rigortype 0.4.3 → 0.4.5

data/lib/rigor/inference/project_patched_visibility.rb

@@ -0,0 +1,214 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../source/literals"
+require_relative "../source/node_children"
+require_relative "module_function_state"
+require_relative "project_patched_mixins"
+
+module Rigor
+  module Inference
+    module ProjectPatchedScanner
+      # Issue #1708 — the visibility a `pre_eval:` file gives each `def` it writes in a class, module or `class <<`
+      # body, so a private patch does not answer a call with an explicit receiver. Ruby 4.0.5:
+      # `module Kernel; private def kp = 1; end; 1.kp` raises NoMethodError (private method 'kp' called for an
+      # instance of Integer), while a bare `kp` runs.
+      #
+      # The readings, over each body's direct statements in order:
+      #
+      # - a bare `private`, `protected`, `public` or `module_function` (receiverless or on `self`) sets the default
+      #   for the `def`s after it in that body;
+      # - `private def x`, `protected def x`, `public def x`, `module_function def x` set that `def`'s, and
+      #   `private_class_method def self.x` / `public_class_method def self.x` a singleton `def`'s;
+      # - a `def self.x` is public whatever the default says, as in Ruby;
+      # - a `def` nested in a statement (an `if`, a `begin`) takes the default, unless the statement holds a bare
+      #   call of its own, which may or may not run: then it and every `def` after it are public, the reading that
+      #   answers more calls.
+      #
+      # A `def` this does not reach (one in a block, a `rescue` clause, or a body nested in a conditional, a block or a
+      # method, which may not run) is public. A named call with Symbol arguments (`private :x`) is the scanner's to
+      # apply, since it may name a `def` of an earlier file ({.pending}).
+      module Visibility
+        # The receiverless calls that set an instance `def`'s visibility, and what they set. `module_function` makes
+        # the instance method private and adds a public singleton copy.
+        INSTANCE_CALLS = {
+          private: :private, protected: :protected, public: :public, module_function: :module_function
+        }.freeze
+        # The calls that set a singleton `def`'s visibility.
+        SINGLETON_CALLS = { private_class_method: :private, public_class_method: :public }.freeze
+
+        # The nodes a nested `def` does not take the body's default under: another body, or a block.
+        OPAQUE = [
+          Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode, Prism::DefNode, Prism::BlockNode,
+          Prism::LambdaNode
+        ].freeze
+        private_constant :OPAQUE
+
+        # The bodies {.read_body} reads when they are a direct statement of a body it reads.
+        BODIES = [Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+        private_constant :BODIES
+
+        # A named visibility call (`private :x`, `module_function :x`, `private_class_method :x`) in a body, which
+        # {ProjectPatchedScanner.resolve_aliases} applies to the binding its name has when it runs. `visibility` is
+        # `:private`, `:protected`, `:public` or `:module_function`.
+        Pending = Data.define(:class_name, :names, :kind, :visibility, :source_path, :source_line)
+
+        module_function
+
+        # The {Pending} change a named visibility call in a body makes, or nil. The `def`-argument form
+        # (`private def x`) is {.defs}'s; a computed name is skipped, leaving the method public.
+        def pending(node, qualified_prefix, in_singleton_class, source_path)
+          return nil if qualified_prefix.empty?
+
+          visibility, side = call(node)
+          return nil if visibility.nil? || node.arguments.nil?
+
+          names = node.arguments.arguments.filter_map { |arg| Source::Literals.symbol_or_string(arg) }
+          return nil if names.empty?
+
+          Pending.new(
+            class_name: qualified_prefix.join("::"), names: names,
+            kind: side == :singleton || in_singleton_class ? :singleton : :instance, visibility: visibility,
+            source_path: source_path, source_line: node.location&.start_line || 1
+          )
+        end
+
+        # The value {.defs} records for a call written as a direct statement of a body or of the file's top level, the
+        # only calls whose named visibility change ({.pending}) or mixin edge ({Mixins.pending}) the scanner applies to
+        # the body's class. A call nested in a conditional, a block, a method body or a `Class.new` may not run, or
+        # runs on another class, so it changes nothing: the reading that answers more calls.
+        STATEMENT = Object.new.freeze
+
+        # @return the visibility of each `def` (by identity) the file's bodies give one other than public:
+        #   `:private`, `:protected` or `:module_function`; and {STATEMENT} for each call that is a direct statement,
+        #   and for the include an idempotence guard runs ({Mixins.guarded}).
+        def defs(root)
+          found = {}.compare_by_identity
+          # The file's top level, and through {.read_body} every class, module or `class <<` body written as a direct
+          # statement of it or of another body so read: the bodies that run whenever the file loads. A body nested in
+          # a conditional, a block or a method may not run, so none of its calls or toggles is read and its `def`s
+          # are public.
+          read_body(root.statements, found, top_level: true) if root.is_a?(Prism::ProgramNode)
+          found
+        end
+
+        # Applies a {Pending} change to the binding each of its names has: `bound` maps `[class_name, name, kind]` to
+        # that binding and `homes` to the per-file table holding it, which is updated in place, so the change is not a
+        # second declaration. A name the class does not bind is one it inherits (`public :kp` in `class Integer` over
+        # `module Kernel; private def kp`), which Ruby copies onto the class with the new visibility: `overrides` gets
+        # `key => visibility` for {ProjectPatchedMethods#lookup_through_ancestors} to apply to the body it finds farther
+        # on. Yields each copy that binds (`module_function :x`'s singleton), at the call's line, for the caller to
+        # bind.
+        def apply(pending, bound, homes, overrides)
+          pending.names.each do |name|
+            key = [pending.class_name, name, pending.kind]
+            entry = bound[key]
+            next overrides[key] = pending.visibility if entry.nil?
+
+            changed, *copies = applied(entry, pending.visibility)
+            bound[key] = homes[key][key] = changed
+            copies.each { |copy| yield copy.with(source_path: pending.source_path, source_line: pending.source_line) }
+          end
+        end
+
+        # `entry` as `visibility` leaves it, then any copy that binds: `module_function` makes an instance method
+        # private and binds a public singleton copy, as Ruby does.
+        def applied(entry, visibility)
+          return [entry.with(visibility: visibility)] unless visibility == :module_function
+
+          copies = [entry.with(visibility: :private)]
+          copies << entry.with(kind: :singleton, visibility: :public) if entry.kind == :instance
+          copies
+        end
+
+        # The visibility call `node` is, as `[visibility, side]`, or nil: `side` is `:instance` for the
+        # {INSTANCE_CALLS} and `:singleton` for the {SINGLETON_CALLS}.
+        def call(node)
+          return nil unless node.is_a?(Prism::CallNode)
+          return nil unless node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+          if (visibility = INSTANCE_CALLS[node.name])
+            [visibility, :instance]
+          elsif (visibility = SINGLETON_CALLS[node.name])
+            [visibility, :singleton]
+          end
+        end
+
+        # The include an idempotence guard runs (`X.include(M) unless X.include?(M)`) is read as a direct statement.
+        def mark_guarded(stmt, found, top_level)
+          guarded = Mixins.guarded(stmt, top_level)
+          found[guarded] = STATEMENT if guarded
+        end
+        private_class_method :mark_guarded
+
+        # `top_level` is true for the file's own statements only; a body it reads is a class or module body.
+        def read_body(body, found, top_level: false) # rubocop:disable Metrics/PerceivedComplexity
+          default = :public
+          direct_statements(body).each do |stmt|
+            found[stmt] = STATEMENT if stmt.is_a?(Prism::CallNode)
+            visibility, side = call(stmt)
+            if visibility && ModuleFunctionState.bare?(stmt)
+              default = visibility if side == :instance
+            elsif visibility
+              mark_arguments(stmt, visibility, side, found)
+            elsif stmt.is_a?(Prism::DefNode)
+              mark(stmt, default, found) if stmt.receiver.nil?
+            elsif BODIES.any? { |kind| stmt.is_a?(kind) }
+              read_body(stmt.body, found)
+            else
+              mark_guarded(stmt, found, top_level)
+              default = :public if bare_call_nested?(stmt)
+              mark_nested(stmt, default, found)
+            end
+          end
+        end
+        private_class_method :read_body
+
+        def direct_statements(body)
+          body = body.statements if body.is_a?(Prism::BeginNode)
+          body.is_a?(Prism::StatementsNode) ? body.body : []
+        end
+        private_class_method :direct_statements
+
+        def mark_arguments(call, visibility, side, found)
+          call.arguments&.arguments&.each do |arg|
+            next unless arg.is_a?(Prism::DefNode)
+            next unless (side == :singleton) == arg.receiver.is_a?(Prism::SelfNode)
+
+            mark(arg, visibility, found)
+          end
+        end
+        private_class_method :mark_arguments
+
+        def mark(def_node, visibility, found)
+          found[def_node] = visibility unless visibility == :public
+        end
+        private_class_method :mark
+
+        def mark_nested(node, default, found)
+          return unless node.is_a?(Prism::Node)
+          return if OPAQUE.any? { |kind| node.is_a?(kind) } && !node.is_a?(Prism::DefNode)
+
+          if node.is_a?(Prism::DefNode)
+            mark(node, default, found) if node.receiver.nil?
+            return
+          end
+          node.rigor_each_child { |child| mark_nested(child, default, found) }
+        end
+        private_class_method :mark_nested
+
+        def bare_call_nested?(node)
+          return false unless node.is_a?(Prism::Node)
+          return false if OPAQUE.any? { |kind| node.is_a?(kind) }
+
+          visibility, = call(node)
+          return true if visibility && ModuleFunctionState.bare?(node)
+
+          node.compact_child_nodes.any? { |child| bare_call_nested?(child) }
+        end
+        private_class_method :bare_call_nested?
+      end
+    end
+  end
+end

data/lib/rigor/inference/project_seed_tables.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require_relative "scope_indexer"
+
+module Rigor
+  module Inference
+    # Issue #1614 — the cross-file discovery seed the paths that type a project WITHOUT a `check` run hand their
+    # per-file scopes: {Protection::DiscoverySeed} (the protection scan, `rigor coverage`) and
+    # {ParameterInferenceCollector} (the ADR-67 call-site pre-pass, which `check` itself runs under
+    # `parameter_inference:`). Each used to keep its own list of tables, and each dropped some that
+    # `Analysis::Runner#project_scope_seed_tables` carries, so a cross-file constant read `30` under `check` and
+    # `Dynamic` under coverage, and a parameter whose call sites pass it went uninferred.
+    #
+    # This module is the one list both paths read. {Analysis::Runner#project_scope_seed_tables} stays the
+    # reference; `spec/rigor/inference/project_seed_tables_spec.rb` compares the two over a project that fills
+    # every table, and requires each table the runner seeds and this one does not to be in {NOT_SEEDED}, with its
+    # reason.
+    module ProjectSeedTables
+      module_function
+
+      # The def-index slots that seed a per-file scope as they are, each with the {Scope::DiscoveryIndex} member it
+      # fills.
+      SLOTS = {
+        def_nodes: :discovered_def_nodes, def_nestings: :discovered_def_nestings,
+        singleton_def_nodes: :discovered_singleton_def_nodes, def_sources: :discovered_def_sources,
+        singleton_def_sources: :discovered_singleton_def_sources, superclasses: :discovered_superclasses,
+        header_nestings: :discovered_header_nestings, includes: :discovered_includes,
+        prepends: :discovered_prepends, extends: :discovered_extends, unpositioned_mixins: :unpositioned_mixins,
+        class_sources: :discovered_class_sources, method_visibilities: :discovered_method_visibilities,
+        methods: :discovered_methods, parameter_envelopes: :discovered_parameter_envelopes,
+        data_member_layouts: :data_member_layouts, struct_member_layouts: :struct_member_layouts,
+        deferred_ranges: :discovered_deferred_ranges, refinements: :discovered_refinements,
+        global_write_census: :discovered_global_write_census
+      }.freeze
+
+      # The tables `Runner#project_scope_seed_tables` can seed that {.from_index} leaves out, and why. Parity is over
+      # the table LIST: the runner's opt-in additions to a table's content are not reproduced here.
+      # `discovered_refinements` is the project's alone (the runner unions in the refinements of gems under
+      # `dependencies.source_inference:`), and no `discovery_seed:` base is merged in (the runner can start from one).
+      NOT_SEEDED = {
+        run_generation: "the identity token of a check run's return memo; these paths run no check",
+        constant_sources: "read only by dependency recording, which only an incremental check run turns on",
+        param_inferred_types: "the parameter-inference output itself; each caller adds its own " \
+                              "(DiscoverySeed.build, coverage under parameter_inference:, the collector's last round)"
+      }.freeze
+
+      # The seed tables over `paths`, from one parse of each file.
+      def for_paths(paths)
+        from_index(ScopeIndexer.discovered_project_index_for_paths(paths))
+      end
+
+      # Maps a `{ classes:, def_index: }` discovery index onto {Scope::DiscoveryIndex} member names. Empty tables are
+      # dropped so an empty seed stays `{}`; a paired member and its sibling are dropped only together.
+      #
+      # `in_source_constants` is the project's literal constant table alone: the `pre_eval:` publication a `check` run
+      # joins to it types each listed file's writes against the RBS environment, which these paths do not build first.
+      def from_index(index)
+        def_index = index.fetch(:def_index)
+        tables = { discovered_classes: index.fetch(:classes) }
+        SLOTS.each { |slot, member| tables[member] = def_index.fetch(slot) }
+        tables.merge!(constant_tables(def_index.fetch(:constant_values), def_index.fetch(:constant_writes)))
+        tables.merge!(def_index.fetch(:siblings))
+        Scope::DiscoveryIndex.compact_pairs(
+          tables.reject { |name, table| !Scope::DiscoveryIndex.paired?(name) && (table.nil? || table.empty?) }
+        )
+      end
+
+      def constant_tables(values, writes)
+        {
+          in_source_constants: values,
+          published_constant_names: published_constant_names(values),
+          constant_writers: constant_writers(writes),
+          constant_shadowers: constant_shadowers(writes)
+        }
+      end
+
+      # Issue #644 — the last segments of the published constant table, the run-wide half of
+      # `Scope#published_constant?`.
+      def published_constant_names(values)
+        values.keys.to_set { |name| name.split("::").last }.freeze
+      end
+
+      # Issue #617 — the censused names that bind, grouped by last segment (`Scope#bound_constant_names`). A name some
+      # write other than a memo `||=` touches always binds. A memo-only name binds once memos of its segment span two
+      # files: either may load first and set the constant the other then reads, so only a memo no other file shares
+      # keeps the idiom's reading. Files are counted expanded, because discovery can walk one file under two
+      # spellings (`lib/b.rb`, `./lib/b.rb`).
+      def constant_writers(writes)
+        memo_files = memo_files_by_segment(writes)
+        writes.each_with_object({}) do |(name, by_path), index|
+          segment = name.split("::").last
+          next if memo_only?(by_path) && memo_files.fetch(segment).size < 2
+
+          (index[segment] ||= []) << name
+        end.each_value(&:freeze).freeze
+      end
+
+      # Issue #1290 — the censused names some write other than a memo `||=` assigns, grouped by last segment
+      # (`Scope#shadowing_constant_names`): the ones that exist whether or not an outer constant of the name does, and
+      # so stop the lexical ladder above it. A memo-only name is left out however many files memoize it, unlike in
+      # {.constant_writers}: `X ||= v` resolves `X` through the very lookup whose lower rung the stop would replace,
+      # so wherever that rung answers, the memo finds it and never creates the name.
+      def constant_shadowers(writes)
+        writes.each_with_object({}) do |(name, by_path), index|
+          (index[name.split("::").last] ||= []) << name unless memo_only?(by_path)
+        end.each_value(&:freeze).freeze
+      end
+
+      def memo_files_by_segment(writes)
+        writes.each_with_object({}) do |(name, by_path), files|
+          set = (files[name.split("::").last] ||= Set.new)
+          by_path.each { |path, descriptor| set << File.absolute_path(path) if memo_descriptor?(descriptor) }
+        end
+      end
+
+      def memo_only?(by_path) = by_path.each_value.all? { |descriptor| memo_descriptor?(descriptor) }
+      def memo_descriptor?(descriptor) = descriptor == ScopeIndexer::CONSTANT_MEMO
+    end
+  end
+end

data/lib/rigor/inference/refined_dispatch/constructed_class.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    module RefinedDispatch
+      # Issue #1979 — whether a class whose superclass the tables do not know is `class K < <expr>` with `<expr>` a
+      # core constructor call (`Data.define(...)`, `Struct.new(...)`, `Class.new(<constant>)`) that cannot answer a
+      # given class or one of its subclasses, so a subclass walk may leave it out (`OwnMethod.each_subclass` with
+      # `possible_only:`).
+      #
+      # Each constant the expression names (the indexer's `[DiscoveryIndex::ENVELOPE_CONSTRUCTED_KIND, name]` entries)
+      # must be a class the environment knows that is neither the given class nor a subclass of it, and the project
+      # must not touch the name: no project class or module whose last segment is the name (Ruby resolves a constant
+      # through the enclosing classes' ancestors and mixins too, so a `Base::StandardError` a class inherits may be
+      # what `Class.new(StandardError)` names), no reopening, singleton `def`, refinement or method table keyed by
+      # the name itself, and no constant write of it. Any other shape answers false, as does a class a
+      # `K = Class.new(...)` write names.
+      module ConstructedClass
+        MEMO_KEY = :__rigor_constructed_class__
+        EMPTY = [].freeze
+        private_constant :MEMO_KEY, :EMPTY
+
+        module_function
+
+        # True when `name` cannot be `class_name` or a subclass of it. Files `name`'s class edge and a `constant:`
+        # edge per named constant on every call; a class declaration appearing fires the walk's `subclass_of:*`.
+        def elsewhere?(scope, name, class_name)
+          table = memo(scope)
+          named = constructed_names(scope, name, table)
+          if Analysis::DependencyRecorder.active?
+            Scope::ResolutionChain.record_class(scope, name)
+            named.each { |constant| Analysis::DependencyRecorder.read_name(:constant, constant) }
+          end
+          return false if named.empty?
+
+          by_class = (table[:verdicts][class_name] ||= {})
+          return by_class[named] if by_class.key?(named)
+
+          by_class[named] = named.all? { |constant| core_class_apart?(scope, constant, class_name.to_s, table) }
+        end
+
+        def core_class_apart?(scope, constant, class_name, table)
+          environment = scope.environment
+          return false unless environment&.class_known?(constant)
+          return false if project_name?(scope, constant, table)
+          return false unless scope.shadowing_constant_names(constant).empty?
+
+          ordering = environment.class_ordering(constant, class_name)
+          %i[disjoint superclass].include?(ordering) ||
+            (ordering == :unknown && !environment.class_known?(class_name))
+        end
+
+        # Whether the project touches `constant` by name: a declared or reopened class or module whose last segment
+        # it is, or a top-level table keyed by it (a singleton `def Data.define`, methods, envelope entries or marks,
+        # mixins, a refinement).
+        def project_name?(scope, constant, table)
+          return true if declared_segments(scope, table).include?(constant)
+
+          discovery = scope.discovery
+          [discovery.discovered_classes, discovery.discovered_superclasses, discovery.discovered_includes,
+           discovery.discovered_prepends, discovery.discovered_extends, discovery.discovered_methods,
+           discovery.discovered_parameter_envelopes, discovery.discovered_refinements].any? do |by_name|
+            by_name.key?(constant)
+          end
+        end
+
+        # The last segment of every class or module the project declares, reopenings included.
+        def declared_segments(scope, table)
+          table[:segments] ||= declared_names(scope).each_key.to_set { |key| key.to_s.split("::").last }.freeze
+        end
+
+        # The constants `name`'s superclass expression names, or an empty Array; memoised per envelope bucket,
+        # which a file's own discovery shares with the run's seed for every class it does not declare.
+        def constructed_names(scope, name, table)
+          bucket = scope.discovered_parameter_envelopes[name]
+          return EMPTY if bucket.nil?
+
+          names = table[:names]
+          return names[bucket] if names.key?(bucket)
+
+          names[bucket] =
+            if bucket.key?(Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK)
+              EMPTY
+            else
+              kind = Scope::DiscoveryIndex::ENVELOPE_CONSTRUCTED_KIND
+              bucket.each_key.filter_map { |key| key[1] if key.is_a?(Array) && key[0] == kind }.freeze
+            end
+        end
+
+        # The run-wide table of declared classes: the seeded `discovered_class_sources`, or a single-file run's
+        # `discovered_classes` where nothing seeded it.
+        def declared_names(scope)
+          sources = scope.discovery.discovered_class_sources
+          sources.empty? ? scope.discovery.discovered_classes : sources
+        end
+
+        # One thread-local slot keyed on the run-generation token the runner seeds (or, unseeded, the file's merged
+        # `discovered_def_nodes`, as `ExpressionTyper` falls back) and the environment: every table read here is
+        # fixed for a run, so each answer is computed once a run, and a new run replaces the slot.
+        def memo(scope)
+          slot = Thread.current[MEMO_KEY]
+          generation = scope.run_generation || scope.discovered_def_nodes
+          environment = scope.environment
+          unless slot && slot[0].equal?(generation) && slot[1].equal?(environment)
+            slot = [generation, environment, { names: {}.compare_by_identity, verdicts: {} }]
+            Thread.current[MEMO_KEY] = slot
+          end
+          slot[2]
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/refined_dispatch/own_method.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../builtins/cruby_definers"
+require_relative "constructed_class"
 
 module Rigor
   module Inference
@@ -193,8 +194,7 @@ module Rigor
         # A module some code `prepend`s to an object's singleton class (or `extend`s an object with in a method
         # body), which puts it ahead of the object's class even where the class already includes it.
         def object_prepended?(scope, name)
-          scope.discovered_parameter_envelopes[name]&.key?(Scope::DiscoveryIndex::ENVELOPE_OBJECT_EXTENDED_MARK) ||
-            false
+          scope.parameter_envelopes_of(name).key?(Scope::DiscoveryIndex::ENVELOPE_OBJECT_EXTENDED_MARK)
         end
 
         # Is some in-effect row under a class no table declares by any spelling of it (the keys sharing its last
@@ -282,10 +282,16 @@ module Rigor
         # declaration with that superclass appearing or vanishing fires (`IncrementalSession#negative_affected`).
         # A class whose superclass the tables do not know may be a subclass of any class, so it joins the walk too
         # (`subclass_of:*`, which any class declaration appearing or vanishing fires).
-        def each_subclass(scope, class_name)
+        #
+        # Issue #1979 — with `possible_only:`, a class whose superclass expression is a core constructor call that
+        # cannot answer `class_name` or a subclass of it (`ConstructedClass.elsewhere?`) is left out, with its
+        # subclasses.
+        def each_subclass(scope, class_name, possible_only: false)
           children = children_by_parent(scope)
           record_subclasses_read(class_name)
-          queue = children.fetch(class_name.to_s, []) + unknown_superclass_classes(scope, class_name)
+          unknown = unknown_superclass_classes(scope, class_name)
+          unknown = unknown.reject { |name| ConstructedClass.elsewhere?(scope, name, class_name) } if possible_only
+          queue = children.fetch(class_name.to_s, []) + unknown
           seen = {}
           until queue.empty?
             subclass = queue.shift
@@ -300,10 +306,32 @@ module Rigor
 
         def unknown_superclass_classes(scope, class_name)
           Analysis::DependencyRecorder.read_name(:subclass_of, "*") if Analysis::DependencyRecorder.active?
-          mark = Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK
-          computed = scope.discovered_superclasses.filter_map { |child, parent| child if parent.nil? }
-          meta = scope.discovered_parameter_envelopes.filter_map { |name, bucket| name if bucket.key?(mark) }
-          (computed + meta).uniq - [class_name.to_s]
+          table = subclass_memo(scope)
+          all = table[:unknown] ||= begin
+            mark = Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK
+            computed = scope.discovered_superclasses.filter_map { |child, parent| child if parent.nil? }
+            meta = scope.discovered_parameter_envelopes.filter_map { |name, bucket| name if bucket.key?(mark) }
+            (computed + meta).uniq.freeze
+          end
+          name = class_name.to_s
+          all.include?(name) ? all - [name] : all
+        end
+
+        SUBCLASS_MEMO_KEY = :__rigor_own_method_subclasses__
+        private_constant :SUBCLASS_MEMO_KEY
+
+        # One thread-local slot keyed on the scope's discovery index (a frozen `Data`) and environment, the only
+        # inputs `children_by_parent` and the unknown-superclass list read; neither files a dependency edge
+        # (`each_subclass` files its own `subclass_of:` edges on every call), so a hit drops none.
+        def subclass_memo(scope)
+          slot = Thread.current[SUBCLASS_MEMO_KEY]
+          discovery = scope.discovery
+          environment = scope.environment
+          unless slot && slot[0].equal?(discovery) && slot[1].equal?(environment)
+            slot = [discovery, environment, {}]
+            Thread.current[SUBCLASS_MEMO_KEY] = slot
+          end
+          slot[2]
         end
 
         def record_subclasses_read(class_name)
@@ -313,10 +341,11 @@ module Rigor
         end
 
         def children_by_parent(scope)
-          scope.discovered_superclasses.each_with_object({}) do |(child, raw_parent), children|
-            parent = scope.ancestor_name_candidates(child, raw_parent).find { |name| known_class?(scope, name) }
-            (children[parent] ||= []) << child if parent
-          end
+          subclass_memo(scope)[:children] ||=
+            scope.discovered_superclasses.each_with_object({}) do |(child, raw_parent), children|
+              parent = scope.ancestor_name_candidates(child, raw_parent).find { |name| known_class?(scope, name) }
+              (children[parent] ||= []) << child if parent
+            end.each_value(&:freeze).freeze
         end
 
         def known_class?(scope, name)

data/lib/rigor/inference/reflective_ivar_write.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+
+module Rigor
+  module Inference
+    # Issue #1889 — `instance_variable_set` called on `self` writes an instance variable that no write node shows.
+    # Left unseen, the binding the call site holds outlived it: `@n = 0; instance_variable_set(:@n, 5)` kept `@n`
+    # on `0`, and a block that wrote `@n` only this way never entered the captured-binding name set, so
+    # `[1, 2].inject(0) { |a, e| instance_variable_set(:@n, @n + 1); a + @n }` folded to a constant.
+    #
+    # A call counts when its receiver is implicit or `self` and it passes any argument ({.self_write?}). With
+    # exactly two plain positional arguments, the first a Symbol or String literal naming an instance variable
+    # (`:@n`, `"@n"`; Ruby accepts both), it is a write of that variable ({.literal_name}). Any other argument list
+    # — a computed name, a splat (`instance_variable_set(*args)`), a keyword hash, or a literal Ruby rejects with
+    # `NameError` (`:n`) — names an ivar the analysis cannot see, so every ivar the scope binds may have been
+    # written ({.apply}; for a rejected literal this over-approximates, which only widens).
+    # `obj.instance_variable_set` writes another object's ivar and does not count; neither does the reflective
+    # `send(:instance_variable_set, …)`.
+    module ReflectiveIvarWrite
+      METHOD_NAME = :instance_variable_set
+      private_constant :METHOD_NAME
+
+      IVAR_NAME = /\A@[A-Za-z_]\w*\z/
+      private_constant :IVAR_NAME
+
+      REPEATING_KEY = :__rigor_reflective_ivar_write_repeating__
+      private_constant :REPEATING_KEY
+
+      module_function
+
+      # True when `node` is an `instance_variable_set` on `self` with at least one argument.
+      def self_write?(node)
+        return false unless node.is_a?(Prism::CallNode) && node.name == METHOD_NAME
+        return false unless node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+        arguments = node.arguments&.arguments
+        !arguments.nil? && !arguments.empty?
+      end
+
+      # `:@n` for `instance_variable_set(:@n, v)` or `instance_variable_set("@n", v)` on `self`, else nil.
+      def literal_name(node)
+        return nil unless self_write?(node)
+
+        arguments = node.arguments.arguments
+        return nil unless arguments.size == 2 && arguments.none? { |arg| splat_or_keywords?(arg) }
+
+        name = arguments.first
+        text =
+          case name
+          when Prism::SymbolNode, Prism::StringNode then name.unescaped
+          end
+        text && IVAR_NAME.match?(text) ? text.to_sym : nil
+      end
+
+      # True for a call {.self_write?} takes whose target {.literal_name} cannot name: it may write any ivar.
+      def unknown_target?(node)
+        self_write?(node) && literal_name(node).nil?
+      end
+
+      # The value argument of a call {.literal_name} names.
+      def value_node(node)
+        node.arguments.arguments[1]
+      end
+
+      # Runs the block with the evaluator inside a `for` body or a `while` / `until` predicate. A `for` loop has no
+      # rebind fixpoint, and a predicate runs before every iteration but is walked once, so a literal-name write there
+      # must not replace the binding with one pass's value ({.apply}). A `while` / `until` body does not enter it: its
+      # fixpoint widens the ivar (issue #1930).
+      def in_repeating_body
+        depth = Thread.current[REPEATING_KEY] || 0
+        Thread.current[REPEATING_KEY] = depth + 1
+        begin
+          yield
+        ensure
+          Thread.current[REPEATING_KEY] = depth
+        end
+      end
+
+      def repeating_body?
+        (Thread.current[REPEATING_KEY] || 0).positive?
+      end
+
+      # `scope` after `node` runs. A literal name binds that ivar to the value's type (yielded), as `@n = v` does.
+      # Inside a `for` body or a loop predicate ({.in_repeating_body}) the value and `Dynamic[top]` are joined into the
+      # current binding instead: nothing widens the single pass's value across iterations there. Any other call joins
+      # `Dynamic[top]` into every ivar `scope` binds: any one of them may now hold the value, and joining the
+      # value's own type would report a method the old value has and the new one lacks. An ivar on its ADR-58
+      # declaration seed keeps its mark, which stops a nil in the seed from fuelling a nil-receiver diagnostic.
+      def apply(node, scope)
+        return scope unless self_write?(node)
+
+        name = literal_name(node)
+        return bind_literal(scope, name, yield) if name
+
+        floor = Type::Combinator.untyped
+        scope.ivars.reduce(scope) do |acc, (ivar, type)|
+          widened = Type::Combinator.union(type, floor)
+          rebound = acc.with_ivar(ivar, widened).without_ivar_guard(ivar)
+          scope.declaration_sourced?(:ivar, ivar) ? rebound.seed_declaration_sourced_ivar(ivar, widened) : rebound
+        end
+      end
+
+      def bind_literal(scope, name, value)
+        type = repeating_body? ? Type::Combinator.union(*scope.ivar(name), value, Type::Combinator.untyped) : value
+        scope.with_ivar(name, type).without_ivar_guard(name)
+      end
+
+      def splat_or_keywords?(arg)
+        arg.is_a?(Prism::SplatNode) || arg.is_a?(Prism::KeywordHashNode) || arg.is_a?(Prism::BlockArgumentNode)
+      end
+    end
+  end
+end