rigortype 0.4.5 → 0.4.7

data/lib/rigor/analysis/check_rules/declaration_sourced_guard.rb

@@ -24,10 +24,10 @@ module Rigor
       # currently declaration-sourced ivar*, so a second hop (`c = @count; d = c`) and an `||=` rewrite land on
       # the plain `with_local` path and carry no mark.
       #
-      # A branch join is NOT one of those cases, contrary to what this comment claimed when it landed: both
-      # arms of `if c then r = @count else r = @count end` stamp `(:local, :r)`, and `join_declaration_sourced`
-      # INTERSECTS, so the mark survives. Only an *asymmetric* join drops it, and by that intersection rather
-      # than by reaching `with_local`. The normative statement — establishment, drop, join and the full list of
+      # A branch join keeps the mark when both arms stamp it: `if c then r = @count else r = @count end` stamps
+      # `(:local, :r)` on each arm, and `join_declaration_sourced` INTERSECTS, so the mark survives. Only an
+      # *asymmetric* join drops it, by that intersection rather than by reaching `with_local`. The normative
+      # statement — establishment, drop, join and the full list of
       # unmarked shapes, each verified against the implementation — is
       # `docs/internal-spec/inference-engine.md` § "Declaration-sourced provenance mark (ADR-58)"; keep this
       # comment subordinate to it.

data/lib/rigor/analysis/check_rules/duplicate_hash_key_collector.rb

@@ -36,8 +36,8 @@ module Rigor
         # a Hash literal, loops and blocks included.
         NODE_CLASSES = [Prism::HashNode, Prism::KeywordHashNode].freeze
 
-        # Returns `Array<{hash_node:, key_node:, first_key_node:, key_label:}>` — one entry per LATER
-        # occurrence of a repeated literal key (`key_node` is the repeat the diagnostic points at;
+        # One entry per LATER occurrence of a repeated literal key, carrying `hash_node`, `key_node`,
+        # `first_key_node` and `key_label` (`key_node` is the repeat the diagnostic points at;
         # `first_key_node` is the earliest occurrence its message references). Empty when the tree has no
         # qualifying duplicates.
         def initialize(scope_index)

data/lib/rigor/analysis/check_rules/inferred_param_guard.rb

@@ -21,6 +21,21 @@ module Rigor
       # - the direct receiver / subject: `param.foo`, `case param`
       # - an indexed element: `param[i] - x` (the `-` receiver is the `[]` call whose root is `param`)
       # - any method chain: `param.foo.bar`, `param.foo(arg).baz`, `param.key?(:x)`
+      # - an array or hash literal holding the parameter (issue #2189): `[param].first.upcase`,
+      #   `{a: param}[:a].upcase`. The engine reads such an element back precisely, so the read is the
+      #   parameter's lower bound again; any other call on the literal declines too, the FP-safe direction.
+      # - an instance variable the same method wrote from such a value (issue #2189): `@x = param; @x.upcase`.
+      #   This one IS a scope mark — {Inference::StatementEvaluator#eval_ivar_write} stamps `:inferred_param`
+      #   under the ivar's `@`-prefixed name, which no local can spell — because the write and the read are
+      #   separate statements. The mark is method-local: the class-ivar census that seeds a sibling method's
+      #   ivars types the write's RHS without the inference seed, so a cross-method read is not a lower bound.
+      # - `Array(param)` (issue #2280): the conversion passes the parameter's elements through, so
+      #   `Array(param).first.upcase` reads the lower bound back.
+      # - an `if` / `unless` / ternary whose value is the parameter (issue #2280): `(c ? param : param).upcase`.
+      #   Unlike `&&` / `||`, a branch that does not hold the parameter keeps its diagnostic: the form is rooted
+      #   when every branch that can run is. A predicate the engine folds to one arm (the same certainty
+      #   `StatementEvaluator#eval_if` elides the dead arm on) leaves only that arm to decide, so
+      #   `(c ? param : 1).upcase` declines when `c` folds truthy and reports `Integer` when it folds falsey.
       #
       # Every value derived from an inferred parameter by dispatch is itself a lower bound, so firing against it
       # is an FP by the same construction. No-op on a normal `check` run — `Scope#inferred_param?` is false
@@ -32,27 +47,105 @@ module Rigor
         # length, which is tiny in practice).
         MAX_DEPTH = 64
 
-        def rooted?(node, scope, depth = 0)
+        # `fold` is whether `scope` is still the scope the walked node is evaluated in. The callers pass the scope
+        # at the start of the expression; once the walk passes something evaluated earlier inside it (a leading
+        # statement, the left operand of `&&`, an earlier literal element, a conditional's predicate), that
+        # earlier code may have rebound what a nested predicate reads (`(c = false; c ? param : 1)`), so a
+        # conditional below no longer folds its predicate in `scope`.
+        def rooted?(node, scope, depth = 0, fold: true)
           return false if node.nil? || depth > MAX_DEPTH
 
           case node
-          when Prism::LocalVariableReadNode then scope.inferred_param?(node.name)
-          when Prism::CallNode then rooted?(node.receiver, scope, depth + 1)
-          # Value-combining forms: the produced value is a union of the operands, so it is a lower bound when
-          # ANY operand is inferred-parameter-rooted (`cps[i] - x rescue -1`, `a && param.foo`, `param || b`).
-          # Declining on the whole expression is FP-safe by the same lower-bound argument.
+          when Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode then scope.inferred_param?(node.name)
+          when Prism::CallNode then call_rooted?(node, scope, depth + 1, fold)
+          when Prism::ArrayNode, Prism::HashNode, Prism::KeywordHashNode, Prism::AssocNode
+            literal_rooted?(node, scope, depth + 1, fold)
+          else combining_rooted?(node, scope, depth + 1, fold)
+          end
+        end
+
+        def call_rooted?(node, scope, depth, fold)
+          return rooted?(node.receiver, scope, depth, fold: fold) unless array_conversion?(node, scope)
+
+          rooted?(node.arguments.arguments.first, scope, depth, fold: fold)
+        end
+
+        # A receiverless `Array(x)` reaching Kernel#Array: exactly one plain argument, no block, and no project
+        # `Array` on `self`'s class or its project ancestors to bind ahead of Kernel's.
+        def array_conversion?(node, scope)
+          node.receiver.nil? && node.name == :Array && node.block.nil? &&
+            node.arguments&.arguments&.size == 1 && !project_array_method?(scope)
+        end
+
+        def project_array_method?(scope)
+          self_type = scope.self_type
+          case self_type
+          when Type::Nominal then scope.discovered_method_through_ancestors?(self_type.class_name, :Array, :instance)
+          when Type::Singleton
+            scope.discovered_method_through_ancestors?(self_type.class_name, :Array, :singleton)
+          else false
+          end
+        end
+
+        # An array or hash literal is rooted when any element is: the engine reads the element back precisely.
+        def literal_rooted?(node, scope, depth, fold)
+          parts = node.is_a?(Prism::AssocNode) ? [node.key, node.value] : node.elements
+          parts.each_with_index.any? { |part, index| rooted?(part, scope, depth, fold: fold && index.zero?) }
+        end
+
+        # Value-combining forms: the produced value is a union of the operands, so it is a lower bound when ANY
+        # operand is inferred-parameter-rooted (`cps[i] - x rescue -1`, `a && param.foo`, `param || b`). Declining
+        # on the whole expression is FP-safe by the same lower-bound argument.
+        def combining_rooted?(node, scope, depth, fold)
+          case node
           when Prism::RescueModifierNode
-            rooted?(node.expression, scope, depth + 1) || rooted?(node.rescue_expression, scope, depth + 1)
+            rooted?(node.expression, scope, depth, fold: fold) ||
+              rooted?(node.rescue_expression, scope, depth, fold: false)
           when Prism::AndNode, Prism::OrNode
-            rooted?(node.left, scope, depth + 1) || rooted?(node.right, scope, depth + 1)
-          when Prism::ParenthesesNode then rooted?(last_statement(node.body), scope, depth + 1)
-          when Prism::StatementsNode then rooted?(node.body.last, scope, depth + 1)
+            rooted?(node.left, scope, depth, fold: fold) || rooted?(node.right, scope, depth, fold: false)
+          when Prism::ParenthesesNode then body_rooted?(node.body, scope, depth, fold)
+          when Prism::StatementsNode then body_rooted?(node, scope, depth, fold)
+          when Prism::IfNode, Prism::UnlessNode then conditional_rooted?(node, scope, depth, fold)
+          when Prism::ElseNode then rooted?(node.statements, scope, depth, fold: fold)
           else false
           end
         end
 
-        def last_statement(body)
-          body.is_a?(Prism::StatementsNode) ? body.body.last : body
+        # A body's value is its last statement; any statement before it runs first.
+        def body_rooted?(body, scope, depth, fold)
+          return rooted?(body, scope, depth, fold: fold) unless body.is_a?(Prism::StatementsNode)
+
+          rooted?(body.body.last, scope, depth, fold: fold && body.body.size == 1)
+        end
+
+        # Every branch that can run must be rooted; an absent branch is `nil`, never rooted. The predicate is
+        # typed only when the branches disagree, so a conditional that never mentions a parameter costs nothing.
+        # An arm runs after the predicate, so a conditional nested in one never folds.
+        def conditional_rooted?(node, scope, depth, fold)
+          truthy_rooted, falsey_rooted = arms(node).map { |arm| rooted?(arm, scope, depth, fold: false) }
+          return truthy_rooted if truthy_rooted == falsey_rooted
+          return false unless fold
+
+          case predicate_certainty(node.predicate, scope)
+          when :truthy then truthy_rooted
+          when :falsey then falsey_rooted
+          else false
+          end
+        end
+
+        # `[runs when the predicate is truthy, runs when it is falsey]`.
+        def arms(node)
+          node.is_a?(Prism::IfNode) ? [node.statements, node.subsequent] : [node.else_clause, node.statements]
+        end
+
+        # The arm certainty `StatementEvaluator#branch_certainty` elides on: a decidable version guard, else the
+        # predicate's folded truthiness unless an optimistic carrier props it up.
+        def predicate_certainty(predicate, scope)
+          guard = Inference::VersionGuard.verdict(predicate)
+          return guard if guard
+          return nil unless Inference::OptimisticOrigin.resolve(predicate, scope).nil?
+
+          Inference::Narrowing.predicate_certainty(scope.type_of(predicate))
         end
       end
     end

data/lib/rigor/analysis/check_rules/ivar_write_collector.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "rule_walk"
+require_relative "../../scope/resolution_chain"
 require_relative "../../source/constant_path"
 require_relative "../../source/node_children"
 
@@ -37,36 +38,55 @@ module Rigor
         # `def` that sits directly in a class / module body, never one nested in another `def`. On the
         # shared full DFS that prune becomes the `:inside_def` gate; the enclosing class / module name stack
         # the legacy walk threaded as `qualified_prefix` is now `context.qualified_prefix`.
-        NODE_CLASSES = [Prism::DefNode].freeze
+        #
+        # ADR-125 — the walk also visits class-body `CallNode`s (a `def` body is gated off), to record the
+        # macro calls whose literal arguments name a method (`before_action :load_roles`).
+        NODE_CLASSES = [Prism::DefNode, Prism::CallNode].freeze
         RULE_WALK_GATES = %i[inside_def detached_ivar_facet].freeze
 
-        # Returns `Hash[class_name (String) => Hash[ivar_name (Symbol) => Array<{node:, type:, declared:}>]]`.
-        # Empty when the tree has no qualifying writes. `declared` is the translated type of the class's RBS
-        # declaration of the ivar — an `@x: T` member or the slot an `attr_*` member implies, own or
-        # inherited — and nil when the RBS declares none.
+        # Groups the writes by class qualified name, then by ivar name. Each write carries `node`, `type`,
+        # `declared`, `method_name`, `visibility`, `per_invocation` and `action`. Empty when the tree has no
+        # qualifying writes.
+        # `declared` is the translated type of the class's RBS declaration of the ivar — an `@x: T` member or
+        # the slot an `attr_*` member implies, own or inherited — and nil when the RBS declares none.
+        #
+        # ADR-125 — `method_name` is the enclosing `def`'s name and `visibility` its instance visibility
+        # (`:public` / `:protected` / `:private`, or nil when the discovery table has no settled answer).
+        # `per_invocation` is whether the class is, or descends from, a class a loaded plugin declares in
+        # `per_invocation_classes:`. `action` is whether the enclosing method is one of that class's entry
+        # points: public, and named by none of the declaring plugin's `per_invocation_non_action_macros:` in a
+        # class body of this file (`before_action :load_roles`, `helper_method :current_roles`).
         def initialize(scope_index)
           @scope_index = scope_index
           @accumulator = {}
+          @per_invocation = {}
+          @macro_arguments = {}
         end
 
         # Legacy single-collector walk — kept as the oracle the ADR-53 Track B equivalence harness compares
         # {RuleWalk} against; deleted when Track B completes.
         def collect(root)
           walk(root, [])
-          @accumulator.transform_values(&:freeze).freeze
+          results
         end
 
         # {RuleWalk} entry point: the legacy walk's per-`def` logic, invoked at each class-/module-body `def`
         # under the shared traversal contract. `collect_def_writes`' verbatim body reads the enclosing class
         # prefix from `context.qualified_prefix`.
-        def visit(def_node, context)
-          collect_def_writes(def_node, context.qualified_prefix)
+        def visit(node, context)
+          if node.is_a?(Prism::CallNode)
+            record_macro_call(node, context.qualified_prefix)
+          else
+            collect_def_writes(node, context.qualified_prefix)
+          end
         end
 
         # The accumulated result, frozen the same way `#collect` returns it — used by {RuleWalk}-driven
         # callers after the walk completes.
         def results
-          @accumulator.transform_values(&:freeze).freeze
+          @accumulator.to_h do |class_name, writes_by_ivar|
+            [class_name, writes_by_ivar.transform_values { |writes| with_actions(class_name, writes) }.freeze]
+          end.freeze
         end
 
         private
@@ -87,29 +107,71 @@ module Rigor
           when Prism::DefNode
             collect_def_writes(node, qualified_prefix)
             return
+          when Prism::CallNode
+            record_macro_call(node, qualified_prefix)
           end
 
           node.rigor_each_child { |child| walk(child, qualified_prefix) }
         end
 
+        # A receiverless (or `self.`) call in a class body, with the method names its literal Symbol / String
+        # arguments spell. Kept for every such call: which macro names count is the registry's answer, read
+        # once per class when the writes are finalised.
+        def record_macro_call(call_node, qualified_prefix)
+          return if qualified_prefix.empty?
+          return unless call_node.receiver.nil? || call_node.receiver.is_a?(Prism::SelfNode)
+
+          names = (call_node.arguments&.arguments || []).filter_map { |argument| literal_method_name(argument) }
+          return if names.empty?
+
+          ((@macro_arguments[qualified_prefix.join("::")] ||= {})[call_node.name] ||= []).concat(names)
+        end
+
+        # A Symbol / String literal's name, or the name of a `def` passed inline (`helper_method def
+        # current_user … end`). A literal with bytes no Symbol can hold (`before_action "\xff"`, #1821) names no
+        # method, so it answers nil.
+        def literal_method_name(argument)
+          return argument.name if argument.is_a?(Prism::DefNode) && argument.receiver.nil?
+          return nil unless argument.is_a?(Prism::SymbolNode) || argument.is_a?(Prism::StringNode)
+
+          text = argument.unescaped
+          text.valid_encoding? ? text.to_sym : nil
+        end
+
+        # Each write with `action` set (see {#initialize}). A frozen copy, so `#results` stays repeatable.
+        def with_actions(class_name, writes)
+          macros = @per_invocation[class_name]
+          excluded = macros ? non_action_names(class_name, macros) : nil
+          writes.map do |write|
+            action = !excluded.nil? && write[:visibility] == :public && !excluded.include?(write[:method_name])
+            write.merge(action: action).freeze
+          end.freeze
+        end
+
+        def non_action_names(class_name, macros)
+          (@macro_arguments[class_name] || {}).each_with_object(Set.new) do |(macro, names), set|
+            set.merge(names) if macros.include?(macro)
+          end
+        end
+
         def collect_def_writes(def_node, qualified_prefix)
           return if def_node.body.nil? || qualified_prefix.empty?
           return if def_node.receiver.is_a?(Prism::SelfNode)
 
           class_name = qualified_prefix.join("::")
-          gather_writes(def_node.body, class_name)
+          gather_writes(def_node.body, class_name, def_node.name)
         end
 
-        def gather_writes(node, class_name)
+        def gather_writes(node, class_name, method_name)
           return unless node.is_a?(Prism::Node)
 
-          record_write(node, class_name) if node.is_a?(Prism::InstanceVariableWriteNode)
+          record_write(node, class_name, method_name) if node.is_a?(Prism::InstanceVariableWriteNode)
           return if BARRIER_NODES.any? { |klass| node.is_a?(klass) }
 
-          node.rigor_each_child { |child| gather_writes(child, class_name) }
+          node.rigor_each_child { |child| gather_writes(child, class_name, method_name) }
         end
 
-        def record_write(node, class_name)
+        def record_write(node, class_name, method_name)
           scope = @scope_index[node]
           return if scope.nil?
 
@@ -117,7 +179,73 @@ module Rigor
           declared = declared_ivar(scope, class_name, node.name)
           @accumulator[class_name] ||= {}
           @accumulator[class_name][node.name] ||= []
-          @accumulator[class_name][node.name] << { node: node, type: rvalue_type, declared: declared }
+          @accumulator[class_name][node.name] << {
+            node: node, type: rvalue_type, declared: declared, method_name: method_name,
+            visibility: method_visibility(scope, class_name, method_name),
+            per_invocation: !per_invocation_macros(scope, class_name).nil?
+          }
+        end
+
+        # The enclosing `def`'s instance visibility, or nil when it is not a settled fact: a slot the
+        # discovery table does not hold, or one a later `define_method` / alias / unplaceable write contests
+        # (#2013). `initialize` and the other lifecycle hooks are private whatever the table says.
+        def method_visibility(scope, class_name, method_name)
+          return :private if CheckRules::IMPLICITLY_PRIVATE_METHODS.include?(method_name)
+          return nil if scope.discovery.contested?(:discovered_method_visibilities, [class_name, method_name])
+
+          scope.discovered_method_visibility(class_name, method_name)
+        end
+
+        # ADR-125 — when `class_name` is, or descends from, a class a loaded plugin declares per-invocation, the
+        # non-action macros its declaring manifests list (a Set, possibly empty); nil otherwise. Read off the
+        # class's instance {Scope::ResolutionChain}, so a project superclass chain
+        # (`UsersController < ApplicationController < ActionController::Base`) is followed as Ruby resolves it.
+        # A project entry matches by name. An external superclass matches through the first of its candidate
+        # spellings the environment knows, by name or by an RBS-known `:equal` / `:subclass` ordering. When the
+        # environment knows none of them (rigor-actionpack leaves `ActionController::Base` undeclared on
+        # purpose), a candidate that is literally a declared name matches, unless some candidate names a class
+        # the project itself declares: then the spelling may resolve there instead. An ambiguous spelling (no
+        # candidates) and a truncated chain answer nil: the carve-out only ever withholds a finding, so an
+        # unproved descent keeps the rule firing. Memoised per class.
+        def per_invocation_macros(scope, class_name)
+          return @per_invocation[class_name] if @per_invocation.key?(class_name)
+
+          @per_invocation[class_name] = matched_per_invocation_macros(scope, class_name)
+        end
+
+        def matched_per_invocation_macros(scope, class_name)
+          environment = scope.environment
+          registry = environment&.plugin_registry
+          return nil if registry.nil? || registry.per_invocation_classes.empty?
+
+          chain = Scope::ResolutionChain.for(scope, class_name, :instance, :methods)
+          return nil if chain.truncated?
+
+          declared = chain.search(scope) { |entry| matched_declarations(entry, registry, scope) }
+          declared&.each_with_object(Set.new) { |name, set| set.merge(registry.per_invocation_non_action_macros(name)) }
+        end
+
+        # The declared per-invocation names `entry` matches, or nil (so {ResolutionChain#search} moves on).
+        def matched_declarations(entry, registry, scope)
+          return (registry.per_invocation_class?(entry.name.to_s) ? [entry.name.to_s] : nil) unless entry.external?
+          return nil unless entry.superclass_edge
+
+          environment = scope.environment
+          names = entry.candidates.map { |name| name.to_s.delete_prefix("::") }
+          known = names.find { |name| environment.class_known?(name) }
+          return literal_declarations(names, registry, scope) if known.nil?
+
+          matched = registry.per_invocation_classes.select do |declared|
+            %i[equal subclass].include?(environment.class_ordering(known, declared))
+          end
+          matched.empty? ? nil : matched
+        end
+
+        def literal_declarations(names, registry, scope)
+          return nil if names.any? { |name| scope.discovered_classes.key?(name) }
+
+          matched = names.select { |name| registry.per_invocation_class?(name) }
+          matched.empty? ? nil : matched
         end
 
         def declared_ivar(scope, class_name, ivar_name)

data/lib/rigor/analysis/check_rules/lexical_method_sites.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../../inference/scope_indexer"
 require_relative "../../source/node_children"
+require_relative "rebinding_block_callees"
 
 module Rigor
   module Analysis
@@ -41,6 +42,9 @@ module Rigor
 
         def refinements = (@refinements ||= Inference::InEffectRefinements.new(@root))
 
+        # Issue #1817 — the file's block-passing calls, for `call.unresolved-toplevel`'s rebinding-callee decline.
+        def block_calls = (@block_calls ||= RebindingBlockCallees::Sites.new(@root))
+
         # Does a `def <local>.<name>` for this call's local receiver and method name — or a call that gives the
         # local's object methods Rigor does not enumerate (issue #1722) — sit in the scope the call is in?
         def singleton_local_def?(call_node)
@@ -148,7 +152,6 @@ module Rigor
           end
         end
 
-        # `o.singleton_class`.
         def singleton_class_of_local?(node)
           node.is_a?(Prism::CallNode) && node.name == :singleton_class && node.arguments.nil? &&
             node.receiver.is_a?(Prism::LocalVariableReadNode)

data/lib/rigor/analysis/check_rules/main_pass_collector.rb

@@ -12,16 +12,13 @@ module Rigor
       # decides, with NO loop / block suppression and NO threaded context — so the collector declares no
       # `RULE_WALK_GATES` and ignores the walk's `context`.
       #
-      # The per-node dispatch itself stays in `CheckRules` (the verbatim `case` from `diagnose`'s former inline
-      # walk — only the traversal moved, ADR-53 WD4) and is handed in as a callable built in the `CheckRules`
-      # module context, so its calls to the private diagnostic builders remain implicit-self. The collector
-      # only owns the traversal hook and accumulation. Unlike the fact collectors its `#results` are the
-      # accumulated {Diagnostic}s, in the same emission order the inline `NodeWalker.each` produced them (the
-      # shared walk is the same visit-before-descend DFS over `compact_child_nodes`).
+      # The per-node dispatch stays in `CheckRules` (ADR-53 WD4) and is handed in as a callable built in the
+      # `CheckRules` module context, so its calls to the private diagnostic builders remain implicit-self. The
+      # collector only owns the traversal hook and accumulation; `#results` are the accumulated {Diagnostic}s in
+      # the walk's emission order.
       class MainPassCollector
         # The node classes the main pass branches on. A plain `Prism::IfNode` covers ternaries and postfix `if`
-        # too (the legacy `when Prism::IfNode, Prism::UnlessNode` arm did the same). The three global-write
-        # classes carry issue #1367's `global.*` rules.
+        # too. The global-write classes and `MultiWriteNode` carry issue #1367's `global.*` rules.
         NODE_CLASSES = [
           Prism::CallNode, Prism::DefNode, Prism::IfNode, Prism::UnlessNode,
           Prism::GlobalVariableWriteNode, Prism::GlobalVariableOperatorWriteNode, Prism::MultiWriteNode

data/lib/rigor/analysis/check_rules/published_constant_guard.rb

@@ -19,7 +19,7 @@ module Rigor
       # branched on, whose declaration the reader's author never opened. A configuration constant read in ten
       # files would put a warning in all ten.
       #
-      # This is [ADR-58](../../../../docs/adr/58-declaration-sourced-ivar-typing.md)'s discipline applied to a
+      # This is [ADR-58](../../../../docs/adr/58-ivar-field-typing.md)'s discipline applied to a
       # different carrier: "a consumer may only ever *withhold* a firing it would otherwise make, so the mark
       # can lose precision but can never manufacture a false positive"
       # (`docs/internal-spec/inference-engine.md` § "Carrier and discipline"). The carrier is deliberately NOT

data/lib/rigor/analysis/check_rules/rbs_receiver_surface.rb

@@ -3,6 +3,7 @@
 require_relative "../../reflection"
 require_relative "../dependency_recorder"
 require_relative "../../inference/singleton_hook_decline"
+require_relative "../../inference/object_mixins"
 
 module Rigor
   module Analysis
@@ -68,6 +69,43 @@ module Rigor
           end
         end
 
+        # Issue #2094 — the singleton side's twin of {.ancestor_may_answer?}: a module the class or an RBS superclass
+        # `extend`s (in its body, as `Float.extend(Ext)`, or as `Float.singleton_class.include(Ext)`) may answer
+        # `method_name` on the class object, read as {.mixin_defines?} / {.external_may_answer?} read an instance-side
+        # mixin. Only each level's own singleton segment is read: the class's further singleton ancestors are the
+        # RBS superclasses this walk visits in turn, and `Class` / `Module` are {.singleton_hook?}'s.
+        def singleton_mixin_may_answer?(scope, class_name, method_name)
+          singleton_class_names(scope, class_name).any? do |name|
+            DependencyRecorder.read_last_segment(:class, name) if DependencyRecorder.active?
+
+            extends_answer?(scope, name, method_name, open_mixins: !OBJECT_ROOTS.include?(name))
+          end
+        end
+
+        def singleton_class_names(scope, class_name)
+          loader = scope.environment&.rbs_loader
+          pairs = loader ? loader.singleton_ancestors_for(class_name.to_s) : []
+          names = pairs.filter_map { |kind, name| name if kind == :singleton }
+          names.empty? ? [class_name.to_s] : names
+        end
+
+        def extends_answer?(scope, name, method_name, open_mixins:)
+          chain = Scope::ResolutionChain.for(scope, name, :singleton, :methods)
+          return true if chain.truncated?
+          # A mixin call the indexer could not record (`Integer.extend(m)`, `Symbol.singleton_class.send(:include,
+          # M)`) leaves the side tainted: some module the tables do not name may answer any name.
+          return true if open_mixins && chain.wildcard_mixin?
+
+          entries = chain.level_count.zero? ? chain.entries : chain.level_entries(0)
+          entries.any? do |entry|
+            if entry.external?
+              external_may_answer?(scope, entry, method_name, open_mixins)
+            else
+              entry.name != name && mixin_defines?(scope, entry, method_name, open_mixins)
+            end
+          end
+        end
+
         # Whether a project subclass of `class_name`, at any depth, defines `method_name` (through its own
         # ancestry, which reaches its project mixins) or a `method_missing`. Its parent is read as written and
         # resolved the way the class header resolves it: the first project class the spelling can denote, else the
@@ -132,19 +170,44 @@ module Rigor
           if Rigor::Reflection.rbs_class_known?(owner, scope: scope)
             scope.discovered_method?(owner, method_name, :instance)
           else
-            project_defines?(scope, owner, method_name) ||
-              (open_mixins && Inference::SingletonHookDecline.entry_hook_capable?(scope, entry))
+            project_defines?(scope, owner, method_name) || macro_names?(scope, owner, method_name) ||
+              (open_mixins && (Inference::SingletonHookDecline.entry_hook_capable?(scope, entry) ||
+                               open_extend?(scope, owner)))
           end
         end
 
+        # Issue #2094 — a class-body macro of the module names the method ({Inference::ObjectMixins.macro_named?}).
+        # Answers the named method only, so it holds on `Object`, `Kernel` and `BasicObject` too, where a module
+        # that defines the name answers.
+        def macro_names?(scope, owner, method_name)
+          Inference::ObjectMixins.macro_named?(scope, owner, method_name)
+        end
+
+        # Issue #2094 — the module `extend`s a module whose surface is open: one neither RBS nor the project declares
+        # (a gem's DSL with no signatures), or a project module {Inference::SingletonHookDecline} reads as
+        # hook-capable. Any macro the module's body calls may come from it and define any name, and its `extended`
+        # hook may too, so the module answers any name, the reading an undeclared `include` already gets. A chain cut
+        # at its budget may hold such a module past the cut.
+        def open_extend?(scope, owner)
+          chain = Scope::ResolutionChain.for(scope, owner, :singleton, :methods)
+          return true if chain.truncated?
+
+          entries = chain.level_count.zero? ? chain.entries : chain.level_entries(0)
+          entries.any? { |extended| Inference::SingletonHookDecline.entry_hook_capable?(scope, extended) }
+        end
+
         # An external the project declares (a module with no `def`, which the chain does not hold as a project entry)
-        # is known, and answers only through RBS.
+        # is known, and answers through RBS, or through what its own body's macros and `extend`s may define (issue
+        # #2094: {.macro_names?} and {.open_extend?}, asked of each candidate the project declares).
         def external_may_answer?(scope, entry, method_name, open_mixins)
           candidates = entry.candidates
           return open_mixins if candidates.empty?
           return true if candidates.any? do |candidate|
             Rigor::Reflection.instance_method_definition(candidate, method_name, scope: scope)
           end
+          return true if candidates.any? do |candidate|
+            macro_names?(scope, candidate, method_name) || (open_mixins && open_extend?(scope, candidate))
+          end
 
           open_mixins && candidates.none? { |candidate| declared?(scope, candidate) }
         end