rigortype 0.4.7 → 0.4.8

data/lib/rigor/analysis/runner.rb

@@ -64,8 +64,10 @@ module Rigor
 
       # ADR-89 WD2 — bounds on the persisted return summaries (per-def observed call keys, and total defs
       # summarised) so the incremental snapshot stays small. A def observed under more keys than the per-def
-      # cap keeps only the first; a def past the total cap is dropped (its symbol dependents then always
-      # re-check — the conservative direction).
+      # cap keeps none of them (issue #3116): the keys past the cap are unknown, so equal returns at the first
+      # eight prove nothing about the ninth key's reader. A def past the total cap keeps none either. Both are
+      # harvested as nil ({#return_summaries}), which the session stores as no summary at all, so the def's symbol
+      # dependents always re-check — the conservative direction.
       RETURN_SUMMARY_KEYS_PER_DEF = 8
       RETURN_SUMMARY_TOTAL_CAP = 4000
 
@@ -515,6 +517,10 @@ module Rigor
         # The return memo bucket the last `run` filled, kept for {#return_summaries} once the run has released the
         # thread's slot; nil before the first run.
         @return_memo = nil
+        # The `[path, node_id] => Prism::DefNode` table the last `run`'s {Inference::DefNodeResolver} filled, kept for
+        # the same reader.
+        @resolved_def_nodes = nil
+        @probe_reads = {}.freeze
         build_collaborators
       end
 
@@ -528,6 +534,9 @@ module Rigor
       # errors. The Environment is built once at run start through `Environment.for_project` so all files
       # share the same RBS load.
       def run(paths = @configuration.paths)
+        # ADR-129 WD5 (#2785) — a mismatch left on the thread by typing after an earlier run (its return summaries, a
+        # language-server hover) fails here rather than reaching this run's first file as a crash row.
+        Inference::MemoAudit.raise_undrained!
         # One per-run file-digest memo spans the whole run, so a path is SHA-256'd at most once across the
         # run-diagnostics dependency descriptor, its `fresh?` validation, the RBS signature tree, and every
         # plugin producer's watched-glob validation (they overlap heavily on the warm path). The nested ADR-85
@@ -536,7 +545,12 @@ module Rigor
         # ADR-87 WD1 — `cache.validation` (or the RIGOR_STRICT_VALIDATION env, which wins) selects the
         # freshness path for this run; the `auto` default resolves strict in CI (#190), stat-first elsewhere.
         Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
-          Inference::DefNodeResolver.with_run { run_analysis(paths) }
+          Inference::DefNodeResolver.with_run do
+            run_analysis(paths)
+          ensure
+            # Issue #3160 — the memo keys an unchanged file's def on the node the resolver minted for its handle.
+            @resolved_def_nodes = Inference::DefNodeResolver.resolved_nodes
+          end
         ensure
           # ADR-89 WD2 — {#return_summaries} reads the return memo after the run, so the runner keeps the bucket the
           # run filled before the thread's run-scoped slots are released (issues #2412, #2399).
@@ -788,15 +802,28 @@ module Rigor
       end
 
       # ADR-89 WD2 — the per-method observed-key return summaries the run's ADR-84 return memo just captured.
-      # For each project method with live memo entries, a bounded `{ keys:, returns:, effects: }` summary the
-      # incremental session persists: `keys` the observed `[receiver, arg_types]` type tuples, `returns` their
+      # For each project method the run observed, a bounded `{ keys:, returns:, effects:, guard_constants: }` summary
+      # the incremental session persists: `keys` the observed `[receiver, arg_types]` type tuples, `returns` their
       # `describe(:short)` descriptors, `effects` the content-mutated parameter positions (a caller-visible
-      # arg-flooring surface). Only meaningful right after a run populated the memo (baseline / recheck),
+      # arg-flooring surface), `guard_constants` the published-constant spellings its body reads ({#guard_constants}).
+      # Only meaningful right after a run populated the memo (baseline / recheck),
       # before the bucket rolls. Keys are held live here; the session Marshals them for the snapshot.
       #
+      # Issue #3160 — the session reads the harvest as EVERY key the files this run analysed observed each def
+      # under, so whatever cannot be that says so instead of looking like a short key list:
+      #
+      # - a def observed under keys this run cannot list maps to nil: more keys than
+      #   {RETURN_SUMMARY_KEYS_PER_DEF} (issue #3116), a call whose result the memo refused to store, or a def
+      #   past {RETURN_SUMMARY_TOTAL_CAP};
+      # - a def absent from the result was observed by no analysed file, wherever it is defined: an unchanged
+      #   file's def is found through the node its {Inference::DefHandle} resolved to;
+      # - the whole result is nil for a pool run, whose workers typed the calls in memos this process never sees.
+      #
       # @return the summaries keyed by `[path, "Class#method"]` (or `"Class.method"`), each holding `keys:`,
-      #   `returns:` and `effects:`.
+      #   `returns:` and `effects:`, or nil; nil for a pool run.
       def return_summaries
+        return nil if pool_mode?
+
         memo = Inference::ExpressionTyper.harvest_return_memo(@return_memo)
         return {} if memo.empty?
 
@@ -806,37 +833,89 @@ module Rigor
                                  "#", memo, effects_evaluator)
         collect_return_summaries(result, @project_discovered_singleton_def_nodes,
                                  @project_discovered_singleton_def_sources, ".", memo, effects_evaluator)
+        # ADR-129 WD5 (#2785) — typing after the run, under `content_effects`' rescue.
+        Inference::MemoAudit.raise_undrained!
         result
       end
 
       # Folds one def-node/def-source table pair's memo entries into the return-summary result under
-      # `separator`. A live def node (a cold / re-walked file) is the identity every cross-file caller
-      # resolved through, so `memo[node]` holds those callers' observed keys; a {DefHandle} (an unchanged
-      # file on the warm path) never keyed a memo entry, so it is skipped (its summary is carried over from
-      # the snapshot). Bounded per def and in total so the snapshot stays small.
+      # `separator`. The node the memo keyed is the identity every cross-file caller resolved through: the live
+      # def node of a cold / re-walked file, or the one the resolver minted for an unchanged file's
+      # {Inference::DefHandle} ({#observed_def_node}).
       def collect_return_summaries(result, nodes, sources, separator, memo, effects_evaluator)
+        summarised = result.count { |_pair, summary| summary }
         nodes.each do |class_name, methods|
-          methods.each do |method_name, node|
-            next if node.is_a?(Inference::DefHandle)
-
-            entries = memo[node]
-            next if entries.nil? || entries.empty?
+          methods.each do |method_name, slot|
+            node = observed_def_node(slot)
+            next unless memo.key?(node)
 
             path_line = sources.dig(class_name, method_name)
             next if path_line.nil?
 
-            break if result.size >= RETURN_SUMMARY_TOTAL_CAP
-
-            capped = entries.first(RETURN_SUMMARY_KEYS_PER_DEF)
-            result[[path_line.split(":", 2).first, "#{class_name}#{separator}#{method_name}"]] = {
-              keys: capped.map { |entry| [entry.receiver, entry.arg_types] },
-              returns: capped.map { |entry| entry.result.describe(:short) },
-              effects: content_effects(effects_evaluator, node)
-            }
+            summary = summarised < RETURN_SUMMARY_TOTAL_CAP ? return_summary(memo[node], effects_evaluator, node) : nil
+            summarised += 1 if summary
+            result[[path_line.split(":", 2).first, "#{class_name}#{separator}#{method_name}"]] = summary
           end
         end
       end
 
+      # The node the run's return memo keyed `slot`'s def on, or nil when no call resolved it: the live node, or the
+      # one the run's resolver minted for a {Inference::DefHandle}.
+      def observed_def_node(slot)
+        return slot unless slot.is_a?(Inference::DefHandle)
+
+        @resolved_def_nodes&.[]([slot.path, slot.node_id])
+      end
+
+      # One def's summary, or nil when `entries` are not every key it was observed under: the memo refused to store
+      # a call of it (so `entries` may be empty), or there are more than {RETURN_SUMMARY_KEYS_PER_DEF} (issue
+      # #3116). A splat call's key (issue #1237) is an entry like any other and counts toward the cap.
+      def return_summary(entries, effects_evaluator, node)
+        return nil if entries.empty? || entries.size > RETURN_SUMMARY_KEYS_PER_DEF
+        return nil if Inference::ExpressionTyper.return_memo_refused?(@return_memo, node)
+
+        { keys: entries.map { |entry| return_summary_key(entry) },
+          returns: entries.map { |entry| entry.result.describe(:short) },
+          effects: content_effects(effects_evaluator, node),
+          guard_constants: guard_constants(node) }
+      end
+
+      # Issue #3186 — the constant spellings in `node`'s body that the truthiness rule's one interprocedural hop
+      # ({CheckRules::PublishedConstantGuard}) could answer true for, or nil when they cannot be listed. A reader's
+      # `flow.always-truthy-condition` withholds when a def it calls reads a constant another file published,
+      # whatever the def returns, so the ADR-89 WD2 gate compares these as well as the returns; nil never compares
+      # equal, so it keeps the def's readers.
+      #
+      # The hop asks `Scope#published_constant?`, which answers true only for a spelling whose last segment the
+      # project publishes or the reader's own file assigns from a published constant, and each of those is a segment
+      # some project file writes. So the spellings whose last segment no file writes (a class name, as a rule) are
+      # left out: they answer false for every reader, and keeping them would fail the gate on every edit that adds a
+      # callee. The filter is this run's write census, so a census that moved fails the comparison.
+      def guard_constants(node)
+        written = constant_write_segments
+        CheckRules::PublishedConstantGuard.body_constant_spellings(node.body).select do |spelling|
+          written.include?(spelling.split("::").last)
+        end
+      rescue StandardError
+        nil
+      end
+
+      # The last segments of every constant name the run's write census holds, a wildcard key's included.
+      def constant_write_segments
+        unless @constant_write_segments_of.equal?(@project_constant_writes)
+          @constant_write_segments_of = @project_constant_writes
+          @constant_write_segments = @project_constant_writes.each_key.to_set { |name| name.split("::").last }
+        end
+        @constant_write_segments
+      end
+
+      # One observed call key: `[receiver, arg_types]`, or, for an entry a splat call stored (issue #1237),
+      # `[receiver, arg_types, true]`, which {#evaluate_spec_returns} re-drives with no positional correspondence.
+      def return_summary_key(entry)
+        key = [entry.receiver, entry.arg_types]
+        entry.positionals_unknown ? key << true : key
+      end
+
       # The content-mutated parameter positions of `node`, or `[]` if the computation raises (defensive: the
       # effects surface only routes attention, never soundness — a missing set reads as "no floor").
       def content_effects(effects_evaluator, node)
@@ -859,13 +938,45 @@ module Rigor
       def evaluate_return_types(paths, specs)
         return {} if specs.empty?
 
+        @probe_reads = {}
+        @probe_plugin_reads = {}
+        @probe_disclosures = {}
+        @probe_guard_constants = {}
         Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
-          Inference::DefNodeResolver.with_run { evaluate_return_types_setup(paths, specs) }
+          Inference::DefNodeResolver.with_run do
+            evaluate_return_types_setup(paths, specs)
+          ensure
+            @resolved_def_nodes = Inference::DefNodeResolver.resolved_nodes
+          end
         end
       ensure
+        # Issue #3180 — as {#run} does: {#return_summaries} then answers for what the probe observed.
+        @return_memo = Inference::ExpressionTyper.current_return_memo
         RunScopedSlots.release
       end
 
+      # Issue #3180 — what the last {#evaluate_return_types} read while re-evaluating each spec's def at its keys: the
+      # spec triple => a {DependencyRecorder::Record} of every def, class and name the evaluation read, the def's own
+      # file included (nothing is filtered as a self-read). The incremental session gives these edges to the readers
+      # a passing gate skips, since they now reach whatever the edited def reaches. Empty before the first probe.
+      attr_reader :probe_reads
+
+      # Issue #3187 — what the plugins did while the last {#evaluate_return_types} re-evaluated each spec's def, as
+      # {#analysis_reads} and {#analysis_disclosures} hold for an analysed file: the spec triple => the boundary rows
+      # its evaluation read ({Plugin::IoBoundary.attributing}), and => the run-scoped rows it registered
+      # ({RunDisclosureCredit}). A triple whose evaluation read or registered nothing has no key. The incremental
+      # session credits the reads to the readers a passing gate skips, as it does {#probe_reads}; a registration
+      # keeps the def's readers instead, since no skipped reader could be credited with it, or have it retracted.
+      attr_reader :probe_plugin_reads, :probe_disclosures
+
+      # Issue #3186 — the spec triple => {#guard_constants} of the def the last {#evaluate_return_types} re-evaluated,
+      # under that probe's write census. A triple whose def the probe did not find has no key.
+      attr_reader :probe_guard_constants
+
+      # The consumer {#evaluate_spec_returns} records under. It is no file's path, so no read is dropped as a self-read.
+      PROBE_CONSUMER = ""
+      private_constant :PROBE_CONSUMER
+
       # Builds the discovery index + environment (a real run's prologue, minus per-file analysis) and
       # re-evaluates each spec's def. Extracted so {#evaluate_return_types}'s `with_run` wrappers stay thin.
       def evaluate_return_types_setup(paths, specs)
@@ -901,10 +1012,43 @@ module Rigor
         return spec[:keys].map { nil } if node.nil?
 
         scope = seed_project_scope(Scope.empty(environment: environment, source_path: spec[:path]))
-        spec[:keys].map do |(receiver, arg_types)|
-          result = scope.user_method_return(node, receiver, arg_types)
-          result&.describe(:short)
+        triple = [spec[:class_name], spec[:method_name], spec[:singleton]]
+        @probe_guard_constants[triple] = guard_constants(node)
+        returns = nil
+        attributed_probe(triple) do
+          record_guard_spelling_edges(node)
+          returns = spec[:keys].map do |(receiver, arg_types, positionals_unknown)|
+            result = scope.user_method_return(node, receiver, arg_types,
+                                              positionals_unknown: positionals_unknown || false)
+            result&.describe(:short)
+          end
+        end
+        returns
+      end
+
+      # Issue #3199 — the `constant:` edge for every spelling the truthiness guard's hop would scan in `node`'s body,
+      # recorded into the probe's reads, which every reader the gate skips receives. {#guard_constants} leaves out a
+      # spelling whose last segment no file writes, so an edit that starts probing one (`defined?(B::X)` before any
+      # file assigns `B::X`) passes the gate; the skipped reader's guard never asks about it, and without this edge a
+      # file that later publishes the constant would re-check nobody.
+      def record_guard_spelling_edges(node)
+        CheckRules::PublishedConstantGuard.body_constant_spellings(node.body).each do |spelling|
+          DependencyRecorder.read_last_segment(:constant, spelling)
+        end
+      end
+
+      # Runs one spec's evaluation with its dependency reads recorded ({#probe_reads}) and its plugin reads and
+      # run-scoped registrations attributed to it ({#probe_plugin_reads}, {#probe_disclosures}), as
+      # {#analyze_file_attributed} does for a file.
+      def attributed_probe(triple, &)
+        reads = []
+        disclosures = RunDisclosureCredit.collect do
+          @probe_reads[triple] = Plugin::IoBoundary.attributing(reads) do
+            DependencyRecorder.record_for(PROBE_CONSUMER, &)
+          end
         end
+        @probe_plugin_reads[triple] = reads.uniq.freeze unless reads.empty?
+        @probe_disclosures[triple] = disclosures unless disclosures.empty?
       end
 
       # ADR-45 — unchanged-project fast path. Serves the whole run's (pre-severity-profile) diagnostics
@@ -920,7 +1064,10 @@ module Rigor
         # #392 — `source_files:` is what a plugin's `source_rbs_synthesizer` is offered at env-build time,
         # and a template unit is not Ruby the synthesiser can read (rbs-inline would be handed `.rbx`
         # bytes). The `.rb` expansion is the right set here; the units join the ANALYSED set only.
-        environment = @pool_coordinator.resolve_sequential_environment(source_files: expansion.fetch(:files))
+        # Issue #2883 — not eager: a warm result-cache HIT never types, so it must not build the RBS environment;
+        # {#assemble_run_diagnostics} builds it on the analysis path.
+        environment = @pool_coordinator.resolve_sequential_environment(source_files: expansion.fetch(:files),
+                                                                       eager: false)
         # Lazy-files descriptor: the cache KEY reads only `gems` + `configs`; the RBS signature-tree `files`
         # are digested solely by `run_dependency_descriptor` on a MISS, so a warm HIT never walks the tree.
         rbs_descriptor = if environment&.rbs_loader
@@ -1194,6 +1341,8 @@ module Rigor
       end
 
       def assemble_run_diagnostics(expansion, environment: nil)
+        # Issue #2883 — the analysis path builds the RBS environment before anything types (ADR-129 G1').
+        environment&.prepare_for_typing!
         # Force the deferred cross-file discovery pre-pass on the analysis (miss) path. Memoised, so the
         # eager force in `#run` (recording / subset modes) makes this a no-op. A warm cache HIT never calls
         # `assemble_run_diagnostics`, so it never runs the two whole-project parse passes. Runs over the FULL
@@ -1442,7 +1591,7 @@ module Rigor
         # #979 — the signature ROOTS' listings, one glob row each. `rbs_descriptor.files` covers only the
         # `.rbs` files that existed while the run read them, so without these a signature file written after
         # the run left the slot validating fresh and the warm run answered without it.
-        globs = rbs_descriptor.globs + template_unit_glob_entries + discovery_glob_entries
+        globs = rbs_descriptor.globs + template_unit_glob_entries + discovery_glob_entries + bundle_sig_glob_entries
         boundary = plugin_boundary_rows
         entries.concat(boundary.files)
         globs.concat(boundary.globs).concat(producer_watch_glob_entries)
@@ -1590,6 +1739,9 @@ module Rigor
         return nil if pool_mode? || !@collect_stats || @analyzed_files.empty?
 
         own, pinned = signature_rows
+        # Issue #2987 — the bundle's `sig/` listing is identified by the gems' directory, outside the project, so a
+        # `pinned` row: the write guard passes over it where it would refuse an `owned` one it cannot stat.
+        pinned = Cache::Descriptor.new(files: pinned.files, globs: (pinned.globs + bundle_sig_glob_entries).uniq)
         BaselineRows.new(
           owned: Cache::Descriptor.new(
             files: own.files + kind_entries(signature_root_candidates) +
@@ -1618,12 +1770,12 @@ module Rigor
         roots.any? { |root| directory.start_with?(root) }
       end
 
-      # The project's own signature roots, whether or not they exist: the configured `signature_paths:`, or the
-      # `sig` directory `Environment.default_signature_paths` auto-detects when none are configured. The
-      # signature rows' listing rows cover a file appearing under a root that existed; only a row for the root
-      # itself covers it appearing.
+      # The project's own signature roots, whether or not they exist:
+      # {Environment.project_signature_root_candidates} — the configured `signature_paths:`, or the `sig`
+      # directory it defaults to when none are configured (issue #1619). The signature rows' listing rows
+      # cover a file appearing under a root that existed; only a row for the root itself covers it appearing.
       def signature_root_candidates
-        @configuration.signature_paths || ["sig"]
+        Environment.project_signature_root_candidates(@configuration.signature_paths)
       end
 
       # One names-mode listing row per directory the discovery widening globbed, so a file appearing there is seen
@@ -1638,6 +1790,22 @@ module Rigor
         end
       end
 
+      # Issue #2987 — one names-mode listing row per bundle `sig/` layout ({Environment::BundleSigDiscovery.discover}'s
+      # two globs). The signature rows list only the directories the loader read, so a gem that GAINS a `sig/`
+      # (or loses it) while its version and lock entry stand still sits in none of them, and the run-result
+      # slot kept serving the environment built without (or with) it.
+      def bundle_sig_glob_entries
+        root = Environment::BundleSigDiscovery.resolve_bundle_path(
+          bundle_path: @configuration.bundler_bundle_path, project_root: Dir.pwd,
+          auto_detect: @configuration.bundler_auto_detect
+        )
+        return [] if root.nil?
+
+        Environment::BundleSigDiscovery::SIG_GLOBS.map do |pattern|
+          Cache::Descriptor::GlobEntry.compute(root: root.to_s, pattern: pattern, mode: :names)
+        end
+      end
+
       def unanalysed_pre_eval_entries(files)
         analysed = files.to_set { |path| File.absolute_path(path) }
         outside = @configuration.pre_eval.reject { |path| analysed.include?(File.absolute_path(path)) }
@@ -1658,6 +1826,7 @@ module Rigor
       end
       private :plugin_boundary_rows, :producer_watch_glob_entries, :kind_entries, :root_presence_entries,
               :analysis_reads_attributed?, :signature_root_candidates, :discovery_glob_entries,
+              :bundle_sig_glob_entries,
               :unanalysed_pre_eval_entries, :signature_rows, :within?
 
       # Issue #684 — the project files this run DISCOVERED but did not analyse. A widened run's diagnostics
@@ -2031,7 +2200,7 @@ module Rigor
       rescue ArgumentError => e
         floor = self.class.prism_supported_floor
         Diagnostic.new(
-          path: ".rigor.yml", line: 1, column: 1,
+          path: @configuration.config_display_path, line: 1, column: 1,
           message: "target_ruby #{@configuration.target_ruby.inspect} is not supported by this Rigor build " \
                    "(Prism accepts #{floor} and newer). Set target_ruby to your project's Ruby version " \
                    "(>= #{floor}) — read it from Gemfile.lock's `RUBY VERSION` or .ruby-version. " \
@@ -2661,6 +2830,14 @@ module Rigor
       # `DependencyRecorder.active? == false`. Recording is observational, so diagnostics are byte-identical
       # either way.
       def analyze_file(path, environment)
+        diagnostics = analyze_file_attributed(path, environment)
+        return diagnostics unless Inference::MemoAudit.enabled?
+
+        # ADR-129 WD5 (#2785) — the audit's mismatches this file raised, a swallowed one included.
+        CrashSignature.with_swallowed(path, diagnostics, Inference::MemoAudit.drain)
+      end
+
+      def analyze_file_attributed(path, environment)
         return analyze_with_effects(path, environment) unless @record_dependencies
 
         # ADR-45 WD2 (#1507) — every plugin read this file's analysis makes is attributed to it, so the
@@ -2741,9 +2918,11 @@ module Rigor
         # `self_call_misses` feeds the `call.self-undefined-method` collector; the recorder is inert unless
         # the rule is active or `record_self_calls:` opted in.
         index = nil
+        TypeOfMemo.begin_file
         self_call_record = with_self_call_recording(path) do
           index = Inference::ScopeIndexer.index(parse_result.value, default_scope: scope, widen_clauses: true)
         end
+        TypeOfMemo.phase!(:rule)
         self_call_misses = self_call_record ? self_call_record.calls : []
         diagnostics = rule_and_plugin_diagnostics(path, parse_result, scope, index, self_call_misses)
         notify_file_indexed(path, parse_result, scope, index)
@@ -2758,16 +2937,18 @@ module Rigor
             severity: :error
           )
         ]
-      rescue StandardError => e
+      rescue StandardError, SystemStackError => e
         [
           Diagnostic.new(
             path: path,
             line: 1,
             column: 1,
-            message: CrashSignature.check_rule_message(e),
+            message: CrashSignature.contained_message!(e, parse_result),
             severity: :error
           )
         ]
+      ensure
+        TypeOfMemo.end_file
       end
 
       # ADR-113 WD2 — the `on_file_indexed` observer. It reads; an error inside it never changes this file's
@@ -2784,7 +2965,9 @@ module Rigor
       # output and the plugin diagnostics are then built from that single walk's results.
       def rule_and_plugin_diagnostics(path, parse_result, scope, index, self_call_misses)
         root = parse_result.value
-        node_collectors = CheckRules.build_node_collectors(path, index, root)
+        node_collectors = CheckRules.build_node_collectors(
+          path, index, root, plugin_api_surface: CheckRules::PluginApiSurface.active?(@configuration)
+        )
         node_results = node_rule_results_by_plugin(path, root, scope, node_collectors, index)
         diagnostics = CheckRules.diagnose(
           path: path,

data/lib/rigor/analysis/self_call_resolution_recorder.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../typing_state"
+
 module Rigor
   module Analysis
     # ADR-24 slice 4a — records every *implicit-self* method call the inference engine could not resolve to any
@@ -25,8 +27,25 @@ module Rigor
     # Modelled on {DependencyRecorder}: process-thread-local accumulator, a cheap disabled fast path, and a
     # frozen snapshot for consumers.
     module SelfCallResolutionRecorder
-      KEY = :__rigor_self_call_resolution_recorder__
-      private_constant :KEY
+      # ADR-129 WD1 — the installed accumulator is a Frame; its contents are the bound Table {CALLS}. The activation
+      # count below is a process switch, outside the typing state (WD5).
+      RECORDER = TypingState.frame(
+        :self_call_resolution_recorder,
+        contents: :table, reason: "the accumulator a recording installs; each unresolved call records into it",
+        # G1′ witness: the memo journals and replays the records, so it is not a shut switch (unlike the tracers).
+        witness: "spec/fixtures/typing_state_witnesses/self_call_resolution_recorder.rb"
+      )
+      private_constant :RECORDER
+
+      # ADR-129 WD1 — the recorded misses are a bound Table: each installed accumulator is one of its stores, keyed by
+      # the call tuple (deduplicated, so the first record of a tuple is its only write), journaled while a capture is
+      # open so a later `type_of` memo can validate the reads and replay the writes in order.
+      CALLS = TypingState.table(
+        :self_call_misses,
+        bound: true,
+        reason: "UnresolvedSelfCall => true per consumer accumulator, appended in first-record order"
+      )
+      private_constant :CALLS
 
       # One unresolved implicit-self call. `class_name` is the receiver's statically known class (the
       # enclosing `self` type); `method_name` the called name; `node` the Prism `CallNode` (held in-memory so
@@ -45,10 +64,28 @@ module Rigor
           @seen = Set.new
         end
 
-        def add(call)
-          return unless @seen.add?(call)
+        def add?(call)
+          return false unless @seen.add?(call)
 
           @calls << call
+          true
+        end
+
+        # Whether `call` is already recorded.
+        def recorded?(call) = @seen.include?(call)
+
+        # The bound Table's store protocol ({CALLS}): `true` for a recorded call, else `default`.
+        def fetch(call, default) = @seen.include?(call) || default
+
+        # The bound Table's store protocol: an undone write (G1's stage-4 form) forgets `call`.
+        def delete(call)
+          @calls.delete(call) if @seen.delete?(call)
+        end
+
+        # The bound Table's store protocol: a replayed write records `call` as {#add?} does, so the replay order of a
+        # write slice is the order of {#calls}.
+        def []=(call, _value)
+          add?(call)
         end
 
         def snapshot
@@ -69,15 +106,16 @@ module Rigor
       # Activates recording for `consumer` (the path being analyzed) for the duration of the block and returns
       # the frozen {Record}. Nests safely; restores the previous recorder on exit.
       def record_for(consumer)
-        previous = Thread.current[KEY]
         accumulator = Accumulator.new(consumer.to_s)
-        Thread.current[KEY] = accumulator
-        @mutex.synchronize { @active_count += 1 }
-        yield
-        accumulator.snapshot
-      ensure
-        Thread.current[KEY] = previous
-        @mutex.synchronize { @active_count -= 1 }
+        TypingState.current.with(RECORDER, accumulator) do
+          @mutex.synchronize { @active_count += 1 }
+          begin
+            yield
+            accumulator.snapshot
+          ensure
+            @mutex.synchronize { @active_count -= 1 }
+          end
+        end
       end
 
       # Plain integer read (GVL-atomic) — no `Thread.current` lookup on the disabled fast path.
@@ -88,19 +126,20 @@ module Rigor
       # Records one unresolved implicit-self call. No-op when no consumer is active on this thread (another
       # thread may have flipped {active?}).
       def record(class_name:, method_name:, node:, path:, line:, column:)
-        accumulator = Thread.current[KEY]
+        state = TypingState.current
+        accumulator = state[RECORDER]
         return if accumulator.nil?
 
-        accumulator.add(
-          UnresolvedSelfCall.new(
-            class_name: class_name.to_s,
-            method_name: method_name.to_sym,
-            node: node,
-            path: path,
-            line: line,
-            column: column
-          )
+        call = UnresolvedSelfCall.new(
+          class_name: class_name.to_s,
+          method_name: method_name.to_sym,
+          node: node,
+          path: path,
+          line: line,
+          column: column
         )
+        state.log_bound_read(CALLS, accumulator, call, accumulator.fetch(call, TypingState::ABSENT)) if state.capturing?
+        state.log_bound_write(CALLS, accumulator, call, true, TypingState::ABSENT) if accumulator.add?(call)
       end
     end
   end