rigortype 0.4.1 → 0.4.2

data/lib/rigor/inference/key_presence_guard.rb

@@ -0,0 +1,303 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+require_relative "mutation_widening"
+require_relative "key_presence_guard/scan"
+
+module Rigor
+  module Inference
+    # Issue #1703 — `H.key?(k)` / `has_key?` / `include?` / `member?` with a non-literal key, followed by `H[k]`.
+    #
+    # A closed hash shape read by a computed key answers every value plus the miss `nil`
+    # (`ShapeDispatch#hash_dig_step`), so the guarded read in typelizer's
+    # `COLUMN_TYPE_MAP.key?(property.column_type) && …; COLUMN_TYPE_MAP[property.column_type].dup` kept the `nil`
+    # and its `[]=` reported `call.possible-nil-receiver`.
+    #
+    # **Fail-closed by construction.** The analysis every rule reads never records a guard: {.record} and
+    # {.guarded_read} act only inside {.with_guards}, which nothing but {.withholds_nil?} enters. When
+    # `call.possible-nil-receiver` is about to report on a file that holds a guard-shaped call, it re-walks the file
+    # once with guards on, from a scope whose side tables are private copies, and withholds the report only when the
+    # re-walk types the receiver as exactly the analysis's type without `nil`. No other type, verdict, summary or
+    # signature can change, so the guard can only remove that one report.
+    #
+    # Inside the re-walk a guard is recorded only when it is safe to rely on ({.eligible?}) and is dropped where the
+    # receiver or the key may have changed ({.invalidate_after_call}, {.invalidate_after_write}, a rebinding through
+    # `Scope#bind_local` / `#bind_ivar`, and the region check in {.guarded_read}).
+    module KeyPresenceGuard
+      # The key half of a guard's address: a local, an instance variable, or a chain of plain readers rooted at one
+      # (`prop.column_type`). `path` is `[[root_kind, root_name], method, …]`, so two spellings of one chain compare
+      # equal.
+      KeyExpr = Data.define(:path) do
+        def root = path.first
+
+        # Whether `other` reads a prefix of this chain (`prop` or `prop.column_type` for `prop.column_type`), so
+        # evaluating it re-reads this key rather than intervening.
+        def prefixed_by?(other) = path.first(other.path.size) == other.path
+      end
+
+      # What a guard stores at its address. The fact is the entry's presence on every joined arm; the read
+      # recomputes its type from the receiver, so the value carries nothing.
+      PRESENT = Type::Combinator.constant_of(true)
+
+      PREDICATES = %i[key? has_key? include? member?].to_set.freeze
+
+      # A plain reader's name: lower-case, no operator, writer or bang.
+      READER_NAME = /\A[a-z_][a-z0-9_]*\??\z/
+
+      # Reader-shaped names that answer something new on each call or consume state, so `h.key?(q.shift)` and a later
+      # `h[q.shift]` read different keys. Every name the mutation tables know is excluded too.
+      NON_IDEMPOTENT_READERS = (
+        %i[
+          shift pop unshift push append prepend next succ pred gets read readline readlines readpartial read_nonblock
+          getc getbyte readchar readbyte each each_line each_char each_byte rand random sample shuffle tick now call
+          yield resume take take_while drop lazy to_enum enum_for peek rewind reload reset lock unlock clear
+          generate fetch_next dequeue deq enqueue enq poll receive recv accept consume
+        ] + MutationWidening::SHAPE_MUTATORS.to_a
+      ).to_set.freeze
+
+      STATE_KEY = :__rigor_key_presence_guard
+      CACHE_KEY = :__rigor_key_presence_guard_rewalk
+      private_constant :STATE_KEY, :CACHE_KEY
+
+      # The re-walk's state: the file's root, the end offset of each recorded guard, and the per-file scans.
+      Walk = Struct.new(:root, :guard_ends, :defs, :frozen_constants, :memo) do
+        # The innermost `def` holding `node`. The defs are collected once, in source order, so the innermost holder
+        # is the last one starting at or before the node that also ends after it.
+        def enclosing_def(node)
+          self.defs ||= collect_defs(root, [])
+          offset = node.location.start_offset
+          index = defs.bsearch_index { |d| d.location.start_offset > offset } || defs.size
+          (index - 1).downto(0) do |i|
+            candidate = defs[i]
+            return candidate if offset < candidate.location.end_offset
+          end
+          nil
+        end
+
+        def collect_defs(node, out)
+          out << node if node.is_a?(Prism::DefNode)
+          node.compact_child_nodes.each { |child| collect_defs(child, out) }
+          out
+        end
+      end
+
+      module_function
+
+      # Runs the block with guards recorded and read, for the re-walk of `root`. Thread-local, so it holds under a
+      # Ractor worker too.
+      def with_guards(root)
+        previous = Thread.current[STATE_KEY]
+        Thread.current[STATE_KEY] = Walk.new(root, {}, nil, nil, {})
+        yield
+      ensure
+        Thread.current[STATE_KEY] = previous
+      end
+
+      # Runs the block with guards off again: a callee's return summary, memoised for the whole run, must be the one
+      # the file's analysis reads.
+      def without_guards
+        previous = Thread.current[STATE_KEY]
+        Thread.current[STATE_KEY] = nil
+        yield
+      ensure
+        Thread.current[STATE_KEY] = previous
+      end
+
+      def active? = !Thread.current[STATE_KEY].nil?
+
+      # Whether `call.possible-nil-receiver` should withhold its report on `call_node`, whose receiver the file's
+      # analysis types `receiver_type`: true only when the guarded re-walk types that receiver as exactly
+      # `receiver_type` without `nil`. False for a file with no guard-shaped call, while an effect or flow trace
+      # records the walk, and on any failure.
+      def withholds_nil?(call_node, receiver_type, root, scope_index)
+        return false if root.nil? || active?
+        return false if Effects::Collector.active? || FlowTracer.active?
+
+        guarded_index = rewalk(root, scope_index)
+        scope = guarded_index && guarded_index[call_node]
+        return false if scope.nil?
+
+        guarded_type = with_guards(root) { scope.type_of(call_node.receiver) }
+        expected = Narrowing.narrow_non_nil(receiver_type)
+        !expected.equal?(receiver_type) && expected == guarded_type && guarded_type != receiver_type
+      rescue StandardError
+        false
+      end
+
+      # The guarded scope index of `root`, built once per file (the cache holds the last file only), or nil when the
+      # file holds no guard-shaped call.
+      def rewalk(root, scope_index)
+        cached = Thread.current[CACHE_KEY]
+        return cached.last if cached&.first.equal?(root)
+
+        # Cached before the walk, so a re-walk that raises is attempted once per file and then answers nil.
+        Thread.current[CACHE_KEY] = [root, nil]
+        return nil unless guard_shaped_call?(root)
+
+        base = scope_index[root]
+        index = base && with_guards(root) do
+          ScopeIndexer.index(root, default_scope: base.with_isolated_side_tables)
+        end
+        Thread.current[CACHE_KEY] = [root, index]
+        index
+      end
+
+      def guard_shaped_call?(node)
+        if node.is_a?(Prism::CallNode) && PREDICATES.include?(node.name)
+          args = node.arguments&.arguments
+          return true if args&.size == 1 && address(node.receiver, args.first)
+        end
+        node.compact_child_nodes.any? { |child| guard_shaped_call?(child) }
+      end
+
+      # The {KeyExpr} for `node`, or nil unless it is a local / ivar read or a chain of plain, idempotent readers
+      # (no argument, block or `&.`) rooted at one. A literal key is the shape path's business and answers nil.
+      def key_expr(node)
+        case node
+        when Prism::LocalVariableReadNode then KeyExpr.new(path: [[:local, node.name]].freeze)
+        when Prism::InstanceVariableReadNode then KeyExpr.new(path: [[:ivar, node.name]].freeze)
+        when Prism::CallNode
+          return nil unless plain_reader_call?(node)
+
+          inner = key_expr(node.receiver)
+          inner && KeyExpr.new(path: (inner.path + [node.name]).freeze)
+        end
+      end
+
+      def plain_reader_call?(node)
+        node.receiver && node.block.nil? && node.arguments.nil? && !node.safe_navigation? &&
+          READER_NAME.match?(node.name) && !NON_IDEMPOTENT_READERS.include?(node.name)
+      end
+
+      # The receiver half of a guard's address: a local, an instance variable or a constant read.
+      def receiver_ref(node)
+        case node
+        when Prism::LocalVariableReadNode then [:local, node.name]
+        when Prism::InstanceVariableReadNode then [:ivar, node.name]
+        when Prism::ConstantReadNode then [:const, node.name]
+        end
+      end
+
+      # `[receiver_kind, receiver_name, KeyExpr]` for `receiver[key]` / `receiver.key?(key)`, or nil.
+      def address(receiver_node, key_node)
+        receiver = receiver_ref(receiver_node)
+        return nil if receiver.nil?
+
+        key = key_expr(key_node)
+        key && [receiver.first, receiver.last, key]
+      end
+
+      # A closed, non-empty hash shape (or a union of them): the carrier whose computed-key read carries the miss
+      # `nil`. An RBS `Hash[K, V]` read is already nil-free; an open shape or a user class answering `key?` is left
+      # alone.
+      def receiver_type?(type)
+        if type.is_a?(Type::Union)
+          type.members.all? { |member| closed_shape?(member) }
+        else
+          closed_shape?(type)
+        end
+      end
+
+      def closed_shape?(type) = type.is_a?(Type::HashShape) && type.closed? && !type.pairs.empty?
+
+      # The truthy edge of `receiver.key?(key)` with a non-literal key, inside the re-walk: `scope` with the guard
+      # recorded, or nil when the guard does not apply.
+      def record(call_node, scope)
+        walk = Thread.current[STATE_KEY]
+        return nil if walk.nil?
+
+        args = call_node.arguments&.arguments
+        return nil unless args&.size == 1
+
+        guard = address(call_node.receiver, args.first)
+        return nil if guard.nil?
+        return nil unless receiver_type?(scope.type_of(call_node.receiver))
+        return nil unless Scan.eligible?(walk, call_node, guard)
+
+        walk.guard_ends[guard] = call_node.location.end_offset
+        scope.with_indexed_narrowing(*guard, PRESENT)
+      end
+
+      # `type`, the un-narrowed answer of the read `node`, with the miss `nil` dropped when, inside the re-walk, a
+      # guard on the same receiver and structurally the same key holds in `scope`, nothing between the guard and the
+      # read may have changed it ({.intervening?}), and no value of the receiver can be `nil` (the read cannot tell a
+      # value's own `nil` from the miss). Nil when no guard applies or nothing would change.
+      def guarded_read(node, type, scope)
+        walk = Thread.current[STATE_KEY]
+        guard = walk && held_guard(node, scope)
+        return nil if guard.nil? || Scan.intervening?(walk, guard, node)
+
+        receiver_type = scope.type_of(node.receiver)
+        return nil unless receiver_type?(receiver_type) && nil_free_values?(receiver_type)
+
+        narrowed = Narrowing.narrow_non_nil(type)
+        narrowed == type || narrowed.is_a?(Type::Bot) ? nil : narrowed
+      end
+
+      # The guard `scope` holds at the address of the blockless single-key read `node`, or nil.
+      def held_guard(node, scope)
+        return nil if !node.block.nil? || !any_guard?(scope)
+
+        args = node.arguments&.arguments
+        guard = args&.size == 1 ? address(node.receiver, args.first) : nil
+        guard && !scope.indexed_narrowing(*guard).nil? ? guard : nil
+      end
+
+      def nil_free_values?(receiver_type)
+        shapes = receiver_type.is_a?(Type::Union) ? receiver_type.members : [receiver_type]
+        shapes.none? { |shape| shape.pairs.each_value.any? { |value| value_may_be_nil?(value) } }
+      end
+
+      # Whether `scope` holds any guard. Walks the keys without allocating, so the common no-guard case costs a size
+      # check.
+      def any_guard?(scope)
+        table = scope.indexed_narrowings
+        return false if table.empty?
+
+        table.each_key { |key| return true if key.key.is_a?(KeyExpr) }
+        false
+      end
+
+      def value_may_be_nil?(value)
+        case value
+        when Type::Top then true
+        when Type::Constant then value.value.nil?
+        when Type::Nominal then value.class_name == "NilClass"
+        when Type::Union then value.members.any? { |member| value_may_be_nil?(member) }
+        else false
+        end
+      end
+
+      # Drops the guards `call_node` may break. Always-safe (only forgets; never invents).
+      def invalidate_after_call(call_node, scope)
+        return scope unless call_node.is_a?(Prism::CallNode) && any_guard?(scope)
+
+        drop_guards(scope) { |guard| Scan.breaks?(call_node, triple(guard)) }
+      end
+
+      # Drops the guards a write aliases: one whose value holds the guarded receiver or the key's root variable
+      # (`g = h`, `j = k`, `@cache = [MAP]`), since the copy may then be mutated or rebound out of sight.
+      def invalidate_after_write(node, scope)
+        return scope unless Scan::WRITE_NODES.include?(node.class) && any_guard?(scope)
+
+        drop_guards(scope) do |guard|
+          Scan.aliases_guard?(node, triple(guard))
+        end
+      end
+
+      def triple(guard) = [guard.receiver_kind, guard.receiver_name, guard.key]
+
+      def drop_guards(scope)
+        result = scope
+        scope.indexed_narrowings.each_key do |guard|
+          next unless guard.key.is_a?(KeyExpr) && yield(guard)
+
+          result = result.without_indexed_narrowing(guard.receiver_kind, guard.receiver_name, guard.key)
+        end
+        result
+      end
+    end
+  end
+end

data/lib/rigor/inference/macro_block_self_type.rb

@@ -27,11 +27,26 @@ module Rigor
     # parameter-typed block params, declared per-verb argument contracts — are ceiling concerns
     # for later slices.
     module MacroBlockSelfType
+      # A matched entry's effect on the block body: the `self_type` it runs with (nil keeps the entry scope's), the
+      # modules its `Proc#refined` puts in effect (issue #1667), and whether that `self` is itself unknown whatever
+      # the receiver: a `:lexical` entry copies the caller's `self`, which inside a block of unknown `self` is the
+      # enclosing method's guess (issue #1717).
+      Match = Data.define(:self_type, :refinements, :self_unknown) do
+        def initialize(self_type:, refinements:, self_unknown: false) = super
+      end
+
       module_function
 
       # @return the narrowed self-type, or
       #   `nil` when no registered entry matches the call shape.
       def narrow_self_type_for(scope:, call_node:, receiver_type:)
+        match_for(scope: scope, call_node: call_node, receiver_type: receiver_type)&.self_type
+      end
+
+      # The block entry `call_node`'s first matching entry contributes, or nil when none matches; a later entry for the
+      # same call, another plugin's included, is not consulted. A `:lexical` entry (issue #1667) keeps the caller's
+      # `self`, so its `self_type` is the calling scope's.
+      def match_for(scope:, call_node:, receiver_type:)
         return nil if receiver_type.nil?
 
         environment = scope&.environment
@@ -47,19 +62,49 @@ module Rigor
         # by the table key.
         entries = registry.contribution_index.block_entries_for(call_node.name)
         entries.each do |entry|
-          narrowed = entry_self_type_for(entry, singleton_name, nominal_name, call_node,
-                                         scope, environment)
-          return narrowed if narrowed
+          next unless entry_matches?(entry, singleton_name, nominal_name, call_node, scope, environment)
+
+          return entry_match(entry, singleton_name || nominal_name, scope, environment)
         end
         nil
       end
 
-      # The narrowed `self_type` one entry contributes for this receiver, or nil on a miss. Nominal
-      # receivers exist only inside an already-narrowed `instance_eval` body — they can only re-enter a
-      # *named instance*-binding entry (`params`-family nesting on `Nominal[ParamsScope]`).
-      # `:receiver_instance` and `singleton(...)` entries keep their Singleton-only contract.
-      def entry_self_type_for(entry, singleton_name, nominal_name, call_node, scope, environment)
-        return nil if singleton_name.nil? && !entry.named_instance_binding?
+      # The {Match} a matching entry contributes: a `:lexical` one keeps the calling scope's `self`, unknown where the
+      # caller's is.
+      def entry_match(entry, receiver_name, scope, environment)
+        if entry.lexical_self?
+          return Match.new(self_type: scope.self_type, refinements: entry.refinements,
+                           self_unknown: scope.block_self_unknown?)
+        end
+
+        Match.new(self_type: narrowed_self_type(entry, receiver_name, environment), refinements: entry.refinements)
+      end
+
+      # The receiver an implicit-self call is matched on: the scope's `self`, or at the file's top level (no
+      # `self_type`) `Object`, as the value pass types it ({ExpressionTyper#call_receiver_type_for}), so the evaluator,
+      # the indexer and the value pass agree on whether a top-level `build { … }` matches (issue #1667).
+      def implicit_receiver_type(scope)
+        scope.self_type || scope.environment&.nominal_for_name("Object")
+      end
+
+      # Applies `match` to a block body's entry scope: the narrowed `self` (with the #1717 mark `keeps_unknown`
+      # decides) and the declared refinements, appended to those the body already inherits.
+      def apply(block_scope, match, keeps_unknown:)
+        return block_scope if match.nil?
+
+        narrowed = block_scope
+        if match.self_type
+          narrowed = narrowed.with_block_self_type(match.self_type, keeps_unknown: keeps_unknown || match.self_unknown)
+        end
+        narrowed.with_declared_refinements(match.refinements)
+      end
+
+      # Whether one entry matches this receiver. Nominal receivers re-enter a *named instance*-binding entry
+      # (`params`-family nesting on `Nominal[ParamsScope]`), and match a `:lexical` one, whose method is as often an
+      # instance method (`ActiveRecord::Relation#where`) as a class-level one. `:receiver_instance` and
+      # `singleton(...)` entries keep their Singleton-only contract.
+      def entry_matches?(entry, singleton_name, nominal_name, call_node, scope, environment)
+        return false if singleton_name.nil? && !entry.matches_instance_receivers?
 
         method_name = call_node.name
         receiver_name = singleton_name || nominal_name
@@ -73,9 +118,7 @@ module Rigor
           matched = singleton_extends_reach?(receiver_name, entry.receiver_constraint, method_name,
                                              call_node, scope, environment)
         end
-        return nil unless matched
-
-        narrowed_self_type(entry, receiver_name, environment)
+        matched
       end
 
       # The match contract stays narrow: `Singleton[X]` receivers (class-level DSL calls) for every
@@ -113,6 +156,10 @@ module Rigor
       def receiver_class_inherits_from?(class_name, constraint, environment, scope = nil)
         name = class_name.to_s
         return true if name == constraint
+        # Every receiver here is an `Object`: a class's instance or class object, or a module object. A class the
+        # project declares without a superclass reaches `Object` through no recorded edge (issue #1667: a
+        # top-level helper's `receiver_constraint: "Object"`).
+        return true if constraint == "Object"
         return true if rbs_inherits?(name, constraint, environment)
 
         # Source-side ancestry — `class API < Grape::API` lives on the scope's discovery tables, not in

data/lib/rigor/inference/method_dispatcher/alias_strict_nominals.rb

@@ -30,6 +30,42 @@ module Rigor
                                                         "::range" => ["Range"]
                                                       })
         private_constant :ALIAS_STRICT_NOMINALS
+
+        class << self
+          private
+
+          # Checks the param's RBS type against an arg using alias-strict-arm matching. Optional / Union
+          # wrappers are flattened; alias resolution is one level deep (the canonical core aliases all have
+          # non-alias strict arms).
+          def alias_param_accepts?(rbs_type, arg)
+            nominal_names = strict_nominal_names_for(rbs_type)
+            return false if nominal_names.nil? || nominal_names.empty?
+
+            nominal_names.any? do |class_name|
+              result = Type::Combinator.nominal_of(class_name).accepts(arg, mode: :gradual)
+              result.yes? || result.maybe?
+            end
+          end
+
+          # Returns the candidate class names a param's RBS type accepts under alias-resolved strict
+          # matching, or nil when the shape cannot be reduced to a closed set of nominals (e.g. an
+          # Interface or an unrecognised alias).
+          def strict_nominal_names_for(rbs_type)
+            case rbs_type
+            when RBS::Types::ClassInstance
+              [rbs_type.name.to_s.delete_prefix("::")]
+            when RBS::Types::Alias
+              ALIAS_STRICT_NOMINALS[rbs_type.name.to_s]
+            when RBS::Types::Optional
+              strict_nominal_names_for(rbs_type.type)
+            when RBS::Types::Union
+              parts = rbs_type.types.map { |t| strict_nominal_names_for(t) }
+              return nil if parts.any?(&:nil?)
+
+              parts.flatten
+            end
+          end
+        end
       end
     end
   end

data/lib/rigor/inference/method_dispatcher/arithmetic_sequence_elements.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require_relative "../../type"
+require_relative "../../reflection"
+require_relative "integer_step_block_params"
+
+module Rigor
+  module Inference
+    module MethodDispatcher
+      # The elements of the `Enumerator::ArithmeticSequence` that block-less `Integer#step` returns (issue #1794).
+      #
+      # `ruby/rbs` declares `class Enumerator::ArithmeticSequence < Enumerator[Numeric]`, a class with no type
+      # parameter, so every element it yields reads as `Numeric` and `1.step(n, 2).map { |i| i.even? }` reported
+      # `even?` on correct code. The block form's operand rule ({IntegerStepBlockParams.element_type}) decides the
+      # elements here too, and the answer rides on the sequence as a Rigor-private type argument,
+      # `Enumerator::ArithmeticSequence[Integer]`, which RBS has no slot for and {Type::Nominal#erase_to_rbs} drops.
+      #
+      # The two forms differ only past an infinite Float limit: `1.step(Float::INFINITY, 2) { … }` yields Integers
+      # but the sequence yields Floats (`.first(2) #=> [1.0, 3.0]`, through `each` too). A Float limit is a
+      # non-Integer operand, which the rule declines, and an untyped one answers `Dynamic[Numeric]`, so both forms
+      # are sound under the shared rule.
+      #
+      # The type argument is read where the `Numeric` would be: a method the sequence inherits from `Enumerator`
+      # or `Enumerable` (`map`, `select`, `to_a`, `first`, `each_slice`, `lazy`, …) dispatches as
+      # `Enumerator[elem]`, with `self` still the sequence, and the block of the sequence's own `each` yields the
+      # element. The rest of its own surface (`begin`, `end`, `last`, `step`, `size`) keeps its RBS return.
+      module ArithmeticSequenceElements
+        module_function
+
+        CLASS_NAME = "Enumerator::ArithmeticSequence"
+        ELEMENT_OWNERS = %w[::Enumerator ::Enumerable].freeze
+        private_constant :ELEMENT_OWNERS
+
+        # The block-less `Integer#step` return, or nil to leave the call to the RBS tier.
+        def try_dispatch(context)
+          return nil unless context.method_name == :step
+          return nil unless context.block_type.nil?
+          return nil if context.call_node.respond_to?(:block) && context.call_node.block
+
+          element = IntegerStepBlockParams.element_type(context.receiver, context.args)
+          element && Type::Combinator.nominal_of(CLASS_NAME, type_args: [element])
+        end
+
+        # The receiver `method_name` reads the sequence's element through: `Enumerator[elem]` for a method the
+        # sequence inherits from `Enumerator` / `Enumerable` (and, with `block: true`, for the block of its own
+        # `each`), or nil to dispatch on the receiver as it is.
+        def element_receiver(receiver, method_name, environment, block: false)
+          element = element_of(receiver)
+          return nil if element.nil?
+          return nil unless (block && method_name == :each) || inherited_element_method?(method_name, environment)
+
+          Type::Combinator.nominal_of("Enumerator", type_args: [element])
+        end
+
+        def element_of(receiver)
+          return nil unless receiver.is_a?(Type::Nominal) && receiver.class_name == CLASS_NAME
+          return nil unless receiver.type_args.size == 1
+
+          receiver.type_args.first
+        end
+
+        def inherited_element_method?(method_name, environment)
+          definition = Rigor::Reflection.instance_method_definition(CLASS_NAME, method_name, environment: environment)
+          return false if definition.nil?
+
+          ELEMENT_OWNERS.include?(definition.defined_in.to_s)
+        rescue StandardError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/method_dispatcher/imprecise_argument.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require_relative "../../type"
+
+module Rigor
+  module Inference
+    module MethodDispatcher
+      # Which arguments `OverloadSelector` may not discriminate on. Issue #1021 — the strict and alias passes must not
+      # key on an argument whose type cannot rule an overload out: the bare untyped carrier, or a union with an untyped
+      # member. That member may reach any overload at runtime, so a strict match is decided by the union's other
+      # members alone — `Dynamic[top] | nil` pinned `Regexp#match?(nil) -> false` and typed a live predicate as the
+      # literal `false`. The gradual pass still accepts against the whole union, so `Dynamic[top] | nil` keeps both
+      # `match?` overloads and the #521 join answers `Dynamic[bool]`.
+      #
+      # A `Dynamic` with a concrete static facet stays out: its facet discriminates. One whose facet itself holds the
+      # untyped carrier does not (#1675): `Array[untyped] | Array[Integer]` indexed at an untyped position answers
+      # `Dynamic[Array[untyped] | untyped | nil] | Dynamic[Array[Integer] | Integer | nil]`, and read as precise,
+      # `0 + @data[i]` took `(Integer) -> Integer`.
+      module ImpreciseArgument
+        module_function
+
+        # The literal `untyped` carrier, `Dynamic[top]`.
+        def untyped?(type) = type.is_a?(Type::Dynamic) && type.static_facet.is_a?(Type::Top)
+
+        # The untyped carrier itself, or a union or `Dynamic` holding it at any depth.
+        def imprecise?(type)
+          case type
+          when Type::Dynamic then type.static_facet.is_a?(Type::Top) || imprecise?(type.static_facet)
+          when Type::Union then type.members.any? { |member| imprecise?(member) }
+          else false
+          end
+        end
+
+        # Whether the call holds an imprecise argument: a positional one, or (#1737) a value of the call's keyword
+        # hash when `keywords_last`. An untyped keyword value reaches every overload's keyword just as an untyped
+        # positional reaches every positional parameter, so `m(1, mode: untyped)` must not pick `mode: Symbol` over
+        # `mode: Integer` by declaration order.
+        def any_in?(arg_types, keywords_last)
+          return true if arg_types.any? { |arg| imprecise?(arg) }
+          return false unless keywords_last
+
+          keywords = arg_types.last
+          keywords.is_a?(Type::HashShape) && keywords.pairs.each_value.any? { |value| imprecise?(value) }
+        end
+
+        # Issue #1675 — the argument list with each imprecise argument replaced by the bare untyped carrier, or nil
+        # when no argument holds the carrier beside something precise. Through its untyped part such an argument
+        # reaches every overload the bare carrier reaches, including one a precise member rules out of the
+        # whole-argument match: `0 + (1 | untyped)` kept only `(Integer) -> Integer`, because `(Float)` refuses the
+        # `1`, and typed the sum `Integer` where the untyped part may be a `Float` or a project `Numeric`.
+        def untyped_stand_ins(arg_types)
+          return nil unless arg_types.any? { |arg| !untyped?(arg) && imprecise?(arg) }
+
+          arg_types.map { |arg| imprecise?(arg) ? Type::Combinator.untyped : arg }
+        end
+
+        # `matches` joined by the overloads the selector's `shared` bundle reaches with its arguments' untyped parts
+        # standing in for them ({.untyped_stand_ins}), which the block selects for that bundle.
+        def with_stand_ins(matches, shared)
+          stand_ins = untyped_stand_ins(shared[:arg_types])
+          return matches if stand_ins.nil?
+
+          (matches + yield(shared.merge(arg_types: stand_ins, positional_arguments: nil))).uniq
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/method_dispatcher/integer_step_block_params.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require_relative "../../type"
+
+module Rigor
+  module Inference
+    module MethodDispatcher
+      # `Integer#step`'s block parameter, reached through {IteratorDispatch.block_param_types} (issue #1783).
+      #
+      # `ruby/rbs` declares every `Numeric#step` overload with a `{ (Numeric) -> void }` block and `Integer` does
+      # not redeclare `step`, so `1.step(n, 2) { |i| i.even? }` reported `even?` on correct code. The block form
+      # yields Integer only while the limit and the step are Integer too: a Float step or a finite Float limit
+      # makes CRuby's `ruby_float_step` yield Floats (`1.step(10, 0.5)`, `1.step(10.0)`; an infinite limit with
+      # an Integer step still yields Integers, which this rule leaves on the RBS binding), and a Rational step yields
+      # Rationals after the first value. So:
+      #
+      # - every operand provably Integer (an absent one is the Integer default; a nil limit means "no limit")
+      #   binds `Integer`;
+      # - an operand that is `Dynamic` (an untyped parameter, `1.step(n, 2)`) could be either, so the binding is
+      #   `Dynamic[Numeric]`: Integer is unsound for `n = 0.5`, and the RBS `Numeric` reports `even?` on correct
+      #   Integer code, so the answer that holds for both declines the check;
+      # - anything else (a Float, a Rational, a union) falls through to the RBS `Numeric` binding, which a Float
+      #   or Rational receiver also keeps.
+      #
+      # The keyword forms (`step(by: 2, to: 10)`, `step(10, by: 2)`) arrive as a trailing hash shape.
+      module IntegerStepBlockParams
+        module_function
+
+        KEYWORD_ROLES = { to: :limit, by: :step }.freeze
+        private_constant :KEYWORD_ROLES
+
+        # @return the block-param types, or nil to fall through to the RBS tier.
+        def block_param_types(receiver, args)
+          element = element_type(receiver, args)
+          element && [element]
+        end
+
+        # The type of every value the call yields, or nil when the rule does not decide it. The block-less form
+        # shares it: the `Enumerator::ArithmeticSequence` it returns yields the same values as the block would,
+        # except past an infinite Float limit, which this rule already declines ({ArithmeticSequenceElements}).
+        def element_type(receiver, args)
+          return nil unless IteratorDispatch.integer_rooted?(receiver)
+
+          operands = operands(args)
+          return nil if operands.nil?
+
+          verdicts = operands.map { |role, type| verdict(role, type) }
+          return nil if verdicts.include?(:decline)
+          return Type::Combinator.nominal_of("Integer") if verdicts.all?(:integer)
+
+          Type::Combinator.dynamic(Type::Combinator.nominal_of("Numeric"))
+        end
+
+        # The `[role, type]` pairs of the call's limit and step operands, or nil when the argument list is not
+        # one of `step`'s shapes.
+        def operands(args)
+          positional = args
+          keywords = {}
+          if args.last.is_a?(Type::HashShape)
+            positional = args[0...-1]
+            keywords = args.last.pairs
+            return nil unless keywords.keys.all? { |key| KEYWORD_ROLES.key?(key) }
+          end
+          return nil if positional.size > 2
+
+          pairs = positional.zip(%i[limit step]).map { |type, role| [role, type] }
+          keywords.each { |key, type| pairs << [KEYWORD_ROLES.fetch(key), type] }
+          pairs
+        end
+
+        def verdict(role, type)
+          return :integer if IteratorDispatch.integer_rooted?(type)
+          return :integer if role == :limit && type.is_a?(Type::Constant) && type.value.nil?
+          return :unknown if type.is_a?(Type::Dynamic)
+
+          :decline
+        end
+      end
+    end
+  end
+end