rigortype 0.4.5 → 0.4.7

data/lib/rigor/scope.rb

@@ -3,6 +3,7 @@
 require_relative "type"
 require_relative "environment"
 require_relative "scope/discovery_index"
+require_relative "run_scoped_slots"
 require_relative "scope/resolution_chain"
 require_relative "inference/definer_resolution"
 require_relative "inference/in_effect_refinements"
@@ -13,6 +14,9 @@ require_relative "inference/flow_tracer"
 require_relative "inference/optimistic_origin"
 require_relative "inference/statement_evaluator"
 require_relative "inference/def_node_resolver"
+# Issue #2608 — read by `MutationWidening` at a remover call, which only an analysis makes; loaded with the engine
+# so the engine-free value layer that requires `MutationWidening` stays as small as it was.
+require_relative "inference/remover_narrowing"
 
 module Rigor
   # Immutable analyzer scope: holds local-variable bindings and a reference to the surrounding Environment. State
@@ -30,7 +34,7 @@ module Rigor
                 :opaque_block_self, :block_self_unknown, :singleton_class_body, :lexical_nesting,
                 :dynamic_origins, :local_origins, :ivar_origins,
                 :void_origins, :plugin_typed_calls,
-                :optimistic_origins, :optimistic_locals, :optimistic_ivars,
+                :optimistic_origins, :optimistic_locals, :optimistic_ivars, :construction_facts,
                 :repeated_or_writes, :match_frame,
                 :constant_narrowings, :guard_records, :bot_guard_classes, :declared_refinements
 
@@ -89,7 +93,7 @@ module Rigor
     def discovered_prepends = @discovery.discovered_prepends.transform_values { |names| names.uniq.freeze }.freeze
     def discovered_extends = @discovery.discovered_extends
     def discovered_class_sources = @discovery.discovered_class_sources
-    # Issue #644 — `{qualified constant name => Set[declaring file]}`; seeded only on an ADR-46 recording run.
+    # Issue #644 — `{qualified constant name => declaring files}`; seeded only on an ADR-46 recording run.
     def constant_sources = @discovery.constant_sources
     def published_constant_names = @discovery.published_constant_names
     def local_constant_names = @discovery.local_constant_names
@@ -202,9 +206,9 @@ module Rigor
     #   `:const` allowed; its entry marks presence only.
     IndexedKey = Data.define(:receiver_kind, :receiver_name, :key)
 
-    # Narrowing key for a no-arg / no-block method-call chain `receiver.method_name` (a "single-hop" chain per A1
-    # from the ROADMAP § Future cycles slice). The value of the map at this key is the narrowed type the next read
-    # of the same chain MUST observe — typically the post-`is_a?(C)` narrowing established on a predicate edge.
+    # Narrowing key for a no-arg / no-block method-call chain `receiver.method_name` (a "single-hop" chain).
+    # The value of the map at this key is the narrowed type the next read of the same chain MUST observe —
+    # typically the post-`is_a?(C)` narrowing established on a predicate edge.
     #
     # - `receiver_kind` ∈ `{:local, :ivar}` — the analyzer only tracks chains rooted at a local or instance
     #   variable today (Law-of-Demeter-style single-hop).
@@ -232,7 +236,7 @@ module Rigor
     # through flow transitions and ignored by `==` / `hash`.
     EMPTY_FOLD_SAFE = Set.new.freeze
     # ADR-82 WD1 — provenance propagation across the receiver-node lookup. `local_origins` / `ivar_origins`
-    # map a `name` (Symbol) to the {Inference::DynamicOrigin} cause of the `Dynamic` value currently bound to
+    # map a `name` to the {Inference::DynamicOrigin} cause of the `Dynamic` value currently bound to
     # it, so a downstream dispatch whose receiver is a bare `x` / `@x` read resolves to why that value is
     # dynamic (the cause was recorded on the *assignment*'s rhs node, which the receiver-read node is not).
     # Advisory metadata like {#dynamic_origins}: ignored by `==` / `hash` (never varies a flow decision) and
@@ -322,6 +326,8 @@ module Rigor
       @plugin_typed_calls.key?(node)
     end
 
+    # Every keyword past the 31st takes CRuby's allocating unspecified-keywords path when omitted with a non-literal
+    # default; see the note at {#rebuild} before adding a field.
     def initialize( # rubocop:disable Metrics/AbcSize, Metrics/MethodLength -- one keyword and assignment per field
       environment:, locals:,
       fact_store: Analysis::FactStore.empty,
@@ -348,6 +354,7 @@ module Rigor
       optimistic_origins: {}.compare_by_identity,
       optimistic_locals: EMPTY_ORIGINS,
       optimistic_ivars: EMPTY_ORIGINS,
+      construction_facts: EMPTY_ORIGINS,
       repeated_or_writes: EMPTY_REPEATED_OR_WRITES,
       match_frame: nil,
       constant_narrowings: EMPTY_CONSTANT_NARROWINGS,
@@ -381,6 +388,7 @@ module Rigor
       @optimistic_origins = optimistic_origins
       @optimistic_locals = optimistic_locals
       @optimistic_ivars = optimistic_ivars
+      @construction_facts = construction_facts
       @repeated_or_writes = repeated_or_writes
       @match_frame = match_frame
       @constant_narrowings = constant_narrowings
@@ -433,6 +441,41 @@ module Rigor
       rebuild(optimistic_ivars: @optimistic_ivars.merge(name.to_sym => mark).freeze)
     end
 
+    # Issue #2555 L3 — the construction facts a LOCAL's binding carries: what the engine knows about how the object
+    # bound to it was made, as opposed to what its type says about its contents. `:synthesised` means the engine
+    # built the object itself (a collection literal, or an `Array.new` / `Hash.new` / `Set.new` / `X[...]`
+    # constructor on the core class), so its element types are this engine's own inference and no declaration's
+    # claim: the mutation seams may re-grow such a carrier precisely, where a declared one (a parameter, an RBS
+    # return) keeps the issue #561 boundary. The table is `{ name => frozen Set[Symbol] }`, so a second fact joins
+    # an existing entry without reshaping it.
+    #
+    # Locals only. An instance variable's binding is seeded across methods from the class-ivar index, whose
+    # construction no single body witnesses, so an ivar never carries a fact. Like {#optimistic_locals} the facts
+    # are kept by {#with_mutated_local} (the binding still names the same object), dropped by {#with_local} (a
+    # source-level rebind names a new one), intersected at a merge, and reset with the locals at a method body's
+    # entry. No fact is copied by an alias write (`b = a`): the type is shared, the provenance is not tracked
+    # through a second name (issue #2335), and a local that may escape anywhere in its body is never stamped
+    # ({Inference::ConstructionEscape}). Within an entry `:synthesised` intersects at a merge and `:grown` (a store
+    # has grown the carrier since construction) unions.
+    CONSTRUCTION_FACT_SETS = Ractor.make_shareable({ synthesised: Set[:synthesised] })
+    NO_CONSTRUCTION_FACTS = Set.new.freeze
+    private_constant :CONSTRUCTION_FACT_SETS, :NO_CONSTRUCTION_FACTS
+
+    def construction_fact?(name, fact = :synthesised)
+      @construction_facts.fetch(name.to_sym, NO_CONSTRUCTION_FACTS).include?(fact)
+    end
+
+    # Records `fact` on the local `name`. Applied AFTER the {#with_local} that binds the value, which drops any
+    # fact the old binding held.
+    def with_construction_fact(name, fact)
+      key = name.to_sym
+      existing = @construction_facts[key]
+      return self if existing&.include?(fact)
+
+      facts = existing ? (existing | [fact]).freeze : (CONSTRUCTION_FACT_SETS[fact] || Set[fact].freeze)
+      rebuild(@construction_facts.merge(key => facts).freeze)
+    end
+
     # ADR-82 WD1 — the propagated origin of the `Dynamic` value currently bound to a local / instance
     # variable, or `nil` when none is tracked. Consulted by `Inference::ProtectionScanner` when a dispatch's
     # receiver is a bare `x` / `@x` read whose own node carries no origin.
@@ -487,7 +530,8 @@ module Rigor
       # longer holds (the new value may carry a method-local nil). `with_declaration_sourced_local` re-establishes
       # the mark afterward when the RHS is a pure copy of a declaration-sourced ivar read; the default is to drop
       # it.
-      rebuild(locals: new_locals, fact_store: new_fact_store,
+      rebuild(keep_marks ? @construction_facts : drop_origin(@construction_facts, name),
+              locals: new_locals, fact_store: new_fact_store,
               indexed_narrowings: new_indexed_narrowings,
               method_chain_narrowings: new_chain_narrowings,
               declaration_sourced: keep_marks ? @declaration_sourced : drop_local_declaration_marks(name),
@@ -681,9 +725,8 @@ module Rigor
 
     # Slice 7 phase 1 — instance/class/global variable bindings. `ivar(name)` / `cvar(name)` / `global(name)`
     # return the type currently bound for the named variable, or `nil` when the variable has not been written in
-    # the analyzed slice of the program. The first cut tracks bindings only within a single method body (each
-    # `def` enters with a fresh binding map), so reads in other methods of the same class fall through to
-    # `Dynamic[Top]`. Cross-method ivar/cvar inference is a follow-up slice.
+    # the analyzed slice of the program. Each `def` enters with a fresh binding map seeded from the class-level
+    # accumulators ({#class_ivars_for}, {#class_cvars_for}).
     def ivar(name)
       @ivars[name.to_sym]
     end
@@ -1186,8 +1229,8 @@ module Rigor
     end
 
     # Slice 7 phase 2 — class-level ivar accumulator. Keyed by the qualified class name (e.g. `"Rigor::Scope"`);
-    # the value is a `Hash[Symbol, Type::t]` of every ivar that appears as a write target inside any def body of
-    # that class. `StatementEvaluator#build_method_entry_scope` seeds the method body's `ivars` map from this
+    # the value maps every ivar that appears as a write target inside any def body of that class to its type.
+    # `StatementEvaluator#build_method_entry_scope` seeds the method body's `ivars` map from this
     # table so a `def get; @x; end` reads the type written in a sibling `def init; @x = 1; end`.
     #
     # `ScopeIndexer` populates the table once at index time through a separate pre-pass over the program. The map
@@ -1207,7 +1250,7 @@ module Rigor
       @discovery.class_cvars[class_name.to_s] || EMPTY_VAR_BINDINGS
     end
 
-    # Slice 7 phase 12 — in-source method discovery. Maps a qualified class name to a `Hash[Symbol, Symbol]` of
+    # Slice 7 phase 12 — in-source method discovery. Maps a qualified class name to a table of
     # `method_name => :instance | :singleton`. Populated by `ScopeIndexer` from every `Prism::DefNode` and
     # recognised `define_method` invocation inside class/module bodies. The `rigor check` undefined-method and
     # wrong-arity rules consult this map to suppress diagnostics for methods the user has defined dynamically,
@@ -1230,6 +1273,33 @@ module Rigor
       true
     end
 
+    # Issue #2555 — whether the project defines a method named `method_name` anywhere: on any class or module,
+    # instance or singleton side (the def-node tables, which hold a plain cross-file `def` on an RBS-declared class
+    # that `discovered_methods` withholds, and `discovered_methods`), or in a `refine` block. The name set is built
+    # once per discovery index. The answer depends on every file, so an incremental run records the name either way:
+    # a file that starts or stops defining it re-analyses the reader (issue #1459's `defines:` edge).
+    def project_method_name?(method_name)
+      Analysis::DependencyRecorder.read_name(:defines, method_name) if Analysis::DependencyRecorder.active?
+      table = (Thread.current[PROJECT_METHOD_NAMES_KEY] ||= ObjectSpace::WeakKeyMap.new)
+      return true if (table[@discovery] ||= collect_project_method_names).include?(method_name.to_sym)
+
+      false
+    end
+
+    def collect_project_method_names
+      names = Set.new
+      [@discovery.discovered_methods, @discovery.discovered_def_nodes, @discovery.discovered_singleton_def_nodes,
+       @discovery.discovered_refinements].each do |by_owner|
+        by_owner.each_value { |methods| methods.each_key { |method_name| names << method_name.to_sym } }
+      end
+      names.freeze
+    end
+    private :collect_project_method_names
+
+    # A run-scoped slot ({RunScopedSlots}): emptied when a run ends, so an edited project is read afresh.
+    PROJECT_METHOD_NAMES_KEY = RunScopedSlots.register(:__rigor_project_method_names)
+    private_constant :PROJECT_METHOD_NAMES_KEY
+
     def record_discovered_method(class_name, method_name)
       record_class_dependency(class_name)
       Analysis::DependencyRecorder.read_name(:defines, method_name)
@@ -1258,7 +1328,7 @@ module Rigor
       per_class && per_class[method_name]
     end
 
-    # v0.0.2 #5 — per-class table mapping `method_name (Symbol) → Prism::DefNode`. Populated by `ScopeIndexer`
+    # v0.0.2 #5 — per-class table mapping `method_name → Prism::DefNode`. Populated by `ScopeIndexer`
     # alongside `discovered_methods` for instance-side defs only (singleton-side and `define_method`-introduced
     # methods do not contribute a static body the engine can re-type). Consumed by `ExpressionTyper` to do
     # inter-procedural return-type inference when the receiver class is user-defined and has no RBS sig.
@@ -1272,6 +1342,86 @@ module Rigor
       Inference::DefNodeResolver.resolve(entry)
     end
 
+    # Issue #2515 — `[class_name, open]` for each class or module whose instance def table holds `method_name`, in
+    # table order (frozen; empty when no user def has the name). The callee floor's hand-off on a receiver it cannot
+    # type reads every def of the name, so the answer depends on the whole project's defs of that name: a recorder
+    # files the `defines:<name>` name edge, which fires when a file starts or stops defining it. `open` is true when
+    # the real receiver may not be the class the def sits on: the owner is a module (an includer's methods are
+    # called from it), or a project class names it as its superclass (a subclass may override what the def calls).
+    # A recorder files `subclass_of:<owner>` for the second.
+    def user_instance_def_owners(method_name)
+      Analysis::DependencyRecorder.read_name(:defines, method_name) if Analysis::DependencyRecorder.active?
+      name = method_name.to_sym
+      owners = nil
+      @discovery.discovered_def_nodes.each do |class_name, defs|
+        next unless defs.key?(name) && class_name != Inference::ScopeIndexer::TOP_LEVEL_DEF_KEY
+
+        (owners ||= []) << [class_name, open_to_override?(class_name)].freeze
+      end
+      owners.nil? ? EMPTY_OWNERS : owners.freeze
+    end
+
+    EMPTY_OWNERS = [].freeze
+    private_constant :EMPTY_OWNERS
+
+    # Issue #2515 — `[opaque, keys]`: whether the project holds a subclass relation the superclass table does not
+    # spell as `class X < Name`, so that no owner can be called free of an override. It holds when a class takes
+    # `Class.new(Parent)` ({DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK}), when a class's superclass expression is
+    # unreadable (`nil` in the table), or when a written superclass is not a declared class and some file assigns a
+    # constant of that name (`H2 = Helper; class Sub < H2`; the writer census {#bound_constant_names} or this file's
+    # constant table).
+    # `keys` are the frozen ADR-46 name keys a recorder files for the answer; the caller files them, since the answer
+    # is memoised per discovery.
+    def subclassing_opacity
+      keys = OPACITY_KEYS.dup
+      opaque = @discovery.discovered_parameter_envelopes.each_value.any? do |bucket|
+        bucket.key?(DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK)
+      end
+      segments = {}
+      @discovery.discovered_superclasses.each_value do |parent|
+        opaque = true if parent.nil? || alias_superclass?(parent, segments, keys)
+      end
+      [opaque ? true : false, keys.each(&:freeze).freeze].freeze
+    end
+
+    # True when `parent`, a written superclass that is no declared class, names a constant some file assigns. Files
+    # the `constant:<segment>` key for it once per segment.
+    def alias_superclass?(parent, segments, keys)
+      return false if @discovery.discovered_classes.key?(parent)
+
+      cut = parent.rindex("::")
+      segment = cut ? parent.byteslice(cut + 2, parent.bytesize - cut - 2) : parent
+      return false if segments.key?(segment)
+
+      segments[segment] = true
+      keys << "constant:#{segment}"
+      @discovery.constant_writers.key?(segment) || @discovery.in_source_constants.key?(parent)
+    end
+    private :alias_superclass?
+
+    OPACITY_KEYS = %w[subclass_of:* mark:*].freeze
+    private_constant :OPACITY_KEYS
+
+    def open_to_override?(class_name)
+      Analysis::DependencyRecorder.read_last_segment(:subclass_of, class_name) if Analysis::DependencyRecorder.active?
+      return true if @discovery.discovered_parameter_envelopes[class_name]&.key?(DiscoveryIndex::ENVELOPE_MODULE_MARK)
+
+      @discovery.discovered_superclasses.any? do |child, parent|
+        child != class_name && parent && names_class?(parent, class_name)
+      end
+    end
+    private :open_to_override?
+
+    # True when a superclass written as `written` (`Helper`, `A::Helper`, `::Helper`) may name `qualified`.
+    def names_class?(written, qualified)
+      written = written[2..] if written.start_with?("::")
+      return true if written == qualified
+      return false unless qualified.end_with?(written)
+
+      qualified.getbyte(qualified.bytesize - written.bytesize - 1) == 58
+    end
+    private :names_class?
+
     # Module-singleton call resolution (ADR-57 follow-up) — companion of {#user_def_for} for SINGLETON-side defs
     # (`def self.x`, `def Foo.x`, `class << self` bodies, and `module_function` defs). Returns the
     # `Prism::DefNode` for `class_name.method_name` invoked on the module/class constant itself, or nil. The
@@ -1317,6 +1467,147 @@ module Rigor
       Inference::DefNodeResolver.resolve(entry)
     end
 
+    # Issue #2515 — why the `<toplevel>` table's def for `method_name` may not be the method a receiverless call of that
+    # name runs, or nil when the project's own tables show nothing else that could be. The table keeps one def per name
+    # (the last writer's) and also files the defs of an anonymous `Class.new` body, so:
+    #
+    # - `:contested` — a def in a block or under a condition wrote the slot last;
+    # - `:several` — the project holds more than one ownerless definition row of the name: two top-level defs (across
+    #   files, or redefined), a def in a block or in another def, `define_method` or `alias_method` of the name;
+    # - `:main_singleton` — a `def self.name` (or a `class << self` def) at the top level defines it on `main`;
+    # - `:aliased` — an `alias` statement or `alias_method` call names it as the new name;
+    # - `:anonymous` — an anonymous class body defines it;
+    # - `:object` — `Object` itself defines it (`class Object; def name`, `define_method`) or has a module prepended,
+    #   which Ruby searches ahead of the top-level def. A module included at the top level is searched after `Object`'s
+    #   own methods, so it is no reason.
+    #
+    # A name with no row at all (a scope built without the project pre-pass) is not `:several`: the rows say nothing.
+    # The answer depends on every file, so an incremental run records the `defines:<name>` edge and the census edge of
+    # an alias either way. The two project-wide scans are built once per table, not per call.
+    def toplevel_def_ambiguity(method_name)
+      name = method_name.to_sym
+      record_toplevel_ambiguity_reads(name) if Analysis::DependencyRecorder.active?
+      key = Inference::ScopeIndexer::TOP_LEVEL_DEF_KEY
+      return :contested if @discovery.contested_discovered_def_nodes.include?([key, name])
+
+      rows = toplevel_definition_rows[name]
+      return :main_singleton if rows == MAIN_SINGLETON_ROWS
+      return :several if rows > 1
+      return :aliased if method_alias_names.include?(name)
+
+      return :anonymous if @discovery.discovered_def_nodes.any? do |class_name, defs|
+        defs.key?(name) && class_name.start_with?(Type::AnonymousClassName::PREFIX)
+      end
+
+      :object if object_answers_first?(name)
+    end
+
+    # True when `Object` defines `name` itself or has a module prepended (see {#toplevel_def_ambiguity}).
+    def object_answers_first?(name)
+      !user_def_for("Object", name).nil? || discovered_method?("Object", name, :instance) ||
+        !(@discovery.discovered_prepends["Object"] || EMPTY_PREPENDS).empty?
+    end
+    private :object_answers_first?
+
+    EMPTY_PREPENDS = [].freeze
+    private_constant :EMPTY_PREPENDS
+
+    # True for a class or module the project declares, even one with no method of its own.
+    def declared_class?(class_name) = @discovery.discovered_classes.key?(class_name.to_s)
+
+    def record_toplevel_ambiguity_reads(name)
+      Analysis::DependencyRecorder.read_name(:defines, name)
+      Analysis::DependencyRecorder.read_name(:global_census, "method_alias:#{name}")
+      Analysis::DependencyRecorder.read_last_segment(:class, "Object")
+      record_class_dependency("Object")
+    end
+    private :record_toplevel_ambiguity_reads
+
+    # Issue #2336 — whether the project gives `method_name` a body through an ownerless definition row
+    # ({#toplevel_definition_rows}): a `define_method` / `define_singleton_method` / `alias_method` call with that
+    # literal name on any receiver, a def in a block, or (with `top_level:`) a def outside every class body. The
+    # callee mutation floor reads a call no def table answers as one such body may run. The answer depends on every
+    # file, so an incremental run records the `defines:<name>` edge either way.
+    def ownerless_definition?(method_name, top_level: true)
+      Analysis::DependencyRecorder.read_name(:defines, method_name) if Analysis::DependencyRecorder.active?
+      name = method_name.to_sym
+      return true if top_level ? toplevel_definition_rows.key?(name) : deferred_definition_names.include?(name)
+
+      false
+    end
+
+    # The names of the ownerless rows that claim no side ({#ownerless_definition?} without `top_level:`): a definer
+    # call's literal name and a def in a block. Held by the table's identity, as {#toplevel_definition_rows} is.
+    def deferred_definition_names
+      ranges = @discovery.discovered_deferred_ranges
+      slots = (Thread.current[DEFERRED_NAMES_KEY] ||= [])
+      slot = slots.find { |entry| entry[0].equal?(ranges) }
+      return slot[1] if slot
+
+      names = Set.new
+      ranges.each_value do |entries|
+        entries.each { |(_start, _finish, name, kind, owner)| names << name if name && kind.nil? && owner.nil? }
+      end
+      slots.unshift([ranges, names.freeze]).slice!(2..)
+      names
+    end
+    private :deferred_definition_names
+
+    # Issue #2336 — {#module_function_def?}'s `:both` reading for a def in any file: whether `def_node`, an instance
+    # def of `owner`, is a module function by a deferred-range row over it (`module_function def x`, or a bare
+    # `module_function` before it), which the singleton def table does not mirror for the argument form.
+    def module_function_row_def?(def_node, owner)
+      start = def_node.location.start_offset
+      name = def_node.name
+      owner = owner.to_s
+      discovered_deferred_ranges.each_value.any? do |entries|
+        entries.any? do |(row_start, _finish, row_name, kind, row_owner)|
+          row_start == start && kind == :both && row_name == name && row_owner == owner
+        end
+      end
+    end
+
+    # `{ name => ownerless definition rows }` over `discovered_deferred_ranges`, {MAIN_SINGLETON_ROWS} for a name with
+    # a singleton row. Held by the table's identity (a file's merged copy and the seed), released with the run.
+    def toplevel_definition_rows
+      ranges = @discovery.discovered_deferred_ranges
+      slots = (Thread.current[TOPLEVEL_ROWS_KEY] ||= [])
+      slot = slots.find { |entry| entry[0].equal?(ranges) }
+      return slot[1] if slot
+
+      rows = Hash.new(0)
+      ranges.each_value do |entries|
+        entries.each do |(_start, _finish, name, kind, owner)|
+          next if name.nil? || !owner.nil?
+
+          rows[name] = kind == :singleton || rows[name] == MAIN_SINGLETON_ROWS ? MAIN_SINGLETON_ROWS : rows[name] + 1
+        end
+      end
+      slots.unshift([ranges, rows.freeze]).slice!(2..)
+      rows
+    end
+    private :toplevel_definition_rows
+
+    # The names an `alias` statement or `alias_method` call introduces, from the global write census; held by the
+    # census's identity as {#toplevel_definition_rows} is.
+    def method_alias_names
+      census = @discovery.discovered_global_write_census
+      slots = (Thread.current[METHOD_ALIASES_KEY] ||= [])
+      slot = slots.find { |entry| entry[0].equal?(census) }
+      return slot[1] if slot
+
+      names = census.each_with_object(Set.new) { |entry, acc| acc << entry[1] if entry[0] == :method_alias }.freeze
+      slots.unshift([census, names]).slice!(2..)
+      names
+    end
+    private :method_alias_names
+
+    MAIN_SINGLETON_ROWS = -1
+    TOPLEVEL_ROWS_KEY = RunScopedSlots.register(:__rigor_toplevel_definition_rows)
+    METHOD_ALIASES_KEY = RunScopedSlots.register(:__rigor_method_alias_names)
+    DEFERRED_NAMES_KEY = RunScopedSlots.register(:__rigor_deferred_definition_names)
+    private_constant :MAIN_SINGLETON_ROWS, :TOPLEVEL_ROWS_KEY, :METHOD_ALIASES_KEY, :DEFERRED_NAMES_KEY
+
     # Issue #316 — the CONFIDENCE-GATED companion of {#top_level_def_for}, and the only accessor the type
     # inference may bind through. {#top_level_def_for} stays unrestricted because it also serves the
     # *suppression* side (`call.unresolved-toplevel`, `call.undefined-method`): a name the project defines at
@@ -1563,7 +1854,8 @@ module Rigor
     #
     # This is EVIDENCE FOR a singleton ancestor, never against one: the walk sees only what a constant
     # argument to a receiverless `extend` (or, since #915, a receiverless `include` / `prepend` inside a
-    # `class << self` body) written inside a declaration body spells, so a runtime `Widget.extend(m)` and an
+    # `class << self` body) written inside a declaration body spells, or, since #2094, `Widget.extend(M)` and
+    # `Widget.singleton_class.include(M)` with a constant receiver, so a runtime `Widget.extend(m)` and an
     # `extend` in a file outside the analysed set are both absent from it, as is an `extend` declared only
     # in RBS — that one reaches the same consumer through `Environment#singleton_extended_modules` instead.
     # Its one consumer ({Inference::Narrowing.narrow_class}) therefore reads it
@@ -1941,8 +2233,9 @@ module Rigor
     # declaration-level fact of the whole file, which is also the granularity
     # `ScopeIndexer#append_constant_signature` moves the declaration signature at.
     #
-    # `constant_sources` is seeded only when dependency recording is on, so on every ordinary run the table
-    # is empty and this is one Hash miss; the caller additionally gates on the recorder being active.
+    # `constant_sources` is seeded when dependency recording is on and in the editor publish's discovery seed
+    # (ADR-124), where the recorder is inactive; elsewhere the table is empty and this is one Hash miss. The caller
+    # gates on the recorder being active.
     def record_constant_dependency(name)
       sites = @discovery.constant_sources[name]
       return if sites.nil?
@@ -1968,25 +2261,33 @@ module Rigor
     EMPTY_PARAMETER_ENVELOPES = {}.freeze
     private_constant :EMPTY_PARAMETER_ENVELOPES
 
-    # v0.1.2 — per-class table mapping `method_name (Symbol) → :public | :private | :protected`. Populated by
+    # v0.1.2 — per-class table mapping `method_name → :public | :private | :protected`. Populated by
     # `ScopeIndexer` for every `def` and `attr_*` member it sees inside a class body, with the visibility taken from
     # a wrapping `private def` / `private attr_reader` call, else the surrounding `private` / `protected` / `public`
     # modifier state, plus any post-hoc `private :name, ...` named-argument calls. Consumed by the
     # `def.method-visibility-mismatch` rule so explicit-non-self calls to a private method surface a diagnostic.
-    def discovered_method_visibility(class_name, method_name)
+    # `singleton: true` reads the class's singleton slot for the name (`[:singleton, name]`).
+    #
+    # Issue #2134 — every answer is an ADR-46 read of the slot, so it records `visibility:<class>#<method_name>`
+    # whichever way it answers ({Analysis::DependencyRecorder.read_visibility}). A `private :foo` can be written from
+    # a reopening or a `class_eval` block in a file the reader has no other edge to, and adding or removing it must
+    # re-check the reader.
+    def discovered_method_visibility(class_name, method_name, singleton: false)
+      Analysis::DependencyRecorder.read_visibility(class_name, method_name) if Analysis::DependencyRecorder.active?
       table = @discovery.discovered_method_visibilities[class_name.to_s]
       return nil unless table
 
-      table[method_name.to_sym]
+      table[singleton ? [:singleton, method_name.to_sym] : method_name.to_sym]
     end
 
-    # Closes the "`params[:f] ||= []; params[:f] << x`" precision gap (ROADMAP § Type-language / engine —
-    # indexed-collection narrowing through `Hash[k] ||= default`). After `receiver[key] ||= default`, the next
+    # Closes the "`params[:f] ||= []; params[:f] << x`" precision gap. After `receiver[key] ||= default`, the next
     # read at `receiver[key]` is known non-nil; recording the post-`||=` type keyed on
     # `(receiver_kind, receiver_name, literal_key)` lets the ExpressionTyper's `[]` dispatch hand back the
     # narrowed type. Receiver-rebind and `[]=`/mutator invalidation rules are documented at the call sites in
     # `Inference::StatementEvaluator`.
     def indexed_narrowing(receiver_kind, receiver_name, key)
+      return nil if @indexed_narrowings.empty?
+
       @indexed_narrowings[indexed_key(receiver_kind, receiver_name, key)]
     end
 
@@ -1998,6 +2299,8 @@ module Rigor
     end
 
     def without_indexed_narrowing(receiver_kind, receiver_name, key)
+      return self if @indexed_narrowings.empty?
+
       lookup = indexed_key(receiver_kind, receiver_name, key)
       return self unless @indexed_narrowings.key?(lookup)
 
@@ -2012,14 +2315,15 @@ module Rigor
       rebuild(indexed_narrowings: new_table)
     end
 
-    # Closes the "stable receiver method-chain narrowing" gap (ROADMAP § Future cycles / Type-language / engine —
-    # "Method-call receiver narrowing across stable receivers"; 2026-05-28 Redmine survey). After
+    # Closes the "stable receiver method-chain narrowing" gap (2026-05-28 Redmine survey). After
     # `if x.last.is_a?(Array)` the dominated body's `x.last` reads MUST observe the truthy-narrowed type; the same
     # chain reaching the falsey edge observes the negative narrowing.
     #
     # Address shape mirrors {.indexed_narrowing}: stable root variable + no-arg single-hop method name. See
     # {ChainKey} for the precise contract.
     def method_chain_narrowing(receiver_kind, receiver_name, method_name)
+      return nil if @method_chain_narrowings.empty?
+
       @method_chain_narrowings[chain_key(receiver_kind, receiver_name, method_name)]
     end
 
@@ -2031,6 +2335,8 @@ module Rigor
     end
 
     def without_method_chain_narrowing(receiver_kind, receiver_name, method_name)
+      return self if @method_chain_narrowings.empty?
+
       lookup = chain_key(receiver_kind, receiver_name, method_name)
       return self unless @method_chain_narrowings.key?(lookup)
 
@@ -2140,11 +2446,13 @@ module Rigor
 
     private
 
-    # The marks {#==} compares: ADR-58's, issue #667's and the repeated `||=` sites, and #1429's guard state.
+    # The marks {#==} compares: ADR-58's, issue #667's, the repeated `||=` sites, #2555's construction facts (they
+    # change what a mutation seam answers), and #1429's guard state.
     def same_marks?(other)
       @declaration_sourced == other.declaration_sourced &&
         @published_constant_sourced == other.published_constant_sourced &&
         @repeated_or_writes == other.repeated_or_writes &&
+        @construction_facts == other.construction_facts &&
         same_guard_state?(other)
     end
 
@@ -2153,7 +2461,15 @@ module Rigor
         @bot_guard_classes == other.bot_guard_classes
     end
 
+    # `construction_facts` is the one positional parameter. CRuby records which keywords a call left out in a bit
+    # field indexed by each keyword's position among ALL the method's keywords, required and optional
+    # (`VM_KW_SPECIFIED_BITS_MAX`, 31); a keyword past that index whose default is not a literal makes every call that
+    # omits it allocate the record instead. A 32nd keyword here did that on every scope transition, about 1% of an
+    # analysis's allocations (issue #2555). `#initialize` is already past the index: `bot_guard_classes` and
+    # `declared_refinements` take the allocating path whenever a caller omits them. The next Scope field crosses it in
+    # this method again, so it needs a positional slot or a restructuring, not a 32nd keyword.
     def rebuild(
+      construction_facts = @construction_facts,
       locals: @locals, fact_store: @fact_store, self_type: @self_type,
       ivars: @ivars, cvars: @cvars, globals: @globals,
       discovery: @discovery,
@@ -2204,7 +2520,7 @@ module Rigor
         plugin_typed_calls: plugin_typed_calls,
         optimistic_origins: optimistic_origins,
         optimistic_locals: optimistic_locals,
-        optimistic_ivars: optimistic_ivars,
+        optimistic_ivars: optimistic_ivars, construction_facts: construction_facts,
         repeated_or_writes: repeated_or_writes,
         match_frame: match_frame,
         constant_narrowings: constant_narrowings,
@@ -2214,11 +2530,18 @@ module Rigor
       )
     end
 
+    # A join with an empty side has no key in common (usually both are empty, the common case at a branch merge), so
+    # its answer is this one frozen hash rather than a fresh one.
+    EMPTY_BINDINGS = {}.freeze
+    private_constant :EMPTY_BINDINGS
+
     def join_bindings(left, right)
       # Keys present in both, unioned. Iterating `left` and probing `right.key?` yields the same keys in the same
       # order as the prior `(left.keys & right.keys)` while avoiding the two key arrays and the intersection
       # array — this is the control-flow join, run at every branch merge, and was a top allocation site (~75% of
       # `Hash#keys`).
+      return EMPTY_BINDINGS if left.empty? || right.empty?
+
       result = {}
       left.each do |name, ltype|
         next unless right.key?(name)
@@ -2297,6 +2620,8 @@ module Rigor
         optimistic_origins: @optimistic_origins,
         optimistic_locals: join_optimistic_marks(@optimistic_locals, other.optimistic_locals),
         optimistic_ivars: join_optimistic_marks(@optimistic_ivars, other.optimistic_ivars),
+        # Issue #2555 L3 — INTERSECTION: a construction fact holds after a merge only when both arms established it.
+        construction_facts: join_construction_facts(@construction_facts, other.construction_facts),
         # UNION, the published-constant mark's direction: the mark only withholds the memoizing `||=`
         # reading, so keeping a site either arm holds is the wider answer.
         repeated_or_writes: join_repeated_or_writes(other),
@@ -2394,6 +2719,31 @@ module Rigor
             .freeze
     end
 
+    # Issue #2555 L3 — a fact survives a merge only for a name both arms hold it for, and only the facts both agree
+    # on. Zero-alloc when either side is empty or both are the same table.
+    def join_construction_facts(mine, theirs)
+      return mine if mine.equal?(theirs)
+      return EMPTY_ORIGINS if mine.empty? || theirs.empty?
+
+      joined = {}
+      mine.each do |name, facts|
+        their_facts = theirs[name]
+        next if their_facts.nil?
+
+        common = facts == their_facts ? facts : join_fact_sets(facts, their_facts)
+        joined[name] = common unless common.empty?
+      end
+      joined.empty? ? EMPTY_ORIGINS : joined.freeze
+    end
+
+    # `:grown` joins by UNION among the names both arms keep: a store on either arm may reach the carrier, and the
+    # fact only ever floors it ({Inference::MutationRejoin.floors_grown_carrier?}). Every other fact intersects.
+    def join_fact_sets(facts, their_facts)
+      common = facts & their_facts
+      common << :grown if facts.include?(:grown) || their_facts.include?(:grown)
+      common.freeze
+    end
+
     # ADR-82 WD1 — rebinding drops any propagated origin for the name (the new value's provenance is set
     # afterward by `with_local_origin` when it is a `Dynamic` with a recorded cause). Zero-alloc when the name
     # carries no origin — the overwhelming common case, so this stays off the with_local hot-path budget.
@@ -2455,19 +2805,12 @@ module Rigor
     end
 
     def indexed_key(receiver_kind, receiver_name, key)
-      IndexedKey.new(
-        receiver_kind: receiver_kind.to_sym,
-        receiver_name: receiver_name.to_sym,
-        key: key
-      )
+      # Positional `new` (field-definition order) skips the keyword hash a keyword `new` allocates.
+      IndexedKey.new(receiver_kind.to_sym, receiver_name.to_sym, key)
     end
 
     def chain_key(receiver_kind, receiver_name, method_name)
-      ChainKey.new(
-        receiver_kind: receiver_kind.to_sym,
-        receiver_name: receiver_name.to_sym,
-        method_name: method_name.to_sym
-      )
+      ChainKey.new(receiver_kind.to_sym, receiver_name.to_sym, method_name.to_sym)
     end
 
     def drop_indexed_narrowings_for(receiver_kind, receiver_name)