rigortype 0.3.9 → 0.4.0

data/lib/rigor/inference/match_rebinding.rb

@@ -0,0 +1,392 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../source/node_children"
+require_relative "../type"
+require_relative "block_call_timing"
+require_relative "fresh_frame_blocks"
+require_relative "guard_rebinding"
+require_relative "stored_block_call"
+require_relative "match_rebinding/frame"
+require_relative "match_rebinding/operands"
+require_relative "match_rebinding/calls"
+require_relative "match_rebinding/self_calls"
+require_relative "last_line"
+
+module Rigor
+  module Inference
+    # Which code may rebind the regex match globals (`$~` and the `$&` / `` $` `` / `$'` / `$+` / `$1`..`$9` family
+    # derived from it) that a scope's narrowing speaks for. Ruby keeps them in the method frame's special-variable
+    # slot, and every block and closure made in the method reaches that same slot, so a match a block body runs
+    # rebinds the enclosing method's `$~` (issue #1358). A `def`, class or module body runs in a frame of its own,
+    # and so does every call into a method defined in Ruby: a match in the callee writes the callee's slot, never
+    # its caller's (issue #1364). A thread, fiber or ractor keeps a slot of its own for the root block it runs
+    # ({FreshFrameBlocks}, issue #1361), so no scan here counts what that block runs; what it makes can still reach
+    # this frame's slot from the creator's thread, so the frame-wide rules keep reading inside it.
+    #
+    # The block and closure scans are syntactic, resolving only constants and the variables a lookup argument
+    # names, through the scope they are given. The code a statement runs outside a block is read call by call
+    # ({Calls}, {.value_may_rebind?}; issue #1365): a call the old name table forgot on keeps forgetting unless its
+    # literal arguments prove it match-free, and any other forgets only when it is known to match. The scans
+    # short-circuit without a `return` out of a child block, which would allocate once per frame it unwinds.
+    module MatchRebinding # rubocop:disable Metrics/ModuleLength
+      # The block and closure scans read calls on narrower terms than the statement-level rule ({Calls}), because
+      # inside a block `[]`, `split` and `index` are overwhelmingly lookups on hashes, arrays and strings whose key
+      # the scan cannot type, and counting them dropped the narrowing on correct code
+      # (`fields.each { |f| out[f] = row[f] }; $1.upcase`).
+      #
+      # These rebind `$~` whatever their argument: `sub` / `gsub` / `scan` with a String pattern still set it, and
+      # `!~` runs `=~`.
+      ALWAYS_MATCHING = Set[:=~, :!~, :match, :sub, :sub!, :gsub, :gsub!, :scan].freeze
+      # These rebind it only with a Regexp argument, so they count only when an argument is known to be one
+      # ({Operands.regexp_argument?}). `match?` never sets `$~`.
+      REGEXP_ARGUMENT = Set[
+        :[], :slice, :slice!, :index, :rindex, :partition, :rpartition, :split, :grep, :grep_v,
+        :start_with?, :byteindex, :byterindex, :any?, :all?, :none?, :one?
+      ].freeze
+      # `grep` / `grep_v` rebind the caller's `$~` only in their block form.
+      BLOCK_FORM_ONLY = Set[:grep, :grep_v].freeze
+      # `&:name` block arguments that rebind `$~`: the method runs on the element in the caller's frame. `===` with
+      # an unknown operand may be a Regexp's. Compared as Strings, as {SelfCalls} explains.
+      MATCHING_SYMBOL_PROCS = (ALWAYS_MATCHING | Set[:===]).to_set(&:to_s).freeze
+      # The broad reading ({.broad_may_match?}) also counts these with any argument that may be a Regexp.
+      BROAD_ARGUMENT = (REGEXP_ARGUMENT | Set[:[]=]).freeze
+      # The names issue #1364 added to the block scan. The entry of a `tap` / `then` / `yield_self` block reads its
+      # body without them ({.block_entry}).
+      ADDED_NAMES = Set[:!~, :start_with?, :byteindex, :byterindex, :any?, :all?, :none?, :one?].freeze
+      # The calls on the method's own `&block` parameter that run it, which the broad reading counts.
+      BLOCK_INVOCATIONS = Set[:call, :yield, :[], :===].freeze
+
+      # A body that runs in a frame of its own, or never runs (`defined?` evaluates nothing): every walk of what a
+      # frame runs stops there, `$_`'s ({LastLine}) included.
+      OWN_FRAME_NODES = Set[
+        Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode, Prism::DefinedNode
+      ].freeze
+      # A bare regex condition (`if /re/`) matches against `$_`.
+      LAST_LINE_MATCHES = Set[Prism::MatchLastLineNode, Prism::InterpolatedMatchLastLineNode].freeze
+      GLOBAL_WRITES = Set[
+        Prism::GlobalVariableWriteNode, Prism::GlobalVariableOperatorWriteNode, Prism::GlobalVariableOrWriteNode,
+        Prism::GlobalVariableAndWriteNode, Prism::GlobalVariableTargetNode
+      ].freeze
+      private_constant :ALWAYS_MATCHING, :REGEXP_ARGUMENT, :BLOCK_FORM_ONLY, :MATCHING_SYMBOL_PROCS, :BROAD_ARGUMENT,
+                       :ADDED_NAMES, :BLOCK_INVOCATIONS,
+                       :LAST_LINE_MATCHES, :GLOBAL_WRITES
+
+      module_function
+
+      # True when running `node` may run a regex match in the frame it runs in, anywhere in `node` but a nested
+      # `def`, class or module body: a call {.call_matches?} counts; so does a `when` condition of a `case` with a
+      # subject, or an `in` / `=>` pattern value, that may be a Regexp ({Operands}); a bare regex condition; a
+      # write to `$~`; or a block argument {.block_argument_may_match?} counts. A block or lambda inside `node`
+      # counts, since it runs in the same frame. `scope` resolves constants and the variables a lookup argument
+      # names, and names the frame; the answer for a node is kept on that frame while those bindings stay the same.
+      def may_match?(node, scope = nil)
+        return false unless node.is_a?(Prism::Node)
+
+        remember(node, scope) { scan(node, scope) }
+      end
+
+      # The answer the block gives for `node`, kept on `scope`'s frame under `kind` ({Frame#memo}) when a body
+      # stamped one.
+      def remember(node, scope, kind = nil, &)
+        frame = scope&.match_frame
+        frame.nil? ? yield : frame.memo(node, scope, kind, &)
+      end
+
+      # `base` reads the body without {ADDED_NAMES}.
+      def scan(node, scope, base: false)
+        return true if matching_node?(node, scope, base: base)
+        return false if OWN_FRAME_NODES.include?(node.class)
+
+        FreshFrameBlocks.any_frame_child?(node, scope) { |child| scan(child, scope, base: base) }
+      end
+      private_class_method :scan
+
+      # `broad` reads an unresolved constant as a possible Regexp ({Operands}).
+      def matching_node?(node, scope, broad: false, base: false)
+        case node
+        when Prism::CallNode then call_matches?(node, scope, broad: broad, base: base)
+        when Prism::CaseNode then case_matches?(node, scope, broad: broad)
+        when Prism::BlockArgumentNode then block_argument_may_match?(node, scope, base: base)
+        # `case … in`, `expr in pat` and `expr => pat` run `===` on each value in the pattern.
+        when Prism::InNode, Prism::MatchPredicateNode, Prism::MatchRequiredNode
+          Operands.pattern_matches?(node.pattern, scope, broad: broad)
+        else
+          LAST_LINE_MATCHES.include?(node.class) || (GLOBAL_WRITES.include?(node.class) && node.name == :$~)
+        end
+      end
+      private_class_method :matching_node?
+
+      # A call that rebinds `$~` in the frame it is made in: an {ALWAYS_MATCHING} name, a {REGEXP_ARGUMENT} name
+      # with a known Regexp argument, or `===` on a receiver that may be a Regexp — `a === b` is `a`'s method, so
+      # `String === re` runs no match.
+      def call_matches?(node, scope, broad: false, base: false)
+        name = node.name
+        return false if base && ADDED_NAMES.include?(name)
+        return true if ALWAYS_MATCHING.include?(name)
+
+        if name == :===
+          receiver = node.receiver
+          return receiver.nil? || Operands.pattern_value?(receiver, scope, broad: broad)
+        end
+        arguments = node.arguments&.arguments
+        return false unless arguments && REGEXP_ARGUMENT.include?(name)
+        return false if BLOCK_FORM_ONLY.include?(name) && node.block.nil?
+
+        arguments.any? { |argument| Operands.regexp_argument?(argument, scope) }
+      end
+
+      # A `case` with a subject runs `condition === subject` for each `when` condition. One without a subject tests
+      # each condition for truth, which runs no `===`; a match inside a condition is scanned like any other code.
+      def case_matches?(node, scope, broad: false)
+        return false if node.predicate.nil?
+
+        node.conditions.any? do |clause|
+          clause.is_a?(Prism::WhenNode) &&
+            clause.conditions.any? { |condition| Operands.pattern_value?(condition, scope, broad: broad) }
+        end
+      end
+      private_class_method :call_matches?, :case_matches?
+
+      # True when an implicit-self call's arguments may run a match in this frame (issue #1364), outside a block or
+      # lambda, which {.value_may_rebind?} and the frame's closure rules answer for: a call the table or
+      # {SelfCalls} names on any receiver, unless its syntax proves it cannot match ({Calls.forgets_by_name?}, issue
+      # #1365: `log(row[:name])` keeps the narrowing, `log(row[key])` does not); a Symbol or String literal naming
+      # one (`inject(:=~)`), which the implicit-self call may run from C; a `yield`; or any other construct the
+      # block scan counts, an unresolved constant read as a possible Regexp. An implicit-self call used to forget
+      # whatever it called, and this keeps it forgetting wherever it forgot then but on that proof; a call in an
+      # argument that is known to match forgets by itself too ({.operands_may_rebind?}).
+      def operand_may_match?(node, scope = nil)
+        return false unless node.is_a?(Prism::Node)
+
+        case node
+        when Prism::BlockNode, Prism::LambdaNode then return false
+        when Prism::CallNode
+          return true if Calls.base_named?(node, implicit: true) && Calls.forgets_by_name?(node, scope)
+        when Prism::YieldNode then return true
+        else
+          return true if SelfCalls.method_name_literal?(node) || matching_node?(node, scope, broad: true)
+        end
+        return false if OWN_FRAME_NODES.include?(node.class)
+
+        FreshFrameBlocks.any_frame_child?(node, scope) { |child| operand_may_match?(child, scope) }
+      end
+
+      # True when `node`, a frame's body or parameters, hands its match globals to code the analyzer does not trace,
+      # so an implicit-self call in the frame keeps forgetting them as every one did before issue #1364: a block or
+      # lambda literal whose body may match by the broad reading ({.broad_may_match?}), since the call it is passed
+      # to may keep it and run it from any later call; `binding` in any spelling, whose `eval` runs in this frame
+      # wherever it is called; or a forward of the method's own block (`&blk` for the method's `&blk`, `&`, `...`),
+      # which may be a C-function proc such as `&:=~`. `block_name` is the method's `&block` parameter. The root block
+      # of a thread, fiber or ractor ({FreshFrameBlocks.root_block}) is not handed to such code: it runs with a slot
+      # of its own. A block, lambda or `binding` inside it is read as anywhere else, since it may be handed back to
+      # this frame's thread (`Thread.new { -> { s =~ re } }.value.call` rebinds the creator's `$~`).
+      def self_call_fallback?(node, block_name, scope = nil)
+        hands_out_slot?(node, block_name, scope) { |body| broad_may_match?(body, scope, block_name) }
+      end
+
+      # The walk under {.self_call_fallback?}, shared with `$_` ({LastLine.fallback?}): the block answers whether a
+      # block or lambda body may rebind the special it asks about.
+      def hands_out_slot?(node, block_name, scope, &)
+        return false unless node.is_a?(Prism::Node)
+        return true if handoff_node?(node, block_name, &)
+        return false if OWN_FRAME_NODES.include?(node.class)
+
+        FreshFrameBlocks.any_frame_child?(node, scope, into_root: true) do |child|
+          hands_out_slot?(child, block_name, scope, &)
+        end
+      end
+
+      def handoff_node?(node, block_name)
+        case node
+        when Prism::BlockNode, Prism::LambdaNode then yield(node.body)
+        when Prism::CallNode then node.name == :binding || SelfCalls.sends_binding?(node)
+        when Prism::ForwardingArgumentsNode then true
+        when Prism::BlockArgumentNode
+          expression = node.expression
+          expression.nil? || (expression.is_a?(Prism::LocalVariableReadNode) && expression.name == block_name)
+        else false
+        end
+      end
+
+      # {.may_match?} on broad terms, where over-counting costs no more than an implicit-self call forgetting as it
+      # did before issue #1364: a {BROAD_ARGUMENT} name counts with any argument that may be a Regexp — a block
+      # parameter, a method's return value, a constant that does not resolve (#1373) — and so does a call {SelfCalls}
+      # reads by name, a literal naming one, a `yield`, or a call that runs the method's own `&block` (`block_name`),
+      # either of which may run a C-function proc such as `&:=~` in this frame.
+      def broad_may_match?(node, scope = nil, block_name = nil)
+        return false unless node.is_a?(Prism::Node)
+        return true if broad_matching_node?(node, scope, block_name)
+        return false if OWN_FRAME_NODES.include?(node.class)
+
+        FreshFrameBlocks.any_frame_child?(node, scope) { |child| broad_may_match?(child, scope, block_name) }
+      end
+
+      def broad_matching_node?(node, scope, block_name)
+        return true if node.is_a?(Prism::YieldNode)
+        unless node.is_a?(Prism::CallNode)
+          return matching_node?(node, scope, broad: true) || SelfCalls.method_name_literal?(node)
+        end
+        return true if call_matches?(node, scope, broad: true) || SelfCalls.named_match?(node)
+        return true if own_block_call?(node, block_name)
+
+        arguments = node.arguments&.arguments
+        !arguments.nil? && BROAD_ARGUMENT.include?(node.name) &&
+          arguments.any? { |argument| Operands.pattern_value?(argument, scope, broad: true) }
+      end
+
+      def own_block_call?(call_node, block_name)
+        receiver = call_node.receiver
+        !block_name.nil? && receiver.is_a?(Prism::LocalVariableReadNode) && receiver.name == block_name &&
+          BLOCK_INVOCATIONS.include?(call_node.name)
+      end
+      private_class_method :handoff_node?, :broad_matching_node?, :own_block_call?
+
+      # True when the block `call_node` passes may rebind the frame's match globals while the call runs: a block
+      # literal whose body {.may_match?}, or a block argument that {.block_argument_may_match?}. The root block of a
+      # thread, fiber or ractor never does ({FreshFrameBlocks.root_call?}); a root `&expr` argument's expression runs
+      # here first, as an operand does ({.value_may_rebind?}).
+      def block_may_match?(call_node, scope = nil)
+        block = call_node.block
+        if FreshFrameBlocks.root_call?(call_node, scope)
+          return block.is_a?(Prism::BlockArgumentNode) && value_may_rebind?(block.expression, scope)
+        end
+
+        case block
+        when Prism::BlockNode then may_match?(block.body, scope)
+        when Prism::BlockArgumentNode then block_argument_may_match?(block, scope)
+        else false
+        end
+      end
+
+      # True when a `&expr` block argument may pass a proc made in this frame. Not an anonymous `&`, nor the method's
+      # own `&block` parameter while the body never rebinds or shadows it ({Frame#forwarded_block?}): either
+      # forwards the block the caller made, in the caller's frame. Not a `&:name` whose method cannot match
+      # ({MATCHING_SYMBOL_PROCS}).
+      def block_argument_may_match?(block_argument, scope, base: false)
+        expression = block_argument.expression
+        case expression
+        when nil then false
+        when Prism::SymbolNode
+          name = expression.unescaped
+          MATCHING_SYMBOL_PROCS.include?(name) && !(base && name == "!~")
+        when Prism::LocalVariableReadNode
+          frame = scope&.match_frame
+          frame.nil? || !frame.forwarded_block?(expression.name)
+        else true
+        end
+      end
+
+      # True when `program`, a String of code an eval runs in this frame, may match, on the block scan's terms: its
+      # statements run here, and a `def` or class in it runs in a frame of its own. The caller keeps the answer.
+      def program_may_match?(program, scope) = scan(program, scope)
+
+      # True when running a call's receiver chain and arguments, which Ruby does before the method, may rebind the
+      # frame's match globals ({.value_may_rebind?}), kept on the frame as {Frame#memo} keeps a scan.
+      def operands_may_rebind?(call_node, scope)
+        remember(call_node, scope, :operands) do
+          value_may_rebind?(call_node.receiver, scope) || value_may_rebind?(call_node.arguments, scope)
+        end
+      end
+
+      # True when evaluating `node` for its value — a call's receiver chain or arguments, an array, hash or
+      # interpolation literal, a `rescue` modifier, a `super` or `yield` — may rebind the frame's match globals
+      # (issue #1365). No call there forgot before, so each forgets only when it is known to match
+      # ({Calls.rebinds?}): `[u.index(/(q)/)]` does, `out << row[key]` and `x = [h[k], 1]` do not. So does an index
+      # write whose index is known to be a Regexp (`s[re] ||= v`), a block literal on a call there whose body
+      # {.may_match?}, a block argument {.block_argument_may_match?} counts, or any other construct the block scan
+      # counts (a `when` or `in` value that may be a Regexp, a bare regex condition, a write to `$~`). An
+      # implicit-self call there is read the same way: the frame-wide fallback of {Calls.statement_rebinds?} stays with
+      # statement-position calls, as before, where an operand's `value.upcase` would otherwise forget at every
+      # attribute read. A lambda literal does not run where it is written ({.matching_closure?} answers for it),
+      # and a `def`, class or module body or a `defined?` operand does not run in this frame.
+      def value_may_rebind?(node, scope)
+        return false unless node.is_a?(Prism::Node)
+
+        case node
+        when Prism::BlockNode then return may_match?(node.body, scope)
+        when Prism::LambdaNode then return false
+        when Prism::CallNode, Prism::IndexOrWriteNode, Prism::IndexAndWriteNode, Prism::IndexOperatorWriteNode
+          return true if Calls.rebinds?(node, scope)
+        else return true if matching_node?(node, scope)
+        end
+        return false if OWN_FRAME_NODES.include?(node.class)
+
+        FreshFrameBlocks.any_frame_child?(node, scope) { |child| value_may_rebind?(child, scope) }
+      end
+
+      # True when `node`, a frame's body or parameters, makes a closure that may rebind the frame's match globals
+      # whenever it is invoked: a `->` literal, or the block of a call that keeps it to run later
+      # ({StoredBlockCall}: `lambda`, `proc`, `Proc.new`, `define_method`, …), whose body {.may_match?}.
+      # Invocations are not traced — the closure can be called through any later call, or run by a method it was
+      # handed to — so {Frame} answers for the whole frame. The root block of a thread or fiber is kept too, but it
+      # only ever runs as that thread's or fiber's root, with a slot of its own ({FreshFrameBlocks}); a closure made
+      # inside it still counts, since it may be handed back to this frame's thread.
+      def matching_closure?(node, scope = nil) = makes_closure?(node, scope) { |body| may_match?(body, scope) }
+
+      # The walk under {.matching_closure?}, shared with `$_` ({LastLine.closure?}): the block answers whether a
+      # closure body may rebind the special it asks about.
+      def makes_closure?(node, scope, &)
+        return false unless node.is_a?(Prism::Node)
+        return false if OWN_FRAME_NODES.include?(node.class)
+        return true if node.is_a?(Prism::LambdaNode) && yield(node.body)
+        return true if node.is_a?(Prism::CallNode) && stored_block_rebinds?(node, scope, &)
+
+        found = false
+        node.rigor_each_child { |child| found ||= makes_closure?(child, scope, &) }
+        found
+      end
+
+      def stored_block_rebinds?(call_node, scope)
+        block = call_node.block
+        block.is_a?(Prism::BlockNode) && StoredBlockCall.stores_block?(call_node) &&
+          !FreshFrameBlocks.root_call?(call_node, scope) && yield(block.body)
+      end
+      private_class_method :stored_block_rebinds?
+
+      # The scope a block or lambda body enters with: `scope` with its match globals forgotten when the body may
+      # match, or when the frame makes a closure that may. The body can run on a later iteration, after an earlier
+      # one — or a call to that closure — rebound them, so no iteration may read the narrowing the call site holds.
+      # A body with neither keeps it: blocks share the frame, so `s =~ /(\d+)/; items.map { $1 }` reads the
+      # guard's `$1`. The block of a call named `tap`, `then` or `yield_self` ({BlockCallTiming}) is read as the scan
+      # read every block before issue #1364, without {ADDED_NAMES}, so its entry is what it was: the name alone
+      # cannot show the block runs once (a user `then` may keep it, and a loop runs the call again, #1375). With
+      # the owning `call_node`, the entry also forgets when the call's receiver chain or arguments may rebind them
+      # ({.operands_may_rebind?}, issue #1365): Ruby runs those before the method yields, so
+      # `[u.index(/(q)/)].map { $1 }` reads the rebound `$1`. Every block-entry pass enters through here:
+      # {StatementEvaluator#build_block_entry_scope} and the block-return and `break` passes in {ExpressionTyper}
+      # pass the call. The per-element fold and the captured-local fixpoint pass none; they run under
+      # `ExpressionTyper#rebound_operand_typer`, whose scope has already forgotten the globals when the operands
+      # may rebind them, so no pass disagrees. Neither runs for the block of a call {FreshFrameBlocks} names, which is
+      # no iterator's; that block enters as {FreshFrameBlocks.entry} gives (issue #1361): a thread's, fiber's or
+      # ractor's root block with the globals unbound, since it reads a slot of its own, and a `define_method` body
+      # with a narrowed global untyped, since it reads the definer's slot whenever the method is called. `$_`, which
+      # shares the slot, enters on the same terms ({LastLine.block_entry}, issue #1359). A closure's body, which runs
+      # whenever it is called, enters with `$!`, `$@` and `$?` unbound ({FreshFrameBlocks.closure_entry}, issue #1360).
+      #
+      # Issue #1429 — the entry also restores a guard's narrowing of a global or constant where the body may run after
+      # code that rebinds it ({GuardRebinding.block_entry}).
+      def block_entry(scope, block_node, call_node = nil)
+        scope = GuardRebinding.block_entry(scope, block_node, call_node)
+        return FreshFrameBlocks.entry(scope, call_node) if FreshFrameBlocks.fresh_entry?(call_node, scope)
+
+        scope = FreshFrameBlocks.closure_entry(scope, block_node, call_node)
+        scope = LastLine.block_entry(scope, block_node, call_node)
+        return scope unless scope.match_globals_bound?
+        return scope unless scope.match_rebinding_closure? || entry_may_match?(block_node.body, scope, call_node) ||
+                            (call_node.is_a?(Prism::CallNode) && operands_may_rebind?(call_node, scope))
+
+        scope.forget_match_globals
+      end
+
+      def entry_may_match?(body, scope, call_node)
+        return may_match?(body, scope) unless call_node.is_a?(Prism::CallNode) &&
+                                              BlockCallTiming.candidate_name?(call_node.name)
+
+        body.is_a?(Prism::Node) && scan(body, scope, base: true)
+      end
+      private_class_method :entry_may_match?
+    end
+  end
+end

data/lib/rigor/inference/method_dispatcher/alias_strict_nominals.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    module MethodDispatcher
+      module OverloadSelector
+        # Canonical RBS-core aliases shipped by `core/builtin.rbs` whose body is `<Nominal> | _DuckType`.
+        # Matching an overload against an Integer literal should pick the `(int) -> Array[Elem]` body over
+        # the `(string) -> String` body because Integer satisfies `int`'s strict arm and not `string`'s.
+        # The translator collapses both aliases to `Dynamic[Top]` (interfaces are not structurally matched
+        # yet), so a dedicated pass 1.5 between strict and gradual consults this map to pick the alias
+        # whose strict arm matches.
+        #
+        # Symbol keys are the alias names as they appear under `RBS::Types::Alias#name.to_s` (the `name` is
+        # a `TypeName` whose `to_s` includes the `::` prefix). Values are an Array of class names whose
+        # Nominal[..] form is the alias's strict-arm matcher.
+        #
+        # `range[T] = Range[T] | _Range[T]` is generic, unlike the others, but its strict arm is still a single
+        # nominal and the args are irrelevant to this pass. rbs 4.1 rewrote `Array#[]`'s slicing overload from
+        # `(::Range[::Integer?])` to `(range[int])`; without the entry both it and the `(int) -> E` overload look
+        # alias-typed, so `a[1..2]` resolved to the element type.
+        ALIAS_STRICT_NOMINALS = Ractor.make_shareable({
+                                                        "::int" => ["Integer"],
+                                                        "::string" => ["String"],
+                                                        "::interned" => %w[Symbol String],
+                                                        "::io" => ["IO"],
+                                                        "::encoding" => %w[Encoding String],
+                                                        "::path" => ["String"],
+                                                        "::boolean" => %w[TrueClass FalseClass],
+                                                        "::range" => ["Range"]
+                                                      })
+        private_constant :ALIAS_STRICT_NOMINALS
+      end
+    end
+  end
+end

data/lib/rigor/inference/method_dispatcher/block_folding.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../../type"
+require_relative "iterator_dispatch"
 
 module Rigor
   module Inference
@@ -15,13 +16,20 @@ module Rigor
       # The methods covered fall in two families:
       #
       # - **Filter-shaped** (`select` / `filter` / `reject` / `take_while` / `drop_while`): the block's
-      #   truthiness selects the all-or-nothing endpoints — either the receiver's full shape (when every
-      #   element is kept) or the empty-tuple carrier (when every element is dropped).
-      # - **Predicate-shaped** (`all?` / `any?` / `none?`): the block's truthiness combined with the
-      #   receiver's emptiness collapses the call to a `Constant[bool]` in the cases where Ruby's actual
-      #   semantics make it unconditional. Non-empty + truthy `any?` is `true`; non-empty + falsey `all?` is
-      #   `false`; the empty-receiver "vacuous" answers (`[].all? { false } == true`, `[].any? { true } ==
-      #   false`, `[].none? { true } == true`) are likewise honoured.
+      #   truthiness selects the all-or-nothing endpoints — either every element kept or every element
+      #   dropped — and each endpoint is a value of the class the method returns. `Hash#select` / `#filter`
+      #   / `#reject` keep the Hash receiver or drop to the empty HashShape; every other combination is
+      #   Enumerable's and returns an Array, so it drops to the empty-tuple carrier and keeps the receiver
+      #   only when that receiver is itself an Array (otherwise the all-kept side declines).
+      # - **Predicate-shaped** (`all?` / `any?` / `none?`, without a pattern argument): the block's
+      #   truthiness combined with the receiver's emptiness collapses the call to a `Constant[bool]` in the
+      #   cases where Ruby's actual semantics make it unconditional. Non-empty + truthy `any?` is `true`;
+      #   non-empty + falsey `all?` is `false`; the empty-receiver "vacuous" answers (`[].all? { false } ==
+      #   true`, `[].any? { true } == false`, `[].none? { true } == true`) are likewise honoured.
+      #
+      # One family reads no block truthiness at all: **edge-selecting** `min_by` / `max_by` without a count
+      # answer `nil` only for an empty receiver, so on a receiver whose non-emptiness is a static fact they
+      # answer the element type without the `nil` the RBS `Elem?` return adds ({#fold_edge_by}).
       #
       # The dispatcher returns `nil` for any case that cannot be decided from the (receiver-shape, method,
       # block-truthiness) tuple — element-wise block re-evaluation against `Constant<Array>` receivers (the
@@ -32,6 +40,16 @@ module Rigor
         FILTER_KEEP_ON_TRUTHY = Set[:select, :filter, :take_while].freeze
         FILTER_KEEP_ON_FALSEY = Set[:reject, :drop_while].freeze
 
+        # The filter methods `Hash` defines itself, returning a Hash. `take_while` / `drop_while` on a Hash
+        # are Enumerable's and return an Array of `[key, value]` pairs; `Set` and `Range` define none of the
+        # five, so all of theirs return an Array too.
+        HASH_RETURNING_FILTERS = Set[:select, :filter, :reject].freeze
+
+        # `filter_receiver_kind`'s answer for a nominal receiver; an unlisted class declines.
+        FILTER_NOMINAL_KINDS = {
+          "Array" => :array, "Hash" => :hash, "Set" => :enumerable, "Range" => :enumerable
+        }.freeze
+
         PREDICATE_METHODS = Set[:all?, :any?, :none?].freeze
 
         # Methods whose answer is `nil` when the block always returns Ruby-falsey — `find` / `detect`
@@ -46,6 +64,10 @@ module Rigor
         # a finitely-sized receiver it is `Constant[size]`.
         COUNT_METHOD = :count
 
+        # `min_by` / `max_by` pick one element by the block's key, so the block's value decides WHICH element
+        # but never WHETHER one is returned: only an empty receiver answers `nil`.
+        EDGE_BY_METHODS = Set[:min_by, :max_by].freeze
+
         # `context.block_type` is the inferred return type of the call's block; `nil` means "no block at the
         # call site" and disqualifies every rule here.
         def try_dispatch(context)
@@ -54,12 +76,13 @@ module Rigor
           args = context.args
           block_type = context.block_type
           return nil if receiver.nil? || block_type.nil?
+          return fold_edge_by(receiver, args) if EDGE_BY_METHODS.include?(method_name)
 
           truthiness = constant_truthiness(block_type)
           return nil if truthiness.nil?
 
           if PREDICATE_METHODS.include?(method_name)
-            fold_predicate(receiver, method_name, truthiness)
+            fold_predicate(receiver, method_name, truthiness, args)
           elsif filter_method?(method_name)
             fold_filter(receiver, method_name, truthiness)
           elsif FALSEY_BLOCK_NIL_METHODS.include?(method_name)
@@ -69,6 +92,22 @@ module Rigor
           end
         end
 
+        # Issue #1333 — `min_by` / `max_by` with a block and no count on a non-empty Tuple or a non-empty
+        # constant integer `Range` answer the receiver's element type: the RBS `Elem?` return adds `nil` for
+        # the empty receiver, and `[1, 2].min_by { |s| rand(3) } + 1` then reported a nil receiver on correct
+        # code. The block's value picks which element, and one `block_type` typed from the call's entry scope
+        # cannot say which, so the answer is the whole element union. An empty receiver, one whose size is
+        # not static (`Array[T]`), and the count form (`min_by(2) { … }`, an Array) decline to RBS.
+        def fold_edge_by(receiver, args)
+          return nil unless args.empty?
+          return nil unless receiver_emptiness(receiver) == :non_empty
+
+          case receiver
+          when Type::Tuple then Type::Combinator.union(*receiver.elements)
+          when Type::Constant then IteratorDispatch.element_type_of(receiver) if receiver.value.is_a?(Range)
+          end
+        end
+
         def filter_method?(method_name)
           FILTER_KEEP_ON_TRUTHY.include?(method_name) ||
             FILTER_KEEP_ON_FALSEY.include?(method_name)
@@ -85,15 +124,28 @@ module Rigor
           block_type.value ? :truthy : :falsey
         end
 
-        # Filter-shaped methods collapse to either the receiver (every element kept) or the empty tuple
-        # (every element dropped). Tuple-shaped receivers widen to `Array[union of elements]` on the
-        # all-kept side because we cannot prove WHICH positional subset survives — Tuple's per-position
-        # semantics do not carry over to a filtered Array.
+        # Filter-shaped methods collapse to either the receiver (every element kept) or the empty collection
+        # (every element dropped), and the collection's class is the method's result class, not the
+        # receiver's: `{ a: 1 }.reject { true }` is `{}`, `{ a: 1 }.take_while { false }` is `[]`.
+        #
+        # The all-kept side answers the receiver only when the result class matches it — an Array for an
+        # Array receiver, a Hash for a Hash receiver's own filters. Otherwise (`Set[1].select { true }` is
+        # `[1]`, `{ a: 1 }.take_while { true }` is `[[:a, 1]]`) it declines so the RBS tier's
+        # `Array[Elem]` projection answers. Tuple-shaped receivers widen to `Array[union of elements]`
+        # on the all-kept side because we cannot prove WHICH positional subset survives — Tuple's
+        # per-position semantics do not carry over to a filtered Array.
         def fold_filter(receiver, method_name, truthiness)
-          return nil unless filter_receiver_known?(receiver)
+          kind = filter_receiver_kind(receiver)
+          return nil if kind.nil?
 
-          keep_all = filter_keeps_all?(method_name, truthiness)
-          keep_all ? receiver_as_kept_array(receiver) : Type::Combinator.tuple_of
+          hash_result = kind == :hash && HASH_RETURNING_FILTERS.include?(method_name)
+          unless filter_keeps_all?(method_name, truthiness)
+            return hash_result ? Type::Combinator.hash_shape_of({}) : Type::Combinator.tuple_of
+          end
+          return receiver if hash_result
+          return receiver_as_kept_array(receiver) if kind == :array
+
+          nil
         end
 
         def filter_keeps_all?(method_name, truthiness)
@@ -117,8 +169,11 @@ module Rigor
         end
 
         # Predicate folds. The decision table mirrors Ruby's actual semantics on `Enumerable#all?` / `#any?` /
-        # `#none?` — see the table at the top of the module.
-        def fold_predicate(receiver, method_name, truthiness)
+        # `#none?` — see the table at the top of the module. A pattern argument declines: Ruby then tests
+        # `pattern === element` and ignores the block, so `[1, 2].all?(String) { true }` is `false`.
+        def fold_predicate(receiver, method_name, truthiness, args)
+          return nil unless args.empty?
+
           emptiness = receiver_emptiness(receiver)
           decision = predicate_decision(method_name, truthiness, emptiness)
           return nil if decision.nil?
@@ -216,14 +271,20 @@ module Rigor
           type.is_a?(Type::Nominal) && %w[Array Hash Set].include?(type.class_name)
         end
 
-        # Filter folds need at least a recognised collection carrier; `Top` / `Dynamic` / arbitrary nominals
-        # decline so the RBS tier answers (its `Array#select { … } -> Array[T]` projection is correct, just
-        # less precise on the empty endpoint).
-        def filter_receiver_known?(receiver)
+        # Classifies a filter receiver as `:array`, `:hash`, or `:enumerable` (a `Set` or `Range`, whose
+        # filters are all Enumerable's). Filter folds need at least a recognised collection carrier, so
+        # `Top` / `Dynamic` / arbitrary nominals / non-collection constants answer `nil` and decline so the
+        # RBS tier answers (its `Array#select { … } -> Array[T]` projection is correct, just less precise
+        # on the empty endpoint). A `Difference` (`non-empty-array[T]`, `non-empty-hash[K, V]`) classifies
+        # by its base. The `Constant` receivers are the ones `constant_emptiness` reads: `Range` literals
+        # and folded `Set` values.
+        def filter_receiver_kind(receiver)
           case receiver
-          when Type::Tuple, Type::HashShape, Type::Constant, Type::Difference then true
-          when Type::Nominal then %w[Array Hash Set Range].include?(receiver.class_name)
-          else false
+          when Type::Tuple then :array
+          when Type::HashShape then :hash
+          when Type::Constant then :enumerable if receiver.value.is_a?(Range) || receiver.value.is_a?(::Set)
+          when Type::Difference then filter_receiver_kind(receiver.base)
+          when Type::Nominal then FILTER_NOMINAL_KINDS[receiver.class_name]
           end
         end