rigortype 0.4.2 → 0.4.4

data/lib/rigor/analysis/reachability/scan.rb

@@ -51,10 +51,22 @@ module Rigor
         # - `:leading` — `"V#{version}"` is the START of a name, not a namespace, so it can construct `V1_0`
         #   and `V2_2` as well as anything beneath them: a string-prefix match (#1734).
         #
-        # `within` is set for `Foo.const_get("Bar::#{k}")`: `prefix` is then relative to the receiver, a
-        # {Reference} that {Graph} resolves as it resolves any other before matching.
-        DynamicUse = Data.define(:name, :prefix, :reason, :site, :path, :line, :scope, :within) do
-          def initialize(scope: :namespace, within: nil, **) = super
+        # `within` is set for a `const_get` on a known receiver — `Foo.const_get("Bar::#{k}")`, or an implicit
+        # receiver, `self` or `self.class`, which is the enclosing declaration written rooted: `prefix` is then
+        # relative to the receiver, a {Reference} that {Graph} resolves as it resolves any other before
+        # matching. A literal `name` keeps `within` too, and {Graph} looks it up from there (#1761). `inherit`
+        # is false when the call passes `inherit = false`, which confines the lookup to the receiver itself;
+        # otherwise the receiver's ancestors are searched as well. `role` is the referring file's (WD8).
+        #
+        # `receiver_open` is true when `within` is the enclosing declaration standing for a runtime `self` that
+        # may be one of its descendants (#1878): a `def self.x = const_get(:X)` runs on whichever subclass it
+        # is called on, and a module's method on whichever class includes, prepends or extends it. {Graph}
+        # then looks the literal name up in those descendants as well.
+        DynamicUse = Data.define(:name, :prefix, :reason, :site, :path, :line, :scope, :within, :inherit, :role,
+                                 :receiver_open) do
+          def initialize(scope: :namespace, within: nil, inherit: true, role: :production, receiver_open: false, **)
+            super
+          end
 
           # Whether this site's evidence reaches `fqn`.
           def taints?(fqn)
@@ -65,18 +77,28 @@ module Rigor
             fqn == prefix || fqn.start_with?("#{prefix}::")
           end
 
-          # This site with `within` resolved by the block into absolute `prefix`es. A resolution of the whole
+          # The namespaces an interpolated site's `within` names, resolved by the block. A resolution of the whole
           # written path is the anchor. {Graph#resolve} peels an unknown `Foo::Bar` to `Foo`, though, and
-          # anchoring there alone looked for `Foo::V*` and missed `Foo::Bar::V1`; the written name is then the
-          # anchor as well as the peeled one, since an undeclared receiver may be an alias of either. A
-          # receiver that does not resolve at all keeps its written name.
-          def anchored
-            return [self] if within.nil?
+          # anchoring there alone looked for `Foo::V*` and missed `Foo::Bar::V1`; the written name is then an
+          # anchor as well as the peeled one, since an undeclared receiver may be an alias of either. A receiver
+          # that does not resolve at all keeps its written name. Over-reaching is safe for a taint only; a
+          # literal anchors at {#receiver} alone.
+          def anchors
+            resolved = yield(within)
+            whole?(resolved) ? [resolved] : [within.as_written, resolved].compact
+          end
 
-            written = within.as_written
+          # The declaration `within` names when it resolves as WHOLE, or nil. A receiver resolved only by peeling
+          # its last segment is unknown: `const_get` never searches the receiver's lexical parent, so anchoring a
+          # literal there could resolve it to a dead constant and miss the live one.
+          def receiver
             resolved = yield(within)
-            anchors = resolved == written || resolved&.end_with?("::#{written}") ? [resolved] : [written, resolved]
-            anchors.compact.map { |anchor| with(prefix: "#{anchor}::#{prefix}", within: nil) }
+            whole?(resolved) ? resolved : nil
+          end
+
+          def whole?(resolved)
+            written = within.as_written
+            resolved == written || resolved&.end_with?("::#{written}")
           end
         end
 
@@ -128,7 +150,8 @@ module Rigor
         # @param root — the project root `path` is made relative to when its role is decided.
         # @return nil when the file does not parse (a parse error is the analyzer's business, not
         #   this scan's — it simply contributes nothing rather than half a file).
-        def self.call(path:, source:, target_ruby: nil, root: nil)
+        # `role`, when given, is the referring file's role, decided by the caller instead of from `path` (#1760).
+        def self.call(path:, source:, target_ruby: nil, root: nil, role: nil)
           parsed = if target_ruby
                      Prism.parse(source, filepath: path,
                                          version: target_ruby)
@@ -137,7 +160,7 @@ module Rigor
                    end
           return nil unless parsed.success?
 
-          walker = Walker.new(path: path, role: role_for(path, root: root))
+          walker = Walker.new(path: path, role: role || role_for(path, root: root))
           walker.walk(parsed.value, [])
           Result.new(declarations: walker.declarations.freeze, references: walker.references.freeze,
                      dynamic_uses: walker.dynamic_uses.freeze)
@@ -197,8 +220,280 @@ module Rigor
           end
         end
 
+        # `Const = Class.new` / `Module.new` / `Data.define(...)` / `Struct.new(...)` declare a class under a
+        # constant, and `ScopeIndexer#record_class_new_constant_decl` already treats them as class declarations
+        # for cross-file resolution. The report must agree, or every such constant reads as an unreferenced
+        # value rather than a class.
+        META_NEW = { "Class" => :new, "Module" => :new, "Data" => :define, "Struct" => :new }.freeze
+        private_constant :META_NEW
+
+        # ADR-102 WD4 — the {Walker}'s reading of dynamic constant resolution: `constantize` and `const_get`
+        # sites, the receivers a `const_get` looks its name up from, and the values its argument can hold.
+        module DynamicSites
+          private
+
+          # Names that turn a String into a constant. `constantize` / `safe_constantize` are ActiveSupport;
+          # `const_get` is core and may carry an explicit receiver (`Object.const_get`, `self.class.const_get`).
+          DYNAMIC_RESOLVERS = %i[constantize safe_constantize const_get].freeze
+          private_constant :DYNAMIC_RESOLVERS
+
+          # The anchor of a lookup that starts at the top level.
+          TOP_LEVEL = ""
+          private_constant :TOP_LEVEL
+
+          SUBJECT_SHAPES = {
+            Prism::StringNode => "a literal string",
+            Prism::SymbolNode => "a literal symbol",
+            Prism::InterpolatedStringNode => "an interpolated string",
+            Prism::InterpolatedSymbolNode => "an interpolated symbol"
+          }.freeze
+          private_constant :SUBJECT_SHAPES
+
+          # Calls that hand a string or symbol through unchanged, as far as the name it spells: `"V#{v}".freeze`.
+          PASS_THROUGH = %i[freeze to_s to_str to_sym dup -@ +@].freeze
+          private_constant :PASS_THROUGH
+
+          # Blocks whose `self` is not the enclosing declaration: a concern's `included` / `class_methods` body
+          # runs on the including class, and an eval block on its receiver.
+          SELF_REBINDING = %i[included prepended extended class_methods class_eval module_eval class_exec
+                              module_exec instance_eval instance_exec].freeze
+          private_constant :SELF_REBINDING
+
+          # The `*_eval` / `*_exec` family: on a constant receiver, the block's `self` IS that constant (#1878).
+          EVAL_FAMILY = %i[class_eval module_eval class_exec module_exec instance_eval instance_exec].freeze
+          private_constant :EVAL_FAMILY
+
+          # A call is a dynamic-resolution site, and its block may run with another `self` ({#rebinds_self?}).
+          def record_call(node, nesting)
+            record_dynamic_use(node, nesting)
+            return unless node.block.is_a?(Prism::BlockNode) && rebinds_self?(node)
+
+            @rebinding_blocks << node.block
+            @eval_receivers[node.block] = receiver_reference(node.receiver, nesting) if eval_on_constant?(node)
+          end
+
+          def eval_on_constant?(call)
+            EVAL_FAMILY.include?(call.name) && constant_receiver?(call.receiver)
+          end
+
+          # Rigor knows the argument's shape, which is the whole reason this can be tiered rather than treated
+          # as a blanket namespace poison: a literal argument names the exact constant and is as good as a
+          # written reference, while an interpolated one can only bound the names its literal head reaches.
+          #
+          # A local variable argument is read through its assignments in the same local scope, because the
+          # name is usually built one line up: GitLab's `Migration[2.2]` is `name = "V#{...}"` followed by
+          # `const_get(name, false)` (#1734).
+          def record_dynamic_use(node, nesting)
+            return unless DYNAMIC_RESOLVERS.include?(node.name)
+
+            subject = node.name == :const_get ? node.arguments&.arguments&.first : node.receiver
+            return if subject.nil?
+
+            anchors = node.name == :const_get ? const_get_anchors(node, nesting) : [TOP_LEVEL]
+            subjects(subject).each { |value| record_dynamic_subject(node, value, anchors) }
+          end
+
+          def record_dynamic_subject(node, subject, anchors)
+            name, head = dynamic_target(subject)
+            # A literal whose bytes are not valid UTF-8 cannot name a constant; dropping it is the only safe
+            # answer, and carrying it forward crashed the whole run downstream.
+            return if subject.is_a?(Prism::StringNode) && name.nil?
+            return if subject.is_a?(Prism::SymbolNode) && name.nil?
+
+            reason = "#{node.name} on #{SUBJECT_SHAPES.fetch(subject.class, 'a computed value')}"
+            bounds = if name then literal_bounds(node, name, anchors)
+                     elsif head then anchors.filter_map { |anchor| bound(head, anchor) }.uniq
+                     else []
+                     end
+            bounds = [[nil, :namespace, nil]] if bounds.empty?
+            bounds.each do |prefix, scope, within|
+              @dynamic_uses << DynamicUse.new(name: name, prefix: prefix, scope: scope, within: within,
+                                              inherit: anchors.include?(TOP_LEVEL), role: @role,
+                                              receiver_open: !within.nil? && runtime_self?(node),
+                                              site: site(node), path: @path, line: node.location.start_line,
+                                              reason: reason)
+            end
+          end
+
+          # A literal name is looked up from each receiver the call can have, so it carries the receiver as
+          # `within` and {Graph} resolves it there first (#1761). A rooted name, or a call whose only anchor is
+          # the top level, is looked up from the top level as any reference is.
+          #
+          # On `self` the receiver is the enclosing declaration only where the walk can name it ({#self_lookup}).
+          # Where `self` is a `Class` or a singleton class, Ruby looks the name up at the top level. Where the
+          # walk cannot tell what `self` is, the name is read BOTH at the enclosing declaration and at the top
+          # level: either reading alone lists a live constant as a candidate when it is the wrong one, and a
+          # dead constant kept reachable is the cheaper mistake. An interpolated name keeps every anchor, since
+          # a taint is safe to over-reach.
+          def literal_bounds(node, name, anchors)
+            return [] if name.start_with?("::")
+
+            within = anchors.grep(Reference).map { |receiver| [nil, :namespace, receiver] }
+            return within unless self_receiver?(node.receiver)
+
+            case self_lookup(node.receiver)
+            when :declaration then within
+            when :top_level then []
+            else within + [[nil, :namespace, nil]]
+            end
+          end
+
+          # Whether a `const_get` on `self` can run on a descendant of the enclosing declaration (#1878): in a
+          # method, or a block that rebinds `self`, `self` is whichever subclass or includer the method was
+          # called on. Directly in a class body, or inside `Other.class_eval { }`, it is the declaration itself.
+          def runtime_self?(node)
+            node.name == :const_get && self_receiver?(node.receiver) && @eval_receiver.nil? &&
+              !(@self_kind == :declaration && !@in_block && !@self_rebound)
+          end
+
+          # Where a `const_get` on `self` (implicit, `self`, or `self.class`) looks its name up: `:declaration`
+          # when `self` is the enclosing class or module, `:top_level` when it is `Class` or a singleton class,
+          # `:unknown` otherwise. A block's `self` is unknown — `included do`, `class_eval` and an instance-
+          # evaluated DSL block (`configure { }`, an RSpec `describe` body) all rebind it, and the walk cannot
+          # tell those from an `each` block. So is the `self` of a `def Other.x` or of a `class << Other` body.
+          def self_lookup(receiver)
+            return :declaration if @eval_receiver && !receiver.is_a?(Prism::CallNode)
+            return :unknown if @in_block || @self_rebound
+
+            class_of_self = receiver.is_a?(Prism::CallNode)
+            case @self_kind
+            when :declaration, :singleton_method then class_of_self ? :top_level : :declaration
+            when :instance_method then class_of_self ? :declaration : :unknown
+            when :singleton_class then :top_level
+            else :unknown
+            end
+          end
+
+          # Where a `const_get` looks a name up, as the namespaces its interpolated argument is bounded by. The
+          # receiver's namespace comes first: an implicit receiver, `self` or `self.class` is the enclosing
+          # declaration, and a constant receiver is resolved by {Graph} as any reference is (`within`). With
+          # the default `inherit = true` the lookup also falls through to the top level, which is all the
+          # reading had before, so that stays tainted too; an explicit `false` confines it to the receiver. An
+          # unknown receiver bounds nothing beyond the top level.
+          def const_get_anchors(node, nesting)
+            receiver = node.receiver
+            namespaces =
+              if self_receiver?(receiver)
+                eval_self_references(receiver) || self_references(node, nesting)
+              elsif constant_receiver?(receiver)
+                [receiver_reference(receiver, nesting)]
+              else
+                []
+              end
+            return [TOP_LEVEL] if namespaces.empty?
+
+            inherit = node.arguments.arguments[1]
+            inherit.is_a?(Prism::FalseNode) ? namespaces : namespaces + [TOP_LEVEL]
+          end
+
+          # Inside `Other.class_eval { }` an implicit or `self` receiver is `Other` (#1878).
+          def eval_self_references(receiver)
+            [@eval_receiver] if @eval_receiver && !receiver.is_a?(Prism::CallNode)
+          end
+
+          # The enclosing declaration as a rooted {Reference}, so {Graph} anchors it as it anchors a constant
+          # receiver and can search its ancestors. Inside a meta-new rvalue `self` is the declared class in its
+          # block but the outer scope in its arguments; the walk does not tell the two apart, so both are taken.
+          def self_references(node, nesting)
+            ([@owner, nesting.join("::")].compact.uniq - [TOP_LEVEL]).map do |fqn|
+              Reference.new(as_written: fqn, nesting: [].freeze, from: nil, role: @role, path: @path,
+                            line: node.location.start_line, rooted: true)
+            end
+          end
+
+          # Whether `call`'s block runs with a `self` other than the enclosing declaration's. A meta-new block
+          # assigned to a constant is that constant ({#walk_constant_write} credits it as `@owner`); an
+          # anonymous one is not the enclosing declaration either.
+          def rebinds_self?(call)
+            return true if SELF_REBINDING.include?(call.name)
+
+            recv = call.receiver
+            name = recv && Source::ConstantPath.qualified_name_or_nil(recv)&.delete_prefix("::")
+            @owner.nil? && !name.nil? && META_NEW[name] == call.name
+          end
+
+          def self_receiver?(receiver)
+            receiver.nil? || receiver.is_a?(Prism::SelfNode) ||
+              (receiver.is_a?(Prism::CallNode) && receiver.name == :class && receiver.receiver.is_a?(Prism::SelfNode))
+          end
+
+          # `Object.const_get` is the top level, which every lookup already reaches.
+          def constant_receiver?(receiver)
+            return false unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+
+            as_written = Source::ConstantPath.qualified_name_or_nil(receiver)
+            !as_written.nil? && as_written.delete_prefix("::") != "Object"
+          end
+
+          def receiver_reference(receiver, nesting)
+            Reference.new(as_written: Source::ConstantPath.qualified_name_or_nil(receiver),
+                          nesting: nesting.dup.freeze, from: nil, role: @role, path: @path,
+                          line: receiver.location.start_line, rooted: Source::ConstantPath.rooted?(receiver))
+          end
+
+          # `[prefix, scope, within]` for a literal head under one anchor. A head ending in `::` names a
+          # namespace and reaches everything beneath it; any other head is the start of a name, so
+          # `"V#{version}"` reaches `V1_0` and `V2_2` alike, and only a string-prefix match says that. A rooted
+          # head ignores the receiver. `within` carries a constant receiver for {Graph} to resolve.
+          def bound(head, anchor)
+            anchor = TOP_LEVEL if head.start_with?("::")
+            head = head.delete_prefix("::")
+            scope = head.end_with?("::") ? :namespace : :leading
+            head = head.delete_suffix("::")
+            return nil if head.empty?
+
+            anchor == TOP_LEVEL ? [head, scope, nil] : [head, scope, anchor]
+          end
+
+          # The values a dynamic-resolution subject can hold: the subject itself, or for a local variable every
+          # value assigned to it in the enclosing local scope. A local with an assignment whose value cannot be
+          # read off the node (`+=`, a multiple assignment, `rescue => name`) stays a computed value.
+          #
+          # A name an enclosing block binds as a parameter or block-local (`|name|`, `|x; name|`) is that
+          # block's value, not the method's: reading it through the method's assignments named a literal the
+          # block never sees, and a constant only that literal named was hidden from the report.
+          def subjects(subject)
+            subject = pass_through(subject)
+            return [subject] unless subject.is_a?(Prism::LocalVariableReadNode) && @local_scope
+            return [subject] if @block_params.include?(subject.name)
+
+            (LocalValues.values(@local_scope, subject.name) || [subject]).map { |value| pass_through(value) }
+          end
+
+          # The string or symbol under `"V#{v}".freeze` / `.to_sym`; any other node unchanged.
+          def pass_through(node)
+            while node.is_a?(Prism::CallNode) && PASS_THROUGH.include?(node.name) && node.arguments.nil? &&
+                  node.block.nil? && SUBJECT_SHAPES.key?(pass_through(node.receiver).class)
+              node = node.receiver
+            end
+            node
+          end
+
+          # `[exact name, literal head]` for a dynamic-resolution subject. A literal names its constant exactly;
+          # an interpolation can only bound the names its literal head starts; anything else bounds nothing.
+          def dynamic_target(subject)
+            case subject
+            when Prism::StringNode, Prism::SymbolNode then [Scan.usable_name(subject.unescaped), nil]
+            when Prism::InterpolatedStringNode, Prism::InterpolatedSymbolNode then [nil, literal_head(subject)]
+            else [nil, nil]
+            end
+          end
+
+          # The literal head of an interpolated name, as written: `"Foo::Bar::#{k}"` gives `Foo::Bar::`. Returns
+          # nil when the interpolation starts the string, which bounds nothing.
+          def literal_head(node)
+            head = node.parts.first
+            return nil unless head.is_a?(Prism::StringNode)
+
+            literal = Scan.usable_name(head.unescaped)
+            literal.nil? || literal.empty? ? nil : literal
+          end
+        end
+
         # Single-pass walker. Tracks `nesting` as the stack of enclosing declaration names.
         class Walker
+          include DynamicSites
+
           attr_reader :declarations, :references, :dynamic_uses
 
           def initialize(path:, role:)
@@ -213,6 +508,23 @@ module Rigor
             @local_scope = nil
             # Names an enclosing block's parameters or block-locals shadow within @local_scope.
             @block_params = Set.new.freeze
+            # Whether `self` here is something other than the enclosing declaration — inside an `included do`,
+            # `class_eval` or anonymous `Class.new` block. See {#rebinds_self?}.
+            @self_rebound = false
+            @rebinding_blocks = Set.new.compare_by_identity
+            # The constant receiver of each `*_eval` block, and the one the walk is inside (nil when `self` is not
+            # such a constant). See {#eval_on_constant?}.
+            @eval_receivers = {}.compare_by_identity
+            @eval_receiver = nil
+            # What `self` is here, for {#self_lookup}: `:declaration` in a class or module body (and at the top
+            # level), `:singleton_method` in a `def self.x` or a def in a `class << self` body,
+            # `:instance_method` in any other def, `:singleton_class` in a `class << self` body outside its
+            # methods, and `:unknown` where the walk cannot name it.
+            @self_kind = :declaration
+            # Whether the walk is inside a block, whose `self` it cannot name. See {#self_lookup}.
+            @in_block = false
+            # Whether the innermost declaration is a module, whose instance methods' `self.class` is not it.
+            @module_body = false
           end
 
           def walk(node, nesting)
@@ -220,7 +532,7 @@ module Rigor
 
             case node
             when Prism::ClassNode  then return walk_declaration(node, nesting, superclass: node.superclass)
-            when Prism::ModuleNode then return walk_declaration(node, nesting, superclass: nil)
+            when Prism::ModuleNode then return walk_declaration(node, nesting, superclass: nil, module_body: true)
             when Prism::ConstantReadNode, Prism::ConstantPathNode
               record_reference(node, nesting)
               # A constant path's segments are not separate references — `A::B::C` is one reference to the leaf,
@@ -236,7 +548,7 @@ module Rigor
               walk_constant_write(node, nesting)
               return
             when Prism::CallNode
-              record_dynamic_use(node, nesting)
+              record_call(node, nesting)
             when Prism::ProgramNode, Prism::DefNode, Prism::SingletonClassNode
               return in_local_scope(node) { node.rigor_each_child { |child| walk(child, nesting) } }
             when Prism::BlockNode, Prism::LambdaNode
@@ -248,7 +560,7 @@ module Rigor
 
           private
 
-          def walk_declaration(node, nesting, superclass:)
+          def walk_declaration(node, nesting, superclass:, module_body: false)
             name = Source::ConstantPath.qualified_name(node.constant_path)
             return node.rigor_each_child { |child| walk(child, nesting) } if name.nil?
 
@@ -272,18 +584,15 @@ module Rigor
             # The body's nesting names the declaration itself, so a credit inherited from a meta-new rvalue
             # this declaration sits in must not leak into it.
             owner = @owner
+            saved = [@self_rebound, @in_block, @module_body]
             @owner = nil
-            in_local_scope(node.body) { walk(node.body, nesting + [name]) }
+            @self_rebound = @in_block = false
+            @module_body = module_body
+            in_local_scope(node.body, :declaration) { walk(node.body, nesting + [name]) }
             @owner = owner
+            @self_rebound, @in_block, @module_body = saved
           end
 
-          # `Const = Class.new` / `Module.new` / `Data.define(...)` / `Struct.new(...)` declare a class under a
-          # constant, and `ScopeIndexer#record_class_new_constant_decl` already treats them as class declarations
-          # for cross-file resolution. The report must agree, or every such constant reads as an unreferenced
-          # value rather than a class.
-          META_NEW = { "Class" => :new, "Module" => :new, "Data" => :define, "Struct" => :new }.freeze
-          private_constant :META_NEW
-
           # A meta-new rvalue — `Class.new(Base) { ... }`, `Struct.new(:a) do ... end` — is the declaration's
           # header and body, so the references in it are credited to the declared constant, exactly as a
           # `class Sub < Base` superclass is (#1720). Its lexical nesting is unchanged: a block opens no cref.
@@ -330,173 +639,65 @@ module Rigor
             end
           end
 
-          # Names that turn a String into a constant. `constantize` / `safe_constantize` are ActiveSupport;
-          # `const_get` is core and may carry an explicit receiver (`Object.const_get`, `self.class.const_get`).
-          DYNAMIC_RESOLVERS = %i[constantize safe_constantize const_get].freeze
-          private_constant :DYNAMIC_RESOLVERS
-
-          # The anchor of a lookup that starts at the top level.
-          TOP_LEVEL = ""
-          private_constant :TOP_LEVEL
-
-          SUBJECT_SHAPES = {
-            Prism::StringNode => "a literal string",
-            Prism::SymbolNode => "a literal symbol",
-            Prism::InterpolatedStringNode => "an interpolated string"
-          }.freeze
-          private_constant :SUBJECT_SHAPES
-
-          # Rigor knows the argument's shape, which is the whole reason this can be tiered rather than treated
-          # as a blanket namespace poison: a literal argument names the exact constant and is as good as a
-          # written reference, while an interpolated one can only bound the names its literal head reaches.
-          #
-          # A local variable argument is read through its assignments in the same local scope, because the
-          # name is usually built one line up: GitLab's `Migration[2.2]` is `name = "V#{...}"` followed by
-          # `const_get(name, false)` (#1734).
-          def record_dynamic_use(node, nesting)
-            return unless DYNAMIC_RESOLVERS.include?(node.name)
-
-            subject = node.name == :const_get ? node.arguments&.arguments&.first : node.receiver
-            return if subject.nil?
-
-            anchors = node.name == :const_get ? const_get_anchors(node, nesting) : [TOP_LEVEL]
-            subjects(subject).each { |value| record_dynamic_subject(node, value, anchors) }
+          def in_local_scope(scope, self_kind = self_kind_in(scope))
+            saved = [@local_scope, @block_params, @self_kind, @eval_receiver]
+            @eval_receiver = nil
+            @local_scope = scope
+            @block_params = Set.new.freeze
+            @self_kind = self_kind
+            yield
+          ensure
+            @local_scope, @block_params, @self_kind, @eval_receiver = saved
           end
 
-          def record_dynamic_subject(node, subject, anchors)
-            name, head = dynamic_target(subject)
-            # A literal whose bytes are not valid UTF-8 cannot name a constant; dropping it is the only safe
-            # answer, and carrying it forward crashed the whole run downstream.
-            return if subject.is_a?(Prism::StringNode) && name.nil?
-            return if subject.is_a?(Prism::SymbolNode) && name.nil?
-
-            reason = "#{node.name} on #{SUBJECT_SHAPES.fetch(subject.class, 'a computed value')}"
-            bounds = head ? anchors.filter_map { |anchor| bound(head, anchor) }.uniq : []
-            bounds = [[nil, :namespace, nil]] if bounds.empty?
-            bounds.each do |prefix, scope, within|
-              @dynamic_uses << DynamicUse.new(name: name, prefix: prefix, scope: scope, within: within,
-                                              site: site(node), path: @path, line: node.location.start_line,
-                                              reason: reason)
+          # The {#self_lookup} kind inside `scope`, from the kind around it. Only a receiver-less def or a `def
+          # self.x` directly in a declaration body, and a `class << self` there, keep `self` nameable.
+          def self_kind_in(scope)
+            case scope
+            when Prism::ProgramNode then :declaration
+            when Prism::SingletonClassNode
+              scope.expression.is_a?(Prism::SelfNode) && @self_kind == :declaration ? :singleton_class : :unknown
+            when Prism::DefNode then def_self_kind(scope)
+            else :unknown
             end
           end
 
-          # Where a `const_get` looks a name up, as the namespaces its interpolated argument is bounded by. The
-          # receiver's namespace comes first: an implicit receiver, `self` or `self.class` is the enclosing
-          # declaration, and a constant receiver is resolved by {Graph} as any reference is (`within`). With
-          # the default `inherit = true` the lookup also falls through to the top level, which is all the
-          # reading had before, so that stays tainted too; an explicit `false` confines it to the receiver. An
-          # unknown receiver bounds nothing beyond the top level.
-          def const_get_anchors(node, nesting)
-            receiver = node.receiver
-            namespaces =
-              if self_receiver?(receiver)
-                # Inside a meta-new rvalue `self` is the declared class in its block but the outer scope in its
-                # arguments; the walk does not tell the two apart, so both are taken.
-                [@owner, nesting.join("::")].compact.uniq - [TOP_LEVEL]
-              elsif constant_receiver?(receiver)
-                [receiver_reference(receiver, nesting)]
-              else
-                []
+          # A receiver-less def names its `self` only directly in a class body or a `class << self` body. In a
+          # module body `self.class` is the includer's class, or `Module` under `module_function` / `extend
+          # self`; a def nested in another def lands on whatever that method's cref is, which the walk cannot
+          # tell apart.
+          def def_self_kind(node)
+            if node.receiver.nil?
+              case @self_kind
+              when :singleton_class then :singleton_method
+              when :declaration then @module_body ? :unknown : :instance_method
+              else :unknown
               end
-            return [TOP_LEVEL] if namespaces.empty?
-
-            inherit = node.arguments.arguments[1]
-            inherit.is_a?(Prism::FalseNode) ? namespaces : namespaces + [TOP_LEVEL]
-          end
-
-          def self_receiver?(receiver)
-            receiver.nil? || receiver.is_a?(Prism::SelfNode) ||
-              (receiver.is_a?(Prism::CallNode) && receiver.name == :class && receiver.receiver.is_a?(Prism::SelfNode))
-          end
-
-          # `Object.const_get` is the top level, which every lookup already reaches.
-          def constant_receiver?(receiver)
-            return false unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
-
-            as_written = Source::ConstantPath.qualified_name_or_nil(receiver)
-            !as_written.nil? && as_written.delete_prefix("::") != "Object"
-          end
-
-          def receiver_reference(receiver, nesting)
-            Reference.new(as_written: Source::ConstantPath.qualified_name_or_nil(receiver),
-                          nesting: nesting.dup.freeze, from: nil, role: @role, path: @path,
-                          line: receiver.location.start_line, rooted: Source::ConstantPath.rooted?(receiver))
-          end
-
-          # `[prefix, scope, within]` for a literal head under one anchor. A head ending in `::` names a
-          # namespace and reaches everything beneath it; any other head is the start of a name, so
-          # `"V#{version}"` reaches `V1_0` and `V2_2` alike, and only a string-prefix match says that. A rooted
-          # head ignores the receiver. `within` carries a constant receiver for {Graph} to resolve.
-          def bound(head, anchor)
-            anchor = TOP_LEVEL if head.start_with?("::")
-            head = head.delete_prefix("::")
-            scope = head.end_with?("::") ? :namespace : :leading
-            head = head.delete_suffix("::")
-            return nil if head.empty?
-
-            case anchor
-            when Reference then [head, scope, anchor]
-            when TOP_LEVEL then [head, scope, nil]
-            else ["#{anchor}::#{head}", scope, nil]
+            elsif node.receiver.is_a?(Prism::SelfNode) && @self_kind == :declaration
+              :singleton_method
+            else
+              :unknown
             end
           end
 
-          # The values a dynamic-resolution subject can hold: the subject itself, or for a local variable every
-          # value assigned to it in the enclosing local scope. A local with an assignment whose value cannot be
-          # read off the node (`+=`, a multiple assignment, `rescue => name`) stays a computed value.
-          #
-          # A name an enclosing block binds as a parameter or block-local (`|name|`, `|x; name|`) is that
-          # block's value, not the method's: reading it through the method's assignments named a literal the
-          # block never sees, and a constant only that literal named was hidden from the report.
-          def subjects(subject)
-            return [subject] unless subject.is_a?(Prism::LocalVariableReadNode) && @local_scope
-            return [subject] if @block_params.include?(subject.name)
-
-            LocalValues.values(@local_scope, subject.name) || [subject]
-          end
-
-          def in_local_scope(scope)
-            saved = [@local_scope, @block_params]
-            @local_scope = scope
-            @block_params = Set.new.freeze
-            yield
-          ensure
-            @local_scope, @block_params = saved
-          end
-
           def in_block(block)
-            saved = @block_params
+            saved = [@block_params, @self_rebound, @in_block, @eval_receiver]
             names = block.parameters ? LocalValues.bindings(block.parameters) : []
             @block_params = (@block_params | names).freeze unless names.empty?
+            if @rebinding_blocks.include?(block)
+              @self_rebound = true
+              @eval_receiver = @eval_receivers[block]
+            end
+            @in_block = true
             yield
           ensure
-            @block_params = saved
-          end
-
-          # `[exact name, literal head]` for a dynamic-resolution subject. A literal names its constant exactly;
-          # an interpolation can only bound the names its literal head starts; anything else bounds nothing.
-          def dynamic_target(subject)
-            case subject
-            when Prism::StringNode, Prism::SymbolNode then [Scan.usable_name(subject.unescaped), nil]
-            when Prism::InterpolatedStringNode then [nil, literal_head(subject)]
-            else [nil, nil]
-            end
+            @block_params, @self_rebound, @in_block, @eval_receiver = saved
           end
 
           def site(node)
             "#{@path}:#{node.location.start_line}"
           end
 
-          # The literal head of an interpolated name, as written: `"Foo::Bar::#{k}"` gives `Foo::Bar::`. Returns
-          # nil when the interpolation starts the string, which bounds nothing.
-          def literal_head(node)
-            head = node.parts.first
-            return nil unless head.is_a?(Prism::StringNode)
-
-            literal = Scan.usable_name(head.unescaped)
-            literal.nil? || literal.empty? ? nil : literal
-          end
-
           # `from` defaults to the innermost enclosing declaration; a declaration's own header (its superclass,
           # its meta-new rvalue) is credited to that declaration instead.
           def record_reference(node, nesting, from: @owner)