rigortype 0.3.5 → 0.3.7

data/lib/rigor/inference/struct_fold_safety.rb

@@ -15,8 +15,16 @@ module Rigor
     # The analysis is a conservative ALLOW-LIST, not a deny-list: a local is fold-safe only when *every* read of it is
     # the receiver of a known-pure read call. Anything the scan does not recognise as a pure read — a setter, an `[]=` /
     # operator-write, an argument / alias / container store / return (escape), or an unknown method call (which could
-    # mutate `self` internally) — disqualifies the local. A missed case therefore makes the scan over-conservative (no
-    # fold), **never unsound** (folding a mutated value) — the false-positive-safe direction.
+    # mutate `self` internally) — disqualifies the local.
+    #
+    # A missed case is USUALLY only over-conservative (no fold), but the direction is not guaranteed, and an earlier
+    # version of this header claimed it was. The counting identity below is about the LOCAL; it says nothing about what
+    # happens to a member read's RESULT. `s.x << v` mutates the container `s.x` returns while `s.x` itself is a
+    # textbook pure read, so the identity held and the local stayed fold-safe while its member's VALUE changed
+    # underneath — `s = Point.new([5]); s.x << "a"; s.x.last` folded to `5` and drew `undefined method 'upcase' for 5`
+    # on correct code. That is why {#count_uses} disqualifies a local whose member-read result is itself a receiver
+    # (see there). Any future extension must ask the same question: does this shape reach the member's value through
+    # something other than the local?
     #
     # Soundness rests on a counting identity: a local `n` is fold-safe iff *every* `LocalVariableReadNode(n)` is the
     # receiver of a pure-read call. Equivalently `total_reads(n) == pure_receiver_reads(n)`. Any other occurrence — `n`
@@ -59,10 +67,12 @@ module Rigor
         collect_struct_locals(root, layout_lookup, members, writes)
         return EMPTY if members.empty?
 
-        total = Hash.new(0)
-        safe_uses = Hash.new(0)
-        deferred_setter = {}
-        count_uses(root, members, total, safe_uses, deferred_setter, false)
+        tally = Tally.new(total: Hash.new(0), safe_uses: Hash.new(0), deferred_setter: {}, chained: {})
+        count_uses(root, members, tally, false)
+        total = tally.total
+        safe_uses = tally.safe_uses
+        deferred_setter = tally.deferred_setter
+        chained = tally.chained
 
         # A local is fold-safe iff every read of it is a safe use — a pure read OR (ADR-48 slice 4) a
         # straight-line member setter (`n.x = v`) that the setter write-back re-types the binding for.
@@ -71,7 +81,7 @@ module Rigor
         # stale binding for the fold to read).
         safe = members.each_key.select do |name|
           writes[name] == 1 && total[name].positive? &&
-            total[name] == safe_uses[name] && !deferred_setter[name]
+            total[name] == safe_uses[name] && !deferred_setter[name] && !chained[name]
         end
         safe.empty? ? EMPTY : safe.to_set
       end
@@ -95,30 +105,63 @@ module Rigor
       # Pass 2 — count, per recorded struct local, total reads vs. SAFE-use reads (the receiver of a pure-read call,
       # or of a straight-line member setter). `deferred` is true inside a loop / block / lambda; a member setter seen
       # there marks the local's `deferred_setter` so it is excluded (its write-back cannot be modelled statically).
-      def count_uses(node, members, total, safe_uses, deferred_setter, deferred)
-        return if node.nil?
+      # The four per-local accumulators pass 2 fills, bundled so the walk stays one recursive call rather than a
+      # seven-argument one.
+      Tally = Struct.new(:total, :safe_uses, :deferred_setter, :chained, keyword_init: true)
 
-        total[node.name] += 1 if node.is_a?(Prism::LocalVariableReadNode) && members.key?(node.name)
+      def count_uses(node, members, tally, deferred)
+        return if node.nil?
 
-        if node.is_a?(Prism::CallNode)
-          receiver = node.receiver
-          if receiver.is_a?(Prism::LocalVariableReadNode) && members.key?(receiver.name)
-            member_set = members[receiver.name]
-            if pure_read_call?(node, member_set)
-              safe_uses[receiver.name] += 1
-            elsif member_setter_call?(node, member_set)
-              safe_uses[receiver.name] += 1
-              deferred_setter[receiver.name] = true if deferred
-            end
-          end
-        end
+        tally.total[node.name] += 1 if node.is_a?(Prism::LocalVariableReadNode) && members.key?(node.name)
+        chained_local_of(node, members)&.then { |name| tally.chained[name] = true }
+        count_receiver_use(node, members, tally, deferred)
 
         child_deferred = deferred || deferred_boundary?(node)
         each_local_scope_child(node) do |child|
-          count_uses(child, members, total, safe_uses, deferred_setter, child_deferred)
+          count_uses(child, members, tally, child_deferred)
+        end
+      end
+
+      # The `<local>.<call>` arm: a pure read or a member setter counts as a SAFE use of the local, and a setter
+      # seen inside a loop / block / lambda additionally marks `deferred_setter`.
+      def count_receiver_use(node, members, tally, deferred)
+        return unless node.is_a?(Prism::CallNode)
+
+        receiver = node.receiver
+        return unless receiver.is_a?(Prism::LocalVariableReadNode) && members.key?(receiver.name)
+
+        member_set = members[receiver.name]
+        if pure_read_call?(node, member_set)
+          tally.safe_uses[receiver.name] += 1
+        elsif member_setter_call?(node, member_set)
+          tally.safe_uses[receiver.name] += 1
+          tally.deferred_setter[receiver.name] = true if deferred
         end
       end
 
+      # The tracked local behind `<local>.<member>` when THAT read is itself the receiver of a further call —
+      # `s.x << v`, `s.x.push(v)`, `row.cells.size`. The counting identity above cannot see these: `s.x` is a
+      # pure read of `s` by every measure it applies, and the mutation lands on the object `s.x` RETURNS. The
+      # local stays fold-safe, the fold serves the materialisation value, and a correct program is told its
+      # accumulated container still holds only what it was built with.
+      #
+      # Any call on the result disqualifies, with no allow-list of its own. `s.x.to_s` is provably harmless and
+      # loses precision here for nothing — but an allow-list is what produced this bug in the first place, and
+      # the failure mode of being too broad is a `Dynamic[top]` where a constant would do. Reads that do NOT
+      # chain (`dump_type(p.x)`, `assert_type("1", stored.foo)`, a bare `s.x`) are arguments or values, not
+      # receivers, and keep folding.
+      def chained_local_of(node, members)
+        return nil unless node.is_a?(Prism::CallNode)
+
+        inner = node.receiver
+        return nil unless inner.is_a?(Prism::CallNode)
+
+        local = inner.receiver
+        return nil unless local.is_a?(Prism::LocalVariableReadNode) && members.key?(local.name)
+
+        local.name
+      end
+
       # A call is a pure read of the receiver when its name is a fixed Struct read or one of the receiver's member
       # readers. Setters (`:x=`), `:[]=`, and any unknown method are excluded.
       def pure_read_call?(call_node, member_set)
@@ -137,9 +180,123 @@ module Rigor
         (call_node.arguments&.arguments&.size || 0) == 1
       end
 
-      # Constructs whose body runs zero-or-many times or is deferred (loops, blocks, lambdas): a single static pass
-      # over the body cannot model a member setter's effect across iterations, so a setter inside one disqualifies the
-      # local. Straight-line conditionals (`if` / `unless` / `case`) are NOT boundaries — their branch scopes join
+      # Self-calls that cannot change a member, on top of the receiver's own member READERS. Same list the
+      # stored-local scan trusts, so the two halves of the gate cannot drift on what "pure" means. `:class`
+      # is added because `self.class.new(...)` is the ordinary way a struct method builds a sibling.
+      SELF_PURE_READS = (FIXED_READS + %i[class]).freeze
+
+      # Issue #525 — whether a method body may be granted the `:self` fold-safety sentinel, i.e. whether the
+      # caller's member map is still the struct's state at every member read the body performs.
+      #
+      # Three shapes refuse, and the third is what makes the grant closed under the calls the body makes:
+      #
+      # 1. a member setter or `[]=` on self (`self.text = v`) — a later read would fold the STALE
+      #    construction value, the wrong-type family this gate exists to prevent;
+      # 2. a bare `self` anywhere but as a call receiver — passed, stored or returned, `self` reaches code
+      #    that can mutate it;
+      # 3. any other self-call that is not a member reader or a fixed pure read. `def shout; reset!;
+      #    text.upcase; end` over a sibling `def reset!; self.text = ""; end` has no setter of its OWN, so a
+      #    guard that only looked for (1) would grant it and fold `text` to the construction value while the
+      #    runtime read is `""`.
+      #
+      # (3) is what makes the grant CLOSED under the calls the body makes. A caller that can resolve sibling
+      # methods passes a block: it receives each otherwise-unrecognised self-call name and answers whether
+      # that sibling is itself self-fold-safe, which is how `def outer; shout; end` keeps the grant while
+      # `def go; reset!; text; end` loses it. Without the block — or for a name the block cannot resolve —
+      # the call refuses, so the AST-only answer stays the conservative one.
+      #
+      # Nested `def` / `class` / `module` bodies are skipped: their statements do not run during THIS body's
+      # evaluation. Blocks are descended into — they share `self`.
+      #
+      # @param body [Prism::Node, nil]
+      # @param member_names [Enumerable<Symbol>] the receiver carrier's member names.
+      # @yieldparam name [Symbol] an unrecognised self-call selector.
+      # @yieldreturn [Boolean] whether that sibling method is itself self-fold-safe.
+      def self_fold_safe_body?(body, member_names, &sibling_pure)
+        return false if body.nil?
+
+        self_uses_pure?(body, member_names.to_set(&:to_sym), sibling_pure)
+      end
+
+      # Recursive worker for {self_fold_safe_body?}. A `SelfNode` reached here came through a non-receiver
+      # edge (a call's own `self` receiver is skipped below), so it is an escape.
+      def self_uses_pure?(node, members, sibling_pure)
+        return true if node.nil? || scope_boundary?(node)
+        return false if node.is_a?(Prism::SelfNode)
+        # `super` / `super(...)` runs an ancestor's body against this same `self`, and the resolver
+        # `sibling_pure` walks owns-class defs only, so nothing here can vouch for what it does. Latent
+        # while struct carriers have no subclass ancestry to reach, closed before they do.
+        return false if node.is_a?(Prism::SuperNode) || node.is_a?(Prism::ForwardingSuperNode)
+
+        if node.is_a?(Prism::CallNode)
+          return false unless self_call_pure?(node, members, sibling_pure)
+
+          return call_children_pure?(node, members, sibling_pure)
+        end
+
+        children_pure?(node, members, sibling_pure)
+      end
+
+      # A call is pure for this scan unless it targets `self` (explicitly or implicitly) under a name that is
+      # neither one of the receiver's member readers nor a fixed pure read. `self.text = v` arrives as a
+      # `:text=` call and `self[:text] = v` as `:[]=`; neither is in either set, so both refuse — and neither
+      # is offered to `sibling_pure`, since a name that WRITES is not made safe by where it is defined.
+      def self_call_pure?(call_node, members, sibling_pure)
+        receiver = call_node.receiver
+        return true unless receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+        name = call_node.name
+        return true if members.include?(name) || SELF_PURE_READS.include?(name)
+        return false if writer_selector?(name)
+
+        !sibling_pure.nil? && sibling_pure.call(name)
+      end
+
+      # A selector that assigns: `text=`, `[]=`. Never delegated to `sibling_pure` — a writer is unsafe on
+      # its face, and asking the resolver about it would let a struct with a hand-written `def text=(v)` that
+      # the resolver walks into read as pure.
+      def writer_selector?(name)
+        text = name.to_s
+        text.end_with?("=") && !%w[== != <= >= ===].include?(text)
+      end
+
+      # Children of a call, skipping an explicit `self` RECEIVER — that occurrence is the call's own target
+      # and was already judged by {self_call_pure?}, not an escape.
+      def call_children_pure?(call_node, members, sibling_pure)
+        call_node.rigor_each_child do |child|
+          next if child.is_a?(Prism::SelfNode) && child.equal?(call_node.receiver)
+          return false unless self_uses_pure?(child, members, sibling_pure)
+        end
+        true
+      end
+
+      def children_pure?(node, members, sibling_pure)
+        node.rigor_each_child do |child|
+          return false unless self_uses_pure?(child, members, sibling_pure)
+        end
+        true
+      end
+
+      # Constructs a member setter's effect cannot reach the continuation soundly, so a setter inside one
+      # disqualifies the local.
+      #
+      # A block or lambda body is evaluated for its own scope and its bindings do NOT leak, so
+      # `[1].each { s.x = v }; s.x` would read the construction value — verified unsound on #525.
+      #
+      # `for` shares the enclosing locals rather than opening a scope, so the block rationale does not apply
+      # to it; it is a boundary for the same reason `while` is (below), and this comment previously gave the
+      # wrong reason for it.
+      #
+      # `while` / `until` are boundaries because a single static pass cannot model a member setter across
+      # ITERATIONS. Issue #597 tried to lift this: `eval_loop` does join the body's exit scope with the
+      # pre-loop scope, which looks like the per-iteration summary the gate stands in for. It is not one.
+      # That join is a single unrolling, and it is sound only under four side conditions nothing checks —
+      # the setter's RHS must not depend on loop-carried member state (`p.x = p.y; p.y = 5` reads `1 | 2`
+      # where the runtime holds 5), the member must be read only AFTER the loop, the loop must exit through
+      # its predicate rather than a `break`, and no later setter may overwrite what the join recorded.
+      # Details and the probes: ADR-56 § WD2.8.
+      #
+      # Straight-line conditionals (`if` / `unless` / `case`) are NOT boundaries — their branch scopes join
       # soundly, so a setter in one branch is fine.
       def deferred_boundary?(node)
         node.is_a?(Prism::WhileNode) || node.is_a?(Prism::UntilNode) ||
@@ -171,7 +328,9 @@ module Rigor
         return nil unless meta_constant?(call_node.receiver, :Struct)
 
         args = call_node.arguments&.arguments || []
-        positional = args.last.is_a?(Prism::KeywordHashNode) ? args[0..-2] : args
+        # `[0..-2]` cannot return nil for a start of 0, but `Array#[](Range) -> Array[T]?` says it can;
+        # the `|| []` keeps the read well-typed on that worst case.
+        positional = args.last.is_a?(Prism::KeywordHashNode) ? (args[0..-2] || []) : args
         positional = positional[1..] if positional.first.is_a?(Prism::StringNode)
         return nil if positional.nil? || positional.empty?
         return nil unless positional.all?(Prism::SymbolNode)

data/lib/rigor/inference/synthetic_method_scanner.rb

@@ -65,6 +65,13 @@ module Rigor
         registries = collect_trait_registries(plugin_registry)
         nested_templates = collect_nested_class_templates(plugin_registry)
         return SyntheticMethodIndex::EMPTY if templates.empty? && registries.empty? && nested_templates.empty?
+        # Tier B alone cannot emit without an environment: every trait entry — the direct route and the
+        # concern-re-targeted one — funnels through `module_instance_method_names`, whose first line
+        # answers `[]` for a nil environment. The production pre-pass passes `environment: nil` (#476),
+        # so a project whose only contributing plugin registers trait registries (rigor-devise on a
+        # Rails app) would otherwise pay a whole-project parse to build a provably empty index. This
+        # gate mirrors that nil guard and MUST be removed in the change that threads a real environment.
+        return SyntheticMethodIndex::EMPTY if environment.nil? && templates.empty? && nested_templates.empty?
 
         asts = parse_paths(paths, buffer: buffer)
         hierarchy = build_hierarchy(asts)

data/lib/rigor/inference/version_guard.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../source/constant_path"
+
+module Rigor
+  module Inference
+    # ADR-47 WD5 — decides the arm of a **version guard**: an `if` / `unless` predicate that compares the
+    # Ruby (or a bundled default gem's) version against a literal, both sides readable at analysis time.
+    #
+    # Multi-version gems select an API generation with these guards routinely:
+    #
+    #     if Gem::Version.new(Psych::VERSION) >= Gem::Version.new("3.1.0.pre1")
+    #       ::YAML.safe_load(yaml, permitted_classes: permitted_classes)
+    #     else
+    #       ::YAML.safe_load(yaml, permitted_classes)   # Psych < 3.1 positional form
+    #     end
+    #
+    # The dead arm is honest code for an older Ruby, but it never runs on the Ruby the user is checking
+    # with — so a diagnostic inside it is a false positive ("the program works" outranks the worst-case
+    # static reading, issue #627). {.verdict} answers `:truthy` / `:falsey` for a decidable guard, and
+    # `StatementEvaluator#eval_if` / `#eval_unless` then take the *exact* path they already take for
+    # `if false`: only the live arm is evaluated, so the dead arm contributes neither diagnostics nor
+    # writes to the post-`if` scope.
+    #
+    # ## The reference Ruby
+    #
+    # The version compared against is the **analyzer's own** `RUBY_VERSION` / `RUBY_ENGINE`. That is the
+    # premise Rigor already runs on: {Builtins::PredefinedConstantRefinements} resolves these constants
+    # through the analyzer's runtime, and the core / stdlib RBS the engine reads is the one shipped with
+    # the interpreter running `rigor`. `Configuration#target_ruby` is deliberately NOT consulted — it is a
+    # Prism *parse* version (it decides which syntax is accepted), it is not threaded to the inference
+    # layer, and its default (`"4.0"`) is a default rather than a user statement about the runtime.
+    #
+    # ## What is folded (and what is deliberately not)
+    #
+    # * `RUBY_VERSION <cmp> "x.y.z"` — compared with **String** semantics, because that is what runs.
+    #   Ruby compares strings lexically, so `RUBY_VERSION >= "3.10"` is famously false on 3.10; folding
+    #   with String semantics reproduces the program's real behaviour rather than an idealised one.
+    # * `Gem::Version.new(a) <cmp> Gem::Version.new(b)` — both sides wrapped, compared with
+    #   `Gem::Version` semantics. A *mixed* comparison (one side wrapped, the other a bare String) is
+    #   never folded: `Gem::Version#<=>` returns nil for a non-Version operand, so `Comparable` raises at
+    #   runtime and there is no arm to pick.
+    # * `RUBY_ENGINE == / != "…"` — equality only. An *ordering* comparison on an engine name is not a
+    #   version guard, so it is left alone.
+    # * `X::VERSION` — only for the curated {VERSION_CONSTANTS} set: constants of **default gems shipped
+    #   with the running Ruby**, where "the analyzer's Ruby is the target's Ruby" already covers them.
+    #   A third-party gem's `VERSION` is not read: its version is the project's `Gemfile.lock`'s to say,
+    #   and the lockfile is not visible from the inference layer.
+    # * `RUBY_PLATFORM` — **never** folded. Every comparison against it is by construction
+    #   platform-dependent, and the machine running `rigor` need not be the machine running the program.
+    # * `<=>` — never folded (it yields -1/0/1, not a branch verdict), and neither are `defined?(Ractor)`
+    #   style capability probes, `!` / `&&` / `||` compositions, or `case` subjects. Each would need its
+    #   own argument; an unfoldable guard simply keeps both arms live, which is the pre-existing
+    #   behaviour.
+    # * Two bare String literals (`if "a" < "b"`) — declined. That is a constant comparison, not a version
+    #   guard; the existing constant-fold tier already answers it, and widening this rule to cover it would
+    #   buy scope without buying an FP fix. At least one side must be a readable constant or a
+    #   `Gem::Version`.
+    module VersionGuard
+      module_function
+
+      # Comparison operators whose result is a branch verdict. `<=>` is excluded on purpose.
+      ORDERING = Set[:<, :<=, :>, :>=].freeze
+      EQUALITY = Set[:==, :!=].freeze
+      private_constant :ORDERING, :EQUALITY
+
+      # Predefined constants read from the analyzer's runtime, mapped to the operand kind they produce.
+      # `:string` operands accept every comparison; `:engine` operands accept equality only.
+      PREDEFINED = { RUBY_VERSION: :string, RUBY_ENGINE: :engine }.freeze
+      private_constant :PREDEFINED
+
+      # Operand kinds that carry a plain Ruby String, i.e. the ones `Gem::Version.new` may wrap and the
+      # ones that compare with each other.
+      STRING_KINDS = Set[:literal_string, :string, :engine].freeze
+      private_constant :STRING_KINDS
+
+      # Qualified `X::VERSION` constants that may be read from the analyzer's runtime.
+      #
+      # Admission criterion: the constant belongs to a **default gem of the running Ruby**, so its value
+      # is fixed by the same interpreter choice that already fixes `RUBY_VERSION` and the core RBS. Add an
+      # entry only when that holds; a gem the project resolves through its own `Gemfile.lock` does not
+      # qualify, because the analyzer's copy and the project's can differ.
+      VERSION_CONSTANTS = Set["Psych::VERSION"].freeze
+      private_constant :VERSION_CONSTANTS
+
+      GEM_VERSION_PATH = "Gem::Version"
+      private_constant :GEM_VERSION_PATH
+
+      # @param node [Prism::Node, nil] an `if` / `unless` predicate
+      # @return [Symbol, nil] `:truthy` / `:falsey` when the guard is decidable on the analyzer's Ruby,
+      #   otherwise nil (both arms stay live)
+      def verdict(node)
+        return nil unless node.is_a?(Prism::CallNode)
+
+        operator = node.name
+        return nil unless ORDERING.include?(operator) || EQUALITY.include?(operator)
+        return nil if node.block || node.receiver.nil?
+
+        arguments = node.arguments&.arguments
+        return nil unless arguments && arguments.length == 1
+
+        left = read_operand(node.receiver)
+        right = read_operand(arguments.first)
+        return nil if left.nil? || right.nil?
+
+        decide(left, right, operator)
+      end
+
+      # Reads one side of the comparison into `[kind, value]`, or nil when it is not readable.
+      #
+      # @return [Array(Symbol, Object), nil]
+      def read_operand(node)
+        case node
+        when Prism::StringNode then [:literal_string, node.unescaped]
+        when Prism::ConstantReadNode then read_predefined(node)
+        when Prism::ConstantPathNode then read_version_constant(node)
+        when Prism::CallNode then read_gem_version(node)
+        end
+      end
+      private_class_method :read_operand
+
+      def read_predefined(node)
+        kind = PREDEFINED[node.name]
+        return nil unless kind
+
+        value = runtime_value(node.name.to_s)
+        value && [kind, value]
+      end
+      private_class_method :read_predefined
+
+      def read_version_constant(node)
+        path = Source::ConstantPath.qualified_name_or_nil(node)
+        return nil unless path && VERSION_CONSTANTS.include?(path)
+
+        value = runtime_value(path)
+        value && [:string, value]
+      end
+      private_class_method :read_version_constant
+
+      # `Gem::Version.new(<readable>)`. The inner operand must be a plain version String — an engine name
+      # is not a version, and `Gem::Version.new` raises on anything `Gem::Version.correct?` rejects, so a
+      # malformed literal keeps both arms live instead of folding a guard the program cannot even reach.
+      def read_gem_version(node)
+        return nil unless node.name == :new && node.block.nil?
+        return nil unless Source::ConstantPath.qualified_name_or_nil(node.receiver) == GEM_VERSION_PATH
+
+        arguments = node.arguments&.arguments
+        return nil unless arguments && arguments.length == 1
+
+        inner = read_operand(arguments.first)
+        return nil unless inner && STRING_KINDS.include?(inner.first)
+        return nil unless ::Gem::Version.correct?(inner.last)
+
+        [:gem_version, ::Gem::Version.new(inner.last)]
+      end
+      private_class_method :read_gem_version
+
+      # Resolves a constant path in the analyzer's own runtime without triggering `const_missing` or an
+      # autoload. The path is always one of {PREDEFINED} / {VERSION_CONSTANTS} — Rigor's own source,
+      # never a name read out of the analysed program — but the walk is guarded the same way
+      # {Builtins::PredefinedConstantRefinements} is, for the same reason: `const_defined?` answers true
+      # for a REGISTERED-BUT-NOT-YET-TRIGGERED autoload, so it does not mean "already in memory" and
+      # `const_get` would execute the target file inside the analyzer. `Module#autoload?` is what
+      # separates the two ([#680](https://github.com/rigortype/rigor/issues/680)).
+      #
+      # @return [String, nil] the constant's value when it is a non-empty String
+      def runtime_value(path)
+        mod = ::Object
+        path.split("::").each do |part|
+          return nil unless mod.is_a?(::Module) && mod.const_defined?(part, false)
+          return nil if mod.autoload?(part)
+
+          mod = mod.const_get(part, false)
+        end
+
+        mod.is_a?(::String) && !mod.empty? ? mod : nil
+      rescue ::StandardError, ::ScriptError, ::SystemExit
+        # Wider than `NameError` / `TypeError` / `LoadError`: folding a version guard is a precision
+        # win, and nothing it can hit justifies stopping the run. `SystemExit` is not a `StandardError`
+        # and escaped every rescue in the analyzer when a resolution executed third-party code (#680).
+        # `Interrupt`, `SignalException` and `NoMemoryError` stay uncaught on purpose.
+        nil
+      end
+      private_class_method :runtime_value
+
+      # Applies the operator with the semantics that actually run. Operands must be the same kind, and an
+      # engine name only ever answers equality.
+      def decide(left, right, operator)
+        left_kind, left_value = left
+        right_kind, right_value = right
+        return nil unless comparable_kinds?(left_kind, right_kind)
+        return nil if (left_kind == :engine || right_kind == :engine) && !EQUALITY.include?(operator)
+
+        result = apply(left_value, right_value, operator)
+        return nil if result.nil?
+
+        result ? :truthy : :falsey
+      end
+      private_class_method :decide
+
+      # `:gem_version` only ever compares with another `:gem_version` — `Gem::Version#<=>` answers nil for
+      # a String operand, so the mixed spelling raises at runtime and has no live arm to pick. The String
+      # kinds compare with each other, EXCEPT two bare literals: that is a constant comparison, not a
+      # version guard.
+      def comparable_kinds?(left_kind, right_kind)
+        return left_kind == right_kind if left_kind == :gem_version || right_kind == :gem_version
+
+        !(left_kind == :literal_string && right_kind == :literal_string)
+      end
+      private_class_method :comparable_kinds?
+
+      def apply(left, right, operator)
+        case operator
+        when :<  then left < right
+        when :<= then left <= right
+        when :>  then left > right
+        when :>= then left >= right
+        when :== then left == right
+        when :!= then left != right
+        end
+      rescue ::ArgumentError, ::TypeError, ::NoMethodError
+        nil
+      end
+      private_class_method :apply
+    end
+  end
+end

data/lib/rigor/language_server/selection_range_provider.rb

@@ -73,7 +73,7 @@ module Rigor
         loc = node.location
         {
           start: { line: loc.start_line - 1, character: loc.start_column },
-          end: { line: loc.end_line - 1,   character: loc.end_column }
+          end: { line: loc.end_line - 1, character: loc.end_column }
         }
       end
 

data/lib/rigor/plugin/base.rb

@@ -435,11 +435,10 @@ module Rigor
         # Frozen snapshot of the declared narrowing-facts rules. Memoised for the same reason as
         # {dynamic_returns} — consulted per plugin per dispatch, over an array fixed at class-definition
         # time.
-        # rubocop:disable Naming/MemoizedInstanceVariableName -- see dynamic_returns
+        # rubocop:disable-next Naming/MemoizedInstanceVariableName -- see dynamic_returns
         def narrowing_facts_rules
           @narrowing_facts_rules_snapshot ||= (@narrowing_facts_rules || []).dup.freeze
         end
-        # rubocop:enable Naming/MemoizedInstanceVariableName
       end
 
       attr_reader :services, :config
@@ -841,6 +840,8 @@ module Rigor
       def dynamic_return_receiver_class_name(receiver_type)
         case receiver_type
         when Rigor::Type::Nominal, Rigor::Type::Singleton then receiver_type.class_name
+        when Rigor::Type::Result then "Dry::Monads::Result"
+        when Rigor::Type::Maybe then "Dry::Monads::Maybe"
         end
       end
 

data/lib/rigor/plugin/inflector.rb

@@ -32,9 +32,17 @@ module Rigor
       # § "safety harness"). The set is fixed and greppable — never a dynamic `public_send`.
       #
       # `tableize` is deliberately NOT delegated: `ActiveSupport::Inflector.tableize("Admin::User")` returns
-      # `"admin/users"`, but ActiveRecord's *actual* table name flattens the namespace to `"admin_users"` (the
-      # table-name computation does more than the pure `tableize` string method). So {.tableize} composes the
-      # AS-backed `underscore` / `pluralize` with the `::`→`_` flattening AR really uses.
+      # `"admin/users"`, a slash-separated path, never a valid SQL table name. {.tableize} composes the
+      # AS-backed `underscore` / `pluralize` with a `::`→`_` flatten instead, so a caller already holding a
+      # BARE (non-namespaced) name gets a plain identifier back rather than a path.
+      #
+      # This is NOT ActiveRecord's actual table-name algorithm for a namespaced model — Rails demodulizes
+      # (drops the enclosing module entirely) rather than flattening it into the name, and prepends /
+      # appends `table_name_prefix` / `table_name_suffix` only when the enclosing module declares one.
+      # `rigor-activerecord`'s `ModelIndex.inflected_table_name` does that demodulize-then-decorate
+      # sequence and calls here only with the already-demodulized (so already namespace-free) local class
+      # name — the `::`→`_` flatten below never actually fires from that caller (#623 fixed a version of
+      # this method that WAS called with the full namespaced path).
       ALLOWED_METHODS = %i[underscore camelize singularize pluralize classify].freeze
 
       # The target library + the constant the allow-listed methods are called on. Passed to {Isolation} so the
@@ -81,8 +89,9 @@ module Rigor
         invoke(:classify, table_name)
       end
 
-      # `BlogPost` → `blog_posts`; `Admin::User` → `admin_users`. Composed (not delegated) so the namespace
-      # flattens with `_` the way ActiveRecord's table naming does — see {ALLOWED_METHODS}.
+      # `BlogPost` → `blog_posts`; `Admin::User` → `admin_users`. Composed (not delegated) — see
+      # {ALLOWED_METHODS} — to flatten a namespaced String into a plain SQL identifier. This is NOT what
+      # ActiveRecord's table-name computation does with a namespace: see {ALLOWED_METHODS}'s comment above.
       def tableize(class_name)
         underscored = underscore(class_name.to_s.gsub("::", "/")).tr("/", "_")
         pluralize(underscored)