rigortype 0.4.0 → 0.4.2

data/lib/rigor/inference/expression_typer.rb

@@ -28,6 +28,7 @@ require_relative "fallback"
 require_relative "flow_tracer"
 require_relative "index_write_widening"
 require_relative "indexed_narrowing"
+require_relative "key_presence_guard"
 require_relative "jump_targets"
 require_relative "define_method_block_self"
 require_relative "macro_block_self_type"
@@ -39,6 +40,7 @@ require_relative "optimistic_origin"
 require_relative "receiver_alias"
 require_relative "repeated_or_writes"
 require_relative "singleton_object_constant"
+require_relative "refined_dispatch"
 require_relative "stored_block_call"
 require_relative "struct_fold_safety"
 require_relative "unknown_store_widening"
@@ -648,7 +650,12 @@ module Rigor
       # `StatementEvaluator` at class-body and method-body boundaries) or `Dynamic[Top]` at the top level.
       # Class-body `self` is `Singleton[<class>]`; instance-method `self` is `Nominal[<class>]`;
       # singleton-method `self` is `Singleton[<class>]`.
+      #
+      # Issue #1763 — directly in a `refine X` block body `self` is the refinement module, which Rigor does not
+      # model; its `Singleton[X]` stand-in serves implicit-self calls only, so a value read of `self` is untyped.
       def type_of_self_node(_node)
+        return dynamic_top if scope.refinement_block_self?
+
         scope.self_type || dynamic_top
       end
 
@@ -1811,7 +1818,8 @@ module Rigor
       # that normal return is `untyped` — the result's declared type — so `loop { e.next }` is not `bot` and
       # `loop { x = e.next; break x if x }` keeps its arm beside it.
       def call_dispatch_type_for(node, receiver_override: nil)
-        result = loop_completion_type(node, call_result_type_for(node, receiver_override: receiver_override))
+        result = key_guarded_type(node, call_result_type_for(node, receiver_override: receiver_override))
+        result = loop_completion_type(node, result)
         arms = call_break_arm_types(node, receiver_override: receiver_override)
         if exactly_once_block_never_completes?(node, receiver_override)
           return arms.empty? ? Type::Combinator.bot : Type::Combinator.union(*arms)
@@ -1821,6 +1829,15 @@ module Rigor
         widen_optimistic_predicate_constant(node, combined)
       end
 
+      # Issue #1703 — `H[k]` under a true `H.key?(k)` with a non-literal key drops the miss `nil`
+      # ({KeyPresenceGuard.guarded_read}). Only inside the guarded re-walk `call.possible-nil-receiver` runs to
+      # decide whether to withhold a report; the analysis every other rule reads never records a guard.
+      def key_guarded_type(node, type)
+        return type unless node.name == :[]
+
+        KeyPresenceGuard.guarded_read(node, type, scope) || type
+      end
+
       # Issue #1172 — the nil-collapsing predicates (`nil?`, `!`, `x == nil`, …) answer a `Constant` that
       # encodes the receiver's nil-freeness. When that nil-freeness is only *optimistic* — an
       # `%a{implicitly-returns-nil}` read `RbsDispatch` deliberately reads past — the constant is a bet,
@@ -1896,6 +1913,9 @@ module Rigor
         # asks nothing further of dispatch. Off (the default) this is one integer read.
         Effects::Collector.record_call(node, receiver, scope) if Effects::Collector.active?
 
+        refined = try_refined_dispatch(node, receiver, arg_types, block_type)
+        return refined if refined
+
         literal_send = try_literal_send(node, receiver)
         return literal_send if literal_send
 
@@ -1927,6 +1947,155 @@ module Rigor
         dispatch_miss_result(node, receiver, arg_types, block_type)
       end
 
+      # ADR-121 WD2 (issue #1664) — a call through an in-effect Ruby refinement, typed from the winning refine body
+      # with the call's receiver as `self`, ahead of every tier below: each answers from the method the refinement
+      # replaces (a refined `String#upcase` must not fold, a refined `map` must not fold per element, a top-level
+      # `def` must not bind ahead of a refinement of `Object`, a plugin models the class's own method). An unreadable
+      # body, or a list that may hold any refinement, answers `Dynamic[top]`, never the replaced method's signature.
+      # A union receiver is decided per member; a `Dynamic` receiver, a class object and a call no refinement wins
+      # fall through. A call site no refinement is in effect at answers nil at once and records nothing: its answer
+      # cannot change without an edit to its own file.
+      #
+      # ADR-121 WD7 (A2) — inside the span of an activation that puts an opaque module in effect
+      # ({InEffectRefinements.opaque_module?}), any method of any instance may be replaced, so every instance-receiver
+      # call answers `Dynamic[top]`; a class object falls through, as it does below.
+      def try_refined_dispatch(node, receiver, arg_types, block_type)
+        list = scope.in_effect_refinements(node)
+        return nil if list.empty?
+
+        InEffectRefinements.record_refinement_names(node.name)
+        return dynamic_top if refined_instance_receiver?(receiver) && opaque_refinement_span?(node, list)
+        return nil if scope.discovered_refinements.empty?
+
+        refined_indirect_result(node, receiver, list) ||
+          refined_receiver_result(node, receiver, list, arg_types, block_type)
+      end
+
+      # ADR-121 WD4 — `send` / `__send__` / `public_send` with a literal name, `respond_to?` and `method` /
+      # `public_method` with one, and a `&:name` block argument honour refinements too (CRuby `test_refinement.rb`;
+      # probed on Ruby 4.0.5). When the name they reach is refined in effect for the receiver they answer
+      # `Dynamic[top]`: typing them through the arm is deferred, and `respond_to?` must never fold to `false`. A
+      # `&:name` block's receiver is the yielded element, which is not known here, so any in-effect refinement of the
+      # name answers. Only `methods` ignores refinements and keeps its answer.
+      def refined_indirect_result(node, receiver, list)
+        name = REFINED_NAMING_CALLS.include?(node.name) ? literal_method_name_argument(node) : nil
+        return dynamic_top if name && refined_name_for?(receiver, name, list)
+
+        block_name = symbol_block_argument(node)
+        dynamic_top if block_name && refined_anywhere?(block_name, list)
+      end
+
+      REFINED_NAMING_CALLS = Set[:send, :__send__, :public_send, :respond_to?, :method, :public_method].freeze
+      private_constant :REFINED_NAMING_CALLS
+
+      def literal_method_name_argument(node)
+        argument = node.arguments&.arguments&.first
+        name = argument.unescaped if argument.is_a?(Prism::SymbolNode) || argument.is_a?(Prism::StringNode)
+        return nil if name.nil?
+
+        name = name.to_sym
+        InEffectRefinements.record_refinement_names(name)
+        name
+      end
+
+      def symbol_block_argument(node)
+        block = node.block
+        return nil unless block.is_a?(Prism::BlockArgumentNode) && block.expression.is_a?(Prism::SymbolNode)
+
+        name = block.expression.unescaped.to_sym
+        InEffectRefinements.record_refinement_names(name)
+        name
+      end
+
+      def refined_name_for?(receiver, name, list)
+        members = receiver.is_a?(Type::Union) ? receiver.members : [receiver]
+        members.any? do |member|
+          class_name = refined_receiver_class_name(member)
+          !class_name.nil? && !RefinedDispatch.winner(scope, class_name, name, list).nil?
+        end
+      end
+
+      # ADR-121 WD7 — a names-wildcard row counts as a refinement of every name.
+      def refined_anywhere?(name, list)
+        refinements = scope.discovered_refinements
+        wildcard = Scope::DiscoveryIndex::REFINEMENT_WILDCARD
+        return true if list.include?(InEffectRefinements::UNKNOWN) &&
+                       refinements.any? { |_refined, methods| methods.key?(name) || methods.key?(wildcard) }
+
+        !RefinedDispatch.targets(refinements, name, list).nil? ||
+          !RefinedDispatch.targets(refinements, wildcard, list).nil?
+      end
+
+      # ADR-121 WD7 — does the call's lexical list (a plugin-declared module is the plugin's declaration and never
+      # opaque) hold an opaque module? `list` is the full list, which is the lexical one when nothing is declared.
+      def opaque_refinement_span?(node, list)
+        lexical = scope.declared_refinements.empty? ? list : scope.in_effect_refinements(node, InEffectRefinements::EMPTY)
+        InEffectRefinements.opaque_in?(scope, lexical)
+      end
+
+      # Does `receiver` (or a member of a union) have a class the refined arm answers for: an instance, not a class
+      # object or `Dynamic`?
+      def refined_instance_receiver?(receiver)
+        members = receiver.is_a?(Type::Union) ? receiver.members : [receiver]
+        members.any? { |member| !refined_receiver_class_name(member).nil? }
+      end
+
+      def refined_receiver_result(node, receiver, list, arg_types, block_type)
+        return refined_member_result(node, receiver, list, arg_types, block_type) unless receiver.is_a?(Type::Union)
+
+        answers = receiver.members.map { |member| refined_member_result(node, member, list, arg_types, block_type) }
+        return nil if answers.none?
+
+        members = receiver.members.each_with_index.map do |member, index|
+          answers[index] || call_result_type_for(node, receiver_override: member)
+        end
+        Type::Combinator.union(*members)
+      end
+
+      def refined_member_result(node, receiver, list, arg_types, block_type)
+        class_name = refined_receiver_class_name(receiver)
+        return nil if class_name.nil?
+
+        winner = RefinedDispatch.winner(scope, class_name, node.name, list)
+        return nil if winner.nil?
+        return dynamic_top if winner == RefinedDispatch::UNKNOWN
+
+        refined_body_return(winner, node.name, Type::Combinator.nominal_of(class_name), arg_types, block_type) ||
+          dynamic_top
+      end
+
+      # The winning refine body's inferred return, re-typed with the receiver's class as `self` and the call's
+      # argument types bound as an undeclared method's are; nil when the body is not readable here.
+      #
+      # A body another file wrote is re-typed with that file's in-effect refinements at the `def` (its own module
+      # among them), so a sibling override it calls answers from its refine body too.
+      def refined_body_return(winner, method_name, self_type, arg_types, block_type)
+        def_node, foreign =
+          InEffectRefinements.refinement_def_with_query(scope, winner.module_name, winner.refined_class, method_name)
+        return nil if def_node.nil?
+
+        refinements = foreign&.at(def_node.location.start_offset) do |name|
+          InEffectRefinements.activated_modules(scope, name)
+        end
+        infer_user_method_return(def_node, self_type, arg_types, yield_type: block_type, refinements: refinements)
+      rescue StandardError
+        nil
+      end
+
+      # The class an instance-side receiver is an instance of, or nil for one a refinement does not answer here: a
+      # class object (refinements of singleton classes are not recorded), `Dynamic`, `top`, or a shape with no class.
+      def refined_receiver_class_name(receiver)
+        case receiver
+        when Type::Nominal, Type::StructInstance, Type::DataInstance then receiver.class_name
+        when Type::Constant then receiver.value.class.name
+        when Type::Tuple then "Array"
+        when Type::HashShape then "Hash"
+        when Type::IntegerRange then "Integer"
+        when Type::FloatRange then "Float"
+        when Type::Refined, Type::Difference then refined_receiver_class_name(receiver.base)
+        end
+      end
+
       # The post-dispatch tiers for a call `MethodDispatcher` could not answer, in their historical
       # order; extracted from {#call_dispatch_type_for} whole.
       def dispatch_miss_result(node, receiver, arg_types, block_type = nil)
@@ -2280,8 +2449,8 @@ module Rigor
       def try_user_method_inference(receiver, call_node, arg_types, method_name: call_node.name, block_type: nil)
         return nil unless user_inference_receiver?(receiver)
 
-        def_node, owner = resolve_user_def_with_owner(receiver.class_name, method_name)
-        return nil if def_node.nil?
+        def_node, owner, raising = resolve_typing_def_with_owner(receiver.class_name, method_name)
+        return every_definer_raises_type(raising, receiver, call_node, arg_types, block_type) if def_node.nil?
 
         result = infer_user_method_return(def_node, receiver, arg_types,
                                           self_fold_safe: fold_safe_call_receiver?(call_node, receiver),
@@ -2383,8 +2552,7 @@ module Rigor
         key = method_name.to_sym
         return table[key] if table.key?(key)
 
-        table[key] = scope.singleton_def_through_ancestors(class_name, method_name,
-                                                           name_memo: class_graph_buckets[:name])
+        table[key] = scope.singleton_def_through_ancestors(class_name, method_name)
       end
 
       # The project-side singleton-method band: a `Foo.bar` call resolved against a `class << …` / `def self.…`
@@ -2415,13 +2583,12 @@ module Rigor
         nil
       end
 
-      # ADR-24 slice 2 — resolves `method_name` against `class_name`'s own `def`s, then walks the user-class
-      # ancestor chain: included / prepended modules (transitive) and the superclass chain. RBS-known
-      # ancestors are NOT walked here — the `MethodDispatcher` RBS tier runs before
-      # `try_user_method_inference` and already covers them; an ancestor name that resolves to no
-      # project-discovered class/module ends that branch. Cross-file: the chain is followed through
-      # `Scope#discovered_superclasses` / `#discovered_includes` / `#discovered_def_nodes`, which the runner
-      # seeds from the project-wide pre-pass. The walk is breadth-first, cycle-guarded, and node-count-capped.
+      # ADR-24 slice 2 — resolves `method_name` against the project definers on `class_name`'s
+      # {Scope::ResolutionChain}, in Ruby's order: prepended modules, the class, its included modules, then the
+      # superclass's chain likewise. RBS-known ancestors are NOT answered here — the `MethodDispatcher` RBS
+      # tier runs before `try_user_method_inference` and already covers them; they sit on the chain as
+      # external entries this lookup passes over. Cross-file: the chain is built from the tables the runner
+      # seeds from the project-wide pre-pass, cycle-guarded and capped at `Scope::ANCESTOR_WALK_LIMIT`.
 
       CLASS_GRAPH_CACHE_KEY = :__rigor_class_graph_cache__
       private_constant :CLASS_GRAPH_CACHE_KEY
@@ -2464,13 +2631,114 @@ module Rigor
           # is a pure function of the same frozen index — the sibling resolver it walks reads nothing else.
           # `singleton_def` is added lazily by {#singleton_def_through_ancestors}'s caller.
           slot = [discovery,
-                  { name: {}, user_def: {}, self_pure: {}.compare_by_identity,
-                    yields: {}.compare_by_identity }]
+                  { user_def: {}, typing_def: {}, self_pure: {}.compare_by_identity, yields: {}.compare_by_identity }]
           Thread.current[CLASS_GRAPH_CACHE_KEY] = slot
         end
         slot[1]
       end
 
+      # ADR-119 C2-b1 — the TYPING read of {#resolve_user_def_with_owner}: the same `[def_node, owner]` pair, but
+      # answered through {DefinerResolution} so a chain that does not stand for the name (a conditional definer,
+      # a conditional include, a fork, an external ancestor that may answer first) is `[nil, nil]` and the call
+      # types `Dynamic` instead of from a definer Ruby may not reach. ABSENT is the same `[nil, nil]`: at a typing
+      # site "no definer" and "cannot say" both fall through to `dispatch_miss_result`. Existence reads
+      # ({#resolve_user_def_through_ancestors}, the self-purity scan) stay on the union memo above: an existence
+      # read turning false there could ADD a `call.undefined-method` firing.
+      #
+      # UNKNOWN carries a third element, the `bot` exception's definers ({#every_project_definer}): the def nodes
+      # of every project entry on the chain that defines the name, or nil where the exception cannot apply.
+      def resolve_typing_def_with_owner(class_name, method_name)
+        cache = class_graph_buckets[:typing_def]
+        table = (cache[class_name.to_s] ||= {})
+        key = method_name.to_sym
+        return table[key] if table.key?(key)
+
+        table[key] =
+          case DefinerResolution.resolve(scope, class_name, method_name, :instance, question: :definer)
+          in DefinerResolution::Known(answer: [node, owner])
+            [node, owner]
+          in DefinerResolution::UNKNOWN
+            [nil, nil, every_project_definer(class_name, method_name)]
+          in DefinerResolution::ABSENT
+            [nil, nil]
+          end
+      end
+
+      # ADR-119 C2-b1 errata (the `bot` exception) — an UNKNOWN chain does not say WHICH definer Ruby calls, but
+      # when every project definer of the name on the chain types `bot` (each raises or exits), the call cannot
+      # return whichever of them runs, so it types `bot` and a guard such as `fail_with 'no' unless count` still
+      # narrows. `defs` is {#every_project_definer}'s list; each is inferred with this call's receiver and
+      # arguments, stopping at the first that returns (the answer is then `Dynamic` whatever the rest say).
+      # Accepted cost: an RBS-unknown external ahead of them that really defines the name and returns is a
+      # narrowing false negative; `bot` reports nothing about a value, and that exposure is master's.
+      def every_definer_raises_type(defs, receiver, call_node, arg_types, block_type)
+        return nil if defs.nil?
+
+        self_fold_safe = fold_safe_call_receiver?(call_node, receiver)
+        defs.each do |def_node|
+          result = infer_user_method_return(def_node, receiver, arg_types,
+                                            self_fold_safe: self_fold_safe, yield_type: block_type)
+          return nil unless result.is_a?(Type::Bot)
+        end
+        Type::Combinator.bot
+      end
+
+      # The def node of every project entry on `class_name`'s instance chain that defines `method_name`, in any
+      # position (the order is what UNKNOWN does not know), or nil where the `bot` exception cannot apply: a cut
+      # chain, no project definer, an entry whose only record of the name has no body (an `attr_*` or a
+      # `define_method` with no `def`), a definer resting on a `possible` or contested fact (another body may be the
+      # one Ruby holds), or an external RBS knows that declares the name. An external RBS does not know is passed
+      # over. Only what the tables hold is read: a `define_method` beside an entry's own `def` of the name, and a
+      # receiver-form `X.include(M)` outside `X`'s body, are not seen (as on the Known path).
+      #
+      # ADR-46: the answer depends on every entry, so each files its class edge and its negative class edge (a new
+      # file reopening it may add a definer or a mixin), and each project entry's {Scope#user_def_for} files the
+      # method edge, positive for a definer and `read_missing(:method, "Owner#name")` for one that lacks the
+      # `def`. `DefinerResolution`'s decline filed none of this past the external that stopped it.
+      def every_project_definer(class_name, method_name)
+        chain = Scope::ResolutionChain.for(scope, class_name.to_s, :instance, :methods)
+        chain.record(scope)
+        return nil if chain.truncated?
+
+        defs = []
+        declined = false
+        chain.entries.uniq.each do |entry|
+          if entry.external?
+            note_missing_class(entry.raw.to_s.split("::").last)
+            declined = true if external_declares?(entry.candidates, method_name)
+            next
+          end
+          note_missing_class(entry.last_segment)
+          node = scope.user_def_for(entry.name, method_name)
+          defs << node if node
+          declined = true if definer_without_single_body?(entry.name, method_name, node)
+        end
+        declined || defs.empty? ? nil : defs.freeze
+      end
+
+      def note_missing_class(segment)
+        Analysis::DependencyRecorder.read_missing(:class, segment) if Analysis::DependencyRecorder.active?
+      end
+
+      def definer_without_single_body?(owner, method_name, node)
+        discovery = scope.discovery
+        key = [owner, method_name.to_sym]
+        (node.nil? && scope.discovered_method?(owner, method_name, :instance)) ||
+          discovery.possible_method?(owner, method_name, :instance) ||
+          discovery.contested?(:discovered_def_nodes, key)
+      end
+
+      # True where RBS knows one of the names the external's spelling can denote and declares the instance method
+      # in it; a lookup that fails counts as declaring (the exception then does not apply).
+      def external_declares?(candidates, method_name)
+        known = candidates.find { |candidate| Rigor::Reflection.rbs_class_known?(candidate, scope: scope) }
+        return false if known.nil?
+
+        !Rigor::Reflection.instance_method_definition(known, method_name, scope: scope).nil?
+      rescue StandardError
+        true
+      end
+
       def resolve_user_def_through_ancestors(class_name, method_name)
         resolve_user_def_with_owner(class_name, method_name).first
       end
@@ -2493,11 +2761,10 @@ module Rigor
       # nothing but the frozen discovery index, and the `.with` guard in
       # {MethodDispatcher::StructMaterialization} needs the SAME answer without threading dispatcher state
       # through the dispatcher (#598 review). What stays here is the caching: the run-scoped
-      # `(class_name, method_name)` memo above, plus the per-edge name bucket handed to the walk so a class
-      # whose many methods are resolved pays each ancestor edge once.
+      # `(class_name, method_name)` memo above. The chain itself is memoised per class by
+      # {Scope::ResolutionChain}, so a class whose many methods are resolved builds it once.
       def compute_user_def_with_owner(class_name, method_name)
-        scope.user_def_through_ancestors(class_name, method_name,
-                                         name_memo: class_graph_buckets[:name])
+        scope.user_def_through_ancestors(class_name, method_name)
       end
 
       # ADR-57 N5 — overridable-method adoption gate. A self-call resolved to a project `def` whose owner has
@@ -2671,34 +2938,14 @@ module Rigor
         index
       end
 
-      # True when `candidate`'s transitive ancestor chain (superclasses + included/prepended modules) reaches
-      # `owner` — i.e. `candidate` is a subclass of an owner class or an includer of an owner module. Reuses
-      # the same BFS resolver the method-resolution ancestor walk uses, so name resolution (lexical nesting,
-      # RBS-known-ancestor pruning) is identical.
-      # Delegates to the shared walk's edge step so this BFS and method resolution resolve ancestor names
-      # identically, sharing the per-edge memo bucket.
-      def enqueue_ancestors(current, queue)
-        scope.enqueue_ancestors(current, queue, class_graph_buckets[:name])
-      end
-
+      # True when `candidate`'s ancestor chain (superclasses + included/prepended modules) reaches `owner` —
+      # i.e. `candidate` is a subclass of an owner class or an includer of an owner module. Asked of the same
+      # {Scope::ResolutionChain} method resolution reads, so name resolution (lexical nesting, RBS-known-ancestor
+      # pruning) is identical; a chain cut at the budget that does not reach `owner` answers false, as the walk
+      # it replaced did. Reachability is the same in both of the chain's worlds.
       def related_to_owner?(candidate, owner)
-        queue = []
-        enqueue_ancestors(candidate, queue)
-        seen = {}
-        visited = 0
-        until queue.empty?
-          current = queue.shift
-          next if current.nil? || seen[current]
-
-          return true if current == owner
-
-          seen[current] = true
-          visited += 1
-          return false if visited > Scope::ANCESTOR_WALK_LIMIT
-
-          enqueue_ancestors(current, queue)
-        end
-        false
+        chain = Scope::ResolutionChain.for(scope, candidate.to_s, :instance, :methods)
+        !chain.search(scope) { |entry| entry.name == owner }.nil?
       end
 
       INFERENCE_GUARD_KEY = :__rigor_user_method_inference_stack__
@@ -2881,14 +3128,37 @@ module Rigor
       # not observable on the body scope, so it does need its own memo-key slot. It is dropped for a def
       # that cannot reach a `yield` — nearly all of them — which keeps the key shape constant for the
       # methods the memo actually carries and confines the extra dimension to yielding callees.
-      def infer_user_method_return(def_node, receiver, arg_types, self_fold_safe: false, yield_type: nil)
+      # Issue #1703 — inside the guarded re-walk a callee's return summary is still computed with `key?` guards off
+      # ({KeyPresenceGuard.without_guards}): summaries are memoised for the whole run, and one computed with a guard
+      # would reach the analysis every rule reads.
+      #
+      # Issue #1664 — `refinements` are the modules in effect in a refine body another file wrote, which the body scope
+      # carries as declared refinements: its nodes are not this file's, so this file's lexical list cannot answer them.
+      # The return memo and the recursion guard do not key on them, which holds because such a node comes only from
+      # `DefNodeResolver.refinement_query`'s own parse and always carries that file's one list; a caller that types
+      # the same node under another list must add it to the key.
+      def infer_user_method_return(def_node, receiver, arg_types, self_fold_safe: false, yield_type: nil,
+                                   refinements: nil)
         return nil if def_node.body.nil?
+        unless KeyPresenceGuard.active?
+          return infer_user_method_return_unguarded(def_node, receiver, arg_types, self_fold_safe, yield_type,
+                                                    refinements)
+        end
 
+        KeyPresenceGuard.without_guards do
+          infer_user_method_return_unguarded(def_node, receiver, arg_types, self_fold_safe, yield_type, refinements)
+        end
+      end
+
+      def infer_user_method_return_unguarded(def_node, receiver, arg_types, self_fold_safe, yield_type,
+                                             refinements = nil)
         yield_type = nil unless yield_type && body_yields?(def_node)
         body_scope = build_user_method_body_scope(def_node, receiver, arg_types,
                                                   self_fold_safe: self_fold_safe)
         return nil if body_scope.nil?
 
+        body_scope = body_scope.with_declared_refinements(refinements) if refinements
+
         # Recursion-guard signature. Keyed on `(receiver, method)` only — NOT the argument types. ADR-24 WD5:
         # a method whose summary is still being computed resolves to `Dynamic[top]` for that cycle. Keying on
         # arg types would let mutual recursion through a `module_function` module (`Acceptance#accepts` →
@@ -3860,15 +4130,28 @@ module Rigor
       # Both are precision-only. A `...` outside a forwarding frame (unreachable in valid Ruby) and a double
       # splat of anything but a Symbol-keyed closed `HashShape` — a shapeless `Hash[Symbol, V]`, an opaque
       # value, a mixed hash — fall back to exactly the pre-#1125 answer.
+      #
+      # Only a list holding a `...` takes the flat_map. Every call is typed through here, and the flat_map's
+      # one-element Array per argument cost `rigor check` about 315K allocations over the v0.3.9 `lib`
+      # ([#1503](https://github.com/rigortype/rigor/issues/1503)).
       def call_arg_types(node)
         arguments_node = node.arguments
         return [] if arguments_node.nil?
 
-        arguments_node.arguments.flat_map do |argument|
+        arguments = arguments_node.arguments
+        return arguments.map { |argument| call_arg_type(argument) } unless forwards_arguments?(arguments)
+
+        arguments.flat_map do |argument|
           forwarded_argument_types(argument) || [call_arg_type(argument)]
         end
       end
 
+      # Whether a call's argument list holds `...`. Ruby accepts it only last; the scan checks every argument
+      # rather than rely on that.
+      def forwards_arguments?(arguments)
+        arguments.any?(Prism::ForwardingArgumentsNode)
+      end
+
       # The frame's argument list when `argument` is `...`, else nil so the caller types it normally.
       def forwarded_argument_types(argument)
         return nil unless argument.is_a?(Prism::ForwardingArgumentsNode)
@@ -3930,12 +4213,13 @@ module Rigor
           method_name: call_node.name,
           arg_types: arg_types,
           environment: scope.environment,
-          scope: scope
+          scope: scope,
+          call_node: call_node
         )
         block_return_for(
           block_arg, expected,
           call_node: call_node,
-          narrowed_self_type: block_body_self_narrowing(call_node, receiver_type),
+          narrowing: block_body_self_narrowing(call_node, receiver_type),
           repeats: !BLOCK_VALUE_DISCARDING.include?(call_node.name) && block_may_repeat?(call_node, receiver_type)
         )
       rescue StandardError
@@ -4002,7 +4286,7 @@ module Rigor
         block_scope = block_entry_scope(
           block_node, param_types,
           call_node: call_node,
-          narrowed_self_type: block_body_self_narrowing(call_node, receiver),
+          narrowing: block_body_self_narrowing(call_node, receiver),
           captured: repeating_captured_bindings(block_node, param_types, block_may_repeat?(call_node, receiver))
         )
         _result, collected = StatementEvaluator.with_break_value_sink do
@@ -4011,10 +4295,12 @@ module Rigor
         collected.filter_map { |jump, type| type if targets.key?(jump) }
       end
 
-      # The block body's narrowed `self_type`, or `nil` to leave the scope contract unchanged.
+      # The block body's narrowing — a {MacroBlockSelfType::Match} carrying the narrowed `self_type` and the declared
+      # refinements — or `nil` to leave the scope contract unchanged.
       #
       # ADR-16 Tier A: a registered plugin's `block_as_methods` entry matching `(receiver_type,
-      # call_node.name)` narrows to the receiver class's instance type.
+      # call_node.name)` narrows to the receiver class's instance type, and puts its `refinements:` in effect in the
+      # body (issue #1667).
       #
       # Issue #963: `define_method(:name) { ... }` installs its block as an instance method and runs it with
       # `self` bound to the receiving instance, so the block body's `self` is the INSTANCE side of a class body's
@@ -4024,9 +4310,11 @@ module Rigor
       # matters wherever the block's value is observable, e.g. a project-declared generic `define_method`
       # signature that returns the block's own type.
       def block_body_self_narrowing(call_node, receiver_type)
-        MacroBlockSelfType.narrow_self_type_for(
-          scope: scope, call_node: call_node, receiver_type: receiver_type
-        ) || DefineMethodBlockSelf.narrow_self_type_for(scope: scope, call_node: call_node)
+        match = MacroBlockSelfType.match_for(scope: scope, call_node: call_node, receiver_type: receiver_type)
+        return match if match
+
+        defined = DefineMethodBlockSelf.narrow_self_type_for(scope: scope, call_node: call_node)
+        defined && MacroBlockSelfType::Match.new(self_type: defined, refinements: InEffectRefinements::EMPTY)
       end
 
       def break_arm_param_types(call_node, receiver)
@@ -4035,16 +4323,17 @@ module Rigor
           method_name: call_node.name,
           arg_types: call_arg_types(call_node),
           environment: scope.environment,
-          scope: scope
+          scope: scope,
+          call_node: call_node
         )
       end
 
-      def block_return_for(block_arg, expected, call_node: nil, narrowed_self_type: nil, repeats: false)
+      def block_return_for(block_arg, expected, call_node: nil, narrowing: nil, repeats: false)
         case block_arg
         when Prism::BlockNode
           captured = repeating_captured_bindings(block_arg, expected, repeats)
           entry = block_entry_scope(
-            block_arg, expected, call_node: call_node, narrowed_self_type: narrowed_self_type, captured: captured
+            block_arg, expected, call_node: call_node, narrowing: narrowing, captured: captured
           )
           type_block_body(block_arg, entry, captured: captured)
         when Prism::BlockArgumentNode
@@ -4060,13 +4349,14 @@ module Rigor
       # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
       # yielding method's business, so the return-typing pass must see the same unmodelled-self mark. Issue #1358
       # — and the same match-global view ({MatchRebinding.block_entry}), which reads the owning `call_node`.
-      def block_entry_scope(block_node, expected, call_node: nil, narrowed_self_type: nil, captured: nil)
+      def block_entry_scope(block_node, expected, call_node: nil, narrowing: nil, captured: nil)
         entry = MatchRebinding.block_entry(scope.entering_opaque_block, block_node, call_node)
         entry = captured.lay(entry) if captured
         block_scope = BlockParameterBinder.new(expected_param_types: expected).bind_onto(block_node, entry)
-        return block_scope unless narrowed_self_type
+        return block_scope unless narrowing
 
-        block_scope.with_self_type(narrowed_self_type)
+        keeps_unknown = call_node ? scope.block_self_narrowing_unknown?(call_node) : false
+        MacroBlockSelfType.apply(block_scope, narrowing, keeps_unknown: keeps_unknown)
       end
 
       # The #587 (b) captured binding when the call may run the block more than once ({#block_may_repeat?}), and