rigortype 0.3.1 → 0.3.3

data/lib/rigor/environment.rb

@@ -399,23 +399,38 @@ module Rigor
         ) { invoke_synthesizer_safely(callable, path) || "" }
       end
 
-      # ADR-32 WD6 — route a synthesizer return value through the per-run failure reporter. The
+      # ADR-32 WD6 / WD12 — route a synthesizer return value through the per-run reporter. The
       # synthesizer's contract (declared in
-      # `plugins/rigor-rbs-inline/lib/rigor/plugin/rbs_inline.rb`) admits three return shapes:
-      #   - `String` (non-empty) → successful RBS source
-      #   - `nil` / `""`         → no contribution
-      #   - `[:error, message]`  → parse failed
+      # `plugins/rigor-rbs-inline/lib/rigor/plugin/rbs_inline.rb`) admits four return shapes:
+      #   - `String` (non-empty)         → successful RBS source
+      #   - `nil` / `""`                 → no contribution
+      #   - `[:error, message]`          → parse failed (WD6)
+      #   - `[:ok, source, [message…]]`  → synthesis SUCCEEDED, but an annotation was parsed and not
+      #                                    honoured (WD12)
       # The error tuple is converted into a reporter entry + treated as "no contribution" so the analysis
-      # pipeline continues. Reporter is `nil` for callers that don't care (legacy Environment.new, tests).
+      # pipeline continues. The WD12 tuple keeps its `source` — the file's other annotations are good, and
+      # dropping them to report one omission would be a strictly worse trade. Reporter is `nil` for callers
+      # that don't care (legacy Environment.new, tests).
+      #
+      # A cached entry written before WD12 is a bare `String`, which falls through the `is_a?(Array)` guard
+      # unchanged, so no cache-descriptor bump is needed for the new shape.
       def interpret_synthesizer_outcome(outcome, plugin, path, reporter)
-        return outcome unless outcome.is_a?(Array) && outcome[0] == :error
+        return outcome unless outcome.is_a?(Array)
+
+        case outcome[0]
+        when :error
+          record_synthesis_entry(reporter, plugin, path, outcome[1], :failed)
+          nil
+        when :ok
+          Array(outcome[2]).each { |m| record_synthesis_entry(reporter, plugin, path, m, :not_honoured) }
+          outcome[1]
+        else
+          outcome
+        end
+      end
 
-        reporter&.record(
-          plugin_id: plugin.manifest.id,
-          path: path,
-          message: outcome[1].to_s
-        )
-        nil
+      def record_synthesis_entry(reporter, plugin, path, message, kind)
+        reporter&.record(plugin_id: plugin.manifest.id, path: path, message: message.to_s, kind: kind)
       end
 
       SYNTHESIZER_CACHE_PRODUCER_ID = "plugin.source_rbs_synthesizer"

data/lib/rigor/inference/anonymous_meta_class.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type/anonymous_class_name"
+
+module Rigor
+  module Inference
+    # #319 — identity for the class a `Class.new do ... end` / `Module.new do ... end` creates away from
+    # constant-write position.
+    #
+    # Ruby evaluates such a block with `self` bound to the freshly created class (`class_eval` semantics): a
+    # `def` inside it defines an instance method on that class and `attr_reader` runs as a class-level macro.
+    # `ScopeIndexer` has always walked that body as a class body — but only through its
+    # `Prism::ConstantWriteNode` branch, because the constant supplied the name the discovered-method tables
+    # are keyed by. At every other position (`klass = Class.new do ... end`, a bare expression, a method
+    # return) there was no name, so the body fell through to the enclosing — usually top-level — scope. Two
+    # false positives followed on correct code: `attr_reader` became a `call.unresolved-toplevel` warning
+    # (`Scope#toplevel?` is `self_type.nil?`), and the class itself typed as the bare `Singleton[Object]`
+    # `MethodDispatcher#class_new_lift` hands back, taking `Object`'s zero-arity `new` with it.
+    #
+    # This module supplies the missing name: a per-call-site synthetic one, spelled so that no Ruby constant
+    # path can collide with it in the discovery tables, and stable across the index pass and the dispatch
+    # pass because both derive it from the same `(call node, source path)` pair.
+    module AnonymousMetaClass
+      module_function
+
+      # The class-creating meta calls whose block body is a class body. `Struct.new` / `Data.define` are here
+      # because the body semantics are identical — the block is `class_eval`'d on the generated subclass — not
+      # because their anonymous *value* is modelled: those keep the `StructClass` / `DataClass` carriers
+      # {MethodDispatcher::StructFolding} / {MethodDispatcher::DataFolding} build for them.
+      META_NEW_SELECTORS = { Class: :new, Module: :new, Struct: :new, Data: :define }.freeze
+
+      # The receiver constant name (`:Class`, `:Module`, `:Struct`, `:Data`) of a class-creating meta call that
+      # carries a literal block, or nil for anything else. The receiver MUST be the bare constant (or its
+      # `::`-rooted spelling) — a call through a variable or another call's return has no statically known
+      # identity, exactly as `ScopeIndexer#meta_constant_receiver?` requires.
+      #
+      # Argument shapes are deliberately NOT inspected: `Class.new(Base) { ... }` and
+      # `Data.define(*members) { ... }` evaluate their block as a class body whatever the arguments are, and a
+      # narrower gate here would leave the body in top-level scope again.
+      def block_form_receiver(node)
+        return nil unless node.is_a?(Prism::CallNode)
+        return nil unless node.block.is_a?(Prism::BlockNode)
+
+        receiver_name = literal_constant_name(node.receiver)
+        return nil if receiver_name.nil?
+        return nil unless META_NEW_SELECTORS[receiver_name] == node.name
+
+        receiver_name
+      end
+
+      # The synthetic class name for `node`'s block body, or nil when `node` is not a recognised block form.
+      # {Type::AnonymousClassName} owns the spelling; this decides which call sites earn one and what the key
+      # holds.
+      #
+      # `source_path` is part of the key so two files whose anonymous classes happen to share a line and column
+      # do not merge their method sets when the per-file tables are folded into the cross-file seed. It is
+      # omitted when the caller has no path (unit-level probes over a bare `Prism` program) — passed through
+      # verbatim rather than defaulted, so every pass over the same file derives the same name.
+      def name_for(node, source_path = nil)
+        receiver_name = block_form_receiver(node)
+        return nil if receiver_name.nil?
+
+        location = node.location
+        key = [source_path, location.start_line, location.start_column].compact.join(":")
+        Type::AnonymousClassName.build(receiver_name, key)
+      end
+
+      # The bare-constant receiver's name (`Class`, `::Class`), or nil for every other receiver shape.
+      def literal_constant_name(node)
+        case node
+        when Prism::ConstantReadNode
+          node.name
+        when Prism::ConstantPathNode
+          node.name if node.parent.nil?
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/expression_typer.rb

@@ -19,6 +19,8 @@ require_relative "indexed_narrowing"
 require_relative "macro_block_self_type"
 require_relative "method_dispatcher"
 require_relative "narrowing"
+require_relative "singleton_object_constant"
+require_relative "optimistic_origin"
 require_relative "struct_fold_safety"
 
 module Rigor
@@ -609,6 +611,13 @@ module Rigor
         elide_or_union(node.predicate, else_type, then_type)
       end
 
+      # Issue #286 — the effective optimistic-nil-free cause of an expression. {OptimisticOrigin.resolve} owns
+      # the judgment, shared verbatim with `StatementEvaluator#optimistic_origin_for` and the
+      # `flow.always-truthy-condition` collector.
+      def optimistic_origin_for(node)
+        OptimisticOrigin.resolve(node, scope)
+      end
+
       def if_else_type(subsequent)
         return Type::Combinator.constant_of(nil) if subsequent.nil?
 
@@ -632,6 +641,9 @@ module Rigor
       # `Constant[false]` fold one branch; `Union[true, false]`, `Dynamic[T]`, and `Top` keep both branches live.
       def constant_predicate_polarity(predicate)
         return nil if predicate.nil?
+        # ADR-101 — decline on an optimistically nil-free carrier; see
+        # `StatementEvaluator#optimistic_carrier?` for why the gate is here and not in `Narrowing`.
+        return nil unless optimistic_origin_for(predicate).nil?
 
         Narrowing.predicate_certainty(type_of(predicate))
       end
@@ -648,7 +660,7 @@ module Rigor
       # fallback is preserved.
       def type_of_and_or(node)
         left_type = type_of(node.left)
-        polarity = constant_value_polarity(left_type)
+        polarity = left_operand_polarity(node.left, left_type)
         return short_circuit_for(node, left_type, polarity) if polarity
 
         # The left operand only flows through on the edge that short-circuits: `a || b` yields `a` solely
@@ -674,6 +686,19 @@ module Rigor
         end
       end
 
+      # Issue #313 — the node-aware wrapper the `&&` / `||` short-circuit reads. The spec's exclusion binds
+      # this gate as much as it binds `flow.always-truthy-condition`, and a `Constant`-only gate is not by
+      # itself enough to honour it: a literal hash whose values share one type reads as a lone `Constant`
+      # (`UNIFORM[key]` → `Constant[1]`), so the gate would judge the left operand of `UNIFORM[key] || key`
+      # provably truthy and discard the author's fallback — the counter-example the spec names verbatim.
+      # Declining returns the union of both operands, which is what `StatementEvaluator#eval_and_or` produces
+      # anyway, so the two `&&` / `||` typers stay in agreement.
+      def left_operand_polarity(left_node, left_type)
+        return nil unless optimistic_origin_for(left_node).nil?
+
+        constant_value_polarity(left_type)
+      end
+
       # Returns `:truthy` / `:falsey` for a `Type::Constant`, nil otherwise. Mirrors
       # `constant_predicate_polarity` but operates on a typed value (already-type-of'd) rather than a Prism
       # node, so the same predicate analysis can be reused in both contexts.
@@ -1077,8 +1102,12 @@ module Rigor
       # through `Enumerable#select` / `Object#select` and the caller observes `Array[Elem]` instead of the
       # helper's actual return type. The check fires only for `node.receiver.nil?` (true implicit self), so
       # explicit-receiver dispatch is unaffected.
+      #
+      # Issue #316 — the lookup goes through the confidence-gated `Scope#bindable_top_level_def_for`, not the
+      # raw table: inside a block whose `self` is unmodelled, a top-level `def` from ANOTHER file is not
+      # evidence about which method the call reaches, so the bind is declined and the call widens.
       def try_local_def_dispatch(node, receiver, arg_types)
-        local_def = node.receiver.nil? ? scope.top_level_def_for(node.name) : nil
+        local_def = node.receiver.nil? ? scope.bindable_top_level_def_for(node.name) : nil
         return nil unless local_def
 
         local_inference = infer_top_level_user_method(local_def, receiver, arg_types)
@@ -1144,7 +1173,7 @@ module Rigor
         # `module_function` body, re-type that body with the call args bound. Sits after the RBS dispatch
         # tier, so foreign / RBS-known singletons (`Math.sqrt`) keep their catalog answer; only
         # project-defined singleton methods reach here.
-        singleton_inference = try_singleton_method_inference(receiver, node, arg_types)
+        singleton_inference = try_project_singleton_inference(receiver, node, arg_types)
         return singleton_inference if singleton_inference
 
         # Dynamic-origin propagation: when the receiver is Dynamic[T] and no positive rule resolves the call,
@@ -1321,6 +1350,31 @@ module Rigor
         nil
       end
 
+      # The project-side singleton-method band: a `Foo.bar` call resolved against a `class << …` / `def self.…`
+      # body the project itself wrote. Which of the two tiers applies is decided by the receiver carrier —
+      # `Singleton[Foo]` when the constant names a class or module, `Nominal[…]` when it holds an ordinary
+      # object (#320) — so the two are mutually exclusive and consulting both is one resolution attempt.
+      def try_project_singleton_inference(receiver, call_node, arg_types)
+        try_singleton_method_inference(receiver, call_node, arg_types) ||
+          try_singleton_object_constant_inference(receiver, call_node, arg_types)
+      end
+
+      # #320 — resolves a call whose receiver is a constant holding an ordinary object with a `class << Const`
+      # singleton body, re-typing that body with the call's argument types bound. `self` inside the body IS
+      # that object, so the receiver carrier is passed through unchanged. Own-constant only, and only for a
+      # name the project actually recorded — a miss degrades to today's `Dynamic[top]`, never a false
+      # resolution. `Singleton` receivers never reach here: {#try_singleton_method_inference} owns them.
+      def try_singleton_object_constant_inference(receiver, call_node, arg_types)
+        return nil unless receiver.is_a?(Type::Nominal)
+
+        def_node = SingletonObjectConstant.def_node_for(call_node, receiver, call_node.name, scope)
+        return nil if def_node.nil?
+
+        infer_user_method_return(def_node, receiver, arg_types)
+      rescue StandardError
+        nil
+      end
+
       # ADR-24 slice 2 — resolves `method_name` against `class_name`'s own `def`s, then walks the user-class
       # ancestor chain: included / prepended modules (transitive) and the superclass chain. RBS-known
       # ancestors are NOT walked here — the `MethodDispatcher` RBS tier runs before
@@ -2429,7 +2483,11 @@ module Rigor
         case block_arg
         when Prism::BlockNode
           bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_arg)
-          block_scope = bindings.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
+          # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
+          # yielding method's business, so the return-typing pass must see the same unmodelled-self mark.
+          block_scope = bindings.reduce(scope.entering_opaque_block) do |acc, (name, type)|
+            acc.with_local(name, type)
+          end
           block_scope = block_scope.with_self_type(narrowed_self_type) if narrowed_self_type
           type_block_body(block_arg, block_scope)
         when Prism::BlockArgumentNode

data/lib/rigor/inference/fork_map.rb

@@ -2,6 +2,8 @@
 
 require "tmpdir"
 
+require_relative "../runtime/jit"
+
 module Rigor
   module Inference
     # Generic fork-over-slices map for the embarrassingly-parallel per-file passes of the
@@ -35,6 +37,27 @@ module Rigor
         worker_count > 1 && Process.respond_to?(:fork)
       end
 
+      # Where a forked child may put process-private scratch files. `nil` on the parent and on the sequential
+      # path, meaning "you are not in a child — use `Dir.tmpdir`".
+      #
+      # A child ends at {.run_worker}'s `exit!`, which skips `at_exit` AND object finalizers, so a `Tempfile`
+      # a child creates is never reclaimed by the mechanism that reclaims the parent's (issue #330 —
+      # `Protection::ClosureKillOracle`'s per-process mutant file leaked one file per worker per
+      # `rigor coverage --protection --mutation` run). Answering with the directory the parent already removes
+      # once every child has been collected makes the child's scratch state the parent's problem, which is the
+      # only place it can be solved: the names are random, so nothing outside the child could find them.
+      #
+      # The directory check is the belt to {.run_worker}'s braces: the offer is only worth taking while the
+      # parent still has the directory open, and answering `nil` once it is gone degrades to `Dir.tmpdir`
+      # instead of raising `Errno::ENOENT` somewhere far from here.
+      #
+      # @return [String, nil]
+      def child_scratch_dir
+        return nil unless @child_scratch_dir && File.directory?(@child_scratch_dir)
+
+        @child_scratch_dir
+      end
+
       # Forks `worker_count` children over contiguous slices, waits for each, and returns the Marshal'd
       # per-slice payloads in slice order. A child that exits abnormally has its slice re-run in-process.
       def fork_map(items, worker_count, block)
@@ -55,11 +78,31 @@ module Rigor
       # Child-process body: run the block over the slice, Marshal the result to `out_path`, and `exit!`
       # (skipping `at_exit` / stdio flush — the payload is durable on disk). Any failure exits non-zero so
       # the parent re-runs the slice in-process.
+      # The `ensure` is not dead code even though `exit!` never unwinds: {.child_scratch_dir} is module state,
+      # and a caller that drives this body in-process with `exit!` stubbed (the deferred-YJIT spec does exactly
+      # that — a spy in the parent cannot observe a real child) would otherwise leave the offer standing for
+      # the rest of the process, pointing at a directory its `Dir.mktmpdir` block has since removed.
       def run_worker(slice, block, out_path)
-        File.binwrite(out_path, Marshal.dump(block.call(slice)))
-        exit!(0)
-      rescue StandardError
-        exit!(1)
+        status = begin
+          # Re-arm deferred YJIT in the child, exactly as the check fork pool does
+          # ({Analysis::Runner::PoolCoordinator#run_fork_worker}). The parent's deadline thread does not
+          # survive `fork`, so without this a worker runs its whole slice un-JITted while the parent JITs the
+          # tail it no longer runs — the pool was a *pessimization* on long runs (`coverage --protection
+          # --mutation lib/rigor/analysis`: 37s sequential against 67s at eight workers). The child picks up
+          # what is left of the parent's window rather than a fresh one; {Runtime::Jit.rearm_after_fork}
+          # carries the mechanism.
+          Runtime::Jit.rearm_after_fork
+          # Published before the block runs, so anything it lazily creates for this process alone lands in the
+          # parent's tmpdir and dies with it. See {.child_scratch_dir}.
+          @child_scratch_dir = File.dirname(out_path)
+          File.binwrite(out_path, Marshal.dump(block.call(slice)))
+          0
+        rescue StandardError
+          1
+        ensure
+          @child_scratch_dir = nil
+        end
+        exit!(status)
       end
 
       # Waits for every child, placing each successful payload at its slice index; a child that exited

data/lib/rigor/inference/method_dispatcher/constant_folding.rb

@@ -117,7 +117,16 @@ module Rigor
           :succ, :pred, :next, :abs, :magnitude,
           :bit_length, :to_s, :to_i, :to_int, :to_f,
           :floor, :ceil, :round, :truncate, :chr,
-          :inspect, :-@, :+@, :~, :to_r, :to_c
+          :inspect, :-@, :+@, :~, :to_r, :to_c,
+          # `rationalize` (no-arg form) is the Integer sibling of the already-folded
+          # `Float#rationalize` / `Rational#rationalize` — pure, returns `Rational(self, 1)`. The
+          # optional-`eps` binary form is NOT mirrored here: unlike `Rational#rationalize` (which reaches
+          # `NUMERIC_BINARY`'s catalog fallback via `numeric.yml`'s `nurat_rationalize` leaf entry),
+          # `numeric.yml` carries no `rationalize` entry for Integer/Float, so the 1-arg call declines to
+          # the RBS tier exactly as it does today — this only closes the 0-arg gap.
+          # `abs2` (`self * self`, always a non-negative Integer) is the Integer sibling of the
+          # already-folded `Rational#abs2` / `Complex#abs2`.
+          :rationalize, :abs2
         ].freeze
         FLOAT_UNARY = Set[
           :zero?, :positive?, :negative?, :nonzero?,
@@ -135,7 +144,12 @@ module Rigor
           # `self >= 0`, `Math::PI` for `self < 0`. Pure sign test, deterministic; a NaN receiver yields NaN
           # which `foldable_constant_value?` declines.
           :arg, :angle, :phase,
-          :inspect, :-@, :+@
+          :inspect, :-@, :+@,
+          # `abs2` (`self * self`) is the Float sibling of the already-folded `Rational#abs2` /
+          # `Complex#abs2` / (now) `Integer#abs2`. A non-finite receiver (`Infinity`, `NaN`) still folds
+          # via `foldable_constant_value?`'s existing NaN guard — `Infinity.abs2` is `Infinity`
+          # (foldable), `NaN.abs2` is `NaN` (declined, same as every other NaN-producing Float unary op).
+          :abs2
         ].freeze
         STRING_UNARY = Set[
           :upcase, :downcase, :capitalize, :swapcase,
@@ -195,6 +209,11 @@ module Rigor
         # `flow.always-truthy-condition`.
         REFLECTIVE_SEND_METHODS = %i[public_send send __send__].to_set.freeze
 
+        # The self-returners, the `Type::Constant` counterpart of `ShapeDispatch`'s `:shape_self` handlers
+        # (ADR-76 WD2 / ADR-78 WD3). Each returns the receiver at run time, so the value-pinned carrier
+        # survives the call.
+        CONSTANT_SELF_RETURNERS = %i[freeze itself dup clone].to_set.freeze
+
         # @return [Rigor::Type::Constant, Rigor::Type::Union, Rigor::Type::IntegerRange, nil]
         def try_dispatch(context)
           receiver = context.receiver
@@ -205,6 +224,9 @@ module Rigor
             first_arg = args.first
             return nil unless first_arg.is_a?(Type::Constant) && first_arg.value.is_a?(Symbol)
           end
+          self_return = try_fold_self_return(receiver, method_name, args)
+          return self_return if self_return
+
           # v0.0.7 — `String#%` against a `Tuple` / `HashShape` argument runs Ruby's format-string engine
           # when both sides are statically constant. The standard `numeric_set_of` path bails on Tuple /
           # HashShape arguments because they are not scalar-Constant carriers, so the special-case sits
@@ -221,6 +243,32 @@ module Rigor
           dispatch_by_arity(receiver_set, method_name, arg_sets)
         end
 
+        # `freeze` / `itself` / `dup` / `clone` on a value-pinned receiver return the receiver carrier.
+        #
+        # This sits AHEAD of the catalogue path and deliberately bypasses its purity gate, because the gate
+        # asks a question that does not apply. `String#freeze` is classified `purity: mutates_self`
+        # (`data/builtins/ruby_core/string.yml`) — correctly, since the C body sets `FL_FREEZE` — and the
+        # gate then holds it back from the pure-invoke path. But nothing here is invoked: the receiver type
+        # is returned unchanged, and freezing mutates an object's flags, not its value. `Type::Constant`
+        # pins a value, not an identity, so the mutation it performs is invisible to the carrier.
+        #
+        # The gap this closes is `FOO = "bar".freeze`, the standard way to write a String constant in
+        # Ruby, which lost its value while `%w[a b].freeze` (a Tuple, via `:shape_self`) and `"bar".-@`
+        # (classified `purity: leaf`) both kept theirs. Integer / Float / Symbol had the same hole for a
+        # different reason — no `Object`/`Kernel` catalogue owns their self-returners at all.
+        #
+        # `dup` / `clone` return a NEW object at run time, so the carrier is right about the value and
+        # silent about the identity — the same trade `shape_self` already makes, and the same one the
+        # existing `"x".dup` fold (which reaches the invoke path, `dup` being `leaf`) already makes.
+        # A `clone(freeze: false)` carries an argument and declines here.
+        def try_fold_self_return(receiver, method_name, args)
+          return nil unless args.empty?
+          return nil unless CONSTANT_SELF_RETURNERS.include?(method_name)
+          return nil unless receiver.is_a?(Type::Constant)
+
+          receiver
+        end
+
         # `Constant<String> % …` — runs the actual `String#%` operation when both sides are statically
         # known. The argument may be:
         # - A `Type::Constant` whose value is a scalar (Integer / Float / String / Symbol). Already handled

data/lib/rigor/inference/method_dispatcher/data_folding.rb

@@ -116,7 +116,7 @@ module Rigor
           map = member_map_for_new(members, context)
           return degraded_instance(class_name) if map.nil?
 
-          Type::Combinator.data_instance_of(members: map, class_name: class_name)
+          Type::Combinator.data_instance_of(members: widen_unowned_emptiness(map), class_name: class_name)
         end
 
         # Builds the member -> type map from the call's arguments, honouring the keyword vs positional

data/lib/rigor/inference/method_dispatcher/member_shape_projection.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../../type"
 require_relative "../../source/node_children"
+require_relative "../mutation_widening"
 
 module Rigor
   module Inference
@@ -18,6 +19,39 @@ module Rigor
       # Both folders `extend` this module so the projections resolve as their own module functions
       # (matching their `module_function` style).
       module MemberShapeProjection
+        # A value object's member holds a **reference** to whatever the constructor was handed, and an
+        # EMPTY container literal's emptiness is a fact about that argument at the instant of
+        # construction — never a fact about the member. The caller keeps its own alias, and "construct
+        # empty, then fill" (`r = R.new([], []); xs.each { |x| r.items << x }`) is the dominant Ruby
+        # shape, so of every literal a member map can pin, emptiness is the one falsified most often.
+        #
+        # It is also the only one whose reads fold to `nil` — `.first` / `.last` / `[]` on an empty
+        # container — and `nil` is the receiver type that fires `call.undefined-method` on correct code
+        # (issue #293). A non-empty literal's element evidence, by contrast, survives an append and its
+        # reads never fold to `nil`, so it is kept intact.
+        #
+        # So an empty `Tuple` / closed empty `HashShape` is recorded widened to its bare nominal —
+        # the same carrier, through the same helpers, that {Inference::MutationWidening} installs when
+        # it retracts a mutated local's literal shape.
+        def widen_unowned_emptiness(member_map)
+          return member_map if member_map.nil?
+
+          member_map.transform_values { |type| widened_empty_container(type) }
+        end
+
+        def widened_empty_container(type)
+          case type
+          when Type::Tuple
+            type.elements.empty? ? MutationWidening.widen_tuple(type) : type
+          when Type::HashShape
+            # An OPEN shape claims nothing about the keys it does not list — a read of an unlisted key
+            # is already `untyped`, not `nil` — so only the closed literal `{}` carries the emptiness.
+            type.closed? && type.pairs.empty? ? MutationWidening.widen_hash_shape(type) : type
+          else
+            type
+          end
+        end
+
         # A Data/Struct subclass body can redefine a member's synthesised reader (`def x`); when it does,
         # `inst.x` runs that `def`, not the member, so folding the read would be unsound. A real `def` node
         # under the class name is the discriminator (the synthesised reader has none), so an entry in the
@@ -109,7 +143,7 @@ module Rigor
           return nil unless shape.optional_keys.empty?
           return nil unless shape.pairs.keys.all? { |key| instance.members.key?(key) }
 
-          merged = instance.members.merge(shape.pairs)
+          merged = widen_unowned_emptiness(instance.members.merge(shape.pairs))
           yield(merged, instance.class_name)
         end
       end