rigortype 0.4.4 → 0.4.6

data/lib/rigor/inference/refined_dispatch/constructed_class.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    module RefinedDispatch
+      # Issue #1979 — whether a class whose superclass the tables do not know is `class K < <expr>` with `<expr>` a
+      # core constructor call (`Data.define(...)`, `Struct.new(...)`, `Class.new(<constant>)`) that cannot answer a
+      # given class or one of its subclasses, so a subclass walk may leave it out (`OwnMethod.each_subclass` with
+      # `possible_only:`).
+      #
+      # Each constant the expression names (the indexer's `[DiscoveryIndex::ENVELOPE_CONSTRUCTED_KIND, name]` entries)
+      # must be a class the environment knows that is neither the given class nor a subclass of it, and the project
+      # must not touch the name: no project class or module whose last segment is the name (Ruby resolves a constant
+      # through the enclosing classes' ancestors and mixins too, so a `Base::StandardError` a class inherits may be
+      # what `Class.new(StandardError)` names), no reopening, singleton `def`, refinement or method table keyed by
+      # the name itself, and no constant write of it. Any other shape answers false, as does a class a
+      # `K = Class.new(...)` write names.
+      module ConstructedClass
+        MEMO_KEY = :__rigor_constructed_class__
+        EMPTY = [].freeze
+        private_constant :MEMO_KEY, :EMPTY
+
+        module_function
+
+        # True when `name` cannot be `class_name` or a subclass of it. Files `name`'s class edge and a `constant:`
+        # edge per named constant on every call; a class declaration appearing fires the walk's `subclass_of:*`.
+        def elsewhere?(scope, name, class_name)
+          table = memo(scope)
+          named = constructed_names(scope, name, table)
+          if Analysis::DependencyRecorder.active?
+            Scope::ResolutionChain.record_class(scope, name)
+            named.each { |constant| Analysis::DependencyRecorder.read_name(:constant, constant) }
+          end
+          return false if named.empty?
+
+          by_class = (table[:verdicts][class_name] ||= {})
+          return by_class[named] if by_class.key?(named)
+
+          by_class[named] = named.all? { |constant| core_class_apart?(scope, constant, class_name.to_s, table) }
+        end
+
+        def core_class_apart?(scope, constant, class_name, table)
+          environment = scope.environment
+          return false unless environment&.class_known?(constant)
+          return false if project_name?(scope, constant, table)
+          return false unless scope.shadowing_constant_names(constant).empty?
+
+          ordering = environment.class_ordering(constant, class_name)
+          %i[disjoint superclass].include?(ordering) ||
+            (ordering == :unknown && !environment.class_known?(class_name))
+        end
+
+        # Whether the project touches `constant` by name: a declared or reopened class or module whose last segment
+        # it is, or a top-level table keyed by it (a singleton `def Data.define`, methods, envelope entries or marks,
+        # mixins, a refinement).
+        def project_name?(scope, constant, table)
+          return true if declared_segments(scope, table).include?(constant)
+
+          discovery = scope.discovery
+          [discovery.discovered_classes, discovery.discovered_superclasses, discovery.discovered_includes,
+           discovery.discovered_prepends, discovery.discovered_extends, discovery.discovered_methods,
+           discovery.discovered_parameter_envelopes, discovery.discovered_refinements].any? do |by_name|
+            by_name.key?(constant)
+          end
+        end
+
+        # The last segment of every class or module the project declares, reopenings included.
+        def declared_segments(scope, table)
+          table[:segments] ||= declared_names(scope).each_key.to_set { |key| key.to_s.split("::").last }.freeze
+        end
+
+        # The constants `name`'s superclass expression names, or an empty Array; memoised per envelope bucket,
+        # which a file's own discovery shares with the run's seed for every class it does not declare.
+        def constructed_names(scope, name, table)
+          bucket = scope.discovered_parameter_envelopes[name]
+          return EMPTY if bucket.nil?
+
+          names = table[:names]
+          return names[bucket] if names.key?(bucket)
+
+          names[bucket] =
+            if bucket.key?(Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK)
+              EMPTY
+            else
+              kind = Scope::DiscoveryIndex::ENVELOPE_CONSTRUCTED_KIND
+              bucket.each_key.filter_map { |key| key[1] if key.is_a?(Array) && key[0] == kind }.freeze
+            end
+        end
+
+        # The run-wide table of declared classes: the seeded `discovered_class_sources`, or a single-file run's
+        # `discovered_classes` where nothing seeded it.
+        def declared_names(scope)
+          sources = scope.discovery.discovered_class_sources
+          sources.empty? ? scope.discovery.discovered_classes : sources
+        end
+
+        # One thread-local slot keyed on the run-generation token the runner seeds (or, unseeded, the file's merged
+        # `discovered_def_nodes`, as `ExpressionTyper` falls back) and the environment: every table read here is
+        # fixed for a run, so each answer is computed once a run, and a new run replaces the slot.
+        def memo(scope)
+          slot = Thread.current[MEMO_KEY]
+          generation = scope.run_generation || scope.discovered_def_nodes
+          environment = scope.environment
+          unless slot && slot[0].equal?(generation) && slot[1].equal?(environment)
+            slot = [generation, environment, { names: {}.compare_by_identity, verdicts: {} }]
+            Thread.current[MEMO_KEY] = slot
+          end
+          slot[2]
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/refined_dispatch/own_method.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../builtins/cruby_definers"
+require_relative "constructed_class"
 
 module Rigor
   module Inference
@@ -193,8 +194,7 @@ module Rigor
         # A module some code `prepend`s to an object's singleton class (or `extend`s an object with in a method
         # body), which puts it ahead of the object's class even where the class already includes it.
         def object_prepended?(scope, name)
-          scope.discovered_parameter_envelopes[name]&.key?(Scope::DiscoveryIndex::ENVELOPE_OBJECT_EXTENDED_MARK) ||
-            false
+          scope.parameter_envelopes_of(name).key?(Scope::DiscoveryIndex::ENVELOPE_OBJECT_EXTENDED_MARK)
         end
 
         # Is some in-effect row under a class no table declares by any spelling of it (the keys sharing its last
@@ -282,10 +282,16 @@ module Rigor
         # declaration with that superclass appearing or vanishing fires (`IncrementalSession#negative_affected`).
         # A class whose superclass the tables do not know may be a subclass of any class, so it joins the walk too
         # (`subclass_of:*`, which any class declaration appearing or vanishing fires).
-        def each_subclass(scope, class_name)
+        #
+        # Issue #1979 — with `possible_only:`, a class whose superclass expression is a core constructor call that
+        # cannot answer `class_name` or a subclass of it (`ConstructedClass.elsewhere?`) is left out, with its
+        # subclasses.
+        def each_subclass(scope, class_name, possible_only: false)
           children = children_by_parent(scope)
           record_subclasses_read(class_name)
-          queue = children.fetch(class_name.to_s, []) + unknown_superclass_classes(scope, class_name)
+          unknown = unknown_superclass_classes(scope, class_name)
+          unknown = unknown.reject { |name| ConstructedClass.elsewhere?(scope, name, class_name) } if possible_only
+          queue = children.fetch(class_name.to_s, []) + unknown
           seen = {}
           until queue.empty?
             subclass = queue.shift
@@ -300,10 +306,32 @@ module Rigor
 
         def unknown_superclass_classes(scope, class_name)
           Analysis::DependencyRecorder.read_name(:subclass_of, "*") if Analysis::DependencyRecorder.active?
-          mark = Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK
-          computed = scope.discovered_superclasses.filter_map { |child, parent| child if parent.nil? }
-          meta = scope.discovered_parameter_envelopes.filter_map { |name, bucket| name if bucket.key?(mark) }
-          (computed + meta).uniq - [class_name.to_s]
+          table = subclass_memo(scope)
+          all = table[:unknown] ||= begin
+            mark = Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK
+            computed = scope.discovered_superclasses.filter_map { |child, parent| child if parent.nil? }
+            meta = scope.discovered_parameter_envelopes.filter_map { |name, bucket| name if bucket.key?(mark) }
+            (computed + meta).uniq.freeze
+          end
+          name = class_name.to_s
+          all.include?(name) ? all - [name] : all
+        end
+
+        SUBCLASS_MEMO_KEY = :__rigor_own_method_subclasses__
+        private_constant :SUBCLASS_MEMO_KEY
+
+        # One thread-local slot keyed on the scope's discovery index (a frozen `Data`) and environment, the only
+        # inputs `children_by_parent` and the unknown-superclass list read; neither files a dependency edge
+        # (`each_subclass` files its own `subclass_of:` edges on every call), so a hit drops none.
+        def subclass_memo(scope)
+          slot = Thread.current[SUBCLASS_MEMO_KEY]
+          discovery = scope.discovery
+          environment = scope.environment
+          unless slot && slot[0].equal?(discovery) && slot[1].equal?(environment)
+            slot = [discovery, environment, {}]
+            Thread.current[SUBCLASS_MEMO_KEY] = slot
+          end
+          slot[2]
         end
 
         def record_subclasses_read(class_name)
@@ -313,10 +341,11 @@ module Rigor
         end
 
         def children_by_parent(scope)
-          scope.discovered_superclasses.each_with_object({}) do |(child, raw_parent), children|
-            parent = scope.ancestor_name_candidates(child, raw_parent).find { |name| known_class?(scope, name) }
-            (children[parent] ||= []) << child if parent
-          end
+          subclass_memo(scope)[:children] ||=
+            scope.discovered_superclasses.each_with_object({}) do |(child, raw_parent), children|
+              parent = scope.ancestor_name_candidates(child, raw_parent).find { |name| known_class?(scope, name) }
+              (children[parent] ||= []) << child if parent
+            end.each_value(&:freeze).freeze
         end
 
         def known_class?(scope, name)

data/lib/rigor/inference/reflective_ivar_write.rb

@@ -65,9 +65,10 @@ module Rigor
         node.arguments.arguments[1]
       end
 
-      # Runs the block with the evaluator inside a `while` / `until` / `for` body. The loop's rebind fixpoint widens
-      # locals only, so a literal-name write there must not replace the binding with one pass's value
-      # ({.apply}).
+      # Runs the block with the evaluator inside a `for` body or a `while` / `until` predicate. A `for` loop has no
+      # rebind fixpoint, and a predicate runs before every iteration but is walked once, so a literal-name write there
+      # must not replace the binding with one pass's value ({.apply}). A `while` / `until` body does not enter it: its
+      # fixpoint widens the ivar (issue #1930).
       def in_repeating_body
         depth = Thread.current[REPEATING_KEY] || 0
         Thread.current[REPEATING_KEY] = depth + 1
@@ -83,9 +84,8 @@ module Rigor
       end
 
       # `scope` after `node` runs. A literal name binds that ivar to the value's type (yielded), as `@n = v` does.
-      # Inside a loop body ({.in_repeating_body}) the value and `Dynamic[top]` are joined into the current binding
-      # instead: the loop's fixpoint widens locals only, so its single pass over an ivar types the value from one
-      # iteration's locals (`instance_variable_set(:@n, i + 1)` stored `1`) and would leave that. Any other call joins
+      # Inside a `for` body or a loop predicate ({.in_repeating_body}) the value and `Dynamic[top]` are joined into the
+      # current binding instead: nothing widens the single pass's value across iterations there. Any other call joins
       # `Dynamic[top]` into every ivar `scope` binds: any one of them may now hold the value, and joining the
       # value's own type would report a method the old value has and the new one lacks. An ivar on its ADR-58
       # declaration seed keeps its mark, which stops a nil in the seed from fuelling a nil-receiver diagnostic.

data/lib/rigor/inference/return_barrier.rb

@@ -2,6 +2,8 @@
 
 require "prism"
 
+require_relative "../source/node_children"
+
 module Rigor
   module Inference
     # The constructs whose body `return` leaves only that body, not the enclosing method. A `return` anywhere else —
@@ -39,6 +41,20 @@ module Rigor
         DEFINE_CALLS.include?(name) || (name == :lambda && kernel_receiver?(call_node.receiver))
       end
 
+      # True when a `return` under `node` exits the enclosing method: one reachable without crossing a barrier node
+      # or a barrier call's block. Allocation-free and early-exiting, for a caller that asks it of every block body.
+      def exits_method?(node)
+        return false if node.nil? || node?(node)
+        return true if node.is_a?(Prism::ReturnNode)
+
+        barrier_block = node.block if node.is_a?(Prism::CallNode) && block_call?(node)
+        node.rigor_each_child do |child|
+          next if child.equal?(barrier_block)
+          return true if exits_method?(child)
+        end
+        false
+      end
+
       # True when a `lambda` call on `receiver` reaches `Kernel#lambda`: no receiver, `self`, `Kernel` or `::Kernel`.
       def kernel_receiver?(receiver)
         case receiver

data/lib/rigor/inference/scope_indexer/certainty.rb

@@ -66,6 +66,15 @@ module Rigor
           classifier.result
         end
 
+        # Issue #2021 — every contribution of the tree under `root`, for a file discovery reached only through a
+        # `require_relative` walk: another file the walk does not see may redefine what it defines, so none of its
+        # contributions is certain.
+        def every_contribution(root)
+          classifier = Classifier.new
+          classifier.possible(root)
+          classifier.result
+        end
+
         # Whether `node` was classified possible in `possible` (a {possible_nodes} answer).
         def possible?(possible, node)
           !possible.empty? && possible.include?(node)

data/lib/rigor/inference/scope_indexer/declared_ivar_types.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require_relative "../../reflection"
+require_relative "../rbs_type_translator"
+
+module Rigor
+  module Inference
+    module ScopeIndexer
+      # Issue #1406 — an ivar the class's RBS declares, as `@x: T` or through an `attr_reader x: T` /
+      # `attr_writer` / `attr_accessor` member (in `sig/`, or inline `attr_reader :x #: T`), reads the declared type
+      # in place of the census's join of the writes. The declaration is the author's contract for the field, so it
+      # wins over every write the census saw, #541's untyped `attr_writer` write included; whether the writes
+      # honour it is ADR-112 WD5's question (#1075), not this one's. It serves
+      # checking only: `rigor sig-gen` indexes with `declared_ivar_types: false` and keeps the census's answer.
+      #
+      # Only an ivar the census already holds is replaced, so a declaration adds no entry the file's writes did not.
+      # A declaration is not taken when it is `untyped` (what rbs-inline supplies for a bare `attr_reader :x`, which
+      # the type specification reads as a placeholder) or mentions a type variable (`@x: T` in `class Box[T]` is
+      # unsolved at a read), and the census entry stands.
+      module DeclaredIvarTypes
+        module_function
+
+        def apply!(accumulator, scope)
+          environment = scope&.environment
+          return if environment.nil?
+
+          accumulator.each do |class_name, entries|
+            next unless class_name.is_a?(String) # a guard: the side-table keys are deleted before this runs
+
+            declared = declared_ivars(class_name, environment)
+            next if declared.empty?
+
+            accumulator[class_name] = entries.to_h do |ivar, type|
+              [ivar, declared.fetch(ivar, type)]
+            end
+          end
+        end
+
+        # `{ivar name => Rigor::Type}` for the ivars `class_name`'s RBS instance definition declares with a usable
+        # type, or `{}`.
+        def declared_ivars(class_name, environment)
+          definition = Reflection.instance_definition(class_name, environment: environment)
+          return {} if definition.nil?
+
+          instance = Type::Combinator.nominal_of(class_name)
+          definition.instance_variables.each_with_object({}) do |(name, variable), acc|
+            type = translate(variable.type, instance, environment)
+            acc[name] = type if type
+          end
+        rescue StandardError # a guard: a definition that fails to build declares nothing
+          {}
+        end
+
+        def translate(rbs_type, instance, environment)
+          return nil unless rbs_type.free_variables.empty?
+
+          type = RbsTypeTranslator.translate(rbs_type, self_type: instance, instance_type: instance,
+                                                       alias_expander: environment.rbs_loader)
+          type.is_a?(Type::Dynamic) ? nil : type
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/scope_indexer/declared_param_writes.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../reflection"
+require_relative "../method_parameter_binder"
+require_relative "../global_write_census"
+require_relative "unseen_ivar_writers"
+
+module Rigor
+  module Inference
+    module ScopeIndexer
+      # Issue #1154 — the class-ivar census types an `@x = x` write whose right-hand side reads a parameter of the
+      # enclosing instance `def` as that parameter's DECLARED type: the method's RBS signature, from `sig/` or from
+      # an rbs-inline `# @rbs` / `#:` annotation, read through {MethodParameterBinder}, the binder the method body's
+      # own entry scope uses. Without it the census typed the rvalue with no local bindings, so a constructor field
+      # read `Dynamic[top]` in every sibling method even where `sig/` declared `initialize: (String x) -> void`.
+      #
+      # The census is flow-free, so a write is credited only where the parameter can hold nothing but its
+      # argument. {.collect} answers `{write node => declared type}` (an identity Hash) for the writes that pass
+      # every gate, and {EMPTY} otherwise; an absent write keeps the census's ordinary rvalue typing, so a declined
+      # case reads exactly what it read before:
+      #
+      # - the write's value is a bare read of the parameter (`@x = x`), not an expression over it;
+      # - the write is not inside a block or a lambda, so a block parameter of the same name and a block that runs
+      #   under another `self` (`instance_eval`, `Class.new`, `define_method`) never borrow the method's parameter;
+      # - the method body never writes the parameter, in any form and at any depth (`x = Integer(x)`, `x ||= …`,
+      #   a `rescue => x` or pattern target);
+      # - the owner is a class, not a module (a module's ivar belongs to whichever object includes it), and its
+      #   RBS declares the method itself (`defined_in`), so an inherited signature never types a redefinition;
+      # - the signature has exactly one overload, whose parameter lists are typed (`(?)` declines) and mention no
+      #   type variable (a class `Box[T]` or a method `[T]` variable is unsolved at the write);
+      # - the class's primary RBS declaration is the project's (`sig/` or rbs-inline), not core, stdlib or a gem's:
+      #   a project reopening of a library class (`Thread::SizedQueue#initialize`) would otherwise borrow the
+      #   library's parameter type for its own `def`;
+      # - the body neither calls `binding` nor passes code to `eval` / `instance_eval` / `class_eval` /
+      #   `module_eval` / `instance_exec` as an argument, any of which can rewrite the parameter unseen;
+      # - nothing outside the class's own census may write the ivar ({UnseenIvarWriters}): no project ancestor, and
+      #   no other object's code (`o.instance_variable_set(:@x, v)`);
+      # - the declared type is not `untyped`, which is what the write already records.
+      module DeclaredParamWrites
+        EMPTY = {}.compare_by_identity.freeze
+
+        SCOPE_BARRIERS = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+        private_constant :SCOPE_BARRIERS
+
+        BLOCK_NODES = [Prism::BlockNode, Prism::LambdaNode].freeze
+        private_constant :BLOCK_NODES
+
+        OPAQUE_EVAL_CALLS = %i[eval instance_eval class_eval module_eval instance_exec class_exec
+                               module_exec].to_set.freeze
+        private_constant :OPAQUE_EVAL_CALLS
+
+        WRITER_SCOPE_KEY = :__rigor_declared_param_writer_scope__
+        private_constant :WRITER_SCOPE_KEY
+
+        module_function
+
+        # Runs the block with `scope` as the one whose project tables the unseen-writer and single-file gates read, in
+        # place of the census's own scope. `rigor sig-gen` indexes each file under a scope that carries no project
+        # tables, so without it another file's writer, ancestor or reopening would go unseen.
+        def with_writer_scope(scope)
+          return yield if scope.nil?
+
+          previous = Thread.current[WRITER_SCOPE_KEY]
+          Thread.current[WRITER_SCOPE_KEY] = scope
+          begin
+            yield
+          ensure
+            Thread.current[WRITER_SCOPE_KEY] = previous
+          end
+        end
+
+        def writer_scope(scope) = Thread.current[WRITER_SCOPE_KEY] || scope
+
+        # `{InstanceVariableWriteNode => Rigor::Type}` for `def_node`'s creditable writes, or {EMPTY}. The caller
+        # passes only an instance `def`: a singleton body's `@x` is the class object's.
+        def collect(def_node, class_name, scope)
+          return EMPTY if def_node.body.nil? || def_node.parameters.nil?
+
+          written = Set.new
+          writes = []
+          return EMPTY if scan(def_node.body, written, writes, in_block: false) == :opaque
+
+          writes.reject! { |write| written.include?(write.value.name) }
+          return EMPTY if writes.empty?
+
+          types = declared_types(def_node, class_name, scope)
+          writers = writer_scope(scope)
+          credited = writes.each_with_object({}.compare_by_identity) do |write, acc|
+            type = types[write.value.name]
+            acc[write] = type if type && !UnseenIvarWriters.possible?(writers, class_name, write.name)
+          end
+          credited.empty? ? EMPTY : credited
+        rescue StandardError
+          EMPTY
+        end
+
+        # Collects the `@x = local` writes outside every block, and the name of every local the body writes in
+        # any form at any depth. A read at depth zero outside a block names the method's own local, which is the
+        # parameter when the body never writes the name.
+        #
+        # Answers `:opaque` when the body can rewrite a local through code the scan cannot read: a `binding` call, or
+        # an `eval`-family call given an argument ({OPAQUE_EVAL_CALLS}).
+        def scan(node, written, writes, in_block:)
+          return unless node.is_a?(Prism::Node)
+          return if SCOPE_BARRIERS.any? { |klass| node.is_a?(klass) }
+
+          case node
+          when Prism::LocalVariableWriteNode, Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode,
+               Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableTargetNode
+            written << node.name
+          when Prism::CallNode
+            return :opaque if opaque_call?(node)
+          end
+          writes << node if !in_block && local_read_write?(node)
+          inner = in_block || BLOCK_NODES.any? { |klass| node.is_a?(klass) }
+          node.rigor_each_child do |child|
+            return :opaque if scan(child, written, writes, in_block: inner) == :opaque
+          end
+          nil
+        end
+
+        # `binding` hands the frame's locals to code that may write them (`binding.eval("x = 's'")`,
+        # `Helper.rw(binding)`); a string passed to an `eval`-family call is code the scan cannot read.
+        def opaque_call?(node)
+          return true if node.name == :binding
+
+          OPAQUE_EVAL_CALLS.include?(node.name) && !(node.arguments&.arguments || []).empty?
+        end
+
+        def local_read_write?(node)
+          node.is_a?(Prism::InstanceVariableWriteNode) && node.value.is_a?(Prism::LocalVariableReadNode)
+        end
+
+        # The declared, non-`untyped` type of each parameter, or `{}` when a gate declines the method.
+        def declared_types(def_node, class_name, scope)
+          environment = scope&.environment
+          return {} if environment.nil?
+          return {} if environment.rbs_module?(class_name)
+          return {} unless Reflection.project_declared_class?(class_name, environment: environment)
+
+          rbs_method = Reflection.instance_method_definition(class_name, def_node.name, environment: environment)
+          return {} unless sole_typed_overload?(rbs_method, class_name)
+
+          binder = MethodParameterBinder.new(environment: environment, class_path: class_name, singleton: false)
+          binder.bind(def_node).reject { |_name, type| type.is_a?(Type::Dynamic) }
+        end
+
+        def sole_typed_overload?(rbs_method, class_name)
+          return false if rbs_method.nil? || rbs_method.defined_in.to_s.delete_prefix("::") != class_name
+
+          method_types = rbs_method.method_types
+          return false unless method_types.size == 1
+
+          function = method_types.first.type
+          function.respond_to?(:required_positionals) && function.free_variables.empty?
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/scope_indexer/unseen_ivar_writers.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../global_write_census"
+require_relative "../reflective_ivar_write"
+
+module Rigor
+  module Inference
+    module ScopeIndexer
+      # Issue #1154 — whether code the class-ivar census of `class_name` never walks may write the instance variable
+      # `ivar` on its instances, where a literal write in the same place would answer for it too. The census joins
+      # only the writes in the class's own bodies in one file, so a declared-parameter write ({DeclaredParamWrites}) is
+      # credited only when this answers false. The standard is parity with a literal write: what an unknown object's
+      # code may do is accepted, as it is for `@x = 1` (the {IvarWriterCensus} policy), and what the class or its
+      # ancestors do is not:
+      #
+      # - a project ancestor on the class's instance resolution chain (a superclass, or a module it or an ancestor
+      #   includes or prepends) defines the writer `ivar=` (an `attr_writer` / `attr_accessor` or a `def`), or has an
+      #   instance `def` whose body writes the ivar, in any form, or calls `instance_variable_set` on `self` (`super`
+      #   from the class's `initialize`, or an inherited setter, runs it on the instance);
+      # - an ancestor the project does not declare is reached through a superclass edge and is not a core class (a
+      #   gem's or a Ruby-written stdlib class's `initialize` may write any ivar), or the chain was cut;
+      # - the class or a project ancestor holds an open-world self writer in an instance body (`[:ivar_set_class, …]`,
+      #   `def configure(&b) = instance_eval(&b)`);
+      # - a file other than this one writes the same ivar in an instance `def` of the class (`[:own_write, …]`): the
+      #   census is per file, so a reopening's write would not be joined;
+      # - the project's {GlobalWriteCensus} records a named write to the ivar from outside the object
+      #   (`o.instance_variable_set(:@x, v)`, `o.instance_eval { @x = v }`).
+      #
+      # An ancestor's `define_method` body is not read: the ancestor's own file census sees it, this file does not.
+      #
+      # Every read files its ADR-46 edge: each project ancestor's declaring files ({Scope::ResolutionChain.record_entry})
+      # and each of its `def`s read ({Scope#user_def_for}), and the `ivar_set:`, `ivar_set_class:` and `own_write:`
+      # name keys the incremental session fires when a file's entries move.
+      module UnseenIvarWriters
+        BARRIERS = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+        private_constant :BARRIERS
+
+        module_function
+
+        def possible?(scope, class_name, ivar)
+          census = census(scope)
+          foreign_write?(census, ivar) || class_open_world?(census, class_name) ||
+            other_file_write?(census, class_name, ivar) || ancestor_write?(scope, census, class_name, ivar)
+        end
+
+        def census(scope)
+          census = scope.discovered_global_write_census
+          pre_eval = scope.environment&.project_patched_methods&.write_census
+          pre_eval.nil? || pre_eval.empty? ? census : census | pre_eval
+        end
+
+        def foreign_write?(census, ivar)
+          Analysis::DependencyRecorder.read_name(:ivar_set, ivar.to_s) if Analysis::DependencyRecorder.active?
+          census.include?([:ivar_set, ivar])
+        end
+
+        def class_open_world?(census, class_name)
+          # A guard: the entry comes from an instance body of the class (or an ancestor), whose declaring files the
+          # class's own resolution already re-checks; kept so the read states its own dependency.
+          Analysis::DependencyRecorder.read_name(:ivar_set_class, class_name) if Analysis::DependencyRecorder.active?
+          census.include?([:ivar_set_class, class_name])
+        end
+
+        # More than one file records an instance-`def` write of the ivar for the class: this file's census sees its
+        # own only. An entry no path tags (a census built outside the project pre-pass) counts as this file.
+        def other_file_write?(census, class_name, ivar)
+          if Analysis::DependencyRecorder.active?
+            Analysis::DependencyRecorder.read_name(:own_write, "#{class_name}##{ivar}")
+          end
+          paths = census.filter_map do |entry|
+            entry[3] if entry.size == 4 && entry[0] == :own_write && entry[1] == class_name && entry[2] == ivar
+          end
+          paths.uniq.size > 1
+        end
+
+        def ancestor_write?(scope, census, class_name, ivar)
+          chain = Scope::ResolutionChain.for(scope, class_name, :instance, :constants)
+          return true if chain.truncated?
+
+          setter = :"#{ivar.to_s.delete_prefix('@')}="
+          chain.entries.any? do |entry|
+            next false if entry.side != :instance || entry.name == class_name
+
+            # A guard: the class body's own `include` / `<` resolution already files this edge; kept so the read
+            # states its own dependency.
+            Scope::ResolutionChain.record_entry(scope, entry, :instance) if Analysis::DependencyRecorder.active?
+            next foreign_superclass?(scope, entry) if entry.external?
+
+            class_open_world?(census, entry.name) || scope.discovered_method?(entry.name, setter, :instance) ||
+              defs_write?(scope, entry.name, ivar)
+          end
+        end
+
+        # A superclass the project does not declare that the interpreter does not implement: a gem's class, or a
+        # stdlib one written in Ruby (`Logger` sets `@level` in `initialize`), may write any ivar of its subclass's
+        # instances. A module the project does not declare is left alone.
+        def foreign_superclass?(scope, entry)
+          return false unless entry.superclass_edge
+
+          loader = scope.environment&.rbs_loader
+          entry.candidates.empty? || entry.candidates.none? { |name| loader&.core_class?(name) }
+        end
+
+        def defs_write?(scope, owner, ivar)
+          (scope.discovered_def_nodes[owner] || {}).each_key.any? do |method_name|
+            node = scope.user_def_for(owner, method_name)
+            node.is_a?(Prism::DefNode) && writes?(node.body, ivar)
+          end
+        end
+
+        def reflective_name(node) = ReflectiveIvarWrite.literal_name(node)
+
+        def writes?(node, ivar)
+          return false unless node.is_a?(Prism::Node)
+          return false if BARRIERS.any? { |klass| node.is_a?(klass) }
+
+          case node
+          when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode,
+               Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableTargetNode
+            return true if node.name == ivar
+          end
+          # A literal `instance_variable_set` of the ivar, or one whose name no literal spells.
+          return true if ReflectiveIvarWrite.self_write?(node) && [ivar, nil].include?(reflective_name(node))
+
+          node.rigor_each_child { |child| return true if writes?(child, ivar) }
+          false
+        end
+      end
+    end
+  end
+end