rigortype 0.4.0 → 0.4.1

data/lib/rigor/effects/plugin_facts.rb

@@ -311,12 +311,12 @@ module Rigor
       # `[class_name, …ancestors]`, memoised per class. Cycle-guarded and capped: the tables are *as
       # written*, so a project can spell an ancestry that loops.
       #
-      # Included and prepended modules are walked beside the superclass, nearer first, because that is
-      # Ruby's own lookup order and because a framework's contract is as often a module as a base class:
-      # a Sidekiq worker is `class TriggerWebhookWorker; include Sidekiq::Job`, with no base class at all,
-      # so a superclass-only walk could not match a row about it however the plugin spelled one (#456).
-      # `ExpressionTyper#enqueue_ancestors` already resolves a self-call this way; the two tables
-      # disagreeing about what an ancestor is was the bug.
+      # Included and prepended modules are walked beside the superclass, nearer first, because a framework's
+      # contract is as often a module as a base class: a Sidekiq worker is `class TriggerWebhookWorker;
+      # include Sidekiq::Job`, with no base class at all, so a superclass-only walk could not match a row
+      # about it however the plugin spelled one (#456). Breadth-first is close to Ruby's lookup order but not
+      # it (a module an included module includes comes after the superclass here); `Scope::ResolutionChain`
+      # is the exact order, and this walk over the plugin facts' own copy of the tables does not read it yet.
       def ancestry(class_name)
         @ancestry[class_name] ||= begin
           chain = []

data/lib/rigor/environment/bundle_sig_discovery.rb

@@ -2,6 +2,8 @@
 
 require "yaml"
 
+require_relative "../config_path"
+
 module Rigor
   class Environment
     # Target-project Bundler awareness (O4, implemented).
@@ -167,7 +169,7 @@ module Rigor
       # for the stats banner so end users can see what rigor picked up.
       def self.resolve_bundle_path(bundle_path:, project_root: Dir.pwd, auto_detect: true, home: nil)
         if bundle_path
-          path = Pathname.new(File.expand_path(bundle_path.to_s, project_root))
+          path = Pathname.new(Rigor::ConfigPath.absolute(bundle_path.to_s, project_root))
           return path if path.directory?
 
           return nil
@@ -203,7 +205,7 @@ module Rigor
       # read of the real `~/.bundle/config`).
       def self.auto_detect(project_root:, home: nil)
         from_config = read_bundle_config_path(File.join(project_root, ".bundle", "config"))
-        return File.expand_path(from_config, project_root) if from_config
+        return Rigor::ConfigPath.absolute(from_config, project_root) if from_config
 
         vendor = File.join(project_root, "vendor", "bundle")
         return vendor if File.directory?(vendor)
@@ -221,7 +223,7 @@ module Rigor
         configured = read_bundle_config_path(File.join(home, ".bundle", "config"))
         return nil unless configured
 
-        resolved = File.expand_path(configured, project_root)
+        resolved = Rigor::ConfigPath.absolute(configured, project_root)
         File.directory?(resolved) ? resolved : nil
       end
       private_class_method :global_bundle_path

data/lib/rigor/environment/lockfile_resolver.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../config_path"
+
 module Rigor
   class Environment
     # Gemfile.lock parser for target-project bundler awareness (O4 Layer 3, implemented).
@@ -109,11 +111,18 @@ module Rigor
       end
       private_class_method :do_parse_dependency_names
 
+      # The absolute path a configured `lockfile:` names, whether or not the file exists. The one place the
+      # setting is expanded (a leading `~/` is the home directory), shared by `resolve_lockfile_path` and
+      # by `WriteGuard`, which must watch the very path the run reads.
+      def self.configured_lockfile_path(lockfile_path, project_root = Dir.pwd)
+        Rigor::ConfigPath.absolute(lockfile_path.to_s, project_root)
+      end
+
       # Returns the resolved lockfile path (`Pathname`) or `nil` when neither explicit nor auto-detect
       # produces one. Public so the stats banner can show what rigor picked up.
       def self.resolve_lockfile_path(lockfile_path:, project_root: Dir.pwd, auto_detect: true)
         if lockfile_path
-          path = Pathname.new(File.expand_path(lockfile_path.to_s, project_root))
+          path = Pathname.new(configured_lockfile_path(lockfile_path, project_root))
           return path if path.file?
 
           return nil

data/lib/rigor/environment/rbs_collection_discovery.rb

@@ -2,6 +2,8 @@
 
 require "yaml"
 
+require_relative "../config_path"
+
 module Rigor
   class Environment
     # `rbs collection install` awareness (O4 Layer 3 slice 2, implemented).
@@ -68,11 +70,18 @@ module Rigor
         gem_paths_from(collection_root, data, skip_gem_names.to_set)
       end
 
+      # The absolute path a configured `lockfile:` names, whether or not the file exists. The one place the
+      # setting is expanded (a leading `~/` is the home directory), shared by `resolve_lockfile_path` and
+      # by `WriteGuard`, which must watch the very path the run reads.
+      def self.configured_lockfile_path(lockfile_path, project_root = Dir.pwd)
+        Rigor::ConfigPath.absolute(lockfile_path.to_s, project_root)
+      end
+
       # Returns the resolved lockfile path (`Pathname`) or `nil` when neither explicit nor auto-detect
       # produces one. Public so the stats banner can surface what rigor found.
       def self.resolve_lockfile_path(lockfile_path:, project_root: Dir.pwd, auto_detect: true)
         if lockfile_path
-          path = Pathname.new(File.expand_path(lockfile_path.to_s, project_root))
+          path = Pathname.new(configured_lockfile_path(lockfile_path, project_root))
           return path if path.file?
 
           return nil

data/lib/rigor/environment/rbs_loader.rb

@@ -812,7 +812,7 @@ module Rigor
           buffer_name = location&.buffer&.name
           return false unless buffer_name
 
-          project_files.include?(File.expand_path(buffer_name.to_s))
+          project_files.include?(File.absolute_path(buffer_name.to_s))
         end
 
         # Adds empty stub declarations for the missing referenced types (and any enclosing namespace they

data/lib/rigor/environment/source_rbs_synthesis.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require "digest"
+require_relative "../cache/value_digest"
+
+module Rigor
+  class Environment
+    # ADR-32 WD5 — one plugin's `source_rbs_synthesizer` output for one source file, cached per (file content,
+    # plugin entry, engine source). Two callers read it, and sharing the function is the point:
+    #
+    # - {Environment.collect_virtual_rbs} hands each output to the loader as a `virtual:` buffer;
+    # - {.digest} reduces every loaded synthesizer's output for a file to one comparable value, which the
+    #   incremental session (ADR-89 WD1, issue #1536) keeps on the file's seed bundle and compares across an
+    #   edit.
+    #
+    # Because the digest reads the very function (and the very cache entries) the loader is fed from, "the
+    # digest did not move" means "the loader read the same bytes for this file", not "some model of what
+    # the plugin reads did not move". That is why it is taken from the output rather than from the file's
+    # comment lines: rbs-inline binds an annotation by adjacency, so a plain comment or a blank line can move
+    # one to another declaration, and in an annotated file every `def`, `attr`, constant and mixin gets a
+    # skeleton whether or not it carries an annotation of its own.
+    module SourceRbsSynthesis
+      PRODUCER_ID = "plugin.source_rbs_synthesizer"
+
+      # The digest of a file no loaded synthesizer contributes anything for — the answer for every file of a
+      # project without an annotation, and for every file when no synthesizer is loaded at all. Not a hex
+      # digest, so it can never collide with one.
+      NO_CONTRIBUTION = "none"
+
+      module_function
+
+      # The cache stores the empty string `""` as the "no contribution" sentinel because `Cache::Store`
+      # treats `nil` as a cache miss. Error tuples are stored as the canonical `[:error, message_string]`
+      # Array so the same wrapper short-circuits subsequent runs against unchanged broken input.
+      def output_for(plugin, callable, path, cache_store)
+        return invoke_safely(callable, path) if cache_store.nil?
+        return invoke_safely(callable, path) unless File.file?(path)
+
+        descriptor = cache_descriptor(plugin, path)
+        return invoke_safely(callable, path) if descriptor.nil?
+
+        cache_store.fetch_or_compute(
+          producer_id: PRODUCER_ID,
+          params: {},
+          descriptor: descriptor,
+          generation_cap: generation_cap
+        ) { invoke_safely(callable, path) || "" }
+      end
+
+      # Issue #1536 — every synthesizer's output for `path`, reduced to one value: {NO_CONTRIBUTION} when none
+      # of them contributes anything, a SHA-256 hex digest of each plugin's id and {.contribution} otherwise,
+      # and nil when an output could not be read at all.
+      #
+      # nil means "unknown", and a caller must treat it as moved. Every failure is per file: one plugin that
+      # cannot answer for one file leaves every other file's digest intact.
+      #
+      # @param synthesizers — `Plugin::Registry#source_rbs_synthesizers` pairs.
+      def digest(synthesizers, path, cache_store)
+        sha = Digest::SHA256.new
+        contributed = false
+        synthesizers.each do |plugin, callable|
+          tag, text = contribution(output_for(plugin, callable, path, cache_store))
+          next if tag.nil?
+
+          contributed = true
+          sha << plugin.manifest.id.to_s.b << "\x00" << tag << "\x00" << text.to_s.b << "\x01"
+        end
+        contributed ? sha.hexdigest : NO_CONTRIBUTION
+      rescue StandardError
+        nil
+      end
+
+      # What one output puts into the environment, as a `[tag, text]` pair, or nil for nothing: exactly the
+      # RBS {Environment.interpret_synthesizer_outcome} hands the loader. The ADR-32 WD6 / WD12 notices are left
+      # out. They reach only the run-level `source-rbs-*` rows, which every run regenerates and the per-file
+      # cache never serves, and they quote line numbers, so a line shift in a file carrying a malformed `#:`
+      # would otherwise read as a moved contribution. A failed synthesis contributes nothing to the loader but
+      # is kept as one stable value of its own, so a file flipping between "no annotation" and "broken
+      # annotation" still reads as moved. Any shape the contract does not name is digested whole, by value: the
+      # output is computed on one run and served from its cache entry on the next, and a digest of its
+      # `Marshal.dump` bytes can differ between the two (issue #1574).
+      #
+      # The RBS text itself is digested whole, comments included. RBS reads a `# resolve-type-names: false`
+      # magic comment at the start of a buffer, rbs-inline copies a `.rb` file's first comment line there, and
+      # a string-literal type may span lines that start with `#`, so no line-based stripping is sound (#1549).
+      def contribution(output)
+        return nil if output.nil? || output == ""
+        return ["rbs", output] if output.is_a?(String)
+        return ["raw", Cache::ValueDigest.hexdigest(output)] unless output.is_a?(Array)
+
+        case output[0]
+        when :error then ["error", nil]
+        when :ok then contribution(output[1])
+        else ["raw", Cache::ValueDigest.hexdigest(output)]
+        end
+      end
+
+      # One entry per (plugin, source file), all of them live for as long as the file is in the project — a
+      # generation count says nothing about staleness here, so this producer declares itself out of
+      # `Cache::Store#evict!`'s compaction pass and is bounded only by the size-based LRU pass. A method
+      # rather than a constant: `Cache::Store` is not loaded yet when this file is.
+      def generation_cap
+        Cache::Store::UNBOUNDED_GENERATIONS
+      end
+
+      # The key composes the file's content SHA with the plugin's `PluginEntry` (id + version + config_hash),
+      # so a config change or a content change invalidates the entry, and with the engine's source identity
+      # (issue #1009): a plugin's manifest version does not move when a checkout edits its synthesizer, and
+      # a stale string here also keeps the `rbs.virtual_rbs` env key warm, so the new build's rules would
+      # read the old build's RBS.
+      def cache_descriptor(plugin, path)
+        Cache::Descriptor.new(
+          files: [Cache::Descriptor::FileEntry.new(
+            path: path.to_s,
+            comparator: :digest,
+            value: input_digest(path)
+          )],
+          plugins: [plugin.plugin_entry],
+          configs: Cache::EngineSource.key_config_entries
+        )
+      rescue Cache::EngineSource::Unavailable
+        # An engine that cannot be identified must not be keyed by its inputs alone (issue #1009): nil runs the
+        # synthesizer uncached rather than serving an entry another build may have written.
+        nil
+      end
+
+      def input_digest(path)
+        Digest::SHA256.hexdigest(File.binread(path))
+      rescue ::SystemCallError
+        # Unreadable file → key on the path alone; the synthesizer's File.file?/File.read will see the same
+        # failure and return nil.
+        Digest::SHA256.hexdigest(path.to_s)
+      end
+
+      def invoke_safely(callable, path)
+        callable.call(path.to_s)
+      rescue StandardError
+        # WD6 fail-soft — a synthesizer that raises does NOT crash analysis. Unlike the `[:error, msg]`
+        # return path (which the runner surfaces as `source-rbs-synthesis-failed`), an unhandled raise is
+        # swallowed silently; the unexamined-raise channel is deliberately silent per WD6.
+        nil
+      end
+
+      private_class_method :contribution, :generation_cap, :cache_descriptor, :input_digest, :invoke_safely
+    end
+  end
+end

data/lib/rigor/environment.rb

@@ -15,6 +15,7 @@ require_relative "environment/bundle_sig_discovery"
 require_relative "environment/lockfile_resolver"
 require_relative "environment/installed_gem_set"
 require_relative "environment/rbs_collection_discovery"
+require_relative "environment/source_rbs_synthesis"
 require_relative "plugin/isolation"
 require_relative "cache/engine_source"
 require_relative "environment/rbs_coverage_report"
@@ -275,7 +276,7 @@ module Rigor
                       rbs_collection_lockfile: nil, rbs_collection_auto_detect: false,
                       synthetic_method_index: nil, project_patched_methods: nil,
                       source_files: [], locked_gems: nil)
-        resolved_paths = signature_paths || default_signature_paths(root)
+        resolved_paths = project_signature_roots(signature_paths, root: root)
         # O4 MVP — append per-gem `sig/` directories discovered under the target project's bundler install
         # root. Empty array when neither an explicit path nor auto-detection finds a bundle. Order: user
         # `signature_paths:` win first (semantic precedence inside `RbsLoader.build_env_for`); gem-shipped
@@ -390,6 +391,13 @@ module Rigor
         )
       end
 
+      # The project-owned `sig/` roots a run reads: the explicit `signature_paths:` when given, else the
+      # auto-detected `<root>/sig` (or none). Public so {Cache::IncrementalSnapshot} digests exactly the
+      # directories the environment loads, including the auto-detected one a `nil` `signature_paths:` hides.
+      def project_signature_roots(signature_paths, root: Dir.pwd)
+        signature_paths || default_signature_paths(root)
+      end
+
       private
 
       def default_signature_paths(root)
@@ -496,11 +504,9 @@ module Rigor
       # empty and this method short-circuits to `[]` without walking the file list.
       #
       # WD5 — when `cache_store` is supplied, each (file, plugin) synthesizer call is memoised through
-      # `Cache::Store`. The cache key composes the file's content SHA with the plugin's `PluginEntry` (id +
-      # version + config_hash) so a config change or content change invalidates the entry automatically, and
-      # with the engine's source identity (issue #1009): a plugin's manifest version does not move when a
-      # checkout edits its synthesizer, and a stale string here also keeps the `rbs.virtual_rbs` env key warm,
-      # so the new build's rules would read the old build's RBS.
+      # `Cache::Store` ({SourceRbsSynthesis.output_for}, which owns the key). The incremental session's
+      # per-file digest (issue #1536) reads the same function, so the two can never disagree on what a file
+      # contributed.
       def collect_virtual_rbs(plugin_registry, source_files, cache_store, reporter)
         return [] if plugin_registry.nil?
 
@@ -511,7 +517,7 @@ module Rigor
         result = []
         source_files.each do |path|
           synthesizers.each do |plugin, callable|
-            outcome = synthesizer_output_for(plugin, callable, path, cache_store)
+            outcome = SourceRbsSynthesis.output_for(plugin, callable, path, cache_store)
             outcome = interpret_synthesizer_outcome(outcome, plugin, path, reporter)
             next if outcome.nil? || outcome.empty?
 
@@ -522,25 +528,6 @@ module Rigor
         result
       end
 
-      # ADR-32 WD5 — cache wrapper around a single (plugin, file) invocation. The cache stores the empty
-      # string `""` as the "no contribution" sentinel because `Cache::Store` treats `nil` as a cache miss.
-      # Error tuples are stored as the canonical `[:error, message_string]` Array so the same wrapper
-      # short-circuits subsequent runs against unchanged broken input.
-      def synthesizer_output_for(plugin, callable, path, cache_store)
-        return invoke_synthesizer_safely(callable, path) if cache_store.nil?
-        return invoke_synthesizer_safely(callable, path) unless File.file?(path)
-
-        descriptor = build_synthesizer_cache_descriptor(plugin, path)
-        return invoke_synthesizer_safely(callable, path) if descriptor.nil?
-
-        cache_store.fetch_or_compute(
-          producer_id: SYNTHESIZER_CACHE_PRODUCER_ID,
-          params: {},
-          descriptor: descriptor,
-          generation_cap: synthesizer_generation_cap
-        ) { invoke_synthesizer_safely(callable, path) || "" }
-      end
-
       # ADR-32 WD6 / WD12 — route a synthesizer return value through the per-run reporter. The
       # synthesizer's contract (declared in
       # `plugins/rigor-rbs-inline/lib/rigor/plugin/rbs_inline.rb`) admits four return shapes:
@@ -661,50 +648,6 @@ module Rigor
         prefix = "#{root}#{File::SEPARATOR}"
         path.to_s.start_with?(prefix) ? path.to_s.delete_prefix(prefix) : path.to_s
       end
-
-      SYNTHESIZER_CACHE_PRODUCER_ID = "plugin.source_rbs_synthesizer"
-      private_constant :SYNTHESIZER_CACHE_PRODUCER_ID
-
-      # One entry per (plugin, source file), all of them live for as long as the file is in the project — a
-      # generation count says nothing about staleness here, so this producer declares itself out of
-      # `Cache::Store#evict!`'s compaction pass and is bounded only by the size-based LRU pass. A method
-      # rather than a constant: `Cache::Store` is not loaded yet when this class body runs.
-      def synthesizer_generation_cap
-        Cache::Store::UNBOUNDED_GENERATIONS
-      end
-
-      def build_synthesizer_cache_descriptor(plugin, path)
-        Cache::Descriptor.new(
-          files: [Cache::Descriptor::FileEntry.new(
-            path: path.to_s,
-            comparator: :digest,
-            value: synthesizer_input_digest(path)
-          )],
-          plugins: [plugin.plugin_entry],
-          configs: Cache::EngineSource.key_config_entries
-        )
-      rescue Cache::EngineSource::Unavailable
-        # An engine that cannot be identified must not be keyed by its inputs alone (issue #1009): nil runs the
-        # synthesizer uncached rather than serving an entry another build may have written.
-        nil
-      end
-
-      def synthesizer_input_digest(path)
-        Digest::SHA256.hexdigest(File.binread(path))
-      rescue ::SystemCallError
-        # Unreadable file → key on the path alone; the synthesizer's File.file?/File.read will see the same
-        # failure and return nil.
-        Digest::SHA256.hexdigest(path.to_s)
-      end
-
-      def invoke_synthesizer_safely(callable, path)
-        callable.call(path.to_s)
-      rescue StandardError
-        # WD6 fail-soft — a synthesizer that raises does NOT crash analysis. Unlike the `[:error, msg]`
-        # return path (which the runner surfaces as `source-rbs-synthesis-failed`), an unhandled raise is
-        # swallowed silently; the unexamined-raise channel is deliberately silent per WD6.
-        nil
-      end
     end
 
     # Resolves a constant name to a Rigor::Type::Nominal (the *instance* type carrier). Consults the static

data/lib/rigor/inference/block_parameter_binder.rb

@@ -54,14 +54,16 @@ module Rigor
         reset_per_bind_state
       end
 
-      # The names the last {#bind} bound optimistically nil-free (see the class comment).
+      # The names the last {#bind} bound optimistically nil-free (see the class comment). Read-only: it is a
+      # shared frozen empty when the bind marked nothing.
       attr_reader :optimistic
 
       # Binds the block's parameters into `scope`: {#bind}'s types through `Scope#with_local`, then the
-      # optimistic mark for every name in {#optimistic}.
+      # optimistic mark for every name in {#optimistic}. It applies them through
+      # {MultiTargetBinder.apply_bindings} directly rather than through a `Result`, which every block entry
+      # built only to apply at once ([#1504](https://github.com/rigortype/rigor/issues/1504)).
       def bind_onto(block_node, scope)
-        types = bind(block_node, scope: scope)
-        MultiTargetBinder::Result.new(types: types, optimistic: @optimistic.dup.freeze).apply_to(scope)
+        MultiTargetBinder.apply_bindings(scope, bind(block_node, scope: scope), @optimistic)
       end
 
       # @return ordered map from parameter name to bound type. Anonymous
@@ -90,29 +92,40 @@ module Rigor
 
       private
 
+      NO_POSITIONS = [].freeze
+      NO_NAMES = [].freeze
+      private_constant :NO_POSITIONS, :NO_NAMES
+
       # {#apply_auto_splat} rewrites the positional table for the block it is binding, so every {#bind} starts
       # from the declared types again; a binder reused across blocks must not see the previous block's splat.
+      # The two lists start as shared frozen empties, since most blocks mark nothing ({#mark_optimistic}).
       def reset_per_bind_state
         @expected_param_types = @declared_param_types
         @splat_rest_type = nil
-        @optimistic_positions = []
-        @optimistic = []
+        @optimistic_positions = NO_POSITIONS
+        @optimistic = NO_NAMES
         @scope = nil
       end
 
+      # Records `name` as bound optimistically, allocating {#optimistic} on the first mark of a {#bind}.
+      def mark_optimistic(name)
+        @optimistic = [] if @optimistic.equal?(NO_NAMES)
+        @optimistic << name
+      end
+
       # `|_1, _2|` numbered-parameter form. Prism exposes the implicit count through
       # `NumberedParametersNode#maximum` (the highest `_N` referenced in the body); we materialise bindings
       # for `:_1` through `:_maximum`, auto-splatting exactly as the explicit list of that many required
       # positionals would, so the body's `LocalVariableReadNode` lookups see the same types and marks.
       def bind_numbered_parameters(numbered_node)
         arity = numbered_node.maximum
-        apply_auto_splat(BlockAutoSplat::ParameterShape.of_arity(arity))
+        apply_auto_splat { BlockAutoSplat::ParameterShape.of_arity(arity) }
 
         bindings = {}
         arity.times do |i|
           name = :"_#{i + 1}"
           bindings[name] = positional_type_at(i)
-          @optimistic << name if @optimistic_positions.include?(i)
+          mark_optimistic(name) if @optimistic_positions.include?(i)
         end
         bindings
       end
@@ -127,7 +140,7 @@ module Rigor
         params_node = params_root.parameters
         return {} if params_node.nil?
 
-        apply_auto_splat(BlockAutoSplat::ParameterShape.of(params_node))
+        apply_auto_splat { BlockAutoSplat::ParameterShape.of(params_node) }
 
         bindings = {}
         bind_positionals(params_node, bindings, 0)
@@ -152,9 +165,12 @@ module Rigor
       # and {BlockAutoSplat} answers a table for that value and `shape`. A multi-arg yield (e.g.
       # `each_with_index`'s `(element, index)` pair) is NOT auto-splatted — matching Ruby semantics where a
       # multi-arg yield to a `|a, b, c|` block fills the extra slot with nil rather than splatting any
-      # element.
-      def apply_auto_splat(shape)
+      # element. The block answers the parameter list's shape, built only past that test
+      # ([#1504](https://github.com/rigortype/rigor/issues/1504)).
+      def apply_auto_splat
         return unless @expected_param_types.size == 1
+
+        shape = yield
         return unless shape.splats?
 
         table = BlockAutoSplat.for(shape, @expected_param_types[0])
@@ -242,12 +258,12 @@ module Rigor
         case param
         when Prism::RequiredParameterNode
           bindings[param.name] = positional_type_at(cursor)
-          @optimistic << param.name if @optimistic_positions.include?(cursor)
+          mark_optimistic(param.name) if @optimistic_positions.include?(cursor)
         when Prism::MultiTargetNode
           nested = MultiTargetBinder.bind_marked(param, positional_type_at(cursor),
                                                  optimistic: @optimistic_positions.include?(cursor), scope: @scope)
           bindings.merge!(nested.types)
-          @optimistic.concat(nested.optimistic)
+          nested.optimistic.each { |name| mark_optimistic(name) }
         end
       end
 

data/lib/rigor/inference/captured_locals.rb

@@ -413,10 +413,16 @@ module Rigor
       NESTED_SCOPE_NODES = Set[Prism::BlockNode, Prism::LambdaNode].freeze
       private_constant :NESTED_SCOPE_NODES
 
+      # The index arm spells {INDEX_STORE_NODES} out rather than splatting it: `when *ARRAY` copies the array
+      # on every evaluation, and this runs once per node of every scanned block body, which cost `rigor check`
+      # about 126K allocations over the v0.3.9 `lib` ([#1502](https://github.com/rigortype/rigor/issues/1502),
+      # the shape `ScopeIndexer::META_CONSTANT_WRITE_NODES` records). Keep the arm and the list in step.
       def mutated_receiver(node)
         case node
         when Prism::CallNode then node.receiver if MutationWidening::SHAPE_MUTATORS.include?(node.name)
-        when *INDEX_STORE_NODES then node.receiver
+        when Prism::IndexOrWriteNode, Prism::IndexAndWriteNode, Prism::IndexOperatorWriteNode,
+             Prism::IndexTargetNode
+          node.receiver
         end
       end