rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/acceptance.rb

@@ -3,6 +3,7 @@
 require_relative "../type"
 require_relative "range_constant"
 require_relative "content_join"
+require_relative "../typing_state"
 
 module Rigor
   module Inference
@@ -75,41 +76,70 @@ module Rigor
       }.freeze
       private_constant :TYPE_HANDLERS
 
-      UNREAD_HASH_REFUSED_KEY = :__rigor_acceptance_unread_hash_refused__
-      private_constant :UNREAD_HASH_REFUSED_KEY
-
-      # Whether a `maybe` for `param` against `arg` rests on a record that could not read a hash's entries: a
-      # `Hash` with a gradual arm ({#gradual_hash?}) or an open `HashShape`. The record cannot prove the key set
-      # of either, and its `maybe` climbs through whatever holds the record. `OverloadSelector`'s strict pass
-      # reads that `maybe` as no evidence for the overload, so this re-asks with each such record answering
-      # `no` and reports whether the pair then fails. A `maybe` from anywhere else (a subclass only the Ruby
-      # source declares, a splat under a parameter that is no record) survives the re-ask and still counts.
-      def maybe_rests_on_unread_hash?(param, arg)
-        return false unless contains_type?(param) { |type| type.is_a?(Type::HashShape) }
-        return false unless contains_type?(arg) { |type| unread_hash?(type) }
+      # ADR-129 WD1 — a Frame: {#refusing_unread} installs the kind of unread shape that answers `no` for one block
+      # and restores the previous one on the way out. It changes answers (`unread_shape_maybe` reads it), and the
+      # installed value is a Symbol (`:all`, `:array`) or nil.
+      UNREAD_SHAPE_REFUSED = TypingState.frame(
+        :acceptance_unread_shape_refused,
+        reason: "installed around a block by refusing_unread; read by unread_shape_maybe, which answers no for " \
+                "the refused kind of unread shape instead of maybe",
+        witness: "spec/fixtures/typing_state_witnesses/acceptance_unread_shape_refused.rb"
+      )
+      private_constant :UNREAD_SHAPE_REFUSED
+
+      # Whether a `maybe` for `param` against `arg` rests on a shape that could not read its argument: a record
+      # against a `Hash` with a gradual arm ({#gradual_hash?}) or an open `HashShape`, or a tuple against an
+      # `Array` of unknown arity ({#array_carrier?}). The shape cannot prove the key set or the length, and its
+      # `maybe` climbs through whatever holds it. `OverloadSelector`'s strict pass reads that `maybe` as no
+      # evidence for the overload, so this re-asks with each such shape answering `no` and reports whether the
+      # pair then fails. A `maybe` from anywhere else (a subclass only the Ruby source declares, a splat under a
+      # parameter that is no shape) survives the re-ask and still counts.
+      def maybe_rests_on_unread_shape?(param, arg)
+        return false unless rests_on_unread_hash?(param, arg) || rests_on_unread_array?(param, arg)
+
+        refusing_unread(:all) { accepts(param, arg, mode: :gradual).no? }
+      end
 
-        refusing_unread_hashes { accepts(param, arg, mode: :gradual).no? }
+      # Whether any of `types` holds an `Array` a tuple cannot read ({#array_carrier?}), so a match may rest on
+      # the tuple's `maybe`. `OverloadSelector`'s gradual pass asks before re-matching under
+      # {#refusing_unread_arrays}.
+      def unread_array_in?(types)
+        types.any? { |type| contains_type?(type) { |inner| array_carrier?(inner) } }
       end
 
+      # Runs the block with each tuple answering `no`, not `maybe`, for an `Array` of unknown arity. A record's
+      # `maybe` for an unread hash is untouched.
+      def refusing_unread_arrays(&) = refusing_unread(:array, &)
+
       # rubocop:disable-next Metrics/ClassLength
       class << self
         private
 
-        # The flag lives on the thread, not on a parameter, because the record may sit any number of `accepts`
-        # calls below the one asked (a tuple element, a `Hash` value, a union member), and those calls go
-        # through each carrier's `Type#accepts`. It is set only for the duration of the block.
-        def refusing_unread_hashes
-          previous = Thread.current[UNREAD_HASH_REFUSED_KEY]
-          Thread.current[UNREAD_HASH_REFUSED_KEY] = true
-          yield
-        ensure
-          Thread.current[UNREAD_HASH_REFUSED_KEY] = previous
+        def rests_on_unread_hash?(param, arg)
+          contains_type?(param) { |type| type.is_a?(Type::HashShape) } &&
+            contains_type?(arg) { |type| unread_hash?(type) }
         end
 
-        # The `maybe` a record answers for a hash whose entries it cannot read, or `no` inside
-        # {#refusing_unread_hashes}.
-        def unread_hash_maybe(mode, reason)
-          return hash_shape_no(mode, "#{reason} (refused as evidence)") if Thread.current[UNREAD_HASH_REFUSED_KEY]
+        def rests_on_unread_array?(param, arg)
+          contains_type?(param) { |type| type.is_a?(Type::Tuple) } &&
+            contains_type?(arg) { |type| array_carrier?(type) }
+        end
+
+        # The flag lives on the thread, not on a parameter, because the shape may sit any number of `accepts`
+        # calls below the one asked (a tuple element, a `Hash` value, a union member), and those calls go
+        # through each carrier's `Type#accepts`. It is set only for the duration of the block. `kind` is `:all`
+        # (records and tuples) or `:array` (tuples only).
+        def refusing_unread(kind, &)
+          TypingState.current.with(UNREAD_SHAPE_REFUSED, kind, &)
+        end
+
+        # The `maybe` a shape of `kind` (`:hash` or `:array`) answers for an argument it cannot read, or `no`
+        # inside {#refusing_unread} for that kind.
+        def unread_shape_maybe(mode, reason, kind)
+          refused = TypingState.current[UNREAD_SHAPE_REFUSED]
+          if refused == :all || refused == kind
+            return Type::AcceptsResult.no(mode: mode, reasons: "#{reason} (refused as evidence)")
+          end
 
           Type::AcceptsResult.maybe(mode: mode, reasons: reason)
         end
@@ -402,6 +432,19 @@ module Rigor
         CLASS_OBJECT_NOMINALS = %w[Module Class Object Kernel BasicObject].freeze
         private_constant :CLASS_OBJECT_NOMINALS
 
+        # Issue #2855 — whether `type` is an unparameterised `Class` or `Module` nominal: a class object whose
+        # identity inference lost (`const_get` kept by `is_a?(Class)`, an `is_a?(Module)` guard). `Acceptance` still
+        # answers `no` for it against a `Singleton` (it is a supertype, not a subtype); `call.argument-type-mismatch`
+        # reads it to withhold that verdict. `Object`, `BasicObject` and `Kernel` are left out: they mean "any value",
+        # and `Object.new` against `singleton(X)` is a real mismatch.
+        CLASS_OR_MODULE_NOMINALS = %w[Class Module].freeze
+        private_constant :CLASS_OR_MODULE_NOMINALS
+
+        def class_or_module_nominal?(type)
+          type.is_a?(Type::Nominal) && type.type_args.empty? && CLASS_OR_MODULE_NOMINALS.include?(type.class_name)
+        end
+        public :class_or_module_nominal?
+
         def accepts_nominal_from_singleton(self_type, other_type, mode)
           if CLASS_OBJECT_NOMINALS.include?(self_type.class_name)
             return Type::AcceptsResult.yes(
@@ -469,9 +512,10 @@ module Rigor
         end
 
         # Returns `other_type` rewritten so its type_args have the same arity as `self_type.type_args`, or
-        # `nil` if no projection is known. Today only the Hash → Enumerable projection is hand-rolled; a
-        # general RBS-driven implementation that consults `definition.ancestors[i].args` for arbitrary
-        # subclass / module-include relations is the principled follow-up.
+        # `nil` if no projection is known. Today the Hash → Enumerable and ArithmeticSequence → Enumerator
+        # projections are hand-rolled; a general RBS-driven implementation that consults
+        # `definition.ancestors[i].args` for arbitrary subclass / module-include relations is the principled
+        # follow-up.
         def project_to_target_arity(self_type, other_type)
           return nil if self_type.type_args.size == other_type.type_args.size
           return nil if self_type.type_args.empty? || other_type.type_args.empty?
@@ -824,11 +868,14 @@ module Rigor
         # carrier whose value set is visibly apart from `removed` — a `Constant` (compare values directly),
         # another `Difference` with the same removed value (already exhibits the disjointness), an
         # `IntegerRange` that skips an Integer removed value, a `Tuple` whose fixed arity differs from a
-        # removed `Tuple`, or a `HashShape` with a required key a closed removed `HashShape` cannot hold. The
-        # last three cover the empty witnesses of `non-zero-int`, `non-empty-array[T]` and
-        # `non-empty-hash[K, V]`. Any other carrier — a Nominal above all — is no proof and the difference
-        # rejects it under gradual mode, even where its values happen to exclude `removed`. A Union or
-        # Intersection argument never reaches this rule whole: `accepts` splits it into members first.
+        # removed `Tuple`, a `HashShape` with a required key a closed removed `HashShape` cannot hold, or a
+        # `Refined` whose predicate recogniser rejects the removed `Constant`. The range, tuple and shape
+        # arms cover the empty witnesses of `non-zero-int`, `non-empty-array[T]` and
+        # `non-empty-hash[K, V]`; the `Refined` arm is what lets `non-empty-string` accept
+        # `decimal-int-string`, which can never hold `""`. Any other carrier — a Nominal above all — is no
+        # proof and the difference rejects it under gradual mode, even where its values happen to exclude
+        # `removed`. A Union or Intersection argument never reaches this rule whole: `accepts` splits it
+        # into members first.
         def accepts_difference(self_type, other_type, mode)
           base_result = accepts(self_type.base, other_type, mode: mode)
           return base_result if base_result.no?
@@ -858,16 +905,30 @@ module Rigor
             # `removed`, the meet is too.
             other_type.members.any? { |m| provably_disjoint_from_removed?(m, removed) }
           when Type::IntegerRange
-            removed.is_a?(Type::Constant) && removed.value.is_a?(Integer) && !other_type.covers?(removed.value)
+            integer_range_excludes_removed?(other_type, removed)
           when Type::Tuple
             # A Tuple's arity is fixed, so it shares no inhabitant with a Tuple of another arity — the
             # zero-arity witness `non-empty-array[T]` removes included.
             removed.is_a?(Type::Tuple) && removed.elements.size != other_type.elements.size
           when Type::HashShape
             hash_shape_excludes_removed?(other_type, removed)
+          when Type::Refined
+            refined_excludes_removed?(other_type, removed)
           end
         end
 
+        def integer_range_excludes_removed?(range, removed)
+          removed.is_a?(Type::Constant) && removed.value.is_a?(Integer) && !range.covers?(removed.value)
+        end
+
+        # A predicate refinement excludes the removed value when its recogniser rejects the removed
+        # constant outright — `decimal-int-string` can never hold `""`. `matches?` answers nil for a
+        # predicate the registry does not know, and nil is no proof, so the comparison is `== false`
+        # rather than `!`.
+        def refined_excludes_removed?(refined, removed)
+          removed.is_a?(Type::Constant) && refined.matches?(removed.value) == false
+        end
+
         # Every inhabitant of `shape` holds each of its required keys, and a closed `removed` shape holds no
         # key outside its pairs, so one required key `removed` does not list makes the two disjoint. Against
         # the closed `{}` witness `non-empty-hash[K, V]` removes, that is any required key; an optional key
@@ -881,8 +942,8 @@ module Rigor
         # `Refined[base, predicate]` accepts another type X when the base accepts the *base* of X *and* X is
         # provably contained in the predicate's value set. The base check is delegated to
         # `accepts(self.base, X.base)` so handlers like `accepts_nominal` see Nominal-vs-Nominal and return
-        # their normal answer (the inner `accepts_nominal` does not register `Refined` / `Difference` as
-        # direct other-shapes — projecting to the base is what makes the comparison meaningful).
+        # their normal answer (`accepts_nominal` projects a `Refined` / `Difference` other onto its base,
+        # which is what makes the comparison meaningful).
         #
         # Provability rules in gradual mode (the conservative analogue of `accepts_difference`):
         #
@@ -1003,9 +1064,12 @@ module Rigor
 
         # Tuple[A1..An] accepts:
         # - Tuple[B1..Bn] when arities match and each Ai accepts Bi (covariant per-position).
-        # - Anything else: no (we cannot prove the arity from a generic nominal alone).
+        # - An `Array[E]` (see {#array_element_verdict}): maybe, or no on an element contradiction.
+        # - Anything else: no.
         def accepts_tuple(self_type, other_type, mode)
           unless other_type.is_a?(Type::Tuple)
+            return array_element_verdict(self_type, other_type, mode) if array_carrier?(other_type)
+
             return Type::AcceptsResult.no(
               mode: mode,
               reasons: "Tuple does not accept #{other_type.class}"
@@ -1025,6 +1089,38 @@ module Rigor
           combine_arg_results(per_element, mode)
         end
 
+        # An `Array` nominal, directly or as the base of a `Difference` (`non-empty-array[E]`). Its arity is
+        # unknown, so a tuple cannot reject it on length: `URI.encode_www_form` takes
+        # `Enumerable[[_ToS, _ToS]]` and is handed the `Array[Array[String]]` that `URI.decode_www_form`
+        # answers. An `Array` subclass is not read, as {#gradual_hash?} does not read a `Hash` subclass.
+        def array_carrier?(type)
+          nominal = type.is_a?(Type::Difference) ? type.base : type
+          nominal.is_a?(Type::Nominal) && nominal.class_name == "Array"
+        end
+
+        # `maybe`, unless the element type rules the tuple out at any length: some position accepts no member
+        # of `E` (`[Integer, Integer]` never takes an `Array[String]`). A raw `Array` stays `maybe`, and so does
+        # an element with a gradual arm, since no position rejects a `Dynamic` member. The accepted cost (ADR-5)
+        # is that a wrong-length `Array[E]` passed or returned where a tuple is declared goes unreported.
+        def array_element_verdict(self_type, other_type, mode)
+          nominal = other_type.is_a?(Type::Difference) ? other_type.base : other_type
+          element = nominal.type_args.first
+          unless element.nil?
+            members = ContentJoin.union_members(element)
+            refused = self_type.elements.find do |formal|
+              members.all? { |member| accepts(formal, member, mode: mode).no? }
+            end
+            if refused
+              return Type::AcceptsResult.no(
+                mode: mode,
+                reasons: "tuple member #{refused.describe(:short)} rejects #{element.describe(:short)}"
+              )
+            end
+          end
+
+          unread_shape_maybe(mode, "tuple arity unknown for #{other_type.describe(:short)}", :array)
+        end
+
         # HashShape{k1: T1, ...} accepts another HashShape when every required key of self is required on
         # the other side and Ti accepts Ui (depth covariant). Optional keys may be absent on the other side;
         # when present, their values are checked. A closed self rejects known extra keys, and answers at most
@@ -1056,7 +1152,7 @@ module Rigor
           result = combine_arg_results(per_entry, mode)
           return result unless result.yes? && self_type.closed? && other_type.open?
 
-          unread_hash_maybe(mode, "HashShape closed target cannot check open source")
+          unread_shape_maybe(mode, "HashShape closed target cannot check open source", :hash)
         end
 
         # A `Hash` nominal — directly or as the base of a `Difference` (`non-empty-hash[K, V]`) — that is raw or
@@ -1085,7 +1181,7 @@ module Rigor
           refused = refused_value_keys(self_type, value_type, mode)
           return hash_shape_no(mode, "Hash value type refused for required keys: #{refused.inspect}") if refused.any?
 
-          unread_hash_maybe(mode, "HashShape cannot check #{other_type.describe(:short)}")
+          unread_shape_maybe(mode, "HashShape cannot check #{other_type.describe(:short)}", :hash)
         end
 
         def unholdable_keys(self_type, key_type, mode)

data/lib/rigor/inference/alias_mutation_floor/foreign_locals.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../source/node_children"
+require_relative "../closure_escape_analyzer"
+require_relative "../remover_holder_scan"
+
+module Rigor
+  module Inference
+    module AliasMutationFloor
+      # Issue #2335 — the *foreign* locals of a frame body ({AliasMutationFloor}): those whose object may have come
+      # from elsewhere, so they may be another local's object. A method parameter, a block or lambda parameter (but one
+      # of a catalogued iterator over literals that read nothing, whose parameters are those literals' own objects), a
+      # local any target node binds, and a local written anything but a new object.
+      module ForeignLocals
+        FRESH_VALUES = [
+          Prism::ArrayNode, Prism::HashNode, Prism::StringNode, Prism::InterpolatedStringNode, Prism::XStringNode,
+          Prism::InterpolatedXStringNode, Prism::IntegerNode, Prism::FloatNode, Prism::RationalNode, Prism::ImaginaryNode,
+          Prism::SymbolNode, Prism::InterpolatedSymbolNode, Prism::NilNode, Prism::TrueNode, Prism::FalseNode,
+          Prism::RangeNode, Prism::RegularExpressionNode, Prism::InterpolatedRegularExpressionNode
+        ].freeze
+        # `+"x"`, `"x".dup`, `String.new`: a new String.
+        FRESH_STRING_CALLS = %i[+@ dup clone].to_set.freeze
+        LITERAL_PARTS = [Prism::ArrayNode, Prism::HashNode, Prism::KeywordHashNode, Prism::AssocNode,
+                         *FRESH_VALUES].freeze
+        private_constant :FRESH_VALUES, :FRESH_STRING_CALLS, :LITERAL_PARTS
+
+        module_function
+
+        # `[foreign, entry]`: the foreign locals, and the method parameters the body never rebinds, each frozen.
+        def collect(body, parameters)
+          foreign = Set.new
+          written = Set.new
+          collect_foreign(body, foreign, written)
+          finish(parameters, foreign, written)
+        end
+
+        # `[foreign, entry]` from the body's own `foreign` and `written` sets and the method's `parameters`.
+        def finish(parameters, foreign, written)
+          entry = Set.new
+          collect_parameters(parameters, entry)
+          [foreign.merge(entry).freeze, (entry - written).freeze]
+        end
+
+        def collect_parameters(node, names)
+          return if node.nil?
+
+          names << node.name if node.class.name.end_with?("ParameterNode") && node.respond_to?(:name) && node.name
+          node.rigor_each_child { |child| collect_parameters(child, names) }
+        end
+
+        # `foreign` gains every block or lambda parameter and every local a write binds to an object from elsewhere (an
+        # operator write's value is a call result); `written` every local any write or target binds. A nested def is
+        # not entered.
+        def collect_foreign(node, foreign, written, literal_blocks = Set.new.compare_by_identity)
+          return if node.is_a?(Prism::DefNode)
+
+          visit(node, foreign, written, literal_blocks)
+          node.rigor_each_child { |child| collect_foreign(child, foreign, written, literal_blocks) }
+        end
+
+        # {.collect_foreign}'s step for one node, which the site collector's walk also takes
+        # ({AliasMutationFloor::SiteCollector}).
+        def visit(node, foreign, written, literal_blocks)
+          case node
+          when Prism::CallNode then literal_blocks << node.block if literal_iterator_block?(node)
+          when Prism::BlockNode, Prism::LambdaNode
+            collect_parameters(node.parameters, foreign) unless literal_blocks.include?(node)
+          when Prism::LocalVariableTargetNode, Prism::LocalVariableOperatorWriteNode
+            foreign << written_name(node, written)
+          when Prism::LocalVariableWriteNode, Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode
+            name = written_name(node, written)
+            foreign << name unless fresh_value?(node.value)
+          end
+        end
+
+        # A catalogued iterator over literals that read nothing (`[[1], [2]].each { |x| }`,
+        # `[1].each_with_object({}) { |x, h| }`): its block's parameters are those literals' own new objects. Any other
+        # block's parameters may be any object.
+        def literal_iterator_block?(call_node)
+          return false unless call_node.block.is_a?(Prism::BlockNode)
+          return false unless ClosureEscapeAnalyzer.iterator_name?(call_node.name)
+
+          [call_node.receiver, *call_node.arguments&.arguments].all? do |operand|
+            !operand.nil? && literal_only?(operand)
+          end
+        end
+
+        def literal_only?(node)
+          return false unless LITERAL_PARTS.any? { |klass| node.is_a?(klass) }
+
+          node.rigor_each_child { |child| return false unless literal_only?(child) }
+          true
+        end
+
+        def written_name(node, written)
+          written << node.name
+          node.name
+        end
+
+        # A value that is a new object, so the local it binds holds no other holder's object.
+        def fresh_value?(value)
+          value = RemoverHolderScan.unparenthesised(value)
+          return true if FRESH_VALUES.any? { |klass| value.is_a?(klass) }
+          return false unless value.is_a?(Prism::CallNode)
+          return true if RemoverHolderScan.fresh_value?(value)
+
+          receiver = value.receiver
+          (FRESH_STRING_CALLS.include?(value.name) &&
+            (receiver.is_a?(Prism::StringNode) || receiver.is_a?(Prism::InterpolatedStringNode))) ||
+            (value.name == :new && receiver.is_a?(Prism::ConstantReadNode) && receiver.name == :String)
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/alias_mutation_floor/memos.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require_relative "../../typing_state"
+require_relative "../../memo_audit"
+
+module Rigor
+  module Inference
+    module AliasMutationFloor
+      # ADR-129 WD1 — the floor's four run-scoped Memos, each a pure function of the key it holds, and their accessors.
+      # Each accessor's block computes the value: on a miss it is stored, on a hit {MemoAudit.check} compares it with
+      # the stored one under `RIGOR_MEMO_AUDIT=1`, and while an audit recomputation runs ({MemoAudit.suspended?}) it
+      # answers without reading or writing the memo.
+      module Memos
+        FACTS = TypingState.memo(
+          :alias_mutation_floor_facts,
+          run_scoped: true, audit: "alias floor facts",
+          reason: "keyed by the body node; the facts are a pure function of the body and its parameters"
+        )
+        IVAR = TypingState.memo(
+          :alias_mutation_floor_ivar_mutators,
+          run_scoped: true, audit: "alias floor ivar mutator",
+          reason: "keyed by def node; whether its body mutates an ivar is a pure function of the body"
+        )
+        FLOOR = TypingState.memo(
+          :alias_mutation_floor_callee_floors,
+          run_scoped: true, audit: "alias floor callee floor",
+          reason: "keyed by the literal shape; the callee block floor is a pure function of it"
+        )
+        STORE = TypingState.memo(
+          :alias_mutation_floor_unknown_stores,
+          run_scoped: true, audit: "alias floor unknown store",
+          reason: "keyed by call node, removed-keys mode and type, every input of the widened store"
+        )
+        private_constant :FACTS, :IVAR, :FLOOR, :STORE
+
+        module_function
+
+        # The facts of `body`. A hit is audited without the facts' per-read memos, which fill as reads are answered.
+        def facts(body, &)
+          return yield if MemoAudit.enabled? && MemoAudit.suspended?
+
+          table = TypingState.current.weak_key_map(FACTS)
+          facts = table[body]
+          return table[body] = MemoAudit.key_audit("alias floor facts", &) if facts.nil?
+
+          MemoAudit.check("alias floor facts", audited(facts), body) { audited(yield) } if MemoAudit.enabled?
+          facts
+        end
+
+        def ivar_mutator(def_node, &)
+          return yield if MemoAudit.enabled? && MemoAudit.suspended?
+
+          table = TypingState.current.weak_key_map(IVAR)
+          cached = table[def_node]
+          return table[def_node] = MemoAudit.key_audit("alias floor ivar mutator", &) if cached.nil?
+
+          MemoAudit.check("alias floor ivar mutator", cached, def_node, &)
+        end
+
+        def callee_floor(type, &)
+          return yield if MemoAudit.enabled? && MemoAudit.suspended?
+
+          state = TypingState.current
+          table = (state[FLOOR] ||= {})
+          return table[type] = MemoAudit.key_audit("alias floor callee floor", &) unless table.key?(type)
+
+          MemoAudit.check("alias floor callee floor", table[type], type, &)
+        end
+
+        def unknown_store(call_node, removed_keys, type, &)
+          return yield if MemoAudit.enabled? && MemoAudit.suspended?
+
+          state = TypingState.current
+          table = (state[STORE] ||= {}.compare_by_identity)
+          per_mode = ((table[call_node] ||= {})[removed_keys] ||= {})
+          return per_mode[type] = MemoAudit.key_audit("alias floor unknown store", &) unless per_mode.key?(type)
+
+          MemoAudit.check("alias floor unknown store", per_mode[type], call_node, type, &)
+        end
+
+        def audited(facts) = facts.with(memo: nil, named_memo: nil)
+      end
+    end
+  end
+end

data/lib/rigor/inference/alias_mutation_floor/reach.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../receiver_alias"
+
+module Rigor
+  module Inference
+    # Issue #2335 — which locals a write through a receiver may reach ({AliasMutationFloor}), read off a frame body's
+    # {AliasMutationFloor::Facts}.
+    module AliasMutationFloor
+      module_function
+
+      # The locals aliased by the time `call_node`'s message runs, as `{ name => depth }`: those a site has handed on,
+      # and those linked to one ({.reach}). A call inside a closure that may run later sees every site.
+      def aliased_at(facts, call_node)
+        return ALL if facts.held.equal?(ALL)
+
+        offset = offset_of(facts, call_node)
+        seeds = {}
+        facts.held.each { |name, key| seeds[name] = FULL if key <= offset }
+        facts.held_part.each { |name, key| seeds[name] ||= PART if key <= offset }
+        reach(seeds, facts.links, offset)
+      end
+
+      def offset_of(facts, call_node)
+        offset = (call_node.message_loc || call_node.location).start_offset
+        facts.deferred.any? { |from, to| offset >= from && offset < to } ? Float::INFINITY : offset
+      end
+
+      # `seeds` closed over every link whose site may have run by `offset`. A depth says how far inside a local's object
+      # the mutated object may sit: 0 ({FULL}) is the object itself, 1 ({PART}) one of its elements, and so on. A copy
+      # keeps the depth; across an element link (`x = a[i]`, `x = a[i][j]`) the parent sits as many levels further out
+      # than the child as the read goes, and the child as many further in, so a mutation of the parent object itself
+      # (depth 0) does not reach the child.
+      # The least depth wins.
+      def reach(seeds, links, offset)
+        changed = !seeds.empty?
+        while changed
+          changed = false
+          links.each do |child, parent, key, levels|
+            next if key > offset
+
+            changed = true if spread(seeds, child, parent, levels) | spread(seeds, parent, child, -levels)
+          end
+        end
+        seeds
+      end
+
+      DEPTH_CAP = 8
+      private_constant :DEPTH_CAP
+
+      # Spreads the depth `from` reached across one link to `to`, `step` levels further out; answers whether `to`
+      # changed.
+      def spread(seeds, from, to, step) # rubocop:disable Naming/PredicateMethod
+        depth = seeds[from]
+        return false if depth.nil?
+
+        depth += step
+        return false if depth.negative? || depth > DEPTH_CAP
+        return false if seeds[to] && seeds[to] <= depth
+
+        seeds[to] = depth
+        true
+      end
+
+      # The locals a write through `receiver` may reach, as {.aliased_at} answers them: through each local it may
+      # evaluate to ({ReceiverAlias.candidates}: `(c ? a : b)`), through an element read's root ({.element_targets}), or
+      # as through any other receiver.
+      def receiver_targets(receiver, facts, call_node)
+        reads = ReceiverAlias.candidates(receiver)
+        aliased = aliased_at(facts, call_node)
+        return element_targets(receiver, facts, aliased, call_node) if reads.empty?
+        return targets(nil, facts, aliased, call_node) unless reads.all?(Prism::LocalVariableReadNode)
+
+        reads.map { |read| targets(read.name, facts, aliased, call_node) }.reduce { |acc, set| union(acc, set) }
+      end
+
+      # Through an element read rooted at a local (`c[0] << x`, `h[:k].fetch(0) << x`), the root's own links as far
+      # inside it as the read goes (`a = c[0]` is the mutated object itself), beside what any other receiver reaches.
+      def element_targets(receiver, facts, aliased, call_node)
+        others = targets(nil, facts, aliased, call_node)
+        root, depth = element_root(receiver)
+        return others if root.nil? || others.equal?(ALL)
+
+        union(others, reach({ root.name => depth }, facts.links, offset_of(facts, call_node)))
+      end
+
+      def union(left, right)
+        return ALL if left.equal?(ALL) || right.equal?(ALL)
+
+        merged = left.dup
+        right.each { |name, depth| merged[name] = [merged[name], depth].compact.min }
+        merged
+      end
+
+      # The locals a write through the local `name` (nil for any other receiver) may reach, as `{ name => depth }`:
+      #
+      # - the locals linked to it ({.reach}): a copy of it, or what it copied (`b = a; b << x`), or the local it is an
+      #   element of (`x = a[i]`);
+      # - and every aliased local, through a receiver that may hold any object: an ivar, an index read, a call result,
+      #   a block parameter, or a local some write binds to an object from elsewhere;
+      # - or only the aliased locals that are foreign, through a local only ever written a new object or a method
+      #   parameter the body never rebinds, once the body has handed it on: either is an object no new-object local
+      #   can be, and only a holder it reached can hand it to another local.
+      def targets(name, facts, aliased, call_node)
+        return ALL if aliased.equal?(ALL)
+        return aliased if name.nil? || NUMBERED_PARAMETER.match?(name)
+
+        group = reach({ name => FULL }, facts.links, offset_of(facts, call_node))
+        group.delete(name)
+        return union(aliased, group) if facts.foreign.include?(name) && !facts.entry.include?(name)
+        return group unless aliased.key?(name)
+
+        union(group, aliased.slice(*facts.foreign))
+      end
+    end
+  end
+end