rigortype 0.3.0 → 0.3.2

data/lib/rigor/inference/method_dispatcher/shape_dispatch.rb

@@ -18,7 +18,8 @@ module Rigor
       #
       # Catalogue (Slice 5 phase 2):
       #
-      # - Tuple#`first`, Tuple#`last`, Tuple#`size`/`length`/`count`: no-arg, no-block.
+      # - Tuple#`first`, Tuple#`last` (no-arg, or a single `Constant[Integer]` count lifting to a
+      #   sub-`Tuple`, the `take`/`drop` shape), Tuple#`size`/`length`/`count`: no-block.
       # - Tuple#`[]`, Tuple#`fetch` with a single `Constant[Integer]` argument inside the tuple's bounds
       #   (negative indices are normalised by length). Tuple#`[]` also handles static Range and
       #   start-length slices, returning a sliced Tuple or `Constant[nil]` for statically nil slices.
@@ -82,6 +83,16 @@ module Rigor
           drop: :tuple_drop,
           rotate: :tuple_rotate,
           uniq: :tuple_uniq,
+          at: :tuple_at,
+          :& => :tuple_intersection,
+          intersection: :tuple_intersection,
+          :| => :tuple_union,
+          union: :tuple_union,
+          :- => :tuple_difference,
+          difference: :tuple_difference,
+          intersect?: :tuple_intersect?,
+          one?: :tuple_one?,
+          deconstruct: :shape_self,
           index: :tuple_find_index,
           find_index: :tuple_find_index,
           rindex: :tuple_rindex,
@@ -672,23 +683,39 @@ module Rigor
             Type::Combinator.integer_range(min, max)
           end
 
-          # `first` (no arg) → the first element (or `Constant[nil]` when empty). The `first(n)` arg-form
-          # is deliberately left to RBS overload selection (see the overload-selection specs) — folding it
-          # here would change that documented `Array[Elem]` contract.
+          # `first` (no arg) → the first element (or `Constant[nil]` when empty). `first(n)` → a `Tuple` of
+          # the leading `n` elements, the same `take`/`drop` shape via `non_negative_count_arg` (`n >= size`
+          # returns the full receiver, a non-static or negative count declines to RBS).
           def tuple_first(tuple, _method_name, args)
-            return nil unless args.empty?
+            return tuple_first_n(tuple, args) unless args.empty?
             return Type::Combinator.constant_of(nil) if tuple.elements.empty?
 
             tuple.elements.first
           end
 
+          def tuple_first_n(tuple, args)
+            n = non_negative_count_arg(args)
+            return nil if n.nil?
+
+            Type::Combinator.tuple_of(*tuple.elements.first(n))
+          end
+
+          # `last` (no arg) → the last element (or `Constant[nil]` when empty). `last(n)` → a `Tuple` of the
+          # trailing `n` elements, mirroring `tuple_first_n`.
           def tuple_last(tuple, _method_name, args)
-            return nil unless args.empty?
+            return tuple_last_n(tuple, args) unless args.empty?
             return Type::Combinator.constant_of(nil) if tuple.elements.empty?
 
             tuple.elements.last
           end
 
+          def tuple_last_n(tuple, args)
+            n = non_negative_count_arg(args)
+            return nil if n.nil?
+
+            Type::Combinator.tuple_of(*tuple.elements.last(n))
+          end
+
           def tuple_size(tuple, _method_name, args)
             return nil unless args.empty?
 
@@ -957,6 +984,88 @@ module Rigor
 
           # `tuple + other` — concatenates two Tuples. Both sides must be `Type::Tuple`. Returns a new
           # Tuple whose elements are those of the receiver followed by those of the argument.
+          # `at(n)` — the strict single-Integer accessor. Deliberately NOT an alias of {#tuple_index}: `[]`
+          # and `slice` accept a Range or a `(start, length)` pair, while `Array#at` raises `ArgumentError`
+          # on anything but one Integer, and a fold must never invent a value for a call that raises.
+          #
+          # An out-of-range index declines rather than folding to `Constant[nil]`, matching {#tuple_index}.
+          # Ruby really does return nil there, so the fold would be correct — but it would also turn a
+          # receiver the RBS tier types as `Elem?` into a proven nil, newly surfacing diagnostics on code
+          # that may be guarded in ways a shape cannot see. Precision that fires a new diagnostic is a
+          # separate decision from precision that removes a `Dynamic` (#121).
+          def tuple_at(tuple, _method_name, args)
+            return nil unless args.size == 1
+            return nil unless args.first.is_a?(Type::Constant) && args.first.value.is_a?(Integer)
+
+            tuple.elements[args.first.value]
+          end
+
+          # `a & b` / `a.intersection(b, ...)`, `a | b` / `a.union(...)`, `a - b` / `a.difference(...)`.
+          # Every set operation is evaluated by running Ruby's own operator over the unwrapped values, which
+          # is the only way to reproduce its `eql?` / `hash` semantics exactly — `[1] & [1.0]` is empty even
+          # though `1 == 1.0`, so an equality-based reimplementation would fold the wrong answer.
+          def tuple_intersection(tuple, _method_name, args)
+            set_operation(tuple, args) { |values, others| others.reduce(values, :&) }
+          end
+
+          def tuple_union(tuple, _method_name, args)
+            set_operation(tuple, args) { |values, others| others.reduce(values, :|) }
+          end
+
+          def tuple_difference(tuple, _method_name, args)
+            set_operation(tuple, args) { |values, others| others.reduce(values, :-) }
+          end
+
+          # `a.intersect?(b)` — the predicate form, `Constant[bool]`. `nil` is the decline signal every
+          # handler shares, not a boolean answer, so the predicate-return cop is disabled as it is for the
+          # other `?`-named handlers above.
+          # rubocop:disable Style/ReturnNilInPredicateMethodDefinition
+          def tuple_intersect?(tuple, _method_name, args)
+            result = set_operation(tuple, args) { |values, others| others.reduce(values, :&) }
+            return nil if result.nil?
+
+            Type::Combinator.constant_of(!result.elements.empty?)
+          end
+
+          # Shared body for the set operations: unwrap the receiver and every Tuple argument, hand the raw
+          # values to `block`, and lift the result back. Declines unless every element on both sides is a
+          # `Constant` (an unknown element makes membership undecidable) and every argument is a `Tuple` —
+          # `Array#&` also accepts anything that responds to `to_ary`, which a shape cannot prove.
+          def set_operation(tuple, args)
+            return nil if args.empty? || args.size > MAX_SET_OPERATION_ARITY
+
+            values = constant_values(tuple.elements)
+            return nil if values.nil?
+
+            others = args.map do |arg|
+              return nil unless arg.is_a?(Type::Tuple)
+
+              constant_values(arg.elements) || (return nil)
+            end
+            result = yield(values, others)
+            return nil if result.size > MAX_SET_OPERATION_SIZE
+
+            Type::Combinator.tuple_of(*result.map { |value| Type::Combinator.constant_of(value) })
+          end
+
+          # An argument list longer than this, or a result wider than this, declines to the RBS tier rather
+          # than materialising an unbounded Tuple — the same discipline as {MAX_ZIP_ARITY} / the join cap.
+          MAX_SET_OPERATION_ARITY = 8
+          MAX_SET_OPERATION_SIZE = 64
+          private_constant :MAX_SET_OPERATION_ARITY, :MAX_SET_OPERATION_SIZE
+
+          # `one?` with no block and no pattern — `Constant[bool]` of "exactly one truthy element". Only
+          # `Constant` elements have decidable truthiness, and the block / pattern forms defer.
+          def tuple_one?(tuple, _method_name, args)
+            return nil unless args.empty?
+
+            values = constant_values(tuple.elements)
+            return nil if values.nil?
+
+            Type::Combinator.constant_of(values.one? { |value| value })
+          end
+          # rubocop:enable Style/ReturnNilInPredicateMethodDefinition
+
           def tuple_concat(tuple, _method_name, args)
             return nil unless args.size == 1
 
@@ -1558,13 +1667,16 @@ module Rigor
             Type::Combinator.hash_shape_of(shape.pairs.merge(other.pairs))
           end
 
-          # `shape[k]` and `shape.fetch(k)` for a value-pinned scalar key. Missing-key resolution depends
-          # on the method:
+          # `shape[k]` and `shape.fetch(k)` for a value-pinned scalar key. On a CLOSED shape a key outside
+          # `pairs` is provably missing, and the resolution depends on the method:
           #
           # - `[]` returns `nil` at runtime; we surface `Constant[nil]` so the carrier is visible to
           #   downstream narrowing.
           # - `fetch` (no default, no block) raises `KeyError`; we let the projection answer apply because
           #   the runtime would not produce a value.
+          #
+          # On an `:open` shape neither applies — the key is unknown rather than missing, so both methods
+          # answer the `untyped` step from {#hash_dig_step}.
           def hash_lookup(shape, method_name, args)
             return nil unless args.size == 1
 
@@ -1594,6 +1706,12 @@ module Rigor
           # Returns the per-step value type for a HashShape lookup (or `Constant[nil]` for a known-missing
           # key). Returns `nil` when the argument is not a value-pinned scalar key so the caller can fall
           # through to the projection answer.
+          #
+          # A key outside `pairs` only resolves to `Constant[nil]` on a CLOSED shape, where `pairs` is the
+          # whole key set and the runtime read provably returns nil. On an `:open` shape the key set is by
+          # definition not exhausted, so an undeclared key is *unknown*, not absent — it may hold a value
+          # of any type. Typing it `Constant[nil]` there would put `call.undefined-method` on the next line
+          # of correct code (`payload[:undeclared].upcase`), so the open case answers `untyped`.
           def hash_dig_step(shape, arg)
             return nil unless arg.is_a?(Type::Constant)
 
@@ -1607,6 +1725,8 @@ module Rigor
               return Type::Combinator.union(value, Type::Combinator.constant_of(nil))
             end
 
+            return Type::Combinator.untyped if shape.open?
+
             Type::Combinator.constant_of(nil)
           end
 
@@ -1616,8 +1736,13 @@ module Rigor
             shape.optional_key?(arg.value)
           end
 
+          # Whether the key is provably ABSENT — which only a closed shape can establish. An open shape
+          # permits keys outside `pairs`, so a key it does not declare is unknown rather than missing, and
+          # `fetch` must not be deferred on the theory that Ruby would raise `KeyError`: the key may well
+          # be there. {#hash_dig_step} has already answered `untyped` for that case.
           def missing_key_step?(shape, arg)
             return false unless arg.is_a?(Type::Constant)
+            return false if shape.open?
 
             !shape.pairs.key?(arg.value)
           end
@@ -1685,7 +1810,9 @@ module Rigor
 
           # Continues a `dig` chain after the first step. Tuple and HashShape members re-dispatch into the
           # catalogue; `Constant[nil]` short-circuits the chain (Hash#dig and Array#dig do the same at
-          # runtime); anything else falls through so the projection answer applies.
+          # runtime); an `untyped` step (an undeclared key on an open shape) keeps the whole chain
+          # `untyped`, since digging further into an unknown value cannot recover a bound; anything else
+          # falls through so the projection answer applies.
           def chain_dig(receiver, args)
             return receiver if args.empty?
 
@@ -1693,6 +1820,7 @@ module Rigor
             when Type::Tuple then tuple_dig(receiver, :dig, args)
             when Type::HashShape then hash_dig(receiver, :dig, args)
             when Type::Constant then receiver.value.nil? ? Type::Combinator.constant_of(nil) : nil
+            when Type::Dynamic then Type::Combinator.untyped
             end
           end
         end

data/lib/rigor/inference/method_dispatcher/struct_folding.rb

@@ -141,7 +141,7 @@ module Rigor
           map = member_map_for_new(members, keyword_init, context)
           return degraded_instance if map.nil?
 
-          Type::Combinator.struct_instance_of(members: map, class_name: class_name)
+          Type::Combinator.struct_instance_of(members: widen_unowned_emptiness(map), class_name: class_name)
         end
 
         # Builds the member -> type map honouring the class's `keyword_init` flag: a `keyword_init: true`
@@ -309,7 +309,8 @@ module Rigor
           return scope if member.nil?
 
           rebound = Type::Combinator.struct_instance_of(
-            members: current.members.merge(member => assigned_type), class_name: current.class_name
+            members: widen_unowned_emptiness(current.members.merge(member => assigned_type)),
+            class_name: current.class_name
           )
           scope.with_local(receiver.name, rebound)
         end

data/lib/rigor/inference/method_dispatcher/uri_folding.rb

@@ -20,12 +20,31 @@ module Rigor
       #   decode. Returns `Constant[String]`.
       # * `encode_uri_component(str)` / `decode_uri_component(str)` — Same encoding but may preserve
       #   additional reserved chars (Ruby 3.2+). Returns `Constant[String]`.
+      # * `encode_www_form(enum)` — the whole-form encoder, over a `Tuple` of `[key, value]` `Tuple`s (an
+      #   array literal) or a `HashShape` (a hash literal) whose keys and values are all `Constant`.
+      #   Returns `Constant[String]`.
+      # * `decode_www_form(str)` — the inverse, over a `Constant[String]`. Returns a `Tuple` of two-element
+      #   `Tuple[Constant[String], Constant[String]]` pairs rather than the RBS tier's
+      #   `Array[[String, String]]`, so a destructuring read of a known form gets the concrete strings.
+      # * `extract(str)` — the URIs a constant string contains, as a `Tuple` of `Constant[String]` rather
+      #   than `Array[String]`. Single-argument form only (see {.fold_extract}).
+      #
+      # === Deliberately NOT folded
+      #
+      # `URI.parse` and `URI.join` are the two remaining gaps in this module's coverage note, and both are
+      # declined on the repo's own existing rule rather than on judgement: they return `URI::Generic` and
+      # friends, which are absent from `ConstantFolding::FOLDABLE_CONSTANT_CLASSES`, so there is no
+      # `Constant[…]` for this tier to produce. Narrowing `URI.parse`'s ten-arm return union to the one
+      # scheme class a constant string selects WOULD be a real precision win, but it makes a gradually-valid
+      # dispatch precise and can therefore surface a diagnostic that does not fire today — which puts it in
+      # the bucket-3 / P0 category, not in this FP-safe fold category ([#121](
+      # https://github.com/rigortype/rigor/issues/121)).
       #
       # === Non-constant / unsupported cases
       #
       # Returns `nil` (deferring to the next dispatcher tier) when:
       # - the receiver is not `Singleton[URI]`,
-      # - the first argument is not a `Constant[String]`,
+      # - an argument is not the constant shape the method's fold requires,
       # - the method is not in the supported set.
       module URIFolding
         URI_COMPONENT_METHODS = Set[
@@ -34,6 +53,12 @@ module Rigor
         ].freeze
         private_constant :URI_COMPONENT_METHODS
 
+        # A form long enough to suggest generated or accumulated data rather than a literal a reader wrote;
+        # past it the folded `Constant[String]` stops being useful in a diagnostic and only costs memory.
+        # Mirrors the byte ceiling `ShapeDispatch`'s own `tuple_join` fold applies for the same reason.
+        FORM_PAIR_LIMIT = 64
+        private_constant :FORM_PAIR_LIMIT
+
         module_function
 
         # @return [Rigor::Type, nil] folded result, or nil to defer.
@@ -42,11 +67,109 @@ module Rigor
           method_name = context.method_name
           args = context.args
           return nil unless SingletonFolding.receiver?(receiver, "URI")
+          return fold_encode_www_form(args) if method_name == :encode_www_form
+          return fold_decode_www_form(args) if method_name == :decode_www_form
+          return fold_extract(args) if method_name == :extract
           return nil unless URI_COMPONENT_METHODS.include?(method_name)
 
           fold_uri_call(method_name, args)
         end
 
+        # `URI.encode_www_form(enum)` — deterministic over its whole input, so it folds only when EVERY key
+        # and value is already a `Constant`. One non-constant pair declines the whole call: a partially
+        # known form has no `Constant[String]` to stand for it.
+        def fold_encode_www_form(args)
+          return nil unless args.size == 1
+
+          pairs = form_pairs(args.first)
+          return nil if pairs.nil? || pairs.size > FORM_PAIR_LIMIT
+
+          Type::Combinator.constant_of(URI.encode_www_form(pairs))
+        rescue StandardError
+          nil
+        end
+
+        # The `[key, value]` pairs of a literal form argument, or nil when the shape is not fully known:
+        # a `Tuple` of two-element `Tuple`s (the array-of-pairs spelling) or a `HashShape` (the hash
+        # spelling). `HashShape` pairs are read only when the shape is CLOSED and carries no optional key —
+        # an open or partially-optional shape describes a hash whose real contents this fold cannot see.
+        def form_pairs(arg)
+          case arg
+          when Type::Tuple then tuple_form_pairs(arg)
+          when Type::HashShape then hash_form_pairs(arg)
+          end
+        end
+
+        def tuple_form_pairs(tuple)
+          tuple.elements.map do |element|
+            return nil unless element.is_a?(Type::Tuple) && element.elements.size == 2
+            return nil unless element.elements.all?(Type::Constant)
+
+            element.elements.map(&:value)
+          end
+        end
+
+        def hash_form_pairs(shape)
+          return nil unless shape.closed? && shape.optional_keys.empty?
+
+          shape.pairs.map do |key, value|
+            return nil unless value.is_a?(Type::Constant)
+
+            [key, value.value]
+          end
+        end
+
+        # `URI.decode_www_form(str)` — the pair list of a constant form, as a `Tuple` of two-element
+        # `Tuple`s so a destructuring read (`k, v = URI.decode_www_form(s).first`) reaches the concrete
+        # strings instead of the RBS tier's `Array[[String, String]]`.
+        def fold_decode_www_form(args)
+          return nil unless args.size == 1
+
+          str = SingletonFolding.constant_string(args.first)
+          return nil if str.nil?
+
+          pairs = URI.decode_www_form(str)
+          return nil if pairs.size > FORM_PAIR_LIMIT
+
+          Type::Combinator.tuple_of(*pairs.map { |key, value| constant_pair(key, value) })
+        rescue StandardError
+          nil
+        end
+
+        def constant_pair(key, value)
+          Type::Combinator.tuple_of(Type::Combinator.constant_of(key), Type::Combinator.constant_of(value))
+        end
+
+        # `URI.extract(str)` — the URIs a constant string contains, as a `Tuple` of `Constant[String]`
+        # instead of the RBS tier's `Array[String]`. Only the single-argument form folds: the optional
+        # second argument is a schema FILTER, and honouring it means reproducing `URI.extract`'s own
+        # argument handling rather than the one call this fold makes, so it declines instead.
+        #
+        # Ruby emits an obsolescence warning for this method under `$VERBOSE`; the fold calls it with
+        # warnings silenced, because a warning about the ANALYZED program's API choice must not appear on
+        # the analyzer's own stderr, where a reader would attribute it to Rigor.
+        def fold_extract(args)
+          return nil unless args.size == 1
+
+          str = SingletonFolding.constant_string(args.first)
+          return nil if str.nil?
+
+          found = silence_warnings { URI.extract(str) }
+          return nil if found.nil? || found.size > FORM_PAIR_LIMIT
+
+          Type::Combinator.tuple_of(*found.map { |uri| Type::Combinator.constant_of(uri) })
+        rescue StandardError
+          nil
+        end
+
+        def silence_warnings
+          previous = $VERBOSE
+          $VERBOSE = nil
+          yield
+        ensure
+          $VERBOSE = previous
+        end
+
         def fold_uri_call(method_name, args)
           return nil unless args.size == 1
 

data/lib/rigor/inference/mutation_widening.rb

@@ -2,6 +2,7 @@
 
 require_relative "../type"
 require_relative "../source/node_children"
+require_relative "receiver_alias"
 
 module Rigor
   module Inference
@@ -45,6 +46,10 @@ module Rigor
     #
     # - `arr.<mutator>(...)` where `arr` is a local variable.
     # - `@arr.<mutator>(...)` where `@arr` is an instance variable.
+    # - a receiver that *selects* among such variables rather than naming one —
+    #   `(kind == :required ? required : optional)[key] = info`, an `if`/`else`, `||` / `&&`. Every
+    #   variable the expression can evaluate to is a possible mutation target, so every one widens
+    #   (issue #277). See {ReceiverAlias}.
     #
     # Out of scope (left for a separate cycle):
     #
@@ -100,10 +105,10 @@ module Rigor
         PURE_SELF_RETURNERS.include?(method_name)
       end
 
-      # Returns a scope with the call's receiver widened, when the receiver is a
-      # local-/instance-variable read whose current binding is a literal-shape carrier
+      # Returns a scope with the call's receiver widened, for every variable the receiver expression
+      # can evaluate to ({ReceiverAlias.candidates}) whose current binding is a literal-shape carrier
       # (`Tuple` / `HashShape`) or an empty-witness refinement (`non-empty-array` /
-      # `non-empty-hash`) AND the call name is a known in-place mutator for that shape.
+      # `non-empty-hash`) AND whose call name is a known in-place mutator for that shape.
       # Returns `current_scope` unchanged otherwise.
       #
       # @param call_node     [Prism::CallNode]
@@ -115,13 +120,8 @@ module Rigor
         receiver = call_node.receiver
         return current_scope if receiver.nil?
 
-        case receiver
-        when Prism::LocalVariableReadNode
-          widen_local(call_node.name, receiver.name, current_scope)
-        when Prism::InstanceVariableReadNode
-          widen_ivar(call_node.name, receiver.name, current_scope)
-        else
-          current_scope
+        ReceiverAlias.candidates(receiver).reduce(current_scope) do |acc, read|
+          widen_alias_read(call_node.name, read, acc)
         end
       end
 
@@ -130,13 +130,13 @@ module Rigor
       # LOCALS are otherwise invisible to the post-call outer scope (ivars are handled correctly
       # already because they live in the method-body scope, not the block-local scope).
       #
-      # Walks the block AST for `<receiver>.<method>(...)` calls whose receiver is either a
-      # `LocalVariableReadNode` with `depth > 0` (a captured outer local — Prism's `depth`
-      # counts scope hops outward; `depth == 0` means a block-local) or an
-      # `InstanceVariableReadNode` (always method-scope), and applies `widen_after_call` for
-      # each one against the outer scope. The widening is always safe — it can only LOSE
-      # precision — so blindly propagating is sound regardless of whether the block actually
-      # runs.
+      # Walks the block AST for `<receiver>.<method>(...)` calls, resolves the receiver expression
+      # to the variables it can evaluate to ({ReceiverAlias.candidates}), and widens each one
+      # against the outer scope. A `LocalVariableReadNode` with `depth == 0` is skipped — Prism's
+      # `depth` counts scope hops outward, so `0` means a block-local, not a capture; an
+      # `InstanceVariableReadNode` is always method-scope and always applies. The widening is
+      # always safe — it can only LOSE precision — so blindly propagating is sound regardless of
+      # whether the block actually runs.
       #
       # Recurses into nested expression nodes so chained / nested forms (`arr << f(x); arr <<
       # g(y)`, `arr.push(x) if cond`) are all caught. Does NOT recurse into nested
@@ -174,15 +174,20 @@ module Rigor
         receiver = call_node.receiver
         return scope if receiver.nil?
 
-        case receiver
-        when Prism::LocalVariableReadNode
-          return scope if receiver.depth.zero?
+        ReceiverAlias.candidates(receiver).reduce(scope) do |acc, read|
+          # A block-local read (`depth == 0`) is not a capture of the outer scope, so widening its
+          # name against the OUTER scope would hit an unrelated same-named binding.
+          next acc if read.is_a?(Prism::LocalVariableReadNode) && read.depth.zero?
 
-          widen_local(call_node.name, receiver.name, scope)
-        when Prism::InstanceVariableReadNode
-          widen_ivar(call_node.name, receiver.name, scope)
-        else
-          scope
+          widen_alias_read(call_node.name, read, acc)
+        end
+      end
+
+      def widen_alias_read(method_name, read, scope)
+        case read
+        when Prism::LocalVariableReadNode then widen_local(method_name, read.name, scope)
+        when Prism::InstanceVariableReadNode then widen_ivar(method_name, read.name, scope)
+        else scope
         end
       end
 

data/lib/rigor/inference/narrowing.rb

@@ -1169,7 +1169,9 @@ module Rigor
         # so the proven-absent key reads `nil`. Returns the input unchanged when nothing
         # applies (caller detects "no narrowing"). Only an *optional* present key is removed: a
         # required key makes `key?` always true (the false edge is dead, leave the shape opaque)
-        # and a key absent from `pairs` already reads `nil`.
+        # and a key absent from `pairs` already reads `nil` on a closed shape. On an open shape an
+        # undeclared key keeps reading `untyped` on this edge — sound but imprecise, since the shape
+        # carries no per-key exclusion to record what the guard just proved absent.
         def narrow_hash_key_absent(type, key)
           case type
           when Type::HashShape

data/lib/rigor/inference/optimistic_origin.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    # Marks a value whose *nil-freeness* rests on Rigor's deliberate choice to ignore core RBS's
+    # `%a{implicitly-returns-nil}` annotation rather than on the value's class. See
+    # docs/internal-spec/inference-engine.md § "That deferred-to answer is nil-free for a lookup that can
+    # miss": `Hash#[]` reads as `V` and `Array#first` as `E` because pessimising them to `V?` costs 25
+    # measured false positives on Rigor's own `lib`. The consequence the spec draws is that such a value is
+    # **optimistic, not proof** — `MAP[key]` reading as `"x" | "y"` asserts nothing about whether the key was
+    # present.
+    #
+    # A side channel in the ADR-75 / ADR-82 sense: it never participates in subtyping, consistency,
+    # normalization or erasure, and no diagnostic fires from it. It differs from {DynamicOrigin} in what it
+    # attaches to — the value here is *not* `Dynamic`; it is an ordinary `Union` / `Constant` / `Nominal`
+    # that happens to have been produced optimistically.
+    #
+    # Issue #286: the `if` / `unless` branch elision is a third consumer of `Narrowing.predicate_certainty`,
+    # and unlike `flow.always-truthy-condition` and the `&&` / `||` gate it is not constrained by the spec
+    # passage above. This channel is what lets a certainty judgment tell the two apart.
+    module OptimisticOrigin
+      # The core-RBS annotation `RbsDispatch` reads the return type past.
+      ANNOTATION = "implicitly-returns-nil"
+
+      # The single cause carried today. Kept as a symbol (rather than a bare `true`) so a later slice can
+      # distinguish further optimistic families without changing the table's shape.
+      IMPLICITLY_RETURNS_NIL = :implicitly_returns_nil
+
+      module_function
+
+      # Whether the overload the selector actually picked carries the ignored annotation. The judgment is
+      # per-overload, which is what makes it precise: `Array#first` is optimistic while `Array#first(3)` is
+      # not, and `String#[]` / `Enumerable#find` are honest because they already spell the miss as `?`.
+      #
+      # @param method_definition [RBS::Definition::Method]
+      # @param method_type [RBS::MethodType] the overload {OverloadSelector.select} returned
+      # @return [Boolean]
+      def optimistic_overload?(method_definition, method_type)
+        type_def = matching_type_def(method_definition, method_type)
+        return false unless type_def.respond_to?(:overload_annotations)
+
+        type_def.overload_annotations.any? { |annotation| annotation.string == ANNOTATION }
+      end
+
+      # `RBS::Definition::Method#defs` runs parallel to `#method_types`, and the selector returns one of the
+      # latter's elements verbatim (`ReceiverAffinity.reorder` permutes the array without copying its
+      # members), so identity resolves the overload exactly. Equality is a fallback for any future path that
+      # rebuilds the method type.
+      def matching_type_def(method_definition, method_type)
+        return nil unless method_definition.respond_to?(:defs)
+
+        defs = method_definition.defs
+        defs.find { |type_def| type_def.type.equal?(method_type) } ||
+          defs.find { |type_def| type_def.type == method_type }
+      end
+    end
+  end
+end

data/lib/rigor/inference/protection_scanner.rb

@@ -3,6 +3,7 @@
 require_relative "scope_indexer"
 require_relative "origin_lookup"
 require_relative "../source/node_walker"
+require_relative "../analysis/check_rules/inferred_param_guard"
 
 module Rigor
   module Inference
@@ -20,7 +21,11 @@ module Rigor
       # A single unprotected call site.
       Site = Data.define(:line, :receiver, :method_name, :dynamic_origin)
 
-      FileResult = Data.define(:protected_count, :unprotected_count, :sites) do
+      # `lower_bound_typed` is a split WITHIN `protected_count`, never a move out of it (issue #263):
+      # a site whose receiver is concrete but rooted at a WD6b-marked inferred parameter (
+      # {Analysis::CheckRules::InferredParamGuard.rooted?}) is a lower-bound type — `protected_count`
+      # and `ratio` stay exactly as before, so `--threshold` never moves on unchanged code.
+      FileResult = Data.define(:protected_count, :unprotected_count, :lower_bound_typed, :sites) do
         def total = protected_count + unprotected_count
 
         # Protected ratio; a file with no dispatch sites is vacuously fully protected (nothing to get
@@ -37,6 +42,7 @@ module Rigor
       def scan(root)
         index = ScopeIndexer.index(root, default_scope: @scope)
         protected_count = 0
+        lower_bound_typed = 0
         sites = []
 
         Source::NodeWalker.each(root) do |node|
@@ -46,6 +52,7 @@ module Rigor
           receiver_type = scope.type_of(node.receiver)
           if concrete_receiver?(receiver_type)
             protected_count += 1
+            lower_bound_typed += 1 if lower_bound_typed?(node.receiver, scope)
           else
             origin = OriginLookup.origin_for(scope, node.receiver)
             sites << Site.new(
@@ -57,7 +64,8 @@ module Rigor
           end
         end
 
-        FileResult.new(protected_count: protected_count, unprotected_count: sites.size, sites: sites)
+        FileResult.new(protected_count: protected_count, unprotected_count: sites.size,
+                       lower_bound_typed: lower_bound_typed, sites: sites)
       end
 
       private
@@ -77,6 +85,14 @@ module Rigor
         end
       end
 
+      # ADR-67 WD6b (issue #263) — true when a concrete receiver is rooted at an inferred-but-undeclared
+      # parameter: the type is a call-site lower bound, so the negative in-body rules decline on it (no
+      # diagnostic can actually fire here yet). Delegates to the single-homed shared predicate every
+      # negative rule already consults — nothing is re-derived.
+      def lower_bound_typed?(receiver, scope)
+        Analysis::CheckRules::InferredParamGuard.rooted?(receiver, scope)
+      end
+
       def safe_describe(type)
         type.respond_to?(:describe) ? type.describe(:short) : type.to_s
       rescue StandardError