rigortype 0.4.5 → 0.4.6

data/lib/rigor/inference/def_return_typer.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../type"
 require_relative "../source/node_children"
 require_relative "return_barrier"
+require_relative "optimistic_origin"
 
 module Rigor
   module Inference
@@ -21,10 +22,16 @@ module Rigor
     #
     # Extracted from `Rigor::SigGen::Generator#infer_return_type` so `LineTypeCollector` (`rigor annotate`'s
     # def-line annotator) and the sig-generator share one source of truth.
+    #
+    # `keep_lookup_nil: true` is the reading a signature needs (#2197). The engine reads a lookup that can miss
+    # (`Hash#[]`, `Array#first`, the {OptimisticOrigin} family) as nil-free on purpose, so `if h[k]` stays
+    # silent, but a `-> V` written into `sig/` is a contract that every caller's `nil` check is dead code. Each
+    # returned expression whose value is such a lookup therefore contributes `nil` beside its type. Only the
+    # value positions a lookup's `nil` reaches the return through are followed ({#optimistic_value?}).
     module DefReturnTyper
       module_function
 
-      def call(def_node, scope_index)
+      def call(def_node, scope_index, keep_lookup_nil: false)
         body = def_node.body
         return nil if body.nil?
 
@@ -37,11 +44,152 @@ module Rigor
         last_type = safe_type_of(inner_scope, last)
         return nil if last_type.nil?
 
-        union_with_explicit_returns(body, last_type, scope_index)
+        lookup_context = keep_lookup_nil ? LookupContext.new(scope_index, truthy_guards(body)) : nil
+        last_type = with_lookup_nil(last_type, last, inner_scope, lookup_context) if lookup_context
+        union_with_explicit_returns(body, last_type, scope_index, lookup_context: lookup_context)
       rescue StandardError
         nil
       end
 
+      # What {#optimistic_value?} reads beside a node's scope: the engine's per-node scopes, and for each lookup
+      # under a guard the source of the guarding predicates ({#truthy_guards}).
+      LookupContext = Data.define(:scope_index, :guards)
+
+      def with_lookup_nil(type, node, scope, context = nil)
+        return type unless optimistic_value?(node, scope, context)
+
+        Type::Combinator.union(type, Type::Combinator.constant_of(nil))
+      end
+
+      # Whether `node`'s value can be the `nil` an optimistic lookup's miss returns: the lookup itself (a call
+      # the dispatcher marked, or `recv&.m` over one), a local or ivar bound to one, or a branch or operand that
+      # hands its value on. `a && b` hands on either operand (a falsy `a`, a missed lookup's `nil` included, is
+      # the result); `a || b` hands on `b` only, since `a` is returned only when truthy, so `h[k] || 0` stays
+      # nil-free. `x ||= v` and `x &&= v` hand on `v` and, for `&&=`, the binding. A call ON the lookup
+      # (`h[k].to_s`) is a different value.
+      #
+      # Each child is read under the scope the engine recorded for it (`scope_index`), so a branch a guard narrows
+      # (`v ? v : "d"`, `return "z" unless v`) reads the binding the narrowing left, not the enclosing one.
+      def optimistic_value?(node, scope, context = nil)
+        scope = context&.scope_index&.[](node) || scope
+        case node
+        when Prism::CallNode then optimistic_call?(node, scope, context)
+        when Prism::LocalVariableReadNode then !scope.optimistic_local(node.name).nil?
+        when Prism::InstanceVariableReadNode then !scope.optimistic_ivar(node.name).nil?
+        when Prism::AndNode then [node.left, node.right].any? { optimistic_value?(it, scope, context) }
+        when Prism::OrNode then optimistic_value?(node.right, scope, context)
+        else optimistic_write?(node, scope, context) || optimistic_branch?(node, scope, context)
+        end
+      end
+
+      def optimistic_call?(node, scope, context)
+        if scope.optimistic_origins[node]
+          return false if guarded_lookup?(node, context) || non_empty_end?(node, scope)
+
+          return true
+        end
+        node.safe_navigation? && optimistic_value?(node.receiver, scope, context)
+      end
+
+      # `return h[k] if h[k]`, `h[k] ? h[k] : d`: the same lookup, read again under a predicate that just found it
+      # truthy. Only a lookup whose receiver and arguments are plain reads or literals counts, so the second read
+      # sees what the first did.
+      GUARDABLE_LOOKUPS = %i[[] first last dig].freeze
+      private_constant :GUARDABLE_LOOKUPS
+
+      def guarded_lookup?(node, context)
+        return false if context.nil? || !GUARDABLE_LOOKUPS.include?(node.name)
+        return false unless [node.receiver, *node.arguments&.arguments].all? { stable_operand?(it) }
+
+        context.guards.fetch(node, EMPTY_GUARDS).include?(node.slice)
+      end
+
+      EMPTY_GUARDS = [].freeze
+      private_constant :EMPTY_GUARDS
+
+      def stable_operand?(node)
+        case node
+        when Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, Prism::SymbolNode, Prism::StringNode,
+             Prism::IntegerNode, Prism::SelfNode, Prism::ConstantReadNode then true
+        else false
+        end
+      end
+
+      # `a.first` / `a.last` on a receiver the engine has narrowed to a non-empty array (`a.empty? ? d : a.first`)
+      # cannot miss.
+      def non_empty_end?(node, scope)
+        return false unless %i[first last].include?(node.name) && node.arguments.nil? && node.receiver
+
+        receiver = scope.type_of(node.receiver)
+        receiver.is_a?(Type::Difference) && receiver.removed == Type::Combinator.tuple_of
+      rescue StandardError
+        false
+      end
+
+      def optimistic_write?(node, scope, context)
+        case node
+        when Prism::LocalVariableWriteNode, Prism::InstanceVariableWriteNode,
+             Prism::LocalVariableOrWriteNode, Prism::InstanceVariableOrWriteNode
+          optimistic_value?(node.value, scope, context)
+        when Prism::LocalVariableAndWriteNode
+          !scope.optimistic_local(node.name).nil? || optimistic_value?(node.value, scope, context)
+        when Prism::InstanceVariableAndWriteNode
+          !scope.optimistic_ivar(node.name).nil? || optimistic_value?(node.value, scope, context)
+        else false
+        end
+      end
+
+      # The value-carrying children of a statement list or a conditional: any of them can be the value returned.
+      def optimistic_branch?(node, scope, context)
+        value_branches(node).any? { |branch| !branch.nil? && optimistic_value?(branch, scope, context) }
+      end
+
+      # The lookup a truthy arm (the body of an `if` or ternary, the `else` of an `unless`) reads FIRST, mapped to
+      # the source of the predicate that just tested it, for {#guarded_lookup?}. Only the first expression, or the
+      # value of a first `return`, counts: anything run between the test and the re-read (`h.delete(k)`, a
+      # reassignment, a block, `yield`, another call that mutates the receiver) can make the re-read miss.
+      def truthy_guards(body)
+        guards = {}.compare_by_identity
+        collect_truthy_guards(body, guards)
+        guards
+      end
+
+      def collect_truthy_guards(node, guards)
+        return unless node.is_a?(Prism::Node)
+
+        predicate, arm = truthy_arm(node)
+        first = first_value(arm)
+        guards[first] = [predicate.slice] if first
+        node.rigor_each_child { collect_truthy_guards(it, guards) }
+      end
+
+      def first_value(arm)
+        return nil unless arm.is_a?(Prism::StatementsNode)
+
+        first = arm.body.first
+        args = first.is_a?(Prism::ReturnNode) ? first.arguments&.arguments : nil
+        args&.size == 1 ? args.first : first
+      end
+
+      def truthy_arm(node)
+        case node
+        when Prism::IfNode then [node.predicate, node.statements]
+        when Prism::UnlessNode then [node.predicate, node.else_clause&.statements]
+        end
+      end
+
+      def value_branches(node)
+        case node
+        when Prism::ParenthesesNode then [node.body && body_last_expression(node.body)]
+        when Prism::StatementsNode, Prism::BeginNode then [body_last_expression(node)]
+        when Prism::IfNode then [node.statements, node.subsequent]
+        when Prism::UnlessNode then [node.statements, node.else_clause]
+        when Prism::ElseNode, Prism::WhenNode, Prism::InNode then [node.statements]
+        when Prism::CaseNode, Prism::CaseMatchNode then [*node.conditions, node.else_clause]
+        else []
+        end
+      end
+
       def body_last_expression(body)
         case body
         when Prism::StatementsNode then body.body.last
@@ -50,27 +198,27 @@ module Rigor
         end
       end
 
-      def union_with_explicit_returns(body, last_type, scope_index)
+      def union_with_explicit_returns(body, last_type, scope_index, lookup_context: nil)
         return_types = []
-        collect_return_types(body, scope_index, return_types)
+        collect_return_types(body, scope_index, return_types, lookup_context: lookup_context)
         return last_type if return_types.empty?
 
         Type::Combinator.union(last_type, *return_types)
       end
 
-      def collect_return_types(node, scope_index, out)
+      def collect_return_types(node, scope_index, out, lookup_context: nil)
         return unless node.is_a?(Prism::Node)
         return if ReturnBarrier.node?(node)
 
-        type_return_node(node, scope_index, out) if node.is_a?(Prism::ReturnNode)
+        type_return_node(node, scope_index, out, lookup_context: lookup_context) if node.is_a?(Prism::ReturnNode)
         # A barrier call's receiver and arguments still run in the method; only its block is cut off.
         barrier_block = node.block if node.is_a?(Prism::CallNode) && ReturnBarrier.block_call?(node)
         node.rigor_each_child do |c|
-          collect_return_types(c, scope_index, out) unless c.equal?(barrier_block)
+          collect_return_types(c, scope_index, out, lookup_context: lookup_context) unless c.equal?(barrier_block)
         end
       end
 
-      def type_return_node(return_node, scope_index, out)
+      def type_return_node(return_node, scope_index, out, lookup_context: nil)
         args = return_node.arguments&.arguments || []
         if args.empty?
           out << Type::Combinator.constant_of(nil)
@@ -84,7 +232,9 @@ module Rigor
         return unless args.size == 1
 
         type = safe_type_of(scope, args.first)
-        out << type unless type.nil?
+        return if type.nil?
+
+        out << (lookup_context ? with_lookup_nil(type, args.first, scope, lookup_context) : type)
       end
 
       def safe_type_of(scope, node)

data/lib/rigor/inference/definer_resolution.rb

@@ -221,11 +221,15 @@ module Rigor
       # alone where a later `attr_*` replaced the `def`: the attr writes the name's visibility slot, so the reader's
       # visibility is certain. A `define_method` or alias that replaced it contests the visibility slot as well, which
       # this question does read.
+      #
+      # Issue #2134 — the contest is a read of the slot, so a question that reads it files `visibility:<owner>#<name>`:
+      # an answer block may answer from RBS without reading the slot itself (`nearest_ancestor_method_def`).
       def possible?(scope, hit, method_name, reads_visibility)
         discovery = scope.discovery
         owner = hit.owner
         kind = hit.side == :singleton ? :singleton : :instance
         nodes = kind == :singleton ? :discovered_singleton_def_nodes : :discovered_def_nodes
+        Analysis::DependencyRecorder.read_visibility(owner, method_name) if reads_visibility
         discovery.possible_method?(owner, method_name, kind) ||
           (!(reads_visibility == :visibility && kind == :instance) &&
            discovery.contested?(nodes, [owner, method_name.to_sym])) ||
@@ -277,7 +281,7 @@ module Rigor
 
       def side_visibility(scope, owner, method_name, kind)
         if kind == :singleton
-          scope.discovered_method_visibilities.dig(owner.to_s, visibility_slot(method_name, :singleton)) ||
+          scope.discovered_method_visibility(owner, method_name, singleton: true) ||
             self_extended_copy_visibility(scope, owner, method_name)
         else
           scope.discovered_method_visibility(owner, method_name)
@@ -301,11 +305,21 @@ module Rigor
 
       # Whether any file's deferred ranges carry a `module_function` row (`:both` or `:singleton`) for the name on
       # `owner` (`ModuleFunctionState`).
+      #
+      # Issue #2161 — the answer reads every file's rows, so it records `visibility:<owner>#<name>` whichever way it
+      # answers: `ScopeIndexer.visibility_entries` carries each file's rows of this shape, so a file that starts or
+      # stops writing one fires the key. A swap from `private :x` to `module_function :x` in a reopening leaves the
+      # file's visibility table and declared classes as they were, and fires nothing else. The caller's own
+      # visibility reads record the same key today; this one keeps the reader's edge where it reads.
+      #
+      # Issue #2209 — a row named {ModuleFunctionState::ANY_ROW_NAME} (a `module_function` spelling whose names the
+      # prescan cannot read) stands for every name of its owner, so it counts too, and its key is read as well
+      # ({ModuleFunctionState.row_names}).
       def module_function_row?(scope, owner, method_name)
-        name = method_name.to_sym
+        names = ModuleFunctionState.row_names(method_name).each { Analysis::DependencyRecorder.read_visibility(owner, it) }
         scope.discovered_deferred_ranges.each_value.any? do |rows|
           rows.any? do |(_start, _finish, row_name, kind, row_owner)|
-            row_name == name && row_owner == owner.to_s && kind != :instance
+            names.include?(row_name) && row_owner == owner.to_s && kind != :instance
           end
         end
       end

data/lib/rigor/inference/error_info.rb

@@ -53,8 +53,8 @@ module Rigor
       # made a class guard on `$!` itself narrow it; #1447 narrows this decline to the guards that still do not.
       #
       # `$@` calls the exception's `backtrace`, which is an `Array[String]` for a raised exception. It is left unbound
-      # in a program that defines a method named `backtrace` anywhere, which may return anything, and in a clause
-      # whose body calls `set_backtrace`, which may set it to nil.
+      # in a program that defines a method named `backtrace` anywhere, which may return anything, in a clause whose
+      # body calls `set_backtrace`, which may set it to nil, and in a clause whose body never reads it.
       #
       # `$?` is unbound because the exception may have been raised while a subprocess waited: a backtick, `%x` or
       # `system` sets `$?` to nil before it runs the child, so a `Timeout::Error`, an `Interrupt` or a `Thread#raise`
@@ -65,6 +65,10 @@ module Rigor
         return entered if guarded?(body, reference)
 
         entered = entered.with_global(ERROR_INFO, rescued_type(exception_type, scope))
+        # Issue #1967 — a clause that never reads `$@` leaves it unbound without asking about `backtrace`: the answer
+        # could not reach a diagnostic, and asking records a `defines:backtrace` edge that re-checked every `rescue`
+        # in the program whenever such a def came or went.
+        return entered unless backtrace_read?(body)
         return entered if calls_set_backtrace?(body) || BlockCallTiming.project_defines_anywhere?(:backtrace, scope)
 
         entered.with_global(BACKTRACE, backtrace_type)
@@ -114,7 +118,17 @@ module Rigor
         node.rigor_each_child { |child| found ||= calls_set_backtrace?(child) }
         found
       end
-      private_class_method :guard?, :error_info_read?, :calls_set_backtrace?
+
+      # True when `node` reads `$@` anywhere in it, a block included. An empty clause (nil) reads nothing.
+      def backtrace_read?(node)
+        return false unless node.is_a?(Prism::Node)
+        return node.name == BACKTRACE if node.is_a?(Prism::GlobalVariableReadNode)
+
+        found = false
+        node.rigor_each_child { |child| found ||= backtrace_read?(child) }
+        found
+      end
+      private_class_method :guard?, :error_info_read?, :calls_set_backtrace?, :backtrace_read?
 
       # True when `node` reads `$!`, `$@` or `$?` anywhere in it: the gate on typing a rescue modifier's fallback
       # under {.modifier_entry}, which most fallbacks (`rescue nil`) never need.

data/lib/rigor/inference/expression_typer.rb

@@ -12,6 +12,7 @@ require_relative "../source/node_walker"
 require_relative "../analysis/self_call_resolution_recorder"
 require_relative "block_call_timing"
 require_relative "block_repetition"
+require_relative "project_yielder"
 require_relative "block_parameter_binder"
 require_relative "method_parameter_binder"
 require_relative "body_fixpoint"
@@ -1051,7 +1052,7 @@ module Rigor
       # optimistic-carrier decline) and one terminating-arm rule, and cannot drift apart again. Only the
       # value is read; the post-scope belongs to whichever walk owns the statement.
       def type_of_conditional(node)
-        scope.evaluate(node, tracer: tracer).first
+        LoopValueRecord.fetch(node, scope) || scope.evaluate(node, tracer: tracer).first
       end
 
       def type_of_else(node)
@@ -1272,11 +1273,22 @@ module Rigor
         Type::Combinator.bot
       end
 
-      # `while` and `until` loops produce nil unless interrupted by `break VALUE`; the expression value of
-      # `break VALUE` is not yet modeled (scope break-path propagation landed in `eval_loop`). Returning
-      # Constant[nil] is safe and matches Ruby semantics for the common case.
-      def type_of_loop(_node)
-        Type::Combinator.constant_of(nil)
+      # A `while` / `until` / `for` loop in value position. Like {#type_of_conditional}, it delegates to the
+      # statement evaluator, which owns the loop's value: `nil` or a `while` / `until` loop's `break` values
+      # (issue #2031), and a `for` loop's collection or its `break` values (issue #1216).
+      #
+      # A `while` / `until` loop no `break` leaves is `nil` without evaluating its body, as
+      # {StatementEvaluator#loop_value} answers it: a loop that is a call's receiver or argument is typed again by
+      # every narrowing and rule that types that operand, and evaluating it each time re-ran the passes of every loop
+      # nested in it.
+      def type_of_loop(node)
+        return Type::Combinator.constant_of(nil) if break_free_condition_loop?(node)
+
+        LoopValueRecord.fetch(node, scope) || scope.evaluate(node, tracer: tracer).first
+      end
+
+      def break_free_condition_loop?(node)
+        !node.is_a?(Prism::ForNode) && !block_level_jump?(node.statements, Prism::BreakNode)
       end
 
       def type_of_lambda(_node)
@@ -3318,21 +3330,34 @@ module Rigor
         cache = class_graph_buckets[:yields]
         return cache[def_node] if cache.key?(def_node)
 
-        cache[def_node] = yield_reachable?(def_node.body)
+        cache[def_node] = yield_reachable?(def_node.body, def_node.parameters&.block&.name)
       end
 
-      def yield_reachable?(node)
+      def yield_reachable?(node, block_name)
         return false if node.nil?
-        return true if node.is_a?(Prism::YieldNode)
+        return true if node.is_a?(Prism::YieldNode) || forwards_block_argument?(node, block_name)
 
         node.rigor_each_child do |child|
           next if YIELD_BOUNDARY_NODES.include?(child.class)
 
-          return true if yield_reachable?(child)
+          return true if yield_reachable?(child, block_name)
         end
         false
       end
 
+      # Issue #1157 — a call that hands on its method's block (`&`, or `&blk` naming the block parameter) reaches the
+      # caller's block as a `yield` does. Whether `blk` is still the method's own block (not rebound or shadowed) is
+      # decided where it is typed ({#forwarded_block_return_type}); this only keeps the call-site dimension for a def
+      # that might.
+      def forwards_block_argument?(node, block_name)
+        block = node.respond_to?(:block) ? node.block : nil
+        return false unless block.is_a?(Prism::BlockArgumentNode)
+
+        expression = block.expression
+        expression.nil? || (!block_name.nil? && expression.is_a?(Prism::LocalVariableReadNode) &&
+                            expression.name == block_name)
+      end
+
       # The candidate-frame memo path: consult the current run generation's bucket, and on a miss compute
       # and store a FINAL result. Reached only when `memo_candidate?` held (see `infer_user_method_return`).
       # The store gate (ADR-84 WD3): a result is stored when no transient-machinery event during the
@@ -4328,9 +4353,13 @@ module Rigor
 
       # Whether the call may run its block more than once, so a later run reads a captured binding an earlier
       # run rebound — the premise of laying the #587 (b) binding ({#captured_block_bindings}) under the block.
-      # {BlockRepetition.may_repeat?} holds the rule, which the statement pass shares (issue #1412).
+      # {BlockRepetition.may_repeat?} holds the rule, which the statement pass shares (issue #1412). Issue #2301 — a
+      # project callee that hands the block on ({ProjectYielder.hands_block_on?}) also counts: the block's value is what
+      # the forward's target `yield`s, and that target may run it many times, so a captured local the block rebinds must
+      # not read its entry binding.
       def block_may_repeat?(call_node, receiver_type)
-        BlockRepetition.may_repeat?(method_name: call_node.name, receiver_type: receiver_type, scope: scope)
+        BlockRepetition.may_repeat?(method_name: call_node.name, receiver_type: receiver_type, scope: scope) ||
+          ProjectYielder.hands_block_on?(call_node, receiver_type, scope)
       end
 
       EMPTY_BREAK_ARMS = [].freeze
@@ -4426,10 +4455,22 @@ module Rigor
           )
           type_block_body(block_arg, entry, captured: captured)
         when Prism::BlockArgumentNode
-          symbol_block_return_type(block_arg, expected)
+          forwarded_block_return_type(block_arg) || symbol_block_return_type(block_arg, expected)
         end
       end
 
+      # Issue #1157 — `&` / `&blk` hands the callee the block this method was itself called with, so the callee's
+      # `yield` is worth what the CALLER's block returns: the value {.current_yield_value_type} already holds for
+      # this frame (the one a `yield` written here reads). Without it a name resolver that passes its block on
+      # (`def walk(x, &) = first_hit(x, &)`) read as `Dynamic[top]` through the forward and was skipped by
+      # `sig-gen`. Nil when the argument is not a forwarded block or the call site passed no block.
+      def forwarded_block_return_type(block_arg)
+        frame = scope.match_frame
+        return nil unless frame&.forwards_block?(block_arg)
+
+        ExpressionTyper.current_yield_value_type
+      end
+
       # The scope a block body is typed under: the surrounding scope plus the parameter bindings the receiving
       # method's signature implies, with the #587 (b) `captured` binding ({#repeating_captured_bindings}) laid
       # between the two, so the body reads what a captured local, instance variable, class variable or global
@@ -4524,6 +4565,14 @@ module Rigor
       # A failure in the re-answer falls back to the plain tail-only answer, for the reason
       # {#threaded_block_body_type} gives: a raise reaching `block_return_type_for` would report "no block".
       def tail_only_block_body_type(body, block_scope, captured)
+        StatementEvaluator.provisional_returns { tail_only_block_body_type_unrecorded(body, block_scope, captured) }
+      end
+
+      # Issue #2299 — the tail alone, typed from `block_scope`, is not the walk the method's returns are collected
+      # from: a `return` in it reads a name the skipped prefix binds as unbound. Its records are provisional
+      # ({StatementEvaluator.provisional_returns}): the statement walk's record of the same `return` replaces one,
+      # and one stands only for a block the walk never enters (a block in expression position).
+      def tail_only_block_body_type_unrecorded(body, block_scope, captured)
         return block_scope.type_of(body) unless block_body_threading_suppressed? && body.is_a?(Prism::StatementsNode)
 
         answered =

data/lib/rigor/inference/global_write_census.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../source/constant_path"
 require_relative "../source/node_children"
+require_relative "ivar_writer_census"
 
 module Rigor
   module Inference
@@ -26,6 +27,8 @@ module Rigor
     #   kept apart from `[:defines, …]`.
     # - `[:main_mixin, name]` — a module a top-level `include`, `prepend` or `extend` mixes into `Object` (or
     #   `main`), as written. A module RBS does not know may carry any method, so it reaches every class.
+    # - the instance-variable writer entries of {IvarWriterCensus} (issue #1154): `[:ivar_set, name]`,
+    #   `[:ivar_set_class, class_name]` and `[:own_write, class_name, name, path]`.
     #
     # The census is a `Set` of those frozen entries, merged by union across files, the project pre-pass and the
     # `pre_eval:` files. It is recorded inside descents that already visit every node ({Collector#visit}), never
@@ -74,12 +77,40 @@ module Rigor
         census.include?(DEFINES_ANY) || names.any? { |name| census.include?([:defines, name]) }
       end
 
+      # #1154 — the {IvarWriterCensus} entries of `census`, for the incremental diff and its readers.
+      IVAR_KINDS = %i[ivar_set ivar_set_class own_write].to_set.freeze
+
+      def ivar_set_entries(census) = census.select { |entry| IVAR_KINDS.include?(entry.first) }.to_set
+
+      # The negative-dependency key an {IvarWriterCensus} entry fires, the one `UnseenIvarWriters` records.
+      def ivar_key(entry)
+        case entry.first
+        when :ivar_set then "ivar_set:#{entry[1]}"
+        when :ivar_set_class then "ivar_set_class:#{entry[1]}"
+        else "own_write:#{entry[1]}##{entry[2]}"
+        end
+      end
+
       # Whether some refinement may add `write`.
       def refines_write?(census) = census.include?(REFINES_ANY) || census.include?(%i[refines write])
 
       # The module names the top-level mixins spell.
       def main_mixins(census) = census.filter_map { |entry| entry[1] if entry[0] == :main_mixin }
 
+      # Issue #2158 — the `global_census:` dependency key a census entry moves, without the kind prefix: `alias:$x`,
+      # `defines:write`, `refines:write`, `defines_any`, `refines_any`, and `main_mixin` for every top-level mixin: its
+      # reader asks about each, and one shared key is a deliberate precision trade-off (a mixin moving anywhere
+      # re-checks every write that read them). The rules that read the census record these keys
+      # (`CheckRules#record_global_census`), and `Analysis::Incremental.changed_global_census_keys` fires them for
+      # every entry that appeared in or vanished from a file's census.
+      def dependency_key(entry)
+        case entry
+        when DEFINES_ANY then "defines_any"
+        when REFINES_ANY then "refines_any"
+        else entry[0] == :main_mixin ? "main_mixin" : "#{entry[0]}:#{entry[1]}"
+        end
+      end
+
       # A standalone walk, for a file no existing descent visits (a `pre_eval:` entry).
       def scan(root)
         collector = Collector.new(InEffectRefinements.new(root))
@@ -107,12 +138,16 @@ module Rigor
         def initialize(in_effect)
           @census = Set.new
           @refine_ranges = []
+          @ivar_writers = IvarWriterCensus.new(@census)
           @in_effect = in_effect
         end
 
         # A node the collector cannot read must not fail the analysis of its file, nor of every file the pre-pass
         # feeds: the census then counts it as a definition of every name, which only declines a report.
-        def visit(node, top_level:)
+        # `owner` is the qualified name of the class whose body the node sits in, for {IvarWriterCensus} (nil where
+        # the host walk does not track it, or no class owns an instance there).
+        def visit(node, top_level:, owner: nil)
+          @ivar_writers.visit(node, owner)
           case node
           when Prism::AliasGlobalVariableNode then visit_global_alias(node)
           when Prism::DefNode then record(node, node.name)