rigortype 0.4.4 → 0.4.6

data/lib/rigor/inference/narrowing.rb

@@ -10,6 +10,7 @@ require_relative "../rbs_extended"
 require_relative "../analysis/fact_store"
 require_relative "../builtins/regex_refinement"
 require_relative "guard_rebinding"
+require_relative "intervening_ivar_reset"
 require_relative "key_presence_guard"
 require_relative "last_line"
 require_relative "operand_effects"
@@ -511,8 +512,9 @@ module Rigor
       # none of the condition shapes are recognised, both returned scopes equal the input
       # scope. The catalogue mirrors {.case_equality_target_class}: static class/module
       # constants narrow as `is_a?`; integer/float-endpoint ranges narrow to `Numeric`;
-      # string-endpoint ranges and regexp literals narrow to `String`; a `nil`, `true` or
-      # `false` literal narrows as its class does ({.when_condition_class}).
+      # string-endpoint ranges narrow to `String`; regexp literals narrow as
+      # {.regexp_case_equality_type} says; a `nil`, `true` or `false` literal narrows as its
+      # class does ({.when_condition_class}).
       def case_when_scopes(subject, conditions, scope)
         # C1 — `case x when /re/` runs `/re/ === x`, which sets the regex match-data globals
         # exactly as a successful `=~` does. Narrow `$~`/`$&`/`$1..$N` on the clause body (the
@@ -522,7 +524,7 @@ module Rigor
 
         # Issue #1429 — a global or constant subject (`case $stdout when StringIO`) narrows as a local does, and so
         # does an instance variable (#1446).
-        slot = receiver_slot(subject, scope, kinds: CASE_SUBJECT_KINDS)
+        slot = case_subject_slot(subject, scope)
         return [body_scope, scope] if slot.nil?
 
         truthy_type, falsey_type = case_when_types(scope, slot.current, conditions)
@@ -536,6 +538,32 @@ module Rigor
       CASE_SUBJECT_KINDS = %i[local ivar global constant].freeze
       private_constant :CASE_SUBJECT_KINDS
 
+      # The slot a `case` subject narrows. Issue #2211 — a subject that writes a local or instance variable
+      # (`case (x = v)`, `case x = v`) tests the value it stores, which the variable holds in every clause, so the
+      # clauses narrow the variable as they narrow a bare read of it: `case (x = s ? String(s) : nil) when String then
+      # x.upcase end` reads `x` as `String`. A single-statement `(…)` is unwrapped.
+      def case_subject_slot(subject, scope)
+        subject = unwrap_case_subject(subject)
+        case subject
+        when Prism::LocalVariableWriteNode
+          variable_slot(:local, subject.name, scope.local(subject.name), CASE_SUBJECT_KINDS)
+        when Prism::InstanceVariableWriteNode
+          variable_slot(:ivar, subject.name, scope.ivar(subject.name), CASE_SUBJECT_KINDS)
+        else receiver_slot(subject, scope, kinds: CASE_SUBJECT_KINDS)
+        end
+      end
+      private_class_method :case_subject_slot
+
+      # `subject` with each single-statement `(…)` around it removed: the node {.case_subject_slot} narrows through,
+      # which `StatementEvaluator#when_test_rebinds_subject?` reads the same way.
+      def unwrap_case_subject(subject)
+        while subject.is_a?(Prism::ParenthesesNode) && subject.body.is_a?(Prism::StatementsNode) &&
+              subject.body.body.size == 1
+          subject = subject.body.body.first
+        end
+        subject
+      end
+
       # Returns `[body_scope, falsey_scope]` for one clause of a `case` with a subject: a `when` clause narrows
       # through {.case_when_scopes}, and an `in` clause only for a bare class pattern ({.bare_class_pattern_node}),
       # which matches exactly when `subject.is_a?(C)`. Every other pattern can fail to match where a class test
@@ -1797,9 +1825,13 @@ module Rigor
         # passes through unchanged (failing one pattern proves nothing about the string's shape).
         # A non-literal / unanchored / `\Z` / line-anchored / `//x` pattern falls through to no
         # narrowing.
+        #
+        # The refinement names a String, so it shares `=~`'s gate (#1955): a receiver that may be a Symbol, or an
+        # untyped one, is left as it is ({#refinable_operand?}).
         def analyse_whole_regex_match_predicate(node, scope)
           return nil unless node.receiver.is_a?(Prism::LocalVariableReadNode)
           return nil if node.arguments.nil? || node.arguments.arguments.size != 1
+          return nil unless refinable_operand?(node, scope)
 
           pattern = regex_operand_pattern(node.arguments.arguments.first, scope)
           return nil unless pattern.is_a?(RegexMatchPattern)
@@ -2636,10 +2668,10 @@ module Rigor
         #   iff the endpoints compare it. We conservatively narrow `x` to `Numeric` for
         #   integer-endpoint ranges and to `String` for string-endpoint ranges; other endpoint
         #   types fall through.
-        # - **Regexp literal receiver** (`/foo/ === x`): the match operator coerces `x` to a
-        #   String, so the truthy edge narrows `x` to `String`. The falsey edge keeps the entry
-        #   type unchanged because `Regexp#===` returns false for non-Strings AND for Strings
-        #   that simply do not match.
+        # - **Regexp literal receiver** (`/foo/ === x`): the truthy edge narrows `x` as
+        #   {#regexp_case_equality_type} says (its String and Symbol parts, #1955). The falsey edge
+        #   keeps the entry type unchanged because `Regexp#===` returns false for non-Strings AND
+        #   for Strings that simply do not match.
         #
         # Anything else — non-local LHS argument, dynamic receiver, custom `===` method — falls
         # through to the no-narrowing branch (nil), preserving the entry scope on both edges.
@@ -2703,6 +2735,9 @@ module Rigor
           if (class_name = lexical_class_name(receiver, scope))
             return class_predicate_scopes(scope, local_name, current, class_name, exact: false)
           end
+          if regexp_literal?(receiver)
+            return [scope.with_local(local_name, regexp_case_equality_type(current, scope)), scope]
+          end
 
           target_class = case_equality_target_class(receiver)
           return nil if target_class.nil?
@@ -2716,7 +2751,7 @@ module Rigor
         end
 
         # The class a `when` condition narrows the subject to, as `is_a?` would, or nil when the condition is no class
-        # test Rigor reads: a class or module constant, a range or regexp literal ({.case_equality_target_class}),
+        # test Rigor reads: a class or module constant, a range literal ({.case_equality_target_class}),
         # or (#1925) a `nil` / `true` / `false` literal. `nil === x` runs `NilClass#===`, which holds only for `nil`
         # itself whatever the subject's class defines, and `nil` is `NilClass`'s only instance, so `when nil` is
         # `when NilClass`; `true` and `false` likewise.
@@ -2733,8 +2768,9 @@ module Rigor
         # Maps a case-equality literal receiver to the class whose membership is implied by the
         # truthy edge. `Prism::ParenthesesNode` wrappers are transparently unwrapped (`(1..10)
         # === x` is parsed with the range inside parentheses).  Range literals: integer
-        # endpoints → `Numeric`; string endpoints → `String`. Regexp literals → `String`. Other
-        # shapes return nil so the caller falls through.
+        # endpoints → `Numeric`; string endpoints → `String`. Regexp literals → `String`, read only
+        # as the class a dead `when` arm names: their narrowing is {#regexp_case_equality_type}'s,
+        # which the callers consult first. Other shapes return nil so the caller falls through.
         def case_equality_target_class(receiver)
           receiver = unwrap_parens(receiver)
           case receiver
@@ -2743,6 +2779,68 @@ module Rigor
           end
         end
 
+        def regexp_literal?(node)
+          case unwrap_parens(node)
+          when Prism::RegularExpressionNode, Prism::InterpolatedRegularExpressionNode then true
+          else false
+          end
+        end
+
+        # Issue #1955 — the subject on the match edge of `/re/ === x` (and of `case x when /re/`). `Regexp#===`
+        # matches a String, a Symbol by its name, and an object that converts with `to_str`, and answers false for
+        # anything else. A member is kept whole when its class defines `to_str` (#2002) — a String and its
+        # subclasses, a class whose signature, ancestry or project source declares it — or when no signature
+        # declares the class, and a `Dynamic` member is kept, since it may also be a Symbol at run time. Any other
+        # member narrows to its String and Symbol parts, which are only what can match: a `String | nil` subject
+        # reads `String`, a Symbol one stays `Symbol`, an Integer one drops out. An `Object`, `BasicObject` or
+        # module member narrows too (to `String | Symbol`): its instances may be anything, and reading the edge as
+        # the String it most often is keeps `s.length` on it from reporting. The no-match edge keeps the entry type:
+        # a String that does not match reaches it too.
+        def regexp_case_equality_type(current, scope)
+          members = current.is_a?(Type::Union) ? current.members : [current]
+          Type::Combinator.union(*members.map { |member| regexp_case_equality_member(member, scope) })
+        end
+
+        def regexp_case_equality_member(member, scope)
+          return member if member.is_a?(Type::Dynamic)
+          return member if converts_with_to_str?(member, scope)
+
+          parts = %w[String Symbol].map do |class_name|
+            narrow_class(member, class_name, exact: false, environment: scope.environment, scope: scope)
+          end
+          Type::Combinator.union(*parts)
+        end
+
+        # True when a class `member` dispatches through declares `to_str`, or is declared by no signature
+        # ({#class_lacks_method?} answers false for it). `Object`, `BasicObject` and a module String or Symbol
+        # includes (`Kernel`, `Comparable`) are read as their String and Symbol parts instead: their instances may be
+        # anything, and the String they most often are keeps a String method on the arm from reporting. Any other
+        # module is kept whole, since a matching value may include it; so is one of those that declares `to_str`.
+        def converts_with_to_str?(member, scope)
+          targets = ProjectMethodOwnership.targets(member)
+          return false if targets.nil? || targets.empty?
+
+          targets.any? { |class_name, kind| class_converts_with_to_str?(class_name, kind, scope) }
+        end
+
+        # The modules String's or Symbol's own ancestry includes, read from the running Ruby.
+        STRING_SYMBOL_MODULES = (String.ancestors + Symbol.ancestors).grep_v(Class).filter_map(&:name).uniq.freeze
+        private_constant :STRING_SYMBOL_MODULES
+
+        def class_converts_with_to_str?(class_name, kind, scope)
+          return false if kind == :instance && OPEN_SURFACE_CLASSES.include?(class_name)
+          if kind == :instance && scope.environment.rbs_module?(class_name)
+            return module_declares_to_str?(class_name, scope) || !STRING_SYMBOL_MODULES.include?(class_name)
+          end
+
+          !class_lacks_method?(class_name, :to_str, kind, scope)
+        end
+
+        def module_declares_to_str?(module_name, scope)
+          ProjectMethodOwnership.defines?(module_name, :to_str, :instance, scope) ||
+            !ExternalAncestorResolution.method_definition(module_name, :to_str, :instance, scope: scope).nil?
+        end
+
         def unwrap_parens(node)
           while node.is_a?(Prism::ParenthesesNode) && node.body.is_a?(Prism::StatementsNode) &&
                 node.body.body.size == 1
@@ -2971,6 +3069,10 @@ module Rigor
             return integer_literal_when_result(current, int_literal, falsey_acc)
           end
 
+          if regexp_literal?(condition)
+            return { truthy: regexp_case_equality_type(current, scope), falsey: falsey_acc, fully_narrowable: true }
+          end
+
           target = when_condition_class(condition, scope)
           return class_when_result(scope, current, target, falsey_acc) if target
 
@@ -3793,9 +3895,12 @@ module Rigor
         # that edge, so a `$_` the earlier operand narrowed is forgotten when the operand may set it
         # (`gets && log(items.each { gets })`), before the operand's own edges narrow it again.
         # Issue #1429 — likewise a guard's narrowing of a global or constant the operand may rebind
-        # (`$sep && reset_sep && $sep.length`).
+        # (`$sep && reset_sep && $sep.length`). Issue #1963 — and an instance variable's narrowing an implicit-self
+        # or `self.` call in the operand may write ({InterveningIvarReset.after_operand}): `@x.nil? && reset!` does
+        # not leave `@x` `nil` when `reset!` assigns it.
         def operand_edges(node, edge_scope)
           edge_scope = LastLine.forget_if_set(edge_scope, node)
+          edge_scope = InterveningIvarReset.after_operand(node, edge_scope)
           if edge_scope.guard_narrowed? && GuardRebinding.may_rebind?(node, edge_scope)
             edge_scope = edge_scope.forget_guard_narrowings
           end

data/lib/rigor/inference/object_mixins.rb

@@ -123,9 +123,14 @@ module Rigor
       # all.
       def answer_for_entry(scope, entry, method_name)
         unless entry.external?
-          return source_defines?(scope, entry.name, method_name) ? [:source, entry.name] : nil
+          defines = source_defines?(scope, entry.name, method_name) || macro_named?(scope, entry.name, method_name)
+          return defines ? [:source, entry.name] : nil
         end
 
+        # Issue #2094 — a project module with no `def` is held as an external; a macro of its body may name it.
+        named = entry.candidates.find { |candidate| macro_named?(scope, candidate, method_name) }
+        return [:source, named] if named
+
         entry.candidates.each do |candidate|
           definition = Rigor::Reflection.instance_method_definition(candidate, method_name, scope: scope)
           return [private_definition?(definition) ? :private_rbs : :rbs, candidate, definition] if definition
@@ -137,6 +142,13 @@ module Rigor
       end
       private_class_method :answer_for_entry
 
+      # Issue #2094 — whether a class-body macro of `owner` was handed `method_name` as a literal
+      # (`dsl_method :xdyn`, `def_delegators :@target, :xdyn`). The indexer files every such name as an opaque
+      # envelope, since what the macro defines under it is unknown, so the module may define the name.
+      def macro_named?(scope, owner, method_name)
+        scope.parameter_envelopes_of(owner).key?([:instance, method_name.to_sym])
+      end
+
       def private_definition?(definition)
         definition.respond_to?(:accessibility) && definition.accessibility == :private
       end

data/lib/rigor/inference/parameter_inference_collector.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "scope_indexer"
+require_relative "project_seed_tables"
 require_relative "fork_map"
 require_relative "../source/node_walker"
 
@@ -238,18 +239,10 @@ module Rigor
         base.with_discovery(base.discovery.with(**tables))
       end
 
+      # Issue #1614 — the tables a `check` run seeds, from the one list {ProjectSeedTables} keeps for every path that
+      # runs no `check`, so an argument types here as it does in the file `check` analyses.
       def discovery_seed_tables
-        classes = ScopeIndexer.discovered_classes_for_paths(@files)
-        def_index = ScopeIndexer.discovered_def_index_for_paths(@files)
-        tables = {}
-        tables[:discovered_classes] = classes unless classes.empty?
-        DISCOVERY_FIELD.each do |index_key, field|
-          table = def_index.fetch(index_key)
-          tables[field] = table unless table.empty? && !Scope::DiscoveryIndex.paired?(field)
-        end
-        # ADR-119 WD1 — the pairs travel together: a pair is dropped only when both halves are empty. A sibling whose
-        # member this collector does not seed completes to that member's empty value, which the base scope holds.
-        Scope::DiscoveryIndex.compact_pairs(tables.merge(def_index.fetch(:siblings)))
+        ProjectSeedTables.for_paths(@files)
       rescue StandardError => e
         # Discovery is best-effort; a malformed corner of the project must not crash the
         # protection scan. Without discovery the collector simply resolves fewer call sites. A broken
@@ -257,21 +250,6 @@ module Rigor
         e.is_a?(DeclarationWalk::ContractError) ? raise : {}
       end
 
-      DISCOVERY_FIELD = {
-        def_nodes: :discovered_def_nodes,
-        singleton_def_nodes: :discovered_singleton_def_nodes,
-        def_sources: :discovered_def_sources,
-        superclasses: :discovered_superclasses,
-        header_nestings: :discovered_header_nestings,
-        includes: :discovered_includes, unpositioned_mixins: :unpositioned_mixins,
-        class_sources: :discovered_class_sources,
-        method_visibilities: :discovered_method_visibilities,
-        methods: :discovered_methods,
-        data_member_layouts: :data_member_layouts,
-        struct_member_layouts: :struct_member_layouts, deferred_ranges: :discovered_deferred_ranges
-      }.freeze
-      private_constant :DISCOVERY_FIELD
-
       # Built once over the whole project and inherited by the fork workers via copy-on-write; a frozen Set
       # for O(1) membership in the {#record_call} hot loop.
       def user_method_names(discovery)

data/lib/rigor/inference/project_patched_methods.rb

@@ -27,25 +27,57 @@ module Rigor
       # alias earlier in the `pre_eval:` files binds `old`, the alias's entry copies that entry's `return_type` (and
       # its `alias_of`); otherwise `alias_of` names `old`, a method the class had before the patch, and the
       # dispatcher answers the alias with what that method answers. `alias_of` is nil for a `def`.
-      Entry = Data.define(:class_name, :method_name, :kind, :source_path, :source_line, :return_type, :alias_of) do
-        def initialize(class_name:, method_name:, kind:, source_path:, source_line:, return_type: nil, alias_of: nil)
+      #
+      # Issue #1708 — `visibility` is `:public`, `:private` or `:protected`, as the patch file leaves the method: a
+      # `private def x`, a `def` after a bare `private` in the same body, a later `private :x`, and the instance copy
+      # a `module_function` makes are `:private` ({#callable?} reads it). An alias takes its old name's visibility,
+      # as Ruby's does; one whose old name no patch binds is `:public`.
+      #
+      # `farther` is set only on an entry {#lookup_through_ancestors} returns: the other definers of the name farther
+      # on the walk (entries, or {SOURCE_DEFINER} for a project-source `def`), which {#callable?} reads before it
+      # refuses the call.
+      Entry = Data.define(:class_name, :method_name, :kind, :source_path, :source_line, :return_type, :alias_of,
+                          :visibility, :farther) do
+        def initialize(class_name:, method_name:, kind:, source_path:, source_line:, return_type: nil, alias_of: nil,
+                       visibility: :public, farther: nil)
           super
         end
       end
 
-      attr_reader :by_key, :write_census
+      # Issue #1708 — one `include` or `prepend` a `pre_eval:` file writes (`Numeric.include(M)`, or `include M` in
+      # `class Numeric`): `owner` gains `module_name` as an ancestor, `kind` `:include` or `:prepend`. Names are as
+      # written, with no lexical resolution, as a patch's class name is.
+      Mixin = Data.define(:owner, :module_name, :kind)
+
+      attr_reader :by_key, :write_census, :mixins, :overrides
+
+      # Each owner's prepended and included modules, the most recent first.
+      def self.mixins_by_owner(mixins)
+        table = mixins.each_with_object({}) do |mixin, acc|
+          edges = (acc[mixin.owner] ||= { prepend: [], include: [] })
+          edges[mixin.kind].unshift(mixin.module_name)
+        end
+        table.each_value { |edges| edges.each_value(&:freeze) }.freeze
+      end
 
       # @param entries — flat list of declarations observed during the pre-pass.
       #   Last-write-wins on `(class_name, method_name, kind)` duplicates, as at runtime (ADR-17); the
       #   `pre-eval.duplicate-declaration` diagnostic emission stays decoupled from registry behaviour.
       # @param write_census — issue #1367: the `pre_eval:` files' {GlobalWriteCensus}, which the `global.*` write
       #   rules join with the project's, since a patch file is loaded ahead of the code it patches.
-      def initialize(entries: [], write_census: GlobalWriteCensus::EMPTY)
+      # @param mixins — issue #1708: the {Mixin} edges the `pre_eval:` files write, in the order they run.
+      # @param overrides — issue #1708: `[class_name, method_name, kind] => visibility` for a named visibility call
+      #   (`public :kp` in `class Integer`) on a method the class inherits rather than binds, which Ruby copies onto
+      #   the class with that visibility.
+      def initialize(entries: [], write_census: GlobalWriteCensus::EMPTY, mixins: [], overrides: {})
         @by_key = entries.each_with_object({}) do |entry, acc|
           key = [entry.class_name, entry.method_name, entry.kind]
           acc[key] = entry
         end.freeze
         @write_census = write_census.frozen? ? write_census : write_census.dup.freeze
+        @mixins = mixins.dup.freeze
+        @mixins_of = ProjectPatchedMethods.mixins_by_owner(@mixins)
+        @overrides = overrides.dup.freeze
         freeze
       end
 
@@ -55,11 +87,143 @@ module Rigor
         @by_key[[class_name, method_name, kind]]
       end
 
+      # Issue #1708 — the entry a `kind` receiver of `class_name` reaches through its ancestors, searched in Ruby's
+      # order: a patch on `Object`, `Kernel`, `Numeric`, `Comparable` or `Enumerable` answers an `Integer`, `Array`
+      # or `String` receiver, and a patch on a nearer ancestor wins over one on a farther. A class object's chain
+      # is its singleton classes, then `Class`, `Module`, `Object`, `Kernel` and `BasicObject`, so `def zz` in
+      # `class Object` answers `Integer.zz` too. The ancestors are the class's RBS ones; a class RBS does not
+      # declare is searched as itself only, as {#lookup} searches it.
+      #
+      # It answers only which patch the chain holds. A method a nearer ancestor's RBS declares wins over the patch
+      # in Ruby, so the callers ask once that RBS has come back without the method. A method the project's own
+      # source defines on the way wins too: `source_defines` is called with each `owner, side` BEFORE that owner's
+      # patch is read, and when it answers true the walk stops with no entry, leaving the call to what types that
+      # method. That includes an owner holding both a patch and a source `def` (a `lib/` reopen loaded after the
+      # patch, or a module the project prepends to it), unlike {#lookup}, which answers the patch.
+      #
+      # A module the `pre_eval:` files include into or prepend to an owner on the way ({Mixin}) is searched where Ruby
+      # puts it: prepends ahead of the owner, includes after it, the most recent first, each with its own mixins. A
+      # named visibility call on an owner the walk passes before the body (`public :kp` in `class Integer`, an
+      # override) gives the entry it returns that visibility, and that owner for {#callable?}'s protected check.
+      # @return the entry, or `nil` when no ancestor's patch declares the method ahead of a source `def`.
+      def lookup_through_ancestors(class_name:, method_name:, kind:, rbs_loader:, source_defines: nil) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        return nil if empty?
+
+        override = nil
+        found = nil
+        farther = []
+        ancestor_keys(class_name.to_s, kind, rbs_loader).each do |owner, side|
+          if source_defines&.call(owner, side)
+            return nil if found.nil?
+
+            farther << SOURCE_DEFINER
+            break
+          end
+
+          entry = @by_key[[owner, method_name, side]]
+          if found
+            farther << entry if entry
+          elsif entry
+            found = override ? entry.with(class_name: override.first, visibility: override.last) : entry
+          elsif (visibility = @overrides[[owner, method_name, side]])
+            override ||= [owner, visibility]
+          end
+        end
+        farther.empty? || found.nil? ? found : found.with(farther: farther.freeze)
+      end
+
+      # A project-source `def` of the name farther on the walk than the entry it returns, in {Entry#farther}.
+      SOURCE_DEFINER = Object.new.freeze
+
+      # Issue #1708 — whether Ruby lets a call reach `entry`. A public method answers any call; a private one only a
+      # call with no receiver or with `self` as it (`explicit` is false for those); a protected one also a call from
+      # a method whose `self` is an instance of the entry's owner. `self_type` is the caller's `self` (`nil` at the
+      # top level, where it is `main`, an Object); a `self` this cannot name (the default) may be one, so a
+      # protected entry answers it.
+      #
+      # It never refuses a call some other definer of the name may answer: the walk's order is an approximation
+      # (a module two owners mix in is spliced at the nearer one, where Ruby keeps the first include and skips the
+      # second), so when {Entry#farther} holds a definer the call may reach (a project-source `def`, or an entry this
+      # would let it reach), it answers nil: decline, neither refused nor typed from `entry`.
+      # @return true (the call reaches `entry`), false (Ruby refuses it), or nil (declined).
+      def callable?(entry, explicit:, self_type: :unknown, rbs_loader: nil)
+        return true unless explicit
+
+        allowed =
+          case entry.visibility
+          when :private, :module_function then false
+          when :protected then self_kind_of?(self_type, entry.class_name, rbs_loader)
+          else true
+          end
+        return true if allowed
+
+        reachable = (entry.farther || []).any? do |other|
+          other.equal?(SOURCE_DEFINER) || callable?(other, explicit: true, self_type: self_type, rbs_loader: rbs_loader)
+        end
+        reachable ? nil : false # rubocop:disable Style/ReturnNilInPredicateMethodDefinition
+      end
+
       def empty?
         @by_key.empty?
       end
 
       EMPTY = new.freeze
+
+      private
+
+      # Whether `self_type` may be an instance of `owner`: false only when the ancestors of a class RBS knows,
+      # with the patches' mixins, do not hold it.
+      def self_kind_of?(self_type, owner, rbs_loader)
+        name, kind =
+          if self_type.nil? then ["Object", :instance]
+          elsif self_type.respond_to?(:class_name) && self_type.class_name
+            [self_type.class_name.to_s, self_type.is_a?(Type::Singleton) ? :singleton : :instance]
+          end
+        return true if name.nil? || rbs_loader.nil?
+
+        keys = ancestor_keys(name, kind, rbs_loader)
+        keys == [[name, kind]] || keys.include?([owner, :instance])
+      end
+
+      def ancestor_keys(class_name, kind, rbs_loader)
+        pairs =
+          if kind == :singleton
+            sides = rbs_loader ? rbs_loader.singleton_ancestors_for(class_name) : []
+            sides.empty? ? [[class_name, :singleton]] : sides.map { |side, owner| [owner, side] }
+          else
+            names = rbs_loader ? rbs_loader.ancestor_names_for(class_name) : []
+            (names.empty? ? [class_name] : names).map { |owner| [owner, :instance] }
+          end
+        @mixins_of.empty? ? pairs : with_mixins(pairs)
+      end
+
+      # The RBS ancestor pairs with each instance-side owner's `pre_eval:` mixins spliced in. A module already on
+      # the chain is not added again, as Ruby skips a module the ancestors already hold.
+      def with_mixins(pairs)
+        chain = pairs.filter_map { |owner, side| owner if side == :instance }.to_set
+        seen = Set.new
+        pairs.flat_map do |owner, side|
+          side == :instance ? expand_mixins(owner, chain, seen).map { |name| [name, :instance] } : [[owner, side]]
+        end
+      end
+
+      # `owner` with the modules the patches prepend to it ahead and the ones they include after, each expanded the
+      # same way: the order Ruby's `ancestors` lists them in. An include of a module the RBS chain already holds
+      # changes nothing, as Ruby skips it (`Integer.include(Comparable)`); a prepend of one is spliced ahead all the
+      # same, as Ruby adds it again (`Integer.prepend(Comparable)`). `seen` holds the modules already spliced, so a
+      # module is spliced once, at the nearest owner that mixes it in, and an include cycle ends. Ruby skips
+      # `Integer.include(A)` run after `Numeric.include(A)`, leaving A after Numeric; the registry, which does not read
+      # the order the two edges ran in, splices A after Integer either way.
+      def expand_mixins(owner, chain, seen)
+        edges = @mixins_of[owner]
+        return [owner] if edges.nil?
+
+        ahead = edges[:prepend].flat_map { |name| seen.add?(name) ? expand_mixins(name, chain, seen) : [] }
+        after = edges[:include].flat_map do |name|
+          !chain.include?(name) && seen.add?(name) ? expand_mixins(name, chain, seen) : []
+        end
+        ahead + [owner] + after
+      end
     end
   end
 end

data/lib/rigor/inference/project_patched_mixins.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "project_patched_methods"
+require_relative "../source/constant_path"
+
+module Rigor
+  module Inference
+    module ProjectPatchedScanner
+      # Issue #1708 — the `include` / `prepend` edges a `pre_eval:` file writes, so a module it mixes into an
+      # ancestor (`Numeric.include(M)`) answers the receivers below that ancestor through
+      # {ProjectPatchedMethods#lookup_through_ancestors}. Ruby 4.0.5: after `Numeric.include(NumExt)`, `1.inc_m` and
+      # `1.5.inc_m` run.
+      module Mixins
+        # An `include` / `prepend` the walk met, with the lexical prefix {.resolve} resolves its module's written
+        # name in.
+        Pending = Data.define(:owner, :module_name, :kind, :prefix)
+
+        CALLS = %i[include prepend].freeze
+        private_constant :CALLS
+
+        module_function
+
+        # The {Pending} edges `node` writes, or none: `Numeric.include(M)` on a constant, or `include M` /
+        # `self.include(M)` in a body. A top-level `include M` includes into `Object`, as Ruby's does. One in a
+        # `class << self` body is an `extend`, which this does not read; a module argument that is not a constant is
+        # skipped.
+        def pending(node, qualified_prefix, in_singleton_class)
+          return [] unless CALLS.include?(node.name) && node.arguments
+
+          owner = owner(node.receiver, qualified_prefix, in_singleton_class)
+          return [] if owner.nil?
+
+          node.arguments.arguments.filter_map do |arg|
+            name = Source::ConstantPath.qualified_name_or_nil(arg)
+            next if name.nil?
+
+            prefix = arg.is_a?(Prism::ConstantPathNode) && arg.parent.nil? ? [] : qualified_prefix
+            Pending.new(owner: owner, module_name: name, kind: node.name, prefix: prefix)
+          end
+        end
+
+        def owner(receiver, qualified_prefix, in_singleton_class)
+          case receiver
+          when nil, Prism::SelfNode
+            return nil if in_singleton_class
+            return "Object" if qualified_prefix.empty? && receiver.nil?
+
+            qualified_prefix.join("::") unless qualified_prefix.empty?
+          else
+            Source::ConstantPath.qualified_name_or_nil(receiver)
+          end
+        end
+        private_class_method :owner
+
+        # The `include` / `prepend` call an idempotence guard runs only while its module is not yet an ancestor of its
+        # receiver, or nil. The guards are `X.include?(M)`, `X.ancestors.include?(M)` and `X < M`, written after the
+        # call as `unless` or as `if !`; the guard only skips a second include, so the call is read as a direct
+        # statement would be (#2109). The guard names the call's own receiver and module; any other condition, or a
+        # guard naming another receiver or module, leaves the call unread.
+        #
+        # `top_level` says the conditional is a direct statement of the file's top level, where a receiverless call
+        # includes into Object; see {guarded_call?}. The `CALLS` check is defensive: the scanner applies a call's mixin
+        # edge only when {Mixins.pending} reads it as include or prepend, so a call of another name changes nothing.
+        def guarded(node, top_level)
+          return nil unless node.is_a?(Prism::UnlessNode) || node.is_a?(Prism::IfNode)
+
+          call = guarded_body(node)
+          return nil unless call.is_a?(Prism::CallNode) && CALLS.include?(call.name) && guarded_call?(call, top_level)
+
+          guard = when_undefined(node)
+          call if guard && guards?(guard, call)
+        end
+
+        # Whether `call` takes exactly one module, and is not receiverless at the file's top level. Such an include's
+        # guard would be `include?` on main, which Ruby does not define: the guard raises, so it is not read as an
+        # include into Object. A receiverless call in a class or module body names that body's own module.
+        def guarded_call?(call, top_level)
+          call.arguments&.arguments&.size == 1 && !(top_level && call.receiver.nil?)
+        end
+        private_class_method :guarded_call?
+
+        # The sole statement of an `unless` or `if` body, or nil when the conditional has an else branch or another
+        # body.
+        def guarded_body(node)
+          return nil if node.is_a?(Prism::UnlessNode) ? node.else_clause : node.subsequent
+
+          body = node.statements&.body
+          body.first if body&.size == 1
+        end
+        private_class_method :guarded_body
+
+        # The predicate the body runs under: `unless P` runs its body when P is false; `if !P` does too.
+        def when_undefined(node)
+          predicate = unwrap(node.predicate)
+          return predicate if node.is_a?(Prism::UnlessNode)
+          return nil unless predicate.is_a?(Prism::CallNode) && predicate.name == :! && predicate.receiver
+
+          unwrap(predicate.receiver)
+        end
+        private_class_method :when_undefined
+
+        def unwrap(node)
+          body = node.body.body if node.is_a?(Prism::ParenthesesNode) && node.body.is_a?(Prism::StatementsNode)
+          body&.size == 1 ? body.first : node
+        end
+        private_class_method :unwrap
+
+        # Whether `guard` is `X.include?(M)`, `X.ancestors.include?(M)` or `X < M`, where `X` and `M` are the receiver
+        # and the argument of `call`; {guarded} passes only a call with exactly one argument.
+        def guards?(guard, call)
+          return false unless guard.is_a?(Prism::CallNode) && guard.arguments&.arguments&.size == 1
+
+          subject, named = guard_subject(guard)
+          named && same_constant?(subject, call.receiver) && same_constant?(named, call.arguments.arguments.first)
+        end
+        private_class_method :guards?
+
+        # The `[receiver, module]` a guard names, or nil.
+        def guard_subject(guard)
+          named = guard.arguments.arguments.first
+          case guard.name
+          when :<
+            [guard.receiver, named] if guard.receiver
+          when :include?
+            receiver = guard.receiver
+            if receiver.is_a?(Prism::CallNode) && receiver.name == :ancestors && receiver.arguments.nil?
+              [receiver.receiver, named]
+            else
+              [receiver, named]
+            end
+          end
+        end
+        private_class_method :guard_subject
+
+        # Whether two receivers or modules name the same constant; two absent receivers (self) match.
+        def same_constant?(left, right)
+          return left.nil? && right.nil? if left.nil? || right.nil?
+
+          name = Source::ConstantPath.qualified_name_or_nil(left)
+          !name.nil? && name == Source::ConstantPath.qualified_name_or_nil(right)
+        end
+        private_class_method :same_constant?
+
+        # Each {Pending} edge's module name, resolved as Ruby resolves the constant from where it is written:
+        # `include NumExt` in `module Ext` names `Ext::NumExt` when a patch body opens that, else `NumExt`. Only the
+        # names the `pre_eval:` files open or mix into are candidates; one they do not name stays as written.
+        def resolve(pending, entries)
+          known = entries.to_set(&:class_name).merge(pending.map(&:owner))
+          pending.map do |item|
+            candidates = item.prefix.size.downto(1).map do |depth|
+              [*item.prefix.first(depth), item.module_name].join("::")
+            end
+            name = candidates.find { |candidate| known.include?(candidate) } || item.module_name
+            ProjectPatchedMethods::Mixin.new(owner: item.owner, module_name: name, kind: item.kind)
+          end
+        end
+      end
+    end
+  end
+end