rigortype 0.2.9 → 0.3.0

data/lib/rigor/inference/statement_evaluator.rb

@@ -6,10 +6,12 @@ require_relative "../reflection"
 require_relative "../type"
 require_relative "../analysis/fact_store"
 require_relative "../source/node_walker"
+require_relative "../source/node_children"
 require_relative "../source/constant_path"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
 require_relative "dynamic_origin"
+require_relative "../analysis/check_rules/inferred_param_guard"
 require_relative "struct_fold_safety"
 require_relative "closure_escape_analyzer"
 require_relative "indexed_narrowing"
@@ -187,6 +189,16 @@ module Rigor
         [@scope.type_of(node, tracer: @tracer), @scope]
       end
 
+      # ADR-89 WD2 — the sorted positions of the positional parameters whose CONTENT `def_node` mutates
+      # (`callee_content_mutated_parameters`, the ADR-56 arg-flooring surface a caller consumes). A per-def
+      # static property of the AST — this is a pure exposure of the existing private computation (it never
+      # reads the scope), so the incremental session can compute it on any `StatementEvaluator` (an empty
+      # scope suffices), persist it in a return summary, and re-check a callee's symbol dependents when it
+      # moves (a caller's arg flooring changes even if the callee's return does not).
+      def content_mutated_parameter_positions(def_node)
+        callee_content_mutated_parameters(def_node).values.uniq.sort
+      end
+
       private
 
       attr_reader :scope, :tracer
@@ -224,6 +236,16 @@ module Rigor
         end
 
         bound = post_rhs.with_local(node.name, rhs_type)
+        # ADR-67 WD6b — a local whose RHS is (transitively) rooted at an inferred parameter inherits the
+        # "inferred, not declared" mark, so a subsequent use of the local declines the negative rules for the
+        # same lower-bound reason (`vindex = codepoints[i] - x; vindex < y`). The mark is STICKY across
+        # narrowing/joins (see `Scope#without_inferred_param_mark`), so a genuine rewrite from a non-param RHS
+        # must clear it here. No-op unless the `parameter_inference:` gate seeded a parameter this RHS reaches.
+        if Analysis::CheckRules::InferredParamGuard.rooted?(node.value, scope)
+          return [rhs_type, bound.with_inferred_param_mark(node.name)]
+        end
+
+        bound = bound.without_inferred_param_mark(node.name)
         bound = bound.with_local_origin(node.name, rhs_origin(node.value, post_rhs, rhs_type))
         [rhs_type, bound]
       end
@@ -748,7 +770,14 @@ module Rigor
                         node.is_a?(Prism::ModuleNode) ||
                         node.is_a?(Prism::BlockNode)
 
-        node.compact_child_nodes.any? { |c| arm_contains_retry?(c) }
+        found = false
+        node.rigor_each_child do |c|
+          next unless arm_contains_retry?(c)
+
+          found = true
+          break
+        end
+        found
       end
 
       def absorb_retry_rebinds(accumulator, entry_scope, arm_post_scope)
@@ -936,7 +965,7 @@ module Rigor
         return if node.nil?
 
         found[node] = true if node.is_a?(Prism::BreakNode)
-        node.compact_child_nodes.each do |child|
+        node.rigor_each_child do |child|
           next if BREAK_BOUNDARY_NODES.any? { |klass| child.is_a?(klass) }
 
           collect_direct_breaks(child, found)
@@ -1322,6 +1351,13 @@ module Rigor
         # (e.g. `arms << x`, `@tags << hashtag`). Stops a literal-shape carrier (`Tuple` / `HashShape`) from outliving
         # its justification when the value is mutated. Always-safe (loses precision, never invents facts).
         post_scope = MutationWidening.widen_after_call(call_node: node, current_scope: post_scope)
+        # ADR-48 slice 4 — Struct member-setter re-typing. After `s.x = v` on a fold-safe StructInstance local, rebind
+        # `s` to a StructInstance with member `:x` replaced by the assigned type, so a later `s.x` folds to `v` and a
+        # sibling `s.y` stays precise. `call_type` is the setter's own result (the assigned value type). Sound only for
+        # a fold-safe local (never aliased / escaped, straight-line setters) — the fold-safe scan is the gate.
+        post_scope = MethodDispatcher::StructFolding.apply_setter_writeback(
+          call_node: node, assigned_type: call_type, scope: post_scope
+        )
         # ADR-57 slice 3 work-item 1 (cross-method-boundary variant). When a self-call resolves to a user method that
         # CONTENT-mutates one of its parameters inside an escaping block (the `build_option_parser(opts)` idiom — the
         # callee returns an `OptionParser` whose `opts.on { o[:k] = v }` blocks close over the passed-in hash), floor
@@ -1624,9 +1660,9 @@ module Rigor
       def collect_gated_statement_contributions(index, relevant, name, call_node, current_scope)
         result = nil
         relevant.each do |plugin|
-          next unless index.type_specifier_candidate_for?(plugin, name)
+          next unless index.narrowing_facts_candidate_for?(plugin, name)
 
-          facts = plugin.type_specifier_facts(call_node: call_node, scope: current_scope)
+          facts = plugin.narrowing_facts_for(call_node: call_node, scope: current_scope)
           (result ||= []) << Rigor::FlowContribution.new(post_return_facts: facts) if facts && !facts.empty?
         rescue StandardError
           next
@@ -1910,7 +1946,7 @@ module Rigor
         return if node.nil?
 
         yield node
-        node.compact_child_nodes.each do |child|
+        node.rigor_each_child do |child|
           next if child.is_a?(Prism::BlockNode) || child.is_a?(Prism::DefNode) || child.is_a?(Prism::LambdaNode)
 
           each_node_outside_nested_scopes(child, &)
@@ -2480,7 +2516,7 @@ module Rigor
         sub_eval(node.body, fresh, class_context: new_context)
       end
 
-      def build_method_entry_scope(def_node)
+      def build_method_entry_scope(def_node) # rubocop:disable Metrics/AbcSize
         singleton = singleton_def?(def_node)
         binder = MethodParameterBinder.new(
           environment: scope.environment,
@@ -2492,8 +2528,11 @@ module Rigor
         # ADR-67 WD3 — override an undeclared parameter with its call-site inferred type (precision-additive; an
         # RBS-declared parameter wins, the table is empty on a normal `check` run). The inferred type lives only as a
         # body local, never as an RBS contract, so it cannot fire a parameter-boundary diagnostic (WD1, satisfied by
-        # construction).
-        bindings = seed_inferred_param_types(bindings, def_node, singleton)
+        # construction). WD6b — the second element is the set of parameters this seed overrode, stamped with
+        # the "inferred, not declared" provenance mark at bind time so the in-body rules can decline on them.
+        seeded = seed_inferred_param_types(bindings, def_node, singleton)
+        bindings = seeded.fetch(0)
+        inferred_names = seeded.fetch(1)
 
         # Method bodies do NOT see the outer scope's locals. They start from a fresh scope with the same environment,
         # then receive the parameter bindings. Slice 7 phase 2: instance defs ALSO seed their `ivars` map from the
@@ -2511,7 +2550,7 @@ module Rigor
             def_node.body, ->(name) { scope.struct_member_layout(name)&.[](:members) }
           )
         )
-        bindings.reduce(fresh) { |acc, (name, type)| bind_param(acc, name, type) }
+        bindings.reduce(fresh) { |acc, (name, type)| bind_param(acc, name, type, inferred_names) }
       end
 
       # ADR-82 root-enrichment — bind a method parameter, and for an *undeclared* (untyped) parameter seed its
@@ -2520,8 +2559,14 @@ module Rigor
       # route to parameter inference rather than reporting no cause at all. Reuses the WD1 `local_origins`
       # channel, so WD6 then carries the cause through any chain rooted at the parameter (`x.foo.bar`). An
       # RBS-declared / call-site-inferred parameter (a non-untyped binding) keeps no origin — it is not a hole.
-      def bind_param(acc, name, type)
+      #
+      # ADR-67 WD6b — a parameter the call-site inference seed overrode (`inferred_names`) is stamped with the
+      # "inferred, not declared" provenance mark instead: its type is a concrete (non-untyped) lower bound, so it
+      # is not an `inferred_return_untyped` hole, but the negative in-body rules must still decline on it (the
+      # union is open, so firing is an FP by construction). The mark drops on any flow-live rewrite of the local.
+      def bind_param(acc, name, type, inferred_names = nil)
         bound = acc.with_local(name, type)
+        return bound.with_inferred_param_mark(name) if inferred_names&.include?(name)
         return bound unless untyped_binding?(type)
 
         bound.with_local_origin(name, DynamicOrigin::INFERRED_RETURN_UNTYPED)
@@ -2534,19 +2579,23 @@ module Rigor
       # seed is byte-identical there.
       def seed_inferred_param_types(bindings, def_node, singleton)
         inferred = scope.param_inferred_types
-        return bindings if inferred.empty?
+        return [bindings, nil] if inferred.empty?
 
         path = current_class_path
-        return bindings if path.nil?
+        return [bindings, nil] if path.nil?
 
         table = inferred[[path, def_node.name, singleton ? :singleton : :instance]]
-        return bindings if table.nil? || table.empty?
+        return [bindings, nil] if table.nil? || table.empty?
 
         merged = bindings.dup
+        overridden = nil
         table.each do |name, type|
-          merged[name] = type if merged.key?(name) && untyped_binding?(merged[name])
+          next unless merged.key?(name) && untyped_binding?(merged[name])
+
+          merged[name] = type
+          (overridden ||= Set.new) << name
         end
-        merged
+        [merged, overridden]
       end
 
       # True for the `Dynamic[Top]` carrier `MethodParameterBinder` leaves on an undeclared parameter — the only

data/lib/rigor/inference/struct_fold_safety.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "../source/constant_path"
+require_relative "../source/node_children"
 
 module Rigor
   module Inference
@@ -59,11 +60,18 @@ module Rigor
         return EMPTY if members.empty?
 
         total = Hash.new(0)
-        pure = Hash.new(0)
-        count_uses(root, members, total, pure)
-
+        safe_uses = Hash.new(0)
+        deferred_setter = {}
+        count_uses(root, members, total, safe_uses, deferred_setter, false)
+
+        # A local is fold-safe iff every read of it is a safe use — a pure read OR (ADR-48 slice 4) a
+        # straight-line member setter (`n.x = v`) that the setter write-back re-types the binding for.
+        # `deferred_setter` disqualifies a local whose setter sits inside a loop / block / lambda, where a
+        # single static pass cannot model the setter's per-iteration effect (the write-back would leave a
+        # stale binding for the fold to read).
         safe = members.each_key.select do |name|
-          writes[name] == 1 && total[name].positive? && total[name] == pure[name]
+          writes[name] == 1 && total[name].positive? &&
+            total[name] == safe_uses[name] && !deferred_setter[name]
         end
         safe.empty? ? EMPTY : safe.to_set
       end
@@ -84,22 +92,30 @@ module Rigor
         end
       end
 
-      # Pass 2 — count, per recorded struct local, total reads vs. reads that are the receiver of a pure-read call.
-      def count_uses(node, members, total, pure)
+      # Pass 2 — count, per recorded struct local, total reads vs. SAFE-use reads (the receiver of a pure-read call,
+      # or of a straight-line member setter). `deferred` is true inside a loop / block / lambda; a member setter seen
+      # there marks the local's `deferred_setter` so it is excluded (its write-back cannot be modelled statically).
+      def count_uses(node, members, total, safe_uses, deferred_setter, deferred)
         return if node.nil?
 
         total[node.name] += 1 if node.is_a?(Prism::LocalVariableReadNode) && members.key?(node.name)
 
         if node.is_a?(Prism::CallNode)
           receiver = node.receiver
-          if receiver.is_a?(Prism::LocalVariableReadNode) && members.key?(receiver.name) &&
-             pure_read_call?(node, members[receiver.name])
-            pure[receiver.name] += 1
+          if receiver.is_a?(Prism::LocalVariableReadNode) && members.key?(receiver.name)
+            member_set = members[receiver.name]
+            if pure_read_call?(node, member_set)
+              safe_uses[receiver.name] += 1
+            elsif member_setter_call?(node, member_set)
+              safe_uses[receiver.name] += 1
+              deferred_setter[receiver.name] = true if deferred
+            end
           end
         end
 
+        child_deferred = deferred || deferred_boundary?(node)
         each_local_scope_child(node) do |child|
-          count_uses(child, members, total, pure)
+          count_uses(child, members, total, safe_uses, deferred_setter, child_deferred)
         end
       end
 
@@ -110,6 +126,27 @@ module Rigor
         FIXED_READS.include?(name) || member_set.include?(name)
       end
 
+      # A `n.<member> = v` attribute setter on the receiver (ADR-48 slice 4): the selector strips its trailing `=` to
+      # a member reader and the call carries exactly one argument. Comparison operators (`==`, `>=`, `!=`) also end
+      # with `=` but never strip to a member, so they stay unknown (unsafe) calls. `:[]=` is likewise not a member.
+      def member_setter_call?(call_node, member_set)
+        name = call_node.name.to_s
+        return false unless name.length > 1 && name.end_with?("=")
+        return false unless member_set.include?(name[0..-2].to_sym)
+
+        (call_node.arguments&.arguments&.size || 0) == 1
+      end
+
+      # Constructs whose body runs zero-or-many times or is deferred (loops, blocks, lambdas): a single static pass
+      # over the body cannot model a member setter's effect across iterations, so a setter inside one disqualifies the
+      # local. Straight-line conditionals (`if` / `unless` / `case`) are NOT boundaries — their branch scopes join
+      # soundly, so a setter in one branch is fine.
+      def deferred_boundary?(node)
+        node.is_a?(Prism::WhileNode) || node.is_a?(Prism::UntilNode) ||
+          node.is_a?(Prism::ForNode) || node.is_a?(Prism::BlockNode) ||
+          node.is_a?(Prism::LambdaNode)
+      end
+
       # The member set of a `<Struct chain>.new(...)` / `.[]` materialisation, or nil. Handles the inline
       # `Struct.new(:a, :b).new(...)` form and the `Const.new(...)` form (resolved through the layout side-table).
       def struct_materialization_members(value_node, layout_lookup)
@@ -156,7 +193,7 @@ module Rigor
       # Yields each child to recurse into, skipping the subtree of a nested local-variable-scope boundary (a `def` /
       # `class` / `module`).
       def each_local_scope_child(node)
-        node.compact_child_nodes.each do |child|
+        node.rigor_each_child do |child|
           next if scope_boundary?(child)
 
           yield child

data/lib/rigor/inference/synthetic_method_scanner.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../plugin/macro/heredoc_template"
 require_relative "../plugin/macro/trait_registry"
 require_relative "../source/literals"
+require_relative "../source/node_children"
 require_relative "synthetic_method"
 require_relative "synthetic_method_index"
 
@@ -166,12 +167,12 @@ module Rigor
           name = class_name_from(node, scope_stack)
           yield name, node if name
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_classes(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_classes(child, new_stack, &) }
         when Prism::ModuleNode
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_classes(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_classes(child, new_stack, &) }
         else
-          node.compact_child_nodes.each { |child| walk_classes(child, scope_stack, &) }
+          node.rigor_each_child { |child| walk_classes(child, scope_stack, &) }
         end
       end
 
@@ -303,12 +304,12 @@ module Rigor
           name = class_name_from(node, scope_stack)
           yield name, node.body
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_module_decls(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_module_decls(child, new_stack, &) }
         when Prism::ClassNode
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_module_decls(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_module_decls(child, new_stack, &) }
         else
-          node.compact_child_nodes.each { |child| walk_module_decls(child, scope_stack, &) }
+          node.rigor_each_child { |child| walk_module_decls(child, scope_stack, &) }
         end
       end
 
@@ -372,7 +373,7 @@ module Rigor
         hierarchy.freeze
       end
 
-      def walk_class_decls(node, scope_stack, &) # rubocop:disable Metrics/PerceivedComplexity
+      def walk_class_decls(node, scope_stack, &)
         return unless node.respond_to?(:compact_child_nodes)
 
         if node.is_a?(Prism::ClassNode)
@@ -380,19 +381,19 @@ module Rigor
           parent = parent_name_from(node, scope_stack)
           yield name, parent if name
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_class_decls(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_class_decls(child, new_stack, &) }
         elsif node.is_a?(Prism::ModuleNode)
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_class_decls(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_class_decls(child, new_stack, &) }
         else
-          node.compact_child_nodes.each { |child| walk_class_decls(child, scope_stack, &) }
+          node.rigor_each_child { |child| walk_class_decls(child, scope_stack, &) }
         end
       end
 
       # Yields `(class_name, call_node)` for every Prism::CallNode at class-body top level (singleton-context calls).
       # Nested method bodies, blocks, and conditionals are skipped — the Tier C call shapes the substrate targets all
       # live at the class body's top level.
-      def walk_class_bodies(node, scope_stack = [], &) # rubocop:disable Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+      def walk_class_bodies(node, scope_stack = [], &)
         return unless node.respond_to?(:compact_child_nodes)
 
         if node.is_a?(Prism::ClassNode)
@@ -403,12 +404,12 @@ module Rigor
               yield name, stmt if stmt.is_a?(Prism::CallNode) && stmt.receiver.nil?
             end
           end
-          node.body&.compact_child_nodes&.each { |child| walk_class_bodies(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_class_bodies(child, new_stack, &) }
         elsif node.is_a?(Prism::ModuleNode)
           new_stack = scope_stack + [node]
-          node.body&.compact_child_nodes&.each { |child| walk_class_bodies(child, new_stack, &) }
+          node.body&.rigor_each_child { |child| walk_class_bodies(child, new_stack, &) }
         else
-          node.compact_child_nodes.each { |child| walk_class_bodies(child, scope_stack, &) }
+          node.rigor_each_child { |child| walk_class_bodies(child, scope_stack, &) }
         end
       end
 

data/lib/rigor/inference/void_origin.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    # ADR-100 WD3 — the resolved `-> void` origin site recorded in {Rigor::Scope#void_origins}. A small cause
+    # record, never a carrier field: it says *which* author-declared `-> void` return was recovered to `top`
+    # at a use site, so the `static.value-use.void` diagnostic can name it. Mirrors the provenance-as-
+    # side-channel discipline {DynamicOrigin} established (ADR-75) — it never participates in subtyping,
+    # consistency, normalization, or erasure.
+    #
+    # @!attribute class_name
+    #   @return [String] the receiver class whose method declared `-> void`.
+    # @!attribute method_name
+    #   @return [Symbol] the method whose return was recovered.
+    # @!attribute kind
+    #   @return [Symbol] `:instance` or `:singleton`.
+    VoidOrigin = Data.define(:class_name, :method_name, :kind) do
+      # A human-facing `Class#method` / `Class.method` label for the diagnostic message.
+      def label
+        separator = kind == :singleton ? "." : "#"
+        "#{class_name}#{separator}#{method_name}"
+      end
+    end
+  end
+end

data/lib/rigor/inference/void_tail_summary.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "void_origin"
+require_relative "../reflection"
+require_relative "../source/node_children"
+
+module Rigor
+  module Inference
+    # ADR-100 WD4 — the lazy per-`def` "void tail" summary that carries an author-declared `-> void`
+    # provenance ACROSS an intermediate method whose own signature declares nothing. The direct case
+    # (`x = logger.log(...)`, an RBS `-> void` resolved on the receiver's own class) is recorded at the
+    # call site by {MethodDispatcher::RbsDispatch}; this summary answers the transitive case
+    # (`def bar; foo; end; b = bar`) where the `void` reaches the use through `bar`'s body, so no rule
+    # reading `bar`'s signature can see it.
+    #
+    # `VoidTail(def_node) -> VoidOrigin | nil`: computed on demand at the first consult, memoised per
+    # `def_node` (identity-keyed), cycle-guarded (a def already on the current chain rejects), and
+    # **pure** — AST shape + RBS reflection ({Reflection.instance_method_definition} /
+    # {Reflection.singleton_method_definition}) + discovery-index lookups ({Scope#user_def_for} /
+    # {Scope#singleton_def_for}) only, never expression evaluation. Because it never evaluates, it can
+    # neither re-enter the dispatcher nor depend on evaluation order or the fork-pool's file
+    # partitioning — the eager record-at-body-evaluation table WD4 rejected failed exactly there.
+    #
+    # A `def` (resolved on `owner` / `kind`) is admitted iff all four hold:
+    #
+    #   1. its OWN resolved RBS signature for `(owner, name, kind)` is absent, or every overload
+    #      returns `untyped` (`RBS::Types::Bases::Any`). An author-declared concrete return — including
+    #      `-> void` itself, which the direct rule already serves at the call site — keeps it out, so
+    #      the direct rule and the summary are disjoint by construction (no double record).
+    #   2. its body is a plain statements body (no `rescue` / `else` / `ensure` on the `def` — those
+    #      shapes make `def_node.body` a `Prism::BeginNode`) containing NO `Prism::ReturnNode` anywhere:
+    #      a bare `return` yields `nil`, a non-void path, so the void tail must be the SOLE return path.
+    #      The walk is deliberately over-conservative — a `return` inside a nested block also
+    #      disqualifies.
+    #   3. its tail (last) expression is a `Prism::CallNode` with an implicit-`self` receiver (`nil`
+    #      receiver or a literal `self`).
+    #   4. that tail resolves on the SAME owner (exact class, no ancestor walk on the discovery side) to
+    #      either (a) an RBS definition whose EVERY overload returns `void` — the leaf, whose origin is
+    #      `VoidOrigin(owner, tail_name, kind)` — or (b) another discovered `def` of the same kind, which
+    #      recurses. Composition (`def baz; bar; end`) is the recursion, and the origin stays the leaf,
+    #      so the message still names the author's `-> void` method. The RBS-void-leaf branch is checked
+    #      FIRST because under ADR-93 auto-wire the leaf `def` is BOTH RBS-`void` and a discovered `def`;
+    #      recursing into its body would miss the leaf.
+    #
+    # Everything else — explicit-receiver tails, conditional / boolean / `begin` tails, unresolvable
+    # names, non-void concrete RBS — rejects.
+    #
+    # Each tail chain is a functional graph (every `def` has exactly one tail, hence at most one
+    # successor), so a `def`'s result is fully determined by its own forward chain and is independent of
+    # the entry point: a chain either reaches a void leaf (`VoidOrigin`), a non-admitted node (nil), or a
+    # cycle (nil). Memoising is therefore always sound, and the cycle guard only ever rejects a node that
+    # is still mid-computation on the current chain (never yet memoised).
+    class VoidTailSummary
+      # Run-scoped memo, the ADR-84 `return_memo_bucket` house pattern: a single retained slot on
+      # `Thread.current` keyed by the run-generation token's identity, so a re-run in one process (LSP,
+      # ADR-62 warm loop) lands in a fresh bucket and can neither serve stale entries nor accumulate
+      # them. Thread-local ⇒ each fork-pool worker (a separate process) and each Ractor-pool worker (its
+      # own Ractor-local `Thread.current`) builds its own bucket; the bucket hash is created and mutated
+      # inside the worker and never shared, so no frozen / shared object is mutated and no
+      # graceful-degradation branch is needed. `def_node` identity is stable per run (the ADR-85
+      # {DefNodeResolver} yields one node object per `(path, node_id)`), the same identity the ADR-84
+      # return memo relies on.
+      MEMO_KEY = :__rigor_void_tail_summary_memo__
+      private_constant :MEMO_KEY
+
+      def initialize(scope)
+        @scope = scope
+        @environment = scope.environment
+      end
+
+      # The recovered `-> void` origin for `def_node` (whose owner / kind the caller resolved through
+      # the discovery index), or nil when the `def` is not admitted. A fresh visited set per top-level
+      # consult; the memo persists across consults for the run. The memo is probed before the visited
+      # set is allocated so the common post-warmup hit path allocates nothing.
+      #
+      # @param def_node [Prism::DefNode]
+      # @param owner [String] the qualified receiver class the `def` belongs to.
+      # @param kind [Symbol] `:instance` or `:singleton`.
+      # @return [Inference::VoidOrigin, nil]
+      def origin_for(def_node, owner, kind)
+        return nil if def_node.nil?
+
+        memo = memo_bucket
+        return memo[def_node] if memo.key?(def_node)
+
+        walk(def_node, owner, kind, {}.compare_by_identity)
+      end
+
+      private
+
+      attr_reader :scope, :environment
+
+      # Memo + cycle-guarded computation. A def already on the current chain rejects WITHOUT memoising
+      # (it is mid-computation; its true result is memoised when its own frame completes).
+      def walk(def_node, owner, kind, visited)
+        return nil if def_node.nil?
+        return nil if visited.key?(def_node)
+
+        memo = memo_bucket
+        return memo[def_node] if memo.key?(def_node)
+
+        visited[def_node] = true
+        memo[def_node] = compute(def_node, owner, kind, visited)
+      end
+
+      def compute(def_node, owner, kind, visited)
+        return nil unless own_signature_admits?(owner, def_node.name, kind) # admission 1
+
+        tail = admissible_tail(def_node) # admissions 2 + 3
+        return nil if tail.nil?
+
+        resolve_tail(tail.name, owner, kind, visited) # admission 4
+      end
+
+      # Admission 1 — absent own signature, or every overload `untyped`. `untyped` is read as "no claim"
+      # per RBS's own semantics, so a hand-written `-> untyped` intermediate still admits: the provenance
+      # fact (this value was produced by an author-declared `-> void` return) remains true of it.
+      def own_signature_admits?(owner, method_name, kind)
+        definition = method_definition(owner, method_name, kind)
+        return true if definition.nil?
+
+        every_overload_return?(definition, RBS::Types::Bases::Any)
+      end
+
+      # Admissions 2 + 3 — the tail expression when the body is a plain statements body with no
+      # `ReturnNode` anywhere and the tail is an implicit-self call; nil (reject) otherwise.
+      def admissible_tail(def_node)
+        body = def_node.body
+        return nil if body.nil?
+        return nil if body.is_a?(Prism::BeginNode) # def-level rescue / else / ensure
+        return nil if contains_return?(body)
+
+        tail = tail_expression(body)
+        return nil unless tail.is_a?(Prism::CallNode)
+        return nil unless implicit_self_receiver?(tail.receiver)
+
+        tail
+      end
+
+      # A `Prism::StatementsNode` (the plain and endless-def shapes both parse to one) tails on its last
+      # statement; any other surviving shape is treated as the tail expression itself.
+      def tail_expression(body)
+        case body
+        when Prism::StatementsNode then body.body.last
+        else body
+        end
+      end
+
+      def implicit_self_receiver?(receiver)
+        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+      end
+
+      # True when a `Prism::ReturnNode` appears anywhere in the subtree — nested blocks and defs
+      # included (over-conservative is correct: a method that can return anything other than the void
+      # tail must never enter the table).
+      def contains_return?(node)
+        return false unless node.is_a?(Prism::Node)
+        return true if node.is_a?(Prism::ReturnNode)
+
+        node.rigor_each_child { |child| return true if contains_return?(child) }
+        false
+      end
+
+      # Admission 4 — the void leaf (RBS every-overload `void`) wins over the discovered-def recursion,
+      # because under ADR-93 auto-wire the annotated leaf is both.
+      def resolve_tail(tail_name, owner, kind, visited)
+        definition = method_definition(owner, tail_name, kind)
+        if definition && every_overload_return?(definition, RBS::Types::Bases::Void)
+          return VoidOrigin.new(class_name: owner, method_name: tail_name, kind: kind)
+        end
+
+        next_def = discovered_def(owner, tail_name, kind)
+        return nil if next_def.nil?
+
+        walk(next_def, owner, kind, visited)
+      end
+
+      def method_definition(owner, method_name, kind)
+        if kind == :singleton
+          Reflection.singleton_method_definition(owner, method_name, environment: environment)
+        else
+          Reflection.instance_method_definition(owner, method_name, environment: environment)
+        end
+      end
+
+      def discovered_def(owner, method_name, kind)
+        if kind == :singleton
+          scope.singleton_def_for(owner, method_name)
+        else
+          scope.user_def_for(owner, method_name)
+        end
+      end
+
+      # True when the definition declares at least one overload and EVERY overload's return type is an
+      # instance of `base_klass` (`RBS::Types::Bases::Any` for admission 1, `...::Void` for the leaf).
+      # An `UntypedFunction` (`(?) -> T`) still responds to `return_type`, so it is handled the same way.
+      def every_overload_return?(definition, base_klass)
+        method_types = definition.method_types
+        return false if method_types.empty?
+
+        method_types.all? do |method_type|
+          fun = method_type.type
+          fun.respond_to?(:return_type) && fun.return_type.is_a?(base_klass)
+        end
+      end
+
+      def memo_bucket
+        generation = scope.run_generation || scope.discovered_def_nodes
+        slot = Thread.current[MEMO_KEY]
+        unless slot && slot[0].equal?(generation)
+          slot = [generation, {}.compare_by_identity]
+          Thread.current[MEMO_KEY] = slot
+        end
+        slot[1]
+      end
+    end
+  end
+end

data/lib/rigor/language_server/completion_provider.rb

@@ -8,6 +8,7 @@ require_relative "../environment"
 require_relative "../reflection"
 require_relative "../scope"
 require_relative "../source/node_locator"
+require_relative "../source/node_children"
 require_relative "../inference/scope_indexer"
 require_relative "../type/nominal"
 require_relative "../type/singleton"
@@ -187,7 +188,7 @@ module Rigor
              n.location.start_offset <= symbol_offset && symbol_offset <= n.location.end_offset
             result = n
           end
-          n.compact_child_nodes.each(&walk)
+          n.rigor_each_child(&walk)
         end
         walk.call(root)
         result

data/lib/rigor/language_server/document_symbol_provider.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "uri"
 require_relative "buffer_resolution"
+require_relative "../source/node_children"
 
 module Rigor
   module LanguageServer
@@ -67,7 +68,7 @@ module Rigor
         when Prism::DefNode
           block.call(def_symbol(node, in_namespace: in_namespace))
         else
-          node.compact_child_nodes.each do |child|
+          node.rigor_each_child do |child|
             each_decl(child, in_namespace: in_namespace, &block)
           end
         end