rigortype 0.4.5 → 0.4.7

data/lib/rigor/inference/global_writer_reach.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../analysis/dependency_recorder"
+require_relative "../source/node_children"
+require_relative "../type"
+require_relative "guard_rebinding"
+require_relative "project_method_ownership"
+
+module Rigor
+  module Inference
+    # Issue #2314 — whether running a node may reach a project method that writes a given global. Both places that
+    # end a global's binding at a call ask it: the statement walk past a statement call
+    # (`StatementEvaluator#forget_reached_globals`), and a `case` whose global subject a `when` test may rebind
+    # (`StatementEvaluator#when_test_rebinds_subject?`, issue #2211), so the two read a global alike.
+    #
+    # The writers come from {GlobalWriteCensus}: a `[:global_writer, name, method]` entry for each write of `name`
+    # inside a method body (`method` is the `def`'s name, or the literal name a `define_method` block defines), and
+    # `[:global_writer, name, nil]` for one inside a lambda or a block a call keeps to run later
+    # ({StoredBlockCall}), which any call may run. A write at the top level or in a class body runs where it is
+    # written, so no call reaches it.
+    #
+    # {.may_write?} answers true when the global has a writer and:
+    #
+    # - the node may run code other than Ruby core and the standard library ({GuardRebinding.may_rebind?}, the
+    #   question #2260 asked of a `when` test), and
+    # - some writer is anonymous, or the node's own call has a receiver no target resolves (a `Dynamic` value), or a
+    #   search by method name reaches a writer ({Search}).
+    #
+    # The search reads method names, not receivers: from the node it follows every call, by name, into every project
+    # `def` of that name on any class, transitively, and reaches a writer when it meets a call named after one. A
+    # call naming its method by a computed value (`send(name)`, `eval(code)`) reaches. A name no project `def` defines
+    # follows `method_missing`, `new` follows `initialize`, and an alias name (`alias`, `alias_method`, a
+    # `def_delegator` alias) follows the name it stands for. A nested `def` is not read, since defining a method runs
+    # nothing. Past {Search::DEF_BUDGET} bodies the search answers that it reaches. A `define_method` method that calls
+    # a writer is not followed (only its own writes count), and a method core code calls back without the program
+    # spelling it (`puts obj` runs `obj.to_s`) is read as the core method alone, as {GuardRebinding} reads it.
+    module GlobalWriterReach
+      EMPTY = Set.new.freeze
+
+      module_function
+
+      # The globals `scope` binds that some project method may write, other than one already `Dynamic[top]`. Each
+      # bound global's census key is recorded whatever the answer, so a file that starts writing one re-checks.
+      def candidates(scope)
+        table = writer_table(scope)
+        globals = scope.globals
+        globals.each_key { |name| record_writers(name) } if Analysis::DependencyRecorder.active?
+        return EMPTY if table.empty? || globals.empty?
+
+        table.each_key.select do |name|
+          type = globals[name]
+          !type.nil? && !type.is_a?(Type::Dynamic)
+        end
+      end
+
+      # True when running `node`, typed in `scope`, may reach a project method that writes `name` (see the module
+      # comment).
+      def may_write?(node, name, scope)
+        writers = writers(scope, name)
+        return false if writers.empty?
+        return false unless GuardRebinding.may_rebind?(node, scope)
+        return true if writers.include?(nil) || unresolved_call?(node, scope)
+
+        Search.new(scope, writers).reaches?(node)
+      end
+
+      # The method names that write `name` (nil for an anonymous writer). Records the census key, so a file that
+      # starts or stops writing the global re-checks the reader. A guard on the `case` site: every `when` test built so
+      # far also records the key through a statement call's {.candidates} or a callee's method edge.
+      def writers(scope, name)
+        record_writers(name) if Analysis::DependencyRecorder.active?
+        writer_table(scope)[name] || EMPTY
+      end
+
+      def record_writers(name)
+        Analysis::DependencyRecorder.read_name(:global_census, "global_writer:#{name}")
+      end
+
+      # `{ global => Set[method name or nil] }` over the project's census and the `pre_eval:` files' own.
+      def writer_table(scope) = census_tables(scope).first
+
+      # `{ alias name => Set[the method names it stands for] }`: an `alias`, an `alias_method` or a `def_delegator`
+      # with a literal alias name, from the same census.
+      def alias_table(scope) = census_tables(scope).last
+
+      # The two tables above, kept for the census objects they were built from.
+      def census_tables(scope)
+        census = scope.discovered_global_write_census
+        pre_eval = scope.environment&.project_patched_methods&.write_census
+        cached = @census_tables
+        return cached[2] if cached && cached[0].equal?(census) && cached[1].equal?(pre_eval)
+
+        tables = build_tables([census, pre_eval])
+        @census_tables = [census, pre_eval, tables.freeze]
+        tables
+      end
+
+      TABLE_KINDS = { global_writer: 0, method_alias: 1 }.freeze
+      private_constant :TABLE_KINDS
+
+      def build_tables(censuses)
+        tables = [{}, {}]
+        censuses.each do |entries|
+          entries&.each do |kind, key, value|
+            index = TABLE_KINDS[kind]
+            (tables[index][key] ||= Set.new) << value if index
+          end
+        end
+        tables.each { |table| table.each_value(&:freeze).freeze }
+      end
+
+      # True when `node` is a call whose receiver no target resolves: the method it runs may be any.
+      def unresolved_call?(node, scope)
+        return false unless node.is_a?(Prism::CallNode)
+
+        receiver = node.receiver
+        return false if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+        targets = ProjectMethodOwnership.targets(GuardRebinding::ScanScope.dispatch_type(receiver, scope))
+        targets.nil? || targets.empty?
+      rescue StandardError
+        true
+      end
+
+      # `{ method name => [[class name, kind], …] }` over the project's `def` tables, kept for the tables it was
+      # built from.
+      def def_index(scope)
+        instance = scope.discovered_def_nodes
+        singleton = scope.discovered_singleton_def_nodes
+        cached = @def_index
+        return cached[2] if cached && cached[0].equal?(instance) && cached[1].equal?(singleton)
+
+        index = {}
+        { instance: instance, singleton: singleton }.each do |kind, table|
+          table.each do |class_name, methods|
+            methods.each_key { |method_name| (index[method_name] ||= []) << [class_name, kind] }
+          end
+        end
+        @def_index = [instance, singleton, index.freeze]
+        index
+      end
+
+      # A breadth-first search by method name from a node to a writer's name.
+      class Search
+        # The most `def` bodies one search reads before it answers that it reaches.
+        DEF_BUDGET = 64
+        SEND_CALLS = %i[send __send__ public_send method public_method instance_method].to_set.freeze
+        CODE_CALLS = %i[eval instance_eval instance_exec class_eval class_exec module_eval module_exec].to_set.freeze
+
+        class Reached < StandardError
+        end
+
+        def initialize(scope, writers)
+          @scope = scope
+          @writers = writers
+          @aliases = GlobalWriterReach.alias_table(scope)
+          @recording = Analysis::DependencyRecorder.active?
+          @seen = Set.new
+          @queue = []
+          @read = 0
+        end
+
+        def reaches?(node)
+          scan(node)
+          until @queue.empty?
+            name = @queue.shift
+            definitions = definitions_of(name)
+            enqueue(:method_missing) if definitions.empty?
+            definitions.each { |definition| read_def(definition) }
+          end
+          false
+        rescue Reached
+          true
+        end
+
+        private
+
+        def read_def(definition)
+          @read += 1
+          reached! if @read > DEF_BUDGET
+          scan(definition.parameters)
+          scan(definition.body)
+        end
+
+        def definitions_of(name)
+          Analysis::DependencyRecorder.read_name(:defines, name) if Analysis::DependencyRecorder.active?
+          targets = GlobalWriterReach.def_index(@scope)[name] || []
+          targets.filter_map do |class_name, kind|
+            kind == :singleton ? @scope.singleton_def_for(class_name, name) : @scope.user_def_for(class_name, name)
+          end
+        end
+
+        def scan(node)
+          return unless node.is_a?(Prism::Node)
+          # A nested `def` defines a method; it runs nothing here, and its name is followed where it is called.
+          return if node.is_a?(Prism::DefNode)
+
+          case node
+          when Prism::CallNode then scan_call(node)
+          when Prism::BlockArgumentNode then scan_block_argument(node)
+          when Prism::ForNode then enqueue(:each)
+          end
+          implicit_names(node).each { |name| enqueue(name) }
+          node.rigor_each_child { |child| scan(child) }
+        end
+
+        def scan_call(node)
+          enqueue(node.name)
+          # `new` runs the class's `initialize`.
+          enqueue(:initialize) if node.name == :new
+          arguments = node.arguments&.arguments || []
+          if SEND_CALLS.include?(node.name)
+            name = literal_name(arguments.first)
+            name ? enqueue(name) : reached!
+          elsif CODE_CALLS.include?(node.name) && !(arguments.empty? && node.block.is_a?(Prism::BlockNode))
+            reached!
+          end
+        end
+
+        def scan_block_argument(node)
+          name = literal_name(node.expression)
+          enqueue(name) if name
+        end
+
+        # The methods an operator or compound write calls without spelling them.
+        def implicit_names(node)
+          names = []
+          names << node.binary_operator if node.respond_to?(:binary_operator)
+          names.push(node.read_name, node.write_name) if node.respond_to?(:read_name) && node.respond_to?(:write_name)
+          names
+        end
+
+        def enqueue(name)
+          return if name.nil? || @seen.include?(name)
+
+          reached! if @writers.include?(name)
+          @seen << name
+          @queue << name
+          # An alias runs the method it names.
+          Analysis::DependencyRecorder.read_name(:global_census, "method_alias:#{name}") if @recording
+          @aliases[name]&.each { |original| enqueue(original) }
+        end
+
+        def literal_name(node)
+          return unless node.is_a?(Prism::SymbolNode) || node.is_a?(Prism::StringNode)
+
+          text = node.unescaped
+          text.to_sym if text.valid_encoding?
+        end
+
+        def reached!
+          raise Reached
+        end
+      end
+      private_constant :Search
+    end
+  end
+end

data/lib/rigor/inference/hkt_body.rb

@@ -41,8 +41,7 @@ module Rigor
 
       # Reference to a formal parameter the enclosing `Definition#params` declared. The reducer
       # substitutes this node with the matching positional arg from the `App` being reduced; an
-      # unknown name raises during reduction (the parser, when it ships, MUST reject unknown names
-      # earlier).
+      # unknown name raises during reduction.
       Param = Data.define(:name) do
         def initialize(name:)
           raise ArgumentError, "name must be a Symbol, got #{name.class}" unless name.is_a?(Symbol)

data/lib/rigor/inference/hkt_body_parser.rb

@@ -43,7 +43,7 @@ module Rigor
     # `Rigor::Type::*` carrier: `nil` / `true` / `false` produce `Constant` carriers; `bool`
     # produces the `Constant<true> | Constant<false>` union; `untyped` produces
     # `Combinator.untyped` (i.e. `Dynamic[Top]`). Nominal class names produce raw `Type::Nominal`
-    # carriers (no `name_scope` resolution at this slice — the reducer trusts the name verbatim).
+    # carriers (no `name_scope` resolution; the reducer trusts the name verbatim).
     module HktBodyParser
       class ParseError < StandardError; end
 
@@ -151,10 +151,8 @@ module Rigor
         #     test        := type_expr ("<:" | "==") type_expr
         #
         # Parens delimit a conditional unambiguously — bare `(type_expr)` grouping is not
-        # supported at this slice (no use case yet). Branches can be unions; test sides are
-        # single arms (wrap in `App[my_union, ...]` if you need a union there). `in [opt1, opt2]`
-        # membership tests are programmatically supported via `HktBody::TestMembership` but the
-        # parser does not yet recognise the `in` keyword (no concrete demand yet).
+        # supported (no use case yet). Branches can be unions; test sides are single arms (wrap
+        # in `App[my_union, ...]` if you need a union there).
         def parse_conditional
           expect!(:lparen)
           test = parse_test

data/lib/rigor/inference/hkt_reducer.rb

@@ -152,8 +152,8 @@ module Rigor
       def subtype_verdict(left, right)
         return :yes if left == right
 
-        # Both Nominals with different class names AND neither carries Dynamic — `:no`
-        # (statically disjoint). For any other shape pair, `:maybe`.
+        # Two Nominals of different class names are statically disjoint (`:no`); any other shape
+        # pair is `:maybe`.
         return :no if disjoint_nominals?(left, right)
         return :no if disjoint_constants?(left, right)
 

data/lib/rigor/inference/hkt_registry.rb

@@ -9,11 +9,9 @@ module Rigor
     # annotations in shipped `.rbs` files.
     #
     # The registry stores registration metadata (arity, variance, bound) and the definition body
-    # as both a raw String and an evaluable `HktBody` node tree. `HktReducer` (Slice 2a) and
-    # `HktBodyParser` (Slice 2b) are both shipped and reduce `Type::App` instances against the
-    # definition. The carrier never needs to read from the registry because Slice 1's `Type::App`
-    # carries its `bound` directly; the registry exists at this slice solely so the parser
-    # round-trip and downstream slices have a stable target API.
+    # as both a raw String and an evaluable `HktBody` node tree. `HktReducer` and `HktBodyParser`
+    # reduce `Type::App` instances against the definition. The carrier never needs to read from the
+    # registry because `Type::App` carries its `bound` directly.
     #
     # The registry is immutable after construction. Callers that need to extend it (e.g. plugin
     # registrations layered on top of stdlib registrations) MUST build a new registry via `merge`

data/lib/rigor/inference/indexed_narrowing.rb

@@ -9,8 +9,7 @@ require_relative "unknown_store_widening"
 module Rigor
   module Inference
     # Closes the "`params[:f] ||= []; params[:f] << x`" precision gap surfaced by the Redmine
-    # 6.1.2 `Query#as_params` survey (ROADMAP § Future cycles / Type-language / engine —
-    # "Indexed-collection narrowing through `Hash[k] ||= default`").
+    # 6.1.2 `Query#as_params` survey.
     #
     # After `receiver[key] ||= default` the next read at `receiver[key]` is known non-nil, but
     # Rigor types each `Hash#[]` independently and the subsequent `<<` / `[]=` / other mutator
@@ -206,11 +205,9 @@ module Rigor
         args&.size == 1 ? stable_address(node.receiver, args.first) : nil
       end
 
-      # Companion invalidator for single-hop method-chain narrowings (ROADMAP § Future cycles —
-      # "Method-call receiver narrowing across stable receivers", B2 from the slice's design
-      # notes). Drops every `(receiver, *)` chain narrowing rooted at the call's OUTER stable
-      # receiver — matching the ROADMAP's "any intervening method call against the same
-      # receiver" criterion. A call against `x.last` (the OUTER receiver is a `CallNode`, not a
+      # Companion invalidator for single-hop method-chain narrowings. Drops every `(receiver, *)`
+      # chain narrowing rooted at the call's OUTER stable receiver, for any intervening method call
+      # against the same receiver. A call against `x.last` (the OUTER receiver is a `CallNode`, not a
       # stable root) does NOT drop narrowings keyed on `x`, so the worked-site `x.last << y`
       # pattern correctly preserves the chain narrowing for any further `x.last` read in the same
       # body. Always-safe (only forgets; never invents).

data/lib/rigor/inference/intervening_ivar_reset.rb

@@ -19,8 +19,8 @@ module Rigor
     # the calls in a condition operand, where a narrowing an earlier operand or clause made would otherwise survive
     # them: `if @x.nil? && reset!` read `@x` as `nil` in the body although `reset!` assigns it.
     module InterveningIvarReset
-      # Nodes whose body does not run where it is written, or runs on another `self`: a `def`, and a class or
-      # module body, where `@x` is the class's own instance variable.
+      # Nodes whose body does not run where it is written, or runs on another `self`: a `def`, and a class,
+      # module or `class << …` body, where `@x` is the class's own instance variable.
       NON_RUNNING_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
       # Issue #1402 — the nodes that run code the program does not show on `self`'s behalf: `yield` runs the
       # method's block, and `super` the superclass's method on `self`.
@@ -180,12 +180,17 @@ module Rigor
       # takes the mark when widened, so a `nil` only the seed brings back is not fuel for
       # `call.possible-nil-receiver` (ADR-58), as a declared one is not. A narrowing that kept `nil`
       # (`return if @tag`, `@tag.nil?`) widens unmarked, so a read the program really makes on `nil` still reports.
-      def widen(scope, mark: false)
+      # Issue #2039 — `mark: :unproven` marks as `mark: true` does only when the block answers nil (no write set is
+      # proven) and `direct_writes` (called at most once, answering a `Set`) does not name the variable: a call
+      # proven to write it, or whose callee visibly assigns it a possibly-nil value ({DirectIvarWrites}), widens it
+      # unmarked.
+      def widen(scope, mark: false, direct_writes: nil)
         seed = class_ivar_seed(scope)
         return scope if seed.nil? || seed.empty?
 
         computed = false
         writes = nil
+        direct = lazy_set(direct_writes)
         seed.reduce(scope) do |widened, (name, seed_type)|
           local_type = scope.ivar(name)
           next widened if local_type.nil? || local_type == seed_type
@@ -198,11 +203,28 @@ module Rigor
 
           joined = Type::Combinator.union(local_type, seed_type)
           widened = widened.with_ivar(name, joined)
-          marked = (mark && nil_free?(local_type)) || scope.declaration_sourced?(:ivar, name)
+          marked = widen_marks?(mark, writes, direct, name, local_type) || scope.declaration_sourced?(:ivar, name)
           marked ? widened.seed_declaration_sourced_ivar(name, joined) : widened
         end
       end
 
+      # Whether {.widen} stamps the declaration mark on `name`'s binding, narrowed to `local_type`: one whose
+      # narrowing ruled `nil` out, under `mark: true`, or under `mark: :unproven` when no write set is proven
+      # (`writes` nil) and the callee does not visibly write it (`direct`).
+      def widen_marks?(mark, writes, direct, name, local_type)
+        return false unless mark && nil_free?(local_type)
+
+        mark != :unproven || (writes.nil? && !direct.call.include?(name))
+      end
+      private_class_method :widen_marks?
+
+      # A callable answering `callable`'s `Set`, computed on the first call; an empty one when `callable` is nil.
+      def lazy_set(callable)
+        value = nil
+        -> { value ||= callable ? callable.call : Set.new }
+      end
+      private_class_method :lazy_set
+
       # Issue #1963 — `scope` past the calls `node`, a condition operand, makes: {.widen} over the names every
       # candidate call in it may write, or every name when one of them is not proven. A call's literal block may run,
       # so its calls count; a `def`, a class or module body and (unless `run_lambdas`) a lambda literal run nothing

data/lib/rigor/inference/ivar_writer_census.rb

@@ -0,0 +1,246 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    # Issue #1154 — the instance-variable writers {GlobalWriteCensus} records for the declared-parameter credit
+    # ({ScopeIndexer::DeclaredParamWrites}), which must not type an ivar a writer the class-ivar census never walks may
+    # replace. The standard is parity with a literal write: `@x = 1` in `initialize` already reads `1` in every sibling
+    # method whatever an unknown object's code does, so only the writers that literal writes would also have to answer
+    # for are recorded, and an unknown-receiver writer records nothing (as `ReflectiveIvarWrite` leaves
+    # `o.instance_variable_set` alone). Three entry kinds go into the census `Set`:
+    #
+    # - `[:ivar_set, name]` — a literal `o.instance_variable_set(:@x, v)` (or the same through a `send` that spells
+    #   it) on an explicit receiver other than `self`, and an `@x` write in the literal block of an
+    #   `o.instance_eval { … }` / `instance_exec`: code that names the ivar it writes.
+    # - `[:ivar_set_class, class_name]` — an open-world writer ({#open_world?}) with an implicit or `self` receiver
+    #   inside an instance body of the class — a `def` or a `define_method` block in its class body, in the block of a
+    #   `K = Struct.new` / `Data.define` / `Class.new` constant, or in a `K.class_eval` block (the host walk passes
+    #   that class as `owner`): it may write any ivar of the class's instances. A writer in a class body, a
+    #   `def self.` or at the top level records nothing.
+    # - `[:own_write, class_name, name]` — an `@x` write inside an instance body of the class.
+    #   {ScopeIndexer#merge_constant_literal_tables} appends the file's path, so a reader can tell whether a second
+    #   file writes the same ivar of the same class.
+    # - `[:own_write_type, class_name, name, value]` — issues #2079 / #2170: the same write with its coarse value, a
+    #   literal's as `[:lit, value]` and anything else as {DYNAMIC}, and a class-body `attr_writer` /
+    #   `attr_accessor` of the name as {DYNAMIC}. The path is appended as for `:own_write`. The class-ivar census
+    #   of a file joins another file's entries, and those of the modules and superclasses on the class's chain,
+    #   into the ivars it already holds ({ScopeIndexer::IvarContributions}).
+    class IvarWriterCensus
+      SEND_CALLS = %i[send __send__ public_send].to_set.freeze
+      # The methods a `send` reaching which is an open-world writer.
+      OPEN_WORLD_SENDS = %i[instance_variable_set instance_eval instance_exec extend
+                            define_singleton_method].to_set.freeze
+      EVAL_CALLS = %i[instance_eval instance_exec].to_set.freeze
+      # The calls on a `singleton_class` receiver that give the object methods or code the census cannot read.
+      SINGLETON_CLASS_CALLS = %i[
+        class_eval class_exec module_eval module_exec define_method include prepend extend attr attr_reader
+        attr_writer attr_accessor send public_send __send__
+      ].to_set.freeze
+      NO_ARGUMENTS = [].freeze
+      # Issue #2079 — the coarse value of a write that is not a literal.
+      DYNAMIC = :dynamic
+      # The writer declarations a class body records as a {DYNAMIC} write of each name it spells.
+      WRITER_DECLARATIONS = %i[attr_writer attr_accessor].to_set.freeze
+
+      # The call names any rule here reads, so every other call returns at one Set probe.
+      # (`define_method` is in {SINGLETON_CLASS_CALLS}.)
+      WATCHED_CALLS = (SEND_CALLS | OPEN_WORLD_SENDS | EVAL_CALLS | SINGLETON_CLASS_CALLS).freeze
+
+      def initialize(census)
+        @census = census
+        @instance_ranges = []
+        @owner_names = {}.compare_by_identity
+        @own_writes = {}
+        @typed_writes = Set.new
+      end
+
+      # Fed each node of a pre-order descent. `owner` is the class whose body the node sits in, as its qualified name
+      # or as the host walk's prefix Array (joined here only when an entry needs it), or nil where no class owns an
+      # instance (`class << self`, the top level, an opaque block).
+      def visit(node, owner)
+        case node
+        when Prism::DefNode then remember(node.location, owner) if owner && node.receiver.nil?
+        when Prism::SingletonClassNode then visit_singleton_class(node)
+        when Prism::CallNode then visit_call(node, owner) if WATCHED_CALLS.include?(node.name)
+        when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode,
+             Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableTargetNode
+          record_own_write(node) unless @instance_ranges.empty?
+        end
+      end
+
+      private
+
+      # One entry per class and ivar: a repeated write costs a Hash probe, not a location and an Array.
+      def record_own_write(node)
+        owner = instance_owner(node)
+        return if owner.nil?
+
+        record_typed_write(owner, node.name, coarse_value(node))
+        seen = (@own_writes[owner] ||= {})
+        return if seen[node.name]
+
+        seen[node.name] = true
+        @census << [:own_write, owner_name(owner), node.name].freeze
+      end
+
+      def record_typed_write(owner, name, value)
+        entry = [:own_write_type, owner_name(owner), name, value].freeze
+        @census << entry if @typed_writes.add?(entry)
+      end
+
+      # Issue #2079 — a literal's value as `[:lit, value]`; any other value, an operator write and a multiple
+      # assignment target as {DYNAMIC}.
+      def coarse_value(node)
+        value = node.value if node.respond_to?(:value) && !node.is_a?(Prism::InstanceVariableOperatorWriteNode)
+        case value
+        when Prism::NilNode then [:lit, nil].freeze
+        when Prism::TrueNode then [:lit, true].freeze
+        when Prism::FalseNode then [:lit, false].freeze
+        when Prism::IntegerNode, Prism::FloatNode then [:lit, value.value].freeze
+        when Prism::SymbolNode, Prism::StringNode then literal_text(value)
+        else DYNAMIC
+        end
+      end
+
+      def literal_text(node)
+        text = node.unescaped
+        return DYNAMIC unless text.valid_encoding?
+
+        [:lit, node.is_a?(Prism::SymbolNode) ? text.to_sym : text.dup.freeze].freeze
+      end
+
+      # Issue #2079 — `attr_writer :x` / `attr_accessor :x` in a class body writes `@x` with whatever the caller hands.
+      def record_writer_declaration(node, owner)
+        return unless owner && WRITER_DECLARATIONS.include?(node.name) && self_receiver?(node)
+        # A guard: an instance body's own `attr_writer` call raises (the method is `Module`'s), so only the class
+        # body's declares a writer.
+        return unless instance_owner(node).nil?
+
+        (node.arguments&.arguments || NO_ARGUMENTS).each do |argument|
+          name = literal_name(argument)
+          record_typed_write(owner, :"@#{name}", DYNAMIC) if name
+        end
+      end
+
+      def owner_name(owner) = owner.is_a?(Array) ? (@owner_names[owner] ||= owner.join("::")) : owner
+
+      def visit_call(node, owner)
+        record_writer_declaration(node, owner)
+        remember(node.block.location, owner) if owner && define_method_block?(node)
+        if self_receiver?(node) || own_singleton_class_call?(node)
+          return if @instance_ranges.empty? || !(own_singleton_class_call?(node) || open_world?(node))
+
+          instance = instance_owner(node)
+          record_class(instance) if instance
+        else
+          visit_foreign(node)
+        end
+      end
+
+      # `class << self` inside an instance `def` opens the instance's singleton class.
+      def visit_singleton_class(node)
+        return unless node.expression.is_a?(Prism::SelfNode) && !@instance_ranges.empty?
+
+        instance = instance_owner(node)
+        record_class(instance) if instance
+      end
+
+      def record_class(owner) = @census << [:ivar_set_class, owner_name(owner)].freeze
+
+      # The self writers whose target or code the census cannot read: a `send` with a computed method name or one
+      # naming {OPEN_WORLD_SENDS}; `instance_eval` / `instance_exec` given a block argument, and `instance_eval`
+      # given a string; `extend`; `define_singleton_method` with a body; and an `instance_variable_set` whose name no
+      # literal spells. A call in {SINGLETON_CLASS_CALLS} on the object's own `singleton_class` counts as well.
+      def open_world?(node)
+        name = node.name
+        arguments = node.arguments&.arguments || NO_ARGUMENTS
+        return open_world_send?(arguments) if SEND_CALLS.include?(name)
+        return open_world_eval?(node, arguments) if EVAL_CALLS.include?(name)
+        # #1931's census already makes every ivar of the class gradual for one in the same file; this entry covers one
+        # in a reopening in another file, which that census does not see.
+        return ivar_name(arguments.first).nil? if name == :instance_variable_set
+
+        name == :extend || (name == :define_singleton_method && (!node.block.nil? || arguments.size > 1))
+      end
+
+      def open_world_send?(arguments)
+        return false if arguments.empty?
+
+        sent = literal_name(arguments.first)
+        sent.nil? || OPEN_WORLD_SENDS.include?(sent)
+      end
+
+      def open_world_eval?(node, arguments)
+        node.block.is_a?(Prism::BlockArgumentNode) || (node.name == :instance_eval && !arguments.empty?)
+      end
+
+      # A call on another receiver: a named foreign write, or `self.singleton_class.class_eval` and its kin.
+      def visit_foreign(node)
+        arguments = node.arguments&.arguments || NO_ARGUMENTS
+        name = node.name
+        if SEND_CALLS.include?(name) && arguments.first && literal_name(arguments.first) == :instance_variable_set
+          name = :instance_variable_set
+          arguments = arguments.drop(1)
+        end
+        if name == :instance_variable_set
+          ivar = ivar_name(arguments.first)
+          @census << [:ivar_set, ivar].freeze if ivar
+        elsif EVAL_CALLS.include?(name) && node.block.is_a?(Prism::BlockNode)
+          record_block_ivar_writes(node.block)
+        end
+      end
+
+      def record_block_ivar_writes(node)
+        return unless node.is_a?(Prism::Node)
+        return if node.is_a?(Prism::DefNode) || node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode)
+
+        case node
+        when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode,
+             Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableTargetNode
+          @census << [:ivar_set, node.name].freeze
+        end
+        node.rigor_each_child { |child| record_block_ivar_writes(child) }
+      end
+
+      def define_method_block?(node)
+        node.name == :define_method && self_receiver?(node) && node.block.is_a?(Prism::BlockNode)
+      end
+
+      # An instance body (`def` or `define_method` block) and the class it belongs to. A `define_method` block's own
+      # nodes may reach the walk with no owner (the walk reads its `self` as opaque), so the class rides the range.
+      def remember(location, owner)
+        @instance_ranges << [(location.start_offset...location.end_offset), owner]
+      end
+
+      # The class of the innermost instance body covering `node` (pre-order, so the last covering range), or nil.
+      def instance_owner(node)
+        offset = node.location.start_offset
+        @instance_ranges.reverse_each { |(range, owner)| return owner if range.cover?(offset) }
+        nil
+      end
+
+      def self_receiver?(node) = node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+      # A call in {SINGLETON_CLASS_CALLS} on the object's own `singleton_class` (`singleton_class.class_eval { … }`).
+      def own_singleton_class_call?(node)
+        receiver = node.receiver
+        receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class && self_receiver?(receiver) &&
+          SINGLETON_CLASS_CALLS.include?(node.name)
+      end
+
+      def literal_name(argument)
+        return unless argument.is_a?(Prism::SymbolNode) || argument.is_a?(Prism::StringNode)
+
+        text = argument.unescaped
+        text.to_sym if text.valid_encoding?
+      end
+
+      def ivar_name(argument)
+        name = literal_name(argument)
+        name if name.to_s.start_with?("@")
+      end
+    end
+  end
+end

data/lib/rigor/inference/key_presence_guard.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../type"
 require_relative "mutation_widening"
 require_relative "key_presence_guard/scan"
+require_relative "../run_scoped_slots"
 
 module Rigor
   module Inference
@@ -58,7 +59,7 @@ module Rigor
       ).to_set.freeze
 
       STATE_KEY = :__rigor_key_presence_guard
-      CACHE_KEY = :__rigor_key_presence_guard_rewalk
+      CACHE_KEY = RunScopedSlots.register(:__rigor_key_presence_guard_rewalk)
       private_constant :STATE_KEY, :CACHE_KEY
 
       # The re-walk's state: the file's root, the end offset of each recorded guard, and the per-file scans.