rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/alias_mutation_floor/site_collector.rb

@@ -0,0 +1,252 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../element_read_widening"
+require_relative "../mutation_widening"
+require_relative "../receiver_alias"
+require_relative "../remover_holder_scan"
+require_relative "../set_mutation"
+require_relative "foreign_locals"
+
+module Rigor
+  module Inference
+    module AliasMutationFloor
+      ALWAYS = -1
+      LOOPS = [Prism::WhileNode, Prism::UntilNode, Prism::ForNode, Prism::BlockNode, Prism::LambdaNode].freeze
+      KEEPING_CALLS = (MutationWidening::SHAPE_MUTATORS | SetMutation::MUTATORS |
+                       %i[new add add? send public_send __send__ instance_variable_set instance_exec instance_eval
+                          class_exec module_exec define_method define_singleton_method]).freeze
+      private_constant :ALWAYS, :LOOPS, :KEEPING_CALLS
+
+      module_function
+
+      IMMUTABLE_CLASSES = %w[Integer Float Rational Complex Symbol NilClass TrueClass FalseClass].to_set.freeze
+      private_constant :IMMUTABLE_CLASSES
+
+      # Whether `type` is a container that may hold a mutable element, which a write through an element read (`x =
+      # a[0]; x << 1`) can change: `[[1]]` and `Array[String]` may, `[1, :a]` may not.
+      def mutable_parts?(type)
+        case type
+        when Type::Tuple then type.elements.any? { |element| mutable_value?(element) }
+        when Type::HashShape then type.pairs.values.any? { |value| mutable_value?(value) }
+        when Type::Nominal then type.type_args.any? { |arg| mutable_value?(arg) }
+        when Type::Difference then mutable_parts?(type.base)
+        when Type::Union then type.members.any? { |member| mutable_parts?(member) }
+        else true
+        end
+      end
+
+      def mutable_value?(type)
+        case type
+        when Type::Constant then type.value.is_a?(String) || type.value.is_a?(::Set)
+        when Type::Nominal then !IMMUTABLE_CLASSES.include?(type.class_name)
+        when Type::Union then type.members.any? { |member| mutable_value?(member) }
+        else true
+        end
+      end
+
+      # Each local or ivar read `node` may evaluate to: through the branches of an `if` / `unless` / ternary, `case`,
+      # `case`/`in`, `begin` (its body, rescue and else clauses), `rescue` modifier and `||` / `&&`, the last statement
+      # of a body, and a call that answers its receiver (`a.tap { }`, `a.itself`, `a.freeze`, `a.to_a`); anything else
+      # as {ReceiverAlias.candidates} reads it. A nest deeper than {SELECTION_DEPTH} reads as no local.
+      def each_may_be(node, depth = 0, &)
+        node = RemoverHolderScan.unparenthesised(node)
+        return if node.nil? || depth > SELECTION_DEPTH
+        return each_may_be(node.receiver, depth + 1, &) if self_returning_call?(node)
+
+        branches = selection_branches(node)
+        return ReceiverAlias.candidates(node).each(&) if branches.nil?
+
+        branches.each { |branch| each_may_be(branch, depth + 1, &) }
+      end
+
+      SELECTION_DEPTH = 6
+
+      def self_returning_call?(node) = node.is_a?(Prism::CallNode) && SELF_RETURNERS.include?(node.name)
+
+      # The sub-expressions a selection's value is one of, or nil for a node that selects nothing.
+      def selection_branches(node)
+        case node
+        when Prism::StatementsNode then [node.body.last]
+        when Prism::ParenthesesNode, Prism::ElseNode then [node.respond_to?(:statements) ? node.statements : node.body]
+        when Prism::IfNode then [node.statements, node.subsequent]
+        when Prism::UnlessNode then [node.statements, node.else_clause]
+        when Prism::OrNode, Prism::AndNode then [node.left, node.right]
+        when Prism::CaseNode, Prism::CaseMatchNode
+          node.conditions.map(&:statements) << node.else_clause
+        when Prism::BeginNode then begin_branches(node)
+        when Prism::RescueModifierNode then [node.expression, node.rescue_expression]
+        end
+      end
+
+      def begin_branches(node)
+        branches = [node.statements, node.else_clause]
+        clause = node.rescue_clause
+        while clause
+          branches << clause.statements
+          clause = clause.subsequent
+        end
+        branches
+      end
+
+      def local_name(read) = ReceiverAlias.read_name(read)
+
+      # `[base, depth]` for an element read (`a[i]`, `a.first`, `h.fetch(:k)`, `a.dig(:k, 0)`, a chain of them): what
+      # it reads from and how many levels inside it, `[node, 0]` for anything else.
+      def element_path(node)
+        node = RemoverHolderScan.unparenthesised(node)
+        depth = 0
+        while node.is_a?(Prism::CallNode) && node.receiver && node.block.nil? && ELEMENT_READS.include?(node.name)
+          depth += node.name == :dig ? [node.arguments&.arguments&.size.to_i, 1].max : 1
+          node = RemoverHolderScan.unparenthesised(node.receiver)
+        end
+        [node, depth]
+      end
+
+      # `[root, depth]` for an element read rooted at a local, or nil.
+      def element_root(node)
+        root, depth = element_path(node)
+        [root, depth] if depth.positive? && root.is_a?(Prism::LocalVariableReadNode)
+      end
+
+      # The {RemoverHolderScan} collector, which reads every fact {.scan} needs in that one walk: for each local the
+      # least key of the sites that hand it on ({.handed_by}), the ranges of the closures that may run later, and the
+      # body's foreign and written locals ({ForeignLocals.visit}).
+      class SiteCollector
+        # Non-local reads: a local bound to one, or to an element read rooted at one (`a = @rows[0]`), is held by that
+        # variable. ({ReceiverAlias.candidates} answers a bare ivar read itself.)
+        NON_LOCAL_READS = [Prism::InstanceVariableReadNode, Prism::GlobalVariableReadNode,
+                           Prism::ClassVariableReadNode].to_set.freeze
+        LOCAL_BINDS = [Prism::LocalVariableWriteNode, Prism::LocalVariableOrWriteNode,
+                       Prism::LocalVariableAndWriteNode].to_set.freeze
+
+        attr_writer :site
+        attr_reader :held, :held_part, :links, :deferred, :foreign, :written
+
+        def initialize
+          @held = {}
+          @held_part = {}
+          @links = []
+          @site = nil
+          @outer = nil
+          @outer_owner = nil
+          @deferred = []
+          @foreign = Set.new
+          @written = Set.new
+          @literal_blocks = Set.new.compare_by_identity
+          @def_depth = 0
+        end
+
+        # A local handed on whole: a capture by a closure that may run later, a reflective receiver, a zero-argument
+        # `super`'s parameter.
+        def <<(name)
+          note(@held, name)
+          self
+        end
+
+        # A value position another holder keeps (an element, an argument of a keeping call, an index or attribute
+        # write's value): each local the value may be is handed on, and the root of an element read hands on a part.
+        def value_held(node)
+          AliasMutationFloor.each_may_be(node) do |read|
+            note(@held, AliasMutationFloor.local_name(read)) if local?(read)
+          end
+          root, = AliasMutationFloor.element_root(node)
+          note(@held_part, root.name) if root
+        end
+
+        # A write: a local bound to a value that may be another local's object links the two (`b = a`), an element read
+        # links them as a part (`x = a[i]`), and a local bound to a non-local holder's object is held by that holder
+        # (`a = @q`). A non-local write hands the value on as {#value_held} does.
+        def value_written(node)
+          return if node.is_a?(Prism::LocalVariableOperatorWriteNode)
+          return value_held(node.value) unless LOCAL_BINDS.include?(node.class)
+
+          bind(node.name, node.value)
+        end
+
+        # A multiple assignment or a pattern: each local target is bound as {#value_written} binds one, to each element
+        # of an Array literal value or to the value whole.
+        def value_bound(value, target_nodes)
+          names = []
+          RemoverHolderScan.local_targets(target_nodes, names)
+          return if names.empty?
+
+          values = value.is_a?(Prism::ArrayNode) ? value.elements : [value]
+          names.each { |name| values.each { |part| bind(name, part) } }
+        end
+
+        def enter(node, parent)
+          if @outer.nil? && LOOPS.any? { |klass| node.is_a?(klass) }
+            @outer = node.location.start_offset
+            @outer_owner = node
+          end
+          note_deferred(node, parent)
+          if node.is_a?(Prism::DefNode)
+            @def_depth += 1
+          elsif @def_depth.zero?
+            ForeignLocals.visit(node, @foreign, @written, @literal_blocks)
+          end
+        end
+
+        def leave(node)
+          if node.equal?(@outer_owner)
+            @outer = nil
+            @outer_owner = nil
+          end
+          @def_depth -= 1 if node.is_a?(Prism::DefNode)
+        end
+
+        # Only a call that may keep its argument hands it to another holder: a constructor, an in-place mutator (a
+        # container adder), and a reflective or `define_method` call. Any other call's arguments are passed, not kept.
+        def keeps_arguments?(call_node) = KEEPING_CALLS.include?(call_node.name)
+
+        private
+
+        def local?(read) = read.is_a?(Prism::LocalVariableReadNode) || read.is_a?(Prism::ItLocalVariableReadNode)
+
+        def key = @site ? @outer || AliasMutationFloor.handed_by(@site) : ALWAYS
+
+        def note(table, name)
+          site_key = key
+          current = table[name]
+          table[name] = site_key if current.nil? || site_key < current
+        end
+
+        def bind(name, value)
+          AliasMutationFloor.each_may_be(value) do |read|
+            next unless local?(read)
+
+            other = AliasMutationFloor.local_name(read)
+            @links << [name, other, key, 0] unless other == name
+          end
+          note(@held, name) if NON_LOCAL_READS.include?(AliasMutationFloor.element_path(value).first.class)
+          root, depth = AliasMutationFloor.element_root(value)
+          @links << [name, root.name, key, depth] if root && root.name != name
+          link_elements(name, value)
+        end
+
+        # A container literal's elements are the local's elements (`c = [inner]`): each local an element may be is
+        # linked to it as a part.
+        def link_elements(name, value)
+          value = RemoverHolderScan.unparenthesised(value)
+          elements = value.elements if value.is_a?(Prism::ArrayNode)
+          elements = value.elements.grep(Prism::AssocNode).map(&:value) if value.is_a?(Prism::HashNode)
+          elements&.each do |element|
+            AliasMutationFloor.each_may_be(element) do |read|
+              @links << [AliasMutationFloor.local_name(read), name, key, 1] if local?(read)
+            end
+          end
+        end
+
+        def note_deferred(node, parent)
+          return unless node.is_a?(Prism::LambdaNode) ||
+                        (node.is_a?(Prism::BlockNode) && RemoverHolderScan.deferred_block?(parent))
+
+          start = node.location.start_offset
+          @deferred << [start, start + node.location.length]
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/alias_mutation_floor.rb

@@ -0,0 +1,339 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../typing_state"
+require_relative "../source/node_children"
+require_relative "closure_escape_analyzer"
+require_relative "element_read_widening"
+require_relative "mutation_widening"
+require_relative "receiver_alias"
+require_relative "remover_holder_scan"
+require_relative "set_mutation"
+require_relative "string_mutation"
+require_relative "unknown_store_widening"
+require_relative "alias_mutation_floor/foreign_locals"
+require_relative "alias_mutation_floor/memos"
+require_relative "alias_mutation_floor/site_collector"
+require_relative "alias_mutation_floor/reach"
+
+module Rigor
+  module Inference
+    # Issue #2335 — a local's literal shape describes its object, and a mutation through another path to that object
+    # makes it stale: `y = x; y << "s"`, `a.each { |x| x << "s" }` on an Array holding `inner`, `@a = a; @a << "s"`,
+    # `h[:k] = a; h[:k] << "s"`, `Hash.new(a)[:k] << "s"`, `[acc].each { |a| poke(a) }`. The named-binding widening
+    # ({MutationWidening.widen_after_call}) and the callee floor only rebind the binding a receiver or argument names,
+    # so every other local holding the object kept its literal and a later read reported on correct code.
+    #
+    # One scan per frame body, in {RemoverHolderScan}'s walk ({SiteCollector}), answers:
+    #
+    # - the locals handed whole to another holder: an element of a container literal, an argument of a call that may
+    #   keep it, an ivar, global, index or attribute write's value, a capture by a closure that may run later, a
+    #   reflective receiver, a local bound to an ivar, global or class variable (`a = @q`); every local under
+    #   `binding` / `eval`. A value counts only where it may evaluate to the local itself ({.each_may_be}: the local,
+    #   a selection of it, a call that answers its receiver), so `n = a.size`, `b = a.dup` and `[a.first]` hand
+    #   nothing on whole;
+    # - the locals one of whose elements is handed on (`[a.first]`), and the links between locals: a copy (`b = a`)
+    #   and an element read (`x = a[i]`);
+    # - the *foreign* locals, whose object may have come from elsewhere ({ForeignLocals}).
+    #
+    # A local is *aliased* at a call once a site that hands it on may have run before the call's message (a site
+    # earlier in the body, or one inside a loop or block that also holds the call; a capture by a closure that may run
+    # later counts everywhere, and a call inside such a closure sees every site), or it is linked to such a local. A
+    # local reached only through an element link is a *part*, floored only when its binding can hold a mutable
+    # element ({.mutable_parts?}).
+    #
+    # A mutating call whose receiver may be another local's object ({.targets}: the locals linked to the receiver, and
+    # the aliased ones when the receiver may hold any object) gives each local it may reach the
+    # unknown store {UnknownStoreWidening.widen_store} gives a site whose stored values nothing typed: the same
+    # widening the named path applies, fed `Dynamic[top]` arguments, with its gradual arm. A callee that writes such
+    # an argument, and a call on one to a method that mutates its instance variables, floor them the same way. The
+    # bindings the receiver itself names are left to the named path, so its precise answer stands.
+    #
+    # A body where no local is handed on, and a receiver only ever written a new object that is not aliased, change
+    # nothing.
+    module AliasMutationFloor
+      # `held` maps each local handed to another holder to the least key of those sites ({.handed_by}), or is {ALL};
+      # `held_part` does the same for a local an element of which was handed on (`[a.first]`); `links` lists
+      # `[child, parent, key, levels]` for each write that binds a local to another local's object (`b = a`, 0 levels)
+      # or to an element of it (`x = a[i]`, 1; `x = a[i][j]`, 2; `c = [x]` links `x` as `c`'s element). `deferred`
+      # lists the `[start, end)` ranges of the closures that may run later. `memo` and `named_memo` keep each call's and
+      # each read's targets for the run: a loop or block body is evaluated more than once.
+      Facts = Data.define(:held, :held_part, :links, :foreign, :entry, :deferred, :memo, :named_memo)
+      # Depths ({.reach}): the mutated object is the local's object itself, or one of its elements.
+      FULL = 0
+      PART = 1
+      NO_KEYS = {}.freeze
+      NO_LINKS = [].freeze
+      # Calls whose result is their receiver (or, for `to_a` / `to_h` / `to_s`, may be on one core class), as
+      # {CalleeWriteCensus} reads them.
+      SELF_RETURNERS = %i[tap itself freeze to_a to_h to_s].to_set.freeze
+
+      ALL = :all
+      NUMBERED_PARAMETER = /\A_[1-9]\z/
+      SEND_NAMES = %i[send public_send __send__].to_set.freeze
+      ELEMENT_READS = %i[[] first last fetch dig].to_set.freeze
+      private_constant :FULL, :PART, :NO_KEYS, :NO_LINKS, :SELF_RETURNERS, :ALL, :NUMBERED_PARAMETER,
+                       :SEND_NAMES, :ELEMENT_READS
+      private_constant :Memos
+
+      module_function
+
+      # `scope` after `call_node`, a shape mutator ({.candidate?}), ran on a receiver that may be another local's
+      # object. The block answers the locals the receiver itself names, whose own widening (the named path's)
+      # stands; it runs only once the call has targets.
+      def floor_after_call(call_node, scope)
+        return scope unless local_besides?(scope, nil) { |type| UnknownStoreWidening.callee_floorable?(type) }
+
+        facts = facts_for(scope)
+        return scope if facts.nil?
+
+        targets = call_targets(facts, call_node) { receiver_targets(call_node.receiver, facts, call_node) }
+        return scope if targets.empty?
+
+        whole = !targets.equal?(ALL)
+        floor_targets(scope, targets, yield) do |type, kind|
+          unknown_store(call_node, type, removed_keys: whole && kind == FULL)
+        end
+      end
+
+      # Whether `call_node` is a shape mutator on an explicit receiver, the only call {.floor_after_call} floors after.
+      def candidate?(call_node)
+        !call_node.receiver.nil? && MutationWidening::SHAPE_MUTATORS.include?(call_node.name)
+      end
+
+      # `scope` after `call_node` wrote the object the local `read` reads (a callee that writes its argument or mutates
+      # the ivars of an object holding it): every local that may be that object and holds a literal shape
+      # ({.literal_shape?}) takes one unknown store ({UnknownStoreWidening.callee_block_floor}). A method parameter the
+      # body never rebinds floors nothing here: the callee census reads every opaque hand-off as a write, and flooring
+      # each local a parameter was copied into at every such call cost precision across the corpus for no finding (a
+      # known limit of #2335).
+      def floor_after_written_local(scope, read, call_node)
+        name = read.name
+        return scope unless local_besides?(scope, name) { |type| literal_shape?(type) }
+
+        facts = facts_for(scope)
+        return scope if facts.nil?
+        return scope if facts.entry.include?(name)
+
+        targets = read_targets(facts, read) { targets(name, facts, aliased_at(facts, call_node), call_node) }
+        return scope if targets.empty?
+
+        floor_targets(scope, targets, name) { |type| callee_floor(type) }
+      end
+
+      # `type` after `call_node`'s unknown store ({UnknownStoreWidening.widen_store}), memoised per call site for the
+      # run as {.callee_floor} is.
+      def unknown_store(call_node, type, removed_keys:)
+        Memos.unknown_store(call_node, removed_keys, type) do
+          method_name, arg_types = UnknownStoreWidening.unknown_store(call_node)
+          (removed_keys && removed_keys_shape(type, method_name)) ||
+            UnknownStoreWidening.widen_store(type, method_name, arg_types)
+        end
+      end
+
+      # A `HashShape` under a remover (`delete`, `clear`, `reject!`, ...) through another holder: the same shape with
+      # every key optional. Nothing is stored, so every value stands, and a read of a key the remover may have taken
+      # still answers its `nil` (`g = h; g.delete(k); h[k].upcase` raises in Ruby), which the nominal `Hash` the unknown
+      # store widens to would not. Only for a target that may be the mutated object itself, and not under `binding` /
+      # `eval`: a remover on an element (`x = h[:k]; x.delete(:a)`) must not mark `h`'s own keys optional and leave the
+      # element's removed key required. Nil for anything else.
+      def removed_keys_shape(type, method_name)
+        return nil unless type.is_a?(Type::HashShape) && UnknownStoreWidening::VALUE_PRESERVING.include?(method_name)
+
+        Type::HashShape.new(type.pairs, required_keys: [], optional_keys: type.pairs.keys,
+                                        read_only_keys: type.read_only_keys, extra_keys: type.extra_keys)
+      end
+
+      # {UnknownStoreWidening.callee_block_floor} of a literal shape, nil for anything else, memoised for the run: the
+      # same shape is floored again on each pass over a loop or block body and by each callee channel.
+      def callee_floor(type)
+        return nil unless literal_shape?(type)
+
+        Memos.callee_floor(type) { UnknownStoreWidening.callee_block_floor(type) }
+      end
+
+      # Whether {.floor_after_written_local} may floor anything for the local `read` reads at `call_node`: a target
+      # bound to a literal shape.
+      def reaches_other_locals?(scope, read, call_node)
+        name = read.name
+        return false unless local_besides?(scope, name) { |type| literal_shape?(type) }
+
+        facts = facts_for(scope)
+        return false if facts.nil? || facts.entry.include?(name)
+
+        targets = read_targets(facts, read) { targets(name, facts, aliased_at(facts, call_node), call_node) }
+        return local_besides?(scope, name) { |type| literal_shape?(type) } if targets.equal?(ALL)
+
+        targets.any? do |target, kind|
+          type = scope.local(target)
+          target != name && literal_shape?(type) && (kind == FULL || mutable_parts?(type))
+        end
+      end
+
+      # Whether a call that may mutate a holder's object through `self` ({.floor_after_holder_call}) reaches an aliased
+      # local holding a literal shape.
+      def holder_call_reaches?(scope, call_node)
+        return false unless local_besides?(scope, nil) { |type| literal_shape?(type) }
+
+        facts = facts_for(scope)
+        return false if facts.nil?
+
+        targets = holder_targets(facts, call_node)
+        return true if targets.equal?(ALL)
+
+        targets.any? do |target, kind|
+          type = scope.local(target)
+          literal_shape?(type) && (kind == FULL || mutable_parts?(type))
+        end
+      end
+
+      # `scope` after a call on `self` whose method mutates one of its ivars: every aliased local holding a literal
+      # shape takes one unknown store, as {.floor_after_written_local} gives it.
+      def floor_after_holder_call(scope, call_node)
+        facts = facts_for(scope)
+        return scope if facts.nil?
+
+        floor_targets(scope, holder_targets(facts, call_node), nil) { |type| callee_floor(type) }
+      end
+
+      def holder_targets(facts, call_node)
+        call_targets(facts, call_node) { targets(nil, facts, aliased_at(facts, call_node), call_node) }
+      end
+
+      # A literal shape a store can make stale: a `Tuple`, a `HashShape`, a literal String or Set, or an empty-witness
+      # refinement, alone or in a union. The callee paths floor only these: a nominal `Array[String]` is a claim the
+      # named path's unknown store leaves as it is too.
+      def literal_shape?(type)
+        case type
+        when Type::Tuple, Type::HashShape then true
+        when Type::Constant then StringMutation.constant?(type) || SetMutation.constant?(type)
+        when Type::Difference then type.removes_empty_witness?
+        when Type::Union then type.members.any? { |member| literal_shape?(member) }
+        else false
+        end
+      end
+
+      # Whether the body of `def_node` runs a shape mutator on one of its own instance variables or an element of one
+      # (`@items << v`, `@h[k] = v`, `@rows[0] << v`): a call to it on an object that holds another local's object
+      # (`box = Box.new(a)`, whose `initialize` keeps `@items = a`) may mutate that object. A nested def is not entered.
+      def mutates_ivar?(def_node)
+        return false if def_node.nil?
+
+        Memos.ivar_mutator(def_node) { ivar_mutation?(def_node.body) }
+      end
+
+      def ivar_mutation?(node)
+        return false if node.nil? || node.is_a?(Prism::DefNode)
+        return true if node.is_a?(Prism::CallNode) && MutationWidening::SHAPE_MUTATORS.include?(node.name) &&
+                       ivar_rooted?(node.receiver)
+
+        node.rigor_each_child { |child| return true if ivar_mutation?(child) }
+        false
+      end
+
+      def ivar_rooted?(receiver)
+        receiver = RemoverHolderScan.unparenthesised(receiver)
+        receiver = receiver.receiver while receiver.is_a?(Prism::CallNode) && ELEMENT_READS.include?(receiver.name)
+        receiver.is_a?(Prism::InstanceVariableReadNode)
+      end
+
+      # A `send` / `public_send` / `__send__` with a literal Symbol or String name as the call it makes (`a.send(:push,
+      # x)` and `a.send("push", x)` are `a.push(x)`), or nil. A name that is no valid string names no method.
+      def literal_send_target(call_node)
+        return nil unless SEND_NAMES.include?(call_node.name) && call_node.block.nil?
+
+        arguments = call_node.arguments&.arguments
+        target = arguments&.first
+        return nil unless target.is_a?(Prism::SymbolNode) || target.is_a?(Prism::StringNode)
+        return nil unless target.unescaped.valid_encoding?
+
+        rest = arguments.drop(1)
+        call_node.copy(name: target.unescaped.to_sym,
+                       arguments: rest.empty? ? nil : call_node.arguments.copy(arguments: rest))
+      end
+
+      def facts_for(scope)
+        frame = scope.match_frame
+        body = frame&.body
+        return nil if body.nil?
+
+        facts = Memos.facts(body) { scan(body, frame.parameters) }
+        facts.held.empty? && facts.held_part.empty? && facts.links.empty? ? nil : facts
+      end
+
+      # One walk ({SiteCollector}) answers the facts. A body that calls `binding` or `eval` stops it early: every local
+      # is aliased, and the foreign locals are read in a walk of their own.
+      def scan(body, parameters)
+        collector = SiteCollector.new
+        result = RemoverHolderScan.unsafe_names(body, parameters, collector)
+        if result.equal?(ALL)
+          foreign, entry = ForeignLocals.collect(body, parameters)
+          return Facts.new(held: ALL, held_part: NO_KEYS, links: NO_LINKS, foreign:, entry:, deferred: NO_LINKS,
+                           memo: {}.compare_by_identity, named_memo: {}.compare_by_identity)
+        end
+
+        foreign, entry = ForeignLocals.finish(parameters, collector.foreign, collector.written)
+        Facts.new(held: collector.held.freeze, held_part: collector.held_part.freeze, links: collector.links.freeze,
+                  foreign:, entry:, deferred: collector.deferred.freeze,
+                  memo: {}.compare_by_identity, named_memo: {}.compare_by_identity)
+      end
+
+      # A site's key ({SiteCollector}) is the start of the outermost loop or block that holds it (it may run again after
+      # any later point inside that loop), else where it has handed its locals on: its end (the receiver of a call has
+      # handed its locals on before the call's message runs, while the call's own arguments are handed on by the call
+      # itself), or its block's start. A local's key is its least site's; a capture by a closure that may run later is
+      # {ALWAYS}.
+      # Where a site has handed its locals on: a call's block may receive them as soon as it starts.
+      def handed_by(node)
+        block = node.block if node.is_a?(Prism::CallNode)
+        block.is_a?(Prism::BlockNode) ? block.location.start_offset : node.location.end_offset
+      end
+
+      # The targets of `call_node` through its receiver, computed once per call site.
+      def call_targets(facts, call_node)
+        facts.memo.fetch(call_node) { facts.memo[call_node] = yield }
+      end
+
+      # The targets of a write through the local `read` reads (a written argument, a receiver), computed once per read.
+      # The read is the call's own operand, so its call's offset is fixed with it.
+      def read_targets(facts, read)
+        facts.named_memo.fetch(read) { facts.named_memo[read] = yield }
+      end
+
+      # Whether `scope` binds a local other than `except` (a name, a list of names, or nil) whose type the block
+      # accepts: the cheap gate every trigger asks before the body scan, since a floor changes only such a binding.
+      def local_besides?(scope, except)
+        scope.locals.each { |name, type| return true if !excepted?(except, name) && yield(type) }
+        false
+      end
+
+      def excepted?(except, name)
+        except.is_a?(Symbol) ? except == name : except&.include?(name)
+      end
+
+      def each_target(scope, targets, &)
+        return scope.locals.each_key { |name| yield name, FULL } if targets.equal?(ALL)
+
+        targets.each(&)
+      end
+
+      # Each target but `except` takes what the block answers for its binding and the depth it was reached at. A target
+      # reached only below its own object (a depth past {FULL}) is floored only when its binding can hold a mutable
+      # element.
+      def floor_targets(scope, targets, except)
+        acc = scope
+        each_target(scope, targets) do |name, kind|
+          next if excepted?(except, name)
+
+          current = acc.local(name)
+          next if current.nil? || (kind > FULL && !mutable_parts?(current))
+
+          floored = yield(current, kind)
+          acc = acc.with_mutated_local(name, floored) unless floored.nil? || floored == current
+        end
+        acc
+      end
+    end
+  end
+end

data/lib/rigor/inference/anonymous_meta_class.rb

@@ -62,11 +62,29 @@ module Rigor
         receiver_name = block_form_receiver(node)
         return nil if receiver_name.nil?
 
+        named = struct_class_name(node) if receiver_name == :Struct
+        return named if named
+
         location = node.location
         key = [source_path, location.start_line, location.start_column].compact.join(":")
         Type::AnonymousClassName.build(receiver_name, key)
       end
 
+      # Issue #2968 — `Struct.new("Named", :a)` names its class `Struct::Named`: a leading String argument that spells a
+      # constant (Ruby raises `NameError` for any other) is the class's name under `Struct`, so a block body is that
+      # class's and a reopening `class Struct::Named` in another file meets the same table entry. Nil for any other
+      # first argument. `node` is a `Struct.new` call.
+      def struct_class_name(node)
+        first = node.arguments&.arguments&.first
+        return nil unless first.is_a?(Prism::StringNode)
+
+        name = first.unescaped
+        "Struct::#{name}" if name.match?(STRUCT_CLASS_NAME)
+      end
+
+      STRUCT_CLASS_NAME = /\A[A-Z][A-Za-z0-9_]*\z/
+      private_constant :STRUCT_CLASS_NAME
+
       # The bare-constant receiver's name (`Class`, `::Class`), or nil for every other receiver shape.
       def literal_constant_name(node)
         case node

data/lib/rigor/inference/block_auto_splat.rb

@@ -194,7 +194,7 @@ module Rigor
         softened = []
         joined = Array.new(tables.map(&:size).max) do |i|
           column = tables.map { |table| table[i] }
-          next Type::Combinator.untyped if column.any? { |t| t.nil? || t == Type::Combinator.untyped }
+          next Type::Combinator.untyped if column.any? { |t| t.nil? || Type::Combinator.untyped?(t) }
 
           firm = column.reject { |t| nil_literal?(t) }
           next Type::Combinator.union(*column) if firm.empty? || firm.size == column.size

data/lib/rigor/inference/block_parameter_binder.rb

@@ -211,9 +211,8 @@ module Rigor
         cursor
       end
 
-      # `|*rest|` binds an Array of the leftover positional arguments. The expected-types array is
-      # per-position, not per-rest; we cannot reliably pick a single element type for rest, so we default to
-      # `Array[Dynamic[Top]]`. Element-type precision for rest parameters is deferred (demand-gated).
+      # `|*rest|` binds an Array of the leftover positional arguments: `Array[Dynamic[Top]]`, unless an
+      # auto-splat answered a rest type ({BlockAutoSplat}). The expected types are per-position, not per-rest.
       def bind_rest(params_node, bindings)
         rest = params_node.rest
         return unless rest.respond_to?(:name) && rest&.name