rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/captured_locals.rb

@@ -272,6 +272,8 @@ module Rigor
 
       def ivar_name?(name) = variable_kind(name) == :ivar
 
+      def local_name?(name) = variable_kind(name) == :local
+
       # Ruby spells a global with a leading `$`, a class variable with `@@`, an instance variable with a single
       # `@`, and a local with none of them.
       def variable_kind(name)

data/lib/rigor/inference/census_foreign_block.rb

@@ -0,0 +1,354 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "anonymous_meta_class"
+
+module Rigor
+  module Inference
+    # Issue #2490 — a block, inside an instance body of a class `K`, whose `self` is provably not an instance of `K`, so
+    # an `@x` write directly in it writes some other object's ivar and the class-ivar censuses must not credit it to
+    # `K`. Read syntactically, before any type is known, by both the per-file census ({ScopeIndexer}) and the cross-file
+    # {IvarWriterCensus}. False positives come first, so a receiver that may hold a `K` instance keeps the credit:
+    #
+    # - `instance_eval` / `instance_exec` on a receiver that is provably no `K` instance ({.provably_other?}): a
+    #   constant or `self.class` (a class object), `X.new` / `X.allocate` on a constant `X` not spelling `K`, a
+    #   literal. Any other receiver (a parameter, a local, `dup`, `itself`) may be a `K` and still counts;
+    # - `class_eval` / `module_eval` / `class_exec` / `module_exec` on an explicit receiver: `self` is the receiver
+    #   module, so `@x` directly in the block is that module object's own ivar;
+    # - `define_method` on a constant not spelling `K` (its block runs on that class's instances), and
+    #   `define_singleton_method` on a class object or a literal;
+    # - a `Class.new` / `Module.new` / `Struct.new` / `Data.define` block: `self` is the new class.
+    #
+    # `class << obj` inside an instance body is one more barred body; the callers bar it themselves, since it is no
+    # call. Only a barred body's own statements are dropped: a `define_method` block nested in a `class_eval` or
+    # `class << obj` body whose module may be `K` or an instance's singleton class runs on a `K` instance and still
+    # counts, and so does a receiver-less `def` nested in either (#2941, {.reentry_blocks}).
+    # `def.ivar-write-mismatch`'s collector reads the same rule (#2943, {.census_children}).
+    module CensusForeignBlock
+      INSTANCE_EVALS = %i[instance_eval instance_exec].to_set.freeze
+      MODULE_EVALS = %i[class_eval module_eval class_exec module_exec].to_set.freeze
+      DEFINERS = %i[define_method define_singleton_method].to_set.freeze
+      SEND_CALLS = %i[send public_send __send__].to_set.freeze
+      # The constructors whose receiver names the class of the object they answer.
+      CONSTRUCTORS = %i[new allocate].to_set.freeze
+      # The literal receivers, none of them an instance of a project class.
+      LITERALS = [Prism::StringNode, Prism::InterpolatedStringNode, Prism::SymbolNode, Prism::IntegerNode,
+                  Prism::FloatNode, Prism::ArrayNode, Prism::HashNode, Prism::RangeNode, Prism::RegularExpressionNode,
+                  Prism::NilNode, Prism::TrueNode, Prism::FalseNode, Prism::LambdaNode].freeze
+      # The calls that answer a module of their receiver.
+      MODULE_OF_INSTANCE = %i[class singleton_class].to_set.freeze
+      # The constants naming a module every class has among its ancestors, whose methods an instance runs.
+      ANCESTOR_ROOTS = %w[Object BasicObject Kernel].to_set.freeze
+      # The calls whose answer is foreign when their receiver is: the object itself, a copy, a new instance, its class.
+      FOREIGN_PRESERVING = %i[new allocate dup clone itself class singleton_class].to_set.freeze
+      # Issue #2983 — the scalar literals, whose blockless calls answer no instance of a project class, unlike a
+      # container's (`[k].first`) or a lambda's.
+      SCALAR_LITERALS = (LITERALS - [Prism::ArrayNode, Prism::HashNode, Prism::LambdaNode]).freeze
+      # A String or Symbol literal that spells a constant path, which a call may resolve to the class
+      # (`"K".constantize`).
+      CONSTANT_SPELLING = /\A(?:::)?[A-Z]\w*(?:::[A-Z]\w*)*\z/
+      # Separates the qualifications of a {.candidate_key}; no constant name holds it.
+      CANDIDATE_SEPARATOR = "|"
+      # Marks a candidate key whose code runs on the constant's own value's module ({.root_constant}).
+      OBJECT_MARK = "@"
+      COPIES = %i[dup clone itself].to_set.freeze
+      BARRIERS = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      NONE = [].freeze
+      # Every name {.foreign?} can answer true for, so any other call returns at one Set probe.
+      CALLS = (INSTANCE_EVALS | MODULE_EVALS | DEFINERS | %i[new define]).freeze
+
+      module_function
+
+      # Whether `node`'s literal block runs with a `self` that is provably not an instance of `class_name`.
+      def foreign?(node, class_name)
+        unless node.is_a?(Prism::CallNode) && CALLS.include?(node.name) && node.block.is_a?(Prism::BlockNode)
+          return false
+        end
+        return true if AnonymousMetaClass.block_form_receiver(node)
+
+        name = node.name
+        receiver = node.receiver
+        return false if self_node?(receiver)
+        return true if MODULE_EVALS.include?(name)
+        return provably_other?(receiver, class_name) if INSTANCE_EVALS.include?(name)
+        return provably_other?(receiver, class_name) if name == :define_singleton_method
+
+        foreign_constant?(receiver, class_name)
+      end
+
+      # A receiver that is provably no instance of `class_name`: a constant or `self.class` (a class object, `K`
+      # itself included), `X.new` / `X.allocate` on a constant `X` not spelling `class_name`, or a literal.
+      def provably_other?(receiver, class_name)
+        case receiver
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then true
+        when Prism::CallNode
+          return receiver.arguments.nil? if receiver.name == :class
+
+          CONSTRUCTORS.include?(receiver.name) && foreign_constant?(receiver.receiver, class_name)
+        else LITERALS.any? { |klass| receiver.is_a?(klass) }
+        end
+      end
+
+      # A constant that does not spell `class_name`.
+      def foreign_constant?(node, class_name)
+        (node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)) && !own_class?(node, class_name)
+      end
+
+      # The children of `node` a census walk for `class_name` still descends into when `node` runs code whose `self`
+      # is another object, or nil for an ordinary node: a {.foreign?} call keeps its receiver and arguments, and a
+      # `class << obj` body its expression; both keep the code nested in them that runs on a `class_name` instance
+      # again ({.reentry_blocks}) unless `reentry` is false, as it is in a singleton-side `def`, whose `self.class`
+      # and `singleton_class` are no module of an instance. A reentered `def` comes back as the {Prism::DefNode},
+      # which a walk that stops at a `def` skips and the class-ivar census walks into (#2941).
+      def census_children(node, class_name, reentry: true)
+        case node
+        when Prism::SingletonClassNode
+          return [node.expression] unless reentry
+
+          [node.expression, *reentry_blocks(node, class_name)]
+        when Prism::CallNode
+          return nil unless foreign?(node, class_name)
+          return [node.receiver, node.arguments].compact unless reentry
+
+          [node.receiver, node.arguments, *reentry_blocks(node, class_name)].compact
+        end
+      end
+
+      # The code inside barred code whose `self` may again be an instance of `class_name`, in a `class_eval`-family
+      # block whose module may be `class_name` or the singleton class of one of its instances ({.foreign_module?}) or in
+      # a `class << obj` body on an operand {.provably_other?} does not name:
+      #
+      # - a `define_method` block on the implicit or `self` receiver, called directly or through `send` /
+      #   `public_send` / `__send__` with the literal name;
+      # - a receiver-less `def` (#2941), which defines an instance method of that module, or a singleton method of
+      #   the `class << obj` operand, just as the `define_method` does.
+      #
+      # Ruby runs each on a `K` instance (a `K` method, or a singleton method of the instance), so its writes are
+      # `K`'s; an untyped receiver keeps the credit, as {.foreign?} keeps it for `instance_eval`.
+      def reentry_blocks(node, class_name)
+        body =
+          case node
+          when Prism::SingletonClassNode then node.body unless provably_other?(node.expression, class_name)
+          when Prism::CallNode
+            node.block.body if MODULE_EVALS.include?(node.name) && !foreign_module?(node.receiver, class_name)
+          end
+        return NONE if body.nil?
+
+        found = []
+        collect_define_method_blocks(body, found)
+        found
+      end
+
+      # A `class_eval` receiver whose module is provably neither `class_name`, an ancestor of it nor an instance's
+      # singleton class, read from inside an instance body. A receiver chain is foreign only when it is:
+      #
+      # - rooted at a constant other than `class_name`'s own spelling and {ANCESTOR_ROOTS} (`Other.class_eval`,
+      #   `Other.dup`), a `X.new` or `Class.new` on such a constant among them, or rooted at a literal, through
+      #   {FOREIGN_PRESERVING} calls only;
+      # - `.class` / `.singleton_class` on a receiver {.provably_other?} names (`Other.new.class`, `"s".class`,
+      #   `self.class.class`);
+      # - rooted at a scalar literal through blockless calls of any name (`"s".upcase.class`, #2983), unless the
+      #   literal is a String or Symbol that spells a constant (`"K".constantize`).
+      #
+      # A `superclass` call may answer an ancestor (`Other.superclass` is `Object`), a `const_get` or registry call may
+      # answer the class (`Other.const_get(:K)`), and every other receiver
+      # (`self.class`, `singleton_class`, a parameter's `o.class`, `self.class.base_class`) may name `class_name`, so
+      # they keep the credit. Parentheses are looked through. The rule is syntactic: a constant naming another
+      # ancestor of the class (`Base.class_eval` with `K < Base`), an alias of it or one of its instances reads as
+      # foreign here, and the cross-file census files the barred block's code under that constant instead
+      # ({.root_constant}), whose entries the class's census joins (#2983).
+      def foreign_module?(receiver, class_name)
+        receiver = unwrap(receiver)
+        return true if scalar_literal_rooted?(receiver)
+
+        case receiver
+        when Prism::ConstantReadNode, Prism::ConstantPathNode
+          foreign_constant?(receiver, class_name) && !ANCESTOR_ROOTS.include?(receiver.slice.delete_prefix("::"))
+        when Prism::CallNode then foreign_module_call?(receiver, class_name)
+        else LITERALS.any? { |klass| receiver.is_a?(klass) }
+        end
+      end
+
+      # A call in the chain keeps it foreign only when it answers its receiver's own object, a copy, a new instance
+      # or its class ({FOREIGN_PRESERVING}); any other call (`const_get`, a registry's `fetch`, `superclass`) may
+      # answer the class, so the receiver may be it.
+      def foreign_module_call?(call, class_name)
+        if MODULE_OF_INSTANCE.include?(call.name) && call.arguments.nil? &&
+           provably_other?(unwrap(call.receiver), class_name)
+          return true
+        end
+        return false unless FOREIGN_PRESERVING.include?(call.name)
+
+        foreign_module?(call.receiver, class_name)
+      end
+
+      # Issue #2983 — whether `receiver` is a chain of blockless calls rooted at a scalar literal that spells no
+      # constant: whatever the calls are, Ruby's methods on such a literal answer no project class or its instance.
+      def scalar_literal_rooted?(receiver)
+        node = receiver
+        while node.is_a?(Prism::CallNode)
+          return false if node.block
+
+          node = unwrap(node.receiver)
+        end
+        return false if node.equal?(receiver) || SCALAR_LITERALS.none? { |klass| node.is_a?(klass) }
+
+        !((node.is_a?(Prism::StringNode) || node.is_a?(Prism::SymbolNode)) && CONSTANT_SPELLING.match?(node.unescaped))
+      end
+
+      # Issue #2983 — the constant a `class_eval` receiver chain is rooted at through {FOREIGN_PRESERVING} calls
+      # (`Anc`, `INST.class`, `AliasK.new.class`, `Other.singleton_class`), as its candidate key under `nesting`
+      # ({.candidate_key}), or nil. The module such a chain names is the constant's, its class's or its singleton's,
+      # so the code a barred block reenters runs on the constant's instances or on the object it holds; the
+      # cross-file census files it under the key, and a class whose census joins the constant the key resolves to (an
+      # ancestor, an alias, an instance constant of it) sees the write.
+      #
+      # Review round 2 of #3001 — a `.class` or `.singleton_class` taken of the constant's own value (`INST.class`,
+      # `X.singleton_class`, through `dup` / `clone` / `itself`) names the module of that object, which is a class
+      # instance only when the constant binds one; the key then carries {OBJECT_MARK}, and the join credits it only
+      # when the constant resolves to an instance binding (`INST = K.new`). One taken of a class object (`X.class` of a
+      # `.class`, `X.new.class.singleton_class`) names `Class` or a metaclass, whose methods no instance runs: nil.
+      def root_constant(receiver, nesting)
+        node = unwrap(receiver)
+        object = false
+        while node.is_a?(Prism::CallNode) && FOREIGN_PRESERVING.include?(node.name)
+          inner = unwrap(node.receiver)
+          if MODULE_OF_INSTANCE.include?(node.name)
+            value = through_copies(inner)
+            return if value.is_a?(Prism::CallNode) && MODULE_OF_INSTANCE.include?(value.name)
+
+            object = true if constant_node?(value)
+          end
+          node = inner
+        end
+        return unless node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+
+        key = candidate_key(node.slice, nesting)
+        object ? "#{OBJECT_MARK}#{key}" : key
+      end
+
+      # `node` with `dup`, `clone` and `itself` calls looked through: the object they answer has the same class.
+      def through_copies(node)
+        node = unwrap(node.receiver) while node.is_a?(Prism::CallNode) && COPIES.include?(node.name)
+        node
+      end
+
+      def constant_node?(node) = node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+
+      # Review round 1 of #3001 — the qualifications a constant spelled `spelling` may have under the lexical
+      # `nesting` (the enclosing class and module names), nearest first as Ruby's lookup tries them, joined by
+      # {CANDIDATE_SEPARATOR}: `Anc` under `N::K` is `"N::K::Anc|N::Anc|Anc"`. A rooted `::Anc`, or one at the top
+      # level, has the one candidate `"Anc"`. `ScopeIndexer::IvarContributions` resolves the key to the first
+      # candidate the project declares.
+      def candidate_key(spelling, nesting)
+        return spelling.delete_prefix("::") if spelling.start_with?("::") || nesting.empty?
+
+        nesting.size.downto(0).map { |depth| [*nesting.first(depth), spelling].join("::") }.join(CANDIDATE_SEPARATOR)
+      end
+
+      # Review round 3 of #3001 — whether `call` is `Class.new`, `Module.new`, `Struct.new` or `Data.define` on the
+      # bare constant, whose answer is a class.
+      def meta_new?(call)
+        !AnonymousMetaClass::META_NEW_SELECTORS[AnonymousMetaClass.literal_constant_name(call.receiver)].nil?
+      end
+
+      # Issue #2983 — for a constant write `C = K` or `C = K.new` / `K.allocate` under the lexical `nesting`, the
+      # census entry `[:binds_class, key, name, kind]`: `K`'s {.candidate_key}, `C`'s qualified name (a path write's
+      # as written) and `:instance` for a constructor or `:alias`, else nil. `C` is an alias or an instance of the
+      # class `K` resolves to.
+      def binding_entry(node, nesting)
+        value = unwrap(node.value)
+        instance = value.is_a?(Prism::CallNode) && CONSTRUCTORS.include?(value.name) && value.block.nil?
+        # Review round 3 of #3001: `Struct.new(:a)`, `Class.new(Base)` and `Module.new` answer a class, not an instance.
+        # A guard beside `IvarContributions.module?`, which drops the same credit once the constant is a declared class.
+        return if instance && meta_new?(value)
+
+        value = value.receiver if instance
+        return unless value.is_a?(Prism::ConstantReadNode) || value.is_a?(Prism::ConstantPathNode)
+
+        name = node.is_a?(Prism::ConstantWriteNode) ? [*nesting, node.name].join("::") : node.target.slice
+        [:binds_class, candidate_key(value.slice, nesting), name.delete_prefix("::"),
+         instance ? :instance : :alias].freeze
+      end
+
+      # Issue #2983 — the module a String `class_eval` / `module_eval` may define methods on, for
+      # `IvarWriterCensus#record_string_eval`: `owner`, the class owning a class body, for an implicit or `self`
+      # receiver there (one in an instance body raises); `instance`, the instance body's class, for a receiver
+      # {.foreign_module?} does not bar; otherwise the receiver chain's root constant ({.root_constant}); or nil.
+      def string_eval_target(node, instance, owner)
+        return (owner unless instance) if self_node?(node.receiver)
+        return instance if instance && !foreign_module?(node.receiver, instance)
+
+        nesting = instance || owner
+        root_constant(node.receiver, nesting ? nesting.split("::") : NONE)
+      end
+
+      # For a barred `class_eval`-family block whose receiver {.foreign_module?} takes as another module and whose
+      # chain is rooted at a constant ({.root_constant}), that constant's candidate key and the code in the block that
+      # runs on its module's instances, as {.reentry_blocks} collects it; else nil.
+      def rooted_reentry(node, class_name)
+        return unless MODULE_EVALS.include?(node.name) && foreign_module?(node.receiver, class_name)
+
+        root = root_constant(node.receiver, class_name.split("::"))
+        return if root.nil?
+
+        found = []
+        collect_define_method_blocks(node.block.body, found)
+        [root, found]
+      end
+
+      # `node` with any parentheses around a single expression looked through.
+      def unwrap(node)
+        while node.is_a?(Prism::ParenthesesNode)
+          body = node.body
+          body = body.body.first if body.is_a?(Prism::StatementsNode) && body.body.size == 1
+          break if body.nil? || body.is_a?(Prism::StatementsNode)
+
+          node = body
+        end
+        node
+      end
+
+      def collect_define_method_blocks(node, found)
+        return unless node.is_a?(Prism::Node)
+        return found << node if node.is_a?(Prism::DefNode) && node.receiver.nil?
+        return if BARRIERS.any? { |klass| node.is_a?(klass) }
+
+        if node.is_a?(Prism::CallNode)
+          return found << node.block if define_method_call?(node)
+          return if node.block.is_a?(Prism::BlockNode) && CALLS.include?(node.name)
+        end
+
+        node.rigor_each_child { |child| collect_define_method_blocks(child, found) }
+      end
+
+      # A `define_method` with a literal block on the implicit or `self` receiver, called directly or through a `send`
+      # whose first argument is the literal name.
+      def define_method_call?(node)
+        return false unless node.is_a?(Prism::CallNode) && self_node?(node.receiver)
+        return false unless node.block.is_a?(Prism::BlockNode)
+        return true if node.name == :define_method
+        return false unless SEND_CALLS.include?(node.name)
+
+        first = node.arguments&.arguments&.first
+        (first.is_a?(Prism::SymbolNode) || first.is_a?(Prism::StringNode)) && first.unescaped == "define_method"
+      end
+
+      # `self.class`, or a constant spelling `class_name`.
+      def own_class?(node, class_name)
+        case node
+        when Prism::CallNode
+          node.name == :class && self_node?(node.receiver) && node.arguments.nil?
+        when Prism::ConstantReadNode, Prism::ConstantPathNode
+          spelled = node.slice.delete_prefix("::")
+          spelled == class_name || spelled == class_name.split("::").last
+        else
+          false
+        end
+      end
+
+      def self_node?(node) = node.nil? || node.is_a?(Prism::SelfNode)
+    end
+  end
+end

data/lib/rigor/inference/clause_widening.rb

@@ -57,7 +57,7 @@ module Rigor
         widened = names.reduce(scope) do |acc, name|
           ivar = name.start_with?("@")
           current = ivar ? scope.ivar(name) : scope.local(name)
-          next acc if current.nil? || current == untyped
+          next acc if current.nil? || Type::Combinator.untyped?(current)
 
           ivar ? acc.with_ivar(name, untyped).without_ivar_guard(name) : acc.with_local(name, untyped)
         end

data/lib/rigor/inference/closure_escape_analyzer.rb

@@ -3,6 +3,7 @@
 require_relative "../type"
 require_relative "../reflection"
 require_relative "external_ancestor_resolution"
+require_relative "../memo_audit"
 require_relative "project_method_ownership"
 
 module Rigor
@@ -185,9 +186,15 @@ module Rigor
           return false unless scope.known_user_class?(class_name)
 
           by_method = (ProjectMethodOwnership.memo(scope)[:ancestry][class_name] ||= {})
-          return by_method[method_sym] if by_method.key?(method_sym)
+          if by_method.key?(method_sym)
+            return MemoAudit.check("ancestry non-escaping", by_method[method_sym], class_name, method_sym) do
+              compute_ancestry_non_escaping?(class_name, method_sym, scope)
+            end
+          end
 
-          by_method[method_sym] = compute_ancestry_non_escaping?(class_name, method_sym, scope)
+          by_method[method_sym] = MemoAudit.key_audit("ancestry non-escaping") do
+            compute_ancestry_non_escaping?(class_name, method_sym, scope)
+          end
         end
 
         def compute_ancestry_non_escaping?(class_name, method_sym, scope)
@@ -236,7 +243,7 @@ module Rigor
       OBJECT_NON_ESCAPING = %i[tap then yield_self].freeze
 
       ENUMERABLE_NON_ESCAPING = %i[
-        each map collect flat_map collect_concat
+        each reverse_each map collect flat_map collect_concat
         select filter reject filter_map
         find detect find_index find_all
         any? all? none? one? count tally sum
@@ -248,7 +255,7 @@ module Rigor
         zip
       ].freeze
 
-      ARRAY_EXTRA = %i[each_index].freeze
+      ARRAY_EXTRA = %i[each_index rfind index rindex].freeze
       HASH_EXTRA = %i[
         each_pair each_key each_value
         transform_keys transform_values

data/lib/rigor/inference/construction_escape.rb

@@ -0,0 +1,258 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../source/node_walker"
+require_relative "../source/node_children"
+require_relative "../source/literals"
+require_relative "../typing_state"
+require_relative "../memo_audit"
+
+module Rigor
+  module Inference
+    # Issue #2555 L3 — which locals of a body may have ESCAPED, so a write to them never carries the `:synthesised`
+    # construction fact ({Scope#construction_fact?}).
+    #
+    # The fact lets the mutation seams re-grow a carrier without the `Dynamic[top]` floor, and the floor existed
+    # because a store the seam does not see leaves the carrier stale. A store reaches a local's object unseen only
+    # through another holder of it, and almost any position can make one: an alias, a container, an argument (a
+    # constructor or an attribute writer keeps it, `Array(a)` and `ident(a)` return it), a call that returns the
+    # receiver for some class (`Set#merge`, `a.each`), or a method the project defines. So every reference escapes
+    # unless it is in one of these positions:
+    #
+    # - the receiver of a call on the per-class {READERS} list, which neither returns, keeps nor mutates its receiver;
+    # - the receiver of an {ITERATORS} call or of a mutator the seams model ({.mutators_for}), with the call's value
+    #   discarded;
+    # - the body's value position (its last statement, or `return a`), after which nothing in the body runs;
+    # - a bare read whose value is discarded.
+    #
+    # A listed name the project defines anywhere (a reopen, a prepended or included module, a refinement, any
+    # class at all) escapes all the same ({.project_defines?}). Every argument position escapes, and so does
+    # any reference inside a block or lambda, a write whose value is used (`a = b = …`), and every local of a
+    # body that reaches the frame reflectively: a call of `binding`, `eval`, `local_variable_get`,
+    # `local_variable_set`, `instance_variable_set` or a string-form `instance_eval` / `class_eval` /
+    # `module_eval`, a `send` / `__send__` / `public_send` dispatch whose first argument is one of those names
+    # as a literal Symbol or String, or a `TOPLEVEL_BINDING` reference.
+    # The scan is flow insensitive and runs once per body, so an escape anywhere drops the fact for the whole body:
+    # the conservative direction, since without the fact the seams answer as before. A nested `def` or class body is
+    # scanned too, though its locals are its own; a same-named local there can only over-report an escape.
+    module ConstructionEscape
+      CLASSES = %w[Array Hash Set].freeze
+
+      # The calls that answer a value other than the receiver, keep no reference to it, and change nothing in it.
+      READERS = Ractor.make_shareable(
+        {
+          "Array" => %i[
+            size length count empty? any? none? all? include? first last [] dig fetch index find_index sum min max
+            join dup map select filter reject sort sort_by uniq compact flatten reverse take drop to_h to_set ==
+          ].to_set,
+          "Hash" => %i[
+            size length count empty? any? include? key? has_key? member? value? has_value? [] dig fetch keys values
+            dup map select filter reject to_a ==
+          ].to_set,
+          "Set" => %i[size length count empty? any? include? member? first dup map select filter reject to_a ==].to_set
+        }
+      )
+
+      # The calls that answer the receiver itself and yield only its members: safe with their value discarded.
+      ITERATORS = Ractor.make_shareable(
+        {
+          "Array" => %i[each each_with_index each_index reverse_each].to_set,
+          "Hash" => %i[each each_pair each_key each_value each_with_index].to_set,
+          "Set" => %i[each].to_set
+        }
+      )
+
+      # Calls that read or rebind the frame's locals by name: one anywhere in a body escapes every local in it.
+      FRAME_CALLS = %i[binding eval local_variable_get local_variable_set instance_variable_set].to_set.freeze
+      STRING_EVAL_CALLS = %i[instance_eval class_eval module_eval].to_set.freeze
+      # The spellings that reach a {FRAME_CALLS} or {STRING_EVAL_CALLS} name through a literal Symbol or String
+      # argument (`send(:eval, …)`, `send("eval", …)`).
+      SEND_CALLS = %i[send __send__ public_send].to_set.freeze
+
+      CLOSURES = [Prism::BlockNode, Prism::LambdaNode].freeze
+      LOCAL_REFERENCES = [
+        Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode,
+        Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode, Prism::LocalVariableTargetNode
+      ].freeze
+      LOCAL_WRITES = [
+        Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+        Prism::LocalVariableAndWriteNode
+      ].freeze
+      ALL = :all
+      EMPTY_CALLS = Set.new.freeze
+      # ADR-129 WD1 — a run-scoped Memo, emptied when a run ends so a long-lived process never serves a verdict from
+      # a body an earlier run parsed: keyed by body node, the only input of the scan.
+      CACHE = TypingState.memo(
+        :construction_escape,
+        run_scoped: true, audit: "construction escape",
+        reason: "keyed by the body node; the escape scan is a pure function of the body"
+      )
+      private_constant :CLOSURES, :LOCAL_REFERENCES, :LOCAL_WRITES, :ALL, :EMPTY_CALLS, :CACHE,
+                       :STRING_EVAL_CALLS, :SEND_CALLS
+
+      # One body's answer: per name, ALL or the classes it escapes as, and the calls the scan admitted on it.
+      Result = Data.define(:escapes, :calls)
+      private_constant :Result
+
+      module_function
+
+      # True when the local `name`, bound to a carrier of `class_name`, may escape somewhere in `body`, or when
+      # `body` is unknown. `scope` answers whether the project defines one of the admitted calls on the class
+      # ({.project_defines?}).
+      def escaped?(body, name, class_name, scope)
+        return true if body.nil? || class_name.nil?
+
+        result = escape_scan(body)
+        return true if result.equal?(ALL)
+
+        reason = result.escapes[name]
+        return true if !reason.nil? && (reason.equal?(ALL) || reason.include?(class_name))
+
+        result.calls.fetch(name, EMPTY_CALLS).any? { |call| project_defines?(scope, class_name, call) }
+      end
+
+      # Whether the project defines a method named `call` anywhere ({Scope#project_method_name?}): on any class or
+      # module, instance or singleton side, in a `refine` block, in any file. An admitted call of such a name escapes
+      # the local whatever the receiver's class, because a prepended or included module, a refinement or a reopen can
+      # put that name on Array, Hash or Set, and telling which owner reaches the receiver is not worth the precision
+      # it buys: without the fact the seams answer as before. When no def is found the def-node lookup on the class
+      # itself still runs, so an incremental run records the missing `Array#size` and a later reopen re-analyses
+      # this file.
+      def project_defines?(scope, class_name, call)
+        scope.project_method_name?(call) || !scope.user_def_for(class_name, call).nil?
+      end
+
+      # The receiver mutators the seams model for `class_name` ({MutationWidening}, {HashLookupMutation},
+      # {SetMutation}).
+      def mutators_for(class_name)
+        case class_name
+        when "Array" then MutationWidening::ARRAY_MUTATORS
+        when "Hash" then MutationWidening::HASH_MUTATORS | HashLookupMutation::MUTATORS
+        else SetMutation::MUTATORS
+        end
+      end
+
+      # {.scan} of `body`, memoised for the run.
+      def escape_scan(body)
+        return scan(body) if MemoAudit.enabled? && MemoAudit.suspended?
+
+        table = TypingState.current.weak_key_map(CACHE)
+        stored = table[body]
+        return table[body] = MemoAudit.key_audit("construction escape") { scan(body) } if stored.nil?
+
+        MemoAudit.check("construction escape", stored, body) { scan(body) }
+      end
+
+      def scan(body)
+        escapes = {}
+        calls = {}
+        Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
+          return ALL if frame_access?(node)
+          next unless LOCAL_REFERENCES.any? { |k| node.is_a?(k) }
+
+          record(escapes, calls, node, ancestors)
+        end
+        Result.new(escapes: escapes.freeze, calls: calls.freeze)
+      end
+
+      def record(escapes, calls, node, ancestors)
+        name = node.name
+        call = receiver_call(node, ancestors)
+        unsafe =
+          if call
+            unsafe_classes(call, ancestors).tap { |u| (calls[name] ||= Set.new) << call.name if u.size < CLASSES.size }
+          else
+            escape_reference?(node, ancestors) ? CLASSES : []
+          end
+        return if unsafe.empty? || escapes[name].equal?(ALL)
+
+        escapes[name] = unsafe.size == CLASSES.size ? ALL : (escapes[name] || Set.new).merge(unsafe)
+      end
+
+      # A node that reaches the frame's locals by name: a {FRAME_CALLS} or string-eval call, a `send`-family
+      # dispatch on a literal frame-call name (`send(:eval, …)`), or a `TOPLEVEL_BINDING` reference under any
+      # qualification (a project's own `X::TOPLEVEL_BINDING` escapes too, costing only precision), whose
+      # `local_variable_get` / `local_variable_set` reads and rebinds the top frame.
+      def frame_access?(node)
+        case node
+        when Prism::CallNode then frame_call_name?(node)
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then node.name == :TOPLEVEL_BINDING
+        else false
+        end
+      end
+
+      def frame_call_name?(node)
+        name = node.name
+        return true if FRAME_CALLS.include?(name)
+        return true if STRING_EVAL_CALLS.include?(name) && !node.arguments.nil?
+        return false unless SEND_CALLS.include?(name)
+
+        arguments = node.arguments&.arguments
+        return false if arguments.nil? || arguments.empty?
+
+        dispatched = Source::Literals.symbol_or_string(arguments.first)
+        FRAME_CALLS.include?(dispatched) ||
+          (STRING_EVAL_CALLS.include?(dispatched) && arguments.size > 1)
+      end
+
+      # The call a read outside any closure is the receiver of, or nil.
+      def receiver_call(node, ancestors)
+        return nil unless node.is_a?(Prism::LocalVariableReadNode) && !in_closure?(ancestors)
+
+        parent = ancestors.last
+        parent if parent.is_a?(Prism::CallNode) && parent.receiver.equal?(node)
+      end
+
+      # The classes for which `call` on the local may hand it on.
+      def unsafe_classes(call, ancestors)
+        discarded = !value_used?(ancestors, ancestors.size - 2, call)
+        CLASSES.reject do |class_name|
+          READERS.fetch(class_name).include?(call.name) ||
+            (discarded && (ITERATORS.fetch(class_name).include?(call.name) ||
+                           mutators_for(class_name).include?(call.name)))
+        end
+      end
+
+      def in_closure?(ancestors)
+        ancestors.any? { |a| CLOSURES.any? { |k| a.is_a?(k) } }
+      end
+
+      # Whether a reference that is no call's receiver may hand the object on.
+      def escape_reference?(node, ancestors)
+        return true if in_closure?(ancestors)
+        return value_used?(ancestors, ancestors.size - 1, node) if LOCAL_WRITES.any? { |k| node.is_a?(k) }
+        return false unless node.is_a?(Prism::LocalVariableReadNode)
+
+        parent = ancestors.last
+        return false if parent.is_a?(Prism::ArgumentsNode) && ancestors[-2].is_a?(Prism::ReturnNode)
+
+        !(parent.is_a?(Prism::StatementsNode) && !value_used?(ancestors, ancestors.size - 1, node))
+      end
+
+      # Whether the value of `node`, whose parent is `ancestors[index]`, reaches anything. The body's own value (its
+      # last statement) is the return position, after which nothing in the body runs, so it reads as unused.
+      def value_used?(ancestors, index, node)
+        while index >= 0
+          parent = ancestors[index]
+          case parent
+          when Prism::StatementsNode
+            return false unless parent.body.last.equal?(node)
+          when Prism::IfNode, Prism::UnlessNode, Prism::CaseNode, Prism::CaseMatchNode
+            return true if parent.predicate.equal?(node)
+          when Prism::WhenNode, Prism::InNode
+            return true unless parent.statements.equal?(node)
+          when Prism::WhileNode, Prism::UntilNode, Prism::EnsureNode
+            return !parent.statements.equal?(node)
+          when Prism::ElseNode, Prism::BeginNode, Prism::ParenthesesNode, Prism::ProgramNode, Prism::RescueNode
+            nil
+          else
+            return true
+          end
+          node = parent
+          index -= 1
+        end
+        false
+      end
+    end
+  end
+end