rigortype 0.4.0 → 0.4.2

data/lib/rigor/inference/statement_evaluator.rb

@@ -9,6 +9,7 @@ require_relative "../source/node_walker"
 require_relative "../source/node_children"
 require_relative "../source/constant_path"
 require_relative "anonymous_meta_class"
+require_relative "definer_resolution"
 require_relative "block_repetition"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
@@ -30,6 +31,7 @@ require_relative "match_rebinding"
 require_relative "element_read_widening"
 require_relative "hash_lookup_mutation"
 require_relative "indexed_narrowing"
+require_relative "key_presence_guard"
 require_relative "index_write_widening"
 require_relative "method_dispatcher"
 require_relative "method_parameter_binder"
@@ -272,10 +274,16 @@ module Rigor
       #   {OperandWalk} rooted inside an operand still records its later operands ({#walk_recorder}).
       # @param operand_types — the later operands' own values ({OperandWalk#types}) for the evaluator that runs a
       #   call from the scope its operands left, read by {#type_operand}.
+      # @param opaque_class — true while the walk is inside the body of a class nothing names (issue #1518:
+      #   a declined `class self::X`, a parse-error header), where `class_context` is empty without the code
+      #   being at the top level. A `def` (or `class << self`) there runs under an untyped `self` instead of
+      #   the top level's nil one, so its implicit-self calls answer `Dynamic` and no top-level rule fires.
       def initialize(scope:, tracer: nil, on_enter: nil, class_context: [].freeze, # rubocop:disable Metrics/ParameterLists
                      lexical_nesting: EMPTY_NESTING, converged_loop_recording: false, next_scope_sink: nil,
-                     operand_scope: nil, in_operand: false, operand_recorder: nil, operand_types: nil)
+                     operand_scope: nil, in_operand: false, operand_recorder: nil, operand_types: nil,
+                     opaque_class: false)
         @scope = scope
+        @opaque_class = opaque_class
         @tracer = tracer
         @on_enter = on_enter
         @class_context = class_context.freeze
@@ -345,7 +353,7 @@ module Rigor
         @on_enter&.call(node, @scope)
 
         handler = HANDLERS[node.class]
-        return forget_implicit_call_guards(node, send(handler, node)) if handler
+        return forget_aliased_key_guards(node, forget_implicit_call_guards(node, send(handler, node))) if handler
 
         # Default: the node is treated as a pure expression. Type it through the existing expression typer (which
         # observes the current scope's locals) and leave the scope unchanged, but for the match globals a call in it
@@ -366,6 +374,16 @@ module Rigor
         [type, after.forget_guard_narrowings]
       end
 
+      # Issue #1703 — a write that stores a `key?` guard's receiver or key root elsewhere (`g = h`) aliases it, so
+      # the guard ends ({KeyPresenceGuard.invalidate_after_write}).
+      def forget_aliased_key_guards(node, result)
+        type, after = result
+        return result unless after.is_a?(Scope)
+
+        guarded = KeyPresenceGuard.invalidate_after_write(node, after)
+        guarded.equal?(after) ? result : [type, guarded]
+      end
+
       # Issue #1359 — the nodes whose handler runs their parts in order, each from the scope the parts before it
       # left, so a `$_` reader among them forgets it where it runs ({LastLine}) and a read before it keeps the
       # narrowing.
@@ -625,7 +643,8 @@ module Rigor
       # lands.
       def eval_ivar_write(node)
         rhs_type, post_rhs = sub_eval(node.value, scope)
-        bound = post_rhs.with_ivar(node.name, rhs_type)
+        # Issue #1446 — a write ends a class guard's narrowing of the variable, as it does a global's.
+        bound = post_rhs.with_ivar(node.name, rhs_type).without_ivar_guard(node.name)
         bound = bound.with_ivar_origin(node.name, rhs_origin(node.value, post_rhs, rhs_type))
         cause = optimistic_rhs_origin(node.value, post_rhs)
         bound = bound.with_optimistic_ivar(node.name, cause, miss: optimistic_rhs_miss(node.value, post_rhs)) if cause
@@ -806,7 +825,8 @@ module Rigor
       end
 
       def rebind_variable(target_scope, kind, name, type)
-        target_scope.public_send(VAR_KIND_BUILDERS.fetch(kind), name, type)
+        bound = target_scope.public_send(VAR_KIND_BUILDERS.fetch(kind), name, type)
+        kind == :ivar ? bound.without_ivar_guard(name) : bound
       end
 
       def compound_result_type(current, rhs, operator)
@@ -2431,6 +2451,12 @@ module Rigor
         case index_node
         when Prism::LocalVariableTargetNode
           scope.with_local(index_node.name, element_type)
+        when Prism::InstanceVariableTargetNode
+          # Issue #1446 — `for @io in xs` writes the ivar each iteration, which ends a class guard's narrowing of it,
+          # and `for $out in xs` the global, which ends any guard's narrowing of it.
+          scope.with_ivar(index_node.name, element_type).without_ivar_guard(index_node.name)
+        when Prism::GlobalVariableTargetNode
+          scope.with_global(index_node.name, element_type)
         when Prism::IndexTargetNode
           widen_index_target(index_node, element_type, scope, type_scope: scope)
         when Prism::MultiTargetNode
@@ -2698,13 +2724,31 @@ module Rigor
       # that half rather than this one deriving it from the frames.
       def eval_class_or_module(node)
         path = node.constant_path
-        frame = ClassFrame.new(name: Source::ConstantPath.qualified_name(path), singleton: false)
+        name = Source::ConstantPath.qualified_name(path)
+        # A header Prism recovered without a constant (`class foo`, a parse error) names no class: its body
+        # runs under an untyped `self` and no class frame, so nothing is filed under an empty name.
+        return eval_unnameable_class_body(node) if name.nil?
+        # `class self::X` the indexer declined (opaque `self`, e.g. `REGISTRY.first.class_eval`) is not the
+        # lexical `X` that `qualified_name` renders; a nameable `self::` header is in the identity table.
+        return eval_unnameable_class_body(node) if declined_self_header?(path)
+
+        frame = ClassFrame.new(name: name, singleton: false)
         new_context = Source::ConstantPath.rooted?(path) ? [frame] : @class_context + [frame]
         body_type, _body_scope = eval_class_body(node, new_context,
                                                  Source::ConstantPath.pushed_nesting(@lexical_nesting, path))
         [body_type, scope]
       end
 
+      def declined_self_header?(path)
+        path.is_a?(Prism::ConstantPathNode) && path.parent.is_a?(Prism::SelfNode) &&
+          !scope.declared_types.key?(path)
+      end
+
+      def eval_unnameable_class_body(node)
+        body_type, _body_scope = eval_class_body(node, [], @lexical_nesting, opaque_self: true)
+        [body_type, scope]
+      end
+
       # `class << expr; body; end`. When `expr` is `self`, the body defines class methods on the immediate enclosing
       # class — the innermost frame flips to `singleton: true` so a nested `def foo` resolves through `singleton_method`
       # rather than `instance_method`. For non-`self` expressions we cannot statically resolve the receiver, so we keep
@@ -2961,6 +3005,8 @@ module Rigor
         # outer receiver is itself a chain node (e.g. `x.last << y`) do NOT drop narrowings keyed on `x` — only direct
         # calls against the root variable invalidate the chain.
         post_scope = IndexedNarrowing.invalidate_chain_after_call(call_node: node, current_scope: post_scope)
+        # Issue #1703 — a non-literal-key `key?` guard the call may break ({KeyPresenceGuard.breaks?}).
+        post_scope = KeyPresenceGuard.invalidate_after_call(node, post_scope)
         # B2.2 — intervening method call ivar invalidation. An implicit-self / self-receiver call could mutate any ivar
         # of the enclosing class (we cannot prove purity without an effect system). Reset each ivar whose current local
         # binding has narrowed below the class-ivar seed back to the seed itself, so a subsequent `if @flag` predicate
@@ -3526,15 +3572,19 @@ module Rigor
       # does not type as a class object (a gem class with no RBS) keeps the name as written: the body is still some
       # class's body, and leaving it on the enclosing `self` made a `refine` at the file's top level report every
       # implicit-self call in it as `call.unresolved-toplevel`.
+      #
+      # Issue #1689 — a `refine` call the file's {InEffectRefinements} places in a class body is the class's own
+      # method, not `Module#refine`, so its block is entered as any other block.
       def refined_class_context(node)
         target = ScopeIndexer.refine_target(node)
         return nil if target.nil?
 
-        refined = scope.type_of(target)
-        name = refined.is_a?(Type::Singleton) ? refined.class_name : Source::ConstantPath.qualified_name(target)
+        return nil if InEffectRefinements.class_body_refine?(scope, node)
+
+        name = ScopeIndexer.refined_class_name(target, scope)
         return nil if name.nil?
 
-        [ClassFrame.new(name: name.delete_prefix("::"), singleton: false, refinement: true)]
+        [ClassFrame.new(name: name, singleton: false, refinement: true)]
       end
 
       # The block calls whose body `return` leaves only the block ({ReturnBarrier.block_call?}). Like a `->` body
@@ -3568,7 +3618,9 @@ module Rigor
         narrowed = DefineMethodBlockSelf.narrow_self_type_for(
           scope: scope, call_node: call_node
         )
-        narrowed ? block_entry.with_self_type(narrowed) : block_entry
+        return block_entry unless narrowed
+
+        block_entry.with_block_self_type(narrowed, keeps_unknown: scope.block_self_narrowing_unknown?(call_node))
       end
 
       # Enters a meta-new `block` as the body of the class `class_context` names: `self_type` is that class's
@@ -3583,8 +3635,17 @@ module Rigor
       # record a `Outer::K` entry: that is a rung Ruby's constant lookup does not have. The `class_context`
       # frame is still pushed — it is what a nested `def` registers its method under — which is exactly the
       # divergence that makes the chain a separate record rather than a view of the frame stack.
+      #
+      # Issue #1759 — a `refine X do … end` block runs on the refinement module, not on X, which Rigor does not
+      # model: the body keeps X's frame and singleton so its `def`s and implicit-self calls resolve as before, but
+      # carries the unknown-`self` mark ({Scope#block_self_unknown?}), so an explicit `self.import_methods(M)` is
+      # not checked against `singleton(X)`. The indexer leaves a value-position refine block unknown the same way.
       def enter_meta_class_body(block, block_entry, class_context)
-        entry = block_entry.with_self_type(self_type_for_class_body(class_context)).with_singleton_class_body(false)
+        # Issue #1717 — the body runs on the new class whatever encloses it, so its `self` is known.
+        entry = block_entry.with_block_self_type(self_type_for_class_body(class_context),
+                                                 keeps_unknown: class_context.last.refinement &&
+                                                                Scope::REFINEMENT_BLOCK_SELF)
+                           .with_singleton_class_body(false)
         sub_eval(block, stamp_nesting(entry, @lexical_nesting), class_context: class_context)
       end
 
@@ -5107,27 +5168,31 @@ module Rigor
         # ({ExpressionTyper#block_body_self_narrowing}) already applies the same contract to block-return
         # typing; without it here the recorded per-node scopes — what `dump_type`/`assert_type` and the
         # survey read — keep the enclosing `self_type` and every DSL call inside stays `Dynamic[top]`.
-        narrowed = call_node && narrow_macro_block_self(call_node)
-        scope_with_params = scope_with_params.with_self_type(narrowed) if narrowed
+        # Issue #1667 — the entry's `refinements:` are put in effect in the body alongside.
+        match = call_node && macro_block_match(call_node)
+        if match
+          keeps_unknown = scope.block_self_narrowing_unknown?(call_node)
+          scope_with_params = MacroBlockSelfType.apply(scope_with_params, match, keeps_unknown: keeps_unknown)
+        end
         block_local_names(block_node).reduce(scope_with_params) do |acc, name|
           acc.with_local(name, Type::Combinator.constant_of(nil))
         end
       end
 
-      # The receiver an ADR-16 `block_as_methods:` match is keyed on: the explicit receiver's type, or the
+      # The ADR-16 `block_as_methods:` match for `call_node`, keyed on the explicit receiver's type, or on the
       # current `self_type` for an implicit-self DSL call (the `params do` / `namespace do` shapes, whose
       # receiver is the enclosing `Singleton[X]`). A miss leaves the entry scope as built — the false-
       # positive-safe direction.
-      def narrow_macro_block_self(call_node)
+      def macro_block_match(call_node)
         receiver_type =
           if call_node.receiver
             explicit_receiver_type(call_node)
           else
-            scope.self_type
+            MacroBlockSelfType.implicit_receiver_type(scope)
           end
         return nil if receiver_type.nil?
 
-        MacroBlockSelfType.narrow_self_type_for(
+        MacroBlockSelfType.match_for(
           scope: scope, call_node: call_node, receiver_type: receiver_type
         )
       rescue StandardError
@@ -5160,7 +5225,8 @@ module Rigor
           method_name: call_node.name,
           arg_types: arg_types,
           environment: scope.environment,
-          scope: scope
+          scope: scope,
+          call_node: call_node
         )
       rescue StandardError
         []
@@ -5175,7 +5241,7 @@ module Rigor
 
       # ----- def/class helpers -----
 
-      def eval_class_body(node, new_context, new_nesting = @lexical_nesting)
+      def eval_class_body(node, new_context, new_nesting = @lexical_nesting, opaque_self: false)
         return [Type::Combinator.constant_of(nil), scope] if node.body.nil?
 
         # Class/module bodies run in a fresh scope: the outer scope's locals are NOT visible inside `class Foo; ...
@@ -5183,15 +5249,24 @@ module Rigor
         # A-engine: `self` inside a class body is the class object itself, so we set `self_type` to
         # `Singleton[<qualified>]`.
         fresh = build_fresh_body_scope
-        body_self = self_type_for_class_body(new_context)
+        # Issue #1518 — `class << self` inside an unnameable class body keeps that body's opacity: it opens the
+        # singleton of a class nothing names, and its empty frame stack is not the top level.
+        singleton_body = node.is_a?(Prism::SingletonClassNode)
+        opaque_self ||= singleton_body && @opaque_class && new_context.empty?
+        # Issue #1763 — a `class << self` in a `refine X` block (the refinement frame {#singleton_context_for} built)
+        # opens the refinement module's singleton class, which Rigor does not model, as the `def`s in it already read
+        # ({#self_type_for_method_body}); `Singleton[X]` there checked `self.m` and a local holding `self` against X's
+        # class methods. A `class << X` names X's real singleton class and takes a frame without the flag.
+        untyped_self = opaque_self || (singleton_body && new_context.last&.refinement)
+        body_self = untyped_self ? Type::Combinator.untyped : self_type_for_class_body(new_context)
         fresh = fresh.with_self_type(body_self) if body_self
         # Issue #963 — `self` in a `class << ...` body is the SINGLETON class, which shares the `Singleton[X]`
         # carrier a `class X` body gets. The mark is the only thing that tells the two apart downstream, and a
         # `def` reached from this body clears it by starting from a fresh scope.
-        fresh = fresh.with_singleton_class_body(node.is_a?(Prism::SingletonClassNode))
+        fresh = fresh.with_singleton_class_body(singleton_body)
         fresh = fresh.with_match_frame(node.body)
         fresh = stamp_nesting(fresh, new_nesting)
-        sub_eval(node.body, fresh, class_context: new_context, lexical_nesting: new_nesting)
+        sub_eval(node.body, fresh, class_context: new_context, lexical_nesting: new_nesting, opaque_class: opaque_self)
       end
 
       def build_method_entry_scope(def_node) # rubocop:disable Metrics/AbcSize
@@ -5218,7 +5293,7 @@ module Rigor
         # then receive the parameter bindings. Slice 7 phase 2: instance defs ALSO seed their `ivars` map from the
         # class-level accumulator so `def get; @x; end` reads the type that a sibling `def init; @x = 1; end` wrote.
         fresh = build_fresh_body_scope
-        body_self = self_type_for_method_body(singleton: singleton)
+        body_self = self_type_for_method_body(singleton: singleton, receiver: def_node.receiver)
         fresh = fresh.with_self_type(body_self) if body_self
         # A `def` opens no new `Module.nesting` entry — the body resolves constants against the chain of the
         # declaration that encloses it, which is what the evaluator is already carrying (#652).
@@ -5353,12 +5428,16 @@ module Rigor
         # chain's throwaway intermediate Scopes were a top `Scope#rebuild` source (ADR-44). Local-empty by design; the
         # discovery index is inherited whole by reference (ADR-53 Track A), so a table added to the index can no longer
         # be dropped here by a missed per-field copy.
+        #
+        # Issue #1667 — a plugin-declared refined block's modules carry into a `def` or class body written in it: CRuby
+        # defines the method with the block's cref, and a class body's cref inherits the outer one's refinements.
         Scope.new(
           environment: scope.environment,
           locals: {}.freeze,
           source_path: scope.source_path,
           discovery: scope.discovery,
-          dynamic_origins: scope.dynamic_origins
+          dynamic_origins: scope.dynamic_origins,
+          declared_refinements: scope.declared_refinements
         )
       end
 
@@ -5408,9 +5487,15 @@ module Rigor
       #   `Nominal[Foo]`.
       #
       # Returns nil for top-level defs that have no enclosing class.
-      def self_type_for_method_body(singleton:)
+      def self_type_for_method_body(singleton:, receiver: nil)
         path = current_class_path
-        return nil if path.nil?
+        # Issue #1518 — a `def` in a class nothing names has a receiver, just not one Rigor can type; nil would
+        # read its body as the top level and its implicit-self calls as unresolved top-level calls.
+        return (Type::Combinator.untyped if @opaque_class) if path.nil?
+        # Issue #1759 — a `def self.m` in a `refine X` block (or a `def m` in a `class << self` there) is a method
+        # of the refinement module, which Rigor does not model; reading it as `Singleton[X]` checked its
+        # explicit-self calls against X's class methods. A `def X.m` there does define X's class method.
+        return Type::Combinator.untyped if singleton && @class_context.last.refinement && refinement_self_def?(receiver)
 
         if singleton
           Type::Combinator.singleton_of(path)
@@ -5419,6 +5504,10 @@ module Rigor
         end
       end
 
+      # Issue #1759 — whether a singleton `def` under a refinement frame defines a method on the refinement module
+      # (`def self.m`, or `def m` in a `class << self`) rather than on an explicitly named receiver (`def X.m`).
+      def refinement_self_def?(receiver) = receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
       def singleton_context_for(node)
         case node.expression
         when Prism::SelfNode
@@ -5426,7 +5515,7 @@ module Rigor
 
           outer = @class_context[0..-2]
           last = @class_context.last
-          outer + [ClassFrame.new(name: last.name, singleton: true)]
+          outer + [ClassFrame.new(name: last.name, singleton: true, refinement: last.refinement)]
         when Prism::ConstantReadNode, Prism::ConstantPathNode
           target = singleton_constant_target(node.expression)
           return @class_context unless target
@@ -5549,10 +5638,14 @@ module Rigor
       # `on_enter: nil` evaluates without recording into the per-node scope index — for a pass whose scopes are not
       # the ones the index should keep. `next_scope_sink:` is replaced only by {#evaluate_invocation} and
       # {#loop_iteration}.
-      def sub_eval(node, with_scope, class_context: @class_context, lexical_nesting: @lexical_nesting,
-                   on_enter: @on_enter, next_scope_sink: @next_scope_sink, operand_recorder: @operand_recorder)
+      # `opaque_class:` survives only while the frame stack stays empty: a named class opened inside an
+      # unnameable body gets a frame, and its `def`s a nominal `self`, as they did before #1518.
+      def sub_eval(node, with_scope, class_context: @class_context, lexical_nesting: @lexical_nesting, # rubocop:disable Metrics/ParameterLists
+                   on_enter: @on_enter, next_scope_sink: @next_scope_sink, operand_recorder: @operand_recorder,
+                   opaque_class: @opaque_class && class_context.empty?)
         evaluator_at(with_scope, class_context: class_context, lexical_nesting: lexical_nesting, on_enter: on_enter,
-                                 next_scope_sink: next_scope_sink, operand_recorder: operand_recorder).evaluate(node)
+                                 next_scope_sink: next_scope_sink, operand_recorder: operand_recorder,
+                                 opaque_class: opaque_class).evaluate(node)
       end
 
       # An evaluator over `with_scope` that inherits everything else from this one. `operand_scope:` and
@@ -5560,7 +5653,8 @@ module Rigor
       # operands left.
       def evaluator_at(with_scope, class_context: @class_context, lexical_nesting: @lexical_nesting, # rubocop:disable Metrics/ParameterLists
                        on_enter: @on_enter, next_scope_sink: @next_scope_sink, operand_scope: nil,
-                       in_operand: @in_operand, operand_recorder: @operand_recorder, operand_types: nil)
+                       in_operand: @in_operand, operand_recorder: @operand_recorder, operand_types: nil,
+                       opaque_class: @opaque_class)
         StatementEvaluator.new(
           scope: with_scope,
           tracer: tracer,
@@ -5572,7 +5666,8 @@ module Rigor
           operand_scope: operand_scope,
           in_operand: in_operand,
           operand_recorder: operand_recorder,
-          operand_types: operand_types
+          operand_types: operand_types,
+          opaque_class: opaque_class
         )
       end
 
@@ -5675,6 +5770,12 @@ module Rigor
         case ref
         when Prism::LocalVariableTargetNode
           scope.with_local(ref.name, exception_type)
+        when Prism::InstanceVariableTargetNode
+          # Issue #1446 — `rescue => @io` writes the ivar, which ends a class guard's narrowing of it, and `rescue =>
+          # $out` the global, which ends any guard's narrowing of it.
+          scope.with_ivar(ref.name, exception_type).without_ivar_guard(ref.name)
+        when Prism::GlobalVariableTargetNode
+          scope.with_global(ref.name, exception_type)
         when Prism::IndexTargetNode
           widen_index_target(ref, exception_type, scope, type_scope: scope)
         else
@@ -5818,7 +5919,7 @@ module Rigor
       def source_decomposition_projection(subject_type, method_name, arg_types, scope)
         return nil unless subject_type.is_a?(Type::Nominal)
 
-        def_node = scope.discovered_def_nodes[subject_type.class_name]&.[](method_name)
+        def_node = own_definer_node(scope, subject_type.class_name, method_name)
         return nil if def_node.nil?
 
         result = scope.user_method_return(def_node, subject_type, arg_types)
@@ -5827,6 +5928,22 @@ module Rigor
         result
       end
 
+      # The `def` node the receiver's OWN class defines `method_name` with, or nil. ADR-119 C2-e (#1615): asked of
+      # `DefinerResolution`, so a slot rebuilt from an ADR-85 seed bundle is resolved to a node and the read files
+      # its ADR-46 edge. UNKNOWN answers nil: an unsettled or forked chain, or a contested slot once ADR-119 C1d
+      # fills the siblings. Conditional or reopened defs are not contested until C1d. A definer further up the
+      # chain (a prepended or included module, a superclass) is not the own class's, so the owner check declines it.
+      def own_definer_node(scope, class_name, method_name)
+        case DefinerResolution.resolve(scope, class_name, method_name, :instance, question: :definer)
+        in DefinerResolution::Known(answer: [node, owner])
+          owner == class_name ? node : nil
+        in DefinerResolution::UNKNOWN # the case/in contract needs one arm per answer
+          nil
+        in DefinerResolution::ABSENT # rubocop:disable Lint/DuplicateBranch -- see above
+          nil
+        end
+      end
+
       # A `StructInstance`'s own projection — `Tuple` of its member values for `deconstruct`, `HashShape` of
       # its members for `deconstruct_keys` — or nil when the subject is another carrier or the projection would
       # be unsound.

data/lib/rigor/inference/string_mutation.rb

@@ -22,6 +22,9 @@ module Rigor
       # the effect classifier and the effect catalogue's `mutators: string` cite it rather than keep a list of their
       # own (ADR-103 WD3). A spec holds it to every bang method `String` defines plus the non-bang mutators reflection
       # cannot find by name.
+      #
+      # The last row is Ruby 4.1's bit operations (#1691), which `data/core_overlay/string.rbs` declares whatever Ruby
+      # runs the analysis; they rewrite bytes in place and keep the byte length.
       MUTATORS = %i[
         << concat insert prepend replace clear []= slice!
         setbyte bytesplice append_as_bytes force_encoding
@@ -29,18 +32,21 @@ module Rigor
         upcase! downcase! capitalize! swapcase! reverse!
         strip! lstrip! rstrip! chomp! chop!
         delete_prefix! delete_suffix! encode! scrub! unicode_normalize!
+        bit_set bit_clear bit_flip bitwise_not! bitwise_and! bitwise_or! bitwise_xor!
       ].to_set.freeze
 
       # The {MUTATORS} that CANNOT leave a non-empty receiver empty, and so keep a `non-empty-string` refinement:
       # appenders (`<<`, `concat`, `insert`, `prepend`, `append_as_bytes`), and rewrites that keep at least one
       # character (`setbyte`, `force_encoding`, the case mappings, `reverse!`, `succ!` / `next!`, `squeeze!`,
-      # `unicode_normalize!`). A whitelist, as `RefinementMutation::EMPTY_PRESERVING` is for Array and Hash: a mutator
-      # missing here retracts the witness, which costs precision, where a mutator missing from a list of emptiers kept
-      # the witness of a string it had just emptied — `tr!` and `tr_s!` did, since `"a".tr!("a", "")` is `""`.
+      # `unicode_normalize!`, and the bit operations, which keep every byte). A whitelist, as
+      # `RefinementMutation::EMPTY_PRESERVING` is for Array and Hash: a mutator missing here retracts the witness, which
+      # costs precision, where a mutator missing from a list of emptiers kept the witness of a string it had just
+      # emptied — `tr!` and `tr_s!` did, since `"a".tr!("a", "")` is `""`.
       EMPTY_PRESERVING = %i[
         << concat insert prepend append_as_bytes
         setbyte force_encoding
         upcase! downcase! capitalize! swapcase! reverse! succ! next! squeeze! unicode_normalize!
+        bit_set bit_clear bit_flip bitwise_not! bitwise_and! bitwise_or! bitwise_xor!
       ].to_set.freeze
 
       # `tr!` / `tr_s!` map every character they match to one character of the replacement (padded with its last), so

data/lib/rigor/inference/synthetic_method_scanner.rb

@@ -333,7 +333,8 @@ module Rigor
 
       def collect_included_do_calls(body)
         body.body.flat_map do |stmt|
-          next [] unless stmt.is_a?(Prism::CallNode) && stmt.receiver.nil? && stmt.name == :included && stmt.block
+          included_do = stmt.is_a?(Prism::CallNode) && stmt.receiver.nil? && stmt.name == :included
+          next [] unless included_do && stmt.block.is_a?(Prism::BlockNode)
 
           block_body = stmt.block.body
           next [] unless block_body.respond_to?(:body)

data/lib/rigor/inference/version_guard.rb

@@ -33,6 +33,10 @@ module Rigor
     # Prism *parse* version (it decides which syntax is accepted), it is not threaded to the inference
     # layer, and its default (`"4.0"`) is a default rather than a user statement about the runtime.
     #
+    # The one exception is the Ruby-deprecation rule (the ADR-47 WD5 amendment, #1692). An explicit
+    # `target_ruby` is a user statement about the runtime, and that rule passes it as `stated_ruby:` to ask
+    # whether a deprecated call can run on the stated Ruby. Narrowing and the dead-arm filter never pass it.
+    #
     # ## What is folded (and what is deliberately not)
     #
     # * `RUBY_VERSION <cmp> "x.y.z"` — compared with **String** semantics, because that is what runs.
@@ -91,9 +95,13 @@ module Rigor
       private_constant :GEM_VERSION_PATH
 
       # @param node — an `if` / `unless` predicate
-      # @return `:truthy` / `:falsey` when the guard is decidable on the analyzer's Ruby,
+      # @param stated_ruby — ADR-47 WD5 amendment (#1692): a `x.y.z` version to read `RUBY_VERSION` as instead of
+      #   the analyzer's own, for the Ruby-deprecation rules only ({Configuration#stated_runtime_ruby}). Under it
+      #   nothing else is readable — `RUBY_ENGINE` and the default gems' `VERSION`s belong to the analyzer's
+      #   interpreter, not to the stated one — so a guard on them answers nil.
+      # @return `:truthy` / `:falsey` when the guard is decidable on the analyzer's Ruby (or on `stated_ruby`),
       #   otherwise nil (both arms stay live)
-      def verdict(node)
+      def verdict(node, stated_ruby: nil)
         return nil unless node.is_a?(Prism::CallNode)
 
         operator = node.name
@@ -103,19 +111,19 @@ module Rigor
         arguments = node.arguments&.arguments
         return nil unless arguments && arguments.length == 1
 
-        left = read_operand(node.receiver)
-        right = read_operand(arguments.first)
+        left = read_operand(node.receiver, stated_ruby)
+        right = read_operand(arguments.first, stated_ruby)
         return nil if left.nil? || right.nil?
 
         decide(left, right, operator)
       end
 
       # Reads one side of the comparison into `[kind, value]`, or nil when it is not readable.
-      def read_operand(node)
+      def read_operand(node, stated_ruby = nil)
         case node
         when Prism::StringNode then [:literal_string, node.unescaped]
-        when Prism::ConstantReadNode, Prism::ConstantPathNode then read_constant(node)
-        when Prism::CallNode then read_gem_version(node)
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then read_constant(node, stated_ruby)
+        when Prism::CallNode then read_gem_version(node, stated_ruby)
         end
       end
       private_class_method :read_operand
@@ -129,9 +137,10 @@ module Rigor
       #
       # The foldable set is unchanged and stays closed: an unqualified name folds only when it is one of
       # {PREDEFINED}, a qualified one only when it is in {VERSION_CONSTANTS}.
-      def read_constant(node)
+      def read_constant(node, stated_ruby = nil)
         path = Source::ConstantPath.qualified_name_or_nil(node)
         return nil unless path
+        return (path == "RUBY_VERSION" ? [:string, stated_ruby] : nil) if stated_ruby
 
         kind =
           if path.include?("::")
@@ -149,14 +158,14 @@ module Rigor
       # `Gem::Version.new(<readable>)`. The inner operand must be a plain version String — an engine name
       # is not a version, and `Gem::Version.new` raises on anything `Gem::Version.correct?` rejects, so a
       # malformed literal keeps both arms live instead of folding a guard the program cannot even reach.
-      def read_gem_version(node)
+      def read_gem_version(node, stated_ruby = nil)
         return nil unless node.name == :new && node.block.nil?
         return nil unless Source::ConstantPath.qualified_name_or_nil(node.receiver) == GEM_VERSION_PATH
 
         arguments = node.arguments&.arguments
         return nil unless arguments && arguments.length == 1
 
-        inner = read_operand(arguments.first)
+        inner = read_operand(arguments.first, stated_ruby)
         return nil unless inner && STRING_KINDS.include?(inner.first)
         return nil unless ::Gem::Version.correct?(inner.last)
 

data/lib/rigor/language_server/project_context.rb

@@ -46,6 +46,9 @@ module Rigor
 
       def initialize(configuration:)
         @configuration = configuration
+        @buffer_sources = {}
+        @disk_feature_files = nil
+        @environment_features = nil
         @generation = 0
         @environment = nil
         @cache_store = nil
@@ -77,6 +80,9 @@ module Rigor
           dependency_source_index: project_scan.dependency_source_index,
           synthetic_method_index: project_scan.synthetic_method_index,
           project_patched_methods: project_scan.project_patched_methods,
+          # Issue #1700 — the configured paths' files overlaid with the open buffers; {#note_buffers}
+          # rebuilds this when an edit or a save changes the set.
+          required_features: (@environment_features = required_features),
           **ProjectEnvironment.dependency_discovery_options(@configuration)
         )
       end
@@ -119,12 +125,37 @@ module Rigor
         diagnostics
       end
 
+      # Issue #1700 — records the open buffers' text (absolute path => source) and rebuilds the environment
+      # when it changes the {Environment::RequiredFeatures} set the current one was built with: a buffer that
+      # gains or drops a `require "prime"` loads or unloads the vendored `prime` signatures. The server calls
+      # it on every open, change, save and close; neither `didSave` nor a `.rb` edit reaches
+      # `workspace/didChangeWatchedFiles`, which most clients send only for the files they were asked to watch.
+      # The configured paths are read once per environment and only the buffers are re-scanned, so a keystroke
+      # costs a substring test per open buffer.
+      def note_buffers(sources)
+        @buffer_sources = sources
+        return if @environment.nil? || required_features == @environment_features
+
+        invalidate!
+      end
+
+      # The required-feature set for the configured paths' files on disk, each open buffer read in place of its
+      # file.
+      def required_features
+        disk = (@disk_feature_files ||= Environment::RequiredFeatures.feature_files(@configuration))
+        found = disk.reject { |path, _| @buffer_sources.key?(path) }.values.flatten
+        found += @buffer_sources.values.flat_map { |source| Environment::RequiredFeatures.features_of(source) }
+        found.uniq.sort.freeze
+      end
+
       # Drops every cached collaborator and bumps the generation. The next reader rebuilds from scratch.
       # Triggered by `workspace/didChangeWatchedFiles` for project source files and by
       # `workspace/didChangeConfiguration`.
       def invalidate!
         @generation += 1
         @environment = nil
+        @environment_features = nil
+        @disk_feature_files = nil
         @project_scan = nil
         # The session's per-file cache was computed against the old environment / project scan, so it cannot
         # outlive them. The next save round primes a fresh one.

data/lib/rigor/language_server/server.rb

@@ -2,6 +2,7 @@
 
 require_relative "../version"
 require_relative "buffer_table"
+require_relative "uri"
 
 module Rigor
   module LanguageServer
@@ -221,6 +222,7 @@ module Rigor
           bytes: doc.fetch(:text),
           version: doc.fetch(:version)
         )
+        note_buffers
         @publisher&.publish_for(uri)
         nil
       end
@@ -242,6 +244,7 @@ module Rigor
           changes: changes,
           version: doc.fetch(:version)
         )
+        note_buffers
         @publisher&.publish_for(uri)
         nil
       end
@@ -257,6 +260,7 @@ module Rigor
       def handle_did_save(params)
         uri = params.fetch(:textDocument).fetch(:uri)
         @buffer_table.save(uri: uri)
+        note_buffers
         @publisher&.publish_project(uri)
         nil
       end
@@ -361,10 +365,24 @@ module Rigor
         doc = params.fetch(:textDocument)
         uri = doc.fetch(:uri)
         @buffer_table.close(uri: uri)
+        note_buffers
         @publisher&.publish_empty(uri)
         nil
       end
 
+      # Issue #1700 — hands the open Ruby buffers to the project context, which rebuilds its environment when
+      # they change the set of required features the vendored signatures are gated on.
+      def note_buffers
+        return unless @project_context.respond_to?(:note_buffers)
+
+        sources = @buffer_table.uris.each_with_object({}) do |uri, acc|
+          path = Uri.to_path(uri)
+          entry = @buffer_table[uri]
+          acc[File.expand_path(path)] = entry.bytes if path&.end_with?(".rb") && entry
+        end
+        @project_context.note_buffers(sources)
+      end
+
       def method_not_found(method)
         rpc_error(ERROR_METHOD_NOT_FOUND, "method not found: #{method.inspect}")
       end