rigortype 0.2.9 → 0.3.0

data/lib/rigor/inference/method_dispatcher/data_folding.rb

@@ -11,9 +11,11 @@ module Rigor
       # and degrading to today's behaviour (no carrier / the `Data` nominal) the moment a premise is
       # uncertain, so the tier is precision-additive and adds no false-positive surface:
       #
-      # 1. `Data.define(:x, :y)` on a `Singleton[Data]` receiver with literal-Symbol args and NO block ->
-      #    `DataClass{members: [...]}`. A block (`Data.define(:x) do ... end`) defers (slice 4 hardens the
-      #    block-body case); non-literal members (`Data.define(*names)`) defer.
+      # 1. `Data.define(:x, :y)` on a `Singleton[Data]` receiver with literal-Symbol args ->
+      #    `DataClass{members: [...]}`. A `do ... end` block folds too when its body redefines no member
+      #    reader (bare-local block-form parity — the block AST stands in for the class name the read-time
+      #    guard would otherwise need); a `&proc` block, a reader-redefining block, or non-literal members
+      #    (`Data.define(*names)`) defer.
       # 2. `.new` / `.[]` on a `DataClass` receiver -> a `DataInstance` whose member map is built from the
       #    call's positional or keyword arguments. An arity / key mismatch degrades to the `Data` (or the
       #    tagged class) nominal rather than a wrong member map.
@@ -63,12 +65,32 @@ module Rigor
 
         def fold_define(context)
           return nil unless context.method_name == :define
-          # Block-form (`Data.define(:x) do ... end`) defers — slice 4.
-          return nil unless context.block_type.nil?
 
           members = member_names_from_args(context.args)
           return nil if members.nil? || members.empty?
 
+          # Block-form (`Data.define(:x) do ... end`) bare-local parity (ADR-48 "Remaining"): the assigned
+          # constant / subclass forms already fold via the layout side-table, with the reader-redefinition
+          # guard consulting `Scope#user_def_for`; the bare-local form has no resolvable class name for it
+          # to key on. But the block AST is in hand, so the guard is applied directly against it: fold when
+          # the block redefines no member's synthesised reader (folding `inst.x` would otherwise run the
+          # redefined `def x`), and bail conservatively — the prior behaviour — the moment the block cannot
+          # be soundly cleared (a `&proc` argument, or any `def <member>` in the body).
+          return fold_define_block(context, members) unless context.block_type.nil?
+
+          Type::Combinator.data_class_of(members: members)
+        end
+
+        # The block-form fold decision. Only a literal `do ... end` block whose body redefines no member
+        # reader folds; a `&proc` block argument (no scannable body) or a body with a member-reader `def`
+        # stays unfolded. The resulting `DataClass` carries no `class_name` — folding is already proven
+        # reader-safe here, so the read-time `reader_overridden?` guard (which keys on the class name) has
+        # nothing left to catch.
+        def fold_define_block(context, members)
+          block = context.call_node&.block
+          return nil unless block.is_a?(Prism::BlockNode)
+          return nil if block_redefines_member_reader?(block, members)
+
           Type::Combinator.data_class_of(members: members)
         end
 
@@ -126,6 +148,9 @@ module Rigor
           shape = args.first
           return nil unless shape.is_a?(Type::HashShape) && shape.closed?
           return nil unless shape.optional_keys.empty?
+          # Non-Symbol keys (a HashShape may carry String / numeric / bool / nil scalar keys) can never
+          # match the Symbol member list — and mixed-class keys would make the `.sort` below raise.
+          return nil unless shape.pairs.keys.all?(Symbol)
           return nil unless shape.pairs.keys.sort == members.sort
 
           members.to_h { |name| [name, shape.pairs.fetch(name)] }

data/lib/rigor/inference/method_dispatcher/kernel_dispatch.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../../type"
+require_relative "constant_folding"
 
 module Rigor
   module Inference
@@ -24,9 +25,27 @@ module Rigor
       #
       # See `docs/type-specification/value-lattice.md` for the union-distribution contract this tier
       # mirrors.
+      #
+      # ADR-91 — this tier is the single owner of the `Kernel` module-function fold surface, covering
+      # the conversion/identity folds (`Array` / `Integer` / `Float` / `Rational` / `Complex` / `p` /
+      # `pp` / `String` / `Hash`) AND the `format` / `sprintf` template fold (moved here from
+      # `LiteralStringFolding` in ADR-91 WD2 — `String#%` stays there as a receiver-typed String
+      # method). Ownership gating no longer happens per-fold: the dispatcher consults this tier only
+      # when `context.method_name` is in {INTRINSIC_NAMES} and {kernel_owned_call?} passes (ADR-91
+      # WD1), so a fold body never re-derives the guard. Callers reaching `try_dispatch` directly
+      # (internal dispatcher, unit probes) vouch for ownership themselves.
       module KernelDispatch
         module_function
 
+        # ADR-91 WD1 — the compiled method-name surface of Kernel's foldable module functions. The
+        # dispatcher gates on membership here before consulting the tier, and the WD3 parity spec
+        # derives its case list from this same table so a fold added without an entry never runs and
+        # every entry is spelling-parity checked. Public (not private_constant) and Ractor-shareable
+        # because the gate and the spec both read it.
+        INTRINSIC_NAMES = Ractor.make_shareable(
+          Set[:Array, :Integer, :Float, :Rational, :Complex, :p, :pp, :String, :Hash, :format, :sprintf]
+        )
+
         # `Kernel#Rational` / `Kernel#Complex` constructor folds. When every argument is a `Type::Constant`
         # whose value is numeric, we can run the actual Ruby constructor and lift the result into a
         # `Constant<Rational>` / `Constant<Complex>`. The factory accepts the same shapes as Ruby:
@@ -49,6 +68,26 @@ module Rigor
         INTEGER_REFINEMENT_PREDICATES = Set[:decimal_int].freeze
         private_constant :INTEGER_REFINEMENT_PREDICATES
 
+        # `Kernel#p` / `Kernel#pp` return their argument: one argument comes back verbatim, several come
+        # back as an Array of them, zero returns nil. The zero-arg form declines here (the RBS `nil` is
+        # already exact); the 1-arg form is a precision-PRESERVING identity (the argument type passes
+        # through unchanged — shapes, constants, and `Dynamic` alike); the n-arg form is a `Tuple`.
+        IDENTITY_PRINTERS = Set[:p, :pp].freeze
+        private_constant :IDENTITY_PRINTERS
+
+        # `Kernel#format` / `Kernel#sprintf` — a String-template fold moved here from
+        # `LiteralStringFolding` in ADR-91 WD2 so every Kernel module-function fold sits behind the
+        # WD1 gate.
+        FORMAT_METHODS = Set[:format, :sprintf].freeze
+        private_constant :FORMAT_METHODS
+
+        # Value classes `Kernel#String` folds over. Each is a literal-carrier class whose `to_s` is a
+        # deterministic pure function of the value, so running the real `String()` at fold time is sound.
+        STRING_SAFE_CLASSES = [
+          String, Symbol, Integer, Float, Rational, Complex, NilClass, TrueClass, FalseClass
+        ].freeze
+        private_constant :STRING_SAFE_CLASSES
+
         def try_dispatch(context)
           receiver = context.receiver
           method_name = context.method_name
@@ -58,10 +97,171 @@ module Rigor
           return try_numeric_constructor(method_name, args) if NUMERIC_CONSTRUCTORS.key?(method_name)
           return try_integer(args) if method_name == :Integer
           return try_float(args) if method_name == :Float
+          return try_identity_printer(context) if IDENTITY_PRINTERS.include?(method_name)
+          return try_string(context) if method_name == :String
+          return try_hash(context) if method_name == :Hash
+          return try_format(context) if FORMAT_METHODS.include?(method_name)
+
+          nil
+        end
+
+        # `Kernel#p(x)` / `Kernel#pp(x)` identity typing. Runtime contract: `p x` returns `x`, `p a, b`
+        # returns `[a, b]`, bare `p` returns nil. The 1-arg path returns the argument's type object
+        # UNCHANGED — never widened, never concretized (a `Dynamic` argument stays `Dynamic`) — so a
+        # `p`-wrapped expression is transparent to downstream inference. The n-arg path materialises the
+        # positional types as a `Tuple`. The 0-arg path declines (RBS `nil` is already exact).
+        #
+        # FP envelope: declines on a splat / forwarding argument (the runtime arity — and hence
+        # 1-arg-identity vs n-arg-Array — is not statically known). Ownership is gated once at the
+        # dispatcher (ADR-91 WD1), so this body no longer re-checks {#kernel_owned_call?}.
+        def try_identity_printer(context)
+          args = context.args
+          return nil if args.empty?
+          return nil if unresolved_argument_arity?(context.call_node)
+          return args.first if args.size == 1
+
+          Type::Combinator.tuple_of(*args)
+        end
+
+        # `Kernel#String(v)` — folds a value-pinned scalar `Constant` to `Constant[String]`
+        # (`String(42)` → `"42"`, `String(nil)` → `""`). Restricted to {STRING_SAFE_CLASSES} so the fold
+        # never models a user-defined `to_s` / `to_str`; anything else declines to the RBS `String`.
+        def try_string(context)
+          args = context.args
+          return nil unless args.size == 1
+          return nil if unresolved_argument_arity?(context.call_node)
+
+          arg = args.first
+          return nil unless arg.is_a?(Type::Constant)
+          return nil unless STRING_SAFE_CLASSES.any? { |klass| arg.value.instance_of?(klass) }
 
+          Type::Combinator.constant_of(String(arg.value))
+        rescue StandardError
           nil
         end
 
+        # `Kernel#Hash(v)` — the trivially-sound slice only. A `HashShape` argument passes through
+        # unchanged (`Hash(h)` returns `h` for a real Hash); `Hash(nil)` and `Hash([])` (an empty Tuple)
+        # collapse to the empty `HashShape`. Arguments relying on the `to_hash` protocol are not decidable
+        # from types alone and decline to the RBS envelope.
+        def try_hash(context)
+          args = context.args
+          return nil unless args.size == 1
+          return nil if unresolved_argument_arity?(context.call_node)
+
+          case (arg = args.first)
+          when Type::HashShape then arg
+          when Type::Constant then arg.value.nil? ? Type::Combinator.hash_shape_of({}) : nil
+          when Type::Tuple then arg.elements.empty? ? Type::Combinator.hash_shape_of({}) : nil
+          end
+        end
+
+        # `Kernel#format("hello %s", lit)` / `Kernel#sprintf(...)` — moved here from
+        # `LiteralStringFolding` in ADR-91 WD2 so it sits behind the WD1 ownership gate with every
+        # other Kernel module-function fold. The template plus every value argument must be
+        # literal-bearing ({Type::Combinator.literal_string_compatible?}) or a `Type::Constant` of
+        # any value (Constants are always provably literal). The template arg specifically must be
+        # literal-bearing — a `Constant<Integer>` first arg would not be a valid format template, so
+        # the `Type::Constant` allowance applies only to subsequent value args.
+        #
+        # When the template AND every value argument are value-pinned `Constant`s, the fold sharpens
+        # to the exact `Constant[String]` (`format("%d", 1)` → `"1"`) — the module-function sibling
+        # of `ConstantFolding#try_fold_string_format`'s `String#%` fold. This is a strict refinement
+        # inside the same firing envelope: every exact-foldable input was already lifted to
+        # `literal-string`. Ownership is gated at the dispatcher, so the fold itself needs no check.
+        def try_format(context)
+          args = context.args
+          return nil if args.empty?
+
+          exact = fold_format_constant(args)
+          return exact if exact
+          return nil unless Type::Combinator.literal_string_compatible?(args.first)
+          return nil unless args.drop(1).all? { |arg| literal_or_constant?(arg) }
+
+          Type::Combinator.literal_string
+        end
+
+        # Runs the real `Kernel#format` when everything is value-pinned. A malformed directive or an
+        # argument-count mismatch raises at fold time; the handler declines so the literal-string
+        # lift (or the RBS `String` envelope) answers instead. Results larger than the shared
+        # `ConstantFolding::STRING_FOLD_BYTE_LIMIT` decline too, keeping the carrier-size convention.
+        def fold_format_constant(args)
+          return nil unless args.all?(Type::Constant)
+          return nil unless args.first.value.is_a?(String)
+
+          result = format(args.first.value, *args.drop(1).map(&:value))
+          return nil if result.bytesize > ConstantFolding::STRING_FOLD_BYTE_LIMIT
+
+          Type::Combinator.constant_of(result)
+        rescue StandardError
+          nil
+        end
+
+        # KernelDispatch's own copy of the literal-or-Constant predicate (LiteralStringFolding keeps
+        # its own for the `String#%` fold that stayed there).
+        def literal_or_constant?(type)
+          Type::Combinator.literal_string_compatible?(type) || type.is_a?(Type::Constant)
+        end
+
+        # True when the call can be attributed to Kernel's own module function. Kernel's instance-side
+        # surface is PRIVATE, so a call with an explicit non-`self` receiver is a user-defined method —
+        # decline — EXCEPT the `Kernel` module object itself: `module_function` exposes every intrinsic
+        # as a public singleton too, so `Kernel.p(x)` / `Kernel.format(...)` dispatch to the same
+        # intrinsic as the implicit-self spelling. Likewise decline when the receiver class (or the
+        # toplevel) carries a discovered user redefinition of the name (`def p(node)` in a printer class
+        # must not be hijacked by the fold; the precise tiers run ahead of user-method inference). With
+        # no call_node / scope (internal dispatcher callers, unit probes) the guards pass — the caller
+        # vouches for the shape.
+        #
+        # ADR-91 WD1: the dispatcher calls this ONCE, before consulting the tier, so the fold bodies
+        # no longer re-check it. Kept public so the dispatcher (and unit probes) can reach it.
+        def kernel_owned_call?(context)
+          return false if user_redefined?(context)
+
+          !explicit_foreign_receiver?(context.call_node) || kernel_module_receiver?(context)
+        end
+
+        # The explicit-receiver spelling of a module function: the receiver TYPE is the `Kernel` module
+        # object itself. Typed (not node-spelled) so a user constant that happens to be named `Kernel`
+        # inside a namespace does not slip through.
+        def kernel_module_receiver?(context)
+          receiver = context.receiver
+          receiver.is_a?(Type::Singleton) && receiver.class_name == "Kernel"
+        end
+
+        def explicit_foreign_receiver?(call_node)
+          return false if call_node.nil?
+
+          receiver = call_node.receiver
+          !(receiver.nil? || receiver.is_a?(Prism::SelfNode))
+        end
+
+        def user_redefined?(context)
+          scope = context.scope
+          return false if scope.nil?
+
+          name = context.method_name
+          return true if scope.top_level_def_for(name)
+
+          case (receiver = context.receiver)
+          when Type::Nominal then scope.discovered_method?(receiver.class_name, name, :instance)
+          when Type::Singleton then scope.discovered_method?(receiver.class_name, name, :singleton)
+          else false
+          end
+        end
+
+        # True when the argument list carries a splat or an argument-forwarding node — the positional
+        # arity (and therefore which fold shape applies) is not statically known. `nil` call_node
+        # (internal callers) reads as resolved: the args array is authoritative there.
+        def unresolved_argument_arity?(call_node)
+          arguments = call_node&.arguments
+          return false if arguments.nil?
+
+          arguments.arguments.any? do |argument|
+            argument.is_a?(Prism::SplatNode) || argument.is_a?(Prism::ForwardingArgumentsNode)
+          end
+        end
+
         # `Kernel#Integer(arg)` / `Integer(arg, base)`. Two folding paths, tried in order:
         #
         # 1. A `Refined[String, predicate]` argument whose predicate is a total-parse carrier narrows to

data/lib/rigor/inference/method_dispatcher/literal_string_folding.rb

@@ -15,8 +15,9 @@ module Rigor
       #   size cap).
       # - `Array#join` on `Tuple[…]` receivers whose every element plus the separator argument (when given)
       #   is literal-bearing.
-      # - `Kernel#format` / `Kernel#sprintf` (any receiver) and `String#%` (literal-bearing receiver) when
-      #   every value argument is literal-bearing or a Type::Constant of any value.
+      # - `String#%` (literal-bearing receiver) when every value argument is literal-bearing or a
+      #   Type::Constant of any value. (`Kernel#format` / `Kernel#sprintf` moved to {KernelDispatch} in
+      #   ADR-91 WD2 — they are Kernel module functions, not receiver-typed String methods.)
       #
       # Result rule:
       #
@@ -38,7 +39,6 @@ module Rigor
         module_function
 
         CONCAT_METHODS = %i[+ << concat].freeze
-        FORMAT_METHODS = %i[format sprintf].freeze
         # v0.1.1 Track 1 slice 5a — methods that, called with no arguments on a literal-bearing receiver,
         # return a value that is also literal-bearing. `#strip` / `#lstrip` / `#rstrip` / `#chomp` (no-arg)
         # / `#chop` strip a known subset of characters from the ends, so the survivors are always a
@@ -55,7 +55,7 @@ module Rigor
         # Integer plus an optional literal padding `String`. When the receiver and the (default or
         # supplied) padding are both literal-bearing, the result is literal-bearing too.
         WIDTH_PADDING_METHODS = %i[center ljust rjust].freeze
-        private_constant :CONCAT_METHODS, :FORMAT_METHODS,
+        private_constant :CONCAT_METHODS,
                          :LITERAL_PRESERVING_METHODS, :NON_EMPTY_LITERAL_PRESERVING_METHODS,
                          :WIDTH_PADDING_METHODS
 
@@ -64,7 +64,6 @@ module Rigor
           method_name = context.method_name
           args = context.args
           return fold_array_join(receiver, args) if method_name == :join
-          return fold_format(args) if FORMAT_METHODS.include?(method_name)
           return nil unless Type::Combinator.literal_string_compatible?(receiver)
           return fold_string_percent(args) if method_name == :%
           return fold_no_arg(receiver, method_name) if args.empty?
@@ -140,21 +139,27 @@ module Rigor
           return nil unless receiver.elements.all? { |el| Type::Combinator.literal_string_compatible?(el) }
           return nil unless args.size <= 1
           return nil if args.size == 1 && !Type::Combinator.literal_string_compatible?(args.first)
+          # Defer to {ShapeDispatch}'s `tuple_join` when the precise `Constant<String>` fold is reachable —
+          # every element is a `Constant` and the separator is absent or a `Constant<String>`. This tier runs
+          # AHEAD of ShapeDispatch, so returning the generic `literal-string` here would shadow that strictly
+          # more precise result (`["a", "b"].join("-")` → `Constant<"a-b">` rather than `literal-string`).
+          # Mixed tuples that carry a non-`Constant` `literal-string` element keep folding to `literal-string`
+          # here, because no exact value is knowable for them.
+          return nil if constant_join_reachable?(receiver, args)
 
           Type::Combinator.literal_string
         end
 
-        # `format("hello %s", lit)` / `sprintf(...)` — template plus every value argument must be
-        # literal-bearing ({Type::Combinator.literal_string_compatible?}) or a `Type::Constant` of any
-        # value (Constants are always provably literal). The template arg specifically must be
-        # literal-bearing — a Constant<Integer> first arg would not be a valid format template, so the
-        # `Type::Constant` allowance applies only to subsequent value args.
-        def fold_format(args)
-          return nil if args.empty?
-          return nil unless Type::Combinator.literal_string_compatible?(args.first)
-          return nil unless args.drop(1).all? { |arg| literal_or_constant?(arg) }
+        # True when every tuple element is a `Constant` and the separator is absent or a `Constant<String>` —
+        # exactly the inputs for which `ShapeDispatch.tuple_join` materialises a precise `Constant<String>`.
+        # An empty tuple qualifies (`[].join` → `Constant<"">`). Callers have already verified every element
+        # is literal-string-compatible, so a `Constant` element is necessarily a `Constant<String>`.
+        def constant_join_reachable?(receiver, args)
+          return false unless receiver.elements.all?(Type::Constant)
+          return true if args.empty?
 
-          Type::Combinator.literal_string
+          arg = args.first
+          arg.is_a?(Type::Constant) && arg.value.is_a?(String)
         end
 
         # `"foo %s" % "x"` / `"foo %s" % ["x", "y"]` — receiver is the template (already verified
@@ -217,7 +222,8 @@ module Rigor
         end
 
         private_class_method :fold_no_arg, :fold_concat, :fold_repeat, :fold_array_join,
-                             :fold_format, :fold_string_percent, :fold_width_pad,
+                             :constant_join_reachable?,
+                             :fold_string_percent, :fold_width_pad,
                              :non_empty_literal_result, :literal_or_constant?,
                              :integer_typed?, :known_negative_integer?,
                              :known_zero_integer?, :known_positive_integer?

data/lib/rigor/inference/method_dispatcher/member_shape_projection.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
+require "prism"
+
 require_relative "../../type"
+require_relative "../../source/node_children"
 
 module Rigor
   module Inference
@@ -26,6 +29,36 @@ module Rigor
           !scope.user_def_for(class_name, method_name).nil?
         end
 
+        # The bare-local block-form counterpart of {#reader_overridden?}: when a `Data.define`/`Struct.new`
+        # block has no resolvable class name to look up in the project def-node table, its member-reader
+        # redefinitions are read straight off the block AST instead. True when the block body defines a
+        # `def <member>` (a plain instance method, receiver-less) for any member — folding that member's
+        # read would run the redefined reader, not return the member. Nested `class`/`module`/`sclass`
+        # bodies open a different namespace and are skipped; a `def` anywhere else in the body counts.
+        def block_redefines_member_reader?(block, members)
+          body = block.body
+          return false if body.nil?
+
+          member_set = members.is_a?(Set) ? members : members.to_set
+          reader_def?(body, member_set)
+        end
+
+        def reader_def?(node, member_set)
+          return false unless node.is_a?(Prism::Node)
+          return true if node.is_a?(Prism::DefNode) && node.receiver.nil? && member_set.include?(node.name)
+          # A nested class / module / singleton-class body opens a different namespace — its `def`s do not
+          # redefine the value object's reader, so the walk does not descend into it.
+          return false if reader_scope_boundary?(node)
+
+          node.rigor_each_child { |child| return true if reader_def?(child, member_set) }
+          false
+        end
+
+        def reader_scope_boundary?(node)
+          node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode) ||
+            node.is_a?(Prism::SingletonClassNode)
+        end
+
         def instance_index(instance, args)
           return nil unless args.size == 1
 

data/lib/rigor/inference/method_dispatcher/overload_selector.rb

@@ -241,6 +241,9 @@ module Rigor
           # would beat strictly-typed alternatives in pass 2 of the selector.
           def strictly_typed_params?(method_type, actual_count)
             fun = method_type.type
+            # A `(?)` method type declares no params at all: it is the gradual case by construction, so it
+            # must never win the strict pass over a genuinely typed sibling overload.
+            return false unless fun.respond_to?(:required_positionals)
             return false unless arity_compatible?(fun, actual_count)
 
             params = positional_params_for(fun, actual_count)
@@ -299,7 +302,11 @@ module Rigor
             !fun.required_keywords.empty?
           end
 
+          # `RBS::Types::UntypedFunction` (`(?)`) declares no arity to enforce, so every call site is
+          # arity-compatible with it.
           def arity_compatible?(fun, actual_count)
+            return true unless fun.respond_to?(:required_positionals)
+
             min_arity = fun.required_positionals.size + fun.trailing_positionals.size
             return false if actual_count < min_arity
 
@@ -314,6 +321,10 @@ module Rigor
           # Rest_positionals consumes the remainder; we repeat its single declaration for each absorbed
           # argument.
           def positional_params_for(fun, actual_count)
+            # `(?)` declares no positional params; the caller zips this against the actual args, so an empty
+            # list is what "accepts anything, constrains nothing" looks like here.
+            return [] unless fun.respond_to?(:required_positionals)
+
             required = fun.required_positionals
             optional = fun.optional_positionals
             rest = fun.rest_positionals

data/lib/rigor/inference/method_dispatcher/rbs_dispatch.rb

@@ -4,6 +4,7 @@ require_relative "../../reflection"
 require_relative "../../type"
 require_relative "../../rbs_extended"
 require_relative "../rbs_type_translator"
+require_relative "../void_origin"
 require_relative "overload_selector"
 
 module Rigor
@@ -96,7 +97,8 @@ module Rigor
             block_type: context.block_type,
             self_type_override: context.self_type_override,
             public_only: context.public_only,
-            scope: context.scope
+            scope: context.scope,
+            call_node: context.call_node
           )
         end
 
@@ -135,23 +137,23 @@ module Rigor
           private
 
           def dispatch_for(receiver:, method_name:, args:, environment:, block_type:, self_type_override: nil, # rubocop:disable Metrics/ParameterLists
-                           public_only: false, scope: nil)
+                           public_only: false, scope: nil, call_node: nil)
             args ||= []
             case receiver
             when Type::Union
               dispatch_union(receiver, method_name, args, environment, block_type, self_type_override,
-                             public_only: public_only, scope: scope)
+                             public_only: public_only, scope: scope, call_node: call_node)
             else
               dispatch_one(receiver, method_name, args, environment, block_type, self_type_override,
-                           public_only: public_only, scope: scope)
+                           public_only: public_only, scope: scope, call_node: call_node)
             end
           end
 
           def dispatch_union(receiver, method_name, args, environment, block_type, self_type_override = nil, # rubocop:disable Metrics/ParameterLists
-                             public_only: false, scope: nil)
+                             public_only: false, scope: nil, call_node: nil)
             results = receiver.members.map do |member|
               dispatch_one(member, method_name, args, environment, block_type, self_type_override,
-                           public_only: public_only, scope: scope)
+                           public_only: public_only, scope: scope, call_node: call_node)
             end
             return nil if results.any?(&:nil?)
 
@@ -159,7 +161,7 @@ module Rigor
           end
 
           def dispatch_one(receiver, method_name, args, environment, block_type, self_type_override = nil, # rubocop:disable Metrics/ParameterLists
-                           public_only: false, scope: nil)
+                           public_only: false, scope: nil, call_node: nil)
             descriptor = receiver_descriptor(receiver)
             return nil unless descriptor
 
@@ -173,11 +175,14 @@ module Rigor
               method_definition,
               class_name: class_name,
               kind: kind,
+              method_name: method_name,
               args: args,
               type_vars: type_vars,
               block_type: block_type,
               environment: environment,
-              self_type_override: self_type_override
+              self_type_override: self_type_override,
+              scope: scope,
+              call_node: call_node
             )
           rescue StandardError
             # Defensive: if RBS' definition builder raises on a broken hierarchy (e.g., partially loaded
@@ -318,7 +323,8 @@ module Rigor
 
           # rubocop:disable Metrics/ParameterLists
           def translate_return_type(method_definition, class_name:, kind:, args:, type_vars:, block_type:,
-                                    environment: nil, self_type_override: nil)
+                                    method_name: nil, environment: nil, self_type_override: nil,
+                                    scope: nil, call_node: nil)
             # rubocop:enable Metrics/ParameterLists
             # Slice 4b-3 (ADR-7 § "Slice 4-A/4-B") — read the return-type override through the merger so
             # future plugin / `:rbs_extended` bundles that also assert a `return_type` slot at this call
@@ -348,6 +354,15 @@ module Rigor
             )
             return nil unless method_type
 
+            # ADR-100 WD2/WD3 — the return-typing tier is where `void → top` widens, so it is the one place
+            # that still knows the RBS return was an author-declared `-> void` before the translator erases
+            # it to a plain `top`. Record the recovery on the scope's `void_origins` side-table, keyed by the
+            # call node, so the `static.value-use.void` check rule can fire when this `top` is used in value
+            # context. Recording is gated on `scope` && `call_node` being present, which naturally scopes it
+            # to the *direct*-RBS dispatch (the receiver's own resolvable class): the user-class / Object
+            # ancestor fallback nils both out (WD4 defers that, murkier, surface).
+            record_void_recovery(method_type, scope, call_node, [class_name, method_name, kind])
+
             full_type_vars = compose_block_type_vars(method_type, type_vars, block_type)
 
             RbsTypeTranslator.translate(
@@ -358,6 +373,24 @@ module Rigor
             )
           end
 
+          # Record the `void → top` recovery when the selected overload declares `-> void` and both `scope` and
+          # `call_node` are present (the direct-dispatch path). `void_site` is the `[class_name, method_name,
+          # kind]` triple the {VoidOrigin} carries.
+          def record_void_recovery(method_type, scope, call_node, void_site)
+            return unless scope && call_node && void_return?(method_type)
+
+            class_name, method_name, kind = void_site
+            scope.record_void_origin(
+              call_node,
+              VoidOrigin.new(class_name: class_name, method_name: method_name, kind: kind)
+            )
+          end
+
+          def void_return?(method_type)
+            fun = method_type.type
+            fun.respond_to?(:return_type) && fun.return_type.is_a?(RBS::Types::Bases::Void)
+          end
+
           # ADR-7 § "Slice 4-A/4-B" — folds the `RBS::Extended` `return:` directive (and any other
           # `return_type`-bearing contribution future slices add at this call site) through the merger
           # before consuming. Returns the merged return type or nil when no contribution overrides the

data/lib/rigor/inference/method_dispatcher/receiver_affinity.rb

@@ -41,8 +41,13 @@ module Rigor
             end
           end
 
+          # `RBS::Types::UntypedFunction` (a `(?)` method type, e.g. core's `Proc#call`) declares no
+          # parameters and exposes none of the per-arity accessors. It has no param classes to compare
+          # against the receiver, so it carries no affinity either way.
           def overload_param_classes_in_ancestry?(method_type, self_class_name, environment)
             fun = method_type.type
+            return false unless fun.respond_to?(:required_positionals)
+
             params = fun.required_positionals + fun.optional_positionals + fun.trailing_positionals
             return false if params.empty?