rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/self_call_ivar_writes.rb

@@ -9,6 +9,8 @@ require_relative "../type"
 require_relative "guard_rebinding"
 require_relative "project_method_ownership"
 require_relative "refined_dispatch/own_method"
+require_relative "../typing_state"
+require_relative "../memo_audit"
 
 module Rigor
   module Inference
@@ -85,7 +87,9 @@ module Rigor
         :to_r, :to_c, :to_proc, :to_path, :to_sym, :to_io, :coerce, :exception, :divmod, :each, :respond_to?,
         :respond_to_missing?, :method_missing, :initialize_copy, :marshal_dump, :pretty_print
       ].freeze
-      private_constant :UNPROVABLE_NODES, :LITERAL_CLASSES, :SELF_SAFE_NAMES, :PROTOCOL_NAMES
+      # Issue #2203 — the classes and module every project class's instances reach past its own chain.
+      IMPLICIT_ROOTS = %w[Object Kernel BasicObject].freeze
+      private_constant :UNPROVABLE_NODES, :LITERAL_CLASSES, :SELF_SAFE_NAMES, :PROTOCOL_NAMES, :IMPLICIT_ROOTS
 
       # Raised inside a proof to abandon it.
       class Unprovable < StandardError
@@ -113,6 +117,50 @@ module Rigor
         nil
       end
 
+      # ADR-129 WD1 — a run-scoped Memo: the `[deferred_ranges, counts]` pair is one table and the counts computed
+      # from it alone, so the counts are a function of the table identity the pair is keyed on.
+      DEFINITION_COUNTS = TypingState.memo(
+        :self_call_ivar_writes_definition_counts,
+        run_scoped: true, audit: "self-call ivar definition counts",
+        reason: "the instance-def counts of one deferred-ranges table; keyed on its identity"
+      )
+      private_constant :DEFINITION_COUNTS
+
+      # `{[owner, name] => the number of instance `def` rows of name the project records for owner}`, over every
+      # file of `deferred_ranges` (a `discovered_deferred_ranges` table). Built once per table and kept in ONE
+      # thread slot keyed by the table's identity (#2300): the table is never written in place, a file whose rows
+      # equal the seed's keeps the seed's table, and a scan of every file's rows per query was the cost once the
+      # table held the whole project. The slot holds one table and its counts, the next table replaces them, and the
+      # run that filled it releases it when it ends (run-scoped, #2399).
+      def definition_counts(deferred_ranges)
+        return count_definitions(deferred_ranges) if MemoAudit.enabled? && MemoAudit.suspended?
+
+        state = TypingState.current
+        slot = state[DEFINITION_COUNTS]
+        if slot && slot[0].equal?(deferred_ranges)
+          return MemoAudit.check("self-call ivar definition counts", slot[1], deferred_ranges.size) do
+            count_definitions(deferred_ranges)
+          end
+        end
+
+        counts = MemoAudit.key_audit("self-call ivar definition counts") { count_definitions(deferred_ranges) }
+        state[DEFINITION_COUNTS] = [deferred_ranges, counts]
+        counts
+      end
+
+      def count_definitions(deferred_ranges)
+        counts = {}
+        deferred_ranges.each_value do |rows|
+          rows.each do |row|
+            next unless row[3] == :instance
+
+            key = [row[4], row[2]]
+            counts[key] = counts.fetch(key, 0) + 1
+          end
+        end
+        counts
+      end
+
       # One proof's state: the instance variables read code writes, and the `def` bodies already read.
       class Proof
         attr_reader :written
@@ -128,7 +176,7 @@ module Rigor
         # Reads the method an implicit-self or `self.` call to `call_node`'s name runs.
         def self_call(call_node)
           name = call_node.name
-          unprovable! if GuardRebinding.code_running_name?(name) || refined?(name)
+          unprovable! if GuardRebinding.code_running_name?(name) || refined?(name, on_self: true)
 
           if ProjectMethodOwnership.defines?(@class_name, name, :instance, @scope)
             read_def(proven_def(name))
@@ -185,19 +233,66 @@ module Rigor
 
         private
 
-        # Whether a `refine` block anywhere in the project defines `name`, on any class: a `using` in effect where the
-        # read code sits may route the call to it (`refine Kernel do def warn …`), whatever the receiver.
+        # Whether a `refine` block in the project defines `name` where the call may reach it: a `using` in effect
+        # where the read code sits may route the call to it (`refine Kernel do def warn …`).
         #
         # Issue #2163 — the answer reads every file's refinements whole, and a refined class off the chain (`Kernel`,
         # `IO`, `String`) is no `mark:` the chain read files, so it records `refinement:<name>` and `refinement:*`
         # whichever way it answers, as `InEffectRefinements` consumers do: a file that starts or stops refining the
         # name re-checks the reader.
-        def refined?(name)
+        #
+        # Issue #2203 — for a call on `self` (`on_self:`) whose reach {#self_reach} knows, a row of the name counts only
+        # on a class key in that reach, on the wildcard class key, or on a key the walk could not name
+        # (`InEffectRefinements.class_wildcard_key?`); a names-wildcard row (a computed `define_method`,
+        # `import_methods`) counts as the name, but only on a class key in the reach. A refinement of `String` leaves
+        # a `Holder` alone: dropping the proof is no safer, since the intervening-call reset restores the class-ivar
+        # seed and a class guard's narrowing then reports. Where the reach is unknown, and for a call on another
+        # receiver, a row of the name counts on any class and a names-wildcard row never does, as before the issue.
+        def refined?(name, on_self: false)
+          wildcard = Scope::DiscoveryIndex::REFINEMENT_WILDCARD
           if Analysis::DependencyRecorder.active?
             Analysis::DependencyRecorder.read_name(:refinement, name)
-            Analysis::DependencyRecorder.read_name(:refinement, Scope::DiscoveryIndex::REFINEMENT_WILDCARD)
+            Analysis::DependencyRecorder.read_name(:refinement, wildcard)
           end
-          @scope.discovered_refinements.any? { |_refined, methods| methods.key?(name) }
+          reach = on_self ? self_reach : nil
+          @scope.discovered_refinements.any? do |refined, methods|
+            next methods.key?(name) if reach.nil?
+
+            if reach.include?(refined)
+              methods.key?(name) || methods.key?(wildcard)
+            else
+              methods.key?(name) && InEffectRefinements.class_wildcard_key?(@scope, refined)
+            end
+          end
+        end
+
+        # Issue #2203 — the classes and modules on the instance chain of `self`'s class and of `Object`, `Kernel` and
+        # `BasicObject` (which holds the modules the project mixes into them), with `Object`'s RBS ancestors
+        # (`PP::ObjectMixin`); nil when a chain is cut, mixes in a module the tables cannot name, ends in a superclass
+        # they do not know (`class Holder < Struct.new(:a)`), or holds an external entry. A project subclass's chain
+        # needs no read: {#no_protocol_override} gives the proof up on a refined class or module anywhere on it. The
+        # implicit roots' chains are recorded, so a file that mixes a module into `Object` re-checks the reader;
+        # `self`'s own chain is recorded by {#no_protocol_override}'s read.
+        def self_reach
+          return @self_reach if defined?(@self_reach)
+
+          @self_reach = read_self_reach
+        end
+
+        def read_self_reach
+          names = Set.new
+          [@class_name.to_s, *IMPLICIT_ROOTS].each do |class_name|
+            chain = Scope::ResolutionChain.for(@scope, class_name, :instance, :methods)
+            chain.record(@scope) if Analysis::DependencyRecorder.active?
+            return nil if chain.truncated? || chain.wildcard_mixin? || chain.opaque_tail?(@scope)
+            return nil if chain.entries.any?(&:external?)
+
+            chain.entries.each { |entry| names << entry.name }
+          end
+          loader = @scope.environment&.rbs_loader
+          return nil if loader.nil?
+
+          names.merge(loader.ancestor_names_for("Object"))
         end
 
         def call_receiver(node) = node.is_a?(Prism::CallNode) ? node.receiver : nil
@@ -268,11 +363,7 @@ module Rigor
         end
 
         def definition_count(owner, name)
-          count = 0
-          @scope.discovered_deferred_ranges.each_value do |rows|
-            count += rows.count { |row| row[2] == name && row[3] == :instance && row[4] == owner }
-          end
-          count
+          SelfCallIvarWrites.definition_counts(@scope.discovered_deferred_ranges).fetch([owner, name], 0)
         end
 
         # Whether `chain`'s own order stands with no second world: no order mark and no fork. `ResolutionChain#settle`

data/lib/rigor/inference/self_preserving_block.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "closure_escape_analyzer"
+require_relative "project_method_ownership"
+require_relative "refined_dispatch"
+
+module Rigor
+  module Inference
+    # Issue #2861 — whether a block-carrying call provably runs its literal block under the CALLER's `self`, so the
+    # block body is no more opaque than the scope around it (`Scope#entering_self_preserving_block`).
+    #
+    # Issue #316 enters every block with `self` unmodelled, because a DSL call (`RSpec.describe`, `Class.new`, a
+    # project `def run(&b) = instance_exec(&b)`) may run the block on another object, and the call cannot be told
+    # apart from `Array#each` without knowing the callee. Here the callee is known: the explicit receiver's type and
+    # method are one {ClosureEscapeAnalyzer} classifies as `:non_escaping` — a catalogued core iterator, `tap` /
+    # `then`, or a project class's inherited `Enumerable` method — each of which `yield`s, which runs the block
+    # with its own `self`. The project must not define the method anywhere the receiver looks it up
+    # ({ProjectMethodOwnership.defines?}): a project reopening of `Array#each` could `instance_exec` the block.
+    # A `def` inside `refine X do … end` is no such answer, so where the call site's in-effect refinements may
+    # define the name the call declines too (issue #2909) — a refined `Integer#times` or `Object#tap` could
+    # `instance_exec` the block just the same.
+    #
+    # The project must not define it on `Object`, `Kernel` or another owner every receiver reaches either
+    # ({.universally_defined?}). A receiverless call is the DSL shape and never answers true, nor does a receiver Rigor
+    # cannot see. A `self.` receiver is read like any other explicit one, through its type.
+    module SelfPreservingBlock
+      module_function
+
+      # `classification` is the receiver's {ClosureEscapeAnalyzer.classify} answer when the caller already holds it.
+      def call?(call_node, receiver_type, scope, classification: nil)
+        return false unless call_node.is_a?(Prism::CallNode) && call_node.block.is_a?(Prism::BlockNode)
+
+        return false if call_node.receiver.nil? || receiver_type.nil?
+
+        method_name = call_node.name
+        classification ||= ClosureEscapeAnalyzer.classify(receiver_type: receiver_type, method_name: method_name,
+                                                          scope: scope)
+        return false unless classification == :non_escaping
+
+        project_shadow_free?(call_node, receiver_type, method_name, scope)
+      rescue StandardError
+        false
+      end
+
+      # The project-side half of {.call?}: nothing the project defines — a plain `def` on a lookup target or a
+      # {UNIVERSAL_OWNERS} entry, nor a refinement in effect at the call site — may answer the yielding method
+      # instead of the catalogued non-escaping one.
+      def project_shadow_free?(call_node, receiver_type, method_name, scope)
+        targets = ProjectMethodOwnership.targets(receiver_type)
+        return false if targets.nil? || targets.empty?
+        return false if universally_defined?(method_name, scope)
+
+        targets.none? { |class_name, kind| ProjectMethodOwnership.defines?(class_name, method_name, kind, scope) } &&
+          !refined_in_effect?(call_node, method_name, scope)
+      end
+
+      # The classes every receiver's lookup reaches: an instance of any class is an `Object` (a class object is also
+      # a `Module` and a `Class`), so a project method of the name on one of them, or on `Kernel`, which
+      # {ProjectMethodOwnership.defines?} reaches through `Object`'s ancestry, may be the one the call runs, whatever
+      # class the receiver names. `ClosureEscapeAnalyzer` answers `tap` / `then` / `yield_self` for every class
+      # without asking who defines them.
+      UNIVERSAL_OWNERS = %w[Object Module Class].freeze
+      private_constant :UNIVERSAL_OWNERS
+
+      # Whether the project defines `method_name` on a {UNIVERSAL_OWNERS} entry. A top-level `def` of the name is
+      # private, so an explicit-receiver call raises NoMethodError before any block runs, and is not counted.
+      def universally_defined?(method_name, scope)
+        UNIVERSAL_OWNERS.any? { |owner| ProjectMethodOwnership.defines?(owner, method_name, :instance, scope) }
+      end
+
+      # Issue #2909 — whether a refinement in effect at `call_node` may define `method_name`. The refined-class
+      # walk is not consulted: any in-effect row for the name declines, the direction ADR-5 prefers, and it covers
+      # `refine Object` / `refine Kernel` without a universal-owner path of its own. An empty list — no `using`
+      # reaches the node — is the common case and costs the one lookup. The answer reads the refinement table by
+      # method name, so `refinement:<name>` is recorded as {ExpressionTyper}'s refined dispatch records it.
+      def refined_in_effect?(call_node, method_name, scope)
+        list = scope.in_effect_refinements(call_node)
+        return false if list.empty?
+
+        InEffectRefinements.record_refinement_names(method_name)
+        RefinedDispatch.refined_anywhere?(scope, method_name, list)
+      end
+    end
+  end
+end

data/lib/rigor/inference/set_mutation.rb

@@ -0,0 +1,189 @@
+# frozen_string_literal: true
+
+require_relative "../type"
+require_relative "content_join"
+require_relative "mutation_rejoin"
+require_relative "rewrite_mutation"
+
+module Rigor
+  module Inference
+    # The Set half of {MutationWidening}'s seams (issue #2294), beside {StringMutation}.
+    #
+    # `f = Set["a"]; f.clear; f << 1; f.map { |v| v.fdiv(2) }` reported `undefined method 'fdiv' for String`
+    # on code that prints `[0.5]`: the mutation seams answered `Tuple`, `HashShape`, `Constant[String]` and the
+    # re-openable `Array` / `Hash` nominals, so a `Set` kept the elements it was built with through every
+    # `<<`, `add`, `merge` and `replace`.
+    #
+    # A Set has no slots and no arity, so the only thing a mutation falsifies is the element set. Both carriers
+    # this module answers end at the typed Set #2290 builds for a non-constant literal — `Set[E | Dynamic[top]]`:
+    #
+    # - a constant-folded `Constant[Set]` widens to that carrier, its members' value pins dropped
+    #   ({MethodDispatcher.array_new_element}) and joined with the `Dynamic[top]` floor;
+    # - a typed `Set` whose element already carries a gradual arm re-grows the way
+    #   {MutationRejoin.regrowable_carrier?} lets an `Array` / `Hash` re-grow;
+    # - a PRECISE `Set[String]` (an RBS return such as `Array#to_set`) re-grows too (issue #2361), as a precise
+    #   `Array[String]` does ({MutationRejoin.widen_precise_array}): `f = ARGV.to_set; f.clear; f << 1` is
+    #   `Set[Dynamic[top] | String]`.
+    #
+    # A gradual seed admits every added member as itself: the seed-admissibility gate has nothing to contradict on
+    # it. A precise seed admits only a member its element accepts ({MutationRejoin.precise_admitted}), any other
+    # taking the floor, and takes no {RewriteMutation} arm: `replace` joins its elements onto the seed, and `map!`
+    # leaves it as it was. Every join carries the `Dynamic[top]` floor, as the Array re-join's does. An adder whose
+    # arguments the block-capture seam did not type joins only that floor: the store happened, and a Set has no
+    # block content join to add it afterwards. An adder called with no arguments changes nothing.
+    module SetMutation
+      # Receiver-mutating Set methods. The non-bang siblings (`map` vs `map!`, `select` vs `select!`) and the
+      # algebra (`|`, `+`, `-`, `&`, `^`) return a new Set and stay precise.
+      MUTATORS = %i[
+        << add add? merge replace
+        map! collect! flatten!
+        clear delete delete? delete_if keep_if select! filter! reject! subtract
+      ].to_set.freeze
+
+      # The {MUTATORS} that put elements in. `<<` / `add` / `add?` store their argument; `merge` stores every
+      # argument's elements; `replace` its argument's elements, after {RewriteMutation} has dropped the old ones.
+      CONTENT_ADDERS = %i[<< add add? merge replace].to_set.freeze
+
+      module_function
+
+      def constant?(type)
+        type.is_a?(Type::Constant) && type.value.is_a?(::Set)
+      end
+
+      # True when `type` is a `Set` carrier of either kind, which {#widen} answers for alone.
+      def set?(type)
+        constant?(type) || (type.is_a?(Type::Nominal) && type.class_name == "Set")
+      end
+
+      # True when `type` is a `Set` the seams may grow: a constant-folded one, or a typed one carrying a gradual
+      # element arm.
+      def carrier?(type)
+        constant?(type) || (type.is_a?(Type::Nominal) && regrowable?(type))
+      end
+
+      # True when `type`, or a member of it, is a {#carrier?}: the only types a Set-only adder's floor can change.
+      def carrier_in?(type)
+        type.is_a?(Type::Union) ? type.members.any? { |member| carrier?(member) } : carrier?(type)
+      end
+
+      # Every typed `Set[E]`, a precise one included since issue #2361.
+      def regrowable?(nominal)
+        nominal.class_name == "Set" && nominal.type_args.size == 1
+      end
+
+      # The carrier `type` holds after `method_name` with argument types `arg_types`, or `nil` when the call is not
+      # a Set mutator or `type` is not a carrier this seam grows. `nil` also answers a re-join that changed nothing,
+      # so a remover on an already-widened Set does not rebind it. That is a guard, not a behaviour: a Set has no
+      # `receiver[key] ||=` slot narrowings for a rebind to drop, so the identical carrier would read the same either
+      # way, and declining only saves rebuilding the scope.
+      #
+      # Issue #2555 L3 — `synthesised` says the binding carries the `:synthesised` construction fact: the engine built
+      # the Set itself (`s = Set[1]`, `Set.new(...)`), so no declaration made a claim about its elements, and the
+      # carrier stays re-growable for as long as the binding keeps the fact. Such a Set joins without the floor
+      # ({#floored}'s and {#join}'s) and without the precise seed's admissibility gate: `s = Set[1]; s << 2` reads
+      # `Set[Integer]`, and a read of its member reports what an Integer does not answer.
+      def widen(type, method_name, arg_types, unread_arguments: false, synthesised: false)
+        return nil unless MUTATORS.include?(method_name)
+
+        if constant?(type)
+          members = type.value.map { |v| Type::Combinator.constant_of(v) }
+          seed = synthesised && !members.empty? ? exact(members) : floored(members)
+          join(seed, method_name, arg_types, unread_arguments, synthesised:)
+        elsif type.is_a?(Type::Nominal) && regrowable?(type)
+          joined = join(type, method_name, arg_types, unread_arguments, synthesised:)
+          joined == type ? nil : joined
+        end
+      end
+
+      # Every join carries the `Dynamic[top]` floor, a precise seed's included (issue #2361): a later remover or
+      # rewriter (`subtract`, `delete`, `map!`) can take the stored members out again, and nothing narrows the
+      # carrier back, so a closed `Set[Integer | String]` would reject a declared `Set[String]` the program meets.
+      # A synthesised carrier (issue #2555) takes the rewrite arm a gradual one takes, admits every added member, and
+      # joins no floor: an untyped store joins `Dynamic[top]` as the one unknown member it is.
+      def join(carrier, method_name, arg_types, unread_arguments, synthesised: false)
+        seed = carrier.type_args.first
+        # A precise seed takes no rewrite arm, as a precise `Array` does not ({MutationRejoin.widen_precise_array}).
+        carrier = RewriteMutation.arm(carrier, method_name) if synthesised || MutationRejoin.gradual_parameter?(seed)
+        return carrier unless CONTENT_ADDERS.include?(method_name)
+
+        stored = added_elements(method_name, arg_types)
+        if stored.empty?
+          # An adder called with no arguments (`s.merge`) is a no-op; one whose arguments went untyped is a store.
+          return carrier unless unread_arguments
+
+          added = []
+        else
+          return carrier if !MutationRejoin.gradual_parameter?(seed) && MutationRejoin.already_held?(seed, stored)
+
+          added = admitted(seed, stored.map { |t| widened_member(t) }, synthesised:)
+        end
+        floor = synthesised && !added.empty? ? [] : [Type::Combinator.untyped]
+        element = Type::Combinator.union(carrier.type_args.first, *added, *floor)
+        Type::Combinator.nominal_of("Set", type_args: [element])
+      end
+
+      # `added` as {MutationRejoin.precise_admitted} admits it into a precise seed; a gradual or synthesised seed
+      # admits all.
+      def admitted(seed, added, synthesised: false)
+        return added if synthesised || MutationRejoin.gradual_parameter?(seed)
+
+        MutationRejoin.precise_admitted(seed, added)
+      end
+
+      # The element types one content-adder call puts in, from the call's argument types.
+      def added_elements(method_name, arg_types)
+        return [] if arg_types.empty?
+
+        case method_name
+        when :merge, :replace then arg_types.flat_map { |t| element_types(t) }
+        else [arg_types.first || Type::Combinator.untyped]
+        end
+      end
+
+      # `Set[E]` over `members`, value pins dropped: a constant Set a synthesised binding holds (issue #2555).
+      def exact(members)
+        Type::Combinator.nominal_of("Set", type_args: [Type::Combinator.union(*members.map { |m| widened_member(m) })])
+      end
+
+      # `Set[E | Dynamic[top]]` over `members`, the #2290 typed-Set floor. An empty seed (`Set.new`) is
+      # `Set[Dynamic[top]]`.
+      def floored(members)
+        widened = members.map { |m| widened_member(m) }
+        Type::Combinator.nominal_of("Set", type_args: [Type::Combinator.union(*widened, Type::Combinator.untyped)])
+      end
+
+      # The element types an enumerable argument (`merge`'s, `replace`'s, the algebra's `_Each[A]`) yields: a
+      # `Tuple`'s elements, an `Array` / `Set` / `Range` nominal's element parameter, a constant Set's or Range's
+      # members. Anything else yields elements this seam cannot name, which are unknown rather than none.
+      def element_types(type)
+        case type
+        when Type::Union then type.members.flat_map { |m| element_types(m) }
+        when Type::Tuple then type.elements
+        when Type::Nominal
+          if %w[Array Set Range].include?(type.class_name) && type.type_args.size == 1
+            type.type_args
+          else
+            [Type::Combinator.untyped]
+          end
+        when Type::Constant then constant_elements(type)
+        else [Type::Combinator.untyped]
+        end
+      end
+
+      def constant_elements(constant)
+        value = constant.value
+        if value.is_a?(::Set) then value.map { |v| Type::Combinator.constant_of(v) }
+        elsif value.is_a?(::Range) && value.begin.is_a?(Integer)
+          [Type::Combinator.nominal_of("Integer")]
+        else [Type::Combinator.untyped]
+        end
+      end
+
+      # A stored member's value pin and literal shape are dropped, as an `Array.new` fill's are: the set holds the
+      # object, and the program keeps a reference to it.
+      def widened_member(type)
+        MethodDispatcher.array_new_element(type)
+      end
+    end
+  end
+end

data/lib/rigor/inference/singleton_hook_decline.rb

@@ -37,7 +37,8 @@ module Rigor
     # Known remainders, pinned in `spec/integration/definer_resolution_witness_spec.rb`: `class << self; prepend
     # P` is recorded as an `extend` (the chain places `P` after the singleton, so an own `def self.x` is trusted
     # against it); a concern is capable for every name; an own `def self.x` is trusted against its own level's
-    # U2 hooks and same-class redefinitions; a `class Class; def inherited` monkeypatch is unseen; and a
+    # U2 hooks and same-class redefinitions, except a concern block's `def self.x` of the same name (#3005, which
+    # the read tests); a `class Class; def inherited` monkeypatch is unseen; and a
     # superclass that only `extend`s adds two forks, so every read on its subclasses declines.
     module SingletonHookDecline
       WILDCARD = "*"
@@ -65,7 +66,8 @@ module Rigor
         entry = chain.entries[index]
         # A singleton project entry on a singleton chain is always a level's class entry.
         own = !entry.external? && entry.side == :singleton && def_head(scope, entry.name, method_name) == entry.name
-        own ? index : index + 1
+        # Issue #3005 — an own `def self.x` that a concern block's `def self.x` on its level may replace is tested.
+        own && !chain.hook_block_rival?(scope, index, method_name) ? index : index + 1
       end
 
       # What a class entry's answer is when its `def` was written in another module's body: `:copy` when that
@@ -92,21 +94,28 @@ module Rigor
       # Whether the class's singleton `def` is the very node `head`'s instance table holds, the one the fold
       # copied: a receiverless `def`. A `def C.x` or `class << C; def x; end` written inside `head`'s body has the
       # same nesting head and is the class's own, not a copy. (The walk records a `def C.x` written in `module X`
-      # as `X#x` too, so identity alone does not tell it from a copy; its receiver does.)
+      # as `X#x` too, so identity alone does not tell it from a copy; its receiver does.) Issue #3155 — the walk no
+      # longer files that `def C.x` anywhere, so the copy is all the table holds; the definer's mark on the class
+      # (`ENVELOPE_OBJECT_SINGLETON_KIND`, {ScopeIndexer#record_object_singleton}) still says the class has its own.
       def copied_from?(scope, head, method_name, owner)
         node = scope.singleton_def_for(owner, method_name)
         return false if node.nil? || !node.receiver.nil?
+        return false if foreign_singleton_definer?(scope, owner, method_name)
 
         scope.user_def_for(head, method_name).equal?(node)
       end
 
+      def foreign_singleton_definer?(scope, owner, method_name)
+        key = [Scope::DiscoveryIndex::ENVELOPE_OBJECT_SINGLETON_KIND, method_name.to_sym]
+        scope.parameter_envelopes_of(owner).key?(key)
+      end
+
       # The innermost `Module.nesting` entry `owner`'s singleton `def` of the name was written in, or nil.
       def def_head(scope, owner, method_name)
         node = scope.singleton_def_for(owner, method_name)
         return nil if node.nil?
 
-        nesting = scope.discovery.discovered_def_nestings[node] || DefNodeResolver.rehydrated_nesting(node)
-        nesting&.first
+        scope.discovery.recorded_def_nesting(node)&.first
       end
 
       # Issue #1722 — the hook-capable test for one chain entry, asked by `call.undefined-method` of a project module
@@ -171,15 +180,40 @@ module Rigor
 
         # The memoised `[verdict, edges]` of one test, its edges replayed while a recording is active.
         def verdict(kind, key)
-          verdict, edges = @memo[[kind, key]] ||= begin
+          memo_key = [kind, key]
+          entry = @memo[memo_key]
+          if entry.nil?
             edges = []
-            value = yield(edges)
-            [value ? true : false, edges.concat(own_edges(kind, key)).uniq.freeze].freeze
+            value = MemoAudit.key_audit("singleton hook verdict") { yield(edges) }
+            entry = @memo[memo_key] = [value ? true : false, edges.concat(own_edges(kind, key)).uniq.freeze].freeze
+          else
+            entry = MemoAudit.check("singleton hook verdict", entry, kind, key) { fresh_verdict(kind, key) }
           end
+          verdict, edges = entry
           replay(edges) if @recording
           verdict
         end
 
+        # ADR-129 G2 — a memoised verdict rebuilt for the audit by a new Context, whose memo is a fresh bucket's
+        # while the recomputation runs ({Scope::ResolutionChain.hook_memo}), its dependency reads withheld.
+        def fresh_verdict(kind, key)
+          Analysis::DependencyRecorder.withhold { Context.new(@scope, @flavor).verdict_entry(kind, key) }.first
+        end
+
+        protected
+
+        # The `[verdict, edges]` entry of one test, computed through {#verdict} on this Context's memo.
+        def verdict_entry(kind, key)
+          case kind
+          when :project then verdict(:project, key) { project_capable?(key) }
+          when :external then verdict(:external, key) { external_capable?(key) }
+          else instance_level_capable?(key)
+          end
+          @memo[[kind, key]]
+        end
+
+        private
+
         def own_edges(kind, key)
           return entry_edges(key) if kind == :external
           return EMPTY_EDGES if kind == :instance_level

data/lib/rigor/inference/singleton_object_constant.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../source/constant_path"
+require_relative "../source/parameter_envelope"
 
 module Rigor
   module Inference
@@ -45,18 +46,47 @@ module Rigor
         name = receiver_constant_name(call_node, receiver_type)
         return false if name.nil?
 
-        scope.discovered_method?(name, method_name, :singleton)
+        scope.discovered_method?(name, method_name, :singleton) || foreign_singleton?(scope, name, method_name)
+      end
+
+      # Issue #3016 — `def Const.x` written outside `Const`'s own body, and `Const.define_singleton_method(:x)`, record
+      # no `:singleton` row: {ScopeIndexer} files them as an opaque `[:singleton, x]` envelope on every name the
+      # constant can denote from the def site. That envelope is the evidence the method exists on the constant's
+      # object. The read records the constant's class edge, and that edge's file set holds every file writing such a
+      # def or call, so adding or removing one re-checks the call.
+      #
+      # A computed `Const.define_singleton_method(name)` may define any name, so the singleton side's open-names mark it
+      # files declines every call through the constant.
+      def foreign_singleton?(scope, name, method_name)
+        bucket = scope.parameter_envelopes_of(name)
+        bucket.key?([:singleton, method_name.to_sym]) ||
+          bucket.key?(Scope::DiscoveryIndex::ENVELOPE_OPEN_SINGLETON_NAMES_MARK)
       end
 
       # The `Prism::DefNode` for `method_name` in the constant's singleton body, or nil. The inference tier's
       # entry point.
+      #
+      # Issue #3018 — nil too when another definer of the name on the constant may replace that def: a `def Const.x`,
+      # a `Const.define_singleton_method(:x)` or a `singleton_class.class_eval` def joins an opaque envelope into the
+      # name's `[:singleton, x]` slot, and a computed `define_singleton_method` files the open-names mark. The body
+      # def's own contribution is its parameter envelope, never opaque, so a lone body def keeps its typed answer.
+      # Declined whatever the source order, since a two-file project has none.
       def def_node_for(call_node, receiver_type, method_name, scope)
         return nil if scope.nil?
 
         name = receiver_constant_name(call_node, receiver_type)
         return nil if name.nil?
 
-        scope.singleton_def_for(name, method_name)
+        def_node = scope.singleton_def_for(name, method_name)
+        return nil if def_node.nil? || replaceable?(scope, name, method_name)
+
+        def_node
+      end
+
+      def replaceable?(scope, name, method_name)
+        bucket = scope.parameter_envelopes_of(name)
+        Source::ParameterEnvelope.opaque?(bucket[[:singleton, method_name.to_sym]]) ||
+          bucket.key?(Scope::DiscoveryIndex::ENVELOPE_OPEN_SINGLETON_NAMES_MARK)
       end
     end
   end