rigortype 0.4.7 → 0.4.8

data/lib/rigor/inference/flow_tracer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../typing_state"
+
 module Rigor
   module Inference
     # Thread-local event recorder behind `rigor trace`: while a block runs under {record}, the inference engine
@@ -13,8 +15,14 @@ module Rigor
     # hot paths (`ExpressionTyper#type_of`, `Scope#with_local`, `Type::Combinator.union`, `MethodDispatcher.dispatch`)
     # each guard their emit behind {active?}, so a normal (non-tracing) run pays one integer comparison.
     module FlowTracer
-      KEY = :__rigor_flow_tracer__
-      private_constant :KEY
+      # ADR-129 WD1 — the installed recorder is a Frame whose contents are a Resource: each emit into it touches. It is
+      # an output the engine never reads back, and the activation count below is a process switch, outside the typing
+      # state (WD5). G1′: a tracer switch, under which the `type_of` memo stays shut (WD4).
+      RECORDER = TypingState.frame(
+        :flow_tracer, contents: :resource, reason: "the recorder a trace installs; each emit records into it",
+                      memo_shut_while_installed: true
+      )
+      private_constant :RECORDER
 
       # One animation-relevant moment.
       #
@@ -95,15 +103,16 @@ module Rigor
       # Activates recording on the current thread for the duration of the block and returns the frozen event list.
       # Nests safely; restores the previous recorder on exit.
       def record
-        previous = Thread.current[KEY]
         recorder = Recorder.new
-        Thread.current[KEY] = recorder
-        @mutex.synchronize { @active_count += 1 }
-        yield
-        recorder.events.freeze
-      ensure
-        Thread.current[KEY] = previous
-        @mutex.synchronize { @active_count -= 1 }
+        TypingState.current.with(RECORDER, recorder) do
+          @mutex.synchronize { @active_count += 1 }
+          begin
+            yield
+            recorder.events.freeze
+          ensure
+            @mutex.synchronize { @active_count -= 1 }
+          end
+        end
       end
 
       # Plain integer read (GVL-atomic) — the disabled fast path.
@@ -114,20 +123,28 @@ module Rigor
       # Brackets one expression-typing recursion. Falls through to the bare block when the current thread is not
       # recording (another thread may have flipped {active?}).
       def trace_node(node, &)
-        recorder = Thread.current[KEY]
+        recorder = recording
         return yield unless recorder
 
         recorder.node(node, &)
       end
 
+      # The recorder installed on this thread, touched because the caller is about to record into it, or nil.
+      def recording
+        state = TypingState.current
+        recorder = state[RECORDER]
+        state.touch(RECORDER) if recorder
+        recorder
+      end
+
       # `Scope#with_local` — the moment a local enters the scope.
       def bind(name, type)
-        Thread.current[KEY]&.emit(:bind, data: { name: name.to_s, type: describe(type) })
+        recording&.emit(:bind, data: { name: name.to_s, type: describe(type) })
       end
 
       # `Type::Combinator.union` — the moment branch types merge (including degenerate collapses like `1 | 1 → 1`).
       def union(members, result)
-        Thread.current[KEY]&.emit(
+        recording&.emit(
           :union,
           data: { members: members.map { |m| describe(m) }.freeze, type: describe(result) }
         )
@@ -136,7 +153,7 @@ module Rigor
       # `MethodDispatcher.dispatch` — resolution or the fail-soft `nil` ("no rule matched"; the caller will widen
       # to `Dynamic[Top]`).
       def dispatch(receiver:, method_name:, args:, result:, location: nil)
-        recorder = Thread.current[KEY]
+        recorder = recording
         return unless recorder
 
         recorder.emit(

data/lib/rigor/inference/fork_map.rb

@@ -3,6 +3,7 @@
 require "tmpdir"
 
 require_relative "../runtime/jit"
+require_relative "../type_of_memo"
 
 module Rigor
   module Inference
@@ -95,6 +96,7 @@ module Rigor
           # what is left of the parent's window rather than a fresh one; {Runtime::Jit.rearm_after_fork}
           # carries the mechanism.
           Runtime::Jit.rearm_after_fork
+          TypeOfMemo.forked
           # Published before the block runs, so anything it lazily creates for this process alone lands in the
           # parent's tmpdir and dies with it. See {.child_scratch_dir}.
           @child_scratch_dir = File.dirname(out_path)
@@ -105,6 +107,7 @@ module Rigor
         ensure
           @child_scratch_dir = nil
         end
+        TypeOfMemo.write_report
         exit!(status)
       end
 

data/lib/rigor/inference/fresh_frame_blocks.rb

@@ -23,7 +23,8 @@ module Rigor
     #   what it reads. Unlike a root block it shares that slot, so a match in it still rebinds the definer's `$~`.
     #
     # `Enumerator.new` is neither: its block runs on an internal fiber whose root is not the block, so it reads and
-    # rebinds the creator's slot like any other block.
+    # rebinds the creator's slot. It reads that slot when the enumerator is read, though, not where the block is
+    # written ({.deferred_body?}, issue #3195).
     #
     # The receiver of a root call must be the literal constant, and must resolve to the core class where a scope is
     # at hand, so a project's own `Thread` (`module Pool; class Thread; …`) keeps the ordinary block rules.
@@ -115,6 +116,56 @@ module Rigor
         scope.forget_error_info.forget_last_status
       end
 
+      # The core constructors that keep their block and run it on a schedule of their own: an enumerator's generator
+      # runs when the enumerator is first read, and a hash's default proc on a missing key.
+      DEFERRED_CONSTRUCTORS = Set[:Enumerator, :Hash].freeze
+      private_constant :DEFERRED_CONSTRUCTORS
+
+      # Issue #1371, #3195 — true when `block_node` is a body that runs later than where it is written, on the slot of
+      # the frame that wrote it: a proc's ({.proc_body?}), or the block of `Enumerator.new` or `Hash.new` on the core
+      # class ({.deferred_constructor?}). Such a body runs whenever the proc is called, the enumerator is read or a
+      # key is missing, so the frame-local specials narrowed where it is written prove nothing about the slot it
+      # reads then. It enters with `$_` unbound ({LastLine.block_entry}), and with the match globals as
+      # {MatchRebinding.block_entry} gives each kind. It still shares the slot, so a match or a reader it runs
+      # rebinds the frame's as any block's does. The other calls that keep their block ({StoredBlockCall}) are a
+      # definer's or a root's ({.entry}).
+      def deferred_body?(block_node, call_node, scope)
+        proc_body?(block_node, call_node, scope) || deferred_constructor?(block_node, call_node, scope)
+      end
+
+      # Issue #1371 — true when `block_node` is the body of a proc made where it is written: a lambda literal, or the
+      # block of Kernel's `lambda` / `proc` or of `Proc.new` on the core class. It enters with the match globals
+      # unbound; a project's own `Proc` keeps the ordinary entry.
+      # Only a lambda literal the statement evaluator enters gets this entry: one written as an operand is typed as a
+      # value, and the rule walker reads its body in the enclosing scope.
+      def proc_body?(block_node, call_node, scope)
+        return true if block_node.is_a?(Prism::LambdaNode)
+        return false unless call_node.is_a?(Prism::CallNode) && call_node.block.equal?(block_node)
+
+        receiver = call_node.receiver
+        case call_node.name
+        when :lambda, :proc then StoredBlockCall.kernel_spelled?(receiver)
+        when :new then StoredBlockCall.root_constant_name(receiver) == :Proc && core_class?(receiver, :Proc, scope)
+        else false
+        end
+      end
+
+      # Issue #3195 — true when `block_node` is the block of `Enumerator.new` or `Hash.new` on the literal constant
+      # naming the core class. The block often runs right away, in the statement that makes it
+      # (`Enumerator.new { … }.to_a`, `Hash.new { … }[key]`), and reads the narrowing then; it may as well run after a
+      # later match. The analyzer does not follow which, so the body enters with a narrowed match global untyped, as
+      # a definer body does ({.entry}): neither narrowed nor flagged. A project's own `Enumerator` or `Hash` keeps
+      # the ordinary entry, and so does every other spelling of the core class: a subclass (`Class.new(Hash)`), an
+      # alias (`E = Enumerator`), `Object::Enumerator`, or a receiver that is not a constant (`klass.new { … }`).
+      def deferred_constructor?(block_node, call_node, scope)
+        return false unless call_node.is_a?(Prism::CallNode) && call_node.name == :new &&
+                            call_node.block.equal?(block_node)
+
+        receiver = call_node.receiver
+        constant = StoredBlockCall.root_constant_name(receiver)
+        DEFERRED_CONSTRUCTORS.include?(constant) && core_class?(receiver, constant, scope)
+      end
+
       def core_class?(receiver, constant, scope)
         type = scope.type_of(receiver)
         type.is_a?(Type::Singleton) && type.class_name == constant.name

data/lib/rigor/inference/global_write_census.rb

@@ -29,8 +29,8 @@ module Rigor
     # - `[:main_mixin, name]` — a module a top-level `include`, `prepend` or `extend` mixes into `Object` (or
     #   `main`), as written. A module RBS does not know may carry any method, so it reaches every class.
     # - the instance-variable writer entries of {IvarWriterCensus} (issue #1154): `[:ivar_set, name]`,
-    #   `[:ivar_set_class, class_name]`, `[:own_write, class_name, name, path]` and, issue #2079,
-    #   `[:own_write_type, class_name, name, value, path]`.
+    #   `[:ivar_set_class, class_name]`, `[:own_write, class_name, name, path]`, issue #2079's
+    #   `[:own_write_type, class_name, name, value, path]` and issue #2983's `[:binds_class, class_key, constant]`.
     # - `[:global_writer, name, method]` — issue #2314: a write of the global `name` inside a method body, keyed by
     #   the `def`'s name (or the literal name a `define_method` block defines), or by nil inside a lambda or a block
     #   its call keeps to run later ({StoredBlockCall}). A write in a block its call runs at once belongs to the
@@ -87,7 +87,7 @@ module Rigor
       end
 
       # #1154 — the {IvarWriterCensus} entries of `census`, for the incremental diff and its readers.
-      IVAR_KINDS = %i[ivar_set ivar_set_class own_write own_write_type].to_set.freeze
+      IVAR_KINDS = %i[ivar_set ivar_set_class own_write own_write_type binds_class].to_set.freeze
 
       def ivar_set_entries(census) = census.select { |entry| IVAR_KINDS.include?(entry.first) }.to_set
 
@@ -97,6 +97,7 @@ module Rigor
         when :ivar_set then "ivar_set:#{entry[1]}"
         when :ivar_set_class then "ivar_set_class:#{entry[1]}"
         when :own_write_type then "own_write_type:#{entry[1]}##{entry[2]}"
+        when :binds_class then "binds_class:#{entry[1].split(CensusForeignBlock::CANDIDATE_SEPARATOR).last.split('::').last}"
         else "own_write:#{entry[1]}##{entry[2]}"
         end
       end
@@ -156,9 +157,10 @@ module Rigor
         # A node the collector cannot read must not fail the analysis of its file, nor of every file the pre-pass
         # feeds: the census then counts it as a definition of every name, which only declines a report.
         # `owner` is the qualified name of the class whose body the node sits in, for {IvarWriterCensus} (nil where
-        # the host walk does not track it, or no class owns an instance there).
-        def visit(node, top_level:, owner: nil)
-          @ivar_writers.visit(node, owner)
+        # the host walk does not track it, or no class owns an instance there); `receiver_owner` the class an
+        # explicit-receiver writer call names (issue #2488).
+        def visit(node, top_level:, owner: nil, receiver_owner: nil)
+          @ivar_writers.visit(node, owner, receiver_owner)
           visit_global_writer(node)
           case node
           when Prism::AliasGlobalVariableNode then visit_global_alias(node)

data/lib/rigor/inference/in_effect_refinements.rb

@@ -6,6 +6,7 @@ require_relative "../source/constant_path"
 require_relative "../source/node_children"
 require_relative "refine_census"
 require_relative "refine_self"
+require_relative "../typing_state"
 require_relative "in_effect_refinements/proc_literals"
 require_relative "in_effect_refinements/scope_reads"
 require_relative "in_effect_refinements/refine_defs"
@@ -53,6 +54,12 @@ module Rigor
     #
     # Built lazily: the walk runs the first time a consumer asks, so a file nobody asks about pays one small object.
     class InEffectRefinements
+      # ADR-129 G4 — {#build} fills every one of these once, from the file's root node alone.
+      TypingState.memo_field(self, :@built, :@activations, :@refinement_defs, :@refine_defs, :@chained_refined_calls,
+                             :@class_body_refines, :@refine_contexts, :@literal_bindings, :@refine_offsets,
+                             :@unresolved_using, :@nesting,
+                             reason: "built once by #build from the file's root node alone")
+
       # The marker an activation contributes when it may put any refinement in effect: a non-constant `using`, a
       # `using` whose include expansion is unknown, or a `refine` block whose module this walk cannot name. A list
       # that carries it answers "any refinement may be in effect"; its position carries no meaning.

data/lib/rigor/inference/indexed_narrowing.rb

@@ -33,8 +33,10 @@ module Rigor
     #
     # **Invalidation.** Three conditions drop a recorded narrowing:
     # - The receiver variable is rebound (handled inside `Scope#with_local` / `Scope#with_ivar`).
-    # - An intervening `receiver[key] = value` writes the same slot — `:[]=` could rebind the
-    #   slot to nil; conservative drop.
+    # - An intervening store writes the same slot — `receiver[key] = value`, an index target, or a
+    #   compound `receiver[key] op= value` / `&&=` (issue #1218) — since it could rebind the slot to
+    #   nil; conservative drop. A store whose index is not one literal key drops every narrowing
+    #   on the receiver.
     # - An intervening mutator from {MutationWidening::SHAPE_MUTATORS} runs against the receiver
     #   (e.g. `params.delete(:f)`, `params.clear`, `params.default = 0`, `buf.delete_prefix!("x")`).
     #
@@ -138,14 +140,61 @@ module Rigor
         MutationWidening::SHAPE_MUTATORS.include?(method_name)
       end
 
-      def invalidate_indexed_write(call_node, current_scope)
-        args = call_node.arguments&.arguments
-        return current_scope if args.nil? || args.empty?
+      # Drops the narrowing on the slot a store through `[]=` overwrote. `node` is the `[]=` call, an index target
+      # (a multi-assign slot, a `for` index, a rescue reference) or a compound index write (`h[k] += v`,
+      # `h[k] &&= v`, `h[k] ||= v`); every form reads only `receiver` and `arguments`, and only a `[]=` call's last
+      # argument is the stored value rather than an index.
+      #
+      # Issue #1218 — a literal single index drops that one slot and leaves the others. Any other index list on a
+      # stable receiver — a key that is not a literal (`h[k] = 1` may be `h[:e] = 1`), a multi-index splice
+      # (`s[0, 1] = [1, 2]` shifts every later slot), a splat — may write any slot, so it drops every narrowing on
+      # the receiver, as {.invalidate_mutator} does. So does a negative Integer index on a receiver not shown to be a
+      # `Hash`: on an `Array` `a[-1]` is the slot some non-negative index also names. An unstable receiver records
+      # no narrowing to drop.
+      def invalidate_indexed_write(node, current_scope)
+        receiver = stable_receiver(node.receiver)
+        return current_scope if receiver.nil?
 
-        address = stable_address(call_node.receiver, args.first)
-        return current_scope if address.nil?
+        indexes = index_arguments(node)
+        address = indexes.size == 1 ? stable_address(node.receiver, indexes.first) : nil
+        if address && !(negative_index?(address.last) && !hash_receiver?(current_scope.type_of(node.receiver)))
+          return current_scope.without_indexed_narrowing(*address)
+        end
+
+        current_scope.without_indexed_narrowings_for(*receiver)
+      end
+
+      # Whether the literal `key` may name the same slot as another literal key: a negative Integer, unless the
+      # receiver is a `Hash`, which tells `-1` from every other key.
+      def aliasing_index?(key, receiver_type)
+        negative_index?(key) && !hash_receiver?(receiver_type)
+      end
+
+      def negative_index?(key) = key.is_a?(Integer) && key.negative?
+
+      def hash_receiver?(receiver_type) = carrier_receiver_type?(receiver_type, HASH_CARRIER)
+
+      VERBATIM_STORE_CARRIERS = %w[Hash Array].freeze
+      HASH_CARRIER = %w[Hash].freeze
+      private_constant :VERBATIM_STORE_CARRIERS, :HASH_CARRIER
+
+      # Whether a store through `[]=` on a receiver of `receiver_type` at the literal `key` leaves exactly the stored
+      # value at that slot, so a recorded narrowing may claim it. Only a `Hash` or `Array` carrier (a shape, a tuple,
+      # a `Hash` / `Array` nominal, refined or not) does, for every member of a union. A `String`'s `[]=` splices
+      # (`s[0] = "xy"` leaves `s[0] == "x"`), and a project class's `[]=` may store anything. A negative Integer key
+      # aliases a non-negative one on an `Array` ({.aliasing_index?}), so it records only on a `Hash`.
+      def verbatim_slot?(receiver_type, key)
+        carrier_receiver_type?(receiver_type, VERBATIM_STORE_CARRIERS) && !aliasing_index?(key, receiver_type)
+      end
+
+      def carrier_receiver_type?(type, classes)
+        members = type.is_a?(Type::Union) ? type.members : [type]
+        members.all? { |member| classes.include?(UnknownStoreWidening.carrier_class(member)) }
+      end
 
-        current_scope.without_indexed_narrowing(*address)
+      def index_arguments(node)
+        args = node.arguments&.arguments || []
+        node.is_a?(Prism::CallNode) ? args[0...-1] : args
       end
 
       def invalidate_mutator(call_node, current_scope)

data/lib/rigor/inference/ivar_writer_census.rb

@@ -2,6 +2,9 @@
 
 require "prism"
 
+require_relative "census_foreign_block"
+require_relative "receiver_writer_call"
+
 module Rigor
   module Inference
     # Issue #1154 — the instance-variable writers {GlobalWriteCensus} records for the declared-parameter credit
@@ -24,9 +27,15 @@ module Rigor
     #   file writes the same ivar of the same class.
     # - `[:own_write_type, class_name, name, value]` — issues #2079 / #2170: the same write with its coarse value, a
     #   literal's as `[:lit, value]` and anything else as {DYNAMIC}, and a class-body `attr_writer` /
-    #   `attr_accessor` of the name as {DYNAMIC}. The path is appended as for `:own_write`. The class-ivar census
-    #   of a file joins another file's entries, and those of the modules and superclasses on the class's chain,
-    #   into the ivars it already holds ({ScopeIndexer::IvarContributions}).
+    #   `attr_accessor` of the name as {DYNAMIC}. The path is appended as for `:own_write`. Issue #2488: an
+    #   explicit-receiver `E.attr_writer` / `E.attr_accessor` (or one through `send`) records the same {DYNAMIC}
+    #   entry under `E`, and an `E.define_method` block is an instance body of `E` ({ReceiverWriterCall}). The
+    #   class-ivar census of a file joins another file's entries, and those of the modules and superclasses on the
+    #   class's chain, into the ivars it already holds ({ScopeIndexer::IvarContributions}).
+    #   Issue #2983: a barred `class_eval`-family block on a receiver rooted at another constant files the code in it
+    #   that runs on an instance under that constant's candidate key ({#remember_root_constant}), a String
+    #   `class_eval` records a {DYNAMIC} write of {ANY_IVAR} ({#record_string_eval}), and a constant write `C = K` /
+    #   `C = K.new` records `[:binds_class, key, "C"]` ({#record_binding}), so the join can take `C`'s entries for `K`.
     class IvarWriterCensus
       SEND_CALLS = %i[send __send__ public_send].to_set.freeze
       # The methods a `send` reaching which is an open-world writer.
@@ -41,6 +50,10 @@ module Rigor
       NO_ARGUMENTS = [].freeze
       # Issue #2079 — the coarse value of a write that is not a literal.
       DYNAMIC = :dynamic
+      # Issue #2983 — the ivar name of a write whose ivar no literal spells: a string `class_eval`'s code may write any.
+      ANY_IVAR = :*
+      # The `class_eval`-family calls that take code in a String.
+      STRING_EVALS = %i[class_eval module_eval].to_set.freeze
       # The writer declarations a class body records as a {DYNAMIC} write of each name it spells.
       WRITER_DECLARATIONS = %i[attr_writer attr_accessor].to_set.freeze
 
@@ -54,16 +67,22 @@ module Rigor
         @owner_names = {}.compare_by_identity
         @own_writes = {}
         @typed_writes = Set.new
+        @rooted = Set.new.compare_by_identity
       end
 
       # Fed each node of a pre-order descent. `owner` is the class whose body the node sits in, as its qualified name
       # or as the host walk's prefix Array (joined here only when an entry needs it), or nil where no class owns an
-      # instance (`class << self`, the top level, an opaque block).
-      def visit(node, owner)
+      # instance (`class << self`, the top level, an opaque block). `receiver_owner` is the class an explicit-receiver
+      # writer call ({ReceiverWriterCall}) names, resolved by the host walk as it resolves a `class_eval` receiver.
+      def visit(node, owner, receiver_owner = nil)
         case node
-        when Prism::DefNode then remember(node.location, owner) if owner && node.receiver.nil?
+        when Prism::DefNode then remember_host(node, owner) if node.receiver.nil?
+        when Prism::ConstantWriteNode, Prism::ConstantPathWriteNode then record_binding(node, owner)
         when Prism::SingletonClassNode then visit_singleton_class(node)
-        when Prism::CallNode then visit_call(node, owner) if WATCHED_CALLS.include?(node.name)
+        when Prism::CallNode
+          bar_foreign_block(node)
+          visit_call(node, owner) if WATCHED_CALLS.include?(node.name)
+          record_receiver_writers(node, receiver_owner) if receiver_owner
         when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode,
              Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableTargetNode
           record_own_write(node) unless @instance_ranges.empty?
@@ -111,6 +130,74 @@ module Rigor
         [:lit, node.is_a?(Prism::SymbolNode) ? text.to_sym : text.dup.freeze].freeze
       end
 
+      # Issue #2490 — a block inside an instance body whose `self` is another object ({CensusForeignBlock}) is
+      # remembered with no owner, so its writes credit nothing. Pre-order, so an instance body nested in it (an
+      # `E.define_method` block, remembered after) still answers for its own class.
+      def bar_foreign_block(node)
+        return if @instance_ranges.empty? || !CensusForeignBlock::CALLS.include?(node.name)
+
+        instance = instance_owner(node)
+        return unless instance && CensusForeignBlock.foreign?(node, owner_name(instance))
+
+        remember(node.block.location, nil)
+        remember_reentry(node, instance)
+        remember_root_constant(node, instance)
+      end
+
+      # Issue #2983 — the code a barred `class_eval`-family block on a receiver rooted at another constant reenters
+      # (`Anc.class_eval`, `INST.class.class_eval`, `AliasK.new.class.class_eval`), remembered under that constant's
+      # candidate key ({CensusForeignBlock.root_constant}), in place of the host walk's as-written owner. A class
+      # whose census joins the entries of the constant the key resolves to, an ancestor's, an alias's or an instance
+      # constant's ({ScopeIndexer::IvarContributions}), then sees the write.
+      def remember_root_constant(node, instance)
+        root, blocks = CensusForeignBlock.rooted_reentry(node, owner_name(instance))
+        blocks&.each { |block| remember(block.location, root) }
+        @rooted.merge(blocks) if blocks
+      end
+
+      # The host walk's `owner` of a `def` or `define_method` block, unless {#remember_root_constant} filed it already.
+      def remember_host(node, owner) = (remember(node.location, owner) if owner && !@rooted.include?(node))
+
+      # Issue #2983 — `C = K` or `C = K.new` (`.allocate`) records `[:binds_class, key, "C"]`, `K`'s candidate key and
+      # `C`'s qualified name ({CensusForeignBlock.binding_entry}), so a class's census also joins the entries filed
+      # under an alias or an instance constant of it (`AliasK.class_eval { … }`, `INST.class.class_eval { … }`).
+      def record_binding(node, owner)
+        entry = CensusForeignBlock.binding_entry(node, nesting(owner))
+        @census << entry if entry
+      end
+
+      # The lexical class and module names `owner` spells: the host walk's prefix Array, or a resolved name.
+      def nesting(owner) = owner.nil? ? NO_ARGUMENTS : owner_name(owner).split("::")
+
+      # Issue #2983 — `class_eval` / `module_eval` given a String runs code the census cannot read, which may define
+      # a method writing any ivar: a {DYNAMIC} write of {ANY_IVAR} is recorded for the module the receiver may be. That
+      # is the class owning the body for an implicit or `self` receiver in a class body, the instance's class for a
+      # receiver in an instance body that {CensusForeignBlock.foreign_module?} does not bar, and otherwise the constant
+      # the receiver chain is rooted at.
+      def record_string_eval(node, owner)
+        return unless STRING_EVALS.include?(node.name) && node.block.nil? && node.arguments
+
+        instance = instance_owner(node) unless @instance_ranges.empty?
+        target = CensusForeignBlock.string_eval_target(node, owner_name(instance), owner_name(owner))
+        record_typed_write(target, ANY_IVAR, DYNAMIC) if target
+      end
+
+      # The `define_method` blocks in a barred body that run on the instance again, remembered after the bar so they
+      # answer for the instance's class ({CensusForeignBlock.reentry_blocks}).
+      def remember_reentry(node, instance)
+        CensusForeignBlock.reentry_blocks(node, owner_name(instance)).each do |block|
+          remember(block.location, instance)
+        end
+      end
+
+      # Issue #2488 — `E.attr_writer :w` declares a writer of `@w` on `E`, and `E.define_method(:m) { … }` installs an
+      # instance body of `E`, wherever the call sits.
+      def record_receiver_writers(node, class_name)
+        ReceiverWriterCall.writer_ivars(node).each { |ivar| record_typed_write(class_name, ivar, DYNAMIC) }
+        block = ReceiverWriterCall.define_method_block(node)
+        remember(block.location, class_name) if block
+      end
+
       # Issue #2079 — `attr_writer :x` / `attr_accessor :x` in a class body writes `@x` with whatever the caller hands.
       def record_writer_declaration(node, owner)
         return unless owner && WRITER_DECLARATIONS.include?(node.name) && self_receiver?(node)
@@ -128,7 +215,8 @@ module Rigor
 
       def visit_call(node, owner)
         record_writer_declaration(node, owner)
-        remember(node.block.location, owner) if owner && define_method_block?(node)
+        record_string_eval(node, owner)
+        remember_host(node.block, owner) if define_method_block?(node)
         if self_receiver?(node) || own_singleton_class_call?(node)
           return if @instance_ranges.empty? || !(own_singleton_class_call?(node) || open_world?(node))
 
@@ -139,12 +227,19 @@ module Rigor
         end
       end
 
-      # `class << self` inside an instance `def` opens the instance's singleton class.
+      # `class << self` inside an instance `def` opens the instance's singleton class. Its body's `self` is that
+      # singleton class, so an `@x` write there is the singleton's own ivar (#2490), whatever the expression.
       def visit_singleton_class(node)
-        return unless node.expression.is_a?(Prism::SelfNode) && !@instance_ranges.empty?
+        return if @instance_ranges.empty?
 
         instance = instance_owner(node)
-        record_class(instance) if instance
+        return unless instance
+
+        record_class(instance) if node.expression.is_a?(Prism::SelfNode)
+        return unless node.body
+
+        remember(node.body.location, nil)
+        remember_reentry(node, instance)
       end
 
       def record_class(owner) = @census << [:ivar_set_class, owner_name(owner)].freeze

data/lib/rigor/inference/key_presence_guard.rb

@@ -5,7 +5,8 @@ require "prism"
 require_relative "../type"
 require_relative "mutation_widening"
 require_relative "key_presence_guard/scan"
-require_relative "../run_scoped_slots"
+require_relative "../typing_state"
+require_relative "../memo_audit"
 
 module Rigor
   module Inference
@@ -58,9 +59,22 @@ module Rigor
         ] + MutationWidening::SHAPE_MUTATORS.to_a
       ).to_set.freeze
 
-      STATE_KEY = :__rigor_key_presence_guard
-      CACHE_KEY = RunScopedSlots.register(:__rigor_key_presence_guard_rewalk)
-      private_constant :STATE_KEY, :CACHE_KEY
+      # ADR-129 WD1 — the walk {.with_guards} installs is a Frame, and {.record}, which rewrites its `guard_ends` in
+      # place, is a Resource touch that also takes a fresh id ({TypingState::State#rewrite}), so a read of the walk's
+      # guards is fixed while the id is. The walk's `defs`, `frozen_constants` and `memo` are extensional caches of
+      # `root`, filled in place without a touch.
+      WALK = TypingState.frame(
+        :key_presence_walk,
+        contents: :resource, read_exemption: :id_determined,
+        reason: "installed per guarded re-walk; each recorded guard rewrites its `guard_ends`",
+        witness: "spec/fixtures/typing_state_witnesses/key_presence_walk.rb"
+      )
+      REWALK = TypingState.memo(
+        :key_presence_rewalk,
+        run_scoped: true, audit: "key presence rewalk",
+        reason: "the last file's guarded index, keyed by the file's root"
+      )
+      private_constant :WALK, :REWALK
 
       # The re-walk's state: the file's root, the end offset of each recorded guard, and the per-file scans.
       Walk = Struct.new(:root, :guard_ends, :defs, :frozen_constants, :memo) do
@@ -88,25 +102,21 @@ module Rigor
 
       # Runs the block with guards recorded and read, for the re-walk of `root`. Thread-local, so it holds under a
       # Ractor worker too.
-      def with_guards(root)
-        previous = Thread.current[STATE_KEY]
-        Thread.current[STATE_KEY] = Walk.new(root, {}, nil, nil, {})
-        yield
-      ensure
-        Thread.current[STATE_KEY] = previous
+      def with_guards(root, &)
+        TypingState.current.with(WALK, Walk.new(root, {}, nil, nil, {}), &)
       end
 
       # Runs the block with guards off again: a callee's return summary, memoised for the whole run, must be the one
       # the file's analysis reads.
-      def without_guards
-        previous = Thread.current[STATE_KEY]
-        Thread.current[STATE_KEY] = nil
-        yield
-      ensure
-        Thread.current[STATE_KEY] = previous
+      def without_guards(&)
+        TypingState.current.with(WALK, nil, &)
       end
 
-      def active? = !Thread.current[STATE_KEY].nil?
+      def active? = !TypingState.current[WALK].nil?
+
+      # {.active?}, read only to decide whether to turn the walk off for the extent that follows ({.without_guards}):
+      # that extent reads it off either way, so the key audit does not count the read (ADR-129 WD1).
+      def forcing_off? = !TypingState.current.forcing_read(WALK).nil?
 
       # Whether `call.possible-nil-receiver` should withhold its report on `call_node`, whose receiver the file's
       # analysis types `receiver_type`: true only when the guarded re-walk types that receiver as exactly
@@ -130,19 +140,33 @@ module Rigor
       # The guarded scope index of `root`, built once per file (the cache holds the last file only), or nil when the
       # file holds no guard-shaped call.
       def rewalk(root, scope_index)
-        cached = Thread.current[CACHE_KEY]
-        return cached.last if cached&.first.equal?(root)
+        return guarded_index(root, scope_index) if MemoAudit.enabled? && MemoAudit.suspended?
+
+        state = TypingState.current
+        cached = state[REWALK]
+        if cached&.first.equal?(root)
+          # A re-walk that raised is stored as nil, and its audit recomputation answers nil the same way.
+          return MemoAudit.check("key presence rewalk", cached.last, root) do
+            guarded_index(root, scope_index)
+          rescue StandardError
+            nil
+          end
+        end
 
         # Cached before the walk, so a re-walk that raises is attempted once per file and then answers nil.
-        Thread.current[CACHE_KEY] = [root, nil]
+        state[REWALK] = [root, nil]
+        index = MemoAudit.key_audit("key presence rewalk") { guarded_index(root, scope_index) }
+        state[REWALK] = [root, index]
+        index
+      end
+
+      def guarded_index(root, scope_index)
         return nil unless guard_shaped_call?(root)
 
         base = scope_index[root]
-        index = base && with_guards(root) do
+        base && with_guards(root) do
           ScopeIndexer.index(root, default_scope: base.with_isolated_side_tables)
         end
-        Thread.current[CACHE_KEY] = [root, index]
-        index
       end
 
       def guard_shaped_call?(node)
@@ -206,7 +230,8 @@ module Rigor
       # The truthy edge of `receiver.key?(key)` with a non-literal key, inside the re-walk: `scope` with the guard
       # recorded, or nil when the guard does not apply.
       def record(call_node, scope)
-        walk = Thread.current[STATE_KEY]
+        state = TypingState.current
+        walk = state[WALK]
         return nil if walk.nil?
 
         args = call_node.arguments&.arguments
@@ -217,6 +242,7 @@ module Rigor
         return nil unless receiver_type?(scope.type_of(call_node.receiver))
         return nil unless Scan.eligible?(walk, call_node, guard)
 
+        state.rewrite(WALK)
         walk.guard_ends[guard] = call_node.location.end_offset
         scope.with_indexed_narrowing(*guard, PRESENT)
       end
@@ -226,7 +252,7 @@ module Rigor
       # read may have changed it ({.intervening?}), and no value of the receiver can be `nil` (the read cannot tell a
       # value's own `nil` from the miss). Nil when no guard applies or nothing would change.
       def guarded_read(node, type, scope)
-        walk = Thread.current[STATE_KEY]
+        walk = TypingState.current[WALK]
         guard = walk && held_guard(node, scope)
         return nil if guard.nil? || Scan.intervening?(walk, guard, node)