rigortype 0.3.8 → 0.4.0

data/lib/rigor/inference/closure_escape_analyzer.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require_relative "../type"
+require_relative "../reflection"
+require_relative "external_ancestor_resolution"
+require_relative "project_method_ownership"
 
 module Rigor
   module Inference
@@ -30,14 +33,19 @@ module Rigor
     # therefore covers ONLY the core-and-stdlib surface where immediate invocation is part of the documented
     # contract:
     #
-    # - `Array`, `Hash`, `Range`, `Integer`, `Enumerator::Lazy` iteration methods (`each`, `map`, `select`,
-    #   `reject`, `flat_map`, `find`/`detect`, `any?`, `all?`, `none?`, `one?`, `count`, `inject`/`reduce`,
-    #   `each_with_index`, `each_with_object`, `min_by`, `max_by`, `sort_by`, `partition`, `group_by`,
-    #   `tally`, `sum`, `take_while`, `drop_while`, `chunk_while`, `slice_when`, `zip`, `collect`,
+    # - `Array`, `Hash`, `Range`, `Set`, `Enumerator`, `Enumerator::Lazy` iteration methods (`each`, `map`,
+    #   `select`, `reject`, `flat_map`, `find`/`detect`, `any?`, `all?`, `none?`, `one?`, `count`,
+    #   `inject`/`reduce`, `each_with_index`, `each_with_object`, `min_by`, `max_by`, `sort_by`, `partition`,
+    #   `group_by`, `tally`, `sum`, `take_while`, `drop_while`, `chunk_while`, `slice_when`, `zip`, `collect`,
     #   `collect_concat`, `filter`, `filter_map`).
     # - `Hash`-only iteration: `each_pair`, `each_key`, `each_value`, `transform_keys`, `transform_values`.
     # - `Integer#times`, `Integer#upto`, `Integer#downto`, `Range#each`, `Range#step`.
-    # - `Object#tap`, `Object#then`, `Object#yield_self`.
+    # - `IO` / `File` / `StringIO` line iteration (`each`, `each_line`, `each_byte`, `each_char`,
+    #   `each_codepoint`, the singleton `foreach`) and the same Enumerable methods minus
+    #   {DEFERRED_ENUMERATOR_METHODS}.
+    # - `Object#tap`, `Object#then`, `Object#yield_self`. The stronger "yields exactly once, before returning"
+    #   fact for these three lives in {BlockCallTiming}; that table is expected to move to the same
+    #   `RBS::Extended` call-timing effect as this one.
     # - Tuple/HashShape carriers map to Array/Hash for catalogue lookup so a literal `[1, 2, 3].each { ... }`
     #   is recognised.
     #
@@ -46,32 +54,80 @@ module Rigor
     # retained. False positives in this catalogue would silently weaken the soundness of fact retention in
     # later sub-phases.
     #
+    # Issue #1234 — a project class is outside the catalogue by name, yet `class Shelf; include Enumerable`
+    # answers `find` with `Enumerable#find` all the same. Given the `scope:` whose discovery tables know the
+    # project, a `Nominal` receiver of a project class classifies through its ancestry
+    # ({.ancestry_non_escaping?}): the method must be one the project does not define anywhere in that
+    # ancestry, and the first ancestor outside the project that declares it must be a catalogued class or
+    # `Enumerable` ({MIXIN_NON_ESCAPING}). An ancestor the RBS environment does not know could declare
+    # anything, so meeting one first declines.
+    #
     # The analyzer is a pure query. It MUST NOT mutate the receiver type or scope, MUST NOT raise on
     # unrecognised inputs, and MUST be deterministic for a given input.
     module ClosureEscapeAnalyzer
       module_function
 
-      # @param receiver_type [Rigor::Type, nil]
-      # @param method_name [Symbol]
-      # @param environment [Rigor::Environment, nil] reserved for the future sub-phase that consults
+      # @param environment — reserved for the future sub-phase that consults
       #   `RBS::Extended` call-timing effects; sub-phase 3a ignores it.
-      # @return [Symbol] one of `:non_escaping`, `:escaping`, `:unknown`.
-      def classify(receiver_type:, method_name:, environment: nil) # rubocop:disable Lint/UnusedMethodArgument
+      # @param scope — the project's discovery tables, for the ancestry step; without it a project class
+      #   stays `:unknown`.
+      # @return one of `:non_escaping`, `:escaping`, `:unknown`.
+      def classify(receiver_type:, method_name:, environment: nil, scope: nil) # rubocop:disable Lint/UnusedMethodArgument
         return :unknown if receiver_type.nil?
 
+        method_sym = method_name.to_sym
         class_name = receiver_class_name(receiver_type)
-        return :unknown if class_name.nil?
+        if class_name
+          return :non_escaping if non_escaping?(class_name, method_sym)
+          return :escaping if escaping?(class_name, method_sym)
+        end
+
+        instance_class = instance_carrier_class_name(receiver_type)
+        return :unknown if instance_class.nil?
+
+        ancestry_non_escaping?(instance_class, method_sym, scope) ? :non_escaping : :unknown
+      end
+
+      # Issue #1234 — whether some catalogue entry lists `method_name` as an iteration method: a name that runs
+      # its block once per element wherever the catalogue knows the receiver. `tap` / `then` / `yield_self` are
+      # left out, as they run the block exactly once. This is a fact about the NAME, for the one consumer that
+      # asks it of an `:unknown` receiver ({BlockRepetition.may_repeat?}); it proves nothing about escape.
+      def iterator_name?(method_name)
+        ITERATOR_NAMES.include?(method_name)
+      end
 
+      # Issue #1234 — whether the NAME of a catalogued iterator is the only thing Rigor knows about the method
+      # `receiver_type` answers `method_name` with, so a pass may read it as repetition
+      # ({BlockRepetition.may_repeat?}, for an `:unknown` receiver). It holds for a receiver Rigor cannot
+      # see at all (`Dynamic`, `Top`), and for a class it can see whose method the project does not define.
+      #
+      # A method the project defines under a catalogued name is the project's, not the iterator, so the name
+      # says nothing about how often it yields: `class Vault; def select(key) = yield(key.to_s); end` runs its
+      # block once. "Defines" is a `def`, `define_method` or `attr_*` anywhere in a project class's ancestry
+      # (instance side, or singleton side for a class-object receiver), or a signature whose declaring owner
+      # is a project class or module. A carrier this does not recognise, or one whose class it cannot name
+      # (an anonymous `Struct.new` value), answers false: when Rigor cannot tell whether the project owns the
+      # method, it does not assume repetition. {ProjectMethodOwnership.targets} carries the carrier audit.
+      def repeats_by_name?(receiver_type:, method_name:, scope:)
         method_sym = method_name.to_sym
-        return :non_escaping if non_escaping?(class_name, method_sym)
-        return :escaping if escaping?(class_name, method_sym)
+        return false unless ITERATOR_NAMES.include?(method_sym)
 
-        :unknown
+        targets = ProjectMethodOwnership.targets(receiver_type)
+        return false if targets.nil?
+
+        targets.none? { |class_name, kind| ProjectMethodOwnership.defines?(class_name, method_sym, kind, scope) }
       end
 
       class << self
         private
 
+        # The instance-side class a `Nominal` or an ADR-48 member carrier names, for the ancestry step.
+        def instance_carrier_class_name(receiver_type)
+          case receiver_type
+          when Type::Nominal, Type::StructInstance, Type::DataInstance then receiver_type.class_name&.to_s
+          end
+        end
+
         # Resolve a single concrete class name for catalogue lookup. Returns `nil` when the receiver carrier
         # does not name a single class (e.g. `Top`, `Dynamic[Top]`, `Union[...]`, `Bot`). `Tuple` projects to
         # `Array`; `HashShape` to `Hash`; `Singleton[C]` to `C` (so `Integer.times` would resolve as a
@@ -117,6 +173,64 @@ module Rigor
           methods = ESCAPING[class_name]
           methods ? methods.include?(method_sym) : false
         end
+
+        # Issue #1234 — a project class answers `method_sym` through the catalogued ancestor Ruby dispatches it
+        # to. The cheap gates come first: the name must be a catalogued iteration method, and the receiver a
+        # class the project declares. A definition anywhere in the project ancestry — the class's own `def
+        # find`, a project module's, a reopened `Enumerable`'s — is not the catalogued method and declines.
+        # A class the project's `sig/` declares asks its RBS definition where the method comes from; one
+        # without RBS walks the ancestors outside the project in method-resolution order.
+        def ancestry_non_escaping?(class_name, method_sym, scope)
+          return false if scope.nil? || !ITERATOR_NAMES.include?(method_sym)
+          return false unless scope.known_user_class?(class_name)
+
+          by_method = (ProjectMethodOwnership.memo(scope)[:ancestry][class_name] ||= {})
+          return by_method[method_sym] if by_method.key?(method_sym)
+
+          by_method[method_sym] = compute_ancestry_non_escaping?(class_name, method_sym, scope)
+        end
+
+        def compute_ancestry_non_escaping?(class_name, method_sym, scope)
+          return false if ProjectMethodOwnership.defines?(class_name, method_sym, :instance, scope)
+
+          if Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
+            return catalogued_declaration?(method_definition(class_name, method_sym, :instance, scope), method_sym)
+          end
+
+          external_ancestry_non_escaping?(class_name, method_sym, scope)
+        end
+
+        # The RBS definition, or nil — a malformed signature is a gap, and
+        # {ExternalAncestorResolution.method_definition} is the one place that rescues it.
+        def method_definition(class_name, method_sym, kind, scope)
+          ExternalAncestorResolution.method_definition(class_name, method_sym, kind, scope: scope)
+        end
+
+        # The first external ancestor that declares the method decides. One the environment does not know may
+        # declare it, so it declines rather than being skipped; one that does not declare it is skipped.
+        def external_ancestry_non_escaping?(class_name, method_sym, scope)
+          scope.external_ancestor_name_candidates(class_name).each do |candidates|
+            known = candidates.find { |candidate| Rigor::Reflection.rbs_class_known?(candidate, scope: scope) }
+            return false if known.nil?
+            return true if catalogued_owner?(known, method_sym)
+
+            definition = method_definition(known, method_sym, :instance, scope)
+            return catalogued_declaration?(definition, method_sym) if definition
+          end
+          false
+        end
+
+        def catalogued_declaration?(definition, method_sym)
+          return false if definition.nil? || !definition.respond_to?(:defined_in)
+
+          owner = definition.defined_in
+          !owner.nil? && catalogued_owner?(owner.to_s.delete_prefix("::"), method_sym)
+        end
+
+        def catalogued_owner?(name, method_sym)
+          methods = NON_ESCAPING[name] || MIXIN_NON_ESCAPING[name]
+          methods ? methods.include?(method_sym) : false
+        end
       end
 
       OBJECT_NON_ESCAPING = %i[tap then yield_self].freeze
@@ -151,9 +265,24 @@ module Rigor
       # `File.foreach(path) { case … when … then flag = true when … then return true if flag end }` classifies
       # `:unknown` and misses the loop-body re-narrowing, so a local written in one `when` arm reads its
       # pre-loop value in a sibling arm and a guarding condition folds to a spurious constant.
+      #
+      # The three are also `Enumerable[String]` over lines (rbs core declares it for `IO`;
+      # `data/core_overlay/string_io.rbs` for `StringIO`). An eager Enumerable method runs its block from inside
+      # the call, through `each`, so `io.each_with_index { … }` / `io.detect { … }` carry the same contract and
+      # take `ENUMERABLE_NON_ESCAPING` — minus {DEFERRED_ENUMERATOR_METHODS}, whose block outlives the call. On
+      # the `singleton(File)` / `singleton(IO)` side those names only ever meet `IO.select`, which takes no
+      # block and so never retains one. The key is the exact class name: a subclass (`Tempfile`, a user
+      # `StringIO` subclass) stays `:unknown`.
       IO_ITERATION = %i[each_line each each_byte each_char each_codepoint].freeze
       IO_SINGLETON_ITERATION = %i[foreach].freeze
 
+      # Enumerable methods that return an Enumerator holding the block and run it only when that Enumerator is
+      # consumed, so the block may run after locals it reads or writes have changed. They are NOT
+      # non-escaping. `ENUMERABLE_NON_ESCAPING` still lists them for the collection entries — a defect tracked
+      # as #1311; the stream entries below leave them out rather than inherit it.
+      DEFERRED_ENUMERATOR_METHODS = %i[chunk chunk_while slice_when slice_before slice_after].freeze
+      STREAM_ENUMERABLE_NON_ESCAPING = (ENUMERABLE_NON_ESCAPING - DEFERRED_ENUMERATOR_METHODS).freeze
+
       NON_ESCAPING = {
         "Array" => (ENUMERABLE_NON_ESCAPING + ARRAY_EXTRA).freeze,
         "Hash" => (ENUMERABLE_NON_ESCAPING + HASH_EXTRA).freeze,
@@ -162,11 +291,24 @@ module Rigor
         "Integer" => INTEGER_EXTRA,
         "Enumerator" => ENUMERABLE_NON_ESCAPING,
         "Enumerator::Lazy" => ENUMERABLE_NON_ESCAPING,
-        "IO" => (IO_ITERATION + IO_SINGLETON_ITERATION).freeze,
-        "File" => (IO_ITERATION + IO_SINGLETON_ITERATION).freeze,
-        "StringIO" => IO_ITERATION
+        "IO" => (STREAM_ENUMERABLE_NON_ESCAPING | IO_ITERATION | IO_SINGLETON_ITERATION).freeze,
+        "File" => (STREAM_ENUMERABLE_NON_ESCAPING | IO_ITERATION | IO_SINGLETON_ITERATION).freeze,
+        "StringIO" => (STREAM_ENUMERABLE_NON_ESCAPING | IO_ITERATION).freeze
+      }.freeze
+
+      # Issue #1234 — the catalogued modules a project class reaches only through its ancestry, read only by
+      # {.ancestry_non_escaping?} after the project has been ruled out as the method's owner. `Enumerable`'s
+      # methods run the block from inside the call, through the includer's `each` — minus
+      # {DEFERRED_ENUMERATOR_METHODS}, whose Enumerator outlives it, and minus `each` itself, which
+      # `Enumerable` does not declare: the includer supplies it, so nothing here speaks for it. For that
+      # reason a receiver typed as the bare module is not a key of {NON_ESCAPING} either.
+      MIXIN_NON_ESCAPING = {
+        "Enumerable" => (STREAM_ENUMERABLE_NON_ESCAPING - %i[each]).freeze
       }.freeze
 
+      # Every name a {NON_ESCAPING} entry lists as iteration, for {.iterator_name?} and the ancestry gate.
+      ITERATOR_NAMES = (NON_ESCAPING.values.flatten.to_set - OBJECT_NON_ESCAPING).freeze
+
       # Methods that are documented to **retain** the block past the call. The block is stored or scheduled,
       # so outer narrowing facts on writeable captured locals cannot survive.
       ESCAPING = {

data/lib/rigor/inference/content_join.rb

@@ -35,23 +35,28 @@ module Rigor
       # argument and the value the last.
       HASH_CONTENT_ADDERS = %i[[]= store].to_set.freeze
 
-      # String content-mutators that append to the buffer. String carries no element parameter, so
-      # these contribute nothing to a join — they are listed so the orchestrator recognises them as
-      # content mutators (the binding already widens to `String` via normal typing); the join
-      # helpers below short-circuit on a non-collection pre-state.
-      STRING_CONTENT_ADDERS = %i[<< concat prepend insert replace].to_set.freeze
+      # Every method name that adds to a collection's CONTENT — the evidence the joins read, and the
+      # gate the straight-line path types its arguments behind. A String carries no element
+      # parameter, so it has no adders of its own; `StatementEvaluator::CONTENT_MUTATORS` adds the
+      # String mutators to what its scans count.
+      CONTENT_ADDERS = (ARRAY_CONTENT_ADDERS | HASH_CONTENT_ADDERS).freeze
 
-      # Every method name that mutates a collection's CONTENT — the union the orchestrators scan a
-      # block body for, and the gate the straight-line path types its arguments behind.
-      CONTENT_ADDERS = (ARRAY_CONTENT_ADDERS | HASH_CONTENT_ADDERS | STRING_CONTENT_ADDERS).freeze
+      # The probes {#could_be_range?} passes to `accepts` — interned because the questions are
+      # asked once per `[]=` index member.
+      RANGE_INDEX_PROBE = Type::Combinator.nominal_of("Range")
+      OBJECT_INDEX_PROBE = Type::Combinator.nominal_of("Object")
+      ARRAY_PROBE = Type::Combinator.nominal_of("Array")
+      private_constant :RANGE_INDEX_PROBE, :OBJECT_INDEX_PROBE, :ARRAY_PROBE
 
       module_function
 
       # The element types a single content-mutator call introduces into an Array, given the
       # per-argument types (already typed by the caller in the scope the arguments are evaluated
       # in). `concat`/`replace` take collection arguments, so their element evidence is the
-      # arguments' OWN element types unioned; the rest append the argument values directly. Returns
-      # `[]` when there is no element evidence (e.g. a `<<` with no resolvable arg).
+      # arguments' OWN element types unioned; the `[]=` splice forms (`arr[i, n] = other` /
+      # `arr[range] = other`) store their value's elements the same way and read it through the
+      # same unwrap (issue #1140). The rest append the argument values directly. Returns `[]` when
+      # there is no element evidence (e.g. a `<<` with no resolvable arg).
       def array_added_elements(method_name, arg_types)
         return [] if arg_types.empty?
 
@@ -62,21 +67,27 @@ module Rigor
           # `insert(index, *objs)` — first arg is the position.
           arg_types.drop(1)
         when :[]=
-          # `arr[i] = v` / `arr[i, n] = v` — value is the last argument.
-          #
-          # The SPLICE forms (`arr[i, n] = other` / `arr[range] = other`) store `other`'s ELEMENTS,
-          # not `other` itself, so reading the value as one element over-widens: `a[0, 2] = [1, 2]`
-          # contributes `Array[Integer]` where `Integer` is the truth. Left alone deliberately —
-          # the answer is a superset either way, so it can only cost precision, and splitting the
-          # arities here would need the receiver's own element type to unwrap against. Revisit if a
-          # corpus site ever reads an element back through a splice-built array.
-          [arg_types.last]
+          # `arr[i] = v` stores `v` as ONE element — the index arguments precede the value.
+          # The splice forms store the value's ELEMENTS instead (issue #1140): `a[0, 2] = [1, 2]`
+          # puts `Integer`s in the receiver, not an `Array[Integer]`. An index the engine cannot
+          # classify (`a[x] = v` with `x` untyped, a `Range | Integer` union, or a splat that
+          # may vanish inside the brackets) may be either form, so both readings join — the
+          # union is a superset of the truth either way.
+          case index_store_form(arg_types)
+          when :splice then splice_stored_elements(arg_types.last)
+          when :either then [arg_types.last] + splice_stored_elements(arg_types.last)
+          else [arg_types.last]
+          end
         when :fill
           # `fill(value)` — only the no-block single-value form adds a concrete element; block /
           # range forms are conservatively ignored (the arity-forget already widened the binding).
           arg_types.size == 1 ? arg_types : []
-        else # << push append prepend unshift
+        when :<<, :push, :append, :prepend, :unshift
           arg_types
+        else
+          # Not an Array adder — a String mutator a content scan counted (`x.sub!("a", "b")` on an
+          # `Array | String` capture): its arguments are not elements.
+          []
         end
       end
 
@@ -122,6 +133,23 @@ module Rigor
         with_residue(Type::Combinator.nominal_of("Hash", type_args: [key_t, value_t]), hash_residue(pre_state))
       end
 
+      # Builds the continuation of a pre-state that carries BOTH an Array and a Hash member, from the
+      # pairs and the elements the body stores. Each side is joined with its own class's evidence, and
+      # every member neither side absorbs survives beside the Hash carrier ({#hash_residue}).
+      #
+      # Joined as one carrier, the other class's member was residue and survived exactly as the seed
+      # had it: an unwidened literal `Tuple` / `HashShape`, so what the body did to it was gone — `x =
+      # gets ? [1] : { a: 1 }; [0].each { x.map!(&:to_s) if x.is_a?(Array); x[:k] = 2 if
+      # x.is_a?(Hash) }` read `[1]`, and `x.first.upcase` drew `undefined method` on correct code. The
+      # caller routes the evidence: a store may reach either member, and only the caller sees its
+      # index (`StatementEvaluator#mixed_content_evidence`).
+      def join_mixed_content(pre_state, added_pairs, added_elements)
+        members = pre_state.is_a?(Type::Union) ? pre_state.members : [pre_state]
+        arrays, rest = members.partition { |member| array_residue(member).empty? }
+        array = join_array_content(Type::Combinator.union(*arrays), added_elements)
+        Type::Combinator.union(array, join_hash_content(Type::Combinator.union(*rest), added_pairs))
+      end
+
       # ----------------------------------------------------------------
       # Union residue — the members the rederived carrier does NOT stand for (issue #631).
       #
@@ -277,15 +305,158 @@ module Rigor
         type.is_a?(Type::Union) ? type.members : [type]
       end
 
+      # How an `arr[...] = v` call's index arguments place the stored value: `:splice` — the
+      # value's ELEMENTS land in the receiver (`arr[i, n] = v` takes two index slots,
+      # `arr[range] = v` takes a Range); `:element` — the value itself is one stored element
+      # (`arr[i] = v`); `:either` — the store may be either form.
+      #
+      # A splat inside the brackets is marked `nil` by the caller — its expansion can change the
+      # store's arity (`a[0, *xs] = v` stores `v` itself when `xs` is empty and `v`'s elements
+      # otherwise). An ordinary argument counts as a provable index however untyped it is:
+      # `a[i, n] = v` is a splice at every binding of `i` and `n`. Two or more provable indices
+      # are therefore always a splice however a splat expands; one provable index beside a splat
+      # reduces to the Range question (extra expansion only reaches an arity error, never a
+      # scalar store); zero provable indices leaves the form to whatever the splat yields.
+      def index_store_form(arg_types)
+        leading = arg_types[0...-1]
+        definite = leading.compact
+        return :splice if definite.size >= 2
+        return :either if definite.empty?
+        return single_index_form(definite.first) if definite.size == leading.size
+
+        range_index?(definite.first) ? :splice : :either
+      end
+
+      # The one-index question: a Range carrier is a splice, a definite scalar an element store,
+      # and anything between — a union straddling both, a broad index that may still hold a
+      # Range at runtime — may be either.
+      def single_index_form(index_type)
+        members = union_members(index_type)
+        return :splice if members.all? { |m| definite_range?(m) }
+        return :element if members.none? { |m| could_be_range?(m) }
+
+        :either
+      end
+
+      # True when the index position PROVABLY holds a Range: a Range carrier {#range_index?}
+      # recognizes, or a member acceptance proves a subtype of `Range` — a loaded
+      # `class MyRange < Range` answers `yes` there where the name check cannot see it. An
+      # unresolvable subclass answers `maybe`, which correctly declines here and still reaches
+      # {#could_be_range?}'s `either` reading. A gradual member accepts in BOTH directions
+      # (`Range` accepts it optimistically), so it must be excluded before asking — an untyped
+      # index may hold a scalar just as well and stays `either`. The exclusion reads through a
+      # `Difference` / `Refined` to its base: acceptance projects the wrapper onto the base too,
+      # so a `non-nil` or refined `Dynamic` answers `yes` there exactly like the bare gradual
+      # while still being free to hold a scalar at runtime.
+      def definite_range?(member)
+        return true if range_index?(member)
+
+        case member
+        when Type::Dynamic, Type::Top then false
+        when Type::Difference, Type::Refined then definite_range?(member.base)
+        else member.respond_to?(:accepts) && RANGE_INDEX_PROBE.accepts(member).yes?
+        end
+      end
+
+      # True when the index position MAY hold a Range at runtime: a definite Range carrier
+      # (`Constant[0..1]` accepts only its own value, so acceptance alone cannot see it),
+      # `Dynamic`, a carrier the engine cannot answer for, and every type related to
+      # `Nominal[Range]` in EITHER direction — `Object`/`Enumerable`/`top` above it, a
+      # project `class MyRange < Range` below it (an unresolvable class name answers `maybe`,
+      # never `no`, so subclass-ness cannot be ruled out).
+      #
+      # `no` in both directions is a real disjointness only when the member's values are
+      # provably `Object` instances — a fixed-class value set that single inheritance keeps
+      # from ever being a Range (`Integer`, a non-Range `Constant`, a `Tuple`). A MODULE
+      # member fails that probe (`Comparable`'s ancestors exclude `Object` — a module has no
+      # superclass chain), and rightly so: `class MyRange < Range; include Comparable; end`
+      # satisfies the annotation and still splices at runtime.
+      def could_be_range?(member)
+        return true if range_index?(member)
+
+        case member
+        when Type::Intersection
+          # An intersected value sits in EVERY member's value set, so it can be a Range only
+          # when every member allows one — `String & Comparable` cannot be (a String never
+          # is), `Object & Comparable` can (`MyRange < Range; include Comparable` satisfies
+          # both). Asked member-wise because the `Object` probe below answers yes when ANY
+          # intersected member accepts it.
+          member.members.all? { |part| could_be_range?(part) }
+        when Type::Maybe then could_be_range?(member.value_type)
+        else
+          return true unless member.respond_to?(:accepts)
+          return true unless member.accepts(RANGE_INDEX_PROBE).no? &&
+                             RANGE_INDEX_PROBE.accepts(member).no?
+
+          !OBJECT_INDEX_PROBE.accepts(member).yes?
+        end
+      end
+
+      # Element types a splice RHS adds to the receiver, read member-wise. Ruby splices an
+      # Array RHS (`a[0, 1] = [1, 2]` puts `Integer`s in — a bare `Nominal[Array]` splices
+      # elements the signature left untyped, which are unknown rather than none), and stores a
+      # NON-Array RHS as one element UNLESS the value coerces through `to_ary`, in which case
+      # the returned array's elements splice instead (`a[0, 1] = obj` where `obj.to_ary`
+      # returns `["x"]` stores `"x"`). `nil` is no exception — `a[i, n] = nil` stores a single
+      # nil.
+      #
+      # Every member that is not an Array carrier keeps a `Dynamic[top]` arm beside itself:
+      # `to_ary` is consulted for a NON-Array value, and nothing here can prove the member's
+      # class does not define one — a `Nominal` may be a subclass that declares it, and the
+      # project may reopen even a non-subclassable core class (ADR-17's patched-methods tier
+      # resolves exactly those). The two exact carriers are the ones `Array#[]=` splices
+      # without a coercion: a `Tuple` literal's elements, and a `Nominal[Array]`'s own type
+      # arguments — an Array object is spliced directly even when its class overrides
+      # `to_ary`.
+      def splice_stored_elements(value_type)
+        union_members(value_type).flat_map do |member|
+          base = member
+          base = base.base while base.is_a?(Type::Difference) || base.is_a?(Type::Refined)
+
+          case base
+          when Type::Tuple
+            base.elements
+          when Type::Nominal
+            if base.class_name == "Array"
+              # `Array#[]=` splices an Array RHS directly — `to_ary` is never consulted
+              # for an Array object, even a subclass overriding it — so the elements
+              # join exactly (a bare `Array` signature left them unknown, not absent).
+              base.type_args.empty? ? [Type::Combinator.untyped] : base.type_args
+            elsif ARRAY_PROBE.accepts(base).yes?
+              # A definite Array subclass is spliced the same way; its elements are
+              # unknown to this seam.
+              [Type::Combinator.untyped]
+            else
+              [member, Type::Combinator.untyped]
+            end
+          else
+            [member, Type::Combinator.untyped]
+          end
+        end
+      end
+
+      # True when an index position holds a Range carrier — a static `Constant<Range>` (`0..1`),
+      # a `Nominal[Range]` (`(0..n)`), or a refinement / difference over either. `IntegerRange`
+      # and `FloatRange` are scalar number refinements rather than Range objects and correctly
+      # decline, as does every ordinary scalar index.
+      def range_index?(type)
+        case type
+        when Type::Constant then type.value.is_a?(::Range)
+        when Type::Nominal then type.class_name == "Range"
+        when Type::Difference, Type::Refined then range_index?(type.base)
+        else false
+        end
+      end
+
       # Element types carried by a collection binding, regardless of which carrier holds them: a
       # `Tuple` lists them, a `Nominal[Array, [E]]` has one element param, a bare `Array` /
       # anything else yields none.
       #
       # A `Difference` reads through to its base: `non-empty-array[T]` holds `T`s, and the seams
       # that read a seed from BEFORE the arity-forget ran (see {#join_array_content}) meet the
-      # refinement carrier itself where they used to meet the base the widening had left. Declining
-      # it there would hand the continuation the widened base ALONE, with every appended arm missing
-      # — a wrong type, not a wide one.
+      # refinement carrier itself where they used to meet the base the widening had left.
+      # Declining it there would hand the continuation the widened base ALONE, with every appended
+      # arm missing — a wrong type, not a wide one.
       def collection_element_types(type)
         case type
         when Type::Tuple
@@ -305,13 +476,15 @@ module Rigor
 
       # `[keys, values]` evidence from a Hash-ish pre-state binding — a `HashShape` (literal pairs)
       # or a `Nominal[Hash, [K, V]]`. A `Difference` (`non-empty-hash[K, V]`) reads through to its
-      # base, as {#collection_element_types} does for the Array side.
+      # base, as {#collection_element_types} does for the Array side. An open shape adds a
+      # `Dynamic[top]` key and value: its unseen keys may hold anything, and the joined carrier's
+      # read of one must not answer a known value (`flags = { debug: true }; flags.default = false`
+      # then a store in a block read `flags[:verbose]` as `true`).
       def hash_shape_key_values(type)
         case type
         when Type::HashShape
-          return [[], []] if type.pairs.empty?
-
-          [[key_union_for(type.pairs.keys)], type.pairs.values]
+          keys, values = type.pairs.empty? ? [[], []] : [[key_union_for(type.pairs.keys)], type.pairs.values]
+          type.open? ? [keys + [Type::Combinator.untyped], values + [Type::Combinator.untyped]] : [keys, values]
         when Type::Nominal
           type.class_name == "Hash" && type.type_args.size == 2 ? [[type.type_args[0]], [type.type_args[1]]] : [[], []]
         when Type::Union

data/lib/rigor/inference/coverage_scanner.rb

@@ -22,17 +22,17 @@ module Rigor
     # a tracer per visited node and discards the inferred type values.
     class CoverageScanner
       class Result < Data.define(:visits, :unrecognized, :events)
-        # @return [Integer] sum of all visits across node classes.
+        # @return sum of all visits across node classes.
         def visited_count
           visits.values.sum
         end
 
-        # @return [Integer] sum of directly-unrecognized counts across classes.
+        # @return sum of directly-unrecognized counts across classes.
         def unrecognized_count
           unrecognized.values.sum
         end
 
-        # @return [Float] unrecognized_count / visited_count, or 0.0 when empty.
+        # @return unrecognized_count / visited_count, or 0.0 when empty.
         def unrecognized_ratio
           total = visited_count
           return 0.0 if total.zero?
@@ -41,13 +41,11 @@ module Rigor
         end
       end
 
-      # @param scope [Rigor::Scope] base scope used for every type_of call. Defaults to `Scope.empty`.
+      # @param scope — base scope used for every type_of call. Defaults to `Scope.empty`.
       def initialize(scope: nil)
         @scope = scope || Scope.empty
       end
 
-      # @param root [Prism::Node]
-      # @return [Result]
       def scan(root)
         visits = Hash.new(0)
         unrecognized = Hash.new(0)

data/lib/rigor/inference/def_return_typer.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../type"
 require_relative "../source/node_children"
+require_relative "return_barrier"
 
 module Rigor
   module Inference
@@ -13,15 +14,14 @@ module Rigor
     # The inferred type is the union of:
     #
     # - the body's last-statement type, and
-    # - the type of every explicit `return value` reachable in the body. Nested `def` / lambda / block bodies
-    #   are return barriers — their `return`s do not bubble up to the enclosing method.
+    # - the type of every explicit `return value` that exits the method. A `return` inside an ordinary block does
+    #   (control-flow-analysis.md § "Non-local exits"); one inside a {ReturnBarrier} — a nested `def`, a lambda,
+    #   or a `define_method` body — does not. The barriers are the ones `StatementEvaluator`'s return sink stops
+    #   at, so the proposal and `rigor check`'s view of callers agree (issue #1382).
     #
     # Extracted from `Rigor::SigGen::Generator#infer_return_type` so `LineTypeCollector` (`rigor annotate`'s
     # def-line annotator) and the sig-generator share one source of truth.
     module DefReturnTyper
-      RETURN_BARRIER_NODES = [Prism::DefNode, Prism::LambdaNode, Prism::BlockNode].freeze
-      private_constant :RETURN_BARRIER_NODES
-
       module_function
 
       def call(def_node, scope_index)
@@ -60,10 +60,14 @@ module Rigor
 
       def collect_return_types(node, scope_index, out)
         return unless node.is_a?(Prism::Node)
-        return if RETURN_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
+        return if ReturnBarrier.node?(node)
 
         type_return_node(node, scope_index, out) if node.is_a?(Prism::ReturnNode)
-        node.rigor_each_child { |c| collect_return_types(c, scope_index, out) }
+        # A barrier call's receiver and arguments still run in the method; only its block is cut off.
+        barrier_block = node.block if node.is_a?(Prism::CallNode) && ReturnBarrier.block_call?(node)
+        node.rigor_each_child do |c|
+          collect_return_types(c, scope_index, out) unless c.equal?(barrier_block)
+        end
       end
 
       def type_return_node(return_node, scope_index, out)