rigortype 0.3.0 → 0.3.2

data/lib/rigor/inference/receiver_alias.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    # Which variables can a receiver EXPRESSION evaluate to?
+    #
+    # A receiver-fact invalidation (see {MutationWidening}) has to name the binding it invalidates,
+    # and the overwhelmingly common receiver — a bare `arr` / `@arr` read — names exactly one. But a
+    # receiver may also *select* among variables without naming any of them:
+    #
+    #     (kind == :required ? required : optional)[key] = info
+    #
+    # The mutation lands on whichever of `required` / `optional` the ternary picked, so BOTH are
+    # possible targets and both must forget their literal shape. Reading only the syntactic head
+    # left both hashes carrying the empty `HashShape` the literal `{}` wrote, and a downstream
+    # `.empty?` then constant-folded into a false `flow.always-truthy-condition`
+    # ([#277](https://github.com/rigortype/rigor/issues/277)).
+    #
+    # The recursion covers only the forms whose value IS one of the sub-expressions: `if` / `unless`
+    # (including the ternary spelling), the short-circuit operators, and the transparent wrappers.
+    # Anything else — an index read (`declared[kind] << key`), a call result, a literal — names an
+    # object no binding can be attributed to and yields `[]`, which is what every receiver form
+    # outside the single-read case already contributed. The walk is depth-capped so a pathological
+    # nest cannot make receiver classification unbounded.
+    module ReceiverAlias
+      # Deep enough for any hand-written selection; a nest beyond it degrades to "names no binding".
+      WALK_DEPTH_CAP = 6
+
+      module_function
+
+      # @param node  [Prism::Node, nil] the receiver expression.
+      # @param depth [Integer] recursion depth, internal.
+      # @return [Array<Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode>] every variable
+      #   read the expression can evaluate to; empty when it can evaluate to none.
+      def candidates(node, depth = 0)
+        return [] if node.nil? || depth > WALK_DEPTH_CAP
+
+        case node
+        when Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode then [node]
+        when Prism::ParenthesesNode then candidates(node.body, depth + 1)
+        when Prism::StatementsNode then candidates(node.body.last, depth + 1)
+        when Prism::ElseNode then candidates(node.statements, depth + 1)
+        when Prism::IfNode then branches(node.statements, node.subsequent, depth)
+        when Prism::UnlessNode then branches(node.statements, node.else_clause, depth)
+        when Prism::OrNode, Prism::AndNode then branches(node.left, node.right, depth)
+        else []
+        end
+      end
+
+      def branches(first, second, depth)
+        candidates(first, depth + 1) + candidates(second, depth + 1)
+      end
+    end
+  end
+end

data/lib/rigor/inference/scope_indexer.rb

@@ -1275,16 +1275,40 @@ module Rigor
       end
 
       # Merges two `class_name => { method => kind }` tables, unioning the per-class method maps (so a seeded cross-file
-      # table and the current file's table combine instead of clobbering).
+      # table and the current file's table combine instead of clobbering). A name recorded on both sides — an instance
+      # `def` here and a `class << self` twin there — merges to {Scope::DiscoveryIndex::METHOD_KIND_BOTH} rather than
+      # letting the overlay's kind win (#239).
       def deep_merge_class_methods(base, overlay)
         return overlay if base.nil? || base.empty?
         return base if overlay.empty?
 
         base.merge(overlay) do |_class_name, base_methods, overlay_methods|
-          base_methods.merge(overlay_methods)
+          merge_method_kinds(base_methods, overlay_methods)
         end
       end
 
+      # `{ method => kind }` union that promotes a kind disagreement to `METHOD_KIND_BOTH` instead of clobbering.
+      def merge_method_kinds(base_methods, overlay_methods)
+        base_methods.merge(overlay_methods) do |_method_name, base_kind, overlay_kind|
+          base_kind == overlay_kind ? base_kind : Scope::DiscoveryIndex::METHOD_KIND_BOTH
+        end
+      end
+
+      # The single write path into a `class_name => { method => kind }` existence table. Every recorder goes through
+      # it so a class that defines one name on both sides keeps both facts: the table is keyed by name alone, so a
+      # bare assignment silently replaced the other side's kind and `Scope#discovered_method?` then answered false for
+      # a method the source plainly defines (#239).
+      def record_method_kind(accumulator, class_name, method_name, kind)
+        table = (accumulator[class_name] ||= {})
+        recorded = table[method_name]
+        table[method_name] =
+          if recorded.nil? || recorded == kind
+            kind
+          else
+            Scope::DiscoveryIndex::METHOD_KIND_BOTH
+          end
+      end
+
       # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/AbcSize
       # Combined `walk_methods` + `walk_def_nodes` descent. The two walks had identical class / module / singleton-class
       # / meta-block traversals and both stopped at `DefNode`; the only divergences are leaf actions (recorded into the
@@ -1393,8 +1417,7 @@ module Rigor
         return if members.empty?
 
         class_name = qualified_prefix.join("::")
-        table = (accumulator[class_name] ||= {})
-        members.each { |member| table[member] ||= :instance }
+        members.each { |member| record_method_kind(accumulator, class_name, member, :instance) }
       end
 
       # The Symbol member names of a `Data.define(*Symbol)` / `Struct.new(*Symbol [, keyword_init:])` call. For
@@ -1412,8 +1435,7 @@ module Rigor
         class_name = qualified_prefix.join("::")
         singleton = def_singleton?(def_node, qualified_prefix, in_singleton_class)
         kind = singleton ? :singleton : :instance
-        accumulator[class_name] ||= {}
-        accumulator[class_name][def_node.name] = kind
+        record_method_kind(accumulator, class_name, def_node.name, kind)
       end
 
       # `def Foo.bar` inside `module Foo` (or `def Meta.init` inside `module Meta`) is semantically equivalent to `def
@@ -1918,7 +1940,7 @@ module Rigor
         class_name = qualified_prefix.join("::")
         new_name = alias_node.new_name.unescaped.to_sym
         kind = in_singleton_class ? :singleton : :instance
-        (accumulator[class_name] ||= {})[new_name] = kind
+        record_method_kind(accumulator, class_name, new_name, kind)
       end
 
       # Post-pass over the `def_nodes` accumulator: for every `alias` declaration inside a class body, if the original
@@ -1981,8 +2003,7 @@ module Rigor
         return if method_name.nil?
 
         class_name = qualified_prefix.join("::")
-        accumulator[class_name] ||= {}
-        accumulator[class_name][method_name] = in_singleton_class ? :singleton : :instance
+        record_method_kind(accumulator, class_name, method_name, in_singleton_class ? :singleton : :instance)
       end
 
       # The `attr_*` accessor macros that introduce methods Rigor must treat as source-declared. Without this, a class
@@ -2005,9 +2026,8 @@ module Rigor
           base = literal_method_name(arg)
           next if base.nil?
 
-          accumulator[class_name] ||= {}
-          accumulator[class_name][base] = kind if reader
-          accumulator[class_name][:"#{base}="] = kind if writer
+          record_method_kind(accumulator, class_name, base, kind) if reader
+          record_method_kind(accumulator, class_name, :"#{base}=", kind) if writer
         end
       end
 
@@ -2352,7 +2372,7 @@ module Rigor
         file_index[:def_nodes].each { |cn, methods| (acc[:def_nodes][cn] ||= {}).merge!(methods) }
         file_index[:singleton_def_nodes].each { |cn, methods| (acc[:singleton_def_nodes][cn] ||= {}).merge!(methods) }
         file_index[:method_visibilities].each { |cn, table| (acc[:method_visibilities][cn] ||= {}).merge!(table) }
-        file_index[:methods].each { |cn, table| (acc[:methods][cn] ||= {}).merge!(table) }
+        file_index[:methods].each { |cn, table| acc[:methods][cn] = merge_method_kinds(acc[:methods][cn] || {}, table) }
         fold_def_sources(acc, :def_sources, file_index[:def_sources])
         fold_def_sources(acc, :singleton_def_sources, file_index[:singleton_def_sources])
       end
@@ -2468,10 +2488,18 @@ module Rigor
 
       # Removes, per class, the method names that have a project `def` node, leaving only
       # accessor/alias/define_method-introduced methods in the cross-file suppression table.
+      #
+      # `def_nodes` is the INSTANCE-side table, so a name recorded on both sides keeps its singleton half: that half
+      # comes from a `def self.x` / `class << self` definition this rule never covered, and dropping it whole would
+      # reintroduce #239's false `call.undefined-method` across files.
       def subtract_def_methods(methods, def_nodes)
         methods.each_with_object({}) do |(class_name, table), out|
           defs = def_nodes[class_name] || {}
-          kept = table.reject { |method_name, _kind| defs.key?(method_name) }
+          kept = table.each_with_object({}) do |(method_name, kind), acc|
+            next acc[method_name] = kind unless defs.key?(method_name)
+
+            acc[method_name] = :singleton if kind == Scope::DiscoveryIndex::METHOD_KIND_BOTH
+          end
           out[class_name] = kept unless kept.empty?
         end
       end
@@ -2517,7 +2545,7 @@ module Rigor
           (acc[:method_visibilities][class_name] ||= {}).merge!(table)
         end
         file_methods.each do |class_name, table|
-          (acc[:methods][class_name] ||= {}).merge!(table)
+          acc[:methods][class_name] = merge_method_kinds(acc[:methods][class_name] || {}, table)
         end
       end
 
@@ -2570,24 +2598,47 @@ module Rigor
         node.rigor_each_child { |child| collect_class_decls(child, qualified_prefix, accumulator) }
       end
 
-      # T1 (template-corpora survey) — record a `Const = Class.new(Super)` (and the bare `Class.new` / `Module.new`)
-      # class-creating constant in the cross-file discovery table so a reference to `Const` from ANOTHER file under the
-      # same namespace resolves to the project class instead of falling through to a core same-named class
+      # T1 (template-corpora survey) — record a class-creating constant write (`Const = Class.new(Super)`, the bare
+      # `Class.new` / `Module.new`, and the `Data.define(*sym)` / `Struct.new(*sym)` forms, each with or without a
+      # block) in the cross-file discovery table so a reference to `Const` from ANOTHER file under the same namespace
+      # resolves to the project class instead of falling through to a same-named class elsewhere
       # (`Liquid::SyntaxError = Class.new(Error)` referenced in a sibling file's `rescue SyntaxError => e`, which
       # otherwise resolved to core `::SyntaxError`). Mirrors the single-file `in_source_constants` answer, which types
-      # `Class.new(Super)` as `Singleton[Super]` (the constructed class answers method lookups through Super's chain).
-      # The superclass name is resolved lexically against the enclosing prefix; a bare `Class.new` with no superclass
-      # (or `Module.new`) types as `Singleton[Const]` itself. The block form is left to the existing
-      # `meta_new_block_body` machinery — only the plain `Class.new(Super)` constant (the namespaced-sibling-error
-      # idiom) is added here.
+      # `Class.new(Super)` as `Singleton[Super]` (the constructed class answers method lookups through Super's chain)
+      # and every other recognised form as `Singleton[Const]`.
+      #
+      # #271 — the Data/Struct forms are here because their absence was an ACTIVE false positive, not merely a missed
+      # resolution: a nested `Const = Data.define(...)` invisible cross-file lets Ruby's lexical walk continue to the
+      # PARENT namespace's same-named sibling, so `Analysis::PluginFactFingerprint.from_registry(...).opaque?` typed
+      # its receiver as the unrelated `Rigor::Analysis::Result` and reported `call.undefined-method` on correct code.
+      # Nested `Result` / `Entry` / `Config` Data constants shadowing a sibling are ordinary Ruby, and only the
+      # DEFINING file's `in_source_constants` (never part of the project seed) knew about them.
       def record_class_new_constant_decl(node, qualified_prefix, accumulator)
         rvalue = node.value
-        return unless class_new_call?(rvalue) || module_new_call?(rvalue)
-        return if rvalue.block # block form: handled by meta_new_block_body walks
+        return unless meta_new_constant_rvalue?(rvalue)
 
         full = (qualified_prefix + [node.name.to_s]).join("::")
-        super_name = class_new_superclass_name(rvalue, qualified_prefix, accumulator)
-        accumulator[full] = Type::Combinator.singleton_of(super_name || full)
+        accumulator[full] = Type::Combinator.singleton_of(
+          meta_new_constant_decl_name(rvalue, full, qualified_prefix, accumulator)
+        )
+      end
+
+      # The four recognised class-creating rvalue shapes at constant-write position — the same set
+      # {#meta_new_block_body} recognises, so the cross-file table and the per-file block-as-method walk agree on what
+      # counts as a declaration.
+      def meta_new_constant_rvalue?(rvalue)
+        class_new_call?(rvalue) || module_new_call?(rvalue) ||
+          data_define_call?(rvalue) || struct_new_call?(rvalue)
+      end
+
+      # The name the constant's `Singleton[...]` carries. Only a block-less `Class.new(Super)` borrows its superclass's
+      # name (the constructed class answers lookups through `Super`'s chain and declares nothing of its own); every
+      # other form — Data/Struct members, any block body — owns methods under its OWN qualified name, which is exactly
+      # what the per-file `meta_new_constant_type` answers.
+      def meta_new_constant_decl_name(rvalue, full, qualified_prefix, accumulator)
+        return full if rvalue.block || data_define_call?(rvalue) || struct_new_call?(rvalue)
+
+        class_new_superclass_name(rvalue, qualified_prefix, accumulator) || full
       end
 
       # Lexically-qualified name of a `Class.new(Super)` superclass argument, or nil when there is no positional

data/lib/rigor/inference/statement_evaluator.rb

@@ -247,9 +247,31 @@ module Rigor
 
         bound = bound.without_inferred_param_mark(node.name)
         bound = bound.with_local_origin(node.name, rhs_origin(node.value, post_rhs, rhs_type))
+        bound = bound.with_optimistic_local(node.name, optimistic_rhs_origin(node.value, post_rhs))
         [rhs_type, bound]
       end
 
+      # Issue #286 — the optimistic-nil-free counterpart of {#rhs_origin}, differing in two ways. It does not
+      # gate on `Dynamic`: the values this channel marks are ordinary `Union` / `Constant` / `Nominal`
+      # carriers, which is the whole point. And it resolves a bare local read through its binding, so
+      # `w = v` keeps the mark — the same propagation `OriginLookup` performs for the Dynamic channel.
+      def optimistic_rhs_origin(value_node, scope_after_rhs)
+        optimistic_origin_for(value_node, scope_after_rhs)
+      end
+
+      # The effective optimistic-nil-free cause of an expression: the mark on its own node, else — for a bare
+      # local read or a local write used in value position (`if (x = MAP[k])`, where the write has already
+      # bound the mark) — the one propagated onto the binding.
+      def optimistic_origin_for(node, scope)
+        recorded = scope.optimistic_origins[node]
+        return recorded if recorded
+
+        case node
+        when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
+        when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
+        end
+      end
+
       # ADR-82 WD1 — the {Inference::DynamicOrigin} cause to propagate onto a local / ivar being bound to `rhs`.
       # Returns the cause recorded on the assignment's rhs node when the value is `Dynamic` (so a later
       # `x` / `@x` receiver-read resolves to why it is dynamic), else `nil` — `with_local_origin` /
@@ -277,6 +299,7 @@ module Rigor
         rhs_type, post_rhs = sub_eval(node.value, scope)
         bound = post_rhs.with_ivar(node.name, rhs_type)
         bound = bound.with_ivar_origin(node.name, rhs_origin(node.value, post_rhs, rhs_type))
+        bound = bound.with_optimistic_ivar(node.name, optimistic_rhs_origin(node.value, post_rhs))
         [rhs_type, bound]
       end
 
@@ -543,19 +566,34 @@ module Rigor
       # non-falsey carriers like `Nominal[Integer]` (Integer is always truthy in Ruby — including 0) also collapse the
       # dead else.
       def live_branch_for_if(node, pred_type, post_pred)
-        case Narrowing.predicate_certainty(pred_type)
+        verdict = optimistic_carrier?(node.predicate, post_pred) ? nil : Narrowing.predicate_certainty(pred_type)
+        case verdict
         when :truthy then eval_branch_or_nil(node.statements, post_pred)
         when :falsey then eval_branch_or_nil(node.subsequent, post_pred)
         end
       end
 
       def live_branch_for_unless(node, pred_type, post_pred)
-        case Narrowing.predicate_certainty(pred_type)
+        verdict = optimistic_carrier?(node.predicate, post_pred) ? nil : Narrowing.predicate_certainty(pred_type)
+        case verdict
         when :truthy then eval_branch_or_nil(node.else_clause, post_pred)
         when :falsey then eval_branch_or_nil(node.statements, post_pred)
         end
       end
 
+      # ADR-101 — the branch elision MUST NOT conclude truthiness from a carrier whose nil-freeness rests on
+      # the `%a{implicitly-returns-nil}` that `RbsDispatch` reads past. Such a value is optimistic, not proof
+      # (see {Inference::OptimisticOrigin} and docs/internal-spec/inference-engine.md), so eliding an arm on
+      # it deletes a branch the program really takes when the lookup misses.
+      #
+      # The decline lives here and NOT in `Narrowing.falsey_nominal?` / `.narrow_falsey`: `&&=` / `||=` and
+      # the and/or surviving-left edge read those too, and widening the falsey fragment there would re-admit
+      # `nil` into a bound local and buy `possible nil receiver` false positives — a soundness fix paid for
+      # in FPs, which is the wrong trade.
+      def optimistic_carrier?(predicate, scope)
+        !optimistic_origin_for(predicate, scope).nil?
+      end
+
       def eval_else(node)
         return [Type::Combinator.constant_of(nil), scope] if node.statements.nil?
 

data/lib/rigor/language_server/buffer_resolution.rb

@@ -13,12 +13,15 @@ module Rigor
     module BufferResolution
       private
 
-      # Resolves `[path, entry]` for the document `uri`, or nil when the uri has no file path or no open
-      # buffer. A caller that destructures `path, entry = buffer_for(uri)` can guard on `entry.nil?` to cover
-      # both misses (a nil return leaves both locals nil).
+      # Resolves `[path, entry]` for the document `uri`, or nil when the uri has no file path, no open buffer,
+      # or a buffer the server could not keep in sync with the editor (see `BufferTable#apply_changes`) — a
+      # position answered from text that has drifted from the editor's is worse than no answer. A caller that
+      # destructures `path, entry = buffer_for(uri)` can guard on `entry.nil?` to cover every miss (a nil
+      # return leaves both locals nil).
       def buffer_for(uri)
         path = Uri.to_path(uri)
         return nil if path.nil?
+        return nil if @buffer_table.desynchronized?(uri)
 
         entry = @buffer_table[uri]
         return nil if entry.nil?

data/lib/rigor/language_server/buffer_table.rb

@@ -1,13 +1,17 @@
 # frozen_string_literal: true
 
+require_relative "incremental_sync"
+
 module Rigor
   module LanguageServer
     # Per-session virtual file table. The LSP server maintains the canonical view of every open buffer here;
     # analysis (slice 4+) reads from this table instead of disk so in-flight edits are reflected immediately.
     #
-    # Keyed by `DocumentUri` (LSP `file://...` URIs). v1 ships FULL text sync (LSP
-    # `TextDocumentSyncKind::Full = 1`) so each `didChange` carries the entire buffer text — there's no
-    # incremental edit application yet. Incremental sync is slice 10 (deferred per the design doc).
+    # Keyed by `DocumentUri` (LSP `file://...` URIs). Sync is INCREMENTAL (LSP
+    # `TextDocumentSyncKind::Incremental = 2`): a `didChange` carries range edits which {#apply_changes} splices
+    # into the held text through {IncrementalSync}. The full-text form ({#change}, and a `contentChanges` entry
+    # with no `range`) stays supported — it is still legal under incremental sync and is what `didOpen` and a
+    # client-side resync send.
     class BufferTable
       # @!attribute uri      [String]  the LSP DocumentUri (e.g. `file:///abs/path/lib/foo.rb`).
       # @!attribute bytes    [String]  the current full text of the buffer.
@@ -16,26 +20,84 @@ module Rigor
 
       def initialize
         @entries = {}
+        @desynchronized = {}
+        @dirty = {}
       end
 
       # Records a `textDocument/didOpen` event. Replaces any existing entry (LSP clients may re-open a
-      # previously closed URI; the new version is authoritative).
+      # previously closed URI; the new version is authoritative) and clears any desynchronised mark — the
+      # payload carries the client's full text, so the two views agree again.
       def open(uri:, bytes:, version:)
+        @desynchronized.delete(uri)
+        @dirty.delete(uri)
         @entries[uri] = Entry.new(uri: uri, bytes: bytes, version: version)
       end
 
-      # Records a `textDocument/didChange` event under FULL sync. The full new buffer text replaces the entry.
-      # If the client sends a `didChange` for a URI that was never opened (spec violation), the entry is still
+      # Records a full-text `textDocument/didChange`. The full new buffer text replaces the entry. If the
+      # client sends a `didChange` for a URI that was never opened (spec violation), the entry is still
       # created — defensive.
       def change(uri:, bytes:, version:)
+        @desynchronized.delete(uri)
+        @dirty[uri] = true
         @entries[uri] = Entry.new(uri: uri, bytes: bytes, version: version)
       end
 
+      # Applies a `textDocument/didChange` payload under INCREMENTAL sync. Each entry of `changes` is applied
+      # in order against the result of the previous one, per the LSP contract.
+      #
+      # On success the entry is replaced with the spliced text at the new version. On failure — a malformed
+      # change, or a range edit for a URI with no held buffer — the held text is left EXACTLY as it was and the
+      # URI is marked desynchronised: the server's view and the editor's view have diverged, and every position
+      # computed from the stale text would be wrong. Consumers check {#desynchronized?} and decline to answer
+      # rather than answering wrongly; the mark clears on the next `didOpen` or full-text change.
+      #
+      # @return [Boolean] true when the changes were applied.
+      def apply_changes(uri:, changes:, version:)
+        text = IncrementalSync.apply_all(@entries[uri]&.bytes, changes)
+        @desynchronized.delete(uri)
+        @dirty[uri] = true
+        @entries[uri] = Entry.new(uri: uri, bytes: text, version: version)
+        true
+      rescue IncrementalSync::UnappliableChange => e
+        @desynchronized[uri] = e.message
+        false
+      end
+
+      # @return [Boolean] true when the last `didChange` for `uri` could not be applied, so the held text no
+      #   longer matches the editor's.
+      def desynchronized?(uri)
+        @desynchronized.key?(uri)
+      end
+
+      # @return [String, nil] why `uri` is desynchronised, for the log line; nil when it is in sync.
+      def desynchronization_reason(uri)
+        @desynchronized[uri]
+      end
+
       # Records a `textDocument/didClose` event. The entry is removed. Subsequent reads via `#[]` return nil.
       def close(uri:)
+        @desynchronized.delete(uri)
+        @dirty.delete(uri)
         @entries.delete(uri)
       end
 
+      # Records a `textDocument/didSave`. The client has written the buffer, so the held text and the file on
+      # disk agree again and the URI stops being dirty.
+      #
+      # Dirtiness is the PROTOCOL's notion — "the client told us it changed and has not told us it saved" —
+      # not a byte comparison against disk. A comparison would look stricter and be weaker: it races with the
+      # editor's own write, and the server's truth is what the client notified.
+      def save(uri:)
+        @dirty.delete(uri)
+      end
+
+      # @return [Boolean] true when `uri` has unsaved changes. A buffer that is dirty may only be published
+      #   from an analysis that bound ITS bytes — see the publish-set invariant in
+      #   `docs/design/20260517-language-server.md`.
+      def dirty?(uri)
+        @dirty.key?(uri)
+      end
+
       def [](uri)
         @entries[uri]
       end