rigortype 0.2.8 → 0.3.0

data/lib/rigor/inference/statement_evaluator.rb

@@ -6,10 +6,12 @@ require_relative "../reflection"
 require_relative "../type"
 require_relative "../analysis/fact_store"
 require_relative "../source/node_walker"
+require_relative "../source/node_children"
 require_relative "../source/constant_path"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
 require_relative "dynamic_origin"
+require_relative "../analysis/check_rules/inferred_param_guard"
 require_relative "struct_fold_safety"
 require_relative "closure_escape_analyzer"
 require_relative "indexed_narrowing"
@@ -187,6 +189,16 @@ module Rigor
         [@scope.type_of(node, tracer: @tracer), @scope]
       end
 
+      # ADR-89 WD2 — the sorted positions of the positional parameters whose CONTENT `def_node` mutates
+      # (`callee_content_mutated_parameters`, the ADR-56 arg-flooring surface a caller consumes). A per-def
+      # static property of the AST — this is a pure exposure of the existing private computation (it never
+      # reads the scope), so the incremental session can compute it on any `StatementEvaluator` (an empty
+      # scope suffices), persist it in a return summary, and re-check a callee's symbol dependents when it
+      # moves (a caller's arg flooring changes even if the callee's return does not).
+      def content_mutated_parameter_positions(def_node)
+        callee_content_mutated_parameters(def_node).values.uniq.sort
+      end
+
       private
 
       attr_reader :scope, :tracer
@@ -224,6 +236,16 @@ module Rigor
         end
 
         bound = post_rhs.with_local(node.name, rhs_type)
+        # ADR-67 WD6b — a local whose RHS is (transitively) rooted at an inferred parameter inherits the
+        # "inferred, not declared" mark, so a subsequent use of the local declines the negative rules for the
+        # same lower-bound reason (`vindex = codepoints[i] - x; vindex < y`). The mark is STICKY across
+        # narrowing/joins (see `Scope#without_inferred_param_mark`), so a genuine rewrite from a non-param RHS
+        # must clear it here. No-op unless the `parameter_inference:` gate seeded a parameter this RHS reaches.
+        if Analysis::CheckRules::InferredParamGuard.rooted?(node.value, scope)
+          return [rhs_type, bound.with_inferred_param_mark(node.name)]
+        end
+
+        bound = bound.without_inferred_param_mark(node.name)
         bound = bound.with_local_origin(node.name, rhs_origin(node.value, post_rhs, rhs_type))
         [rhs_type, bound]
       end
@@ -748,7 +770,14 @@ module Rigor
                         node.is_a?(Prism::ModuleNode) ||
                         node.is_a?(Prism::BlockNode)
 
-        node.compact_child_nodes.any? { |c| arm_contains_retry?(c) }
+        found = false
+        node.rigor_each_child do |c|
+          next unless arm_contains_retry?(c)
+
+          found = true
+          break
+        end
+        found
       end
 
       def absorb_retry_rebinds(accumulator, entry_scope, arm_post_scope)
@@ -936,7 +965,7 @@ module Rigor
         return if node.nil?
 
         found[node] = true if node.is_a?(Prism::BreakNode)
-        node.compact_child_nodes.each do |child|
+        node.rigor_each_child do |child|
           next if BREAK_BOUNDARY_NODES.any? { |klass| child.is_a?(klass) }
 
           collect_direct_breaks(child, found)
@@ -1322,6 +1351,13 @@ module Rigor
         # (e.g. `arms << x`, `@tags << hashtag`). Stops a literal-shape carrier (`Tuple` / `HashShape`) from outliving
         # its justification when the value is mutated. Always-safe (loses precision, never invents facts).
         post_scope = MutationWidening.widen_after_call(call_node: node, current_scope: post_scope)
+        # ADR-48 slice 4 — Struct member-setter re-typing. After `s.x = v` on a fold-safe StructInstance local, rebind
+        # `s` to a StructInstance with member `:x` replaced by the assigned type, so a later `s.x` folds to `v` and a
+        # sibling `s.y` stays precise. `call_type` is the setter's own result (the assigned value type). Sound only for
+        # a fold-safe local (never aliased / escaped, straight-line setters) — the fold-safe scan is the gate.
+        post_scope = MethodDispatcher::StructFolding.apply_setter_writeback(
+          call_node: node, assigned_type: call_type, scope: post_scope
+        )
         # ADR-57 slice 3 work-item 1 (cross-method-boundary variant). When a self-call resolves to a user method that
         # CONTENT-mutates one of its parameters inside an escaping block (the `build_option_parser(opts)` idiom — the
         # callee returns an `OptionParser` whose `opts.on { o[:k] = v }` blocks close over the passed-in hash), floor
@@ -1624,9 +1660,9 @@ module Rigor
       def collect_gated_statement_contributions(index, relevant, name, call_node, current_scope)
         result = nil
         relevant.each do |plugin|
-          next unless index.type_specifier_candidate_for?(plugin, name)
+          next unless index.narrowing_facts_candidate_for?(plugin, name)
 
-          facts = plugin.type_specifier_facts(call_node: call_node, scope: current_scope)
+          facts = plugin.narrowing_facts_for(call_node: call_node, scope: current_scope)
           (result ||= []) << Rigor::FlowContribution.new(post_return_facts: facts) if facts && !facts.empty?
         rescue StandardError
           next
@@ -1825,10 +1861,19 @@ module Rigor
         def_node = resolve_self_callee_def(node)
         return base_scope if def_node.nil?
 
-        escaped = escaped_content_parameters(def_node)
-        return base_scope if escaped.empty?
+        mutated = callee_content_mutated_parameters(def_node)
+        return base_scope if mutated.empty?
+
+        floor_arguments_at_positions(node, mutated, base_scope)
+      end
 
-        floor_arguments_at_positions(node, escaped, base_scope)
+      # The `{ name => position }` positional parameters whose content the callee mutates, from either channel: those
+      # escape-mutated inside a block (which may run later / repeatedly) AND those mutated directly in the method body
+      # during the call itself (`declaration[:prefix] = v`). Both leave the caller's argument binding stale after the
+      # call, so both floor it. Memoised per def node (the merge is otherwise recomputed at every call site).
+      def callee_content_mutated_parameters(def_node)
+        cache = (@callee_mutated_param_cache ||= {}.compare_by_identity)
+        cache[def_node] ||= escaped_content_parameters(def_node).merge(direct_content_parameters(def_node))
       end
 
       # The user def a self-dispatch `node` resolves to in the enclosing class, or nil. Reuses the discovery index
@@ -1872,6 +1917,42 @@ module Rigor
         positions.slice(*mutated)
       end
 
+      # The `{ name => position }` positional parameters whose CONTENT the callee mutates directly in its method body —
+      # a top-level `param[k] = v` / `param << x`, outside a nested block. Memoised per def node. The block-nested case
+      # is `escaped_content_parameters`'s job; walking only outside nested blocks / defs / lambdas here means a matching
+      # parameter-name read is genuinely at method scope (depth 0) rather than a block-local of the same name that
+      # merely shadows the parameter — so we never floor a caller argument the callee did not actually mutate.
+      def direct_content_parameters(def_node)
+        cache = (@direct_param_cache ||= {}.compare_by_identity)
+        cache[def_node] ||= compute_direct_content_parameters(def_node)
+      end
+
+      def compute_direct_content_parameters(def_node)
+        positions = positional_parameter_positions(def_node)
+        return {} if positions.empty?
+
+        mutated = Set.new
+        each_node_outside_nested_scopes(def_node.body) do |descendant|
+          name, = content_mutation_target(descendant) { |r| r.is_a?(Prism::LocalVariableReadNode) && r.depth.zero? }
+          mutated << name if !name.nil? && positions.key?(name)
+        end
+        positions.slice(*mutated)
+      end
+
+      # Yields every node reachable from `body` without crossing into a nested block / def / lambda — i.e. the nodes
+      # that execute in the method's own scope. A local-variable read found here has depth 0 relative to the method, so
+      # a content mutation whose receiver is a positional-parameter name is a genuine mutation of that parameter.
+      def each_node_outside_nested_scopes(node, &)
+        return if node.nil?
+
+        yield node
+        node.rigor_each_child do |child|
+          next if child.is_a?(Prism::BlockNode) || child.is_a?(Prism::DefNode) || child.is_a?(Prism::LambdaNode)
+
+          each_node_outside_nested_scopes(child, &)
+        end
+      end
+
       # A receiver-independent over-approximation of `ClosureEscapeAnalyzer`'s non-escaping verdict, used when scanning
       # a callee body where the block- owning call's receiver TYPE is not available. A call whose method name is a known
       # structural iterator (`each` / `map` / `tap` / …) runs its block synchronously and does not retain it, so its
@@ -2435,7 +2516,7 @@ module Rigor
         sub_eval(node.body, fresh, class_context: new_context)
       end
 
-      def build_method_entry_scope(def_node)
+      def build_method_entry_scope(def_node) # rubocop:disable Metrics/AbcSize
         singleton = singleton_def?(def_node)
         binder = MethodParameterBinder.new(
           environment: scope.environment,
@@ -2447,8 +2528,11 @@ module Rigor
         # ADR-67 WD3 — override an undeclared parameter with its call-site inferred type (precision-additive; an
         # RBS-declared parameter wins, the table is empty on a normal `check` run). The inferred type lives only as a
         # body local, never as an RBS contract, so it cannot fire a parameter-boundary diagnostic (WD1, satisfied by
-        # construction).
-        bindings = seed_inferred_param_types(bindings, def_node, singleton)
+        # construction). WD6b — the second element is the set of parameters this seed overrode, stamped with
+        # the "inferred, not declared" provenance mark at bind time so the in-body rules can decline on them.
+        seeded = seed_inferred_param_types(bindings, def_node, singleton)
+        bindings = seeded.fetch(0)
+        inferred_names = seeded.fetch(1)
 
         # Method bodies do NOT see the outer scope's locals. They start from a fresh scope with the same environment,
         # then receive the parameter bindings. Slice 7 phase 2: instance defs ALSO seed their `ivars` map from the
@@ -2466,7 +2550,7 @@ module Rigor
             def_node.body, ->(name) { scope.struct_member_layout(name)&.[](:members) }
           )
         )
-        bindings.reduce(fresh) { |acc, (name, type)| bind_param(acc, name, type) }
+        bindings.reduce(fresh) { |acc, (name, type)| bind_param(acc, name, type, inferred_names) }
       end
 
       # ADR-82 root-enrichment — bind a method parameter, and for an *undeclared* (untyped) parameter seed its
@@ -2475,8 +2559,14 @@ module Rigor
       # route to parameter inference rather than reporting no cause at all. Reuses the WD1 `local_origins`
       # channel, so WD6 then carries the cause through any chain rooted at the parameter (`x.foo.bar`). An
       # RBS-declared / call-site-inferred parameter (a non-untyped binding) keeps no origin — it is not a hole.
-      def bind_param(acc, name, type)
+      #
+      # ADR-67 WD6b — a parameter the call-site inference seed overrode (`inferred_names`) is stamped with the
+      # "inferred, not declared" provenance mark instead: its type is a concrete (non-untyped) lower bound, so it
+      # is not an `inferred_return_untyped` hole, but the negative in-body rules must still decline on it (the
+      # union is open, so firing is an FP by construction). The mark drops on any flow-live rewrite of the local.
+      def bind_param(acc, name, type, inferred_names = nil)
         bound = acc.with_local(name, type)
+        return bound.with_inferred_param_mark(name) if inferred_names&.include?(name)
         return bound unless untyped_binding?(type)
 
         bound.with_local_origin(name, DynamicOrigin::INFERRED_RETURN_UNTYPED)
@@ -2489,19 +2579,23 @@ module Rigor
       # seed is byte-identical there.
       def seed_inferred_param_types(bindings, def_node, singleton)
         inferred = scope.param_inferred_types
-        return bindings if inferred.empty?
+        return [bindings, nil] if inferred.empty?
 
         path = current_class_path
-        return bindings if path.nil?
+        return [bindings, nil] if path.nil?
 
         table = inferred[[path, def_node.name, singleton ? :singleton : :instance]]
-        return bindings if table.nil? || table.empty?
+        return [bindings, nil] if table.nil? || table.empty?
 
         merged = bindings.dup
+        overridden = nil
         table.each do |name, type|
-          merged[name] = type if merged.key?(name) && untyped_binding?(merged[name])
+          next unless merged.key?(name) && untyped_binding?(merged[name])
+
+          merged[name] = type
+          (overridden ||= Set.new) << name
         end
-        merged
+        [merged, overridden]
       end
 
       # True for the `Dynamic[Top]` carrier `MethodParameterBinder` leaves on an undeclared parameter — the only

data/lib/rigor/inference/struct_fold_safety.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "../source/constant_path"
+require_relative "../source/node_children"
 
 module Rigor
   module Inference
@@ -59,11 +60,18 @@ module Rigor
         return EMPTY if members.empty?
 
         total = Hash.new(0)
-        pure = Hash.new(0)
-        count_uses(root, members, total, pure)
-
+        safe_uses = Hash.new(0)
+        deferred_setter = {}
+        count_uses(root, members, total, safe_uses, deferred_setter, false)
+
+        # A local is fold-safe iff every read of it is a safe use — a pure read OR (ADR-48 slice 4) a
+        # straight-line member setter (`n.x = v`) that the setter write-back re-types the binding for.
+        # `deferred_setter` disqualifies a local whose setter sits inside a loop / block / lambda, where a
+        # single static pass cannot model the setter's per-iteration effect (the write-back would leave a
+        # stale binding for the fold to read).
         safe = members.each_key.select do |name|
-          writes[name] == 1 && total[name].positive? && total[name] == pure[name]
+          writes[name] == 1 && total[name].positive? &&
+            total[name] == safe_uses[name] && !deferred_setter[name]
         end
         safe.empty? ? EMPTY : safe.to_set
       end
@@ -84,22 +92,30 @@ module Rigor
         end
       end
 
-      # Pass 2 — count, per recorded struct local, total reads vs. reads that are the receiver of a pure-read call.
-      def count_uses(node, members, total, pure)
+      # Pass 2 — count, per recorded struct local, total reads vs. SAFE-use reads (the receiver of a pure-read call,
+      # or of a straight-line member setter). `deferred` is true inside a loop / block / lambda; a member setter seen
+      # there marks the local's `deferred_setter` so it is excluded (its write-back cannot be modelled statically).
+      def count_uses(node, members, total, safe_uses, deferred_setter, deferred)
         return if node.nil?
 
         total[node.name] += 1 if node.is_a?(Prism::LocalVariableReadNode) && members.key?(node.name)
 
         if node.is_a?(Prism::CallNode)
           receiver = node.receiver
-          if receiver.is_a?(Prism::LocalVariableReadNode) && members.key?(receiver.name) &&
-             pure_read_call?(node, members[receiver.name])
-            pure[receiver.name] += 1
+          if receiver.is_a?(Prism::LocalVariableReadNode) && members.key?(receiver.name)
+            member_set = members[receiver.name]
+            if pure_read_call?(node, member_set)
+              safe_uses[receiver.name] += 1
+            elsif member_setter_call?(node, member_set)
+              safe_uses[receiver.name] += 1
+              deferred_setter[receiver.name] = true if deferred
+            end
           end
         end
 
+        child_deferred = deferred || deferred_boundary?(node)
         each_local_scope_child(node) do |child|
-          count_uses(child, members, total, pure)
+          count_uses(child, members, total, safe_uses, deferred_setter, child_deferred)
         end
       end
 
@@ -110,6 +126,27 @@ module Rigor
         FIXED_READS.include?(name) || member_set.include?(name)
       end
 
+      # A `n.<member> = v` attribute setter on the receiver (ADR-48 slice 4): the selector strips its trailing `=` to
+      # a member reader and the call carries exactly one argument. Comparison operators (`==`, `>=`, `!=`) also end
+      # with `=` but never strip to a member, so they stay unknown (unsafe) calls. `:[]=` is likewise not a member.
+      def member_setter_call?(call_node, member_set)
+        name = call_node.name.to_s
+        return false unless name.length > 1 && name.end_with?("=")
+        return false unless member_set.include?(name[0..-2].to_sym)
+
+        (call_node.arguments&.arguments&.size || 0) == 1
+      end
+
+      # Constructs whose body runs zero-or-many times or is deferred (loops, blocks, lambdas): a single static pass
+      # over the body cannot model a member setter's effect across iterations, so a setter inside one disqualifies the
+      # local. Straight-line conditionals (`if` / `unless` / `case`) are NOT boundaries — their branch scopes join
+      # soundly, so a setter in one branch is fine.
+      def deferred_boundary?(node)
+        node.is_a?(Prism::WhileNode) || node.is_a?(Prism::UntilNode) ||
+          node.is_a?(Prism::ForNode) || node.is_a?(Prism::BlockNode) ||
+          node.is_a?(Prism::LambdaNode)
+      end
+
       # The member set of a `<Struct chain>.new(...)` / `.[]` materialisation, or nil. Handles the inline
       # `Struct.new(:a, :b).new(...)` form and the `Const.new(...)` form (resolved through the layout side-table).
       def struct_materialization_members(value_node, layout_lookup)
@@ -156,7 +193,7 @@ module Rigor
       # Yields each child to recurse into, skipping the subtree of a nested local-variable-scope boundary (a `def` /
       # `class` / `module`).
       def each_local_scope_child(node)
-        node.compact_child_nodes.each do |child|
+        node.rigor_each_child do |child|
           next if scope_boundary?(child)
 
           yield child

data/lib/rigor/inference/synthetic_method_scanner.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../plugin/macro/heredoc_template"
 require_relative "../plugin/macro/trait_registry"
 require_relative "../source/literals"
+require_relative "../source/node_children"
 require_relative "synthetic_method"
 require_relative "synthetic_method_index"
 
@@ -166,12 +167,12 @@ module Rigor
           name = class_name_from(node, scope_stack)
           yield name, node if name
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_classes(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_classes(child, new_stack, &) }
         when Prism::ModuleNode
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_classes(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_classes(child, new_stack, &) }
         else
-          node.compact_child_nodes.each { |child| walk_classes(child, scope_stack, &) }
+          node.rigor_each_child { |child| walk_classes(child, scope_stack, &) }
         end
       end
 
@@ -303,12 +304,12 @@ module Rigor
           name = class_name_from(node, scope_stack)
           yield name, node.body
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_module_decls(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_module_decls(child, new_stack, &) }
         when Prism::ClassNode
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_module_decls(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_module_decls(child, new_stack, &) }
         else
-          node.compact_child_nodes.each { |child| walk_module_decls(child, scope_stack, &) }
+          node.rigor_each_child { |child| walk_module_decls(child, scope_stack, &) }
         end
       end
 
@@ -372,7 +373,7 @@ module Rigor
         hierarchy.freeze
       end
 
-      def walk_class_decls(node, scope_stack, &) # rubocop:disable Metrics/PerceivedComplexity
+      def walk_class_decls(node, scope_stack, &)
         return unless node.respond_to?(:compact_child_nodes)
 
         if node.is_a?(Prism::ClassNode)
@@ -380,19 +381,19 @@ module Rigor
           parent = parent_name_from(node, scope_stack)
           yield name, parent if name
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_class_decls(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_class_decls(child, new_stack, &) }
         elsif node.is_a?(Prism::ModuleNode)
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_class_decls(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_class_decls(child, new_stack, &) }
         else
-          node.compact_child_nodes.each { |child| walk_class_decls(child, scope_stack, &) }
+          node.rigor_each_child { |child| walk_class_decls(child, scope_stack, &) }
         end
       end
 
       # Yields `(class_name, call_node)` for every Prism::CallNode at class-body top level (singleton-context calls).
       # Nested method bodies, blocks, and conditionals are skipped — the Tier C call shapes the substrate targets all
       # live at the class body's top level.
-      def walk_class_bodies(node, scope_stack = [], &) # rubocop:disable Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+      def walk_class_bodies(node, scope_stack = [], &)
         return unless node.respond_to?(:compact_child_nodes)
 
         if node.is_a?(Prism::ClassNode)
@@ -403,12 +404,12 @@ module Rigor
               yield name, stmt if stmt.is_a?(Prism::CallNode) && stmt.receiver.nil?
             end
           end
-          node.body&.compact_child_nodes&.each { |child| walk_class_bodies(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_class_bodies(child, new_stack, &) }
         elsif node.is_a?(Prism::ModuleNode)
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_class_bodies(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_class_bodies(child, new_stack, &) }
         else
-          node.compact_child_nodes.each { |child| walk_class_bodies(child, scope_stack, &) }
+          node.rigor_each_child { |child| walk_class_bodies(child, scope_stack, &) }
         end
       end
 

data/lib/rigor/inference/void_origin.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    # ADR-100 WD3 — the resolved `-> void` origin site recorded in {Rigor::Scope#void_origins}. A small cause
+    # record, never a carrier field: it says *which* author-declared `-> void` return was recovered to `top`
+    # at a use site, so the `static.value-use.void` diagnostic can name it. Mirrors the provenance-as-
+    # side-channel discipline {DynamicOrigin} established (ADR-75) — it never participates in subtyping,
+    # consistency, normalization, or erasure.
+    #
+    # @!attribute class_name
+    #   @return [String] the receiver class whose method declared `-> void`.
+    # @!attribute method_name
+    #   @return [Symbol] the method whose return was recovered.
+    # @!attribute kind
+    #   @return [Symbol] `:instance` or `:singleton`.
+    VoidOrigin = Data.define(:class_name, :method_name, :kind) do
+      # A human-facing `Class#method` / `Class.method` label for the diagnostic message.
+      def label
+        separator = kind == :singleton ? "." : "#"
+        "#{class_name}#{separator}#{method_name}"
+      end
+    end
+  end
+end