rigortype 0.4.5 → 0.4.7

data/lib/rigor/inference/narrowing.rb

@@ -524,7 +524,7 @@ module Rigor
 
         # Issue #1429 — a global or constant subject (`case $stdout when StringIO`) narrows as a local does, and so
         # does an instance variable (#1446).
-        slot = receiver_slot(subject, scope, kinds: CASE_SUBJECT_KINDS)
+        slot = case_subject_slot(subject, scope)
         return [body_scope, scope] if slot.nil?
 
         truthy_type, falsey_type = case_when_types(scope, slot.current, conditions)
@@ -538,6 +538,32 @@ module Rigor
       CASE_SUBJECT_KINDS = %i[local ivar global constant].freeze
       private_constant :CASE_SUBJECT_KINDS
 
+      # The slot a `case` subject narrows. Issue #2211 — a subject that writes a local or instance variable
+      # (`case (x = v)`, `case x = v`) tests the value it stores, which the variable holds in every clause, so the
+      # clauses narrow the variable as they narrow a bare read of it: `case (x = s ? String(s) : nil) when String then
+      # x.upcase end` reads `x` as `String`. A single-statement `(…)` is unwrapped.
+      def case_subject_slot(subject, scope)
+        subject = unwrap_case_subject(subject)
+        case subject
+        when Prism::LocalVariableWriteNode
+          variable_slot(:local, subject.name, scope.local(subject.name), CASE_SUBJECT_KINDS)
+        when Prism::InstanceVariableWriteNode
+          variable_slot(:ivar, subject.name, scope.ivar(subject.name), CASE_SUBJECT_KINDS)
+        else receiver_slot(subject, scope, kinds: CASE_SUBJECT_KINDS)
+        end
+      end
+      private_class_method :case_subject_slot
+
+      # `subject` with each single-statement `(…)` around it removed: the node {.case_subject_slot} narrows through,
+      # which `StatementEvaluator#when_test_rebinds_subject?` reads the same way.
+      def unwrap_case_subject(subject)
+        while subject.is_a?(Prism::ParenthesesNode) && subject.body.is_a?(Prism::StatementsNode) &&
+              subject.body.body.size == 1
+          subject = subject.body.body.first
+        end
+        subject
+      end
+
       # Returns `[body_scope, falsey_scope]` for one clause of a `case` with a subject: a `when` clause narrows
       # through {.case_when_scopes}, and an `in` clause only for a bare class pattern ({.bare_class_pattern_node}),
       # which matches exactly when `subject.is_a?(C)`. Every other pattern can fail to match where a class test
@@ -582,6 +608,26 @@ module Rigor
         truthy
       end
 
+      # Issue #2443 — `scope` with what every match binds, laid over the bindings it holds, for the block of a call
+      # that yields only after it has matched in the caller's frame ({MatchRebinding::YieldingMatch}): `$~` a
+      # `MatchData`, and `$&` and the pre- and post-match a `String`. The numbered groups and `$+` keep the bindings
+      # `scope` gives them. Typing them from the call's own pattern needs the group walk
+      # ({#unconditional_capture_groups}) to read every source right, which it does not yet (#2472), and forgetting
+      # them would report a group an earlier match in the method narrowed.
+      def yielded_match_scope(scope)
+        string_t = Type::Combinator.nominal_of("String")
+        scope.with_global(:$~, Type::Combinator.nominal_of("MatchData"))
+             .with_global(:$&, string_t).with_global(:$`, string_t).with_global(:$', string_t)
+      end
+
+      # Issue #2443 — true when every member of `type` is a String (a project subclass included) or a `Dynamic` that
+      # is untyped or may hold only Strings, Symbols and nil ({#match_member_kind}). A `nil` member never runs the
+      # block, so it counts neither way.
+      def string_match_receiver?(type, scope)
+        kinds = match_member_kinds(type, scope) - [:nil]
+        !kinds.empty? && kinds.all? { |kind| %i[string string_subclass dynamic].include?(kind) }
+      end
+
       # Internal analyser. Returns `[truthy_scope, falsey_scope]` when the predicate shape is
       # recognised, or `nil` to signal "no narrowing" so the public surface can fall back to the
       # entry scope. Issue #1359 — a condition whose value is a `gets`-family reader's, the bare call
@@ -942,12 +988,22 @@ module Rigor
         end
 
         def analyse_local_read(node, scope)
-          current = scope.local(node.name)
+          local_truthiness_edges(node.name, scope)
+        end
+
+        # The falsey edge is where an optimistic lookup's miss lands (ADR-101, issue #2306): `Scope#with_local`
+        # drops the issue #286 mark as a write does, so the edge re-takes the one `scope` holds. Without it the
+        # join after `if v; …; end` with no `else` lost the mark on both arms and read `v` as nil-free, although
+        # a miss reaches that join through the implicit else. The truthy edge proves the value non-nil, so it
+        # keeps dropping the mark.
+        def local_truthiness_edges(name, scope)
+          current = scope.local(name)
           return nil if current.nil?
 
+          falsey = scope.with_local(name, narrow_falsey(current))
           [
-            scope.with_local(node.name, narrow_truthy(current)),
-            scope.with_local(node.name, narrow_falsey(current))
+            scope.with_local(name, narrow_truthy(current)),
+            OptimisticOrigin.carry_local_mark(scope, falsey, name, nil)
           ]
         end
 
@@ -961,13 +1017,7 @@ module Rigor
         # holds the just-bound value; the narrowing contract on the surrounding `if` is the
         # same.
         def analyse_local_write(node, scope)
-          current = scope.local(node.name)
-          return nil if current.nil?
-
-          [
-            scope.with_local(node.name, narrow_truthy(current)),
-            scope.with_local(node.name, narrow_falsey(current))
-          ]
+          local_truthiness_edges(node.name, scope)
         end
 
         # Truthy guard on an instance variable. Covers both the bare read — `if @ivar`, the
@@ -981,9 +1031,11 @@ module Rigor
           current = scope.ivar(node.name)
           return nil if current.nil?
 
+          # The falsey edge keeps the optimistic mark, as {#local_truthiness_edges} explains.
+          falsey = scope.with_ivar(node.name, narrow_falsey(current))
           [
             scope.with_ivar(node.name, narrow_truthy(current)),
-            scope.with_ivar(node.name, narrow_falsey(current))
+            OptimisticOrigin.carry_ivar_mark(scope, falsey, node.name, nil)
           ]
         end
 
@@ -1154,15 +1206,6 @@ module Rigor
           refinements
         end
 
-        # Recognised CallNode predicates:
-        # - `recv.nil?` (Slice 6 phase 1, no args, no block)
-        # - unary `!recv` (`name == :!`, no args, no block)
-        # - `recv.is_a?(C)` / `recv.kind_of?(C)` / `recv.instance_of?(C)` with a single
-        #   static-constant argument and no block (Slice 6 phase 2 sub-phase 1).
-        # - `local == literal` / `literal == local` and the `!=` mirror for trusted static
-        #   literals (Slice 6 phase 2 sub-phase 2).
-        # Anything else returns nil so the surrounding analyser falls through to the
-        # no-narrowing fallback.
         # Issue #1223 — `(x = e).nil?`, `(x ||= e).empty?`, `(@x = e).is_a?(C)`. A write's value is the binding
         # it leaves, and a predicate is narrowed in the scope after its receiver ran, so the call narrows the
         # variable exactly as the same call on a read of it would. Every analyser keys its receiver on a read
@@ -2440,10 +2483,10 @@ module Rigor
           narrowed == original ? :relational : :local_binding
         end
 
-        # `recv.is_a?(C)` / `recv.kind_of?(C)` / `recv.instance_of?(C)` narrowing. The receiver
-        # MUST be a `LocalVariableReadNode` (so we have a name to rebind), and the argument
+        # `recv.is_a?(C)` / `recv.kind_of?(C)` / `recv.instance_of?(C)` narrowing. The argument
         # MUST be a single static constant reference (`Foo` or `Foo::Bar`) we can resolve to a
-        # qualified class name. Anything else falls through to "no narrowing".
+        # qualified class name. The receiver is a local, a global, constant or instance variable
+        # ({#receiver_slot}) or a single-hop chain; anything else falls through to "no narrowing".
         def analyse_class_predicate(node, scope, exact:)
           return nil if node.arguments.nil?
           return nil unless node.arguments.arguments.size == 1
@@ -2512,14 +2555,13 @@ module Rigor
           class_predicate_scopes(scope, node.receiver.name, current, class_name, exact: exact)
         end
 
-        # Stable single-hop method-chain narrowing (ROADMAP § Future cycles — "Method-call
-        # receiver narrowing across stable receivers"). When the predicate's receiver is
+        # Stable single-hop method-chain narrowing. When the predicate's receiver is
         # `<local/ivar>.<method>` with no args and no block, record the truthy / falsey
         # narrowing in `Scope#method_chain_narrowings` keyed on the chain address. The
         # dominated body's identical chain reads then observe the narrowed type through
         # `ExpressionTyper#call_type_for`'s lookup.
         #
-        # Heuristic-by-design (ROADMAP § "Soundness gap"): a second call to `x.last` could in
+        # Heuristic-by-design: a second call to `x.last` could in
         # principle return a different value than the first. The chain is dropped on (1)
         # receiver variable rebind (handled inside `Scope#with_local` / `#with_ivar`), and (2)
         # any intervening call against the same root receiver (handled by
@@ -2762,10 +2804,14 @@ module Rigor
 
         # Issue #1955 — the subject on the match edge of `/re/ === x` (and of `case x when /re/`). `Regexp#===`
         # matches a String, a Symbol by its name, and an object that converts with `to_str`, and answers false for
-        # anything else. Each member narrows to its String and Symbol parts: a `String | nil` subject reads `String`, a
-        # Symbol one stays `Symbol`. The `to_str` conversion is not modelled, so a member that defines `to_str` and is
-        # neither drops out of the edge. A `Dynamic` member is left as it is, since it may be a Symbol at run time. The
-        # no-match edge keeps the entry type: a String that does not match reaches it too.
+        # anything else. A member is kept whole when its class defines `to_str` (#2002) — a String and its
+        # subclasses, a class whose signature, ancestry or project source declares it — or when no signature
+        # declares the class, and a `Dynamic` member is kept, since it may also be a Symbol at run time. Any other
+        # member narrows to its String and Symbol parts, which are only what can match: a `String | nil` subject
+        # reads `String`, a Symbol one stays `Symbol`, an Integer one drops out. An `Object`, `BasicObject` or
+        # module member narrows too (to `String | Symbol`): its instances may be anything, and reading the edge as
+        # the String it most often is keeps `s.length` on it from reporting. The no-match edge keeps the entry type:
+        # a String that does not match reaches it too.
         def regexp_case_equality_type(current, scope)
           members = current.is_a?(Type::Union) ? current.members : [current]
           Type::Combinator.union(*members.map { |member| regexp_case_equality_member(member, scope) })
@@ -2773,6 +2819,7 @@ module Rigor
 
         def regexp_case_equality_member(member, scope)
           return member if member.is_a?(Type::Dynamic)
+          return member if converts_with_to_str?(member, scope)
 
           parts = %w[String Symbol].map do |class_name|
             narrow_class(member, class_name, exact: false, environment: scope.environment, scope: scope)
@@ -2780,6 +2827,36 @@ module Rigor
           Type::Combinator.union(*parts)
         end
 
+        # True when a class `member` dispatches through declares `to_str`, or is declared by no signature
+        # ({#class_lacks_method?} answers false for it). `Object`, `BasicObject` and a module String or Symbol
+        # includes (`Kernel`, `Comparable`) are read as their String and Symbol parts instead: their instances may be
+        # anything, and the String they most often are keeps a String method on the arm from reporting. Any other
+        # module is kept whole, since a matching value may include it; so is one of those that declares `to_str`.
+        def converts_with_to_str?(member, scope)
+          targets = ProjectMethodOwnership.targets(member)
+          return false if targets.nil? || targets.empty?
+
+          targets.any? { |class_name, kind| class_converts_with_to_str?(class_name, kind, scope) }
+        end
+
+        # The modules String's or Symbol's own ancestry includes, read from the running Ruby.
+        STRING_SYMBOL_MODULES = (String.ancestors + Symbol.ancestors).grep_v(Class).filter_map(&:name).uniq.freeze
+        private_constant :STRING_SYMBOL_MODULES
+
+        def class_converts_with_to_str?(class_name, kind, scope)
+          return false if kind == :instance && OPEN_SURFACE_CLASSES.include?(class_name)
+          if kind == :instance && scope.environment.rbs_module?(class_name)
+            return module_declares_to_str?(class_name, scope) || !STRING_SYMBOL_MODULES.include?(class_name)
+          end
+
+          !class_lacks_method?(class_name, :to_str, kind, scope)
+        end
+
+        def module_declares_to_str?(module_name, scope)
+          ProjectMethodOwnership.defines?(module_name, :to_str, :instance, scope) ||
+            !ExternalAncestorResolution.method_definition(module_name, :to_str, :instance, scope: scope).nil?
+        end
+
         def unwrap_parens(node)
           while node.is_a?(Prism::ParenthesesNode) && node.body.is_a?(Prism::StatementsNode) &&
                 node.body.body.size == 1
@@ -2803,9 +2880,7 @@ module Rigor
         # - For each fact, the corresponding positional argument (matched by parameter name in
         #   the selected overload) MUST be a `Prism::LocalVariableReadNode` for narrowing to
         #   apply.
-        # - When the target is `self`, narrowing applies to the receiver — but the engine does
-        #   not yet narrow `self` itself, so `self`-targeted facts are accepted by the merger
-        #   but currently produce no scope edits.
+        # - When the target is `self`, narrowing applies to the receiver ({#apply_self_fact}).
         def analyse_rbs_extended_contribution(node, scope)
           method_def = resolve_rbs_extended_method(node, scope)
           return nil if method_def.nil?
@@ -3342,8 +3417,8 @@ module Rigor
         # extend record that is structurally incomplete: `Widget.extend(m)` at a call site and an `extend`
         # written in a file outside the analysed set are both invisible to the walk behind
         # {Scope#singleton_extends_of}, and the declaration-side record joined to it below is no more
-        # complete — RBS says nothing about a class it does not declare. A shape that turned this table into a positive
-        # `:subclass` verdict would have to be right about ABSENCE too, and it cannot be. Preserving
+        # complete — RBS says nothing about a class it does not declare. A shape that turned this table
+        # into a positive `:subclass` verdict would have to be right about ABSENCE too, and it cannot be. Preserving
         # `Singleton[C]` would also hand the arm a receiver whose singleton method table has no `clamp` on
         # it, trading the unreachable-clause false positive for an undefined-method one — the same trap
         # #657 recorded on the `Constant` carrier.
@@ -3525,7 +3600,7 @@ module Rigor
           rbs_type.is_a?(RBS::Types::Literal) && rbs_type.literal == value
         end
 
-        # The four receiver shapes with a scope binding the edges can rebind, mirroring
+        # The three receiver shapes with a scope binding the edges can rebind, mirroring
         # `apply_self_fact`. A method chain or arbitrary expression has none, so it reads nil and
         # the caller declines.
         def receiver_binding_type(receiver, scope)
@@ -3635,7 +3710,7 @@ module Rigor
 
         # Walks a call chain down to its `&.` link, collecting the suffix method names applied
         # above it (outermost first). Declines unless the chain bottoms out in a `&.` call on a
-        # direct local / ivar read — those are the two bindings a scope can rewrite — and unless
+        # direct local, instance-variable, global or constant read — the slots a scope can rewrite — and unless
         # every suffix is a bare reader or predicate, since an argument or a block could make the
         # answer depend on something other than the receiver.
         #

data/lib/rigor/inference/object_mixins.rb

@@ -123,9 +123,14 @@ module Rigor
       # all.
       def answer_for_entry(scope, entry, method_name)
         unless entry.external?
-          return source_defines?(scope, entry.name, method_name) ? [:source, entry.name] : nil
+          defines = source_defines?(scope, entry.name, method_name) || macro_named?(scope, entry.name, method_name)
+          return defines ? [:source, entry.name] : nil
         end
 
+        # Issue #2094 — a project module with no `def` is held as an external; a macro of its body may name it.
+        named = entry.candidates.find { |candidate| macro_named?(scope, candidate, method_name) }
+        return [:source, named] if named
+
         entry.candidates.each do |candidate|
           definition = Rigor::Reflection.instance_method_definition(candidate, method_name, scope: scope)
           return [private_definition?(definition) ? :private_rbs : :rbs, candidate, definition] if definition
@@ -137,6 +142,13 @@ module Rigor
       end
       private_class_method :answer_for_entry
 
+      # Issue #2094 — whether a class-body macro of `owner` was handed `method_name` as a literal
+      # (`dsl_method :xdyn`, `def_delegators :@target, :xdyn`). The indexer files every such name as an opaque
+      # envelope, since what the macro defines under it is unknown, so the module may define the name.
+      def macro_named?(scope, owner, method_name)
+        scope.parameter_envelopes_of(owner).key?([:instance, method_name.to_sym])
+      end
+
       def private_definition?(definition)
         definition.respond_to?(:accessibility) && definition.accessibility == :private
       end

data/lib/rigor/inference/optimistic_origin.rb

@@ -18,7 +18,7 @@ module Rigor
     # that happens to have been produced optimistically.
     #
     # Issue #286: the `if` / `unless` branch elision is one consumer of `Narrowing.predicate_certainty`; the
-    # other two are `flow.always-truthy-condition` and the `&&` / `||` `constant_value_polarity` gate, and the
+    # other two are `flow.always-truthy-condition` and `StatementEvaluator#right_operand_dead?`, and the
     # spec passage above binds all three. This channel is what lets a certainty judgment tell the two apart.
     #
     # Issue #313: the mark is attached to a *value* — the call node that produced it, or the local / ivar it

data/lib/rigor/inference/out_buffer_mutation.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "mutation_widening"
+require_relative "receiver_alias"
+require_relative "../type"
+
+module Rigor
+  module Inference
+    # Issue #2499 rule 3 (part of #2494) — the stdlib calls that fill a String the caller passes in. After
+    # `io.read(n, buf)`, `io.readpartial(n, buf)`, `io.sysread(n, buf)` and `io.read_nonblock(n, buf)` the buffer
+    # holds what was read, and after `StringIO.new(s)` every later write through the StringIO lands in `s`. The
+    # argument (a local, instance, class or global variable read) is widened as an in-place `replace` of it would
+    # widen it, so a `buf = +""` seed stops reading `""` after the call.
+    #
+    # A built-in catalogue keyed by method name and argument position, not a receiver-typed dispatch: a method of
+    # another class with the same name and a second positional argument loses only precision on that argument.
+    module OutBufferMutation
+      # Method name => the zero-based position of the buffer argument.
+      READERS = { read: 1, readpartial: 1, sysread: 1, read_nonblock: 1 }.freeze
+      private_constant :READERS
+
+      module_function
+
+      # `scope` with the buffer argument of `call_node` widened, or `scope` itself when the call is no such call or the
+      # argument holds no String: `Rails.cache.read(key, opts)` passes an options Hash that keeps its shape.
+      def floor(call_node, scope)
+        buffer = buffer_argument(call_node)
+        return scope if buffer.nil?
+
+        getter, = MutationWidening::ALIAS_ACCESSORS[buffer.class]
+        return scope unless string_carrier?(scope.public_send(getter, ReceiverAlias.read_name(buffer)))
+
+        MutationWidening.widen_alias_read(:replace, buffer, scope)
+      end
+
+      # A `Constant<String>` or the `String` nominal, or a union of nothing else.
+      def string_carrier?(type)
+        case type
+        when Type::Constant then type.value.is_a?(String)
+        when Type::Nominal then type.class_name == "String"
+        when Type::Union then type.members.all? { |member| string_carrier?(member) }
+        else false
+        end
+      end
+
+      def buffer_argument(call_node)
+        arguments = call_node.arguments&.arguments
+        return nil if arguments.nil?
+
+        position = READERS[call_node.name]
+        position = 0 if position.nil? && string_io_new?(call_node)
+        return nil if position.nil?
+
+        argument = arguments[position]
+        MutationWidening::ALIAS_ACCESSORS.key?(argument.class) ? argument : nil
+      end
+
+      def string_io_new?(call_node)
+        return false unless call_node.name == :new
+
+        receiver = call_node.receiver
+        case receiver
+        when Prism::ConstantReadNode then receiver.name == :StringIO
+        when Prism::ConstantPathNode then receiver.parent.nil? && receiver.name == :StringIO
+        else false
+        end
+      end
+      private_class_method :buffer_argument, :string_io_new?, :string_carrier?
+    end
+  end
+end

data/lib/rigor/inference/parameter_inference_collector.rb

@@ -95,11 +95,10 @@ module Rigor
     # may type in a later round once its own argument resolves). Unresolved call sites do not
     # contribute.
     #
-    # What it does NOT do yet (deferred — the check-wiring slice): feeding the table into the
-    # `check` walk (only `coverage --protection` consumes it today), keyword / optional / rest
-    # / block parameters, inherited-method receivers, top-level helpers, and a rigorous
-    # closed-call-site-set proof (the union is optimistic over resolved sites — acceptable
-    # because the only consumer is the protection metric, which runs no diagnostics).
+    # What it does NOT do yet: typing keyword / optional / rest / block parameters themselves,
+    # inherited-method receivers, top-level helpers, and a rigorous closed-call-site-set proof
+    # (the union is optimistic over resolved sites; the `check` walk tolerates that because an
+    # inferred parameter is only a lower bound, which the in-body rules decline on, WD6b).
     class ParameterInferenceCollector
       EMPTY = {}.freeze
 
@@ -120,7 +119,7 @@ module Rigor
       # @param files — project `.rb` paths to scan for call sites.
       # @param target_ruby — Prism parse target.
       # @param max_rounds — the WD5 fixpoint cap (1 = single-level).
-      # @return => Hash{Symbol => Rigor::Type}}] frozen.
+      # @return the inferred parameter table, frozen.
       def self.collect(files:, environment:, target_ruby: nil, max_rounds: DEFAULT_ROUNDS, workers: 0)
         new(files: files, environment: environment, target_ruby: target_ruby,
             max_rounds: max_rounds, workers: workers).collect

data/lib/rigor/inference/pre_eval_constants.rb

@@ -13,7 +13,7 @@ module Rigor
     #
     # ADR-17 slice 2 gave `pre_eval:` a project-wide **method** registry ({ProjectPatchedMethods}). A
     # constant declared in the same file stayed invisible across the file boundary: `Scope#in_source_constants`
-    # is per-file and is deliberately not part of `Runner#project_scope_seed_tables`, so only class-shaped
+    # was per-file and kept out of `Runner#project_scope_seed_tables`, so only class-shaped
     # constants (a `class` / `module` declaration, or one of the four meta-new forms `ScopeIndexer`'s
     # `record_class_new_constant_decl` promotes) ever crossed. `TIMEOUT = 30` in a listed file read as
     # `Dynamic[top]` everywhere else.

data/lib/rigor/inference/project_method_ownership.rb

@@ -2,6 +2,7 @@
 
 require_relative "../type"
 require_relative "external_ancestor_resolution"
+require_relative "../run_scoped_slots"
 
 module Rigor
   module Inference
@@ -19,7 +20,7 @@ module Rigor
       NO_TARGETS = [].freeze
       private_constant :NO_TARGETS
 
-      MEMO_KEY = :__rigor_project_method_ownership_memo__
+      MEMO_KEY = RunScopedSlots.register(:__rigor_project_method_ownership_memo__)
       private_constant :MEMO_KEY
 
       module_function
@@ -72,13 +73,15 @@ module Rigor
       # `Scope` merges each file's discovery with the project pre-pass, so the slot turns over per file, and
       # an ADR-46 dependency the first lookup recorded belongs to the file every later hit serves. Pool
       # workers are separate processes, and a Ractor has its own `Thread.current`. The `:ancestry` bucket
-      # belongs to {ClosureEscapeAnalyzer}'s ancestry step.
+      # belongs to {ClosureEscapeAnalyzer}'s ancestry step. The `:block_runs` bucket belongs to
+      # {BlockRunCount}.
       def memo(scope)
         discovery = scope.discovery
         environment = scope.environment
         slot = Thread.current[MEMO_KEY]
         unless slot && slot[0].equal?(discovery) && slot[1].equal?(environment)
-          slot = [discovery, environment, { instance: {}, singleton: {}, ancestry: {} }]
+          buckets = { instance: {}, singleton: {}, ancestry: {}, block_runs: {}.compare_by_identity }
+          slot = [discovery, environment, buckets]
           Thread.current[MEMO_KEY] = slot
         end
         slot[2]

data/lib/rigor/inference/project_seed_tables.rb

@@ -39,7 +39,8 @@ module Rigor
       # `dependencies.source_inference:`), and no `discovery_seed:` base is merged in (the runner can start from one).
       NOT_SEEDED = {
         run_generation: "the identity token of a check run's return memo; these paths run no check",
-        constant_sources: "read only by dependency recording, which only an incremental check run turns on",
+        constant_sources: "read by dependency recording and the #663 pre_eval retraction; a seed carries it only " \
+                          "when asked (DiscoverySeed.tables_for_buffer(constant_sources: true), the editor publish)",
         param_inferred_types: "the parameter-inference output itself; each caller adds its own " \
                               "(DiscoverySeed.build, coverage under parameter_inference:, the collector's last round)"
       }.freeze

data/lib/rigor/inference/project_yielder.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+require_relative "block_run_count"
+
+module Rigor
+  module Inference
+    # Issue #2127 — whether a call to a PROJECT method may run the block it passes more than once, read off the
+    # callee's body. {BlockRepetition.may_repeat?} answers only for the core iterators {ClosureEscapeAnalyzer}
+    # catalogues, so `def yielder = (yield; yield)` or the idiomatic wrapper `def each = @items.each { |i| yield i }`
+    # counted as running the block once, and a `return` in the block that only a later run reaches (`each { return
+    # false if (seen += 1) > 3 }`) never joined the method's return type.
+    #
+    # Only the later-run `return` pass asks {.may_run_block_repeatedly?}
+    # (`StatementEvaluator#collect_repeated_block_returns`); the block's entry scopes and the ADR-56 write-back keep
+    # {BlockRepetition}'s rule. That pass only widens the method's return type, so the rule here errs toward
+    # "repeats". The expression-position block-value pass asks {.block_value_may_repeat?} instead, whose rule
+    # ({BlockRunCount}) errs the other way. The callee repeats when its body, outside a nested `def` (a `yield` in a
+    # class body is a syntax error inside a method):
+    #
+    # - holds two or more sites that run the block (`yield`, or `call` / `yield` / `===` / `[]` on the `&blk`
+    #   parameter), or one inside a loop, a block or a lambda, which may run it many times; or
+    # - hands the block on (`each(&blk)`, `each(&)`, `...` forwarding) or reads the `&blk` parameter any other way
+    #   (stores it, passes it as an argument), so code the walk does not see may run it any number of times.
+    #
+    # A callee the analysis cannot resolve to a project `def` (an unknown receiver, a method defined by
+    # metaprogramming) answers false, as before.
+    module ProjectYielder
+      module_function
+
+      BLOCK_RUN_CALLS = Set[:call, :yield, :===, :[]].freeze
+      REPEATING_NODES = Set[Prism::WhileNode, Prism::UntilNode, Prism::ForNode, Prism::BlockNode,
+                            Prism::LambdaNode].freeze
+      private_constant :BLOCK_RUN_CALLS, :REPEATING_NODES
+
+      def may_run_block_repeatedly?(call_node, receiver_type, scope)
+        def_node = callee_def(call_node, receiver_type, scope)
+        return false unless def_node.is_a?(Prism::DefNode) && def_node.body
+
+        repeats?(def_node)
+      rescue StandardError
+        false
+      end
+
+      # Issues #2301 and #2303 — whether the callee may run the block more than once on one path, for the
+      # expression-position block-value pass ({BlockRunCount}). Answers false where the callee does not resolve.
+      def block_value_may_repeat?(call_node, receiver_type, scope)
+        def_node = callee_def(call_node, receiver_type, scope)
+        return false unless def_node.is_a?(Prism::DefNode) && def_node.body
+
+        BlockRunCount.may_repeat?(def_node, scope)
+      rescue StandardError
+        false
+      end
+
+      # The `def` an instance call on a project class, a singleton call on one, or an implicit-self call to a
+      # top-level method resolves to.
+      def callee_def(call_node, receiver_type, scope)
+        name = call_node.name
+        found =
+          case receiver_type
+          when Type::Nominal then scope.user_def_through_ancestors(receiver_type.class_name, name).first
+          when Type::Singleton then scope.singleton_def_for(receiver_type.class_name, name)
+          end
+        found || (call_node.receiver.nil? ? scope.top_level_def_for(name) : nil)
+      end
+
+      def repeats?(def_node)
+        block_param = def_node.parameters&.block
+        counter = { sites: 0, repeats: false }
+        walk(def_node.body, block_param&.name, false, counter)
+        counter[:repeats] || counter[:sites] >= 2
+      end
+
+      def walk(node, block_name, repeating, counter)
+        return if counter[:repeats] || node.is_a?(Prism::DefNode)
+
+        skipped = visit(node, block_name, repeating, counter)
+        inner = repeating || REPEATING_NODES.include?(node.class)
+        node.compact_child_nodes.each do |child|
+          walk(child, block_name, inner, counter) unless child.equal?(skipped)
+        end
+      end
+
+      # Counts `node` and answers the child the walk must not visit: the `blk` receiver of a `blk.call`, which is a
+      # run, not a hand-off.
+      def visit(node, block_name, repeating, counter)
+        case node
+        when Prism::YieldNode then run_site(repeating, counter)
+        when Prism::ForwardingArgumentsNode then counter[:repeats] = true
+        when Prism::BlockArgumentNode then counter[:repeats] = true if forwards_block?(node, block_name)
+        when Prism::CallNode
+          return unless block_run_call?(node, block_name)
+
+          run_site(repeating, counter)
+          node.receiver
+        when Prism::LocalVariableReadNode then counter[:repeats] = true if block_name && node.name == block_name
+        end
+      end
+
+      def run_site(repeating, counter)
+        counter[:sites] += 1
+        counter[:repeats] = true if repeating
+      end
+
+      # `blk.call` and its spellings.
+      def block_run_call?(node, block_name)
+        receiver = node.receiver
+        !block_name.nil? && receiver.is_a?(Prism::LocalVariableReadNode) && receiver.name == block_name &&
+          BLOCK_RUN_CALLS.include?(node.name)
+      end
+
+      # `&blk` or an anonymous `&` handed to another call.
+      def forwards_block?(node, block_name)
+        expression = node.expression
+        expression.nil? || (expression.is_a?(Prism::LocalVariableReadNode) && expression.name == block_name)
+      end
+    end
+  end
+end

data/lib/rigor/inference/receiver_alias.rb

@@ -85,6 +85,26 @@ module Rigor
         candidates(first, depth + 1) + candidates(second, depth + 1)
       end
 
+      # Calls whose result hands its caller the receiver's own element objects (issue #2287): `h.values` the hash's
+      # values, `a.dup` / `a.clone` a shallow copy sharing them, and the blockless enumerator spellings (`a.each`,
+      # `a.map`, `a.each_with_index`, `e.with_index`) the elements themselves.
+      ELEMENT_EXPOSING_CALLS = %i[values dup clone each map each_with_index with_index].to_set.freeze
+      private_constant :ELEMENT_EXPOSING_CALLS
+
+      # The variables whose elements a loop over `receiver` is handed: {.candidates} of `receiver` once every
+      # blockless {ELEMENT_EXPOSING_CALLS} call is peeled off, so `h.values.each { |v| v << 2 }` and
+      # `a.each_with_index.map { |x, i| x << i }` name `h` and `a`. Only a loop's element widening reads it; an
+      # in-place mutation OF such a result (`h.values << 1`, `a.dup << 1`) changes a new object, not the variable.
+      def element_sources(receiver)
+        depth = 0
+        while receiver.is_a?(Prism::CallNode) && receiver.block.nil? && ELEMENT_EXPOSING_CALLS.include?(receiver.name)
+          return [] if (depth += 1) > WALK_DEPTH_CAP
+
+          receiver = receiver.receiver
+        end
+        candidates(receiver)
+      end
+
       # The variable reads an in-place mutation of `receiver` changes: {.candidates}' locals and instance
       # variables, or the class variable or global the receiver reads or writes directly, parenthesised or not
       # (`(@@c ||= []) << x` mutates `@@c`, as `(buf ||= []) << x` mutates `buf`). A class variable or global counts

data/lib/rigor/inference/refined_dispatch/constructed_class.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../../run_scoped_slots"
+
 module Rigor
   module Inference
     module RefinedDispatch
@@ -16,7 +18,7 @@ module Rigor
       # the name itself, and no constant write of it. Any other shape answers false, as does a class a
       # `K = Class.new(...)` write names.
       module ConstructedClass
-        MEMO_KEY = :__rigor_constructed_class__
+        MEMO_KEY = RunScopedSlots.register(:__rigor_constructed_class__)
         EMPTY = [].freeze
         private_constant :MEMO_KEY, :EMPTY
 

data/lib/rigor/inference/refined_dispatch/own_method.rb

@@ -2,6 +2,7 @@
 
 require_relative "../builtins/cruby_definers"
 require_relative "constructed_class"
+require_relative "../../run_scoped_slots"
 
 module Rigor
   module Inference
@@ -317,7 +318,7 @@ module Rigor
           all.include?(name) ? all - [name] : all
         end
 
-        SUBCLASS_MEMO_KEY = :__rigor_own_method_subclasses__
+        SUBCLASS_MEMO_KEY = RunScopedSlots.register(:__rigor_own_method_subclasses__)
         private_constant :SUBCLASS_MEMO_KEY
 
         # One thread-local slot keyed on the scope's discovery index (a frozen `Data`) and environment, the only