rigortype 0.3.6 → 0.3.8

data/lib/rigor/inference/narrowing.rb

@@ -37,7 +37,7 @@ module Rigor
     #
     # See docs/internal-spec/inference-engine.md (Narrowing) and
     # docs/type-specification/control-flow-analysis.md for the binding contract.
-    # rubocop:disable Metrics/ModuleLength
+    # rubocop:disable-next Metrics/ModuleLength
     module Narrowing
       TRUSTED_EQUALITY_LITERAL_CLASSES = [String, Symbol, Integer, TrueClass, FalseClass, NilClass].freeze
       SINGLETON_LITERAL_CLASSES = [TrueClass, FalseClass, NilClass].freeze
@@ -439,7 +439,7 @@ module Rigor
         end
       end
 
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class << self
         private
 
@@ -897,6 +897,30 @@ module Rigor
             # the conservative no-op (falsey could mean nil receiver OR a falsey method result).
             safe_nav_result = analyse_safe_nav_receiver(node, scope)
             return safe_nav_result if safe_nav_result
+
+            # Issue #606 slice 1 — the same proof one call further out, where the `&.` result is
+            # fed to a suffix (`custom&.value.present?`, `backup&.user.nil?`) or compared against
+            # a non-nil operand. Sits after every pre-existing NARROWING path so those keep first claim
+            # on the node (the RBS-extended contribution hook still runs later and can be pre-empted —
+            # no live collision today since arg-free chains carry no argument facts):
+            # each of them returns nil for these shapes today (the predicate analysers require a
+            # local-read receiver, which a chain is not), so this only ever runs on nodes that
+            # were otherwise about to narrow nothing.
+            chain_result =
+              if %i[== !=].include?(node.name)
+                analyse_safe_nav_chain_equality(node, scope)
+              else
+                analyse_safe_nav_chain(node, scope)
+              end
+            return chain_result if chain_result
+
+            # Issue #606 slice 2 — membership. Runs after `analyse_string_predicate`, which owns
+            # the `str.include?(literal)` shape; this one wants the mirror image (a collection
+            # receiver, a bound argument), so the two never contend for the same node.
+            if node.name == :include?
+              membership_result = analyse_membership_predicate(node, scope)
+              return membership_result if membership_result
+            end
           end
 
           # Slice 7 phase 15 — RBS::Extended predicate effects. When the method's RBS signature
@@ -1311,7 +1335,8 @@ module Rigor
           name = Source::ConstantPath.qualified_name_or_nil(node)
           return nil if name.nil?
 
-          type = Reflection.resolve_constant_type(name, scope: scope)
+          type = Reflection.resolve_constant_type(name, scope: scope,
+                                                        rooted: Source::ConstantPath.rooted?(node))
           return :ambiguous if type.is_a?(Type::Union)
           return nil unless type.is_a?(Type::Constant)
 
@@ -1764,7 +1789,8 @@ module Rigor
           return nil if node.arguments.nil?
           return nil unless node.arguments.arguments.size == 1
 
-          bare_name = static_class_name(node.arguments.arguments.first)
+          argument = node.arguments.arguments.first
+          bare_name = static_class_name(argument)
           return nil if bare_name.nil?
 
           # Resolve `bare_name` through the lexical-scope chain so a name shadowed by the
@@ -1773,7 +1799,15 @@ module Rigor
           # `Rigor::Type::Singleton#==`, `is_a?(Singleton)` should resolve to
           # `Rigor::Type::Singleton`, not the top-level stdlib `Singleton` mixin (which would
           # surface as a spurious `undefined-method` on subsequent `other.class_name` calls).
-          class_name = resolve_class_name_lexically(bare_name, scope)
+          #
+          # A leading `::` opts out of that walk (#614): `static_class_name` de-roots the
+          # argument, so without the marker the guard answered the shadow while the READ
+          # `::Foo.new` answered the top-level class — the guard and the value it guards
+          # disagreeing about the same spelling. When no top-level class owns the name we
+          # DECLINE (nil) rather than pass the unknown name down: keeping the pre-state is the
+          # conservative answer, and narrowing to the shadow is the one answer that is wrong.
+          class_name = rooted_class_predicate_name(argument, bare_name, scope)
+          return nil if class_name.nil?
 
           case node.receiver
           when Prism::LocalVariableReadNode
@@ -1783,6 +1817,15 @@ module Rigor
           end
         end
 
+        # The class name a `is_a?` / `kind_of?` / `instance_of?` argument denotes: the top-level
+        # `bare_name` when the reference is written `::Foo` (nil when nothing declares it there),
+        # the lexical resolution otherwise.
+        def rooted_class_predicate_name(argument, bare_name, scope)
+          return resolve_class_name_lexically(bare_name, scope) unless Source::ConstantPath.rooted?(argument)
+
+          class_known_to_scope?(scope, bare_name) ? bare_name : nil
+        end
+
         def analyse_class_predicate_on_local(node, scope, class_name, exact)
           current = scope.local(node.receiver.name)
           return nil if current.nil?
@@ -1844,9 +1887,27 @@ module Rigor
         # `<prefix>::<bare_name>` (or bare `<bare_name>` at the top level) that the environment
         # recognises. Falls back to `bare_name` itself when nothing in the chain resolves; the
         # downstream `narrow_class` then yields the conservative answer for unknown receivers.
+        #
+        # A MULTI-SEGMENT spelling is relative too and gets the same walk (#635). `Type::Nominal`
+        # written inside `module Rigor` is not "already qualified": Ruby anchors the path's FIRST
+        # segment through `Module.nesting`, so the constant it names is `Rigor::Type::Nominal`.
+        # Treating any `::` as absolute left every such guard narrowing to a name no environment
+        # knows, and each subsequent reader call on the narrowed receiver degraded to
+        # `Dynamic[top]` — ~300 sites in Rigor's own `lib/` alone. Trying the whole path under
+        # each prefix is the same rule the single-segment case already applies, and it adopts a
+        # candidate only when the scope actually knows it, so a genuinely absolute spelling still
+        # falls through to `bare_name` unchanged.
+        #
+        # The chain IS `Module.nesting` wherever a declaration walk recorded one (#652): a COMPACT
+        # `class Admin::UsersController` contributes the single entry `["Admin::UsersController"]`, so a
+        # bare `User` guard there narrows to the top-level `::User` exactly as Ruby resolves it, while
+        # the nested `module Admin; class UsersController` spelling still reaches `Admin::User`. Peeling
+        # `scope.self_type.class_name` could not tell the two apart — the string is identical — and
+        # answered `Admin::User` for both, reporting `undefined method` on correct code across all four
+        # shapes at once. Because the repair lives in the shared derivation, `is_a?`, `case`/`when`, `===`
+        # and the constant typer were fixed together rather than one guard shape at a time. A scope no
+        # declaration walk built still falls back to the peel; see {Reflection.lexical_nesting_chain}.
         def resolve_class_name_lexically(bare_name, scope)
-          return bare_name if bare_name.include?("::") # Already qualified.
-
           chain = lexical_nesting_for(scope)
           chain.each do |prefix|
             candidate = "#{prefix}::#{bare_name}"
@@ -1864,20 +1925,12 @@ module Rigor
           scope.discovered_classes.key?(candidate)
         end
 
-        # Approximates `Module.nesting` from the inferable `self_type`. Today's implementation
-        # handles the common case: when the surrounding method is a regular instance method
-        # (`self_type = Nominal[T]`) or a class-body / singleton (`self_type = Singleton[T]`),
-        # the chain is `T`'s namespace path — `Foo::Bar::Baz` → `["Foo::Bar::Baz", "Foo::Bar",
-        # "Foo"]`. Returns an empty array when `self_type` is unknown.
+        # `Module.nesting` for the guard's body, innermost first. Delegates to
+        # {Reflection.lexical_nesting_chain} — the SINGLE owner of the question, shared with the constant
+        # typer's step-1 ladder, so `User` read as a value and `x.is_a?(User)` written beside it cannot
+        # resolve to two different classes ([#652](https://github.com/rigortype/rigor/issues/652)).
         def lexical_nesting_for(scope)
-          self_type = scope.self_type
-          base = case self_type
-                 when Type::Nominal, Type::Singleton then self_type.class_name
-                 end
-          return [] if base.nil? || base.empty?
-
-          parts = base.split("::")
-          parts.each_index.map { |i| parts[0..-(i + 1)].join("::") }
+          Reflection.lexical_nesting_chain(scope)
         end
 
         def class_predicate_scopes(scope, name, current, class_name, exact:)
@@ -1934,7 +1987,7 @@ module Rigor
         # Only static class/module receivers narrow here — the Range / Regexp literal receivers
         # (`(1..10) === x.foo`) are not a common method-chain shape and stay deferred.
         def analyse_case_equality_on_chain(receiver, chain_arg, scope)
-          class_name = static_class_name(receiver)
+          class_name = lexical_class_name(receiver, scope)
           return nil if class_name.nil?
 
           address = stable_chain_address(chain_arg)
@@ -1952,7 +2005,7 @@ module Rigor
         end
 
         def analyse_case_equality_receiver(receiver, scope, local_name, current)
-          if (class_name = static_class_name(receiver))
+          if (class_name = lexical_class_name(receiver, scope))
             return class_predicate_scopes(scope, local_name, current, class_name, exact: false)
           end
 
@@ -2192,7 +2245,7 @@ module Rigor
             return integer_literal_when_result(current, int_literal, falsey_acc)
           end
 
-          target = static_class_name(condition) || case_equality_target_class(condition)
+          target = lexical_class_name(condition, scope) || case_equality_target_class(condition)
           return class_when_result(scope, current, target, falsey_acc) if target
 
           nil
@@ -2304,6 +2357,25 @@ module Rigor
           end
         end
 
+        # The class a constant reference denotes at THIS point in the source (#635). `case t when
+        # Type::Union` inside `module Rigor` names `Rigor::Type::Union`, and narrowing to the
+        # source spelling instead left the guarded receiver an unknown nominal whose every reader
+        # dispatched to `Dynamic[top]`. The resolution APPROXIMATES Ruby's — see
+        # {#resolve_class_name_lexically} for where the derived nesting chain diverges (#652).
+        #
+        # Shared by the case-equality shapes (`Class === x`, `case/when`) so one spelling narrows
+        # to one name whichever guard it is written in; `is_a?` / `kind_of?` / `instance_of?` go
+        # through {#rooted_class_predicate_name}, which layers #614's extra decline on top of the
+        # same walk. A rooted `::Foo` names the top level and never a lexically nearer shadow, so
+        # it keeps the un-walked spelling. nil for any non-constant shape, as before.
+        def lexical_class_name(node, scope)
+          bare_name = static_class_name(node)
+          return nil if bare_name.nil?
+          return bare_name if Source::ConstantPath.rooted?(node)
+
+          resolve_class_name_lexically(bare_name, scope)
+        end
+
         # ----- narrow_class / narrow_not_class helpers -----
 
         # Polarity-aware dispatch table for {.narrow_class} / {.narrow_not_class}. Avoids
@@ -2364,9 +2436,34 @@ module Rigor
           context.polarity == :positive ? narrow_class_other(type, class_name) : type
         end
 
+        # Issue #657 — `Bot` is the assertion "this can never match", and only a KNOWN-disjoint ordering
+        # supports it. `subclass_of?` folds `:disjoint` and `:unknown` into one `false`, which is safe on
+        # the negative edge (where the pre-state survives) and an over-claim on the positive one:
+        #
+        #   module Taggable; def tag = "t"; end
+        #   class Integer; include Taggable; end
+        #   x = 1
+        #   case x
+        #   when Taggable then x.tag      # reported unreachable; `1.is_a?(Taggable)` is true
+        #   end
+        #
+        # The ordering is `:unknown` because an in-source `include` into a CORE class never reaches the
+        # environment's class ordering — the include is discovered in project source, `Integer`'s ancestry
+        # comes from RBS, and the two are not joined (the precision half, left in #657).
+        #
+        # `:unknown` joins to Dynamic, the same answer {#narrow_nominal_to_class} gives and for the same
+        # reason: keeping the old bound licenses `call.undefined-method` on the guard-proven branch. Keeping
+        # the literal was tried first and did exactly that — `s = "str"` under `when Unrelated` stayed
+        # `Constant["str"]` and reported `undefined method 'other'`, trading one false positive for
+        # another. The value is lost only on the guarded arm, which is where the guard just told us the
+        # environment's picture was incomplete.
         def narrow_constant_to_class(constant, class_name, context)
           rigor_class = constant.value.class.name
-          subclass_of?(rigor_class, class_name, context) ? constant : Type::Combinator.bot
+          return constant if subclass_of?(rigor_class, class_name, context)
+          return Type::Combinator.untyped if !context.exact &&
+                                             class_ordering(rigor_class, class_name, context) == :unknown
+
+          Type::Combinator.bot
         end
 
         def narrow_constant_not_class(constant, class_name, context)
@@ -2387,7 +2484,13 @@ module Rigor
           case class_ordering(nominal.class_name, class_name, context)
           when :superclass then Type::Combinator.nominal_of(class_name)
           when :disjoint then Type::Combinator.bot
-          else nominal # :subclass preserves the bound; :unknown stays conservative
+          when :subclass then nominal
+          else
+            # :unknown — the guard proved membership in a class the environment cannot order against the
+            # bound (an RBS-less gem class, typically). Keeping the old bound licenses `undefined-method`
+            # on the guard-proven branch (concurrent-ruby's `done.is_a?(Concurrent::Maybe)` kept `Array`
+            # and fired on `.value`); the honest join is Dynamic — the guard destroyed the old knowledge.
+            Type::Combinator.untyped
           end
         end
 
@@ -2606,6 +2709,209 @@ module Rigor
           [scope.public_send(writer, receiver.name, non_nil), scope]
         end
 
+        # Issue #606 slice 1 — the SAFE-NAV CHAIN forms. {.analyse_safe_nav_receiver} above proves
+        # the receiver non-nil when the `&.` call is itself the predicate (`if v&.foo`). It cannot
+        # see the far more common shape where the `&.` result is fed to one more call:
+        #
+        #   if custom&.value.present?          # mastodon extended_description.rb / privacy_policy.rb
+        #   return true if backup&.user.nil?   # mastodon backup_worker.rb  (the FALL-THROUGH proves it)
+        #
+        # Both were measured firing `call.possible-nil-receiver` on correct code (#574's matrix).
+        #
+        # ## Why a truthy chain proves the root non-nil, and when it does not
+        #
+        # If the root IS nil, `root&.y` is nil and every suffix runs ON nil. Reaching the guarded
+        # branch then requires each of them to have returned — and the outermost to have returned
+        # TRUTHY. Two things can stop that, and only these two are sound to rely on:
+        #
+        # 1. `NilClass` does not define the method. The call raises, so control never reaches the
+        #    branch at all, and narrowing the branch body is vacuously correct.
+        # 2. The method is defined on `NilClass` and documented falsey there — {NIL_FALSEY_SUFFIXES}.
+        #    ActiveSupport's `nil.present?` is `false`, so a truthy answer excludes the nil root.
+        #
+        # Anything else must decline, and the temptation to wave this through is exactly where the
+        # bug would be: most of what `NilClass` DOES define returns something truthy. `nil.to_s` is
+        # `""`, `nil.to_a` is `[]`, `nil.to_i` is `0`, `nil.inspect` is `"nil"` — all truthy — and
+        # `nil.nil?` and `nil.blank?` are literally `true`. Narrowing on `x&.y.nil?`'s TRUTHY edge
+        # would invert the guard's meaning. `nil?` therefore gets the opposite edge instead: a
+        # FALSEY `x&.y.nil?` says `x&.y` is not nil, which no nil root can produce.
+        #
+        # Scoped to chains that actually contain `&.`. The same raise-based argument would license
+        # narrowing a plain `x.y.present?` chain, but there `x.y` is itself the latent nil bug this
+        # rule exists to report, and suppressing it is the opposite of the intent.
+        NIL_FALSEY_SUFFIXES = %i[present?].freeze
+        private_constant :NIL_FALSEY_SUFFIXES
+
+        def analyse_safe_nav_chain(node, scope)
+          chain = safe_nav_chain(node)
+          return nil if chain.nil?
+
+          receiver, suffixes = chain
+          edge = safe_nav_chain_edge(suffixes, scope)
+          return nil if edge.nil?
+
+          narrowed = safe_nav_chain_narrowed_scope(receiver, scope)
+          return nil if narrowed.nil?
+
+          edge == :truthy ? [narrowed, scope] : [scope, narrowed]
+        end
+
+        # Walks a call chain down to its `&.` link, collecting the suffix method names applied
+        # above it (outermost first). Declines unless the chain bottoms out in a `&.` call on a
+        # direct local / ivar read — those are the two bindings a scope can rewrite — and unless
+        # every suffix is a bare reader or predicate, since an argument or a block could make the
+        # answer depend on something other than the receiver.
+        #
+        # `allow_bare:` false keeps the zero-suffix case (`if v&.foo`) with
+        # {.analyse_safe_nav_receiver}, which already owns it; the equality form passes true
+        # because there the `&.` call IS the comparison's receiver.
+        def safe_nav_chain(node, allow_bare: false)
+          suffixes = []
+          current = node
+          while current.is_a?(Prism::CallNode) && !current.safe_navigation?
+            return nil unless argument_free?(current) && current.block.nil?
+
+            suffixes << current.name
+            current = current.receiver
+          end
+          return nil unless current.is_a?(Prism::CallNode) && current.safe_navigation?
+          return nil if suffixes.empty? && !allow_bare
+
+          receiver = current.receiver
+          return nil unless receiver.is_a?(Prism::LocalVariableReadNode) ||
+                            receiver.is_a?(Prism::InstanceVariableReadNode)
+
+          [receiver, suffixes]
+        end
+
+        # Which edge — if either — a chain's outcome narrows on. The inner suffixes (everything
+        # below the outermost) only ever have to NOT return, so they are held to the raise test
+        # alone; the outermost decides the edge per the table in {NIL_FALSEY_SUFFIXES}'s comment.
+        def safe_nav_chain_edge(suffixes, scope)
+          outermost, *inner = suffixes
+          return nil unless inner.all? { |name| !nilclass_method?(name, scope) }
+          return :falsey if outermost == :nil?
+          return :truthy if NIL_FALSEY_SUFFIXES.include?(outermost)
+          return :truthy unless nilclass_method?(outermost, scope)
+
+          nil
+        end
+
+        def safe_nav_chain_narrowed_scope(receiver, scope)
+          reader, writer =
+            case receiver
+            when Prism::LocalVariableReadNode then %i[local with_local]
+            when Prism::InstanceVariableReadNode then %i[ivar with_ivar]
+            else return nil
+            end
+
+          current = scope.public_send(reader, receiver.name)
+          return nil if current.nil?
+
+          non_nil = narrow_non_nil(current)
+          return nil if non_nil.equal?(current)
+
+          scope.public_send(writer, receiver.name, non_nil)
+        end
+
+        # Issue #606 slice 1, second form — a safe-nav chain COMPARED to a value that cannot be
+        # nil: `next unless status&.account_id == @account.id`. A nil root makes the left side nil,
+        # and `nil == <non-nil>` is false, so a true comparison excludes it.
+        #
+        # The whole form turns on proving the OTHER operand non-nil, and `x&.y == nil` is the
+        # counter-example that must never narrow — there a nil root makes the comparison TRUE.
+        # {.provably_non_nil_type?} is deliberately a whitelist rather than "not obviously nil":
+        # an operand typed `Dynamic` may well be nil at runtime, so it declines. That costs the
+        # third corpus site (`@account.id` types opaque there), which is the honest price of not
+        # guessing.
+        #
+        # `!=` takes the opposite edge, for the same reason `nil?` did above: a nil root makes
+        # `nil != <non-nil>` true, so it is the FALSEY edge that proves the root non-nil.
+        def analyse_safe_nav_chain_equality(node, scope)
+          return nil if node.arguments.nil? || node.arguments.arguments.size != 1
+
+          chain = safe_nav_chain(node.receiver, allow_bare: true)
+          return nil if chain.nil?
+
+          receiver, suffixes = chain
+          return nil unless suffixes.all? { |name| !nilclass_method?(name, scope) }
+          return nil unless provably_non_nil_type?(scope.type_of(node.arguments.arguments.first))
+
+          narrowed = safe_nav_chain_narrowed_scope(receiver, scope)
+          return nil if narrowed.nil?
+
+          node.name == :== ? [narrowed, scope] : [scope, narrowed]
+        end
+
+        # Whitelist: true only for types every inhabitant of which is non-nil. `Dynamic` / `Top`
+        # answer FALSE — an untyped operand is exactly the case where nil cannot be excluded —
+        # and so does `Bot`, which has no inhabitants to reason about.
+        def provably_non_nil_type?(type)
+          case type
+          when Type::Constant then !type.value.nil?
+          when Type::Nominal then type.class_name != "NilClass"
+          when Type::Singleton, Type::Tuple, Type::HashShape then true
+          when Type::Union then type.members.all? { |member| provably_non_nil_type?(member) }
+          end
+        end
+
+        # Issue #606 slice 2 — MEMBERSHIP. `collection.include?(x)` answering true proves `x` is one
+        # of the collection's elements, so if none of those can be nil, neither can `x`:
+        #
+        #   unless Redmine::Reaction::REACTABLE_TYPES.include?(object_type)   # redmine reactions_controller.rb
+        #     render_403
+        #     return
+        #   end
+        #   @object = object_type.constantize.find(...)                       # ← fired before this
+        #
+        # The proof lives entirely in the collection, which is why {.nil_free_collection?} answers
+        # only for shapes whose element types are actually known — a literal / `Tuple`, or an
+        # `Array` / `Set` carrying an element type. An untyped collection declines: `Dynamic` may
+        # hold nil, and "we do not know" must not read as "no nil here".
+        #
+        # Only the truthy edge narrows. A false `include?` says nothing about `x` — a nil `x` is
+        # simply not in the list, which is exactly what false means.
+        MEMBERSHIP_COLLECTION_CLASSES = %w[Array Set].freeze
+        private_constant :MEMBERSHIP_COLLECTION_CLASSES
+
+        def analyse_membership_predicate(node, scope)
+          return nil if node.receiver.nil? || node.arguments.nil?
+          return nil unless node.arguments.arguments.size == 1
+
+          argument = node.arguments.arguments.first
+          reader, writer =
+            case argument
+            when Prism::LocalVariableReadNode then %i[local with_local]
+            when Prism::InstanceVariableReadNode then %i[ivar with_ivar]
+            else return nil
+            end
+          return nil unless nil_free_collection?(scope.type_of(node.receiver))
+
+          current = scope.public_send(reader, argument.name)
+          return nil if current.nil?
+
+          non_nil = narrow_non_nil(current)
+          return nil if non_nil.equal?(current)
+
+          [scope.public_send(writer, argument.name, non_nil), scope]
+        end
+
+        # True only when every inhabitant the collection can yield is non-nil. Restricted to
+        # sequence shapes on purpose: `Hash#include?` asks about KEYS and `Range#include?` about
+        # bounds, so neither element story is the one this rule reasons about.
+        def nil_free_collection?(type)
+          case type
+          when Type::Tuple
+            !type.elements.empty? && type.elements.all? { |element| provably_non_nil_type?(element) }
+          when Type::Constant
+            type.value.is_a?(Array) && !type.value.empty? && type.value.none?(&:nil?)
+          when Type::Nominal
+            MEMBERSHIP_COLLECTION_CLASSES.include?(type.class_name) &&
+              type.type_args.size == 1 &&
+              provably_non_nil_type?(type.type_args.first)
+          end
+        end
+
         # Layers the safe-nav non-nil truthy narrowing over the edges an existing predicate path
         # already produced, so a safe-nav string predicate (`v&.start_with?(x)`) keeps its
         # relational fact AND proves `v` non-nil on the truthy edge. Re-runs the predicate's
@@ -2645,8 +2951,6 @@ module Rigor
           [truthy_a.join(truthy_b), falsey_b]
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
-    # rubocop:enable Metrics/ModuleLength
   end
 end

data/lib/rigor/inference/parameter_inference_collector.rb

@@ -260,6 +260,7 @@ module Rigor
         singleton_def_nodes: :discovered_singleton_def_nodes,
         def_sources: :discovered_def_sources,
         superclasses: :discovered_superclasses,
+        header_nestings: :discovered_header_nestings,
         includes: :discovered_includes,
         class_sources: :discovered_class_sources,
         method_visibilities: :discovered_method_visibilities,

data/lib/rigor/inference/pre_eval_constants.rb

@@ -54,6 +54,21 @@ module Rigor
     # Value-pinning a *provably* frozen single-write literal cross-file is a strictly later question; it needs
     # its own FP measurement and is deliberately not attempted here.
     #
+    # **Issue #644 asked that later question and answered it.** The discovery pre-pass now publishes a
+    # project-wide table of syntactic frozen-scalar literal assignments (Symbol / Integer / Float / boolean,
+    # written once, in one file), with the FP measurement this paragraph asked for. Where that table and this
+    # one both answer a name, THAT TABLE WINS and the value is not erased — a listed `TIMEOUT = 30` reads
+    # `30`, not `Integer`. Nothing above is wrong; its scope is narrower than it reads. The widening exists
+    # for the rvalues whose basis this collector cannot fully see, and every hazard it names — the closed
+    # `HashShape`, the `Tuple` displacing an RBS overload, the mutable String — is a form #644's table
+    # DECLINES. So the two producers do not overlap where the widening earns its cost, and where they do
+    # overlap the narrower, purely syntactic basis is the better-founded answer. Normative in
+    # `docs/internal-spec/inference-engine.md` § "Cross-file value constants"; pinned by
+    # `spec/rigor/analysis/pre_eval_constants_spec.rb`.
+    #
+    # What this collector still owns alone: every rvalue #644 declines — a String, an Array, a Hash, a class
+    # alias, and anything that needs the rvalue TYPED rather than read off the syntax.
+    #
     # ## The multi-file write rule — widen on conflict, all the way to `Dynamic[top]`
     #
     # Within one file, `ScopeIndexer#record_constant_write` unions repeated writes; that union is widened as a

data/lib/rigor/inference/precision_scanner.rb

@@ -153,9 +153,12 @@ module Rigor
         when Type::Bot                          then :bot
         when Type::Top                          then :top
         when Type::Constant                     then :constant
-        when Type::Nominal, Type::Singleton     then :nominal
+        when Type::Nominal, Type::Singleton,
+             Type::DataClass, Type::StructClass then :nominal
         when Type::Tuple, Type::HashShape,
-             Type::IntegerRange, Type::App      then :shaped
+             Type::IntegerRange, Type::App,
+             Type::DataInstance, Type::StructInstance,
+             Type::BoundMethod                  then :shaped
         when Type::Refined                      then :refined
         when Type::Dynamic                      then classify_dynamic(type)
         when Type::Union                        then worst_of(type.members)

data/lib/rigor/inference/project_patched_scanner.rb

@@ -151,7 +151,8 @@ module Rigor
       def descend_class_or_module(node, qualified_prefix, in_singleton_class, source_path, entries)
         name = Source::ConstantPath.qualified_name_or_nil(node.constant_path)
         if name && node.body
-          walk_node(node.body, qualified_prefix + [name], in_singleton_class, source_path, entries)
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          walk_node(node.body, child_prefix, in_singleton_class, source_path, entries)
         else
           walk_children(node, qualified_prefix, in_singleton_class, source_path, entries)
         end