rigortype 0.2.8 → 0.2.9

data/lib/rigor/environment/missing_gem_constant_index.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  class Environment
+    # ADR-82 WD9 — maps a top-level constant name to the locked, RBS-less gem that declares it, so an
+    # unresolved constant read (`Faraday`, `Sidekiq`) can carry the `external_gem_without_rbs` provenance
+    # cause instead of the generic `unsupported_syntax`. For a gem with no RBS the constant read is where the
+    # class name is last visible — by dispatch time the receiver is already `Dynamic[top]` — so this index is
+    # what lets `coverage --protection` route those holes to `add_rbs` honestly.
+    #
+    # Ownership is established by READING, never by guessing: each gem's conventional entry file
+    # (`lib/<name>.rb`, with the dash → directory variant) is parsed with Prism and its top-level
+    # class / module / constant declarations recorded under their root name. No gem code runs — the same
+    # posture as ADR-72's "loads RBS data only" and the ADR-10 walker. A name-derivation heuristic
+    # (`faraday` → `Faraday` by camelizing) is deliberately NOT used: it breaks on irregular names
+    # (`activesupport` → `ActiveSupport`) and is exactly the guessing the ADR-82 honesty criterion forbids.
+    #
+    # Everything fails OPEN to "no owner": a gem that is not installed, an entry file that does not exist or
+    # does not parse, a root constant declared only in a deeper file. An unindexed constant keeps today's
+    # generic cause — the failure mode is a missing label, never a wrong one.
+    #
+    # The scan is bounded to entry files (one or two per gem) so building the index over a real app's
+    # hundreds of RBS-less gems stays sub-second; it is built lazily on the first unresolved constant, so a
+    # project whose constants all resolve never pays it.
+    #
+    # **Gem-directory resolution.** Rigor runs under its OWN bundle (`BUNDLE_GEMFILE=<rigor>/Gemfile`), so
+    # `Gem::Specification.find_by_name` sees rigor's gems, not the target project's — it would resolve only
+    # the handful of gems both bundles happen to share (i18n, rack) and miss every project-specific gem
+    # (the very ones a Rails app's holes root at). So the primary resolver is the **target's bundle install
+    # tree** (`<bundle>/ruby/*/gems/<name>-<version>/`, the same pure-filesystem layout
+    # {BundleSigDiscovery} walks — no `Bundler` API, no gem code). `Gem::Specification` remains a last-resort
+    # fallback for a project installed against system gems with no discoverable bundle; reading a gem's own
+    # entry file for its own top-level namespace constant is version-stable, so even a rigor-vs-target
+    # version skew on a shared gem yields the same constant name.
+    module MissingGemConstantIndex
+      module_function
+
+      # @param gems [Enumerable<Array(String, String)>] `[gem_name, version]` pairs (the `:missing` rows of
+      #   {RbsCoverageReport}).
+      # @param bundle_path [String, Pathname, nil] the target's resolved bundler install root, or nil.
+      # @param spec_resolver [#call] `(name, version) -> String?` fallback dir resolver. Injectable for
+      #   specs; the default is the RubyGems-metadata lookup (no code load).
+      # @return [Hash{String => String}] frozen `root constant name => gem name`. On a collision (two gems
+      #   declaring the same top-level constant) the first gem wins — the CAUSE recorded downstream
+      #   (external gem without RBS) is true under either owner.
+      def build(gems, bundle_path: nil, spec_resolver: method(:installed_gem_dir))
+        bundle_dirs = bundle_gem_dirs(bundle_path)
+        index = {}
+        gems.each do |gem_name, version|
+          dir = bundle_dirs["#{gem_name}-#{version}"] || spec_resolver.call(gem_name, version)
+          next unless dir
+
+          entry_files(dir, gem_name).each do |file|
+            top_level_root_constants(file).each { |name| index[name] ||= gem_name }
+          end
+        end
+        index.freeze
+      end
+
+      # `{"<name>-<version>" => gem_dir}` for the target's bundle, or `{}` when no bundle is resolvable. The
+      # glob mirrors {BundleSigDiscovery}: `<bundle>/ruby/X.Y.Z/gems/<name>-<version>/`. Keyed on the dir
+      # basename so a platform-tagged variant (`ffi-1.17.4-aarch64-linux-gnu`) simply doesn't match a
+      # `<name>-<version>` lookup — those gems ship native code, not the pure-Ruby constants this indexes.
+      def bundle_gem_dirs(bundle_path)
+        return {} if bundle_path.nil?
+
+        base = Pathname.new(bundle_path)
+        return {} unless base.directory?
+
+        Dir.glob(base.join("ruby", "*", "gems", "*")).each_with_object({}) do |dir, acc|
+          acc[File.basename(dir)] ||= dir
+        end
+      end
+
+      # RubyGems spec metadata lookup — the gem's on-disk source root, without loading any of its code.
+      # Exact-version first, any-version fallback. See the class note on why this is only a fallback.
+      def installed_gem_dir(name, version)
+        spec = begin
+          Gem::Specification.find_by_name(name, "= #{version}")
+        rescue Gem::LoadError
+          begin
+            Gem::Specification.find_by_name(name)
+          rescue Gem::LoadError
+            nil
+          end
+        end
+        spec&.full_gem_path
+      end
+
+      # The conventional require targets for a gem name: `lib/foo.rb`, and `lib/foo/bar.rb` for a dashed
+      # `foo-bar`. This is the require-name convention Bundler.require depends on — a filename convention,
+      # not a constant-name guess; the constants come from parsing whichever of these exists.
+      def entry_files(dir, gem_name)
+        candidates = ["lib/#{gem_name}.rb"]
+        candidates << "lib/#{gem_name.tr('-', '/')}.rb" if gem_name.include?("-")
+        candidates.filter_map do |relative|
+          path = File.join(dir, relative)
+          path if File.file?(path)
+        end
+      end
+
+      # Root names of the file's top-level declarations. Only direct children of the program are read — the
+      # root constant of a gem's namespace is declared at file top level by construction (`module Faraday`,
+      # `class Money::Error < …` roots at `Money`), so no recursion into bodies is needed.
+      def top_level_root_constants(path)
+        result = Prism.parse(File.read(path))
+        return [] unless result.errors.empty?
+
+        result.value.statements.body.filter_map do |node|
+          case node
+          when Prism::ClassNode, Prism::ModuleNode then root_segment(node.constant_path)
+          when Prism::ConstantWriteNode then node.name.to_s
+          end
+        end
+      rescue StandardError
+        []
+      end
+
+      def root_segment(node)
+        current = node
+        current = current.parent while current.is_a?(Prism::ConstantPathNode) && current.parent
+        current.respond_to?(:name) && current.name ? current.name.to_s : nil
+      end
+    end
+  end
+end

data/lib/rigor/environment.rb

@@ -8,6 +8,7 @@ require_relative "environment/reflection"
 require_relative "environment/reporters"
 require_relative "environment/hkt_registry_holder"
 require_relative "environment/constant_type_cache_holder"
+require_relative "environment/missing_gem_constant_index"
 require_relative "environment/bundle_sig_discovery"
 require_relative "environment/lockfile_resolver"
 require_relative "environment/rbs_collection_discovery"
@@ -84,7 +85,7 @@ module Rigor
                    rbs_extended_reporter: nil, boundary_cross_reporter: nil,
                    source_rbs_synthesis_reporter: nil,
                    synthetic_method_index: nil, project_patched_methods: nil,
-                   hkt_registry: nil)
+                   hkt_registry: nil, missing_rbs_gems: [], missing_rbs_bundle_path: nil)
       @class_registry = class_registry
       @rbs_loader = rbs_loader
       @plugin_registry = plugin_registry
@@ -109,6 +110,12 @@ module Rigor
       @hkt_registry_base = hkt_registry || Inference::HktRegistry::EMPTY
       @hkt_registry_holder = HktRegistryHolder.new
       @constant_type_cache = ConstantTypeCacheHolder.new
+      # ADR-82 WD9 — `[gem_name, version]` pairs for the locked gems with no resolvable RBS. The
+      # root-constant ownership index over them is built lazily (first unresolved constant read) so runs
+      # whose constants all resolve never pay the entry-file scan.
+      @missing_rbs_gems = missing_rbs_gems.freeze
+      @missing_rbs_bundle_path = missing_rbs_bundle_path
+      @missing_rbs_gem_constants_holder = HktRegistryHolder.new
       @name_scope = build_name_scope
       freeze
     end
@@ -133,6 +140,21 @@ module Rigor
       end
     end
 
+    # ADR-82 WD9 — the gem name owning `root_constant_name`, when that gem is locked in the project's
+    # Gemfile.lock, ships no resolvable RBS, and its entry file declares the constant at top level. Nil for
+    # everything else — the caller then keeps the generic provenance cause. The index is built once, lazily,
+    # from RubyGems metadata + a Prism parse of each gem's entry file; no gem code runs (see
+    # {MissingGemConstantIndex}). Under the fork pool a worker that never meets an unresolved constant never
+    # builds it.
+    def missing_rbs_gem_owner(root_constant_name)
+      return nil if @missing_rbs_gems.empty?
+
+      index = @missing_rbs_gem_constants_holder.fetch do
+        MissingGemConstantIndex.build(@missing_rbs_gems, bundle_path: @missing_rbs_bundle_path)
+      end
+      index[root_constant_name.to_s]
+    end
+
     # Backwards-compatible reporter accessors — every existing consumer (rbs_extended, method_dispatcher)
     # calls these. The frozen `@reporters` container is mutable for slot reassignment via
     # {#attach_reporters!} below.
@@ -220,6 +242,12 @@ module Rigor
           auto_detect: bundler_auto_detect,
           locked_gems: locked.empty? ? nil : locked
         ).map(&:to_s)
+        # ADR-82 WD9 — the resolved bundle root, so the missing-gem constant index reads each RBS-less gem's
+        # entry file from the TARGET's bundle (not rigor's own — see `MissingGemConstantIndex`). Resolved
+        # once here; passed through to the lazy index build.
+        bundle_root = BundleSigDiscovery.resolve_bundle_path(
+          bundle_path: bundler_bundle_path, project_root: root, auto_detect: bundler_auto_detect
+        )&.to_s
         # O4 Layer 3 slice 2 — when `rbs collection install` has been run for the target project, parse the
         # resulting `rbs_collection.lock.yaml` and feed each gem's `<collection_path>/<name>/<version>/`
         # directory into `signature_paths:`. Stdlib-typed entries are skipped (already covered by
@@ -248,10 +276,9 @@ module Rigor
         # diagnostic. Appended last so any RBS the project already supplies wins, and skipped for a gem whose
         # opt-in plugin twin is loaded (no duplicate declaration). The paths ride in
         # `loader_signature_paths`, so the env cache descriptor digests them for free.
-        overlay_paths = gem_overlay_paths(
-          locked: locked, default_libraries: merged_libraries,
-          bundle_sig_paths: gem_sig_paths, rbs_collection_paths: collection_paths,
-          plugin_registry: plugin_registry
+        missing_gems, overlay_paths = missing_gems_and_overlay_paths(
+          locked: locked, default_libraries: merged_libraries, bundle_sig_paths: gem_sig_paths,
+          rbs_collection_paths: collection_paths, plugin_registry: plugin_registry
         )
         loader_signature_paths = resolved_paths + plugin_sig_paths + gem_sig_paths +
                                  collection_paths + overlay_paths
@@ -286,7 +313,9 @@ module Rigor
           source_rbs_synthesis_reporter: source_rbs_synthesis_reporter,
           synthetic_method_index: synthetic_method_index,
           project_patched_methods: project_patched_methods,
-          hkt_registry: Builtins::HktBuiltins.registry
+          hkt_registry: Builtins::HktBuiltins.registry,
+          missing_rbs_gems: missing_gems,
+          missing_rbs_bundle_path: bundle_root
         )
       end
       # rubocop:enable Metrics/MethodLength, Metrics/ParameterLists
@@ -298,22 +327,29 @@ module Rigor
         sig.directory? ? [sig] : []
       end
 
-      # ADR-72 — resolve the bundled RBS overlay directories to load for this project. A gem is eligible when
-      # it is locked in the Gemfile.lock, classified `:missing` by {RbsCoverageReport} (no RBS through
-      # default-library / vendored / bundle-`sig/` / rbs-collection), and its conflicting opt-in plugin (if
-      # any) is not loaded. Returns `[Pathname]`, deterministically ordered, or `[]` when no lockfile / no
-      # eligible gem.
-      def gem_overlay_paths(locked:, default_libraries:, bundle_sig_paths:,
-                            rbs_collection_paths:, plugin_registry:)
-        return [] if locked.empty?
-
-        missing = RbsCoverageReport.classify(
+      # The `:missing` classification (locked gems with no RBS through any resolution path), computed once
+      # and consumed twice: as `[gem_name, version]` pairs for the ADR-82 WD9 constant-ownership index, and
+      # as the eligible-gem set for the ADR-72 overlay resolution. Returns `[pairs, overlay_paths]`.
+      def missing_gems_and_overlay_paths(locked:, default_libraries:, bundle_sig_paths:,
+                                         rbs_collection_paths:, plugin_registry:)
+        return [[], []] if locked.empty?
+
+        rows = RbsCoverageReport.classify(
           locked_gems: locked, default_libraries: default_libraries,
           bundle_sig_paths: bundle_sig_paths, rbs_collection_paths: rbs_collection_paths
-        ).select { |row| row.source == :missing }.map(&:gem_name)
+        ).select { |row| row.source == :missing }
+        overlays = gem_overlay_paths(missing_gem_names: rows.map(&:gem_name), plugin_registry: plugin_registry)
+        [rows.map { |row| [row.gem_name, row.version] }, overlays]
+      end
+
+      # ADR-72 — resolve the bundled RBS overlay directories to load for this project. A gem is eligible when
+      # it is classified `:missing` (see {missing_rbs_gem_rows}) and its conflicting opt-in plugin (if any)
+      # is not loaded. Returns `[Pathname]`, deterministically ordered, or `[]` when no eligible gem.
+      def gem_overlay_paths(missing_gem_names:, plugin_registry:)
+        return [] if missing_gem_names.empty?
 
         loaded_ids = plugin_registry ? plugin_registry.ids.to_set : Set.new
-        eligible = missing.reject do |gem_name|
+        eligible = missing_gem_names.reject do |gem_name|
           plugin_id = GEM_OVERLAY_PLUGIN_IDS[gem_name]
           plugin_id && loaded_ids.include?(plugin_id)
         end.sort

data/lib/rigor/inference/expression_typer.rb

@@ -385,14 +385,32 @@ module Rigor
       # `Inference::FallbackTracer` from inside `Rigor::CLI::Foo` resolves to
       # `Rigor::Inference::FallbackTracer`.
       def type_of_constant_read(node)
-        resolve_constant_name(node.name.to_s) || fallback_for(node, family: :prism)
+        resolve_constant_name(node.name.to_s) || unresolved_constant_fallback(node, node.name.to_s)
       end
 
       def type_of_constant_path(node)
         full_name = Source::ConstantPath.qualified_name_or_nil(node)
         return fallback_for(node, family: :prism) if full_name.nil?
 
-        resolve_constant_name(full_name) || fallback_for(node, family: :prism)
+        resolve_constant_name(full_name) || unresolved_constant_fallback(node, full_name)
+      end
+
+      # ADR-82 WD9 — an unresolved constant whose root name a locked, RBS-less gem declares carries the
+      # `external_gem_without_rbs` cause instead of the generic `unsupported_syntax`. The constant read is
+      # where the class name is last visible (a no-RBS gem's receiver never types Nominal, so the dispatch
+      # tiers that record this cause under ADR-10 / `pre_eval:` opt-ins can't see it); WD6 chain inheritance
+      # then carries the cause through `Faraday.new.get(...)`. Side-channel only — the type stays the same
+      # `Dynamic[top]`, and an unindexed constant (project typo, unanalyzed project path) keeps the generic
+      # cause: the fail-open direction is a missing label, never a wrong one.
+      def unresolved_constant_fallback(node, full_name)
+        root = full_name.delete_prefix("::").split("::").first
+        owner = root && scope.environment.missing_rbs_gem_owner(root)
+        return fallback_for(node, family: :prism) unless owner
+
+        inner = dynamic_top
+        record_fallback(node, family: :prism, inner_type: inner, origin: DynamicOrigin::EXTERNAL_GEM_WITHOUT_RBS)
+        scope.record_dynamic_origin(node, DynamicOrigin::EXTERNAL_GEM_WITHOUT_RBS)
+        inner
       end
 
       # Try the literal name first, then walk Ruby's lexical lookup by progressively prefixing the surrounding

data/lib/rigor/inference/fork_map.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+
+module Rigor
+  module Inference
+    # Generic fork-over-slices map for the embarrassingly-parallel per-file passes of the
+    # `rigor coverage --protection` path — the ADR-67 {ParameterInferenceCollector} rounds and the
+    # {ProtectionScanner} scan (P3-10). The expensive shared state (the RBS environment, plugin registry,
+    # seeded scope, parsed ASTs) is built ONCE on the parent; children copy-on-write inherit it and each map
+    # a contiguous slice of `items` to a marshalable payload that the parent collects **in slice order**.
+    #
+    # A child that exits abnormally (crash, unmarshalable payload) has its slice re-run in-process, so the
+    # returned array is identical to a plain sequential `[block.call(items)]` — order-preserving and
+    # complete. Slice order is the caller's `items` order, so a caller that merges the payloads in array
+    # order reproduces a sequential run byte-for-byte.
+    #
+    # This owns only the fork mechanics; the parent-side prewarm (forcing the RBS env to fully build so
+    # children inherit it warm) and the payload merge are the caller's responsibility.
+    module ForkMap
+      module_function
+
+      # @param items [Array] work items (file paths, or `[path, ast]` pairs), in caller order.
+      # @param workers [Integer] resolved worker count (≤1, empty items, or no `fork` → sequential).
+      # @yield [Array] a contiguous slice of `items`; must return a **marshalable** object.
+      # @return [Array] the per-slice block results, in original slice order.
+      def call(items:, workers:, &block)
+        worker_count = [workers, items.size].min
+        return [block.call(items)] unless parallel?(worker_count) && !items.empty?
+
+        fork_map(items, worker_count, block)
+      end
+
+      def parallel?(worker_count)
+        worker_count > 1 && Process.respond_to?(:fork)
+      end
+
+      # Forks `worker_count` children over contiguous slices, waits for each, and returns the Marshal'd
+      # per-slice payloads in slice order. A child that exits abnormally has its slice re-run in-process.
+      def fork_map(items, worker_count, block)
+        slices = items.each_slice((items.size.to_f / worker_count).ceil).to_a
+        payloads = Array.new(slices.size)
+
+        Dir.mktmpdir("rigor-fork-map") do |tmpdir|
+          children = slices.each_with_index.map do |slice, index|
+            out_path = File.join(tmpdir, "worker-#{index}")
+            { pid: fork { run_worker(slice, block, out_path) }, index: index, slice: slice, out_path: out_path }
+          end
+          collect(children, payloads, block)
+        end
+
+        payloads
+      end
+
+      # Child-process body: run the block over the slice, Marshal the result to `out_path`, and `exit!`
+      # (skipping `at_exit` / stdio flush — the payload is durable on disk). Any failure exits non-zero so
+      # the parent re-runs the slice in-process.
+      def run_worker(slice, block, out_path)
+        File.binwrite(out_path, Marshal.dump(block.call(slice)))
+        exit!(0)
+      rescue StandardError
+        exit!(1)
+      end
+
+      # Waits for every child, placing each successful payload at its slice index; a child that exited
+      # abnormally has its slice re-run in-process (identical to the sequential result).
+      def collect(children, payloads, block)
+        children.each do |child|
+          _, status = Process.waitpid2(child[:pid])
+          payload = worker_payload(status, child[:out_path])
+          payloads[child[:index]] = payload.nil? ? block.call(child[:slice]) : payload.fetch(:value)
+        end
+      end
+
+      # @return [Hash{value: Object}, nil] the child's payload wrapped so a legitimately-nil block result is
+      #   distinguishable from an abnormal exit. `Marshal.load` is safe: the blob was written by our own
+      #   forked child to a temp file we created.
+      def worker_payload(status, out_path)
+        return nil unless status.success? && File.exist?(out_path)
+
+        { value: Marshal.load(File.binread(out_path)) } # rubocop:disable Security/MarshalLoad
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/rigor/inference/narrowing.rb

@@ -873,6 +873,15 @@ module Rigor
             string_predicate_result = analyse_string_predicate(node, scope)
             return apply_safe_nav_non_nil(node, scope, string_predicate_result) if string_predicate_result
 
+            # A predicate whose RBS says it always returns `false` for one union arm cannot have
+            # been called on that arm when it answered truthily. `NilClass#present?: () -> false`
+            # (ActiveSupport) is the motivating case: `if login.present?` must narrow `String | nil`
+            # to `String`, and nothing else in the catalogue does it — `present?` is a gem method the
+            # engine must not hardcode, and `rigor:v1:predicate-if-true` facts never reach a union
+            # receiver.
+            polarity_result = analyse_union_predicate_polarity(node, scope)
+            return polarity_result if polarity_result
+
             # A safe-navigation call (`v&.foo`) whose result is truthy proves the receiver was
             # non-nil — `&.` returns `nil` when the receiver is nil, so a truthy outcome can
             # only come from a non-nil receiver. Narrow the receiver on the truthy edge even
@@ -2352,6 +2361,115 @@ module Rigor
           end
         end
 
+        # The three value-pinned classes a union arm can name whose instances are the single
+        # value itself. Their finality is what makes the polarity rule below sound: no subclass
+        # can override the predicate, because there is no subclass.
+        POLARITY_ARM_CLASSES = { nil => "NilClass", true => "TrueClass", false => "FalseClass" }.freeze
+        private_constant :POLARITY_ARM_CLASSES
+
+        # Drops union arms a zero-argument predicate's own signature rules out on each edge.
+        #
+        # `if x.present?` with `x: String | nil` must see `String` in the body. Rigor could not:
+        # `present?` is an ActiveSupport method (so the engine must not join the hardcoded
+        # `nil?` / `empty?` catalogue with it), and `resolve_rbs_extended_method` hands a union
+        # receiver no `rigor:v1:predicate-if-true` facts, so annotating the RBS would not help
+        # either. But the answer is already written down: the bundled ActiveSupport signature
+        # declares `NilClass#present?: () -> false`, and a method that always returns `false` for
+        # `nil` cannot have answered truthily on a `nil` receiver.
+        #
+        # Soundness rests on the arm being a value-pinned `nil` / `true` / `false`. For an
+        # ordinary `Nominal[Foo]` arm the static type admits Foo's subclasses, any of which may
+        # override the predicate and return the other polarity; the three classes here have no
+        # subclasses, so the declared return is the runtime return.
+        #
+        # Safe navigation is excluded: `x&.blank?` yields `nil` (falsey) for a nil receiver
+        # rather than `NilClass#blank?`'s declared `true`, so the falsey edge would wrongly drop
+        # the nil arm. `analyse_safe_nav_receiver` below handles that shape's truthy edge.
+        #
+        # Returns `[truthy_scope, falsey_scope]`, or nil when no arm is ruled out, when an edge
+        # would be emptied, or when the receiver has no scope binding to narrow.
+        def analyse_union_predicate_polarity(node, scope)
+          return nil if node.safe_navigation? || !argument_free?(node)
+          return nil unless node.name.end_with?("?")
+
+          receiver_type = receiver_binding_type(node.receiver, scope)
+          return nil unless receiver_type.is_a?(Type::Union)
+
+          truthy, falsey = partition_arms_by_polarity(receiver_type.members, node.name, scope)
+          return nil if truthy.size == receiver_type.members.size && falsey.size == receiver_type.members.size
+          return nil if truthy.empty? || falsey.empty?
+
+          [
+            narrow_receiver_binding(node.receiver, scope, Type::Combinator.union(*truthy)),
+            narrow_receiver_binding(node.receiver, scope, Type::Combinator.union(*falsey))
+          ]
+        end
+
+        # Splits `members` into the arms that survive the truthy edge and those that survive the
+        # falsey edge. An arm whose polarity is unknown survives both.
+        def partition_arms_by_polarity(members, method_name, scope)
+          truthy = []
+          falsey = []
+          members.each do |arm|
+            case arm_predicate_polarity(arm, method_name, scope)
+            when :always_false then falsey << arm
+            when :always_true then truthy << arm
+            else
+              truthy << arm
+              falsey << arm
+            end
+          end
+          [truthy, falsey]
+        end
+
+        # `:always_false` / `:always_true` when every RBS overload of `method_name` on the arm's
+        # class returns that literal; nil for any other arm, signature, or lookup failure.
+        def arm_predicate_polarity(arm, method_name, scope)
+          returns = arm_predicate_return_types(arm, method_name, scope)
+          return nil if returns.nil? || returns.empty?
+          return :always_false if returns.all? { |type| literal_boolean?(type, false) }
+          return :always_true if returns.all? { |type| literal_boolean?(type, true) }
+
+          nil
+        end
+
+        # Declared return type of every RBS overload of `method_name` on the arm's class, or nil
+        # when the arm is not one of the three value-pinned classes or the lookup fails.
+        def arm_predicate_return_types(arm, method_name, scope)
+          return nil unless arm.is_a?(Type::Constant)
+
+          class_name = POLARITY_ARM_CLASSES[arm.value]
+          return nil if class_name.nil?
+
+          definition = Rigor::Reflection.instance_method_definition(class_name, method_name, scope: scope)
+          definition&.method_types&.map { |method_type| method_type.type.return_type }
+        rescue StandardError
+          nil
+        end
+
+        def literal_boolean?(rbs_type, value)
+          rbs_type.is_a?(RBS::Types::Literal) && rbs_type.literal == value
+        end
+
+        # The four receiver shapes with a scope binding the edges can rebind, mirroring
+        # `apply_self_fact`. A method chain or arbitrary expression has none, so it reads nil and
+        # the caller declines.
+        def receiver_binding_type(receiver, scope)
+          case receiver
+          when Prism::LocalVariableReadNode then scope.local(receiver.name)
+          when Prism::InstanceVariableReadNode then scope.ivar(receiver.name)
+          when Prism::SelfNode then scope.self_type
+          end
+        end
+
+        def narrow_receiver_binding(receiver, scope, narrowed)
+          case receiver
+          when Prism::LocalVariableReadNode then scope.with_local(receiver.name, narrowed)
+          when Prism::InstanceVariableReadNode then scope.with_ivar(receiver.name, narrowed)
+          when Prism::SelfNode then scope.with_self_type(narrowed)
+          end
+        end
+
         # Narrows a safe-navigation call's receiver (`v&.foo`) to its non-nil fragment on the
         # truthy edge, returning `[truthy, falsey]` or nil when nothing applies (not safe-nav,
         # opaque receiver, or already non-nil). Used standalone for a bare `v&.foo` truthy edge

data/lib/rigor/inference/parameter_inference_collector.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "scope_indexer"
+require_relative "fork_map"
 require_relative "../source/node_walker"
 
 module Rigor
@@ -120,15 +121,20 @@ module Rigor
       # @param target_ruby [String, nil] Prism parse target.
       # @param max_rounds [Integer] the WD5 fixpoint cap (1 = single-level).
       # @return [Hash{[String,Symbol,Symbol] => Hash{Symbol => Rigor::Type}}] frozen.
-      def self.collect(files:, environment:, target_ruby: nil, max_rounds: DEFAULT_ROUNDS)
-        new(files: files, environment: environment, target_ruby: target_ruby, max_rounds: max_rounds).collect
+      def self.collect(files:, environment:, target_ruby: nil, max_rounds: DEFAULT_ROUNDS, workers: 0)
+        new(files: files, environment: environment, target_ruby: target_ruby,
+            max_rounds: max_rounds, workers: workers).collect
       end
 
-      def initialize(files:, environment:, target_ruby: nil, max_rounds: DEFAULT_ROUNDS)
+      def initialize(files:, environment:, target_ruby: nil, max_rounds: DEFAULT_ROUNDS, workers: 0)
         @files = files
         @environment = environment
         @target_ruby = target_ruby
         @max_rounds = max_rounds
+        # P3-10 — fork-parallelism for the per-round re-typing (the dominant coverage-protection cost). A
+        # round's per-file typing is independent; contributions merge associatively (see {#merge_round}), so
+        # forking over file slices is byte-identical to the sequential pass. 0/1 → sequential.
+        @workers = workers
         # Reset per round (see {#run_round}). `[[class, method, kind], param_sym]` => [Type] of
         # observed concrete arguments (a default-block Hash, not a `{}` literal, so the
         # analyzer types its reads generically — {#finalize}), plus the ids widened to
@@ -139,6 +145,10 @@ module Rigor
 
       def collect
         parsed = parse_all
+        # Force the full RBS load on the parent so forked round-workers copy-on-write inherit a warm
+        # environment instead of each rebuilding it (mirrors the check / scan fork pools). A no-op on the
+        # sequential path.
+        @environment.rbs_loader&.prewarm if ForkMap.parallel?([@workers, parsed.size].min)
         discovery = discovery_seed_tables
         table = EMPTY
         @max_rounds.times do
@@ -164,18 +174,51 @@ module Rigor
       end
 
       # One fixpoint round: re-type every file with `seed_table` (the previous round's inferred
-      # parameters) seeded, collecting the next round's table.
+      # parameters) seeded, collecting the next round's table. The per-file typing is fork-mapped over
+      # `@workers` (byte-identical to sequential — see {#merge_round}); each slice returns a marshalable
+      # `[observations, poisoned]` contribution the parent merges in slice order.
       def run_round(parsed, discovery_tables, seed_table)
+        seed_scope = build_seed_scope(discovery_tables, seed_table)
+        contributions = ForkMap.call(items: parsed, workers: @workers) do |slice|
+          accumulate_slice(slice, seed_scope)
+        end
+        merge_round(contributions)
+      end
+
+      # Types every call in one contiguous file slice, returning a marshalable contribution: the per-`id`
+      # observed argument types (default proc stripped for `Marshal`) and the poisoned-`id` list. Uses the
+      # per-process observation ivars, so a forked worker and the sequential single-slice call share this
+      # exact code.
+      def accumulate_slice(parsed_slice, seed_scope)
         @type_observations = Hash.new { |hash, id| hash[id] = [] }
         @poisoned_params = Set.new
-        seed_scope = build_seed_scope(discovery_tables, seed_table)
-        parsed.each do |path, ast|
+        parsed_slice.each do |path, ast|
           index = ScopeIndexer.index(ast, default_scope: seed_scope.with_source_path(path))
           Source::NodeWalker.each(ast) do |node|
             record_call(node, index) if node.is_a?(Prism::CallNode)
           end
         end
-        finalize
+        # Copy into a plain Hash, dropping the default proc — a Marshal-unfriendly proc the fork worker
+        # would otherwise fail to dump. (`.to_h` returns self here, keeping the proc, so copy explicitly.)
+        observations = @type_observations.each_with_object({}) { |(id, types), plain| plain[id] = types }
+        [observations, @poisoned_params.to_a]
+      end
+
+      # Merges the per-slice contributions into the round's table. Associative and order-preserving, so the
+      # result is identical to a sequential single-slice run: a parameter is poisoned if ANY slice poisoned
+      # it, its observations are the file-order concatenation across slices, and the {MAX_CALL_SITE_TYPES}
+      # cap re-applies over the merged total (a per-slice sub-cap can undercount, so the parent enforces the
+      # real cap — the same "poisoned" outcome the sequential mid-stream cap reaches).
+      def merge_round(contributions)
+        poisoned = contributions.each_with_object(Set.new) { |(_obs, pois), set| set.merge(pois) }
+        observations = {}
+        contributions.each do |(obs, _pois)|
+          obs.each do |id, types|
+            (observations[id] ||= []).concat(types) unless poisoned.include?(id)
+          end
+        end
+        observations.each { |id, types| poisoned << id if types.length > MAX_CALL_SITE_TYPES }
+        finalize(observations, poisoned)
       end
 
       # A scope carrying the cross-file discovery index (so `Foo.new` receivers and
@@ -343,13 +386,15 @@ module Rigor
         @type_observations.delete(id)
       end
 
-      def finalize
+      # Builds the round's frozen `[class, method, kind] => {param => Type}` table from the merged
+      # observations and poisoned set.
+      def finalize(merged_observations, poisoned)
         # `result` is a default-block Hash (not a `{}` literal) so the analyzer types its reads
         # generically rather than folding the empty shape — the nesting writes stay plain
         # assignments, no literal-fold conditions.
         result = Hash.new { |hash, key| hash[key] = {} }
-        @type_observations.each do |id, observations|
-          next if @poisoned_params.include?(id)
+        merged_observations.each do |id, observations|
+          next if poisoned.include?(id)
           next if observations.empty?
 
           union = Type::Combinator.union(*observations)