_call` — no bare-factory arm, so a `self::` header in a `Class.new { … }`
+        #   block anchors on the enclosing `self` and the block's parameters are walked (#1521 item 8).
+        # - `lexical_prefix: :nesting_head` — the walker threads no qualified prefix; its meta-new and eval
+        #   splits resolve against `nesting.first` split into segments, which differs from the walk's prefix
+        #   below a compact header and below an unnameable cref (#1521 item 1).
+        # - `unrendered_header: :body_with_lost_nesting` — a header that renders no name (a parse error) walks
+        #   its body alone, with the chain lost unless an unnameable cref encloses it (#1521 item 3).
+        VARIANTS = {
+          factory_block: :ordinary_call,
+          lexical_prefix: :nesting_head,
+          unrendered_header: :body_with_lost_nesting
+        }.freeze
+
+        def initialize
+          @table = {}.compare_by_identity
+        end
+
+        # Nothing below a `def` declares a class or module, so the walk goes no further in for this table.
+        def on_def(node, context)
+          nesting = context.nesting
+          @table[node] = nesting unless nesting.nil?
+          DeclarationWalk::DECLINE
+        end
+
+        def table
+          @table.freeze
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/scope_indexer/layered_def_nestings.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    module ScopeIndexer
+      # Issue #1507 — a file's issue #681 def-nesting table read over the cross-file seed rather than merged into a
+      # copy of it. The copy inserted every `def` in the PROJECT once per analysed file (263 ms of an 18.95 s cold
+      # Mastodon run); a lookup probes at most both layers, and only for a `def` whose body is re-walked.
+      #
+      # Both layers are keyed by node identity, so a same-file declaration and its cross-file twin are distinct keys
+      # and the order cannot change an answer. The file layer is read first all the same, which is what the merge it
+      # replaces did (`merge!(seed)`, then `merge!(file)`), so the answer holds even if a shared parse ever made the
+      # keys overlap.
+      #
+      # It answers what the table's readers ask — `[]` ({ExpressionTyper#recorded_def_nesting}) and `empty?` — and
+      # is deliberately not a Hash: `each`, `key?`, `size` or `==` would have to see both layers, and a Hash holding
+      # one of them would answer those wrong instead of raising.
+      class LayeredDefNestings
+        def initialize(file, seed)
+          @file = file
+          @seed = seed
+          freeze
+        end
+
+        # `fetch` rather than `||`, so presence in the file layer decides, as the later `merge!` did.
+        def [](def_node)
+          @file.fetch(def_node) { @seed[def_node] }
+        end
+
+        def empty?
+          @file.empty? && @seed.empty?
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/scope_indexer/member_layouts_collector.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative "../declaration_walk/traversal"
+
+module Rigor
+  module Inference
+    module ScopeIndexer
+      # ADR-48's two member-layout tables as one {DeclarationWalk} collector: the ordered members of each
+      # `Data.define` class and of each `Struct.new` class (with its `keyword_init:` flag), in both the subclass
+      # form (`class Point < Data.define(:x, :y)`) and the constant form (`Point = Data.define(:x, :y)`). The
+      # legacy walkers built the two tables in two walks with the same rules; one collector builds both.
+      class MemberLayoutsCollector
+        include DeclarationWalk::Collector
+
+        # The rules the member-layout walkers answered differently from the walk, kept so both tables stay
+        # byte-identical (ADR-116 WD5). Each is a legacy answer, and #1521 tracks converging it:
+        #
+        # - `factory_block: :ordinary_call` — no bare-factory arm, so a `self::` header in a `Class.new { … }`
+        #   block anchors on the enclosing `self` and the block's parameters are walked (#1521 item 8).
+        # - `unrendered_header: :skip` — a header that renders no name (a parse error) stops the walk there:
+        #   neither its parts nor its body are walked (#1521 item 3).
+        VARIANTS = { factory_block: :ordinary_call, unrendered_header: :skip }.freeze
+
+        def initialize
+          @data = {}
+          @struct = {}
+        end
+
+        # A `class Point < Data.define(:x, :y)` header, recorded under the class it names; an unnameable
+        # header (`class D` below `class <<` opens `#<Class:C>::D`, which no name spells) records nothing.
+        def on_declaration(node, _context, body)
+          if node.is_a?(Prism::ClassNode) && !body.singleton_cref
+            ScopeIndexer.record_data_member_layout(@data, body.prefix, node.superclass, allow_outer_block: false)
+            ScopeIndexer.record_struct_member_layout(@struct, body.prefix, node.superclass, allow_outer_block: false)
+          end
+          DeclarationWalk::DESCEND
+        end
+
+        # A `Point = Data.define(:x, :y)` write, recorded under the class the write names. Below an unnameable
+        # cref only a path write still names one.
+        def on_constant_write(node, context)
+          self_owner = context.self_owner
+          unless context.singleton_cref && !ScopeIndexer.meta_new_path_target_nameable?(node, self_owner)
+            child_prefix = ScopeIndexer.meta_new_child_prefix(node, context.prefix, self_owner)
+          end
+          if child_prefix
+            rvalue = ScopeIndexer.meta_new_rvalue(node)
+            ScopeIndexer.record_data_member_layout(@data, child_prefix, rvalue)
+            ScopeIndexer.record_struct_member_layout(@struct, child_prefix, rvalue)
+          end
+          DeclarationWalk::DESCEND
+        end
+
+        # `[data_member_layouts, struct_member_layouts]`, each frozen.
+        def tables
+          [@data.freeze, @struct.freeze]
+        end
+      end
+    end
+  end
+end