rigortype 0.3.1 → 0.3.3

data/lib/rigor/inference/mutation_widening.rb

@@ -2,6 +2,7 @@
 
 require_relative "../type"
 require_relative "../source/node_children"
+require_relative "receiver_alias"
 
 module Rigor
   module Inference
@@ -45,6 +46,10 @@ module Rigor
     #
     # - `arr.<mutator>(...)` where `arr` is a local variable.
     # - `@arr.<mutator>(...)` where `@arr` is an instance variable.
+    # - a receiver that *selects* among such variables rather than naming one —
+    #   `(kind == :required ? required : optional)[key] = info`, an `if`/`else`, `||` / `&&`. Every
+    #   variable the expression can evaluate to is a possible mutation target, so every one widens
+    #   (issue #277). See {ReceiverAlias}.
     #
     # Out of scope (left for a separate cycle):
     #
@@ -100,10 +105,10 @@ module Rigor
         PURE_SELF_RETURNERS.include?(method_name)
       end
 
-      # Returns a scope with the call's receiver widened, when the receiver is a
-      # local-/instance-variable read whose current binding is a literal-shape carrier
+      # Returns a scope with the call's receiver widened, for every variable the receiver expression
+      # can evaluate to ({ReceiverAlias.candidates}) whose current binding is a literal-shape carrier
       # (`Tuple` / `HashShape`) or an empty-witness refinement (`non-empty-array` /
-      # `non-empty-hash`) AND the call name is a known in-place mutator for that shape.
+      # `non-empty-hash`) AND whose call name is a known in-place mutator for that shape.
       # Returns `current_scope` unchanged otherwise.
       #
       # @param call_node     [Prism::CallNode]
@@ -115,13 +120,8 @@ module Rigor
         receiver = call_node.receiver
         return current_scope if receiver.nil?
 
-        case receiver
-        when Prism::LocalVariableReadNode
-          widen_local(call_node.name, receiver.name, current_scope)
-        when Prism::InstanceVariableReadNode
-          widen_ivar(call_node.name, receiver.name, current_scope)
-        else
-          current_scope
+        ReceiverAlias.candidates(receiver).reduce(current_scope) do |acc, read|
+          widen_alias_read(call_node.name, read, acc)
         end
       end
 
@@ -130,13 +130,13 @@ module Rigor
       # LOCALS are otherwise invisible to the post-call outer scope (ivars are handled correctly
       # already because they live in the method-body scope, not the block-local scope).
       #
-      # Walks the block AST for `<receiver>.<method>(...)` calls whose receiver is either a
-      # `LocalVariableReadNode` with `depth > 0` (a captured outer local — Prism's `depth`
-      # counts scope hops outward; `depth == 0` means a block-local) or an
-      # `InstanceVariableReadNode` (always method-scope), and applies `widen_after_call` for
-      # each one against the outer scope. The widening is always safe — it can only LOSE
-      # precision — so blindly propagating is sound regardless of whether the block actually
-      # runs.
+      # Walks the block AST for `<receiver>.<method>(...)` calls, resolves the receiver expression
+      # to the variables it can evaluate to ({ReceiverAlias.candidates}), and widens each one
+      # against the outer scope. A `LocalVariableReadNode` with `depth == 0` is skipped — Prism's
+      # `depth` counts scope hops outward, so `0` means a block-local, not a capture; an
+      # `InstanceVariableReadNode` is always method-scope and always applies. The widening is
+      # always safe — it can only LOSE precision — so blindly propagating is sound regardless of
+      # whether the block actually runs.
       #
       # Recurses into nested expression nodes so chained / nested forms (`arr << f(x); arr <<
       # g(y)`, `arr.push(x) if cond`) are all caught. Does NOT recurse into nested
@@ -174,15 +174,20 @@ module Rigor
         receiver = call_node.receiver
         return scope if receiver.nil?
 
-        case receiver
-        when Prism::LocalVariableReadNode
-          return scope if receiver.depth.zero?
+        ReceiverAlias.candidates(receiver).reduce(scope) do |acc, read|
+          # A block-local read (`depth == 0`) is not a capture of the outer scope, so widening its
+          # name against the OUTER scope would hit an unrelated same-named binding.
+          next acc if read.is_a?(Prism::LocalVariableReadNode) && read.depth.zero?
 
-          widen_local(call_node.name, receiver.name, scope)
-        when Prism::InstanceVariableReadNode
-          widen_ivar(call_node.name, receiver.name, scope)
-        else
-          scope
+          widen_alias_read(call_node.name, read, acc)
+        end
+      end
+
+      def widen_alias_read(method_name, read, scope)
+        case read
+        when Prism::LocalVariableReadNode then widen_local(method_name, read.name, scope)
+        when Prism::InstanceVariableReadNode then widen_ivar(method_name, read.name, scope)
+        else scope
         end
       end
 

data/lib/rigor/inference/narrowing.rb

@@ -1169,7 +1169,9 @@ module Rigor
         # so the proven-absent key reads `nil`. Returns the input unchanged when nothing
         # applies (caller detects "no narrowing"). Only an *optional* present key is removed: a
         # required key makes `key?` always true (the false edge is dead, leave the shape opaque)
-        # and a key absent from `pairs` already reads `nil`.
+        # and a key absent from `pairs` already reads `nil` on a closed shape. On an open shape an
+        # undeclared key keeps reading `untyped` on this edge — sound but imprecise, since the shape
+        # carries no per-key exclusion to record what the guard just proved absent.
         def narrow_hash_key_absent(type, key)
           case type
           when Type::HashShape

data/lib/rigor/inference/optimistic_origin.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    # Marks a value whose *nil-freeness* rests on Rigor's deliberate choice to ignore core RBS's
+    # `%a{implicitly-returns-nil}` annotation rather than on the value's class. See
+    # docs/internal-spec/inference-engine.md § "That deferred-to answer is nil-free for a lookup that can
+    # miss": `Hash#[]` reads as `V` and `Array#first` as `E` because pessimising them to `V?` costs 25
+    # measured false positives on Rigor's own `lib`. The consequence the spec draws is that such a value is
+    # **optimistic, not proof** — `MAP[key]` reading as `"x" | "y"` asserts nothing about whether the key was
+    # present.
+    #
+    # A side channel in the ADR-75 / ADR-82 sense: it never participates in subtyping, consistency,
+    # normalization or erasure, and no diagnostic fires from it. It differs from {DynamicOrigin} in what it
+    # attaches to — the value here is *not* `Dynamic`; it is an ordinary `Union` / `Constant` / `Nominal`
+    # that happens to have been produced optimistically.
+    #
+    # Issue #286: the `if` / `unless` branch elision is one consumer of `Narrowing.predicate_certainty`; the
+    # other two are `flow.always-truthy-condition` and the `&&` / `||` `constant_value_polarity` gate, and the
+    # spec passage above binds all three. This channel is what lets a certainty judgment tell the two apart.
+    #
+    # Issue #313: the mark is attached to a *value* — the call node that produced it, or the local / ivar it
+    # was bound to — but every one of those consumers reads a *predicate expression*, and a predicate is
+    # rarely the bare carrier. `x.nil?` collapses the carrier's nil-freeness into a `Constant[false]` of its
+    # own, `!x.nil?` inverts it, and `x.nil? || y.nil?` composes two of them; each step produced an unmarked
+    # `Constant` that the gates then read as proof. {.resolve} therefore derives the mark through exactly
+    # those shapes, so the exclusion survives composition instead of stopping at the read.
+    module OptimisticOrigin
+      # The core-RBS annotation `RbsDispatch` reads the return type past.
+      ANNOTATION = "implicitly-returns-nil"
+
+      # The single cause carried today. Kept as a symbol (rather than a bare `true`) so a later slice can
+      # distinguish further optimistic families without changing the table's shape.
+      IMPLICITLY_RETURNS_NIL = :implicitly_returns_nil
+
+      # The argument-free unary predicates whose folded result is a statement about the receiver's
+      # *nil-freeness* and nothing else, which is what makes the derivation sound rather than a general taint:
+      # `nil?` answers the exact question the optimism is a bet on, and `!` (which Prism spells as a `CallNode`
+      # named `:!`, covering both `!x` and `not x`) inverts whatever it is applied to. Value predicates —
+      # `empty?`, `zero?`, `any?` — are deliberately absent: they fold from the carrier's *value*, and marking
+      # them would widen this channel into a taint that silences genuine diagnostics.
+      NIL_COLLAPSING_PREDICATES = %i[nil? !].freeze
+
+      module_function
+
+      # The effective optimistic-nil-free cause of an expression under `scope`, or nil when its nil-freeness is
+      # a property of the value rather than a bet. The single owner of the judgment: `ExpressionTyper`,
+      # `StatementEvaluator` and `AlwaysTruthyConditionCollector` all route here, so the three consumers the
+      # spec binds cannot drift apart.
+      #
+      # Resolution order — the mark recorded on the node itself, then the binding a bare local / ivar read (or
+      # a write in value position, `if (x = MAP[k])`) resolves through, then the predicate-fold derivation
+      # issue #313 added.
+      #
+      # @param node [Prism::Node, nil]
+      # @param scope [Rigor::Scope, nil]
+      # @return [Symbol, nil]
+      def resolve(node, scope)
+        return nil if node.nil? || scope.nil?
+
+        recorded = scope.optimistic_origins[node]
+        return recorded if recorded
+
+        case node
+        when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
+        when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
+        when Prism::AndNode, Prism::OrNode then resolve(node.left, scope) || resolve(node.right, scope)
+        when Prism::CallNode then resolve_through_predicate(node, scope)
+        when Prism::ParenthesesNode then resolve_through_parentheses(node, scope)
+        end
+      end
+
+      # `recv.nil?` / `!recv` — the fold is a statement about `recv`, so it is exactly as optimistic as `recv`
+      # is. A block or any argument means this is not the unary predicate it looks like (`x.!(y)` is a
+      # user-defined operator), and the derivation declines.
+      def resolve_through_predicate(node, scope)
+        return nil unless NIL_COLLAPSING_PREDICATES.include?(node.name)
+        return nil unless node.block.nil?
+        return nil unless node.arguments.nil? || node.arguments.arguments.empty?
+
+        resolve(node.receiver, scope)
+      end
+
+      # `(x.nil?)` — a single-statement parenthesised body is its own value, and authors do parenthesise a
+      # composed guard. A multi-statement body's value is its last statement, but the earlier statements can
+      # rebind, so only the single-statement form is derived.
+      def resolve_through_parentheses(node, scope)
+        body = node.body
+        return nil unless body.is_a?(Prism::StatementsNode) && body.body.size == 1
+
+        resolve(body.body.first, scope)
+      end
+
+      # Whether the overload the selector actually picked carries the ignored annotation. The judgment is
+      # per-overload, which is what makes it precise: `Array#first` is optimistic while `Array#first(3)` is
+      # not, and `String#[]` / `Enumerable#find` are honest because they already spell the miss as `?`.
+      #
+      # @param method_definition [RBS::Definition::Method]
+      # @param method_type [RBS::MethodType] the overload {OverloadSelector.select} returned
+      # @return [Boolean]
+      def optimistic_overload?(method_definition, method_type)
+        type_def = matching_type_def(method_definition, method_type)
+        return false unless type_def.respond_to?(:overload_annotations)
+
+        type_def.overload_annotations.any? { |annotation| annotation.string == ANNOTATION }
+      end
+
+      # `RBS::Definition::Method#defs` runs parallel to `#method_types`, and the selector returns one of the
+      # latter's elements verbatim (`ReceiverAffinity.reorder` permutes the array without copying its
+      # members), so identity resolves the overload exactly. Equality is a fallback for any future path that
+      # rebuilds the method type.
+      def matching_type_def(method_definition, method_type)
+        return nil unless method_definition.respond_to?(:defs)
+
+        defs = method_definition.defs
+        defs.find { |type_def| type_def.type.equal?(method_type) } ||
+          defs.find { |type_def| type_def.type == method_type }
+      end
+    end
+  end
+end

data/lib/rigor/inference/protection_scanner.rb

@@ -3,6 +3,7 @@
 require_relative "scope_indexer"
 require_relative "origin_lookup"
 require_relative "../source/node_walker"
+require_relative "../analysis/check_rules/inferred_param_guard"
 
 module Rigor
   module Inference
@@ -20,7 +21,11 @@ module Rigor
       # A single unprotected call site.
       Site = Data.define(:line, :receiver, :method_name, :dynamic_origin)
 
-      FileResult = Data.define(:protected_count, :unprotected_count, :sites) do
+      # `lower_bound_typed` is a split WITHIN `protected_count`, never a move out of it (issue #263):
+      # a site whose receiver is concrete but rooted at a WD6b-marked inferred parameter (
+      # {Analysis::CheckRules::InferredParamGuard.rooted?}) is a lower-bound type — `protected_count`
+      # and `ratio` stay exactly as before, so `--threshold` never moves on unchanged code.
+      FileResult = Data.define(:protected_count, :unprotected_count, :lower_bound_typed, :sites) do
         def total = protected_count + unprotected_count
 
         # Protected ratio; a file with no dispatch sites is vacuously fully protected (nothing to get
@@ -37,6 +42,7 @@ module Rigor
       def scan(root)
         index = ScopeIndexer.index(root, default_scope: @scope)
         protected_count = 0
+        lower_bound_typed = 0
         sites = []
 
         Source::NodeWalker.each(root) do |node|
@@ -46,6 +52,7 @@ module Rigor
           receiver_type = scope.type_of(node.receiver)
           if concrete_receiver?(receiver_type)
             protected_count += 1
+            lower_bound_typed += 1 if lower_bound_typed?(node.receiver, scope)
           else
             origin = OriginLookup.origin_for(scope, node.receiver)
             sites << Site.new(
@@ -57,7 +64,8 @@ module Rigor
           end
         end
 
-        FileResult.new(protected_count: protected_count, unprotected_count: sites.size, sites: sites)
+        FileResult.new(protected_count: protected_count, unprotected_count: sites.size,
+                       lower_bound_typed: lower_bound_typed, sites: sites)
       end
 
       private
@@ -77,6 +85,14 @@ module Rigor
         end
       end
 
+      # ADR-67 WD6b (issue #263) — true when a concrete receiver is rooted at an inferred-but-undeclared
+      # parameter: the type is a call-site lower bound, so the negative in-body rules decline on it (no
+      # diagnostic can actually fire here yet). Delegates to the single-homed shared predicate every
+      # negative rule already consults — nothing is re-derived.
+      def lower_bound_typed?(receiver, scope)
+        Analysis::CheckRules::InferredParamGuard.rooted?(receiver, scope)
+      end
+
       def safe_describe(type)
         type.respond_to?(:describe) ? type.describe(:short) : type.to_s
       rescue StandardError

data/lib/rigor/inference/receiver_alias.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    # Which variables can a receiver EXPRESSION evaluate to?
+    #
+    # A receiver-fact invalidation (see {MutationWidening}) has to name the binding it invalidates,
+    # and the overwhelmingly common receiver — a bare `arr` / `@arr` read — names exactly one. But a
+    # receiver may also *select* among variables without naming any of them:
+    #
+    #     (kind == :required ? required : optional)[key] = info
+    #
+    # The mutation lands on whichever of `required` / `optional` the ternary picked, so BOTH are
+    # possible targets and both must forget their literal shape. Reading only the syntactic head
+    # left both hashes carrying the empty `HashShape` the literal `{}` wrote, and a downstream
+    # `.empty?` then constant-folded into a false `flow.always-truthy-condition`
+    # ([#277](https://github.com/rigortype/rigor/issues/277)).
+    #
+    # The recursion covers only the forms whose value IS one of the sub-expressions: `if` / `unless`
+    # (including the ternary spelling), the short-circuit operators, and the transparent wrappers.
+    # Anything else — an index read (`declared[kind] << key`), a call result, a literal — names an
+    # object no binding can be attributed to and yields `[]`, which is what every receiver form
+    # outside the single-read case already contributed. The walk is depth-capped so a pathological
+    # nest cannot make receiver classification unbounded.
+    module ReceiverAlias
+      # Deep enough for any hand-written selection; a nest beyond it degrades to "names no binding".
+      WALK_DEPTH_CAP = 6
+
+      module_function
+
+      # @param node  [Prism::Node, nil] the receiver expression.
+      # @param depth [Integer] recursion depth, internal.
+      # @return [Array<Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode>] every variable
+      #   read the expression can evaluate to; empty when it can evaluate to none.
+      def candidates(node, depth = 0)
+        return [] if node.nil? || depth > WALK_DEPTH_CAP
+
+        case node
+        when Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode then [node]
+        when Prism::ParenthesesNode then candidates(node.body, depth + 1)
+        when Prism::StatementsNode then candidates(node.body.last, depth + 1)
+        when Prism::ElseNode then candidates(node.statements, depth + 1)
+        when Prism::IfNode then branches(node.statements, node.subsequent, depth)
+        when Prism::UnlessNode then branches(node.statements, node.else_clause, depth)
+        when Prism::OrNode, Prism::AndNode then branches(node.left, node.right, depth)
+        else []
+        end
+      end
+
+      def branches(first, second, depth)
+        candidates(first, depth + 1) + candidates(second, depth + 1)
+      end
+    end
+  end
+end