rigortype 0.4.6 → 0.4.7

data/lib/rigor/inference/scope_indexer.rb

@@ -15,6 +15,7 @@ require_relative "../cache/file_digest"
 require_relative "../analysis/check_rules/published_constant_guard"
 require_relative "anonymous_meta_class"
 require_relative "def_handle"
+require_relative "definers_index"
 require_relative "fresh_frame_blocks"
 require_relative "global_write_census"
 require_relative "guard_rebinding"
@@ -45,6 +46,9 @@ require_relative "scope_indexer/certainty"
 require_relative "scope_indexer/member_layouts_collector"
 require_relative "scope_indexer/declared_ivar_types"
 require_relative "scope_indexer/declared_param_writes"
+require_relative "scope_indexer/constant_ivar_value"
+require_relative "scope_indexer/ivar_contributions"
+require_relative "scope_indexer/empty_seed"
 
 module Rigor
   module Inference
@@ -67,8 +71,8 @@ module Rigor
     # ```
     #
     # Nodes that are not part of the program subtree (e.g. synthesised virtual nodes that the caller looks up after the
-    # fact) yield the `default_scope`. The returned Hash is mutable in principle but callers MUST treat it as read-only;
-    # the indexer itself never exposes a way to update it past construction.
+    # fact) yield the seeded `default_scope`. The returned Hash is mutable in principle but callers MUST treat it as
+    # read-only; the indexer itself never exposes a way to update it past construction.
     # rubocop:disable-next Metrics/ModuleLength
     module ScopeIndexer
       # Issue #644 — the census descriptor for a constant write that publishes no value: an unfoldable or
@@ -109,13 +113,15 @@ module Rigor
       #   `Dynamic[top]`. Off for every other reader, so parameter inference
       #   and sig-gen observe the clause's plain entry.
       # @return identity-comparing
-      #   table whose default value is `default_scope`.
+      #   table whose default value is the seeded `default_scope`.
       # The no-op re-anchoring table (#722 residue 2): shared so the overwhelmingly common
       # nothing-to-re-anchor walk allocates none.
       EMPTY_RENAMES = {}.freeze
 
       # No path whose contributions are all `possible` (issue #2021), the cross-file walks' default.
       EMPTY_PATH_SET = Set.new.freeze
+      # The {IvarWriterCensus} entry kinds the project pre-pass tags with the file that records them.
+      PATH_TAGGED_KINDS = %i[own_write own_write_type].to_set.freeze
 
       # `declared_ivar_types:` — whether an RBS-declared ivar type replaces the census's join of the writes (#1406).
       # `rigor sig-gen` passes false: it proposes what the code says, and reading a declaration back would make a row
@@ -233,9 +239,9 @@ module Rigor
       end
 
       # Runs the combined methods/def-nodes descent (one walk of the file), seeds the discovered-methods existence table
-      # onto `seeded_scope` (merged UNDER the cross-file pre-pass seed `default_scope` carries), and returns `[scope,
-      # file_def_nodes, file_envelopes]` so the caller can thread the def-node and issue #992 envelope tables into
-      # {#merge_project_method_indexes} without walking the file a second time.
+      # onto `seeded_scope` (merged UNDER the cross-file pre-pass seed `default_scope` carries), and returns
+      # `[scope, [file_def_nodes, file_envelopes, file_siblings]]` so the caller can thread the def-node and issue #992
+      # envelope tables into {#merge_project_method_indexes} without walking the file a second time.
       #
       # ADR-119 WD3 — the file's `possible_discovered_methods` folds over the seed's by {#fold_possible_methods}, so a
       # name the file defines certainly is no longer possible and a name only the file's possible contribution
@@ -306,8 +312,8 @@ module Rigor
         siblings = per_file_siblings(seeded_scope.discovery.sibling_tables, file_tables[0], file_tables[2],
                                      file_singleton, file_visibilities)
         extends, methods_table, unpositioned =
-          merge_and_fold_extends(default_scope, root, def_nodes, singleton_def_nodes, seeded_scope, siblings,
-                                 mixin_unpositioned)
+          merge_and_fold_extends(default_scope, root, [def_nodes, file_tables[0]],
+                                 [singleton_def_nodes, file_singleton[0]], seeded_scope, siblings, mixin_unpositioned)
 
         seeded_scope.with_discovery(
           seeded_scope.discovery.with(
@@ -421,13 +427,23 @@ module Rigor
       # ADR-119 WD1 — the unpositioned union (the seed's, the mixin walks' and this file's extend side) is settled
       # first, because the fold reads it to tell a certain extend edge from a listed one. `siblings` is written by
       # the fold.
-      def merge_and_fold_extends(default_scope, root, def_nodes, singleton_def_nodes, seeded_scope, siblings,
+      # `def_pair` and `singleton_pair` are `[merged table, this file's own]`; the merged tables are frozen once the
+      # fold, their last in-place writer, is done ({#freeze_def_tables}).
+      def merge_and_fold_extends(default_scope, root, def_pair, singleton_pair, seeded_scope, siblings,
                                  mixin_unpositioned)
+        def_nodes = def_pair.first
+        singleton_def_nodes = singleton_pair.first
         file_extends, extends, extend_unpositioned = merge_extend_tables(default_scope, root)
         unpositioned = union_unpositioned(default_scope.discovery.unpositioned_mixins, *mixin_unpositioned,
                                           extend_unpositioned)
         methods_table = fold_per_file_extends(file_extends, def_nodes, singleton_def_nodes, seeded_scope, siblings,
                                               unpositioned)
+        # The fold also writes the singleton hash of each class this file `extend`s, declared there or not.
+        file_extends.each_key { |owner| singleton_def_nodes[owner]&.freeze }
+        freeze_def_tables(def_pair, singleton_pair)
+        # #2300 — the override gate's definers index then inverts the seed once per run, not once per file.
+        DefinersIndex.record_layers(def_nodes, default_scope.discovered_def_nodes)
+        DefinersIndex.record_layers(singleton_def_nodes, default_scope.discovered_singleton_def_nodes)
         [extends, methods_table, unpositioned]
       end
 
@@ -458,6 +474,20 @@ module Rigor
                                walked.fetch(:header_nestings)).freeze]
       end
 
+      # Issue #2330 — the per-file def table is read by identity: the callee-chain census memo is keyed by the
+      # {Scope::DiscoveryIndex} that carries it, which is only sound while the table is never written in place.
+      # Frozen after the extends fold, the last in-place writer; the seed's per-class hashes are frozen already.
+      #
+      # Only the per-class hashes of the classes this file declares are frozen here (the merge made or took
+      # them); a seed-only class's hash was frozen by `finalize_def_index`, so walking the whole table per file is
+      # needless.
+      def freeze_def_tables(*pairs)
+        pairs.each do |table, file_table|
+          file_table.each_key { |owner| table[owner].freeze }
+          table.freeze
+        end
+      end
+
       # The instance-side def-node table and its issue #681 nesting twin, each merged over the cross-file seed.
       # Returned as a pair so the two stay written together: a node the merge keeps must be the same object the
       # nesting table keys, and they are only that if both halves take the same file's walk.
@@ -529,20 +559,28 @@ module Rigor
         mutated_ivars = {}
         read_before_write = {}
         init_writes = {}
-        # WD3 — per-class summary of `{class_name => {method_name => Set<ivar names definitely assigned non-nil on every
-        # completing path>}}`, consulted by `dead_transient_nil_writes` so a ctor that reassigns `@x` indirectly through
-        # an unconditional same-class method call (`mask!`) credits the overwrite. Built once per program here, memoised
-        # by class.
+        # WD3 — per class, then per method, the ivars the method definitely assigns non-nil on every completing path,
+        # consulted by `dead_transient_nil_writes` so a ctor that reassigns `@x` indirectly through an unconditional
+        # same-class method call (`mask!`) credits the overwrite. Built once per program here, memoised by class.
         method_assign_effects = build_method_assign_effects(root)
+        # #2291 — an `@x = LIT` write reads the file's constant table, built on the first such write.
+        accumulator[CONSTANT_IVAR_VALUES] = ConstantIvarValue.new(root, default_scope)
         walk_class_ivars(root, [], default_scope, accumulator, mutated_ivars,
                          read_before_write, init_writes, method_assign_effects)
+        accumulator.delete(CONSTANT_IVAR_VALUES)
         reflective_opaque = accumulator.delete(REFLECTIVE_OPAQUE_CLASSES)
         exempt_class_body_writes!(init_writes, accumulator.delete(DEFINE_METHOD_WRITES) || {})
         merge_held_ivar_writes!(accumulator)
         record_aliased_ivar_mutations!(root, mutated_ivars)
         widen_mutated_ivar_entries!(accumulator, mutated_ivars)
+        # #2170 — an ancestor's writes as this file's census types them, before its read-before-write `nil`.
+        writes = accumulator.transform_values(&:dup)
         contribute_read_before_write_nil!(accumulator, read_before_write, init_writes)
         make_reflective_classes_gradual!(accumulator, reflective_opaque)
+        # #2079 / #2170 — another file's writes, and the chain's modules' and superclasses', join existing entries.
+        IvarContributions.join!(accumulator, writes, default_scope)
+        # An in-place mutation the file observes widens a joined value too (a same-file ancestor's String literal).
+        widen_mutated_ivar_entries!(accumulator, mutated_ivars)
         # #1406 — an RBS `@x: T` or `attr_* x: T` declaration replaces the census's join of the writes.
         DeclaredIvarTypes.apply!(accumulator, default_scope) if declared_ivar_types
         accumulator.transform_values(&:freeze).freeze
@@ -628,8 +666,8 @@ module Rigor
         end
       end
 
-      # `{class_name => {method_name => Set<ivar name>}}` for methods that hand an ivar back, dropping the empty sets
-      # so the caller's `next if per_class.nil?` skips a whole class in one lookup.
+      # Per class, then per method, the ivars each method hands back, dropping the empty sets so the caller's
+      # `next if per_class.nil?` skips a whole class in one lookup.
       def returned_ivars_by_method(defs)
         defs.each_with_object({}) do |(class_name, methods), acc|
           methods.each do |method_name, def_node|
@@ -718,9 +756,8 @@ module Rigor
       # The widening uses `MutationWidening.widen_for_mutator` — the same primitive
       # `Inference::StatementEvaluator#eval_call` applies for per-method-body widening on a local / ivar receiver. The
       # class-level pass extends that primitive's reach so a `Tuple`-seeded ivar in `initialize` is observed as
-      # `Nominal[Array]` at the entry of every OTHER method body in the class — closing the cross-method gap noted in
-      # ROADMAP § Future cycles / Type-language / engine ("Tuple / HashShape widening for ivar-seeded literals after
-      # mutation"; Redmine 6.1.2 `Redmine::Views::Builders::Structure` is the canonical worked site).
+      # `Nominal[Array]` at the entry of every OTHER method body in the class — closing the cross-method gap
+      # (Redmine 6.1.2 `Redmine::Views::Builders::Structure` is the canonical worked site).
       #
       # Always-safe: the widening can only LOSE precision; the underlying nominal (`Array` / `Hash`) and the element
       # union are preserved.
@@ -765,18 +802,27 @@ module Rigor
           end
 
           widen_member_for_lookup_mutators(member, observed_methods)
-        when Type::Constant
-          # `@s = +"ab"` in one method and `@s << "c"` in another: without this arm the seed stayed pinned at every
-          # other method's entry, and `@s == "ab"` folded always-truthy on a receiver that holds `"abc"`.
-          return member unless StringMutation.constant?(member) &&
-                               observed_methods.any? { |m| StringMutation::MUTATORS.include?(m) }
-
-          Type::Combinator.nominal_of("String")
+        when Type::Constant then widen_constant_for_observed_mutators(member, observed_methods)
         else
           member
         end
       end
 
+      # `@s = +"ab"` in one method and `@s << "c"` in another: without this arm the seed stayed pinned at every other
+      # method's entry, and `@s == "ab"` folded always-truthy on a receiver that holds `"abc"`. A constant-folded Set
+      # (`@s = Set["a"]`, then `@s.clear; @s << 1` elsewhere — issue #2294) takes the untyped floor the Tuple arm takes.
+      def widen_constant_for_observed_mutators(member, observed_methods)
+        if SetMutation.constant?(member)
+          return member unless observed_methods.any? { |m| SetMutation::MUTATORS.include?(m) }
+
+          return Type::Combinator.nominal_of("Set", type_args: [Type::Combinator.untyped])
+        end
+        return member unless StringMutation.constant?(member) &&
+                             observed_methods.any? { |m| StringMutation::MUTATORS.include?(m) }
+
+        Type::Combinator.nominal_of("String")
+      end
+
       # A `HashShape` ivar seed some method gave a default, a default proc or identity keys, and no method stored
       # into, removed from or rewrote: its pairs are the seed's own, so it takes the per-method {HashLookupMutation}
       # widening rather than the untyped floor above — a present key keeps its value across methods, a missing one
@@ -1316,9 +1362,9 @@ module Rigor
         # not `InstanceVariableWriteNode`s, so the generic descent below never records them as writes. Left unhandled,
         # an ivar written only via massign in `initialize` stays absent from `init_writes`, and
         # `contribute_read_before_write_nil!` then unions a spurious `nil` into its class-ivar seed — masking a
-        # genuinely-typed `@m` (e.g. `Tuple[]`) as `T | nil` at every sibling read. The RHS runs before any target is
-        # committed, so descend into `value` FIRST (an ivar read there is read-before-write), then mark every ivar
-        # target as written.
+        # genuinely-typed `@m` (e.g. `Tuple[]`) as `T | nil` at every sibling read. The RHS runs before any
+        # target is committed, so descend into `value` FIRST (an ivar read there is read-before-write), then mark every
+        # ivar target as written.
         if node.is_a?(Prism::MultiWriteNode)
           detect_read_before_write(node.value, seen_writes, read_first) if node.value
           detect_multi_write_target_writes(node, seen_writes, read_first)
@@ -1445,13 +1491,21 @@ module Rigor
         method_name, receiver = mutation_target(node)
         return if method_name.nil?
         return unless receiver.is_a?(Prism::InstanceVariableReadNode)
-        return unless MutationWidening::SHAPE_MUTATORS.include?(method_name)
+        return unless ivar_census_mutator?(method_name)
 
         per_class = (mutated_ivars[class_name] ||= {})
         per_ivar = (per_class[receiver.name] ||= Set.new)
         per_ivar << method_name
       end
 
+      # The Set-only names (`add`, `merge`, … — issue #2294) are recorded here rather than in `SHAPE_MUTATORS`, which
+      # every scan reads by name alone: there `merge` would make `Hash#merge`, which returns a new Hash, a mutation of
+      # its receiver. The census is safe to over-collect, since {#widen_member_for_observed_mutators} reads each name
+      # against the table of the carrier it widens.
+      def ivar_census_mutator?(method_name)
+        MutationWidening::SHAPE_MUTATORS.include?(method_name) || SetMutation::MUTATORS.include?(method_name)
+      end
+
       # `[mutator name, receiver node]` for a node that mutates its receiver, `nil` otherwise.
       #
       # `@h[k] ||= v` and its `&&=` / `+=` siblings store through `[]=` but are not `[]=` CallNodes; missing them left
@@ -1586,10 +1640,9 @@ module Rigor
       SAME_CLASS_CALL_DEPTH_CAP = 3
       private_constant :SAME_CLASS_CALL_DEPTH_CAP
 
-      # WD3 — builds the per-class definite-assignment summary `{class_name => {method_name => Set<ivar names assigned
-      # non-nil on every completing path>}}`. Used so a ctor's `dead_transient_nil_writes` can credit an indirect
-      # overwrite through an unconditionally-called same-class method (ipaddr's `initialize` reassigns `@mask_addr` via
-      # `mask!`).
+      # WD3 — builds the per-class definite-assignment summary: per class, then per method, the ivars assigned non-nil
+      # on every completing path. Used so a ctor's `dead_transient_nil_writes` can credit an indirect overwrite through
+      # an unconditionally-called same-class method (ipaddr's `initialize` reassigns `@mask_addr` via `mask!`).
       #
       # Each method's set is computed by the same suffix definite-assignment analysis used for the ctor seed, run from
       # the method body's first statement for every ivar the method writes anywhere. Same-class calls inside a method
@@ -1976,10 +2029,11 @@ module Rigor
       end
 
       def record_ivar_write(node, scope, class_name, accumulator, guarded: false, declared: nil)
-        rvalue_type = declared || scope.type_of(node.value)
+        rvalue_type = declared || accumulator[CONSTANT_IVAR_VALUES]&.type_of(node.value, scope) ||
+                      scope.type_of(node.value)
 
         # `@x = nil unless @x` / `@y = false unless @y` — follow-up to the polarity-aware defensive-init guard fix
-        # (ROADMAP § Future cycles — "Defensive ivar-init with nil / false rvalue"). When the rvalue is itself a falsey
+        # (defensive ivar-init with a nil / false rvalue). When the rvalue is itself a falsey
         # Constant, `union(rvalue, Constant[nil])` collapses (for `nil`) or doesn't widen the type's truthiness profile
         # (for `false`) — the predicate `unless @x` then folds to a single `Constant[nil]` / `Constant[false]` and the
         # `flow.always-truthy-condition` / `-always-falsey-` rule false-fires on the no-op-but-documented-default idiom.
@@ -1989,6 +2043,8 @@ module Rigor
         # `lib/tdiary/configuration.rb:157` for the worked site.
         return if guarded && falsey_constant?(rvalue_type)
 
+        rvalue_type = EmptySeed.erase(node.value, rvalue_type)
+
         rvalue_type = Type::Combinator.union(rvalue_type, Type::Combinator.constant_of(nil)) if guarded
         accumulate_ivar_type(accumulator, class_name, node.name, rvalue_type)
       end
@@ -2018,7 +2074,7 @@ module Rigor
       # `nil`, the guard bound its own ivar, and `ExpressionTyper#compound_write_value` read
       # `truthy(nil) | bot` — an instance method that sig-gen declared `-> bot`.
       def record_ivar_or_write(node, scope, class_name, accumulator)
-        rvalue_type = scope.type_of(node.value)
+        rvalue_type = EmptySeed.erase(node.value, scope.type_of(node.value))
         return if Narrowing.narrow_truthy(rvalue_type).is_a?(Type::Bot)
 
         accumulate_ivar_type(accumulator, class_name, node.name,
@@ -2182,7 +2238,9 @@ module Rigor
       CLASS_BODY_WRITES = :class_body_writes
       # The classes a computed-name `instance_variable_set` may write any ivar of ({#record_reflective_ivar_write}).
       REFLECTIVE_OPAQUE_CLASSES = :reflective_opaque_classes
-      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES, :REFLECTIVE_OPAQUE_CLASSES
+      # The census's {ConstantIvarValue}, which {#record_ivar_write} reads.
+      CONSTANT_IVAR_VALUES = :constant_ivar_values
+      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES, :REFLECTIVE_OPAQUE_CLASSES, :CONSTANT_IVAR_VALUES
 
       # Unions `type` into the class-ivar accumulator for `(class_name, ivar_name)`. Shared by the single-write and
       # multi-write (parallel-assignment) collectors.
@@ -2215,7 +2273,11 @@ module Rigor
 
         rhs_type = scope.type_of(node.value)
         ivars = MultiTargetBinder.bind_marked(node, rhs_type, scope: scope, soften_slots: false).ivars
-        ivars.each { |name, type| accumulate_ivar_type(accumulator, class_name, name, type) }
+        # #2499 — `@a, @b = {}, []` erases each empty seed as a single write does.
+        values = EmptySeed.multi_write_values(node)
+        ivars.each do |name, type|
+          accumulate_ivar_type(accumulator, class_name, name, EmptySeed.erase(values[name], type))
+        end
       end
 
       def falsey_constant?(type)
@@ -2382,7 +2444,7 @@ module Rigor
       end
 
       def record_cvar_write(node, scope, class_name, accumulator)
-        rvalue_type = scope.type_of(node.value)
+        rvalue_type = EmptySeed.erase(node.value, scope.type_of(node.value))
         accumulator[class_name] ||= {}
         existing = accumulator[class_name][node.name]
         accumulator[class_name][node.name] =
@@ -2504,7 +2566,7 @@ module Rigor
       end
 
       def record_global_write(node, scope, accumulator)
-        rvalue_type = scope.type_of(node.value)
+        rvalue_type = EmptySeed.erase(node.value, scope.type_of(node.value))
         existing = accumulator[node.name]
         accumulator[node.name] =
           existing ? Type::Combinator.union(existing, rvalue_type) : rvalue_type
@@ -3269,7 +3331,7 @@ module Rigor
         unless owner.empty?
           body_scope = census_body_scope(default_scope, enclosing_prefix, Type::Combinator.singleton_of(owner))
         end
-        rvalue_type = meta_new_constant_type(node, full) || body_scope.type_of(node.value)
+        rvalue_type = meta_new_constant_type(node, full) || EmptySeed.erase(node.value, body_scope.type_of(node.value))
         existing = accumulator[full]
         accumulator[full] = existing ? Type::Combinator.union(existing, rvalue_type) : rvalue_type
       end
@@ -3567,7 +3629,8 @@ module Rigor
       REFINEMENT_WILDCARD = Scope::DiscoveryIndex::REFINEMENT_WILDCARD
       REFINE_WORD = /\brefine\b/
       HEREDOC_OPENER = /<<[~-]?["'`A-Za-z_]/
-      private_constant :EMPTY_REFINEMENTS, :REFINEMENT_WILDCARD, :REFINE_WORD, :HEREDOC_OPENER
+      COMPARISON_OPERATORS = Set[:==, :!=, :===].freeze
+      private_constant :EMPTY_REFINEMENTS, :REFINEMENT_WILDCARD, :REFINE_WORD, :HEREDOC_OPENER, :COMPARISON_OPERATORS
 
       NO_OFFSETS = [].freeze
       private_constant :NO_OFFSETS
@@ -3660,7 +3723,8 @@ module Rigor
       # `self`, charged to its module or the wildcard), `:literal` (A3's `:refine` / eval-string literal), `:nested` (a
       # `refine` in a refine body, or in a singleton method of one), `:dsl` (where `self` is a class, #1689) and
       # `:raises` (no block, a Proc as the block, another receiver, or a computed target where `self` is `main`), and
-      # `:data` (a `:refine` literal where `self` is a plain class or one of its instances).
+      # `:data` (a `:refine` literal where `self` is a plain class or one of its instances), and `:inert` (issue #2203:
+      # a `:refine` Symbol that is a hash key or a comparison operand, which no call reads as a method name).
       def refine_census(root)
         census = []
         refinements = build_methods_and_def_nodes(root, census: census)[3]
@@ -3839,6 +3903,8 @@ module Rigor
           end
 
           census_call(node, qualified_prefix, tables, refine_body)
+        when Prism::AssocNode
+          census_assoc_key(node, tables)
         when Prism::SymbolNode
           census_symbol(node, tables)
         end
@@ -3894,6 +3960,8 @@ module Rigor
         arguments = node.arguments&.arguments
         return if arguments.nil?
 
+        return census_compared_literal(arguments.first, tables) if COMPARISON_OPERATORS.include?(node.name)
+
         strings = RefineCensus.string_literal_call?(node)
         arguments.each do |argument|
           next unless RefineCensus.refine_symbol?(argument) || (strings && RefineCensus.refine_string?(argument))
@@ -3928,6 +3996,26 @@ module Rigor
 
       def constant_shaped?(node) = node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
 
+      # Issue #2203 — a `:refine` Symbol a comparison reads (`node.name == :refine`, `!=`, `===`) is a value compared,
+      # never a method name a call runs: it is inert (`:inert`), and records no row.
+      def census_compared_literal(argument, tables)
+        return unless RefineCensus.refine_symbol?(argument) && !tables.literal_seen?(argument)
+
+        tables.see_literal(argument)
+        tables.account(argument, :inert)
+      end
+
+      # Issue #2203 — a `:refine` Symbol that is a hash key (`h(x, refine: true)`, `{ refine: 1 }`, `{ :refine => 1 }`)
+      # names an option, not `Module#refine`: it is inert (`:inert`), and records no row. A `:refine` value stays a
+      # literal.
+      def census_assoc_key(node, tables)
+        key = node.key
+        return unless RefineCensus.refine_symbol?(key) && !tables.literal_seen?(key)
+
+        tables.see_literal(key)
+        tables.account(key, :inert)
+      end
+
       # A3 — a `:refine` Symbol anywhere else (`alias my_refine refine`, `%i[refine]`, a hash) names `Module#refine`
       # for code the walk cannot follow, run on the module the in-effect walk says `self` is there; where `self` is a
       # plain class or one of its instances it is data.
@@ -4199,6 +4287,8 @@ module Rigor
             end
           end
           return
+        when Prism::AssocNode
+          census_assoc_key(node, methods_acc) if methods_acc.mentions_refine?
         when Prism::SymbolNode
           census_symbol(node, methods_acc) if methods_acc.mentions_refine?
         when Prism::CallNode
@@ -10423,10 +10513,11 @@ module Rigor
 
       # #1154 — tags each `[:own_write, class, ivar]` entry with the file that records it, so a reader of the merged
       # census can tell a second file writing the same ivar of the same class (`UnseenIvarWriters`).
+      # Issue #2079 — and each `[:own_write_type, class, ivar, value]` entry, which {IvarContributions} reads.
       def attribute_own_writes(census, path)
-        return census unless census.any? { |entry| entry.first == :own_write }
+        return census unless census.any? { |entry| PATH_TAGGED_KINDS.include?(entry.first) }
 
-        census.to_set { |entry| entry.first == :own_write ? [*entry, path].freeze : entry }
+        census.to_set { |entry| PATH_TAGGED_KINDS.include?(entry.first) ? [*entry, path].freeze : entry }
       end
 
       # Folds one file's Data + Struct member-layout tables into the cross-file accumulator (kept out of
@@ -10859,7 +10950,7 @@ module Rigor
       # A {DYNAMIC_TARGET_PREFIX} key is not a name and never publishes; it is expanded by
       # {#apply_dynamic_target_writes} into a retraction over the names it could have written.
       #
-      # @return `[{name => Type}, {name => Set[path]}]`.
+      # @return the value table and the table of source paths per name.
       def finalize_constant_writes(writes)
         values = {}
         sources = {}

data/lib/rigor/inference/self_call_ivar_writes.rb

@@ -9,6 +9,7 @@ require_relative "../type"
 require_relative "guard_rebinding"
 require_relative "project_method_ownership"
 require_relative "refined_dispatch/own_method"
+require_relative "../run_scoped_slots"
 
 module Rigor
   module Inference
@@ -85,7 +86,9 @@ module Rigor
         :to_r, :to_c, :to_proc, :to_path, :to_sym, :to_io, :coerce, :exception, :divmod, :each, :respond_to?,
         :respond_to_missing?, :method_missing, :initialize_copy, :marshal_dump, :pretty_print
       ].freeze
-      private_constant :UNPROVABLE_NODES, :LITERAL_CLASSES, :SELF_SAFE_NAMES, :PROTOCOL_NAMES
+      # Issue #2203 — the classes and module every project class's instances reach past its own chain.
+      IMPLICIT_ROOTS = %w[Object Kernel BasicObject].freeze
+      private_constant :UNPROVABLE_NODES, :LITERAL_CLASSES, :SELF_SAFE_NAMES, :PROTOCOL_NAMES, :IMPLICIT_ROOTS
 
       # Raised inside a proof to abandon it.
       class Unprovable < StandardError
@@ -113,6 +116,32 @@ module Rigor
         nil
       end
 
+      DEFINITION_COUNTS_KEY = RunScopedSlots.register(:__rigor_self_call_ivar_writes_definition_counts__)
+      private_constant :DEFINITION_COUNTS_KEY
+
+      # `{[owner, name] => the number of instance `def` rows of name the project records for owner}`, over every
+      # file of `deferred_ranges` (a `discovered_deferred_ranges` table). Built once per table and kept in ONE
+      # thread slot keyed by the table's identity (#2300): the table is never written in place, a file whose rows
+      # equal the seed's keeps the seed's table, and a scan of every file's rows per query was the cost once the
+      # table held the whole project. The slot holds one table and its counts, the next table replaces them, and the
+      # run that filled it releases it when it ends ({RunScopedSlots}, #2399).
+      def definition_counts(deferred_ranges)
+        slot = Thread.current[DEFINITION_COUNTS_KEY]
+        return slot[1] if slot && slot[0].equal?(deferred_ranges)
+
+        counts = {}
+        deferred_ranges.each_value do |rows|
+          rows.each do |row|
+            next unless row[3] == :instance
+
+            key = [row[4], row[2]]
+            counts[key] = counts.fetch(key, 0) + 1
+          end
+        end
+        Thread.current[DEFINITION_COUNTS_KEY] = [deferred_ranges, counts]
+        counts
+      end
+
       # One proof's state: the instance variables read code writes, and the `def` bodies already read.
       class Proof
         attr_reader :written
@@ -128,7 +157,7 @@ module Rigor
         # Reads the method an implicit-self or `self.` call to `call_node`'s name runs.
         def self_call(call_node)
           name = call_node.name
-          unprovable! if GuardRebinding.code_running_name?(name) || refined?(name)
+          unprovable! if GuardRebinding.code_running_name?(name) || refined?(name, on_self: true)
 
           if ProjectMethodOwnership.defines?(@class_name, name, :instance, @scope)
             read_def(proven_def(name))
@@ -185,19 +214,66 @@ module Rigor
 
         private
 
-        # Whether a `refine` block anywhere in the project defines `name`, on any class: a `using` in effect where the
-        # read code sits may route the call to it (`refine Kernel do def warn …`), whatever the receiver.
+        # Whether a `refine` block in the project defines `name` where the call may reach it: a `using` in effect
+        # where the read code sits may route the call to it (`refine Kernel do def warn …`).
         #
         # Issue #2163 — the answer reads every file's refinements whole, and a refined class off the chain (`Kernel`,
         # `IO`, `String`) is no `mark:` the chain read files, so it records `refinement:<name>` and `refinement:*`
         # whichever way it answers, as `InEffectRefinements` consumers do: a file that starts or stops refining the
         # name re-checks the reader.
-        def refined?(name)
+        #
+        # Issue #2203 — for a call on `self` (`on_self:`) whose reach {#self_reach} knows, a row of the name counts only
+        # on a class key in that reach, on the wildcard class key, or on a key the walk could not name
+        # (`InEffectRefinements.class_wildcard_key?`); a names-wildcard row (a computed `define_method`,
+        # `import_methods`) counts as the name, but only on a class key in the reach. A refinement of `String` leaves
+        # a `Holder` alone: dropping the proof is no safer, since the intervening-call reset restores the class-ivar
+        # seed and a class guard's narrowing then reports. Where the reach is unknown, and for a call on another
+        # receiver, a row of the name counts on any class and a names-wildcard row never does, as before the issue.
+        def refined?(name, on_self: false)
+          wildcard = Scope::DiscoveryIndex::REFINEMENT_WILDCARD
           if Analysis::DependencyRecorder.active?
             Analysis::DependencyRecorder.read_name(:refinement, name)
-            Analysis::DependencyRecorder.read_name(:refinement, Scope::DiscoveryIndex::REFINEMENT_WILDCARD)
+            Analysis::DependencyRecorder.read_name(:refinement, wildcard)
+          end
+          reach = on_self ? self_reach : nil
+          @scope.discovered_refinements.any? do |refined, methods|
+            next methods.key?(name) if reach.nil?
+
+            if reach.include?(refined)
+              methods.key?(name) || methods.key?(wildcard)
+            else
+              methods.key?(name) && InEffectRefinements.class_wildcard_key?(@scope, refined)
+            end
           end
-          @scope.discovered_refinements.any? { |_refined, methods| methods.key?(name) }
+        end
+
+        # Issue #2203 — the classes and modules on the instance chain of `self`'s class and of `Object`, `Kernel` and
+        # `BasicObject` (which holds the modules the project mixes into them), with `Object`'s RBS ancestors
+        # (`PP::ObjectMixin`); nil when a chain is cut, mixes in a module the tables cannot name, ends in a superclass
+        # they do not know (`class Holder < Struct.new(:a)`), or holds an external entry. A project subclass's chain
+        # needs no read: {#no_protocol_override} gives the proof up on a refined class or module anywhere on it. The
+        # implicit roots' chains are recorded, so a file that mixes a module into `Object` re-checks the reader;
+        # `self`'s own chain is recorded by {#no_protocol_override}'s read.
+        def self_reach
+          return @self_reach if defined?(@self_reach)
+
+          @self_reach = read_self_reach
+        end
+
+        def read_self_reach
+          names = Set.new
+          [@class_name.to_s, *IMPLICIT_ROOTS].each do |class_name|
+            chain = Scope::ResolutionChain.for(@scope, class_name, :instance, :methods)
+            chain.record(@scope) if Analysis::DependencyRecorder.active?
+            return nil if chain.truncated? || chain.wildcard_mixin? || chain.opaque_tail?(@scope)
+            return nil if chain.entries.any?(&:external?)
+
+            chain.entries.each { |entry| names << entry.name }
+          end
+          loader = @scope.environment&.rbs_loader
+          return nil if loader.nil?
+
+          names.merge(loader.ancestor_names_for("Object"))
         end
 
         def call_receiver(node) = node.is_a?(Prism::CallNode) ? node.receiver : nil
@@ -268,11 +344,7 @@ module Rigor
         end
 
         def definition_count(owner, name)
-          count = 0
-          @scope.discovered_deferred_ranges.each_value do |rows|
-            count += rows.count { |row| row[2] == name && row[3] == :instance && row[4] == owner }
-          end
-          count
+          SelfCallIvarWrites.definition_counts(@scope.discovered_deferred_ranges).fetch([owner, name], 0)
         end
 
         # Whether `chain`'s own order stands with no second world: no order mark and no fork. `ResolutionChain#settle`