rigortype 0.4.0 → 0.4.2

data/lib/rigor/environment/source_rbs_synthesis.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require "digest"
+require_relative "../cache/value_digest"
+
+module Rigor
+  class Environment
+    # ADR-32 WD5 — one plugin's `source_rbs_synthesizer` output for one source file, cached per (file content,
+    # plugin entry, engine source). Two callers read it, and sharing the function is the point:
+    #
+    # - {Environment.collect_virtual_rbs} hands each output to the loader as a `virtual:` buffer;
+    # - {.digest} reduces every loaded synthesizer's output for a file to one comparable value, which the
+    #   incremental session (ADR-89 WD1, issue #1536) keeps on the file's seed bundle and compares across an
+    #   edit.
+    #
+    # Because the digest reads the very function (and the very cache entries) the loader is fed from, "the
+    # digest did not move" means "the loader read the same bytes for this file", not "some model of what
+    # the plugin reads did not move". That is why it is taken from the output rather than from the file's
+    # comment lines: rbs-inline binds an annotation by adjacency, so a plain comment or a blank line can move
+    # one to another declaration, and in an annotated file every `def`, `attr`, constant and mixin gets a
+    # skeleton whether or not it carries an annotation of its own.
+    module SourceRbsSynthesis
+      PRODUCER_ID = "plugin.source_rbs_synthesizer"
+
+      # The digest of a file no loaded synthesizer contributes anything for — the answer for every file of a
+      # project without an annotation, and for every file when no synthesizer is loaded at all. Not a hex
+      # digest, so it can never collide with one.
+      NO_CONTRIBUTION = "none"
+
+      module_function
+
+      # The cache stores the empty string `""` as the "no contribution" sentinel because `Cache::Store`
+      # treats `nil` as a cache miss. Error tuples are stored as the canonical `[:error, message_string]`
+      # Array so the same wrapper short-circuits subsequent runs against unchanged broken input.
+      def output_for(plugin, callable, path, cache_store)
+        return invoke_safely(callable, path) if cache_store.nil?
+        return invoke_safely(callable, path) unless File.file?(path)
+
+        descriptor = cache_descriptor(plugin, path)
+        return invoke_safely(callable, path) if descriptor.nil?
+
+        cache_store.fetch_or_compute(
+          producer_id: PRODUCER_ID,
+          params: {},
+          descriptor: descriptor,
+          generation_cap: generation_cap
+        ) { invoke_safely(callable, path) || "" }
+      end
+
+      # Issue #1536 — every synthesizer's output for `path`, reduced to one value: {NO_CONTRIBUTION} when none
+      # of them contributes anything, a SHA-256 hex digest of each plugin's id and {.contribution} otherwise,
+      # and nil when an output could not be read at all.
+      #
+      # nil means "unknown", and a caller must treat it as moved. Every failure is per file: one plugin that
+      # cannot answer for one file leaves every other file's digest intact.
+      #
+      # @param synthesizers — `Plugin::Registry#source_rbs_synthesizers` pairs.
+      def digest(synthesizers, path, cache_store)
+        sha = Digest::SHA256.new
+        contributed = false
+        synthesizers.each do |plugin, callable|
+          tag, text = contribution(output_for(plugin, callable, path, cache_store))
+          next if tag.nil?
+
+          contributed = true
+          sha << plugin.manifest.id.to_s.b << "\x00" << tag << "\x00" << text.to_s.b << "\x01"
+        end
+        contributed ? sha.hexdigest : NO_CONTRIBUTION
+      rescue StandardError
+        nil
+      end
+
+      # What one output puts into the environment, as a `[tag, text]` pair, or nil for nothing: exactly the
+      # RBS {Environment.interpret_synthesizer_outcome} hands the loader. The ADR-32 WD6 / WD12 notices are left
+      # out. They reach only the run-level `source-rbs-*` rows, which every run regenerates and the per-file
+      # cache never serves, and they quote line numbers, so a line shift in a file carrying a malformed `#:`
+      # would otherwise read as a moved contribution. A failed synthesis contributes nothing to the loader but
+      # is kept as one stable value of its own, so a file flipping between "no annotation" and "broken
+      # annotation" still reads as moved. Any shape the contract does not name is digested whole, by value: the
+      # output is computed on one run and served from its cache entry on the next, and a digest of its
+      # `Marshal.dump` bytes can differ between the two (issue #1574).
+      #
+      # The RBS text itself is digested whole, comments included. RBS reads a `# resolve-type-names: false`
+      # magic comment at the start of a buffer, rbs-inline copies a `.rb` file's first comment line there, and
+      # a string-literal type may span lines that start with `#`, so no line-based stripping is sound (#1549).
+      def contribution(output)
+        return nil if output.nil? || output == ""
+        return ["rbs", output] if output.is_a?(String)
+        return ["raw", Cache::ValueDigest.hexdigest(output)] unless output.is_a?(Array)
+
+        case output[0]
+        when :error then ["error", nil]
+        when :ok then contribution(output[1])
+        else ["raw", Cache::ValueDigest.hexdigest(output)]
+        end
+      end
+
+      # One entry per (plugin, source file), all of them live for as long as the file is in the project — a
+      # generation count says nothing about staleness here, so this producer declares itself out of
+      # `Cache::Store#evict!`'s compaction pass and is bounded only by the size-based LRU pass. A method
+      # rather than a constant: `Cache::Store` is not loaded yet when this file is.
+      def generation_cap
+        Cache::Store::UNBOUNDED_GENERATIONS
+      end
+
+      # The key composes the file's content SHA with the plugin's `PluginEntry` (id + version + config_hash),
+      # so a config change or a content change invalidates the entry, and with the engine's source identity
+      # (issue #1009): a plugin's manifest version does not move when a checkout edits its synthesizer, and
+      # a stale string here also keeps the `rbs.virtual_rbs` env key warm, so the new build's rules would
+      # read the old build's RBS.
+      def cache_descriptor(plugin, path)
+        Cache::Descriptor.new(
+          files: [Cache::Descriptor::FileEntry.new(
+            path: path.to_s,
+            comparator: :digest,
+            value: input_digest(path)
+          )],
+          plugins: [plugin.plugin_entry],
+          configs: Cache::EngineSource.key_config_entries
+        )
+      rescue Cache::EngineSource::Unavailable
+        # An engine that cannot be identified must not be keyed by its inputs alone (issue #1009): nil runs the
+        # synthesizer uncached rather than serving an entry another build may have written.
+        nil
+      end
+
+      def input_digest(path)
+        Digest::SHA256.hexdigest(File.binread(path))
+      rescue ::SystemCallError
+        # Unreadable file → key on the path alone; the synthesizer's File.file?/File.read will see the same
+        # failure and return nil.
+        Digest::SHA256.hexdigest(path.to_s)
+      end
+
+      def invoke_safely(callable, path)
+        callable.call(path.to_s)
+      rescue StandardError
+        # WD6 fail-soft — a synthesizer that raises does NOT crash analysis. Unlike the `[:error, msg]`
+        # return path (which the runner surfaces as `source-rbs-synthesis-failed`), an unhandled raise is
+        # swallowed silently; the unexamined-raise channel is deliberately silent per WD6.
+        nil
+      end
+
+      private_class_method :contribution, :generation_cap, :cache_descriptor, :input_digest, :invoke_safely
+    end
+  end
+end

data/lib/rigor/environment.rb

@@ -3,6 +3,7 @@
 require "digest"
 
 require_relative "environment/default_libraries"
+require_relative "environment/required_features"
 require_relative "environment/class_registry"
 require_relative "environment/rbs_loader"
 require_relative "environment/reflection"
@@ -15,6 +16,7 @@ require_relative "environment/bundle_sig_discovery"
 require_relative "environment/lockfile_resolver"
 require_relative "environment/installed_gem_set"
 require_relative "environment/rbs_collection_discovery"
+require_relative "environment/source_rbs_synthesis"
 require_relative "plugin/isolation"
 require_relative "cache/engine_source"
 require_relative "environment/rbs_coverage_report"
@@ -274,8 +276,8 @@ module Rigor
                       bundler_lockfile: nil,
                       rbs_collection_lockfile: nil, rbs_collection_auto_detect: false,
                       synthetic_method_index: nil, project_patched_methods: nil,
-                      source_files: [], locked_gems: nil)
-        resolved_paths = signature_paths || default_signature_paths(root)
+                      source_files: [], locked_gems: nil, required_features: nil)
+        resolved_paths = project_signature_roots(signature_paths, root: root)
         # O4 MVP — append per-gem `sig/` directories discovered under the target project's bundler install
         # root. Empty array when neither an explicit path nor auto-detection finds a bundle. Order: user
         # `signature_paths:` win first (semantic precedence inside `RbsLoader.build_env_for`); gem-shipped
@@ -313,8 +315,10 @@ module Rigor
         # and the `data/vendored_gem_sigs/` bundle (`redis`, `nokogiri`, `pg`, …). `skip_gem_names:` passes
         # both sets so the collection copy doesn't double-declare against rigor's bundled RBS (the
         # `RBS::DuplicatedDeclarationError` hazard).
-        merged_libraries = (DEFAULT_LIBRARIES + libraries.map(&:to_s)).uniq
-        skip_gem_names = merged_libraries + RbsLoader.vendored_gem_names
+        # Issue #1700 — plus the gated vendored directories this run's source activates ({#feature_tokens}).
+        merged_libraries = (DEFAULT_LIBRARIES + libraries.map(&:to_s) +
+                            feature_tokens(required_features, source_files, libraries)).uniq
+        skip_gem_names = collection_skip_gem_names(merged_libraries)
         collection_paths = RbsCollectionDiscovery.discover(
           lockfile_path: rbs_collection_lockfile,
           project_root: root,
@@ -390,8 +394,30 @@ module Rigor
         )
       end
 
+      # The project-owned `sig/` roots a run reads: the explicit `signature_paths:` when given, else the
+      # auto-detected `<root>/sig` (or none). Public so {Cache::IncrementalSnapshot} digests exactly the
+      # directories the environment loads, including the auto-detected one a `nil` `signature_paths:` hides.
+      def project_signature_roots(signature_paths, root: Dir.pwd)
+        signature_paths || default_signature_paths(root)
+      end
+
       private
 
+      # Issue #1700 — the `RequiredFeatures` library tokens for the gated vendored directories this run asks for:
+      # each feature its source requires and each one the configuration's `libraries:` names. `required_features`
+      # is the scan a caller already took; nil scans `source_files`. Whether a directory then loads is decided
+      # by `RbsLoader.build_env_for` against the environment it builds.
+      def feature_tokens(required_features, source_files, libraries)
+        RequiredFeatures.tokens(required_features || RequiredFeatures.scan(source_files), libraries)
+      end
+
+      # The gem names an `rbs collection` copy must not double-declare against: the library list and every
+      # vendored directory except a `RequiredFeatures`-gated one. A gated directory stands down for any other
+      # copy of its declarations (`GatedSignatureGuard`), so the collection's copy is kept and wins.
+      def collection_skip_gem_names(library_names)
+        library_names + RbsLoader.vendored_gem_names.reject { |name| RequiredFeatures.gated_dir?(name) }
+      end
+
       def default_signature_paths(root)
         sig = Pathname(root) / DEFAULT_PROJECT_SIG_DIR
         sig.directory? ? [sig] : []
@@ -496,11 +522,9 @@ module Rigor
       # empty and this method short-circuits to `[]` without walking the file list.
       #
       # WD5 — when `cache_store` is supplied, each (file, plugin) synthesizer call is memoised through
-      # `Cache::Store`. The cache key composes the file's content SHA with the plugin's `PluginEntry` (id +
-      # version + config_hash) so a config change or content change invalidates the entry automatically, and
-      # with the engine's source identity (issue #1009): a plugin's manifest version does not move when a
-      # checkout edits its synthesizer, and a stale string here also keeps the `rbs.virtual_rbs` env key warm,
-      # so the new build's rules would read the old build's RBS.
+      # `Cache::Store` ({SourceRbsSynthesis.output_for}, which owns the key). The incremental session's
+      # per-file digest (issue #1536) reads the same function, so the two can never disagree on what a file
+      # contributed.
       def collect_virtual_rbs(plugin_registry, source_files, cache_store, reporter)
         return [] if plugin_registry.nil?
 
@@ -511,7 +535,7 @@ module Rigor
         result = []
         source_files.each do |path|
           synthesizers.each do |plugin, callable|
-            outcome = synthesizer_output_for(plugin, callable, path, cache_store)
+            outcome = SourceRbsSynthesis.output_for(plugin, callable, path, cache_store)
             outcome = interpret_synthesizer_outcome(outcome, plugin, path, reporter)
             next if outcome.nil? || outcome.empty?
 
@@ -522,25 +546,6 @@ module Rigor
         result
       end
 
-      # ADR-32 WD5 — cache wrapper around a single (plugin, file) invocation. The cache stores the empty
-      # string `""` as the "no contribution" sentinel because `Cache::Store` treats `nil` as a cache miss.
-      # Error tuples are stored as the canonical `[:error, message_string]` Array so the same wrapper
-      # short-circuits subsequent runs against unchanged broken input.
-      def synthesizer_output_for(plugin, callable, path, cache_store)
-        return invoke_synthesizer_safely(callable, path) if cache_store.nil?
-        return invoke_synthesizer_safely(callable, path) unless File.file?(path)
-
-        descriptor = build_synthesizer_cache_descriptor(plugin, path)
-        return invoke_synthesizer_safely(callable, path) if descriptor.nil?
-
-        cache_store.fetch_or_compute(
-          producer_id: SYNTHESIZER_CACHE_PRODUCER_ID,
-          params: {},
-          descriptor: descriptor,
-          generation_cap: synthesizer_generation_cap
-        ) { invoke_synthesizer_safely(callable, path) || "" }
-      end
-
       # ADR-32 WD6 / WD12 — route a synthesizer return value through the per-run reporter. The
       # synthesizer's contract (declared in
       # `plugins/rigor-rbs-inline/lib/rigor/plugin/rbs_inline.rb`) admits four return shapes:
@@ -661,50 +666,6 @@ module Rigor
         prefix = "#{root}#{File::SEPARATOR}"
         path.to_s.start_with?(prefix) ? path.to_s.delete_prefix(prefix) : path.to_s
       end
-
-      SYNTHESIZER_CACHE_PRODUCER_ID = "plugin.source_rbs_synthesizer"
-      private_constant :SYNTHESIZER_CACHE_PRODUCER_ID
-
-      # One entry per (plugin, source file), all of them live for as long as the file is in the project — a
-      # generation count says nothing about staleness here, so this producer declares itself out of
-      # `Cache::Store#evict!`'s compaction pass and is bounded only by the size-based LRU pass. A method
-      # rather than a constant: `Cache::Store` is not loaded yet when this class body runs.
-      def synthesizer_generation_cap
-        Cache::Store::UNBOUNDED_GENERATIONS
-      end
-
-      def build_synthesizer_cache_descriptor(plugin, path)
-        Cache::Descriptor.new(
-          files: [Cache::Descriptor::FileEntry.new(
-            path: path.to_s,
-            comparator: :digest,
-            value: synthesizer_input_digest(path)
-          )],
-          plugins: [plugin.plugin_entry],
-          configs: Cache::EngineSource.key_config_entries
-        )
-      rescue Cache::EngineSource::Unavailable
-        # An engine that cannot be identified must not be keyed by its inputs alone (issue #1009): nil runs the
-        # synthesizer uncached rather than serving an entry another build may have written.
-        nil
-      end
-
-      def synthesizer_input_digest(path)
-        Digest::SHA256.hexdigest(File.binread(path))
-      rescue ::SystemCallError
-        # Unreadable file → key on the path alone; the synthesizer's File.file?/File.read will see the same
-        # failure and return nil.
-        Digest::SHA256.hexdigest(path.to_s)
-      end
-
-      def invoke_synthesizer_safely(callable, path)
-        callable.call(path.to_s)
-      rescue StandardError
-        # WD6 fail-soft — a synthesizer that raises does NOT crash analysis. Unlike the `[:error, msg]`
-        # return path (which the runner surfaces as `source-rbs-synthesis-failed`), an unhandled raise is
-        # swallowed silently; the unexamined-raise channel is deliberately silent per WD6.
-        nil
-      end
     end
 
     # Resolves a constant name to a Rigor::Type::Nominal (the *instance* type carrier). Consults the static

data/lib/rigor/inference/acceptance.rb

@@ -486,7 +486,17 @@ module Rigor
             )
           end
 
-          nil
+          project_sequence_to_enumerator(self_type, other_type)
+        end
+
+        # `Enumerator::ArithmeticSequence[E]` carries only the element of its `Enumerator[Numeric, void]` superclass
+        # (#1794), so against a two-argument `Enumerator` it projects to `Enumerator[E, top]`, `top` being what RBS
+        # `void` translates to: `Enumerator[Integer, void]` and `[Integer, untyped]` accept it, as RBS would.
+        def project_sequence_to_enumerator(self_type, other_type)
+          return nil unless self_type.class_name == "Enumerator" && self_type.type_args.size == 2
+          return nil unless other_type.class_name == "Enumerator::ArithmeticSequence" && other_type.type_args.size == 1
+
+          Type::Combinator.nominal_of("Enumerator", type_args: [other_type.type_args.first, Type::Combinator.top])
         end
 
         def project_tuple_to_nominal(tuple)
@@ -963,11 +973,14 @@ module Rigor
           end
         end
 
-        # Constant[v] accepts only Constant[v'] with structurally equal value. Any other type is rejected
-        # (modulo the universal Bot/Dynamic short-circuits already applied upstream).
+        # Constant[v] accepts Constant[v'] with structurally equal value, and the plain nominal of a class whose
+        # only instance is `v`. Any other type is rejected (modulo the universal Bot/Dynamic short-circuits
+        # already applied upstream).
         def accepts_constant(self_type, other_type, mode)
           if other_type.is_a?(Type::Constant) && self_type == other_type
             Type::AcceptsResult.yes(mode: mode, reasons: "structural literal match")
+          elsif sole_instance_nominal?(self_type, other_type)
+            Type::AcceptsResult.yes(mode: mode, reasons: "#{other_type.class_name} has no instance but the literal")
           else
             Type::AcceptsResult.no(
               mode: mode,
@@ -976,6 +989,18 @@ module Rigor
           end
         end
 
+        # `true`, `false` and `nil` are the only instances of their classes, so `FalseClass` holds exactly the
+        # values `false` holds. Read apart, `Array.new(n, false)`, typed `Array[FalseClass]` through the
+        # `[T] (Integer, T)` binding, failed a declared `-> Array[bool]` and fired `def.return-type-mismatch` on
+        # correct code.
+        SOLE_INSTANCE_CLASSES = { true => "TrueClass", false => "FalseClass", nil => "NilClass" }.freeze
+        private_constant :SOLE_INSTANCE_CLASSES
+
+        def sole_instance_nominal?(constant, other_type)
+          other_type.is_a?(Type::Nominal) && other_type.type_args.empty? &&
+            SOLE_INSTANCE_CLASSES.key?(constant.value) && SOLE_INSTANCE_CLASSES[constant.value] == other_type.class_name
+        end
+
         # Tuple[A1..An] accepts:
         # - Tuple[B1..Bn] when arities match and each Ai accepts Bi (covariant per-position).
         # - Anything else: no (we cannot prove the arity from a generic nominal alone).

data/lib/rigor/inference/block_parameter_binder.rb

@@ -54,14 +54,16 @@ module Rigor
         reset_per_bind_state
       end
 
-      # The names the last {#bind} bound optimistically nil-free (see the class comment).
+      # The names the last {#bind} bound optimistically nil-free (see the class comment). Read-only: it is a
+      # shared frozen empty when the bind marked nothing.
       attr_reader :optimistic
 
       # Binds the block's parameters into `scope`: {#bind}'s types through `Scope#with_local`, then the
-      # optimistic mark for every name in {#optimistic}.
+      # optimistic mark for every name in {#optimistic}. It applies them through
+      # {MultiTargetBinder.apply_bindings} directly rather than through a `Result`, which every block entry
+      # built only to apply at once ([#1504](https://github.com/rigortype/rigor/issues/1504)).
       def bind_onto(block_node, scope)
-        types = bind(block_node, scope: scope)
-        MultiTargetBinder::Result.new(types: types, optimistic: @optimistic.dup.freeze).apply_to(scope)
+        MultiTargetBinder.apply_bindings(scope, bind(block_node, scope: scope), @optimistic)
       end
 
       # @return ordered map from parameter name to bound type. Anonymous
@@ -90,29 +92,40 @@ module Rigor
 
       private
 
+      NO_POSITIONS = [].freeze
+      NO_NAMES = [].freeze
+      private_constant :NO_POSITIONS, :NO_NAMES
+
       # {#apply_auto_splat} rewrites the positional table for the block it is binding, so every {#bind} starts
       # from the declared types again; a binder reused across blocks must not see the previous block's splat.
+      # The two lists start as shared frozen empties, since most blocks mark nothing ({#mark_optimistic}).
       def reset_per_bind_state
         @expected_param_types = @declared_param_types
         @splat_rest_type = nil
-        @optimistic_positions = []
-        @optimistic = []
+        @optimistic_positions = NO_POSITIONS
+        @optimistic = NO_NAMES
         @scope = nil
       end
 
+      # Records `name` as bound optimistically, allocating {#optimistic} on the first mark of a {#bind}.
+      def mark_optimistic(name)
+        @optimistic = [] if @optimistic.equal?(NO_NAMES)
+        @optimistic << name
+      end
+
       # `|_1, _2|` numbered-parameter form. Prism exposes the implicit count through
       # `NumberedParametersNode#maximum` (the highest `_N` referenced in the body); we materialise bindings
       # for `:_1` through `:_maximum`, auto-splatting exactly as the explicit list of that many required
       # positionals would, so the body's `LocalVariableReadNode` lookups see the same types and marks.
       def bind_numbered_parameters(numbered_node)
         arity = numbered_node.maximum
-        apply_auto_splat(BlockAutoSplat::ParameterShape.of_arity(arity))
+        apply_auto_splat { BlockAutoSplat::ParameterShape.of_arity(arity) }
 
         bindings = {}
         arity.times do |i|
           name = :"_#{i + 1}"
           bindings[name] = positional_type_at(i)
-          @optimistic << name if @optimistic_positions.include?(i)
+          mark_optimistic(name) if @optimistic_positions.include?(i)
         end
         bindings
       end
@@ -127,7 +140,7 @@ module Rigor
         params_node = params_root.parameters
         return {} if params_node.nil?
 
-        apply_auto_splat(BlockAutoSplat::ParameterShape.of(params_node))
+        apply_auto_splat { BlockAutoSplat::ParameterShape.of(params_node) }
 
         bindings = {}
         bind_positionals(params_node, bindings, 0)
@@ -152,9 +165,12 @@ module Rigor
       # and {BlockAutoSplat} answers a table for that value and `shape`. A multi-arg yield (e.g.
       # `each_with_index`'s `(element, index)` pair) is NOT auto-splatted — matching Ruby semantics where a
       # multi-arg yield to a `|a, b, c|` block fills the extra slot with nil rather than splatting any
-      # element.
-      def apply_auto_splat(shape)
+      # element. The block answers the parameter list's shape, built only past that test
+      # ([#1504](https://github.com/rigortype/rigor/issues/1504)).
+      def apply_auto_splat
         return unless @expected_param_types.size == 1
+
+        shape = yield
         return unless shape.splats?
 
         table = BlockAutoSplat.for(shape, @expected_param_types[0])
@@ -242,12 +258,12 @@ module Rigor
         case param
         when Prism::RequiredParameterNode
           bindings[param.name] = positional_type_at(cursor)
-          @optimistic << param.name if @optimistic_positions.include?(cursor)
+          mark_optimistic(param.name) if @optimistic_positions.include?(cursor)
         when Prism::MultiTargetNode
           nested = MultiTargetBinder.bind_marked(param, positional_type_at(cursor),
                                                  optimistic: @optimistic_positions.include?(cursor), scope: @scope)
           bindings.merge!(nested.types)
-          @optimistic.concat(nested.optimistic)
+          nested.optimistic.each { |name| mark_optimistic(name) }
         end
       end
 

data/lib/rigor/inference/builtins/cruby_definers.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "yaml"
+require_relative "method_catalog"
+
+module Rigor
+  module Inference
+    module Builtins
+      # Issue #1740 — which instance methods CRuby itself defines on a core class or module, read from the offline
+      # catalogues under `data/builtins/ruby_core/` (`tool/extract_builtin_catalog.rb` records each `rb_define_method`
+      # and prelude `def` of an `Init_*` function on the class it names, aliases included). A registration inside an
+      # `#if 0` block CRuby keeps for RDoc carries `rdoc_only: true` and is left out: `random.c`'s registers
+      # `Random#seed` on `Random`, though it runs on `Random::Base`.
+      # `spec/rigor/inference/builtins/c_ruby_definers_spec.rb` checks every listed method the running Ruby has
+      # against its runtime owner. RBS is not that record: core RBS redeclares some inherited methods on a subclass
+      # (`Integer#quo` and `File#to_path`, whose CRuby owners are `Numeric` and `IO`), and declares a few CRuby no
+      # longer defines (`Process::Status#&`). A class no catalogue covers answers false, as does a method its
+      # catalogue does not list: the caller reads both as "not proven". The catalogue is one CRuby snapshot.
+      module CRubyDefiners
+        module_function
+
+        # Does the catalogue prove CRuby defines `method_name` on `class_name` itself?
+        def defines?(class_name, method_name)
+          names = INDEX[class_name.to_s.delete_prefix("::")]
+          !names.nil? && names.include?(method_name.to_s)
+        end
+
+        def build_index
+          index = Hash.new { |hash, key| hash[key] = Set.new }
+          MethodCatalog.topic_paths.each do |path|
+            data = YAML.safe_load_file(path, permitted_classes: [Symbol])
+            classes = data.is_a?(Hash) ? data["classes"] : nil
+            next unless classes.is_a?(Hash)
+
+            classes.each do |name, klass|
+              next if klass["rdoc_only"]
+
+              names = index[name]
+              names.merge(defined_names(klass["instance_methods"]))
+              names.merge(defined_names(klass["aliases"]))
+            end
+          end
+          Ractor.make_shareable(index.to_h { |name, names| [name, names.freeze] })
+        rescue Psych::SyntaxError, SystemCallError
+          Ractor.make_shareable({})
+        end
+
+        # The names of `entries` CRuby defines at runtime: one the catalogue marks `rdoc_only` was registered only for
+        # RDoc, inside an `#if 0` block.
+        def defined_names(entries)
+          return [] unless entries.is_a?(Hash)
+
+          entries.filter_map { |method, entry| method unless entry.is_a?(Hash) && entry["rdoc_only"] }
+        end
+
+        INDEX = build_index
+        private_constant :INDEX
+      end
+    end
+  end
+end

data/lib/rigor/inference/builtins/method_catalog.rb

@@ -48,6 +48,9 @@ module Rigor
           new(path: File.join(DATA_ROOT, "#{topic}.yml"), mutating_selectors: mutating_selectors)
         end
 
+        # Every catalogue file under {DATA_ROOT}, in a stable order.
+        def self.topic_paths = Dir[File.join(DATA_ROOT, "*.yml")]
+
         def initialize(path:, mutating_selectors: {})
           @path = path
           @mutating_selectors = mutating_selectors.transform_values(&:freeze).freeze

data/lib/rigor/inference/captured_locals.rb

@@ -413,10 +413,16 @@ module Rigor
       NESTED_SCOPE_NODES = Set[Prism::BlockNode, Prism::LambdaNode].freeze
       private_constant :NESTED_SCOPE_NODES
 
+      # The index arm spells {INDEX_STORE_NODES} out rather than splatting it: `when *ARRAY` copies the array
+      # on every evaluation, and this runs once per node of every scanned block body, which cost `rigor check`
+      # about 126K allocations over the v0.3.9 `lib` ([#1502](https://github.com/rigortype/rigor/issues/1502),
+      # the shape `ScopeIndexer::META_CONSTANT_WRITE_NODES` records). Keep the arm and the list in step.
       def mutated_receiver(node)
         case node
         when Prism::CallNode then node.receiver if MutationWidening::SHAPE_MUTATORS.include?(node.name)
-        when *INDEX_STORE_NODES then node.receiver
+        when Prism::IndexOrWriteNode, Prism::IndexAndWriteNode, Prism::IndexOperatorWriteNode,
+             Prism::IndexTargetNode
+          node.receiver
         end
       end