rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/in_effect_refinements.rb

@@ -6,6 +6,7 @@ require_relative "../source/constant_path"
 require_relative "../source/node_children"
 require_relative "refine_census"
 require_relative "refine_self"
+require_relative "../typing_state"
 require_relative "in_effect_refinements/proc_literals"
 require_relative "in_effect_refinements/scope_reads"
 require_relative "in_effect_refinements/refine_defs"
@@ -53,6 +54,12 @@ module Rigor
     #
     # Built lazily: the walk runs the first time a consumer asks, so a file nobody asks about pays one small object.
     class InEffectRefinements
+      # ADR-129 G4 — {#build} fills every one of these once, from the file's root node alone.
+      TypingState.memo_field(self, :@built, :@activations, :@refinement_defs, :@refine_defs, :@chained_refined_calls,
+                             :@class_body_refines, :@refine_contexts, :@literal_bindings, :@refine_offsets,
+                             :@unresolved_using, :@nesting,
+                             reason: "built once by #build from the file's root node alone")
+
       # The marker an activation contributes when it may put any refinement in effect: a non-constant `using`, a
       # `using` whose include expansion is unknown, or a `refine` block whose module this walk cannot name. A list
       # that carries it answers "any refinement may be in effect"; its position carries no meaning.

data/lib/rigor/inference/indexed_narrowing.rb

@@ -9,8 +9,7 @@ require_relative "unknown_store_widening"
 module Rigor
   module Inference
     # Closes the "`params[:f] ||= []; params[:f] << x`" precision gap surfaced by the Redmine
-    # 6.1.2 `Query#as_params` survey (ROADMAP § Future cycles / Type-language / engine —
-    # "Indexed-collection narrowing through `Hash[k] ||= default`").
+    # 6.1.2 `Query#as_params` survey.
     #
     # After `receiver[key] ||= default` the next read at `receiver[key]` is known non-nil, but
     # Rigor types each `Hash#[]` independently and the subsequent `<<` / `[]=` / other mutator
@@ -34,8 +33,10 @@ module Rigor
     #
     # **Invalidation.** Three conditions drop a recorded narrowing:
     # - The receiver variable is rebound (handled inside `Scope#with_local` / `Scope#with_ivar`).
-    # - An intervening `receiver[key] = value` writes the same slot — `:[]=` could rebind the
-    #   slot to nil; conservative drop.
+    # - An intervening store writes the same slot — `receiver[key] = value`, an index target, or a
+    #   compound `receiver[key] op= value` / `&&=` (issue #1218) — since it could rebind the slot to
+    #   nil; conservative drop. A store whose index is not one literal key drops every narrowing
+    #   on the receiver.
     # - An intervening mutator from {MutationWidening::SHAPE_MUTATORS} runs against the receiver
     #   (e.g. `params.delete(:f)`, `params.clear`, `params.default = 0`, `buf.delete_prefix!("x")`).
     #
@@ -139,14 +140,61 @@ module Rigor
         MutationWidening::SHAPE_MUTATORS.include?(method_name)
       end
 
-      def invalidate_indexed_write(call_node, current_scope)
-        args = call_node.arguments&.arguments
-        return current_scope if args.nil? || args.empty?
+      # Drops the narrowing on the slot a store through `[]=` overwrote. `node` is the `[]=` call, an index target
+      # (a multi-assign slot, a `for` index, a rescue reference) or a compound index write (`h[k] += v`,
+      # `h[k] &&= v`, `h[k] ||= v`); every form reads only `receiver` and `arguments`, and only a `[]=` call's last
+      # argument is the stored value rather than an index.
+      #
+      # Issue #1218 — a literal single index drops that one slot and leaves the others. Any other index list on a
+      # stable receiver — a key that is not a literal (`h[k] = 1` may be `h[:e] = 1`), a multi-index splice
+      # (`s[0, 1] = [1, 2]` shifts every later slot), a splat — may write any slot, so it drops every narrowing on
+      # the receiver, as {.invalidate_mutator} does. So does a negative Integer index on a receiver not shown to be a
+      # `Hash`: on an `Array` `a[-1]` is the slot some non-negative index also names. An unstable receiver records
+      # no narrowing to drop.
+      def invalidate_indexed_write(node, current_scope)
+        receiver = stable_receiver(node.receiver)
+        return current_scope if receiver.nil?
 
-        address = stable_address(call_node.receiver, args.first)
-        return current_scope if address.nil?
+        indexes = index_arguments(node)
+        address = indexes.size == 1 ? stable_address(node.receiver, indexes.first) : nil
+        if address && !(negative_index?(address.last) && !hash_receiver?(current_scope.type_of(node.receiver)))
+          return current_scope.without_indexed_narrowing(*address)
+        end
+
+        current_scope.without_indexed_narrowings_for(*receiver)
+      end
+
+      # Whether the literal `key` may name the same slot as another literal key: a negative Integer, unless the
+      # receiver is a `Hash`, which tells `-1` from every other key.
+      def aliasing_index?(key, receiver_type)
+        negative_index?(key) && !hash_receiver?(receiver_type)
+      end
+
+      def negative_index?(key) = key.is_a?(Integer) && key.negative?
+
+      def hash_receiver?(receiver_type) = carrier_receiver_type?(receiver_type, HASH_CARRIER)
+
+      VERBATIM_STORE_CARRIERS = %w[Hash Array].freeze
+      HASH_CARRIER = %w[Hash].freeze
+      private_constant :VERBATIM_STORE_CARRIERS, :HASH_CARRIER
+
+      # Whether a store through `[]=` on a receiver of `receiver_type` at the literal `key` leaves exactly the stored
+      # value at that slot, so a recorded narrowing may claim it. Only a `Hash` or `Array` carrier (a shape, a tuple,
+      # a `Hash` / `Array` nominal, refined or not) does, for every member of a union. A `String`'s `[]=` splices
+      # (`s[0] = "xy"` leaves `s[0] == "x"`), and a project class's `[]=` may store anything. A negative Integer key
+      # aliases a non-negative one on an `Array` ({.aliasing_index?}), so it records only on a `Hash`.
+      def verbatim_slot?(receiver_type, key)
+        carrier_receiver_type?(receiver_type, VERBATIM_STORE_CARRIERS) && !aliasing_index?(key, receiver_type)
+      end
+
+      def carrier_receiver_type?(type, classes)
+        members = type.is_a?(Type::Union) ? type.members : [type]
+        members.all? { |member| classes.include?(UnknownStoreWidening.carrier_class(member)) }
+      end
 
-        current_scope.without_indexed_narrowing(*address)
+      def index_arguments(node)
+        args = node.arguments&.arguments || []
+        node.is_a?(Prism::CallNode) ? args[0...-1] : args
       end
 
       def invalidate_mutator(call_node, current_scope)
@@ -206,11 +254,9 @@ module Rigor
         args&.size == 1 ? stable_address(node.receiver, args.first) : nil
       end
 
-      # Companion invalidator for single-hop method-chain narrowings (ROADMAP § Future cycles —
-      # "Method-call receiver narrowing across stable receivers", B2 from the slice's design
-      # notes). Drops every `(receiver, *)` chain narrowing rooted at the call's OUTER stable
-      # receiver — matching the ROADMAP's "any intervening method call against the same
-      # receiver" criterion. A call against `x.last` (the OUTER receiver is a `CallNode`, not a
+      # Companion invalidator for single-hop method-chain narrowings. Drops every `(receiver, *)`
+      # chain narrowing rooted at the call's OUTER stable receiver, for any intervening method call
+      # against the same receiver. A call against `x.last` (the OUTER receiver is a `CallNode`, not a
       # stable root) does NOT drop narrowings keyed on `x`, so the worked-site `x.last << y`
       # pattern correctly preserves the chain narrowing for any further `x.last` read in the same
       # body. Always-safe (only forgets; never invents).

data/lib/rigor/inference/intervening_ivar_reset.rb

@@ -19,8 +19,8 @@ module Rigor
     # the calls in a condition operand, where a narrowing an earlier operand or clause made would otherwise survive
     # them: `if @x.nil? && reset!` read `@x` as `nil` in the body although `reset!` assigns it.
     module InterveningIvarReset
-      # Nodes whose body does not run where it is written, or runs on another `self`: a `def`, and a class or
-      # module body, where `@x` is the class's own instance variable.
+      # Nodes whose body does not run where it is written, or runs on another `self`: a `def`, and a class,
+      # module or `class << …` body, where `@x` is the class's own instance variable.
       NON_RUNNING_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
       # Issue #1402 — the nodes that run code the program does not show on `self`'s behalf: `yield` runs the
       # method's block, and `super` the superclass's method on `self`.
@@ -180,12 +180,17 @@ module Rigor
       # takes the mark when widened, so a `nil` only the seed brings back is not fuel for
       # `call.possible-nil-receiver` (ADR-58), as a declared one is not. A narrowing that kept `nil`
       # (`return if @tag`, `@tag.nil?`) widens unmarked, so a read the program really makes on `nil` still reports.
-      def widen(scope, mark: false)
+      # Issue #2039 — `mark: :unproven` marks as `mark: true` does only when the block answers nil (no write set is
+      # proven) and `direct_writes` (called at most once, answering a `Set`) does not name the variable: a call
+      # proven to write it, or whose callee visibly assigns it a possibly-nil value ({DirectIvarWrites}), widens it
+      # unmarked.
+      def widen(scope, mark: false, direct_writes: nil)
         seed = class_ivar_seed(scope)
         return scope if seed.nil? || seed.empty?
 
         computed = false
         writes = nil
+        direct = lazy_set(direct_writes)
         seed.reduce(scope) do |widened, (name, seed_type)|
           local_type = scope.ivar(name)
           next widened if local_type.nil? || local_type == seed_type
@@ -198,11 +203,28 @@ module Rigor
 
           joined = Type::Combinator.union(local_type, seed_type)
           widened = widened.with_ivar(name, joined)
-          marked = (mark && nil_free?(local_type)) || scope.declaration_sourced?(:ivar, name)
+          marked = widen_marks?(mark, writes, direct, name, local_type) || scope.declaration_sourced?(:ivar, name)
           marked ? widened.seed_declaration_sourced_ivar(name, joined) : widened
         end
       end
 
+      # Whether {.widen} stamps the declaration mark on `name`'s binding, narrowed to `local_type`: one whose
+      # narrowing ruled `nil` out, under `mark: true`, or under `mark: :unproven` when no write set is proven
+      # (`writes` nil) and the callee does not visibly write it (`direct`).
+      def widen_marks?(mark, writes, direct, name, local_type)
+        return false unless mark && nil_free?(local_type)
+
+        mark != :unproven || (writes.nil? && !direct.call.include?(name))
+      end
+      private_class_method :widen_marks?
+
+      # A callable answering `callable`'s `Set`, computed on the first call; an empty one when `callable` is nil.
+      def lazy_set(callable)
+        value = nil
+        -> { value ||= callable ? callable.call : Set.new }
+      end
+      private_class_method :lazy_set
+
       # Issue #1963 — `scope` past the calls `node`, a condition operand, makes: {.widen} over the names every
       # candidate call in it may write, or every name when one of them is not proven. A call's literal block may run,
       # so its calls count; a `def`, a class or module body and (unless `run_lambdas`) a lambda literal run nothing

data/lib/rigor/inference/ivar_writer_census.rb

@@ -2,6 +2,9 @@
 
 require "prism"
 
+require_relative "census_foreign_block"
+require_relative "receiver_writer_call"
+
 module Rigor
   module Inference
     # Issue #1154 — the instance-variable writers {GlobalWriteCensus} records for the declared-parameter credit
@@ -22,6 +25,17 @@ module Rigor
     # - `[:own_write, class_name, name]` — an `@x` write inside an instance body of the class.
     #   {ScopeIndexer#merge_constant_literal_tables} appends the file's path, so a reader can tell whether a second
     #   file writes the same ivar of the same class.
+    # - `[:own_write_type, class_name, name, value]` — issues #2079 / #2170: the same write with its coarse value, a
+    #   literal's as `[:lit, value]` and anything else as {DYNAMIC}, and a class-body `attr_writer` /
+    #   `attr_accessor` of the name as {DYNAMIC}. The path is appended as for `:own_write`. Issue #2488: an
+    #   explicit-receiver `E.attr_writer` / `E.attr_accessor` (or one through `send`) records the same {DYNAMIC}
+    #   entry under `E`, and an `E.define_method` block is an instance body of `E` ({ReceiverWriterCall}). The
+    #   class-ivar census of a file joins another file's entries, and those of the modules and superclasses on the
+    #   class's chain, into the ivars it already holds ({ScopeIndexer::IvarContributions}).
+    #   Issue #2983: a barred `class_eval`-family block on a receiver rooted at another constant files the code in it
+    #   that runs on an instance under that constant's candidate key ({#remember_root_constant}), a String
+    #   `class_eval` records a {DYNAMIC} write of {ANY_IVAR} ({#record_string_eval}), and a constant write `C = K` /
+    #   `C = K.new` records `[:binds_class, key, "C"]` ({#record_binding}), so the join can take `C`'s entries for `K`.
     class IvarWriterCensus
       SEND_CALLS = %i[send __send__ public_send].to_set.freeze
       # The methods a `send` reaching which is an open-world writer.
@@ -34,6 +48,14 @@ module Rigor
         attr_writer attr_accessor send public_send __send__
       ].to_set.freeze
       NO_ARGUMENTS = [].freeze
+      # Issue #2079 — the coarse value of a write that is not a literal.
+      DYNAMIC = :dynamic
+      # Issue #2983 — the ivar name of a write whose ivar no literal spells: a string `class_eval`'s code may write any.
+      ANY_IVAR = :*
+      # The `class_eval`-family calls that take code in a String.
+      STRING_EVALS = %i[class_eval module_eval].to_set.freeze
+      # The writer declarations a class body records as a {DYNAMIC} write of each name it spells.
+      WRITER_DECLARATIONS = %i[attr_writer attr_accessor].to_set.freeze
 
       # The call names any rule here reads, so every other call returns at one Set probe.
       # (`define_method` is in {SINGLETON_CLASS_CALLS}.)
@@ -44,16 +66,23 @@ module Rigor
         @instance_ranges = []
         @owner_names = {}.compare_by_identity
         @own_writes = {}
+        @typed_writes = Set.new
+        @rooted = Set.new.compare_by_identity
       end
 
       # Fed each node of a pre-order descent. `owner` is the class whose body the node sits in, as its qualified name
       # or as the host walk's prefix Array (joined here only when an entry needs it), or nil where no class owns an
-      # instance (`class << self`, the top level, an opaque block).
-      def visit(node, owner)
+      # instance (`class << self`, the top level, an opaque block). `receiver_owner` is the class an explicit-receiver
+      # writer call ({ReceiverWriterCall}) names, resolved by the host walk as it resolves a `class_eval` receiver.
+      def visit(node, owner, receiver_owner = nil)
         case node
-        when Prism::DefNode then remember(node.location, owner) if owner && node.receiver.nil?
+        when Prism::DefNode then remember_host(node, owner) if node.receiver.nil?
+        when Prism::ConstantWriteNode, Prism::ConstantPathWriteNode then record_binding(node, owner)
         when Prism::SingletonClassNode then visit_singleton_class(node)
-        when Prism::CallNode then visit_call(node, owner) if WATCHED_CALLS.include?(node.name)
+        when Prism::CallNode
+          bar_foreign_block(node)
+          visit_call(node, owner) if WATCHED_CALLS.include?(node.name)
+          record_receiver_writers(node, receiver_owner) if receiver_owner
         when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode,
              Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableTargetNode
           record_own_write(node) unless @instance_ranges.empty?
@@ -67,6 +96,7 @@ module Rigor
         owner = instance_owner(node)
         return if owner.nil?
 
+        record_typed_write(owner, node.name, coarse_value(node))
         seen = (@own_writes[owner] ||= {})
         return if seen[node.name]
 
@@ -74,10 +104,119 @@ module Rigor
         @census << [:own_write, owner_name(owner), node.name].freeze
       end
 
+      def record_typed_write(owner, name, value)
+        entry = [:own_write_type, owner_name(owner), name, value].freeze
+        @census << entry if @typed_writes.add?(entry)
+      end
+
+      # Issue #2079 — a literal's value as `[:lit, value]`; any other value, an operator write and a multiple
+      # assignment target as {DYNAMIC}.
+      def coarse_value(node)
+        value = node.value if node.respond_to?(:value) && !node.is_a?(Prism::InstanceVariableOperatorWriteNode)
+        case value
+        when Prism::NilNode then [:lit, nil].freeze
+        when Prism::TrueNode then [:lit, true].freeze
+        when Prism::FalseNode then [:lit, false].freeze
+        when Prism::IntegerNode, Prism::FloatNode then [:lit, value.value].freeze
+        when Prism::SymbolNode, Prism::StringNode then literal_text(value)
+        else DYNAMIC
+        end
+      end
+
+      def literal_text(node)
+        text = node.unescaped
+        return DYNAMIC unless text.valid_encoding?
+
+        [:lit, node.is_a?(Prism::SymbolNode) ? text.to_sym : text.dup.freeze].freeze
+      end
+
+      # Issue #2490 — a block inside an instance body whose `self` is another object ({CensusForeignBlock}) is
+      # remembered with no owner, so its writes credit nothing. Pre-order, so an instance body nested in it (an
+      # `E.define_method` block, remembered after) still answers for its own class.
+      def bar_foreign_block(node)
+        return if @instance_ranges.empty? || !CensusForeignBlock::CALLS.include?(node.name)
+
+        instance = instance_owner(node)
+        return unless instance && CensusForeignBlock.foreign?(node, owner_name(instance))
+
+        remember(node.block.location, nil)
+        remember_reentry(node, instance)
+        remember_root_constant(node, instance)
+      end
+
+      # Issue #2983 — the code a barred `class_eval`-family block on a receiver rooted at another constant reenters
+      # (`Anc.class_eval`, `INST.class.class_eval`, `AliasK.new.class.class_eval`), remembered under that constant's
+      # candidate key ({CensusForeignBlock.root_constant}), in place of the host walk's as-written owner. A class
+      # whose census joins the entries of the constant the key resolves to, an ancestor's, an alias's or an instance
+      # constant's ({ScopeIndexer::IvarContributions}), then sees the write.
+      def remember_root_constant(node, instance)
+        root, blocks = CensusForeignBlock.rooted_reentry(node, owner_name(instance))
+        blocks&.each { |block| remember(block.location, root) }
+        @rooted.merge(blocks) if blocks
+      end
+
+      # The host walk's `owner` of a `def` or `define_method` block, unless {#remember_root_constant} filed it already.
+      def remember_host(node, owner) = (remember(node.location, owner) if owner && !@rooted.include?(node))
+
+      # Issue #2983 — `C = K` or `C = K.new` (`.allocate`) records `[:binds_class, key, "C"]`, `K`'s candidate key and
+      # `C`'s qualified name ({CensusForeignBlock.binding_entry}), so a class's census also joins the entries filed
+      # under an alias or an instance constant of it (`AliasK.class_eval { … }`, `INST.class.class_eval { … }`).
+      def record_binding(node, owner)
+        entry = CensusForeignBlock.binding_entry(node, nesting(owner))
+        @census << entry if entry
+      end
+
+      # The lexical class and module names `owner` spells: the host walk's prefix Array, or a resolved name.
+      def nesting(owner) = owner.nil? ? NO_ARGUMENTS : owner_name(owner).split("::")
+
+      # Issue #2983 — `class_eval` / `module_eval` given a String runs code the census cannot read, which may define
+      # a method writing any ivar: a {DYNAMIC} write of {ANY_IVAR} is recorded for the module the receiver may be. That
+      # is the class owning the body for an implicit or `self` receiver in a class body, the instance's class for a
+      # receiver in an instance body that {CensusForeignBlock.foreign_module?} does not bar, and otherwise the constant
+      # the receiver chain is rooted at.
+      def record_string_eval(node, owner)
+        return unless STRING_EVALS.include?(node.name) && node.block.nil? && node.arguments
+
+        instance = instance_owner(node) unless @instance_ranges.empty?
+        target = CensusForeignBlock.string_eval_target(node, owner_name(instance), owner_name(owner))
+        record_typed_write(target, ANY_IVAR, DYNAMIC) if target
+      end
+
+      # The `define_method` blocks in a barred body that run on the instance again, remembered after the bar so they
+      # answer for the instance's class ({CensusForeignBlock.reentry_blocks}).
+      def remember_reentry(node, instance)
+        CensusForeignBlock.reentry_blocks(node, owner_name(instance)).each do |block|
+          remember(block.location, instance)
+        end
+      end
+
+      # Issue #2488 — `E.attr_writer :w` declares a writer of `@w` on `E`, and `E.define_method(:m) { … }` installs an
+      # instance body of `E`, wherever the call sits.
+      def record_receiver_writers(node, class_name)
+        ReceiverWriterCall.writer_ivars(node).each { |ivar| record_typed_write(class_name, ivar, DYNAMIC) }
+        block = ReceiverWriterCall.define_method_block(node)
+        remember(block.location, class_name) if block
+      end
+
+      # Issue #2079 — `attr_writer :x` / `attr_accessor :x` in a class body writes `@x` with whatever the caller hands.
+      def record_writer_declaration(node, owner)
+        return unless owner && WRITER_DECLARATIONS.include?(node.name) && self_receiver?(node)
+        # A guard: an instance body's own `attr_writer` call raises (the method is `Module`'s), so only the class
+        # body's declares a writer.
+        return unless instance_owner(node).nil?
+
+        (node.arguments&.arguments || NO_ARGUMENTS).each do |argument|
+          name = literal_name(argument)
+          record_typed_write(owner, :"@#{name}", DYNAMIC) if name
+        end
+      end
+
       def owner_name(owner) = owner.is_a?(Array) ? (@owner_names[owner] ||= owner.join("::")) : owner
 
       def visit_call(node, owner)
-        remember(node.block.location, owner) if owner && define_method_block?(node)
+        record_writer_declaration(node, owner)
+        record_string_eval(node, owner)
+        remember_host(node.block, owner) if define_method_block?(node)
         if self_receiver?(node) || own_singleton_class_call?(node)
           return if @instance_ranges.empty? || !(own_singleton_class_call?(node) || open_world?(node))
 
@@ -88,12 +227,19 @@ module Rigor
         end
       end
 
-      # `class << self` inside an instance `def` opens the instance's singleton class.
+      # `class << self` inside an instance `def` opens the instance's singleton class. Its body's `self` is that
+      # singleton class, so an `@x` write there is the singleton's own ivar (#2490), whatever the expression.
       def visit_singleton_class(node)
-        return unless node.expression.is_a?(Prism::SelfNode) && !@instance_ranges.empty?
+        return if @instance_ranges.empty?
 
         instance = instance_owner(node)
-        record_class(instance) if instance
+        return unless instance
+
+        record_class(instance) if node.expression.is_a?(Prism::SelfNode)
+        return unless node.body
+
+        remember(node.body.location, nil)
+        remember_reentry(node, instance)
       end
 
       def record_class(owner) = @census << [:ivar_set_class, owner_name(owner)].freeze

data/lib/rigor/inference/key_presence_guard.rb

@@ -5,6 +5,8 @@ require "prism"
 require_relative "../type"
 require_relative "mutation_widening"
 require_relative "key_presence_guard/scan"
+require_relative "../typing_state"
+require_relative "../memo_audit"
 
 module Rigor
   module Inference
@@ -57,9 +59,22 @@ module Rigor
         ] + MutationWidening::SHAPE_MUTATORS.to_a
       ).to_set.freeze
 
-      STATE_KEY = :__rigor_key_presence_guard
-      CACHE_KEY = :__rigor_key_presence_guard_rewalk
-      private_constant :STATE_KEY, :CACHE_KEY
+      # ADR-129 WD1 — the walk {.with_guards} installs is a Frame, and {.record}, which rewrites its `guard_ends` in
+      # place, is a Resource touch that also takes a fresh id ({TypingState::State#rewrite}), so a read of the walk's
+      # guards is fixed while the id is. The walk's `defs`, `frozen_constants` and `memo` are extensional caches of
+      # `root`, filled in place without a touch.
+      WALK = TypingState.frame(
+        :key_presence_walk,
+        contents: :resource, read_exemption: :id_determined,
+        reason: "installed per guarded re-walk; each recorded guard rewrites its `guard_ends`",
+        witness: "spec/fixtures/typing_state_witnesses/key_presence_walk.rb"
+      )
+      REWALK = TypingState.memo(
+        :key_presence_rewalk,
+        run_scoped: true, audit: "key presence rewalk",
+        reason: "the last file's guarded index, keyed by the file's root"
+      )
+      private_constant :WALK, :REWALK
 
       # The re-walk's state: the file's root, the end offset of each recorded guard, and the per-file scans.
       Walk = Struct.new(:root, :guard_ends, :defs, :frozen_constants, :memo) do
@@ -87,25 +102,21 @@ module Rigor
 
       # Runs the block with guards recorded and read, for the re-walk of `root`. Thread-local, so it holds under a
       # Ractor worker too.
-      def with_guards(root)
-        previous = Thread.current[STATE_KEY]
-        Thread.current[STATE_KEY] = Walk.new(root, {}, nil, nil, {})
-        yield
-      ensure
-        Thread.current[STATE_KEY] = previous
+      def with_guards(root, &)
+        TypingState.current.with(WALK, Walk.new(root, {}, nil, nil, {}), &)
       end
 
       # Runs the block with guards off again: a callee's return summary, memoised for the whole run, must be the one
       # the file's analysis reads.
-      def without_guards
-        previous = Thread.current[STATE_KEY]
-        Thread.current[STATE_KEY] = nil
-        yield
-      ensure
-        Thread.current[STATE_KEY] = previous
+      def without_guards(&)
+        TypingState.current.with(WALK, nil, &)
       end
 
-      def active? = !Thread.current[STATE_KEY].nil?
+      def active? = !TypingState.current[WALK].nil?
+
+      # {.active?}, read only to decide whether to turn the walk off for the extent that follows ({.without_guards}):
+      # that extent reads it off either way, so the key audit does not count the read (ADR-129 WD1).
+      def forcing_off? = !TypingState.current.forcing_read(WALK).nil?
 
       # Whether `call.possible-nil-receiver` should withhold its report on `call_node`, whose receiver the file's
       # analysis types `receiver_type`: true only when the guarded re-walk types that receiver as exactly
@@ -129,19 +140,33 @@ module Rigor
       # The guarded scope index of `root`, built once per file (the cache holds the last file only), or nil when the
       # file holds no guard-shaped call.
       def rewalk(root, scope_index)
-        cached = Thread.current[CACHE_KEY]
-        return cached.last if cached&.first.equal?(root)
+        return guarded_index(root, scope_index) if MemoAudit.enabled? && MemoAudit.suspended?
+
+        state = TypingState.current
+        cached = state[REWALK]
+        if cached&.first.equal?(root)
+          # A re-walk that raised is stored as nil, and its audit recomputation answers nil the same way.
+          return MemoAudit.check("key presence rewalk", cached.last, root) do
+            guarded_index(root, scope_index)
+          rescue StandardError
+            nil
+          end
+        end
 
         # Cached before the walk, so a re-walk that raises is attempted once per file and then answers nil.
-        Thread.current[CACHE_KEY] = [root, nil]
+        state[REWALK] = [root, nil]
+        index = MemoAudit.key_audit("key presence rewalk") { guarded_index(root, scope_index) }
+        state[REWALK] = [root, index]
+        index
+      end
+
+      def guarded_index(root, scope_index)
         return nil unless guard_shaped_call?(root)
 
         base = scope_index[root]
-        index = base && with_guards(root) do
+        base && with_guards(root) do
           ScopeIndexer.index(root, default_scope: base.with_isolated_side_tables)
         end
-        Thread.current[CACHE_KEY] = [root, index]
-        index
       end
 
       def guard_shaped_call?(node)
@@ -205,7 +230,8 @@ module Rigor
       # The truthy edge of `receiver.key?(key)` with a non-literal key, inside the re-walk: `scope` with the guard
       # recorded, or nil when the guard does not apply.
       def record(call_node, scope)
-        walk = Thread.current[STATE_KEY]
+        state = TypingState.current
+        walk = state[WALK]
         return nil if walk.nil?
 
         args = call_node.arguments&.arguments
@@ -216,6 +242,7 @@ module Rigor
         return nil unless receiver_type?(scope.type_of(call_node.receiver))
         return nil unless Scan.eligible?(walk, call_node, guard)
 
+        state.rewrite(WALK)
         walk.guard_ends[guard] = call_node.location.end_offset
         scope.with_indexed_narrowing(*guard, PRESENT)
       end
@@ -225,7 +252,7 @@ module Rigor
       # read may have changed it ({.intervening?}), and no value of the receiver can be `nil` (the read cannot tell a
       # value's own `nil` from the miss). Nil when no guard applies or nothing would change.
       def guarded_read(node, type, scope)
-        walk = Thread.current[STATE_KEY]
+        walk = TypingState.current[WALK]
         guard = walk && held_guard(node, scope)
         return nil if guard.nil? || Scan.intervening?(walk, guard, node)
 

data/lib/rigor/inference/last_line/self_evidence.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../../source/constant_path"
 require_relative "../../source/node_children"
+require_relative "../../typing_state"
 
 module Rigor
   module Inference
@@ -50,6 +51,9 @@ module Rigor
       #   `undef_method :gets`), other than `&:gets` and the first argument of a call that only names a method
       #   (`respond_to?(:gets)`, `send(:gets)`).
       class SelfEvidence
+        TypingState.memo_field(self, :@scan, reason: "one walk of the file's root node, built on first ask")
+        TypingState.memo_field(self, :@const_set_spellings, reason: "one walk of the file's root, built on first ask")
+
         # The context of a reader whose `self` is `main`.
         MAIN = :main
         UNKNOWN = :unknown
@@ -83,8 +87,14 @@ module Rigor
         def initialize(root)
           @root = root
           @scan = nil
+          @const_set_spellings = nil
         end
 
+        # Issue #3156 — the constants this file binds by a `const_set` with a literal name on the body's own module
+        # (implicit `self` or `self.const_set`) inside a `class` / `module` body, qualified by that body's nesting
+        # (`module NS; const_set(:AMid, Other)` binds `"NS::AMid"`). The census files no such write.
+        def const_set_spellings = (@const_set_spellings ||= collect_const_sets(@root, nil, Set.new).freeze)
+
         # {MAIN}, the `Prism::ClassNode` or `Prism::ModuleNode` whose body the implicit-self reader `call_node` runs
         # in, or nil: the file may give it another `self`, or it is not one of this file's readers.
         def context(call_node) = scan.context(call_node)
@@ -96,6 +106,26 @@ module Rigor
 
         def scan = (@scan ||= Scan.new(@root))
 
+        def collect_const_sets(node, namespace, found)
+          case node
+          when Prism::ClassNode, Prism::ModuleNode
+            inner = Source::ConstantPath.pushed_nesting(namespace ? [namespace] : [], node.constant_path)&.first
+            collect_const_sets(node.body, inner, found) if inner
+            return found
+          when Prism::CallNode
+            found << "#{namespace}::#{literal_const_set_name(node)}" if namespace && literal_const_set_name(node)
+          end
+          node&.compact_child_nodes&.each { |child| collect_const_sets(child, namespace, found) }
+          found
+        end
+
+        def literal_const_set_name(node)
+          return nil unless node.name == :const_set && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+
+          name = node.arguments&.arguments&.first
+          name.unescaped if name.is_a?(Prism::SymbolNode) || name.is_a?(Prism::StringNode)
+        end
+
         # One walk of the file, whose answers {SelfEvidence} keeps once the walk is complete.
         class Scan
           def initialize(root)

data/lib/rigor/inference/last_line.rb

@@ -261,10 +261,13 @@ module Rigor
       # The scope a block or lambda body enters with, as {MatchRebinding.block_entry} gives the match globals': `$_`
       # forgotten when the body may set it, which a later iteration then reads, when the frame makes a closure that
       # may, or when the owning call may: its receiver chain and arguments run before the method yields, and
-      # `IO.foreach` sets `$_` to each line it yields.
+      # `IO.foreach` sets `$_` to each line it yields. Issue #3195 — and whatever the body does when it runs later
+      # than where it is written ({FreshFrameBlocks.deferred_body?}): a proc's body, an enumerator's or a hash's
+      # default proc reads the `$_` the slot holds when it runs.
       def block_entry(scope, block_node, call_node = nil)
         return scope unless scope.last_line_bound?
-        return scope unless scope.last_line_closure? || may_set?(block_node.body, scope) || call_sets?(call_node, scope)
+        return scope unless FreshFrameBlocks.deferred_body?(block_node, call_node, scope) ||
+                            scope.last_line_closure? || may_set?(block_node.body, scope) || call_sets?(call_node, scope)
 
         scope.forget_last_line
       end