rigortype 0.4.4 → 0.4.6

data/lib/rigor/environment/required_features.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../analysis/path_expansion"
+require_relative "../rooted_glob"
 
 module Rigor
   class Environment
@@ -42,6 +43,36 @@ module Rigor
       # anything.
       PATTERN = /(?:(?<![\w.$@])|(?<=Kernel\.))require[ \t]*\(?[ \t]*(["'])(#{FEATURE_ALTERNATION})\1/
 
+      # Issue #2174 — the gems Ruby 4.0 bundles (its `gems/bundled_gems` list, which an installation does not
+      # keep): installed beside the interpreter, but loaded only by an explicit `require`. Gems installed later
+      # into the same directory are deliberately not read from it.
+      BUNDLED_GEMS = %w[
+        abbrev base64 benchmark bigdecimal csv debug drb fiddle getoptlong irb logger matrix minitest mutex_m
+        net-ftp net-imap net-pop net-smtp nkf observer ostruct power_assert prime pstore racc rake rbs rdoc readline
+        reline repl_type_completor resolv-replace rexml rinda rss syslog test-unit typeprof win32ole
+      ].freeze
+
+      # Issue #2174 — the first path segments of the features Ruby ships: the `.rb` files and directories of the
+      # interpreter's library directory, the extensions and directories of its architecture directory, and the
+      # bundled gems' names (`net-ftp` → `net`). Read once, at load time and on the main Ractor, since
+      # `RbConfig::CONFIG` is not shareable; empty when the directories cannot be read.
+      SHIPPED_SEGMENTS = begin
+        require "rbconfig"
+        segments = Set.new
+        [RbConfig::CONFIG["rubylibdir"], RbConfig::CONFIG["archdir"]].compact.each do |dir|
+          next unless File.directory?(dir)
+
+          Dir.children(dir).each { |entry| segments << entry.sub(/\.(?:rb|so|bundle|dll)\z/, "") }
+        end
+        BUNDLED_GEMS.each { |name| segments << name.split("-").first }
+        segments.to_set(&:freeze).freeze
+      rescue StandardError
+        Set.new.freeze
+      end
+
+      # A `require` of any literal feature, read as {PATTERN} reads one; {.features_of} keeps those Ruby ships.
+      ANY_FEATURE = %r{(?:(?<![\w.$@])|(?<=Kernel\.))require[ \t]*\(?[ \t]*(["'])([\w-]+(?:/[\w-]+)*)\1}
+
       module_function
 
       # The features a run over `configuration` requires: every file under the configured paths, plus
@@ -53,37 +84,51 @@ module Rigor
       def for_configuration(configuration, extra_files = [], sources: {})
         files = Analysis::PathExpansion.ruby_files(configuration.paths, configuration.exclude_patterns,
                                                    base: configuration.exclude_base)
-        scan(files + Array(extra_files).map(&:to_s), sources: sources)
+        scan(files + Array(extra_files).map(&:to_s), sources: sources,
+                                                     sig_paths: configured_sig_paths(configuration))
       rescue StandardError
         []
       end
 
+      # The project signature roots the environment loads: the configured `signature_paths:`, else `./sig` when it
+      # exists (`Environment.project_signature_roots`, which this leaf file does not load).
+      def configured_sig_paths(configuration)
+        configured = configuration.signature_paths
+        return Array(configured).map(&:to_s) if configured
+
+        File.directory?("sig") ? ["sig"] : []
+      end
+
       # @param files — source paths (Strings or Pathnames); an unreadable one contributes nothing.
       # @param sources — path => source text, scanned instead of the file; its paths are scanned even when
       #   `files` does not list them.
-      # @return the sorted, frozen features some file requires.
-      def scan(files, sources: {})
+      # @param sig_paths — the project's signature roots, whose `.rbs` declaration headers count as the project's
+      #   own names ({.relevant}).
+      # @return the sorted, frozen features some file requires, a shipped one kept only when {.relevant}.
+      def scan(files, sources: {}, sig_paths: [])
         sources = sources.to_h { |path, text| [File.expand_path(path.to_s), text] }
         paths = (Array(files).map { |path| source_key(File.expand_path(path.to_s), sources) } + sources.keys).uniq
         found = Set.new
+        names = Set.new
         paths.each do |path|
-          break if found.size == VENDORED_DIRS.size
-
-          found.merge(sources.key?(path) ? features_of(sources[path]) : memoized_features_in(path))
+          features, declared = sources.key?(path) ? scan_source(sources[path]) : memoized_scan_in(path)
+          found.merge(features)
+          names.merge(declared)
         end
         prune_memo(paths)
-        found.to_a.sort.freeze
+        relevant(found, names.merge(sig_names(sig_paths))).sort.freeze
       end
 
-      # @return path (absolute) => the features that file requires, for every file under the configured paths
-      #   that requires any. A long-lived reader (the language server) keeps this and overlays its open buffers.
+      # @return path (absolute) => `[features, declared names]` ({.scan_source}) for every file under the
+      #   configured paths that has either. A long-lived reader (the language server) keeps this, overlays its open
+      #   buffers and passes the union to {.relevant}.
       def feature_files(configuration)
         listed = Analysis::PathExpansion.ruby_files(configuration.paths, configuration.exclude_patterns,
                                                     base: configuration.exclude_base)
         files = listed.map { |path| File.expand_path(path.to_s) }
         result = files.each_with_object({}) do |path, acc|
-          features = memoized_features_in(path)
-          acc[path] = features unless features.empty?
+          scanned = memoized_scan_in(path)
+          acc[path] = scanned unless scanned.all?(&:empty?)
         end
         prune_memo(files)
         result
@@ -91,6 +136,42 @@ module Rigor
         {}
       end
 
+      # Issue #2174 — `features` with each shipped feature kept only when one of `names` (constant names the
+      # project's source or signatures declare a class or module under) is a root the feature's library declares
+      # ({RubyLibraryRoots}). Only such a feature can open a class (`RbsLoader#ruby_library_reopen?` asks it of a
+      # class every declaration of which is the project's), so dropping the rest changes no diagnostic, and keeps a
+      # `require "json"` edit in a project that reopens no library class out of the incremental snapshot's
+      # fingerprint and the language server's environment key. The listed features ({VENDORED_DIRS}) are kept.
+      def relevant(features, names)
+        return features.to_a if features.all? { |feature| VENDORED_DIRS.key?(feature) }
+
+        segments = names.empty? ? EMPTY_SEGMENTS : library_segments(names)
+        features.select { |feature| VENDORED_DIRS.key?(feature) || segments.include?(feature.split("/").first) }
+      end
+
+      # The feature segments of the libraries that declare one of `names` as a root. Loaded lazily: the roots read
+      # the `rbs` stdlib tree, which a run with no shipped `require` never needs.
+      def library_segments(names)
+        require_relative "ruby_library_roots"
+        roots = RubyLibraryRoots.shared
+        names.each_with_object(Set.new) { |name, acc| acc.merge(roots.fetch(name, EMPTY_SEGMENTS)) }
+      end
+
+      EMPTY_SEGMENTS = [].freeze
+
+      # The constant names the `.rbs` files under `sig_paths` declare a class or module under.
+      def sig_names(sig_paths)
+        Array(sig_paths).each_with_object(Set.new) do |root, acc|
+          next unless File.directory?(root.to_s)
+
+          RootedGlob.glob(root.to_s, "**/*.rbs").each do |path|
+            acc.merge(declared_names(File.binread(path)))
+          rescue SystemCallError, IOError
+            next
+          end
+        end
+      end
+
       # Paths are compared expanded, so a relative `--instead-of=lib/a.rb` replaces the configured
       # `/project/lib/a.rb`; a source whose real path matches (a symlinked directory) replaces it too. The real
       # path is asked only for a file that shares a source's basename, so a scan does not resolve every path.
@@ -114,8 +195,8 @@ module Rigor
       # build; a long-lived language server on every rebuild), so on the main Ractor each file's answer is kept
       # against its stat and the file is re-read only when the stat moved. A non-main Ractor may not touch the
       # module's state and reads the file every time.
-      def memoized_features_in(path)
-        return features_in(path) unless Ractor.current == Ractor.main
+      def memoized_scan_in(path)
+        return scan_in(path) unless Ractor.current == Ractor.main
 
         stat = File.stat(path)
         stamp = [stat.mtime.to_r, stat.ctime.to_r, stat.size, stat.ino]
@@ -123,13 +204,15 @@ module Rigor
         cached = memo[path]
         return cached.last if cached && cached.first == stamp
 
-        features = features_in(path)
-        memo[path] = [stamp, features]
-        features
+        scanned = scan_in(path)
+        memo[path] = [stamp, scanned]
+        scanned
       rescue SystemCallError
-        []
+        NOTHING
       end
 
+      NOTHING = [[].freeze, [].freeze].freeze
+
       # Keeps the memo to the files the latest scan was asked about, so a long-lived language server holds one
       # entry per project file rather than one per file it ever saw.
       def prune_memo(paths)
@@ -139,28 +222,51 @@ module Rigor
         @memo.select! { |path, _| keep.include?(path) }
       end
 
-      # @return the features one file requires.
-      def features_in(path)
-        features_of(File.binread(path))
+      # @return `[features, declared names]` for one file ({.scan_source}).
+      def scan_in(path)
+        scan_source(File.binread(path))
       rescue SystemCallError, IOError
-        []
+        NOTHING
+      end
+
+      # @return `[features, declared names]`: what {.features_of} reads, and the constant names a `class` or
+      # `module` header in `source` spells, each segment on its own (`class Net::SMTP` gives `Net` and `SMTP`).
+      def scan_source(source)
+        [features_of(source), declared_names(source)].freeze
+      end
+
+      # A header on a line of its own, or inside a comment (an rbs-inline `# @rbs!` block declares
+      # `#   class Matrix`). Over-matching a comment only keeps more features.
+      HEADER = /^[ \t]*(?:#[ \t]*)?(?:class|module)[ \t]+(?:::)?([A-Z]\w*(?:::[A-Z]\w*)*)/
+
+      def declared_names(source)
+        bytes = source.b
+        return [] unless bytes.include?("class") || bytes.include?("module")
+
+        bytes.scan(HEADER).flat_map { |(name)| name.split("::") }
+             .uniq.map { |name| name.dup.force_encoding(Encoding::UTF_8).freeze }.freeze
       end
 
-      # @return the features `source` requires.
+      # @return the features `source` requires: the listed ones ({VENDORED_DIRS}), and, for issue #2174, every
+      # feature Ruby ships ({SHIPPED_SEGMENTS}), which `RbsLoader#ruby_library_reopen?` reads to tell a reopened
+      # library class from a project class of the same name. Only the listed ones become library tokens.
       def features_of(source)
-        # A plain substring test first: almost no file mentions any listed feature, and it is far cheaper than
-        # the regexp on a file that does not.
-        return [] unless VENDORED_DIRS.each_key.any? { |feature| source.include?(feature) }
+        # A plain substring test first: a file with no `require` at all is the common case, and it is far cheaper
+        # than the regexp on a file that has none.
+        return [] unless source.include?("require")
 
         bytes = source.b
         named = []
         position = 0
-        while (match = PATTERN.match(bytes, position))
+        while (match = ANY_FEATURE.match(bytes, position))
           named << match[2] unless commented?(bytes, match.begin(0))
           position = match.end(0)
         end
-        # The table's own frozen keys, so the result is shareable across Ractors whatever the source's encoding.
-        VENDORED_DIRS.each_key.select { |feature| named.include?(feature) }
+        # The table's own frozen keys, and frozen copies of the rest, so the result is shareable across Ractors
+        # whatever the source's encoding.
+        listed = VENDORED_DIRS.each_key.select { |feature| named.include?(feature) }
+        shipped = named.select { |feature| SHIPPED_SEGMENTS.include?(feature.split("/").first) }
+        (listed + shipped.map { |feature| feature.dup.force_encoding(Encoding::UTF_8).freeze }).uniq
       end
 
       # Whether the match at `offset` sits on a line whose first non-blank character is `#`: a whole-line comment.
@@ -176,7 +282,8 @@ module Rigor
       # The library tokens for `features` and for any listed feature the configuration's `libraries:` names.
       def tokens(features, configured_libraries)
         configured = Array(configured_libraries).map(&:to_s).select { |name| VENDORED_DIRS.key?(name) }
-        (Array(features) | configured).sort.map { |feature| token(feature) }
+        listed = Array(features).select { |feature| VENDORED_DIRS.key?(feature) }
+        (listed | configured).sort.map { |feature| token(feature) }
       end
 
       def token(feature)

data/lib/rigor/environment/ruby_library_roots.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require "rbs"
+require "rbconfig"
+require_relative "missing_gem_constant_index"
+require_relative "required_features"
+require_relative "../rooted_glob"
+
+module Rigor
+  class Environment
+    # Issue #2174 — which library Ruby ships declares each root constant name. Three sources are read, and no others:
+    #
+    # - every library of the `rbs` gem's `stdlib/` tree, loaded into this run or not, read from its `.rbs` files
+    #   (`net-http` declares `Net`);
+    # - every top-level `.rb` file of the interpreter's library directory (`RbConfig::CONFIG["rubylibdir"]`), the
+    #   default gems' and the standard library's entry files, read from their top-level declarations;
+    # - the entry file of each gem Ruby bundles ({RequiredFeatures::BUNDLED_GEMS}), found under the interpreter's
+    #   gem directory. A gem installed there later is not one of them and is not read.
+    #
+    # Each root maps to the first path segments of the features that load it (`Matrix` → `matrix`, `Net` → `net`),
+    # which {RbsLoader#ruby_library_reopen?} intersects with the features the project's source requires
+    # ({RequiredFeatures.features_of}).
+    #
+    # Ownership is read, never guessed by camelizing a library name, for the reason {MissingGemConstantIndex}
+    # gives; that module's reader parses the `.rb` entry files. No library code runs. Everything fails open to
+    # "no library", which keeps the pre-#2174 reading. Core names (`Array`, `Kernel`) appear too, harmlessly:
+    # core signatures always load, so no project-only class carries one.
+    #
+    # The directories are resolved at load time, on the main Ractor: `RbConfig::CONFIG` and `Gem.default_dir`
+    # read non-shareable constants and raise `Ractor::IsolationError` inside a pool worker. The scan itself runs
+    # lazily (about 0.1 s), memoised per loader, and only for a class about to be reported.
+    module RubyLibraryRoots
+      STDLIB_ROOT = begin
+        ::RBS::Repository::DEFAULT_STDLIB_ROOT.to_s.dup.freeze
+      rescue StandardError
+        nil
+      end
+
+      RUBY_LIB_DIR = begin
+        RbConfig::CONFIG["rubylibdir"].to_s.dup.freeze
+      rescue StandardError
+        nil
+      end
+
+      RUBY_GEMS_DIR = begin
+        File.join(Gem.default_dir, "gems").freeze
+      rescue StandardError
+        nil
+      end
+
+      module_function
+
+      # {.build}, built once per process on the main Ractor, where the language server and the incremental
+      # snapshot fingerprint ask it repeatedly; a non-main Ractor may not keep module state and builds its own.
+      def shared
+        return build unless Ractor.current == Ractor.main
+
+        @shared ||= build
+      end
+
+      # The frozen map of root constant name to the frozen set of feature segments that load it.
+      def build
+        roots = Hash.new { |hash, key| hash[key] = Set.new }
+        stdlib_roots(roots)
+        ruby_lib_roots(roots)
+        bundled_gem_roots(roots)
+        roots.each_value(&:freeze)
+        roots.default_proc = nil
+        roots.freeze
+      end
+
+      def stdlib_roots(roots)
+        return if STDLIB_ROOT.nil? || !File.directory?(STDLIB_ROOT)
+
+        Dir.children(STDLIB_ROOT).each do |library|
+          segment = library.split("-").first
+          RootedGlob.glob(File.join(STDLIB_ROOT, library), "*/**/*.rbs").each do |path|
+            stdlib_file_roots(path).each { |root| roots[root] << segment }
+          end
+        end
+      end
+
+      def stdlib_file_roots(path)
+        _, _, decls = ::RBS::Parser.parse_signature(File.read(path))
+        decls.filter_map { |decl| root_of(decl) if named_declaration?(decl) }
+      rescue StandardError
+        []
+      end
+
+      def ruby_lib_roots(roots)
+        return if RUBY_LIB_DIR.nil? || !File.directory?(RUBY_LIB_DIR)
+
+        RootedGlob.glob(RUBY_LIB_DIR, "*.rb").each do |path|
+          segment = File.basename(path, ".rb")
+          MissingGemConstantIndex.top_level_root_constants(path).each { |root| roots[root] << segment }
+        end
+      end
+
+      def bundled_gem_roots(roots)
+        return if RUBY_GEMS_DIR.nil? || !File.directory?(RUBY_GEMS_DIR)
+
+        Dir.children(RUBY_GEMS_DIR).each do |basename|
+          gem_name = basename[/\A(.+?)-\d/, 1]
+          next if gem_name.nil? || !RequiredFeatures::BUNDLED_GEMS.include?(gem_name)
+
+          segment = gem_name.split("-").first
+          MissingGemConstantIndex.entry_files(File.join(RUBY_GEMS_DIR, basename), gem_name).each do |path|
+            MissingGemConstantIndex.top_level_root_constants(path).each { |root| roots[root] << segment }
+          end
+        end
+      end
+
+      def named_declaration?(decl)
+        decl.is_a?(::RBS::AST::Declarations::Class) || decl.is_a?(::RBS::AST::Declarations::Module)
+      end
+
+      def root_of(decl)
+        decl.name.to_s.delete_prefix("::").split("::").first
+      end
+    end
+  end
+end

data/lib/rigor/environment.rb

@@ -268,7 +268,7 @@ module Rigor
       #   {Environment::RbsLoader} so constant lookups (and, in later v0.0.9 slices, other reflection
       #   artefacts) consult the cache. Pass `nil` (the default) to skip caching for this environment.
       # rubocop:disable-next Metrics/MethodLength, Metrics/ParameterLists
-      def for_project(root: Dir.pwd, libraries: [], signature_paths: nil, cache_store: nil,
+      def for_project(root: Dir.pwd, libraries: [], signature_paths: nil, cache_store: nil, # rubocop:disable Metrics/AbcSize
                       plugin_registry: nil, dependency_source_index: nil,
                       rbs_extended_reporter: nil, boundary_cross_reporter: nil,
                       source_rbs_synthesis_reporter: nil,
@@ -364,7 +364,9 @@ module Rigor
           # Issue #610 — the plugin-contributed subset is loaded LAST and may stand down against a colliding
           # generic arity. Only the bundled plugins' own `sig/` is deferred: the user's `signature_paths:`,
           # the bundle walk and `rbs collection install` all stay authoritative.
-          deferred_signature_paths: plugin_sig_paths
+          deferred_signature_paths: plugin_sig_paths,
+          project_signature_paths: resolved_paths,
+          required_features: required_features || RequiredFeatures.scan(source_files, sig_paths: resolved_paths)
         )
         # Issues #824 / #1075 — the rows ADR-112 WD5's consistency rule reports for members the project's
         # own `sig/` and an inline source both declare: an error per contradiction (or per refinement that

data/lib/rigor/inference/block_call_timing.rb

@@ -72,6 +72,12 @@ module Rigor
 
       module_function
 
+      # Whether `call_node` is spelled to reach the private `Kernel#loop` (see {.loop_may_complete?}), which runs its
+      # block until it breaks or raises.
+      def kernel_loop?(call_node)
+        call_node.name == :loop && kernel_spelled_receiver?(call_node.receiver)
+      end
+
       # Issue #1107 — whether a `loop` call can complete normally although its declared return is `bot`.
       #
       # `Kernel#loop` is `() { () -> void } -> bot` in core RBS, yet it rescues a `StopIteration` its block
@@ -86,7 +92,7 @@ module Rigor
       # promise. A project redefinition of `loop` itself is not excluded: widening its `bot` costs precision,
       # never a false positive.
       def loop_may_complete?(call_node)
-        return false unless call_node.name == :loop && kernel_spelled_receiver?(call_node.receiver)
+        return false unless kernel_loop?(call_node)
 
         block = call_node.block
         return false if block.nil?

data/lib/rigor/inference/builtins/method_catalog.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "yaml"
+require_relative "../../rooted_glob"
 
 module Rigor
   module Inference
@@ -49,7 +50,7 @@ module Rigor
         end
 
         # Every catalogue file under {DATA_ROOT}, in a stable order.
-        def self.topic_paths = Dir[File.join(DATA_ROOT, "*.yml")]
+        def self.topic_paths = RootedGlob.glob(DATA_ROOT, "*.yml")
 
         def initialize(path:, mutating_selectors: {})
           @path = path

data/lib/rigor/inference/callee_mutation_chain.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    # Issue #2104 — the callee floor's census made transitive. A method that hands its parameter to another method
+    # which mutates it (`def stripes(acc) = poke(acc)`, `def poke(acc) = (acc[0] = "x")`) mutates that parameter as
+    # surely as one that writes it itself, so the caller's argument is floored after `stripes(acc)` too.
+    #
+    # This module is the closure over a parameter-flow graph, independent of how the graph is read. `own` answers a
+    # def's own census, `{ name => slot }` (a slot is a positional index or a keyword symbol); `edges` answers the
+    # {Edge}s along which a def hands one of its parameters to a resolved callee. A node is one parameter of one def,
+    # and the walk follows only the edges that hand on the parameter the node is, so a def's hand-offs of its OTHER
+    # parameters cost nothing. A node is mutated when its def mutates it or it hands itself to a mutated node: the
+    # least fixpoint, so a recursive or mutually recursive chain terminates and a cycle with no mutation on it mutates
+    # nothing.
+    #
+    # The walk reads at most {MAX_NODES} nodes per closure. A hand-off to a node past the cap is read as no hand-off,
+    # as the one-level floor reads a callee it cannot resolve: flooring there would drop a literal shape on evidence
+    # the walk never saw, and a floored `Array[Dynamic[top]]` then fails a declared tuple on correct code.
+    module CalleeMutationChain
+      # `name` and `slot` are the forwarding def's parameter, `callee` the def it is handed to, and `callee_names`
+      # the callee's parameters it may bind there.
+      Edge = Data.define(:name, :slot, :callee, :callee_names)
+
+      MAX_NODES = 32
+
+      module_function
+
+      def close(root, own:, edges:)
+        census = own.call(root)
+        handed = edges.call(root).reject { |edge| census.key?(edge.name) }
+        return census if handed.empty?
+
+        flow = Flow.new(own, edges)
+        handed.each { |edge| flow.visit(root, edge.name) }
+        flow.settle
+        handed.each_with_object(census.dup) do |edge, result|
+          result[edge.name] = edge.slot if flow.mutated?(root, edge.name)
+        end
+      end
+
+      # The parameter-flow graph one closure reads: per def, per parameter name, whether the node is mutated and the
+      # nodes it hands itself on to.
+      class Flow
+        Node = Struct.new(:mutated, :successors)
+
+        def initialize(own, edges)
+          @own = own
+          @edges = edges
+          @nodes = {}.compare_by_identity
+          @count = 0
+        end
+
+        def mutated?(def_node, name)
+          node = @nodes.dig(def_node, name)
+          !node.nil? && node.mutated
+        end
+
+        # Reads the nodes reachable from `def_node`'s `name`, breadth first, while fewer than {MAX_NODES} are read.
+        def visit(def_node, name)
+          queue = [[def_node, name]]
+          until queue.empty?
+            current, parameter = queue.shift
+            next if known?(current, parameter)
+            break if @count >= MAX_NODES
+
+            queue.concat(add(current, parameter))
+          end
+        end
+
+        def settle
+          changed = true
+          while changed
+            changed = false
+            each_node do |node|
+              next if node.mutated
+              next unless node.successors.any? { |callee, name| mutated?(callee, name) }
+
+              node.mutated = true
+              changed = true
+            end
+          end
+        end
+
+        private
+
+        def known?(def_node, name)
+          by_name = @nodes[def_node]
+          !by_name.nil? && by_name.key?(name)
+        end
+
+        # Records the node and answers its successors. A node its def mutates needs none.
+        def add(def_node, name)
+          @count += 1
+          mutated = @own.call(def_node).key?(name)
+          successors = mutated ? [] : successors_of(def_node, name)
+          (@nodes[def_node] ||= {})[name] = Node.new(mutated, successors)
+          successors
+        end
+
+        def successors_of(def_node, name)
+          @edges.call(def_node).each_with_object([]) do |edge, successors|
+            next unless edge.name == name
+
+            edge.callee_names.each { |callee_name| successors << [edge.callee, callee_name] }
+          end
+        end
+
+        def each_node(&)
+          @nodes.each_value { |by_name| by_name.each_value(&) }
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/captured_locals.rb

@@ -6,6 +6,7 @@ require_relative "../source/node_walker"
 require_relative "block_parameter_binder"
 require_relative "element_read_widening"
 require_relative "index_write_widening"
+require_relative "intervening_ivar_reset"
 require_relative "mutation_widening"
 require_relative "optimistic_origin"
 require_relative "receiver_alias"
@@ -109,16 +110,22 @@ module Rigor
       #   `base_scope`), except that one still on its class-wide binding does not: ADR-58's declaration seed is
       #   the union of every write in the class, this body's included, so nothing the body stores can move it,
       #   and rebinding it would only drop the declaration mark that keeps its nil from being diagnostic fuel.
-      #   A nested block that rebinds `self` (`o.instance_eval`) writes another object's ivar, and a nested
-      #   `def` runs only when called; both still count, because an `instance_eval` without a receiver, or a
-      #   call to that `def` inside the body, does write this one.
+      #   Issue #1402 — an instance variable written in a nested block that runs on an object provably not `self`
+      #   (`Other.class_eval { @x = 1 }`, {InterveningIvarReset.foreign_self_block?}, its receiver typed in
+      #   `base_scope`) is that object's, and does not count; one on a receiver that may be `self` does. A class
+      #   variable or global written there counts as anywhere else: Ruby resolves a class variable lexically, and
+      #   a global is the same one whatever `self` is. A nested `def` runs only when called; it still counts,
+      #   because a call to it inside the body writes this one.
+      # @param foreign_self — the block itself runs on an object provably not `self`
+      #   ({InterveningIvarReset.foreign_self_block?} of its call): no instance variable it writes is the caller's.
+      #   Its locals, class variables and globals still count.
       # @param non_locals — the per-element fold's superset of `ivars`: the class variables and globals the body
       #   rebinds count too, on the same terms, and so does an attribute setter called on `self` (`self.w = v`)
       #   as a rebind of the instance variable it is named after, `@w`: the `attr_writer` / `attr_accessor`
       #   convention stores there, and no write node shows it. A hand-written setter storing elsewhere is not
       #   seen.
       # @return the captured names the body writes, each once, in first-write order.
-      def writes(block_node, base_scope, ivars: false, non_locals: false)
+      def writes(block_node, base_scope, ivars: false, non_locals: false, foreign_self: false)
         body = block_node.body
         return NO_NAMES if body.nil?
 
@@ -126,20 +133,44 @@ module Rigor
         names = nil
         outliving = non_locals || ivars
         Source::NodeWalker.each_with_ancestors(body) do |descendant, ancestors|
-          name =
-            if LOCAL_WRITE_NODES.include?(descendant.class)
-              captured_local_write(descendant, ancestors, base_scope) { introduced ||= introduced_locals(block_node) }
-            elsif outliving
-              if ReflectiveIvarWrite.unknown_target?(descendant)
-                (names ||= []).concat(reflective_unknown_ivars(base_scope))
-              end
-              rebindable_outliving_write(descendant, base_scope, non_locals)
+          if LOCAL_WRITE_NODES.include?(descendant.class)
+            name = captured_local_write(descendant, ancestors, base_scope) do
+              introduced ||= introduced_locals(block_node)
             end
-          (names ||= []) << name if name
+            (names ||= []) << name if name
+          elsif outliving
+            found = outliving_writes(descendant, ancestors, base_scope, non_locals, foreign_self)
+            (names ||= []).concat(found) unless found.empty?
+          end
         end
         names ? names.uniq : NO_NAMES
       end
 
+      # The non-local names `node` writes ({.reflective_unknown_ivars} for an `instance_variable_set` on `self` whose
+      # target no literal names, then {.rebindable_outliving_write}), less the instance variables when the write
+      # runs on an object provably not `self` (`foreign_self`, or a nested block {.under_foreign_self_block?}).
+      def outliving_writes(node, ancestors, base_scope, non_locals, foreign_self)
+        found = ReflectiveIvarWrite.unknown_target?(node) ? reflective_unknown_ivars(base_scope) : NO_NAMES
+        written = rebindable_outliving_write(node, base_scope, non_locals)
+        return found if written.nil? && found.empty?
+
+        names = written ? found + [written] : found
+        return names unless foreign_self || under_foreign_self_block?(ancestors, base_scope)
+
+        names.reject { |name| ivar_name?(name) }
+      end
+
+      # Issue #1402 — whether a block on the path `ancestors` runs on an object provably not `self`: its call is a
+      # {InterveningIvarReset.foreign_self_block?}, the receiver typed in `base_scope`.
+      def under_foreign_self_block?(ancestors, base_scope)
+        (1...ancestors.size).any? do |index|
+          child = ancestors[index]
+          parent = ancestors[index - 1]
+          child.is_a?(Prism::BlockNode) && parent.is_a?(Prism::CallNode) && parent.block.equal?(child) &&
+            InterveningIvarReset.foreign_self_block?(parent, base_scope)
+        end
+      end
+
       # Issue #1889 — every ivar `base_scope` binds: an `instance_variable_set` on `self` whose target no literal
       # names ({ReflectiveIvarWrite.unknown_target?}) may write any of them. One on its ADR-58 declaration seed
       # counts too, since the census behind the seed sees no reflective write; {.bind} keeps its mark.