rigortype 0.3.2 → 0.3.3

data/lib/rigor/inference/method_dispatcher/rbs_dispatch.rb

@@ -44,8 +44,11 @@ module Rigor
       # * `block_type:` is ignored; method types that constrain the block return type are not yet honored.
       # * Keyword arguments are not threaded through call_arg_types, so overloads with required keywords
       #   are skipped (they cannot match the empty kwargs we send).
-      # * Method-level type parameters (e.g., `def foo[T]: (T) -> T`) are not bound; their variables remain
-      #   `Dynamic[Top]` after substitution.
+      # * Method-level type parameters bind only from two positions: the block return type (Slice 6 phase C)
+      #   and a positional parameter whose declared type is EXACTLY a type variable (issue #303 —
+      #   `def foo[T]: (T) -> T` binds `T` from the first argument, and carries it into a generic return
+      #   such as `-> Array[T]`). A variable reachable only through a container position (`Array[T] arg`),
+      #   a rest positional (`*T`), or a keyword parameter is still unbound and degrades to `Dynamic[Top]`.
       #
       # See docs/adr/4-type-inference-engine.md for the broader plan.
       # rubocop:disable Metrics/ModuleLength
@@ -61,6 +64,14 @@ module Rigor
         # objects answer to methods their RBS omits (`ActionController::Base`, `Hash`, …).
         ALLOWED_RBS_COMPLETE_ANCESTORS = ["Rigor::Plugin::Base"].freeze
 
+        # Shared empty returns for the argument-position type-variable binding (issue #303). The
+        # no-candidate answer is by far the common case — every non-generic overload takes it — so it must
+        # not allocate.
+        EMPTY_TYPE_VARS = {}.freeze
+        private_constant :EMPTY_TYPE_VARS
+        EMPTY_TYPE_PARAM_NAMES = [].freeze
+        private_constant :EMPTY_TYPE_PARAM_NAMES
+
         # @param receiver [Rigor::Type]
         # @param method_name [Symbol]
         # @param args [Array<Rigor::Type>]
@@ -355,21 +366,9 @@ module Rigor
             )
             return nil unless method_type
 
-            # ADR-100 WD2/WD3 — the return-typing tier is where `void → top` widens, so it is the one place
-            # that still knows the RBS return was an author-declared `-> void` before the translator erases
-            # it to a plain `top`. Record the recovery on the scope's `void_origins` side-table, keyed by the
-            # call node, so the `static.value-use.void` check rule can fire when this `top` is used in value
-            # context. Recording is gated on `scope` && `call_node` being present, which naturally scopes it
-            # to the *direct*-RBS dispatch (the receiver's own resolvable class): the user-class / Object
-            # ancestor fallback nils both out (WD4 defers that, murkier, surface).
-            record_void_recovery(method_type, scope, call_node, [class_name, method_name, kind])
-            # Issue #286 — the same call site is the one place that still knows the selected overload spelled
-            # its miss as `%a{implicitly-returns-nil}` rather than as `?`; the translator below reads the
-            # return type only, by the deliberate choice the spec records. Mark the result so a certainty
-            # judgment downstream can tell "nil-free because of its class" from "nil-free because we bet".
-            record_optimistic_nil_free(method_definition, method_type, scope, call_node)
-
-            full_type_vars = compose_block_type_vars(method_type, type_vars, block_type)
+            call_site = [class_name, method_name, kind]
+            record_dispatch_provenance(method_definition, method_type, scope, call_node, call_site)
+            full_type_vars = compose_type_vars(method_type, type_vars, args, block_type, scope, call_node, call_site)
 
             RbsTypeTranslator.translate(
               method_type.type.return_type,
@@ -379,6 +378,34 @@ module Rigor
             )
           end
 
+          # The two provenance side-tables the return-typing tier is the last place able to populate, recorded
+          # together because they share one gate (`scope` && `call_node`) and one call site.
+          #
+          # ADR-100 WD2/WD3 — the return-typing tier is where `void → top` widens, so it is the one place that
+          # still knows the RBS return was an author-declared `-> void` before the translator erases it to a
+          # plain `top`. The recovery lands on the scope's `void_origins` side-table, keyed by the call node,
+          # so the `static.value-use.void` check rule can fire when this `top` is used in value context. The
+          # gate naturally scopes it to the *direct*-RBS dispatch (the receiver's own resolvable class): the
+          # user-class / Object ancestor fallback nils both out (WD4 defers that, murkier, surface).
+          #
+          # Issue #286 — the same call site is the one place that still knows the selected overload spelled
+          # its miss as `%a{implicitly-returns-nil}` rather than as `?`; the translator reads the return type
+          # only, by the deliberate choice the spec records. Mark the result so a certainty judgment
+          # downstream can tell "nil-free because of its class" from "nil-free because we bet".
+          def record_dispatch_provenance(method_definition, method_type, scope, call_node, call_site)
+            record_void_recovery(method_type, scope, call_node, call_site)
+            record_optimistic_nil_free(method_definition, method_type, scope, call_node)
+          end
+
+          # The two method-level type-parameter binding positions, layered in precedence order over the
+          # receiver-derived `type_vars`: the block return type first, then the argument positions (which
+          # never displace an existing key). See {#compose_arg_type_vars} for the argument envelope.
+          def compose_type_vars(method_type, type_vars, args, block_type, scope, call_node, call_site)
+            vars = compose_block_type_vars(method_type, type_vars, block_type)
+            compose_arg_type_vars(method_type, vars, args, scope: scope, call_node: call_node,
+                                                           call_site: call_site)
+          end
+
           # Record the `void → top` recovery when the selected overload declares `-> void` and both `scope` and
           # `call_node` are present (the direct-dispatch path). `void_site` is the `[class_name, method_name,
           # kind]` triple the {VoidOrigin} carries.
@@ -434,6 +461,109 @@ module Rigor
             type_vars.merge(block_var_name => block_type)
           end
 
+          # Issue #303 — bind method-level type parameters from ARGUMENT positions, layering on top of the
+          # receiver-derived and block-derived `type_vars` exactly as {#compose_block_type_vars} does, so
+          # `Ractor.make_shareable("x")` (`[T] (T) -> T`) answers `"x"` instead of `Dynamic[top]`.
+          #
+          # Envelope, deliberately the narrowest sound shape:
+          #
+          # * only a positional parameter (required or optional) whose declared type is EXACTLY
+          #   `RBS::Types::Variable` — no container walk, so `(Array[T]) -> T` still degrades;
+          # * only names the SELECTED overload declares in its own `type_params` (a class-level variable
+          #   keeps its receiver-derived binding);
+          # * an existing key wins, so the receiver and the block return type both outrank an argument;
+          # * a `Dynamic[Top]` argument carries no evidence and contributes nothing;
+          # * repeated occurrences of one variable union their arguments.
+          #
+          # See {#arg_binding_permitted?} for why the contribution is gated on the call site.
+          def compose_arg_type_vars(method_type, type_vars, args, scope:, call_node:, call_site:)
+            bindings = arg_type_var_bindings(method_type, type_vars, args)
+            return type_vars if bindings.empty?
+            return type_vars unless arg_binding_permitted?(scope, call_node, call_site)
+
+            type_vars.merge(bindings)
+          end
+
+          # The candidate bindings, computed before the guard so a non-generic overload (the overwhelming
+          # majority) never pays for the `scope` probes.
+          def arg_type_var_bindings(method_type, type_vars, args)
+            declared = declared_type_param_names(method_type)
+            return EMPTY_TYPE_VARS if declared.empty? || args.empty?
+
+            fun = method_type.type
+            return EMPTY_TYPE_VARS unless fun.respond_to?(:required_positionals)
+
+            positionals = fun.required_positionals + fun.optional_positionals
+            positionals.zip(args).each_with_object({}) do |(param, arg), bindings|
+              next if arg.nil?
+
+              name = variable_param_name(param, declared, type_vars)
+              next if name.nil?
+              next if no_static_evidence?(arg)
+
+              bindings[name] = bindings.key?(name) ? Type::Combinator.union(bindings[name], arg) : arg
+            end
+          end
+
+          def declared_type_param_names(method_type)
+            params = method_type.respond_to?(:type_params) ? method_type.type_params : nil
+            return EMPTY_TYPE_PARAM_NAMES if params.nil? || params.empty?
+
+            params.map(&:name)
+          end
+
+          # The parameter's binding name when it is spelled as a bare method-level type variable that is
+          # still unbound; nil for every other shape.
+          def variable_param_name(param, declared, type_vars)
+            declared_type = param.type
+            return nil unless declared_type.is_a?(RBS::Types::Variable)
+
+            name = declared_type.name
+            return nil unless declared.include?(name)
+            return nil if type_vars.key?(name)
+
+            name
+          end
+
+          # `Dynamic[top]` is the engine's "we could not tell" answer, so binding a variable to it would
+          # dress up an absence of evidence as an inference. The variable stays unbound and degrades as it
+          # did before, which is the same value anyway.
+          def no_static_evidence?(arg)
+            arg.is_a?(Type::Dynamic) && arg.static_facet.is_a?(Type::Top)
+          end
+
+          # Issue #303 — the FP guard on the argument-position binding.
+          #
+          # Binding an argument makes the RESULT precise, which turns a benign mis-resolution into a
+          # confidently wrong type. The shape that matters is a user method shadowing the RBS method this
+          # dispatch resolved: `spec/integration/fixtures/kernel_functions.rb`'s `def p(node)` self-send
+          # resolves through `Kernel#p: [T] (T) -> T`, and binding `T` would type `p(1)` as `1` when the
+          # real method returns a String.
+          #
+          # Two gates, cheapest first.
+          #
+          # 1. `scope` && `call_node` present, the same evidence surface {#record_void_recovery} reads.
+          #    DIAGNOSED, not assumed: that fixture's `p(1)` reaches here through
+          #    `MethodDispatcher#try_user_class_fallback`, which dispatches with `scope: nil, call_node:
+          #    nil` — so the presence gate alone already declines every call routed through the Object /
+          #    Kernel ancestor fallback, the path a class with no RBS of its own always takes.
+          # 2. The explicit redefinition probe, in the shape `KernelDispatch#user_redefined?` established.
+          #    The presence gate does NOT cover the direct-dispatch spelling of the same hazard — a
+          #    top-level `def p(x)` called from the top level resolves `Nominal[Object]` DIRECTLY, with
+          #    scope and call node both live — so a discovered top-level def, or a discovered method on the
+          #    resolved class itself, declines too. Over-wide by construction (a project class that also
+          #    has RBS declines for its own self-sends, losing precision it could have kept), and
+          #    deliberately so: the cost is a `Dynamic[top]` that was already there.
+          def arg_binding_permitted?(scope, call_node, call_site)
+            return false if scope.nil? || call_node.nil?
+
+            class_name, method_name, kind = call_site
+            return false if method_name.nil?
+            return false if scope.top_level_def_for(method_name)
+
+            !scope.discovered_method?(class_name, method_name, kind)
+          end
+
           def method_type_block_return_variable(method_type)
             return_variable = block_return_variable(method_type)
             return nil if return_variable.nil?

data/lib/rigor/inference/method_dispatcher/shape_dispatch.rb

@@ -77,6 +77,14 @@ module Rigor
           fetch: :tuple_index,
           dig: :tuple_dig,
           values_at: :tuple_values_at,
+          # `concat` / `<<` are deliberately ABSENT from this table: both mutate the receiver in place
+          # (`ARRAY_MUTATORS` in `MutationWidening`), and a fold tier has no way to write the folded
+          # result back into the caller's binding — it can only return a value for the call expression.
+          # `tuple.concat(other)` would fold correctly as a VALUE (same shape as `tuple + other`) but the
+          # receiver local/ivar would still carry the pre-concat Tuple afterward, which is unsound (#121).
+          # `MutationWidening.widen_after_call` is the actual precision mechanism for a mutator call site:
+          # it forgets the literal-arity carrier so a stale `size`/`empty?` fold cannot survive the
+          # mutation, rather than trying to fold the mutator itself.
           :+ => :tuple_concat,
           compact: :tuple_compact,
           take: :tuple_take,
@@ -98,14 +106,19 @@ module Rigor
           rindex: :tuple_rindex,
           flatten: :tuple_flatten,
           join: :tuple_join,
+          # `inspect` / `to_s` (an exact alias for Array — `Array#to_s` IS `Array#inspect`) — see
+          # {#tuple_inspect}, below the join helpers it shares a byte cap with.
+          inspect: :tuple_inspect,
+          to_s: :tuple_inspect,
+          :* => :tuple_star,
           freeze: :shape_self,
           dup: :shape_self,
           clone: :shape_self,
           itself: :shape_self
         }.freeze
 
-        # Byte cap on a folded `tuple.join` result — a huge tuple times a long separator must not
-        # materialise an unbounded `Constant`.
+        # Byte cap on a folded `tuple.join` / `tuple.inspect` / `hash.inspect` result — a huge tuple or
+        # shape must not materialise an unbounded `Constant`.
         TUPLE_JOIN_BYTE_LIMIT = 4096
         private_constant :TUPLE_JOIN_BYTE_LIMIT
 
@@ -126,6 +139,13 @@ module Rigor
           entries: :hash_to_a,
           to_h: :hash_to_h,
           to_hash: :hash_to_h,
+          # `inspect` / `to_s` (an exact alias for Hash — `Hash#to_s` IS `Hash#inspect`) — see
+          # {#hash_inspect}. Gated CLOSED-no-optional-key, same predicate `URIFolding#hash_form_pairs`
+          # uses for `URI.encode_www_form`'s HashShape argument: an open or partially-optional shape
+          # describes a hash whose real membership this fold cannot see, so its `inspect` string is not
+          # deterministic.
+          inspect: :hash_inspect,
+          to_s: :hash_inspect,
           deconstruct_keys: :hash_deconstruct_keys,
           invert: :hash_invert,
           merge: :hash_merge,
@@ -823,6 +843,59 @@ module Rigor
             arg.value
           end
 
+          # `tuple.inspect` / `tuple.to_s` (`Array#to_s` is an exact alias of `Array#inspect`) — folds when
+          # every element is a `Constant`, by reconstructing the Ruby Array and calling the REAL `inspect`
+          # so the analyzer's Ruby (4.0.x's `Array#inspect` format) is matched rather than re-derived.
+          # Capped at `TUPLE_JOIN_BYTE_LIMIT` like `#join`, since a large tuple's `inspect` string is
+          # similarly unbounded.
+          def tuple_inspect(tuple, _method_name, args)
+            return nil unless args.empty?
+
+            values = constant_values(tuple.elements)
+            return nil if values.nil?
+
+            result = values.inspect
+            return nil if result.bytesize > TUPLE_JOIN_BYTE_LIMIT
+
+            Type::Combinator.constant_of(result)
+          rescue StandardError
+            nil
+          end
+
+          # `tuple * n` — a `Constant[String]` argument is `Array#*`'s join-alias form (identical semantics
+          # to `#join`); a `Constant[Integer]` argument is repetition. Any other argument shape (2+ args,
+          # `Dynamic`, `Float`, no args) declines so the RBS / alias-pass tier answers — for the Integer
+          # case that tier already gives a decent union-of-elements `Array[...]` answer, so a decline here
+          # is not a regression.
+          def tuple_star(tuple, _method_name, args)
+            return nil unless args.size == 1
+
+            arg = args.first
+            return nil unless arg.is_a?(Type::Constant)
+
+            case arg.value
+            when String then tuple_join(tuple, :join, args)
+            when Integer then tuple_repeat(tuple, arg.value)
+            end
+          end
+
+          # `tuple * n` repetition. `n == 0` folds to the empty Tuple (any array repeated 0 times is `[]`,
+          # even for an unbounded/empty receiver). A negative `n` declines — `Array#*` raises
+          # `ArgumentError` at runtime, so no fold should invent a value for it (same fail-soft discipline
+          # every other handler in this catalogue follows). The result element count is capped at
+          # `MAX_SET_OPERATION_SIZE` (64) — the same element-count-cap convention as
+          # `ShellwordsFolding::SHELLWORDS_SPLIT_LIMIT` / `RegexpFolding`'s `Regexp.union` cap / the Tuple
+          # set operations above, reused rather than minting a second constant with the same value.
+          def tuple_repeat(tuple, count)
+            return nil if count.negative?
+            return Type::Combinator.tuple_of if count.zero?
+
+            total = tuple.elements.size * count
+            return nil if total > MAX_SET_OPERATION_SIZE
+
+            Type::Combinator.tuple_of(*(tuple.elements * count))
+          end
+
           # `tuple.min` / `tuple.max` — fold when every element is a `Constant` whose values share a
           # Ruby-comparable domain. Empty tuples fold to `Constant[nil]`. The 1-arg `min(n)` / `max(n)`
           # form folds to a `Tuple` of the n edge-most values in Ruby's order (`min(n)` ascending, `max(n)`
@@ -1596,6 +1669,28 @@ module Rigor
             shape
           end
 
+          # `shape.inspect` / `shape.to_s` (`Hash#to_s` is an exact alias of `Hash#inspect`) — folds only
+          # on a CLOSED shape with no optional keys (an open or partially-optional shape's real membership
+          # is not fully known, so its `inspect` string is not deterministic — the same gate
+          # `URIFolding#hash_form_pairs` uses for `URI.encode_www_form`'s HashShape argument) and only when
+          # every value is a `Constant` ({#constant_pairs}). Reconstructs the Ruby Hash and calls the REAL
+          # `inspect` so the analyzer matches Ruby 4.0.x's `{a: 1}` hash-inspect format rather than
+          # re-deriving it. Capped at `TUPLE_JOIN_BYTE_LIMIT` like the Tuple sibling.
+          def hash_inspect(shape, _method_name, args)
+            return nil unless args.empty?
+            return nil unless shape.closed? && shape.optional_keys.empty?
+
+            pairs = constant_pairs(shape)
+            return nil if pairs.nil?
+
+            result = pairs.inspect
+            return nil if result.bytesize > TUPLE_JOIN_BYTE_LIMIT
+
+            Type::Combinator.constant_of(result)
+          rescue StandardError
+            nil
+          end
+
           # `shape.invert` — swaps keys and values. Folds when every value is a `Constant` whose value is a
           # scalar the carrier accepts as a key (Symbol / String / Integer / Float / true / false / nil;
           # see {#static_shape_key?}). Duplicate values

data/lib/rigor/inference/method_dispatcher.rb

@@ -6,6 +6,7 @@ require_relative "../flow_contribution"
 require_relative "../flow_contribution/merger"
 require_relative "../builtins/hkt_builtins"
 require_relative "../builtins/static_return_refinements"
+require_relative "anonymous_meta_class"
 require_relative "dynamic_origin"
 require_relative "flow_tracer"
 require_relative "void_tail_summary"
@@ -760,7 +761,7 @@ module Rigor
         struct_result = StructFolding.try_dispatch(context)
         return struct_result if struct_result
 
-        meta_result = try_meta_introspection(context.receiver, context.method_name, context.args)
+        meta_result = try_meta_introspection(context.receiver, context.method_name, context.args, context)
         return meta_result if meta_result
 
         PRECISE_TIERS_HEAD.each do |tier|
@@ -868,10 +869,10 @@ module Rigor
       # `Foo.class` as `Singleton[Class]` (deliberate; calling `.class` on a class object yields
       # `Class`, the metaclass). We also special-case `is_a?`-adjacent calls and the trivial
       # `instance_of?(self)` later as the rule catalogue grows; for now only `class` is handled.
-      def try_meta_introspection(receiver_type, method_name, arg_types = [])
+      def try_meta_introspection(receiver_type, method_name, arg_types = [], context = nil)
         case method_name
         when :class then meta_class(receiver_type)
-        when :new then meta_new(receiver_type, arg_types)
+        when :new then meta_new(receiver_type, arg_types, context)
         end
       end
 
@@ -891,13 +892,13 @@ module Rigor
       # `Type::Constant::SCALAR_CLASSES` accepts (today: `Pathname`), `.new(Constant<…>)` lifts
       # to a `Constant<…>` carrier so downstream method calls fold through the standard catalog
       # tier.
-      def meta_new(receiver_type, arg_types = [])
+      def meta_new(receiver_type, arg_types = [], context = nil)
         return nil unless receiver_type.is_a?(Type::Singleton)
 
         constant_lift = constant_constructor_lift(receiver_type.class_name, arg_types)
         return constant_lift if constant_lift
 
-        array_lift = array_new_lift(receiver_type.class_name, arg_types)
+        array_lift = array_new_lift(receiver_type.class_name, arg_types, context&.block_type)
         return array_lift if array_lift
 
         range_lift = range_new_lift(receiver_type.class_name, arg_types)
@@ -918,7 +919,7 @@ module Rigor
         struct_new_lift = struct_new_lift(receiver_type.class_name, arg_types)
         return struct_new_lift if struct_new_lift
 
-        class_new_lift = class_new_lift(receiver_type.class_name, arg_types)
+        class_new_lift = class_new_lift(receiver_type.class_name, arg_types, context)
         return class_new_lift if class_new_lift
 
         Type::Combinator.nominal_of(receiver_type.class_name)
@@ -955,9 +956,22 @@ module Rigor
       # so `Singleton[Parent]` lets downstream `klass.some_class_method` resolve. No parent →
       # `singleton(Object)`. Anything else (dynamic parent, more than one positional, …) falls
       # back to `Nominal[Class]` via the surrounding `meta_new` tail.
-      def class_new_lift(class_name, arg_types)
+      # #319 — a `Class.new do ... end` with no parent is NOT `Object`: the block body is a class body, so the
+      # class owns whatever that body defines. Answering `Singleton[Object]` handed the call site `Object`'s
+      # zero-arity `new` and `Object`'s method surface, so an `initialize(bucket)` written right there produced
+      # `wrong number of arguments ... (given 1, expected 0)` on code Ruby runs happily. `ScopeIndexer` registers
+      # the body's methods under the call site's anonymous name; return that name so the lookups reach them.
+      #
+      # Scoped to the parentless form on purpose. `Class.new(Parent) { ... }` keeps `Singleton[Parent]`: the
+      # anonymous name would have to carry the full ancestor chain for `Parent`'s own surface to stay reachable,
+      # and the parentless case is where the false positive lives.
+      def class_new_lift(class_name, arg_types, context = nil)
         return nil unless class_name == "Class"
-        return Type::Combinator.singleton_of("Object") if arg_types.empty?
+
+        if arg_types.empty?
+          anonymous = anonymous_class_new_name(context)
+          return Type::Combinator.singleton_of(anonymous || "Object")
+        end
         return nil unless arg_types.size == 1
 
         parent = arg_types.first
@@ -966,6 +980,16 @@ module Rigor
         nil
       end
 
+      # The synthetic name `ScopeIndexer` keyed this call site's block body by, or nil when the context carries no
+      # call node (internal dispatcher callers) or the call has no block. The source path is passed through
+      # verbatim — including when it is nil, which is exactly what `ScopeIndexer` saw for the same file — so the
+      # two passes derive the same name whether or not the caller supplied a path.
+      def anonymous_class_new_name(context)
+        return nil if context.nil?
+
+        AnonymousMetaClass.name_for(context.call_node, context.scope&.source_path)
+      end
+
       # ADR-15 Phase 4b.x — `Ractor.make_shareable` on both the outer Hash and each lambda value.
       # A plain `.freeze` leaves the Procs unshareable; reading `CONSTANT_CONSTRUCTORS[class]`
       # from a worker Ractor would raise `Ractor::IsolationError`, which the `rescue
@@ -1000,17 +1024,24 @@ module Rigor
       # `Tuple[…]` when `n` is a small `Constant<Integer>`. Cap at `ARRAY_NEW_TUPLE_LIMIT` (16)
       # so a `Array.new(1_000_000)` does not balloon the carrier; oversize calls fall back to
       # `Nominal[Array]`.
+      #
+      # #317 — `Array.new(n) { |i| ... }` fills every slot from the BLOCK's return type instead
+      # of the two-arg `(n, default_value)` overload's `nil` fill. The block and the trailing
+      # `default_value` positional are mutually exclusive per `Array#initialize`'s RBS overload
+      # set (`(int size, ?E default_value) -> void` vs `(int size) { (Integer index) -> E } ->
+      # void`), so a block present at the call site always wins over any (illegal, but tolerated
+      # rather than rejected here) second positional.
       ARRAY_NEW_TUPLE_LIMIT = 16
       private_constant :ARRAY_NEW_TUPLE_LIMIT
 
-      def array_new_lift(class_name, arg_types)
+      def array_new_lift(class_name, arg_types, block_type = nil)
         return nil unless class_name == "Array"
         return nil if arg_types.empty? || arg_types.size > 2
 
         size = array_new_size(arg_types.first)
         return nil if size.nil? || size.negative? || size > ARRAY_NEW_TUPLE_LIMIT
 
-        fill = array_new_fill(arg_types[1])
+        fill = block_type || array_new_fill(arg_types[1])
         Type::Combinator.tuple_of(*Array.new(size, fill))
       end
 

data/lib/rigor/inference/optimistic_origin.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "prism"
+
 module Rigor
   module Inference
     # Marks a value whose *nil-freeness* rests on Rigor's deliberate choice to ignore core RBS's
@@ -15,9 +17,16 @@ module Rigor
     # attaches to — the value here is *not* `Dynamic`; it is an ordinary `Union` / `Constant` / `Nominal`
     # that happens to have been produced optimistically.
     #
-    # Issue #286: the `if` / `unless` branch elision is a third consumer of `Narrowing.predicate_certainty`,
-    # and unlike `flow.always-truthy-condition` and the `&&` / `||` gate it is not constrained by the spec
-    # passage above. This channel is what lets a certainty judgment tell the two apart.
+    # Issue #286: the `if` / `unless` branch elision is one consumer of `Narrowing.predicate_certainty`; the
+    # other two are `flow.always-truthy-condition` and the `&&` / `||` `constant_value_polarity` gate, and the
+    # spec passage above binds all three. This channel is what lets a certainty judgment tell the two apart.
+    #
+    # Issue #313: the mark is attached to a *value* — the call node that produced it, or the local / ivar it
+    # was bound to — but every one of those consumers reads a *predicate expression*, and a predicate is
+    # rarely the bare carrier. `x.nil?` collapses the carrier's nil-freeness into a `Constant[false]` of its
+    # own, `!x.nil?` inverts it, and `x.nil? || y.nil?` composes two of them; each step produced an unmarked
+    # `Constant` that the gates then read as proof. {.resolve} therefore derives the mark through exactly
+    # those shapes, so the exclusion survives composition instead of stopping at the read.
     module OptimisticOrigin
       # The core-RBS annotation `RbsDispatch` reads the return type past.
       ANNOTATION = "implicitly-returns-nil"
@@ -26,8 +35,64 @@ module Rigor
       # distinguish further optimistic families without changing the table's shape.
       IMPLICITLY_RETURNS_NIL = :implicitly_returns_nil
 
+      # The argument-free unary predicates whose folded result is a statement about the receiver's
+      # *nil-freeness* and nothing else, which is what makes the derivation sound rather than a general taint:
+      # `nil?` answers the exact question the optimism is a bet on, and `!` (which Prism spells as a `CallNode`
+      # named `:!`, covering both `!x` and `not x`) inverts whatever it is applied to. Value predicates —
+      # `empty?`, `zero?`, `any?` — are deliberately absent: they fold from the carrier's *value*, and marking
+      # them would widen this channel into a taint that silences genuine diagnostics.
+      NIL_COLLAPSING_PREDICATES = %i[nil? !].freeze
+
       module_function
 
+      # The effective optimistic-nil-free cause of an expression under `scope`, or nil when its nil-freeness is
+      # a property of the value rather than a bet. The single owner of the judgment: `ExpressionTyper`,
+      # `StatementEvaluator` and `AlwaysTruthyConditionCollector` all route here, so the three consumers the
+      # spec binds cannot drift apart.
+      #
+      # Resolution order — the mark recorded on the node itself, then the binding a bare local / ivar read (or
+      # a write in value position, `if (x = MAP[k])`) resolves through, then the predicate-fold derivation
+      # issue #313 added.
+      #
+      # @param node [Prism::Node, nil]
+      # @param scope [Rigor::Scope, nil]
+      # @return [Symbol, nil]
+      def resolve(node, scope)
+        return nil if node.nil? || scope.nil?
+
+        recorded = scope.optimistic_origins[node]
+        return recorded if recorded
+
+        case node
+        when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
+        when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
+        when Prism::AndNode, Prism::OrNode then resolve(node.left, scope) || resolve(node.right, scope)
+        when Prism::CallNode then resolve_through_predicate(node, scope)
+        when Prism::ParenthesesNode then resolve_through_parentheses(node, scope)
+        end
+      end
+
+      # `recv.nil?` / `!recv` — the fold is a statement about `recv`, so it is exactly as optimistic as `recv`
+      # is. A block or any argument means this is not the unary predicate it looks like (`x.!(y)` is a
+      # user-defined operator), and the derivation declines.
+      def resolve_through_predicate(node, scope)
+        return nil unless NIL_COLLAPSING_PREDICATES.include?(node.name)
+        return nil unless node.block.nil?
+        return nil unless node.arguments.nil? || node.arguments.arguments.empty?
+
+        resolve(node.receiver, scope)
+      end
+
+      # `(x.nil?)` — a single-statement parenthesised body is its own value, and authors do parenthesise a
+      # composed guard. A multi-statement body's value is its last statement, but the earlier statements can
+      # rebind, so only the single-statement form is derived.
+      def resolve_through_parentheses(node, scope)
+        body = node.body
+        return nil unless body.is_a?(Prism::StatementsNode) && body.body.size == 1
+
+        resolve(body.body.first, scope)
+      end
+
       # Whether the overload the selector actually picked carries the ignored annotation. The judgment is
       # per-overload, which is what makes it precise: `Array#first` is optimistic while `Array#first(3)` is
       # not, and `String#[]` / `Enumerable#find` are honest because they already spell the miss as `?`.