rigortype 0.1.18 → 0.2.0

data/lib/rigor/inference/acceptance.rb

@@ -249,6 +249,12 @@ module Rigor
             # anonymous local-bound form projects to `Data` itself).
             accepts(self_type, project_data_instance_to_nominal(other_type), mode: mode)
               .with_reason("projected DataInstance to Nominal[#{other_type.class_name || 'Data'}]")
+          when Type::StructInstance
+            # ADR-48 Struct follow-up: same projection as DataInstance — a
+            # class-tagged Struct value is exactly one value of its tagging
+            # class (the anonymous form projects to `Struct` itself).
+            accepts(self_type, project_struct_instance_to_nominal(other_type), mode: mode)
+              .with_reason("projected StructInstance to Nominal[#{other_type.class_name || 'Struct'}]")
           when Type::Difference, Type::Refined
             # A refinement carrier's value set is a subset of its
             # base. So if `self` (Nominal) accepts the base, it
@@ -386,6 +392,10 @@ module Rigor
           Type::Combinator.nominal_of(instance.class_name || "Data")
         end
 
+        def project_struct_instance_to_nominal(instance)
+          Type::Combinator.nominal_of(instance.class_name || "Struct")
+        end
+
         def project_hash_shape_to_nominal(shape)
           return Type::Combinator.nominal_of(Hash) if shape.pairs.empty?
 
@@ -822,15 +832,13 @@ module Rigor
           Type::AcceptsResult.no(mode: mode, reasons: reason)
         end
 
-        # Slice 4 phase 2c uses Ruby's actual class hierarchy to answer
-        # "is D a subclass of C?". This works for any class loadable
-        # through Object.const_get -- core, stdlib, and live application
-        # classes. When either name fails to resolve we surface "maybe":
-        # the caller (overload selector) treats yes/maybe identically,
-        # so the conservative answer keeps overload coverage intact.
-        # Slice 5 will replace this with an RBS-driven hierarchy lookup
-        # so ahead-of-time type checking no longer relies on Ruby
-        # loading the application classes.
+        # Uses Ruby's actual class hierarchy via Object.const_get to answer
+        # "is D a subclass of C?" for core, stdlib, and application classes.
+        # When either name fails to resolve we surface "maybe": the caller
+        # (overload selector) treats yes/maybe identically, so the conservative
+        # answer keeps overload coverage intact. RbsHierarchy exists but this
+        # path does not yet consult it; migration to an RBS-driven lookup
+        # is deferred.
         def class_subtype_result(target_name:, actual_name:, mode:, kind:)
           return Type::AcceptsResult.yes(mode: mode, reasons: "exact name match") if target_name == actual_name
 

data/lib/rigor/inference/block_parameter_binder.rb

@@ -183,9 +183,8 @@ module Rigor
       # `|*rest|` binds an Array of the leftover positional arguments.
       # The expected-types array is per-position, not per-rest; we
       # cannot reliably pick a single element type for rest, so we
-      # default to `Array[Dynamic[Top]]`. Slice C sub-phase 2 may
-      # tighten this when the receiving method's RBS rest type is
-      # available.
+      # default to `Array[Dynamic[Top]]`. Element-type precision for
+      # rest parameters is deferred (demand-gated).
       def bind_rest(params_node, bindings)
         rest = params_node.rest
         return unless rest.respond_to?(:name) && rest&.name

data/lib/rigor/inference/body_fixpoint.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require_relative "../type"
+require_relative "budget_trace"
+
+module Rigor
+  module Inference
+    # ADR-56 WD3 — the single capped-fixpoint mechanism shared by the
+    # non-escaping block captured-local write-back (slice A) and the
+    # loop-body fixpoint (slice B). Computes the continuation binding of a
+    # set of locals that a body (a block body or a loop body) may rebind
+    # across an unknown number (0..N) of iterations.
+    #
+    # The body may run zero times, so the seed (pre-state) binding is kept
+    # as a join constituent throughout; it may compound (`a = [a]`), so the
+    # join is iterated to a fixed point under a hard cap (ADR-41 WD4). On
+    # the final permitted iteration value-pinned constituents are widened to
+    # their nominal base to force convergence; a local that still moves is
+    # collapsed to `Dynamic[top]` — the established escaping-block floor —
+    # and a {BudgetTrace::BLOCK_WRITEBACK_CAP} hit is recorded.
+    #
+    # The mechanism is parameterized over an `evaluate_body` callable so
+    # slice B can reuse it: given the current per-name bindings it returns
+    # the per-name exit bindings produced by one body evaluation from those
+    # bindings (names the body leaves unwritten in a given pass simply do
+    # not appear in the returned hash).
+    module BodyFixpoint
+      # One body evaluation per iteration; ADR-55's shape (cap 3).
+      CAP = 3
+
+      module_function
+
+      # @param names [Array<Symbol>] the outer locals the body can rebind.
+      # @param seed_bindings [Hash{Symbol=>Type}] pre-state binding per name.
+      # @param widen [#call] value-pinned widener (Constant -> Nominal).
+      # @param evaluate_body [#call] `bindings -> exit_bindings` — evaluates
+      #   the body once from `bindings` (the per-name current assumption) and
+      #   returns the per-name exit binding it produced.
+      # @return [Hash{Symbol=>Type}] the continuation binding per name.
+      def converge(names:, seed_bindings:, widen:, evaluate_body:)
+        return {} if names.empty?
+
+        # Running assumption per name; seeded with the pre-state binding,
+        # which stays a join constituent throughout (0-iteration soundness).
+        assumption = seed_bindings.dup
+
+        (0...CAP).each do |iteration|
+          last_iteration = iteration == CAP - 1
+          exit_bindings = evaluate_body.call(assumption)
+
+          stable = true
+          names.each do |name|
+            exit_type = exit_bindings[name]
+            next if exit_type.nil? # body did not write it this pass
+
+            if last_iteration
+              # On the final permitted iteration widen BOTH the running
+              # assumption and the fresh exit type to their nominal bases
+              # before joining: Rigor's `union` keeps `Constant[1]` and
+              # `Nominal[Integer]` as distinct members, so an accumulator
+              # (`+=`/`*=`) producing a fresh constant per pass would never
+              # converge without collapsing both sides first. If the join
+              # is still wider than the widened assumption (structural
+              # compounding, `a = [a]`), the local floors to `Dynamic[top]`.
+              base = widen.call(assumption[name])
+              joined = Type::Combinator.union(base, widen.call(exit_type))
+              if joined == base
+                assumption[name] = joined
+              else
+                BudgetTrace.hit(BudgetTrace::BLOCK_WRITEBACK_CAP)
+                assumption[name] = Type::Combinator.untyped
+              end
+            else
+              joined = Type::Combinator.union(assumption[name], exit_type)
+              next if joined == assumption[name]
+
+              stable = false
+              assumption[name] = joined
+            end
+          end
+
+          break if stable
+        end
+
+        assumption
+      end
+    end
+  end
+end

data/lib/rigor/inference/budget_trace.rb

@@ -20,6 +20,12 @@ module Rigor
     #   hit the 100-node BFS cap and gave up resolving the self-call.
     # - {HKT_FUEL_EXHAUSTED} — `HktReducer` ran out of its reduction
     #   fuel budget and unwound to `app.bound`.
+    # - {RECURSION_UNROLL_FUEL} — the constant-arg recursion unroll
+    #   (ADR-55 slice 1) exhausted its per-entry fuel and fell back to
+    #   the plain `(receiver, method)` guard (in-cycle call → `Dynamic[top]`).
+    # - {RECURSION_FIXPOINT_CAP} — the fixpoint return-summary iteration
+    #   (ADR-55 slice 2) hit its 3-evaluation cap without converging and
+    #   collapsed the summary to `untyped` (today's behaviour).
     #
     # Enabled only when `RIGOR_BUDGET_TRACE` is set (to any non-empty
     # value) in the environment, or via {enable!} in tests. When
@@ -34,8 +40,29 @@ module Rigor
       RECURSION_GUARD = :recursion_guard
       ANCESTOR_WALK_LIMIT = :ancestor_walk_limit
       HKT_FUEL_EXHAUSTED = :hkt_fuel_exhausted
-
-      CATEGORIES = [RECURSION_GUARD, ANCESTOR_WALK_LIMIT, HKT_FUEL_EXHAUSTED].freeze
+      # `ExpressionTyper#infer_user_method_return` exhausted its
+      # constant-arg unroll fuel (ADR-55 slice 1) and fell back to the
+      # plain `(receiver, method)` recursion guard — i.e. the in-cycle
+      # call widened to `Dynamic[top]` exactly as it does without the
+      # unroll.
+      RECURSION_UNROLL_FUEL = :recursion_unroll_fuel
+      # `ExpressionTyper#infer_user_method_return` ran the fixpoint
+      # return-summary iteration (ADR-55 slice 2) to its 3-evaluation cap
+      # without reaching convergence and collapsed the summary to
+      # `untyped` — the in-cycle result widens to `Dynamic[top]` exactly
+      # as it does without the fixpoint.
+      RECURSION_FIXPOINT_CAP = :recursion_fixpoint_cap
+      # `BodyFixpoint#converge` (ADR-56 slice A — non-escaping block
+      # captured-local write-back) ran its 3-evaluation cap without the
+      # written local's join converging and collapsed that local to
+      # `Dynamic[top]` (the escaping-block floor). Shared by slice B's
+      # loop-body fixpoint.
+      BLOCK_WRITEBACK_CAP = :block_writeback_cap
+
+      CATEGORIES = [
+        RECURSION_GUARD, ANCESTOR_WALK_LIMIT, HKT_FUEL_EXHAUSTED, RECURSION_UNROLL_FUEL,
+        RECURSION_FIXPOINT_CAP, BLOCK_WRITEBACK_CAP
+      ].freeze
 
       # Distribution (histogram) categories — read-only observations of
       # a value's size at a site, used to choose budget defaults from an

data/lib/rigor/inference/builtins/comparable_catalog.rb

@@ -11,8 +11,8 @@ module Rigor
       # catalog is NOT routed through
       # `MethodDispatcher::ConstantFolding::CATALOG_BY_CLASS`
       # (which dispatches on the receiver's concrete class).
-      # The data is consumed by future include-aware lookup —
-      # see `docs/CURRENT_WORK.md` for the planned slice.
+      # The data is wired into `MODULE_CATALOGS` in
+      # `MethodDispatcher::ConstantFolding` (ancestor-chain lookup).
       COMPARABLE_CATALOG = MethodCatalog.for_topic(
         "comparable",
         mutating_selectors: {

data/lib/rigor/inference/builtins/enumerable_catalog.rb

@@ -11,8 +11,8 @@ module Rigor
       # catalog is NOT routed through
       # `MethodDispatcher::ConstantFolding::CATALOG_BY_CLASS`
       # (which dispatches on the receiver's concrete class).
-      # The data is consumed by future include-aware lookup —
-      # see `docs/CURRENT_WORK.md` for the planned slice.
+      # The data is wired into `MODULE_CATALOGS` in
+      # `MethodDispatcher::ConstantFolding` (ancestor-chain lookup).
       ENUMERABLE_CATALOG = MethodCatalog.for_topic(
         "enumerable",
         mutating_selectors: {

data/lib/rigor/inference/builtins/method_catalog.rb

@@ -27,6 +27,24 @@ module Rigor
         FOLDABLE_PURITIES = Set["leaf", "trivial", "leaf_when_numeric"].freeze
         EMPTY_CATALOG = { "classes" => {} }.freeze
 
+        # Selectors that are classified `:leaf` by the C-body analysis
+        # (they read no global mutable state in the C sense) but whose
+        # result is NOT reproducible across Ruby processes, so they must
+        # never be folded into a `Constant`:
+        #
+        # - `hash` — every core `#hash` (`String`/`Symbol`/`Integer`/
+        #   `Float`/…) is salted with a per-process SipHash seed, so
+        #   `"x".hash` differs in every process. Folding bakes one
+        #   process's value into the type and the on-disk cache.
+        # - `object_id` / `__id__` — identity-allocated per process.
+        #
+        # This is a UNIVERSAL block (across every catalogued class)
+        # because `hash` / `object_id` are `Object`-level and present on
+        # every receiver; a per-class blocklist would silently miss a
+        # class. The deterministic siblings (`inspect`, `to_s`) are
+        # unaffected.
+        NON_REPRODUCIBLE_SELECTORS = Set[:hash, :object_id, :__id__].freeze
+
         # Shared root for the offline-generated catalogues. Resolving it
         # here keeps the repo-relative `../../../../` hop in one place
         # instead of copying it into every per-topic loader.
@@ -59,6 +77,7 @@ module Rigor
 
         def safe_for_folding?(class_name, selector, kind: :instance)
           class_name_str = class_name.to_s
+          return false if NON_REPRODUCIBLE_SELECTORS.include?(selector.to_sym)
           return false if blocked?(class_name_str, selector)
 
           entry = method_entry(class_name_str, selector, kind: kind)

data/lib/rigor/inference/builtins/string_catalog.rb

@@ -22,7 +22,15 @@ module Rigor
             :replace, :initialize, :initialize_copy, :clear, :<<, :concat, :insert,
             :prepend, :force_encoding, :encode, :scrub, :unicode_normalize, :"[]=",
             :upto, :each_byte, :each_char, :each_codepoint,
-            :each_grapheme_cluster, :each_line, :bytesplice
+            :each_grapheme_cluster, :each_line, :bytesplice,
+            # `crypt` is not a mutator but is blocked from folding for the
+            # same "do not bake a non-pure result into a Constant" reason:
+            # `rb_str_crypt` delegates to the platform `crypt(3)`, whose
+            # output (algorithm and digest) varies by libc / OS, so
+            # `"x".crypt("ab")` is not deterministic across the platforms
+            # an analyzed project may target. The catalog classifies it
+            # `:leaf` from its C body; this entry overrides that.
+            :crypt
           ],
           "Symbol" => Set[
             # Symbol is immutable in Ruby; the classifier mis-flags