rigortype 0.4.4 → 0.4.6

data/lib/rigor/inference/method_dispatcher/constant_folding.rb

@@ -190,6 +190,44 @@ module Rigor
 
         STRING_FOLD_BYTE_LIMIT = 4096
 
+        # #2115 — the numeric twin of `STRING_FOLD_BYTE_LIMIT`. A folded Integer (and each Integer part of a
+        # folded Rational / Complex) is at most this many bits, the largest bit length whose decimal
+        # rendering still fits in `STRING_FOLD_BYTE_LIMIT` digits: `2 ** 13_605` folds, `2 ** 13_606`
+        # (bit length 13_607) does not. Computing `2 ** 100_000_000` takes Ruby milliseconds, but
+        # rendering it in decimal — which describing, sorting and printing the `Constant` does — takes
+        # minutes. `**` / `pow` / `<<` / `>>` also check their operands before invoking, so the big value
+        # is never computed.
+        INTEGER_FOLD_BIT_LIMIT = (STRING_FOLD_BYTE_LIMIT * Math.log2(10)).floor
+
+        # #2115 — the most elements a fold walks out of a `Constant<Range>` receiver. A method that
+        # enumerates the range (`to_a`, `to_set`, `all?`, `include?` on a String range, …) declines when
+        # the range holds more elements, or is endless (`1..Float::INFINITY`); a method that reads only
+        # the endpoints (`RANGE_ENDPOINT_METHODS`) still folds whatever the range's size.
+        RANGE_ENUMERATION_LIMIT = 1024
+
+        # The `Range` methods whose CRuby body reads the endpoints without walking the elements, so they
+        # stay foldable on a range past `RANGE_ENUMERATION_LIMIT`. `include?` / `member?` join them on a
+        # numeric range, where CRuby answers them by `cover?`.
+        RANGE_ENDPOINT_METHODS = Set[
+          :begin, :end, :exclude_end?, :cover?, :===, :size, :to_s, :inspect, :==, :eql?, :hash
+        ].freeze
+        RANGE_COVER_METHODS = Set[:include?, :member?].freeze
+        private_constant :RANGE_ENDPOINT_METHODS, :RANGE_COVER_METHODS
+
+        # A result `INTEGER_FOLD_BIT_LIMIT` keeps from becoming a `Constant`: the fold still knows its class,
+        # and answers `Nominal[class_name]` for it. Falling through to RBS instead would read `Integer#**`'s
+        # declared `Numeric`, on which `(2 ** 20_000).even?` is an undefined method.
+        WidenedResult = Data.define(:class_name)
+
+        # #2125 — a String result past `STRING_FOLD_BYTE_LIMIT`, or an operand that would build one. Unlike a
+        # `WidenedResult` it declines the WHOLE fold, every other member of a union receiver included: dropping
+        # only the oversized member would answer the rest (`(c ? "a" : big) * 2` read `"aa"`). The next tier then
+        # answers the call — `LiteralStringFolding`'s `literal-string`, or RBS's `String`, never less than the
+        # `Nominal[String]` the fold could have widened to.
+        OversizedString = Data.define
+        OVERSIZED_STRING = [OversizedString.new].freeze
+        private_constant :OversizedString, :OVERSIZED_STRING
+
         # Input cartesian product hard cap. Keeps fold cost bounded even when the receiver and argument are
         # both `Union[Constant…]`. 5 × 5 = 25 inputs is permitted; 6 × 6 = 36 is not. The user-facing payoff
         # (a precise small enum) drops off fast past this range and CRuby method invocation cost adds up.
@@ -302,6 +340,7 @@ module Rigor
           arg = args.first
           ruby_arg = format_argument_value(arg)
           return nil if ruby_arg.nil?
+          return nil if format_blow_up?(receiver.value, ruby_arg)
 
           result = receiver.value % ruby_arg
           return nil unless foldable_constant_value?(result)
@@ -649,45 +688,41 @@ module Rigor
         def range_constant_unary(range, method_name)
           case method_name
           when :to_a, :entries then range_to_a_tuple(range)
-          when :first, :min then range_endpoint_constant(range, :first)
-          when :last, :max then range_endpoint_constant(range, :last)
-          when :count, :size, :length then Type::Combinator.constant_of(range.to_a.size)
-          when :minmax then range_minmax_tuple(range)
+          # #2115 — `Range#min` / `#max` / `#minmax` / `#size` are O(1) on Integer endpoints in CRuby, so
+          # none of these materialises the range. The no-arg `first` / `last` read the endpoints, not the
+          # elements: `first` is `begin` and `last` is `end` whether the range is empty, reversed or
+          # exclusive (`(5..1).first` is 5, `(1...10).last` is 10). Only `min` / `max` depend on emptiness
+          # and exclusivity (`(5..1).min` is nil, `(1...10).max` is 9).
+          when :first then Type::Combinator.constant_of(range.begin)
+          when :last then Type::Combinator.constant_of(range.end)
+          when :min then Type::Combinator.constant_of(range.min)
+          when :max then Type::Combinator.constant_of(range.max)
+          when :count, :size, :length then Type::Combinator.constant_of(range.size)
+          when :minmax then Type::Combinator.tuple_of(*range.minmax.map { |v| Type::Combinator.constant_of(v) })
           # `range.sum` is closed-form (Gauss) for an integer range, so a huge range still costs O(1) and
-          # yields a single Integer — no materialisation, no cap needed. Endless ranges are already excluded
-          # by the Integer-endpoint guard in the caller.
-          when :sum then Type::Combinator.constant_of(range.sum)
+          # yields a single Integer — no materialisation; only `INTEGER_FOLD_BIT_LIMIT` applies. Endless
+          # ranges are already excluded by the Integer-endpoint guard in the caller.
+          when :sum then range_sum_constant(range)
           end
         end
 
-        def range_to_a_tuple(range)
-          values = range.to_a
-          return Type::Combinator.tuple_of if values.empty?
-          return nil if values.size > RANGE_TO_A_LIMIT
+        # The Gauss sum of a range of large endpoints can still pass `INTEGER_FOLD_BIT_LIMIT`; it is then
+        # an `Integer` (both endpoints are).
+        def range_sum_constant(range)
+          sum = range.sum
+          return Type::Combinator.nominal_of("Integer") if oversized_number?(sum)
 
-          Type::Combinator.tuple_of(*values.map { |v| Type::Combinator.constant_of(v) })
+          Type::Combinator.constant_of(sum)
         end
 
-        def range_endpoint_constant(range, edge)
-          values = range.to_a
-          return Type::Combinator.constant_of(nil) if values.empty?
-
-          Type::Combinator.constant_of(edge == :first ? values.first : values.last)
-        end
+        def range_to_a_tuple(range)
+          # `Range#size` is O(1) on Integer endpoints: check the cardinality before materialising.
+          return nil if range.size > RANGE_TO_A_LIMIT
 
-        def range_minmax_tuple(range)
           values = range.to_a
-          if values.empty?
-            return Type::Combinator.tuple_of(
-              Type::Combinator.constant_of(nil),
-              Type::Combinator.constant_of(nil)
-            )
-          end
+          return Type::Combinator.tuple_of if values.empty?
 
-          Type::Combinator.tuple_of(
-            Type::Combinator.constant_of(values.first),
-            Type::Combinator.constant_of(values.last)
-          )
+          Type::Combinator.tuple_of(*values.map { |v| Type::Combinator.constant_of(v) })
         end
 
         # `(1..10).first(3)` / `.take(3)` / `.last(3)` — the 1-arg head / tail forms. `first`/`last` already
@@ -1175,9 +1210,23 @@ module Rigor
         # "Integer-ness" was already implied by the inputs (so the widening fallback only fires for
         # arithmetic over integers).
         def build_constant_type(values, source: nil)
+          return nil if values.any?(OversizedString)
+
+          widened, values = values.partition { |value| value.is_a?(WidenedResult) }
+          return build_scalar_constant_type(values, source) if widened.empty?
+
+          nominals = widened.map(&:class_name).uniq.map { |name| Type::Combinator.nominal_of(name) }
+          return Type::Combinator.union(*nominals) if values.empty?
+
+          constants = build_scalar_constant_type(values, source)
+          constants && Type::Combinator.union(constants, *nominals)
+        end
+
+        def build_scalar_constant_type(values, source)
           return nil if values.empty?
 
-          unique = values.uniq
+          # #1513 — keyed so the possible results `0.0` and `-0.0` stay two members, as `Constant#==` keeps them.
+          unique = values.uniq { |value| Type::Constant.value_key(value) }
           return collapse_constants(unique) if unique.size <= UNION_FOLD_OUTPUT_LIMIT
 
           widen_to_integer_range(unique, source) ||
@@ -1607,9 +1656,13 @@ module Rigor
         # `flat_map`.
         def invoke_binary(receiver_value, method_name, arg_value)
           return nil unless safe?(receiver_value, method_name, arg_value)
+          return OVERSIZED_STRING if string_blow_up?(receiver_value, method_name, arg_value)
+          return nil if range_enumeration_blow_up?(receiver_value, method_name)
 
-          result = receiver_value.public_send(method_name, arg_value)
-          foldable_constant_value?(result) ? [result] : nil
+          widened = numeric_blow_up_class(receiver_value, method_name, arg_value)
+          return [WidenedResult.new(widened)] if widened
+
+          fold_result(receiver_value.public_send(method_name, arg_value))
         rescue StandardError
           nil
         end
@@ -1619,9 +1672,9 @@ module Rigor
         # `false`/`nil` folds.
         def invoke_ternary(receiver_value, method_name, av0, av1)
           return nil unless ternary_method_allowed?(receiver_value, method_name)
+          return OVERSIZED_STRING if string_ternary_blow_up?(receiver_value, method_name, av0, av1)
 
-          result = receiver_value.public_send(method_name, av0, av1)
-          foldable_constant_value?(result) ? [result] : nil
+          fold_result(receiver_value.public_send(method_name, av0, av1))
         rescue StandardError
           nil
         end
@@ -1629,14 +1682,23 @@ module Rigor
         # Returns `[value]` on success, `nil` to signal "skip". See `invoke_binary` for why we wrap.
         def invoke_unary(receiver_value, method_name)
           return nil unless unary_safe?(receiver_value, method_name)
-          return nil if string_unary_blow_up?(receiver_value, method_name)
+          return OVERSIZED_STRING if string_unary_blow_up?(receiver_value, method_name)
+          return nil if range_enumeration_blow_up?(receiver_value, method_name)
 
-          result = receiver_value.public_send(method_name)
-          foldable_constant_value?(result) ? [result] : nil
+          fold_result(receiver_value.public_send(method_name))
         rescue StandardError
           nil
         end
 
+        # `[result]` for a foldable value, `[WidenedResult]` for a number past `INTEGER_FOLD_BIT_LIMIT`,
+        # `OVERSIZED_STRING` for a String past `STRING_FOLD_BYTE_LIMIT`, nil for anything else.
+        def fold_result(result)
+          return [WidenedResult.new(result.class.name)] if oversized_number?(result)
+          return OVERSIZED_STRING if oversized_string?(result)
+
+          foldable_constant_value?(result) ? [result] : nil
+        end
+
         def unary_safe?(receiver_value, method_name)
           return true if unary_ops_for(receiver_value).include?(method_name)
 
@@ -1775,7 +1837,54 @@ module Rigor
           # with the widened class.
           return false if value.is_a?(Float) && value.nan?
           return false if value.is_a?(Complex) && complex_nan?(value)
+          return false if oversized_number?(value)
+          return false if oversized_string?(value)
+
+          true
+        end
+
+        # #2125 — the result gate every String-producing fold passes through, the String twin of
+        # `oversized_number?`. The operand prechecks (`string_blow_up?`, `string_ternary_blow_up?`,
+        # `format_blow_up?`) keep the costly cases from being built at all; this catches the rest after the
+        # fact (`tr` into multibyte characters, `dump`, `Integer#to_s(2)`, whose receiver
+        # `INTEGER_FOLD_BIT_LIMIT` already bounds, so its rendering is at most 13 KB).
+        def oversized_string?(value)
+          value.is_a?(String) && value.bytesize > STRING_FOLD_BYTE_LIMIT
+        end
+
+        # True when an Integer, or an Integer part of a Rational / Complex, is past `INTEGER_FOLD_BIT_LIMIT`.
+        def oversized_number?(value)
+          case value
+          when Integer then value.bit_length > INTEGER_FOLD_BIT_LIMIT
+          when Rational then oversized_number?(value.numerator) || oversized_number?(value.denominator)
+          when Complex then oversized_number?(value.real) || oversized_number?(value.imaginary)
+          else false
+          end
+        end
+
+        # #2115 — true when `receiver_value` is a `Range` the method would walk element by element and the
+        # range holds more than `RANGE_ENUMERATION_LIMIT` elements (an endless one never stops).
+        def range_enumeration_blow_up?(receiver_value, method_name)
+          return false unless receiver_value.is_a?(Range)
+          return false if RANGE_ENDPOINT_METHODS.include?(method_name)
+          return false if RANGE_COVER_METHODS.include?(method_name) && numeric_range?(receiver_value)
+
+          !range_within_enumeration_budget?(receiver_value)
+        end
+
+        def numeric_range?(range)
+          range.begin.is_a?(Numeric) || range.end.is_a?(Numeric)
+        end
 
+        # Takes at most `RANGE_ENUMERATION_LIMIT + 1` elements (`Range#first(n)` stops there, endless or
+        # not). A range that cannot iterate at all (a Float or Time begin) raises, and so does every
+        # enumerating method on it before doing any work, so it counts as within budget: the invoke's own
+        # rescue declines an enumerating fold, and `(t0..t1).include?(t)`, which CRuby answers by `cover?`,
+        # keeps folding. A beginless range raises `RangeError` here, which the invoke's own rescue turns into
+        # a declined fold, as the enumerating method itself would raise.
+        def range_within_enumeration_budget?(range)
+          range.first(RANGE_ENUMERATION_LIMIT + 1).size <= RANGE_ENUMERATION_LIMIT
+        rescue TypeError
           true
         end
 
@@ -1791,11 +1900,62 @@ module Rigor
                     catalog_allows?(receiver_value, method_name)
           return false unless allowed
           return false if integer_division_by_zero?(receiver_value, method_name, arg_value)
-          return false if string_blow_up?(receiver_value, method_name, arg_value)
 
           true
         end
 
+        # #2115 — the result's class name when `**` / `pow` / `<<` / `>>` would produce a number past
+        # `INTEGER_FOLD_BIT_LIMIT`, read from the operands so the huge value is never computed; nil
+        # otherwise. `fold_result` applies the same bound to every other result after the fact.
+        def numeric_blow_up_class(receiver_value, method_name, arg_value)
+          return nil unless arg_value.is_a?(Integer)
+
+          case method_name
+          when :**, :pow then power_blow_up_class(receiver_value, arg_value)
+          when :<<, :>> then "Integer" if shift_blow_up?(receiver_value, method_name, arg_value)
+          end
+        end
+
+        # An Integer base to a negative power is a Rational (`2 ** -3 == (1/8)`); a Rational or Complex
+        # base keeps its class.
+        def power_blow_up_class(base, exponent)
+          return nil unless power_blow_up?(base, exponent)
+          return base.class.name unless base.is_a?(Integer)
+
+          exponent.negative? ? "Rational" : "Integer"
+        end
+
+        # A lower bound on the result's bit length is `floor(log2 |base|) * |exponent|`; past the limit the
+        # result is declined anyway. A Float base (or Float part) stays in Float arithmetic and never grows.
+        def power_blow_up?(base, exponent)
+          bits = power_base_bits(base)
+          !bits.nil? && bits * exponent.abs > INTEGER_FOLD_BIT_LIMIT
+        end
+
+        # `floor(log2 |base|)` for an Integer, the larger of its terms' for a Rational. A Complex part
+        # counts one bit more: `(1+1i) ** n` grows although neither part is past 1.
+        def power_base_bits(base)
+          case base
+          when Integer then base.abs.bit_length - 1
+          when Rational then [base.numerator.abs.bit_length, base.denominator.bit_length].max - 1
+          when Complex then complex_power_base_bits(base)
+          end
+        end
+
+        def complex_power_base_bits(base)
+          parts = [base.real, base.imaginary]
+          return nil unless parts.all? { |part| part.is_a?(Integer) || part.is_a?(Rational) }
+
+          parts.map { |part| power_base_bits(part) + 1 }.max
+        end
+
+        def shift_blow_up?(receiver_value, method_name, arg_value)
+          return false unless receiver_value.is_a?(Integer) && !receiver_value.zero?
+
+          shift = method_name == :<< ? arg_value : -arg_value
+          receiver_value.bit_length + shift > INTEGER_FOLD_BIT_LIMIT
+        end
+
         def ops_for(receiver_value)
           case receiver_value
           when Integer, Float then NUMERIC_BINARY
@@ -1825,16 +1985,91 @@ module Rigor
           case method_name
           when :+ then string_concat_blow_up?(receiver_value, arg_value)
           when :* then string_repeat_blow_up?(receiver_value, arg_value)
+          when :% then format_blow_up?(receiver_value, arg_value)
           when :center, :ljust, :rjust then string_pad_blow_up?(arg_value)
           else false
           end
         end
 
+        # #2125 — the two-argument String folds that can grow past the input: the padded `center` / `ljust`
+        # / `rjust` (width, pad) and `sub` / `gsub` (pattern, replacement).
+        def string_ternary_blow_up?(receiver_value, method_name, av0, av1)
+          return false unless receiver_value.is_a?(String)
+
+          case method_name
+          when :center, :ljust, :rjust then string_pad_blow_up?(av0)
+          when :sub, :gsub then string_substitution_blow_up?(receiver_value, method_name, av1)
+          else false
+          end
+        end
+
+        # An upper bound on a `sub` / `gsub` result with a String replacement: `gsub` matches at most once per
+        # position plus once at the end, and each replacement is the replacement's bytes plus, for every
+        # backslash in it (`\0`, `\1`, `\k<name>`, `` \` ``, `\'`), at most the receiver's bytes again.
+        def string_substitution_blow_up?(receiver_value, method_name, replacement)
+          return false unless replacement.is_a?(String)
+
+          size = receiver_value.bytesize
+          matches = method_name == :gsub ? size + 1 : 1
+          per_match = replacement.bytesize + (replacement.count("\\") * size)
+          size + (matches * per_match) > STRING_FOLD_BYTE_LIMIT
+        end
+
+        # #2125 — `String#%` / `Kernel#format` pad to a field width and render to a precision the format
+        # string spells (`"%02000000000d"`, `"%.100000f"`) or an argument supplies (`"%*d" % [n, 1]`).
+        # Formatting builds the whole padded string before any result gate can look at it — two billion
+        # bytes took 13 s and 4 GB — so the numbers are read from the directives first. A `*` width counts
+        # every Integer argument as a possible width, and a `%%` escape matches as a whole, carrying no digits.
+        FORMAT_DIRECTIVE = /%%|%(?:<[^>]*>|\{[^}]*\}|[-+ 0#*$.\d])*/
+        private_constant :FORMAT_DIRECTIVE
+
+        def format_blow_up?(format_string, arguments)
+          star = false
+          format_string.scan(FORMAT_DIRECTIVE) do |directive|
+            spec = directive.gsub(/<[^>]*>|\{[^}]*\}|\d+\$/, "")
+            return true if spec.scan(/\d+/).any? { |digits| digits.to_i > STRING_FOLD_BYTE_LIMIT }
+
+            star ||= spec.include?("*")
+          end
+          star && format_argument_values(arguments).any? do |value|
+            width = integer_operand(value)
+            !width.nil? && width.abs > STRING_FOLD_BYTE_LIMIT
+          end
+        end
+
+        def format_argument_values(arguments)
+          case arguments
+          when Hash then arguments.values
+          when Array then arguments
+          else [arguments]
+          end
+        end
+
         # `"x".center(width)` / `#ljust` / `#rjust` produce a string of `max(width, len)` characters. A
         # literal `width` far larger than the receiver would materialise a huge Constant; cap it at the same
         # byte limit the concat / repeat paths use.
         def string_pad_blow_up?(arg_value)
-          arg_value.is_a?(Integer) && arg_value > STRING_FOLD_BYTE_LIMIT
+          width = integer_operand(arg_value)
+          !width.nil? && width > STRING_FOLD_BYTE_LIMIT
+        end
+
+        # The Integer a width or count operand stands for. Ruby converts a Float or Rational one with `NUM2LONG`
+        # (`"x" * 2.9` is `"xx"`, `"x".ljust(2e9)` pads to two billion), and a Complex one whose imaginary part is an
+        # exact zero through its real part (`"x" * Complex(3, 0)` is `"xxx"`; `Complex(3, 0.0)` raises), so the
+        # prechecks read it the same way. Those are every Numeric class a `Constant` carries. A non-finite Float
+        # raises in Ruby, and any other operand is left to the call, so both answer nil.
+        def integer_operand(value)
+          case value
+          when Integer then value
+          when Float then value.finite? ? value.to_i : nil
+          when Rational then value.to_i
+          when Complex then exact_real_operand(value)
+          end
+        end
+
+        def exact_real_operand(value)
+          imaginary = value.imaginary
+          imaginary.is_a?(Integer) && imaginary.zero? ? integer_operand(value.real) : nil
         end
 
         def string_concat_blow_up?(receiver_value, arg_value)
@@ -1843,10 +2078,11 @@ module Rigor
         end
 
         def string_repeat_blow_up?(receiver_value, arg_value)
-          return false unless arg_value.is_a?(Integer)
-          return true if arg_value.negative?
+          # A negative count raises (`ArgumentError`), so the call itself skips that member, as any raising one is.
+          count = integer_operand(arg_value)
+          return false if count.nil? || count.negative?
 
-          receiver_value.bytesize * arg_value > STRING_FOLD_BYTE_LIMIT
+          receiver_value.bytesize * count > STRING_FOLD_BYTE_LIMIT
         end
       end
     end

data/lib/rigor/inference/method_dispatcher/kernel_dispatch.rb

@@ -191,12 +191,16 @@ module Rigor
         # Runs the real `Kernel#format` when everything is value-pinned. A malformed directive or an
         # argument-count mismatch raises at fold time; the handler declines so the literal-string
         # lift (or the RBS `String` envelope) answers instead. Results larger than the shared
-        # `ConstantFolding::STRING_FOLD_BYTE_LIMIT` decline too, keeping the carrier-size convention.
+        # `ConstantFolding::STRING_FOLD_BYTE_LIMIT` decline too, keeping the carrier-size convention,
+        # and a field width or precision past it declines before the string is built (#2125).
         def fold_format_constant(args)
           return nil unless args.all?(Type::Constant)
           return nil unless args.first.value.is_a?(String)
 
-          result = format(args.first.value, *args.drop(1).map(&:value))
+          values = args.drop(1).map(&:value)
+          return nil if ConstantFolding.format_blow_up?(args.first.value, values)
+
+          result = format(args.first.value, *values)
           return nil if result.bytesize > ConstantFolding::STRING_FOLD_BYTE_LIMIT
 
           Type::Combinator.constant_of(result)

data/lib/rigor/inference/method_dispatcher/rbs_dispatch.rb

@@ -526,12 +526,60 @@ module Rigor
             registry = environment&.plugin_registry
             each_source_ancestor_candidate(scope, class_name) do |candidate|
               return nil if scope.discovered_method?(candidate, method_name, kind)
-              return candidate if ALLOWED_RBS_COMPLETE_ANCESTORS.include?(candidate) ||
-                                  registry&.rbs_complete_ancestor?(candidate)
+              next unless ALLOWED_RBS_COMPLETE_ANCESTORS.include?(candidate) ||
+                          registry&.rbs_complete_ancestor?(candidate)
+
+              return shadowed_in_ruby_order?(scope, class_name, kind, method_name, candidate) ? nil : candidate
             end
             nil
           end
 
+          # Issue #1572 — the walk above is breadth-first, so it reaches the superclass before a module an included
+          # module includes, which Ruby's order puts ahead of it (`class P < Rigor::Plugin::Base; include A` with `A`
+          # including `M` calls `M#prepare`, not `Base#prepare`), and it passes over RBS-known modules. True when the
+          # bridged `ancestor` is not what Ruby calls: on `class_name`'s {Scope::ResolutionChain} in Ruby's order, a
+          # project entry ahead of it records the name ({#project_records_name?}), an external entry ahead of it is a
+          # module RBS knows and declares the name in, or the chain does not hold it. An RBS-unknown external ahead is
+          # passed over, as the breadth-first walk always did. An unsettled chain withholds too: a mixin edge the
+          # tables cannot place (a receiver-form `Demo.include(M)` after the body, an edge in a conditional, a block or
+          # a hook) may put a definer ahead of the ancestor.
+          def shadowed_in_ruby_order?(scope, class_name, kind, method_name, ancestor)
+            chain = Scope::ResolutionChain.for(scope, class_name.to_s, kind, :methods)
+            return true if chain.unsettled?
+
+            entries = chain.entries
+            stop = entries.index do |entry|
+              entry.external? ? entry.candidates.include?(ancestor) : entry.name == ancestor
+            end
+            return true if stop.nil?
+
+            entries.first(stop).any? do |entry|
+              if entry.external?
+                rbs_declares_ahead?(scope, entry, method_name)
+              else
+                project_records_name?(scope, entry.name, method_name, entry.side)
+              end
+            end
+          end
+
+          # Whether the project entry `owner` holds the name on `kind`'s side. `discovered_methods` carries the
+          # `attr_*` and `define_method` rows project-wide, but at dispatch it has no row for a `def` in a module
+          # declared in another file, so a `def` is also asked of the project-wide def tables. ADR-46:
+          # `user_def_for` / `singleton_def_for` file the method edge, positive or negative, so a file that adds or
+          # removes the `def` on an entry ahead of the ancestor re-checks the call.
+          def project_records_name?(scope, owner, method_name, kind)
+            return true if scope.discovered_method?(owner, method_name, kind)
+
+            return !scope.singleton_def_for(owner, method_name).nil? if kind == :singleton
+
+            !scope.user_def_for(owner, method_name).nil?
+          end
+
+          def rbs_declares_ahead?(scope, entry, method_name)
+            entry.candidates.any? { |candidate| Rigor::Reflection.rbs_class_known?(candidate, scope: scope) } &&
+              !Scope::ResolutionChain::Relevance.external_lacks_on?(scope, entry.candidates, entry.side, method_name)
+          end
+
           # Issue #527 slice 1 — the RBS instance definition a Ruby-source class inherits from a CORE or
           # STDLIB ancestor, or nil. `Oj::EasyHash < Hash` answering `Dynamic[top]` to `has_key?` while
           # `{}.has_key?` folds was the largest single opacity family in the 2026-09-01 corpus sweep.

data/lib/rigor/inference/method_dispatcher/set_folding.rb

@@ -35,43 +35,76 @@ module Rigor
           return nil unless SingletonFolding.receiver?(receiver, "Set")
 
           case method_name
-          when :[] then fold_bracket(args)
-          when :new then fold_new(args)
+          when :[] then fold_bracket(args, context.call_node)
+          when :new then fold_new(args, context.call_node, context.block_type)
           end
         end
 
-        # `Set["a", "b", "c"]` — all positional args must be Constant.
-        def fold_bracket(args)
-          values = args.map do |a|
-            return nil unless a.is_a?(Type::Constant)
+        # `Set["a", "b", "c"]` — all positional args must be Constant to fold to a value. Otherwise the
+        # element type is the union of the arguments, widened off their literal pins (#2278).
+        def fold_bracket(args, call_node = nil)
+          return nil if splatted?(call_node)
 
-            a.value
-          end
+          return Type::Combinator.constant_of(::Set.new(args.map(&:value))) if args.all?(Type::Constant)
 
-          Type::Combinator.constant_of(::Set.new(values))
+          typed_set(args)
         rescue StandardError
           nil
         end
 
-        # `Set.new` / `Set.new(tuple_of_constants)`.
-        def fold_new(args)
+        # `Set.new` / `Set.new(enum)`. A call with a block declines: the block maps each element
+        # (`Set.new([1, 2], &:to_s)` holds `"1"` and `"2"`), so the argument's elements are not the set's.
+        def fold_new(args, call_node = nil, block_type = nil)
+          return nil if block_type || block_given?(call_node) || splatted?(call_node)
           return Type::Combinator.constant_of(::Set.new) if args.empty?
           return nil if args.size > 1
 
           arg = args.first
-          values = case arg
-                   when Type::Tuple
-                     return nil unless arg.elements.all?(Type::Constant)
-
-                     arg.elements.map(&:value)
-                   else
-                     return nil
-                   end
+          return fold_tuple(arg) if arg.is_a?(Type::Tuple)
 
-          Type::Combinator.constant_of(::Set.new(values))
+          element = nominal_element(arg)
+          element ? typed_set([element]) : nil
         rescue StandardError
           nil
         end
+
+        def fold_tuple(tuple)
+          if tuple.elements.all?(Type::Constant)
+            return Type::Combinator.constant_of(::Set.new(tuple.elements.map(&:value)))
+          end
+
+          typed_set(tuple.elements)
+        end
+
+        # The element of an `Array[T]` / `Set[T]` argument, or nil for any other carrier.
+        def nominal_element(arg)
+          return nil unless arg.is_a?(Type::Nominal) && %w[Array Set].include?(arg.class_name)
+          return nil unless arg.type_args.size == 1
+
+          arg.type_args.first
+        end
+
+        # `Nominal[Set, [E]]`, `E` the members widened as an `Array.new` fill is (value pins dropped, a literal
+        # container widened to its nominal) joined with a `Dynamic[top]` floor. The floor is the conservative half:
+        # nothing widens a Set's element when the program mutates it (`add`, `<<`, `merge`, `replace`, `clear`
+        # then `<<`, a callee that fills it), so the classes the set was built with are not a claim about what it
+        # holds later, and a read of the element must not report on them (#2278).
+        def typed_set(types)
+          return nil if types.empty?
+
+          members = types.map { |t| MethodDispatcher.array_new_element(t) }
+          Type::Combinator.nominal_of("Set", type_args: [Type::Combinator.union(*members, Type::Combinator.untyped)])
+        end
+
+        def block_given?(call_node)
+          call_node.respond_to?(:block) && !call_node.block.nil?
+        end
+
+        def splatted?(call_node)
+          return false unless call_node.respond_to?(:arguments)
+
+          (call_node.arguments&.arguments || []).any?(Prism::SplatNode)
+        end
       end
     end
   end