rigortype 0.3.1 → 0.3.2

data/lib/rigor/environment.rb

@@ -399,23 +399,38 @@ module Rigor
         ) { invoke_synthesizer_safely(callable, path) || "" }
       end
 
-      # ADR-32 WD6 — route a synthesizer return value through the per-run failure reporter. The
+      # ADR-32 WD6 / WD12 — route a synthesizer return value through the per-run reporter. The
       # synthesizer's contract (declared in
-      # `plugins/rigor-rbs-inline/lib/rigor/plugin/rbs_inline.rb`) admits three return shapes:
-      #   - `String` (non-empty) → successful RBS source
-      #   - `nil` / `""`         → no contribution
-      #   - `[:error, message]`  → parse failed
+      # `plugins/rigor-rbs-inline/lib/rigor/plugin/rbs_inline.rb`) admits four return shapes:
+      #   - `String` (non-empty)         → successful RBS source
+      #   - `nil` / `""`                 → no contribution
+      #   - `[:error, message]`          → parse failed (WD6)
+      #   - `[:ok, source, [message…]]`  → synthesis SUCCEEDED, but an annotation was parsed and not
+      #                                    honoured (WD12)
       # The error tuple is converted into a reporter entry + treated as "no contribution" so the analysis
-      # pipeline continues. Reporter is `nil` for callers that don't care (legacy Environment.new, tests).
+      # pipeline continues. The WD12 tuple keeps its `source` — the file's other annotations are good, and
+      # dropping them to report one omission would be a strictly worse trade. Reporter is `nil` for callers
+      # that don't care (legacy Environment.new, tests).
+      #
+      # A cached entry written before WD12 is a bare `String`, which falls through the `is_a?(Array)` guard
+      # unchanged, so no cache-descriptor bump is needed for the new shape.
       def interpret_synthesizer_outcome(outcome, plugin, path, reporter)
-        return outcome unless outcome.is_a?(Array) && outcome[0] == :error
+        return outcome unless outcome.is_a?(Array)
+
+        case outcome[0]
+        when :error
+          record_synthesis_entry(reporter, plugin, path, outcome[1], :failed)
+          nil
+        when :ok
+          Array(outcome[2]).each { |m| record_synthesis_entry(reporter, plugin, path, m, :not_honoured) }
+          outcome[1]
+        else
+          outcome
+        end
+      end
 
-        reporter&.record(
-          plugin_id: plugin.manifest.id,
-          path: path,
-          message: outcome[1].to_s
-        )
-        nil
+      def record_synthesis_entry(reporter, plugin, path, message, kind)
+        reporter&.record(plugin_id: plugin.manifest.id, path: path, message: message.to_s, kind: kind)
       end
 
       SYNTHESIZER_CACHE_PRODUCER_ID = "plugin.source_rbs_synthesizer"

data/lib/rigor/inference/expression_typer.rb

@@ -609,6 +609,18 @@ module Rigor
         elide_or_union(node.predicate, else_type, then_type)
       end
 
+      # Issue #286 — the effective optimistic-nil-free cause of an expression, resolving a bare local read (or
+      # a local write in value position) through its binding. Mirrors `StatementEvaluator#optimistic_origin_for`.
+      def optimistic_origin_for(node)
+        recorded = scope.optimistic_origins[node]
+        return recorded if recorded
+
+        case node
+        when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
+        when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
+        end
+      end
+
       def if_else_type(subsequent)
         return Type::Combinator.constant_of(nil) if subsequent.nil?
 
@@ -632,6 +644,9 @@ module Rigor
       # `Constant[false]` fold one branch; `Union[true, false]`, `Dynamic[T]`, and `Top` keep both branches live.
       def constant_predicate_polarity(predicate)
         return nil if predicate.nil?
+        # ADR-101 — decline on an optimistically nil-free carrier; see
+        # `StatementEvaluator#optimistic_carrier?` for why the gate is here and not in `Narrowing`.
+        return nil unless optimistic_origin_for(predicate).nil?
 
         Narrowing.predicate_certainty(type_of(predicate))
       end

data/lib/rigor/inference/fork_map.rb

@@ -2,6 +2,8 @@
 
 require "tmpdir"
 
+require_relative "../runtime/jit"
+
 module Rigor
   module Inference
     # Generic fork-over-slices map for the embarrassingly-parallel per-file passes of the
@@ -56,6 +58,13 @@ module Rigor
       # (skipping `at_exit` / stdio flush — the payload is durable on disk). Any failure exits non-zero so
       # the parent re-runs the slice in-process.
       def run_worker(slice, block, out_path)
+        # Re-arm deferred YJIT in the child, exactly as the check fork pool does
+        # ({Analysis::Runner::PoolCoordinator#run_fork_worker}). The parent's deadline thread does not survive
+        # `fork`, so without this a worker runs its whole slice un-JITted while the parent JITs the tail it no
+        # longer runs — the pool was a *pessimization* on long runs (`coverage --protection --mutation
+        # lib/rigor/analysis`: 37s sequential against 67s at eight workers). The child picks up what is left of
+        # the parent's window rather than a fresh one; {Runtime::Jit.rearm_after_fork} carries the mechanism.
+        Runtime::Jit.rearm_after_fork
         File.binwrite(out_path, Marshal.dump(block.call(slice)))
         exit!(0)
       rescue StandardError

data/lib/rigor/inference/method_dispatcher/constant_folding.rb

@@ -117,7 +117,16 @@ module Rigor
           :succ, :pred, :next, :abs, :magnitude,
           :bit_length, :to_s, :to_i, :to_int, :to_f,
           :floor, :ceil, :round, :truncate, :chr,
-          :inspect, :-@, :+@, :~, :to_r, :to_c
+          :inspect, :-@, :+@, :~, :to_r, :to_c,
+          # `rationalize` (no-arg form) is the Integer sibling of the already-folded
+          # `Float#rationalize` / `Rational#rationalize` — pure, returns `Rational(self, 1)`. The
+          # optional-`eps` binary form is NOT mirrored here: unlike `Rational#rationalize` (which reaches
+          # `NUMERIC_BINARY`'s catalog fallback via `numeric.yml`'s `nurat_rationalize` leaf entry),
+          # `numeric.yml` carries no `rationalize` entry for Integer/Float, so the 1-arg call declines to
+          # the RBS tier exactly as it does today — this only closes the 0-arg gap.
+          # `abs2` (`self * self`, always a non-negative Integer) is the Integer sibling of the
+          # already-folded `Rational#abs2` / `Complex#abs2`.
+          :rationalize, :abs2
         ].freeze
         FLOAT_UNARY = Set[
           :zero?, :positive?, :negative?, :nonzero?,
@@ -135,7 +144,12 @@ module Rigor
           # `self >= 0`, `Math::PI` for `self < 0`. Pure sign test, deterministic; a NaN receiver yields NaN
           # which `foldable_constant_value?` declines.
           :arg, :angle, :phase,
-          :inspect, :-@, :+@
+          :inspect, :-@, :+@,
+          # `abs2` (`self * self`) is the Float sibling of the already-folded `Rational#abs2` /
+          # `Complex#abs2` / (now) `Integer#abs2`. A non-finite receiver (`Infinity`, `NaN`) still folds
+          # via `foldable_constant_value?`'s existing NaN guard — `Infinity.abs2` is `Infinity`
+          # (foldable), `NaN.abs2` is `NaN` (declined, same as every other NaN-producing Float unary op).
+          :abs2
         ].freeze
         STRING_UNARY = Set[
           :upcase, :downcase, :capitalize, :swapcase,
@@ -195,6 +209,11 @@ module Rigor
         # `flow.always-truthy-condition`.
         REFLECTIVE_SEND_METHODS = %i[public_send send __send__].to_set.freeze
 
+        # The self-returners, the `Type::Constant` counterpart of `ShapeDispatch`'s `:shape_self` handlers
+        # (ADR-76 WD2 / ADR-78 WD3). Each returns the receiver at run time, so the value-pinned carrier
+        # survives the call.
+        CONSTANT_SELF_RETURNERS = %i[freeze itself dup clone].to_set.freeze
+
         # @return [Rigor::Type::Constant, Rigor::Type::Union, Rigor::Type::IntegerRange, nil]
         def try_dispatch(context)
           receiver = context.receiver
@@ -205,6 +224,9 @@ module Rigor
             first_arg = args.first
             return nil unless first_arg.is_a?(Type::Constant) && first_arg.value.is_a?(Symbol)
           end
+          self_return = try_fold_self_return(receiver, method_name, args)
+          return self_return if self_return
+
           # v0.0.7 — `String#%` against a `Tuple` / `HashShape` argument runs Ruby's format-string engine
           # when both sides are statically constant. The standard `numeric_set_of` path bails on Tuple /
           # HashShape arguments because they are not scalar-Constant carriers, so the special-case sits
@@ -221,6 +243,32 @@ module Rigor
           dispatch_by_arity(receiver_set, method_name, arg_sets)
         end
 
+        # `freeze` / `itself` / `dup` / `clone` on a value-pinned receiver return the receiver carrier.
+        #
+        # This sits AHEAD of the catalogue path and deliberately bypasses its purity gate, because the gate
+        # asks a question that does not apply. `String#freeze` is classified `purity: mutates_self`
+        # (`data/builtins/ruby_core/string.yml`) — correctly, since the C body sets `FL_FREEZE` — and the
+        # gate then holds it back from the pure-invoke path. But nothing here is invoked: the receiver type
+        # is returned unchanged, and freezing mutates an object's flags, not its value. `Type::Constant`
+        # pins a value, not an identity, so the mutation it performs is invisible to the carrier.
+        #
+        # The gap this closes is `FOO = "bar".freeze`, the standard way to write a String constant in
+        # Ruby, which lost its value while `%w[a b].freeze` (a Tuple, via `:shape_self`) and `"bar".-@`
+        # (classified `purity: leaf`) both kept theirs. Integer / Float / Symbol had the same hole for a
+        # different reason — no `Object`/`Kernel` catalogue owns their self-returners at all.
+        #
+        # `dup` / `clone` return a NEW object at run time, so the carrier is right about the value and
+        # silent about the identity — the same trade `shape_self` already makes, and the same one the
+        # existing `"x".dup` fold (which reaches the invoke path, `dup` being `leaf`) already makes.
+        # A `clone(freeze: false)` carries an argument and declines here.
+        def try_fold_self_return(receiver, method_name, args)
+          return nil unless args.empty?
+          return nil unless CONSTANT_SELF_RETURNERS.include?(method_name)
+          return nil unless receiver.is_a?(Type::Constant)
+
+          receiver
+        end
+
         # `Constant<String> % …` — runs the actual `String#%` operation when both sides are statically
         # known. The argument may be:
         # - A `Type::Constant` whose value is a scalar (Integer / Float / String / Symbol). Already handled

data/lib/rigor/inference/method_dispatcher/data_folding.rb

@@ -116,7 +116,7 @@ module Rigor
           map = member_map_for_new(members, context)
           return degraded_instance(class_name) if map.nil?
 
-          Type::Combinator.data_instance_of(members: map, class_name: class_name)
+          Type::Combinator.data_instance_of(members: widen_unowned_emptiness(map), class_name: class_name)
         end
 
         # Builds the member -> type map from the call's arguments, honouring the keyword vs positional

data/lib/rigor/inference/method_dispatcher/member_shape_projection.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../../type"
 require_relative "../../source/node_children"
+require_relative "../mutation_widening"
 
 module Rigor
   module Inference
@@ -18,6 +19,39 @@ module Rigor
       # Both folders `extend` this module so the projections resolve as their own module functions
       # (matching their `module_function` style).
       module MemberShapeProjection
+        # A value object's member holds a **reference** to whatever the constructor was handed, and an
+        # EMPTY container literal's emptiness is a fact about that argument at the instant of
+        # construction — never a fact about the member. The caller keeps its own alias, and "construct
+        # empty, then fill" (`r = R.new([], []); xs.each { |x| r.items << x }`) is the dominant Ruby
+        # shape, so of every literal a member map can pin, emptiness is the one falsified most often.
+        #
+        # It is also the only one whose reads fold to `nil` — `.first` / `.last` / `[]` on an empty
+        # container — and `nil` is the receiver type that fires `call.undefined-method` on correct code
+        # (issue #293). A non-empty literal's element evidence, by contrast, survives an append and its
+        # reads never fold to `nil`, so it is kept intact.
+        #
+        # So an empty `Tuple` / closed empty `HashShape` is recorded widened to its bare nominal —
+        # the same carrier, through the same helpers, that {Inference::MutationWidening} installs when
+        # it retracts a mutated local's literal shape.
+        def widen_unowned_emptiness(member_map)
+          return member_map if member_map.nil?
+
+          member_map.transform_values { |type| widened_empty_container(type) }
+        end
+
+        def widened_empty_container(type)
+          case type
+          when Type::Tuple
+            type.elements.empty? ? MutationWidening.widen_tuple(type) : type
+          when Type::HashShape
+            # An OPEN shape claims nothing about the keys it does not list — a read of an unlisted key
+            # is already `untyped`, not `nil` — so only the closed literal `{}` carries the emptiness.
+            type.closed? && type.pairs.empty? ? MutationWidening.widen_hash_shape(type) : type
+          else
+            type
+          end
+        end
+
         # A Data/Struct subclass body can redefine a member's synthesised reader (`def x`); when it does,
         # `inst.x` runs that `def`, not the member, so folding the read would be unsound. A real `def` node
         # under the class name is the discriminator (the synthesised reader has none), so an entry in the
@@ -109,7 +143,7 @@ module Rigor
           return nil unless shape.optional_keys.empty?
           return nil unless shape.pairs.keys.all? { |key| instance.members.key?(key) }
 
-          merged = instance.members.merge(shape.pairs)
+          merged = widen_unowned_emptiness(instance.members.merge(shape.pairs))
           yield(merged, instance.class_name)
         end
       end

data/lib/rigor/inference/method_dispatcher/rbs_dispatch.rb

@@ -5,6 +5,7 @@ require_relative "../../type"
 require_relative "../../rbs_extended"
 require_relative "../rbs_type_translator"
 require_relative "../void_origin"
+require_relative "../optimistic_origin"
 require_relative "overload_selector"
 
 module Rigor
@@ -362,6 +363,11 @@ module Rigor
             # to the *direct*-RBS dispatch (the receiver's own resolvable class): the user-class / Object
             # ancestor fallback nils both out (WD4 defers that, murkier, surface).
             record_void_recovery(method_type, scope, call_node, [class_name, method_name, kind])
+            # Issue #286 — the same call site is the one place that still knows the selected overload spelled
+            # its miss as `%a{implicitly-returns-nil}` rather than as `?`; the translator below reads the
+            # return type only, by the deliberate choice the spec records. Mark the result so a certainty
+            # judgment downstream can tell "nil-free because of its class" from "nil-free because we bet".
+            record_optimistic_nil_free(method_definition, method_type, scope, call_node)
 
             full_type_vars = compose_block_type_vars(method_type, type_vars, block_type)
 
@@ -386,6 +392,16 @@ module Rigor
             )
           end
 
+          # Issue #286 — record that this value's nil-freeness is a bet rather than a class property. Gated on
+          # `scope` && `call_node` exactly as {#record_void_recovery} is, which scopes it to the direct-RBS
+          # dispatch path.
+          def record_optimistic_nil_free(method_definition, method_type, scope, call_node)
+            return unless scope && call_node
+            return unless OptimisticOrigin.optimistic_overload?(method_definition, method_type)
+
+            scope.record_optimistic_origin(call_node, OptimisticOrigin::IMPLICITLY_RETURNS_NIL)
+          end
+
           def void_return?(method_type)
             fun = method_type.type
             fun.respond_to?(:return_type) && fun.return_type.is_a?(RBS::Types::Bases::Void)

data/lib/rigor/inference/method_dispatcher/regexp_folding.rb

@@ -14,17 +14,38 @@ module Rigor
       # * `new(str)` / `new(str, opts)` — constructs a Regexp at fold time when the pattern argument is a
       #   `Constant[String]`. The optional second argument may be a `Constant[Integer]` (flag bits), a
       #   `Constant[true/false]` (IGNORECASE shorthand), or absent. Returns `Constant[Regexp]`.
+      # * `compile(str)` / `compile(str, opts)` — `Regexp.compile` is a documented alias of `Regexp.new`
+      #   (same C entry point, `rb_reg_s_new`); shares `fold_new` verbatim.
+      # * `union(*patterns)` / `union(array)` — builds the combined pattern at inference time when every
+      #   element is a `Constant[String]` or `Constant[Regexp]`. Delegates to the real `Regexp.union` so the
+      #   zero-arg (`/(?!)/`), single-array-argument, and pre-built-Regexp-argument forms all match Ruby's
+      #   own semantics without separate case analysis. Returns `Constant[Regexp]`.
+      # * `linear_time?(pattern)` — one `Constant[String]` or `Constant[Regexp]` argument. Returns
+      #   `Constant[bool]`.
       #
       # === Non-constant / unsupported cases
       #
       # Returns `nil` (deferring to the next dispatcher tier) when:
       # - the receiver is not `Singleton[Regexp]`,
-      # - the required pattern argument is not a `Constant[String]`,
+      # - the required pattern argument is not a `Constant[String]` (or, for `union`/`linear_time?`, not a
+      #   `Constant[String]`/`Constant[Regexp]`),
+      # - `union` is given more elements than `UNION_LIMIT` or any element fails the constant check,
+      # - `linear_time?` is given anything other than exactly one constant argument (a `timeout:` keyword
+      #   argument is rejected this way — it would land as a second positional slot),
       # - the method is not in the supported set.
       module RegexpFolding
         REGEXP_ESCAPE_METHODS = Set[:escape, :quote].freeze
         private_constant :REGEXP_ESCAPE_METHODS
 
+        # `.new` and `.compile` are the same C function under two names — both fold identically.
+        REGEXP_NEW_METHODS = Set[:new, :compile].freeze
+        private_constant :REGEXP_NEW_METHODS
+
+        # `Regexp.union` element cap — same rationale as `SHELLWORDS_SPLIT_LIMIT` / `STRING_ARRAY_LIFT_LIMIT`:
+        # keep the fold's work bounded even though the source is a static literal.
+        UNION_LIMIT = 64
+        private_constant :UNION_LIMIT
+
         module_function
 
         # @return [Rigor::Type, nil] folded result, or nil to defer.
@@ -34,8 +55,10 @@ module Rigor
           args = context.args
           return nil unless SingletonFolding.receiver?(receiver, "Regexp")
           return fold_escape(args) if REGEXP_ESCAPE_METHODS.include?(method_name)
-          return fold_new(args) if method_name == :new
+          return fold_new(args) if REGEXP_NEW_METHODS.include?(method_name)
           return fold_last_match(context) if method_name == :last_match
+          return fold_union(args) if method_name == :union
+          return fold_linear_time(args) if method_name == :linear_time?
 
           nil
         end
@@ -111,9 +134,9 @@ module Rigor
         end
 
         # `Regexp.new(pattern)` / `Regexp.new(pattern, opts)` — constructs the pattern at inference time.
-        # Delegates to Ruby's real `Regexp.new` so all option forms (Integer flags, `true`/`false`, option
-        # strings) are handled without case-analysis; non-constant or invalid arguments decline through to
-        # the RBS tier.
+        # Also serves `Regexp.compile`, its documented alias (`REGEXP_NEW_METHODS`). Delegates to Ruby's
+        # real `Regexp.new` so all option forms (Integer flags, `true`/`false`, option strings) are handled
+        # without case-analysis; non-constant or invalid arguments decline through to the RBS tier.
         def fold_new(args)
           return nil if args.empty? || args.size > 2
 
@@ -132,6 +155,42 @@ module Rigor
         def constant_value_or_nil(type)
           type.is_a?(Type::Constant) ? type.value : nil
         end
+
+        # `Regexp.union(*patterns)` / `Regexp.union(array)` — folds when every pattern element is a
+        # `Constant[String]` or `Constant[Regexp]`. A single `Tuple` argument is unpacked exactly like
+        # Ruby's own single-array-argument form (`Regexp.union(["a", "b"])`); anything else is treated as
+        # the splatted-arguments form, including zero arguments (`Regexp.union()` → `/(?!)/`). Delegates to
+        # the real `Regexp.union` so encoding handling, escaping of String elements, and pass-through of
+        # already-`Regexp` elements all match Ruby exactly; declines (rescues to `nil`) on an encoding
+        # conflict between elements rather than propagating the exception.
+        def fold_union(args)
+          pattern_args = args.size == 1 && args.first.is_a?(Type::Tuple) ? args.first.elements : args
+          return nil if pattern_args.size > UNION_LIMIT
+          return nil unless pattern_args.all? { |arg| union_element?(arg) }
+
+          Type::Combinator.constant_of(Regexp.union(*pattern_args.map(&:value)))
+        rescue StandardError
+          nil
+        end
+
+        def union_element?(arg)
+          arg.is_a?(Type::Constant) && (arg.value.is_a?(String) || arg.value.is_a?(Regexp))
+        end
+
+        # `Regexp.linear_time?(pattern)` — one `Constant[String]` or `Constant[Regexp]` argument. A second
+        # argument (the `timeout:` keyword, which lands as an extra positional slot) declines rather than
+        # being silently ignored. An invalid String pattern raises `RegexpError` when Ruby compiles it
+        # internally; rescued to `nil` like every other fold in this file.
+        def fold_linear_time(args)
+          return nil unless args.size == 1
+
+          arg = args.first
+          return nil unless union_element?(arg)
+
+          Type::Combinator.constant_of(Regexp.linear_time?(arg.value))
+        rescue StandardError
+          nil
+        end
       end
     end
   end

data/lib/rigor/inference/method_dispatcher/shape_dispatch.rb

@@ -18,7 +18,8 @@ module Rigor
       #
       # Catalogue (Slice 5 phase 2):
       #
-      # - Tuple#`first`, Tuple#`last`, Tuple#`size`/`length`/`count`: no-arg, no-block.
+      # - Tuple#`first`, Tuple#`last` (no-arg, or a single `Constant[Integer]` count lifting to a
+      #   sub-`Tuple`, the `take`/`drop` shape), Tuple#`size`/`length`/`count`: no-block.
       # - Tuple#`[]`, Tuple#`fetch` with a single `Constant[Integer]` argument inside the tuple's bounds
       #   (negative indices are normalised by length). Tuple#`[]` also handles static Range and
       #   start-length slices, returning a sliced Tuple or `Constant[nil]` for statically nil slices.
@@ -82,6 +83,16 @@ module Rigor
           drop: :tuple_drop,
           rotate: :tuple_rotate,
           uniq: :tuple_uniq,
+          at: :tuple_at,
+          :& => :tuple_intersection,
+          intersection: :tuple_intersection,
+          :| => :tuple_union,
+          union: :tuple_union,
+          :- => :tuple_difference,
+          difference: :tuple_difference,
+          intersect?: :tuple_intersect?,
+          one?: :tuple_one?,
+          deconstruct: :shape_self,
           index: :tuple_find_index,
           find_index: :tuple_find_index,
           rindex: :tuple_rindex,
@@ -672,23 +683,39 @@ module Rigor
             Type::Combinator.integer_range(min, max)
           end
 
-          # `first` (no arg) → the first element (or `Constant[nil]` when empty). The `first(n)` arg-form
-          # is deliberately left to RBS overload selection (see the overload-selection specs) — folding it
-          # here would change that documented `Array[Elem]` contract.
+          # `first` (no arg) → the first element (or `Constant[nil]` when empty). `first(n)` → a `Tuple` of
+          # the leading `n` elements, the same `take`/`drop` shape via `non_negative_count_arg` (`n >= size`
+          # returns the full receiver, a non-static or negative count declines to RBS).
           def tuple_first(tuple, _method_name, args)
-            return nil unless args.empty?
+            return tuple_first_n(tuple, args) unless args.empty?
             return Type::Combinator.constant_of(nil) if tuple.elements.empty?
 
             tuple.elements.first
           end
 
+          def tuple_first_n(tuple, args)
+            n = non_negative_count_arg(args)
+            return nil if n.nil?
+
+            Type::Combinator.tuple_of(*tuple.elements.first(n))
+          end
+
+          # `last` (no arg) → the last element (or `Constant[nil]` when empty). `last(n)` → a `Tuple` of the
+          # trailing `n` elements, mirroring `tuple_first_n`.
           def tuple_last(tuple, _method_name, args)
-            return nil unless args.empty?
+            return tuple_last_n(tuple, args) unless args.empty?
             return Type::Combinator.constant_of(nil) if tuple.elements.empty?
 
             tuple.elements.last
           end
 
+          def tuple_last_n(tuple, args)
+            n = non_negative_count_arg(args)
+            return nil if n.nil?
+
+            Type::Combinator.tuple_of(*tuple.elements.last(n))
+          end
+
           def tuple_size(tuple, _method_name, args)
             return nil unless args.empty?
 
@@ -957,6 +984,88 @@ module Rigor
 
           # `tuple + other` — concatenates two Tuples. Both sides must be `Type::Tuple`. Returns a new
           # Tuple whose elements are those of the receiver followed by those of the argument.
+          # `at(n)` — the strict single-Integer accessor. Deliberately NOT an alias of {#tuple_index}: `[]`
+          # and `slice` accept a Range or a `(start, length)` pair, while `Array#at` raises `ArgumentError`
+          # on anything but one Integer, and a fold must never invent a value for a call that raises.
+          #
+          # An out-of-range index declines rather than folding to `Constant[nil]`, matching {#tuple_index}.
+          # Ruby really does return nil there, so the fold would be correct — but it would also turn a
+          # receiver the RBS tier types as `Elem?` into a proven nil, newly surfacing diagnostics on code
+          # that may be guarded in ways a shape cannot see. Precision that fires a new diagnostic is a
+          # separate decision from precision that removes a `Dynamic` (#121).
+          def tuple_at(tuple, _method_name, args)
+            return nil unless args.size == 1
+            return nil unless args.first.is_a?(Type::Constant) && args.first.value.is_a?(Integer)
+
+            tuple.elements[args.first.value]
+          end
+
+          # `a & b` / `a.intersection(b, ...)`, `a | b` / `a.union(...)`, `a - b` / `a.difference(...)`.
+          # Every set operation is evaluated by running Ruby's own operator over the unwrapped values, which
+          # is the only way to reproduce its `eql?` / `hash` semantics exactly — `[1] & [1.0]` is empty even
+          # though `1 == 1.0`, so an equality-based reimplementation would fold the wrong answer.
+          def tuple_intersection(tuple, _method_name, args)
+            set_operation(tuple, args) { |values, others| others.reduce(values, :&) }
+          end
+
+          def tuple_union(tuple, _method_name, args)
+            set_operation(tuple, args) { |values, others| others.reduce(values, :|) }
+          end
+
+          def tuple_difference(tuple, _method_name, args)
+            set_operation(tuple, args) { |values, others| others.reduce(values, :-) }
+          end
+
+          # `a.intersect?(b)` — the predicate form, `Constant[bool]`. `nil` is the decline signal every
+          # handler shares, not a boolean answer, so the predicate-return cop is disabled as it is for the
+          # other `?`-named handlers above.
+          # rubocop:disable Style/ReturnNilInPredicateMethodDefinition
+          def tuple_intersect?(tuple, _method_name, args)
+            result = set_operation(tuple, args) { |values, others| others.reduce(values, :&) }
+            return nil if result.nil?
+
+            Type::Combinator.constant_of(!result.elements.empty?)
+          end
+
+          # Shared body for the set operations: unwrap the receiver and every Tuple argument, hand the raw
+          # values to `block`, and lift the result back. Declines unless every element on both sides is a
+          # `Constant` (an unknown element makes membership undecidable) and every argument is a `Tuple` —
+          # `Array#&` also accepts anything that responds to `to_ary`, which a shape cannot prove.
+          def set_operation(tuple, args)
+            return nil if args.empty? || args.size > MAX_SET_OPERATION_ARITY
+
+            values = constant_values(tuple.elements)
+            return nil if values.nil?
+
+            others = args.map do |arg|
+              return nil unless arg.is_a?(Type::Tuple)
+
+              constant_values(arg.elements) || (return nil)
+            end
+            result = yield(values, others)
+            return nil if result.size > MAX_SET_OPERATION_SIZE
+
+            Type::Combinator.tuple_of(*result.map { |value| Type::Combinator.constant_of(value) })
+          end
+
+          # An argument list longer than this, or a result wider than this, declines to the RBS tier rather
+          # than materialising an unbounded Tuple — the same discipline as {MAX_ZIP_ARITY} / the join cap.
+          MAX_SET_OPERATION_ARITY = 8
+          MAX_SET_OPERATION_SIZE = 64
+          private_constant :MAX_SET_OPERATION_ARITY, :MAX_SET_OPERATION_SIZE
+
+          # `one?` with no block and no pattern — `Constant[bool]` of "exactly one truthy element". Only
+          # `Constant` elements have decidable truthiness, and the block / pattern forms defer.
+          def tuple_one?(tuple, _method_name, args)
+            return nil unless args.empty?
+
+            values = constant_values(tuple.elements)
+            return nil if values.nil?
+
+            Type::Combinator.constant_of(values.one? { |value| value })
+          end
+          # rubocop:enable Style/ReturnNilInPredicateMethodDefinition
+
           def tuple_concat(tuple, _method_name, args)
             return nil unless args.size == 1
 
@@ -1558,13 +1667,16 @@ module Rigor
             Type::Combinator.hash_shape_of(shape.pairs.merge(other.pairs))
           end
 
-          # `shape[k]` and `shape.fetch(k)` for a value-pinned scalar key. Missing-key resolution depends
-          # on the method:
+          # `shape[k]` and `shape.fetch(k)` for a value-pinned scalar key. On a CLOSED shape a key outside
+          # `pairs` is provably missing, and the resolution depends on the method:
           #
           # - `[]` returns `nil` at runtime; we surface `Constant[nil]` so the carrier is visible to
           #   downstream narrowing.
           # - `fetch` (no default, no block) raises `KeyError`; we let the projection answer apply because
           #   the runtime would not produce a value.
+          #
+          # On an `:open` shape neither applies — the key is unknown rather than missing, so both methods
+          # answer the `untyped` step from {#hash_dig_step}.
           def hash_lookup(shape, method_name, args)
             return nil unless args.size == 1
 
@@ -1594,6 +1706,12 @@ module Rigor
           # Returns the per-step value type for a HashShape lookup (or `Constant[nil]` for a known-missing
           # key). Returns `nil` when the argument is not a value-pinned scalar key so the caller can fall
           # through to the projection answer.
+          #
+          # A key outside `pairs` only resolves to `Constant[nil]` on a CLOSED shape, where `pairs` is the
+          # whole key set and the runtime read provably returns nil. On an `:open` shape the key set is by
+          # definition not exhausted, so an undeclared key is *unknown*, not absent — it may hold a value
+          # of any type. Typing it `Constant[nil]` there would put `call.undefined-method` on the next line
+          # of correct code (`payload[:undeclared].upcase`), so the open case answers `untyped`.
           def hash_dig_step(shape, arg)
             return nil unless arg.is_a?(Type::Constant)
 
@@ -1607,6 +1725,8 @@ module Rigor
               return Type::Combinator.union(value, Type::Combinator.constant_of(nil))
             end
 
+            return Type::Combinator.untyped if shape.open?
+
             Type::Combinator.constant_of(nil)
           end
 
@@ -1616,8 +1736,13 @@ module Rigor
             shape.optional_key?(arg.value)
           end
 
+          # Whether the key is provably ABSENT — which only a closed shape can establish. An open shape
+          # permits keys outside `pairs`, so a key it does not declare is unknown rather than missing, and
+          # `fetch` must not be deferred on the theory that Ruby would raise `KeyError`: the key may well
+          # be there. {#hash_dig_step} has already answered `untyped` for that case.
           def missing_key_step?(shape, arg)
             return false unless arg.is_a?(Type::Constant)
+            return false if shape.open?
 
             !shape.pairs.key?(arg.value)
           end
@@ -1685,7 +1810,9 @@ module Rigor
 
           # Continues a `dig` chain after the first step. Tuple and HashShape members re-dispatch into the
           # catalogue; `Constant[nil]` short-circuits the chain (Hash#dig and Array#dig do the same at
-          # runtime); anything else falls through so the projection answer applies.
+          # runtime); an `untyped` step (an undeclared key on an open shape) keeps the whole chain
+          # `untyped`, since digging further into an unknown value cannot recover a bound; anything else
+          # falls through so the projection answer applies.
           def chain_dig(receiver, args)
             return receiver if args.empty?
 
@@ -1693,6 +1820,7 @@ module Rigor
             when Type::Tuple then tuple_dig(receiver, :dig, args)
             when Type::HashShape then hash_dig(receiver, :dig, args)
             when Type::Constant then receiver.value.nil? ? Type::Combinator.constant_of(nil) : nil
+            when Type::Dynamic then Type::Combinator.untyped
             end
           end
         end

data/lib/rigor/inference/method_dispatcher/struct_folding.rb

@@ -141,7 +141,7 @@ module Rigor
           map = member_map_for_new(members, keyword_init, context)
           return degraded_instance if map.nil?
 
-          Type::Combinator.struct_instance_of(members: map, class_name: class_name)
+          Type::Combinator.struct_instance_of(members: widen_unowned_emptiness(map), class_name: class_name)
         end
 
         # Builds the member -> type map honouring the class's `keyword_init` flag: a `keyword_init: true`
@@ -309,7 +309,8 @@ module Rigor
           return scope if member.nil?
 
           rebound = Type::Combinator.struct_instance_of(
-            members: current.members.merge(member => assigned_type), class_name: current.class_name
+            members: widen_unowned_emptiness(current.members.merge(member => assigned_type)),
+            class_name: current.class_name
           )
           scope.with_local(receiver.name, rebound)
         end