rigortype 0.4.5 → 0.4.7

data/lib/rigor/inference/struct_fold_safety.rb

@@ -56,8 +56,7 @@ module Rigor
       end
 
       # @param root — the local-variable scope to scan.
-      # @param layout_lookup — a `String -> Array[Symbol] | nil` resolver mapping a constant receiver name to its
-      #   struct member list.
+      # @param layout_lookup — a resolver mapping a constant receiver name to its struct member list.
       # @return the fold-safe local names.
       def fold_safe_locals(root, layout_lookup)
         return EMPTY if root.nil?
@@ -283,8 +282,7 @@ module Rigor
       # `[1].each { s.x = v }; s.x` would read the construction value — verified unsound on #525.
       #
       # `for` shares the enclosing locals rather than opening a scope, so the block rationale does not apply
-      # to it; it is a boundary for the same reason `while` is (below), and this comment previously gave the
-      # wrong reason for it.
+      # to it; it is a boundary for the same reason `while` is (below).
       #
       # `while` / `until` are boundaries because a single static pass cannot model a member setter across
       # ITERATIONS. Issue #597 tried to lift this: `eval_loop` does join the body's exit scope with the
@@ -327,8 +325,8 @@ module Rigor
         return nil unless meta_constant?(call_node.receiver, :Struct)
 
         args = call_node.arguments&.arguments || []
-        # `[0..-2]` cannot return nil for a start of 0, but `Array#[](Range) -> Array[T]?` says it can;
-        # the `|| []` keeps the read well-typed on that worst case.
+        # `[0..-2]` cannot return nil for a start of 0, but the RBS signature of `Array#[]` with a Range says it
+        # can; the `|| []` keeps the read well-typed on that worst case.
         positional = args.last.is_a?(Prism::KeywordHashNode) ? (args[0..-2] || []) : args
         positional = positional[1..] if positional.first.is_a?(Prism::StringNode)
         return nil if positional.nil? || positional.empty?

data/lib/rigor/inference/synthetic_method_index.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "digest"
+
 require_relative "synthetic_method"
 
 module Rigor
@@ -65,8 +67,29 @@ module Rigor
         { "entries" => entries.map(&:to_h), "class_names" => class_names }
       end
 
+      # What a dispatch can read from the index, digested (nil for the empty index): each key's rows in their
+      # first-wins order, with the return type and the Tier B `origin_module` the dispatcher promotes through,
+      # and the synthesised class names. The rest of the provenance (the call site's path and line) is left
+      # out, so an edit that only moves the `devise` line keeps the digest. `IncrementalSession` compares it
+      # across runs (PR #2286 review M1): the index is built from class-body calls that no declaration
+      # signature records, so a recheck that sees it move cannot trust its served files.
+      def surface_digest
+        return nil if empty?
+
+        rows = entries.each_with_index
+                      .sort_by { |entry, index| [entry.kind.to_s, entry.class_name, entry.method_name.to_s, index] }
+                      .map { |entry, _| surface_row(entry) }
+        Digest::SHA256.hexdigest((rows + class_names.sort.map { |name| "class\x1f#{name}" }).join("\x00"))
+      end
+
       EMPTY_ROW = [].freeze
 
+      def surface_row(entry)
+        [entry.kind, entry.class_name, entry.method_name, entry.return_type,
+         entry.provenance[:origin_module], entry.provenance[:plugin_id]].join("\x1f")
+      end
+      private :surface_row
+
       def bucket(entries, kind)
         h = {}
         entries.each do |entry|

data/lib/rigor/inference/synthetic_method_scanner/project_members.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../../source/literals"
+
+module Rigor
+  module Inference
+    module SyntheticMethodScanner
+      # The instance-method names a project class answers ahead of a module a trait registry includes into it
+      # (PR #2286 review S1). Ruby looks a method up on the class itself before any module it includes, and a
+      # module the class itself includes or prepends sits ahead of one `devise` included earlier — so where
+      # the project names a member, the Tier B entry for it would answer the call from the wrong rung:
+      #
+      #   class User < ApplicationRecord
+      #     devise :confirmable
+      #     include PasswordPolicy   # defines password_required?
+      #     def confirmed? = :yes
+      #   end
+      #
+      # `User.new.confirmed?` is `:yes` and `password_required?` is the policy's, not `bool` from the Devise
+      # module's RBS. {SyntheticMethodScanner} therefore drops a trait entry whose name this index reports.
+      #
+      # A name counts as the class's when any reopening of the class body (in any project file) writes `def`,
+      # `alias` / `alias_method`, `attr_*`, `define_method` or `delegate` for it, or when a project module the
+      # class includes or prepends (followed through that module's own `include` / `prepend`) does. The MRO
+      # order of an `include` relative to the `devise` call is NOT consulted: a module included before the
+      # call sits behind the Devise module at runtime, but the name is declined anyway. Declining is the
+      # conservative direction — the call then reaches the tiers below the synthetic one (the discovered
+      # method, the project mixin), which answer it as they did before Tier B was reachable. A mixin constant
+      # is matched to a project module by name or by `::`-suffix, again widening only what is declined.
+      class ProjectMembers
+        # The calls that name members through their literal arguments, and the suffixes each name takes.
+        SUFFIXES_BY_CALL = Ractor.make_shareable(
+          {
+            attr_reader: [""], attr: [""], attr_writer: ["="], attr_accessor: ["", "="], delegate: [""]
+          }
+        )
+        NAME_ARG_CALLS = %i[define_method alias_method].freeze
+        MIXIN_CALLS = %i[include prepend].freeze
+
+        Entry = Struct.new(:names, :mixins)
+        private_constant :Entry
+
+        def initialize(asts)
+          @classes = Hash.new { |hash, key| hash[key] = Entry.new(Set.new, []) }
+          @modules = Hash.new { |hash, key| hash[key] = Entry.new(Set.new, []) }
+          asts.each_value { |ast| walk_namespaces(ast, []) unless ast.nil? }
+          @declared = {}
+        end
+
+        # True when `class_name`'s own body, or a project module it includes or prepends, names `method_name`.
+        def declares?(class_name, method_name)
+          (@declared[class_name] ||= declared_names(class_name)).include?(method_name.to_sym)
+        end
+
+        private
+
+        def declared_names(class_name)
+          entry = @classes.fetch(class_name, nil)
+          return Set.new.freeze if entry.nil?
+
+          names = entry.names.dup
+          visited = Set.new
+          queue = entry.mixins.dup
+          until queue.empty?
+            module_keys_for(queue.shift).each do |key|
+              next unless visited.add?(key)
+
+              names.merge(@modules[key].names)
+              queue.concat(@modules[key].mixins)
+            end
+          end
+          names.freeze
+        end
+
+        def module_keys_for(name)
+          @modules.keys.select { |key| key == name || key.end_with?("::#{name}") }
+        end
+
+        def walk_namespaces(node, scope_stack)
+          case node
+          when Prism::ClassNode, Prism::ModuleNode
+            name = SyntheticMethodScanner.class_name_from(node, scope_stack)
+            if name
+              table = node.is_a?(Prism::ClassNode) ? @classes : @modules
+              collect_members(node.body, table[name])
+            end
+            inner = scope_stack + [node]
+            node.body&.rigor_each_child { |child| walk_namespaces(child, inner) }
+          else
+            node.rigor_each_child { |child| walk_namespaces(child, scope_stack) }
+          end
+        end
+
+        # Every member-naming form under the namespace body, at any depth short of a nested namespace (a
+        # `private def`, a `def` under a conditional and an `included do ... def` all count). A nested `class`,
+        # `module` or `class << self` is another namespace's body.
+        def collect_members(node, entry)
+          return if node.nil?
+
+          case node
+          when Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode then return
+          when Prism::DefNode then entry.names << node.name if node.receiver.nil?
+          when Prism::AliasMethodNode then add_symbol(entry, node.new_name)
+          when Prism::CallNode then collect_call(node, entry)
+          end
+          node.rigor_each_child { |child| collect_members(child, entry) }
+        end
+
+        def collect_call(call, entry)
+          return unless call.receiver.nil? || call.receiver.is_a?(Prism::SelfNode)
+
+          args = call.arguments&.arguments || []
+          if MIXIN_CALLS.include?(call.name)
+            entry.mixins.concat(args.filter_map { |arg| SyntheticMethodScanner.const_name_string(arg) })
+          elsif NAME_ARG_CALLS.include?(call.name)
+            add_symbol(entry, args.first)
+          elsif (suffixes = SUFFIXES_BY_CALL[call.name])
+            args.each { |arg| suffixes.each { |suffix| add_symbol(entry, arg, suffix: suffix) } }
+          end
+        end
+
+        def add_symbol(entry, node, suffix: "")
+          value = Source::Literals.symbol_or_string_name(node)
+          entry.names << :"#{value}#{suffix}" unless value.nil?
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/synthetic_method_scanner.rb

@@ -8,6 +8,7 @@ require_relative "../source/literals"
 require_relative "../source/node_children"
 require_relative "synthetic_method"
 require_relative "synthetic_method_index"
+require_relative "synthetic_method_scanner/project_members"
 
 module Rigor
   module Inference
@@ -63,18 +64,30 @@ module Rigor
         registries = collect_trait_registries(plugin_registry)
         nested_templates = collect_nested_class_templates(plugin_registry)
         return SyntheticMethodIndex::EMPTY if templates.empty? && registries.empty? && nested_templates.empty?
-        # Tier B alone cannot emit without an environment: every trait entry — the direct route and the
-        # concern-re-targeted one — funnels through `module_instance_method_names`, whose first line
-        # answers `[]` for a nil environment. The production pre-pass passes `environment: nil` (#476),
-        # so a project whose only contributing plugin registers trait registries (rigor-devise on a
-        # Rails app) would otherwise pay a whole-project parse to build a provably empty index. This
-        # gate mirrors that nil guard and MUST be removed in the change that threads a real environment.
+        # Tier B alone cannot emit without an environment: every trait entry funnels through
+        # `module_instance_method_names`, which answers `[]` for a nil environment. The production pre-pass always
+        # passes one (#476), so this gate guards the direct callers that pass none (a spec, a probe): a
+        # registry-only scan would otherwise pay a whole-project parse to build a provably empty index. It mirrors
+        # that nil guard and goes with it.
         return SyntheticMethodIndex::EMPTY if environment.nil? && templates.empty? && nested_templates.empty?
 
-        asts = parse_paths(paths, buffer: buffer)
+        sources = read_sources(paths, buffer: buffer)
+        # With only trait registries contributing, a project that never writes a registry's method name (no
+        # `devise` anywhere) cannot produce an entry: a call node named `devise` needs the text `devise` in its
+        # file. Skip the parse (the dominant cost) then, and the environment build it would have asked for.
+        return SyntheticMethodIndex::EMPTY if templates.empty? && nested_templates.empty? &&
+                                              none_mention_registry_method?(sources, registries)
+
+        asts = parse_sources(sources)
+        entries, class_names = collect_all_entries(asts, templates, registries, nested_templates, environment,
+                                                   fact_store)
+        SyntheticMethodIndex.new(entries: decline_project_declared(entries, asts), class_names: class_names)
+      end
+
+      # The match + emit walk over every parsed file: `[entries, class_names]`.
+      def collect_all_entries(asts, templates, registries, nested_templates, environment, fact_store)
         hierarchy = build_hierarchy(asts)
         concern_index = build_concern_index(asts)
-
         entries = []
         class_names = []
         asts.each do |path, ast|
@@ -88,8 +101,19 @@ module Rigor
           end
           collect_nested_class_entries(entries, class_names, nested_templates, ast, path) unless nested_templates.empty?
         end
+        [entries, class_names]
+      end
 
-        SyntheticMethodIndex.new(entries: entries, class_names: class_names)
+      # PR #2286 review S1 — a Tier B entry whose name the class itself declares, or a project module it includes
+      # or prepends declares, is dropped: Ruby answers that call from the project's member, ahead of the module
+      # the registry included ({ProjectMembers}). Tier C entries (no `origin_module`) are left as they were.
+      def decline_project_declared(entries, asts)
+        return entries unless entries.any? { |entry| entry.provenance[:origin_module] }
+
+        members = ProjectMembers.new(asts)
+        entries.reject do |entry|
+          entry.provenance[:origin_module] && members.declares?(entry.class_name, entry.method_name)
+        end
       end
 
       # Aggregates `(plugin_id, template)` pairs across every plugin's `manifest.heredoc_templates` in registration
@@ -249,16 +273,32 @@ module Rigor
         call_node.arguments&.arguments&.first
       end
 
-      def parse_paths(paths, buffer: nil)
+      # `path => source text` (nil when the file cannot be read), reading an editor buffer's in-flight bytes
+      # for the logical path it is bound to.
+      def read_sources(paths, buffer: nil)
         paths.to_h do |path|
           physical = buffer ? buffer.resolve(path) : path
-          source = File.read(physical)
-          [path, Prism.parse(source, filepath: path).value]
+          [path, File.read(physical)]
         rescue StandardError
           [path, nil]
         end
       end
 
+      def parse_sources(sources)
+        sources.to_h do |path, source|
+          [path, source.nil? ? nil : Prism.parse(source, filepath: path).value]
+        rescue StandardError
+          [path, nil]
+        end
+      end
+
+      def none_mention_registry_method?(sources, registries)
+        names = registries.map { |(_plugin_id, registry)| registry.method_name.to_s }
+        sources.each_value.none? do |source|
+          !source.nil? && names.any? { |name| source.include?(name) }
+        end
+      end
+
       # ADR-16 slice 4 — Concern re-targeting index.
       #
       # Walks every top-level / nested `module M` decl looking for the ActiveSupport::Concern shape:
@@ -493,7 +533,7 @@ module Rigor
       #   (resolved through `registry.modules_by_symbol`; unknown
       #   symbols silently skipped per design decision (2)).
       #
-      # Returns an Array<String> of module names in `always_included` order followed by argument order.
+      # Returns the module names: the `always_included` ones first, then those for the symbol arguments in order.
       def resolve_trait_modules(registry, call_node)
         modules = registry.always_included.dup
         positional_symbols(call_node, registry).each do |symbol|
@@ -534,6 +574,18 @@ module Rigor
       # Returns the Symbol method-name list defined on `module_name`'s RBS instance definition. Empty Array when the
       # module is not in the RBS env (silent skip — the synthetic emit produces nothing rather than fabricating method
       # names).
+      #
+      # RBS builds a module's instance definition over its self types, or over `Object` when it declares none:
+      # `Kernel#puts`, `Object#hash`, the pretty-printer's mixin — and, for `module Devise::Models::X :
+      # ActiveRecord::Base`, every `ActiveRecord::Base` method (`save`, `update`) — appear in its method table
+      # beside its own members. They are not what including the module adds, and synthesising them would answer
+      # the class's own or inherited methods from the module's view of them. A method is kept only when its
+      # defining owner is the module itself or one of the module's own ancestors (its `include` / `prepend`
+      # chain, which `definition.ancestors` lists without the self types or `Object`).
+      #
+      # A non-public method is skipped: the tier answers a call by name, and a private module method answered
+      # for `user.secret` would silence the call Ruby rejects. A definition that carries no owner (the specs'
+      # stubs) keeps every name.
       def module_instance_method_names(module_name, environment)
         return [] if environment.nil?
 
@@ -543,7 +595,14 @@ module Rigor
         definition = loader.instance_definition(module_name)
         return [] if definition.nil?
 
-        definition.methods.keys
+        own_ancestors = nil
+        definition.methods.filter_map do |name, method|
+          next name unless method.respond_to?(:defined_in)
+          next unless method.public?
+
+          own_ancestors ||= definition.ancestors.ancestors.to_set { |ancestor| ancestor.name.to_s }
+          name if own_ancestors.include?(method.defined_in.to_s)
+        end
       rescue StandardError
         []
       end

data/lib/rigor/inference/toplevel_def_census.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative "../run_scoped_slots"
+require_relative "memo_audit"
+
+module Rigor
+  module Inference
+    # Issue #2515 — whether the `<toplevel>` def table's answer for a name IS the method a receiverless call of that
+    # name runs, so the callee mutation floor may read the def as written. {.reliable?} is false (the floor reads every
+    # argument as written, `StatementEvaluator::FLOOR_EVERY`) when any of these holds for `name`:
+    #
+    # - {Scope#toplevel_def_ambiguity} names a reason (the slot is contested, several ownerless definition rows of the
+    #   name exist, a `def self.name` defines it on `main`, an `alias` introduces it, an anonymous class body defines
+    #   it, `Object` defines it or has a module prepended);
+    # - a `pre_eval:` patch defines `name` on `Object`, `Kernel` or `BasicObject`.
+    #
+    # A visibility toggle (`private :name`, `public :name`) does not change which def answers a receiverless call, and
+    # `method_missing` on `Object` only answers a name nothing defines, so neither is a hazard.
+    #
+    # The answer is a function of the discovery index and the name (the environment is the run's), so it is memoised
+    # per index. A recorder is told the `defines:<name>` name edge on every call, hit or not
+    # ({Scope#toplevel_def_ambiguity}), so a file that starts or stops defining the name re-checks the caller; the memo
+    # is bypassed while one is active, as the callee floor's other memos are.
+    module ToplevelDefCensus
+      OBJECT_OWNERS = %w[Object Kernel BasicObject].freeze
+      RELIABLE_KEY = RunScopedSlots.register(:rigor_toplevel_def_reliable)
+      private_constant :OBJECT_OWNERS, :RELIABLE_KEY
+
+      module_function
+
+      # True when the `<toplevel>` table's def for `name` is the method a receiverless call of `name` runs.
+      def reliable?(scope, name)
+        return compute?(scope, name) if Analysis::DependencyRecorder.active? || MemoAudit.suspended?
+
+        table = (Thread.current[RELIABLE_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        by_name = (table[scope.discovery] ||= {})
+        return by_name[name] = compute?(scope, name) unless by_name.key?(name)
+
+        MemoAudit.check("top-level def census", by_name[name], name) { compute?(scope, name) }
+      end
+
+      def compute?(scope, name)
+        return false unless scope.toplevel_def_ambiguity(name).nil?
+
+        !patched?(scope, name)
+      end
+
+      # True when a `pre_eval:` patch defines `name` on an `Object`-level class.
+      def patched?(scope, name)
+        patched = scope.environment&.project_patched_methods
+        return false if patched.nil?
+
+        patched.by_key.each_key.any? do |(owner, method_name, _kind)|
+          method_name == name && OBJECT_OWNERS.include?(owner)
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/unknown_store_widening.rb

@@ -29,9 +29,10 @@ module Rigor
     # written in; a refinement seed (`non-empty-array[0]`) still can, since its remover does not close a literal.
     #
     # A site whose widening declines leaves the binding as it is, exactly as the straight-line seam does: a
-    # precise nominal (a declared or inferred `Array[String]` is a claim this seam may not grow), a receiver
-    # that is no carrier, or a name the mutator tables do not list for that carrier (`store` on a `Tuple`, a method
-    # its class does not define). The caller MUST therefore not read an unchanged binding as describing later
+    # precise nominal under a site that stores nothing it can see (a declared or inferred `Array[String]` is a claim
+    # this seam may not grow; an element rewriter such as `map!` replaces it with the gradual arm, issue #2427), a
+    # receiver that is no carrier, or a name the mutator tables do not list for that carrier (`store` on a `Tuple`, a
+    # method its class does not define). The caller MUST therefore not read an unchanged binding as describing later
     # iterations. An empty-witness refinement under a storing mutator that keeps the witness is not such a decline:
     # the straight-line widening grows it (issue #936), and gives a site whose arguments describe nothing it stores
     # (`non-empty-array[String]` under `map!`) the gradual arm itself ({RewriteMutation}),
@@ -64,10 +65,11 @@ module Rigor
       CalleeStore = Data.define(:call, :arguments)
 
       COLLECTION_CLASSES = %w[Array Hash].freeze
+      CONTAINER_CLASSES = %w[Array Hash Set].freeze
       FLOORED_CLASSES = %w[Array Hash String].freeze
 
       NO_ARG_NODES = [].freeze
-      private_constant :COLLECTION_CLASSES, :FLOORED_CLASSES, :NO_ARG_NODES
+      private_constant :COLLECTION_CLASSES, :CONTAINER_CLASSES, :FLOORED_CLASSES, :NO_ARG_NODES
 
       module_function
 
@@ -99,6 +101,103 @@ module Rigor
         VALUE_PRESERVING.include?(method_name) && !literal_carrier?(type) ? widened : gradual_content(widened)
       end
 
+      # Issue #2296 — what the caller's argument `type` can hold after a callee that mutates the parameter inside a
+      # block (`def poke(acc) = 2.times { |i| acc[i] = "x" }`). Nothing at the call says what the block stores, so
+      # each carrier takes one unknown store and keeps its element type beside the gradual arm, as a block-captured
+      # binding does ({.widen}): `[7, 9]` reads `Array[Dynamic[top] | Integer]`, `{ a: 1 }`
+      # `Hash[Dynamic[top] | Symbol, Dynamic[top] | Integer]`, `Set[1]` `Set[Dynamic[top] | Integer]`, a literal
+      # String `String`. Not {.content_floor}'s bare carrier: dropping the element type there widened
+      # `ScopeIndexer.finalize_constant_writes` to `Hash[untyped, untyped]` under sig-gen (#2295). A class-level
+      # nominal (`Hash[String, Set[String]]`) is a claim this seam may not grow, and is left alone; a value-pinned one
+      # (`Hash["a" | "b", 1]`) holds a first-store answer the unknown store falsifies, and takes the gradual arm, as a
+      # block's unknown-store binding does.
+      def callee_block_floor(type)
+        widened = widen_store(type, :[]=, unknown_arguments(2)) || type
+        widened = callee_set_floor(widened) || widened
+        dynamic_elements(value_pinned_collection?(widened) ? gradual_content(widened) : widened)
+      end
+
+      # Issue #2296 — `type` after a callee that grows the parameter through a Set-only adder (`s.add(x)`,
+      # `s.merge(xs)`): a Set carrier takes one unknown store, and anything else, a Hash under `merge` included, is
+      # returned as nil (unchanged).
+      def callee_set_floor(type)
+        widened = widen_store(type, :add, unknown_arguments(1))
+        widened && dynamic_elements(widened)
+      end
+
+      # Issue #2647 — `type` with each container element the unknown store widened (`Dynamic[top] | String`, which an
+      # element read back out fails a literal-typed parameter with, although the callee stored a value the call never
+      # shows) made a gradual `Dynamic[String]`: the floor may forget a fact, never claim the nominal class. An element
+      # that carries no `Dynamic[top]` arm (a class-level `Array[Integer]`, which the floor leaves alone) is returned as
+      # it is. Scoped to the callee floor's two entry points, so a local mutation's unknown-store widening keeps its
+      # answer.
+      def dynamic_elements(type)
+        return type unless needs_dynamic?(type)
+
+        case type
+        when Type::Union then Type::Combinator.union(*type.members.map { |member| dynamic_elements(member) })
+        when Type::Difference then Type::Combinator.difference(dynamic_elements(type.base), type.removed)
+        when Type::Nominal
+          return type unless CONTAINER_CLASSES.include?(type.class_name) && !type.type_args.empty?
+
+          Type::Combinator.nominal_of(type.class_name, type_args: type.type_args.map { |arg| dynamic_element(arg) })
+        else type
+        end
+      end
+
+      # True when {.dynamic_elements} would change `type`: a container element with a `Dynamic[top]` member and a class
+      # member (neither a literal nor `Dynamic[top]`). Reads with `any?` only, so the common unchanged type is not
+      # rebuilt.
+      def needs_dynamic?(type)
+        case type
+        when Type::Union then type.members.any? { |member| needs_dynamic?(member) }
+        when Type::Difference then needs_dynamic?(type.base)
+        when Type::Nominal
+          CONTAINER_CLASSES.include?(type.class_name) && type.type_args.any? { |arg| needs_dynamic_element?(arg) }
+        else false
+        end
+      end
+
+      def needs_dynamic_element?(arg)
+        return false unless arg.is_a?(Type::Union)
+
+        arg.members.any? { |member| gradual_top?(member) } &&
+          arg.members.any? { |member| !member.is_a?(Type::Constant) && !gradual_top?(member) }
+      end
+
+      def gradual_top?(member) = member.is_a?(Type::Dynamic) && member.static_facet.is_a?(Type::Top)
+
+      # `Dynamic[top] | A | B` as `Dynamic[A | B]` for the class members; a literal member (a value-pinned key) and any
+      # other element stay as they are.
+      def dynamic_element(arg)
+        members = arg.is_a?(Type::Union) ? arg.members : [arg]
+        gradual, known = members.partition { |member| gradual_top?(member) }
+        return arg if gradual.empty?
+
+        literals, classes = known.partition { |member| member.is_a?(Type::Constant) }
+        return arg if classes.empty?
+
+        Type::Combinator.union(*literals, Type::Combinator.dynamic(Type::Combinator.union(*classes)))
+      end
+
+      def unknown_arguments(count) = Array.new(count) { Type::Combinator.untyped }
+
+      # False only when {.callee_block_floor} and {.callee_set_floor} are sure to leave `type` as it is: a type that is
+      # no String, Array, Hash or Set carrier in any form. A cheap gate, so a call passing only such locals skips the
+      # census closures those floors read.
+      def callee_floorable?(type)
+        case type
+        when Type::Union then type.members.any? { |member| callee_floorable?(member) }
+        when Type::Tuple, Type::HashShape, Type::Difference, Type::Refined, Type::Intersection then true
+        when Type::Constant then type.value.is_a?(String) || type.value.is_a?(::Set)
+        when Type::Nominal then FLOORABLE_NOMINALS.include?(type.class_name)
+        else false
+        end
+      end
+
+      FLOORABLE_NOMINALS = %w[Array Hash Set String].freeze
+      private_constant :FLOORABLE_NOMINALS
+
       # Every `Array` / `Hash` / `String` carrier `type` can be as its bare carrier: `Array[Dynamic[top]]`,
       # `Hash[Dynamic[top], Dynamic[top]]`, `String`. A literal, a nominal (a precise one included) and a refinement
       # over one ({.carrier_class}) all floor; so `non-empty-string`, which a callee can empty, reads `String`.

data/lib/rigor/inference/unthreaded_rebinds.rb

@@ -124,9 +124,8 @@ module Rigor
 
       # How a walk position reaches the exit scope: whether a local rebind there is threaded, whether an
       # instance variable's is, whether a class variable's or global's is, the offset below which a rebind
-      # precedes a jump,
-      # whether the position binds targets only (`:multi_assign` under a multi-assign, `:capture` under any
-      # other binding construct, false otherwise), and the locals a nested block shadows.
+      # precedes a jump, whether the position binds targets only (`:multi_assign` under a multi-assign,
+      # `:capture` under any other binding construct, false otherwise), and the locals a nested block shadows.
       Position = Data.define(:local, :ivar, :other, :horizon, :binding, :shadowed)
       private_constant :Position
 

data/lib/rigor/inference/void_tail_summary.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "void_origin"
 require_relative "../reflection"
 require_relative "../source/node_children"
+require_relative "../run_scoped_slots"
 
 module Rigor
   module Inference
@@ -62,7 +63,7 @@ module Rigor
       # graceful-degradation branch is needed. `def_node` identity is stable per run (the ADR-85
       # {DefNodeResolver} yields one node object per `(path, node_id)`), the same identity the ADR-84
       # return memo relies on.
-      MEMO_KEY = :__rigor_void_tail_summary_memo__
+      MEMO_KEY = RunScopedSlots.register(:__rigor_void_tail_summary_memo__)
       private_constant :MEMO_KEY
 
       def initialize(scope)

data/lib/rigor/language_server/buffer_table.rb

@@ -13,9 +13,9 @@ module Rigor
     # with no `range`) stays supported — it is still legal under incremental sync and is what `didOpen` and a
     # client-side resync send.
     class BufferTable
-      # @!attribute uri      [String]  the LSP DocumentUri (e.g. `file:///abs/path/lib/foo.rb`).
-      # @!attribute bytes    [String]  the current full text of the buffer.
-      # @!attribute version  [Integer] the monotonically increasing LSP version number.
+      # @!attribute uri — the LSP DocumentUri (e.g. `file:///abs/path/lib/foo.rb`).
+      # @!attribute bytes — the current full text of the buffer.
+      # @!attribute version — the monotonically increasing LSP version number.
       Entry = Data.define(:uri, :bytes, :version)
 
       def initialize
@@ -98,6 +98,12 @@ module Rigor
         @dirty.key?(uri)
       end
 
+      # @return true when `uri` is open, its bytes are the ones on disk, and the table holds them faithfully: the
+      #   buffers a whole-project round analysed as they are.
+      def on_disk?(uri)
+        open?(uri) && !dirty?(uri) && !desynchronized?(uri)
+      end
+
       def [](uri)
         @entries[uri]
       end