rigortype 0.1.18 → 0.2.0

data/lib/rigor/inference/method_dispatcher.rb

@@ -12,9 +12,12 @@ require_relative "method_dispatcher/constant_folding"
 require_relative "method_dispatcher/literal_string_folding"
 require_relative "method_dispatcher/shape_dispatch"
 require_relative "method_dispatcher/data_folding"
+require_relative "method_dispatcher/struct_folding"
 require_relative "method_dispatcher/rbs_dispatch"
 require_relative "method_dispatcher/iterator_dispatch"
+require_relative "method_dispatcher/reduce_folding"
 require_relative "method_dispatcher/block_folding"
+require_relative "method_dispatcher/array_to_h_folding"
 require_relative "method_dispatcher/file_folding"
 require_relative "method_dispatcher/shellwords_folding"
 require_relative "method_dispatcher/math_folding"
@@ -36,28 +39,15 @@ module Rigor
     # callers (today only `ExpressionTyper`) own the fail-soft fallback
     # and decide whether to record a `FallbackTracer` event.
     #
-    # Tiers (in order):
+    # Tier order is documented inline in `resolve`; the precise-tier
+    # group is built from `PRECISE_TIERS_HEAD`, `STDLIB_SINGLETON_FOLDERS`,
+    # and `PRECISE_TIERS_TAIL`. `ShapeDispatch` runs above {RbsDispatch}
+    # so a precise per-position/per-key answer wins over the projected
+    # `Array#[]`/`Hash#fetch` RBS answer.
     #
-    # 1. {ConstantFolding}: executes the Ruby operation directly when
-    #    the receiver and argument are `Constant` carriers and the
-    #    method is on the curated whitelist. Slice 2.
-    # 2. {ShapeDispatch}: returns the precise element/value type for a
-    #    curated catalogue of `Tuple`/`HashShape` element-access
-    #    methods (`first`, `last`, `[]` with a static integer/key,
-    #    `fetch`, `dig`, `size`/`length`/`count`). Slice 5 phase 2.
-    # 3. {RbsDispatch}: looks up the receiver's class in the RBS
-    #    environment carried by the scope and translates the method's
-    #    return type into a Rigor::Type. Slice 4.
-    #
-    # `ShapeDispatch` deliberately runs *above* {RbsDispatch} so the
-    # precise per-position/per-key answer wins over the projected
-    # `Array#[]`/`Hash#fetch` answer; it falls through (`nil`) when
-    # the call cannot be proved against the static shape, in which
-    # case the projection answer from {RbsDispatch} applies.
-    #
-    # The dispatcher's public signature reserves space for `block_type:`
-    # and ADR-2 plugin extensions (later slices), so call sites added
-    # now do not have to be rewritten when those tiers arrive.
+    # The `block_type:` and plugin contribution (`dynamic_return`) tiers
+    # landed in Slice 6 phase C and v0.1.1 Track 2 respectively; all
+    # call sites pass through `dispatch`/`resolve` unchanged.
     module MethodDispatcher # rubocop:disable Metrics/ModuleLength
       module_function
 
@@ -274,7 +264,14 @@ module Rigor
         class_name, kind = discovered_method_lookup(receiver_type)
         return nil if class_name.nil?
         return nil unless scope.discovered_method?(class_name, method_name, kind)
+        # Decline when a re-typable body is recorded for the method, so the
+        # downstream `ExpressionTyper` inference tier can fold a precise
+        # return instead of collapsing to `Dynamic[top]` here — instance
+        # bodies via `user_def_for`, singleton bodies (`def self.x` /
+        # `module_function`) via `singleton_def_for` (module-singleton
+        # call resolution, ADR-57 follow-up).
         return nil if kind == :instance && scope.user_def_for(class_name, method_name)
+        return nil if kind == :singleton && scope.singleton_def_for(class_name, method_name)
 
         Type::Combinator.untyped
       end
@@ -317,19 +314,6 @@ module Rigor
         Type::Combinator.untyped
       end
 
-      # ADR-2 § "Flow Contribution Bundle" / v0.1.1 Track 2
-      # slice 7; ADR-52 WD3 — consults each loaded plugin's gated
-      # `dynamic_return` rules, wraps the contributed types as
-      # `FlowContribution` bundles, merges them through
-      # `FlowContribution::Merger`, and returns the merged
-      # `return_type` slot (or nil when no plugin contributed a
-      # return type).
-      #
-      # Plugins whose hook raises have their contribution
-      # silently dropped for this call so the dispatch chain
-      # keeps moving — the run-level diagnostic envelope (per
-      # ADR-2 § "Plugin Trust and I/O Policy") is owned by
-      # `Analysis::Runner#plugin_emitted_diagnostics`.
       # ADR-20 slice 3 — looks up the receiver / method pair
       # in {Rigor::Builtins::HktBuiltins::METHOD_RETURN_OVERRIDES}
       # and returns the reduced HKT type. Only fires when the
@@ -404,6 +388,19 @@ module Rigor
         end
       end
 
+      # ADR-2 § "Flow Contribution Bundle" / v0.1.1 Track 2
+      # slice 7; ADR-52 WD3 — consults each loaded plugin's gated
+      # `dynamic_return` rules, wraps the contributed types as
+      # `FlowContribution` bundles, merges them through
+      # `FlowContribution::Merger`, and returns the merged
+      # `return_type` slot (or nil when no plugin contributed a
+      # return type).
+      #
+      # Plugins whose hook raises have their contribution
+      # silently dropped for this call so the dispatch chain
+      # keeps moving — the run-level diagnostic envelope (per
+      # ADR-2 § "Plugin Trust and I/O Policy") is owned by
+      # `Analysis::Runner#plugin_emitted_diagnostics`.
       def try_plugin_contribution(call_node, scope, receiver_type)
         return nil if call_node.nil? || scope.nil?
 
@@ -416,16 +413,6 @@ module Rigor
         FlowContribution::Merger.merge(contributions).return_type
       end
 
-      # ADR-10 slice 2b-ii. Consults the per-run
-      # `Analysis::DependencySourceInference::Index` carried by
-      # the environment for `(class_name, method_name)`
-      # observations harvested from opt-in gems' `roots:`. On a
-      # hit, returns `Combinator.untyped` so the call site
-      # carries the `Dynamic[top]` provenance (per ADR-10's
-      # "Inference contract": gem-source-inferred shapes never
-      # publish as ground-truth `T`). Returns `nil` when the
-      # environment carries no index, the index has no entry, or
-      # the receiver has no nominal class to look up.
       # ADR-16 synthetic-method tier. Slice 2b shipped the floor —
       # a match short-circuits at the right precedence (above
       # dep-source / discovered / user-class-fallback; below RBS)
@@ -547,6 +534,16 @@ module Rigor
         Type::Combinator.dynamic(entry.return_type)
       end
 
+      # ADR-10 slice 2b-ii. Consults the per-run
+      # `Analysis::DependencySourceInference::Index` carried by
+      # the environment for `(class_name, method_name)`
+      # observations harvested from opt-in gems' `roots:`. On a
+      # hit, returns `Combinator.untyped` so the call site
+      # carries the `Dynamic[top]` provenance (per ADR-10's
+      # "Inference contract": gem-source-inferred shapes never
+      # publish as ground-truth `T`). Returns `nil` when the
+      # environment carries no index, the index has no entry, or
+      # the receiver has no nominal class to look up.
       def try_dependency_source(receiver_type, method_name, environment)
         index = environment&.dependency_source_index
         return nil if index.nil? || index.empty?
@@ -750,10 +747,6 @@ module Rigor
       # below this chain and is invoked by the outer `dispatch`
       # method.
       #
-      # `BlockFolding` runs last among the precision tiers because
-      # its rules apply only to block-taking calls, so the cheaper
-      # arity-based fold tiers above it filter out the common
-      # cases first. When `block_type` is nil the tier is a no-op.
       # The precise-tier folders, consulted in order via the uniform
       # `_DispatchTier` interface (`try_dispatch(CallContext) -> Type?`).
       # Order is significant: ConstantFolding's exact-value folds win
@@ -792,7 +785,7 @@ module Rigor
       private_constant :STDLIB_SINGLETON_FOLDERS
 
       PRECISE_TIERS_TAIL = Ractor.make_shareable([
-        KernelDispatch, MethodFolding, BlockFolding
+        KernelDispatch, MethodFolding, ReduceFolding, ArrayToHFolding, BlockFolding
       ].freeze)
       private_constant :PRECISE_TIERS_TAIL
 
@@ -806,6 +799,14 @@ module Rigor
         data_result = DataFolding.try_dispatch(context)
         return data_result if data_result
 
+        # ADR-48 Struct follow-up — runs in the same band and for the same
+        # reason as DataFolding: `meta_new` would otherwise intercept every
+        # `Singleton[*].new` (the old `struct_new_lift` produced a bare
+        # `Singleton[Struct]`), masking a Struct class's precise instance.
+        # Only fires on Struct receivers, so it never shadows meta's lifts.
+        struct_result = StructFolding.try_dispatch(context)
+        return struct_result if struct_result
+
         meta_result = try_meta_introspection(context.receiver, context.method_name, context.args)
         return meta_result if meta_result
 
@@ -952,18 +953,53 @@ module Rigor
         set_lift = set_new_lift(receiver_type.class_name, arg_types)
         return set_lift if set_lift
 
+        hash_lift = hash_new_lift(receiver_type.class_name, arg_types)
+        return hash_lift if hash_lift
+
         regexp_lift = regexp_new_lift(receiver_type.class_name, arg_types)
         return regexp_lift if regexp_lift
 
         date_lift = date_new_lift(receiver_type.class_name, arg_types)
         return date_lift if date_lift
 
+        struct_new_lift = struct_new_lift(receiver_type.class_name, arg_types)
+        return struct_new_lift if struct_new_lift
+
         class_new_lift = class_new_lift(receiver_type.class_name, arg_types)
         return class_new_lift if class_new_lift
 
         Type::Combinator.nominal_of(receiver_type.class_name)
       end
 
+      # `Struct.new(:a, :b)` synthesises an anonymous Struct *subclass*
+      # (a class object), not a Struct *instance* — so the chained
+      # idiom `Struct.new(:a, :b).new(1, 2)` must resolve `.new` again
+      # on a class-like carrier. The constant-bound form
+      # (`S = Struct.new(:a); S.new(1)`) already records `Singleton[S]`
+      # via `ScopeIndexer#record_meta_new_constant?`; this lift gives
+      # the *chained* (anonymous) position the same class-like carrier
+      # so the trailing `.new` dispatches instead of firing a spurious
+      # `undefined method 'new' for Struct`.
+      #
+      # The disambiguation mirrors `ScopeIndexer#struct_new_call?`: a
+      # call whose positionals are all `Constant<Symbol>` literals is a
+      # member-list class definition → `Singleton[Struct]`. The
+      # following `AnonStruct.new(1, 2)` carries non-symbol args, so it
+      # falls through this gate to `Nominal[Struct]` (a fresh instance)
+      # via the `meta_new` tail. ADR-48 deferred full Struct *value*
+      # folding (member-reader precision) on mutability grounds; this is
+      # the narrower `.new`-dispatch-only fix and contributes no member
+      # layout, so `instance.a` stays at its RBS/Dynamic type.
+      def struct_new_lift(class_name, arg_types)
+        return nil unless class_name == "Struct"
+
+        positional = arg_types.grep_v(Type::HashShape)
+        return nil if positional.empty?
+        return nil unless positional.all? { |t| t.is_a?(Type::Constant) && t.value.is_a?(Symbol) }
+
+        Type::Combinator.singleton_of("Struct")
+      end
+
       # `Class.new` and `Class.new(Parent)` create a brand-new
       # anonymous class. Statically that class is representable as
       # the parent's singleton type — its singleton-method surface
@@ -1050,6 +1086,33 @@ module Rigor
         type
       end
 
+      # `Hash.new(default)` — lifts the default value's type into the
+      # Hash's value parameter so a subsequent `h[k]` read surfaces the
+      # default type rather than `Dynamic[top]`. The common counter
+      # idiom `h = Hash.new(0); h[k] += 1` then types the read as
+      # `Integer`. The key parameter is left `untyped` (the default
+      # carrier imposes no key constraint), so reads of any key resolve
+      # through the value parameter. A value-pinned `Constant` default
+      # (`0`) is widened to its nominal (`Integer`): the hash's values
+      # mutate over its lifetime, so pinning the parameter to the
+      # literal would be unsound for the aggregate.
+      #
+      # Only the single-argument default form folds. The zero-arg
+      # (`Hash.new`) and the block form (`Hash.new { |h, k| … }`) keep
+      # the bare `Nominal[Hash]` answer — the block's value type is not
+      # available at this `:new` dispatch site, and conservatively
+      # leaving the read as today's behaviour is precision-additive.
+      def hash_new_lift(class_name, arg_types)
+        return nil unless class_name == "Hash"
+        return nil unless arg_types.size == 1
+
+        default = arg_types.first
+        return nil if default.nil?
+
+        value = Type::Combinator.widen_value_pinned(default)
+        Type::Combinator.nominal_of("Hash", type_args: [Type::Combinator.untyped, value])
+      end
+
       # `Range.new(b, e)` / `Range.new(b, e, excl)` — folds to
       # `Constant[Range]` when both endpoints are `Constant[Integer]`
       # or both are `Constant[String]`, and the optional third argument

data/lib/rigor/inference/method_parameter_binder.rb

@@ -32,6 +32,35 @@ module Rigor
     # `#singleton_method`.
     #
     # See docs/internal-spec/inference-engine.md for the binding contract.
+    # Leaf-name extraction for a destructured positional parameter
+    # (`Prism::MultiTargetNode`). Stateless; lifted out of
+    # {MethodParameterBinder} so the binder's class length stays in
+    # budget.
+    module Destructure
+      module_function
+
+      # Collect every leaf local name a `MultiTargetNode` binds,
+      # recursing through nested destructures (`((a, b), c)`) and the
+      # splat slot (`(a, *rest)`). Targets without a `#name` (an
+      # index/call write target, vanishingly rare in a parameter
+      # position) are skipped — there is no local to bind.
+      def target_names(multi_target)
+        entries = multi_target.lefts + [multi_target.rest, *multi_target.rights].compact
+        entries.flat_map { |entry| names_for_entry(entry) }
+      end
+
+      def names_for_entry(entry)
+        # A splat sub-target (`*rest` inside the destructure) wraps its
+        # real target in a `SplatNode#expression`; unwrap it.
+        entry = entry.expression if entry.is_a?(Prism::SplatNode) && entry.expression
+        return [] if entry.nil?
+        return target_names(entry) if entry.is_a?(Prism::MultiTargetNode)
+        return [entry.name] if entry.respond_to?(:name) && entry.name
+
+        []
+      end
+    end
+
     class MethodParameterBinder
       # @param environment [Rigor::Environment]
       # @param class_path [String, nil] the qualified name of the class
@@ -112,14 +141,39 @@ module Rigor
 
       def positional_slots(params_node)
         slots = []
-        params_node.requireds.each_with_index { |p, i| slots << ParamSlot.new(:required_positional, p.name, i) }
+        params_node.requireds.each_with_index do |p, i|
+          append_positional_slot(slots, :required_positional, p, i)
+        end
         params_node.optionals.each_with_index { |p, i| slots << ParamSlot.new(:optional_positional, p.name, i) }
         rest = params_node.rest
         slots << ParamSlot.new(:rest_positional, rest.name, nil) if rest.respond_to?(:name) && rest&.name
-        params_node.posts.each_with_index { |p, i| slots << ParamSlot.new(:trailing_positional, p.name, i) }
+        params_node.posts.each_with_index do |p, i|
+          append_positional_slot(slots, :trailing_positional, p, i)
+        end
         slots
       end
 
+      # A destructured positional parameter — `def f((a, b))` — is a
+      # `Prism::MultiTargetNode` in the `requireds`/`posts` list, not a
+      # `RequiredParameterNode`, so it has no `#name`. Bind each leaf
+      # sub-target local to `Dynamic[Top]` (a `:destructured_positional`
+      # slot with no RBS index) instead of crashing on a blind `.name`.
+      # Binding the names at all is what matters: it keeps the
+      # destructured locals present in the entry scope so the body's
+      # reads of them don't fall through to undefined-local noise. The
+      # element types are not cheaply available from the parameter list
+      # alone (no RBS function param maps onto a destructured slot), so
+      # `Dynamic[Top]` is the sound default.
+      def append_positional_slot(slots, kind, param, index)
+        if param.is_a?(Prism::MultiTargetNode)
+          Destructure.target_names(param).each do |name|
+            slots << ParamSlot.new(:destructured_positional, name, nil)
+          end
+        else
+          slots << ParamSlot.new(kind, param.name, index)
+        end
+      end
+
       def keyword_slots(params_node)
         params_node.keywords.filter_map do |kw|
           case kw

data/lib/rigor/inference/multi_target_binder.rb

@@ -100,19 +100,62 @@ module Rigor
 
         def decompose_tuple(tuple, front_count, back_count, rest_present:)
           elements = tuple.elements
-          fronts = Array.new(front_count) { |i| elements[i] || Type::Combinator.constant_of(nil) }
+          fronts = Array.new(front_count) { |i| slot_type(elements, i) }
           if rest_present
             middle_end = [elements.size - back_count, front_count].max
             middle = elements[front_count...middle_end] || []
             rest_type = Type::Combinator.tuple_of(*middle)
-            backs = Array.new(back_count) { |i| elements[middle_end + i] || Type::Combinator.constant_of(nil) }
+            backs = Array.new(back_count) { |i| slot_type(elements, middle_end + i) }
           else
             rest_type = nil
-            backs = Array.new(back_count) { |i| elements[front_count + i] || Type::Combinator.constant_of(nil) }
+            backs = Array.new(back_count) { |i| slot_type(elements, front_count + i) }
           end
           [fronts, rest_type, backs]
         end
 
+        # The per-slot type for index `i` of a tuple decomposition, FP-safely
+        # softened: a missing slot is `nil` (the runtime value of an
+        # over-destructured positional), and a PRESENT but nil-bearing slot
+        # (`X | nil`) is softened to its non-`nil` part — for a heterogeneous
+        # `Tuple` whose optional slot was made optional by flow.
+        #
+        # Rationale (ADR-57 slice 3 work-item 2): a destructure of a tuple
+        # element that flow typed as optional is almost always guarded by a
+        # CORRELATED invariant the flow engine cannot prove. The canonical case
+        # is haml's `parse_tag`, which returns `[..., last_line || @line.index
+        # + 1]` — a 9-tuple whose `last_line` slot widens to `Dynamic[top]?`
+        # through a loop-nested destructure; at the call site `..., last_line =
+        # parse_tag(text); raise(..., last_line - 1) if parse && value.empty?`
+        # the `last_line` is nil ONLY when an earlier element is too, and the
+        # guard short-circuits — but that correlation lives across slots, so
+        # per-slot flow sees `last_line` as nil-able and `last_line - 1` fires a
+        # spurious `possible nil receiver`. Manufacturing a `T?` for every
+        # destructured slot frightens working code; FP discipline (the program
+        # works) outranks the worst-case per-slot reading, so we drop the `nil`
+        # from a destructured slot and keep the non-`nil` constituent (a bare
+        # `nil` slot stays `nil` — there is nothing to soften). A pure non-
+        # optional element keeps its precise type unchanged.
+        def slot_type(elements, index)
+          element = elements[index]
+          return Type::Combinator.constant_of(nil) if element.nil?
+
+          soften_optional_slot(element)
+        end
+
+        def soften_optional_slot(element)
+          return element unless element.is_a?(Type::Union)
+          return element unless element.members.any? { |m| nil_literal?(m) }
+
+          non_nil = element.members.reject { |m| nil_literal?(m) }
+          return element if non_nil.empty? # a bare `nil` slot: nothing to soften
+
+          Type::Combinator.union(*non_nil)
+        end
+
+        def nil_literal?(member)
+          member.is_a?(Type::Constant) && member.value.nil?
+        end
+
         def decompose_default(front_count, back_count, rest_present:)
           [
             Array.new(front_count) { Type::Combinator.untyped },

data/lib/rigor/inference/mutation_widening.rb

@@ -67,18 +67,12 @@ module Rigor
     #   ...; @warning_issued = true`). Requires tracking the
     #   first-write position; flow-sensitive but orthogonal.
     # - **Local-variable mutation inside a block body** (e.g.
-    #   `arr = []; xs.each { |x| arr << x }`). Block bodies
-    #   create a child scope; the existing closure-escape model
-    #   only widens outer locals when the block ESCAPES the
-    #   call. An in-place mutator inside a non-escaping block on
-    #   an outer LOCAL does not yet flow back. **Ivar mutations
-    #   inside a block ARE handled** (ivars live in the
-    #   method-body scope, not the block-local scope) — the
-    #   widening fires from inside the block and the new ivar
-    #   binding is visible to the outer scope.
+    #   `arr = []; xs.each { |x| arr << x }`) — landed as
+    #   ADR-56 slice A (`widen_after_block`). **Ivar mutations
+    #   inside a block ARE also handled** (ivars live in the
+    #   method-body scope, not the block-local scope).
     #
-    # Those four are documented as "G2 remaining" in
-    # `docs/CURRENT_WORK.md` and are intentionally deferred.
+    # The remaining three items above are demand-gated; see ADR-56.
     module MutationWidening
       # Array mutators that change either the size or the element
       # set of a literal-shape carrier (Tuple). Receiver-mutating
@@ -280,6 +274,148 @@ module Rigor
         carriers = kinds.map { |name| Type::Combinator.nominal_of(name) }
         carriers.size == 1 ? carriers.first : Type::Combinator.union(*carriers)
       end
+
+      # ----------------------------------------------------------------
+      # ADR-56 slice C — receiver-content element-type JOIN.
+      #
+      # `widen_after_block` above forgets a literal-shape carrier's arity
+      # when a captured local is content-mutated inside a block, but it
+      # keeps only the SEED's element types — an unsound under-
+      # approximation for a non-empty seed (`out = [0]; arr.each { |x|
+      # out << x }` types `Array[0]` while the runtime array is
+      # `[0, 1, 2, 3]`). Slice C joins the appended/stored element (and
+      # key/value) types INTO the continuation collection's parameter, so
+      # the result is `Array[0 | Integer]` rather than `Array[0]`.
+      #
+      # Array content-mutators that append/store ELEMENTS. The appended
+      # element type is the call's argument type(s); `[]=`'s value is its
+      # LAST argument (the keys precede it). Subset of `ARRAY_MUTATORS`:
+      # only the element-INTRODUCING methods (removers / reorderers add no
+      # new element evidence and are already covered by the arity-forget).
+      ARRAY_CONTENT_ADDERS = %i[
+        << push append prepend unshift concat insert []= fill replace
+      ].to_set.freeze
+
+      # Hash content-mutators that store a key→value pair. For `[]=` /
+      # `store` the key is the first argument and the value the last.
+      HASH_CONTENT_ADDERS = %i[[]= store].to_set.freeze
+
+      # String content-mutators that append to the buffer. String carries
+      # no element parameter, so these contribute nothing to a join — they
+      # are listed so the orchestrator recognises them as content mutators
+      # (the binding already widens to `String` via normal typing); the
+      # join helpers below short-circuit on a non-collection pre-state.
+      STRING_CONTENT_ADDERS = %i[<< concat prepend insert replace].to_set.freeze
+
+      # Every method name that mutates a captured local's CONTENT — the
+      # union the orchestrator scans the block body for.
+      CONTENT_ADDERS = (ARRAY_CONTENT_ADDERS | HASH_CONTENT_ADDERS | STRING_CONTENT_ADDERS).freeze
+
+      # The element types a single content-mutator call introduces into an
+      # Array, given the per-argument types (already typed in the block
+      # body scope). `concat`/`replace` take collection arguments, so their
+      # element evidence is the arguments' OWN element types unioned; the
+      # rest append the argument values directly. Returns `[]` when no
+      # element evidence (e.g. a `<<` with no resolvable arg).
+      def array_added_elements(method_name, arg_types)
+        return [] if arg_types.empty?
+
+        case method_name
+        when :concat, :replace
+          arg_types.flat_map { |t| collection_element_types(t) }
+        when :insert
+          # `insert(index, *objs)` — first arg is the position.
+          arg_types.drop(1)
+        when :[]=
+          # `arr[i] = v` / `arr[i, n] = v` — value is the last argument.
+          [arg_types.last]
+        when :fill
+          # `fill(value)` — only the no-block single-value form adds a
+          # concrete element; block / range forms are conservatively
+          # ignored (the arity-forget already widened the binding).
+          arg_types.size == 1 ? arg_types : []
+        else # << push append prepend unshift
+          arg_types
+        end
+      end
+
+      # Builds the continuation Array type from the pre-state binding and
+      # the appended element types. The floor is `Array[Dynamic[top]]`
+      # (the sound empty-seed behaviour) when there is no element evidence
+      # at all.
+      def join_array_content(pre_state, added_elements)
+        seed_elements = collection_element_types(pre_state)
+        added = added_elements.compact
+        # The empty-seed floor element is `Dynamic[top]` (no element
+        # evidence). When real appended evidence exists that floor carries
+        # nothing, so drop it — an empty accumulator built by `out << x*2`
+        # reads `Array[Integer]`, not `Array[Integer | Dynamic[top]]`.
+        seed_elements = drop_dynamic(seed_elements) unless added.empty?
+        elements = seed_elements + added
+        return Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.untyped]) if elements.empty?
+
+        Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.union(*elements)])
+      end
+
+      # Builds the continuation Hash type from the pre-state binding and a
+      # list of `[key_type, value_type]` pairs stored by `[]=` / `store`.
+      def join_hash_content(pre_state, added_pairs)
+        seed_keys, seed_values = hash_shape_key_values(pre_state)
+        added_keys = added_pairs.map(&:first).compact
+        added_values = added_pairs.map(&:last).compact
+        seed_keys = drop_dynamic(seed_keys) unless added_keys.empty?
+        seed_values = drop_dynamic(seed_values) unless added_values.empty?
+        keys = seed_keys + added_keys
+        values = seed_values + added_values
+        key_t = keys.empty? ? Type::Combinator.untyped : Type::Combinator.union(*keys)
+        value_t = values.empty? ? Type::Combinator.untyped : Type::Combinator.union(*values)
+        Type::Combinator.nominal_of("Hash", type_args: [key_t, value_t])
+      end
+
+      # Drops `Dynamic` (incl. `untyped`) constituents from a type list.
+      def drop_dynamic(types)
+        types.grep_v(Type::Dynamic)
+      end
+
+      # Element types carried by a collection binding, regardless of which
+      # carrier holds them: a `Tuple` lists them, a `Nominal[Array, [E]]`
+      # has one element param, a bare `Array` / anything else yields none.
+      def collection_element_types(type)
+        case type
+        when Type::Tuple
+          type.elements
+        when Type::Nominal
+          type.class_name == "Array" ? type.type_args : []
+        when Type::Union
+          # A loop's single-pass join can union the widened collection with
+          # its un-widened literal seed (`Array[0] | [0]`); pull element
+          # evidence from every Array-ish member.
+          type.members.flat_map { |m| collection_element_types(m) }
+        else
+          []
+        end
+      end
+
+      # `[keys, values]` evidence from a Hash-ish pre-state binding —
+      # a `HashShape` (literal pairs) or a `Nominal[Hash, [K, V]]`.
+      def hash_shape_key_values(type)
+        case type
+        when Type::HashShape
+          return [[], []] if type.pairs.empty?
+
+          [[key_union_for(type.pairs.keys)], type.pairs.values]
+        when Type::Nominal
+          type.class_name == "Hash" && type.type_args.size == 2 ? [[type.type_args[0]], [type.type_args[1]]] : [[], []]
+        when Type::Union
+          type.members.each_with_object([[], []]) do |m, (ks, vs)|
+            mk, mv = hash_shape_key_values(m)
+            ks.concat(mk)
+            vs.concat(mv)
+          end
+        else
+          [[], []]
+        end
+      end
     end
   end
 end