rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/external_ancestor_resolution.rb

@@ -28,13 +28,12 @@ module Rigor
     # a flag threaded into `Scope`: an ADR-2 plugin-facing bypass of dependency recording would produce
     # a silently stale warm cache that no diagnostic diff can show.
     #
-    # There is deliberately NO memo here. The dispatch consumer this module is being extracted FOR does
-    # not exist yet, and a memo keyed on the tables this slice happens to name would be keyed on less
+    # There is deliberately NO memo here. A memo keyed on the tables the walk names would be keyed on less
     # than the walk reads — the ancestor chain resolves names through `known_user_class?`
     # (`discovered_def_nodes`, `discovered_methods`) and `ancestor_name_candidates`
     # (`discovered_header_nestings`). The chain itself is memoised per discovery index
-    # ({Scope::ResolutionChain}); the slice that brings the hot path brings this module's memo, keyed on
-    # what that consumer actually reads.
+    # ({Scope::ResolutionChain}); the dispatch callers in {MethodDispatcher::RbsDispatch} memoise their
+    # own answers, keyed on what they read.
     module ExternalAncestorResolution
       # The owner a name must PRECEDE for its declaration to win an MRO. See {declared_before_object?}.
       OBJECT_OWNER = "Object"

data/lib/rigor/inference/flow_tracer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../typing_state"
+
 module Rigor
   module Inference
     # Thread-local event recorder behind `rigor trace`: while a block runs under {record}, the inference engine
@@ -13,8 +15,14 @@ module Rigor
     # hot paths (`ExpressionTyper#type_of`, `Scope#with_local`, `Type::Combinator.union`, `MethodDispatcher.dispatch`)
     # each guard their emit behind {active?}, so a normal (non-tracing) run pays one integer comparison.
     module FlowTracer
-      KEY = :__rigor_flow_tracer__
-      private_constant :KEY
+      # ADR-129 WD1 — the installed recorder is a Frame whose contents are a Resource: each emit into it touches. It is
+      # an output the engine never reads back, and the activation count below is a process switch, outside the typing
+      # state (WD5). G1′: a tracer switch, under which the `type_of` memo stays shut (WD4).
+      RECORDER = TypingState.frame(
+        :flow_tracer, contents: :resource, reason: "the recorder a trace installs; each emit records into it",
+                      memo_shut_while_installed: true
+      )
+      private_constant :RECORDER
 
       # One animation-relevant moment.
       #
@@ -95,15 +103,16 @@ module Rigor
       # Activates recording on the current thread for the duration of the block and returns the frozen event list.
       # Nests safely; restores the previous recorder on exit.
       def record
-        previous = Thread.current[KEY]
         recorder = Recorder.new
-        Thread.current[KEY] = recorder
-        @mutex.synchronize { @active_count += 1 }
-        yield
-        recorder.events.freeze
-      ensure
-        Thread.current[KEY] = previous
-        @mutex.synchronize { @active_count -= 1 }
+        TypingState.current.with(RECORDER, recorder) do
+          @mutex.synchronize { @active_count += 1 }
+          begin
+            yield
+            recorder.events.freeze
+          ensure
+            @mutex.synchronize { @active_count -= 1 }
+          end
+        end
       end
 
       # Plain integer read (GVL-atomic) — the disabled fast path.
@@ -114,20 +123,28 @@ module Rigor
       # Brackets one expression-typing recursion. Falls through to the bare block when the current thread is not
       # recording (another thread may have flipped {active?}).
       def trace_node(node, &)
-        recorder = Thread.current[KEY]
+        recorder = recording
         return yield unless recorder
 
         recorder.node(node, &)
       end
 
+      # The recorder installed on this thread, touched because the caller is about to record into it, or nil.
+      def recording
+        state = TypingState.current
+        recorder = state[RECORDER]
+        state.touch(RECORDER) if recorder
+        recorder
+      end
+
       # `Scope#with_local` — the moment a local enters the scope.
       def bind(name, type)
-        Thread.current[KEY]&.emit(:bind, data: { name: name.to_s, type: describe(type) })
+        recording&.emit(:bind, data: { name: name.to_s, type: describe(type) })
       end
 
       # `Type::Combinator.union` — the moment branch types merge (including degenerate collapses like `1 | 1 → 1`).
       def union(members, result)
-        Thread.current[KEY]&.emit(
+        recording&.emit(
           :union,
           data: { members: members.map { |m| describe(m) }.freeze, type: describe(result) }
         )
@@ -136,7 +153,7 @@ module Rigor
       # `MethodDispatcher.dispatch` — resolution or the fail-soft `nil` ("no rule matched"; the caller will widen
       # to `Dynamic[Top]`).
       def dispatch(receiver:, method_name:, args:, result:, location: nil)
-        recorder = Thread.current[KEY]
+        recorder = recording
         return unless recorder
 
         recorder.emit(

data/lib/rigor/inference/fork_map.rb

@@ -3,6 +3,7 @@
 require "tmpdir"
 
 require_relative "../runtime/jit"
+require_relative "../type_of_memo"
 
 module Rigor
   module Inference
@@ -95,6 +96,7 @@ module Rigor
           # what is left of the parent's window rather than a fresh one; {Runtime::Jit.rearm_after_fork}
           # carries the mechanism.
           Runtime::Jit.rearm_after_fork
+          TypeOfMemo.forked
           # Published before the block runs, so anything it lazily creates for this process alone lands in the
           # parent's tmpdir and dies with it. See {.child_scratch_dir}.
           @child_scratch_dir = File.dirname(out_path)
@@ -105,6 +107,7 @@ module Rigor
         ensure
           @child_scratch_dir = nil
         end
+        TypeOfMemo.write_report
         exit!(status)
       end
 

data/lib/rigor/inference/fresh_frame_blocks.rb

@@ -23,7 +23,8 @@ module Rigor
     #   what it reads. Unlike a root block it shares that slot, so a match in it still rebinds the definer's `$~`.
     #
     # `Enumerator.new` is neither: its block runs on an internal fiber whose root is not the block, so it reads and
-    # rebinds the creator's slot like any other block.
+    # rebinds the creator's slot. It reads that slot when the enumerator is read, though, not where the block is
+    # written ({.deferred_body?}, issue #3195).
     #
     # The receiver of a root call must be the literal constant, and must resolve to the core class where a scope is
     # at hand, so a project's own `Thread` (`module Pool; class Thread; …`) keeps the ordinary block rules.
@@ -115,6 +116,56 @@ module Rigor
         scope.forget_error_info.forget_last_status
       end
 
+      # The core constructors that keep their block and run it on a schedule of their own: an enumerator's generator
+      # runs when the enumerator is first read, and a hash's default proc on a missing key.
+      DEFERRED_CONSTRUCTORS = Set[:Enumerator, :Hash].freeze
+      private_constant :DEFERRED_CONSTRUCTORS
+
+      # Issue #1371, #3195 — true when `block_node` is a body that runs later than where it is written, on the slot of
+      # the frame that wrote it: a proc's ({.proc_body?}), or the block of `Enumerator.new` or `Hash.new` on the core
+      # class ({.deferred_constructor?}). Such a body runs whenever the proc is called, the enumerator is read or a
+      # key is missing, so the frame-local specials narrowed where it is written prove nothing about the slot it
+      # reads then. It enters with `$_` unbound ({LastLine.block_entry}), and with the match globals as
+      # {MatchRebinding.block_entry} gives each kind. It still shares the slot, so a match or a reader it runs
+      # rebinds the frame's as any block's does. The other calls that keep their block ({StoredBlockCall}) are a
+      # definer's or a root's ({.entry}).
+      def deferred_body?(block_node, call_node, scope)
+        proc_body?(block_node, call_node, scope) || deferred_constructor?(block_node, call_node, scope)
+      end
+
+      # Issue #1371 — true when `block_node` is the body of a proc made where it is written: a lambda literal, or the
+      # block of Kernel's `lambda` / `proc` or of `Proc.new` on the core class. It enters with the match globals
+      # unbound; a project's own `Proc` keeps the ordinary entry.
+      # Only a lambda literal the statement evaluator enters gets this entry: one written as an operand is typed as a
+      # value, and the rule walker reads its body in the enclosing scope.
+      def proc_body?(block_node, call_node, scope)
+        return true if block_node.is_a?(Prism::LambdaNode)
+        return false unless call_node.is_a?(Prism::CallNode) && call_node.block.equal?(block_node)
+
+        receiver = call_node.receiver
+        case call_node.name
+        when :lambda, :proc then StoredBlockCall.kernel_spelled?(receiver)
+        when :new then StoredBlockCall.root_constant_name(receiver) == :Proc && core_class?(receiver, :Proc, scope)
+        else false
+        end
+      end
+
+      # Issue #3195 — true when `block_node` is the block of `Enumerator.new` or `Hash.new` on the literal constant
+      # naming the core class. The block often runs right away, in the statement that makes it
+      # (`Enumerator.new { … }.to_a`, `Hash.new { … }[key]`), and reads the narrowing then; it may as well run after a
+      # later match. The analyzer does not follow which, so the body enters with a narrowed match global untyped, as
+      # a definer body does ({.entry}): neither narrowed nor flagged. A project's own `Enumerator` or `Hash` keeps
+      # the ordinary entry, and so does every other spelling of the core class: a subclass (`Class.new(Hash)`), an
+      # alias (`E = Enumerator`), `Object::Enumerator`, or a receiver that is not a constant (`klass.new { … }`).
+      def deferred_constructor?(block_node, call_node, scope)
+        return false unless call_node.is_a?(Prism::CallNode) && call_node.name == :new &&
+                            call_node.block.equal?(block_node)
+
+        receiver = call_node.receiver
+        constant = StoredBlockCall.root_constant_name(receiver)
+        DEFERRED_CONSTRUCTORS.include?(constant) && core_class?(receiver, constant, scope)
+      end
+
       def core_class?(receiver, constant, scope)
         type = scope.type_of(receiver)
         type.is_a?(Type::Singleton) && type.class_name == constant.name

data/lib/rigor/inference/global_write_census.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../source/constant_path"
 require_relative "../source/node_children"
 require_relative "ivar_writer_census"
+require_relative "stored_block_call"
 
 module Rigor
   module Inference
@@ -28,7 +29,15 @@ module Rigor
     # - `[:main_mixin, name]` — a module a top-level `include`, `prepend` or `extend` mixes into `Object` (or
     #   `main`), as written. A module RBS does not know may carry any method, so it reaches every class.
     # - the instance-variable writer entries of {IvarWriterCensus} (issue #1154): `[:ivar_set, name]`,
-    #   `[:ivar_set_class, class_name]` and `[:own_write, class_name, name, path]`.
+    #   `[:ivar_set_class, class_name]`, `[:own_write, class_name, name, path]`, issue #2079's
+    #   `[:own_write_type, class_name, name, value, path]` and issue #2983's `[:binds_class, class_key, constant]`.
+    # - `[:global_writer, name, method]` — issue #2314: a write of the global `name` inside a method body, keyed by
+    #   the `def`'s name (or the literal name a `define_method` block defines), or by nil inside a lambda or a block
+    #   its call keeps to run later ({StoredBlockCall}). A write in a block its call runs at once belongs to the
+    #   enclosing body. A write at the top level or in a class body records nothing, and neither does a write of
+    #   the frame-local `$_` or `$~`. {GlobalWriterReach} reads these.
+    # - `[:method_alias, new, old]` — issue #2314: `alias new old`, `alias_method :new, :old` or `def_delegator
+    #   :@o, :old, :new`, whose new name runs a method named old. {GlobalWriterReach} follows it.
     #
     # The census is a `Set` of those frozen entries, merged by union across files, the project pre-pass and the
     # `pre_eval:` files. It is recorded inside descents that already visit every node ({Collector#visit}), never
@@ -78,7 +87,7 @@ module Rigor
       end
 
       # #1154 — the {IvarWriterCensus} entries of `census`, for the incremental diff and its readers.
-      IVAR_KINDS = %i[ivar_set ivar_set_class own_write].to_set.freeze
+      IVAR_KINDS = %i[ivar_set ivar_set_class own_write own_write_type binds_class].to_set.freeze
 
       def ivar_set_entries(census) = census.select { |entry| IVAR_KINDS.include?(entry.first) }.to_set
 
@@ -87,6 +96,8 @@ module Rigor
         case entry.first
         when :ivar_set then "ivar_set:#{entry[1]}"
         when :ivar_set_class then "ivar_set_class:#{entry[1]}"
+        when :own_write_type then "own_write_type:#{entry[1]}##{entry[2]}"
+        when :binds_class then "binds_class:#{entry[1].split(CensusForeignBlock::CANDIDATE_SEPARATOR).last.split('::').last}"
         else "own_write:#{entry[1]}##{entry[2]}"
         end
       end
@@ -140,14 +151,17 @@ module Rigor
           @refine_ranges = []
           @ivar_writers = IvarWriterCensus.new(@census)
           @in_effect = in_effect
+          @bodies = []
         end
 
         # A node the collector cannot read must not fail the analysis of its file, nor of every file the pre-pass
         # feeds: the census then counts it as a definition of every name, which only declines a report.
         # `owner` is the qualified name of the class whose body the node sits in, for {IvarWriterCensus} (nil where
-        # the host walk does not track it, or no class owns an instance there).
-        def visit(node, top_level:, owner: nil)
-          @ivar_writers.visit(node, owner)
+        # the host walk does not track it, or no class owns an instance there); `receiver_owner` the class an
+        # explicit-receiver writer call names (issue #2488).
+        def visit(node, top_level:, owner: nil, receiver_owner: nil)
+          @ivar_writers.visit(node, owner, receiver_owner)
+          visit_global_writer(node)
           case node
           when Prism::AliasGlobalVariableNode then visit_global_alias(node)
           when Prism::DefNode then record(node, node.name)
@@ -160,6 +174,68 @@ module Rigor
 
         private
 
+        # Issue #2314 — tracks the method bodies, lambdas and stored blocks of a pre-order descent as flat
+        # `start, end, label` triples (`@bodies`, innermost last), and records a global write inside one
+        # ({GlobalWriterReach}). A body ending before the write starts is closed. Only those nodes read their location.
+        def visit_global_writer(node)
+          case node
+          when Prism::DefNode then open_body(node, node.name)
+          when Prism::LambdaNode then open_body(node, nil)
+          when Prism::AliasMethodNode then record_method_alias(node.new_name, node.old_name)
+          when Prism::CallNode
+            open_stored_block(node)
+            visit_alias_call(node)
+          when Prism::GlobalVariableWriteNode, Prism::GlobalVariableOrWriteNode, Prism::GlobalVariableAndWriteNode,
+               Prism::GlobalVariableOperatorWriteNode, Prism::GlobalVariableTargetNode
+            record_global_writer(node)
+          end
+        end
+
+        # `$_` and `$~` are the frame's own: a method's write to one never reaches its caller.
+        FRAME_LOCAL_GLOBALS = %i[$_ $~].freeze
+        private_constant :FRAME_LOCAL_GLOBALS
+
+        def record_global_writer(node)
+          return if FRAME_LOCAL_GLOBALS.include?(node.name)
+
+          start = node.location.start_offset
+          bodies = @bodies
+          bodies.pop(3) while !bodies.empty? && bodies[-2] <= start
+          index = bodies.size - 3
+          index -= 3 while index >= 0 && !(bodies[index] <= start && start < bodies[index + 1])
+          @census << [:global_writer, node.name, bodies[index + 2]].freeze if index >= 0
+        end
+
+        def open_body(node, label)
+          location = node.location
+          @bodies.push(location.start_offset, location.end_offset, label)
+        end
+
+        # `alias_method :new, :old`, and `def_delegator :@o, :old, :new` (and its instance and single spellings), whose
+        # new name runs a method of the old name.
+        def visit_alias_call(node)
+          arguments = node.arguments&.arguments
+          case node.name
+          when :alias_method then record_method_alias(arguments[0], arguments[1]) if arguments&.size == 2
+          when :def_delegator, :def_instance_delegator, :def_single_delegator
+            record_method_alias(arguments[2], arguments[1]) if arguments&.size == 3
+          end
+        end
+
+        def record_method_alias(new_node, old_node)
+          new_name = literal_name(new_node)
+          old_name = literal_name(old_node)
+          @census << [:method_alias, new_name, old_name].freeze if new_name && old_name && new_name != old_name
+        end
+
+        def open_stored_block(node)
+          block = node.block
+          return unless block.is_a?(Prism::BlockNode) && StoredBlockCall.stores_block?(node)
+
+          definer = %i[define_method define_singleton_method].include?(node.name)
+          open_body(block, definer ? literal_name(node.arguments&.arguments&.first) : nil)
+        end
+
         def visit_global_alias(node)
           [node.new_name, node.old_name].each do |side|
             @census << GlobalWriteCensus.alias_entry(side.name) if side.is_a?(Prism::GlobalVariableReadNode)

data/lib/rigor/inference/global_writer_reach.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../analysis/dependency_recorder"
+require_relative "../source/node_children"
+require_relative "../type"
+require_relative "guard_rebinding"
+require_relative "project_method_ownership"
+
+module Rigor
+  module Inference
+    # Issue #2314 — whether running a node may reach a project method that writes a given global. Both places that
+    # end a global's binding at a call ask it: the statement walk past a statement call
+    # (`StatementEvaluator#forget_reached_globals`), and a `case` whose global subject a `when` test may rebind
+    # (`StatementEvaluator#when_test_rebinds_subject?`, issue #2211), so the two read a global alike.
+    #
+    # The writers come from {GlobalWriteCensus}: a `[:global_writer, name, method]` entry for each write of `name`
+    # inside a method body (`method` is the `def`'s name, or the literal name a `define_method` block defines), and
+    # `[:global_writer, name, nil]` for one inside a lambda or a block a call keeps to run later
+    # ({StoredBlockCall}), which any call may run. A write at the top level or in a class body runs where it is
+    # written, so no call reaches it.
+    #
+    # {.may_write?} answers true when the global has a writer and:
+    #
+    # - the node may run code other than Ruby core and the standard library ({GuardRebinding.may_rebind?}, the
+    #   question #2260 asked of a `when` test), and
+    # - some writer is anonymous, or the node's own call has a receiver no target resolves (a `Dynamic` value), or a
+    #   search by method name reaches a writer ({Search}).
+    #
+    # The search reads method names, not receivers: from the node it follows every call, by name, into every project
+    # `def` of that name on any class, transitively, and reaches a writer when it meets a call named after one. A
+    # call naming its method by a computed value (`send(name)`, `eval(code)`) reaches. A name no project `def` defines
+    # follows `method_missing`, `new` follows `initialize`, and an alias name (`alias`, `alias_method`, a
+    # `def_delegator` alias) follows the name it stands for. A nested `def` is not read, since defining a method runs
+    # nothing. Past {Search::DEF_BUDGET} bodies the search answers that it reaches. A `define_method` method that calls
+    # a writer is not followed (only its own writes count), and a method core code calls back without the program
+    # spelling it (`puts obj` runs `obj.to_s`) is read as the core method alone, as {GuardRebinding} reads it.
+    module GlobalWriterReach
+      EMPTY = Set.new.freeze
+
+      module_function
+
+      # The globals `scope` binds that some project method may write, other than one already `Dynamic[top]`. Each
+      # bound global's census key is recorded whatever the answer, so a file that starts writing one re-checks.
+      def candidates(scope)
+        table = writer_table(scope)
+        globals = scope.globals
+        globals.each_key { |name| record_writers(name) } if Analysis::DependencyRecorder.active?
+        return EMPTY if table.empty? || globals.empty?
+
+        table.each_key.select do |name|
+          type = globals[name]
+          !type.nil? && !type.is_a?(Type::Dynamic)
+        end
+      end
+
+      # True when running `node`, typed in `scope`, may reach a project method that writes `name` (see the module
+      # comment).
+      def may_write?(node, name, scope)
+        writers = writers(scope, name)
+        return false if writers.empty?
+        return false unless GuardRebinding.may_rebind?(node, scope)
+        return true if writers.include?(nil) || unresolved_call?(node, scope)
+
+        Search.new(scope, writers).reaches?(node)
+      end
+
+      # The method names that write `name` (nil for an anonymous writer). Records the census key, so a file that
+      # starts or stops writing the global re-checks the reader. A guard on the `case` site: every `when` test built so
+      # far also records the key through a statement call's {.candidates} or a callee's method edge.
+      def writers(scope, name)
+        record_writers(name) if Analysis::DependencyRecorder.active?
+        writer_table(scope)[name] || EMPTY
+      end
+
+      def record_writers(name)
+        Analysis::DependencyRecorder.read_name(:global_census, "global_writer:#{name}")
+      end
+
+      # `{ global => Set[method name or nil] }` over the project's census and the `pre_eval:` files' own.
+      def writer_table(scope) = census_tables(scope).first
+
+      # `{ alias name => Set[the method names it stands for] }`: an `alias`, an `alias_method` or a `def_delegator`
+      # with a literal alias name, from the same census.
+      def alias_table(scope) = census_tables(scope).last
+
+      # The two tables above, kept for the census objects they were built from.
+      def census_tables(scope)
+        census = scope.discovered_global_write_census
+        pre_eval = scope.environment&.project_patched_methods&.write_census
+        cached = @census_tables
+        return cached[2] if cached && cached[0].equal?(census) && cached[1].equal?(pre_eval)
+
+        tables = build_tables([census, pre_eval])
+        @census_tables = [census, pre_eval, tables.freeze]
+        tables
+      end
+
+      TABLE_KINDS = { global_writer: 0, method_alias: 1 }.freeze
+      private_constant :TABLE_KINDS
+
+      def build_tables(censuses)
+        tables = [{}, {}]
+        censuses.each do |entries|
+          entries&.each do |kind, key, value|
+            index = TABLE_KINDS[kind]
+            (tables[index][key] ||= Set.new) << value if index
+          end
+        end
+        tables.each { |table| table.each_value(&:freeze).freeze }
+      end
+
+      # True when `node` is a call whose receiver no target resolves: the method it runs may be any.
+      def unresolved_call?(node, scope)
+        return false unless node.is_a?(Prism::CallNode)
+
+        receiver = node.receiver
+        return false if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+        targets = ProjectMethodOwnership.targets(GuardRebinding::ScanScope.dispatch_type(receiver, scope))
+        targets.nil? || targets.empty?
+      rescue StandardError
+        true
+      end
+
+      # `{ method name => [[class name, kind], …] }` over the project's `def` tables, kept for the tables it was
+      # built from.
+      def def_index(scope)
+        instance = scope.discovered_def_nodes
+        singleton = scope.discovered_singleton_def_nodes
+        cached = @def_index
+        return cached[2] if cached && cached[0].equal?(instance) && cached[1].equal?(singleton)
+
+        index = {}
+        { instance: instance, singleton: singleton }.each do |kind, table|
+          table.each do |class_name, methods|
+            methods.each_key { |method_name| (index[method_name] ||= []) << [class_name, kind] }
+          end
+        end
+        @def_index = [instance, singleton, index.freeze]
+        index
+      end
+
+      # A breadth-first search by method name from a node to a writer's name.
+      class Search
+        # The most `def` bodies one search reads before it answers that it reaches.
+        DEF_BUDGET = 64
+        SEND_CALLS = %i[send __send__ public_send method public_method instance_method].to_set.freeze
+        CODE_CALLS = %i[eval instance_eval instance_exec class_eval class_exec module_eval module_exec].to_set.freeze
+
+        class Reached < StandardError
+        end
+
+        def initialize(scope, writers)
+          @scope = scope
+          @writers = writers
+          @aliases = GlobalWriterReach.alias_table(scope)
+          @recording = Analysis::DependencyRecorder.active?
+          @seen = Set.new
+          @queue = []
+          @read = 0
+        end
+
+        def reaches?(node)
+          scan(node)
+          until @queue.empty?
+            name = @queue.shift
+            definitions = definitions_of(name)
+            enqueue(:method_missing) if definitions.empty?
+            definitions.each { |definition| read_def(definition) }
+          end
+          false
+        rescue Reached
+          true
+        end
+
+        private
+
+        def read_def(definition)
+          @read += 1
+          reached! if @read > DEF_BUDGET
+          scan(definition.parameters)
+          scan(definition.body)
+        end
+
+        def definitions_of(name)
+          Analysis::DependencyRecorder.read_name(:defines, name) if Analysis::DependencyRecorder.active?
+          targets = GlobalWriterReach.def_index(@scope)[name] || []
+          targets.filter_map do |class_name, kind|
+            kind == :singleton ? @scope.singleton_def_for(class_name, name) : @scope.user_def_for(class_name, name)
+          end
+        end
+
+        def scan(node)
+          return unless node.is_a?(Prism::Node)
+          # A nested `def` defines a method; it runs nothing here, and its name is followed where it is called.
+          return if node.is_a?(Prism::DefNode)
+
+          case node
+          when Prism::CallNode then scan_call(node)
+          when Prism::BlockArgumentNode then scan_block_argument(node)
+          when Prism::ForNode then enqueue(:each)
+          end
+          implicit_names(node).each { |name| enqueue(name) }
+          node.rigor_each_child { |child| scan(child) }
+        end
+
+        def scan_call(node)
+          enqueue(node.name)
+          # `new` runs the class's `initialize`.
+          enqueue(:initialize) if node.name == :new
+          arguments = node.arguments&.arguments || []
+          if SEND_CALLS.include?(node.name)
+            name = literal_name(arguments.first)
+            name ? enqueue(name) : reached!
+          elsif CODE_CALLS.include?(node.name) && !(arguments.empty? && node.block.is_a?(Prism::BlockNode))
+            reached!
+          end
+        end
+
+        def scan_block_argument(node)
+          name = literal_name(node.expression)
+          enqueue(name) if name
+        end
+
+        # The methods an operator or compound write calls without spelling them.
+        def implicit_names(node)
+          names = []
+          names << node.binary_operator if node.respond_to?(:binary_operator)
+          names.push(node.read_name, node.write_name) if node.respond_to?(:read_name) && node.respond_to?(:write_name)
+          names
+        end
+
+        def enqueue(name)
+          return if name.nil? || @seen.include?(name)
+
+          reached! if @writers.include?(name)
+          @seen << name
+          @queue << name
+          # An alias runs the method it names.
+          Analysis::DependencyRecorder.read_name(:global_census, "method_alias:#{name}") if @recording
+          @aliases[name]&.each { |original| enqueue(original) }
+        end
+
+        def literal_name(node)
+          return unless node.is_a?(Prism::SymbolNode) || node.is_a?(Prism::StringNode)
+
+          text = node.unescaped
+          text.to_sym if text.valid_encoding?
+        end
+
+        def reached!
+          raise Reached
+        end
+      end
+      private_constant :Search
+    end
+  end
+end

data/lib/rigor/inference/hkt_body.rb

@@ -41,8 +41,7 @@ module Rigor
 
       # Reference to a formal parameter the enclosing `Definition#params` declared. The reducer
       # substitutes this node with the matching positional arg from the `App` being reduced; an
-      # unknown name raises during reduction (the parser, when it ships, MUST reject unknown names
-      # earlier).
+      # unknown name raises during reduction.
       Param = Data.define(:name) do
         def initialize(name:)
           raise ArgumentError, "name must be a Symbol, got #{name.class}" unless name.is_a?(Symbol)

data/lib/rigor/inference/hkt_body_parser.rb

@@ -43,7 +43,7 @@ module Rigor
     # `Rigor::Type::*` carrier: `nil` / `true` / `false` produce `Constant` carriers; `bool`
     # produces the `Constant<true> | Constant<false>` union; `untyped` produces
     # `Combinator.untyped` (i.e. `Dynamic[Top]`). Nominal class names produce raw `Type::Nominal`
-    # carriers (no `name_scope` resolution at this slice — the reducer trusts the name verbatim).
+    # carriers (no `name_scope` resolution; the reducer trusts the name verbatim).
     module HktBodyParser
       class ParseError < StandardError; end
 
@@ -151,10 +151,8 @@ module Rigor
         #     test        := type_expr ("<:" | "==") type_expr
         #
         # Parens delimit a conditional unambiguously — bare `(type_expr)` grouping is not
-        # supported at this slice (no use case yet). Branches can be unions; test sides are
-        # single arms (wrap in `App[my_union, ...]` if you need a union there). `in [opt1, opt2]`
-        # membership tests are programmatically supported via `HktBody::TestMembership` but the
-        # parser does not yet recognise the `in` keyword (no concrete demand yet).
+        # supported (no use case yet). Branches can be unions; test sides are single arms (wrap
+        # in `App[my_union, ...]` if you need a union there).
         def parse_conditional
           expect!(:lparen)
           test = parse_test

data/lib/rigor/inference/hkt_reducer.rb

@@ -152,8 +152,8 @@ module Rigor
       def subtype_verdict(left, right)
         return :yes if left == right
 
-        # Both Nominals with different class names AND neither carries Dynamic — `:no`
-        # (statically disjoint). For any other shape pair, `:maybe`.
+        # Two Nominals of different class names are statically disjoint (`:no`); any other shape
+        # pair is `:maybe`.
         return :no if disjoint_nominals?(left, right)
         return :no if disjoint_constants?(left, right)
 

data/lib/rigor/inference/hkt_registry.rb

@@ -9,11 +9,9 @@ module Rigor
     # annotations in shipped `.rbs` files.
     #
     # The registry stores registration metadata (arity, variance, bound) and the definition body
-    # as both a raw String and an evaluable `HktBody` node tree. `HktReducer` (Slice 2a) and
-    # `HktBodyParser` (Slice 2b) are both shipped and reduce `Type::App` instances against the
-    # definition. The carrier never needs to read from the registry because Slice 1's `Type::App`
-    # carries its `bound` directly; the registry exists at this slice solely so the parser
-    # round-trip and downstream slices have a stable target API.
+    # as both a raw String and an evaluable `HktBody` node tree. `HktReducer` and `HktBodyParser`
+    # reduce `Type::App` instances against the definition. The carrier never needs to read from the
+    # registry because `Type::App` carries its `bound` directly.
     #
     # The registry is immutable after construction. Callers that need to extend it (e.g. plugin
     # registrations layered on top of stdlib registrations) MUST build a new registry via `merge`