rigortype 0.4.7 → 0.4.8

data/lib/rigor/inference/census_foreign_block.rb

@@ -0,0 +1,354 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "anonymous_meta_class"
+
+module Rigor
+  module Inference
+    # Issue #2490 — a block, inside an instance body of a class `K`, whose `self` is provably not an instance of `K`, so
+    # an `@x` write directly in it writes some other object's ivar and the class-ivar censuses must not credit it to
+    # `K`. Read syntactically, before any type is known, by both the per-file census ({ScopeIndexer}) and the cross-file
+    # {IvarWriterCensus}. False positives come first, so a receiver that may hold a `K` instance keeps the credit:
+    #
+    # - `instance_eval` / `instance_exec` on a receiver that is provably no `K` instance ({.provably_other?}): a
+    #   constant or `self.class` (a class object), `X.new` / `X.allocate` on a constant `X` not spelling `K`, a
+    #   literal. Any other receiver (a parameter, a local, `dup`, `itself`) may be a `K` and still counts;
+    # - `class_eval` / `module_eval` / `class_exec` / `module_exec` on an explicit receiver: `self` is the receiver
+    #   module, so `@x` directly in the block is that module object's own ivar;
+    # - `define_method` on a constant not spelling `K` (its block runs on that class's instances), and
+    #   `define_singleton_method` on a class object or a literal;
+    # - a `Class.new` / `Module.new` / `Struct.new` / `Data.define` block: `self` is the new class.
+    #
+    # `class << obj` inside an instance body is one more barred body; the callers bar it themselves, since it is no
+    # call. Only a barred body's own statements are dropped: a `define_method` block nested in a `class_eval` or
+    # `class << obj` body whose module may be `K` or an instance's singleton class runs on a `K` instance and still
+    # counts, and so does a receiver-less `def` nested in either (#2941, {.reentry_blocks}).
+    # `def.ivar-write-mismatch`'s collector reads the same rule (#2943, {.census_children}).
+    module CensusForeignBlock
+      INSTANCE_EVALS = %i[instance_eval instance_exec].to_set.freeze
+      MODULE_EVALS = %i[class_eval module_eval class_exec module_exec].to_set.freeze
+      DEFINERS = %i[define_method define_singleton_method].to_set.freeze
+      SEND_CALLS = %i[send public_send __send__].to_set.freeze
+      # The constructors whose receiver names the class of the object they answer.
+      CONSTRUCTORS = %i[new allocate].to_set.freeze
+      # The literal receivers, none of them an instance of a project class.
+      LITERALS = [Prism::StringNode, Prism::InterpolatedStringNode, Prism::SymbolNode, Prism::IntegerNode,
+                  Prism::FloatNode, Prism::ArrayNode, Prism::HashNode, Prism::RangeNode, Prism::RegularExpressionNode,
+                  Prism::NilNode, Prism::TrueNode, Prism::FalseNode, Prism::LambdaNode].freeze
+      # The calls that answer a module of their receiver.
+      MODULE_OF_INSTANCE = %i[class singleton_class].to_set.freeze
+      # The constants naming a module every class has among its ancestors, whose methods an instance runs.
+      ANCESTOR_ROOTS = %w[Object BasicObject Kernel].to_set.freeze
+      # The calls whose answer is foreign when their receiver is: the object itself, a copy, a new instance, its class.
+      FOREIGN_PRESERVING = %i[new allocate dup clone itself class singleton_class].to_set.freeze
+      # Issue #2983 — the scalar literals, whose blockless calls answer no instance of a project class, unlike a
+      # container's (`[k].first`) or a lambda's.
+      SCALAR_LITERALS = (LITERALS - [Prism::ArrayNode, Prism::HashNode, Prism::LambdaNode]).freeze
+      # A String or Symbol literal that spells a constant path, which a call may resolve to the class
+      # (`"K".constantize`).
+      CONSTANT_SPELLING = /\A(?:::)?[A-Z]\w*(?:::[A-Z]\w*)*\z/
+      # Separates the qualifications of a {.candidate_key}; no constant name holds it.
+      CANDIDATE_SEPARATOR = "|"
+      # Marks a candidate key whose code runs on the constant's own value's module ({.root_constant}).
+      OBJECT_MARK = "@"
+      COPIES = %i[dup clone itself].to_set.freeze
+      BARRIERS = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      NONE = [].freeze
+      # Every name {.foreign?} can answer true for, so any other call returns at one Set probe.
+      CALLS = (INSTANCE_EVALS | MODULE_EVALS | DEFINERS | %i[new define]).freeze
+
+      module_function
+
+      # Whether `node`'s literal block runs with a `self` that is provably not an instance of `class_name`.
+      def foreign?(node, class_name)
+        unless node.is_a?(Prism::CallNode) && CALLS.include?(node.name) && node.block.is_a?(Prism::BlockNode)
+          return false
+        end
+        return true if AnonymousMetaClass.block_form_receiver(node)
+
+        name = node.name
+        receiver = node.receiver
+        return false if self_node?(receiver)
+        return true if MODULE_EVALS.include?(name)
+        return provably_other?(receiver, class_name) if INSTANCE_EVALS.include?(name)
+        return provably_other?(receiver, class_name) if name == :define_singleton_method
+
+        foreign_constant?(receiver, class_name)
+      end
+
+      # A receiver that is provably no instance of `class_name`: a constant or `self.class` (a class object, `K`
+      # itself included), `X.new` / `X.allocate` on a constant `X` not spelling `class_name`, or a literal.
+      def provably_other?(receiver, class_name)
+        case receiver
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then true
+        when Prism::CallNode
+          return receiver.arguments.nil? if receiver.name == :class
+
+          CONSTRUCTORS.include?(receiver.name) && foreign_constant?(receiver.receiver, class_name)
+        else LITERALS.any? { |klass| receiver.is_a?(klass) }
+        end
+      end
+
+      # A constant that does not spell `class_name`.
+      def foreign_constant?(node, class_name)
+        (node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)) && !own_class?(node, class_name)
+      end
+
+      # The children of `node` a census walk for `class_name` still descends into when `node` runs code whose `self`
+      # is another object, or nil for an ordinary node: a {.foreign?} call keeps its receiver and arguments, and a
+      # `class << obj` body its expression; both keep the code nested in them that runs on a `class_name` instance
+      # again ({.reentry_blocks}) unless `reentry` is false, as it is in a singleton-side `def`, whose `self.class`
+      # and `singleton_class` are no module of an instance. A reentered `def` comes back as the {Prism::DefNode},
+      # which a walk that stops at a `def` skips and the class-ivar census walks into (#2941).
+      def census_children(node, class_name, reentry: true)
+        case node
+        when Prism::SingletonClassNode
+          return [node.expression] unless reentry
+
+          [node.expression, *reentry_blocks(node, class_name)]
+        when Prism::CallNode
+          return nil unless foreign?(node, class_name)
+          return [node.receiver, node.arguments].compact unless reentry
+
+          [node.receiver, node.arguments, *reentry_blocks(node, class_name)].compact
+        end
+      end
+
+      # The code inside barred code whose `self` may again be an instance of `class_name`, in a `class_eval`-family
+      # block whose module may be `class_name` or the singleton class of one of its instances ({.foreign_module?}) or in
+      # a `class << obj` body on an operand {.provably_other?} does not name:
+      #
+      # - a `define_method` block on the implicit or `self` receiver, called directly or through `send` /
+      #   `public_send` / `__send__` with the literal name;
+      # - a receiver-less `def` (#2941), which defines an instance method of that module, or a singleton method of
+      #   the `class << obj` operand, just as the `define_method` does.
+      #
+      # Ruby runs each on a `K` instance (a `K` method, or a singleton method of the instance), so its writes are
+      # `K`'s; an untyped receiver keeps the credit, as {.foreign?} keeps it for `instance_eval`.
+      def reentry_blocks(node, class_name)
+        body =
+          case node
+          when Prism::SingletonClassNode then node.body unless provably_other?(node.expression, class_name)
+          when Prism::CallNode
+            node.block.body if MODULE_EVALS.include?(node.name) && !foreign_module?(node.receiver, class_name)
+          end
+        return NONE if body.nil?
+
+        found = []
+        collect_define_method_blocks(body, found)
+        found
+      end
+
+      # A `class_eval` receiver whose module is provably neither `class_name`, an ancestor of it nor an instance's
+      # singleton class, read from inside an instance body. A receiver chain is foreign only when it is:
+      #
+      # - rooted at a constant other than `class_name`'s own spelling and {ANCESTOR_ROOTS} (`Other.class_eval`,
+      #   `Other.dup`), a `X.new` or `Class.new` on such a constant among them, or rooted at a literal, through
+      #   {FOREIGN_PRESERVING} calls only;
+      # - `.class` / `.singleton_class` on a receiver {.provably_other?} names (`Other.new.class`, `"s".class`,
+      #   `self.class.class`);
+      # - rooted at a scalar literal through blockless calls of any name (`"s".upcase.class`, #2983), unless the
+      #   literal is a String or Symbol that spells a constant (`"K".constantize`).
+      #
+      # A `superclass` call may answer an ancestor (`Other.superclass` is `Object`), a `const_get` or registry call may
+      # answer the class (`Other.const_get(:K)`), and every other receiver
+      # (`self.class`, `singleton_class`, a parameter's `o.class`, `self.class.base_class`) may name `class_name`, so
+      # they keep the credit. Parentheses are looked through. The rule is syntactic: a constant naming another
+      # ancestor of the class (`Base.class_eval` with `K < Base`), an alias of it or one of its instances reads as
+      # foreign here, and the cross-file census files the barred block's code under that constant instead
+      # ({.root_constant}), whose entries the class's census joins (#2983).
+      def foreign_module?(receiver, class_name)
+        receiver = unwrap(receiver)
+        return true if scalar_literal_rooted?(receiver)
+
+        case receiver
+        when Prism::ConstantReadNode, Prism::ConstantPathNode
+          foreign_constant?(receiver, class_name) && !ANCESTOR_ROOTS.include?(receiver.slice.delete_prefix("::"))
+        when Prism::CallNode then foreign_module_call?(receiver, class_name)
+        else LITERALS.any? { |klass| receiver.is_a?(klass) }
+        end
+      end
+
+      # A call in the chain keeps it foreign only when it answers its receiver's own object, a copy, a new instance
+      # or its class ({FOREIGN_PRESERVING}); any other call (`const_get`, a registry's `fetch`, `superclass`) may
+      # answer the class, so the receiver may be it.
+      def foreign_module_call?(call, class_name)
+        if MODULE_OF_INSTANCE.include?(call.name) && call.arguments.nil? &&
+           provably_other?(unwrap(call.receiver), class_name)
+          return true
+        end
+        return false unless FOREIGN_PRESERVING.include?(call.name)
+
+        foreign_module?(call.receiver, class_name)
+      end
+
+      # Issue #2983 — whether `receiver` is a chain of blockless calls rooted at a scalar literal that spells no
+      # constant: whatever the calls are, Ruby's methods on such a literal answer no project class or its instance.
+      def scalar_literal_rooted?(receiver)
+        node = receiver
+        while node.is_a?(Prism::CallNode)
+          return false if node.block
+
+          node = unwrap(node.receiver)
+        end
+        return false if node.equal?(receiver) || SCALAR_LITERALS.none? { |klass| node.is_a?(klass) }
+
+        !((node.is_a?(Prism::StringNode) || node.is_a?(Prism::SymbolNode)) && CONSTANT_SPELLING.match?(node.unescaped))
+      end
+
+      # Issue #2983 — the constant a `class_eval` receiver chain is rooted at through {FOREIGN_PRESERVING} calls
+      # (`Anc`, `INST.class`, `AliasK.new.class`, `Other.singleton_class`), as its candidate key under `nesting`
+      # ({.candidate_key}), or nil. The module such a chain names is the constant's, its class's or its singleton's,
+      # so the code a barred block reenters runs on the constant's instances or on the object it holds; the
+      # cross-file census files it under the key, and a class whose census joins the constant the key resolves to (an
+      # ancestor, an alias, an instance constant of it) sees the write.
+      #
+      # Review round 2 of #3001 — a `.class` or `.singleton_class` taken of the constant's own value (`INST.class`,
+      # `X.singleton_class`, through `dup` / `clone` / `itself`) names the module of that object, which is a class
+      # instance only when the constant binds one; the key then carries {OBJECT_MARK}, and the join credits it only
+      # when the constant resolves to an instance binding (`INST = K.new`). One taken of a class object (`X.class` of a
+      # `.class`, `X.new.class.singleton_class`) names `Class` or a metaclass, whose methods no instance runs: nil.
+      def root_constant(receiver, nesting)
+        node = unwrap(receiver)
+        object = false
+        while node.is_a?(Prism::CallNode) && FOREIGN_PRESERVING.include?(node.name)
+          inner = unwrap(node.receiver)
+          if MODULE_OF_INSTANCE.include?(node.name)
+            value = through_copies(inner)
+            return if value.is_a?(Prism::CallNode) && MODULE_OF_INSTANCE.include?(value.name)
+
+            object = true if constant_node?(value)
+          end
+          node = inner
+        end
+        return unless node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+
+        key = candidate_key(node.slice, nesting)
+        object ? "#{OBJECT_MARK}#{key}" : key
+      end
+
+      # `node` with `dup`, `clone` and `itself` calls looked through: the object they answer has the same class.
+      def through_copies(node)
+        node = unwrap(node.receiver) while node.is_a?(Prism::CallNode) && COPIES.include?(node.name)
+        node
+      end
+
+      def constant_node?(node) = node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+
+      # Review round 1 of #3001 — the qualifications a constant spelled `spelling` may have under the lexical
+      # `nesting` (the enclosing class and module names), nearest first as Ruby's lookup tries them, joined by
+      # {CANDIDATE_SEPARATOR}: `Anc` under `N::K` is `"N::K::Anc|N::Anc|Anc"`. A rooted `::Anc`, or one at the top
+      # level, has the one candidate `"Anc"`. `ScopeIndexer::IvarContributions` resolves the key to the first
+      # candidate the project declares.
+      def candidate_key(spelling, nesting)
+        return spelling.delete_prefix("::") if spelling.start_with?("::") || nesting.empty?
+
+        nesting.size.downto(0).map { |depth| [*nesting.first(depth), spelling].join("::") }.join(CANDIDATE_SEPARATOR)
+      end
+
+      # Review round 3 of #3001 — whether `call` is `Class.new`, `Module.new`, `Struct.new` or `Data.define` on the
+      # bare constant, whose answer is a class.
+      def meta_new?(call)
+        !AnonymousMetaClass::META_NEW_SELECTORS[AnonymousMetaClass.literal_constant_name(call.receiver)].nil?
+      end
+
+      # Issue #2983 — for a constant write `C = K` or `C = K.new` / `K.allocate` under the lexical `nesting`, the
+      # census entry `[:binds_class, key, name, kind]`: `K`'s {.candidate_key}, `C`'s qualified name (a path write's
+      # as written) and `:instance` for a constructor or `:alias`, else nil. `C` is an alias or an instance of the
+      # class `K` resolves to.
+      def binding_entry(node, nesting)
+        value = unwrap(node.value)
+        instance = value.is_a?(Prism::CallNode) && CONSTRUCTORS.include?(value.name) && value.block.nil?
+        # Review round 3 of #3001: `Struct.new(:a)`, `Class.new(Base)` and `Module.new` answer a class, not an instance.
+        # A guard beside `IvarContributions.module?`, which drops the same credit once the constant is a declared class.
+        return if instance && meta_new?(value)
+
+        value = value.receiver if instance
+        return unless value.is_a?(Prism::ConstantReadNode) || value.is_a?(Prism::ConstantPathNode)
+
+        name = node.is_a?(Prism::ConstantWriteNode) ? [*nesting, node.name].join("::") : node.target.slice
+        [:binds_class, candidate_key(value.slice, nesting), name.delete_prefix("::"),
+         instance ? :instance : :alias].freeze
+      end
+
+      # Issue #2983 — the module a String `class_eval` / `module_eval` may define methods on, for
+      # `IvarWriterCensus#record_string_eval`: `owner`, the class owning a class body, for an implicit or `self`
+      # receiver there (one in an instance body raises); `instance`, the instance body's class, for a receiver
+      # {.foreign_module?} does not bar; otherwise the receiver chain's root constant ({.root_constant}); or nil.
+      def string_eval_target(node, instance, owner)
+        return (owner unless instance) if self_node?(node.receiver)
+        return instance if instance && !foreign_module?(node.receiver, instance)
+
+        nesting = instance || owner
+        root_constant(node.receiver, nesting ? nesting.split("::") : NONE)
+      end
+
+      # For a barred `class_eval`-family block whose receiver {.foreign_module?} takes as another module and whose
+      # chain is rooted at a constant ({.root_constant}), that constant's candidate key and the code in the block that
+      # runs on its module's instances, as {.reentry_blocks} collects it; else nil.
+      def rooted_reentry(node, class_name)
+        return unless MODULE_EVALS.include?(node.name) && foreign_module?(node.receiver, class_name)
+
+        root = root_constant(node.receiver, class_name.split("::"))
+        return if root.nil?
+
+        found = []
+        collect_define_method_blocks(node.block.body, found)
+        [root, found]
+      end
+
+      # `node` with any parentheses around a single expression looked through.
+      def unwrap(node)
+        while node.is_a?(Prism::ParenthesesNode)
+          body = node.body
+          body = body.body.first if body.is_a?(Prism::StatementsNode) && body.body.size == 1
+          break if body.nil? || body.is_a?(Prism::StatementsNode)
+
+          node = body
+        end
+        node
+      end
+
+      def collect_define_method_blocks(node, found)
+        return unless node.is_a?(Prism::Node)
+        return found << node if node.is_a?(Prism::DefNode) && node.receiver.nil?
+        return if BARRIERS.any? { |klass| node.is_a?(klass) }
+
+        if node.is_a?(Prism::CallNode)
+          return found << node.block if define_method_call?(node)
+          return if node.block.is_a?(Prism::BlockNode) && CALLS.include?(node.name)
+        end
+
+        node.rigor_each_child { |child| collect_define_method_blocks(child, found) }
+      end
+
+      # A `define_method` with a literal block on the implicit or `self` receiver, called directly or through a `send`
+      # whose first argument is the literal name.
+      def define_method_call?(node)
+        return false unless node.is_a?(Prism::CallNode) && self_node?(node.receiver)
+        return false unless node.block.is_a?(Prism::BlockNode)
+        return true if node.name == :define_method
+        return false unless SEND_CALLS.include?(node.name)
+
+        first = node.arguments&.arguments&.first
+        (first.is_a?(Prism::SymbolNode) || first.is_a?(Prism::StringNode)) && first.unescaped == "define_method"
+      end
+
+      # `self.class`, or a constant spelling `class_name`.
+      def own_class?(node, class_name)
+        case node
+        when Prism::CallNode
+          node.name == :class && self_node?(node.receiver) && node.arguments.nil?
+        when Prism::ConstantReadNode, Prism::ConstantPathNode
+          spelled = node.slice.delete_prefix("::")
+          spelled == class_name || spelled == class_name.split("::").last
+        else
+          false
+        end
+      end
+
+      def self_node?(node) = node.nil? || node.is_a?(Prism::SelfNode)
+    end
+  end
+end

data/lib/rigor/inference/clause_widening.rb

@@ -57,7 +57,7 @@ module Rigor
         widened = names.reduce(scope) do |acc, name|
           ivar = name.start_with?("@")
           current = ivar ? scope.ivar(name) : scope.local(name)
-          next acc if current.nil? || current == untyped
+          next acc if current.nil? || Type::Combinator.untyped?(current)
 
           ivar ? acc.with_ivar(name, untyped).without_ivar_guard(name) : acc.with_local(name, untyped)
         end

data/lib/rigor/inference/closure_escape_analyzer.rb

@@ -3,6 +3,7 @@
 require_relative "../type"
 require_relative "../reflection"
 require_relative "external_ancestor_resolution"
+require_relative "../memo_audit"
 require_relative "project_method_ownership"
 
 module Rigor
@@ -185,9 +186,15 @@ module Rigor
           return false unless scope.known_user_class?(class_name)
 
           by_method = (ProjectMethodOwnership.memo(scope)[:ancestry][class_name] ||= {})
-          return by_method[method_sym] if by_method.key?(method_sym)
+          if by_method.key?(method_sym)
+            return MemoAudit.check("ancestry non-escaping", by_method[method_sym], class_name, method_sym) do
+              compute_ancestry_non_escaping?(class_name, method_sym, scope)
+            end
+          end
 
-          by_method[method_sym] = compute_ancestry_non_escaping?(class_name, method_sym, scope)
+          by_method[method_sym] = MemoAudit.key_audit("ancestry non-escaping") do
+            compute_ancestry_non_escaping?(class_name, method_sym, scope)
+          end
         end
 
         def compute_ancestry_non_escaping?(class_name, method_sym, scope)
@@ -236,7 +243,7 @@ module Rigor
       OBJECT_NON_ESCAPING = %i[tap then yield_self].freeze
 
       ENUMERABLE_NON_ESCAPING = %i[
-        each map collect flat_map collect_concat
+        each reverse_each map collect flat_map collect_concat
         select filter reject filter_map
         find detect find_index find_all
         any? all? none? one? count tally sum
@@ -248,7 +255,7 @@ module Rigor
         zip
       ].freeze
 
-      ARRAY_EXTRA = %i[each_index].freeze
+      ARRAY_EXTRA = %i[each_index rfind index rindex].freeze
       HASH_EXTRA = %i[
         each_pair each_key each_value
         transform_keys transform_values

data/lib/rigor/inference/construction_escape.rb

@@ -3,7 +3,9 @@
 require "prism"
 require_relative "../source/node_walker"
 require_relative "../source/node_children"
-require_relative "../run_scoped_slots"
+require_relative "../source/literals"
+require_relative "../typing_state"
+require_relative "../memo_audit"
 
 module Rigor
   module Inference
@@ -26,8 +28,10 @@ module Rigor
     # A listed name the project defines anywhere (a reopen, a prepended or included module, a refinement, any
     # class at all) escapes all the same ({.project_defines?}). Every argument position escapes, and so does
     # any reference inside a block or lambda, a write whose value is used (`a = b = …`), and every local of a
-    # body that calls `binding`, `eval`, `local_variable_set`, `instance_variable_set` or a string-form
-    # `instance_eval` / `class_eval` / `module_eval`.
+    # body that reaches the frame reflectively: a call of `binding`, `eval`, `local_variable_get`,
+    # `local_variable_set`, `instance_variable_set` or a string-form `instance_eval` / `class_eval` /
+    # `module_eval`, a `send` / `__send__` / `public_send` dispatch whose first argument is one of those names
+    # as a literal Symbol or String, or a `TOPLEVEL_BINDING` reference.
     # The scan is flow insensitive and runs once per body, so an escape anywhere drops the fact for the whole body:
     # the conservative direction, since without the fact the seams answer as before. A nested `def` or class body is
     # scanned too, though its locals are its own; a same-named local there can only over-report an escape.
@@ -59,8 +63,11 @@ module Rigor
       )
 
       # Calls that read or rebind the frame's locals by name: one anywhere in a body escapes every local in it.
-      FRAME_CALLS = %i[binding eval local_variable_set instance_variable_set].to_set.freeze
+      FRAME_CALLS = %i[binding eval local_variable_get local_variable_set instance_variable_set].to_set.freeze
       STRING_EVAL_CALLS = %i[instance_eval class_eval module_eval].to_set.freeze
+      # The spellings that reach a {FRAME_CALLS} or {STRING_EVAL_CALLS} name through a literal Symbol or String
+      # argument (`send(:eval, …)`, `send("eval", …)`).
+      SEND_CALLS = %i[send __send__ public_send].to_set.freeze
 
       CLOSURES = [Prism::BlockNode, Prism::LambdaNode].freeze
       LOCAL_REFERENCES = [
@@ -73,11 +80,15 @@ module Rigor
       ].freeze
       ALL = :all
       EMPTY_CALLS = Set.new.freeze
-      # A run-scoped slot ({RunScopedSlots}): emptied when a run ends, so a long-lived process never serves a verdict
-      # from a body an earlier run parsed.
-      CACHE_KEY = RunScopedSlots.register(:__rigor_construction_escape)
-      private_constant :CLOSURES, :LOCAL_REFERENCES, :LOCAL_WRITES, :ALL, :EMPTY_CALLS, :CACHE_KEY,
-                       :STRING_EVAL_CALLS
+      # ADR-129 WD1 — a run-scoped Memo, emptied when a run ends so a long-lived process never serves a verdict from
+      # a body an earlier run parsed: keyed by body node, the only input of the scan.
+      CACHE = TypingState.memo(
+        :construction_escape,
+        run_scoped: true, audit: "construction escape",
+        reason: "keyed by the body node; the escape scan is a pure function of the body"
+      )
+      private_constant :CLOSURES, :LOCAL_REFERENCES, :LOCAL_WRITES, :ALL, :EMPTY_CALLS, :CACHE,
+                       :STRING_EVAL_CALLS, :SEND_CALLS
 
       # One body's answer: per name, ALL or the classes it escapes as, and the calls the scan admitted on it.
       Result = Data.define(:escapes, :calls)
@@ -91,8 +102,7 @@ module Rigor
       def escaped?(body, name, class_name, scope)
         return true if body.nil? || class_name.nil?
 
-        table = (Thread.current[CACHE_KEY] ||= ObjectSpace::WeakKeyMap.new)
-        result = table[body] ||= scan(body)
+        result = escape_scan(body)
         return true if result.equal?(ALL)
 
         reason = result.escapes[name]
@@ -122,11 +132,22 @@ module Rigor
         end
       end
 
+      # {.scan} of `body`, memoised for the run.
+      def escape_scan(body)
+        return scan(body) if MemoAudit.enabled? && MemoAudit.suspended?
+
+        table = TypingState.current.weak_key_map(CACHE)
+        stored = table[body]
+        return table[body] = MemoAudit.key_audit("construction escape") { scan(body) } if stored.nil?
+
+        MemoAudit.check("construction escape", stored, body) { scan(body) }
+      end
+
       def scan(body)
         escapes = {}
         calls = {}
         Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
-          return ALL if frame_call?(node)
+          return ALL if frame_access?(node)
           next unless LOCAL_REFERENCES.any? { |k| node.is_a?(k) }
 
           record(escapes, calls, node, ancestors)
@@ -148,10 +169,30 @@ module Rigor
         escapes[name] = unsafe.size == CLASSES.size ? ALL : (escapes[name] || Set.new).merge(unsafe)
       end
 
-      def frame_call?(node)
-        return false unless node.is_a?(Prism::CallNode)
+      # A node that reaches the frame's locals by name: a {FRAME_CALLS} or string-eval call, a `send`-family
+      # dispatch on a literal frame-call name (`send(:eval, …)`), or a `TOPLEVEL_BINDING` reference under any
+      # qualification (a project's own `X::TOPLEVEL_BINDING` escapes too, costing only precision), whose
+      # `local_variable_get` / `local_variable_set` reads and rebinds the top frame.
+      def frame_access?(node)
+        case node
+        when Prism::CallNode then frame_call_name?(node)
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then node.name == :TOPLEVEL_BINDING
+        else false
+        end
+      end
+
+      def frame_call_name?(node)
+        name = node.name
+        return true if FRAME_CALLS.include?(name)
+        return true if STRING_EVAL_CALLS.include?(name) && !node.arguments.nil?
+        return false unless SEND_CALLS.include?(name)
+
+        arguments = node.arguments&.arguments
+        return false if arguments.nil? || arguments.empty?
 
-        FRAME_CALLS.include?(node.name) || (STRING_EVAL_CALLS.include?(node.name) && !node.arguments.nil?)
+        dispatched = Source::Literals.symbol_or_string(arguments.first)
+        FRAME_CALLS.include?(dispatched) ||
+          (STRING_EVAL_CALLS.include?(dispatched) && arguments.size > 1)
       end
 
       # The call a read outside any closure is the receiver of, or nil.

data/lib/rigor/inference/declaration_walk.rb

@@ -5,3 +5,7 @@
 # the indexer, which loads the walk. `ScopeIndexer` itself requires the traversal file rather than this one, which
 # keeps the two free of a require cycle.
 require_relative "scope_indexer"
+
+# {Rigor::Reflection.class_declarations_in}'s collectors: the plugin-facing walk lives with `Reflection` but needs the
+# walk above, so it is loaded here rather than by `reflection/declarations`, which the engine-free paths load.
+require_relative "../reflection/declaration_collectors"

data/lib/rigor/inference/def_node_resolver.rb

@@ -2,6 +2,7 @@
 
 require "prism"
 require_relative "def_handle"
+require_relative "../typing_state"
 require_relative "../source/node_children"
 
 module Rigor
@@ -20,23 +21,35 @@ module Rigor
     # file, and finally nil — conservative (the accessor then reports no user def, losing precision but never
     # firing a wrong diagnostic), never silent.
     #
-    # The memo is a thread-local installed for the duration of a run (the {Cache::FileDigest} pattern:
-    # process-local, Ractor-safe, never crosses a fork boundary, reset per run). Outside a run scope every
+    # The memo is a {TypingState} Frame installed for the duration of a run ({.with_run}) and restored on the way
+    # out: per thread, and a fork child inherits whatever is installed at the fork. Outside a run scope every
     # resolution parses directly — a correct if un-memoised fallback for runner-less probes.
     module DefNodeResolver
-      MEMO_KEY = :rigor_def_node_resolver_memo
-      private_constant :MEMO_KEY
+      # ADR-129 WD1 — the run's memo is a Frame: {.with_run} installs it for the run and restores the previous one, and
+      # whether one is installed changes answers (outside a run every resolution parses afresh and no `Module.nesting`
+      # is recorded). The installed hash is frozen; the four tables in it are extensional caches its owner fills in
+      # place without a touch (Memos by kind, whose entry is fixed once written): `nodes` is keyed on
+      # `(path, node_id)`, `indexes` and `refinement_queries` on the file's path, and `nestings` on the identity of
+      # the node this module minted, holding the nesting the handle's bundle row (or the file's `refine` bodies)
+      # recorded for it.
+      RUN_MEMO = TypingState.frame(
+        :def_node_resolver_run,
+        memos: %i[nodes indexes nestings refinement_queries],
+        reason: "installed per run by with_run; its tables are extensional caches, keyed on (path, node_id), on the " \
+                "path, and (nestings) on the minted node's identity, filled in place",
+        # G1′ witness: an incremental recheck types a file against handles of the unchanged files, and
+        # {.resolve} reads the run's tables from inside `type_of` (#2874).
+        witness: "spec/fixtures/typing_state_witnesses/def_node_resolver_run.rb"
+      )
+      private_constant :RUN_MEMO
 
       # Installs a fresh per-run resolution memo, restoring the previous one on exit (always, even on a raise).
       # `nodes` caches the resolved node per `(path, node_id)`; `indexes` caches each file's parse index;
       # `nestings` re-attaches each handle's recorded `Module.nesting` to the node this module minted for it
       # ({.rehydrated_nesting}).
-      def self.with_run
-        previous = Thread.current[MEMO_KEY]
-        Thread.current[MEMO_KEY] = { nodes: {}, indexes: {}, nestings: {}.compare_by_identity, refinement_queries: {} }
-        yield
-      ensure
-        Thread.current[MEMO_KEY] = previous
+      def self.with_run(&)
+        memo = { nodes: {}, indexes: {}, nestings: {}.compare_by_identity, refinement_queries: {} }.freeze
+        TypingState.current.with(RUN_MEMO, memo, &)
       end
 
       # Whether a per-run memo scope is in force. The rehydrated `Module.nesting` ({.rehydrated_nesting}) is
@@ -44,7 +57,12 @@ module Rigor
       # per-run memo scope" clause states — and lets a spec assert that no handle-consuming entry point
       # resolves outside it, which is the difference between the peel fallback being a documented edge and
       # being silently reachable from production.
-      def self.run_scope? = !Thread.current[MEMO_KEY].nil?
+      def self.run_scope? = !TypingState.current[RUN_MEMO].nil?
+
+      # Issue #3160 — the nodes this run's memo has minted so far, keyed `[path, node_id]` (nil outside a run scope).
+      # The return memo keys on them, so the runner keeps the table to find an unchanged file's def in the memo once
+      # the run scope has closed.
+      def self.resolved_nodes = TypingState.current[RUN_MEMO]&.fetch(:nodes)
 
       # Resolves `handle` to a `Prism::DefNode` (the same object across the run for a given (path, node_id)), or
       # nil. A non-handle argument is returned unchanged, so callers can pass a table value that is either a live
@@ -52,7 +70,7 @@ module Rigor
       def self.resolve(handle)
         return handle unless handle.is_a?(DefHandle)
 
-        memo = Thread.current[MEMO_KEY]
+        memo = TypingState.current[RUN_MEMO]
         return locate(handle, {}) if memo.nil?
 
         key = [handle.path, handle.node_id].freeze
@@ -96,7 +114,7 @@ module Rigor
       # def_node_resolver_spec.rb` pins that, so a new one added outside a run scope fails there rather than
       # silently reverting to the peel.
       def self.rehydrated_nesting(node)
-        memo = Thread.current[MEMO_KEY]
+        memo = TypingState.current[RUN_MEMO]
         memo && memo[:nestings][node]
       end
 
@@ -117,7 +135,7 @@ module Rigor
       # read: the typed refined arm reads another file's refine body through it. The bodies' `Module.nesting`
       # is recorded as a handle's is, so the re-typed body reads its constants where it is written.
       def self.refinement_query(path)
-        memo = Thread.current[MEMO_KEY]
+        memo = TypingState.current[RUN_MEMO]
         return build_refinement_query(path, nil) if memo.nil?
 
         queries = memo[:refinement_queries]

data/lib/rigor/inference/def_return_typer.rb

@@ -126,7 +126,7 @@ module Rigor
       end
 
       def optimistic_call?(node, scope, context)
-        if scope.optimistic_origins[node]
+        if scope.optimistic_origin(node)
           return false if guarded_lookup?(node, context) || non_empty_end?(node, scope)
 
           return true