rigortype 0.4.5 → 0.4.7

data/lib/rigor/inference/loop_value_record.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require_relative "../run_scoped_slots"
+
+module Rigor
+  module Inference
+    # The value the statement evaluator last gave a loop node, and the scope it evaluated the loop from, so
+    # `ExpressionTyper#type_of_loop` reads it instead of evaluating the loop again (issue #2031 review). A loop's value
+    # costs an evaluation of its body, its fixpoint and its `break` passes included, and the typer types a loop again
+    # wherever it types a node that holds one: the value of a write that wraps it (`id(z = (while …))`), a call it is
+    # the receiver of (`(while …).itself`), each narrowing and rule that types that operand. Each such typing of a
+    # loop nested in another loop re-ran the inner loop's passes, once more per level of nesting.
+    #
+    # The record is reused only for the very scope object the loop was evaluated from, so it answers exactly what an
+    # evaluation would. It is not compared with `Scope#==`, which ignores several fields (`match_frame`,
+    # `declared_refinements`, `struct_fold_safe_locals`, the opaque-block flags, `lexical_nesting`, the origins tables,
+    # `discovery`): across the cost spec's 10933 reads every match was an identity match, and `lib/` read no record at
+    # all (issue #2262). It lives in a per-thread map keyed by the loop node. The map's keys are weak but its values
+    # are strong, and a recorded scope reaches its discovery, its environment and the parse tree that holds the key,
+    # so a record never goes on its own (issue #2412): the map is a run-scoped slot ({RunScopedSlots}), emptied when
+    # the run that filled it ends.
+    module LoopValueRecord
+      KEY = RunScopedSlots.register(:rigor_loop_value_record)
+      private_constant :KEY
+
+      module_function
+
+      COUNT_KEY = RunScopedSlots.register(:rigor_loop_value_count)
+      private_constant :COUNT_KEY
+
+      def record(node, scope, type)
+        Thread.current[COUNT_KEY] = loops_evaluated + 1
+        conditional(node, scope, type)
+      end
+
+      # How many loops this thread has evaluated, so a conditional can tell whether its evaluation held one.
+      def loops_evaluated = Thread.current[COUNT_KEY] || 0
+
+      # The same record for a conditional that evaluated a loop in a branch: `id(c ? (while …) : 0)` types the
+      # conditional again from the scope it was evaluated from, and each typing evaluated the loop again from a
+      # branch scope of its own, which multiplied the passes of every loop nested in it (issue #2262).
+      def conditional(node, scope, type)
+        (Thread.current[KEY] ||= ObjectSpace::WeakKeyMap.new)[node] = [scope, type]
+        type
+      end
+
+      # The recorded value of `node` evaluated from `scope` itself, or nil.
+      def fetch(node, scope)
+        slot = Thread.current[KEY]&.[](node)
+        return nil if slot.nil?
+
+        recorded, type = slot
+        recorded.equal?(scope) ? type : nil
+      end
+    end
+  end
+end

data/lib/rigor/inference/match_rebinding/frame.rb

@@ -15,6 +15,12 @@ module Rigor
       # `$_` (issue #1359), whose frame-wide answers ({#last_line_closure?}, {#last_line_fallback?}) are kept here
       # too, asked only while `$_` is narrowed.
       class Frame
+        # The body the frame runs, which issue #2555's escape scan reads ({ConstructionEscape.escaped?}).
+        attr_reader :body
+        # The method's parameters (nil for a class, module or file body), which issue #2608's holder scan reads for a
+        # zero-argument `super` ({RemoverHolderScan}).
+        attr_reader :parameters
+
         # The nodes that bind a local in a body: the writes, and a block's, lambda's, `rescue`'s or pattern's own
         # parameters and targets.
         LOCAL_BINDINGS = Set[
@@ -37,6 +43,8 @@ module Rigor
           @scans = nil
           @last_line_closure = nil
           @last_line_fallback = nil
+          @body_locals = nil
+          @parameter_names = nil
         end
 
         def matching_closure?(scope = nil)
@@ -88,6 +96,29 @@ module Rigor
           @forwarded_block == name
         end
 
+        # Issue #2354 — whether `name` is a local of the frame's own body: the body binds it (a write, or a block's,
+        # lambda's, `rescue`'s or pattern's own parameter or target) and no parameter of the method names it. A
+        # method parameter is the caller's object wherever the body also writes the name (`h = h.dup if f`, a
+        # later `h = {}`), so it never counts. Kept per name for the rest of the body.
+        def body_local?(name)
+          bound = (@body_locals ||= {})
+          return bound[name] if bound.key?(name)
+
+          bound[name] = !parameter_names.include?(name) && binds_local?(@body, name)
+        end
+
+        # Issue #1157 — whether a call's `&expr` block argument hands on the block THIS method was called with: the
+        # anonymous `&` of a method that declares an anonymous `&` parameter, or {#forwarded_block?} for `&name`.
+        # Anything else (`&:sym`, a proc made here, a rebound name) is a block of this frame's own making.
+        def forwards_block?(block_argument)
+          expression = block_argument.expression
+          case expression
+          when nil then anonymous_block_parameter?
+          when Prism::LocalVariableReadNode then forwarded_block?(expression.name)
+          else false
+          end
+        end
+
         # The scan of `node` under `scope`, kept while `scope`'s local and instance-variable tables are the same
         # objects: a lookup argument's answer reads them ({MatchRebinding.may_match?}), and a rebuild that leaves
         # them alone passes the same tables on. `kind` keeps another reading of the same node apart (issue #1365:
@@ -125,6 +156,40 @@ module Rigor
           name
         end
 
+        # True when the method declares a bare `&` parameter, which only an anonymous `&` argument can read.
+        def anonymous_block_parameter?
+          parameters = @parameters
+          block = parameters.is_a?(Prism::ParametersNode) ? parameters.block : nil
+          !block.nil? && block.name.nil?
+        end
+
+        # The names the method's own parameters bind: positional (destructured ones included), optional, rest,
+        # keyword, keyword-rest and block. Empty for a class, module or file body.
+        def parameter_names
+          @parameter_names ||= begin
+            parameters = @parameters
+            names = Set.new
+            if parameters.is_a?(Prism::ParametersNode)
+              [*parameters.requireds, *parameters.optionals, parameters.rest, *parameters.posts,
+               *parameters.keywords, parameters.keyword_rest, parameters.block].each do |parameter|
+                collect_parameter_names(parameter, names)
+              end
+            end
+            names.freeze
+          end
+        end
+
+        def collect_parameter_names(node, names)
+          case node
+          when Prism::MultiTargetNode
+            [*node.lefts, node.rest, *node.rights].each { |target| collect_parameter_names(target, names) }
+          when Prism::SplatNode then collect_parameter_names(node.expression, names)
+          else
+            name = node.respond_to?(:name) ? node.name : nil
+            names << name if name
+          end
+        end
+
         # The method's own `&block` parameter's name, or nil.
         def block_parameter_name
           parameters = @parameters

data/lib/rigor/inference/match_rebinding/yielding_match.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    module MatchRebinding
+      # Issue #2443 — the match globals a block enters with when the call that owns it matches before every yield.
+      # `String#scan`, `#gsub`, `#gsub!`, `#sub` and `#sub!` set the caller's `$~` to the current match before each
+      # run of their block, with a Regexp pattern or a String one, so the block reads that match on every run
+      # whatever the enclosing frame held; the frame-wide entry ({MatchRebinding.block_entry}) would otherwise leave
+      # it the narrowing at the call site (issue #1371) or nothing at all, and `Regexp.last_match.begin(0)` in the
+      # block read `MatchData?`.
+      #
+      # A receiver that is a String, or a `Dynamic` the analyzer cannot type ({Narrowing.string_match_receiver?}),
+      # enters with the call's own match edge ({Narrowing.yielded_match_scope}). A `Dynamic` receiver may be another
+      # object whose block-taking `scan` runs no match, and then the block reads the caller's `$~`; narrowing it
+      # anyway can only drop a diagnostic, never add one (ADR-5). A receiver known to be anything else — a project
+      # class, `Pathname`, a union with either — keeps the frame-wide entry: a method defined in Ruby runs its
+      # matches in a frame of its own, so its block reads the caller's `$~` as the frame rules leave it. So does an
+      # implicit-self call.
+      module YieldingMatch
+        NAMES = Set[:scan, :gsub, :gsub!, :sub, :sub!].freeze
+        private_constant :NAMES
+
+        module_function
+
+        # `scope` with the match globals `call_node`'s block enters with; `scope` itself for any other block.
+        # `operand_scope` types the receiver.
+        def entry(scope, block_node, call_node, operand_scope)
+          return scope unless yielding_call?(block_node, call_node) &&
+                              Narrowing.string_match_receiver?(operand_scope.type_of(call_node.receiver), operand_scope)
+
+          Narrowing.yielded_match_scope(scope)
+        end
+
+        def yielding_call?(block_node, call_node)
+          call_node.is_a?(Prism::CallNode) && NAMES.include?(call_node.name) && !call_node.receiver.nil? &&
+            block_node.is_a?(Prism::BlockNode) && call_node.block.equal?(block_node)
+        end
+        private_class_method :yielding_call?
+      end
+    end
+  end
+end

data/lib/rigor/inference/match_rebinding.rb

@@ -12,6 +12,7 @@ require_relative "match_rebinding/frame"
 require_relative "match_rebinding/operands"
 require_relative "match_rebinding/calls"
 require_relative "match_rebinding/self_calls"
+require_relative "match_rebinding/yielding_match"
 require_relative "last_line"
 
 module Rigor
@@ -367,12 +368,21 @@ module Rigor
       #
       # Issue #1429 — the entry also restores a guard's narrowing of a global or constant where the body may run after
       # code that rebinds it ({GuardRebinding.block_entry}).
+      #
+      # Issue #2443 — the block of a call that matches before every yield (`scan`, `gsub`, `sub`, …) on a String or
+      # untyped receiver enters with that call's own match edge, laid over the entry above ({YieldingMatch}); a match
+      # its body runs still rebinds them through the statement-level rules.
       def block_entry(scope, block_node, call_node = nil)
+        operand_scope = scope
         scope = GuardRebinding.block_entry(scope, block_node, call_node)
         return FreshFrameBlocks.entry(scope, call_node) if FreshFrameBlocks.fresh_entry?(call_node, scope)
 
         scope = FreshFrameBlocks.closure_entry(scope, block_node, call_node)
         scope = LastLine.block_entry(scope, block_node, call_node)
+        YieldingMatch.entry(frame_entry(scope, block_node, call_node), block_node, call_node, operand_scope)
+      end
+
+      def frame_entry(scope, block_node, call_node)
         return scope unless scope.match_globals_bound?
         return scope unless scope.match_rebinding_closure? || entry_may_match?(block_node.body, scope, call_node) ||
                             (call_node.is_a?(Prism::CallNode) && operands_may_rebind?(call_node, scope))
@@ -386,7 +396,7 @@ module Rigor
 
         body.is_a?(Prism::Node) && scan(body, scope, base: true)
       end
-      private_class_method :entry_may_match?
+      private_class_method :frame_entry, :entry_may_match?
     end
   end
 end

data/lib/rigor/inference/memo_audit.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    # ADR-127 WD3 — the callee floor's memo audit. A memo hit is correct only when the key holds every input the value
+    # was computed from, and a key that misses one answers a caller with another caller's value (#2516, #2524). With the
+    # audit on, every hit in the callee floor's memos (`resolved_census`, the unrecorded hand-off memo, the successor
+    # store and `def_census`) recomputes the value and raises {Mismatch} when it differs from the stored one, so a key
+    # defect fails on the first hit instead of waiting for an order that exposes it.
+    #
+    # Like {BudgetTrace}, a switch for specs and CI (`RIGOR_MEMO_AUDIT=1` in the environment, read once at load, or
+    # {enable!}): off by default, a single boolean check when off. A recomputation
+    # runs with the audit suspended on its thread and the memos bypassed ({suspended?}), so it reads nothing stored.
+    module MemoAudit
+      # A memo hit whose stored value differs from a fresh computation.
+      class Mismatch < StandardError; end
+
+      SUSPENDED_KEY = :rigor_memo_audit_suspended
+
+      @enabled = %w[1 true].include?(ENV["RIGOR_MEMO_AUDIT"].to_s.downcase)
+
+      module_function
+
+      def enabled? = @enabled
+
+      # True while an audit recomputation runs on this thread. The callee floor's memos are then bypassed (read and
+      # write), so the recomputation reads no stored entry of another memo: a defect shared across a table (a stale
+      # `resolved_census(:edges)` entry) would otherwise make the recomputed value match the stored one.
+      def suspended? = Thread.current[SUSPENDED_KEY]
+
+      def enable! = (@enabled = true)
+
+      def disable! = (@enabled = false)
+
+      # `stored`, after checking it against `yield` when the audit is on. `label` and the key parts (`key`, `key2`) name
+      # the memo entry in the failure; they are passed apart so an audit that is off allocates nothing.
+      def check(label, stored, key, key2 = nil, &)
+        return stored unless @enabled && !Thread.current[SUSPENDED_KEY]
+
+        fresh = suspended(&)
+        return stored if fresh == stored
+
+        raise Mismatch, "#{label} memo hit differs from a fresh computation for #{[key, key2].inspect[0, 120]}: " \
+                        "stored #{stored.inspect[0, 200]}, fresh #{fresh.inspect[0, 200]}"
+      end
+
+      def suspended
+        Thread.current[SUSPENDED_KEY] = true
+        yield
+      ensure
+        Thread.current[SUSPENDED_KEY] = nil
+      end
+    end
+  end
+end

data/lib/rigor/inference/method_dispatcher/alias_strict_nominals.rb

@@ -7,7 +7,7 @@ module Rigor
         # Canonical RBS-core aliases shipped by `core/builtin.rbs` whose body is `<Nominal> | _DuckType`.
         # Matching an overload against an Integer literal should pick the `(int) -> Array[Elem]` body over
         # the `(string) -> String` body because Integer satisfies `int`'s strict arm and not `string`'s.
-        # The translator collapses both aliases to `Dynamic[Top]` (interfaces are not structurally matched
+        # The translator reads each alias's interface arm as `Dynamic[Top]` (interfaces are not structurally matched
         # yet), so a dedicated pass 1.5 between strict and gradual consults this map to pick the alias
         # whose strict arm matches.
         #

data/lib/rigor/inference/method_dispatcher/argument_distribution.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require_relative "../../type"
+
+module Rigor
+  module Inference
+    module MethodDispatcher
+      # The positional argument lists a call with a precise union argument stands for (#2379): one per combination
+      # of the union arguments' members, since the runtime selects an overload per value. `RbsDispatch` selects an
+      # overload for each list and joins their returns.
+      module ArgumentDistribution
+        # The most lists {.lists} spells out when more than one argument is a union. One union argument is linear in
+        # its members and is not capped.
+        LIMIT = 8
+        private_constant :LIMIT
+
+        # {.lists}' answer past {LIMIT}: the call's overloads cannot be read per value, and it answers `Dynamic[top]`.
+        OVER_LIMIT = :over_limit
+
+        module_function
+
+        # The lists, nil when no argument is a union, or {OVER_LIMIT}.
+        def lists(arg_types)
+          unions = arg_types.count { |arg| arg.is_a?(Type::Union) }
+          return nil if unions.zero?
+
+          if unions > 1
+            count = arg_types.reduce(1) { |product, arg| arg.is_a?(Type::Union) ? product * arg.members.size : product }
+            return OVER_LIMIT if count > LIMIT
+          end
+
+          arg_types.reduce([[]]) do |partials, arg|
+            members = arg.is_a?(Type::Union) ? arg.members : [arg]
+            partials.flat_map { |partial| members.map { |member| partial + [member] } }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/method_dispatcher/block_folding.rb

@@ -317,7 +317,7 @@ module Rigor
         end
 
         # Returns the receiver's known finite element count, or nil when the carrier does not pin a size.
-        # Tuple and HashShape are pinned by construction; `Constant<…>` exposes the literal's `.size`. Other
+        # Tuple and HashShape are pinned by construction, and a `Constant` Range by its bounds. Other
         # shapes (Array[T], Range[T], Nominal) decline so the RBS tier widens.
         def finite_size(receiver)
           case receiver

data/lib/rigor/inference/method_dispatcher/constant_folding.rb

@@ -192,8 +192,8 @@ module Rigor
 
         # #2115 — the numeric twin of `STRING_FOLD_BYTE_LIMIT`. A folded Integer (and each Integer part of a
         # folded Rational / Complex) is at most this many bits, the largest bit length whose decimal
-        # rendering still fits in `STRING_FOLD_BYTE_LIMIT` digits: `2 ** 13_605` folds, `2 ** 13_606`
-        # (bit length 13_607) does not. Computing `2 ** 100_000_000` takes Ruby milliseconds, but
+        # rendering still fits in `STRING_FOLD_BYTE_LIMIT` digits: `2 ** 13_605` folds,
+        # `2 ** 13_606` (bit length 13_607) does not. Computing `2 ** 100_000_000` takes Ruby milliseconds, but
         # rendering it in decimal — which describing, sorting and printing the `Constant` does — takes
         # minutes. `**` / `pow` / `<<` / `>>` also check their operands before invoking, so the big value
         # is never computed.
@@ -219,6 +219,15 @@ module Rigor
         # declared `Numeric`, on which `(2 ** 20_000).even?` is an undefined method.
         WidenedResult = Data.define(:class_name)
 
+        # #2125 — a String result past `STRING_FOLD_BYTE_LIMIT`, or an operand that would build one. Unlike a
+        # `WidenedResult` it declines the WHOLE fold, every other member of a union receiver included: dropping
+        # only the oversized member would answer the rest (`(c ? "a" : big) * 2` read `"aa"`). The next tier then
+        # answers the call — `LiteralStringFolding`'s `literal-string`, or RBS's `String`, never less than the
+        # `Nominal[String]` the fold could have widened to.
+        OversizedString = Data.define
+        OVERSIZED_STRING = [OversizedString.new].freeze
+        private_constant :OversizedString, :OVERSIZED_STRING
+
         # Input cartesian product hard cap. Keeps fold cost bounded even when the receiver and argument are
         # both `Union[Constant…]`. 5 × 5 = 25 inputs is permitted; 6 × 6 = 36 is not. The user-facing payoff
         # (a precise small enum) drops off fast past this range and CRuby method invocation cost adds up.
@@ -331,6 +340,7 @@ module Rigor
           arg = args.first
           ruby_arg = format_argument_value(arg)
           return nil if ruby_arg.nil?
+          return nil if format_blow_up?(receiver.value, ruby_arg)
 
           result = receiver.value % ruby_arg
           return nil unless foldable_constant_value?(result)
@@ -370,7 +380,7 @@ module Rigor
         # Normalises an input type into one of:
         # - `Array<Object>` for a `Constant` (1-element) or `Union[Constant…]` (n-element) — concrete values
         #   to enumerate.
-        # - `Type::IntegerRange` — bounded interval.
+        # - `Type::IntegerRange` / `Type::FloatRange` — bounded interval.
         # - `nil` — the input shape is not foldable.
         def numeric_set_of(type)
           case type
@@ -1200,6 +1210,8 @@ module Rigor
         # "Integer-ness" was already implied by the inputs (so the widening fallback only fires for
         # arithmetic over integers).
         def build_constant_type(values, source: nil)
+          return nil if values.any?(OversizedString)
+
           widened, values = values.partition { |value| value.is_a?(WidenedResult) }
           return build_scalar_constant_type(values, source) if widened.empty?
 
@@ -1213,7 +1225,8 @@ module Rigor
         def build_scalar_constant_type(values, source)
           return nil if values.empty?
 
-          unique = values.uniq
+          # #1513 — keyed so the possible results `0.0` and `-0.0` stay two members, as `Constant#==` keeps them.
+          unique = values.uniq { |value| Type::Constant.value_key(value) }
           return collapse_constants(unique) if unique.size <= UNION_FOLD_OUTPUT_LIMIT
 
           widen_to_integer_range(unique, source) ||
@@ -1643,6 +1656,7 @@ module Rigor
         # `flat_map`.
         def invoke_binary(receiver_value, method_name, arg_value)
           return nil unless safe?(receiver_value, method_name, arg_value)
+          return OVERSIZED_STRING if string_blow_up?(receiver_value, method_name, arg_value)
           return nil if range_enumeration_blow_up?(receiver_value, method_name)
 
           widened = numeric_blow_up_class(receiver_value, method_name, arg_value)
@@ -1658,6 +1672,7 @@ module Rigor
         # `false`/`nil` folds.
         def invoke_ternary(receiver_value, method_name, av0, av1)
           return nil unless ternary_method_allowed?(receiver_value, method_name)
+          return OVERSIZED_STRING if string_ternary_blow_up?(receiver_value, method_name, av0, av1)
 
           fold_result(receiver_value.public_send(method_name, av0, av1))
         rescue StandardError
@@ -1667,7 +1682,7 @@ module Rigor
         # Returns `[value]` on success, `nil` to signal "skip". See `invoke_binary` for why we wrap.
         def invoke_unary(receiver_value, method_name)
           return nil unless unary_safe?(receiver_value, method_name)
-          return nil if string_unary_blow_up?(receiver_value, method_name)
+          return OVERSIZED_STRING if string_unary_blow_up?(receiver_value, method_name)
           return nil if range_enumeration_blow_up?(receiver_value, method_name)
 
           fold_result(receiver_value.public_send(method_name))
@@ -1675,10 +1690,11 @@ module Rigor
           nil
         end
 
-        # `[result]` for a foldable value, `[WidenedResult]` for a number past `INTEGER_FOLD_BIT_LIMIT`, nil
-        # for anything else.
+        # `[result]` for a foldable value, `[WidenedResult]` for a number past `INTEGER_FOLD_BIT_LIMIT`,
+        # `OVERSIZED_STRING` for a String past `STRING_FOLD_BYTE_LIMIT`, nil for anything else.
         def fold_result(result)
           return [WidenedResult.new(result.class.name)] if oversized_number?(result)
+          return OVERSIZED_STRING if oversized_string?(result)
 
           foldable_constant_value?(result) ? [result] : nil
         end
@@ -1822,10 +1838,20 @@ module Rigor
           return false if value.is_a?(Float) && value.nan?
           return false if value.is_a?(Complex) && complex_nan?(value)
           return false if oversized_number?(value)
+          return false if oversized_string?(value)
 
           true
         end
 
+        # #2125 — the result gate every String-producing fold passes through, the String twin of
+        # `oversized_number?`. The operand prechecks (`string_blow_up?`, `string_ternary_blow_up?`,
+        # `format_blow_up?`) keep the costly cases from being built at all; this catches the rest after the
+        # fact (`tr` into multibyte characters, `dump`, `Integer#to_s(2)`, whose receiver
+        # `INTEGER_FOLD_BIT_LIMIT` already bounds, so its rendering is at most 13 KB).
+        def oversized_string?(value)
+          value.is_a?(String) && value.bytesize > STRING_FOLD_BYTE_LIMIT
+        end
+
         # True when an Integer, or an Integer part of a Rational / Complex, is past `INTEGER_FOLD_BIT_LIMIT`.
         def oversized_number?(value)
           case value
@@ -1874,7 +1900,6 @@ module Rigor
                     catalog_allows?(receiver_value, method_name)
           return false unless allowed
           return false if integer_division_by_zero?(receiver_value, method_name, arg_value)
-          return false if string_blow_up?(receiver_value, method_name, arg_value)
 
           true
         end
@@ -1960,16 +1985,91 @@ module Rigor
           case method_name
           when :+ then string_concat_blow_up?(receiver_value, arg_value)
           when :* then string_repeat_blow_up?(receiver_value, arg_value)
+          when :% then format_blow_up?(receiver_value, arg_value)
           when :center, :ljust, :rjust then string_pad_blow_up?(arg_value)
           else false
           end
         end
 
+        # #2125 — the two-argument String folds that can grow past the input: the padded `center` / `ljust`
+        # / `rjust` (width, pad) and `sub` / `gsub` (pattern, replacement).
+        def string_ternary_blow_up?(receiver_value, method_name, av0, av1)
+          return false unless receiver_value.is_a?(String)
+
+          case method_name
+          when :center, :ljust, :rjust then string_pad_blow_up?(av0)
+          when :sub, :gsub then string_substitution_blow_up?(receiver_value, method_name, av1)
+          else false
+          end
+        end
+
+        # An upper bound on a `sub` / `gsub` result with a String replacement: `gsub` matches at most once per
+        # position plus once at the end, and each replacement is the replacement's bytes plus, for every
+        # backslash in it (`\0`, `\1`, `\k<name>`, `` \` ``, `\'`), at most the receiver's bytes again.
+        def string_substitution_blow_up?(receiver_value, method_name, replacement)
+          return false unless replacement.is_a?(String)
+
+          size = receiver_value.bytesize
+          matches = method_name == :gsub ? size + 1 : 1
+          per_match = replacement.bytesize + (replacement.count("\\") * size)
+          size + (matches * per_match) > STRING_FOLD_BYTE_LIMIT
+        end
+
+        # #2125 — `String#%` / `Kernel#format` pad to a field width and render to a precision the format
+        # string spells (`"%02000000000d"`, `"%.100000f"`) or an argument supplies (`"%*d" % [n, 1]`).
+        # Formatting builds the whole padded string before any result gate can look at it — two billion
+        # bytes took 13 s and 4 GB — so the numbers are read from the directives first. A `*` width counts
+        # every Integer argument as a possible width, and a `%%` escape matches as a whole, carrying no digits.
+        FORMAT_DIRECTIVE = /%%|%(?:<[^>]*>|\{[^}]*\}|[-+ 0#*$.\d])*/
+        private_constant :FORMAT_DIRECTIVE
+
+        def format_blow_up?(format_string, arguments)
+          star = false
+          format_string.scan(FORMAT_DIRECTIVE) do |directive|
+            spec = directive.gsub(/<[^>]*>|\{[^}]*\}|\d+\$/, "")
+            return true if spec.scan(/\d+/).any? { |digits| digits.to_i > STRING_FOLD_BYTE_LIMIT }
+
+            star ||= spec.include?("*")
+          end
+          star && format_argument_values(arguments).any? do |value|
+            width = integer_operand(value)
+            !width.nil? && width.abs > STRING_FOLD_BYTE_LIMIT
+          end
+        end
+
+        def format_argument_values(arguments)
+          case arguments
+          when Hash then arguments.values
+          when Array then arguments
+          else [arguments]
+          end
+        end
+
         # `"x".center(width)` / `#ljust` / `#rjust` produce a string of `max(width, len)` characters. A
         # literal `width` far larger than the receiver would materialise a huge Constant; cap it at the same
         # byte limit the concat / repeat paths use.
         def string_pad_blow_up?(arg_value)
-          arg_value.is_a?(Integer) && arg_value > STRING_FOLD_BYTE_LIMIT
+          width = integer_operand(arg_value)
+          !width.nil? && width > STRING_FOLD_BYTE_LIMIT
+        end
+
+        # The Integer a width or count operand stands for. Ruby converts a Float or Rational one with `NUM2LONG`
+        # (`"x" * 2.9` is `"xx"`, `"x".ljust(2e9)` pads to two billion), and a Complex one whose imaginary part is an
+        # exact zero through its real part (`"x" * Complex(3, 0)` is `"xxx"`; `Complex(3, 0.0)` raises), so the
+        # prechecks read it the same way. Those are every Numeric class a `Constant` carries. A non-finite Float
+        # raises in Ruby, and any other operand is left to the call, so both answer nil.
+        def integer_operand(value)
+          case value
+          when Integer then value
+          when Float then value.finite? ? value.to_i : nil
+          when Rational then value.to_i
+          when Complex then exact_real_operand(value)
+          end
+        end
+
+        def exact_real_operand(value)
+          imaginary = value.imaginary
+          imaginary.is_a?(Integer) && imaginary.zero? ? integer_operand(value.real) : nil
         end
 
         def string_concat_blow_up?(receiver_value, arg_value)
@@ -1978,10 +2078,11 @@ module Rigor
         end
 
         def string_repeat_blow_up?(receiver_value, arg_value)
-          return false unless arg_value.is_a?(Integer)
-          return true if arg_value.negative?
+          # A negative count raises (`ArgumentError`), so the call itself skips that member, as any raising one is.
+          count = integer_operand(arg_value)
+          return false if count.nil? || count.negative?
 
-          receiver_value.bytesize * arg_value > STRING_FOLD_BYTE_LIMIT
+          receiver_value.bytesize * count > STRING_FOLD_BYTE_LIMIT
         end
       end
     end